kitos
e951567ba1
Aegis CI / lint-and-test (push) Has been cancelled
Snyk Security Scan / Python vulnerabilities (backend) (push) Has been cancelled
Snyk Security Scan / npm vulnerabilities (frontend) (push) Has been cancelled
Snyk Security Scan / Docker image vulnerabilities (backend) (push) Has been cancelled
- /scores/history was annotated -> dict but the service actually returns a list, so FastAPI's response validation raised an unhandled exception, surfacing as a raw 500 on every call. Fixed the annotation. - The professional_reports.py endpoints (PDF/DOCX/HTML generation) back a Reports feature the frontend already hides entirely (unfinished). Hitting them directly fell through to whatever the render pipeline raised (e.g. missing weasyprint system deps) as an unhelpful 500. Added a REPORTS_ENABLED setting (off by default) so they now return a clean 503 instead, without removing the routes or their test coverage.
226 lines
7.5 KiB
Python
226 lines
7.5 KiB
Python
"""Professional report generation endpoints — PDF, DOCX, HTML output."""
|
|
|
|
# Import UUID from uuid
|
|
from uuid import UUID
|
|
from pathlib import Path
|
|
|
|
# Import APIRouter, Depends, HTTPException, Query, Request from fastapi
|
|
from fastapi import APIRouter, Depends, HTTPException, Query, Request
|
|
|
|
# Import FileResponse from fastapi.responses
|
|
from fastapi.responses import FileResponse
|
|
|
|
# Import Session from sqlalchemy.orm
|
|
from sqlalchemy.orm import Session
|
|
|
|
# Import get_db from app.database
|
|
from app.database import get_db
|
|
|
|
# Import get_current_user, require_any_role from app.dependencies.auth
|
|
from app.dependencies.auth import get_current_user, require_any_role
|
|
|
|
# Import limiter from app.limiter
|
|
from app.limiter import limiter
|
|
|
|
# Import settings from app.config
|
|
from app.config import settings
|
|
|
|
# Import User from app.models.user
|
|
from app.models.user import User
|
|
|
|
# Import report_generation_service from app.services
|
|
from app.services import report_generation_service
|
|
|
|
|
|
def _assert_safe_report_path(filepath: str) -> str:
|
|
"""Raise 500 if the generated filepath escapes the configured report directory."""
|
|
output_dir = Path(settings.REPORT_OUTPUT_DIR).resolve()
|
|
resolved = Path(filepath).resolve()
|
|
if not resolved.is_relative_to(output_dir):
|
|
raise HTTPException(status_code=500, detail="Report generation path error")
|
|
return filepath
|
|
|
|
|
|
def _assert_reports_enabled() -> None:
|
|
"""Raise a clean 503 while report generation is unfinished/disabled.
|
|
|
|
The frontend hides the Reports UI entirely; without this guard, hitting
|
|
these endpoints directly falls through to whatever the underlying
|
|
render pipeline raises (e.g. missing weasyprint system deps) as a raw,
|
|
unhelpful 500.
|
|
"""
|
|
if not settings.REPORTS_ENABLED:
|
|
raise HTTPException(status_code=503, detail="Report generation is not yet available on this platform")
|
|
|
|
# Assign router = APIRouter(prefix="/reports/generate", tags=["professional-reports"])
|
|
router = APIRouter(prefix="/reports/generate", tags=["professional-reports"])
|
|
|
|
# Assign _MEDIA_TYPES = {
|
|
_MEDIA_TYPES = {
|
|
# Literal argument value
|
|
"pdf": "application/pdf",
|
|
# Literal argument value
|
|
"docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
|
|
# Literal argument value
|
|
"html": "text/html",
|
|
}
|
|
|
|
|
|
# Apply the @router.get decorator
|
|
@router.get("/purple-campaign/{campaign_id}")
|
|
# Apply the @limiter.limit decorator
|
|
@limiter.limit("5/minute")
|
|
# Define function generate_purple_report
|
|
def generate_purple_report(
|
|
# Entry: request
|
|
request: Request,
|
|
# Entry: campaign_id
|
|
campaign_id: UUID,
|
|
# Entry: format
|
|
format: str = Query("pdf", pattern="^(pdf|docx|html)$"),
|
|
# Entry: db
|
|
db: Session = Depends(get_db),
|
|
# Entry: user
|
|
user: User = Depends(require_any_role("red_lead", "blue_lead", "viewer")),
|
|
) -> FileResponse:
|
|
"""Generate a Purple Team campaign assessment report."""
|
|
_assert_reports_enabled()
|
|
# Assign filepath = report_generation_service.generate_purple_campaign_report(
|
|
filepath = report_generation_service.generate_purple_campaign_report(
|
|
db, str(campaign_id), output_format=format,
|
|
)
|
|
# Return FileResponse(
|
|
return FileResponse(
|
|
_assert_safe_report_path(filepath),
|
|
# Keyword argument: media_type
|
|
media_type=_MEDIA_TYPES[format],
|
|
# Keyword argument: filename
|
|
filename=f"purple_report.{format}",
|
|
)
|
|
|
|
|
|
# Apply the @router.get decorator
|
|
@router.get("/coverage-summary")
|
|
# Apply the @limiter.limit decorator
|
|
@limiter.limit("5/minute")
|
|
# Define function generate_coverage_report
|
|
def generate_coverage_report(
|
|
# Entry: request
|
|
request: Request,
|
|
# Entry: format
|
|
format: str = Query("pdf", pattern="^(pdf|docx|html)$"),
|
|
# Entry: db
|
|
db: Session = Depends(get_db),
|
|
# Entry: user
|
|
user: User = Depends(require_any_role("red_lead", "blue_lead", "viewer")),
|
|
) -> FileResponse:
|
|
"""Generate an organization-wide MITRE ATT&CK coverage report."""
|
|
_assert_reports_enabled()
|
|
# Assign filepath = report_generation_service.generate_coverage_report(
|
|
filepath = report_generation_service.generate_coverage_report(
|
|
db, output_format=format,
|
|
)
|
|
# Return FileResponse(
|
|
return FileResponse(
|
|
_assert_safe_report_path(filepath),
|
|
# Keyword argument: media_type
|
|
media_type=_MEDIA_TYPES[format],
|
|
# Keyword argument: filename
|
|
filename=f"coverage_report.{format}",
|
|
)
|
|
|
|
|
|
# Apply the @router.get decorator
|
|
@router.get("/executive-summary")
|
|
# Apply the @limiter.limit decorator
|
|
@limiter.limit("5/minute")
|
|
# Define function generate_executive_report
|
|
def generate_executive_report(
|
|
# Entry: request
|
|
request: Request,
|
|
# Entry: format
|
|
format: str = Query("pdf", pattern="^(pdf|docx|html)$"),
|
|
# Entry: db
|
|
db: Session = Depends(get_db),
|
|
# Entry: user
|
|
user: User = Depends(require_any_role("red_lead", "blue_lead", "viewer")),
|
|
) -> FileResponse:
|
|
"""Generate an executive security summary report."""
|
|
_assert_reports_enabled()
|
|
# Assign filepath = report_generation_service.generate_executive_summary(
|
|
filepath = report_generation_service.generate_executive_summary(
|
|
db, output_format=format,
|
|
)
|
|
# Return FileResponse(
|
|
return FileResponse(
|
|
_assert_safe_report_path(filepath),
|
|
# Keyword argument: media_type
|
|
media_type=_MEDIA_TYPES[format],
|
|
# Keyword argument: filename
|
|
filename=f"executive_summary.{format}",
|
|
)
|
|
|
|
|
|
# Apply the @router.get decorator
|
|
@router.get("/quarterly-summary")
|
|
# Apply the @limiter.limit decorator
|
|
@limiter.limit("5/minute")
|
|
# Define function generate_quarterly_report
|
|
def generate_quarterly_report(
|
|
# Entry: request
|
|
request: Request,
|
|
# Entry: format
|
|
format: str = Query("pdf", pattern="^(pdf|docx|html)$"),
|
|
# Entry: db
|
|
db: Session = Depends(get_db),
|
|
# Entry: user
|
|
user: User = Depends(require_any_role("red_lead", "blue_lead", "viewer")),
|
|
) -> FileResponse:
|
|
"""Generate a quarterly security summary report."""
|
|
_assert_reports_enabled()
|
|
# Assign filepath = report_generation_service.generate_quarterly_summary(
|
|
filepath = report_generation_service.generate_quarterly_summary(
|
|
db, output_format=format,
|
|
)
|
|
# Return FileResponse(
|
|
return FileResponse(
|
|
_assert_safe_report_path(filepath),
|
|
# Keyword argument: media_type
|
|
media_type=_MEDIA_TYPES[format],
|
|
# Keyword argument: filename
|
|
filename=f"quarterly_summary.{format}",
|
|
)
|
|
|
|
|
|
# Apply the @router.get decorator
|
|
@router.get("/technique/{technique_id}")
|
|
# Apply the @limiter.limit decorator
|
|
@limiter.limit("5/minute")
|
|
# Define function generate_technique_report
|
|
def generate_technique_report(
|
|
# Entry: request
|
|
request: Request,
|
|
# Entry: technique_id
|
|
technique_id: UUID,
|
|
# Entry: format
|
|
format: str = Query("pdf", pattern="^(pdf|docx|html)$"),
|
|
# Entry: db
|
|
db: Session = Depends(get_db),
|
|
# Entry: user
|
|
user: User = Depends(get_current_user),
|
|
) -> FileResponse:
|
|
"""Generate a detailed report for one MITRE technique."""
|
|
_assert_reports_enabled()
|
|
# Assign filepath = report_generation_service.generate_technique_detail_report(
|
|
filepath = report_generation_service.generate_technique_detail_report(
|
|
db, str(technique_id), output_format=format,
|
|
)
|
|
# Return FileResponse(
|
|
return FileResponse(
|
|
_assert_safe_report_path(filepath),
|
|
# Keyword argument: media_type
|
|
media_type=_MEDIA_TYPES[format],
|
|
# Keyword argument: filename
|
|
filename=f"technique_{technique_id}.{format}",
|
|
)
|