Gaps fill up, fixes, ui restructuring
This commit is contained in:
master
@@ -0,0 +1,859 @@
|
||||
using Microsoft.AspNetCore.Builder;
|
||||
using Microsoft.AspNetCore.Http;
|
||||
using Microsoft.AspNetCore.Routing;
|
||||
using StellaOps.Platform.WebService.Constants;
|
||||
using StellaOps.Platform.WebService.Contracts;
|
||||
using StellaOps.Platform.WebService.Services;
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.Linq;
|
||||
|
||||
namespace StellaOps.Platform.WebService.Endpoints;
|
||||
|
||||
/// <summary>
|
||||
/// Pack-driven adapter endpoints for Dashboard, Platform Ops, and Administration views.
|
||||
/// </summary>
|
||||
public static class PackAdapterEndpoints
|
||||
{
|
||||
private static readonly DateTimeOffset SnapshotAt = DateTimeOffset.Parse("2026-02-19T03:15:00Z");
|
||||
|
||||
public static IEndpointRouteBuilder MapPackAdapterEndpoints(this IEndpointRouteBuilder app)
|
||||
{
|
||||
app.MapGet("/api/v1/dashboard/summary", (
|
||||
HttpContext context,
|
||||
PlatformRequestContextResolver resolver) =>
|
||||
{
|
||||
if (!TryResolveContext(context, resolver, out var requestContext, out var failure))
|
||||
{
|
||||
return failure!;
|
||||
}
|
||||
|
||||
var payload = BuildDashboardSummary();
|
||||
return Results.Ok(new PlatformItemResponse<DashboardSummaryDto>(
|
||||
requestContext!.TenantId,
|
||||
requestContext.ActorId,
|
||||
SnapshotAt,
|
||||
Cached: false,
|
||||
CacheTtlSeconds: 0,
|
||||
payload));
|
||||
})
|
||||
.WithTags("Dashboard")
|
||||
.WithName("GetDashboardSummary")
|
||||
.WithSummary("Pack v2 dashboard summary projection.")
|
||||
.RequireAuthorization(PlatformPolicies.HealthRead);
|
||||
|
||||
var platform = app.MapGroup("/api/v1/platform")
|
||||
.WithTags("Platform Ops");
|
||||
|
||||
platform.MapGet("/data-integrity/summary", (
|
||||
HttpContext context,
|
||||
PlatformRequestContextResolver resolver) =>
|
||||
{
|
||||
if (!TryResolveContext(context, resolver, out var requestContext, out var failure))
|
||||
{
|
||||
return failure!;
|
||||
}
|
||||
|
||||
var payload = BuildDataIntegritySummary();
|
||||
return Results.Ok(new PlatformItemResponse<DataIntegritySummaryDto>(
|
||||
requestContext!.TenantId,
|
||||
requestContext.ActorId,
|
||||
SnapshotAt,
|
||||
Cached: false,
|
||||
CacheTtlSeconds: 0,
|
||||
payload));
|
||||
})
|
||||
.WithName("GetDataIntegritySummary")
|
||||
.WithSummary("Pack v2 data-integrity card summary.")
|
||||
.RequireAuthorization(PlatformPolicies.HealthRead);
|
||||
|
||||
platform.MapGet("/data-integrity/report", (
|
||||
HttpContext context,
|
||||
PlatformRequestContextResolver resolver) =>
|
||||
{
|
||||
if (!TryResolveContext(context, resolver, out var requestContext, out var failure))
|
||||
{
|
||||
return failure!;
|
||||
}
|
||||
|
||||
var payload = BuildDataIntegrityReport();
|
||||
return Results.Ok(new PlatformItemResponse<DataIntegrityReportDto>(
|
||||
requestContext!.TenantId,
|
||||
requestContext.ActorId,
|
||||
SnapshotAt,
|
||||
Cached: false,
|
||||
CacheTtlSeconds: 0,
|
||||
payload));
|
||||
})
|
||||
.WithName("GetDataIntegrityReport")
|
||||
.WithSummary("Pack v2 nightly data-integrity report projection.")
|
||||
.RequireAuthorization(PlatformPolicies.HealthRead);
|
||||
|
||||
platform.MapGet("/feeds/freshness", (
|
||||
HttpContext context,
|
||||
PlatformRequestContextResolver resolver) =>
|
||||
{
|
||||
if (!TryResolveContext(context, resolver, out var requestContext, out var failure))
|
||||
{
|
||||
return failure!;
|
||||
}
|
||||
|
||||
var feeds = BuildFeedFreshness();
|
||||
return Results.Ok(new PlatformListResponse<FeedFreshnessDto>(
|
||||
requestContext!.TenantId,
|
||||
requestContext.ActorId,
|
||||
SnapshotAt,
|
||||
Cached: false,
|
||||
CacheTtlSeconds: 0,
|
||||
feeds,
|
||||
feeds.Count));
|
||||
})
|
||||
.WithName("GetFeedsFreshness")
|
||||
.WithSummary("Pack v2 advisory/feed freshness projection.")
|
||||
.RequireAuthorization(PlatformPolicies.HealthRead);
|
||||
|
||||
platform.MapGet("/scan-pipeline/health", (
|
||||
HttpContext context,
|
||||
PlatformRequestContextResolver resolver) =>
|
||||
{
|
||||
if (!TryResolveContext(context, resolver, out var requestContext, out var failure))
|
||||
{
|
||||
return failure!;
|
||||
}
|
||||
|
||||
var payload = BuildScanPipelineHealth();
|
||||
return Results.Ok(new PlatformItemResponse<ScanPipelineHealthDto>(
|
||||
requestContext!.TenantId,
|
||||
requestContext.ActorId,
|
||||
SnapshotAt,
|
||||
Cached: false,
|
||||
CacheTtlSeconds: 0,
|
||||
payload));
|
||||
})
|
||||
.WithName("GetScanPipelineHealth")
|
||||
.WithSummary("Pack v2 scan-pipeline health projection.")
|
||||
.RequireAuthorization(PlatformPolicies.HealthRead);
|
||||
|
||||
platform.MapGet("/reachability/ingest-health", (
|
||||
HttpContext context,
|
||||
PlatformRequestContextResolver resolver) =>
|
||||
{
|
||||
if (!TryResolveContext(context, resolver, out var requestContext, out var failure))
|
||||
{
|
||||
return failure!;
|
||||
}
|
||||
|
||||
var payload = BuildReachabilityIngestHealth();
|
||||
return Results.Ok(new PlatformItemResponse<ReachabilityIngestHealthDto>(
|
||||
requestContext!.TenantId,
|
||||
requestContext.ActorId,
|
||||
SnapshotAt,
|
||||
Cached: false,
|
||||
CacheTtlSeconds: 0,
|
||||
payload));
|
||||
})
|
||||
.WithName("GetReachabilityIngestHealth")
|
||||
.WithSummary("Pack v2 reachability ingest health projection.")
|
||||
.RequireAuthorization(PlatformPolicies.HealthRead);
|
||||
|
||||
var administration = app.MapGroup("/api/v1/administration")
|
||||
.WithTags("Administration");
|
||||
|
||||
administration.MapGet("/summary", (
|
||||
HttpContext context,
|
||||
PlatformRequestContextResolver resolver) =>
|
||||
{
|
||||
return BuildAdministrationItem(context, resolver, BuildAdministrationSummary);
|
||||
})
|
||||
.WithName("GetAdministrationSummary")
|
||||
.WithSummary("Pack v2 administration overview cards.")
|
||||
.RequireAuthorization(PlatformPolicies.SetupRead);
|
||||
|
||||
administration.MapGet("/identity-access", (
|
||||
HttpContext context,
|
||||
PlatformRequestContextResolver resolver) =>
|
||||
{
|
||||
return BuildAdministrationItem(context, resolver, BuildAdministrationIdentityAccess);
|
||||
})
|
||||
.WithName("GetAdministrationIdentityAccess")
|
||||
.WithSummary("Pack v2 administration A1 identity and access projection.")
|
||||
.RequireAuthorization(PlatformPolicies.SetupRead);
|
||||
|
||||
administration.MapGet("/tenant-branding", (
|
||||
HttpContext context,
|
||||
PlatformRequestContextResolver resolver) =>
|
||||
{
|
||||
return BuildAdministrationItem(context, resolver, BuildAdministrationTenantBranding);
|
||||
})
|
||||
.WithName("GetAdministrationTenantBranding")
|
||||
.WithSummary("Pack v2 administration A2 tenant and branding projection.")
|
||||
.RequireAuthorization(PlatformPolicies.SetupRead);
|
||||
|
||||
administration.MapGet("/notifications", (
|
||||
HttpContext context,
|
||||
PlatformRequestContextResolver resolver) =>
|
||||
{
|
||||
return BuildAdministrationItem(context, resolver, BuildAdministrationNotifications);
|
||||
})
|
||||
.WithName("GetAdministrationNotifications")
|
||||
.WithSummary("Pack v2 administration A3 notifications projection.")
|
||||
.RequireAuthorization(PlatformPolicies.SetupRead);
|
||||
|
||||
administration.MapGet("/usage-limits", (
|
||||
HttpContext context,
|
||||
PlatformRequestContextResolver resolver) =>
|
||||
{
|
||||
return BuildAdministrationItem(context, resolver, BuildAdministrationUsageLimits);
|
||||
})
|
||||
.WithName("GetAdministrationUsageLimits")
|
||||
.WithSummary("Pack v2 administration A4 usage and limits projection.")
|
||||
.RequireAuthorization(PlatformPolicies.SetupRead);
|
||||
|
||||
administration.MapGet("/policy-governance", (
|
||||
HttpContext context,
|
||||
PlatformRequestContextResolver resolver) =>
|
||||
{
|
||||
return BuildAdministrationItem(context, resolver, BuildAdministrationPolicyGovernance);
|
||||
})
|
||||
.WithName("GetAdministrationPolicyGovernance")
|
||||
.WithSummary("Pack v2 administration A5 policy governance projection.")
|
||||
.RequireAuthorization(PlatformPolicies.SetupRead);
|
||||
|
||||
administration.MapGet("/trust-signing", (
|
||||
HttpContext context,
|
||||
PlatformRequestContextResolver resolver) =>
|
||||
{
|
||||
return BuildAdministrationItem(context, resolver, BuildAdministrationTrustSigning);
|
||||
})
|
||||
.WithName("GetAdministrationTrustSigning")
|
||||
.WithSummary("Pack v2 administration A6 trust and signing projection.")
|
||||
.RequireAuthorization(PlatformPolicies.TrustRead);
|
||||
|
||||
administration.MapGet("/system", (
|
||||
HttpContext context,
|
||||
PlatformRequestContextResolver resolver) =>
|
||||
{
|
||||
return BuildAdministrationItem(context, resolver, BuildAdministrationSystem);
|
||||
})
|
||||
.WithName("GetAdministrationSystem")
|
||||
.WithSummary("Pack v2 administration A7 system projection.")
|
||||
.RequireAuthorization(PlatformPolicies.SetupRead);
|
||||
|
||||
return app;
|
||||
}
|
||||
|
||||
private static DashboardSummaryDto BuildDashboardSummary()
|
||||
{
|
||||
var confidence = BuildConfidenceBadge();
|
||||
var environments = new[]
|
||||
{
|
||||
new EnvironmentRiskSnapshotDto("apac-prod", CriticalReachable: 0, HighReachable: 0, SbomState: "fresh"),
|
||||
new EnvironmentRiskSnapshotDto("eu-prod", CriticalReachable: 0, HighReachable: 1, SbomState: "fresh"),
|
||||
new EnvironmentRiskSnapshotDto("us-prod", CriticalReachable: 2, HighReachable: 1, SbomState: "stale"),
|
||||
new EnvironmentRiskSnapshotDto("us-uat", CriticalReachable: 1, HighReachable: 2, SbomState: "stale"),
|
||||
}.OrderBy(item => item.Environment, StringComparer.Ordinal).ToList();
|
||||
|
||||
var topDrivers = new[]
|
||||
{
|
||||
new DashboardDriverDto("CVE-2026-1234", "user-service", "critical", "reachable"),
|
||||
new DashboardDriverDto("CVE-2026-2222", "billing-worker", "critical", "reachable"),
|
||||
new DashboardDriverDto("CVE-2026-9001", "api-gateway", "high", "not_reachable"),
|
||||
};
|
||||
|
||||
return new DashboardSummaryDto(
|
||||
DataConfidence: confidence,
|
||||
EnvironmentsWithCriticalReachable: 2,
|
||||
TotalCriticalReachable: 3,
|
||||
SbomCoveragePercent: 98.0m,
|
||||
VexCoveragePercent: 62.0m,
|
||||
BlockedApprovals: 2,
|
||||
ExceptionsExpiringSoon: 4,
|
||||
EnvironmentRisk: environments,
|
||||
TopDrivers: topDrivers);
|
||||
}
|
||||
|
||||
private static DataIntegritySummaryDto BuildDataIntegritySummary()
|
||||
{
|
||||
var cards = new[]
|
||||
{
|
||||
new DataIntegritySignalDto("feeds", "Advisory feeds", "warning", "NVD mirror stale by 3h.", "/api/v1/platform/feeds/freshness"),
|
||||
new DataIntegritySignalDto("reachability", "Reachability ingest", "warning", "Runtime ingest lag exceeds policy threshold.", "/api/v1/platform/reachability/ingest-health"),
|
||||
new DataIntegritySignalDto("scan-pipeline", "Scan pipeline", "warning", "Pending SBOM rescans create stale risk windows.", "/api/v1/platform/scan-pipeline/health"),
|
||||
new DataIntegritySignalDto("sbom", "SBOM coverage", "warning", "12 digests missing a fresh scan snapshot.", "/api/v1/platform/data-integrity/report"),
|
||||
}.OrderBy(card => card.Id, StringComparer.Ordinal).ToList();
|
||||
|
||||
return new DataIntegritySummaryDto(
|
||||
Confidence: BuildConfidenceBadge(),
|
||||
Signals: cards);
|
||||
}
|
||||
|
||||
private static DataIntegrityReportDto BuildDataIntegrityReport()
|
||||
{
|
||||
var sections = new[]
|
||||
{
|
||||
new DataIntegrityReportSectionDto(
|
||||
"advisory-feeds",
|
||||
"warning",
|
||||
"NVD and vendor feed freshness lag detected.",
|
||||
["nvd stale by 3h", "vendor feed retry budget exceeded once"]),
|
||||
new DataIntegrityReportSectionDto(
|
||||
"scan-pipeline",
|
||||
"warning",
|
||||
"Scan backlog increased due to transient worker degradation.",
|
||||
["pending sbom rescans: 12", "oldest pending digest age: 26h"]),
|
||||
new DataIntegrityReportSectionDto(
|
||||
"reachability",
|
||||
"warning",
|
||||
"Runtime attestations delayed in one region.",
|
||||
["us-east runtime agents degraded", "eu-west ingest healthy"]),
|
||||
}.OrderBy(section => section.SectionId, StringComparer.Ordinal).ToList();
|
||||
|
||||
return new DataIntegrityReportDto(
|
||||
ReportId: "ops-nightly-2026-02-19",
|
||||
GeneratedAt: SnapshotAt,
|
||||
Window: "2026-02-18T03:15:00Z/2026-02-19T03:15:00Z",
|
||||
Sections: sections,
|
||||
RecommendedActions:
|
||||
[
|
||||
"Prioritize runtime ingest queue drain in us-east.",
|
||||
"Force-feed refresh for NVD source before next approval window.",
|
||||
"Trigger high-risk SBOM rescan profile for stale production digests.",
|
||||
]);
|
||||
}
|
||||
|
||||
private static IReadOnlyList<FeedFreshnessDto> BuildFeedFreshness()
|
||||
{
|
||||
return new[]
|
||||
{
|
||||
new FeedFreshnessDto("NVD", "warning", LastSyncedAt: "2026-02-19T00:12:00Z", FreshnessHours: 3, SlaHours: 1),
|
||||
new FeedFreshnessDto("OSV", "healthy", LastSyncedAt: "2026-02-19T03:02:00Z", FreshnessHours: 0, SlaHours: 1),
|
||||
new FeedFreshnessDto("Vendor advisories", "healthy", LastSyncedAt: "2026-02-19T02:48:00Z", FreshnessHours: 0, SlaHours: 2),
|
||||
}.OrderBy(feed => feed.Source, StringComparer.Ordinal).ToList();
|
||||
}
|
||||
|
||||
private static ScanPipelineHealthDto BuildScanPipelineHealth()
|
||||
{
|
||||
var stages = new[]
|
||||
{
|
||||
new PipelineStageHealthDto("ingest", "healthy", QueueDepth: 12, OldestAgeMinutes: 8),
|
||||
new PipelineStageHealthDto("normalize", "healthy", QueueDepth: 3, OldestAgeMinutes: 4),
|
||||
new PipelineStageHealthDto("rescan", "warning", QueueDepth: 12, OldestAgeMinutes: 1570),
|
||||
}.OrderBy(stage => stage.Stage, StringComparer.Ordinal).ToList();
|
||||
|
||||
return new ScanPipelineHealthDto(
|
||||
Status: "warning",
|
||||
PendingDigests: 12,
|
||||
FailedJobs24h: 3,
|
||||
Stages: stages);
|
||||
}
|
||||
|
||||
private static ReachabilityIngestHealthDto BuildReachabilityIngestHealth()
|
||||
{
|
||||
var regions = new[]
|
||||
{
|
||||
new RegionIngestHealthDto("apac", "healthy", Backlog: 7, FreshnessMinutes: 6),
|
||||
new RegionIngestHealthDto("eu-west", "healthy", Backlog: 11, FreshnessMinutes: 7),
|
||||
new RegionIngestHealthDto("us-east", "warning", Backlog: 1230, FreshnessMinutes: 42),
|
||||
}.OrderBy(region => region.Region, StringComparer.Ordinal).ToList();
|
||||
|
||||
return new ReachabilityIngestHealthDto(
|
||||
Status: "warning",
|
||||
RuntimeCoveragePercent: 41,
|
||||
Regions: regions);
|
||||
}
|
||||
|
||||
private static AdministrationSummaryDto BuildAdministrationSummary()
|
||||
{
|
||||
var domains = new[]
|
||||
{
|
||||
new AdministrationDomainCardDto("identity", "Identity & Access", "healthy", "Role assignments and API tokens are within policy.", "/administration/identity-access"),
|
||||
new AdministrationDomainCardDto("notifications", "Notifications", "healthy", "All configured notification providers are operational.", "/administration/notifications"),
|
||||
new AdministrationDomainCardDto("policy", "Policy Governance", "warning", "One policy bundle update is pending review.", "/administration/policy-governance"),
|
||||
new AdministrationDomainCardDto("system", "System", "healthy", "Control plane services report healthy heartbeat.", "/administration/system"),
|
||||
new AdministrationDomainCardDto("tenant", "Tenant & Branding", "healthy", "Tenant branding and domain mappings are current.", "/administration/tenant-branding"),
|
||||
new AdministrationDomainCardDto("trust", "Trust & Signing", "warning", "One certificate expires within 10 days.", "/administration/trust-signing"),
|
||||
new AdministrationDomainCardDto("usage", "Usage & Limits", "warning", "Scanner quota at 65% with upward trend.", "/administration/usage"),
|
||||
}.OrderBy(domain => domain.DomainId, StringComparer.Ordinal).ToList();
|
||||
|
||||
return new AdministrationSummaryDto(
|
||||
Domains: domains,
|
||||
ActiveIncidents:
|
||||
[
|
||||
"trust/certificate-expiry-warning",
|
||||
"usage/scanner-quota-warning",
|
||||
]);
|
||||
}
|
||||
|
||||
private static AdministrationIdentityAccessDto BuildAdministrationIdentityAccess()
|
||||
{
|
||||
var tabs = new[]
|
||||
{
|
||||
new AdministrationFacetTabDto("api-tokens", "API Tokens", Count: 12, Status: "warning", ActionPath: "/administration/identity-access/tokens"),
|
||||
new AdministrationFacetTabDto("oauth-clients", "OAuth/SSO Clients", Count: 6, Status: "healthy", ActionPath: "/administration/identity-access/clients"),
|
||||
new AdministrationFacetTabDto("roles", "Roles", Count: 18, Status: "healthy", ActionPath: "/administration/identity-access/roles"),
|
||||
new AdministrationFacetTabDto("tenants", "Tenants", Count: 4, Status: "healthy", ActionPath: "/administration/identity-access/tenants"),
|
||||
new AdministrationFacetTabDto("users", "Users", Count: 146, Status: "healthy", ActionPath: "/administration/identity-access/users"),
|
||||
}.OrderBy(tab => tab.TabId, StringComparer.Ordinal).ToList();
|
||||
|
||||
var actors = new[]
|
||||
{
|
||||
new IdentityAccessActorDto("alice@core.example", "release-approver", "active", "2026-02-19T01:22:00Z"),
|
||||
new IdentityAccessActorDto("jenkins-bot", "ci-bot", "active", "2026-02-19T02:17:00Z"),
|
||||
new IdentityAccessActorDto("security-admin@core.example", "security-admin", "active", "2026-02-19T02:59:00Z"),
|
||||
}.OrderBy(actor => actor.Actor, StringComparer.Ordinal).ToList();
|
||||
|
||||
var aliases = BuildAdministrationAliases(
|
||||
[
|
||||
new AdministrationRouteAliasDto("/settings/admin/clients", "/administration/identity-access/clients", "redirect"),
|
||||
new AdministrationRouteAliasDto("/settings/admin/roles", "/administration/identity-access/roles", "redirect"),
|
||||
new AdministrationRouteAliasDto("/settings/admin/tenants", "/administration/identity-access/tenants", "redirect"),
|
||||
new AdministrationRouteAliasDto("/settings/admin/tokens", "/administration/identity-access/tokens", "redirect"),
|
||||
new AdministrationRouteAliasDto("/settings/admin/users", "/administration/identity-access/users", "redirect"),
|
||||
]);
|
||||
|
||||
return new AdministrationIdentityAccessDto(
|
||||
Tabs: tabs,
|
||||
RecentActors: actors,
|
||||
LegacyAliases: aliases,
|
||||
AuditLogPath: "/evidence-audit/audit");
|
||||
}
|
||||
|
||||
private static AdministrationTenantBrandingDto BuildAdministrationTenantBranding()
|
||||
{
|
||||
var tenants = new[]
|
||||
{
|
||||
new AdministrationTenantDto("apac-core", "Core APAC", "apac.core.example", "core-pack-v7", "active"),
|
||||
new AdministrationTenantDto("eu-core", "Core EU", "eu.core.example", "core-pack-v7", "active"),
|
||||
new AdministrationTenantDto("us-core", "Core US", "us.core.example", "core-pack-v7", "active"),
|
||||
}.OrderBy(tenant => tenant.TenantId, StringComparer.Ordinal).ToList();
|
||||
|
||||
var aliases = BuildAdministrationAliases(
|
||||
[
|
||||
new AdministrationRouteAliasDto("/settings/admin/branding", "/administration/tenant-branding", "redirect"),
|
||||
]);
|
||||
|
||||
return new AdministrationTenantBrandingDto(
|
||||
Tenants: tenants,
|
||||
BrandingDefaults: new TenantBrandingDefaultsDto(
|
||||
Theme: "light",
|
||||
SupportUrl: "https://support.core.example",
|
||||
LegalFooterVersion: "2026.02"),
|
||||
LegacyAliases: aliases);
|
||||
}
|
||||
|
||||
private static AdministrationNotificationsDto BuildAdministrationNotifications()
|
||||
{
|
||||
var rules = new[]
|
||||
{
|
||||
new AdministrationNotificationRuleDto("critical-reachable", "Critical reachable finding", "high", "active"),
|
||||
new AdministrationNotificationRuleDto("gate-blocked", "Gate blocked release", "high", "active"),
|
||||
new AdministrationNotificationRuleDto("quota-warning", "Quota warning", "medium", "active"),
|
||||
}.OrderBy(rule => rule.RuleId, StringComparer.Ordinal).ToList();
|
||||
|
||||
var channels = new[]
|
||||
{
|
||||
new AdministrationNotificationChannelDto("email", "healthy", "2026-02-19T02:40:00Z"),
|
||||
new AdministrationNotificationChannelDto("slack", "healthy", "2026-02-19T02:41:00Z"),
|
||||
new AdministrationNotificationChannelDto("webhook", "warning", "2026-02-19T01:58:00Z"),
|
||||
}.OrderBy(channel => channel.ChannelId, StringComparer.Ordinal).ToList();
|
||||
|
||||
var aliases = BuildAdministrationAliases(
|
||||
[
|
||||
new AdministrationRouteAliasDto("/admin/notifications", "/administration/notifications", "redirect"),
|
||||
new AdministrationRouteAliasDto("/operations/notifications", "/administration/notifications", "redirect"),
|
||||
new AdministrationRouteAliasDto("/settings/notifications/*", "/administration/notifications/*", "redirect"),
|
||||
]);
|
||||
|
||||
return new AdministrationNotificationsDto(
|
||||
Rules: rules,
|
||||
Channels: channels,
|
||||
ChannelManagementPath: "/integrations/notifications",
|
||||
LegacyAliases: aliases);
|
||||
}
|
||||
|
||||
private static AdministrationUsageLimitsDto BuildAdministrationUsageLimits()
|
||||
{
|
||||
var meters = new[]
|
||||
{
|
||||
new AdministrationUsageMeterDto("api-calls", "API calls", Used: 15000, Limit: 100000, Unit: "calls"),
|
||||
new AdministrationUsageMeterDto("evidence-packets", "Evidence packets", Used: 2800, Limit: 10000, Unit: "packets"),
|
||||
new AdministrationUsageMeterDto("scanner-runs", "Scanner runs", Used: 6500, Limit: 10000, Unit: "runs"),
|
||||
new AdministrationUsageMeterDto("storage", "Storage", Used: 42, Limit: 100, Unit: "GB"),
|
||||
}.OrderBy(meter => meter.MeterId, StringComparer.Ordinal).ToList();
|
||||
|
||||
var policies = new[]
|
||||
{
|
||||
new AdministrationUsagePolicyDto("api-burst", "API burst throttle", "enabled"),
|
||||
new AdministrationUsagePolicyDto("integration-cap", "Per-integration cap", "enabled"),
|
||||
new AdministrationUsagePolicyDto("scanner-quota", "Scanner daily quota", "warning"),
|
||||
}.OrderBy(policy => policy.PolicyId, StringComparer.Ordinal).ToList();
|
||||
|
||||
var aliases = BuildAdministrationAliases(
|
||||
[
|
||||
new AdministrationRouteAliasDto("/settings/admin/:page", "/administration/:page", "redirect"),
|
||||
]);
|
||||
|
||||
return new AdministrationUsageLimitsDto(
|
||||
Meters: meters,
|
||||
Policies: policies,
|
||||
OperationsDrilldownPath: "/platform-ops/quotas",
|
||||
LegacyAliases: aliases);
|
||||
}
|
||||
|
||||
private static AdministrationPolicyGovernanceDto BuildAdministrationPolicyGovernance()
|
||||
{
|
||||
var baselines = new[]
|
||||
{
|
||||
new AdministrationPolicyBaselineDto("dev", "core-pack-v7", "active"),
|
||||
new AdministrationPolicyBaselineDto("prod", "core-pack-v7", "active"),
|
||||
new AdministrationPolicyBaselineDto("stage", "core-pack-v7", "active"),
|
||||
}.OrderBy(baseline => baseline.Environment, StringComparer.Ordinal).ToList();
|
||||
|
||||
var signals = new[]
|
||||
{
|
||||
new AdministrationPolicySignalDto("exception-workflow", "warning", "2 pending exception approvals"),
|
||||
new AdministrationPolicySignalDto("governance-rules", "healthy", "Reachable-critical gate enforced"),
|
||||
new AdministrationPolicySignalDto("simulation", "healthy", "Last what-if simulation completed successfully"),
|
||||
}.OrderBy(signal => signal.SignalId, StringComparer.Ordinal).ToList();
|
||||
|
||||
var aliases = BuildAdministrationAliases(
|
||||
[
|
||||
new AdministrationRouteAliasDto("/admin/policy/governance", "/administration/policy-governance", "redirect"),
|
||||
new AdministrationRouteAliasDto("/admin/policy/simulation", "/administration/policy-governance/simulation", "redirect"),
|
||||
new AdministrationRouteAliasDto("/policy/exceptions/*", "/administration/policy-governance/exceptions/*", "redirect"),
|
||||
new AdministrationRouteAliasDto("/policy/governance", "/administration/policy-governance", "redirect"),
|
||||
new AdministrationRouteAliasDto("/policy/packs/*", "/administration/policy-governance/packs/*", "redirect"),
|
||||
]);
|
||||
|
||||
return new AdministrationPolicyGovernanceDto(
|
||||
Baselines: baselines,
|
||||
Signals: signals,
|
||||
LegacyAliases: aliases,
|
||||
CrossLinks:
|
||||
[
|
||||
"/release-control/approvals",
|
||||
"/administration/policy/exceptions",
|
||||
]);
|
||||
}
|
||||
|
||||
private static AdministrationTrustSigningDto BuildAdministrationTrustSigning()
|
||||
{
|
||||
var signals = new[]
|
||||
{
|
||||
new AdministrationTrustSignalDto("audit-log", "healthy", "Audit log ingestion is current."),
|
||||
new AdministrationTrustSignalDto("certificate-expiry", "warning", "1 certificate expires within 10 days."),
|
||||
new AdministrationTrustSignalDto("transparency-log", "healthy", "Rekor witness is reachable."),
|
||||
new AdministrationTrustSignalDto("trust-scoring", "healthy", "Issuer trust score recalculation completed."),
|
||||
}.OrderBy(signal => signal.SignalId, StringComparer.Ordinal).ToList();
|
||||
|
||||
var aliases = BuildAdministrationAliases(
|
||||
[
|
||||
new AdministrationRouteAliasDto("/admin/issuers", "/administration/trust-signing/issuers", "redirect"),
|
||||
new AdministrationRouteAliasDto("/admin/trust/*", "/administration/trust-signing/*", "redirect"),
|
||||
new AdministrationRouteAliasDto("/settings/trust/*", "/administration/trust-signing/*", "redirect"),
|
||||
]);
|
||||
|
||||
return new AdministrationTrustSigningDto(
|
||||
Inventory: new AdministrationTrustInventoryDto(Keys: 14, Issuers: 7, Certificates: 23),
|
||||
Signals: signals,
|
||||
LegacyAliases: aliases,
|
||||
EvidenceConsumerPath: "/evidence-audit/proofs");
|
||||
}
|
||||
|
||||
private static AdministrationSystemDto BuildAdministrationSystem()
|
||||
{
|
||||
var controls = new[]
|
||||
{
|
||||
new AdministrationSystemControlDto("background-jobs", "warning", "1 paused job family awaiting manual resume."),
|
||||
new AdministrationSystemControlDto("doctor", "healthy", "Last diagnostics run passed."),
|
||||
new AdministrationSystemControlDto("health-check", "healthy", "All core control-plane services are healthy."),
|
||||
new AdministrationSystemControlDto("slo-config", "healthy", "SLO thresholds are synchronized."),
|
||||
}.OrderBy(control => control.ControlId, StringComparer.Ordinal).ToList();
|
||||
|
||||
var aliases = BuildAdministrationAliases(
|
||||
[
|
||||
new AdministrationRouteAliasDto("/operations/status", "/administration/system/status", "redirect"),
|
||||
new AdministrationRouteAliasDto("/settings/configuration-pane", "/administration/system/configuration", "redirect"),
|
||||
new AdministrationRouteAliasDto("/settings/workflows/*", "/administration/system/workflows", "redirect"),
|
||||
]);
|
||||
|
||||
return new AdministrationSystemDto(
|
||||
OverallStatus: "healthy",
|
||||
Controls: controls,
|
||||
LegacyAliases: aliases,
|
||||
Drilldowns:
|
||||
[
|
||||
"/platform-ops/health",
|
||||
"/platform-ops/orchestrator/jobs",
|
||||
"/platform-ops/data-integrity",
|
||||
]);
|
||||
}
|
||||
|
||||
private static IReadOnlyList<AdministrationRouteAliasDto> BuildAdministrationAliases(
|
||||
AdministrationRouteAliasDto[] aliases)
|
||||
{
|
||||
return aliases
|
||||
.OrderBy(alias => alias.LegacyPath, StringComparer.Ordinal)
|
||||
.ToList();
|
||||
}
|
||||
|
||||
private static DataConfidenceBadgeDto BuildConfidenceBadge()
|
||||
{
|
||||
return new DataConfidenceBadgeDto(
|
||||
Status: "warning",
|
||||
Summary: "NVD freshness and runtime ingest lag reduce confidence.",
|
||||
NvdStalenessHours: 3,
|
||||
StaleSbomDigests: 12,
|
||||
RuntimeDlqDepth: 1230);
|
||||
}
|
||||
|
||||
private static IResult BuildAdministrationItem<T>(
|
||||
HttpContext context,
|
||||
PlatformRequestContextResolver resolver,
|
||||
Func<T> payloadFactory)
|
||||
{
|
||||
if (!TryResolveContext(context, resolver, out var requestContext, out var failure))
|
||||
{
|
||||
return failure!;
|
||||
}
|
||||
|
||||
var payload = payloadFactory();
|
||||
return Results.Ok(new PlatformItemResponse<T>(
|
||||
requestContext!.TenantId,
|
||||
requestContext.ActorId,
|
||||
SnapshotAt,
|
||||
Cached: false,
|
||||
CacheTtlSeconds: 0,
|
||||
payload));
|
||||
}
|
||||
|
||||
private static bool TryResolveContext(
|
||||
HttpContext context,
|
||||
PlatformRequestContextResolver resolver,
|
||||
out PlatformRequestContext? requestContext,
|
||||
out IResult? failure)
|
||||
{
|
||||
if (resolver.TryResolve(context, out requestContext, out var error))
|
||||
{
|
||||
failure = null;
|
||||
return true;
|
||||
}
|
||||
|
||||
failure = Results.BadRequest(new { error = error ?? "tenant_missing" });
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
public sealed record DashboardSummaryDto(
|
||||
DataConfidenceBadgeDto DataConfidence,
|
||||
int EnvironmentsWithCriticalReachable,
|
||||
int TotalCriticalReachable,
|
||||
decimal SbomCoveragePercent,
|
||||
decimal VexCoveragePercent,
|
||||
int BlockedApprovals,
|
||||
int ExceptionsExpiringSoon,
|
||||
IReadOnlyList<EnvironmentRiskSnapshotDto> EnvironmentRisk,
|
||||
IReadOnlyList<DashboardDriverDto> TopDrivers);
|
||||
|
||||
public sealed record EnvironmentRiskSnapshotDto(
|
||||
string Environment,
|
||||
int CriticalReachable,
|
||||
int HighReachable,
|
||||
string SbomState);
|
||||
|
||||
public sealed record DashboardDriverDto(
|
||||
string Cve,
|
||||
string Component,
|
||||
string Severity,
|
||||
string Reachability);
|
||||
|
||||
public sealed record DataIntegritySummaryDto(
|
||||
DataConfidenceBadgeDto Confidence,
|
||||
IReadOnlyList<DataIntegritySignalDto> Signals);
|
||||
|
||||
public sealed record DataIntegritySignalDto(
|
||||
string Id,
|
||||
string Label,
|
||||
string Status,
|
||||
string Summary,
|
||||
string ActionPath);
|
||||
|
||||
public sealed record DataIntegrityReportDto(
|
||||
string ReportId,
|
||||
DateTimeOffset GeneratedAt,
|
||||
string Window,
|
||||
IReadOnlyList<DataIntegrityReportSectionDto> Sections,
|
||||
IReadOnlyList<string> RecommendedActions);
|
||||
|
||||
public sealed record DataIntegrityReportSectionDto(
|
||||
string SectionId,
|
||||
string Status,
|
||||
string Summary,
|
||||
IReadOnlyList<string> Highlights);
|
||||
|
||||
public sealed record FeedFreshnessDto(
|
||||
string Source,
|
||||
string Status,
|
||||
string LastSyncedAt,
|
||||
int FreshnessHours,
|
||||
int SlaHours);
|
||||
|
||||
public sealed record ScanPipelineHealthDto(
|
||||
string Status,
|
||||
int PendingDigests,
|
||||
int FailedJobs24h,
|
||||
IReadOnlyList<PipelineStageHealthDto> Stages);
|
||||
|
||||
public sealed record PipelineStageHealthDto(
|
||||
string Stage,
|
||||
string Status,
|
||||
int QueueDepth,
|
||||
int OldestAgeMinutes);
|
||||
|
||||
public sealed record ReachabilityIngestHealthDto(
|
||||
string Status,
|
||||
int RuntimeCoveragePercent,
|
||||
IReadOnlyList<RegionIngestHealthDto> Regions);
|
||||
|
||||
public sealed record RegionIngestHealthDto(
|
||||
string Region,
|
||||
string Status,
|
||||
int Backlog,
|
||||
int FreshnessMinutes);
|
||||
|
||||
public sealed record AdministrationSummaryDto(
|
||||
IReadOnlyList<AdministrationDomainCardDto> Domains,
|
||||
IReadOnlyList<string> ActiveIncidents);
|
||||
|
||||
public sealed record AdministrationDomainCardDto(
|
||||
string DomainId,
|
||||
string Label,
|
||||
string Status,
|
||||
string Summary,
|
||||
string ActionPath);
|
||||
|
||||
public sealed record AdministrationIdentityAccessDto(
|
||||
IReadOnlyList<AdministrationFacetTabDto> Tabs,
|
||||
IReadOnlyList<IdentityAccessActorDto> RecentActors,
|
||||
IReadOnlyList<AdministrationRouteAliasDto> LegacyAliases,
|
||||
string AuditLogPath);
|
||||
|
||||
public sealed record AdministrationFacetTabDto(
|
||||
string TabId,
|
||||
string Label,
|
||||
int Count,
|
||||
string Status,
|
||||
string ActionPath);
|
||||
|
||||
public sealed record IdentityAccessActorDto(
|
||||
string Actor,
|
||||
string Role,
|
||||
string Status,
|
||||
string LastSeenAt);
|
||||
|
||||
public sealed record AdministrationTenantBrandingDto(
|
||||
IReadOnlyList<AdministrationTenantDto> Tenants,
|
||||
TenantBrandingDefaultsDto BrandingDefaults,
|
||||
IReadOnlyList<AdministrationRouteAliasDto> LegacyAliases);
|
||||
|
||||
public sealed record AdministrationTenantDto(
|
||||
string TenantId,
|
||||
string DisplayName,
|
||||
string PrimaryDomain,
|
||||
string DefaultPolicyPack,
|
||||
string Status);
|
||||
|
||||
public sealed record TenantBrandingDefaultsDto(
|
||||
string Theme,
|
||||
string SupportUrl,
|
||||
string LegalFooterVersion);
|
||||
|
||||
public sealed record AdministrationNotificationsDto(
|
||||
IReadOnlyList<AdministrationNotificationRuleDto> Rules,
|
||||
IReadOnlyList<AdministrationNotificationChannelDto> Channels,
|
||||
string ChannelManagementPath,
|
||||
IReadOnlyList<AdministrationRouteAliasDto> LegacyAliases);
|
||||
|
||||
public sealed record AdministrationNotificationRuleDto(
|
||||
string RuleId,
|
||||
string Label,
|
||||
string Severity,
|
||||
string Status);
|
||||
|
||||
public sealed record AdministrationNotificationChannelDto(
|
||||
string ChannelId,
|
||||
string Status,
|
||||
string LastDeliveredAt);
|
||||
|
||||
public sealed record AdministrationUsageLimitsDto(
|
||||
IReadOnlyList<AdministrationUsageMeterDto> Meters,
|
||||
IReadOnlyList<AdministrationUsagePolicyDto> Policies,
|
||||
string OperationsDrilldownPath,
|
||||
IReadOnlyList<AdministrationRouteAliasDto> LegacyAliases);
|
||||
|
||||
public sealed record AdministrationUsageMeterDto(
|
||||
string MeterId,
|
||||
string Label,
|
||||
int Used,
|
||||
int Limit,
|
||||
string Unit);
|
||||
|
||||
public sealed record AdministrationUsagePolicyDto(
|
||||
string PolicyId,
|
||||
string Label,
|
||||
string Status);
|
||||
|
||||
public sealed record AdministrationPolicyGovernanceDto(
|
||||
IReadOnlyList<AdministrationPolicyBaselineDto> Baselines,
|
||||
IReadOnlyList<AdministrationPolicySignalDto> Signals,
|
||||
IReadOnlyList<AdministrationRouteAliasDto> LegacyAliases,
|
||||
IReadOnlyList<string> CrossLinks);
|
||||
|
||||
public sealed record AdministrationPolicyBaselineDto(
|
||||
string Environment,
|
||||
string PolicyPack,
|
||||
string Status);
|
||||
|
||||
public sealed record AdministrationPolicySignalDto(
|
||||
string SignalId,
|
||||
string Status,
|
||||
string Summary);
|
||||
|
||||
public sealed record AdministrationTrustSigningDto(
|
||||
AdministrationTrustInventoryDto Inventory,
|
||||
IReadOnlyList<AdministrationTrustSignalDto> Signals,
|
||||
IReadOnlyList<AdministrationRouteAliasDto> LegacyAliases,
|
||||
string EvidenceConsumerPath);
|
||||
|
||||
public sealed record AdministrationTrustInventoryDto(
|
||||
int Keys,
|
||||
int Issuers,
|
||||
int Certificates);
|
||||
|
||||
public sealed record AdministrationTrustSignalDto(
|
||||
string SignalId,
|
||||
string Status,
|
||||
string Summary);
|
||||
|
||||
public sealed record AdministrationSystemDto(
|
||||
string OverallStatus,
|
||||
IReadOnlyList<AdministrationSystemControlDto> Controls,
|
||||
IReadOnlyList<AdministrationRouteAliasDto> LegacyAliases,
|
||||
IReadOnlyList<string> Drilldowns);
|
||||
|
||||
public sealed record AdministrationSystemControlDto(
|
||||
string ControlId,
|
||||
string Status,
|
||||
string Summary);
|
||||
|
||||
public sealed record AdministrationRouteAliasDto(
|
||||
string LegacyPath,
|
||||
string CanonicalPath,
|
||||
string Action);
|
||||
|
||||
public sealed record DataConfidenceBadgeDto(
|
||||
string Status,
|
||||
string Summary,
|
||||
int NvdStalenessHours,
|
||||
int StaleSbomDigests,
|
||||
int RuntimeDlqDepth);
|
||||
Reference in New Issue
Block a user