Add comprehensive security tests for OWASP A02, A05, A07, and A08 categories

- Implemented tests for Cryptographic Failures (A02) to ensure proper handling of sensitive data, secure algorithms, and key management.
- Added tests for Security Misconfiguration (A05) to validate production configurations, security headers, CORS settings, and feature management.
- Developed tests for Authentication Failures (A07) to enforce strong password policies, rate limiting, session management, and MFA support.
- Created tests for Software and Data Integrity Failures (A08) to verify artifact signatures, SBOM integrity, attestation chains, and feed updates.

docs/api/evidence-decision-api.openapi.yaml

@@ -0,0 +1,434 @@
+openapi: 3.1.0
+info:
+  title: StellaOps Evidence & Decision API
+  description: |
+    REST API for evidence retrieval and decision recording.
+    Sprint: SPRINT_3602_0001_0001
+  version: 1.0.0
+  license:
+    name: AGPL-3.0-or-later
+    url: https://www.gnu.org/licenses/agpl-3.0.html
+
+servers:
+  - url: /v1
+    description: API v1
+
+security:
+  - bearerAuth: []
+
+paths:
+  /alerts:
+    get:
+      operationId: listAlerts
+      summary: List alerts with filtering and pagination
+      tags:
+        - Alerts
+      parameters:
+        - name: band
+          in: query
+          schema:
+            type: string
+            enum: [critical, high, medium, low, info]
+        - name: severity
+          in: query
+          schema:
+            type: string
+        - name: status
+          in: query
+          schema:
+            type: string
+            enum: [open, acknowledged, resolved, suppressed]
+        - name: artifactId
+          in: query
+          schema:
+            type: string
+        - name: vulnId
+          in: query
+          schema:
+            type: string
+        - name: componentPurl
+          in: query
+          schema:
+            type: string
+        - name: limit
+          in: query
+          schema:
+            type: integer
+            default: 50
+            maximum: 500
+        - name: offset
+          in: query
+          schema:
+            type: integer
+            default: 0
+      responses:
+        '200':
+          description: Alert list
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AlertListResponse'
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+
+  /alerts/{alertId}:
+    get:
+      operationId: getAlert
+      summary: Get alert details
+      tags:
+        - Alerts
+      parameters:
+        - $ref: '#/components/parameters/alertId'
+      responses:
+        '200':
+          description: Alert details
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AlertSummary'
+        '404':
+          $ref: '#/components/responses/NotFound'
+
+  /alerts/{alertId}/evidence:
+    get:
+      operationId: getAlertEvidence
+      summary: Get evidence bundle for an alert
+      tags:
+        - Evidence
+      parameters:
+        - $ref: '#/components/parameters/alertId'
+      responses:
+        '200':
+          description: Evidence payload
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/EvidencePayloadResponse'
+        '404':
+          $ref: '#/components/responses/NotFound'
+
+  /alerts/{alertId}/decisions:
+    post:
+      operationId: recordDecision
+      summary: Record a decision for an alert
+      tags:
+        - Decisions
+      parameters:
+        - $ref: '#/components/parameters/alertId'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/DecisionRequest'
+      responses:
+        '201':
+          description: Decision recorded
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/DecisionResponse'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '400':
+          $ref: '#/components/responses/BadRequest'
+
+  /alerts/{alertId}/audit:
+    get:
+      operationId: getAlertAudit
+      summary: Get audit timeline for an alert
+      tags:
+        - Audit
+      parameters:
+        - $ref: '#/components/parameters/alertId'
+      responses:
+        '200':
+          description: Audit timeline
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AuditTimelineResponse'
+        '404':
+          $ref: '#/components/responses/NotFound'
+
+  /alerts/{alertId}/bundle:
+    get:
+      operationId: downloadAlertBundle
+      summary: Download evidence bundle as tar.gz
+      tags:
+        - Bundles
+      parameters:
+        - $ref: '#/components/parameters/alertId'
+      responses:
+        '200':
+          description: Evidence bundle file
+          content:
+            application/gzip:
+              schema:
+                type: string
+                format: binary
+        '404':
+          $ref: '#/components/responses/NotFound'
+
+  /alerts/{alertId}/bundle/verify:
+    post:
+      operationId: verifyAlertBundle
+      summary: Verify evidence bundle integrity
+      tags:
+        - Bundles
+      parameters:
+        - $ref: '#/components/parameters/alertId'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/BundleVerificationRequest'
+      responses:
+        '200':
+          description: Verification result
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/BundleVerificationResponse'
+        '404':
+          $ref: '#/components/responses/NotFound'
+
+components:
+  securitySchemes:
+    bearerAuth:
+      type: http
+      scheme: bearer
+      bearerFormat: JWT
+
+  parameters:
+    alertId:
+      name: alertId
+      in: path
+      required: true
+      schema:
+        type: string
+      description: Alert identifier
+
+  responses:
+    BadRequest:
+      description: Bad request
+      content:
+        application/problem+json:
+          schema:
+            $ref: '#/components/schemas/ProblemDetails'
+    Unauthorized:
+      description: Unauthorized
+    NotFound:
+      description: Resource not found
+
+  schemas:
+    AlertListResponse:
+      type: object
+      required:
+        - items
+        - total_count
+      properties:
+        items:
+          type: array
+          items:
+            $ref: '#/components/schemas/AlertSummary'
+        total_count:
+          type: integer
+        next_page_token:
+          type: string
+
+    AlertSummary:
+      type: object
+      required:
+        - alert_id
+        - artifact_id
+        - vuln_id
+        - severity
+        - band
+        - status
+        - created_at
+      properties:
+        alert_id:
+          type: string
+        artifact_id:
+          type: string
+        vuln_id:
+          type: string
+        component_purl:
+          type: string
+        severity:
+          type: string
+        band:
+          type: string
+          enum: [critical, high, medium, low, info]
+        status:
+          type: string
+          enum: [open, acknowledged, resolved, suppressed]
+        score:
+          type: number
+          format: double
+        created_at:
+          type: string
+          format: date-time
+        updated_at:
+          type: string
+          format: date-time
+        decision_count:
+          type: integer
+
+    EvidencePayloadResponse:
+      type: object
+      required:
+        - alert_id
+      properties:
+        alert_id:
+          type: string
+        reachability:
+          $ref: '#/components/schemas/EvidenceSection'
+        callstack:
+          $ref: '#/components/schemas/EvidenceSection'
+        vex:
+          $ref: '#/components/schemas/EvidenceSection'
+
+    EvidenceSection:
+      type: object
+      properties:
+        data:
+          type: object
+        hash:
+          type: string
+        source:
+          type: string
+
+    DecisionRequest:
+      type: object
+      required:
+        - decision
+        - rationale
+      properties:
+        decision:
+          type: string
+          enum: [accept_risk, mitigate, suppress, escalate]
+        rationale:
+          type: string
+          minLength: 10
+          maxLength: 2000
+        justification_code:
+          type: string
+        metadata:
+          type: object
+
+    DecisionResponse:
+      type: object
+      required:
+        - decision_id
+        - alert_id
+        - decision
+        - recorded_at
+      properties:
+        decision_id:
+          type: string
+        alert_id:
+          type: string
+        decision:
+          type: string
+        rationale:
+          type: string
+        recorded_at:
+          type: string
+          format: date-time
+        recorded_by:
+          type: string
+        replay_token:
+          type: string
+
+    AuditTimelineResponse:
+      type: object
+      required:
+        - alert_id
+        - events
+        - total_count
+      properties:
+        alert_id:
+          type: string
+        events:
+          type: array
+          items:
+            $ref: '#/components/schemas/AuditEvent'
+        total_count:
+          type: integer
+
+    AuditEvent:
+      type: object
+      required:
+        - event_id
+        - event_type
+        - timestamp
+      properties:
+        event_id:
+          type: string
+        event_type:
+          type: string
+        timestamp:
+          type: string
+          format: date-time
+        actor:
+          type: string
+        details:
+          type: object
+        replay_token:
+          type: string
+
+    BundleVerificationRequest:
+      type: object
+      required:
+        - bundle_hash
+      properties:
+        bundle_hash:
+          type: string
+          description: SHA-256 hash of the bundle
+        signature:
+          type: string
+          description: Optional DSSE signature
+
+    BundleVerificationResponse:
+      type: object
+      required:
+        - alert_id
+        - is_valid
+        - verified_at
+      properties:
+        alert_id:
+          type: string
+        is_valid:
+          type: boolean
+        verified_at:
+          type: string
+          format: date-time
+        signature_valid:
+          type: boolean
+        hash_valid:
+          type: boolean
+        chain_valid:
+          type: boolean
+        errors:
+          type: array
+          items:
+            type: string
+
+    ProblemDetails:
+      type: object
+      properties:
+        type:
+          type: string
+        title:
+          type: string
+        status:
+          type: integer
+        detail:
+          type: string
+        instance:
+          type: string