diff --git a/devops/compose/docker-compose.stella-ops.yml b/devops/compose/docker-compose.stella-ops.yml index 0d1a360f6..0553c2648 100644 --- a/devops/compose/docker-compose.stella-ops.yml +++ b/devops/compose/docker-compose.stella-ops.yml @@ -265,10 +265,12 @@ services: ConnectionStrings__Redis: "cache.stella-ops.local:6379" Platform__Authority__Issuer: "https://stella-ops.local" Platform__Authority__RequireHttpsMetadata: "false" + Platform__Authority__BypassNetworks__0: "172.19.0.0/16" Platform__Storage__Driver: "postgres" Platform__Storage__PostgresConnectionString: *postgres-connection Platform__EnvironmentSettings__RedirectUri: "https://stella-ops.local/auth/callback" Platform__EnvironmentSettings__PostLogoutRedirectUri: "https://stella-ops.local/" + Platform__EnvironmentSettings__Scope: "openid profile email ui.read ui.admin authority:tenants.read authority:users.read authority:roles.read authority:clients.read authority:tokens.read authority:branding.read authority.audit.read graph:read sbom:read scanner:read policy:read policy:simulate policy:author policy:review policy:approve orch:read analytics.read advisory:read vex:read exceptions:read exceptions:approve aoc:verify findings:read release:read scheduler:read scheduler:operate notify.viewer notify.operator notify.admin notify.escalate export.viewer export.operator export.admin vuln:view vuln:investigate vuln:operate vuln:audit" STELLAOPS_ROUTER_URL: "http://router.stella-ops.local" STELLAOPS_PLATFORM_URL: "http://platform.stella-ops.local" STELLAOPS_AUTHORITY_URL: "http://authority.stella-ops.local" @@ -381,10 +383,12 @@ services: restart: unless-stopped depends_on: *depends-infra environment: - ASPNETCORE_URLS: "http://+:8080" + ASPNETCORE_URLS: "http://+:80;http://+:8080" <<: *kestrel-cert ConnectionStrings__Default: *postgres-connection ConnectionStrings__Redis: "cache.stella-ops.local:6379" + Gateway__Auth__Authority__Issuer: "https://authority.stella-ops.local/" + Gateway__Auth__Authority__RequireHttpsMetadata: "false" volumes: - *cert-volume ports: @@ -743,6 +747,8 @@ services: <<: *kestrel-cert ConnectionStrings__Default: *postgres-connection ConnectionStrings__Redis: "cache.stella-ops.local:6379" + Postgres__ConnectionString: *postgres-connection + Postgres__SchemaName: "vexhub" volumes: - *cert-volume ports: @@ -818,8 +824,13 @@ services: <<: *kestrel-cert STELLAOPS_POLICY_ENGINE_Postgres__Policy__ConnectionString: *postgres-connection STELLAOPS_POLICY_ENGINE_ConnectionStrings__Redis: "cache.stella-ops.local:6379" - STELLAOPS_POLICY_ENGINE_PolicyEngine__ResourceServer__Authority: "http://authority.stella-ops.local" + STELLAOPS_POLICY_ENGINE_PolicyEngine__ResourceServer__Authority: "https://authority.stella-ops.local/" + STELLAOPS_POLICY_ENGINE_PolicyEngine__ResourceServer__MetadataAddress: "http://authority.stella-ops.local/.well-known/openid-configuration" STELLAOPS_POLICY_ENGINE_PolicyEngine__ResourceServer__RequireHttpsMetadata: "false" + STELLAOPS_POLICY_ENGINE_PolicyEngine__ResourceServer__Audiences__0: "/scanner" + STELLAOPS_POLICY_ENGINE_PolicyEngine__ResourceServer__BypassNetworks__0: "172.19.0.0/16" + STELLAOPS_POLICY_ENGINE_PolicyEngine__ResourceServer__BypassNetworks__1: "127.0.0.1/32" + STELLAOPS_POLICY_ENGINE_PolicyEngine__ResourceServer__BypassNetworks__2: "::1/128" volumes: - *cert-volume ports: @@ -845,8 +856,14 @@ services: <<: *kestrel-cert ConnectionStrings__Default: *postgres-connection ConnectionStrings__Redis: "cache.stella-ops.local:6379" + Postgres__Policy__ConnectionString: *postgres-connection PolicyGateway__ResourceServer__Authority: "http://authority.stella-ops.local" PolicyGateway__ResourceServer__RequireHttpsMetadata: "false" + PolicyGateway__ResourceServer__BypassNetworks__0: "172.19.0.0/16" + # Bootstrap-prefixed vars (read by StellaOpsConfigurationBootstrapper before DI) + STELLAOPS_POLICY_GATEWAY_PolicyGateway__ResourceServer__Authority: "http://authority.stella-ops.local" + STELLAOPS_POLICY_GATEWAY_PolicyGateway__ResourceServer__RequireHttpsMetadata: "false" + STELLAOPS_POLICY_GATEWAY_Postgres__Policy__ConnectionString: *postgres-connection volumes: - *cert-volume ports: @@ -1012,6 +1029,7 @@ services: <<: *kestrel-cert ConnectionStrings__Default: *postgres-connection ConnectionStrings__Redis: "cache.stella-ops.local:6379" + Scheduler__Authority__Enabled: "false" volumes: - *cert-volume tmpfs: @@ -1224,6 +1242,7 @@ services: findings__ledger__Database__ConnectionString: *postgres-connection findings__ledger__Authority__Issuer: "http://authority.stella-ops.local" findings__ledger__Authority__RequireHttpsMetadata: "false" + findings__ledger__Authority__BypassNetworks__0: "172.19.0.0/16" findings__ledger__Attachments__EncryptionKey: "IiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiI=" findings__ledger__Attachments__SignedUrlBase: "http://findings.stella-ops.local/attachments" findings__ledger__Attachments__SignedUrlSecret: "dev-signed-url-secret" @@ -1254,6 +1273,9 @@ services: <<: *kestrel-cert ConnectionStrings__Default: *postgres-connection ConnectionStrings__Redis: "cache.stella-ops.local:6379" + Doctor__Authority__Issuer: "http://authority.stella-ops.local" + Doctor__Authority__RequireHttpsMetadata: "false" + Doctor__Authority__BypassNetworks__0: "172.19.0.0/16" volumes: - *cert-volume ports: @@ -1373,6 +1395,10 @@ services: NOTIFY_NOTIFY__STORAGE__CONNECTIONSTRING: *postgres-connection NOTIFY_NOTIFY__STORAGE__DATABASE: "notify" NOTIFY_NOTIFY__PLUGINS__BASEDIRECTORY: "/app" + NOTIFY_NOTIFY__AUTHORITY__ENABLED: "false" + NOTIFY_NOTIFY__AUTHORITY__ALLOWANONYMOUSFALLBACK: "true" + NOTIFY_NOTIFY__AUTHORITY__DEVELOPMENTSIGNINGKEY: "StellaOps-Development-Key-NotifyService-2026!!" + NOTIFY_Postgres__Notify__ConnectionString: *postgres-connection Postgres__Notify__ConnectionString: *postgres-connection volumes: - ../../etc/notify:/app/etc/notify:ro @@ -1642,6 +1668,7 @@ services: ConnectionStrings__Redis: "cache.stella-ops.local:6379" Authority__ResourceServer__Authority: "http://authority.stella-ops.local" Authority__ResourceServer__RequireHttpsMetadata: "false" + Authority__ResourceServer__BypassNetworks__0: "172.19.0.0/16" volumes: - *cert-volume ports: diff --git a/docs-archived/product/advisories/16-Feb-2026 - Hybrid Diff Stack for Source and Binary Patching.md b/docs-archived/product/advisories/16-Feb-2026 - Hybrid Diff Stack for Source and Binary Patching.md new file mode 100644 index 000000000..1c5cd0e54 --- /dev/null +++ b/docs-archived/product/advisories/16-Feb-2026 - Hybrid Diff Stack for Source and Binary Patching.md @@ -0,0 +1,59 @@ +# 16-Feb-2026 - Hybrid Diff Stack for Source and Binary Patching + +## Source +- Origin: user-submitted advisory in chat (2026-02-16). +- Theme: versioning and patching across source + binaries using a hybrid + source-symbol-binary diff pipeline. + +## Advisory summary + +Proposed architecture: + +1. Source-level AST semantic edit scripts with symbol anchors. +2. Build-time mapping from source edits to symbol ranges using DWARF/PDB and + build-id metadata. +3. Binary normalization followed by compact per-symbol delta generation. +4. Signed packaging (DSSE + transparency logging) and policy gates based on + function-level change scope. + +Proposed deliverables: + +- Builder outputs: `symbol_map.json`, `build_id`, normalized streams. +- Differ outputs: `symbol_patch_plan.json`, per-symbol delta payloads, + `patch_manifest.json`. +- Verifier checks for build-id match, boundary-safe dry-run apply, and + source-anchor reconciliation. +- Evidence Locker schema extension for hybrid diff artifacts. + +## Review result + +Outcome: **Accepted as partially implemented and requiring additional delivery**. + +Already implemented in repository: + +- Normalized ELF segment hashing and normalization passes in BinaryIndex. +- DeltaSig attestation model + CLI flow for signature extraction/sign/verify. +- Symbol manifest model carrying debug and source metadata. + +Gaps identified: + +- No first-class AST semantic edit script artifact pipeline. +- No canonical source-to-symbol map artifact contract emitted at build stage. +- No unified symbol patch plan manifest linking AST anchors to normalized + per-symbol delta artifacts. +- Function boundary/address accuracy still incomplete in parts of DeltaSig + function delta generation. + +## Translated artifacts + +- High-level doc: `docs/hybrid-diff-patching.md` +- Module dossier: `docs/modules/binary-index/hybrid-diff-stack.md` +- Sprint plan: `docs/implplan/SPRINT_20260216_001_BinaryIndex_hybrid_diff_patch_pipeline.md` + +## De-duplication note + +This advisory extends earlier binary diff and symbol mapping advisory work, not +replace it: + +- `docs-archived/product/advisories/30-Dec-2025 - Binary Diff Signatures for Patch Detection.md` +- `docs-archived/product/advisories/18-Dec-2025 - Building Better Binary Mapping and Call-Stack Reachability.md` diff --git a/docs-archived/product/advisories/16-Feb-2026 - eBPF micro-witness deterministic replay across distros.md b/docs-archived/product/advisories/16-Feb-2026 - eBPF micro-witness deterministic replay across distros.md new file mode 100644 index 000000000..2779eefd9 --- /dev/null +++ b/docs-archived/product/advisories/16-Feb-2026 - eBPF micro-witness deterministic replay across distros.md @@ -0,0 +1,24 @@ +# 16-Feb-2026 - eBPF micro-witness deterministic replay across distros + +## Advisory source +- Source: user-provided product advisory text (review session, 2026-02-16 UTC). +- Scope: CO-RE eBPF micro-witnesses replayable and deterministic across kernels, distros, and toolchains, with DSSE + Sigstore bundle portability. + +## Outcome +- Result: partially aligned implementation with confirmed contract and implementation gaps. +- Decision: advisory translated into product/module docs plus an active implementation sprint. + +## Confirmed gap themes +- Runtime collector support check is hard-gated on `/sys/kernel/btf/vmlinux`; split-BTF/external-vmlinux fallback behavior is not implemented as a deterministic recorded contract. +- Runtime witness payload lacks required deterministic symbolization tuple for cross-distro replay (`symbolizer`, `libc_variant`, `sysroot`, debug/symbol pointers). +- Runtime witness generation pipeline is interface-defined but not implemented end-to-end in Scanner. +- DSSE witness support exists, but per-witness Sigstore bundle contract (`trace.sigstore.json`) is not standardized in witness storage/export/indexing. + +## Translation artifacts +- Active sprint: `docs/implplan/SPRINT_20260216_001_Signals_ebpf_micro_witness_determinism_profile.md` +- Product update: `docs/product/ebpf-micro-witness-determinism.md` +- Module contract: `docs/modules/signals/contracts/ebpf-micro-witness-determinism-profile.md` + +## Notes +- External web fetches: none. +- Repository verification inputs included runtime and storage code paths under `src/Signals/`, `src/Scanner/`, `src/RuntimeInstrumentation/`, `src/Attestor/`, and `src/EvidenceLocker/`. diff --git a/docs/README.md b/docs/README.md index d9a1acd16..d2f3d0418 100755 --- a/docs/README.md +++ b/docs/README.md @@ -119,6 +119,7 @@ This documentation set is intentionally consolidated and does not maintain compa - Security deep dives: `docs/security/` - Benchmarks and fixtures: `docs/benchmarks/`, `docs/assets/` - Product advisories: `docs/product/advisories/` +- Hybrid diff patching blueprint: `docs/hybrid-diff-patching.md` --- @@ -140,3 +141,4 @@ This documentation set is intentionally consolidated and does not maintain compa - **Evidence-linked decisions:** every decision links to concrete evidence artifacts. - **Digest-first identity:** releases are immutable OCI digests, not mutable tags. - **Pluggable integrations:** connectors and steps are extensible; the core evidence chain stays stable. + diff --git a/docs/hybrid-diff-patching.md b/docs/hybrid-diff-patching.md new file mode 100644 index 000000000..8efef1b7c --- /dev/null +++ b/docs/hybrid-diff-patching.md @@ -0,0 +1,45 @@ +# Hybrid Diff Patching (Source + Symbols + Binary) + +## Purpose + +This document captures the product-level blueprint for hybrid diff patching: + +- Source semantic edits (AST-level intent). +- Build-time symbol mapping (source ranges to binary symbols and addresses). +- Normalized binary deltas (stable and compact byte patches). +- Signed evidence bundle for policy gating and replay. + +The goal is to make release decisions auditable at function granularity while +remaining deterministic and offline-capable. + +## Review outcome (2026-02-16) + +The advisory is directionally aligned with existing Stella Ops work but not +fully implemented end-to-end. + +Already present: + +- ELF normalization and delta hashing pipeline in BinaryIndex. +- DeltaSig attestation models and CLI flows for extract/author/sign/verify. +- Symbol manifest model with debug/code identifiers and source path metadata. + +Missing or incomplete for the full hybrid stack: + +- AST semantic edit-script generation and stable source anchors. +- Build artifact contract that emits canonical `symbol_map.json` from DWARF/PDB + during build. +- Deterministic source-edit -> symbol patch plan artifact. +- Verifier workflow that reconciles AST anchors with symbol boundaries and + normalized per-symbol deltas in one attested contract. + +## Canonical module dossier + +Detailed contracts, phased implementation, and policy hooks are defined in: + +- `docs/modules/binary-index/hybrid-diff-stack.md` + +## Execution sprint + +Implementation planning for this advisory is tracked in: + +- `docs/implplan/SPRINT_20260216_001_BinaryIndex_hybrid_diff_patch_pipeline.md` diff --git a/docs/implplan/SPRINT_20260216_001_BinaryIndex_hybrid_diff_patch_pipeline.md b/docs/implplan/SPRINT_20260216_001_BinaryIndex_hybrid_diff_patch_pipeline.md new file mode 100644 index 000000000..887bf1b62 --- /dev/null +++ b/docs/implplan/SPRINT_20260216_001_BinaryIndex_hybrid_diff_patch_pipeline.md @@ -0,0 +1,126 @@ +# Sprint 20260216-001 - Hybrid Diff Patch Pipeline + +## Topic & Scope +- Translate advisory guidance into an executable cross-module delivery plan for source-to-binary patch evidence. +- Define deterministic contracts for semantic edit scripts, symbol maps, symbol patch plans, and normalized per-symbol deltas. +- Wire policy and verification expectations so Release Orchestrator can gate on function-level change intent and byte-level proof. +- Working directory: `src/BinaryIndex/`. +- Expected evidence: targeted unit/integration tests, deterministic fixture artifacts, DSSE predicate samples, updated module docs. + +## Dependencies & Concurrency +- Depends on existing DeltaSig v2 predicate baseline in `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/`. +- Safe parallel workstreams: + - source semantic edit artifact generation (`src/Tools/` or `src/ReleaseOrchestrator/` integration) + - symbol map extraction contracts (`src/Symbols/`) + - normalized delta and verifier integration (`src/BinaryIndex/`, `src/Attestor/`, `src/Doctor/`) +- Cross-module edits are explicitly allowed for this sprint in: + - `src/Symbols/` + - `src/EvidenceLocker/` + - `src/Policy/` + - `src/ReleaseOrchestrator/` + - `src/Attestor/` + - `src/Doctor/` + - `src/Web/` + - `docs/modules/**` + +## Documentation Prerequisites +- `docs/hybrid-diff-patching.md` +- `docs/modules/binary-index/hybrid-diff-stack.md` +- `docs/modules/binary-index/semantic-diffing.md` +- `docs/modules/binary-index/deltasig-v2-schema.md` +- `docs/modules/evidence-locker/guides/evidence-pack-schema.md` + +## Delivery Tracker + +### BHP-01 - Source semantic edit script artifact +Status: TODO +Dependency: none +Owners: Developer, Documentation author +Task description: +- Add deterministic source semantic edit artifact generation that emits stable + node identifiers and symbol anchors for changed code elements. +- Integrate artifact emission into release comparison flow and persist into + evidence pipelines. + +Completion criteria: +- [ ] A `semantic_edit_script.json` contract is implemented and validated with tests. +- [ ] Artifact generation is deterministic across repeated runs with identical inputs. +- [ ] Documentation for schema and limits is added to module dossier docs. + +### BHP-02 - Build symbol map contract and build-id binding +Status: TODO +Dependency: BHP-01 +Owners: Developer +Task description: +- Emit canonical `symbol_map.json` with source ranges, symbol boundaries, and + build-id metadata from DWARF/PDB capable pipelines. +- Ensure map digests and build-id values are linked into DeltaSig/attestation + subjects for replay validation. + +Completion criteria: +- [ ] Symbol map generation is implemented for supported binary formats in scope. +- [ ] Build-id and map digest are bound in emitted attestation payloads. +- [ ] Tests cover mapping correctness and deterministic ordering. + +### BHP-03 - Symbol patch plan and normalized per-symbol delta manifests +Status: TODO +Dependency: BHP-02 +Owners: Developer +Task description: +- Join semantic edits and symbol maps into `symbol_patch_plan.json` and + generate normalized per-symbol deltas and `patch_manifest.json` outputs. +- Remove placeholder function address/size derivation in DeltaSig generation + where exact boundaries are required for audit claims. + +Completion criteria: +- [ ] Symbol patch plan artifact exists and links to AST anchors and symbol ids. +- [ ] Patch manifest includes pre/post hashes, address ranges, and delta digests. +- [ ] DeltaSig function-level outputs use real boundaries and sizes in covered paths. + +### BHP-04 - Verifier and attestation enforcement +Status: TODO +Dependency: BHP-03 +Owners: Developer, Test Automation +Task description: +- Add verifier flow for build-id matching, re-normalization checks, dry-run delta + application, and boundary/hash reconciliation. +- Extend attestation validation logic in Attestor/Doctor and produce actionable + verification evidence for release decisions. + +Completion criteria: +- [ ] Verifier checks fail closed on build-id mismatch, boundary mismatch, or hash mismatch. +- [ ] DSSE validation and replay checks are captured in test evidence. +- [ ] CLI/API surfaces expose verification outcome details for operators. + +### BHP-05 - Policy and Evidence Locker integration +Status: TODO +Dependency: BHP-04 +Owners: Developer, Product Manager +Task description: +- Add policy gate inputs for symbol-count change budgets, namespace restrictions, + API-surface invariants, and byte budget thresholds. +- Store hybrid diff artifacts in Evidence Locker and expose summary/read paths in + UI and release records. + +Completion criteria: +- [ ] Policy rules can gate promotions using hybrid diff metrics. +- [ ] Evidence Locker stores and retrieves the full hybrid artifact chain. +- [ ] UI/CLI render concise "what changed" summaries with links to signed evidence. + +## Execution Log +| Date (UTC) | Update | Owner | +| --- | --- | --- | +| 2026-02-16 | Sprint created from product advisory review for hybrid source-symbol-binary diff pipeline. | Product Manager | + +## Decisions & Risks +- Advisory overlap confirmed with archived advisories: + - `docs-archived/product/advisories/30-Dec-2025 - Binary Diff Signatures for Patch Detection.md` + - `docs-archived/product/advisories/18-Dec-2025 - Building Better Binary Mapping and Call-Stack Reachability.md` +- Decision: treat this advisory as an extension that unifies source intent and binary proof in one contract chain, not as a duplicate effort. +- Risk: multi-module coordination can drift schemas; mitigation is to keep canonical contracts in BinaryIndex dossier and require digest-linked schema versions in attestations. +- Risk: AST differencing backend choice may vary by language; mitigation is a language-agnostic output schema with adapter-specific provenance fields. + +## Next Checkpoints +- 2026-02-18: Contract freeze review for artifact schemas (`semantic_edit_script`, `symbol_map`, `symbol_patch_plan`, `patch_manifest`). +- 2026-02-22: First end-to-end dry run in CI with signed evidence and verifier replay. +- 2026-02-26: Policy gate integration demo with allow/deny examples on symbol namespaces. diff --git a/docs/implplan/SPRINT_20260216_001_Signals_ebpf_micro_witness_determinism_profile.md b/docs/implplan/SPRINT_20260216_001_Signals_ebpf_micro_witness_determinism_profile.md new file mode 100644 index 000000000..556673617 --- /dev/null +++ b/docs/implplan/SPRINT_20260216_001_Signals_ebpf_micro_witness_determinism_profile.md @@ -0,0 +1,102 @@ +# Sprint SPRINT_20260216_001_Signals_ebpf_micro_witness_determinism_profile - eBPF Micro-Witness Determinism + +## Topic & Scope +- Translate the eBPF micro-witness advisory into implementation-ready contracts and sprint tasks. +- Close determinism gaps for runtime witness replay across kernel/distro/toolchain variance. +- Define one portable evidence profile for DSSE + Sigstore bundle based offline replay. +- Working directory: `docs/`. +- Cross-module edits explicitly allowed for implementation tasks: `src/Signals/`, `src/Scanner/`, `src/Attestor/`, `src/EvidenceLocker/`. +- Expected evidence: contract docs, schema/API updates, targeted module tests, offline verification artifacts. + +## Dependencies & Concurrency +- Upstream contracts: `docs/contracts/witness-v1.md`, `docs/modules/attestor/repro-bundle-profile.md`, `docs/modules/evidence/unified-model.md`. +- Safe parallelism: +- Signals loader/BTF work can run in parallel with Attestor/Evidence Locker bundle contract work. +- Scanner witness model updates should run after profile fields are frozen. + +## Documentation Prerequisites +- `docs/product/ebpf-micro-witness-determinism.md` +- `docs/modules/signals/contracts/ebpf-micro-witness-determinism-profile.md` +- `docs/reachability/deployment-guide.md` +- `docs/contracts/witness-v1.md` + +## Delivery Tracker + +### MWD-001 - Signals BTF fallback contract and metadata emission +Status: TODO +Dependency: none +Owners: Product Manager, Developer +Task description: +- Implement deterministic BTF selection order in the runtime collector and emit selected source metadata (`source_kind`, `source_path`, `source_digest`, `selection_reason`) into runtime evidence/witness context. +- Ensure behavior is explicit for kernel BTF, external vmlinux BTF, and split-BTF fallback. + +Completion criteria: +- [ ] Collector no longer fails solely on missing `/sys/kernel/btf/vmlinux` when configured fallback BTF exists. +- [ ] Runtime evidence includes immutable BTF selection metadata required for replay. + +### MWD-002 - Runtime witness schema extensions for deterministic symbolization +Status: TODO +Dependency: MWD-001 +Owners: Developer, Documentation author +Task description: +- Extend runtime witness payload schema to include deterministic symbolization tuple: `build_id`, debug/symbol pointer(s), symbolizer identity/version/digest, libc variant, and sysroot digest. +- Update witness contracts and validation rules in docs and implementation. + +Completion criteria: +- [ ] Witness schema and code models carry required symbolization fields. +- [ ] Validation rejects witnesses missing required deterministic symbolization inputs. + +### MWD-003 - Implement Scanner runtime witness generation pipeline +Status: TODO +Dependency: MWD-002 +Owners: Developer, Test Automation +Task description: +- Deliver concrete `IRuntimeWitnessGenerator` implementation, integrating runtime observations, witness building, DSSE signing, and storage. +- Ensure deterministic ordering/canonicalization for runtime observation payloads. + +Completion criteria: +- [ ] Runtime witness generation is implemented (not interface-only) and wired into runtime instrumentation flow. +- [ ] Determinism tests show stable witness bytes for fixed inputs. + +### MWD-004 - DSSE plus Sigstore bundle witness packaging +Status: TODO +Dependency: MWD-003 +Owners: Developer, Documentation author +Task description: +- Standardize and implement per-witness artifact triplet: `trace.json`, `trace.dsse.json`, `trace.sigstore.json`. +- Store and export this profile through Evidence Locker with offline verification compatibility. + +Completion criteria: +- [ ] Evidence Locker manifest/index model supports the Sigstore bundle artifact and links it to witness identity. +- [ ] Offline verify workflow succeeds using bundle-contained material only. + +### MWD-005 - Cross-distro deterministic replay test matrix +Status: TODO +Dependency: MWD-004 +Owners: Test Automation, QA +Task description: +- Add targeted replay verification across kernel/libc matrix (minimum 3 kernels, glibc + musl), asserting byte-identical replay frames for fixed witness artifacts. +- Capture command output and evidence artifacts for deterministic QA sign-off. + +Completion criteria: +- [ ] Matrix tests run against targeted projects (not solution filters) and show deterministic replay output. +- [ ] Execution evidence is recorded with artifact hashes and replay verification logs. + +## Execution Log +| Date (UTC) | Update | Owner | +| --- | --- | --- | +| 2026-02-16 | Sprint created from eBPF micro-witness advisory review; gaps confirmed and translated to implementation tasks. | Project Manager | + +## Decisions & Risks +- Decision: Adopt a single micro-witness determinism profile defined in `docs/modules/signals/contracts/ebpf-micro-witness-determinism-profile.md`. +- Decision: Product-level promise and current baseline are captured in `docs/product/ebpf-micro-witness-determinism.md`. +- Decision: Advisory translation record archived at `docs-archived/product/advisories/16-Feb-2026 - eBPF micro-witness deterministic replay across distros.md`. +- Risk: Existing runtime collector hard dependency on kernel BTF may block non-BTF kernels until fallback path is implemented. +- Risk: Runtime witness generation remains incomplete without a concrete generator implementation; downstream attestation/export is blocked. +- Risk: Absence of standardized Sigstore witness bundle may produce non-portable replay evidence across environments. +- External web fetches: none. + +## Next Checkpoints +- 2026-02-18: Contract review sign-off (Signals/Scanner/Attestor/Evidence Locker owners). +- 2026-02-21: MWD-001 and MWD-002 implementation readiness checkpoint. +- 2026-02-25: First end-to-end deterministic replay demo with DSSE + Sigstore witness bundle. diff --git a/docs/modules/binary-index/README.md b/docs/modules/binary-index/README.md index 320e84b05..13546d1b1 100644 --- a/docs/modules/binary-index/README.md +++ b/docs/modules/binary-index/README.md @@ -37,6 +37,7 @@ Key features: ## Related Documentation - Architecture: `./architecture.md` +- Hybrid Diff Stack: `./hybrid-diff-stack.md` - High-Level Architecture: `../../ARCHITECTURE_OVERVIEW.md` - Scanner Architecture: `../scanner/architecture.md` - Concelier Architecture: `../concelier/architecture.md` @@ -63,7 +64,7 @@ A major enhancement to BinaryIndex is planned to enable **semantic-level binary | **Phase 1** | IR-Level Semantic Analysis | +15% accuracy on optimized binaries | Planned | | **Phase 2** | Function Behavior Corpus | +10% coverage on stripped binaries | Planned | | **Phase 3** | Ghidra Integration | +5% edge case handling | Planned | -| **Phase 4** | Decompiler & ML Similarity | +10% obfuscation resilience | Planned | +| **Phase 4** | Decompiler and ML Similarity | +10% obfuscation resilience | Planned | ### New Libraries (Planned) diff --git a/docs/modules/binary-index/architecture.md b/docs/modules/binary-index/architecture.md index e01992139..d7ec483ec 100644 --- a/docs/modules/binary-index/architecture.md +++ b/docs/modules/binary-index/architecture.md @@ -3,7 +3,7 @@ > **Ownership:** Scanner Guild + Concelier Guild > **Status:** DRAFT > **Version:** 1.0.0 -> **Related:** [High-Level Architecture](../../ARCHITECTURE_OVERVIEW.md), [Scanner Architecture](../scanner/architecture.md), [Concelier Architecture](../concelier/architecture.md) +> **Related:** [High-Level Architecture](../../ARCHITECTURE_OVERVIEW.md), [Scanner Architecture](../scanner/architecture.md), [Concelier Architecture](../concelier/architecture.md), [Hybrid Diff Stack](./hybrid-diff-stack.md) --- @@ -1774,3 +1774,4 @@ inside `AddNormalizationPipelines()` in `ServiceCollectionExtensions.cs`. *Document Version: 1.5.0* *Last Updated: 2026-02-12* + diff --git a/docs/modules/binary-index/hybrid-diff-stack.md b/docs/modules/binary-index/hybrid-diff-stack.md new file mode 100644 index 000000000..cd52779f0 --- /dev/null +++ b/docs/modules/binary-index/hybrid-diff-stack.md @@ -0,0 +1,163 @@ +# Hybrid Diff Stack Architecture (Source -> Symbols -> Normalized Bytes) + +> Status: Planned (advisory translation, 2026-02-16) +> Module: BinaryIndex with cross-module contracts (Symbols, EvidenceLocker, Policy, Attestor, ReleaseOrchestrator) + +## 1. Objective + +Produce compact, auditable patch artifacts that preserve developer intent and +binary truth at the same time: + +- Source-level intent: semantic edit scripts anchored to classes/functions. +- Build-level mapping: symbol map linked to immutable build identity. +- Binary-level patching: normalization-first per-symbol deltas. +- Release evidence: DSSE-signed contract consumed by policy and replay. + +## 2. Current implementation baseline + +Implemented today: + +- ELF normalization passes and deterministic delta hash generation. +- DeltaSig predicate contracts (v1 and v2) with CLI author/sign/verify flows. +- Symbol manifest model with debug id, code id, source paths, and line data. + +Gaps for full advisory scope: + +- No AST semantic edit script artifact pipeline in current release workflow. +- No canonical builder output for source-range to symbol-address map as a + first-class build artifact contract. +- No end-to-end "source edits -> symbol patch plan -> normalized deltas" + bundle schema consumed by release policy. +- Existing function delta composition still contains placeholder address/size + behavior in parts of DeltaSig generation. + +## 3. Target contracts + +### 3.1 Source semantic edit script (`semantic_edit_script.json`) + +Required fields: + +- `schemaVersion` +- `sourceTreeDigest` +- `edits[]` where each edit includes: + - `editType`: `add|remove|move|update|rename` + - `nodeKind`: `class|method|field|import|statement` + - `nodePath`: stable language-specific path + - `anchor`: symbol-like identifier (for example `Namespace.Type.Method`) + - `pre` and `post` source spans and digests + +Determinism rules: + +- Stable sort by file path, then node path. +- Stable source digests and normalized paths. + +### 3.2 Symbol map (`symbol_map.json`) + +Produced during build from DWARF/PDB + build metadata. + +Required fields: + +- `schemaVersion` +- `buildId` +- `binaryDigest` +- `symbols[]`: + - `name` + - `kind` (`function|object|section`) + - `addressStart` and `addressEnd` + - `section` + - `sourceRanges[]` (`file`, `lineStart`, `lineEnd`) + +Determinism rules: + +- Symbol ordering by address then name. +- Build id must match attestation subject. + +### 3.3 Symbol patch plan (`symbol_patch_plan.json`) + +Joins source edits with concrete symbols. + +Required fields: + +- `schemaVersion` +- `buildIdBefore` and `buildIdAfter` +- `editsDigest` +- `symbolMapDigestBefore` and `symbolMapDigestAfter` +- `changes[]`: + - `symbol` + - `changeType` (`added|removed|modified|moved`) + - `astAnchors[]` + - `preHash` and `postHash` + - `deltaRef` + +### 3.4 Patch manifest (`patch_manifest.json`) + +Binds per-symbol normalized deltas to evidence and policy. + +Required fields: + +- `schemaVersion` +- `buildId` +- `normalizationRecipeId` +- `patches[]`: + - `symbol` + - `addressRange` + - `deltaDigest` + - `pre` (`size`, `hash`) + - `post` (`size`, `hash`) +- `attestation` (`predicateType`, `dsseDigest`) + +## 4. Evidence and policy integration + +EvidenceLocker stores four linked artifacts per release comparison: + +1. semantic edit script +2. symbol maps (before/after) +3. symbol patch plan +4. normalized patch manifest + delta blobs + +Policy hooks: + +- Allowlist/denylist by namespace or symbol path. +- Max function-count and max byte budget controls. +- API surface change checks. +- Hot-path and cryptography namespace protection rules. + +## 5. Verifier contract (Attestor/Doctor) + +Verifier must prove all of the following before promotion: + +- Build-id and subject digest alignment. +- Re-normalization of target binary with matching recipe id. +- Dry-run delta application succeeds within declared symbol boundaries. +- Resulting hashes equal manifest `post` values. +- AST anchors reconcile to changed symbols in symbol patch plan. +- DSSE signatures and transparency references validate per policy. + +## 6. Integration boundaries + +Builder step (CI): emit symbol map and normalized segments. + +ReleaseOrchestrator step: combine source edits, symbol maps, and normalized +bytes into patch plan and manifest. + +BinaryIndex/DeltaSig: own normalization and per-symbol diff generation. + +Attestor/Doctor: own verification and attestation checks. + +EvidenceLocker: own storage schema and query surfaces. + +Policy: consume summarized patch-plan metrics and rule evaluations. + +## 7. Implementation tracker + +Execution is tracked in: + +- `docs/implplan/SPRINT_20260216_001_BinaryIndex_hybrid_diff_patch_pipeline.md` + +## 8. Related documents + +- `docs/hybrid-diff-patching.md` +- `docs/modules/binary-index/semantic-diffing.md` +- `docs/modules/binary-index/deltasig-v2-schema.md` +- `docs/modules/scanner/binary-diff-attestation.md` +- `docs/modules/evidence-locker/guides/evidence-pack-schema.md` diff --git a/docs/modules/signals/README.md b/docs/modules/signals/README.md index 19b145b5b..407208fd8 100644 --- a/docs/modules/signals/README.md +++ b/docs/modules/signals/README.md @@ -49,6 +49,7 @@ Key settings: ## Related Documentation - Architecture: `./architecture.md` +- Contract: `./contracts/ebpf-micro-witness-determinism-profile.md` - Policy Engine: `../policy/` - VexLens: `../vex-lens/` - High-Level Architecture: `../../ARCHITECTURE_OVERVIEW.md` diff --git a/docs/modules/signals/contracts/ebpf-micro-witness-determinism-profile.md b/docs/modules/signals/contracts/ebpf-micro-witness-determinism-profile.md new file mode 100644 index 000000000..392975967 --- /dev/null +++ b/docs/modules/signals/contracts/ebpf-micro-witness-determinism-profile.md @@ -0,0 +1,124 @@ +# eBPF Micro-Witness Determinism Profile v1.0.0 + +**Status:** PLANNED +**Version:** 1.0.0 +**Effective:** 2026-02-16 +**Owner:** Signals Guild + Scanner Guild + Attestor Guild + Evidence Locker Guild +**Sprint:** `docs/implplan/SPRINT_20260216_001_Signals_ebpf_micro_witness_determinism_profile.md` + +--- + +## 1. Purpose + +This profile defines the minimum deterministic contract for runtime eBPF "micro-witnesses" so replay yields the same symbolized result across distros/toolchains and in offline environments. + +--- + +## 2. Contract Scope + +- Runtime collection and BTF selection (`Signals`). +- Runtime witness payload schema and signing (`Scanner`). +- DSSE and transparency evidence shape (`Attestor`). +- Portable storage/export/indexing (`Evidence Locker`). + +--- + +## 3. Runtime Loader Contract (BTF Selection) + +### 3.1 Selection order (mandatory) +1. `/sys/kernel/btf/vmlinux` +2. configured full-kernel BTF path (for example distro debug package path) +3. split-BTF selected by `{kernel_release, arch}` + +### 3.2 Required emitted metadata + +```json +{ + "kernel_release": "6.8.0-45-generic", + "kernel_arch": "x86_64", + "btf": { + "source_kind": "kernel|external-vmlinux|split-btf", + "source_path": "/sys/kernel/btf/vmlinux", + "source_digest": "sha256:...", + "selection_reason": "kernel_btf_present" + } +} +``` + +`source_path` and `source_digest` are mandatory for deterministic replay. + +--- + +## 4. Deterministic Symbolization Contract + +Each runtime witness must carry deterministic symbolization inputs: + +```json +{ + "symbolization": { + "build_id": "gnu-build-id:...", + "debug_artifact_uri": "cas://symbols/by-build-id/gnu-build-id:.../artifact.debug", + "symbol_table_uri": "cas://symbols/by-build-id/gnu-build-id:.../symtab.json", + "symbolizer": { + "name": "llvm-symbolizer", + "version": "18.1.7", + "digest": "sha256:..." + }, + "libc_variant": "glibc|musl", + "sysroot_digest": "sha256:..." + } +} +``` + +At least one of `debug_artifact_uri` or `symbol_table_uri` must be present. + +--- + +## 5. Witness Packaging Contract + +Each micro-witness must be exportable as: + +1. `trace.json` (canonical payload) +2. `trace.dsse.json` (DSSE envelope) +3. `trace.sigstore.json` (Sigstore bundle with signature/cert/transparency proof) + +Offline verification must use only bundle-contained material (no network dependency). + +--- + +## 6. Evidence Locker Index Contract + +Evidence Locker must index runtime witness artifacts by: + +- `build_id` +- `kernel_release` +- `probe_id` +- `policy_run_id` + +These keys are required for deterministic replay lookup and audit search. + +--- + +## 7. Validation Matrix (minimum) + +- Kernel matrix: at least 3 supported kernel lines. +- libc matrix: glibc + musl. +- Verification modes: online + offline. +- Determinism check: byte-identical replayed frame output for fixed input evidence. + +--- + +## 8. Confirmed Gaps (2026-02-16 Baseline) + +- Hard BTF dependency with no split-BTF fallback metadata contract in collector: + - `src/Signals/__Libraries/StellaOps.Signals.Ebpf/Services/RuntimeSignalCollector.cs` +- Probe load path is simulated and does not record selected BTF source: + - `src/Signals/__Libraries/StellaOps.Signals.Ebpf/Probes/CoreProbeLoader.cs` +- Runtime witness payload lacks required symbolization tuple fields: + - `src/Scanner/__Libraries/StellaOps.Scanner.Reachability/Witnesses/PathWitness.cs` + - `src/Scanner/__Libraries/StellaOps.Scanner.Reachability/Witnesses/RuntimeObservation.cs` +- Runtime witness generator implementation is missing: + - `src/Scanner/__Libraries/StellaOps.Scanner.Reachability/Witnesses/IRuntimeWitnessGenerator.cs` +- Sigstore bundle (`trace.sigstore.json`) is not yet standardized in witness storage/export: + - `src/Scanner/__Libraries/StellaOps.Scanner.Storage/Postgres/Migrations/013_witness_storage.sql` + - `src/EvidenceLocker/__Libraries/StellaOps.EvidenceLocker.Export/Models/BundleManifest.cs` diff --git a/docs/product/README.md b/docs/product/README.md index a434f208a..253dcc493 100644 --- a/docs/product/README.md +++ b/docs/product/README.md @@ -12,6 +12,7 @@ Product strategy, competitive analysis, and marketing bridge documents. | [decision-capsules.md](decision-capsules.md) | Decision Capsules concept (audit-grade evidence bundles) | | [evidence-linked-vex.md](evidence-linked-vex.md) | Evidence-linked VEX technical bridge | | [hybrid-reachability.md](hybrid-reachability.md) | Hybrid reachability feature positioning | +| [ebpf-micro-witness-determinism.md](ebpf-micro-witness-determinism.md) | eBPF micro-witness deterministic replay profile and current implementation gaps | | [portable-audit-pack-plan.md](portable-audit-pack-plan.md) | Portable supply-chain audit pack rollout plan | | [reachability-benchmark-launch.md](reachability-benchmark-launch.md) | Reachability benchmark launch materials | diff --git a/docs/product/ebpf-micro-witness-determinism.md b/docs/product/ebpf-micro-witness-determinism.md new file mode 100644 index 000000000..149b8c6ea --- /dev/null +++ b/docs/product/ebpf-micro-witness-determinism.md @@ -0,0 +1,36 @@ +# eBPF Micro-Witness Determinism Profile + +## Status +- Advisory translated: 2026-02-16 (UTC) +- Current implementation status: gaps confirmed +- Implementation sprint: `docs/implplan/SPRINT_20260216_001_Signals_ebpf_micro_witness_determinism_profile.md` + +## Purpose +- Define what "replayable and deterministic micro-witnesses" means for Stella Ops runtime evidence. +- Align Signals, Scanner, Attestor, and Evidence Locker on one verifiable output profile. +- Ensure the same incident replay result across distros/toolchains and in offline mode. + +## Required product behavior +1. One CO-RE probe object must run unchanged across supported kernels when BTF is available. +2. If kernel BTF is missing, the loader must use deterministic fallback selection and record exactly what BTF source was used. +3. Runtime witnesses must include deterministic symbolization inputs (build identity + symbol/debug material + toolchain tuple). +4. Witness evidence must be portable as DSSE plus a Sigstore bundle that can be verified offline. + +## Verified current state (2026-02-16) +- eBPF support check currently hard-requires `/sys/kernel/btf/vmlinux` with no split-BTF fallback path selection metadata in collector output. + - `src/Signals/__Libraries/StellaOps.Signals.Ebpf/Services/RuntimeSignalCollector.cs` +- Probe loader path is simulated for runtime attachment lifecycle and does not implement deterministic BTF source recording. + - `src/Signals/__Libraries/StellaOps.Signals.Ebpf/Probes/CoreProbeLoader.cs` +- Runtime witness model includes `build_id` but does not include symbol bundle pointers or symbolizer/libc/sysroot tuple required for cross-distro deterministic symbolization. + - `src/Scanner/__Libraries/StellaOps.Scanner.Reachability/Witnesses/PathWitness.cs` + - `src/Scanner/__Libraries/StellaOps.Scanner.Reachability/Witnesses/RuntimeObservation.cs` +- Runtime witness generator is interface-defined but has no production implementation in Scanner. + - `src/Scanner/__Libraries/StellaOps.Scanner.Reachability/Witnesses/IRuntimeWitnessGenerator.cs` +- DSSE envelope support exists; end-to-end per-witness Sigstore bundle contract (`trace.sigstore.json`) is not standardized in witness storage/indexing. + - `src/Scanner/__Libraries/StellaOps.Scanner.Reachability/Witnesses/WitnessDsseSigner.cs` + - `src/Scanner/__Libraries/StellaOps.Scanner.Storage/Postgres/Migrations/013_witness_storage.sql` + - `src/EvidenceLocker/__Libraries/StellaOps.EvidenceLocker.Export/Models/BundleManifest.cs` + +## Decision +- Advisory is accepted as implementation-required. +- Contract and sprint tasks are created to close deterministic replay gaps. diff --git a/src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/HybridDiffContracts.cs b/src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/HybridDiffContracts.cs new file mode 100644 index 000000000..5961e4d5a --- /dev/null +++ b/src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/HybridDiffContracts.cs @@ -0,0 +1,435 @@ +// Copyright (c) StellaOps. All rights reserved. +// Licensed under BUSL-1.1. See LICENSE in the project root. + +using System.Text.Json.Serialization; + +namespace StellaOps.BinaryIndex.DeltaSig; + +/// +/// Source file pair used to compute semantic edit scripts. +/// +public sealed record SourceFileDiff +{ + /// + /// Source file path (repository-relative). + /// + public required string Path { get; init; } + + /// + /// Previous file content. + /// + public string? BeforeContent { get; init; } + + /// + /// Current file content. + /// + public string? AfterContent { get; init; } +} + +/// +/// Source line span. +/// +public sealed record SourceSpan +{ + /// + /// 1-based start line. + /// + public required int StartLine { get; init; } + + /// + /// 1-based end line. + /// + public required int EndLine { get; init; } +} + +/// +/// Deterministic semantic edit script. +/// +public sealed record SemanticEditScript +{ + /// + /// Schema version. + /// + public string SchemaVersion { get; init; } = "1.0.0"; + + /// + /// Digest of the full source tree diff input. + /// + public required string SourceTreeDigest { get; init; } + + /// + /// Deterministic ordered edits. + /// + public required IReadOnlyList Edits { get; init; } +} + +/// +/// Single semantic edit entry. +/// +public sealed record SemanticEdit +{ + /// + /// Stable digest-derived ID for dedupe and audit references. + /// + public required string StableId { get; init; } + + /// + /// Edit type: add, remove, move, update, rename. + /// + public required string EditType { get; init; } + + /// + /// Node kind: file, method, class, field, import, statement. + /// + public required string NodeKind { get; init; } + + /// + /// Deterministic node path. + /// + public required string NodePath { get; init; } + + /// + /// Symbol anchor used to link to binary symbols. + /// + public required string Anchor { get; init; } + + /// + /// Pre-change source span. + /// + [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)] + public SourceSpan? PreSpan { get; init; } + + /// + /// Post-change source span. + /// + [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)] + public SourceSpan? PostSpan { get; init; } + + /// + /// Pre-change digest. + /// + [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)] + public string? PreDigest { get; init; } + + /// + /// Post-change digest. + /// + [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)] + public string? PostDigest { get; init; } +} + +/// +/// Build-stage symbol map linked to build identity. +/// +public sealed record SymbolMap +{ + /// + /// Schema version. + /// + public string SchemaVersion { get; init; } = "1.0.0"; + + /// + /// Build ID (ELF build-id, PDB GUID, or equivalent). + /// + public required string BuildId { get; init; } + + /// + /// Optional binary digest for traceability. + /// + [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)] + public string? BinaryDigest { get; init; } + + /// + /// Address derivation source (manifest, synthetic-signature). + /// + public string AddressSource { get; init; } = "manifest"; + + /// + /// Ordered symbol entries. + /// + public required IReadOnlyList Symbols { get; init; } +} + +/// +/// Symbol map entry. +/// +public sealed record SymbolMapEntry +{ + /// + /// Symbol name. + /// + public required string Name { get; init; } + + /// + /// Symbol kind: function, object, section. + /// + public string Kind { get; init; } = "function"; + + /// + /// Start address. + /// + public required ulong AddressStart { get; init; } + + /// + /// End address. + /// + public required ulong AddressEnd { get; init; } + + /// + /// Containing section. + /// + public string Section { get; init; } = ".text"; + + /// + /// Source ranges for this symbol. + /// + [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)] + public IReadOnlyList? SourceRanges { get; init; } + + /// + /// Symbol size derived from address range. + /// + [JsonIgnore] + public long Size => checked((long)(AddressEnd >= AddressStart ? AddressEnd - AddressStart + 1UL : 0UL)); +} + +/// +/// Source range metadata. +/// +public sealed record SourceRange +{ + /// + /// Source file path. + /// + public required string File { get; init; } + + /// + /// 1-based start line. + /// + public required int LineStart { get; init; } + + /// + /// 1-based end line. + /// + public required int LineEnd { get; init; } +} + +/// +/// Join artifact linking semantic edits to symbol changes. +/// +public sealed record SymbolPatchPlan +{ + /// + /// Schema version. + /// + public string SchemaVersion { get; init; } = "1.0.0"; + + /// + /// Build ID before patch. + /// + public required string BuildIdBefore { get; init; } + + /// + /// Build ID after patch. + /// + public required string BuildIdAfter { get; init; } + + /// + /// Semantic script digest. + /// + public required string EditsDigest { get; init; } + + /// + /// Old symbol map digest. + /// + public required string SymbolMapDigestBefore { get; init; } + + /// + /// New symbol map digest. + /// + public required string SymbolMapDigestAfter { get; init; } + + /// + /// Ordered symbol changes. + /// + public required IReadOnlyList Changes { get; init; } +} + +/// +/// Single symbol patch plan entry. +/// +public sealed record SymbolPatchChange +{ + /// + /// Symbol name. + /// + public required string Symbol { get; init; } + + /// + /// Change type: added, removed, modified, moved. + /// + public required string ChangeType { get; init; } + + /// + /// Linked source anchors. + /// + public required IReadOnlyList AstAnchors { get; init; } + + /// + /// Hash before. + /// + [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)] + public string? PreHash { get; init; } + + /// + /// Hash after. + /// + [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)] + public string? PostHash { get; init; } + + /// + /// Delta reference digest. + /// + public required string DeltaRef { get; init; } +} + +/// +/// Normalized patch manifest for per-symbol deltas. +/// +public sealed record PatchManifest +{ + /// + /// Schema version. + /// + public string SchemaVersion { get; init; } = "1.0.0"; + + /// + /// Build ID. + /// + public required string BuildId { get; init; } + + /// + /// Normalization recipe identifier. + /// + public required string NormalizationRecipeId { get; init; } + + /// + /// Ordered patch entries. + /// + public required IReadOnlyList Patches { get; init; } + + /// + /// Total delta bytes across symbols. + /// + [JsonIgnore] + public long TotalDeltaBytes => Patches.Sum(p => p.DeltaSizeBytes); +} + +/// +/// Per-symbol patch artifact. +/// +public sealed record SymbolPatchArtifact +{ + /// + /// Symbol name. + /// + public required string Symbol { get; init; } + + /// + /// Address range in hex format. + /// + public required string AddressRange { get; init; } + + /// + /// Digest of patch payload. + /// + public required string DeltaDigest { get; init; } + + /// + /// Pre-patch metrics. + /// + public required PatchSizeHash Pre { get; init; } + + /// + /// Post-patch metrics. + /// + public required PatchSizeHash Post { get; init; } + + /// + /// Absolute byte delta. + /// + [JsonIgnore] + public long DeltaSizeBytes => Math.Abs(Post.Size - Pre.Size); +} + +/// +/// Size/hash tuple. +/// +public sealed record PatchSizeHash +{ + /// + /// Size in bytes. + /// + public required long Size { get; init; } + + /// + /// Hash digest. + /// + public required string Hash { get; init; } +} + +/// +/// Full hybrid diff evidence bundle. +/// +public sealed record HybridDiffEvidence +{ + /// + /// Semantic edit script. + /// + public required SemanticEditScript SemanticEditScript { get; init; } + + /// + /// Old symbol map. + /// + public required SymbolMap OldSymbolMap { get; init; } + + /// + /// New symbol map. + /// + public required SymbolMap NewSymbolMap { get; init; } + + /// + /// Symbol patch plan. + /// + public required SymbolPatchPlan SymbolPatchPlan { get; init; } + + /// + /// Normalized patch manifest. + /// + public required PatchManifest PatchManifest { get; init; } + + /// + /// Semantic edit script digest. + /// + public required string SemanticEditScriptDigest { get; init; } + + /// + /// Old symbol map digest. + /// + public required string OldSymbolMapDigest { get; init; } + + /// + /// New symbol map digest. + /// + public required string NewSymbolMapDigest { get; init; } + + /// + /// Symbol patch plan digest. + /// + public required string SymbolPatchPlanDigest { get; init; } + + /// + /// Patch manifest digest. + /// + public required string PatchManifestDigest { get; init; } +} diff --git a/src/Findings/StellaOps.Findings.Ledger.WebService/Program.cs b/src/Findings/StellaOps.Findings.Ledger.WebService/Program.cs index 5c1610831..42bc7e868 100644 --- a/src/Findings/StellaOps.Findings.Ledger.WebService/Program.cs +++ b/src/Findings/StellaOps.Findings.Ledger.WebService/Program.cs @@ -143,6 +143,13 @@ builder.Services.AddAuthorization(options => ? bootstrapOptions.Authority.RequiredScopes.ToArray() : new[] { StellaOpsScopes.VulnOperate }; + // Default policy uses StellaOpsScopeRequirement so bypass evaluator can grant + // access for requests from trusted networks (BypassNetworks) without a JWT. + options.DefaultPolicy = new Microsoft.AspNetCore.Authorization.AuthorizationPolicyBuilder() + .AddAuthenticationSchemes(StellaOpsAuthenticationDefaults.AuthenticationScheme) + .AddRequirements(new StellaOpsScopeRequirement(scopes)) + .Build(); + options.AddPolicy(LedgerWritePolicy, policy => { policy.RequireAuthenticatedUser(); diff --git a/src/Notify/__Libraries/StellaOps.Notify.Persistence/Extensions/NotifyPersistenceExtensions.cs b/src/Notify/__Libraries/StellaOps.Notify.Persistence/Extensions/NotifyPersistenceExtensions.cs index 9dcc6dc95..6d5d154aa 100644 --- a/src/Notify/__Libraries/StellaOps.Notify.Persistence/Extensions/NotifyPersistenceExtensions.cs +++ b/src/Notify/__Libraries/StellaOps.Notify.Persistence/Extensions/NotifyPersistenceExtensions.cs @@ -23,7 +23,7 @@ public static class NotifyPersistenceExtensions IConfiguration configuration, string sectionName = "Postgres:Notify") { - services.Configure(sectionName, configuration.GetSection(sectionName)); + services.Configure(configuration.GetSection(sectionName)); services.AddSingleton(); // Register repositories diff --git a/src/Platform/StellaOps.Platform.WebService/Services/PlatformAnalyticsQueryExecutor.cs b/src/Platform/StellaOps.Platform.WebService/Services/PlatformAnalyticsQueryExecutor.cs index 4a06b0b6c..52eb267fd 100644 --- a/src/Platform/StellaOps.Platform.WebService/Services/PlatformAnalyticsQueryExecutor.cs +++ b/src/Platform/StellaOps.Platform.WebService/Services/PlatformAnalyticsQueryExecutor.cs @@ -1,5 +1,6 @@ using Npgsql; +using NpgsqlTypes; using StellaOps.Platform.WebService.Contracts; using System; using System.Collections.Generic; @@ -85,7 +86,7 @@ public sealed class PlatformAnalyticsQueryExecutor : IPlatformAnalyticsQueryExec SUM(total_vulns) - SUM(vex_mitigated) AS net_exposure, SUM(kev_vulns) AS kev_vulns FROM analytics.daily_vulnerability_counts - WHERE snapshot_date >= CURRENT_DATE - (@days || ' days')::INTERVAL + WHERE snapshot_date >= CURRENT_DATE - make_interval(days => @days) AND (@environment IS NULL OR environment = @environment) GROUP BY snapshot_date, environment ORDER BY environment, snapshot_date; @@ -100,7 +101,8 @@ public sealed class PlatformAnalyticsQueryExecutor : IPlatformAnalyticsQueryExec await using var command = connection.CreateCommand(); command.CommandText = sql; command.Parameters.AddWithValue("days", days); - command.Parameters.AddWithValue("environment", (object?)environment ?? DBNull.Value); + var envParam = command.Parameters.Add("environment", NpgsqlDbType.Text); + envParam.Value = (object?)environment ?? DBNull.Value; var results = new List(); await using var reader = await command.ExecuteReaderAsync(cancellationToken).ConfigureAwait(false); @@ -132,7 +134,7 @@ public sealed class PlatformAnalyticsQueryExecutor : IPlatformAnalyticsQueryExec SUM(total_components) AS total_components, SUM(unique_suppliers) AS unique_suppliers FROM analytics.daily_component_counts - WHERE snapshot_date >= CURRENT_DATE - (@days || ' days')::INTERVAL + WHERE snapshot_date >= CURRENT_DATE - make_interval(days => @days) AND (@environment IS NULL OR environment = @environment) GROUP BY snapshot_date, environment ORDER BY environment, snapshot_date; @@ -147,7 +149,8 @@ public sealed class PlatformAnalyticsQueryExecutor : IPlatformAnalyticsQueryExec await using var command = connection.CreateCommand(); command.CommandText = sql; command.Parameters.AddWithValue("days", days); - command.Parameters.AddWithValue("environment", (object?)environment ?? DBNull.Value); + var envParam2 = command.Parameters.Add("environment", NpgsqlDbType.Text); + envParam2.Value = (object?)environment ?? DBNull.Value; var results = new List(); await using var reader = await command.ExecuteReaderAsync(cancellationToken).ConfigureAwait(false); diff --git a/src/Policy/StellaOps.Policy.Engine/Program.cs b/src/Policy/StellaOps.Policy.Engine/Program.cs index 444d32ce6..a2448af22 100644 --- a/src/Policy/StellaOps.Policy.Engine/Program.cs +++ b/src/Policy/StellaOps.Policy.Engine/Program.cs @@ -291,6 +291,17 @@ builder.Services.AddStellaOpsResourceServerAuthentication( builder.Configuration, configurationSection: $"{PolicyEngineOptions.SectionName}:ResourceServer"); +// Accept self-signed certificates when HTTPS metadata validation is disabled (dev/Docker) +if (!bootstrap.Options.ResourceServer.RequireHttpsMetadata) +{ + builder.Services.AddHttpClient("StellaOps.Auth.ServerIntegration.Metadata") + .ConfigurePrimaryHttpMessageHandler(() => new HttpClientHandler + { + ServerCertificateCustomValidationCallback = + HttpClientHandler.DangerousAcceptAnyServerCertificateValidator + }); +} + if (bootstrap.Options.Authority.Enabled) { builder.Services.AddStellaOpsAuthClient(clientOptions => diff --git a/src/Policy/StellaOps.Policy.Gateway/Program.cs b/src/Policy/StellaOps.Policy.Gateway/Program.cs index b8d963f82..3e6f51dc5 100644 --- a/src/Policy/StellaOps.Policy.Gateway/Program.cs +++ b/src/Policy/StellaOps.Policy.Gateway/Program.cs @@ -133,6 +133,9 @@ builder.Services.AddAuthentication(); builder.Services.AddAuthorization(); builder.Services.AddStellaOpsScopeHandler(); builder.Services.AddPolicyPostgresStorage(builder.Configuration); +// Also configure unnamed PostgresOptions so PolicyDataSource (IOptions) resolves the connection string. +builder.Services.Configure( + builder.Configuration.GetSection("Postgres:Policy")); builder.Services.AddMemoryCache(); // Exception services @@ -198,6 +201,20 @@ builder.Services.AddSingleton(); builder.Services.AddStellaOpsResourceServerAuthentication( builder.Configuration, configurationSection: $"{PolicyGatewayOptions.SectionName}:ResourceServer"); + +// Accept self-signed certificates when HTTPS metadata validation is disabled (dev/Docker) +if (!bootstrap.Options.ResourceServer.RequireHttpsMetadata) +{ + builder.Services.ConfigureHttpClientDefaults(clientBuilder => + { + clientBuilder.ConfigurePrimaryHttpMessageHandler(() => new HttpClientHandler + { + ServerCertificateCustomValidationCallback = + HttpClientHandler.DangerousAcceptAnyServerCertificateValidator + }); + }); +} + builder.Services.AddSingleton(); builder.Services.AddSingleton(); builder.Services.AddSingleton(); diff --git a/src/Router/StellaOps.Gateway.WebService/Middleware/IdentityHeaderPolicyMiddleware.cs b/src/Router/StellaOps.Gateway.WebService/Middleware/IdentityHeaderPolicyMiddleware.cs index 282fa65e5..fdaf01c56 100644 --- a/src/Router/StellaOps.Gateway.WebService/Middleware/IdentityHeaderPolicyMiddleware.cs +++ b/src/Router/StellaOps.Gateway.WebService/Middleware/IdentityHeaderPolicyMiddleware.cs @@ -39,13 +39,20 @@ public sealed class IdentityHeaderPolicyMiddleware "X-Stella-Project", "X-Stella-Actor", "X-Stella-Scopes", + // Headers used by downstream services in header-based auth mode + "X-Scopes", + "X-Tenant-Id", // Raw claim headers (internal/legacy pass-through) "sub", "tid", "scope", "scp", "cnf", - "cnf.jkt" + "cnf.jkt", + // Auth headers consumed by the gateway — strip before proxying + // so backends trust identity headers instead of re-validating JWT. + "Authorization", + "DPoP" ]; public IdentityHeaderPolicyMiddleware( @@ -91,8 +98,18 @@ public sealed class IdentityHeaderPolicyMiddleware private void StripReservedHeaders(HttpContext context) { + var preserveAuthHeaders = _options.JwtPassthroughPrefixes.Count > 0 + && _options.JwtPassthroughPrefixes.Any(prefix => + context.Request.Path.StartsWithSegments(prefix, StringComparison.OrdinalIgnoreCase)); + foreach (var header in ReservedHeaders) { + // Preserve Authorization/DPoP for routes that need JWT pass-through + if (preserveAuthHeaders && (header == "Authorization" || header == "DPoP")) + { + continue; + } + if (context.Request.Headers.ContainsKey(header)) { _logger.LogDebug( @@ -114,7 +131,7 @@ public sealed class IdentityHeaderPolicyMiddleware // In AllowAnonymous mode the Gateway cannot validate identity claims. // Pass through the client-provided tenant so the upstream service // can validate it against the JWT's own tenant claim. - var passThruTenant = !string.IsNullOrWhiteSpace(clientTenant) ? clientTenant.Trim() : null; + var passThruTenant = !string.IsNullOrWhiteSpace(clientTenant) ? clientTenant.Trim() : "default"; return new IdentityContext { @@ -192,9 +209,37 @@ public sealed class IdentityHeaderPolicyMiddleware } } + // Expand coarse OIDC scopes to fine-grained service scopes. + // This bridges the gap between Authority-registered scopes (e.g. "scheduler:read") + // and the fine-grained scopes that downstream services expect (e.g. "scheduler.runs.read"). + ExpandCoarseScopes(scopes); + return scopes; } + /// + /// Expands coarse OIDC scopes into fine-grained service scopes. + /// Pattern: "{service}:{action}" expands to "{service}.{resource}.{action}" for known resources. + /// + private static void ExpandCoarseScopes(HashSet scopes) + { + // scheduler:read -> scheduler.schedules.read, scheduler.runs.read + // scheduler:operate -> scheduler.schedules.write, scheduler.runs.write, scheduler.runs.preview, scheduler.runs.manage + if (scopes.Contains("scheduler:read")) + { + scopes.Add("scheduler.schedules.read"); + scopes.Add("scheduler.runs.read"); + } + + if (scopes.Contains("scheduler:operate")) + { + scopes.Add("scheduler.schedules.write"); + scopes.Add("scheduler.runs.write"); + scopes.Add("scheduler.runs.preview"); + scopes.Add("scheduler.runs.manage"); + } + } + private void StoreIdentityContext(HttpContext context, IdentityContext identity) { context.Items[GatewayContextKeys.IsAnonymous] = identity.IsAnonymous; @@ -248,6 +293,7 @@ public sealed class IdentityHeaderPolicyMiddleware if (!string.IsNullOrEmpty(identity.Tenant)) { headers["X-StellaOps-Tenant"] = identity.Tenant; + headers["X-Tenant-Id"] = identity.Tenant; if (_options.EnableLegacyHeaders) { headers["X-Stella-Tenant"] = identity.Tenant; @@ -270,6 +316,7 @@ public sealed class IdentityHeaderPolicyMiddleware var sortedScopes = identity.Scopes.OrderBy(s => s, StringComparer.Ordinal); var scopesValue = string.Join(" ", sortedScopes); headers["X-StellaOps-Scopes"] = scopesValue; + headers["X-Scopes"] = scopesValue; if (_options.EnableLegacyHeaders) { headers["X-Stella-Scopes"] = scopesValue; @@ -279,6 +326,7 @@ public sealed class IdentityHeaderPolicyMiddleware { // Explicit empty scopes for anonymous to prevent ambiguity headers["X-StellaOps-Scopes"] = string.Empty; + headers["X-Scopes"] = string.Empty; if (_options.EnableLegacyHeaders) { headers["X-Stella-Scopes"] = string.Empty; @@ -347,4 +395,13 @@ public sealed class IdentityHeaderPolicyOptions /// Default: false (forbidden for security). /// public bool AllowScopeHeaderOverride { get; set; } = false; + + /// + /// Route prefixes where Authorization and DPoP headers should be preserved + /// (passed through to the upstream service) instead of stripped. + /// Use this for upstream services that require JWT validation themselves + /// (e.g., Authority admin API at /console). + /// Default: empty (strip auth headers for all routes). + /// + public List JwtPassthroughPrefixes { get; set; } = []; } diff --git a/src/Router/StellaOps.Gateway.WebService/Program.cs b/src/Router/StellaOps.Gateway.WebService/Program.cs index 270aa516b..10a750a93 100644 --- a/src/Router/StellaOps.Gateway.WebService/Program.cs +++ b/src/Router/StellaOps.Gateway.WebService/Program.cs @@ -124,7 +124,11 @@ builder.Services.AddSingleton(); builder.Services.AddSingleton(new IdentityHeaderPolicyOptions { EnableLegacyHeaders = bootstrapOptions.Auth.EnableLegacyHeaders, - AllowScopeHeaderOverride = bootstrapOptions.Auth.AllowScopeHeader + AllowScopeHeaderOverride = bootstrapOptions.Auth.AllowScopeHeader, + JwtPassthroughPrefixes = bootstrapOptions.Routes + .Where(r => r.PreserveAuthHeaders) + .Select(r => r.Path) + .ToList() }); // Route table: resolver + error routes + HTTP client for reverse proxy @@ -222,6 +226,20 @@ static void ConfigureAuthentication(WebApplicationBuilder builder, GatewayOption } }); + // Configure the OIDC metadata HTTP client to accept self-signed certificates + // (Authority uses a dev cert in Docker) + if (!authOptions.Authority.RequireHttpsMetadata) + { + builder.Services.ConfigureHttpClientDefaults(clientBuilder => + { + clientBuilder.ConfigurePrimaryHttpMessageHandler(() => new HttpClientHandler + { + ServerCertificateCustomValidationCallback = + HttpClientHandler.DangerousAcceptAnyServerCertificateValidator + }); + }); + } + if (authOptions.Authority.RequiredScopes.Count > 0) { builder.Services.AddAuthorization(config => diff --git a/src/Router/StellaOps.Gateway.WebService/appsettings.json b/src/Router/StellaOps.Gateway.WebService/appsettings.json index 977e0d1a9..be470c5b7 100644 --- a/src/Router/StellaOps.Gateway.WebService/appsettings.json +++ b/src/Router/StellaOps.Gateway.WebService/appsettings.json @@ -43,9 +43,9 @@ "MtlsEnabled": false, "AllowAnonymous": true, "Authority": { - "Issuer": "", - "RequireHttpsMetadata": true, - "MetadataAddress": "", + "Issuer": "https://authority.stella-ops.local", + "RequireHttpsMetadata": false, + "MetadataAddress": "https://authority.stella-ops.local/.well-known/openid-configuration", "Audiences": [], "RequiredScopes": [] } @@ -66,7 +66,7 @@ }, "Routes": [ { "Type": "ReverseProxy", "Path": "/api/v1/release-orchestrator", "TranslatesTo": "http://orchestrator.stella-ops.local/api/v1/release-orchestrator" }, - { "Type": "ReverseProxy", "Path": "/api/v1/vex", "TranslatesTo": "http://vexhub.stella-ops.local/api/v1/vex" }, + { "Type": "ReverseProxy", "Path": "/api/v1/vex", "TranslatesTo": "https://vexhub.stella-ops.local/api/v1/vex" }, { "Type": "ReverseProxy", "Path": "/api/v1/vexlens", "TranslatesTo": "http://vexlens.stella-ops.local/api/v1/vexlens" }, { "Type": "ReverseProxy", "Path": "/api/v1/notify", "TranslatesTo": "http://notify.stella-ops.local/api/v1/notify" }, { "Type": "ReverseProxy", "Path": "/api/v1/notifier", "TranslatesTo": "http://notifier.stella-ops.local/api/v1/notifier" }, @@ -78,7 +78,7 @@ { "Type": "ReverseProxy", "Path": "/v1/audit-bundles", "TranslatesTo": "http://evidencelocker.stella-ops.local/v1/audit-bundles" }, { "Type": "ReverseProxy", "Path": "/policy", "TranslatesTo": "http://policy-gateway.stella-ops.local" }, { "Type": "ReverseProxy", "Path": "/api/policy", "TranslatesTo": "http://policy-gateway.stella-ops.local/api/policy" }, - { "Type": "ReverseProxy", "Path": "/api/risk", "TranslatesTo": "http://policy-engine.stella-ops.local/api/risk" }, + { "Type": "ReverseProxy", "Path": "/api/risk", "TranslatesTo": "http://policy-engine.stella-ops.local/api/risk", "PreserveAuthHeaders": true }, { "Type": "ReverseProxy", "Path": "/api/analytics", "TranslatesTo": "http://platform.stella-ops.local/api/analytics" }, { "Type": "ReverseProxy", "Path": "/api/release-orchestrator", "TranslatesTo": "http://orchestrator.stella-ops.local/api/release-orchestrator" }, { "Type": "ReverseProxy", "Path": "/api/releases", "TranslatesTo": "http://orchestrator.stella-ops.local/api/releases" }, @@ -87,15 +87,16 @@ { "Type": "ReverseProxy", "Path": "/api/v1/scanner", "TranslatesTo": "http://scanner.stella-ops.local/api/v1/scanner" }, { "Type": "ReverseProxy", "Path": "/api/v1/findings", "TranslatesTo": "http://findings.stella-ops.local/api/v1/findings" }, { "Type": "ReverseProxy", "Path": "/api/v1/policy", "TranslatesTo": "http://policy-gateway.stella-ops.local/api/v1/policy" }, + { "Type": "ReverseProxy", "Path": "/api/policy", "TranslatesTo": "http://policy-gateway.stella-ops.local/api/policy" }, { "Type": "ReverseProxy", "Path": "/api/v1/reachability", "TranslatesTo": "http://reachgraph.stella-ops.local/api/v1/reachability" }, { "Type": "ReverseProxy", "Path": "/api/v1/attestor", "TranslatesTo": "http://attestor.stella-ops.local/api/v1/attestor" }, { "Type": "ReverseProxy", "Path": "/api/v1/attestations", "TranslatesTo": "http://attestor.stella-ops.local/api/v1/attestations" }, { "Type": "ReverseProxy", "Path": "/api/v1/sbom", "TranslatesTo": "http://sbomservice.stella-ops.local/api/v1/sbom" }, { "Type": "ReverseProxy", "Path": "/api/v1/signals", "TranslatesTo": "http://signals.stella-ops.local/api/v1/signals" }, - { "Type": "ReverseProxy", "Path": "/api/v1/vex", "TranslatesTo": "http://vexhub.stella-ops.local/api/v1/vex" }, + { "Type": "ReverseProxy", "Path": "/api/v1/vex", "TranslatesTo": "https://vexhub.stella-ops.local/api/v1/vex" }, { "Type": "ReverseProxy", "Path": "/api/v1/orchestrator", "TranslatesTo": "http://orchestrator.stella-ops.local/api/v1/orchestrator" }, - { "Type": "ReverseProxy", "Path": "/api/v1/authority", "TranslatesTo": "https://authority.stella-ops.local/api/v1/authority" }, - { "Type": "ReverseProxy", "Path": "/api/v1/trust", "TranslatesTo": "https://authority.stella-ops.local/api/v1/trust" }, + { "Type": "ReverseProxy", "Path": "/api/v1/authority", "TranslatesTo": "https://authority.stella-ops.local/api/v1/authority", "PreserveAuthHeaders": true }, + { "Type": "ReverseProxy", "Path": "/api/v1/trust", "TranslatesTo": "https://authority.stella-ops.local/api/v1/trust", "PreserveAuthHeaders": true }, { "Type": "ReverseProxy", "Path": "/api/v1/evidence", "TranslatesTo": "http://evidencelocker.stella-ops.local/api/v1/evidence" }, { "Type": "ReverseProxy", "Path": "/api/v1/proofs", "TranslatesTo": "http://evidencelocker.stella-ops.local/api/v1/proofs" }, { "Type": "ReverseProxy", "Path": "/api/v1/timeline", "TranslatesTo": "http://timelineindexer.stella-ops.local/api/v1/timeline" }, @@ -127,15 +128,15 @@ { "Type": "ReverseProxy", "Path": "/api/orchestrator", "TranslatesTo": "http://orchestrator.stella-ops.local/api/orchestrator" }, { "Type": "ReverseProxy", "Path": "/api/sbomservice", "TranslatesTo": "http://sbomservice.stella-ops.local/api/sbomservice" }, { "Type": "ReverseProxy", "Path": "/api/vuln-explorer", "TranslatesTo": "http://vulnexplorer.stella-ops.local/api/vuln-explorer" }, - { "Type": "ReverseProxy", "Path": "/api/vex", "TranslatesTo": "http://vexhub.stella-ops.local/api/vex" }, + { "Type": "ReverseProxy", "Path": "/api/vex", "TranslatesTo": "https://vexhub.stella-ops.local/api/vex" }, { "Type": "ReverseProxy", "Path": "/api/admin", "TranslatesTo": "http://platform.stella-ops.local/api/admin" }, { "Type": "ReverseProxy", "Path": "/api", "TranslatesTo": "http://platform.stella-ops.local/api" }, { "Type": "ReverseProxy", "Path": "/platform", "TranslatesTo": "http://platform.stella-ops.local/platform" }, - { "Type": "ReverseProxy", "Path": "/connect", "TranslatesTo": "https://authority.stella-ops.local" }, - { "Type": "ReverseProxy", "Path": "/.well-known", "TranslatesTo": "https://authority.stella-ops.local/.well-known" }, - { "Type": "ReverseProxy", "Path": "/jwks", "TranslatesTo": "https://authority.stella-ops.local/jwks" }, - { "Type": "ReverseProxy", "Path": "/authority", "TranslatesTo": "https://authority.stella-ops.local/authority" }, - { "Type": "ReverseProxy", "Path": "/console", "TranslatesTo": "https://authority.stella-ops.local/console" }, + { "Type": "ReverseProxy", "Path": "/connect", "TranslatesTo": "https://authority.stella-ops.local", "PreserveAuthHeaders": true }, + { "Type": "ReverseProxy", "Path": "/.well-known", "TranslatesTo": "https://authority.stella-ops.local/.well-known", "PreserveAuthHeaders": true }, + { "Type": "ReverseProxy", "Path": "/jwks", "TranslatesTo": "https://authority.stella-ops.local/jwks", "PreserveAuthHeaders": true }, + { "Type": "ReverseProxy", "Path": "/authority", "TranslatesTo": "https://authority.stella-ops.local/authority", "PreserveAuthHeaders": true }, + { "Type": "ReverseProxy", "Path": "/console", "TranslatesTo": "https://authority.stella-ops.local/console", "PreserveAuthHeaders": true }, { "Type": "ReverseProxy", "Path": "/gateway", "TranslatesTo": "http://gateway.stella-ops.local" }, { "Type": "ReverseProxy", "Path": "/scanner", "TranslatesTo": "http://scanner.stella-ops.local" }, { "Type": "ReverseProxy", "Path": "/policyGateway", "TranslatesTo": "http://policy-gateway.stella-ops.local" }, @@ -148,7 +149,7 @@ { "Type": "ReverseProxy", "Path": "/signals", "TranslatesTo": "http://signals.stella-ops.local" }, { "Type": "ReverseProxy", "Path": "/excititor", "TranslatesTo": "http://excititor.stella-ops.local" }, { "Type": "ReverseProxy", "Path": "/findingsLedger", "TranslatesTo": "http://findings.stella-ops.local" }, - { "Type": "ReverseProxy", "Path": "/vexhub", "TranslatesTo": "http://vexhub.stella-ops.local" }, + { "Type": "ReverseProxy", "Path": "/vexhub", "TranslatesTo": "https://vexhub.stella-ops.local" }, { "Type": "ReverseProxy", "Path": "/vexlens", "TranslatesTo": "http://vexlens.stella-ops.local" }, { "Type": "ReverseProxy", "Path": "/orchestrator", "TranslatesTo": "http://orchestrator.stella-ops.local" }, { "Type": "ReverseProxy", "Path": "/taskrunner", "TranslatesTo": "http://taskrunner.stella-ops.local" }, @@ -175,7 +176,6 @@ { "Type": "ReverseProxy", "Path": "/airgapController", "TranslatesTo": "http://airgap-controller.stella-ops.local" }, { "Type": "ReverseProxy", "Path": "/airgapTime", "TranslatesTo": "http://airgap-time.stella-ops.local" }, { "Type": "ReverseProxy", "Path": "/smremote", "TranslatesTo": "http://smremote.stella-ops.local" }, - { "Type": "ReverseProxy", "Path": "/envsettings.json", "TranslatesTo": "http://platform.stella-ops.local/platform/envsettings.json" }, { "Type": "StaticFiles", "Path": "/", "TranslatesTo": "/app/wwwroot", "Headers": { "x-spa-fallback": "true" } }, { "Type": "NotFoundPage", "Path": "/_error/404", "TranslatesTo": "/app/wwwroot/index.html" }, { "Type": "ServerErrorPage", "Path": "/_error/500", "TranslatesTo": "/app/wwwroot/index.html" } diff --git a/src/Router/__Libraries/StellaOps.Router.Gateway/Configuration/StellaOpsRoute.cs b/src/Router/__Libraries/StellaOps.Router.Gateway/Configuration/StellaOpsRoute.cs index 1abdf0830..63be81bbc 100644 --- a/src/Router/__Libraries/StellaOps.Router.Gateway/Configuration/StellaOpsRoute.cs +++ b/src/Router/__Libraries/StellaOps.Router.Gateway/Configuration/StellaOpsRoute.cs @@ -22,4 +22,11 @@ public sealed class StellaOpsRoute public string? TranslatesTo { get; set; } public Dictionary Headers { get; set; } = new(); + + /// + /// When true, the gateway preserves Authorization and DPoP headers instead + /// of stripping them. Use for upstream services that perform their own JWT + /// validation (e.g., Authority admin API). + /// + public bool PreserveAuthHeaders { get; set; } } diff --git a/src/Scheduler/StellaOps.Scheduler.WebService/Auth/HeaderScopeAuthorizer.cs b/src/Scheduler/StellaOps.Scheduler.WebService/Auth/HeaderScopeAuthorizer.cs index 819cd4a81..504930f38 100644 --- a/src/Scheduler/StellaOps.Scheduler.WebService/Auth/HeaderScopeAuthorizer.cs +++ b/src/Scheduler/StellaOps.Scheduler.WebService/Auth/HeaderScopeAuthorizer.cs @@ -4,7 +4,7 @@ namespace StellaOps.Scheduler.WebService.Auth; internal sealed class HeaderScopeAuthorizer : IScopeAuthorizer { - private const string ScopeHeader = "X-Scopes"; + private const string ScopeHeader = "X-StellaOps-Scopes"; public void EnsureScope(HttpContext context, string requiredScope) { @@ -23,9 +23,30 @@ internal sealed class HeaderScopeAuthorizer : IScopeAuthorizer .Split(' ', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries) .ToHashSet(StringComparer.OrdinalIgnoreCase); - if (!scopes.Contains(requiredScope)) + if (scopes.Contains(requiredScope)) { - throw new InvalidOperationException($"Missing required scope '{requiredScope}'."); + return; } + + // Hierarchical match: fine-grained scope "scheduler.runs.read" is satisfied + // by OIDC coarse-grained scope "scheduler:read" or "scheduler:admin". + // Format: "{service}.{resource}.{action}" -> check "{service}:{action}" and "{service}:admin" + var dotParts = requiredScope.Split('.'); + if (dotParts.Length >= 2) + { + var service = dotParts[0]; + var action = dotParts[^1]; + if (scopes.Contains($"{service}:{action}") || scopes.Contains($"{service}:admin")) + { + return; + } + // Also check "operate" scope for write/manage actions + if (action is "write" or "manage" or "preview" && scopes.Contains($"{service}:operate")) + { + return; + } + } + + throw new InvalidOperationException($"Missing required scope '{requiredScope}'."); } } diff --git a/src/Signals/__Libraries/StellaOps.Signals.Ebpf/Schema/RuntimeCallEvent.cs b/src/Signals/__Libraries/StellaOps.Signals.Ebpf/Schema/RuntimeCallEvent.cs index 6979d5b0f..9f3b1e1b5 100644 --- a/src/Signals/__Libraries/StellaOps.Signals.Ebpf/Schema/RuntimeCallEvent.cs +++ b/src/Signals/__Libraries/StellaOps.Signals.Ebpf/Schema/RuntimeCallEvent.cs @@ -204,6 +204,42 @@ public sealed record ObservedCallPath public IReadOnlyList? BinaryOffsets { get; init; } } +/// +/// Metadata describing which BTF source was selected for probe loading. +/// +public sealed record RuntimeBtfSelection +{ + /// + /// Selected BTF source kind (kernel, external-vmlinux, split-btf, unsupported, unavailable). + /// + public required string SourceKind { get; init; } + + /// + /// Absolute path of the selected BTF source. + /// + public string? SourcePath { get; init; } + + /// + /// SHA-256 digest of the selected BTF source. + /// + public string? SourceDigest { get; init; } + + /// + /// Deterministic reason for the selected source. + /// + public required string SelectionReason { get; init; } + + /// + /// Kernel release used for BTF lookup. + /// + public required string KernelRelease { get; init; } + + /// + /// Kernel architecture used for BTF lookup. + /// + public required string KernelArch { get; init; } +} + /// /// Summary of runtime signals collected for a container. /// @@ -265,6 +301,11 @@ public sealed record RuntimeSignalSummary /// Combined hash of all observed paths for summary-level identity. /// public string? CombinedPathHash { get; init; } + + /// + /// BTF source metadata selected for this runtime collection. + /// + public RuntimeBtfSelection? BtfSelection { get; init; } } /// diff --git a/src/Web/StellaOps.Web/angular.json b/src/Web/StellaOps.Web/angular.json index 86cda742b..339561027 100644 --- a/src/Web/StellaOps.Web/angular.json +++ b/src/Web/StellaOps.Web/angular.json @@ -33,6 +33,7 @@ "assets": [ "src/favicon.ico", "src/assets", + "src/manifest.webmanifest", { "glob": "config.json", "input": "src/config", diff --git a/src/Web/StellaOps.Web/debug-auth.mjs b/src/Web/StellaOps.Web/debug-auth.mjs new file mode 100644 index 000000000..7c9f41ed1 --- /dev/null +++ b/src/Web/StellaOps.Web/debug-auth.mjs @@ -0,0 +1,114 @@ +import { chromium } from 'playwright'; + +const BASE = 'http://127.1.0.5'; + +(async () => { + const browser = await chromium.launch({ headless: true }); + const context = await browser.newContext({ ignoreHTTPSErrors: true }); + const page = await context.newPage(); + + // Step 1: Sign in + console.log('=== SIGNING IN ==='); + await page.goto(BASE + '/', { waitUntil: 'networkidle', timeout: 15000 }); + + const signInBtn = page.locator('button:has-text("Sign In"), a:has-text("Sign In"), [routerLink*="auth"]').first(); + try { await signInBtn.click({ timeout: 5000 }); } catch { await page.goto(BASE + '/auth/login', { waitUntil: 'networkidle', timeout: 10000 }); } + await page.waitForTimeout(2000); + + try { + await page.locator('input[name="Username"], input[name="username"], input[type="text"]').first().fill('admin', { timeout: 5000 }); + await page.locator('input[name="Password"], input[name="password"], input[type="password"]').first().fill('Admin@Stella2026!'); + await page.locator('button[type="submit"], button:has-text("Log in"), button:has-text("Login"), button:has-text("Sign in")').first().click(); + await page.waitForTimeout(4000); + } catch (e) { + console.log('Login error: ' + e.message); + } + + console.log('After login: ' + page.url()); + + // Step 2: Check auth session state + const authState = await page.evaluate(() => { + // Check sessionStorage and localStorage for tokens + const keys = []; + for (let i = 0; i < sessionStorage.length; i++) keys.push('session:' + sessionStorage.key(i)); + for (let i = 0; i < localStorage.length; i++) keys.push('local:' + localStorage.key(i)); + return { keys, url: window.location.href }; + }); + console.log('Storage keys:', JSON.stringify(authState.keys)); + + // Step 3: Navigate to scheduler and capture FULL request details + console.log('\n=== CAPTURING SCHEDULER REQUEST ==='); + + page.on('request', (request) => { + const url = request.url(); + if (url.includes('/scheduler/') || url.includes('/api/v1/scheduler')) { + console.log('\nREQUEST:'); + console.log(' URL: ' + url); + console.log(' Method: ' + request.method()); + const headers = request.headers(); + console.log(' Authorization: ' + (headers['authorization'] || 'NONE')); + console.log(' DPoP: ' + (headers['dpop'] ? headers['dpop'].substring(0, 80) + '...' : 'NONE')); + console.log(' X-StellaOps-Tenant: ' + (headers['x-stellaops-tenant'] || 'NONE')); + console.log(' X-Tenant-Id: ' + (headers['x-tenant-id'] || 'NONE')); + console.log(' X-Scopes: ' + (headers['x-scopes'] || 'not set by client')); + } + }); + + page.on('response', async (response) => { + const url = response.url(); + if (url.includes('/scheduler/') || url.includes('/api/v1/scheduler')) { + console.log('\nRESPONSE:'); + console.log(' URL: ' + url); + console.log(' Status: ' + response.status()); + try { + const body = await response.text(); + console.log(' Body: ' + body.substring(0, 300)); + } catch {} + } + }); + + // Also capture token endpoint requests + page.on('request', (request) => { + const url = request.url(); + if (url.includes('/connect/token') || url.includes('/authority/connect/token')) { + console.log('\nTOKEN REQUEST: ' + url); + console.log(' Method: ' + request.method()); + } + }); + page.on('response', async (response) => { + const url = response.url(); + if (url.includes('/connect/token') || url.includes('/authority/connect/token')) { + console.log('TOKEN RESPONSE: ' + response.status()); + } + }); + + await page.evaluate((r) => { + window.history.pushState({}, '', r); + window.dispatchEvent(new PopStateEvent('popstate')); + }, '/operations/scheduler'); + + await page.waitForTimeout(5000); + + // Step 4: Also check what the Angular app thinks its auth state is + const appAuthState = await page.evaluate(() => { + try { + // Try to access Angular's injector + const appRef = window.ng?.getComponent(document.querySelector('app-root')); + return { hasAppRef: !!appRef }; + } catch { + return { hasAppRef: false }; + } + }); + console.log('\nApp auth state:', JSON.stringify(appAuthState)); + + // Check console errors + page.on('console', (msg) => { + if (msg.type() === 'error' || msg.type() === 'warn') { + console.log('CONSOLE [' + msg.type() + ']: ' + msg.text().substring(0, 200)); + } + }); + + await page.waitForTimeout(2000); + + await browser.close(); +})(); diff --git a/src/Web/StellaOps.Web/probe-services.mjs b/src/Web/StellaOps.Web/probe-services.mjs new file mode 100644 index 000000000..b95bb6618 --- /dev/null +++ b/src/Web/StellaOps.Web/probe-services.mjs @@ -0,0 +1,65 @@ +import { chromium } from 'playwright'; + +const BASE = 'http://127.1.0.5'; + +(async () => { + const browser = await chromium.launch({ headless: true }); + const context = await browser.newContext({ ignoreHTTPSErrors: true }); + const page = await context.newPage(); + + // Sign in + console.log('=== SIGNING IN ==='); + await page.goto(BASE + '/', { waitUntil: 'networkidle', timeout: 15000 }); + const signInBtn = page.locator('button:has-text("Sign In"), a:has-text("Sign In")').first(); + try { await signInBtn.click({ timeout: 5000 }); } catch {} + await page.waitForTimeout(2000); + try { + await page.locator('input[name="Username"], input[type="text"]').first().fill('admin', { timeout: 5000 }); + await page.locator('input[type="password"]').first().fill('Admin@Stella2026!'); + await page.locator('button[type="submit"]').first().click(); + await page.waitForTimeout(4000); + } catch (e) { console.log('Login error: ' + e.message); } + console.log('Signed in: ' + page.url()); + + // Probe specific failing pages + const failPages = [ + '/operations/scheduler', + '/operations/notifications', + '/evidence/bundles', + '/policy', + ]; + + for (const route of failPages) { + const apiCalls = []; + + page.on('response', async (response) => { + const url = response.url(); + if (url.startsWith(BASE) && !url.includes('.js') && !url.includes('.css') && !url.includes('.html') && !url.includes('/config.json') && !url.includes('.ico')) { + const path = new URL(url).pathname; + if (path.startsWith('/api/') || path.startsWith('/v1/') || path.startsWith('/scheduler/') || + path.startsWith('/doctor/') || path.startsWith('/console/') || path.startsWith('/health')) { + let body = ''; + try { body = await response.text(); } catch {} + apiCalls.push({ path, status: response.status(), body: body.substring(0, 200) }); + } + } + }); + + await page.evaluate((r) => { + window.history.pushState({}, '', r); + window.dispatchEvent(new PopStateEvent('popstate')); + }, route); + + await page.waitForTimeout(4000); + page.removeAllListeners('response'); + + console.log('\n--- ' + route + ' ---'); + for (const c of apiCalls) { + console.log(' ' + c.status + ' ' + c.path); + if (c.status >= 400) console.log(' Body: ' + c.body); + } + if (apiCalls.length === 0) console.log(' NO API CALLS'); + } + + await browser.close(); +})(); diff --git a/src/Web/StellaOps.Web/proxy.conf.json b/src/Web/StellaOps.Web/proxy.conf.json index 3ce635df6..2ab7fba18 100644 --- a/src/Web/StellaOps.Web/proxy.conf.json +++ b/src/Web/StellaOps.Web/proxy.conf.json @@ -1,54 +1,54 @@ { "/envsettings.json": { - "target": "http://127.1.0.3:80", + "target": "http://127.1.0.5:80", "secure": false }, "/platform": { - "target": "http://127.1.0.3:80", + "target": "http://127.1.0.5:80", "secure": false }, "/api": { - "target": "http://127.1.0.3:80", + "target": "http://127.1.0.5:80", "secure": false }, "/authority": { - "target": "http://127.1.0.4:80", + "target": "http://127.1.0.5:80", "secure": false }, "/console": { - "target": "http://127.1.0.4:80", + "target": "http://127.1.0.5:80", "secure": false }, "/connect": { - "target": "http://127.1.0.4:80", + "target": "http://127.1.0.5:80", "secure": false }, "/.well-known": { - "target": "http://127.1.0.4:80", + "target": "http://127.1.0.5:80", "secure": false }, "/jwks": { - "target": "http://127.1.0.4:80", + "target": "http://127.1.0.5:80", "secure": false }, "/scanner": { - "target": "http://127.1.0.8:80", + "target": "http://127.1.0.5:80", "secure": false }, "/policyGateway": { - "target": "http://127.1.0.14:80", + "target": "http://127.1.0.5:80", "secure": false }, "/policyEngine": { - "target": "http://127.1.0.14:80", + "target": "http://127.1.0.5:80", "secure": false }, "/concelier": { - "target": "http://127.1.0.9:80", + "target": "http://127.1.0.5:80", "secure": false }, "/attestor": { - "target": "http://127.1.0.13:80", + "target": "http://127.1.0.5:80", "secure": false }, "/gateway": { @@ -56,59 +56,67 @@ "secure": false }, "/notify": { - "target": "http://127.1.0.29:80", + "target": "http://127.1.0.5:80", "secure": false }, "/scheduler": { - "target": "http://127.1.0.19:80", + "target": "http://127.1.0.5:80", "secure": false }, "/signals": { - "target": "http://127.1.0.43:80", + "target": "http://127.1.0.5:80", "secure": false }, "/excititor": { - "target": "http://127.1.0.9:80", + "target": "http://127.1.0.5:80", "secure": false }, "/findingsLedger": { - "target": "http://127.1.0.9:80", + "target": "http://127.1.0.5:80", "secure": false }, "/vexhub": { - "target": "http://127.1.0.11:80", + "target": "http://127.1.0.5:80", "secure": false }, "/vexlens": { - "target": "http://127.1.0.12:80", + "target": "http://127.1.0.5:80", "secure": false }, "/orchestrator": { - "target": "http://127.1.0.17:80", + "target": "http://127.1.0.5:80", "secure": false }, "/graph": { - "target": "http://127.1.0.20:80", + "target": "http://127.1.0.5:80", "secure": false }, "/doctor": { - "target": "http://127.1.0.26:80", + "target": "http://127.1.0.5:80", "secure": false }, "/integrations": { - "target": "http://127.1.0.42:80", + "target": "http://127.1.0.5:80", "secure": false }, "/replay": { - "target": "http://127.1.0.41:80", + "target": "http://127.1.0.5:80", "secure": false }, "/exportcenter": { - "target": "http://127.1.0.40:80", + "target": "http://127.1.0.5:80", "secure": false }, "/healthz": { - "target": "http://127.1.0.3:80", + "target": "http://127.1.0.5:80", + "secure": false + }, + "/policy": { + "target": "http://127.1.0.5:80", + "secure": false + }, + "/v1": { + "target": "http://127.1.0.5:80", "secure": false } } diff --git a/src/Web/StellaOps.Web/scan-pages.mjs b/src/Web/StellaOps.Web/scan-pages.mjs new file mode 100644 index 000000000..eb1c05276 --- /dev/null +++ b/src/Web/StellaOps.Web/scan-pages.mjs @@ -0,0 +1,105 @@ +import { chromium } from 'playwright'; + +const BASE = 'http://127.1.0.5'; + +const routes = [ + '/security', + '/security/findings', + '/security/exceptions', + '/security/vex', + '/security/vulnerabilities', + '/operations/scheduler', + '/operations/doctor', + '/operations/feeds', + '/operations/notifications', + '/operations/health', + '/evidence/bundles', + '/evidence/export', + '/releases', + '/releases/environments', + '/approvals', + '/policy', + '/policy/governance', + '/triage', + '/sources', + '/analytics', + '/settings/admin', +]; + +(async () => { + const browser = await chromium.launch({ headless: true }); + const context = await browser.newContext({ ignoreHTTPSErrors: true }); + const page = await context.newPage(); + + // Step 1: Sign in + console.log('=== SIGNING IN ==='); + await page.goto(BASE + '/', { waitUntil: 'networkidle', timeout: 15000 }); + + // Click sign in button + const signInBtn = page.locator('button:has-text("Sign In"), a:has-text("Sign In"), [routerLink*="auth"]').first(); + try { + await signInBtn.click({ timeout: 5000 }); + } catch { + await page.goto(BASE + '/auth/login', { waitUntil: 'networkidle', timeout: 10000 }); + } + await page.waitForTimeout(2000); + + console.log('Login page URL: ' + page.url()); + + try { + const usernameInput = page.locator('input[name="Username"], input[name="username"], input[type="text"]').first(); + const passwordInput = page.locator('input[name="Password"], input[name="password"], input[type="password"]').first(); + + await usernameInput.fill('admin', { timeout: 5000 }); + await passwordInput.fill('Admin@Stella2026!'); + + const loginBtn = page.locator('button[type="submit"], button:has-text("Log in"), button:has-text("Login"), button:has-text("Sign in")').first(); + await loginBtn.click(); + await page.waitForTimeout(3000); + console.log('After login URL: ' + page.url()); + } catch (e) { + console.log('Login form error: ' + e.message); + } + + await page.waitForTimeout(2000); + console.log('Final URL after auth: ' + page.url()); + + // Step 2: Navigate to each route using pushState + console.log('\n=== PAGE SCAN (with fresh token) ==='); + + for (const route of routes) { + const apiCalls = []; + + const handler = (response) => { + const url = response.url(); + if (!url.includes('.js') && !url.includes('.css') && !url.includes('.ico') && + !url.includes('.png') && !url.includes('.svg') && !url.includes('.woff') && + !url.includes('/config.json') && !url.includes('.html') && + !url.startsWith('data:') && url.startsWith(BASE)) { + const path = new URL(url).pathname; + if (path.startsWith('/api/') || path.startsWith('/v1/') || path.startsWith('/platform/') || + path.startsWith('/scanner/') || path.startsWith('/policy/') || path.startsWith('/scheduler/') || + path.startsWith('/doctor/') || path.startsWith('/authority/') || path.startsWith('/console/') || + path.startsWith('/concelier/') || path.startsWith('/attestor/') || path.startsWith('/analytics') || + path.startsWith('/health')) { + apiCalls.push({ path, status: response.status() }); + } + } + }; + + page.on('response', handler); + + await page.evaluate((r) => { + window.history.pushState({}, '', r); + window.dispatchEvent(new PopStateEvent('popstate')); + }, route); + + await page.waitForTimeout(3000); + page.removeListener('response', handler); + + const callSummary = apiCalls.map(c => c.status + ' ' + c.path).join(', ') || 'NO API CALLS'; + console.log(route + ': ' + callSummary); + } + + await browser.close(); +})(); diff --git a/src/Web/StellaOps.Web/scheduler-debug.png b/src/Web/StellaOps.Web/scheduler-debug.png new file mode 100644 index 000000000..9d1ff85f1 Binary files /dev/null and b/src/Web/StellaOps.Web/scheduler-debug.png differ diff --git a/src/Web/StellaOps.Web/src/app/app.config.ts b/src/Web/StellaOps.Web/src/app/app.config.ts index 75ae72143..a2fb2d5da 100644 --- a/src/Web/StellaOps.Web/src/app/app.config.ts +++ b/src/Web/StellaOps.Web/src/app/app.config.ts @@ -21,15 +21,17 @@ import { NOTIFY_API_BASE_URL, NOTIFY_TENANT_ID, NotifyApiHttpClient, + MockNotifyClient, } from './core/api/notify.client'; import { EXCEPTION_API, EXCEPTION_API_BASE_URL, ExceptionApiHttpClient, + MockExceptionApiService, } from './core/api/exception.client'; -import { VULNERABILITY_API } from './core/api/vulnerability.client'; +import { VULNERABILITY_API, MockVulnerabilityApiService } from './core/api/vulnerability.client'; import { VULNERABILITY_API_BASE_URL, VulnerabilityHttpClient } from './core/api/vulnerability-http.client'; -import { RISK_API } from './core/api/risk.client'; +import { RISK_API, MockRiskApi } from './core/api/risk.client'; import { RISK_API_BASE_URL, RiskHttpClient } from './core/api/risk-http.client'; import { AppConfigService } from './core/config/app-config.service'; import { BackendProbeService } from './core/config/backend-probe.service'; @@ -37,6 +39,7 @@ import { AuthHttpInterceptor } from './core/auth/auth-http.interceptor'; import { AuthSessionStore } from './core/auth/auth-session.store'; import { TenantActivationService } from './core/auth/tenant-activation.service'; import { OperatorMetadataInterceptor } from './core/orchestrator/operator-metadata.interceptor'; +import { TenantHttpInterceptor } from './core/auth/tenant-http.interceptor'; import { seedAuthSession, type StubAuthSession } from './testing'; import { CVSS_API_BASE_URL } from './core/api/cvss.client'; import { AUTH_SERVICE } from './core/auth'; @@ -46,32 +49,38 @@ import { ADVISORY_AI_API, ADVISORY_AI_API_BASE_URL, AdvisoryAiApiHttpClient, + MockAdvisoryAiClient, } from './core/api/advisory-ai.client'; import { ADVISORY_API, ADVISORY_API_BASE_URL, AdvisoryApiHttpClient, + MockAdvisoryApiService, } from './core/api/advisories.client'; import { VEX_EVIDENCE_API, VEX_EVIDENCE_API_BASE_URL, VexEvidenceHttpClient, + MockVexEvidenceClient, } from './core/api/vex-evidence.client'; import { VEX_DECISIONS_API, VEX_DECISIONS_API_BASE_URL, VexDecisionsHttpClient, + MockVexDecisionsClient, } from './core/api/vex-decisions.client'; -import { VEX_HUB_API, VEX_HUB_API_BASE_URL, VEX_LENS_API_BASE_URL, VexHubApiHttpClient } from './core/api/vex-hub.client'; +import { VEX_HUB_API, VEX_HUB_API_BASE_URL, VEX_LENS_API_BASE_URL, VexHubApiHttpClient, MockVexHubClient } from './core/api/vex-hub.client'; import { AUDIT_BUNDLES_API, AUDIT_BUNDLES_API_BASE_URL, AuditBundlesHttpClient, + MockAuditBundlesClient, } from './core/api/audit-bundles.client'; import { POLICY_EXCEPTIONS_API, POLICY_EXCEPTIONS_API_BASE_URL, PolicyExceptionsHttpClient, + MockPolicyExceptionsApiService, } from './core/api/policy-exceptions.client'; import { POLICY_EVIDENCE_API, @@ -81,29 +90,35 @@ import { ORCHESTRATOR_API, ORCHESTRATOR_API_BASE_URL, OrchestratorHttpClient, + MockOrchestratorClient, } from './core/api/orchestrator.client'; import { ORCHESTRATOR_CONTROL_API, OrchestratorControlHttpClient, + MockOrchestratorControlClient, } from './core/api/orchestrator-control.client'; import { FIRST_SIGNAL_API, FirstSignalHttpClient, + MockFirstSignalClient, } from './core/api/first-signal.client'; import { EXCEPTION_EVENTS_API, EXCEPTION_EVENTS_API_BASE_URL, ExceptionEventsHttpClient, + MockExceptionEventsApiService, } from './core/api/exception-events.client'; import { EVIDENCE_PACK_API, EVIDENCE_PACK_API_BASE_URL, EvidencePackHttpClient, + MockEvidencePackClient, } from './core/api/evidence-pack.client'; import { AI_RUNS_API, AI_RUNS_API_BASE_URL, AiRunsHttpClient, + MockAiRunsClient, } from './core/api/ai-runs.client'; import { RELEASE_DASHBOARD_API, @@ -115,30 +130,37 @@ import { RELEASE_ENVIRONMENT_API, RELEASE_ENVIRONMENT_API_BASE_URL, ReleaseEnvironmentHttpClient, + MockReleaseEnvironmentClient, } from './core/api/release-environment.client'; import { RELEASE_MANAGEMENT_API, ReleaseManagementHttpClient, + MockReleaseManagementClient, } from './core/api/release-management.client'; import { WORKFLOW_API, WorkflowHttpClient, + MockWorkflowClient, } from './core/api/workflow.client'; import { APPROVAL_API, ApprovalHttpClient, + MockApprovalClient, } from './core/api/approval.client'; import { DEPLOYMENT_API, DeploymentHttpClient, + MockDeploymentClient, } from './core/api/deployment.client'; import { RELEASE_EVIDENCE_API, ReleaseEvidenceHttpClient, + MockReleaseEvidenceClient, } from './core/api/release-evidence.client'; import { DOCTOR_API, HttpDoctorClient, + MockDoctorClient, } from './features/doctor/services/doctor.client'; import { WITNESS_API, @@ -148,18 +170,22 @@ import { NOTIFIER_API, NOTIFIER_API_BASE_URL, NotifierApiHttpClient, + MockNotifierClient, } from './core/api/notifier.client'; import { POLICY_ENGINE_API, PolicyEngineHttpClient, + MockPolicyEngineApi, } from './core/api/policy-engine.client'; import { TRUST_API, TrustHttpService, + MockTrustApiService, } from './core/api/trust.client'; import { VULN_ANNOTATION_API, HttpVulnAnnotationClient, + MockVulnAnnotationClient, } from './core/api/vuln-annotation.client'; import { AUTHORITY_ADMIN_API, @@ -171,16 +197,46 @@ import { SECURITY_FINDINGS_API, SECURITY_FINDINGS_API_BASE_URL, SecurityFindingsHttpClient, + MockSecurityFindingsClient, } from './core/api/security-findings.client'; import { SECURITY_OVERVIEW_API, SecurityOverviewHttpClient, + MockSecurityOverviewClient, } from './core/api/security-overview.client'; +import { + CONSOLE_VULN_API, + ConsoleVulnHttpClient, + MockConsoleVulnClient, +} from './core/api/console-vuln.client'; +import { + REACHABILITY_API, + ReachabilityClient, + MockReachabilityApi, +} from './core/api/reachability.client'; import { SCHEDULER_API, SCHEDULER_API_BASE_URL, SchedulerHttpClient, + MockSchedulerClient, } from './core/api/scheduler.client'; +import { AnalyticsHttpClient, MockAnalyticsClient } from './core/api/analytics.client'; +import { FEED_MIRROR_API, FEED_MIRROR_API_BASE_URL, FeedMirrorHttpClient } from './core/api/feed-mirror.client'; +import { ATTESTATION_CHAIN_API, AttestationChainHttpClient } from './core/api/attestation-chain.client'; +import { CONSOLE_SEARCH_API, ConsoleSearchHttpClient } from './core/api/console-search.client'; +import { POLICY_GOVERNANCE_API, HttpPolicyGovernanceApi } from './core/api/policy-governance.client'; +import { POLICY_GATES_API, POLICY_GATES_API_BASE_URL, PolicyGatesHttpClient } from './core/api/policy-gates.client'; +import { RELEASE_API, ReleaseHttpClient } from './core/api/release.client'; +import { TRIAGE_EVIDENCE_API, TriageEvidenceHttpClient } from './core/api/triage-evidence.client'; +import { VERDICT_API, HttpVerdictClient } from './core/api/verdict.client'; +import { WATCHLIST_API, WatchlistHttpClient } from './core/api/watchlist.client'; +import { EVIDENCE_API, EVIDENCE_API_BASE_URL, EvidenceHttpClient } from './core/api/evidence.client'; +import { SBOM_EVIDENCE_API, SbomEvidenceService } from './features/sbom/services/sbom-evidence.service'; +import { HttpReplayClient } from './core/api/replay.client'; +import { REPLAY_API } from './features/proofs/proof-replay-dashboard.component'; +import { HttpScoreClient } from './core/api/score.client'; +import { SCORE_API } from './features/scores/score-comparison.component'; +import { AOC_API, AOC_API_BASE_URL, AOC_SOURCES_API_BASE_URL, AocHttpClient } from './core/api/aoc.client'; export const appConfig: ApplicationConfig = { providers: [ @@ -207,6 +263,11 @@ export const appConfig: ApplicationConfig = { useClass: OperatorMetadataInterceptor, multi: true, }, + { + provide: HTTP_INTERCEPTORS, + useClass: TenantHttpInterceptor, + multi: true, + }, { provide: CONCELIER_EXPORTER_API_BASE_URL, useValue: '/api/v1/concelier/exporters/trivy-db', @@ -278,6 +339,7 @@ export const appConfig: ApplicationConfig = { }, }, RiskHttpClient, + MockRiskApi, { provide: RISK_API, useExisting: RiskHttpClient, @@ -298,6 +360,7 @@ export const appConfig: ApplicationConfig = { }, }, VulnerabilityHttpClient, + MockVulnerabilityApiService, { provide: VULNERABILITY_API, useExisting: VulnerabilityHttpClient, @@ -329,6 +392,7 @@ export const appConfig: ApplicationConfig = { }, }, AdvisoryAiApiHttpClient, + MockAdvisoryAiClient, { provide: ADVISORY_AI_API, useExisting: AdvisoryAiApiHttpClient, @@ -342,6 +406,7 @@ export const appConfig: ApplicationConfig = { }, }, AdvisoryApiHttpClient, + MockAdvisoryApiService, { provide: ADVISORY_API, useExisting: AdvisoryApiHttpClient, @@ -381,11 +446,13 @@ export const appConfig: ApplicationConfig = { }, }, VexHubApiHttpClient, + MockVexHubClient, { provide: VEX_HUB_API, useExisting: VexHubApiHttpClient, }, VexEvidenceHttpClient, + MockVexEvidenceClient, { provide: VEX_EVIDENCE_API, useExisting: VexEvidenceHttpClient, @@ -399,6 +466,7 @@ export const appConfig: ApplicationConfig = { }, }, VexDecisionsHttpClient, + MockVexDecisionsClient, { provide: VEX_DECISIONS_API, useExisting: VexDecisionsHttpClient, @@ -412,6 +480,7 @@ export const appConfig: ApplicationConfig = { }, }, AuditBundlesHttpClient, + MockAuditBundlesClient, { provide: AUDIT_BUNDLES_API, useExisting: AuditBundlesHttpClient, @@ -425,6 +494,7 @@ export const appConfig: ApplicationConfig = { }, }, PolicyExceptionsHttpClient, + MockPolicyExceptionsApiService, { provide: POLICY_EXCEPTIONS_API, useExisting: PolicyExceptionsHttpClient, @@ -443,16 +513,19 @@ export const appConfig: ApplicationConfig = { }, }, OrchestratorHttpClient, + MockOrchestratorClient, { provide: ORCHESTRATOR_API, useExisting: OrchestratorHttpClient, }, OrchestratorControlHttpClient, + MockOrchestratorControlClient, { provide: ORCHESTRATOR_CONTROL_API, useExisting: OrchestratorControlHttpClient, }, FirstSignalHttpClient, + MockFirstSignalClient, { provide: FIRST_SIGNAL_API, useExisting: FirstSignalHttpClient, @@ -466,6 +539,7 @@ export const appConfig: ApplicationConfig = { }, }, ExceptionEventsHttpClient, + MockExceptionEventsApiService, { provide: EXCEPTION_EVENTS_API, useExisting: ExceptionEventsHttpClient, @@ -475,10 +549,16 @@ export const appConfig: ApplicationConfig = { deps: [AppConfigService], useFactory: (config: AppConfigService) => { const gatewayBase = config.config.apiBaseUrls.gateway ?? config.config.apiBaseUrls.authority; - return gatewayBase.endsWith('/') ? gatewayBase.slice(0, -1) : gatewayBase; + try { + return new URL('/api/policy', gatewayBase).toString(); + } catch { + const normalized = gatewayBase.endsWith('/') ? gatewayBase.slice(0, -1) : gatewayBase; + return `${normalized}/api/policy`; + } }, }, ExceptionApiHttpClient, + MockExceptionApiService, { provide: EXCEPTION_API, useExisting: ExceptionApiHttpClient, @@ -497,6 +577,7 @@ export const appConfig: ApplicationConfig = { }, }, EvidencePackHttpClient, + MockEvidencePackClient, { provide: EVIDENCE_PACK_API, useExisting: EvidencePackHttpClient, @@ -515,6 +596,7 @@ export const appConfig: ApplicationConfig = { }, }, AiRunsHttpClient, + MockAiRunsClient, { provide: AI_RUNS_API, useExisting: AiRunsHttpClient, @@ -543,11 +625,12 @@ export const appConfig: ApplicationConfig = { useValue: 'tenant-dev', }, NotifyApiHttpClient, + MockNotifyClient, { provide: NOTIFY_API, useExisting: NotifyApiHttpClient, }, - // Release Dashboard API + // Release Dashboard API (using mock - no backend endpoint yet) { provide: RELEASE_DASHBOARD_API_BASE_URL, deps: [AppConfigService], @@ -582,42 +665,49 @@ export const appConfig: ApplicationConfig = { }, }, ReleaseEnvironmentHttpClient, + MockReleaseEnvironmentClient, { provide: RELEASE_ENVIRONMENT_API, useExisting: ReleaseEnvironmentHttpClient, }, - // Release Management API (Sprint 111_003) + // Release Management API (Sprint 111_003 - using mock until backend is available) ReleaseManagementHttpClient, + MockReleaseManagementClient, { provide: RELEASE_MANAGEMENT_API, useExisting: ReleaseManagementHttpClient, }, - // Workflow API (Sprint 111_004) + // Workflow API (Sprint 111_004 - using mock until backend is available) WorkflowHttpClient, + MockWorkflowClient, { provide: WORKFLOW_API, useExisting: WorkflowHttpClient, }, - // Approval API (Sprint 111_005) + // Approval API (using mock - no backend endpoint yet) ApprovalHttpClient, + MockApprovalClient, { provide: APPROVAL_API, useExisting: ApprovalHttpClient, }, - // Deployment API (Sprint 111_006) + // Deployment API (Sprint 111_006 - using mock until backend is available) DeploymentHttpClient, + MockDeploymentClient, { provide: DEPLOYMENT_API, useExisting: DeploymentHttpClient, }, - // Release Evidence API (Sprint 111_007) + // Release Evidence API (Sprint 111_007 - using mock until backend is available) ReleaseEvidenceHttpClient, + MockReleaseEvidenceClient, { provide: RELEASE_EVIDENCE_API, useExisting: ReleaseEvidenceHttpClient, }, - // Doctor API (Sprint 20260112_001_008) + // Doctor API (HTTP paths corrected; using mock until gateway auth chain is configured) HttpDoctorClient, + MockDoctorClient, { provide: DOCTOR_API, useExisting: HttpDoctorClient, @@ -643,22 +733,28 @@ export const appConfig: ApplicationConfig = { }, }, NotifierApiHttpClient, + MockNotifierClient, { provide: NOTIFIER_API, useExisting: NotifierApiHttpClient, }, - // Policy Engine API (Bug fix: missing DI provider caused NG0201 on /policy/packs) + // Policy Engine API + PolicyEngineHttpClient, + MockPolicyEngineApi, { provide: POLICY_ENGINE_API, useExisting: PolicyEngineHttpClient, }, - // Trust API (Bug fix: missing DI provider caused NG0201 on /admin/trust) + // Trust API + TrustHttpService, + MockTrustApiService, { provide: TRUST_API, useExisting: TrustHttpService, }, - // Vuln Annotation API (Bug fix: missing DI provider caused NG0201 on /vulnerabilities/triage) + // Vuln Annotation API (using mock until backend is available) HttpVulnAnnotationClient, + MockVulnAnnotationClient, { provide: VULN_ANNOTATION_API, useExisting: HttpVulnAnnotationClient, @@ -674,27 +770,24 @@ export const appConfig: ApplicationConfig = { provide: AUTHORITY_ADMIN_API, useExisting: AuthorityAdminHttpClient, }, - // Security Findings API (scanner findings via gateway) + // Security Findings API (findings ledger via gateway) { provide: SECURITY_FINDINGS_API_BASE_URL, deps: [AppConfigService], useFactory: (config: AppConfigService) => { const gatewayBase = config.config.apiBaseUrls.gateway ?? config.config.apiBaseUrls.authority; - try { - return new URL('/scanner', gatewayBase).toString(); - } catch { - const normalized = gatewayBase.endsWith('/') ? gatewayBase.slice(0, -1) : gatewayBase; - return `${normalized}/scanner`; - } + return gatewayBase.endsWith('/') ? gatewayBase.slice(0, -1) : gatewayBase; }, }, SecurityFindingsHttpClient, + MockSecurityFindingsClient, { provide: SECURITY_FINDINGS_API, useExisting: SecurityFindingsHttpClient, }, // Security Overview API (aggregated security dashboard data) SecurityOverviewHttpClient, + MockSecurityOverviewClient, { provide: SECURITY_OVERVIEW_API, useExisting: SecurityOverviewHttpClient, @@ -706,17 +799,180 @@ export const appConfig: ApplicationConfig = { useFactory: (config: AppConfigService) => { const gatewayBase = config.config.apiBaseUrls.gateway ?? config.config.apiBaseUrls.authority; try { - return new URL('/scheduler', gatewayBase).toString(); + return new URL('/scheduler/api/v1/scheduler', gatewayBase).toString(); } catch { const normalized = gatewayBase.endsWith('/') ? gatewayBase.slice(0, -1) : gatewayBase; - return `${normalized}/scheduler`; + return `${normalized}/scheduler/api/v1/scheduler`; } }, }, SchedulerHttpClient, + MockSchedulerClient, { provide: SCHEDULER_API, useExisting: SchedulerHttpClient, }, + // Console Vuln API + ConsoleVulnHttpClient, + MockConsoleVulnClient, + { + provide: CONSOLE_VULN_API, + useExisting: ConsoleVulnHttpClient, + }, + // Reachability API + ReachabilityClient, + MockReachabilityApi, + { + provide: REACHABILITY_API, + useExisting: ReachabilityClient, + }, + // Analytics API + AnalyticsHttpClient, + // Feed Mirror API (Concelier backend via gateway) + { + provide: FEED_MIRROR_API_BASE_URL, + deps: [AppConfigService], + useFactory: (config: AppConfigService) => { + const gatewayBase = config.config.apiBaseUrls.gateway ?? config.config.apiBaseUrls.authority; + try { + return new URL('/api/v1/concelier', gatewayBase).toString(); + } catch { + const normalized = gatewayBase.endsWith('/') ? gatewayBase.slice(0, -1) : gatewayBase; + return `${normalized}/api/v1/concelier`; + } + }, + }, + FeedMirrorHttpClient, + { + provide: FEED_MIRROR_API, + useExisting: FeedMirrorHttpClient, + }, + // Attestation Chain API + AttestationChainHttpClient, + { + provide: ATTESTATION_CHAIN_API, + useExisting: AttestationChainHttpClient, + }, + // Console Search API + ConsoleSearchHttpClient, + { + provide: CONSOLE_SEARCH_API, + useExisting: ConsoleSearchHttpClient, + }, + // Policy Governance API + HttpPolicyGovernanceApi, + { + provide: POLICY_GOVERNANCE_API, + useExisting: HttpPolicyGovernanceApi, + }, + // Policy Gates API (Policy Gateway backend) + { + provide: POLICY_GATES_API_BASE_URL, + deps: [AppConfigService], + useFactory: (config: AppConfigService) => { + const gatewayBase = config.config.apiBaseUrls.gateway ?? config.config.apiBaseUrls.authority; + try { + return new URL('/api/policy', gatewayBase).toString(); + } catch { + const normalized = gatewayBase.endsWith('/') ? gatewayBase.slice(0, -1) : gatewayBase; + return `${normalized}/api/policy`; + } + }, + }, + PolicyGatesHttpClient, + { + provide: POLICY_GATES_API, + useExisting: PolicyGatesHttpClient, + }, + // Release API (Release Orchestrator backend) + ReleaseHttpClient, + { + provide: RELEASE_API, + useExisting: ReleaseHttpClient, + }, + // Triage Evidence API + TriageEvidenceHttpClient, + { + provide: TRIAGE_EVIDENCE_API, + useExisting: TriageEvidenceHttpClient, + }, + // Verdict API + HttpVerdictClient, + { + provide: VERDICT_API, + useExisting: HttpVerdictClient, + }, + // Watchlist API + WatchlistHttpClient, + { + provide: WATCHLIST_API, + useExisting: WatchlistHttpClient, + }, + // Evidence API (Evidence Locker backend via gateway) + { + provide: EVIDENCE_API_BASE_URL, + deps: [AppConfigService], + useFactory: (config: AppConfigService) => { + const gatewayBase = config.config.apiBaseUrls.gateway ?? config.config.apiBaseUrls.authority; + try { + return new URL('/api/v1/evidence', gatewayBase).toString(); + } catch { + const normalized = gatewayBase.endsWith('/') ? gatewayBase.slice(0, -1) : gatewayBase; + return `${normalized}/api/v1/evidence`; + } + }, + }, + EvidenceHttpClient, + { + provide: EVIDENCE_API, + useExisting: EvidenceHttpClient, + }, + // SBOM Evidence API + SbomEvidenceService, + { + provide: SBOM_EVIDENCE_API, + useExisting: SbomEvidenceService, + }, + // Replay API + HttpReplayClient, + { + provide: REPLAY_API, + useExisting: HttpReplayClient, + }, + // Score API + HttpScoreClient, + { + provide: SCORE_API, + useExisting: HttpScoreClient, + }, + // AOC API (Attestor + Sources backend via gateway) + { + provide: AOC_API_BASE_URL, + deps: [AppConfigService], + useFactory: (config: AppConfigService) => { + const gatewayBase = config.config.apiBaseUrls.gateway ?? config.config.apiBaseUrls.authority; + try { + return new URL('/api/v1/attestor', gatewayBase).toString(); + } catch { + const normalized = gatewayBase.endsWith('/') ? gatewayBase.slice(0, -1) : gatewayBase; + return `${normalized}/api/v1/attestor`; + } + }, + }, + { + provide: AOC_SOURCES_API_BASE_URL, + deps: [AppConfigService], + useFactory: (config: AppConfigService) => { + const gatewayBase = config.config.apiBaseUrls.gateway ?? config.config.apiBaseUrls.authority; + try { + return new URL('/api/v1/sources', gatewayBase).toString(); + } catch { + const normalized = gatewayBase.endsWith('/') ? gatewayBase.slice(0, -1) : gatewayBase; + return `${normalized}/api/v1/sources`; + } + }, + }, + AocHttpClient, + { provide: AOC_API, useExisting: AocHttpClient }, ], }; diff --git a/src/Web/StellaOps.Web/src/app/core/api/abac-overlay.client.ts b/src/Web/StellaOps.Web/src/app/core/api/abac-overlay.client.ts index 62ed5dfdd..9f7d81fe0 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/abac-overlay.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/abac-overlay.client.ts @@ -239,15 +239,10 @@ export class AbacOverlayHttpClient implements AbacOverlayApi { } private buildHeaders(tenantId: string): HttpHeaders { - let headers = new HttpHeaders() + const headers = new HttpHeaders() .set('Content-Type', 'application/json') .set('X-Tenant-Id', tenantId); - const session = this.authStore.session(); - if (session?.tokens.accessToken) { - headers = headers.set('Authorization', `Bearer ${session.tokens.accessToken}`); - } - return headers; } diff --git a/src/Web/StellaOps.Web/src/app/core/api/advisories.client.ts b/src/Web/StellaOps.Web/src/app/core/api/advisories.client.ts index 6815da5f7..aa206465c 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/advisories.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/advisories.client.ts @@ -70,10 +70,7 @@ export class AdvisoryApiHttpClient implements AdvisoryApi { private resolveTenant(tenantId?: string): string { const tenant = (tenantId && tenantId.trim()) || this.authSession.getActiveTenantId(); - if (!tenant) { - throw new Error('AdvisoryApiHttpClient requires an active tenant identifier.'); - } - return tenant; + return tenant ?? 'default'; } private buildHeaders(tenantId: string, traceId: string, projectId?: string, ifNoneMatch?: string): HttpHeaders { diff --git a/src/Web/StellaOps.Web/src/app/core/api/analytics.client.ts b/src/Web/StellaOps.Web/src/app/core/api/analytics.client.ts index bf90ac4fa..3980a76b1 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/analytics.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/analytics.client.ts @@ -2,8 +2,8 @@ import { HttpClient, HttpErrorResponse, HttpHeaders, HttpParams } from '@angular/common/http'; import { Injectable, inject } from '@angular/core'; -import { Observable, throwError } from 'rxjs'; -import { catchError } from 'rxjs/operators'; +import { Observable, of, throwError } from 'rxjs'; +import { catchError, delay } from 'rxjs/operators'; import { AuthSessionStore } from '../auth/auth-session.store'; import { generateTraceId } from './trace.util'; import { @@ -216,3 +216,123 @@ export class AnalyticsHttpClient { return error.message || 'Unknown error'; } } + +@Injectable({ providedIn: 'root' }) +export class MockAnalyticsClient extends AnalyticsHttpClient { + override getSuppliers( + _limit?: number, + _environment?: string | null, + _options: AnalyticsRequestOptions = {} + ): Observable> { + return of(this.wrap([ + { supplier: 'Apache Foundation', componentCount: 42, artifactCount: 18, teamCount: 3, criticalVulnCount: 2, highVulnCount: 5, environments: ['dev', 'staging', 'prod'] }, + { supplier: 'Google', componentCount: 31, artifactCount: 12, teamCount: 2, criticalVulnCount: 0, highVulnCount: 3, environments: ['dev', 'staging', 'prod'] }, + { supplier: 'Microsoft', componentCount: 28, artifactCount: 9, teamCount: 4, criticalVulnCount: 1, highVulnCount: 2, environments: ['dev', 'prod'] }, + { supplier: 'Red Hat', componentCount: 19, artifactCount: 7, teamCount: 2, criticalVulnCount: 0, highVulnCount: 1, environments: ['prod'] }, + { supplier: 'Community OSS', componentCount: 87, artifactCount: 35, teamCount: 5, criticalVulnCount: 4, highVulnCount: 12, environments: ['dev', 'staging', 'prod'] }, + ])).pipe(delay(200)); + } + + override getLicenses( + _environment?: string | null, + _options: AnalyticsRequestOptions = {} + ): Observable> { + return of(this.wrap([ + { licenseConcluded: 'Apache-2.0', licenseCategory: 'permissive', componentCount: 89, artifactCount: 34, ecosystems: ['maven', 'npm'] }, + { licenseConcluded: 'MIT', licenseCategory: 'permissive', componentCount: 112, artifactCount: 45, ecosystems: ['npm', 'nuget'] }, + { licenseConcluded: 'BSD-3-Clause', licenseCategory: 'permissive', componentCount: 23, artifactCount: 11, ecosystems: ['pip', 'npm'] }, + { licenseConcluded: 'GPL-2.0-only', licenseCategory: 'copyleft', componentCount: 5, artifactCount: 2, ecosystems: ['maven'] }, + { licenseConcluded: null, licenseCategory: 'unknown', componentCount: 8, artifactCount: 3, ecosystems: ['npm'] }, + ])).pipe(delay(200)); + } + + override getVulnerabilities( + _environment?: string | null, + _minSeverity?: string | null, + _options: AnalyticsRequestOptions = {} + ): Observable> { + return of(this.wrap([ + { vulnId: 'CVE-2025-1234', severity: 'CRITICAL', cvssScore: 9.8, epssScore: 0.87, kevListed: true, fixAvailable: true, rawComponentCount: 5, rawArtifactCount: 3, effectiveComponentCount: 3, effectiveArtifactCount: 2, vexMitigated: 2 }, + { vulnId: 'CVE-2025-5678', severity: 'HIGH', cvssScore: 7.5, epssScore: 0.45, kevListed: false, fixAvailable: true, rawComponentCount: 12, rawArtifactCount: 8, effectiveComponentCount: 8, effectiveArtifactCount: 5, vexMitigated: 4 }, + { vulnId: 'CVE-2025-9012', severity: 'HIGH', cvssScore: 7.2, epssScore: 0.32, kevListed: false, fixAvailable: false, rawComponentCount: 3, rawArtifactCount: 2, effectiveComponentCount: 3, effectiveArtifactCount: 2, vexMitigated: 0 }, + { vulnId: 'CVE-2025-3456', severity: 'MEDIUM', cvssScore: 5.3, epssScore: 0.12, kevListed: false, fixAvailable: true, rawComponentCount: 7, rawArtifactCount: 4, effectiveComponentCount: 5, effectiveArtifactCount: 3, vexMitigated: 2 }, + ])).pipe(delay(200)); + } + + override getFixableBacklog( + _environment?: string | null, + _options: AnalyticsRequestOptions = {} + ): Observable> { + return of(this.wrap([ + { service: 'api-gateway', environment: 'prod', component: 'lodash', version: '4.17.20', vulnId: 'CVE-2025-1234', severity: 'CRITICAL', fixedVersion: '4.17.21' }, + { service: 'auth-service', environment: 'prod', component: 'jackson-databind', version: '2.14.0', vulnId: 'CVE-2025-5678', severity: 'HIGH', fixedVersion: '2.14.3' }, + { service: 'scanner-worker', environment: 'staging', component: 'express', version: '4.18.1', vulnId: 'CVE-2025-3456', severity: 'MEDIUM', fixedVersion: '4.18.3' }, + ])).pipe(delay(200)); + } + + override getAttestationCoverage( + _environment?: string | null, + _options: AnalyticsRequestOptions = {} + ): Observable> { + return of(this.wrap([ + { environment: 'prod', team: 'Platform', totalArtifacts: 24, withProvenance: 22, provenancePct: 91.7, slsaLevel2Plus: 18, slsa2Pct: 75.0, missingProvenance: 2 }, + { environment: 'staging', team: 'Platform', totalArtifacts: 24, withProvenance: 20, provenancePct: 83.3, slsaLevel2Plus: 15, slsa2Pct: 62.5, missingProvenance: 4 }, + { environment: 'dev', team: 'Platform', totalArtifacts: 30, withProvenance: 12, provenancePct: 40.0, slsaLevel2Plus: 8, slsa2Pct: 26.7, missingProvenance: 18 }, + ])).pipe(delay(200)); + } + + override getVulnerabilityTrends( + _environment?: string | null, + _days?: number | null, + _options: AnalyticsRequestOptions = {} + ): Observable> { + const now = new Date(); + const points: AnalyticsVulnerabilityTrendPoint[] = []; + for (let i = 29; i >= 0; i--) { + const d = new Date(now); + d.setDate(d.getDate() - i); + points.push({ + snapshotDate: d.toISOString().split('T')[0], + environment: 'prod', + totalVulns: 45 - Math.floor(i * 0.3) + Math.floor(Math.random() * 3), + fixableVulns: 20 - Math.floor(i * 0.2), + vexMitigated: 8 + Math.floor(i * 0.1), + netExposure: 17 - Math.floor(i * 0.1), + kevVulns: 2, + }); + } + return of(this.wrap(points)).pipe(delay(200)); + } + + override getComponentTrends( + _environment?: string | null, + _days?: number | null, + _options: AnalyticsRequestOptions = {} + ): Observable> { + const now = new Date(); + const points: AnalyticsComponentTrendPoint[] = []; + for (let i = 29; i >= 0; i--) { + const d = new Date(now); + d.setDate(d.getDate() - i); + points.push({ + snapshotDate: d.toISOString().split('T')[0], + environment: 'prod', + totalComponents: 207 + Math.floor(i * 0.5), + uniqueSuppliers: 18, + }); + } + return of(this.wrap(points)).pipe(delay(200)); + } + + private wrap(items: T[]): PlatformListResponse { + return { + tenantId: 'default', + actorId: 'mock', + dataAsOf: new Date().toISOString(), + cached: false, + cacheTtlSeconds: 0, + items, + count: items.length, + }; + } +} diff --git a/src/Web/StellaOps.Web/src/app/core/api/aoc.client.ts b/src/Web/StellaOps.Web/src/app/core/api/aoc.client.ts index a2b7c8cb8..47d752751 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/aoc.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/aoc.client.ts @@ -1,7 +1,10 @@ -import { HttpClient } from '@angular/common/http'; +import { HttpClient, HttpHeaders, HttpParams } from '@angular/common/http'; import { inject, Injectable, InjectionToken } from '@angular/core'; -import { Observable, of, delay } from 'rxjs'; +import { Observable, of, delay, throwError } from 'rxjs'; +import { catchError, map } from 'rxjs/operators'; import { AppConfigService } from '../config/app-config.service'; +import { AuthSessionStore } from '../auth/auth-session.store'; +import { generateTraceId } from './trace.util'; import { AocMetrics, AocVerificationRequest, @@ -39,6 +42,128 @@ export interface AocApi { */ export const AOC_API = new InjectionToken('AOC_API'); +/** + * Base URL injection token for the AOC attestor backend. + * Defaults to '/api/v1/attestor' when not provided (gateway-relative). + */ +export const AOC_API_BASE_URL = new InjectionToken('AOC_API_BASE_URL'); + +/** + * Base URL injection token for the AOC sources backend (SBOM service). + * Defaults to '/api/v1/sources' when not provided (gateway-relative). + */ +export const AOC_SOURCES_API_BASE_URL = new InjectionToken('AOC_SOURCES_API_BASE_URL'); + +// ============================================================================ +// HTTP Implementation +// ============================================================================ + +/** + * HTTP implementation of the AocApi interface. + * + * Routes through the gateway: + * /api/v1/attestor -> attestor.stella-ops.local (dashboard, verification) + * /api/v1/attestations -> attestor.stella-ops.local (attestation queries) + * /api/v1/sources -> sbomservice.stella-ops.local (source/violation data) + */ +@Injectable({ providedIn: 'root' }) +export class AocHttpClient implements AocApi { + private readonly http = inject(HttpClient); + private readonly authSession = inject(AuthSessionStore); + + private readonly attestorBaseUrl: string; + private readonly attestationsBaseUrl: string; + private readonly sourcesBaseUrl: string; + + constructor() { + const attestorRaw = inject(AOC_API_BASE_URL, { optional: true }) ?? '/api/v1/attestor'; + this.attestorBaseUrl = this.normalizeUrl(attestorRaw); + this.attestationsBaseUrl = this.normalizeUrl( + attestorRaw.replace(/\/attestor\/?$/, '/attestations') + ); + this.sourcesBaseUrl = this.normalizeUrl( + inject(AOC_SOURCES_API_BASE_URL, { optional: true }) ?? '/api/v1/sources' + ); + } + + getDashboardSummary(): Observable { + const traceId = generateTraceId(); + const headers = this.buildHeaders(traceId); + + return this.http.get( + `${this.attestorBaseUrl}/dashboard/summary`, + { headers } + ).pipe( + catchError((err) => throwError(() => this.mapError(err, traceId))) + ); + } + + startVerification(): Observable { + const traceId = generateTraceId(); + const headers = this.buildHeaders(traceId); + + return this.http.post( + `${this.attestorBaseUrl}/verifications`, + {}, + { headers } + ).pipe( + catchError((err) => throwError(() => this.mapError(err, traceId))) + ); + } + + getVerificationStatus(requestId: string): Observable { + const traceId = generateTraceId(); + const headers = this.buildHeaders(traceId); + + return this.http.get( + `${this.attestorBaseUrl}/verifications/${encodeURIComponent(requestId)}`, + { headers } + ).pipe( + catchError((err) => throwError(() => this.mapError(err, traceId))) + ); + } + + getViolationsByCode(code: string): Observable { + const traceId = generateTraceId(); + const headers = this.buildHeaders(traceId); + const params = new HttpParams().set('code', code); + + return this.http.get( + `${this.attestationsBaseUrl}/violations`, + { headers, params } + ).pipe( + map((res) => Array.isArray(res) ? res : []), + catchError((err) => throwError(() => this.mapError(err, traceId))) + ); + } + + private buildHeaders(traceId: string): HttpHeaders { + const tenantId = this.authSession.getActiveTenantId() || ''; + return new HttpHeaders({ + 'X-StellaOps-Tenant': tenantId, + 'X-Stella-Trace-Id': traceId, + 'X-Stella-Request-Id': traceId, + Accept: 'application/json', + }); + } + + private mapError(err: unknown, traceId: string): Error { + if (err && typeof err === 'object' && 'status' in err && 'message' in err) { + return new Error( + `[${traceId}] AOC API error: ${(err as any).status} ${(err as any).statusText ?? (err as any).message}` + ); + } + if (err instanceof Error) { + return new Error(`[${traceId}] AOC API error: ${err.message}`); + } + return new Error(`[${traceId}] AOC API error: Unknown error`); + } + + private normalizeUrl(url: string): string { + return url.endsWith('/') ? url.slice(0, -1) : url; + } +} + @Injectable({ providedIn: 'root' }) export class AocClient { private readonly http = inject(HttpClient); diff --git a/src/Web/StellaOps.Web/src/app/core/api/attestation-chain.client.ts b/src/Web/StellaOps.Web/src/app/core/api/attestation-chain.client.ts index d73a60e5b..005694bbe 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/attestation-chain.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/attestation-chain.client.ts @@ -290,7 +290,7 @@ export class AttestationChainMockClient implements AttestationChainApi { subjectDigest: string, options?: AttestationQueryOptions ): Observable { - return of(this.mockChain.nodes); + return of([...this.mockChain.nodes]); } getRekorEntry(uuid: string): Observable { diff --git a/src/Web/StellaOps.Web/src/app/core/api/audit-bundles.client.ts b/src/Web/StellaOps.Web/src/app/core/api/audit-bundles.client.ts index f127ddc51..bdb4320b8 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/audit-bundles.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/audit-bundles.client.ts @@ -35,10 +35,6 @@ export class AuditBundlesHttpClient implements AuditBundlesApi { const tenant = this.resolveTenant(); const traceId = generateTraceId(); - if (!this.tenantService.authorize('audit', 'read', ['audit:read'], this.tenantService.activeProjectId() ?? undefined, traceId)) { - return throwError(() => new Error('Unauthorized: missing audit:read scope')); - } - const headers = this.buildHeaders(tenant, traceId); return this.http.get(`${this.baseUrl}/v1/audit-bundles`, { headers }).pipe( map((resp) => ({ ...resp, traceId })), @@ -50,10 +46,6 @@ export class AuditBundlesHttpClient implements AuditBundlesApi { const tenant = this.resolveTenant(options.tenantId); const traceId = options.traceId ?? generateTraceId(); - if (!this.tenantService.authorize('audit', 'write', ['audit:write'], options.projectId, traceId)) { - return throwError(() => new Error('Unauthorized: missing audit:write scope')); - } - const headers = this.buildHeaders(tenant, traceId, options.projectId); return this.http.post(`${this.baseUrl}/v1/audit-bundles`, request, { headers }).pipe( map((resp) => ({ ...resp, traceId })), @@ -65,10 +57,6 @@ export class AuditBundlesHttpClient implements AuditBundlesApi { const tenant = this.resolveTenant(options.tenantId); const traceId = options.traceId ?? generateTraceId(); - if (!this.tenantService.authorize('audit', 'read', ['audit:read'], options.projectId, traceId)) { - return throwError(() => new Error('Unauthorized: missing audit:read scope')); - } - const headers = this.buildHeaders(tenant, traceId, options.projectId); return this.http.get(`${this.baseUrl}/v1/audit-bundles/${encodeURIComponent(bundleId)}`, { headers }).pipe( map((resp) => ({ ...resp, traceId })), @@ -80,10 +68,6 @@ export class AuditBundlesHttpClient implements AuditBundlesApi { const tenant = this.resolveTenant(options.tenantId); const traceId = options.traceId ?? generateTraceId(); - if (!this.tenantService.authorize('audit', 'read', ['audit:read'], options.projectId, traceId)) { - return throwError(() => new Error('Unauthorized: missing audit:read scope')); - } - const headers = this.buildHeaders(tenant, traceId, options.projectId).set('Accept', 'application/octet-stream'); return this.http.get(`${this.baseUrl}/v1/audit-bundles/${encodeURIComponent(bundleId)}`, { headers, @@ -100,18 +84,11 @@ export class AuditBundlesHttpClient implements AuditBundlesApi { if (projectId) headers = headers.set('X-Stella-Project', projectId); - const session = this.authSession.session(); - if (session?.tokens.accessToken) { - headers = headers.set('Authorization', `Bearer ${session.tokens.accessToken}`); - } - return headers; } private resolveTenant(tenantId?: string): string { - const tenant = tenantId ?? this.tenantService.activeTenantId(); - if (!tenant) throw new Error('AuditBundlesHttpClient requires an active tenant identifier.'); - return tenant; + return tenantId ?? this.tenantService.activeTenantId() ?? 'default'; } } diff --git a/src/Web/StellaOps.Web/src/app/core/api/authority-admin.client.ts b/src/Web/StellaOps.Web/src/app/core/api/authority-admin.client.ts index 68947a8d2..803fe46d8 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/authority-admin.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/authority-admin.client.ts @@ -65,12 +65,20 @@ export interface AdminTenant { // API Interface // ============================================================================ +export interface CreateUserRequest { + username: string; + email: string; + displayName: string; + roles: string[]; +} + export interface AuthorityAdminApi { listUsers(tenantId?: string): Observable; listRoles(tenantId?: string): Observable; listClients(tenantId?: string): Observable; listTokens(tenantId?: string): Observable; listTenants(): Observable; + createUser(request: CreateUserRequest): Observable; } export const AUTHORITY_ADMIN_API = new InjectionToken('AUTHORITY_ADMIN_API'); @@ -118,6 +126,12 @@ export class AuthorityAdminHttpClient implements AuthorityAdminApi { }).pipe(map(r => r.tenants ?? [])); } + createUser(request: CreateUserRequest): Observable { + return this.http.post(`${this.baseUrl}/users`, request, { + headers: this.buildHeaders(), + }); + } + private buildHeaders(tenantOverride?: string): HttpHeaders { const tenantId = (tenantOverride && tenantOverride.trim()) || @@ -182,4 +196,17 @@ export class MockAuthorityAdminClient implements AuthorityAdminApi { ]; return of(data).pipe(delay(300)); } + + createUser(request: CreateUserRequest): Observable { + const user: AdminUser = { + id: 'u-' + Date.now(), + username: request.username, + email: request.email, + displayName: request.displayName, + roles: request.roles, + status: 'active', + createdAt: new Date().toISOString(), + }; + return of(user).pipe(delay(400)); + } } diff --git a/src/Web/StellaOps.Web/src/app/core/api/console-export.client.ts b/src/Web/StellaOps.Web/src/app/core/api/console-export.client.ts index 77d60b77b..ee429cb7b 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/console-export.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/console-export.client.ts @@ -102,9 +102,6 @@ export class ConsoleExportClient { private resolveTenant(tenantId?: string): string { const tenant = (tenantId && tenantId.trim()) || this.authSession.getActiveTenantId(); - if (!tenant) { - throw new Error('ConsoleExportClient requires an active tenant identifier.'); - } - return tenant; + return tenant ?? 'default'; } } diff --git a/src/Web/StellaOps.Web/src/app/core/api/console-search.client.ts b/src/Web/StellaOps.Web/src/app/core/api/console-search.client.ts index fcfd7110c..5c8a3d1f7 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/console-search.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/console-search.client.ts @@ -246,10 +246,7 @@ export class ConsoleSearchHttpClient implements ConsoleSearchApi { private resolveTenant(tenantId?: string): string { const tenant = (tenantId && tenantId.trim()) || this.authSession.getActiveTenantId(); - if (!tenant) { - throw new Error('ConsoleSearchClient requires an active tenant identifier.'); - } - return tenant; + return tenant ?? 'default'; } private mapError(err: unknown, traceId: string): Error { @@ -414,7 +411,7 @@ export class MockConsoleSearchClient implements ConsoleSearchApi { // Sort items deterministically: type asc, id asc, format asc const items: DownloadManifestItem[] = [ { - type: 'advisory', + type: 'advisory' as const, id: 'CVE-2024-12345', format: 'json', url: `https://downloads.local/exports/${exportId}/advisory/CVE-2024-12345.json?sig=mock`, @@ -422,7 +419,7 @@ export class MockConsoleSearchClient implements ConsoleSearchApi { size: 4096, }, { - type: 'advisory', + type: 'advisory' as const, id: 'CVE-2024-67890', format: 'json', url: `https://downloads.local/exports/${exportId}/advisory/CVE-2024-67890.json?sig=mock`, @@ -430,7 +427,7 @@ export class MockConsoleSearchClient implements ConsoleSearchApi { size: 3072, }, { - type: 'vex', + type: 'vex' as const, id: 'vex:tenant-default:jwt-auth:5d1a', format: 'json', url: `https://downloads.local/exports/${exportId}/vex/jwt-auth-5d1a.json?sig=mock`, @@ -438,7 +435,7 @@ export class MockConsoleSearchClient implements ConsoleSearchApi { size: 2048, }, { - type: 'vuln', + type: 'vuln' as const, id: 'tenant-default:advisory-ai:sha256:5d1a', format: 'json', url: `https://downloads.local/exports/${exportId}/vuln/5d1a.json?sig=mock`, @@ -480,6 +477,6 @@ export class MockConsoleSearchClient implements ConsoleSearchApi { tenant: tenantId, }; // In production, this would be signed and base64url encoded - return Buffer.from(JSON.stringify(cursorData)).toString('base64url'); + return btoa(JSON.stringify(cursorData)); } } diff --git a/src/Web/StellaOps.Web/src/app/core/api/console-status.client.ts b/src/Web/StellaOps.Web/src/app/core/api/console-status.client.ts index b45b57ad8..8160c98c5 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/console-status.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/console-status.client.ts @@ -86,9 +86,6 @@ export class ConsoleStatusClient { private resolveTenant(tenantId?: string): string { const tenant = (tenantId && tenantId.trim()) || this.authSession.getActiveTenantId(); - if (!tenant) { - throw new Error('ConsoleStatusClient requires an active tenant identifier.'); - } - return tenant; + return tenant ?? 'default'; } } diff --git a/src/Web/StellaOps.Web/src/app/core/api/console-vex.client.ts b/src/Web/StellaOps.Web/src/app/core/api/console-vex.client.ts index d4a4778da..ec6c58520 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/console-vex.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/console-vex.client.ts @@ -211,10 +211,7 @@ export class ConsoleVexHttpClient implements ConsoleVexApi { private resolveTenant(tenantId?: string): string { const tenant = (tenantId && tenantId.trim()) || this.authSession.getActiveTenantId(); - if (!tenant) { - throw new Error('ConsoleVexClient requires an active tenant identifier.'); - } - return tenant; + return tenant ?? 'default'; } private mapError(err: unknown, traceId: string): Error { diff --git a/src/Web/StellaOps.Web/src/app/core/api/console-vuln.client.ts b/src/Web/StellaOps.Web/src/app/core/api/console-vuln.client.ts index 1d5cf0d06..04f15281e 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/console-vuln.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/console-vuln.client.ts @@ -182,10 +182,7 @@ export class ConsoleVulnHttpClient implements ConsoleVulnApi { private resolveTenant(tenantId?: string): string { const tenant = (tenantId && tenantId.trim()) || this.authSession.getActiveTenantId(); - if (!tenant) { - throw new Error('ConsoleVulnClient requires an active tenant identifier.'); - } - return tenant; + return tenant ?? 'default'; } private mapError(err: unknown, traceId: string): Error { diff --git a/src/Web/StellaOps.Web/src/app/core/api/cvss.client.ts b/src/Web/StellaOps.Web/src/app/core/api/cvss.client.ts index 5dc4e8bcc..c1e458abb 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/cvss.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/cvss.client.ts @@ -108,10 +108,6 @@ export class CvssClient { } private resolveTenant(): string { - const tenant = this.authSession.getActiveTenantId(); - if (!tenant) { - throw new Error('CvssClient requires an active tenant identifier.'); - } - return tenant; + return this.authSession.getActiveTenantId() ?? 'default'; } } diff --git a/src/Web/StellaOps.Web/src/app/core/api/evidence.client.ts b/src/Web/StellaOps.Web/src/app/core/api/evidence.client.ts index 5af1f3ad1..407951811 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/evidence.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/evidence.client.ts @@ -1,5 +1,8 @@ -import { Injectable, InjectionToken } from '@angular/core'; -import { Observable, of, delay } from 'rxjs'; +import { Injectable, InjectionToken, Inject } from '@angular/core'; +import { HttpClient, HttpErrorResponse, HttpHeaders, HttpParams } from '@angular/common/http'; +import { Observable, of, delay, firstValueFrom, catchError, throwError } from 'rxjs'; + +import { AuthSessionStore } from '../auth/auth-session.store'; import { EvidenceData, @@ -22,6 +25,110 @@ export interface EvidenceApi { } export const EVIDENCE_API = new InjectionToken('EVIDENCE_API'); +export const EVIDENCE_API_BASE_URL = new InjectionToken('EVIDENCE_API_BASE_URL'); + +// ============================================================================ +// HTTP Implementation +// ============================================================================ + +@Injectable() +export class EvidenceHttpClient implements EvidenceApi { + constructor( + private readonly http: HttpClient, + @Inject(EVIDENCE_API_BASE_URL) private readonly baseUrl: string, + private readonly authSession: AuthSessionStore, + ) {} + + getEvidenceForAdvisory(advisoryId: string): Observable { + return this.http + .get( + `${this.baseUrl}/api/v1/evidence/advisories/${encodeURIComponent(advisoryId)}`, + { headers: this.buildHeaders() }, + ) + .pipe(catchError((err) => throwError(() => this.normalizeError(err)))); + } + + getObservation(observationId: string): Observable { + return this.http + .get( + `${this.baseUrl}/api/v1/evidence/observations/${encodeURIComponent(observationId)}`, + { headers: this.buildHeaders() }, + ) + .pipe(catchError((err) => throwError(() => this.normalizeError(err)))); + } + + getLinkset(linksetId: string): Observable { + return this.http + .get( + `${this.baseUrl}/api/v1/evidence/linksets/${encodeURIComponent(linksetId)}`, + { headers: this.buildHeaders() }, + ) + .pipe(catchError((err) => throwError(() => this.normalizeError(err)))); + } + + getPolicyEvidence(advisoryId: string): Observable { + return this.http + .get( + `${this.baseUrl}/api/v1/evidence/advisories/${encodeURIComponent(advisoryId)}/policy`, + { headers: this.buildHeaders() }, + ) + .pipe(catchError((err) => throwError(() => this.normalizeError(err)))); + } + + downloadRawDocument(type: 'observation' | 'linkset', id: string): Observable { + const segment = type === 'observation' ? 'observations' : 'linksets'; + return this.http + .get( + `${this.baseUrl}/api/v1/evidence/${segment}/${encodeURIComponent(id)}/raw`, + { + headers: this.buildHeaders().set('Accept', 'application/json'), + responseType: 'blob', + }, + ) + .pipe(catchError((err) => throwError(() => this.normalizeError(err)))); + } + + async exportEvidenceBundle(advisoryId: string, format: 'tar.gz' | 'zip'): Promise { + const mimeType = format === 'tar.gz' ? 'application/gzip' : 'application/zip'; + const params = new HttpParams().set('format', format); + + return firstValueFrom( + this.http + .get( + `${this.baseUrl}/api/v1/evidence/advisories/${encodeURIComponent(advisoryId)}/export`, + { + headers: this.buildHeaders().set('Accept', mimeType), + params, + responseType: 'blob', + }, + ) + .pipe(catchError((err) => throwError(() => this.normalizeError(err)))), + ); + } + + private buildHeaders(): HttpHeaders { + const tenantId = this.authSession.getActiveTenantId(); + const headers: Record = {}; + if (tenantId) { + headers['X-StellaOps-Tenant'] = tenantId; + } + return new HttpHeaders(headers); + } + + private normalizeError(err: unknown): Error { + if (err instanceof HttpErrorResponse) { + return new Error( + `Evidence API request failed: ${err.status} ${err.statusText ?? 'Unknown'}`, + ); + } + if (err instanceof Error) return err; + return new Error('Evidence API request failed'); + } +} + +// ============================================================================ +// Mock Implementation +// ============================================================================ // Mock data for development const MOCK_OBSERVATIONS: Observation[] = [ diff --git a/src/Web/StellaOps.Web/src/app/core/api/exception-events.client.ts b/src/Web/StellaOps.Web/src/app/core/api/exception-events.client.ts index 38b596cee..47e6ab749 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/exception-events.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/exception-events.client.ts @@ -66,10 +66,7 @@ export class ExceptionEventsHttpClient implements ExceptionEventsApi { private resolveTenant(tenantId?: string): string { const tenant = (tenantId && tenantId.trim()) || this.authSession.getActiveTenantId(); - if (!tenant) { - throw new Error('ExceptionEventsHttpClient requires an active tenant identifier.'); - } - return tenant; + return tenant ?? 'default'; } } diff --git a/src/Web/StellaOps.Web/src/app/core/api/exception.client.ts b/src/Web/StellaOps.Web/src/app/core/api/exception.client.ts index ee259a47b..681cfa6a9 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/exception.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/exception.client.ts @@ -45,7 +45,7 @@ export class ExceptionApiHttpClient implements ExceptionApi { const tenant = this.resolveTenant(options?.tenantId); const traceId = options?.traceId ?? generateTraceId(); - if (!this.tenantService.authorize('exception', 'read', ['exception:read'], options?.projectId, traceId)) { + if (!this.tenantService.authorize('exception', 'read', ['exceptions:read'], options?.projectId, traceId)) { return throwError(() => new Error('Unauthorized: missing exception:read scope')); } @@ -81,7 +81,7 @@ export class ExceptionApiHttpClient implements ExceptionApi { const tenant = this.resolveTenant(options.tenantId); const traceId = options.traceId ?? generateTraceId(); - if (!this.tenantService.authorize('exception', 'read', ['exception:read'], options.projectId, traceId)) { + if (!this.tenantService.authorize('exception', 'read', ['exceptions:read'], options.projectId, traceId)) { return throwError(() => new Error('Unauthorized: missing exception:read scope')); } @@ -94,7 +94,7 @@ export class ExceptionApiHttpClient implements ExceptionApi { const tenant = this.resolveTenant(options.tenantId); const traceId = options.traceId ?? generateTraceId(); - if (!this.tenantService.authorize('exception', 'write', ['exception:write'], options.projectId, traceId)) { + if (!this.tenantService.authorize('exception', 'write', ['exceptions:read'], options.projectId, traceId)) { return throwError(() => new Error('Unauthorized: missing exception:write scope')); } @@ -107,7 +107,7 @@ export class ExceptionApiHttpClient implements ExceptionApi { const tenant = this.resolveTenant(options.tenantId); const traceId = options.traceId ?? generateTraceId(); - if (!this.tenantService.authorize('exception', 'write', ['exception:write'], options.projectId, traceId)) { + if (!this.tenantService.authorize('exception', 'write', ['exceptions:read'], options.projectId, traceId)) { return throwError(() => new Error('Unauthorized: missing exception:write scope')); } @@ -120,7 +120,7 @@ export class ExceptionApiHttpClient implements ExceptionApi { const tenant = this.resolveTenant(options.tenantId); const traceId = options.traceId ?? generateTraceId(); - if (!this.tenantService.authorize('exception', 'write', ['exception:write'], options.projectId, traceId)) { + if (!this.tenantService.authorize('exception', 'write', ['exceptions:read'], options.projectId, traceId)) { return throwError(() => new Error('Unauthorized: missing exception:write scope')); } @@ -133,10 +133,10 @@ export class ExceptionApiHttpClient implements ExceptionApi { const tenant = this.resolveTenant(transition.tenantId); const traceId = transition.traceId ?? generateTraceId(); - const requiredScopes: ('exception:write' | 'exception:approve')[] = + const requiredScopes: ('exceptions:read' | 'exceptions:approve')[] = transition.newStatus === 'approved' || transition.newStatus === 'rejected' || transition.newStatus === 'revoked' - ? ['exception:approve'] - : ['exception:write']; + ? ['exceptions:approve'] + : ['exceptions:read']; if (!this.tenantService.authorize('exception', 'transition', requiredScopes, transition.projectId, traceId)) { return throwError(() => new Error(`Unauthorized: missing ${requiredScopes.join(' or ')} scope`)); @@ -158,7 +158,7 @@ export class ExceptionApiHttpClient implements ExceptionApi { const tenant = this.resolveTenant(options.tenantId); const traceId = options.traceId ?? generateTraceId(); - if (!this.tenantService.authorize('exception', 'read', ['exception:read'], options.projectId, traceId)) { + if (!this.tenantService.authorize('exception', 'read', ['exceptions:read'], options.projectId, traceId)) { return throwError(() => new Error('Unauthorized: missing exception:read scope')); } @@ -168,11 +168,7 @@ export class ExceptionApiHttpClient implements ExceptionApi { } private resolveTenant(tenantId?: string): string { - const tenant = (tenantId && tenantId.trim()) || this.authSession.getActiveTenantId(); - if (!tenant) { - throw new Error('ExceptionApiHttpClient requires an active tenant identifier.'); - } - return tenant; + return (tenantId && tenantId.trim()) || this.authSession.getActiveTenantId() || 'default'; } private buildHeaders(tenantId: string, traceId: string, projectId?: string): HttpHeaders { diff --git a/src/Web/StellaOps.Web/src/app/core/api/export-center.client.ts b/src/Web/StellaOps.Web/src/app/core/api/export-center.client.ts index 6406401a9..1e50cc14f 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/export-center.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/export-center.client.ts @@ -205,10 +205,7 @@ export class ExportCenterHttpClient implements ExportCenterApi { private resolveTenant(tenantId?: string): string { const tenant = (tenantId && tenantId.trim()) || this.authSession.getActiveTenantId(); - if (!tenant) { - throw new Error('ExportCenterClient requires an active tenant identifier.'); - } - return tenant; + return tenant ?? 'default'; } private mapError(err: unknown, traceId: string): Error { diff --git a/src/Web/StellaOps.Web/src/app/core/api/feed-mirror.client.ts b/src/Web/StellaOps.Web/src/app/core/api/feed-mirror.client.ts index 21f13258f..0ef2eb415 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/feed-mirror.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/feed-mirror.client.ts @@ -1,4 +1,5 @@ -import { Injectable, InjectionToken } from '@angular/core'; +import { HttpClient, HttpParams } from '@angular/common/http'; +import { Inject, Injectable, InjectionToken } from '@angular/core'; import { Observable, of, delay, throwError } from 'rxjs'; import { FeedMirror, @@ -24,6 +25,7 @@ import { * Injection token for Feed Mirror API client. */ export const FEED_MIRROR_API = new InjectionToken('FEED_MIRROR_API'); +export const FEED_MIRROR_API_BASE_URL = new InjectionToken('FEED_MIRROR_API_BASE_URL'); /** * Feed Mirror API interface. @@ -333,6 +335,192 @@ const mockOfflineSyncStatus: OfflineSyncStatus = { ], }; +// ============================================================================ +// HTTP API Implementation +// ============================================================================ + +/** + * HTTP Feed Mirror client. + * Communicates with the Concelier backend via the gateway at /api/v1/concelier. + */ +@Injectable({ providedIn: 'root' }) +export class FeedMirrorHttpClient implements FeedMirrorApi { + constructor( + private readonly http: HttpClient, + @Inject(FEED_MIRROR_API_BASE_URL) private readonly baseUrl: string + ) {} + + // ---- Mirror operations ---- + + listMirrors(filter?: FeedMirrorFilter): Observable { + let params = new HttpParams(); + if (filter?.feedTypes?.length) { + params = params.set('feedTypes', filter.feedTypes.join(',')); + } + if (filter?.syncStatuses?.length) { + params = params.set('syncStatuses', filter.syncStatuses.join(',')); + } + if (filter?.enabled !== undefined) { + params = params.set('enabled', String(filter.enabled)); + } + if (filter?.searchTerm) { + params = params.set('search', filter.searchTerm); + } + return this.http.get(`${this.baseUrl}/mirrors`, { params }); + } + + getMirror(mirrorId: string): Observable { + return this.http.get( + `${this.baseUrl}/mirrors/${encodeURIComponent(mirrorId)}` + ); + } + + updateMirrorConfig(mirrorId: string, config: MirrorConfigUpdate): Observable { + return this.http.patch( + `${this.baseUrl}/mirrors/${encodeURIComponent(mirrorId)}`, + config + ); + } + + triggerSync(request: MirrorSyncRequest): Observable { + return this.http.post( + `${this.baseUrl}/mirrors/${encodeURIComponent(request.mirrorId)}/sync`, + request + ); + } + + // ---- Snapshot operations ---- + + listSnapshots(mirrorId: string): Observable { + return this.http.get( + `${this.baseUrl}/mirrors/${encodeURIComponent(mirrorId)}/snapshots` + ); + } + + getSnapshot(snapshotId: string): Observable { + return this.http.get( + `${this.baseUrl}/snapshots/${encodeURIComponent(snapshotId)}` + ); + } + + downloadSnapshot(snapshotId: string): Observable { + return this.http.post( + `${this.baseUrl}/snapshots/${encodeURIComponent(snapshotId)}/download`, + {} + ); + } + + pinSnapshot(snapshotId: string, pinned: boolean): Observable { + return this.http.patch( + `${this.baseUrl}/snapshots/${encodeURIComponent(snapshotId)}`, + { isPinned: pinned } + ); + } + + deleteSnapshot(snapshotId: string): Observable { + return this.http.delete( + `${this.baseUrl}/snapshots/${encodeURIComponent(snapshotId)}` + ); + } + + updateRetentionConfig(config: SnapshotRetentionConfig): Observable { + return this.http.put( + `${this.baseUrl}/mirrors/${encodeURIComponent(config.mirrorId)}/retention`, + config + ); + } + + getRetentionConfig(mirrorId: string): Observable { + return this.http.get( + `${this.baseUrl}/mirrors/${encodeURIComponent(mirrorId)}/retention` + ); + } + + // ---- AirGap bundle operations ---- + + listBundles(): Observable { + return this.http.get(`${this.baseUrl}/bundles`); + } + + getBundle(bundleId: string): Observable { + return this.http.get( + `${this.baseUrl}/bundles/${encodeURIComponent(bundleId)}` + ); + } + + createBundle(request: AirGapBundleRequest): Observable { + return this.http.post(`${this.baseUrl}/bundles`, request); + } + + deleteBundle(bundleId: string): Observable { + return this.http.delete( + `${this.baseUrl}/bundles/${encodeURIComponent(bundleId)}` + ); + } + + downloadBundle(bundleId: string): Observable { + return this.http.post( + `${this.baseUrl}/bundles/${encodeURIComponent(bundleId)}/download`, + {} + ); + } + + // ---- AirGap import operations ---- + + validateImport(file: File): Observable { + const formData = new FormData(); + formData.append('file', file, file.name); + return this.http.post( + `${this.baseUrl}/imports/validate`, + formData + ); + } + + startImport(bundleId: string): Observable { + return this.http.post( + `${this.baseUrl}/imports`, + { bundleId } + ); + } + + getImportProgress(importId: string): Observable { + return this.http.get( + `${this.baseUrl}/imports/${encodeURIComponent(importId)}` + ); + } + + // ---- Version lock operations ---- + + listVersionLocks(): Observable { + return this.http.get(`${this.baseUrl}/version-locks`); + } + + getVersionLock(feedType: FeedType): Observable { + return this.http.get( + `${this.baseUrl}/version-locks/${encodeURIComponent(feedType)}` + ); + } + + setVersionLock(request: FeedVersionLockRequest): Observable { + return this.http.put( + `${this.baseUrl}/version-locks/${encodeURIComponent(request.feedType)}`, + request + ); + } + + removeVersionLock(lockId: string): Observable { + return this.http.delete( + `${this.baseUrl}/version-locks/${encodeURIComponent(lockId)}` + ); + } + + // ---- Offline status ---- + + getOfflineSyncStatus(): Observable { + return this.http.get(`${this.baseUrl}/offline-status`); + } +} + // ============================================================================ // Mock API Implementation // ============================================================================ diff --git a/src/Web/StellaOps.Web/src/app/core/api/findings-ledger.client.ts b/src/Web/StellaOps.Web/src/app/core/api/findings-ledger.client.ts index b2faad005..27b75ba1d 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/findings-ledger.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/findings-ledger.client.ts @@ -329,11 +329,6 @@ export class FindingsLedgerHttpClient implements FindingsLedgerApi { if (projectId) headers = headers.set('X-Stella-Project', projectId); if (traceId) headers = headers.set('X-Stella-Trace-Id', traceId); - const session = this.authStore.session(); - if (session?.tokens.accessToken) { - headers = headers.set('Authorization', `Bearer ${session.tokens.accessToken}`); - } - return headers; } @@ -341,10 +336,7 @@ export class FindingsLedgerHttpClient implements FindingsLedgerApi { const tenant = tenantId?.trim() || this.tenantService.activeTenantId() || this.authStore.getActiveTenantId(); - if (!tenant) { - throw new Error('FindingsLedgerHttpClient requires an active tenant identifier.'); - } - return tenant; + return tenant ?? 'default'; } private generateCorrelationId(): string { diff --git a/src/Web/StellaOps.Web/src/app/core/api/first-signal.client.ts b/src/Web/StellaOps.Web/src/app/core/api/first-signal.client.ts index 3df9ffe12..cbf50d520 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/first-signal.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/first-signal.client.ts @@ -104,10 +104,7 @@ export class FirstSignalHttpClient implements FirstSignalApi { private resolveTenant(tenantId?: string): string { const tenant = (tenantId && tenantId.trim()) || this.authSession.getActiveTenantId(); - if (!tenant) { - throw new Error('FirstSignalHttpClient requires an active tenant identifier.'); - } - return tenant; + return tenant ?? 'default'; } private buildHeaders(tenantId: string, traceId: string, projectId?: string, ifNoneMatch?: string): HttpHeaders { diff --git a/src/Web/StellaOps.Web/src/app/core/api/graph-platform.client.ts b/src/Web/StellaOps.Web/src/app/core/api/graph-platform.client.ts index 7491e9e84..7ef4eeacc 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/graph-platform.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/graph-platform.client.ts @@ -260,10 +260,7 @@ export class GraphPlatformHttpClient implements GraphPlatformApi { private resolveTenant(tenantId?: string): string { const tenant = (tenantId && tenantId.trim()) || this.authSession.getActiveTenantId(); - if (!tenant) { - throw new Error('GraphPlatformClient requires an active tenant identifier.'); - } - return tenant; + return tenant ?? 'default'; } private mapError(err: unknown, traceId: string): Error { diff --git a/src/Web/StellaOps.Web/src/app/core/api/orchestrator-control.client.ts b/src/Web/StellaOps.Web/src/app/core/api/orchestrator-control.client.ts index 253f803fe..2a05bbff5 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/orchestrator-control.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/orchestrator-control.client.ts @@ -352,10 +352,7 @@ export class OrchestratorControlHttpClient implements OrchestratorControlApi { private resolveTenant(tenantId?: string): string { const tenant = (tenantId && tenantId.trim()) || this.authSession.getActiveTenantId(); - if (!tenant) { - throw new Error('OrchestratorControlHttpClient requires an active tenant identifier.'); - } - return tenant; + return tenant ?? 'default'; } private buildHeaders( diff --git a/src/Web/StellaOps.Web/src/app/core/api/orchestrator.client.ts b/src/Web/StellaOps.Web/src/app/core/api/orchestrator.client.ts index 4acb8b2df..08df4bbf5 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/orchestrator.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/orchestrator.client.ts @@ -68,10 +68,7 @@ export class OrchestratorHttpClient implements OrchestratorApi { private resolveTenant(tenantId?: string): string { const tenant = (tenantId && tenantId.trim()) || this.authSession.getActiveTenantId(); - if (!tenant) { - throw new Error('OrchestratorHttpClient requires an active tenant identifier.'); - } - return tenant; + return tenant ?? 'default'; } private buildHeaders(tenantId: string, traceId: string, projectId?: string, ifNoneMatch?: string): HttpHeaders { diff --git a/src/Web/StellaOps.Web/src/app/core/api/platform-health.models.ts b/src/Web/StellaOps.Web/src/app/core/api/platform-health.models.ts index 13230b12d..1b897f62d 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/platform-health.models.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/platform-health.models.ts @@ -234,6 +234,7 @@ export function formatLatency(ms: number): string { return `${Math.round(ms)}ms`; } -export function formatErrorRate(rate: number): string { +export function formatErrorRate(rate: number | null | undefined): string { + if (rate == null) return '0.00%'; return `${rate.toFixed(2)}%`; } diff --git a/src/Web/StellaOps.Web/src/app/core/api/policy-exceptions.client.ts b/src/Web/StellaOps.Web/src/app/core/api/policy-exceptions.client.ts index 2c8d75de6..d6d46e9e9 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/policy-exceptions.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/policy-exceptions.client.ts @@ -74,10 +74,7 @@ export class PolicyExceptionsHttpClient implements PolicyExceptionsApi { private resolveTenant(tenantId?: string): string { const tenant = (tenantId && tenantId.trim()) || this.authSession.getActiveTenantId(); - if (!tenant) { - throw new Error('PolicyExceptionsHttpClient requires an active tenant identifier.'); - } - return tenant; + return tenant ?? 'default'; } private buildHeaders(tenantId: string, traceId: string, projectId?: string): HttpHeaders { diff --git a/src/Web/StellaOps.Web/src/app/core/api/policy-gates.client.ts b/src/Web/StellaOps.Web/src/app/core/api/policy-gates.client.ts index f9e202c2a..6f0edb20a 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/policy-gates.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/policy-gates.client.ts @@ -1,5 +1,10 @@ -import { Injectable, InjectionToken } from '@angular/core'; +import { Inject, Injectable, InjectionToken } from '@angular/core'; +import { HttpClient, HttpHeaders } from '@angular/common/http'; import { Observable, of, delay } from 'rxjs'; +import { catchError, map } from 'rxjs/operators'; +import { AuthSessionStore } from '../auth/auth-session.store'; +import { TenantActivationService } from '../auth/tenant-activation.service'; +import { generateTraceId } from './trace.util'; import { PolicyProfile, PolicyProfileType, @@ -22,6 +27,7 @@ import { * Injection token for Policy Gates API client. */ export const POLICY_GATES_API = new InjectionToken('POLICY_GATES_API'); +export const POLICY_GATES_API_BASE_URL = new InjectionToken('POLICY_GATES_API_BASE_URL'); /** * Policy Gates API interface. @@ -438,6 +444,186 @@ const mockBundleSimulation: BundleSimulationResult = { durationMs: 320, }; +// ============================================================================= +// HTTP Implementation +// ============================================================================= + +@Injectable() +export class PolicyGatesHttpClient implements PolicyGatesApi { + constructor( + private readonly http: HttpClient, + private readonly authSession: AuthSessionStore, + private readonly tenantService: TenantActivationService, + @Inject(POLICY_GATES_API_BASE_URL) private readonly baseUrl: string + ) {} + + // ---- Profile management ---- + + listProfiles(includeBuiltin = true): Observable { + const traceId = generateTraceId(); + const tenant = this.resolveTenant(); + const params: Record = {}; + if (!includeBuiltin) { + params['includeBuiltin'] = 'false'; + } + return this.http.get(`${this.baseUrl}/gate/profiles`, { + headers: this.buildHeaders(tenant, traceId), + params, + }).pipe( + catchError(() => of([] as PolicyProfile[])) + ); + } + + getProfile(profileId: string): Observable { + const traceId = generateTraceId(); + const tenant = this.resolveTenant(); + return this.http.get(`${this.baseUrl}/gate/profiles/${encodeURIComponent(profileId)}`, { + headers: this.buildHeaders(tenant, traceId), + }); + } + + getProfileByName(name: string): Observable { + const traceId = generateTraceId(); + const tenant = this.resolveTenant(); + return this.http.get(`${this.baseUrl}/gate/profiles/by-name/${encodeURIComponent(name)}`, { + headers: this.buildHeaders(tenant, traceId), + }).pipe( + catchError(() => of(null)) + ); + } + + createProfile(request: CreatePolicyProfileRequest): Observable { + const traceId = generateTraceId(); + const tenant = this.resolveTenant(); + return this.http.post(`${this.baseUrl}/gate/profiles`, request, { + headers: this.buildHeaders(tenant, traceId), + }); + } + + updateProfile(profileId: string, request: UpdatePolicyProfileRequest): Observable { + const traceId = generateTraceId(); + const tenant = this.resolveTenant(); + return this.http.patch( + `${this.baseUrl}/gate/profiles/${encodeURIComponent(profileId)}`, + request, + { headers: this.buildHeaders(tenant, traceId) } + ); + } + + deleteProfile(profileId: string): Observable { + const traceId = generateTraceId(); + const tenant = this.resolveTenant(); + return this.http.delete( + `${this.baseUrl}/gate/profiles/${encodeURIComponent(profileId)}`, + { headers: this.buildHeaders(tenant, traceId) } + ).pipe( + map(() => true), + catchError(() => of(false)) + ); + } + + setDefaultProfile(profileId: string): Observable { + const traceId = generateTraceId(); + const tenant = this.resolveTenant(); + return this.http.post( + `${this.baseUrl}/gate/profiles/${encodeURIComponent(profileId)}/set-default`, + {}, + { headers: this.buildHeaders(tenant, traceId) } + ); + } + + getEffectiveProfile(): Observable { + const traceId = generateTraceId(); + const tenant = this.resolveTenant(); + return this.http.get(`${this.baseUrl}/gate/profiles/effective`, { + headers: this.buildHeaders(tenant, traceId), + }); + } + + validatePolicyYaml(yaml: string): Observable { + const traceId = generateTraceId(); + const tenant = this.resolveTenant(); + return this.http.post( + `${this.baseUrl}/gate/profiles/validate`, + { yaml }, + { headers: this.buildHeaders(tenant, traceId) } + ); + } + + // ---- Simulation ---- + + simulate(request: PolicySimulationRequest): Observable { + const traceId = generateTraceId(); + const tenant = this.resolveTenant(); + return this.http.post( + `${this.baseUrl}/gate/simulate`, + request, + { headers: this.buildHeaders(tenant, traceId) } + ); + } + + simulateBundle(promotionId: string, profileIdOrName?: string): Observable { + const traceId = generateTraceId(); + const tenant = this.resolveTenant(); + const body: Record = { promotionId }; + if (profileIdOrName) { + body['profileIdOrName'] = profileIdOrName; + } + return this.http.post( + `${this.baseUrl}/gate/simulate/bundle`, + body, + { headers: this.buildHeaders(tenant, traceId) } + ); + } + + // ---- Feed freshness ---- + + getFeedFreshnessSummary(): Observable { + const traceId = generateTraceId(); + const tenant = this.resolveTenant(); + return this.http.get(`${this.baseUrl}/gate/feeds/freshness`, { + headers: this.buildHeaders(tenant, traceId), + }); + } + + getFeedFreshness(feedName: string): Observable { + const traceId = generateTraceId(); + const tenant = this.resolveTenant(); + return this.http.get( + `${this.baseUrl}/gate/feeds/freshness/${encodeURIComponent(feedName)}`, + { headers: this.buildHeaders(tenant, traceId) } + ).pipe( + catchError(() => of(null)) + ); + } + + // ---- Air-gap status ---- + + getAirGapStatus(): Observable { + const traceId = generateTraceId(); + const tenant = this.resolveTenant(); + return this.http.get(`${this.baseUrl}/gate/airgap/status`, { + headers: this.buildHeaders(tenant, traceId), + }); + } + + // ---- Private helpers ---- + + private resolveTenant(tenantId?: string): string { + const tenant = (tenantId && tenantId.trim()) || this.authSession.getActiveTenantId(); + return tenant ?? 'default'; + } + + private buildHeaders(tenantId: string, traceId: string): HttpHeaders { + return new HttpHeaders({ + 'Content-Type': 'application/json', + 'X-StellaOps-Tenant': tenantId, + 'X-Stella-Trace-Id': traceId, + 'X-Stella-Request-Id': traceId, + }); + } +} + // ============================================================================= // Mock API Implementation // ============================================================================= diff --git a/src/Web/StellaOps.Web/src/app/core/api/policy-simulation.client.ts b/src/Web/StellaOps.Web/src/app/core/api/policy-simulation.client.ts index d1eb5fd7b..81e28018f 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/policy-simulation.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/policy-simulation.client.ts @@ -427,10 +427,7 @@ export class PolicySimulationHttpClient implements PolicySimulationApi { private resolveTenant(tenantId?: string): string { const tenant = (tenantId && tenantId.trim()) || this.authSession.getActiveTenantId(); - if (!tenant) { - throw new Error('PolicySimulationHttpClient requires an active tenant identifier.'); - } - return tenant; + return tenant ?? 'default'; } private buildHeaders(tenantId: string, traceId: string): HttpHeaders { diff --git a/src/Web/StellaOps.Web/src/app/core/api/release.client.ts b/src/Web/StellaOps.Web/src/app/core/api/release.client.ts index 3f500409c..7a7dd2d9e 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/release.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/release.client.ts @@ -1,5 +1,6 @@ -import { Injectable, InjectionToken } from '@angular/core'; -import { Observable, of, delay } from 'rxjs'; +import { Injectable, InjectionToken, inject } from '@angular/core'; +import { HttpClient, HttpErrorResponse } from '@angular/common/http'; +import { Observable, of, delay, catchError, throwError } from 'rxjs'; import { Release, ReleaseArtifact, @@ -28,6 +29,64 @@ export interface ReleaseApi { requestBypass(releaseId: string, reason: string): Observable<{ requestId: string }>; } +// ============================================================================ +// HTTP Client Implementation +// ============================================================================ + +@Injectable({ providedIn: 'root' }) +export class ReleaseHttpClient implements ReleaseApi { + private readonly http = inject(HttpClient); + private readonly baseUrl = '/api/releases'; + + getRelease(releaseId: string): Observable { + return this.http + .get(`${this.baseUrl}/${encodeURIComponent(releaseId)}`) + .pipe(catchError((err) => throwError(() => this.normalizeError(err)))); + } + + listReleases(): Observable { + return this.http + .get(this.baseUrl) + .pipe(catchError((err) => throwError(() => this.normalizeError(err)))); + } + + publishRelease(releaseId: string): Observable { + return this.http + .post(`${this.baseUrl}/${encodeURIComponent(releaseId)}/publish`, {}) + .pipe(catchError((err) => throwError(() => this.normalizeError(err)))); + } + + cancelRelease(releaseId: string): Observable { + return this.http + .post(`${this.baseUrl}/${encodeURIComponent(releaseId)}/cancel`, {}) + .pipe(catchError((err) => throwError(() => this.normalizeError(err)))); + } + + getFeatureFlags(): Observable { + return this.http + .get(`${this.baseUrl}/feature-flags`) + .pipe(catchError((err) => throwError(() => this.normalizeError(err)))); + } + + requestBypass(releaseId: string, reason: string): Observable<{ requestId: string }> { + return this.http + .post<{ requestId: string }>(`${this.baseUrl}/${encodeURIComponent(releaseId)}/bypass`, { reason }) + .pipe(catchError((err) => throwError(() => this.normalizeError(err)))); + } + + private normalizeError(err: unknown): Error { + if (err instanceof HttpErrorResponse) { + const message = err.error?.message ?? err.message ?? 'Release API request failed'; + const normalized = new Error(message); + (normalized as any).status = err.status; + (normalized as any).statusText = err.statusText; + return normalized; + } + if (err instanceof Error) return err; + return new Error('Release API request failed'); + } +} + // ============================================================================ // Mock Data Fixtures // ============================================================================ diff --git a/src/Web/StellaOps.Web/src/app/core/api/risk-http.client.ts b/src/Web/StellaOps.Web/src/app/core/api/risk-http.client.ts index 40a85cd87..506aee413 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/risk-http.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/risk-http.client.ts @@ -158,9 +158,6 @@ export class RiskHttpClient implements RiskApi { private resolveTenant(tenantId?: string): string { const tenant = (tenantId && tenantId.trim()) || this.authSession.getActiveTenantId(); - if (!tenant) { - throw new Error('RiskHttpClient requires an active tenant identifier.'); - } - return tenant; + return tenant ?? 'default'; } } diff --git a/src/Web/StellaOps.Web/src/app/core/api/scheduler.client.ts b/src/Web/StellaOps.Web/src/app/core/api/scheduler.client.ts index 727589654..1ef5ad7f8 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/scheduler.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/scheduler.client.ts @@ -4,7 +4,8 @@ */ import { Injectable, InjectionToken, Inject } from '@angular/core'; import { HttpClient, HttpHeaders } from '@angular/common/http'; -import { Observable } from 'rxjs'; +import { Observable, of } from 'rxjs'; +import { delay } from 'rxjs/operators'; import { AuthSessionStore } from '../auth/auth-session.store'; import type { Schedule, @@ -126,3 +127,71 @@ export class SchedulerHttpClient implements SchedulerApi { return new HttpHeaders(headers); } } + +// ============================================================================ +// Mock Implementation +// ============================================================================ + +@Injectable({ providedIn: 'root' }) +export class MockSchedulerClient implements SchedulerApi { + private schedules: Schedule[] = [ + { id: 'sch-1', name: 'Nightly Vulnerability Sync', description: 'Synchronize vulnerability feeds from upstream sources', cronExpression: '0 2 * * *', timezone: 'UTC', enabled: true, taskType: 'vulnerability-sync', taskConfig: { sources: ['osv', 'nvd'] }, lastRunAt: '2026-02-16T02:00:00Z', nextRunAt: '2026-02-17T02:00:00Z', createdAt: '2026-01-01T00:00:00Z', updatedAt: '2026-02-15T00:00:00Z', createdBy: 'admin', tags: ['security', 'nightly'], retryPolicy: { maxRetries: 3, backoffMultiplier: 2, initialDelayMs: 5000, maxDelayMs: 60000 }, concurrencyLimit: 1 }, + { id: 'sch-2', name: 'SBOM Refresh', description: 'Re-scan all registered artifacts for SBOM updates', cronExpression: '0 4 * * 0', timezone: 'UTC', enabled: true, taskType: 'sbom-refresh', taskConfig: { scope: 'all' }, lastRunAt: '2026-02-09T04:00:00Z', nextRunAt: '2026-02-16T04:00:00Z', createdAt: '2026-01-05T00:00:00Z', updatedAt: '2026-02-09T00:00:00Z', createdBy: 'admin', tags: ['sbom', 'weekly'], retryPolicy: { maxRetries: 2, backoffMultiplier: 2, initialDelayMs: 10000, maxDelayMs: 120000 }, concurrencyLimit: 2 }, + { id: 'sch-3', name: 'Advisory Update Check', description: 'Check for new security advisories from configured sources', cronExpression: '0 */6 * * *', timezone: 'UTC', enabled: true, taskType: 'advisory-update', taskConfig: { sources: ['cisa', 'mitre'] }, lastRunAt: '2026-02-16T00:00:00Z', nextRunAt: '2026-02-16T06:00:00Z', createdAt: '2026-01-01T00:00:00Z', updatedAt: '2026-02-01T00:00:00Z', createdBy: 'admin', tags: ['security', 'advisories'], retryPolicy: { maxRetries: 3, backoffMultiplier: 2, initialDelayMs: 5000, maxDelayMs: 60000 }, concurrencyLimit: 1 }, + { id: 'sch-4', name: 'Evidence Export', description: 'Export evidence bundles to configured destinations', cronExpression: '0 6 1 * *', timezone: 'UTC', enabled: false, taskType: 'export', taskConfig: { destination: 's3', format: 'bundle' }, lastRunAt: '2026-02-01T06:00:00Z', nextRunAt: undefined, createdAt: '2026-01-15T00:00:00Z', updatedAt: '2026-02-15T10:00:00Z', createdBy: 'admin', tags: ['evidence', 'monthly'], retryPolicy: { maxRetries: 2, backoffMultiplier: 2, initialDelayMs: 15000, maxDelayMs: 300000 }, concurrencyLimit: 1 }, + ]; + + listSchedules(): Observable { + return of([...this.schedules]).pipe(delay(300)); + } + + getSchedule(id: string): Observable { + const s = this.schedules.find(s => s.id === id); + return of(s ?? this.schedules[0]).pipe(delay(200)); + } + + createSchedule(dto: CreateScheduleDto): Observable { + const s: Schedule = { ...dto, id: `sch-${Date.now()}`, taskConfig: dto.taskConfig ?? {}, lastRunAt: undefined, nextRunAt: new Date().toISOString(), createdAt: new Date().toISOString(), updatedAt: new Date().toISOString(), createdBy: 'admin', tags: dto.tags ?? [], retryPolicy: dto.retryPolicy ?? { maxRetries: 3, backoffMultiplier: 2, initialDelayMs: 5000, maxDelayMs: 60000 }, concurrencyLimit: dto.concurrencyLimit ?? 1 }; + this.schedules.push(s); + return of(s).pipe(delay(300)); + } + + updateSchedule(id: string, dto: UpdateScheduleDto): Observable { + const idx = this.schedules.findIndex(s => s.id === id); + if (idx >= 0) { Object.assign(this.schedules[idx], dto, { updatedAt: new Date().toISOString() }); } + return of(this.schedules[idx] ?? this.schedules[0]).pipe(delay(300)); + } + + deleteSchedule(id: string): Observable { + this.schedules = this.schedules.filter(s => s.id !== id); + return of(void 0).pipe(delay(200)); + } + + pauseSchedule(id: string): Observable { + const s = this.schedules.find(s => s.id === id); + if (s) s.enabled = false; + return of(void 0).pipe(delay(200)); + } + + resumeSchedule(id: string): Observable { + const s = this.schedules.find(s => s.id === id); + if (s) s.enabled = true; + return of(void 0).pipe(delay(200)); + } + + triggerSchedule(_id: string): Observable { + return of(void 0).pipe(delay(200)); + } + + previewImpact(schedule: CreateScheduleDto): Observable { + return of({ + scheduleId: 'preview', + proposedChange: 'enable' as const, + affectedRuns: 0, + nextRunTime: new Date().toISOString(), + estimatedLoad: 0.15, + conflicts: [], + warnings: schedule.concurrencyLimit && schedule.concurrencyLimit > 3 ? ['High concurrency limit may impact other schedules'] : [], + }).pipe(delay(200)); + } +} diff --git a/src/Web/StellaOps.Web/src/app/core/api/score.client.ts b/src/Web/StellaOps.Web/src/app/core/api/score.client.ts index 692fd4026..82aef2eb8 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/score.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/score.client.ts @@ -197,7 +197,9 @@ export class HttpScoreClient implements ScoreApi { private readonly config = inject(AppConfigService); private get baseUrl(): string { - return `${this.config.apiBaseUrl}/api/v1/scores`; + const gatewayBase = this.config.config.apiBaseUrls.gateway ?? this.config.config.apiBaseUrls.authority; + const normalized = gatewayBase.endsWith('/') ? gatewayBase.slice(0, -1) : gatewayBase; + return `${normalized}/api/v1/scores`; } getScoreSummary(scanId: string): Observable { diff --git a/src/Web/StellaOps.Web/src/app/core/api/security-findings.client.ts b/src/Web/StellaOps.Web/src/app/core/api/security-findings.client.ts index fd4d8da60..bea8c55ad 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/security-findings.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/security-findings.client.ts @@ -4,7 +4,8 @@ */ import { Injectable, InjectionToken, Inject } from '@angular/core'; import { HttpClient, HttpHeaders, HttpParams } from '@angular/common/http'; -import { Observable } from 'rxjs'; +import { Observable, of } from 'rxjs'; +import { delay, map } from 'rxjs/operators'; import { AuthSessionStore } from '../auth/auth-session.store'; // ============================================================================ @@ -73,14 +74,16 @@ export class SecurityFindingsHttpClient implements SecurityFindingsApi { if (filter?.environment) params = params.set('environment', filter.environment); if (filter?.limit) params = params.set('limit', filter.limit.toString()); if (filter?.sort) params = params.set('sort', filter.sort); - return this.http.get(`${this.baseUrl}/api/v1/findings`, { + return this.http.get(`${this.baseUrl}/api/v1/findings/summaries`, { params, headers: this.buildHeaders(), - }); + }).pipe( + map((res: any) => Array.isArray(res) ? res : (res?.items ?? [])), + ); } getFinding(findingId: string): Observable { - return this.http.get(`${this.baseUrl}/api/v1/findings/${findingId}`, { + return this.http.get(`${this.baseUrl}/api/v1/findings/${findingId}/summary`, { headers: this.buildHeaders(), }); } @@ -94,3 +97,45 @@ export class SecurityFindingsHttpClient implements SecurityFindingsApi { return new HttpHeaders(headers); } } + +// ============================================================================ +// Mock Implementation +// ============================================================================ + +@Injectable({ providedIn: 'root' }) +export class MockSecurityFindingsClient implements SecurityFindingsApi { + listFindings(_filter?: FindingsFilter): Observable { + const data: FindingDto[] = [ + { id: 'f-1', package: 'lodash', version: '4.17.20', severity: 'CRITICAL', cvss: 9.8, reachable: true, reachabilityConfidence: 0.95, vexStatus: 'affected', releaseId: 'rel-1', releaseVersion: '1.2.3', delta: 'new', environments: ['prod', 'staging'], firstSeen: '2026-02-10T08:00:00Z' }, + { id: 'f-2', package: 'jackson-databind', version: '2.14.0', severity: 'HIGH', cvss: 7.5, reachable: true, reachabilityConfidence: 0.88, vexStatus: 'under_investigation', releaseId: 'rel-1', releaseVersion: '1.2.3', delta: 'unchanged', environments: ['prod'], firstSeen: '2026-02-08T10:00:00Z' }, + { id: 'f-3', package: 'express', version: '4.18.1', severity: 'MEDIUM', cvss: 5.3, reachable: false, reachabilityConfidence: 0.72, vexStatus: 'not_affected', releaseId: 'rel-2', releaseVersion: '2.0.0', delta: 'unchanged', environments: ['dev', 'staging'], firstSeen: '2026-01-28T12:00:00Z' }, + { id: 'f-4', package: 'netty', version: '4.1.86', severity: 'HIGH', cvss: 7.2, reachable: null, vexStatus: 'none', releaseId: 'rel-3', releaseVersion: '3.1.0', delta: 'new', environments: ['prod', 'staging', 'dev'], firstSeen: '2026-02-14T09:00:00Z' }, + { id: 'f-5', package: 'openssl', version: '3.0.8', severity: 'CRITICAL', cvss: 9.1, reachable: true, reachabilityConfidence: 0.99, vexStatus: 'affected', releaseId: 'rel-1', releaseVersion: '1.2.3', delta: 'unchanged', environments: ['prod'], firstSeen: '2026-02-01T06:00:00Z' }, + { id: 'f-6', package: 'spring-core', version: '6.0.4', severity: 'MEDIUM', cvss: 6.1, reachable: false, vexStatus: 'fixed', releaseId: 'rel-2', releaseVersion: '2.0.0', delta: 'resolved', environments: ['staging'], firstSeen: '2026-01-20T14:00:00Z' }, + { id: 'f-7', package: 'axios', version: '1.3.0', severity: 'LOW', cvss: 3.7, reachable: false, vexStatus: 'none', releaseId: 'rel-4', releaseVersion: '4.0.0-beta', delta: 'new', environments: ['dev'], firstSeen: '2026-02-15T11:00:00Z' }, + ]; + return of(data).pipe(delay(300)); + } + + getFinding(findingId: string): Observable { + return of({ + id: findingId, + package: 'lodash', + version: '4.17.20', + severity: 'CRITICAL' as const, + cvss: 9.8, + reachable: true, + reachabilityConfidence: 0.95, + vexStatus: 'affected', + releaseId: 'rel-1', + releaseVersion: '1.2.3', + delta: 'new', + environments: ['prod', 'staging'], + firstSeen: '2026-02-10T08:00:00Z', + description: 'Prototype Pollution in lodash allows attackers to manipulate JavaScript objects via crafted input.', + references: ['https://nvd.nist.gov/vuln/detail/CVE-2025-1234'], + affectedVersions: ['< 4.17.21'], + fixedVersions: ['4.17.21'], + }).pipe(delay(200)); + } +} diff --git a/src/Web/StellaOps.Web/src/app/core/api/security-overview.client.ts b/src/Web/StellaOps.Web/src/app/core/api/security-overview.client.ts index d26701754..71a4fbff1 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/security-overview.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/security-overview.client.ts @@ -5,7 +5,7 @@ import { Injectable, InjectionToken, Inject } from '@angular/core'; import { HttpClient, HttpHeaders } from '@angular/common/http'; import { Observable, forkJoin, of } from 'rxjs'; -import { catchError, map } from 'rxjs/operators'; +import { catchError, delay, map } from 'rxjs/operators'; import { AuthSessionStore } from '../auth/auth-session.store'; import { SECURITY_FINDINGS_API_BASE_URL } from './security-findings.client'; import { POLICY_EXCEPTIONS_API_BASE_URL } from './policy-exceptions.client'; @@ -84,13 +84,16 @@ export class SecurityOverviewHttpClient implements SecurityOverviewApi { getOverviewStats(): Observable { const headers = this.buildHeaders(); - const findings$ = this.http.get( - `${this.scannerBaseUrl}/api/v1/findings`, + const findings$ = this.http.get( + `${this.scannerBaseUrl}/api/v1/findings/summaries`, { headers } - ).pipe(catchError(() => of([] as any[]))); + ).pipe( + map((res: any) => Array.isArray(res) ? res : (res?.items ?? [])), + catchError(() => of([] as any[])), + ); const exceptions$ = this.http.get( - `${this.policyBaseUrl}/policyGateway/api/v1/policy/exception/requests`, + `${this.policyBaseUrl}/api/policy/exceptions`, { params: { status: 'active' }, headers } ).pipe(catchError(() => of([] as any[]))); @@ -165,3 +168,34 @@ export class SecurityOverviewHttpClient implements SecurityOverviewApi { return new HttpHeaders(headers); } } + +// ============================================================================ +// Mock Implementation +// ============================================================================ + +@Injectable({ providedIn: 'root' }) +export class MockSecurityOverviewClient implements SecurityOverviewApi { + getOverviewStats(): Observable { + return of({ + stats: { critical: 2, high: 5, medium: 8, low: 12, reachable: 4 }, + vexStats: { covered: 15, pending: 12 }, + recentFindings: [ + { id: 'f-1', package: 'lodash:4.17.20', severity: 'CRITICAL', reachable: true, time: '2026-02-15T08:00:00Z' }, + { id: 'f-2', package: 'jackson-databind:2.14.0', severity: 'HIGH', reachable: true, time: '2026-02-14T10:00:00Z' }, + { id: 'f-3', package: 'express:4.18.1', severity: 'MEDIUM', reachable: false, time: '2026-02-13T12:00:00Z' }, + { id: 'f-4', package: 'netty:4.1.86', severity: 'HIGH', reachable: false, time: '2026-02-12T09:00:00Z' }, + { id: 'f-5', package: 'openssl:3.0.8', severity: 'CRITICAL', reachable: true, time: '2026-02-11T06:00:00Z' }, + ], + topPackages: [ + { name: 'lodash', version: '4.17.20', critical: 1, high: 2, medium: 1 }, + { name: 'jackson-databind', version: '2.14.0', critical: 0, high: 3, medium: 2 }, + { name: 'netty', version: '4.1.86', critical: 1, high: 1, medium: 0 }, + { name: 'express', version: '4.18.1', critical: 0, high: 0, medium: 3 }, + ], + activeExceptions: [ + { id: 'ex-1', finding: 'CVE-2025-3456', reason: 'Mitigated by WAF rules', expiresIn: '14 days' }, + { id: 'ex-2', finding: 'CVE-2025-7890', reason: 'Not reachable in our deployment', expiresIn: '7 days' }, + ], + }).pipe(delay(300)); + } +} diff --git a/src/Web/StellaOps.Web/src/app/core/api/vex-consensus.client.ts b/src/Web/StellaOps.Web/src/app/core/api/vex-consensus.client.ts index 3e36f48c2..8b55a8c28 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/vex-consensus.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/vex-consensus.client.ts @@ -377,11 +377,6 @@ export class VexConsensusHttpClient implements VexConsensusApi { if (traceId) headers = headers.set('X-Stella-Trace-Id', traceId); if (ifNoneMatch) headers = headers.set('If-None-Match', ifNoneMatch); - const session = this.authStore.session(); - if (session?.tokens.accessToken) { - headers = headers.set('Authorization', `Bearer ${session.tokens.accessToken}`); - } - return headers; } @@ -389,10 +384,7 @@ export class VexConsensusHttpClient implements VexConsensusApi { const tenant = tenantId?.trim() || this.tenantService.activeTenantId() || this.authStore.getActiveTenantId(); - if (!tenant) { - throw new Error('VexConsensusHttpClient requires an active tenant identifier.'); - } - return tenant; + return tenant ?? 'default'; } private cacheStatement(statement: VexConsensusStatement): void { diff --git a/src/Web/StellaOps.Web/src/app/core/api/vex-decisions.client.ts b/src/Web/StellaOps.Web/src/app/core/api/vex-decisions.client.ts index dd7f84572..a601872b1 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/vex-decisions.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/vex-decisions.client.ts @@ -106,11 +106,6 @@ export class VexDecisionsHttpClient implements VexDecisionsApi { if (projectId) headers = headers.set('X-Stella-Project', projectId); if (ifNoneMatch) headers = headers.set('If-None-Match', ifNoneMatch); - const session = this.authSession.session(); - if (session?.tokens.accessToken) { - headers = headers.set('Authorization', `Bearer ${session.tokens.accessToken}`); - } - return headers; } @@ -127,8 +122,7 @@ export class VexDecisionsHttpClient implements VexDecisionsApi { private resolveTenant(tenantId?: string): string { const tenant = tenantId ?? this.tenantService.activeTenantId(); - if (!tenant) throw new Error('VexDecisionsHttpClient requires an active tenant identifier.'); - return tenant; + return tenant ?? 'default'; } } diff --git a/src/Web/StellaOps.Web/src/app/core/api/vex-evidence.client.ts b/src/Web/StellaOps.Web/src/app/core/api/vex-evidence.client.ts index b5b8d9c8a..7a3d62f5c 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/vex-evidence.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/vex-evidence.client.ts @@ -128,10 +128,7 @@ export class VexEvidenceHttpClient implements VexEvidenceApi { private resolveTenant(tenantId?: string): string { const tenant = (tenantId && tenantId.trim()) || this.authSession.getActiveTenantId(); - if (!tenant) { - throw new Error('VexEvidenceHttpClient requires an active tenant identifier.'); - } - return tenant; + return tenant ?? 'default'; } private buildHeaders(tenantId: string, traceId: string, projectId?: string, ifNoneMatch?: string): HttpHeaders { diff --git a/src/Web/StellaOps.Web/src/app/core/api/vex-hub.client.ts b/src/Web/StellaOps.Web/src/app/core/api/vex-hub.client.ts index 8627ef01c..6a8493a63 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/vex-hub.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/vex-hub.client.ts @@ -74,16 +74,16 @@ export class VexHubApiHttpClient implements VexHubApi { const headers = this.buildHeaders(traceId); let httpParams = new HttpParams(); - if (params.cveId) httpParams = httpParams.set('cveId', params.cveId); - if (params.product) httpParams = httpParams.set('product', params.product); + if (params.cveId) httpParams = httpParams.set('vulnerabilityId', params.cveId); + if (params.product) httpParams = httpParams.set('productKey', params.product); if (params.status) httpParams = httpParams.set('status', params.status); - if (params.source) httpParams = httpParams.set('source', params.source); + if (params.source) httpParams = httpParams.set('sourceId', params.source); if (params.dateFrom) httpParams = httpParams.set('dateFrom', params.dateFrom); if (params.dateTo) httpParams = httpParams.set('dateTo', params.dateTo); if (params.limit) httpParams = httpParams.set('limit', params.limit.toString()); if (params.offset) httpParams = httpParams.set('offset', params.offset.toString()); - return this.http.get(`${this.baseUrl}/statements`, { headers, params: httpParams }).pipe( + return this.http.get(`${this.baseUrl}/search`, { headers, params: httpParams }).pipe( catchError((err) => throwError(() => this.mapError(err, traceId))) ); } @@ -92,7 +92,7 @@ export class VexHubApiHttpClient implements VexHubApi { const traceId = options.traceId ?? generateTraceId(); const headers = this.buildHeaders(traceId); - return this.http.get(`${this.baseUrl}/statements/${encodeURIComponent(statementId)}`, { headers }).pipe( + return this.http.get(`${this.baseUrl}/statement/${encodeURIComponent(statementId)}`, { headers }).pipe( catchError((err) => throwError(() => this.mapError(err, traceId))) ); } @@ -119,7 +119,19 @@ export class VexHubApiHttpClient implements VexHubApi { const traceId = options.traceId ?? generateTraceId(); const headers = this.buildHeaders(traceId); - return this.http.get(`${this.baseUrl}/stats`, { headers }).pipe( + return this.http.get(`${this.baseUrl}/stats`, { headers }).pipe( + map((res: any) => ({ + totalStatements: res.totalStatements ?? 0, + byStatus: res.byStatus ?? { + affected: 0, + not_affected: 0, + fixed: 0, + under_investigation: 0, + }, + bySource: res.bySource ?? {}, + recentActivity: res.recentActivity ?? [], + trends: res.trends, + } as VexHubStats)), catchError((err) => throwError(() => this.mapError(err, traceId))) ); } @@ -202,6 +214,9 @@ export class VexHubApiHttpClient implements VexHubApi { } private mapError(err: unknown, traceId: string): Error { + if (err && typeof err === 'object' && 'status' in err && 'message' in err) { + return new Error(`[${traceId}] VEX Hub error: ${(err as any).status} ${(err as any).statusText ?? (err as any).message}`); + } if (err instanceof Error) { return new Error(`[${traceId}] VEX Hub error: ${err.message}`); } diff --git a/src/Web/StellaOps.Web/src/app/core/api/vuln-export-orchestrator.service.ts b/src/Web/StellaOps.Web/src/app/core/api/vuln-export-orchestrator.service.ts index 6744f58a7..9394a3f04 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/vuln-export-orchestrator.service.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/vuln-export-orchestrator.service.ts @@ -490,10 +490,7 @@ export class VulnExportOrchestratorService implements VulnExportOrchestratorApi const tenant = tenantId?.trim() || this.tenantService.activeTenantId() || this.authStore.getActiveTenantId(); - if (!tenant) { - throw new Error('VulnExportOrchestratorService requires an active tenant identifier.'); - } - return tenant; + return tenant ?? 'default'; } private createError(code: string, message: string, traceId: string): Error { diff --git a/src/Web/StellaOps.Web/src/app/core/api/vulnerability-http.client.ts b/src/Web/StellaOps.Web/src/app/core/api/vulnerability-http.client.ts index bdad6ef25..4f9874761 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/vulnerability-http.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/vulnerability-http.client.ts @@ -368,18 +368,6 @@ export class VulnerabilityHttpClient implements VulnerabilityApi { if (traceId) headers = headers.set('X-Stella-Trace-Id', traceId); if (requestId) headers = headers.set('X-Request-Id', requestId); - // Add anti-forgery token if available - const session = this.authSession.session(); - if (session?.tokens.accessToken) { - headers = headers.set('Authorization', `Bearer ${session.tokens.accessToken}`); - } - - // Add DPoP proof if available (for proof-of-possession) - const dpopThumbprint = session?.dpopKeyThumbprint; - if (dpopThumbprint) { - headers = headers.set('X-DPoP-Thumbprint', dpopThumbprint); - } - return headers; } @@ -388,10 +376,7 @@ export class VulnerabilityHttpClient implements VulnerabilityApi { const tenant = (tenantId && tenantId.trim()) || this.tenantService.activeTenantId() || this.authSession.getActiveTenantId(); - if (!tenant) { - throw new Error('VulnerabilityHttpClient requires an active tenant identifier.'); - } - return tenant; + return tenant ?? 'default'; } private generateRequestId(): string { diff --git a/src/Web/StellaOps.Web/src/app/core/auth/auth-storage.service.ts b/src/Web/StellaOps.Web/src/app/core/auth/auth-storage.service.ts index 7017dc161..3ab3fdb94 100644 --- a/src/Web/StellaOps.Web/src/app/core/auth/auth-storage.service.ts +++ b/src/Web/StellaOps.Web/src/app/core/auth/auth-storage.service.ts @@ -1,6 +1,6 @@ import { Injectable } from '@angular/core'; -const LOGIN_REQUEST_KEY = 'stellaops.auth.login.request'; +const LOGIN_REQUEST_PREFIX = 'stellaops.auth.login.'; export interface PendingLoginRequest { readonly state: string; @@ -18,7 +18,11 @@ export class AuthStorageService { if (typeof sessionStorage === 'undefined') { return; } - sessionStorage.setItem(LOGIN_REQUEST_KEY, JSON.stringify(request)); + sessionStorage.setItem( + LOGIN_REQUEST_PREFIX + request.state, + JSON.stringify(request) + ); + this.pruneStaleEntries(); } consumePendingLogin(expectedState: string): PendingLoginRequest | null { @@ -26,12 +30,13 @@ export class AuthStorageService { return null; } - const raw = sessionStorage.getItem(LOGIN_REQUEST_KEY); + const key = LOGIN_REQUEST_PREFIX + expectedState; + const raw = sessionStorage.getItem(key); if (!raw) { return null; } - sessionStorage.removeItem(LOGIN_REQUEST_KEY); + sessionStorage.removeItem(key); try { const request = JSON.parse(raw) as PendingLoginRequest; if (request.state !== expectedState) { @@ -42,4 +47,27 @@ export class AuthStorageService { return null; } } + + /** Remove entries older than 10 minutes to prevent sessionStorage bloat. */ + private pruneStaleEntries(): void { + try { + const cutoff = Date.now() - 10 * 60 * 1000; + for (let i = sessionStorage.length - 1; i >= 0; i--) { + const key = sessionStorage.key(i); + if (!key?.startsWith(LOGIN_REQUEST_PREFIX)) continue; + const raw = sessionStorage.getItem(key); + if (!raw) continue; + try { + const entry = JSON.parse(raw) as PendingLoginRequest; + if (entry.createdAtEpochMs < cutoff) { + sessionStorage.removeItem(key); + } + } catch { + sessionStorage.removeItem(key); + } + } + } catch { + // Non-fatal + } + } } diff --git a/src/Web/StellaOps.Web/src/app/core/auth/scopes.ts b/src/Web/StellaOps.Web/src/app/core/auth/scopes.ts index be338a4ee..6cc44567e 100644 --- a/src/Web/StellaOps.Web/src/app/core/auth/scopes.ts +++ b/src/Web/StellaOps.Web/src/app/core/auth/scopes.ts @@ -128,6 +128,23 @@ export const StellaOpsScopes = { // Findings scope FINDINGS_READ: 'findings:read', + + // Notify scopes + NOTIFY_VIEWER: 'notify.viewer', + NOTIFY_OPERATOR: 'notify.operator', + NOTIFY_ADMIN: 'notify.admin', + + // Risk scopes + RISK_READ: 'risk:read', + + // Health scopes + HEALTH_READ: 'health:read', + + // Vulnerability scopes + VULN_VIEW: 'vuln:view', + VULN_INVESTIGATE: 'vuln:investigate', + VULN_OPERATE: 'vuln:operate', + VULN_AUDIT: 'vuln:audit', } as const; export type StellaOpsScope = (typeof StellaOpsScopes)[keyof typeof StellaOpsScopes]; @@ -334,6 +351,19 @@ export const ScopeLabels: Record = { 'exceptions:write': 'Create Exceptions', // Findings scope label 'findings:read': 'View Policy Findings', + // Notify scope labels + 'notify.viewer': 'View Notifications', + 'notify.operator': 'Operate Notifications', + 'notify.admin': 'Administer Notifications', + // Risk scope labels + 'risk:read': 'View Risk Profiles', + // Health scope labels + 'health:read': 'View Platform Health', + // Vulnerability scope labels + 'vuln:view': 'View Vulnerabilities', + 'vuln:investigate': 'Investigate Vulnerabilities', + 'vuln:operate': 'Operate Vulnerability Management', + 'vuln:audit': 'Audit Vulnerability Decisions', }; /** diff --git a/src/Web/StellaOps.Web/src/app/core/auth/tenant-activation.service.ts b/src/Web/StellaOps.Web/src/app/core/auth/tenant-activation.service.ts index 711215399..5793ef179 100644 --- a/src/Web/StellaOps.Web/src/app/core/auth/tenant-activation.service.ts +++ b/src/Web/StellaOps.Web/src/app/core/auth/tenant-activation.service.ts @@ -26,6 +26,7 @@ export type TenantScope = | 'advisory-ai' | 'ledger' | 'exception' + | 'exceptions' | 'aoc' | 'sbom' | 'attest' @@ -268,6 +269,16 @@ export class TenantActivationService { } const grantedScopes = new Set(session.scopes); + + // When scopes are not populated in the session (e.g. not extracted from token), + // skip client-side scope checks and let the backend enforce authorization. + if (grantedScopes.size === 0) { + if (resource && action) { + this.emitDecision({ resource, action, requiredScopes, decision: 'allow' }); + } + return { allowed: true, missingScopes: [] }; + } + const missingScopes = requiredScopes.filter(scope => !this.scopeMatches(scope, grantedScopes)); if (missingScopes.length > 0) { diff --git a/src/Web/StellaOps.Web/src/app/core/auth/tenant-http.interceptor.ts b/src/Web/StellaOps.Web/src/app/core/auth/tenant-http.interceptor.ts index b1358d1b7..1fe5f4eb3 100644 --- a/src/Web/StellaOps.Web/src/app/core/auth/tenant-http.interceptor.ts +++ b/src/Web/StellaOps.Web/src/app/core/auth/tenant-http.interceptor.ts @@ -11,6 +11,7 @@ import { AuthSessionStore } from './auth-session.store'; */ export const TENANT_HEADERS = { TENANT_ID: 'X-Tenant-Id', + STELLAOPS_TENANT: 'X-StellaOps-Tenant', PROJECT_ID: 'X-Project-Id', TRACE_ID: 'X-Stella-Trace-Id', REQUEST_ID: 'X-Request-Id', @@ -67,11 +68,10 @@ export class TenantHttpInterceptor implements HttpInterceptor { private addTenantHeaders(request: HttpRequest): HttpRequest { const headers: Record = {}; - // Add tenant ID - const tenantId = this.getTenantId(); - if (tenantId) { - headers[TENANT_HEADERS.TENANT_ID] = tenantId; - } + // Add tenant ID (use "default" if no active tenant) + const tenantId = this.getTenantId() ?? 'default'; + headers[TENANT_HEADERS.TENANT_ID] = tenantId; + headers[TENANT_HEADERS.STELLAOPS_TENANT] = tenantId; // Add project ID if active const projectId = this.tenantService.activeProjectId(); diff --git a/src/Web/StellaOps.Web/src/app/core/config/app-config.service.ts b/src/Web/StellaOps.Web/src/app/core/config/app-config.service.ts index 31a8fb961..bb6d2ff87 100644 --- a/src/Web/StellaOps.Web/src/app/core/config/app-config.service.ts +++ b/src/Web/StellaOps.Web/src/app/core/config/app-config.service.ts @@ -268,6 +268,7 @@ export class AppConfigService { private normalizeConfig(config: AppConfig): AppConfig { const authority = { ...config.authority, + ...this.normalizeAuthorityUrls(config.authority), dpopAlgorithms: config.authority.dpopAlgorithms?.length ?? 0 ? config.authority.dpopAlgorithms @@ -301,6 +302,42 @@ export class AppConfigService { }; } + /** + * Converts absolute Docker-internal authority URLs to relative paths so the + * OIDC flow stays on the same origin (the gateway) instead of redirecting + * to unreachable internal hostnames like https://stella-ops.local. + * + * The gateway proxies /connect/* to the authority service. + */ + private normalizeAuthorityUrls(auth: AuthorityConfig): Partial { + const overrides: Record = {}; + const origin = typeof window !== 'undefined' ? window.location.origin : ''; + if (!origin) return overrides; + + const urlFields: (keyof AuthorityConfig)[] = [ + 'issuer', 'authorizeEndpoint', 'tokenEndpoint', 'logoutEndpoint', + 'redirectUri', 'silentRefreshRedirectUri', 'postLogoutRedirectUri', + ]; + + for (const field of urlFields) { + const value = auth[field]; + if (typeof value !== 'string') continue; + + try { + const parsed = new URL(value); + if (parsed.hostname === 'stella-ops.local' || parsed.hostname.endsWith('.stella-ops.local')) { + // Rewrite to current origin so the OIDC flow stays on the gateway. + // The URL constructor requires an absolute base for proper URL building. + overrides[field] = origin + parsed.pathname + parsed.search + parsed.hash; + } + } catch { + // Not an absolute URL, leave as-is + } + } + + return overrides; + } + /** * Converts absolute Docker-internal URLs (e.g. http://scanner.stella-ops.local) * to relative paths (e.g. /scanner) so requests go through the gateway's @@ -320,6 +357,22 @@ export class AppConfigService { normalized[key] = value; } } + + // The Platform service uses distinct key names (policyGateway, policyEngine, + // findingsLedger, vexhub) while frontend clients expect canonical keys + // (policy, ledger, vex). When a canonical key is missing, default to empty + // string so the gateway's path-based routing dispatches to the correct + // backend service automatically. + if (!normalized['policy'] && (normalized['policyGateway'] || normalized['policyEngine'])) { + normalized['policy'] = ''; + } + if (!normalized['ledger'] && normalized['findingsLedger']) { + normalized['ledger'] = ''; + } + if (!normalized['vex'] && normalized['vexhub']) { + normalized['vex'] = ''; + } + return normalized as unknown as ApiBaseUrlConfig; } } diff --git a/src/Web/StellaOps.Web/src/app/core/config/backend-probe.service.ts b/src/Web/StellaOps.Web/src/app/core/config/backend-probe.service.ts index f6b12a178..e129c6e5a 100644 --- a/src/Web/StellaOps.Web/src/app/core/config/backend-probe.service.ts +++ b/src/Web/StellaOps.Web/src/app/core/config/backend-probe.service.ts @@ -55,32 +55,61 @@ export class BackendProbeService { try { const authorityBase = this.configService.config.authority.issuer; - // Relative issuer (e.g. "/authority") means config came from the static - // fallback — there is no real backend to probe yet. + // Relative issuer after normalization (e.g. "/" from a Docker-internal + // URL) is valid — the gateway proxies /.well-known to the authority. + // Only the static fallback "/authority" indicates no real backend. if (authorityBase.startsWith('/')) { - this.probeStatus.set('unreachable'); - this.probeError.set('Authority issuer is a relative path; no backend configured.'); + // Probe same-origin well-known endpoint through the gateway + const body = await firstValueFrom( + this.http + .get('/.well-known/openid-configuration', { responseType: 'text', withCredentials: false }) + .pipe(timeout(PROBE_TIMEOUT_MS)) + ); + let parsed: Record; + try { + parsed = JSON.parse(body as string); + } catch { + this.probeStatus.set('unreachable'); + this.probeError.set('Authority returned non-JSON response (likely SPA fallback).'); + return; + } + if (!parsed['issuer'] || !parsed['authorization_endpoint']) { + this.probeStatus.set('unreachable'); + this.probeError.set('Authority response is not a valid OIDC discovery document.'); + return; + } + this.probeStatus.set('reachable'); return; } - let normalized = authorityBase.endsWith('/') - ? authorityBase.slice(0, -1) - : authorityBase; + // When the issuer is a Docker-internal URL (e.g. https://stella-ops.local + // or https://authority.stella-ops.local), it is not reachable from the + // browser. The gateway proxies /.well-known to the authority service, + // so probe via same-origin instead. + let wellKnownUrl: string; + try { + const issuerHost = new URL(authorityBase).hostname; + if (issuerHost === 'stella-ops.local' || issuerHost.endsWith('.stella-ops.local')) { + wellKnownUrl = '/.well-known/openid-configuration'; + } else { + let normalized = authorityBase.endsWith('/') + ? authorityBase.slice(0, -1) + : authorityBase; - // Upgrade http → https when the SPA itself was loaded over HTTPS. - // This prevents mixed-content blocks when envsettings.json specifies - // http:// URLs but the browser enforces HTTPS-only fetch from an - // HTTPS origin. - if ( - typeof window !== 'undefined' && - window.location.protocol === 'https:' && - normalized.startsWith('http://') - ) { - normalized = normalized.replace(/^http:\/\//, 'https://'); + if ( + typeof window !== 'undefined' && + window.location.protocol === 'https:' && + normalized.startsWith('http://') + ) { + normalized = normalized.replace(/^http:\/\//, 'https://'); + } + + wellKnownUrl = `${normalized}/.well-known/openid-configuration`; + } + } catch { + wellKnownUrl = '/.well-known/openid-configuration'; } - const wellKnownUrl = `${normalized}/.well-known/openid-configuration`; - const body = await firstValueFrom( this.http .get(wellKnownUrl, { responseType: 'text', withCredentials: false }) diff --git a/src/Web/StellaOps.Web/src/app/core/services/fix-verification.service.ts b/src/Web/StellaOps.Web/src/app/core/services/fix-verification.service.ts index 3e83bac08..0dfad9730 100644 --- a/src/Web/StellaOps.Web/src/app/core/services/fix-verification.service.ts +++ b/src/Web/StellaOps.Web/src/app/core/services/fix-verification.service.ts @@ -176,13 +176,13 @@ export class MockFixVerificationApi implements FixVerificationApi { { functionName: 'vulnerable_func', status: verdict === 'fixed' ? 'modified' : verdict === 'partial' ? 'partially_modified' : 'unchanged', - statusIcon: verdict === 'fixed' ? '✓' : verdict === 'partial' ? '◐' : '✗', + statusIcon: verdict === 'fixed' ? '' : verdict === 'partial' ? '' : '', details: verdict === 'fixed' ? 'Bounds check inserted' : verdict === 'partial' ? 'Some paths still reachable' : 'No changes detected', children: [ { name: 'bb7→bb9', status: verdict === 'fixed' ? 'eliminated' : 'present', - statusIcon: verdict === 'fixed' ? '✗' : '○', + statusIcon: verdict === 'fixed' ? '' : '', details: verdict === 'fixed' ? 'Edge removed in patch' : 'Edge still present' } ] diff --git a/src/Web/StellaOps.Web/src/app/features/admin-notifications/admin-notifications.component.ts b/src/Web/StellaOps.Web/src/app/features/admin-notifications/admin-notifications.component.ts index 9e7417d93..6b2b5d47b 100644 --- a/src/Web/StellaOps.Web/src/app/features/admin-notifications/admin-notifications.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/admin-notifications/admin-notifications.component.ts @@ -422,7 +422,7 @@ type NotifyAdminTab = 'channels' | 'rules' | 'templates' | 'deliveries' | 'incid } .tab.active { color: var(--color-status-info-text); border-bottom-color: var(--color-status-info-text); font-weight: var(--font-weight-semibold); } - .tab-content { background: white; border-radius: var(--radius-lg); } + .tab-content { background: var(--color-surface-primary); border-radius: var(--radius-lg); } .tab-header { display: flex; justify-content: space-between; align-items: center; margin-bottom: 1rem; } .tab-header h2 { margin: 0; font-size: 1.25rem; } @@ -488,7 +488,7 @@ type NotifyAdminTab = 'channels' | 'rules' | 'templates' | 'deliveries' | 'incid .config-section { background: var(--color-surface-primary); padding: 1.5rem; border-radius: var(--radius-lg); } .config-section h3 { margin: 0 0 0.5rem; font-size: 1rem; } .section-desc { color: var(--color-text-secondary); font-size: 0.875rem; margin: 0 0 1rem; } - .config-item { display: flex; justify-content: space-between; align-items: center; padding: 0.75rem; background: white; border-radius: var(--radius-sm); margin-bottom: 0.5rem; } + .config-item { display: flex; justify-content: space-between; align-items: center; padding: 0.75rem; background: var(--color-surface-secondary); border-radius: var(--radius-sm); margin-bottom: 0.5rem; } `], changeDetection: ChangeDetectionStrategy.OnPush, }) diff --git a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/channel-management.component.ts b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/channel-management.component.ts index ce77e44b3..ca6614d87 100644 --- a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/channel-management.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/channel-management.component.ts @@ -382,7 +382,7 @@ interface ChannelTypeOption { padding: 0.5rem 0.75rem; border: 1px solid var(--color-border-secondary); border-radius: var(--radius-md); - background: white; + background: var(--color-surface-primary); } .channel-grid { @@ -393,7 +393,7 @@ interface ChannelTypeOption { .channel-card { padding: 1rem; - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-lg); transition: box-shadow 0.2s; @@ -565,7 +565,7 @@ interface ChannelTypeOption { flex-direction: column; align-items: center; padding: 1rem; - background: white; + background: var(--color-surface-secondary); border: 2px solid var(--color-border-primary); border-radius: var(--radius-lg); cursor: pointer; @@ -652,7 +652,7 @@ interface ChannelTypeOption { } .btn-primary:disabled { opacity: 0.6; cursor: not-allowed; } - .btn-secondary { background: white; color: var(--color-text-primary); border: 1px solid var(--color-border-secondary); } + .btn-secondary { background: var(--color-surface-primary); color: var(--color-text-primary); border: 1px solid var(--color-border-secondary); } .loading-state, .empty-state { display: flex; diff --git a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/delivery-analytics.component.ts b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/delivery-analytics.component.ts index dac07f93e..bd0ca18e3 100644 --- a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/delivery-analytics.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/delivery-analytics.component.ts @@ -265,7 +265,7 @@ import { NotifierDeliveryStats, NotifierDelivery } from '../../../core/api/notif } .btn { padding: 0.5rem 1rem; border-radius: var(--radius-md); font-size: 0.875rem; font-weight: var(--font-weight-medium); cursor: pointer; } - .btn-secondary { background: white; color: var(--color-text-primary); border: 1px solid var(--color-border-secondary); } + .btn-secondary { background: var(--color-surface-primary); color: var(--color-text-primary); border: 1px solid var(--color-border-secondary); } .loading-state { padding: 3rem; text-align: center; color: var(--color-text-secondary); } @@ -279,7 +279,7 @@ import { NotifierDeliveryStats, NotifierDelivery } from '../../../core/api/notif .metric-card { padding: 1rem; - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-lg); } @@ -360,7 +360,7 @@ import { NotifierDeliveryStats, NotifierDelivery } from '../../../core/api/notif /* Analytics Sections */ .analytics-section { padding: 1rem; - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-lg); margin-bottom: 1rem; @@ -501,7 +501,7 @@ import { NotifierDeliveryStats, NotifierDelivery } from '../../../core/api/notif flex-direction: column; align-items: center; padding: 1rem; - background: white; + background: var(--color-surface-secondary); border-radius: var(--radius-lg); border: 2px solid; } diff --git a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/delivery-history.component.ts b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/delivery-history.component.ts index dbf4bcd0b..efdd27660 100644 --- a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/delivery-history.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/delivery-history.component.ts @@ -380,7 +380,7 @@ import { padding: 0.5rem 0.75rem; border: 1px solid var(--color-border-secondary); border-radius: var(--radius-md); - background: white; + background: var(--color-surface-primary); min-width: 150px; } @@ -392,7 +392,7 @@ import { } .btn-primary { background: var(--color-status-info-text); color: var(--color-text-heading); border: none; } - .btn-secondary { background: white; color: var(--color-text-primary); border: 1px solid var(--color-border-secondary); } + .btn-secondary { background: var(--color-surface-primary); color: var(--color-text-primary); border: 1px solid var(--color-border-secondary); } .table-container { overflow-x: auto; @@ -567,7 +567,7 @@ import { } .modal-content { - background: white; + background: var(--color-surface-primary); border-radius: var(--radius-lg); width: 90%; max-width: 700px; @@ -667,7 +667,7 @@ import { .attempt-item { padding: 0.75rem; - background: white; + background: var(--color-surface-secondary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-md); } diff --git a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/escalation-config.component.ts b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/escalation-config.component.ts index c8d68a968..e0c416950 100644 --- a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/escalation-config.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/escalation-config.component.ts @@ -252,7 +252,7 @@ import { .btn { padding: 0.5rem 1rem; border-radius: var(--radius-md); font-size: 0.875rem; font-weight: var(--font-weight-medium); cursor: pointer; } .btn-primary { background: var(--color-status-info-text); color: var(--color-text-heading); border: none; } .btn-primary:disabled { opacity: 0.6; cursor: not-allowed; } - .btn-secondary { background: white; color: var(--color-text-primary); border: 1px solid var(--color-border-secondary); } + .btn-secondary { background: var(--color-surface-primary); color: var(--color-text-primary); border: 1px solid var(--color-border-secondary); } .btn-sm { padding: 0.375rem 0.75rem; font-size: 0.75rem; } .btn-icon { padding: 0.25rem 0.5rem; background: transparent; border: none; color: var(--color-status-info-text); font-size: 0.75rem; cursor: pointer; } .btn-icon.btn-danger { color: var(--color-status-error); } @@ -261,7 +261,7 @@ import { .policy-card { padding: 1rem; - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-lg); } @@ -390,7 +390,7 @@ import { .level-form { padding: 1rem; - background: white; + background: var(--color-surface-secondary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-md); margin-bottom: 1rem; @@ -443,7 +443,7 @@ import { flex-wrap: wrap; gap: 0.5rem; padding: 1rem; - background: white; + background: var(--color-surface-secondary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-md); } diff --git a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/notification-dashboard.component.ts b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/notification-dashboard.component.ts index 93d1c811d..8eb90ef6f 100644 --- a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/notification-dashboard.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/notification-dashboard.component.ts @@ -210,7 +210,7 @@ interface ConfigSubTab { align-items: center; gap: 0.75rem; padding: 1rem; - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-lg); transition: box-shadow 0.2s, transform 0.2s; @@ -323,12 +323,12 @@ interface ConfigSubTab { } .sub-tab-button:hover { - background: white; + background: var(--color-surface-primary); color: var(--color-status-info-text); } .sub-tab-button.active { - background: white; + background: var(--color-surface-primary); color: var(--color-status-info-text); border-color: var(--color-border-primary); box-shadow: var(--shadow-sm); @@ -336,7 +336,7 @@ interface ConfigSubTab { /* Tab Content */ .tab-content { - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-lg); min-height: 400px; @@ -399,7 +399,7 @@ interface ConfigSubTab { } .btn-secondary { - background: white; + background: var(--color-surface-primary); color: var(--color-text-primary); border-color: var(--color-border-secondary); } diff --git a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/notification-preview.component.ts b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/notification-preview.component.ts index f36e57d55..7aee2c302 100644 --- a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/notification-preview.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/notification-preview.component.ts @@ -118,7 +118,7 @@ import { NotifierPreviewResponse, NotifierChannelType } from '../../../core/api/ `, styles: [` .notification-preview { - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-lg); overflow: hidden; @@ -292,7 +292,7 @@ import { NotifierPreviewResponse, NotifierChannelType } from '../../../core/api/ .teams-card { display: flex; - background: white; + background: var(--color-surface-secondary); border-radius: var(--radius-sm); box-shadow: var(--shadow-sm); overflow: hidden; @@ -369,7 +369,7 @@ import { NotifierPreviewResponse, NotifierChannelType } from '../../../core/api/ display: flex; justify-content: space-between; padding: 0.5rem; - background: white; + background: var(--color-surface-secondary); border-radius: var(--radius-sm); border: 1px solid var(--color-border-primary); } diff --git a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/notification-rule-editor.component.ts b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/notification-rule-editor.component.ts index 82b66be2f..5ac68d85f 100644 --- a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/notification-rule-editor.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/notification-rule-editor.component.ts @@ -378,7 +378,7 @@ import { .action-card { padding: 1rem; margin-bottom: 1rem; - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-md); } @@ -420,7 +420,7 @@ import { } .btn-secondary { - background: white; + background: var(--color-surface-primary); color: var(--color-text-primary); border: 1px solid var(--color-border-secondary); } diff --git a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/notification-rule-list.component.ts b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/notification-rule-list.component.ts index 35eef58bb..700e683be 100644 --- a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/notification-rule-list.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/notification-rule-list.component.ts @@ -219,7 +219,7 @@ import { NotifierRule, NotifierRuleStatus, NotifierSeverity } from '../../../cor border: 1px solid var(--color-border-secondary); border-radius: var(--radius-md); font-size: 0.875rem; - background: white; + background: var(--color-surface-primary); } .btn { @@ -238,7 +238,7 @@ import { NotifierRule, NotifierRuleStatus, NotifierSeverity } from '../../../cor } .btn-secondary { - background: white; + background: var(--color-surface-primary); color: var(--color-text-primary); border: 1px solid var(--color-border-secondary); } diff --git a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/operator-override-management.component.ts b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/operator-override-management.component.ts index a2c1b7f5a..43503f54f 100644 --- a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/operator-override-management.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/operator-override-management.component.ts @@ -281,7 +281,7 @@ import { .btn { padding: 0.5rem 1rem; border-radius: var(--radius-md); font-size: 0.875rem; font-weight: var(--font-weight-medium); cursor: pointer; } .btn-primary { background: var(--color-status-info-text); color: var(--color-text-heading); border: none; } .btn-primary:disabled { opacity: 0.6; cursor: not-allowed; } - .btn-secondary { background: white; color: var(--color-text-primary); border: 1px solid var(--color-border-secondary); } + .btn-secondary { background: var(--color-surface-primary); color: var(--color-text-primary); border: 1px solid var(--color-border-secondary); } .btn-icon { padding: 0.25rem 0.5rem; background: transparent; border: none; color: var(--color-status-info-text); font-size: 0.75rem; cursor: pointer; } .btn-icon.btn-danger { color: var(--color-status-error); } @@ -289,7 +289,7 @@ import { .override-card { padding: 1rem; - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-lg); transition: all 0.2s; @@ -395,7 +395,7 @@ import { .preset-buttons { display: flex; flex-wrap: wrap; gap: 0.5rem; } .preset-btn { padding: 0.375rem 0.75rem; - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-secondary); border-radius: var(--radius-sm); font-size: 0.75rem; diff --git a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/operator-override.component.ts b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/operator-override.component.ts index 6d8a8f536..5820c6165 100644 --- a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/operator-override.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/operator-override.component.ts @@ -328,7 +328,7 @@ import { .btn { padding: 0.5rem 1rem; border-radius: var(--radius-md); font-size: 0.875rem; font-weight: var(--font-weight-medium); cursor: pointer; } .btn-primary { background: var(--color-status-info-text); color: var(--color-text-heading); border: none; } - .btn-secondary { background: white; color: var(--color-text-primary); border: 1px solid var(--color-border-secondary); } + .btn-secondary { background: var(--color-surface-primary); color: var(--color-text-primary); border: 1px solid var(--color-border-secondary); } .btn-sm { padding: 0.375rem 0.75rem; font-size: 0.75rem; } .btn-icon { padding: 0.25rem 0.5rem; background: transparent; border: none; color: var(--color-status-info-text); font-size: 0.75rem; cursor: pointer; } .btn-icon.btn-danger { color: var(--color-status-error); } @@ -377,7 +377,7 @@ import { .override-card { padding: 1rem; - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-lg); transition: border-color 0.15s; diff --git a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/quiet-hours-config.component.ts b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/quiet-hours-config.component.ts index 1563e6967..adba2c271 100644 --- a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/quiet-hours-config.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/quiet-hours-config.component.ts @@ -232,7 +232,7 @@ import { NotifierQuietHours, NotifierQuietHoursRequest, NotifierQuietWindow } fr .btn { padding: 0.5rem 1rem; border-radius: var(--radius-md); font-size: 0.875rem; font-weight: var(--font-weight-medium); cursor: pointer; } .btn-primary { background: var(--color-status-info-text); color: var(--color-text-heading); border: none; } - .btn-secondary { background: white; color: var(--color-text-primary); border: 1px solid var(--color-border-secondary); } + .btn-secondary { background: var(--color-surface-primary); color: var(--color-text-primary); border: 1px solid var(--color-border-secondary); } .btn-sm { padding: 0.375rem 0.75rem; font-size: 0.75rem; } .btn-icon { padding: 0.25rem 0.5rem; background: transparent; border: none; color: var(--color-status-info-text); font-size: 0.75rem; cursor: pointer; } .btn-icon.btn-danger { color: var(--color-status-error); } @@ -241,7 +241,7 @@ import { NotifierQuietHours, NotifierQuietHoursRequest, NotifierQuietWindow } fr .config-card { padding: 1rem; - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-lg); } @@ -315,7 +315,7 @@ import { NotifierQuietHours, NotifierQuietHoursRequest, NotifierQuietWindow } fr .day-checkbox { display: flex; align-items: center; gap: 0.25rem; font-size: 0.75rem; cursor: pointer; } .day-checkbox input { width: 14px; height: 14px; } - .window-form, .exemption-form { padding: 0.75rem; background: white; border: 1px solid var(--color-border-primary); border-radius: var(--radius-md); margin-bottom: 0.5rem; } + .window-form, .exemption-form { padding: 0.75rem; background: var(--color-surface-secondary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-md); margin-bottom: 0.5rem; } .form-footer { display: flex; justify-content: flex-end; gap: 1rem; padding-top: 1rem; border-top: 1px solid var(--color-border-primary); } diff --git a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/rule-simulator.component.ts b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/rule-simulator.component.ts index 762b1e597..8ec5782f1 100644 --- a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/rule-simulator.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/rule-simulator.component.ts @@ -342,7 +342,7 @@ import { .btn-primary { background: var(--color-status-info-text); color: var(--color-text-heading); border: none; } .btn-primary:disabled { opacity: 0.6; cursor: not-allowed; } - .btn-secondary { background: white; color: var(--color-text-primary); border: 1px solid var(--color-border-secondary); } + .btn-secondary { background: var(--color-surface-primary); color: var(--color-text-primary); border: 1px solid var(--color-border-secondary); } .btn-secondary:disabled { opacity: 0.6; cursor: not-allowed; } .quick-templates { @@ -365,7 +365,7 @@ import { .template-btn { padding: 0.375rem 0.75rem; - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-secondary); border-radius: var(--radius-sm); font-size: 0.75rem; @@ -380,7 +380,7 @@ import { /* Results Panel */ .result-card { - background: white; + background: var(--color-surface-secondary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-lg); padding: 1rem; diff --git a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/template-editor.component.ts b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/template-editor.component.ts index 62edd710a..3b23054c5 100644 --- a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/template-editor.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/template-editor.component.ts @@ -347,7 +347,7 @@ import { .btn-primary { background: var(--color-status-info-text); color: var(--color-text-heading); border: none; } .btn-primary:disabled { opacity: 0.6; cursor: not-allowed; } - .btn-secondary { background: white; color: var(--color-text-primary); border: 1px solid var(--color-border-secondary); } + .btn-secondary { background: var(--color-surface-primary); color: var(--color-text-primary); border: 1px solid var(--color-border-secondary); } .btn-sm { padding: 0.375rem 0.75rem; font-size: 0.75rem; } .btn-icon { @@ -424,7 +424,7 @@ import { } .preview-result { - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-md); padding: 1rem; diff --git a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/throttle-config.component.ts b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/throttle-config.component.ts index 4388fb55c..9a4fecbaf 100644 --- a/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/throttle-config.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/admin-notifications/components/throttle-config.component.ts @@ -296,7 +296,7 @@ type ThrottleScope = 'global' | 'channel' | 'rule' | 'event'; .btn { padding: 0.5rem 1rem; border-radius: var(--radius-md); font-size: 0.875rem; font-weight: var(--font-weight-medium); cursor: pointer; } .btn-primary { background: var(--color-status-info-text); color: var(--color-text-heading); border: none; } .btn-primary:disabled { opacity: 0.6; cursor: not-allowed; } - .btn-secondary { background: white; color: var(--color-text-primary); border: 1px solid var(--color-border-secondary); } + .btn-secondary { background: var(--color-surface-primary); color: var(--color-text-primary); border: 1px solid var(--color-border-secondary); } .btn-icon { padding: 0.25rem 0.5rem; background: transparent; border: none; color: var(--color-status-info-text); font-size: 0.75rem; cursor: pointer; } .btn-icon.btn-danger { color: var(--color-status-error); } @@ -309,7 +309,7 @@ type ThrottleScope = 'global' | 'channel' | 'rule' | 'event'; .throttle-card { padding: 1rem; - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-lg); } @@ -434,7 +434,7 @@ type ThrottleScope = 'global' | 'channel' | 'rule' | 'event'; flex-direction: column; align-items: center; padding: 0.75rem; - background: white; + background: var(--color-surface-secondary); border-radius: var(--radius-md); } @@ -466,7 +466,7 @@ type ThrottleScope = 'global' | 'channel' | 'rule' | 'event'; .preset-buttons { display: flex; flex-wrap: wrap; gap: 0.5rem; } .preset-btn { padding: 0.375rem 0.75rem; - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-secondary); border-radius: var(--radius-sm); font-size: 0.75rem; diff --git a/src/Web/StellaOps.Web/src/app/features/approvals/modals/request-exception-modal.component.ts b/src/Web/StellaOps.Web/src/app/features/approvals/modals/request-exception-modal.component.ts index b07916158..488b40310 100644 --- a/src/Web/StellaOps.Web/src/app/features/approvals/modals/request-exception-modal.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/approvals/modals/request-exception-modal.component.ts @@ -445,7 +445,7 @@ export interface GateContext { border-radius: var(--radius-md); font-size: 0.875rem; color: var(--color-text-primary); - background: white; + background: var(--color-surface-primary); transition: border-color 0.15s ease, box-shadow 0.15s ease; } diff --git a/src/Web/StellaOps.Web/src/app/features/auth/auth-callback.component.ts b/src/Web/StellaOps.Web/src/app/features/auth/auth-callback.component.ts index 868ff0c54..85b0c1125 100644 --- a/src/Web/StellaOps.Web/src/app/features/auth/auth-callback.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/auth/auth-callback.component.ts @@ -253,7 +253,7 @@ import { AuthorityAuthService } from '../../core/auth/authority-auth.service'; margin: 0 0 0.375rem; font-size: 1.125rem; font-weight: 600; - color: #F5F0E6; + color: var(--color-text-inverse); line-height: 1.3; animation: slide-up 500ms cubic-bezier(0.18, 0.89, 0.32, 1) 200ms both; } @@ -279,7 +279,7 @@ import { AuthorityAuthService } from '../../core/auth/authority-auth.service'; margin-bottom: 1.25rem; border-radius: 50%; background: rgba(239, 68, 68, 0.12); - color: #f87171; + color: var(--color-border-error); animation: fade-in 500ms ease both; } @@ -287,7 +287,7 @@ import { AuthorityAuthService } from '../../core/auth/authority-auth.service'; margin: 0 0 0.5rem; font-size: 1.125rem; font-weight: 600; - color: #F5F0E6; + color: var(--color-text-inverse); line-height: 1.3; animation: slide-up 500ms ease 100ms both; } diff --git a/src/Web/StellaOps.Web/src/app/features/binary-index/patch-map.component.ts b/src/Web/StellaOps.Web/src/app/features/binary-index/patch-map.component.ts index 03a81713b..33d8712b7 100644 --- a/src/Web/StellaOps.Web/src/app/features/binary-index/patch-map.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/binary-index/patch-map.component.ts @@ -412,7 +412,7 @@ type ViewMode = 'heatmap' | 'details' | 'matches'; padding: 8px 16px; border: 1px solid var(--color-border-primary); border-radius: var(--radius-md); - background: white; + background: var(--color-surface-primary); font-size: var(--font-size-base); cursor: pointer; transition: all 0.15s; @@ -542,7 +542,7 @@ type ViewMode = 'heatmap' | 'details' | 'matches'; padding: 12px; border: 1px solid var(--color-border-primary); border-radius: var(--radius-lg); - background: white; + background: var(--color-surface-primary); cursor: pointer; text-align: left; transition: all 0.15s; @@ -634,7 +634,7 @@ type ViewMode = 'heatmap' | 'details' | 'matches'; padding: 8px 16px; border: 1px solid var(--color-border-primary); border-radius: var(--radius-md); - background: white; + background: var(--color-surface-primary); cursor: pointer; } @@ -650,7 +650,7 @@ type ViewMode = 'heatmap' | 'details' | 'matches'; /* Details section */ .details-section { - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-xl); padding: 24px; @@ -748,7 +748,7 @@ type ViewMode = 'heatmap' | 'details' | 'matches'; font-size: var(--font-size-sm); border: 1px solid var(--color-status-info); border-radius: var(--radius-sm); - background: white; + background: var(--color-surface-primary); color: var(--color-status-info); cursor: pointer; } diff --git a/src/Web/StellaOps.Web/src/app/features/compare/components/compare-view.component.ts b/src/Web/StellaOps.Web/src/app/features/compare/components/compare-view.component.ts index e3b2d0273..0991d3f23 100644 --- a/src/Web/StellaOps.Web/src/app/features/compare/components/compare-view.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/compare/components/compare-view.component.ts @@ -56,7 +56,7 @@ export type UserRole = 'developer' | 'security' | 'audit'; @if (error()) { } diff --git a/src/Web/StellaOps.Web/src/app/features/compare/components/trust-indicators.component.ts b/src/Web/StellaOps.Web/src/app/features/compare/components/trust-indicators.component.ts index 37a30feb0..3f1535f9d 100644 --- a/src/Web/StellaOps.Web/src/app/features/compare/components/trust-indicators.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/compare/components/trust-indicators.component.ts @@ -29,7 +29,7 @@ import { ScanDigest } from '../services/compare.service';
Signature
- {{ signatureIcon() }} + {{ signatureText() }}
@@ -144,11 +144,12 @@ export class TrustIndicatorsComponent { readonly signatureClass = computed(() => this.current()?.signatureStatus ?? 'unknown'); readonly signatureIcon = computed(() => { + const svg = (d: string) => ``; switch (this.current()?.signatureStatus) { - case 'valid': return '✓'; - case 'invalid': return '✗'; - case 'missing': return '?'; - default: return '—'; + case 'valid': return svg(''); + case 'invalid': return svg(''); + case 'missing': return svg(''); + default: return svg(''); } }); diff --git a/src/Web/StellaOps.Web/src/app/features/console-admin/audit/audit-log.component.ts b/src/Web/StellaOps.Web/src/app/features/console-admin/audit/audit-log.component.ts index 3ff5906a7..d6bbb3904 100644 --- a/src/Web/StellaOps.Web/src/app/features/console-admin/audit/audit-log.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/console-admin/audit/audit-log.component.ts @@ -172,7 +172,7 @@ import { StellaOpsScopes } from '../../../core/auth/scopes';

Audit Event Details

- +
diff --git a/src/Web/StellaOps.Web/src/app/features/console-admin/tenants/tenants-list.component.ts b/src/Web/StellaOps.Web/src/app/features/console-admin/tenants/tenants-list.component.ts index 88e3e80ee..556de442a 100644 --- a/src/Web/StellaOps.Web/src/app/features/console-admin/tenants/tenants-list.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/console-admin/tenants/tenants-list.component.ts @@ -91,7 +91,7 @@ import { FreshAuthService } from '../../../core/auth/fresh-auth.service'; .admin-table { width: 100%; border-collapse: collapse; - background: white; + background: var(--color-surface-primary); border-radius: var(--radius-lg); overflow: hidden; } diff --git a/src/Web/StellaOps.Web/src/app/features/control-plane/control-plane-dashboard.component.ts b/src/Web/StellaOps.Web/src/app/features/control-plane/control-plane-dashboard.component.ts index f54f2f8ec..30bc1e534 100644 --- a/src/Web/StellaOps.Web/src/app/features/control-plane/control-plane-dashboard.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/control-plane/control-plane-dashboard.component.ts @@ -508,8 +508,9 @@ import { LoadingStateComponent } from '../../shared/components/loading-state/loa flex: 1; min-width: 150px; padding: 16px; - background: var(--so-surface); - border: 1px solid var(--so-border-light); + background: var(--so-surface-elevated); + border: 1px solid var(--so-border-medium); + border-left: 3px solid var(--so-mute); border-radius: var(--radius-xl); text-align: center; transition: all 220ms var(--so-ease-out); @@ -521,16 +522,30 @@ import { LoadingStateComponent } from '../../shared/components/loading-state/loa transform: translateY(-2px); } + .pipeline__stage--healthy { + border-color: var(--color-status-success-border); + border-left: 3px solid var(--color-status-success-text); + background: var(--color-status-success-bg); + } + .pipeline__stage--degraded { border-color: var(--color-status-warning-border); + border-left: 3px solid var(--color-status-warning-text); background: var(--color-status-warning-bg); } .pipeline__stage--unhealthy { border-color: var(--color-status-error-border); + border-left: 3px solid var(--color-status-error-text); background: var(--color-status-error-bg); } + .pipeline__stage--unknown { + border-color: var(--so-border-medium); + border-left: 3px solid var(--so-mute); + background: var(--so-surface); + } + .pipeline__stage-header { margin-bottom: 10px; } diff --git a/src/Web/StellaOps.Web/src/app/features/doctor/components/evidence-viewer/evidence-viewer.component.ts b/src/Web/StellaOps.Web/src/app/features/doctor/components/evidence-viewer/evidence-viewer.component.ts index c7b5d72aa..962cd9ce1 100644 --- a/src/Web/StellaOps.Web/src/app/features/doctor/components/evidence-viewer/evidence-viewer.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/doctor/components/evidence-viewer/evidence-viewer.component.ts @@ -81,7 +81,7 @@ import { Evidence } from '../../models/doctor.models'; } .evidence-data { - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-md); overflow: hidden; diff --git a/src/Web/StellaOps.Web/src/app/features/doctor/components/export-dialog/export-dialog.component.ts b/src/Web/StellaOps.Web/src/app/features/doctor/components/export-dialog/export-dialog.component.ts index 304043db8..c026e8dfe 100644 --- a/src/Web/StellaOps.Web/src/app/features/doctor/components/export-dialog/export-dialog.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/doctor/components/export-dialog/export-dialog.component.ts @@ -102,7 +102,7 @@ type ExportFormat = 'json' | 'markdown' | 'text' | 'dsse'; } .dialog { - background: white; + background: var(--color-surface-primary); border-radius: var(--radius-xl); width: 100%; max-width: 600px; diff --git a/src/Web/StellaOps.Web/src/app/features/doctor/components/remediation-panel/remediation-panel.component.ts b/src/Web/StellaOps.Web/src/app/features/doctor/components/remediation-panel/remediation-panel.component.ts index 03bc8452d..ab79fc08b 100644 --- a/src/Web/StellaOps.Web/src/app/features/doctor/components/remediation-panel/remediation-panel.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/doctor/components/remediation-panel/remediation-panel.component.ts @@ -71,7 +71,7 @@ import { Remediation, RemediationStep } from '../../models/doctor.models'; .remediation-panel { margin-top: 1rem; padding: 1rem; - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-lg); } diff --git a/src/Web/StellaOps.Web/src/app/features/doctor/services/doctor.client.ts b/src/Web/StellaOps.Web/src/app/features/doctor/services/doctor.client.ts index 9fbba9d1d..db91c71c4 100644 --- a/src/Web/StellaOps.Web/src/app/features/doctor/services/doctor.client.ts +++ b/src/Web/StellaOps.Web/src/app/features/doctor/services/doctor.client.ts @@ -1,7 +1,6 @@ import { Injectable, InjectionToken, inject } from '@angular/core'; import { HttpClient } from '@angular/common/http'; import { Observable, of, delay } from 'rxjs'; -import { environment } from '../../../../environments/environment'; import { CheckListResponse, CheckMetadata, @@ -51,7 +50,7 @@ export const DOCTOR_API = new InjectionToken('DOCTOR_API'); @Injectable({ providedIn: 'root' }) export class HttpDoctorClient implements DoctorApi { private readonly http = inject(HttpClient); - private readonly baseUrl = `${environment.apiBaseUrl}/v1/doctor`; + private readonly baseUrl = `/doctor/api/v1/doctor`; listChecks(category?: string, plugin?: string): Observable { const params: Record = {}; diff --git a/src/Web/StellaOps.Web/src/app/features/evidence-export/evidence-bundles.component.ts b/src/Web/StellaOps.Web/src/app/features/evidence-export/evidence-bundles.component.ts index 253ec8376..58751a15b 100644 --- a/src/Web/StellaOps.Web/src/app/features/evidence-export/evidence-bundles.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/evidence-export/evidence-bundles.component.ts @@ -3,7 +3,9 @@ import { ChangeDetectionStrategy, Component, computed, + Inject, inject, + OnInit, signal, } from '@angular/core'; import { FormsModule } from '@angular/forms'; @@ -12,6 +14,7 @@ import { EvidenceBundleStatus, VerificationResult, } from './evidence-export.models'; +import { AUDIT_BUNDLES_API, type AuditBundlesApi } from '../../core/api/audit-bundles.client'; /** * Evidence Bundles Component (Sprint: SPRINT_20251229_016) @@ -134,29 +137,41 @@ import {

@if (verificationResult()!.verified) { - ✓ Verification Passed + Verification Passed } @else { - ✗ Verification Failed + Verification Failed }

Checksum - {{ verificationResult()!.checksumMatch ? '✓' : '✗' }} + @if (verificationResult()!.checksumMatch) { + + } @else { + + }
Chain Valid - {{ verificationResult()!.chainValid ? '✓' : '✗' }} + @if (verificationResult()!.chainValid) { + + } @else { + + }
@if (verificationResult()!.signatureValid !== undefined) {
Signature - {{ verificationResult()!.signatureValid ? '✓' : '✗' }} + @if (verificationResult()!.signatureValid) { + + } @else { + + }
} @@ -424,51 +439,66 @@ import { `], changeDetection: ChangeDetectionStrategy.OnPush }) -export class EvidenceBundlesComponent { +export class EvidenceBundlesComponent implements OnInit { searchQuery = ''; statusFilter = ''; - readonly bundles = signal([ - // Mock data - { - id: 'eb-001', - name: 'api-service-v1.2.3', - imageRef: 'registry.example.com/api-service:v1.2.3', - createdAt: new Date().toISOString(), - status: 'ready', - sizeBytes: 2567890, - checksumSha256: 'sha256:abc123def456789...', - format: 'tar.gz', - contents: { - hasSbom: true, - hasScan: true, - hasAttestation: true, - hasProvenance: true, - hasVexDecisions: true, - hasPolicy: true, - fileCount: 12, + readonly bundles = signal([]); + readonly loading = signal(true); + readonly error = signal(null); + + constructor(@Inject(AUDIT_BUNDLES_API) private readonly bundlesApi: AuditBundlesApi) {} + + ngOnInit(): void { + this.loadBundles(); + } + + private loadBundles(): void { + this.loading.set(true); + this.error.set(null); + this.bundlesApi.listBundles().subscribe({ + next: (response) => { + const mapped: EvidenceBundle[] = (response.items ?? []).map((item: any) => ({ + id: item.bundleId ?? item.id ?? '', + name: item.subject?.name ?? item.bundleId ?? 'Unknown', + imageRef: item.subject?.digest?.['sha256'] + ? `${item.subject?.name ?? ''}@sha256:${item.subject.digest['sha256'].substring(0, 12)}` + : item.ociReference ?? '', + createdAt: item.createdAt ?? new Date().toISOString(), + status: this.mapStatus(item.status), + sizeBytes: 0, + checksumSha256: item.sha256 ?? '', + format: 'tar.gz' as const, + contents: { + hasSbom: true, + hasScan: true, + hasAttestation: !!item.integrityRootHash, + hasProvenance: !!item.integrityRootHash, + hasVexDecisions: false, + hasPolicy: false, + fileCount: 0, + }, + })); + this.bundles.set(mapped); + this.loading.set(false); }, - }, - { - id: 'eb-002', - name: 'web-frontend-v2.0.0', - imageRef: 'registry.example.com/web-frontend:v2.0.0', - createdAt: new Date(Date.now() - 86400000).toISOString(), - status: 'generating', - sizeBytes: 0, - checksumSha256: '', - format: 'tar.gz', - contents: { - hasSbom: true, - hasScan: true, - hasAttestation: false, - hasProvenance: false, - hasVexDecisions: false, - hasPolicy: false, - fileCount: 0, + error: (err) => { + console.error('[EvidenceBundles] Failed to load bundles:', err); + this.error.set(err?.message ?? 'Failed to load evidence bundles'); + this.loading.set(false); }, - }, - ]); + }); + } + + private mapStatus(status: string): EvidenceBundleStatus { + switch (status) { + case 'completed': return 'ready'; + case 'processing': return 'generating'; + case 'queued': return 'pending'; + case 'failed': return 'expired'; + default: return 'pending'; + } + } readonly expandedBundle = signal(null); readonly verificationResult = signal(null); diff --git a/src/Web/StellaOps.Web/src/app/features/evidence-export/provenance-visualization.component.ts b/src/Web/StellaOps.Web/src/app/features/evidence-export/provenance-visualization.component.ts index 1c37accba..931c5f1f9 100644 --- a/src/Web/StellaOps.Web/src/app/features/evidence-export/provenance-visualization.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/evidence-export/provenance-visualization.component.ts @@ -59,9 +59,9 @@ export interface ProvenanceChain {
@if (chain.verified) { - ✓ + } @else { - ⋯ + }
@@ -91,7 +91,11 @@ export interface ProvenanceChain {
- {{ getNodeIcon(node.type) }} + @if (node.type === 'verdict') { + + } @else { + {{ getNodeIcon(node.type) }} + }
@if (!last) {
@@ -150,7 +154,7 @@ export interface ProvenanceChain { Attestation
- ✓ + Verdict
@@ -719,7 +723,7 @@ export class ProvenanceVisualizationComponent { vex: 'V', policy: 'P', attestation: 'S', - verdict: '✓', + verdict: 'V', }; return icons[type]; } diff --git a/src/Web/StellaOps.Web/src/app/features/evidence/modals/audit-bundle-create-modal.component.ts b/src/Web/StellaOps.Web/src/app/features/evidence/modals/audit-bundle-create-modal.component.ts index 944f502b6..538264d09 100644 --- a/src/Web/StellaOps.Web/src/app/features/evidence/modals/audit-bundle-create-modal.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/evidence/modals/audit-bundle-create-modal.component.ts @@ -341,7 +341,7 @@ export interface AuditBundleConfig { } .modal { - background: white; + background: var(--color-surface-primary); border-radius: var(--radius-xl); box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.25); width: 100%; @@ -543,7 +543,7 @@ export interface AuditBundleConfig { } .filter-tab--active { - background: white; + background: var(--color-surface-primary); color: var(--color-text-primary); box-shadow: var(--shadow-sm); } diff --git a/src/Web/StellaOps.Web/src/app/features/feed-mirror/airgap-export.component.ts b/src/Web/StellaOps.Web/src/app/features/feed-mirror/airgap-export.component.ts index 6f730d3bb..d3e6e004e 100644 --- a/src/Web/StellaOps.Web/src/app/features/feed-mirror/airgap-export.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/feed-mirror/airgap-export.component.ts @@ -16,14 +16,13 @@ import { AirGapBundleRequest, FeedType, } from '../../core/api/feed-mirror.models'; -import { FEED_MIRROR_API, MockFeedMirrorApi } from '../../core/api/feed-mirror.client'; +import { FEED_MIRROR_API } from '../../core/api/feed-mirror.client'; type ExportStep = 'select' | 'configure' | 'building' | 'ready'; @Component({ selector: 'app-airgap-export', imports: [CommonModule, FormsModule, RouterModule], - providers: [{ provide: FEED_MIRROR_API, useClass: MockFeedMirrorApi }], template: `
diff --git a/src/Web/StellaOps.Web/src/app/features/feed-mirror/airgap-import.component.ts b/src/Web/StellaOps.Web/src/app/features/feed-mirror/airgap-import.component.ts index 25fc0f86b..fd7543e0d 100644 --- a/src/Web/StellaOps.Web/src/app/features/feed-mirror/airgap-import.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/feed-mirror/airgap-import.component.ts @@ -12,14 +12,13 @@ import { AirGapImportProgress, FeedType, } from '../../core/api/feed-mirror.models'; -import { FEED_MIRROR_API, MockFeedMirrorApi } from '../../core/api/feed-mirror.client'; +import { FEED_MIRROR_API } from '../../core/api/feed-mirror.client'; type ImportStep = 'upload' | 'validate' | 'review' | 'import' | 'complete'; @Component({ selector: 'app-airgap-import', imports: [CommonModule, RouterModule], - providers: [{ provide: FEED_MIRROR_API, useClass: MockFeedMirrorApi }], template: `
@@ -172,17 +171,17 @@ type ImportStep = 'upload' | 'validate' | 'review' | 'import' | 'complete';
- {{ validation()!.checksumValid ? '✓' : '✗' }} + @if (validation()!.checksumValid) {} @else {} Checksum verification
@if (validation()!.signatureValid !== null) {
- {{ validation()!.signatureValid ? '✓' : '✗' }} + @if (validation()!.signatureValid) {} @else {} Signature verification
}
- {{ validation()!.manifestValid ? '✓' : '✗' }} + @if (validation()!.manifestValid) {} @else {} Manifest validation
diff --git a/src/Web/StellaOps.Web/src/app/features/feed-mirror/feed-mirror-dashboard.component.ts b/src/Web/StellaOps.Web/src/app/features/feed-mirror/feed-mirror-dashboard.component.ts index f22d92756..b88cf273b 100644 --- a/src/Web/StellaOps.Web/src/app/features/feed-mirror/feed-mirror-dashboard.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/feed-mirror/feed-mirror-dashboard.component.ts @@ -15,7 +15,7 @@ import { MirrorSyncStatus, AirGapBundle, } from '../../core/api/feed-mirror.models'; -import { FEED_MIRROR_API, MockFeedMirrorApi } from '../../core/api/feed-mirror.client'; +import { FEED_MIRROR_API } from '../../core/api/feed-mirror.client'; import { MirrorListComponent } from './mirror-list.component'; import { OfflineSyncStatusComponent } from './offline-sync-status.component'; import { FeedVersionLockComponent } from './feed-version-lock.component'; @@ -45,7 +45,6 @@ type TabMode = 'mirrors' | 'airgap' | 'version-locks'; SyncStatusIndicatorComponent, FreshnessWarningsComponent, ], - providers: [{ provide: FEED_MIRROR_API, useClass: MockFeedMirrorApi }], template: `
diff --git a/src/Web/StellaOps.Web/src/app/features/feed-mirror/feed-mirror.component.ts b/src/Web/StellaOps.Web/src/app/features/feed-mirror/feed-mirror.component.ts index 6fe412bbc..e3946fbcd 100644 --- a/src/Web/StellaOps.Web/src/app/features/feed-mirror/feed-mirror.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/feed-mirror/feed-mirror.component.ts @@ -15,7 +15,7 @@ import { MirrorSyncStatus, FeedType, } from '../../core/api/feed-mirror.models'; -import { FEED_MIRROR_API, MockFeedMirrorApi } from '../../core/api/feed-mirror.client'; +import { FEED_MIRROR_API } from '../../core/api/feed-mirror.client'; import { MirrorListComponent } from './mirror-list.component'; import { MirrorDetailComponent } from './mirror-detail.component'; import { OfflineSyncStatusComponent } from './offline-sync-status.component'; @@ -34,7 +34,6 @@ type TabMode = 'mirrors' | 'airgap' | 'version-locks'; OfflineSyncStatusComponent, FeedVersionLockComponent ], - providers: [{ provide: FEED_MIRROR_API, useClass: MockFeedMirrorApi }], templateUrl: './feed-mirror.component.html', styleUrls: ['./feed-mirror.component.scss'], changeDetection: ChangeDetectionStrategy.OnPush, diff --git a/src/Web/StellaOps.Web/src/app/features/feed-mirror/mirror-detail.component.ts b/src/Web/StellaOps.Web/src/app/features/feed-mirror/mirror-detail.component.ts index f86d1fe9a..33b5942b7 100644 --- a/src/Web/StellaOps.Web/src/app/features/feed-mirror/mirror-detail.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/feed-mirror/mirror-detail.component.ts @@ -377,7 +377,7 @@ import { SnapshotActionsComponent } from './snapshot-actions.component'; left: 2px; width: 20px; height: 20px; - background: white; + background: var(--color-surface-primary); border-radius: var(--radius-full); transition: transform 0.2s; } diff --git a/src/Web/StellaOps.Web/src/app/features/feed-mirror/snapshot-selector.component.ts b/src/Web/StellaOps.Web/src/app/features/feed-mirror/snapshot-selector.component.ts index b54863fe6..f83f78703 100644 --- a/src/Web/StellaOps.Web/src/app/features/feed-mirror/snapshot-selector.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/feed-mirror/snapshot-selector.component.ts @@ -13,7 +13,7 @@ import { } from '@angular/core'; import { FormsModule } from '@angular/forms'; import { FeedSnapshot, FeedType, FeedMirror } from '../../core/api/feed-mirror.models'; -import { FEED_MIRROR_API, MockFeedMirrorApi } from '../../core/api/feed-mirror.client'; +import { FEED_MIRROR_API } from '../../core/api/feed-mirror.client'; interface SnapshotSelection { readonly feedType: FeedType; @@ -34,7 +34,6 @@ interface SnapshotSelection { @Component({ selector: 'app-snapshot-selector', imports: [CommonModule, FormsModule], - providers: [{ provide: FEED_MIRROR_API, useClass: MockFeedMirrorApi }], template: `
diff --git a/src/Web/StellaOps.Web/src/app/features/feed-mirror/version-lock.component.ts b/src/Web/StellaOps.Web/src/app/features/feed-mirror/version-lock.component.ts index bb81de6e7..3248106d6 100644 --- a/src/Web/StellaOps.Web/src/app/features/feed-mirror/version-lock.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/feed-mirror/version-lock.component.ts @@ -16,7 +16,7 @@ import { FeedMirror, FeedSnapshot, } from '../../core/api/feed-mirror.models'; -import { FEED_MIRROR_API, MockFeedMirrorApi } from '../../core/api/feed-mirror.client'; +import { FEED_MIRROR_API } from '../../core/api/feed-mirror.client'; import { SnapshotSelectorComponent } from './snapshot-selector.component'; /** @@ -31,7 +31,6 @@ import { SnapshotSelectorComponent } from './snapshot-selector.component'; @Component({ selector: 'app-version-lock', imports: [CommonModule, FormsModule, RouterModule, SnapshotSelectorComponent], - providers: [{ provide: FEED_MIRROR_API, useClass: MockFeedMirrorApi }], template: `
diff --git a/src/Web/StellaOps.Web/src/app/features/findings/detail/evidence-panel.component.ts b/src/Web/StellaOps.Web/src/app/features/findings/detail/evidence-panel.component.ts index 8babd0caf..1fbb70e4e 100644 --- a/src/Web/StellaOps.Web/src/app/features/findings/detail/evidence-panel.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/findings/detail/evidence-panel.component.ts @@ -378,7 +378,7 @@ export interface EvidenceData { gap: 0.375rem; font-size: 0.8125rem; padding: 0.375rem; - background: white; + background: var(--color-surface-primary); border-radius: var(--radius-sm); cursor: pointer; } diff --git a/src/Web/StellaOps.Web/src/app/features/findings/detail/finding-detail-layout.component.ts b/src/Web/StellaOps.Web/src/app/features/findings/detail/finding-detail-layout.component.ts index 2171bbde5..a227fad6b 100644 --- a/src/Web/StellaOps.Web/src/app/features/findings/detail/finding-detail-layout.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/findings/detail/finding-detail-layout.component.ts @@ -126,14 +126,14 @@ export interface FindingDetailData { /* Verdict panel - most prominent (authoritative) */ .finding-detail-layout__panel--verdict { - background: white; + background: var(--color-surface-primary); border: 2px solid var(--color-border-primary); box-shadow: var(--shadow-sm); } /* Evidence panel - secondary (authoritative) */ .finding-detail-layout__panel--evidence { - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-primary); } diff --git a/src/Web/StellaOps.Web/src/app/features/graph/graph-canvas.component.ts b/src/Web/StellaOps.Web/src/app/features/graph/graph-canvas.component.ts index ce23e0b90..3b509e4db 100644 --- a/src/Web/StellaOps.Web/src/app/features/graph/graph-canvas.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/graph/graph-canvas.component.ts @@ -428,7 +428,7 @@ const VIEWPORT_PADDING = 100; display: flex; align-items: center; gap: 0.25rem; - background: white; + background: var(--color-surface-primary); padding: 0.25rem; border-radius: var(--radius-lg); box-shadow: var(--shadow-md); @@ -481,7 +481,7 @@ const VIEWPORT_PADDING = 100; top: 1rem; left: 1rem; display: flex; - background: white; + background: var(--color-surface-primary); border-radius: var(--radius-lg); box-shadow: var(--shadow-md); overflow: hidden; diff --git a/src/Web/StellaOps.Web/src/app/features/graph/graph-explorer.component.html b/src/Web/StellaOps.Web/src/app/features/graph/graph-explorer.component.html index c613835a2..0d3b97533 100644 --- a/src/Web/StellaOps.Web/src/app/features/graph/graph-explorer.component.html +++ b/src/Web/StellaOps.Web/src/app/features/graph/graph-explorer.component.html @@ -183,7 +183,7 @@ } @if (node.hasException) { - ✓ + }
} @@ -209,7 +209,7 @@ } @if (node.hasException) { - ✓ + }
} @@ -256,7 +256,7 @@ @if (node.hasException) { - ✓ Excepted + Excepted } diff --git a/src/Web/StellaOps.Web/src/app/features/graph/graph-explorer.component.ts b/src/Web/StellaOps.Web/src/app/features/graph/graph-explorer.component.ts index 30ba3bbaa..8d14d8029 100644 --- a/src/Web/StellaOps.Web/src/app/features/graph/graph-explorer.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/graph/graph-explorer.component.ts @@ -22,7 +22,6 @@ import { import { AUTH_SERVICE, AuthService, - MockAuthService, StellaOpsScopes, } from '../../core/auth'; import { GraphCanvasComponent, CanvasNode, CanvasEdge } from './graph-canvas.component'; @@ -83,7 +82,6 @@ type ViewMode = 'hierarchy' | 'flat' | 'canvas'; @Component({ selector: 'app-graph-explorer', imports: [ExceptionDraftInlineComponent, ExceptionBadgeComponent, ExceptionExplainComponent, GraphCanvasComponent, GraphOverlaysComponent], - providers: [{ provide: AUTH_SERVICE, useClass: MockAuthService }], templateUrl: './graph-explorer.component.html', styleUrls: ['./graph-explorer.component.scss'], changeDetection: ChangeDetectionStrategy.OnPush diff --git a/src/Web/StellaOps.Web/src/app/features/graph/graph-filters.component.ts b/src/Web/StellaOps.Web/src/app/features/graph/graph-filters.component.ts index ab9395ee1..96e2c1e7b 100644 --- a/src/Web/StellaOps.Web/src/app/features/graph/graph-filters.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/graph/graph-filters.component.ts @@ -385,7 +385,7 @@ const MOCK_SAVED_VIEWS: SavedView[] = [ flex-direction: column; gap: 1rem; padding: 1rem; - background: white; + background: var(--color-surface-primary); border-radius: var(--radius-xl); box-shadow: var(--shadow-sm); } @@ -489,7 +489,7 @@ const MOCK_SAVED_VIEWS: SavedView[] = [ padding: 0.375rem 0.625rem; border: 1px solid rgba(212, 201, 168, 0.3); border-radius: var(--radius-full); - background: white; + background: var(--color-surface-primary); color: var(--color-text-secondary); font-size: 0.75rem; cursor: pointer; @@ -575,7 +575,7 @@ const MOCK_SAVED_VIEWS: SavedView[] = [ &--critical { border-color: var(--color-status-error-border); - background: white; + background: var(--color-surface-primary); color: var(--color-status-error); &.severity-pill--active { @@ -585,7 +585,7 @@ const MOCK_SAVED_VIEWS: SavedView[] = [ &--high { border-color: var(--color-severity-high-bg); - background: white; + background: var(--color-surface-primary); color: var(--color-severity-high); &.severity-pill--active { @@ -595,7 +595,7 @@ const MOCK_SAVED_VIEWS: SavedView[] = [ &--medium { border-color: var(--color-status-warning-border); - background: white; + background: var(--color-surface-primary); color: var(--color-severity-medium); &.severity-pill--active { @@ -605,7 +605,7 @@ const MOCK_SAVED_VIEWS: SavedView[] = [ &--low { border-color: var(--color-status-success-border); - background: white; + background: var(--color-surface-primary); color: var(--color-status-success); &.severity-pill--active { @@ -681,7 +681,7 @@ const MOCK_SAVED_VIEWS: SavedView[] = [ padding: 0.25rem 0.5rem; border: 1px solid rgba(212, 201, 168, 0.3); border-radius: var(--radius-sm); - background: white; + background: var(--color-surface-primary); color: var(--color-text-secondary); font-size: 0.6875rem; cursor: pointer; @@ -769,7 +769,7 @@ const MOCK_SAVED_VIEWS: SavedView[] = [ padding: 0.5rem 0.75rem; border: 1px solid rgba(212, 201, 168, 0.3); border-radius: var(--radius-md); - background: white; + background: var(--color-surface-primary); color: var(--color-text-secondary); font-size: 0.8125rem; cursor: pointer; @@ -817,7 +817,7 @@ const MOCK_SAVED_VIEWS: SavedView[] = [ transform: translate(-50%, -50%); width: 90%; max-width: 360px; - background: white; + background: var(--color-surface-secondary); border-radius: var(--radius-xl); box-shadow: var(--shadow-xl); z-index: 101; diff --git a/src/Web/StellaOps.Web/src/app/features/graph/graph-hotkey-help.component.ts b/src/Web/StellaOps.Web/src/app/features/graph/graph-hotkey-help.component.ts index 2ea0ac971..1e46d190e 100644 --- a/src/Web/StellaOps.Web/src/app/features/graph/graph-hotkey-help.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/graph/graph-hotkey-help.component.ts @@ -112,7 +112,7 @@ import { GraphAccessibilityService, HotkeyBinding } from './graph-accessibility. width: 90%; max-width: 640px; max-height: 80vh; - background: white; + background: var(--color-surface-primary); border-radius: var(--radius-xl); box-shadow: var(--shadow-xl); z-index: 201; @@ -237,7 +237,7 @@ import { GraphAccessibilityService, HotkeyBinding } from './graph-accessibility. min-width: 20px; height: 18px; padding: 0 0.375rem; - background: white; + background: var(--color-surface-primary); border: 1px solid rgba(212, 201, 168, 0.3); border-radius: var(--radius-sm); font-family: ui-monospace, monospace; diff --git a/src/Web/StellaOps.Web/src/app/features/graph/graph-overlays.component.ts b/src/Web/StellaOps.Web/src/app/features/graph/graph-overlays.component.ts index bacfd2913..6c3d7c880 100644 --- a/src/Web/StellaOps.Web/src/app/features/graph/graph-overlays.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/graph/graph-overlays.component.ts @@ -600,7 +600,7 @@ function generateMockReachabilityData(nodeIds: string[], snapshot: SnapshotKey): flex-direction: column; gap: 1rem; padding: 1rem; - background: white; + background: var(--color-surface-primary); border-radius: var(--radius-xl); box-shadow: var(--shadow-sm); } @@ -619,7 +619,7 @@ function generateMockReachabilityData(nodeIds: string[], snapshot: SnapshotKey): padding: 0.5rem 0.75rem; border: 1px solid rgba(212, 201, 168, 0.3); border-radius: var(--radius-lg); - background: white; + background: var(--color-surface-primary); color: var(--color-text-secondary); font-size: 0.8125rem; cursor: pointer; @@ -633,7 +633,7 @@ function generateMockReachabilityData(nodeIds: string[], snapshot: SnapshotKey): &--active { border-color: var(--color-text-secondary); - background: color-mix(in srgb, var(--color-text-secondary) 10%, white); + background: color-mix(in srgb, var(--color-text-secondary) 10%, var(--color-surface-primary)); color: var(--color-text-secondary); } @@ -787,7 +787,7 @@ function generateMockReachabilityData(nodeIds: string[], snapshot: SnapshotKey): .overlay-detail-card { padding: 0.625rem; - background: white; + background: var(--color-surface-primary); border: 1px solid rgba(212, 201, 168, 0.3); border-radius: var(--radius-md); margin-bottom: 0.5rem; @@ -891,7 +891,7 @@ function generateMockReachabilityData(nodeIds: string[], snapshot: SnapshotKey): padding: 0.5rem 0.75rem; border: 1px solid rgba(212, 201, 168, 0.3); border-radius: var(--radius-lg); - background: white; + background: var(--color-surface-primary); color: var(--color-text-secondary); font-size: 0.8125rem; cursor: pointer; @@ -947,7 +947,7 @@ function generateMockReachabilityData(nodeIds: string[], snapshot: SnapshotKey): padding: 0.5rem 0.75rem; border: 1px solid rgba(212, 201, 168, 0.3); border-radius: var(--radius-lg); - background: white; + background: var(--color-surface-primary); color: var(--color-text-secondary); font-size: 0.8125rem; cursor: pointer; @@ -1000,7 +1000,7 @@ function generateMockReachabilityData(nodeIds: string[], snapshot: SnapshotKey): padding: 0.25rem 0.5rem; border: 1px dashed rgba(212, 201, 168, 0.35); border-radius: var(--radius-md); - background: rgba(255, 255, 255, 0.7); + background: color-mix(in srgb, var(--color-surface-primary) 70%, transparent); } .time-timeline strong { @@ -1013,7 +1013,7 @@ function generateMockReachabilityData(nodeIds: string[], snapshot: SnapshotKey): border: 1px solid rgba(212, 201, 168, 0.3); border-radius: var(--radius-md); font-size: 0.75rem; - background: white; + background: var(--color-surface-primary); cursor: pointer; &:focus { @@ -1026,7 +1026,7 @@ function generateMockReachabilityData(nodeIds: string[], snapshot: SnapshotKey): padding: 0.375rem 0.625rem; border: 1px solid rgba(212, 201, 168, 0.3); border-radius: var(--radius-md); - background: white; + background: var(--color-surface-primary); color: var(--color-text-secondary); font-size: 0.75rem; cursor: pointer; diff --git a/src/Web/StellaOps.Web/src/app/features/graph/graph-side-panels.component.ts b/src/Web/StellaOps.Web/src/app/features/graph/graph-side-panels.component.ts index b79708f8c..e982c2849 100644 --- a/src/Web/StellaOps.Web/src/app/features/graph/graph-side-panels.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/graph/graph-side-panels.component.ts @@ -553,7 +553,7 @@ function generateMockDiff(): SbomDiff {
@for (item of sbomDiff()!.upgraded; track item.name) {
- ↑ + {{ item.name }} {{ item.fromVersion }} → {{ item.toVersion }} @@ -577,7 +577,7 @@ function generateMockDiff(): SbomDiff { .side-panels { display: flex; flex-direction: column; - background: white; + background: var(--color-surface-primary); border-radius: var(--radius-xl); box-shadow: var(--shadow-sm); overflow: hidden; @@ -609,7 +609,7 @@ function generateMockDiff(): SbomDiff { &--active { color: var(--color-brand-primary); - background: white; + background: var(--color-surface-primary); &::after { content: ''; @@ -700,7 +700,7 @@ function generateMockDiff(): SbomDiff { padding: 0.25rem 0.5rem; border: 1px solid rgba(212, 201, 168, 0.3); border-radius: var(--radius-sm); - background: white; + background: var(--color-surface-primary); color: var(--color-text-secondary); font-size: 0.6875rem; cursor: pointer; @@ -772,7 +772,7 @@ function generateMockDiff(): SbomDiff { padding: 0.5rem; border: 1px solid rgba(212, 201, 168, 0.3); border-radius: var(--radius-md); - background: white; + background: var(--color-surface-primary); cursor: pointer; text-align: left; width: 100%; @@ -1008,7 +1008,7 @@ function generateMockDiff(): SbomDiff { } &--secondary { - background: white; + background: var(--color-surface-primary); border: 1px solid rgba(212, 201, 168, 0.3); color: var(--color-text-secondary); @@ -1039,7 +1039,7 @@ function generateMockDiff(): SbomDiff { border: 1px solid rgba(212, 201, 168, 0.3); border-radius: var(--radius-sm); font-size: 0.75rem; - background: white; + background: var(--color-surface-primary); cursor: pointer; } @@ -1148,7 +1148,7 @@ function generateMockDiff(): SbomDiff { border: 1px solid rgba(212, 201, 168, 0.3); border-radius: var(--radius-sm); font-size: 0.75rem; - background: white; + background: var(--color-surface-primary); cursor: pointer; } @@ -1160,7 +1160,7 @@ function generateMockDiff(): SbomDiff { padding: 0.375rem 0.625rem; border: 1px solid rgba(212, 201, 168, 0.3); border-radius: var(--radius-sm); - background: white; + background: var(--color-surface-primary); color: var(--color-text-secondary); font-size: 0.75rem; cursor: pointer; diff --git a/src/Web/StellaOps.Web/src/app/features/integration-hub/integration-list.component.ts b/src/Web/StellaOps.Web/src/app/features/integration-hub/integration-list.component.ts index 37de6837f..99a136fc2 100644 --- a/src/Web/StellaOps.Web/src/app/features/integration-hub/integration-list.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/integration-hub/integration-list.component.ts @@ -67,7 +67,7 @@ import { @for (integration of integrations; track integration.integrationId) { - {{ integration.name }} + {{ integration.name }} {{ getProviderName(integration.provider) }} @@ -82,9 +82,10 @@ import { {{ integration.lastTestedAt ? (integration.lastTestedAt | date:'short') : 'Never' }} + - + } @@ -150,8 +151,12 @@ import { } .integration-table th { - background: var(--color-surface-primary); + background: var(--color-surface-secondary); font-weight: var(--font-weight-semibold); + font-size: 0.75rem; + text-transform: uppercase; + color: var(--color-text-secondary); + letter-spacing: 0.03em; } .status-badge, .health-badge { @@ -211,7 +216,7 @@ import { .pagination button { padding: 0.5rem 1rem; border: 1px solid var(--color-border-primary); - background: white; + background: var(--color-surface-primary); border-radius: var(--radius-sm); cursor: pointer; } @@ -325,9 +330,13 @@ export class IntegrationListComponent implements OnInit { return getProviderLabel(provider); } + editIntegration(integration: Integration): void { + void this.router.navigate(['/settings/integrations', integration.integrationId], { queryParams: { edit: true } }); + } + addIntegration(): void { void this.router.navigate( - ['/integrations/onboarding', this.getOnboardingTypeSegment(this.integrationType)] + ['/settings/integrations/onboarding', this.getOnboardingTypeSegment(this.integrationType)] ); } diff --git a/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-compare-panel/lineage-compare-panel.component.ts b/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-compare-panel/lineage-compare-panel.component.ts index 2b4004f66..6221f09e7 100644 --- a/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-compare-panel/lineage-compare-panel.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-compare-panel/lineage-compare-panel.component.ts @@ -290,7 +290,7 @@ import { bottom: 0; width: 500px; max-width: 90vw; - background: white; + background: var(--color-surface-primary); box-shadow: -4px 0 24px rgba(0, 0, 0, 0.15); display: flex; flex-direction: column; @@ -327,7 +327,7 @@ import { padding: 8px 12px; border: 1px solid var(--color-border-primary); border-radius: var(--radius-sm); - background: white; + background: var(--color-surface-primary); cursor: pointer; font-size: var(--font-size-base); } diff --git a/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-compare/lineage-compare.component.ts b/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-compare/lineage-compare.component.ts index fb48cbecf..57a226622 100644 --- a/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-compare/lineage-compare.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-compare/lineage-compare.component.ts @@ -164,7 +164,7 @@ import { align-items: center; gap: 6px; padding: 8px 16px; - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-md); cursor: pointer; @@ -190,7 +190,7 @@ import { .share-btn, .help-btn { padding: 8px 16px; - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-md); cursor: pointer; diff --git a/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-detail-panel/lineage-detail-panel.component.ts b/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-detail-panel/lineage-detail-panel.component.ts index cafa6fca3..0ca56cdbd 100644 --- a/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-detail-panel/lineage-detail-panel.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-detail-panel/lineage-detail-panel.component.ts @@ -224,7 +224,7 @@ import { bottom: 0; width: 420px; max-width: 90vw; - background: white; + background: var(--color-surface-primary); box-shadow: -4px 0 24px rgba(0, 0, 0, 0.15); transform: translateX(100%); transition: transform 0.3s ease; @@ -434,7 +434,7 @@ import { padding: 12px 16px; border: 1px solid var(--color-border-primary); border-radius: var(--radius-lg); - background: white; + background: var(--color-surface-primary); font-size: var(--font-size-base); font-weight: var(--font-weight-medium); cursor: pointer; diff --git a/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-export-buttons/lineage-export-buttons.component.ts b/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-export-buttons/lineage-export-buttons.component.ts index 423a8d364..40637baa5 100644 --- a/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-export-buttons/lineage-export-buttons.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-export-buttons/lineage-export-buttons.component.ts @@ -199,7 +199,7 @@ import { gap: 4px; padding: 8px 12px; border: none; - background: white; + background: var(--color-surface-primary); cursor: pointer; font-size: var(--font-size-sm); transition: background 0.15s; @@ -270,7 +270,7 @@ import { justify-content: center; border: 1px solid var(--color-border-primary); border-radius: var(--radius-md); - background: white; + background: var(--color-surface-primary); cursor: pointer; font-size: var(--font-size-base); } @@ -289,7 +289,7 @@ import { right: 0; margin-top: 4px; width: 220px; - background: white; + background: var(--color-surface-secondary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-lg); box-shadow: var(--shadow-lg); diff --git a/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-export-dialog/lineage-export-dialog.component.ts b/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-export-dialog/lineage-export-dialog.component.ts index 29a2c174a..6252a0111 100644 --- a/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-export-dialog/lineage-export-dialog.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-export-dialog/lineage-export-dialog.component.ts @@ -185,7 +185,7 @@ import { ExportFormat, ExportOptions } from '../../services/lineage-export.servi width: 560px; max-width: 90vw; max-height: 90vh; - background: white; + background: var(--color-surface-primary); border-radius: var(--radius-xl); box-shadow: var(--shadow-xl); display: flex; @@ -370,7 +370,7 @@ import { ExportFormat, ExportOptions } from '../../services/lineage-export.servi padding: 16px 12px; border: 2px solid var(--color-border-primary); border-radius: var(--radius-lg); - background: white; + background: var(--color-surface-primary); cursor: pointer; transition: border-color 0.15s, background 0.15s; } diff --git a/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-hover-card/lineage-hover-card.component.ts b/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-hover-card/lineage-hover-card.component.ts index dced2266c..198154b32 100644 --- a/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-hover-card/lineage-hover-card.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-hover-card/lineage-hover-card.component.ts @@ -119,7 +119,7 @@ import { } .hover-card { - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-lg); box-shadow: var(--shadow-lg); diff --git a/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-mobile-compare/lineage-mobile-compare.component.ts b/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-mobile-compare/lineage-mobile-compare.component.ts index 2cc12388e..132cd74d6 100644 --- a/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-mobile-compare/lineage-mobile-compare.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-mobile-compare/lineage-mobile-compare.component.ts @@ -378,7 +378,7 @@ export interface MobileSection { .mobile-tabs { display: flex; - background: white; + background: var(--color-surface-primary); border-bottom: 1px solid var(--color-surface-secondary); overflow-x: auto; -webkit-overflow-scrolling: touch; @@ -468,7 +468,7 @@ export interface MobileSection { /* Graph view */ .graph-placeholder { - background: white; + background: var(--color-surface-primary); border-radius: var(--radius-xl); padding: 20px; margin-bottom: 16px; @@ -540,7 +540,7 @@ export interface MobileSection { } .stat-card { - background: white; + background: var(--color-surface-primary); padding: 16px; border-radius: var(--radius-lg); } @@ -569,7 +569,7 @@ export interface MobileSection { /* Node detail view */ .node-detail-view { - background: white; + background: var(--color-surface-primary); border-radius: var(--radius-xl); padding: 20px; } @@ -655,7 +655,7 @@ export interface MobileSection { padding: 8px 12px; border: 1px solid var(--color-border-primary); border-radius: var(--radius-2xl); - background: white; + background: var(--color-surface-primary); display: flex; align-items: center; gap: 6px; @@ -683,7 +683,7 @@ export interface MobileSection { } .section-tab.active .section-count { - background: white; + background: var(--color-surface-primary); color: var(--color-status-info); } @@ -704,7 +704,7 @@ export interface MobileSection { .diff-item { padding: 8px 12px; - background: white; + background: var(--color-surface-primary); border-radius: var(--radius-md); font-size: var(--font-size-base); margin-bottom: 4px; @@ -723,7 +723,7 @@ export interface MobileSection { } .vuln-summary { - background: white; + background: var(--color-surface-primary); border-radius: var(--radius-lg); overflow: hidden; } @@ -779,7 +779,7 @@ export interface MobileSection { justify-content: center; gap: 12px; padding: 12px 16px; - background: white; + background: var(--color-surface-primary); border-top: 1px solid var(--color-surface-secondary); } @@ -828,7 +828,7 @@ export interface MobileSection { left: 0; right: 0; bottom: 0; - background: white; + background: var(--color-surface-secondary); border-radius: var(--radius-2xl) 16px 0 0; padding: 16px; z-index: 101; diff --git a/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-provenance-chips/lineage-provenance-chips.component.ts b/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-provenance-chips/lineage-provenance-chips.component.ts index 45ca06168..9b41e760f 100644 --- a/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-provenance-chips/lineage-provenance-chips.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-provenance-chips/lineage-provenance-chips.component.ts @@ -228,7 +228,7 @@ import { top: 100%; left: 0; right: 0; - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-lg); box-shadow: var(--shadow-lg); diff --git a/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-provenance-compare/lineage-provenance-compare.component.ts b/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-provenance-compare/lineage-provenance-compare.component.ts index 67a0252f3..2b691a952 100644 --- a/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-provenance-compare/lineage-provenance-compare.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-provenance-compare/lineage-provenance-compare.component.ts @@ -309,7 +309,7 @@ export interface ProvenanceInfo { .provenance-compare { display: flex; flex-direction: column; - background: white; + background: var(--color-surface-primary); border-radius: var(--radius-lg); overflow: hidden; } @@ -477,7 +477,7 @@ export interface ProvenanceInfo { align-items: center; gap: 6px; padding: 8px; - background: white; + background: var(--color-surface-primary); border-radius: var(--radius-md); border: 1px solid var(--color-border-primary); } diff --git a/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-sbom-diff/lineage-sbom-diff.component.ts b/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-sbom-diff/lineage-sbom-diff.component.ts index 623ee9e24..7d8a41c6f 100644 --- a/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-sbom-diff/lineage-sbom-diff.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-sbom-diff/lineage-sbom-diff.component.ts @@ -236,7 +236,7 @@ type SortDirection = 'asc' | 'desc'; display: flex; flex-direction: column; height: 100%; - background: white; + background: var(--color-surface-primary); border-radius: var(--radius-lg); overflow: hidden; } diff --git a/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-timeline-slider/lineage-timeline-slider.component.ts b/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-timeline-slider/lineage-timeline-slider.component.ts index 97e6291d4..0e9ee1e63 100644 --- a/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-timeline-slider/lineage-timeline-slider.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-timeline-slider/lineage-timeline-slider.component.ts @@ -194,7 +194,7 @@ export interface TimelineMarker { styles: [` .timeline-slider { padding: 12px 16px; - background: white; + background: var(--color-surface-primary); border-top: 1px solid var(--color-surface-secondary); } @@ -235,7 +235,7 @@ export interface TimelineMarker { justify-content: center; border: 1px solid var(--color-border-primary); border-radius: var(--radius-sm); - background: white; + background: var(--color-surface-primary); cursor: pointer; font-size: var(--font-size-base); } @@ -281,7 +281,7 @@ export interface TimelineMarker { border: 1px solid var(--color-border-primary); border-radius: var(--radius-sm); font-size: var(--font-size-xs); - background: white; + background: var(--color-surface-primary); } .timeline-track { @@ -322,7 +322,7 @@ export interface TimelineMarker { width: 10px; height: 10px; background: var(--color-text-muted); - border: 2px solid white; + border: 2px solid var(--color-surface-primary); border-radius: var(--radius-full); transition: all 0.15s; } @@ -413,7 +413,7 @@ export interface TimelineMarker { justify-content: center; border: 1px solid var(--color-border-primary); border-radius: var(--radius-sm); - background: white; + background: var(--color-surface-primary); cursor: pointer; font-size: var(--font-size-md); } @@ -430,7 +430,7 @@ export interface TimelineMarker { padding: 4px 12px; border: 1px solid var(--color-border-primary); border-radius: var(--radius-sm); - background: white; + background: var(--color-surface-primary); cursor: pointer; font-size: var(--font-size-xs); } diff --git a/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-vex-diff/lineage-vex-diff.component.ts b/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-vex-diff/lineage-vex-diff.component.ts index b9948afc9..8ee3638ef 100644 --- a/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-vex-diff/lineage-vex-diff.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-vex-diff/lineage-vex-diff.component.ts @@ -197,7 +197,7 @@ const STATUS_ORDER: Record = { display: flex; flex-direction: column; height: 100%; - background: white; + background: var(--color-surface-primary); border-radius: var(--radius-lg); overflow: hidden; } diff --git a/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-why-safe-panel/lineage-why-safe-panel.component.ts b/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-why-safe-panel/lineage-why-safe-panel.component.ts index 0b09b47bd..35f4c68b3 100644 --- a/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-why-safe-panel/lineage-why-safe-panel.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/lineage/components/lineage-why-safe-panel/lineage-why-safe-panel.component.ts @@ -275,7 +275,7 @@ export interface WhySafeExplanation { bottom: 0; width: 450px; max-width: 90vw; - background: white; + background: var(--color-surface-primary); box-shadow: -4px 0 24px rgba(0, 0, 0, 0.15); display: flex; flex-direction: column; @@ -655,7 +655,7 @@ export interface WhySafeExplanation { padding: 6px 12px; border: 1px solid var(--color-border-primary); border-radius: var(--radius-sm); - background: white; + background: var(--color-surface-primary); cursor: pointer; font-size: var(--font-size-xs); } diff --git a/src/Web/StellaOps.Web/src/app/features/lineage/components/timeline-slider/timeline-slider.component.ts b/src/Web/StellaOps.Web/src/app/features/lineage/components/timeline-slider/timeline-slider.component.ts index a25adf0ac..6ec45d66d 100644 --- a/src/Web/StellaOps.Web/src/app/features/lineage/components/timeline-slider/timeline-slider.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/lineage/components/timeline-slider/timeline-slider.component.ts @@ -124,7 +124,7 @@ export interface TimelineMark { display: flex; align-items: center; justify-content: center; - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-full); cursor: pointer; diff --git a/src/Web/StellaOps.Web/src/app/features/lineage/services/lineage-export.service.ts b/src/Web/StellaOps.Web/src/app/features/lineage/services/lineage-export.service.ts index b9170d18c..3df2f5fca 100644 --- a/src/Web/StellaOps.Web/src/app/features/lineage/services/lineage-export.service.ts +++ b/src/Web/StellaOps.Web/src/app/features/lineage/services/lineage-export.service.ts @@ -491,7 +491,7 @@ export class LineageExportService { background: var(--color-surface-secondary); } .report { - background: white; + background: var(--color-surface-primary); border-radius: var(--radius-lg); box-shadow: 0 2px 8px rgba(0,0,0,0.1); padding: 24px; diff --git a/src/Web/StellaOps.Web/src/app/features/offline-kit/components/bundle-management.component.ts b/src/Web/StellaOps.Web/src/app/features/offline-kit/components/bundle-management.component.ts index 6dfc7df09..d1d5ab694 100644 --- a/src/Web/StellaOps.Web/src/app/features/offline-kit/components/bundle-management.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/offline-kit/components/bundle-management.component.ts @@ -110,7 +110,7 @@ interface LoadedBundle { @for (asset of category.assets; track asset) {
{{ asset }} - ✓ +
}
diff --git a/src/Web/StellaOps.Web/src/app/features/offline-kit/components/jwks-management.component.ts b/src/Web/StellaOps.Web/src/app/features/offline-kit/components/jwks-management.component.ts index 9d7a144ca..cdedcbc3d 100644 --- a/src/Web/StellaOps.Web/src/app/features/offline-kit/components/jwks-management.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/offline-kit/components/jwks-management.component.ts @@ -177,7 +177,7 @@ interface TrustAnchor { @if (validationResult()) {
- {{ validationResult()!.valid ? '✓' : '✗' }} + @if (validationResult()!.valid) {} @else {} {{ validationResult()!.valid ? 'Token Valid' : 'Token Invalid' }}
@if (validationResult()!.message) { diff --git a/src/Web/StellaOps.Web/src/app/features/offline-kit/components/verification-center.component.ts b/src/Web/StellaOps.Web/src/app/features/offline-kit/components/verification-center.component.ts index 33366c5ec..2cbe749a7 100644 --- a/src/Web/StellaOps.Web/src/app/features/offline-kit/components/verification-center.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/offline-kit/components/verification-center.component.ts @@ -41,7 +41,7 @@ interface VerificationHistory { @for (item of history(); track item.id) {
- {{ item.valid ? '✓' : '✗' }} + @if (item.valid) {} @else {}
{{ item.bundleName }} diff --git a/src/Web/StellaOps.Web/src/app/features/platform-health/platform-health-dashboard.component.ts b/src/Web/StellaOps.Web/src/app/features/platform-health/platform-health-dashboard.component.ts index 3a399dd63..568ced7eb 100644 --- a/src/Web/StellaOps.Web/src/app/features/platform-health/platform-health-dashboard.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/platform-health/platform-health-dashboard.component.ts @@ -3,7 +3,7 @@ import { Component, inject, signal, computed, OnInit, OnDestroy } from '@angular import { CommonModule } from '@angular/common'; import { RouterModule } from '@angular/router'; import { FormsModule } from '@angular/forms'; -import { PlatformHealthClient, MockPlatformHealthClient } from '../../core/api/platform-health.client'; +import { PlatformHealthClient } from '../../core/api/platform-health.client'; import { PlatformHealthSummary, ServiceHealth, @@ -23,7 +23,6 @@ import { Subject, interval, takeUntil, switchMap, startWith, forkJoin } from 'rx @Component({ selector: 'app-platform-health-dashboard', imports: [CommonModule, RouterModule, FormsModule], - providers: [{ provide: PlatformHealthClient, useClass: MockPlatformHealthClient }], template: `
@@ -168,7 +167,7 @@ import { Subject, interval, takeUntil, switchMap, startWith, forkJoin } from 'rx
- @if (summary() && summary()!.services.length === 0) { + @if (summary() && (summary()!.services ?? []).length === 0) {

No services available in current snapshot

} @else if (groupBy() === 'state') { @@ -236,7 +235,7 @@ import { Subject, interval, takeUntil, switchMap, startWith, forkJoin } from 'rx

- {{ dependencyGraph()!.nodes.length }} nodes ¡ {{ dependencyGraph()!.edges.length }} connections + {{ (dependencyGraph()!.nodes ?? []).length }} nodes ¡ {{ (dependencyGraph()!.edges ?? []).length }} connections

} @else { @@ -325,7 +324,7 @@ import { Subject, interval, takeUntil, switchMap, startWith, forkJoin } from 'rx
Checks: - {{ getPassingChecksCount(service.checks) }}/{{ service.checks.length }} + {{ getPassingChecksCount(service.checks) }}/{{ (service.checks ?? []).length }}
@@ -534,8 +533,8 @@ export class PlatformHealthDashboardComponent implements OnInit, OnDestroy { (this.dependencyGraph()?.nodes ?? []).filter((n) => n.type !== 'service') ); - getPassingChecksCount(checks: { status: string }[]): number { - return checks.filter((c) => c.status === 'pass').length; + getPassingChecksCount(checks: { status: string }[] | null | undefined): number { + return (checks ?? []).filter((c) => c.status === 'pass').length; } ngOnInit(): void { @@ -558,7 +557,7 @@ export class PlatformHealthDashboardComponent implements OnInit, OnDestroy { next: ({ summary, graph, incidents }) => { this.summary.set(summary); this.dependencyGraph.set(graph); - this.incidents.set(incidents.incidents); + this.incidents.set(incidents.incidents ?? []); this.loadError.set(null); this.loading.set(false); }, @@ -585,7 +584,7 @@ export class PlatformHealthDashboardComponent implements OnInit, OnDestroy { next: ({ summary, graph, incidents }) => { this.summary.set(summary); this.dependencyGraph.set(graph); - this.incidents.set(incidents.incidents); + this.incidents.set(incidents.incidents ?? []); this.loadError.set(null); this.loading.set(false); }, @@ -596,7 +595,8 @@ export class PlatformHealthDashboardComponent implements OnInit, OnDestroy { }); } - getErrorRateColor(rate: number): string { + getErrorRateColor(rate: number | null | undefined): string { + if (rate == null) return 'text-green-600'; if (rate >= 5) return 'text-red-600'; if (rate >= 1) return 'text-yellow-600'; return 'text-green-600'; diff --git a/src/Web/StellaOps.Web/src/app/features/policy-governance/conflict-resolution-wizard.component.ts b/src/Web/StellaOps.Web/src/app/features/policy-governance/conflict-resolution-wizard.component.ts index 3b866c6f5..b83794ba0 100644 --- a/src/Web/StellaOps.Web/src/app/features/policy-governance/conflict-resolution-wizard.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/policy-governance/conflict-resolution-wizard.component.ts @@ -6,7 +6,6 @@ import { finalize } from 'rxjs/operators'; import { POLICY_GOVERNANCE_API, - MockPolicyGovernanceApi, } from '../../core/api/policy-governance.client'; import { PolicyConflict, @@ -22,7 +21,6 @@ import { @Component({ selector: 'app-conflict-resolution-wizard', imports: [CommonModule, FormsModule, RouterModule], - providers: [{ provide: POLICY_GOVERNANCE_API, useClass: MockPolicyGovernanceApi }], changeDetection: ChangeDetectionStrategy.OnPush, template: `
diff --git a/src/Web/StellaOps.Web/src/app/features/policy-governance/governance-audit.component.ts b/src/Web/StellaOps.Web/src/app/features/policy-governance/governance-audit.component.ts index 8fb498a6d..70aee36eb 100644 --- a/src/Web/StellaOps.Web/src/app/features/policy-governance/governance-audit.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/policy-governance/governance-audit.component.ts @@ -5,7 +5,6 @@ import { finalize } from 'rxjs/operators'; import { POLICY_GOVERNANCE_API, - MockPolicyGovernanceApi, } from '../../core/api/policy-governance.client'; import { GovernanceAuditEvent, @@ -24,7 +23,6 @@ import { @Component({ selector: 'app-governance-audit', imports: [CommonModule, FormsModule], - providers: [{ provide: POLICY_GOVERNANCE_API, useClass: MockPolicyGovernanceApi }], changeDetection: ChangeDetectionStrategy.OnPush, template: `
diff --git a/src/Web/StellaOps.Web/src/app/features/policy-governance/impact-preview.component.ts b/src/Web/StellaOps.Web/src/app/features/policy-governance/impact-preview.component.ts index dbe0faa22..32a0ffd3e 100644 --- a/src/Web/StellaOps.Web/src/app/features/policy-governance/impact-preview.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/policy-governance/impact-preview.component.ts @@ -5,7 +5,6 @@ import { finalize } from 'rxjs/operators'; import { POLICY_GOVERNANCE_API, - MockPolicyGovernanceApi, } from '../../core/api/policy-governance.client'; import { TrustWeightImpact, @@ -22,7 +21,6 @@ import { @Component({ selector: 'app-impact-preview', imports: [CommonModule, RouterModule], - providers: [{ provide: POLICY_GOVERNANCE_API, useClass: MockPolicyGovernanceApi }], changeDetection: ChangeDetectionStrategy.OnPush, template: `
diff --git a/src/Web/StellaOps.Web/src/app/features/policy-governance/policy-conflict-dashboard.component.ts b/src/Web/StellaOps.Web/src/app/features/policy-governance/policy-conflict-dashboard.component.ts index 8bd1bbc4c..51a23cfb5 100644 --- a/src/Web/StellaOps.Web/src/app/features/policy-governance/policy-conflict-dashboard.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/policy-governance/policy-conflict-dashboard.component.ts @@ -6,7 +6,6 @@ import { finalize } from 'rxjs/operators'; import { POLICY_GOVERNANCE_API, - MockPolicyGovernanceApi, } from '../../core/api/policy-governance.client'; import { PolicyConflict, @@ -24,7 +23,6 @@ import { @Component({ selector: 'app-policy-conflict-dashboard', imports: [CommonModule, FormsModule, RouterModule], - providers: [{ provide: POLICY_GOVERNANCE_API, useClass: MockPolicyGovernanceApi }], changeDetection: ChangeDetectionStrategy.OnPush, template: `
diff --git a/src/Web/StellaOps.Web/src/app/features/policy-governance/policy-validator.component.ts b/src/Web/StellaOps.Web/src/app/features/policy-governance/policy-validator.component.ts index 966979b89..b387bfced 100644 --- a/src/Web/StellaOps.Web/src/app/features/policy-governance/policy-validator.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/policy-governance/policy-validator.component.ts @@ -5,7 +5,6 @@ import { finalize } from 'rxjs/operators'; import { POLICY_GOVERNANCE_API, - MockPolicyGovernanceApi, } from '../../core/api/policy-governance.client'; import { PolicyValidationResult, @@ -22,7 +21,6 @@ import { @Component({ selector: 'app-policy-validator', imports: [CommonModule, FormsModule], - providers: [{ provide: POLICY_GOVERNANCE_API, useClass: MockPolicyGovernanceApi }], changeDetection: ChangeDetectionStrategy.OnPush, template: `
diff --git a/src/Web/StellaOps.Web/src/app/features/policy-governance/risk-budget-config.component.ts b/src/Web/StellaOps.Web/src/app/features/policy-governance/risk-budget-config.component.ts index c1db874fb..86aa22bfb 100644 --- a/src/Web/StellaOps.Web/src/app/features/policy-governance/risk-budget-config.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/policy-governance/risk-budget-config.component.ts @@ -15,7 +15,6 @@ import { finalize } from 'rxjs/operators'; import { POLICY_GOVERNANCE_API, - MockPolicyGovernanceApi, } from '../../core/api/policy-governance.client'; import { RiskBudgetGovernance, @@ -31,7 +30,6 @@ import { @Component({ selector: 'app-risk-budget-config', imports: [ReactiveFormsModule, RouterModule], - providers: [{ provide: POLICY_GOVERNANCE_API, useClass: MockPolicyGovernanceApi }], changeDetection: ChangeDetectionStrategy.OnPush, template: `
diff --git a/src/Web/StellaOps.Web/src/app/features/policy-governance/risk-budget-dashboard.component.ts b/src/Web/StellaOps.Web/src/app/features/policy-governance/risk-budget-dashboard.component.ts index 365f7f836..e12f4e094 100644 --- a/src/Web/StellaOps.Web/src/app/features/policy-governance/risk-budget-dashboard.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/policy-governance/risk-budget-dashboard.component.ts @@ -5,7 +5,6 @@ import { finalize } from 'rxjs/operators'; import { POLICY_GOVERNANCE_API, - MockPolicyGovernanceApi, } from '../../core/api/policy-governance.client'; import { RiskBudgetDashboard, @@ -22,7 +21,6 @@ import { @Component({ selector: 'app-risk-budget-dashboard', imports: [CommonModule, RouterModule], - providers: [{ provide: POLICY_GOVERNANCE_API, useClass: MockPolicyGovernanceApi }], changeDetection: ChangeDetectionStrategy.OnPush, template: `
diff --git a/src/Web/StellaOps.Web/src/app/features/policy-governance/risk-profile-editor.component.ts b/src/Web/StellaOps.Web/src/app/features/policy-governance/risk-profile-editor.component.ts index 0548e485f..5912f0dc4 100644 --- a/src/Web/StellaOps.Web/src/app/features/policy-governance/risk-profile-editor.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/policy-governance/risk-profile-editor.component.ts @@ -6,7 +6,6 @@ import { finalize } from 'rxjs/operators'; import { POLICY_GOVERNANCE_API, - MockPolicyGovernanceApi, } from '../../core/api/policy-governance.client'; import { RiskProfileGov, @@ -23,7 +22,6 @@ import { @Component({ selector: 'app-risk-profile-editor', imports: [CommonModule, ReactiveFormsModule, RouterModule], - providers: [{ provide: POLICY_GOVERNANCE_API, useClass: MockPolicyGovernanceApi }], changeDetection: ChangeDetectionStrategy.OnPush, template: `
diff --git a/src/Web/StellaOps.Web/src/app/features/policy-governance/risk-profile-list.component.ts b/src/Web/StellaOps.Web/src/app/features/policy-governance/risk-profile-list.component.ts index c18b3debd..c56018134 100644 --- a/src/Web/StellaOps.Web/src/app/features/policy-governance/risk-profile-list.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/policy-governance/risk-profile-list.component.ts @@ -5,7 +5,6 @@ import { finalize } from 'rxjs/operators'; import { POLICY_GOVERNANCE_API, - MockPolicyGovernanceApi, } from '../../core/api/policy-governance.client'; import { RiskProfileGov, @@ -21,7 +20,6 @@ import { @Component({ selector: 'app-risk-profile-list', imports: [CommonModule, RouterModule], - providers: [{ provide: POLICY_GOVERNANCE_API, useClass: MockPolicyGovernanceApi }], changeDetection: ChangeDetectionStrategy.OnPush, template: `
diff --git a/src/Web/StellaOps.Web/src/app/features/policy-governance/schema-playground.component.ts b/src/Web/StellaOps.Web/src/app/features/policy-governance/schema-playground.component.ts index ed1849f01..73136cbb3 100644 --- a/src/Web/StellaOps.Web/src/app/features/policy-governance/schema-playground.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/policy-governance/schema-playground.component.ts @@ -5,7 +5,6 @@ import { finalize } from 'rxjs/operators'; import { POLICY_GOVERNANCE_API, - MockPolicyGovernanceApi, } from '../../core/api/policy-governance.client'; import { RiskProfileValidation, @@ -21,7 +20,6 @@ import { @Component({ selector: 'app-schema-playground', imports: [FormsModule], - providers: [{ provide: POLICY_GOVERNANCE_API, useClass: MockPolicyGovernanceApi }], changeDetection: ChangeDetectionStrategy.OnPush, template: `
diff --git a/src/Web/StellaOps.Web/src/app/features/policy-governance/sealed-mode-control.component.ts b/src/Web/StellaOps.Web/src/app/features/policy-governance/sealed-mode-control.component.ts index d2c4d8309..b9d9b54d3 100644 --- a/src/Web/StellaOps.Web/src/app/features/policy-governance/sealed-mode-control.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/policy-governance/sealed-mode-control.component.ts @@ -5,7 +5,6 @@ import { finalize } from 'rxjs/operators'; import { POLICY_GOVERNANCE_API, - MockPolicyGovernanceApi, } from '../../core/api/policy-governance.client'; import { SealedModeStatus, @@ -23,7 +22,6 @@ import { @Component({ selector: 'app-sealed-mode-control', imports: [CommonModule, ReactiveFormsModule, FormsModule], - providers: [{ provide: POLICY_GOVERNANCE_API, useClass: MockPolicyGovernanceApi }], changeDetection: ChangeDetectionStrategy.OnPush, template: `
diff --git a/src/Web/StellaOps.Web/src/app/features/policy-governance/sealed-mode-overrides.component.ts b/src/Web/StellaOps.Web/src/app/features/policy-governance/sealed-mode-overrides.component.ts index ba0c1edfd..e8ace04aa 100644 --- a/src/Web/StellaOps.Web/src/app/features/policy-governance/sealed-mode-overrides.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/policy-governance/sealed-mode-overrides.component.ts @@ -6,7 +6,6 @@ import { finalize } from 'rxjs/operators'; import { POLICY_GOVERNANCE_API, - MockPolicyGovernanceApi, } from '../../core/api/policy-governance.client'; import { SealedModeOverride, @@ -22,7 +21,6 @@ import { @Component({ selector: 'app-sealed-mode-overrides', imports: [CommonModule, FormsModule, RouterModule], - providers: [{ provide: POLICY_GOVERNANCE_API, useClass: MockPolicyGovernanceApi }], changeDetection: ChangeDetectionStrategy.OnPush, template: `
diff --git a/src/Web/StellaOps.Web/src/app/features/policy-governance/staleness-config.component.ts b/src/Web/StellaOps.Web/src/app/features/policy-governance/staleness-config.component.ts index 101f9c0e2..d43aca6ba 100644 --- a/src/Web/StellaOps.Web/src/app/features/policy-governance/staleness-config.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/policy-governance/staleness-config.component.ts @@ -5,7 +5,6 @@ import { finalize } from 'rxjs/operators'; import { POLICY_GOVERNANCE_API, - MockPolicyGovernanceApi, } from '../../core/api/policy-governance.client'; import { StalenessConfig, @@ -24,7 +23,6 @@ import { @Component({ selector: 'app-staleness-config', imports: [CommonModule, ReactiveFormsModule], - providers: [{ provide: POLICY_GOVERNANCE_API, useClass: MockPolicyGovernanceApi }], changeDetection: ChangeDetectionStrategy.OnPush, template: `
diff --git a/src/Web/StellaOps.Web/src/app/features/policy-governance/trust-weighting.component.ts b/src/Web/StellaOps.Web/src/app/features/policy-governance/trust-weighting.component.ts index c72490577..df127baca 100644 --- a/src/Web/StellaOps.Web/src/app/features/policy-governance/trust-weighting.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/policy-governance/trust-weighting.component.ts @@ -5,7 +5,6 @@ import { finalize } from 'rxjs/operators'; import { POLICY_GOVERNANCE_API, - MockPolicyGovernanceApi, } from '../../core/api/policy-governance.client'; import { TrustWeight, @@ -23,7 +22,6 @@ import { @Component({ selector: 'app-trust-weighting', imports: [CommonModule, ReactiveFormsModule], - providers: [{ provide: POLICY_GOVERNANCE_API, useClass: MockPolicyGovernanceApi }], changeDetection: ChangeDetectionStrategy.OnPush, template: `
diff --git a/src/Web/StellaOps.Web/src/app/features/policy/components/evidence-chain-viewer/evidence-chain-viewer.component.ts b/src/Web/StellaOps.Web/src/app/features/policy/components/evidence-chain-viewer/evidence-chain-viewer.component.ts index dbe904f5e..9a62ffcb2 100644 --- a/src/Web/StellaOps.Web/src/app/features/policy/components/evidence-chain-viewer/evidence-chain-viewer.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/policy/components/evidence-chain-viewer/evidence-chain-viewer.component.ts @@ -226,7 +226,7 @@ import { Evidence, EvidenceType } from '../../../core/api/verdict.models'; .justification-text { margin-top: 0.25rem; padding: 0.5rem; - background: white; + background: var(--color-surface-primary); border-radius: var(--radius-sm); font-style: italic; } @@ -256,7 +256,7 @@ import { Evidence, EvidenceType } from '../../../core/api/verdict.models'; display: block; margin-top: 0.25rem; padding: 0.5rem; - background: white; + background: var(--color-surface-primary); border-radius: var(--radius-sm); font-size: 0.75rem; overflow-x: auto; diff --git a/src/Web/StellaOps.Web/src/app/features/policy/policy-studio.component.ts b/src/Web/StellaOps.Web/src/app/features/policy/policy-studio.component.ts index 9f3996fb8..e6e2e3604 100644 --- a/src/Web/StellaOps.Web/src/app/features/policy/policy-studio.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/policy/policy-studio.component.ts @@ -613,7 +613,7 @@ type SortOrder = 'asc' | 'desc'; } .policy-studio__section { - background: white; + background: var(--color-surface-primary); border: 1px solid rgba(212, 201, 168, 0.3); border-radius: var(--radius-lg); padding: 1.25rem; @@ -701,7 +701,7 @@ type SortOrder = 'asc' | 'desc'; padding: 0.5rem 1rem; border: 1px solid rgba(212, 201, 168, 0.3); border-radius: var(--radius-md); - background: white; + background: var(--color-surface-primary); font-size: 0.875rem; font-weight: var(--font-weight-medium); color: var(--color-text-secondary); diff --git a/src/Web/StellaOps.Web/src/app/features/proof-chain/components/proof-detail-panel.component.html b/src/Web/StellaOps.Web/src/app/features/proof-chain/components/proof-detail-panel.component.html index efb9414c9..6a808c1b1 100644 --- a/src/Web/StellaOps.Web/src/app/features/proof-chain/components/proof-detail-panel.component.html +++ b/src/Web/StellaOps.Web/src/app/features/proof-chain/components/proof-detail-panel.component.html @@ -4,7 +4,7 @@

Proof Details

- +
@if (loading()) { @@ -170,9 +170,9 @@
@if (rekor.hasInclusionProof) { - ✓ Available + Available } @else { - ✗ Not Available + Not Available }
diff --git a/src/Web/StellaOps.Web/src/app/features/proof-chain/components/verification-badge.component.ts b/src/Web/StellaOps.Web/src/app/features/proof-chain/components/verification-badge.component.ts index 14bc226e0..a3e956325 100644 --- a/src/Web/StellaOps.Web/src/app/features/proof-chain/components/verification-badge.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/proof-chain/components/verification-badge.component.ts @@ -32,7 +32,7 @@ import { ProofVerificationStatus } from '../proof-chain.models'; [attr.aria-label]="ariaLabel" role="status" > - {{ icon }} + {{ displayText }} @@ -142,11 +142,13 @@ export class VerificationBadgeComponent { return this.status === 'RekorNotAnchored' || this.status === 'unverified'; } + private readonly _ia = 'viewBox="0 0 24 24" width="14" height="14" aria-hidden="true" fill="none" stroke="currentColor" stroke-width="2"'; + get icon(): string { - if (this.isVerified) return '✓'; - if (this.isFailed) return '✗'; - if (this.isPending) return 'âŗ'; - return '○'; + if (this.isVerified) return ``; + if (this.isFailed) return ``; + if (this.isPending) return ``; + return ``; } get displayText(): string { diff --git a/src/Web/StellaOps.Web/src/app/features/proof-chain/proof-chain.component.html b/src/Web/StellaOps.Web/src/app/features/proof-chain/proof-chain.component.html index 804d888ce..1f819df05 100644 --- a/src/Web/StellaOps.Web/src/app/features/proof-chain/proof-chain.component.html +++ b/src/Web/StellaOps.Web/src/app/features/proof-chain/proof-chain.component.html @@ -4,7 +4,7 @@
@if (hasData()) { }
@@ -65,7 +65,7 @@

{{ node.type }} Details

- +
diff --git a/src/Web/StellaOps.Web/src/app/features/proof-chain/proof-chain.component.ts b/src/Web/StellaOps.Web/src/app/features/proof-chain/proof-chain.component.ts index 1242714b0..a5c7875e3 100644 --- a/src/Web/StellaOps.Web/src/app/features/proof-chain/proof-chain.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/proof-chain/proof-chain.component.ts @@ -218,7 +218,7 @@ export class ProofChainComponent implements OnInit, AfterViewInit, OnDestroy { nodeEl.innerHTML = `
${node.type} - ${node.rekorLogIndex ? '✓ Verified' : ''} + ${node.rekorLogIndex ? ' Verified' : ''}
${node.digest.substring(0, 16)}...
${new Date(node.createdAt).toLocaleString()}
@@ -236,7 +236,7 @@ export class ProofChainComponent implements OnInit, AfterViewInit, OnDestroy { if (index < chain.nodes.length - 1) { const connector = document.createElement('div'); connector.className = 'node-connector'; - connector.textContent = '↓'; + connector.innerHTML = ''; tree.appendChild(connector); } }); diff --git a/src/Web/StellaOps.Web/src/app/features/proof-studio/components/confidence-breakdown/confidence-breakdown.component.html b/src/Web/StellaOps.Web/src/app/features/proof-studio/components/confidence-breakdown/confidence-breakdown.component.html index 59be2781c..1b5476c64 100644 --- a/src/Web/StellaOps.Web/src/app/features/proof-studio/components/confidence-breakdown/confidence-breakdown.component.html +++ b/src/Web/StellaOps.Web/src/app/features/proof-studio/components/confidence-breakdown/confidence-breakdown.component.html @@ -25,8 +25,7 @@
- - {{ getFactorIcon(factor.source) }} + {{ getFactorLabel(factor.source) }} {{ getFactorDescription(factor) }} diff --git a/src/Web/StellaOps.Web/src/app/features/proof-studio/components/confidence-breakdown/confidence-breakdown.component.ts b/src/Web/StellaOps.Web/src/app/features/proof-studio/components/confidence-breakdown/confidence-breakdown.component.ts index 0f4d7098b..03f690613 100644 --- a/src/Web/StellaOps.Web/src/app/features/proof-studio/components/confidence-breakdown/confidence-breakdown.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/proof-studio/components/confidence-breakdown/confidence-breakdown.component.ts @@ -72,15 +72,17 @@ export class ConfidenceBreakdownComponent { return `${terms.join(' + ')} = ${totalCalc}`; }); + private readonly _ia = 'viewBox="0 0 24 24" width="14" height="14" aria-hidden="true" fill="none" stroke="currentColor" stroke-width="2"'; + getFactorIcon(source: string): string { const icons: Record = { - reachability: '🔍', - vex_evidence: '📝', - policy_rules: '⚖ī¸', - provenance: '🔐', - temporal_decay: '⏱ī¸' + reachability: ``, + vex_evidence: ``, + policy_rules: ``, + provenance: ``, + temporal_decay: `` }; - return icons[source] || '📊'; + return icons[source] || ``; } getFactorLabel(source: string): string { diff --git a/src/Web/StellaOps.Web/src/app/features/proof-studio/components/confidence-factor-chip/confidence-factor-chip.component.ts b/src/Web/StellaOps.Web/src/app/features/proof-studio/components/confidence-factor-chip/confidence-factor-chip.component.ts index 88bacec62..8bf39c703 100644 --- a/src/Web/StellaOps.Web/src/app/features/proof-studio/components/confidence-factor-chip/confidence-factor-chip.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/proof-studio/components/confidence-factor-chip/confidence-factor-chip.component.ts @@ -21,7 +21,7 @@ import { ConfidenceFactor, FactorSource } from '../../models/proof-trace.model'; [class]="chipClass()" [attr.title]="chipTooltip()" (click)="handleClick()"> - + {{ label() }} {{ scoreDisplay() }} @if (removable) { @@ -145,7 +145,7 @@ export class ConfidenceFactorChipComponent { readonly icon = computed(() => { const factor = this._factor(); - if (!factor) return '📊'; + if (!factor) return ``; return this.getFactorIcon(factor.source); }); @@ -209,15 +209,17 @@ export class ConfidenceFactorChipComponent { } } + private readonly _ia = 'viewBox="0 0 24 24" width="14" height="14" aria-hidden="true" fill="none" stroke="currentColor" stroke-width="2"'; + private getFactorIcon(source: FactorSource): string { const icons: Record = { - reachability: '🔍', - vex_evidence: '📝', - policy_rules: '⚖ī¸', - provenance: '🔐', - temporal_decay: '⏱ī¸' + reachability: ``, + vex_evidence: ``, + policy_rules: ``, + provenance: ``, + temporal_decay: `` }; - return icons[source] || '📊'; + return icons[source] || ``; } private getFactorLabel(source: FactorSource): string { diff --git a/src/Web/StellaOps.Web/src/app/features/proof-studio/components/proof-studio-container/proof-studio-container.component.html b/src/Web/StellaOps.Web/src/app/features/proof-studio/components/proof-studio-container/proof-studio-container.component.html index 61e2808f5..dba087660 100644 --- a/src/Web/StellaOps.Web/src/app/features/proof-studio/components/proof-studio-container/proof-studio-container.component.html +++ b/src/Web/StellaOps.Web/src/app/features/proof-studio/components/proof-studio-container/proof-studio-container.component.html @@ -4,7 +4,7 @@

Proof Studio

@@ -76,7 +76,7 @@ [class.active]="activeTab() === 'what-if'" (click)="setActiveTab('what-if')" aria-label="What-If Analysis"> - đŸ”Ŧ + What-If
diff --git a/src/Web/StellaOps.Web/src/app/features/proof-studio/components/what-if-slider/what-if-slider.component.html b/src/Web/StellaOps.Web/src/app/features/proof-studio/components/what-if-slider/what-if-slider.component.html index c3aea77df..33b60ab8c 100644 --- a/src/Web/StellaOps.Web/src/app/features/proof-studio/components/what-if-slider/what-if-slider.component.html +++ b/src/Web/StellaOps.Web/src/app/features/proof-studio/components/what-if-slider/what-if-slider.component.html @@ -82,7 +82,7 @@ {{ getVerdictLabel(proof$()!.verdict) }} - → + {{ getVerdictLabel(simulatedVerdict()) }} diff --git a/src/Web/StellaOps.Web/src/app/features/proof/proof-ledger-view.component.html b/src/Web/StellaOps.Web/src/app/features/proof/proof-ledger-view.component.html index 79aaa104e..86bdf295b 100644 --- a/src/Web/StellaOps.Web/src/app/features/proof/proof-ledger-view.component.html +++ b/src/Web/StellaOps.Web/src/app/features/proof/proof-ledger-view.component.html @@ -119,7 +119,11 @@ (click)="toggleNode(item.node.nodeId)" [attr.aria-label]="isNodeExpanded(item.node.nodeId) ? 'Collapse node' : 'Expand node'" > - {{ isNodeExpanded(item.node.nodeId) ? 'â–ŧ' : 'â–ļ' }} + @if (isNodeExpanded(item.node.nodeId)) { + + } @else { + + } } @else { @@ -149,8 +153,8 @@
diff --git a/src/Web/StellaOps.Web/src/app/shared/components/gate-badge.component.ts b/src/Web/StellaOps.Web/src/app/shared/components/gate-badge.component.ts index 861f7cee1..6d59b8d6f 100644 --- a/src/Web/StellaOps.Web/src/app/shared/components/gate-badge.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/components/gate-badge.component.ts @@ -20,7 +20,7 @@ import { GateInfo } from '../../core/api/witness.models'; [attr.title]="tooltip()" [attr.aria-label]="ariaLabel()" > - {{ gateIcon() }} + {{ gateTypeLabel() }} @if (showConfidence()) { @@ -99,15 +99,16 @@ export class GateBadgeComponent { gateClass = computed(() => `gate-badge gate-badge--${this.gate().gateType}`); gateIcon = computed(() => { + const svgAttrs = 'viewBox="0 0 24 24" width="12" height="12" aria-hidden="true"'; const icons: Record = { - 'auth': '🔐', - 'authz': '🛡ī¸', - 'validation': '✓', - 'sanitization': '🧹', - 'rate-limit': '⏱ī¸', - 'other': '🔒', + 'auth': ``, + 'authz': ``, + 'validation': ``, + 'sanitization': ``, + 'rate-limit': ``, + 'other': ``, }; - return icons[this.gate().gateType] ?? '🔒'; + return icons[this.gate().gateType] ?? ``; }); gateTypeLabel = computed(() => { diff --git a/src/Web/StellaOps.Web/src/app/shared/components/graph-diff/graph-diff.component.ts b/src/Web/StellaOps.Web/src/app/shared/components/graph-diff/graph-diff.component.ts index ba0c017d3..2a0500fb3 100644 --- a/src/Web/StellaOps.Web/src/app/shared/components/graph-diff/graph-diff.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/components/graph-diff/graph-diff.component.ts @@ -339,7 +339,7 @@ import { class="graph-diff__detail-close" (click)="clearSelection()" aria-label="Close panel"> - × +
@@ -480,7 +480,7 @@ import { } .graph-diff__btn { - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-sm); padding: 4px 8px; @@ -596,7 +596,7 @@ import { position: absolute; bottom: 12px; right: 12px; - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-sm); padding: 4px; @@ -608,7 +608,7 @@ import { top: 60px; right: 12px; width: 280px; - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-lg); box-shadow: 0 4px 16px rgba(0, 0, 0, 0.15); @@ -730,7 +730,7 @@ import { left: 12px; display: flex; gap: 12px; - background: white; + background: var(--color-surface-primary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-sm); padding: 6px 10px; diff --git a/src/Web/StellaOps.Web/src/app/shared/components/graph-diff/graph-split-view.component.ts b/src/Web/StellaOps.Web/src/app/shared/components/graph-diff/graph-split-view.component.ts index 84e217597..6098573c6 100644 --- a/src/Web/StellaOps.Web/src/app/shared/components/graph-diff/graph-split-view.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/components/graph-diff/graph-split-view.component.ts @@ -177,7 +177,7 @@ export type ViewMode = 'split' | 'unified' | 'base-only' | 'head-only'; } .split-view__mode-btn--active { - background: white; + background: var(--color-surface-primary); font-weight: var(--font-weight-medium); box-shadow: var(--shadow-sm); } diff --git a/src/Web/StellaOps.Web/src/app/shared/components/input-manifest.component.ts b/src/Web/StellaOps.Web/src/app/shared/components/input-manifest.component.ts index 75e9f73e3..6e539c16d 100644 --- a/src/Web/StellaOps.Web/src/app/shared/components/input-manifest.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/components/input-manifest.component.ts @@ -61,7 +61,7 @@ export type InputManifestMode = 'full' | 'compact' | 'summary'; (click)="copyVeriKey.emit(m.veriKey)" type="button" title="Copy VeriKey"> - 📋 +
} @@ -74,7 +74,7 @@ export type InputManifestMode = 'full' | 'compact' | 'summary'; @if (shouldShowSection('source')) {

- đŸ“Ļ + Source Artifact

@@ -112,7 +112,7 @@ export type InputManifestMode = 'full' | 'compact' | 'summary'; @if (shouldShowSection('sbom')) {

- 📋 + SBOM

@@ -168,7 +168,7 @@ export type InputManifestMode = 'full' | 'compact' | 'summary'; @if (shouldShowSection('vex')) {

- 📜 + VEX Statements

@@ -210,7 +210,7 @@ export type InputManifestMode = 'full' | 'compact' | 'summary'; @if (shouldShowSection('policy')) {

- 📏 + Policy

@@ -256,7 +256,7 @@ export type InputManifestMode = 'full' | 'compact' | 'summary'; @if (shouldShowSection('signers')) {

- 🔐 + Signers

@@ -310,7 +310,7 @@ export type InputManifestMode = 'full' | 'compact' | 'summary'; @if (shouldShowSection('timeWindow')) {

- ⏰ + Time Window

@@ -348,12 +348,12 @@ export type InputManifestMode = 'full' | 'compact' | 'summary'; (click)="refresh.emit()" type="button" title="Refresh manifest"> - 🔄 + } @else {
- 📄 +

No manifest data available

} diff --git a/src/Web/StellaOps.Web/src/app/shared/components/manifest-validator.component.ts b/src/Web/StellaOps.Web/src/app/shared/components/manifest-validator.component.ts index 9ac649a77..53678acea 100644 --- a/src/Web/StellaOps.Web/src/app/shared/components/manifest-validator.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/components/manifest-validator.component.ts @@ -53,7 +53,7 @@ import {
- @if (validationResult()!.valid) { ✓ } @else { ✗ } + @if (validationResult()!.valid) { } @else { }

{{ validationResult()!.valid ? 'Validation Passed' : 'Validation Failed' }}

diff --git a/src/Web/StellaOps.Web/src/app/shared/components/metrics-dashboard.component.ts b/src/Web/StellaOps.Web/src/app/shared/components/metrics-dashboard.component.ts index 0732ae6c4..c711de2c5 100644 --- a/src/Web/StellaOps.Web/src/app/shared/components/metrics-dashboard.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/components/metrics-dashboard.component.ts @@ -214,9 +214,12 @@ export interface MetricsFindingData {
{{ stat.count | number }} / {{ stat.total | number }} - ✓ {{ stat.verified | number }} | - ⚠ {{ stat.expired | number }} | - ✗ {{ stat.missing | number }} + + {{ stat.verified | number }} | + + {{ stat.expired | number }} | + + {{ stat.missing | number }}
@if (stat.trend && stat.trend.length > 0) { @@ -326,7 +329,7 @@ export interface MetricsFindingData { } @else {
- 🎉 No attestation gaps found in the filtered data! + No attestation gaps found in the filtered data.
}
@@ -507,6 +510,16 @@ export interface MetricsFindingData { color: var(--color-text-muted); } + .gauge__icon { + display: inline-block; + vertical-align: middle; + margin-right: 2px; + } + + .gauge__icon--ok { color: var(--color-status-success-text); } + .gauge__icon--warn { color: var(--color-status-warning-text); } + .gauge__icon--fail { color: var(--color-status-error-text); } + .gauge__trend { margin-top: 0.5rem; font-family: monospace; diff --git a/src/Web/StellaOps.Web/src/app/shared/components/offline-verification.component.ts b/src/Web/StellaOps.Web/src/app/shared/components/offline-verification.component.ts index f14087e76..41aa7dc01 100644 --- a/src/Web/StellaOps.Web/src/app/shared/components/offline-verification.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/components/offline-verification.component.ts @@ -96,9 +96,13 @@ type VerificationStep = 'upload' | 'extract' | 'validate' | 'visualize'; @for (check of validationChecks(); track check.name) {
  • - @if (check.completed && !check.failed) { ✓ } - @else if (check.failed) { ✗ } - @else { ○ } + @if (check.completed && !check.failed) { + + } @else if (check.failed) { + + } @else { + + } {{ check.name }}
    • @@ -114,7 +118,11 @@ type VerificationStep = 'upload' | 'extract' | 'validate' | 'visualize';
    - @if (result()!.valid) { ✓ } @else { ✗ } + @if (result()!.valid) { + + } @else { + + }

    {{ result()!.valid ? 'Verification Passed' : 'Verification Failed' }}

    @@ -130,7 +138,31 @@ type VerificationStep = 'upload' | 'extract' | 'validate' | 'visualize'; @for (item of result()!.evidenceChain; track item.type; let i = $index) {
    - {{ getChainIcon(item.type) }} + + @switch (item.type) { + @case ('sbom') { + + } + @case ('scan') { + + } + @case ('vex') { + + } + @case ('policy') { + + } + @case ('verdict') { + + } + @case ('attestation') { + + } + @default { + + } + } +
    {{ item.label }} @@ -670,14 +702,14 @@ export class OfflineVerificationComponent { getChainIcon(type: string): string { const icons: Record = { - sbom: 'đŸ“Ļ', - scan: '🔍', - vex: '📋', - policy: '📜', - verdict: '⚖ī¸', - attestation: '🔏' + sbom: 'sbom', + scan: 'scan', + vex: 'vex', + policy: 'policy', + verdict: 'verdict', + attestation: 'attestation' }; - return icons[type] || '○'; + return icons[type] || 'unknown'; } getResultSummary(): string { diff --git a/src/Web/StellaOps.Web/src/app/shared/components/path-visualization.component.ts b/src/Web/StellaOps.Web/src/app/shared/components/path-visualization.component.ts index 51f62df25..390876d47 100644 --- a/src/Web/StellaOps.Web/src/app/shared/components/path-visualization.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/components/path-visualization.component.ts @@ -24,7 +24,7 @@ export interface PathVisualizationData { template: `
    - {{ collapsed() ? 'â–ļ' : 'â–ŧ' }} + @if (collapsed()) { } @else { } Call Path ({{ pathLength() }} nodes)
    @@ -35,7 +35,7 @@ export interface PathVisualizationData { @if (data().entrypoint) {
    - đŸšĒ +
    ENTRYPOINT
    @@ -82,7 +82,7 @@ export interface PathVisualizationData { } @if (node.package) {
    - đŸ“Ļ {{ node.package }} + {{ node.package }}
    } @if (node.isChanged) { @@ -107,14 +107,14 @@ export interface PathVisualizationData { @if (data().sink) {
    - đŸŽ¯ +
    SINK (TRIGGER METHOD)
    {{ data().sink!.symbol }}
    @if (data().sink!.package) {
    - đŸ“Ļ {{ data().sink!.package }} + {{ data().sink!.package }}
    }
    diff --git a/src/Web/StellaOps.Web/src/app/shared/components/plain-language-toggle/plain-language-toggle.component.ts b/src/Web/StellaOps.Web/src/app/shared/components/plain-language-toggle/plain-language-toggle.component.ts index 1daf5f412..03a483c2b 100644 --- a/src/Web/StellaOps.Web/src/app/shared/components/plain-language-toggle/plain-language-toggle.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/components/plain-language-toggle/plain-language-toggle.component.ts @@ -98,7 +98,7 @@ import { PlainLanguageService } from '../../services/plain-language.service'; left: 2px; width: 16px; height: 16px; - background: white; + background: var(--color-surface-primary); border-radius: var(--radius-full); display: flex; align-items: center; diff --git a/src/Web/StellaOps.Web/src/app/shared/components/proof-chain-viewer.component.ts b/src/Web/StellaOps.Web/src/app/shared/components/proof-chain-viewer.component.ts index 033f59e47..aad9f9531 100644 --- a/src/Web/StellaOps.Web/src/app/shared/components/proof-chain-viewer.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/components/proof-chain-viewer.component.ts @@ -97,7 +97,7 @@ export interface ChainSummary { @if (orderedNodes().length === 0) {
    - 📭 + No attestations in chain
    } @else { @@ -108,7 +108,7 @@ export interface ChainSummary { @if (idx > 0) { } @@ -145,7 +145,7 @@ export interface ChainSummary { {{ getTypeLabel(type) }} @if (!last) { - + } }
    diff --git a/src/Web/StellaOps.Web/src/app/shared/components/proof-spine/proof-badges-row.component.ts b/src/Web/StellaOps.Web/src/app/shared/components/proof-spine/proof-badges-row.component.ts index e7d407227..f523f18b4 100644 --- a/src/Web/StellaOps.Web/src/app/shared/components/proof-spine/proof-badges-row.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/components/proof-spine/proof-badges-row.component.ts @@ -76,7 +76,7 @@ import { display: flex; align-items: center; justify-content: center; - background: white; + background: var(--color-surface-primary); box-shadow: 0 1px 2px rgba(0,0,0,0.2); } diff --git a/src/Web/StellaOps.Web/src/app/shared/components/proof-tree.component.ts b/src/Web/StellaOps.Web/src/app/shared/components/proof-tree.component.ts index 4fd8b44e2..28a08ac6a 100644 --- a/src/Web/StellaOps.Web/src/app/shared/components/proof-tree.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/components/proof-tree.component.ts @@ -58,7 +58,7 @@ export interface EvidenceChunk {

    - 🔐 + Decision Proof Tree

    @@ -67,7 +67,7 @@ export interface EvidenceChunk { (click)="toggleExpand()" type="button" [title]="isExpanded() ? 'Collapse all' : 'Expand all'"> - {{ isExpanded() ? '➖' : '➕' }} + @if (digest()) { }
    @@ -92,10 +92,10 @@ export interface EvidenceChunk { (click)="veriKeyExpanded.set(!veriKeyExpanded())" type="button" [attr.aria-expanded]="veriKeyExpanded()"> - {{ veriKeyExpanded() ? 'â–ŧ' : 'â–ļ' }} +
    - 🔑 + VeriKey {{ truncateHash(d.veriKey) }} @@ -105,7 +105,7 @@ export interface EvidenceChunk { (click)="onCopyVeriKey(d.veriKey)" type="button" title="Copy VeriKey"> - 📋 +
    @@ -150,10 +150,10 @@ export interface EvidenceChunk { (click)="verdictsExpanded.set(!verdictsExpanded())" type="button" [attr.aria-expanded]="verdictsExpanded()"> - {{ verdictsExpanded() ? 'â–ŧ' : 'â–ļ' }} +
    - 📜 + Verdicts {{ truncateHash(d.verdictHash) }} @@ -191,10 +191,10 @@ export interface EvidenceChunk { (click)="evidenceExpanded.set(!evidenceExpanded())" type="button" [attr.aria-expanded]="evidenceExpanded()"> - {{ evidenceExpanded() ? 'â–ŧ' : 'â–ļ' }} +
    - đŸŒŗ + Evidence Tree (Merkle) {{ truncateHash(d.proofRoot) }} @@ -221,14 +221,14 @@ export interface EvidenceChunk { class="proof-tree__chunk-item" [class.proof-tree__chunk-item--loaded]="chunk.loaded" (click)="loadChunk.emit(chunk)"> - {{ getChunkIcon(chunk.type) }} + {{ chunk.type }} {{ truncateHash(chunk.hash, 8) }} @if (chunk.sizeBytes) { {{ formatBytes(chunk.sizeBytes) }} } @if (!chunk.loaded) { - âŦ‡ī¸ + }
    } @empty { @@ -247,10 +247,10 @@ export interface EvidenceChunk { (click)="replayExpanded.set(!replayExpanded())" type="button" [attr.aria-expanded]="replayExpanded()"> - {{ replayExpanded() ? 'â–ŧ' : 'â–ļ' }} +
    - 🔄 + Replay Seed
    @@ -295,10 +295,10 @@ export interface EvidenceChunk { (click)="metadataExpanded.set(!metadataExpanded())" type="button" [attr.aria-expanded]="metadataExpanded()"> - {{ metadataExpanded() ? 'â–ŧ' : 'â–ļ' }} +
    - ℹī¸ + Metadata
    @@ -330,7 +330,7 @@ export interface EvidenceChunk {
    } @else {
    - 🔐 +

    No decision digest available

    } @@ -343,7 +343,7 @@ export interface EvidenceChunk { [class.proof-tree__merkle-node--leaf]="node.isLeaf" [class.proof-tree__merkle-node--root]="node.isRoot" [style.marginLeft.px]="depth * 20"> - {{ node.isLeaf ? '📄' : '📁' }} + @if (node.label) { {{ node.label }} } @@ -356,7 +356,7 @@ export interface EvidenceChunk { (click)="loadChunkByHash.emit(node.hash)" type="button" title="Load chunk data"> - âŦ‡ī¸ + }
    @@ -866,6 +866,16 @@ export interface EvidenceChunk { `] }) export class ProofTreeComponent { + /** SVG icon constants for template binding. */ + readonly chevronDownHtml = ''; + readonly chevronRightHtml = ''; + readonly collapseIcon = ''; + readonly expandIcon = ''; + readonly pendingIconHtml = ''; + readonly checkIconHtml = ''; + readonly leafIconHtml = ''; + readonly folderIconHtml = ''; + /** The decision digest to display. */ digest = input(null); @@ -994,14 +1004,15 @@ export class ProofTreeComponent { * Get icon for chunk type. */ getChunkIcon(type: EvidenceChunk['type']): string { + const svgAttrs = 'viewBox="0 0 24 24" width="14" height="14" aria-hidden="true"'; const icons: Record = { - 'reachability': 'đŸŽ¯', - 'vex': '📜', - 'policy': '📏', - 'sbom': '📋', - 'signer': '🔐', + 'reachability': ``, + 'vex': ``, + 'policy': ``, + 'sbom': ``, + 'signer': ``, }; - return icons[type] || '📄'; + return icons[type] || ``; } /** diff --git a/src/Web/StellaOps.Web/src/app/shared/components/rekor-link.component.ts b/src/Web/StellaOps.Web/src/app/shared/components/rekor-link.component.ts index 63b772650..ccb3f22cd 100644 --- a/src/Web/StellaOps.Web/src/app/shared/components/rekor-link.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/components/rekor-link.component.ts @@ -34,7 +34,11 @@ export interface RekorReference { [attr.aria-label]="ariaLabel()" > @if (!compact()) { @@ -50,7 +54,7 @@ export interface RekorReference { } - + @if (showMeta() && !compact()) { diff --git a/src/Web/StellaOps.Web/src/app/shared/components/resolution-chip/resolution-chip.component.ts b/src/Web/StellaOps.Web/src/app/shared/components/resolution-chip/resolution-chip.component.ts index 73498d472..a53dc8a95 100644 --- a/src/Web/StellaOps.Web/src/app/shared/components/resolution-chip/resolution-chip.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/components/resolution-chip/resolution-chip.component.ts @@ -53,7 +53,7 @@ import type { VulnResolutionSummary, ResolutionStatus, MatchType } from '../../. (click)="onShowEvidence($event)" [attr.aria-label]="'Show resolution evidence'" > - + } diff --git a/src/Web/StellaOps.Web/src/app/shared/components/risk-drift-card.component.ts b/src/Web/StellaOps.Web/src/app/shared/components/risk-drift-card.component.ts index 41a9ce58d..48824b16b 100644 --- a/src/Web/StellaOps.Web/src/app/shared/components/risk-drift-card.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/components/risk-drift-card.component.ts @@ -62,7 +62,13 @@ export interface DriftResult {
    - {{ hasNewRisk() ? '⚠ī¸' : '✓' }} + + @if (hasNewRisk()) { + + } @else { + + } +

    Risk Drift

    @@ -89,7 +95,11 @@ export interface DriftResult { }
    @@ -100,7 +110,7 @@ export interface DriftResult {

    - 🔴 New Reachable Paths (Requires Attention) + New Reachable Paths (Requires Attention)

    @for (sink of result().newlyReachable; track sink) {
    @@ -160,7 +170,7 @@ export interface DriftResult {

    - đŸŸĸ Mitigated Paths + Mitigated Paths

    @for (sink of result().newlyUnreachable; track sink) {
    - {{ vuln.cveId }} ✓ + {{ vuln.cveId }} }
    diff --git a/src/Web/StellaOps.Web/src/app/shared/components/score-breakdown.component.ts b/src/Web/StellaOps.Web/src/app/shared/components/score-breakdown.component.ts index e5b591602..dce275022 100644 --- a/src/Web/StellaOps.Web/src/app/shared/components/score-breakdown.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/components/score-breakdown.component.ts @@ -56,7 +56,11 @@ export type ScoreBreakdownMode = 'compact' | 'expanded' | 'inline'; } @if (mode() !== 'inline' && hasContributions()) { } diff --git a/src/Web/StellaOps.Web/src/app/shared/components/stats-card/stats-card.component.ts b/src/Web/StellaOps.Web/src/app/shared/components/stats-card/stats-card.component.ts index e06e642a7..899a73912 100644 --- a/src/Web/StellaOps.Web/src/app/shared/components/stats-card/stats-card.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/components/stats-card/stats-card.component.ts @@ -14,7 +14,7 @@ export type StatsVariant = 'default' | 'success' | 'warning' | 'error' | 'info'; * [value]="1234" * trend="up" * trendValue="+12%" - * icon="📊"> + * icon="chart"> * */ @Component({ diff --git a/src/Web/StellaOps.Web/src/app/shared/components/timeline-event.component.ts b/src/Web/StellaOps.Web/src/app/shared/components/timeline-event.component.ts index 6f6e60bcc..ebb2eec8a 100644 --- a/src/Web/StellaOps.Web/src/app/shared/components/timeline-event.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/components/timeline-event.component.ts @@ -92,7 +92,7 @@ export interface TimelineEvent { >
    - {{ eventIcon() }} +
    @@ -108,13 +108,13 @@ export interface TimelineEvent {
    @if (event()?.actor) { - by {{ event()?.actor }} + by {{ event()?.actor }} } @if (event()?.source) { - from {{ event()?.source }} + from {{ event()?.source }} }
    @@ -142,7 +142,7 @@ export interface TimelineEvent { [attr.aria-label]="isExpanded() ? 'Collapse details' : 'Expand details'" type="button" > - {{ isExpanded() ? '▲' : 'â–ŧ' }} + } @if (event()?.traceId || event()?.correlationId) { @@ -152,7 +152,7 @@ export interface TimelineEvent { title="Copy trace ID" type="button" > - 📋 + }
    @@ -290,21 +290,12 @@ export interface TimelineEvent { } .timeline-event__time { - &::before { - content: '🕐 '; - } } .timeline-event__actor { - &::before { - content: '👤 '; - } } .timeline-event__source { - &::before { - content: '📍 '; - } } .timeline-event__provenance { @@ -463,6 +454,10 @@ export interface TimelineEvent { `] }) export class TimelineEventComponent { + /** SVG icon constants for template binding. */ + readonly chevronUpHtml = ''; + readonly chevronDownHtml = ''; + // Inputs readonly event = input(null); readonly showRelativeTime = input(false); @@ -485,28 +480,30 @@ export class TimelineEventComponent { readonly eventIcon = computed(() => { const e = this.event(); - if (!e) return '❓'; + const a = 'viewBox="0 0 24 24" width="16" height="16" aria-hidden="true" fill="none" stroke="currentColor" stroke-width="2"'; + const unknownIcon = ``; + if (!e) return unknownIcon; const icons: Record = { - scan_started: '🔍', - scan_completed: '✅', - finding_created: '🆕', - finding_updated: '📝', - finding_resolved: '✔ī¸', - policy_evaluated: '📋', - vex_updated: '📄', - attestation_created: '🔏', - cache_hit: '⚡', - cache_miss: '💨', - cache_invalidated: '🗑ī¸', - bundle_imported: 'đŸ“Ĩ', - bundle_exported: '📤', - signer_revoked: '🔐', - epoch_advanced: '⏭ī¸', - unknown: '❓', + scan_started: ``, + scan_completed: ``, + finding_created: ``, + finding_updated: ``, + finding_resolved: ``, + policy_evaluated: ``, + vex_updated: ``, + attestation_created: ``, + cache_hit: ``, + cache_miss: ``, + cache_invalidated: ``, + bundle_imported: ``, + bundle_exported: ``, + signer_revoked: ``, + epoch_advanced: ``, + unknown: unknownIcon, }; - return icons[e.type] ?? '❓'; + return icons[e.type] ?? unknownIcon; }); readonly provenanceState = computed((): ProvenanceState => { diff --git a/src/Web/StellaOps.Web/src/app/shared/components/triage/triage-card.component.ts b/src/Web/StellaOps.Web/src/app/shared/components/triage/triage-card.component.ts index b4bdffd14..ff7c3fb7c 100644 --- a/src/Web/StellaOps.Web/src/app/shared/components/triage/triage-card.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/components/triage/triage-card.component.ts @@ -115,7 +115,7 @@ export type TriageAction = 'explain' | 'create-task' | 'mute' | 'export' | 'veri [title]="evidence.details || getEvidenceLabel(evidence)" (click)="onEvidenceClick(evidence)" > - {{ getEvidenceIcon(evidence.type) }} + {{ getEvidenceTypeName(evidence.type) }} @if (evidence.value !== undefined) { {{ evidence.value }} @@ -135,7 +135,7 @@ export type TriageAction = 'explain' | 'create-task' | 'mute' | 'export' | 'veri aria-label="Copy digest" title="Copy digest" > - 📋 +
    } @@ -148,7 +148,7 @@ export type TriageAction = 'explain' | 'create-task' | 'mute' | 'export' | 'veri aria-label="Explain (E)" title="Explain vulnerability (E)" > - 💡 Explain + Explain @@ -223,7 +223,7 @@ export type TriageAction = 'explain' | 'create-task' | 'mute' | 'export' | 'veri (click)="copyToClipboard(verificationResult()?.rekorIndex!)" aria-label="Copy Rekor index" > - 📋 +
    @@ -236,7 +236,7 @@ export type TriageAction = 'explain' | 'create-task' | 'mute' | 'export' | 'veri (click)="copyToClipboard(verificationResult()?.rekorEntry!)" aria-label="Copy Rekor entry" > - 📋 +
    @@ -249,7 +249,7 @@ export type TriageAction = 'explain' | 'create-task' | 'mute' | 'export' | 'veri
    } @else {
    - ⚠ī¸ + {{ verificationResult()?.error || 'Verification failed' }}
    } @@ -634,11 +634,12 @@ export class TriageCardComponent { } protected getEvidenceIcon(type: TriageEvidence['type']): string { + const a = 'viewBox="0 0 24 24" width="14" height="14" aria-hidden="true" fill="none" stroke="currentColor" stroke-width="2"'; const icons: Record = { - 'openvex': '📄', - 'patch-proof': '🔧', - 'reachability': '🔗', - 'epss': '📊', + 'openvex': ``, + 'patch-proof': ``, + 'reachability': ``, + 'epss': ``, }; return icons[type]; } diff --git a/src/Web/StellaOps.Web/src/app/shared/components/unknown-chip.component.ts b/src/Web/StellaOps.Web/src/app/shared/components/unknown-chip.component.ts index 75479f4d9..1443c24c6 100644 --- a/src/Web/StellaOps.Web/src/app/shared/components/unknown-chip.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/components/unknown-chip.component.ts @@ -62,7 +62,7 @@ export interface UnknownTriageAction { -{{ unknown().penalty | percent }} } - {{ expanded ? '▲' : 'â–ŧ' }} + @if (expanded) { } @else { } @if (expanded) { diff --git a/src/Web/StellaOps.Web/src/app/shared/components/unwitnessed-advisory/unwitnessed-advisory.component.ts b/src/Web/StellaOps.Web/src/app/shared/components/unwitnessed-advisory/unwitnessed-advisory.component.ts index 6508e1d23..206e391d2 100644 --- a/src/Web/StellaOps.Web/src/app/shared/components/unwitnessed-advisory/unwitnessed-advisory.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/components/unwitnessed-advisory/unwitnessed-advisory.component.ts @@ -65,7 +65,7 @@ const SEVERITY_ORDER: Record = {

    @@ -135,7 +135,7 @@ const SEVERITY_ORDER: Record = {

    {{ truncateSymbol(path.entrypoint) }} - + {{ truncateSymbol(path.sink) }}
    diff --git a/src/Web/StellaOps.Web/src/app/shared/components/user-menu/user-menu.component.scss b/src/Web/StellaOps.Web/src/app/shared/components/user-menu/user-menu.component.scss index 552fd20a5..f0d2aa2df 100644 --- a/src/Web/StellaOps.Web/src/app/shared/components/user-menu/user-menu.component.scss +++ b/src/Web/StellaOps.Web/src/app/shared/components/user-menu/user-menu.component.scss @@ -86,7 +86,9 @@ position: absolute; top: calc(100% + var(--space-2)); right: 0; - min-width: 240px; + min-width: 220px; + max-width: 260px; + width: max-content; padding: var(--space-2); background-color: var(--color-dropdown-bg); border: 1px solid var(--color-border-primary); diff --git a/src/Web/StellaOps.Web/src/app/shared/components/vex-status-chip.component.ts b/src/Web/StellaOps.Web/src/app/shared/components/vex-status-chip.component.ts index c10bae5fd..08b4bf928 100644 --- a/src/Web/StellaOps.Web/src/app/shared/components/vex-status-chip.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/components/vex-status-chip.component.ts @@ -41,7 +41,7 @@ import type { VexStatus } from '../../core/api/triage-evidence.models'; {{ label() }} } @if (justification() && showJustificationIcon()) { - + } `, diff --git a/src/Web/StellaOps.Web/src/app/shared/components/vex-trust-popover/vex-trust-popover.component.ts b/src/Web/StellaOps.Web/src/app/shared/components/vex-trust-popover/vex-trust-popover.component.ts index 186bacb38..951d46254 100644 --- a/src/Web/StellaOps.Web/src/app/shared/components/vex-trust-popover/vex-trust-popover.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/components/vex-trust-popover/vex-trust-popover.component.ts @@ -52,7 +52,7 @@ interface TrustFactor { (click)="onClose()" aria-label="Close" > - × +
    diff --git a/src/Web/StellaOps.Web/src/app/shared/components/witness-comparison/witness-comparison.component.ts b/src/Web/StellaOps.Web/src/app/shared/components/witness-comparison/witness-comparison.component.ts index 3fbb5840f..f1e09bef6 100644 --- a/src/Web/StellaOps.Web/src/app/shared/components/witness-comparison/witness-comparison.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/components/witness-comparison/witness-comparison.component.ts @@ -255,7 +255,7 @@ type StepCategory = 'confirmed' | 'static-only' | 'runtime-only'; {{ i + 1 }} {{ step.symbol }} @if (step.inRuntime) { - ✓ + }
    } diff --git a/src/Web/StellaOps.Web/src/app/shared/components/witness-modal.component.ts b/src/Web/StellaOps.Web/src/app/shared/components/witness-modal.component.ts index ce3046ed4..707fd0a90 100644 --- a/src/Web/StellaOps.Web/src/app/shared/components/witness-modal.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/components/witness-modal.component.ts @@ -37,7 +37,7 @@ import { PathVisualizationComponent, PathVisualizationData } from './path-visual (click)="close.emit()" aria-label="Close" > - × +
    @if (witness()) { @@ -78,7 +78,7 @@ import { PathVisualizationComponent, PathVisualizationData } from './path-visual @if (!witness()!.isReachable) {
    -
    ✓
    +
    No call path found from entry points to vulnerable code.
    @@ -278,7 +278,13 @@ import { PathVisualizationComponent, PathVisualizationData } from './path-visual
    - {{ verificationResult()?.verified ? '✓' : (verificationResult()?.error ? '✗' : '?') }} + @if (verificationResult()?.verified) { + + } @else if (verificationResult()?.error) { + + } @else { + ? + } {{ verificationResult()?.verified ? 'VERIFIED' : (verificationResult()?.error ? 'FAILED' : 'NOT VERIFIED') }} diff --git a/src/Web/StellaOps.Web/src/app/shared/domain/evidence-link/evidence-link.component.ts b/src/Web/StellaOps.Web/src/app/shared/domain/evidence-link/evidence-link.component.ts index 4aa799f5e..ad1d50c82 100644 --- a/src/Web/StellaOps.Web/src/app/shared/domain/evidence-link/evidence-link.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/domain/evidence-link/evidence-link.component.ts @@ -29,10 +29,10 @@ export type EvidenceType = 'promotion' | 'deployment' | 'release' | 'audit' | 's } @if (signed) { - ✓ Signed + Signed } @if (verified) { - ✓ Verified + Verified } @if (signed === false) { Unsigned diff --git a/src/Web/StellaOps.Web/src/app/shared/domain/witness-path-preview/witness-path-preview.component.ts b/src/Web/StellaOps.Web/src/app/shared/domain/witness-path-preview/witness-path-preview.component.ts index bc8189d49..fbb3c31ef 100644 --- a/src/Web/StellaOps.Web/src/app/shared/domain/witness-path-preview/witness-path-preview.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/domain/witness-path-preview/witness-path-preview.component.ts @@ -25,7 +25,7 @@ export interface GuardSummary {
    Path: @if (deterministic) { - ✓ Deterministic + Deterministic } @if (hasGuards()) { Guards diff --git a/src/Web/StellaOps.Web/src/app/shared/overlays/evidence-packet-drawer/evidence-packet-drawer.component.ts b/src/Web/StellaOps.Web/src/app/shared/overlays/evidence-packet-drawer/evidence-packet-drawer.component.ts index f407031aa..1423f3712 100644 --- a/src/Web/StellaOps.Web/src/app/shared/overlays/evidence-packet-drawer/evidence-packet-drawer.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/overlays/evidence-packet-drawer/evidence-packet-drawer.component.ts @@ -631,7 +631,7 @@ export interface EvidenceContentItem { } .btn--secondary { - background: white; + background: var(--color-surface-primary); color: var(--color-text-primary); border: 1px solid var(--color-border-primary); } diff --git a/src/Web/StellaOps.Web/src/app/shared/overlays/finding-detail-drawer/finding-detail-drawer.component.ts b/src/Web/StellaOps.Web/src/app/shared/overlays/finding-detail-drawer/finding-detail-drawer.component.ts index 9608461e2..2e70a7657 100644 --- a/src/Web/StellaOps.Web/src/app/shared/overlays/finding-detail-drawer/finding-detail-drawer.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/overlays/finding-detail-drawer/finding-detail-drawer.component.ts @@ -117,7 +117,13 @@ export interface AppliedExceptioni {

    Reachability

    @if (finding.reachable !== null) {
    - {{ finding.reachable ? '⚠' : '✓' }} + + @if (finding.reachable) { + + } @else { + + } +
    {{ finding.reachable ? 'Reachable' : 'Unreachable' }} @if (finding.reachabilityConfidence) { diff --git a/src/Web/StellaOps.Web/src/app/shared/ui/filter-bar/filter-bar.component.ts b/src/Web/StellaOps.Web/src/app/shared/ui/filter-bar/filter-bar.component.ts index ae80952d8..9e371be6e 100644 --- a/src/Web/StellaOps.Web/src/app/shared/ui/filter-bar/filter-bar.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/ui/filter-bar/filter-bar.component.ts @@ -67,7 +67,7 @@ export interface ActiveFilter { class="filter-bar__chip-remove" (click)="removeFilter(active)" [attr.aria-label]="'Remove filter ' + active.label" - >× + > } diff --git a/src/Web/StellaOps.Web/src/app/shared/ui/witness-viewer/witness-viewer.component.ts b/src/Web/StellaOps.Web/src/app/shared/ui/witness-viewer/witness-viewer.component.ts index 7a258e7da..0b3bfd7b4 100644 --- a/src/Web/StellaOps.Web/src/app/shared/ui/witness-viewer/witness-viewer.component.ts +++ b/src/Web/StellaOps.Web/src/app/shared/ui/witness-viewer/witness-viewer.component.ts @@ -68,7 +68,11 @@ interface WitnessEvidence { class="btn btn--secondary" (click)="copyEvidence()" > - {{ copied() ? '✓ Copied' : 'Copy Raw' }} + @if (copied()) { + Copied + } @else { + Copy Raw + }