feat: Implement policy attestation features and service account delegation
- Added new policy scopes: `policy:publish` and `policy:promote` with interactive-only enforcement. - Introduced metadata parameters for policy actions: `policy_reason`, `policy_ticket`, and `policy_digest`. - Enhanced token validation to require fresh authentication for policy attestation tokens. - Updated grant handlers to enforce policy scope checks and log audit information. - Implemented service account delegation configuration, including quotas and validation. - Seeded service accounts during application initialization based on configuration. - Updated documentation and tasks to reflect new features and changes.
This commit is contained in:
master
193
src/AdvisoryAI/StellaOps.AdvisoryAI.sln
Normal file
193
src/AdvisoryAI/StellaOps.AdvisoryAI.sln
Normal file
@@ -0,0 +1,193 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 12.00
|
||||
# Visual Studio Version 17
|
||||
VisualStudioVersion = 17.0.31903.59
|
||||
MinimumVisualStudioVersion = 10.0.40219.1
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "StellaOps.AdvisoryAI", "StellaOps.AdvisoryAI\StellaOps.AdvisoryAI.csproj", "{E41E2FDA-3827-4B18-8596-B25BDE882D5F}"
|
||||
EndProject
|
||||
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "__Tests", "__Tests", "{56BCE1BF-7CBA-7CE8-203D-A88051F1D642}"
|
||||
EndProject
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "StellaOps.AdvisoryAI.Tests", "__Tests\StellaOps.AdvisoryAI.Tests\StellaOps.AdvisoryAI.Tests.csproj", "{F6860DE5-0C7C-4848-8356-7555E3C391A3}"
|
||||
EndProject
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "StellaOps.Concelier.Testing", "..\Concelier\__Libraries\StellaOps.Concelier.Testing\StellaOps.Concelier.Testing.csproj", "{B53E4FED-8988-4354-8D1A-D3C618DBFD78}"
|
||||
EndProject
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "StellaOps.Concelier.Connector.Common", "..\Concelier\__Libraries\StellaOps.Concelier.Connector.Common\StellaOps.Concelier.Connector.Common.csproj", "{E98A7C01-1619-41A0-A586-84EF9952F75D}"
|
||||
EndProject
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "StellaOps.Concelier.Storage.Mongo", "..\Concelier\__Libraries\StellaOps.Concelier.Storage.Mongo\StellaOps.Concelier.Storage.Mongo.csproj", "{973DD52D-AD3C-4526-92CB-F35FDD9AEA10}"
|
||||
EndProject
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "StellaOps.Concelier.Core", "..\Concelier\__Libraries\StellaOps.Concelier.Core\StellaOps.Concelier.Core.csproj", "{F7FB8ABD-31D7-4B4D-8B2A-F4D2B696ACAF}"
|
||||
EndProject
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "StellaOps.Concelier.Models", "..\Concelier\__Libraries\StellaOps.Concelier.Models\StellaOps.Concelier.Models.csproj", "{BBB5CD3C-866A-4298-ACE1-598413631CF5}"
|
||||
EndProject
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "StellaOps.Concelier.RawModels", "..\Concelier\__Libraries\StellaOps.Concelier.RawModels\StellaOps.Concelier.RawModels.csproj", "{7E3D9A33-BD0E-424A-88E6-F4440E386A3C}"
|
||||
EndProject
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "StellaOps.Concelier.Normalization", "..\Concelier\__Libraries\StellaOps.Concelier.Normalization\StellaOps.Concelier.Normalization.csproj", "{1313202A-E8A8-41E3-80BC-472096074681}"
|
||||
EndProject
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "StellaOps.Plugin", "..\__Libraries\StellaOps.Plugin\StellaOps.Plugin.csproj", "{1CC5F6F8-DF9A-4BCC-8C69-79E2DF604F6D}"
|
||||
EndProject
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "StellaOps.DependencyInjection", "..\__Libraries\StellaOps.DependencyInjection\StellaOps.DependencyInjection.csproj", "{F567F20C-552F-4761-941A-0552CEF68160}"
|
||||
EndProject
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "StellaOps.Aoc", "..\Aoc\__Libraries\StellaOps.Aoc\StellaOps.Aoc.csproj", "{C8CE71D3-952A-43F7-9346-20113E37F672}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|Any CPU = Debug|Any CPU
|
||||
Debug|x64 = Debug|x64
|
||||
Debug|x86 = Debug|x86
|
||||
Release|Any CPU = Release|Any CPU
|
||||
Release|x64 = Release|x64
|
||||
Release|x86 = Release|x86
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{E41E2FDA-3827-4B18-8596-B25BDE882D5F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{E41E2FDA-3827-4B18-8596-B25BDE882D5F}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{E41E2FDA-3827-4B18-8596-B25BDE882D5F}.Debug|x64.ActiveCfg = Debug|Any CPU
|
||||
{E41E2FDA-3827-4B18-8596-B25BDE882D5F}.Debug|x64.Build.0 = Debug|Any CPU
|
||||
{E41E2FDA-3827-4B18-8596-B25BDE882D5F}.Debug|x86.ActiveCfg = Debug|Any CPU
|
||||
{E41E2FDA-3827-4B18-8596-B25BDE882D5F}.Debug|x86.Build.0 = Debug|Any CPU
|
||||
{E41E2FDA-3827-4B18-8596-B25BDE882D5F}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{E41E2FDA-3827-4B18-8596-B25BDE882D5F}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
{E41E2FDA-3827-4B18-8596-B25BDE882D5F}.Release|x64.ActiveCfg = Release|Any CPU
|
||||
{E41E2FDA-3827-4B18-8596-B25BDE882D5F}.Release|x64.Build.0 = Release|Any CPU
|
||||
{E41E2FDA-3827-4B18-8596-B25BDE882D5F}.Release|x86.ActiveCfg = Release|Any CPU
|
||||
{E41E2FDA-3827-4B18-8596-B25BDE882D5F}.Release|x86.Build.0 = Release|Any CPU
|
||||
{F6860DE5-0C7C-4848-8356-7555E3C391A3}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{F6860DE5-0C7C-4848-8356-7555E3C391A3}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{F6860DE5-0C7C-4848-8356-7555E3C391A3}.Debug|x64.ActiveCfg = Debug|Any CPU
|
||||
{F6860DE5-0C7C-4848-8356-7555E3C391A3}.Debug|x64.Build.0 = Debug|Any CPU
|
||||
{F6860DE5-0C7C-4848-8356-7555E3C391A3}.Debug|x86.ActiveCfg = Debug|Any CPU
|
||||
{F6860DE5-0C7C-4848-8356-7555E3C391A3}.Debug|x86.Build.0 = Debug|Any CPU
|
||||
{F6860DE5-0C7C-4848-8356-7555E3C391A3}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{F6860DE5-0C7C-4848-8356-7555E3C391A3}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
{F6860DE5-0C7C-4848-8356-7555E3C391A3}.Release|x64.ActiveCfg = Release|Any CPU
|
||||
{F6860DE5-0C7C-4848-8356-7555E3C391A3}.Release|x64.Build.0 = Release|Any CPU
|
||||
{F6860DE5-0C7C-4848-8356-7555E3C391A3}.Release|x86.ActiveCfg = Release|Any CPU
|
||||
{F6860DE5-0C7C-4848-8356-7555E3C391A3}.Release|x86.Build.0 = Release|Any CPU
|
||||
{B53E4FED-8988-4354-8D1A-D3C618DBFD78}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{B53E4FED-8988-4354-8D1A-D3C618DBFD78}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{B53E4FED-8988-4354-8D1A-D3C618DBFD78}.Debug|x64.ActiveCfg = Debug|Any CPU
|
||||
{B53E4FED-8988-4354-8D1A-D3C618DBFD78}.Debug|x64.Build.0 = Debug|Any CPU
|
||||
{B53E4FED-8988-4354-8D1A-D3C618DBFD78}.Debug|x86.ActiveCfg = Debug|Any CPU
|
||||
{B53E4FED-8988-4354-8D1A-D3C618DBFD78}.Debug|x86.Build.0 = Debug|Any CPU
|
||||
{B53E4FED-8988-4354-8D1A-D3C618DBFD78}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{B53E4FED-8988-4354-8D1A-D3C618DBFD78}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
{B53E4FED-8988-4354-8D1A-D3C618DBFD78}.Release|x64.ActiveCfg = Release|Any CPU
|
||||
{B53E4FED-8988-4354-8D1A-D3C618DBFD78}.Release|x64.Build.0 = Release|Any CPU
|
||||
{B53E4FED-8988-4354-8D1A-D3C618DBFD78}.Release|x86.ActiveCfg = Release|Any CPU
|
||||
{B53E4FED-8988-4354-8D1A-D3C618DBFD78}.Release|x86.Build.0 = Release|Any CPU
|
||||
{E98A7C01-1619-41A0-A586-84EF9952F75D}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{E98A7C01-1619-41A0-A586-84EF9952F75D}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{E98A7C01-1619-41A0-A586-84EF9952F75D}.Debug|x64.ActiveCfg = Debug|Any CPU
|
||||
{E98A7C01-1619-41A0-A586-84EF9952F75D}.Debug|x64.Build.0 = Debug|Any CPU
|
||||
{E98A7C01-1619-41A0-A586-84EF9952F75D}.Debug|x86.ActiveCfg = Debug|Any CPU
|
||||
{E98A7C01-1619-41A0-A586-84EF9952F75D}.Debug|x86.Build.0 = Debug|Any CPU
|
||||
{E98A7C01-1619-41A0-A586-84EF9952F75D}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{E98A7C01-1619-41A0-A586-84EF9952F75D}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
{E98A7C01-1619-41A0-A586-84EF9952F75D}.Release|x64.ActiveCfg = Release|Any CPU
|
||||
{E98A7C01-1619-41A0-A586-84EF9952F75D}.Release|x64.Build.0 = Release|Any CPU
|
||||
{E98A7C01-1619-41A0-A586-84EF9952F75D}.Release|x86.ActiveCfg = Release|Any CPU
|
||||
{E98A7C01-1619-41A0-A586-84EF9952F75D}.Release|x86.Build.0 = Release|Any CPU
|
||||
{973DD52D-AD3C-4526-92CB-F35FDD9AEA10}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{973DD52D-AD3C-4526-92CB-F35FDD9AEA10}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{973DD52D-AD3C-4526-92CB-F35FDD9AEA10}.Debug|x64.ActiveCfg = Debug|Any CPU
|
||||
{973DD52D-AD3C-4526-92CB-F35FDD9AEA10}.Debug|x64.Build.0 = Debug|Any CPU
|
||||
{973DD52D-AD3C-4526-92CB-F35FDD9AEA10}.Debug|x86.ActiveCfg = Debug|Any CPU
|
||||
{973DD52D-AD3C-4526-92CB-F35FDD9AEA10}.Debug|x86.Build.0 = Debug|Any CPU
|
||||
{973DD52D-AD3C-4526-92CB-F35FDD9AEA10}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{973DD52D-AD3C-4526-92CB-F35FDD9AEA10}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
{973DD52D-AD3C-4526-92CB-F35FDD9AEA10}.Release|x64.ActiveCfg = Release|Any CPU
|
||||
{973DD52D-AD3C-4526-92CB-F35FDD9AEA10}.Release|x64.Build.0 = Release|Any CPU
|
||||
{973DD52D-AD3C-4526-92CB-F35FDD9AEA10}.Release|x86.ActiveCfg = Release|Any CPU
|
||||
{973DD52D-AD3C-4526-92CB-F35FDD9AEA10}.Release|x86.Build.0 = Release|Any CPU
|
||||
{F7FB8ABD-31D7-4B4D-8B2A-F4D2B696ACAF}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{F7FB8ABD-31D7-4B4D-8B2A-F4D2B696ACAF}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{F7FB8ABD-31D7-4B4D-8B2A-F4D2B696ACAF}.Debug|x64.ActiveCfg = Debug|Any CPU
|
||||
{F7FB8ABD-31D7-4B4D-8B2A-F4D2B696ACAF}.Debug|x64.Build.0 = Debug|Any CPU
|
||||
{F7FB8ABD-31D7-4B4D-8B2A-F4D2B696ACAF}.Debug|x86.ActiveCfg = Debug|Any CPU
|
||||
{F7FB8ABD-31D7-4B4D-8B2A-F4D2B696ACAF}.Debug|x86.Build.0 = Debug|Any CPU
|
||||
{F7FB8ABD-31D7-4B4D-8B2A-F4D2B696ACAF}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{F7FB8ABD-31D7-4B4D-8B2A-F4D2B696ACAF}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
{F7FB8ABD-31D7-4B4D-8B2A-F4D2B696ACAF}.Release|x64.ActiveCfg = Release|Any CPU
|
||||
{F7FB8ABD-31D7-4B4D-8B2A-F4D2B696ACAF}.Release|x64.Build.0 = Release|Any CPU
|
||||
{F7FB8ABD-31D7-4B4D-8B2A-F4D2B696ACAF}.Release|x86.ActiveCfg = Release|Any CPU
|
||||
{F7FB8ABD-31D7-4B4D-8B2A-F4D2B696ACAF}.Release|x86.Build.0 = Release|Any CPU
|
||||
{BBB5CD3C-866A-4298-ACE1-598413631CF5}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{BBB5CD3C-866A-4298-ACE1-598413631CF5}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{BBB5CD3C-866A-4298-ACE1-598413631CF5}.Debug|x64.ActiveCfg = Debug|Any CPU
|
||||
{BBB5CD3C-866A-4298-ACE1-598413631CF5}.Debug|x64.Build.0 = Debug|Any CPU
|
||||
{BBB5CD3C-866A-4298-ACE1-598413631CF5}.Debug|x86.ActiveCfg = Debug|Any CPU
|
||||
{BBB5CD3C-866A-4298-ACE1-598413631CF5}.Debug|x86.Build.0 = Debug|Any CPU
|
||||
{BBB5CD3C-866A-4298-ACE1-598413631CF5}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{BBB5CD3C-866A-4298-ACE1-598413631CF5}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
{BBB5CD3C-866A-4298-ACE1-598413631CF5}.Release|x64.ActiveCfg = Release|Any CPU
|
||||
{BBB5CD3C-866A-4298-ACE1-598413631CF5}.Release|x64.Build.0 = Release|Any CPU
|
||||
{BBB5CD3C-866A-4298-ACE1-598413631CF5}.Release|x86.ActiveCfg = Release|Any CPU
|
||||
{BBB5CD3C-866A-4298-ACE1-598413631CF5}.Release|x86.Build.0 = Release|Any CPU
|
||||
{7E3D9A33-BD0E-424A-88E6-F4440E386A3C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{7E3D9A33-BD0E-424A-88E6-F4440E386A3C}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{7E3D9A33-BD0E-424A-88E6-F4440E386A3C}.Debug|x64.ActiveCfg = Debug|Any CPU
|
||||
{7E3D9A33-BD0E-424A-88E6-F4440E386A3C}.Debug|x64.Build.0 = Debug|Any CPU
|
||||
{7E3D9A33-BD0E-424A-88E6-F4440E386A3C}.Debug|x86.ActiveCfg = Debug|Any CPU
|
||||
{7E3D9A33-BD0E-424A-88E6-F4440E386A3C}.Debug|x86.Build.0 = Debug|Any CPU
|
||||
{7E3D9A33-BD0E-424A-88E6-F4440E386A3C}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{7E3D9A33-BD0E-424A-88E6-F4440E386A3C}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
{7E3D9A33-BD0E-424A-88E6-F4440E386A3C}.Release|x64.ActiveCfg = Release|Any CPU
|
||||
{7E3D9A33-BD0E-424A-88E6-F4440E386A3C}.Release|x64.Build.0 = Release|Any CPU
|
||||
{7E3D9A33-BD0E-424A-88E6-F4440E386A3C}.Release|x86.ActiveCfg = Release|Any CPU
|
||||
{7E3D9A33-BD0E-424A-88E6-F4440E386A3C}.Release|x86.Build.0 = Release|Any CPU
|
||||
{1313202A-E8A8-41E3-80BC-472096074681}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{1313202A-E8A8-41E3-80BC-472096074681}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{1313202A-E8A8-41E3-80BC-472096074681}.Debug|x64.ActiveCfg = Debug|Any CPU
|
||||
{1313202A-E8A8-41E3-80BC-472096074681}.Debug|x64.Build.0 = Debug|Any CPU
|
||||
{1313202A-E8A8-41E3-80BC-472096074681}.Debug|x86.ActiveCfg = Debug|Any CPU
|
||||
{1313202A-E8A8-41E3-80BC-472096074681}.Debug|x86.Build.0 = Debug|Any CPU
|
||||
{1313202A-E8A8-41E3-80BC-472096074681}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{1313202A-E8A8-41E3-80BC-472096074681}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
{1313202A-E8A8-41E3-80BC-472096074681}.Release|x64.ActiveCfg = Release|Any CPU
|
||||
{1313202A-E8A8-41E3-80BC-472096074681}.Release|x64.Build.0 = Release|Any CPU
|
||||
{1313202A-E8A8-41E3-80BC-472096074681}.Release|x86.ActiveCfg = Release|Any CPU
|
||||
{1313202A-E8A8-41E3-80BC-472096074681}.Release|x86.Build.0 = Release|Any CPU
|
||||
{1CC5F6F8-DF9A-4BCC-8C69-79E2DF604F6D}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{1CC5F6F8-DF9A-4BCC-8C69-79E2DF604F6D}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{1CC5F6F8-DF9A-4BCC-8C69-79E2DF604F6D}.Debug|x64.ActiveCfg = Debug|Any CPU
|
||||
{1CC5F6F8-DF9A-4BCC-8C69-79E2DF604F6D}.Debug|x64.Build.0 = Debug|Any CPU
|
||||
{1CC5F6F8-DF9A-4BCC-8C69-79E2DF604F6D}.Debug|x86.ActiveCfg = Debug|Any CPU
|
||||
{1CC5F6F8-DF9A-4BCC-8C69-79E2DF604F6D}.Debug|x86.Build.0 = Debug|Any CPU
|
||||
{1CC5F6F8-DF9A-4BCC-8C69-79E2DF604F6D}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{1CC5F6F8-DF9A-4BCC-8C69-79E2DF604F6D}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
{1CC5F6F8-DF9A-4BCC-8C69-79E2DF604F6D}.Release|x64.ActiveCfg = Release|Any CPU
|
||||
{1CC5F6F8-DF9A-4BCC-8C69-79E2DF604F6D}.Release|x64.Build.0 = Release|Any CPU
|
||||
{1CC5F6F8-DF9A-4BCC-8C69-79E2DF604F6D}.Release|x86.ActiveCfg = Release|Any CPU
|
||||
{1CC5F6F8-DF9A-4BCC-8C69-79E2DF604F6D}.Release|x86.Build.0 = Release|Any CPU
|
||||
{F567F20C-552F-4761-941A-0552CEF68160}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{F567F20C-552F-4761-941A-0552CEF68160}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{F567F20C-552F-4761-941A-0552CEF68160}.Debug|x64.ActiveCfg = Debug|Any CPU
|
||||
{F567F20C-552F-4761-941A-0552CEF68160}.Debug|x64.Build.0 = Debug|Any CPU
|
||||
{F567F20C-552F-4761-941A-0552CEF68160}.Debug|x86.ActiveCfg = Debug|Any CPU
|
||||
{F567F20C-552F-4761-941A-0552CEF68160}.Debug|x86.Build.0 = Debug|Any CPU
|
||||
{F567F20C-552F-4761-941A-0552CEF68160}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{F567F20C-552F-4761-941A-0552CEF68160}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
{F567F20C-552F-4761-941A-0552CEF68160}.Release|x64.ActiveCfg = Release|Any CPU
|
||||
{F567F20C-552F-4761-941A-0552CEF68160}.Release|x64.Build.0 = Release|Any CPU
|
||||
{F567F20C-552F-4761-941A-0552CEF68160}.Release|x86.ActiveCfg = Release|Any CPU
|
||||
{F567F20C-552F-4761-941A-0552CEF68160}.Release|x86.Build.0 = Release|Any CPU
|
||||
{C8CE71D3-952A-43F7-9346-20113E37F672}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{C8CE71D3-952A-43F7-9346-20113E37F672}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{C8CE71D3-952A-43F7-9346-20113E37F672}.Debug|x64.ActiveCfg = Debug|Any CPU
|
||||
{C8CE71D3-952A-43F7-9346-20113E37F672}.Debug|x64.Build.0 = Debug|Any CPU
|
||||
{C8CE71D3-952A-43F7-9346-20113E37F672}.Debug|x86.ActiveCfg = Debug|Any CPU
|
||||
{C8CE71D3-952A-43F7-9346-20113E37F672}.Debug|x86.Build.0 = Debug|Any CPU
|
||||
{C8CE71D3-952A-43F7-9346-20113E37F672}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{C8CE71D3-952A-43F7-9346-20113E37F672}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
{C8CE71D3-952A-43F7-9346-20113E37F672}.Release|x64.ActiveCfg = Release|Any CPU
|
||||
{C8CE71D3-952A-43F7-9346-20113E37F672}.Release|x64.Build.0 = Release|Any CPU
|
||||
{C8CE71D3-952A-43F7-9346-20113E37F672}.Release|x86.ActiveCfg = Release|Any CPU
|
||||
{C8CE71D3-952A-43F7-9346-20113E37F672}.Release|x86.Build.0 = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
GlobalSection(NestedProjects) = preSolution
|
||||
{F6860DE5-0C7C-4848-8356-7555E3C391A3} = {56BCE1BF-7CBA-7CE8-203D-A88051F1D642}
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
@@ -0,0 +1,10 @@
|
||||
using System.Threading;
|
||||
using System.Threading.Tasks;
|
||||
using StellaOps.AdvisoryAI.Context;
|
||||
|
||||
namespace StellaOps.AdvisoryAI.Abstractions;
|
||||
|
||||
public interface ISbomContextRetriever
|
||||
{
|
||||
Task<SbomContextResult> RetrieveAsync(SbomContextRequest request, CancellationToken cancellationToken);
|
||||
}
|
||||
@@ -0,0 +1,82 @@
|
||||
using System;
|
||||
|
||||
namespace StellaOps.AdvisoryAI.Abstractions;
|
||||
|
||||
/// <summary>
|
||||
/// Defines the inputs required to build SBOM-derived context for Advisory AI prompts.
|
||||
/// </summary>
|
||||
public sealed class SbomContextRequest
|
||||
{
|
||||
/// <summary>
|
||||
/// Maximum number of version timeline entries we will ever request from the SBOM service.
|
||||
/// </summary>
|
||||
public const int TimelineLimitCeiling = 500;
|
||||
|
||||
/// <summary>
|
||||
/// Maximum number of dependency paths we will ever request from the SBOM service.
|
||||
/// </summary>
|
||||
public const int DependencyPathLimitCeiling = 200;
|
||||
|
||||
public SbomContextRequest(
|
||||
string artifactId,
|
||||
string? purl = null,
|
||||
int maxTimelineEntries = 50,
|
||||
int maxDependencyPaths = 25,
|
||||
bool includeEnvironmentFlags = true,
|
||||
bool includeBlastRadius = true)
|
||||
{
|
||||
ArgumentException.ThrowIfNullOrWhiteSpace(artifactId);
|
||||
|
||||
ArtifactId = artifactId.Trim();
|
||||
Purl = string.IsNullOrWhiteSpace(purl) ? null : purl.Trim();
|
||||
MaxTimelineEntries = NormalizeLimit(maxTimelineEntries, TimelineLimitCeiling);
|
||||
MaxDependencyPaths = NormalizeLimit(maxDependencyPaths, DependencyPathLimitCeiling);
|
||||
IncludeEnvironmentFlags = includeEnvironmentFlags;
|
||||
IncludeBlastRadius = includeBlastRadius;
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// The advisory artifact identifier (e.g. internal scan ID).
|
||||
/// </summary>
|
||||
public string ArtifactId { get; }
|
||||
|
||||
/// <summary>
|
||||
/// Optional package URL used to scope SBOM data.
|
||||
/// </summary>
|
||||
public string? Purl { get; }
|
||||
|
||||
/// <summary>
|
||||
/// Maximum number of timeline entries that should be returned. Set to 0 to disable.
|
||||
/// </summary>
|
||||
public int MaxTimelineEntries { get; }
|
||||
|
||||
/// <summary>
|
||||
/// Maximum number of dependency paths that should be returned. Set to 0 to disable.
|
||||
/// </summary>
|
||||
public int MaxDependencyPaths { get; }
|
||||
|
||||
/// <summary>
|
||||
/// Whether environment feature flags (prod/staging/etc.) should be returned.
|
||||
/// </summary>
|
||||
public bool IncludeEnvironmentFlags { get; }
|
||||
|
||||
/// <summary>
|
||||
/// Whether blast radius summaries should be returned.
|
||||
/// </summary>
|
||||
public bool IncludeBlastRadius { get; }
|
||||
|
||||
private static int NormalizeLimit(int requested, int ceiling)
|
||||
{
|
||||
if (requested <= 0)
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (requested > ceiling)
|
||||
{
|
||||
return ceiling;
|
||||
}
|
||||
|
||||
return requested;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,278 @@
|
||||
using System.Collections.Immutable;
|
||||
using System.Text.Json;
|
||||
using StellaOps.AdvisoryAI.Documents;
|
||||
|
||||
namespace StellaOps.AdvisoryAI.Chunking;
|
||||
|
||||
internal sealed class CsafDocumentChunker : IDocumentChunker
|
||||
{
|
||||
private static readonly ImmutableHashSet<string> SupportedNoteCategories =
|
||||
ImmutableHashSet.Create(StringComparer.OrdinalIgnoreCase, "summary", "description", "remediation");
|
||||
|
||||
public bool CanHandle(DocumentFormat format) => format == DocumentFormat.Csaf;
|
||||
|
||||
public IEnumerable<AdvisoryChunk> Chunk(AdvisoryDocument document)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(document);
|
||||
|
||||
using var jsonDocument = JsonDocument.Parse(document.Content);
|
||||
var root = jsonDocument.RootElement;
|
||||
|
||||
var chunkIndex = 0;
|
||||
var sectionStack = new Stack<string>();
|
||||
sectionStack.Push("document");
|
||||
|
||||
string NextChunkId() => $"{document.DocumentId}:{++chunkIndex:D4}";
|
||||
|
||||
foreach (var chunk in ExtractDocumentNotes(document, root, NextChunkId))
|
||||
{
|
||||
yield return chunk;
|
||||
}
|
||||
|
||||
foreach (var chunk in ExtractVulnerabilities(document, root, NextChunkId))
|
||||
{
|
||||
yield return chunk;
|
||||
}
|
||||
}
|
||||
|
||||
private static IEnumerable<AdvisoryChunk> ExtractDocumentNotes(
|
||||
AdvisoryDocument document,
|
||||
JsonElement root,
|
||||
Func<string> chunkIdFactory)
|
||||
{
|
||||
if (!root.TryGetProperty("document", out var documentNode))
|
||||
{
|
||||
yield break;
|
||||
}
|
||||
|
||||
if (!documentNode.TryGetProperty("notes", out var notesNode) || notesNode.ValueKind != JsonValueKind.Array)
|
||||
{
|
||||
yield break;
|
||||
}
|
||||
|
||||
var index = 0;
|
||||
foreach (var note in notesNode.EnumerateArray())
|
||||
{
|
||||
index++;
|
||||
if (note.ValueKind != JsonValueKind.Object)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
var text = note.GetPropertyOrDefault("text");
|
||||
if (string.IsNullOrWhiteSpace(text))
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
var category = note.GetPropertyOrDefault("category");
|
||||
if (category.Length > 0 && !SupportedNoteCategories.Contains(category))
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
var metadata = new Dictionary<string, string>(StringComparer.Ordinal)
|
||||
{
|
||||
["format"] = "csaf",
|
||||
["section"] = "document.notes",
|
||||
["index"] = index.ToString(),
|
||||
};
|
||||
|
||||
if (category.Length > 0)
|
||||
{
|
||||
metadata["category"] = category;
|
||||
}
|
||||
|
||||
yield return AdvisoryChunk.Create(
|
||||
document.DocumentId,
|
||||
chunkIdFactory(),
|
||||
section: "document.notes",
|
||||
paragraphId: $"document.notes[{index}]",
|
||||
text: text.Trim(),
|
||||
metadata: metadata);
|
||||
}
|
||||
}
|
||||
|
||||
private static IEnumerable<AdvisoryChunk> ExtractVulnerabilities(
|
||||
AdvisoryDocument document,
|
||||
JsonElement root,
|
||||
Func<string> chunkIdFactory)
|
||||
{
|
||||
if (!root.TryGetProperty("vulnerabilities", out var vulnerabilitiesNode) ||
|
||||
vulnerabilitiesNode.ValueKind != JsonValueKind.Array)
|
||||
{
|
||||
yield break;
|
||||
}
|
||||
|
||||
var vulnIndex = 0;
|
||||
foreach (var vulnerability in vulnerabilitiesNode.EnumerateArray())
|
||||
{
|
||||
vulnIndex++;
|
||||
if (vulnerability.ValueKind != JsonValueKind.Object)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
var vulnerabilityId = vulnerability.GetPropertyOrDefault("id", fallback: vulnIndex.ToString());
|
||||
|
||||
foreach (var chunk in ExtractVulnerabilityTitle(document, vulnerability, vulnerabilityId, chunkIdFactory))
|
||||
{
|
||||
yield return chunk;
|
||||
}
|
||||
|
||||
foreach (var chunk in ExtractVulnerabilityNotes(document, vulnerability, vulnerabilityId, chunkIdFactory))
|
||||
{
|
||||
yield return chunk;
|
||||
}
|
||||
|
||||
foreach (var chunk in ExtractRemediations(document, vulnerability, vulnerabilityId, chunkIdFactory))
|
||||
{
|
||||
yield return chunk;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
private static IEnumerable<AdvisoryChunk> ExtractVulnerabilityTitle(
|
||||
AdvisoryDocument document,
|
||||
JsonElement vulnerability,
|
||||
string vulnerabilityId,
|
||||
Func<string> chunkIdFactory)
|
||||
{
|
||||
var title = vulnerability.GetPropertyOrDefault("title");
|
||||
var description = vulnerability.GetPropertyOrDefault("description");
|
||||
|
||||
if (!string.IsNullOrWhiteSpace(title))
|
||||
{
|
||||
yield return CreateChunk(document, chunkIdFactory(), "vulnerabilities.title", vulnerabilityId, title!);
|
||||
}
|
||||
|
||||
if (!string.IsNullOrWhiteSpace(description))
|
||||
{
|
||||
yield return CreateChunk(document, chunkIdFactory(), "vulnerabilities.description", vulnerabilityId, description!);
|
||||
}
|
||||
}
|
||||
|
||||
private static IEnumerable<AdvisoryChunk> ExtractVulnerabilityNotes(
|
||||
AdvisoryDocument document,
|
||||
JsonElement vulnerability,
|
||||
string vulnerabilityId,
|
||||
Func<string> chunkIdFactory)
|
||||
{
|
||||
if (!vulnerability.TryGetProperty("notes", out var notes) || notes.ValueKind != JsonValueKind.Array)
|
||||
{
|
||||
yield break;
|
||||
}
|
||||
|
||||
var noteIndex = 0;
|
||||
foreach (var note in notes.EnumerateArray())
|
||||
{
|
||||
noteIndex++;
|
||||
if (note.ValueKind != JsonValueKind.Object)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
var text = note.GetPropertyOrDefault("text");
|
||||
if (string.IsNullOrWhiteSpace(text))
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
yield return CreateChunk(
|
||||
document,
|
||||
chunkIdFactory(),
|
||||
"vulnerabilities.notes",
|
||||
vulnerabilityId,
|
||||
text!,
|
||||
additionalMetadata: new Dictionary<string, string>
|
||||
{
|
||||
["noteIndex"] = noteIndex.ToString(),
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
private static IEnumerable<AdvisoryChunk> ExtractRemediations(
|
||||
AdvisoryDocument document,
|
||||
JsonElement vulnerability,
|
||||
string vulnerabilityId,
|
||||
Func<string> chunkIdFactory)
|
||||
{
|
||||
if (!vulnerability.TryGetProperty("remediations", out var remediations) || remediations.ValueKind != JsonValueKind.Array)
|
||||
{
|
||||
yield break;
|
||||
}
|
||||
|
||||
var remediationIndex = 0;
|
||||
foreach (var remediation in remediations.EnumerateArray())
|
||||
{
|
||||
remediationIndex++;
|
||||
if (remediation.ValueKind != JsonValueKind.Object)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
var details = remediation.GetPropertyOrDefault("details");
|
||||
if (string.IsNullOrWhiteSpace(details))
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
var metadata = new Dictionary<string, string>(StringComparer.Ordinal)
|
||||
{
|
||||
["remediationIndex"] = remediationIndex.ToString(),
|
||||
};
|
||||
|
||||
var type = remediation.GetPropertyOrDefault("category");
|
||||
if (!string.IsNullOrWhiteSpace(type))
|
||||
{
|
||||
metadata["category"] = type!;
|
||||
}
|
||||
|
||||
var productIds = remediation.GetPropertyOrDefault("product_ids");
|
||||
if (!string.IsNullOrWhiteSpace(productIds))
|
||||
{
|
||||
metadata["product_ids"] = productIds!;
|
||||
}
|
||||
|
||||
yield return CreateChunk(
|
||||
document,
|
||||
chunkIdFactory(),
|
||||
"vulnerabilities.remediations",
|
||||
vulnerabilityId,
|
||||
details!,
|
||||
metadata);
|
||||
}
|
||||
}
|
||||
|
||||
private static AdvisoryChunk CreateChunk(
|
||||
AdvisoryDocument document,
|
||||
string chunkId,
|
||||
string section,
|
||||
string paragraph,
|
||||
string text,
|
||||
IReadOnlyDictionary<string, string>? additionalMetadata = null)
|
||||
{
|
||||
var metadata = new Dictionary<string, string>(StringComparer.Ordinal)
|
||||
{
|
||||
["format"] = "csaf",
|
||||
["section"] = section,
|
||||
["paragraph"] = paragraph,
|
||||
};
|
||||
|
||||
if (additionalMetadata is not null)
|
||||
{
|
||||
foreach (var pair in additionalMetadata)
|
||||
{
|
||||
metadata[pair.Key] = pair.Value;
|
||||
}
|
||||
}
|
||||
|
||||
return AdvisoryChunk.Create(
|
||||
document.DocumentId,
|
||||
chunkId,
|
||||
section,
|
||||
paragraph,
|
||||
text.Trim(),
|
||||
metadata);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,41 @@
|
||||
using System.Linq;
|
||||
using System.Text.Json;
|
||||
|
||||
namespace StellaOps.AdvisoryAI.Chunking;
|
||||
|
||||
internal static class JsonElementExtensions
|
||||
{
|
||||
public static string GetPropertyOrDefault(this JsonElement element, string propertyName, string? fallback = "")
|
||||
{
|
||||
if (element.ValueKind != JsonValueKind.Object)
|
||||
{
|
||||
return fallback ?? string.Empty;
|
||||
}
|
||||
|
||||
if (element.TryGetProperty(propertyName, out var property))
|
||||
{
|
||||
return property.ValueKind switch
|
||||
{
|
||||
JsonValueKind.String => property.GetString() ?? string.Empty,
|
||||
JsonValueKind.Array => string.Join(",", property.EnumerateArray().Select(ToStringValue).Where(static v => !string.IsNullOrWhiteSpace(v))),
|
||||
JsonValueKind.Object => property.ToString(),
|
||||
JsonValueKind.Number => property.ToString(),
|
||||
JsonValueKind.True => "true",
|
||||
JsonValueKind.False => "false",
|
||||
_ => string.Empty,
|
||||
};
|
||||
}
|
||||
|
||||
return fallback ?? string.Empty;
|
||||
}
|
||||
|
||||
private static string? ToStringValue(JsonElement element)
|
||||
=> element.ValueKind switch
|
||||
{
|
||||
JsonValueKind.String => element.GetString(),
|
||||
JsonValueKind.Number => element.ToString(),
|
||||
JsonValueKind.True => "true",
|
||||
JsonValueKind.False => "false",
|
||||
_ => null,
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,86 @@
|
||||
using System.Text.RegularExpressions;
|
||||
using StellaOps.AdvisoryAI.Documents;
|
||||
|
||||
namespace StellaOps.AdvisoryAI.Chunking;
|
||||
|
||||
internal sealed class MarkdownDocumentChunker : IDocumentChunker
|
||||
{
|
||||
private static readonly Regex HeadingRegex = new("^(#+)\\s+(?<title>.+)$", RegexOptions.Compiled | RegexOptions.CultureInvariant);
|
||||
|
||||
public bool CanHandle(DocumentFormat format) => format == DocumentFormat.Markdown;
|
||||
|
||||
public IEnumerable<AdvisoryChunk> Chunk(AdvisoryDocument document)
|
||||
{
|
||||
var lines = document.Content.Replace("\r\n", "\n", StringComparison.Ordinal).Split('\n');
|
||||
var section = "body";
|
||||
var paragraphId = 0;
|
||||
var chunkIndex = 0;
|
||||
var buffer = new List<string>();
|
||||
|
||||
IEnumerable<AdvisoryChunk> FlushBuffer()
|
||||
{
|
||||
if (buffer.Count == 0)
|
||||
{
|
||||
yield break;
|
||||
}
|
||||
|
||||
var text = string.Join("\n", buffer).Trim();
|
||||
buffer.Clear();
|
||||
if (string.IsNullOrWhiteSpace(text))
|
||||
{
|
||||
yield break;
|
||||
}
|
||||
|
||||
paragraphId++;
|
||||
var metadata = new Dictionary<string, string>(StringComparer.Ordinal)
|
||||
{
|
||||
["format"] = "markdown",
|
||||
["section"] = section,
|
||||
["paragraph"] = paragraphId.ToString(),
|
||||
};
|
||||
|
||||
yield return AdvisoryChunk.Create(
|
||||
document.DocumentId,
|
||||
chunkId: $"{document.DocumentId}:{++chunkIndex:D4}",
|
||||
section,
|
||||
paragraphId: $"{section}#{paragraphId}",
|
||||
text,
|
||||
metadata);
|
||||
}
|
||||
|
||||
foreach (var rawLine in lines)
|
||||
{
|
||||
var line = rawLine.TrimEnd();
|
||||
if (line.Length == 0)
|
||||
{
|
||||
foreach (var chunk in FlushBuffer())
|
||||
{
|
||||
yield return chunk;
|
||||
}
|
||||
continue;
|
||||
}
|
||||
|
||||
var headingMatch = HeadingRegex.Match(line);
|
||||
if (headingMatch.Success)
|
||||
{
|
||||
foreach (var chunk in FlushBuffer())
|
||||
{
|
||||
yield return chunk;
|
||||
}
|
||||
|
||||
var level = headingMatch.Groups[1].Value.Length;
|
||||
var title = headingMatch.Groups["title"].Value.Trim();
|
||||
section = level == 1 ? title : $"{section}/{title}";
|
||||
paragraphId = 0;
|
||||
continue;
|
||||
}
|
||||
|
||||
buffer.Add(line);
|
||||
}
|
||||
|
||||
foreach (var chunk in FlushBuffer())
|
||||
{
|
||||
yield return chunk;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,199 @@
|
||||
|
||||
using System.Text;
|
||||
using System.Text.Json;
|
||||
using StellaOps.AdvisoryAI.Documents;
|
||||
|
||||
namespace StellaOps.AdvisoryAI.Chunking;
|
||||
|
||||
internal sealed class OpenVexDocumentChunker : IDocumentChunker
|
||||
{
|
||||
public bool CanHandle(DocumentFormat format) => format == DocumentFormat.OpenVex;
|
||||
|
||||
public IEnumerable<AdvisoryChunk> Chunk(AdvisoryDocument document)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(document);
|
||||
|
||||
using var jsonDocument = JsonDocument.Parse(document.Content);
|
||||
var root = jsonDocument.RootElement;
|
||||
|
||||
if (!root.TryGetProperty("statements", out var statements) || statements.ValueKind != JsonValueKind.Array)
|
||||
{
|
||||
yield break;
|
||||
}
|
||||
|
||||
var index = 0;
|
||||
foreach (var statement in statements.EnumerateArray())
|
||||
{
|
||||
index++;
|
||||
if (statement.ValueKind != JsonValueKind.Object)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
var vulnerabilityId = statement.GetPropertyOrDefault("vulnerability", fallback: string.Empty);
|
||||
var status = statement.GetPropertyOrDefault("status", fallback: string.Empty);
|
||||
var justification = statement.GetPropertyOrDefault("justification", fallback: string.Empty);
|
||||
var impact = statement.GetPropertyOrDefault("impact_statement", fallback: string.Empty);
|
||||
var notes = statement.GetPropertyOrDefault("status_notes", fallback: string.Empty);
|
||||
var timestamp = statement.GetPropertyOrDefault("timestamp", fallback: string.Empty);
|
||||
var lastUpdated = statement.GetPropertyOrDefault("last_updated", fallback: string.Empty);
|
||||
|
||||
var products = ExtractProducts(statement);
|
||||
var section = "vex.statements";
|
||||
var paragraphId = $"statements[{index}]";
|
||||
var chunkId = $"{document.DocumentId}:{index:D4}";
|
||||
|
||||
var text = BuildStatementSummary(vulnerabilityId, status, justification, impact, notes, products);
|
||||
|
||||
var metadata = new Dictionary<string, string>(StringComparer.Ordinal)
|
||||
{
|
||||
["format"] = "openvex",
|
||||
["section"] = section,
|
||||
};
|
||||
|
||||
if (!string.IsNullOrWhiteSpace(vulnerabilityId))
|
||||
{
|
||||
metadata["vulnerability"] = vulnerabilityId;
|
||||
}
|
||||
|
||||
if (!string.IsNullOrWhiteSpace(status))
|
||||
{
|
||||
metadata["status"] = status;
|
||||
}
|
||||
|
||||
if (!string.IsNullOrWhiteSpace(justification))
|
||||
{
|
||||
metadata["justification"] = justification;
|
||||
}
|
||||
|
||||
if (!string.IsNullOrWhiteSpace(impact))
|
||||
{
|
||||
metadata["impact_statement"] = impact;
|
||||
}
|
||||
|
||||
if (!string.IsNullOrWhiteSpace(notes))
|
||||
{
|
||||
metadata["status_notes"] = notes;
|
||||
}
|
||||
|
||||
if (products.Count > 0)
|
||||
{
|
||||
metadata["products"] = string.Join(",", products);
|
||||
}
|
||||
|
||||
if (!string.IsNullOrWhiteSpace(timestamp))
|
||||
{
|
||||
metadata["timestamp"] = timestamp;
|
||||
}
|
||||
|
||||
if (!string.IsNullOrWhiteSpace(lastUpdated))
|
||||
{
|
||||
metadata["last_updated"] = lastUpdated;
|
||||
}
|
||||
|
||||
yield return AdvisoryChunk.Create(
|
||||
document.DocumentId,
|
||||
chunkId,
|
||||
section,
|
||||
paragraphId,
|
||||
text,
|
||||
metadata);
|
||||
}
|
||||
}
|
||||
|
||||
private static List<string> ExtractProducts(JsonElement statement)
|
||||
{
|
||||
if (!statement.TryGetProperty("products", out var productsElement) ||
|
||||
productsElement.ValueKind != JsonValueKind.Array)
|
||||
{
|
||||
return new List<string>();
|
||||
}
|
||||
|
||||
var results = new List<string>();
|
||||
foreach (var product in productsElement.EnumerateArray())
|
||||
{
|
||||
switch (product.ValueKind)
|
||||
{
|
||||
case JsonValueKind.String:
|
||||
var value = product.GetString();
|
||||
if (!string.IsNullOrWhiteSpace(value))
|
||||
{
|
||||
results.Add(value.Trim());
|
||||
}
|
||||
break;
|
||||
case JsonValueKind.Object:
|
||||
var productId = product.GetPropertyOrDefault("product_id", fallback: string.Empty);
|
||||
if (!string.IsNullOrWhiteSpace(productId))
|
||||
{
|
||||
results.Add(productId);
|
||||
break;
|
||||
}
|
||||
|
||||
var name = product.GetPropertyOrDefault("name", fallback: string.Empty);
|
||||
if (!string.IsNullOrWhiteSpace(name))
|
||||
{
|
||||
results.Add(name);
|
||||
}
|
||||
|
||||
break;
|
||||
default:
|
||||
continue;
|
||||
}
|
||||
}
|
||||
|
||||
return results;
|
||||
}
|
||||
|
||||
private static string BuildStatementSummary(
|
||||
string vulnerabilityId,
|
||||
string status,
|
||||
string justification,
|
||||
string impact,
|
||||
string notes,
|
||||
IReadOnlyList<string> products)
|
||||
{
|
||||
var builder = new StringBuilder();
|
||||
|
||||
if (!string.IsNullOrWhiteSpace(vulnerabilityId))
|
||||
{
|
||||
builder.Append(vulnerabilityId.Trim());
|
||||
}
|
||||
else
|
||||
{
|
||||
builder.Append("Unknown vulnerability");
|
||||
}
|
||||
|
||||
if (products.Count > 0)
|
||||
{
|
||||
builder.Append(" affects ");
|
||||
builder.Append(string.Join(", ", products));
|
||||
}
|
||||
|
||||
if (!string.IsNullOrWhiteSpace(status))
|
||||
{
|
||||
builder.Append(" → status: ");
|
||||
builder.Append(status.Trim());
|
||||
}
|
||||
|
||||
if (!string.IsNullOrWhiteSpace(justification))
|
||||
{
|
||||
builder.Append(" (justification: ");
|
||||
builder.Append(justification.Trim());
|
||||
builder.Append(')');
|
||||
}
|
||||
|
||||
if (!string.IsNullOrWhiteSpace(impact))
|
||||
{
|
||||
builder.Append(". Impact: ");
|
||||
builder.Append(impact.Trim());
|
||||
}
|
||||
|
||||
if (!string.IsNullOrWhiteSpace(notes))
|
||||
{
|
||||
builder.Append(". Notes: ");
|
||||
builder.Append(notes.Trim());
|
||||
}
|
||||
|
||||
return builder.ToString();
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,138 @@
|
||||
using System.Text.Json;
|
||||
using StellaOps.AdvisoryAI.Documents;
|
||||
|
||||
namespace StellaOps.AdvisoryAI.Chunking;
|
||||
|
||||
internal sealed class OsvDocumentChunker : IDocumentChunker
|
||||
{
|
||||
public bool CanHandle(DocumentFormat format) => format == DocumentFormat.Osv;
|
||||
|
||||
public IEnumerable<AdvisoryChunk> Chunk(AdvisoryDocument document)
|
||||
{
|
||||
using var jsonDocument = JsonDocument.Parse(document.Content);
|
||||
var root = jsonDocument.RootElement;
|
||||
|
||||
var chunkIndex = 0;
|
||||
string NextChunkId() => $"{document.DocumentId}:{++chunkIndex:D4}";
|
||||
|
||||
string summary = root.GetPropertyOrDefault("summary");
|
||||
if (!string.IsNullOrWhiteSpace(summary))
|
||||
{
|
||||
yield return CreateChunk(document, NextChunkId(), "summary", "summary", summary!);
|
||||
}
|
||||
|
||||
string details = root.GetPropertyOrDefault("details");
|
||||
if (!string.IsNullOrWhiteSpace(details))
|
||||
{
|
||||
yield return CreateChunk(document, NextChunkId(), "details", "details", details!);
|
||||
}
|
||||
|
||||
if (root.TryGetProperty("affected", out var affectedNode) && affectedNode.ValueKind == JsonValueKind.Array)
|
||||
{
|
||||
var affectedIndex = 0;
|
||||
foreach (var affected in affectedNode.EnumerateArray())
|
||||
{
|
||||
affectedIndex++;
|
||||
if (affected.ValueKind != JsonValueKind.Object)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
var packageName = string.Empty;
|
||||
var ecosystem = string.Empty;
|
||||
if (affected.TryGetProperty("package", out var package))
|
||||
{
|
||||
packageName = package.GetPropertyOrDefault("name", string.Empty);
|
||||
ecosystem = package.GetPropertyOrDefault("ecosystem", string.Empty);
|
||||
}
|
||||
var metadata = new Dictionary<string, string>(StringComparer.Ordinal)
|
||||
{
|
||||
["package"] = packageName,
|
||||
["ecosystem"] = ecosystem,
|
||||
};
|
||||
|
||||
if (affected.TryGetProperty("ranges", out var ranges) && ranges.ValueKind == JsonValueKind.Array)
|
||||
{
|
||||
var rangeIndex = 0;
|
||||
foreach (var range in ranges.EnumerateArray())
|
||||
{
|
||||
rangeIndex++;
|
||||
var events = range.GetPropertyOrDefault("events");
|
||||
if (string.IsNullOrWhiteSpace(events))
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
var rangeMetadata = new Dictionary<string, string>(metadata)
|
||||
{
|
||||
["range.type"] = range.GetPropertyOrDefault("type", fallback: ""),
|
||||
["range.index"] = rangeIndex.ToString(),
|
||||
};
|
||||
yield return CreateChunk(
|
||||
document,
|
||||
NextChunkId(),
|
||||
"affected.ranges",
|
||||
$"affected[{affectedIndex}]",
|
||||
events!,
|
||||
metadata: rangeMetadata);
|
||||
}
|
||||
}
|
||||
|
||||
var versions = affected.GetPropertyOrDefault("versions");
|
||||
if (!string.IsNullOrWhiteSpace(versions))
|
||||
{
|
||||
var versionMetadata = new Dictionary<string, string>(metadata)
|
||||
{
|
||||
["section"] = "affected.versions",
|
||||
};
|
||||
|
||||
yield return CreateChunk(
|
||||
document,
|
||||
NextChunkId(),
|
||||
"affected.versions",
|
||||
$"affected[{affectedIndex}]",
|
||||
versions!,
|
||||
metadata: versionMetadata);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
var references = root.GetPropertyOrDefault("references");
|
||||
if (!string.IsNullOrWhiteSpace(references))
|
||||
{
|
||||
yield return CreateChunk(document, NextChunkId(), "references", "references", references!);
|
||||
}
|
||||
}
|
||||
|
||||
private static AdvisoryChunk CreateChunk(
|
||||
AdvisoryDocument document,
|
||||
string chunkId,
|
||||
string section,
|
||||
string paragraph,
|
||||
string text,
|
||||
IReadOnlyDictionary<string, string>? metadata = null)
|
||||
{
|
||||
var meta = new Dictionary<string, string>(StringComparer.Ordinal)
|
||||
{
|
||||
["format"] = "osv",
|
||||
["section"] = section,
|
||||
["paragraph"] = paragraph,
|
||||
};
|
||||
|
||||
if (metadata is not null)
|
||||
{
|
||||
foreach (var pair in metadata)
|
||||
{
|
||||
meta[pair.Key] = pair.Value;
|
||||
}
|
||||
}
|
||||
|
||||
return AdvisoryChunk.Create(
|
||||
document.DocumentId,
|
||||
chunkId,
|
||||
section,
|
||||
paragraph,
|
||||
text.Trim(),
|
||||
meta);
|
||||
}
|
||||
}
|
||||
189
src/AdvisoryAI/StellaOps.AdvisoryAI/Context/SbomContextResult.cs
Normal file
189
src/AdvisoryAI/StellaOps.AdvisoryAI/Context/SbomContextResult.cs
Normal file
@@ -0,0 +1,189 @@
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.Collections.Immutable;
|
||||
using System.Linq;
|
||||
|
||||
namespace StellaOps.AdvisoryAI.Context;
|
||||
|
||||
/// <summary>
|
||||
/// Represents SBOM-derived context that Advisory AI can hydrate into prompts.
|
||||
/// </summary>
|
||||
public sealed class SbomContextResult
|
||||
{
|
||||
private SbomContextResult(
|
||||
string artifactId,
|
||||
string? purl,
|
||||
ImmutableArray<SbomVersionTimelineEntry> versionTimeline,
|
||||
ImmutableArray<SbomDependencyPath> dependencyPaths,
|
||||
ImmutableDictionary<string, string> environmentFlags,
|
||||
SbomBlastRadiusSummary? blastRadius,
|
||||
ImmutableDictionary<string, string> metadata)
|
||||
{
|
||||
ArtifactId = artifactId;
|
||||
Purl = purl;
|
||||
VersionTimeline = versionTimeline;
|
||||
DependencyPaths = dependencyPaths;
|
||||
EnvironmentFlags = environmentFlags;
|
||||
BlastRadius = blastRadius;
|
||||
Metadata = metadata;
|
||||
}
|
||||
|
||||
public string ArtifactId { get; }
|
||||
|
||||
public string? Purl { get; }
|
||||
|
||||
public ImmutableArray<SbomVersionTimelineEntry> VersionTimeline { get; }
|
||||
|
||||
public ImmutableArray<SbomDependencyPath> DependencyPaths { get; }
|
||||
|
||||
public ImmutableDictionary<string, string> EnvironmentFlags { get; }
|
||||
|
||||
public SbomBlastRadiusSummary? BlastRadius { get; }
|
||||
|
||||
public ImmutableDictionary<string, string> Metadata { get; }
|
||||
|
||||
public static SbomContextResult Create(
|
||||
string artifactId,
|
||||
string? purl,
|
||||
IEnumerable<SbomVersionTimelineEntry> versionTimeline,
|
||||
IEnumerable<SbomDependencyPath> dependencyPaths,
|
||||
IReadOnlyDictionary<string, string>? environmentFlags = null,
|
||||
SbomBlastRadiusSummary? blastRadius = null,
|
||||
IReadOnlyDictionary<string, string>? metadata = null)
|
||||
{
|
||||
ArgumentException.ThrowIfNullOrWhiteSpace(artifactId);
|
||||
ArgumentNullException.ThrowIfNull(versionTimeline);
|
||||
ArgumentNullException.ThrowIfNull(dependencyPaths);
|
||||
|
||||
var timeline = versionTimeline.ToImmutableArray();
|
||||
var paths = dependencyPaths.ToImmutableArray();
|
||||
var flags = environmentFlags is null
|
||||
? ImmutableDictionary<string, string>.Empty
|
||||
: environmentFlags.ToImmutableDictionary(StringComparer.Ordinal);
|
||||
var meta = metadata is null
|
||||
? ImmutableDictionary<string, string>.Empty
|
||||
: metadata.ToImmutableDictionary(StringComparer.Ordinal);
|
||||
|
||||
return new SbomContextResult(
|
||||
artifactId.Trim(),
|
||||
string.IsNullOrWhiteSpace(purl) ? null : purl.Trim(),
|
||||
timeline,
|
||||
paths,
|
||||
flags,
|
||||
blastRadius,
|
||||
meta);
|
||||
}
|
||||
|
||||
public static SbomContextResult Empty(string artifactId, string? purl = null)
|
||||
=> Create(artifactId, purl, Array.Empty<SbomVersionTimelineEntry>(), Array.Empty<SbomDependencyPath>());
|
||||
}
|
||||
|
||||
public sealed class SbomVersionTimelineEntry
|
||||
{
|
||||
public SbomVersionTimelineEntry(
|
||||
string version,
|
||||
DateTimeOffset firstObserved,
|
||||
DateTimeOffset? lastObserved,
|
||||
string status,
|
||||
string source)
|
||||
{
|
||||
ArgumentException.ThrowIfNullOrWhiteSpace(version);
|
||||
ArgumentException.ThrowIfNullOrWhiteSpace(status);
|
||||
ArgumentException.ThrowIfNullOrWhiteSpace(source);
|
||||
|
||||
Version = version.Trim();
|
||||
FirstObserved = firstObserved;
|
||||
LastObserved = lastObserved;
|
||||
Status = status.Trim();
|
||||
Source = source.Trim();
|
||||
}
|
||||
|
||||
public string Version { get; }
|
||||
|
||||
public DateTimeOffset FirstObserved { get; }
|
||||
|
||||
public DateTimeOffset? LastObserved { get; }
|
||||
|
||||
public string Status { get; }
|
||||
|
||||
public string Source { get; }
|
||||
}
|
||||
|
||||
public sealed class SbomDependencyPath
|
||||
{
|
||||
public SbomDependencyPath(
|
||||
IEnumerable<SbomDependencyNode> nodes,
|
||||
bool isRuntime,
|
||||
string? source = null,
|
||||
IReadOnlyDictionary<string, string>? metadata = null)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(nodes);
|
||||
|
||||
var immutableNodes = nodes.ToImmutableArray();
|
||||
if (immutableNodes.IsDefaultOrEmpty)
|
||||
{
|
||||
throw new ArgumentException("At least one node must be supplied.", nameof(nodes));
|
||||
}
|
||||
|
||||
Nodes = immutableNodes;
|
||||
IsRuntime = isRuntime;
|
||||
Source = string.IsNullOrWhiteSpace(source) ? null : source.Trim();
|
||||
Metadata = metadata is null
|
||||
? ImmutableDictionary<string, string>.Empty
|
||||
: metadata.ToImmutableDictionary(StringComparer.Ordinal);
|
||||
}
|
||||
|
||||
public ImmutableArray<SbomDependencyNode> Nodes { get; }
|
||||
|
||||
public bool IsRuntime { get; }
|
||||
|
||||
public string? Source { get; }
|
||||
|
||||
public ImmutableDictionary<string, string> Metadata { get; }
|
||||
}
|
||||
|
||||
public sealed class SbomDependencyNode
|
||||
{
|
||||
public SbomDependencyNode(string identifier, string? version)
|
||||
{
|
||||
ArgumentException.ThrowIfNullOrWhiteSpace(identifier);
|
||||
|
||||
Identifier = identifier.Trim();
|
||||
Version = string.IsNullOrWhiteSpace(version) ? null : version.Trim();
|
||||
}
|
||||
|
||||
public string Identifier { get; }
|
||||
|
||||
public string? Version { get; }
|
||||
}
|
||||
|
||||
public sealed class SbomBlastRadiusSummary
|
||||
{
|
||||
public SbomBlastRadiusSummary(
|
||||
int impactedAssets,
|
||||
int impactedWorkloads,
|
||||
int impactedNamespaces,
|
||||
double? impactedPercentage,
|
||||
IReadOnlyDictionary<string, string>? metadata = null)
|
||||
{
|
||||
ImpactedAssets = Math.Max(0, impactedAssets);
|
||||
ImpactedWorkloads = Math.Max(0, impactedWorkloads);
|
||||
ImpactedNamespaces = Math.Max(0, impactedNamespaces);
|
||||
ImpactedPercentage = impactedPercentage.HasValue
|
||||
? Math.Max(0, impactedPercentage.Value)
|
||||
: null;
|
||||
Metadata = metadata is null
|
||||
? ImmutableDictionary<string, string>.Empty
|
||||
: metadata.ToImmutableDictionary(StringComparer.Ordinal);
|
||||
}
|
||||
|
||||
public int ImpactedAssets { get; }
|
||||
|
||||
public int ImpactedWorkloads { get; }
|
||||
|
||||
public int ImpactedNamespaces { get; }
|
||||
|
||||
public double? ImpactedPercentage { get; }
|
||||
|
||||
public ImmutableDictionary<string, string> Metadata { get; }
|
||||
}
|
||||
@@ -6,4 +6,5 @@ public enum DocumentFormat
|
||||
Csaf,
|
||||
Osv,
|
||||
Markdown,
|
||||
OpenVex,
|
||||
}
|
||||
|
||||
@@ -0,0 +1,24 @@
|
||||
using System.Globalization;
|
||||
|
||||
namespace StellaOps.AdvisoryAI.Documents;
|
||||
|
||||
internal static class DocumentFormatMapper
|
||||
{
|
||||
public static DocumentFormat Map(string? format)
|
||||
{
|
||||
if (string.IsNullOrWhiteSpace(format))
|
||||
{
|
||||
return DocumentFormat.Unknown;
|
||||
}
|
||||
|
||||
var normalized = format.Trim().ToLowerInvariant();
|
||||
return normalized switch
|
||||
{
|
||||
"csaf" or "csaf-json" or "csaf_json" or "csaf/v2" => DocumentFormat.Csaf,
|
||||
"osv" => DocumentFormat.Osv,
|
||||
"markdown" or "md" => DocumentFormat.Markdown,
|
||||
"openvex" or "open-vex" or "vex" => DocumentFormat.OpenVex,
|
||||
_ => DocumentFormat.Unknown,
|
||||
};
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,3 @@
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
[assembly: InternalsVisibleTo("StellaOps.AdvisoryAI.Tests")]
|
||||
@@ -0,0 +1,124 @@
|
||||
using System.Collections.Immutable;
|
||||
using Microsoft.Extensions.Logging;
|
||||
using Microsoft.Extensions.Options;
|
||||
using StellaOps.AdvisoryAI.Abstractions;
|
||||
using StellaOps.AdvisoryAI.Documents;
|
||||
using StellaOps.Concelier.Core.Raw;
|
||||
|
||||
namespace StellaOps.AdvisoryAI.Providers;
|
||||
|
||||
public sealed class ConcelierAdvisoryDocumentProviderOptions
|
||||
{
|
||||
public string Tenant { get; set; } = string.Empty;
|
||||
|
||||
public ImmutableArray<string> Vendors { get; set; } = ImmutableArray<string>.Empty;
|
||||
|
||||
public int MaxDocuments { get; set; } = 25;
|
||||
}
|
||||
|
||||
internal sealed class ConcelierAdvisoryDocumentProvider : IAdvisoryDocumentProvider
|
||||
{
|
||||
private readonly IAdvisoryRawService _rawService;
|
||||
private readonly ConcelierAdvisoryDocumentProviderOptions _options;
|
||||
private readonly ILogger<ConcelierAdvisoryDocumentProvider>? _logger;
|
||||
|
||||
public ConcelierAdvisoryDocumentProvider(
|
||||
IAdvisoryRawService rawService,
|
||||
IOptions<ConcelierAdvisoryDocumentProviderOptions> options,
|
||||
ILogger<ConcelierAdvisoryDocumentProvider>? logger = null)
|
||||
{
|
||||
_rawService = rawService ?? throw new ArgumentNullException(nameof(rawService));
|
||||
_options = options?.Value ?? throw new ArgumentNullException(nameof(options));
|
||||
_logger = logger;
|
||||
|
||||
if (string.IsNullOrWhiteSpace(_options.Tenant))
|
||||
{
|
||||
throw new ArgumentException("Tenant must be configured.", nameof(options));
|
||||
}
|
||||
|
||||
if (_options.MaxDocuments <= 0)
|
||||
{
|
||||
throw new ArgumentOutOfRangeException(nameof(options), "MaxDocuments must be positive.");
|
||||
}
|
||||
}
|
||||
|
||||
public async Task<IReadOnlyList<AdvisoryDocument>> GetDocumentsAsync(string advisoryKey, CancellationToken cancellationToken)
|
||||
{
|
||||
ArgumentException.ThrowIfNullOrWhiteSpace(advisoryKey);
|
||||
|
||||
var options = new AdvisoryRawQueryOptions(_options.Tenant)
|
||||
{
|
||||
Aliases = ImmutableArray.Create(advisoryKey),
|
||||
UpstreamIds = ImmutableArray.Create(advisoryKey),
|
||||
Vendors = _options.Vendors,
|
||||
Limit = _options.MaxDocuments
|
||||
};
|
||||
|
||||
var result = await _rawService.QueryAsync(options, cancellationToken).ConfigureAwait(false);
|
||||
if (result.Records.Count == 0)
|
||||
{
|
||||
_logger?.LogDebug("No advisory raw records returned for key {AdvisoryKey}", advisoryKey);
|
||||
return Array.Empty<AdvisoryDocument>();
|
||||
}
|
||||
|
||||
var documents = new List<AdvisoryDocument>(result.Records.Count);
|
||||
foreach (var record in result.Records)
|
||||
{
|
||||
var raw = record.Document.Content;
|
||||
var format = DocumentFormatMapper.Map(raw.Format);
|
||||
if (format == DocumentFormat.Unknown)
|
||||
{
|
||||
_logger?.LogWarning("Unsupported advisory content format {Format} for advisory {AdvisoryKey}", raw.Format, advisoryKey);
|
||||
continue;
|
||||
}
|
||||
|
||||
var documentId = DetermineDocumentId(record);
|
||||
var metadata = BuildMetadata(record);
|
||||
var json = record.Document.Content.Raw.GetRawText();
|
||||
|
||||
documents.Add(AdvisoryDocument.Create(documentId, format, record.Document.Source.Vendor, json, metadata));
|
||||
}
|
||||
|
||||
return documents;
|
||||
}
|
||||
|
||||
private static string DetermineDocumentId(AdvisoryRawRecord record)
|
||||
{
|
||||
if (!string.IsNullOrWhiteSpace(record.Document.Upstream.UpstreamId))
|
||||
{
|
||||
return record.Document.Upstream.UpstreamId;
|
||||
}
|
||||
|
||||
var primary = record.Document.Identifiers.PrimaryId;
|
||||
if (!string.IsNullOrWhiteSpace(primary))
|
||||
{
|
||||
return primary;
|
||||
}
|
||||
|
||||
return record.Id;
|
||||
}
|
||||
|
||||
private static IReadOnlyDictionary<string, string> BuildMetadata(AdvisoryRawRecord record)
|
||||
{
|
||||
var metadata = new Dictionary<string, string>(StringComparer.Ordinal)
|
||||
{
|
||||
["tenant"] = record.Document.Tenant,
|
||||
["vendor"] = record.Document.Source.Vendor,
|
||||
["connector"] = record.Document.Source.Connector,
|
||||
["content_hash"] = record.Document.Upstream.ContentHash,
|
||||
["ingested_at"] = record.IngestedAt.UtcDateTime.ToString("O"),
|
||||
};
|
||||
|
||||
if (!string.IsNullOrWhiteSpace(record.Document.Source.Stream))
|
||||
{
|
||||
metadata["stream"] = record.Document.Source.Stream!;
|
||||
}
|
||||
|
||||
if (!string.IsNullOrWhiteSpace(record.Document.Upstream.DocumentVersion))
|
||||
{
|
||||
metadata["document_version"] = record.Document.Upstream.DocumentVersion!;
|
||||
}
|
||||
|
||||
return metadata;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,202 @@
|
||||
|
||||
using System.Collections.Immutable;
|
||||
using System.Globalization;
|
||||
using System.Text.Json;
|
||||
using System.Text.Json.Nodes;
|
||||
using Microsoft.Extensions.Logging;
|
||||
using Microsoft.Extensions.Options;
|
||||
using StellaOps.AdvisoryAI.Abstractions;
|
||||
using StellaOps.AdvisoryAI.Documents;
|
||||
using StellaOps.Excititor.Core;
|
||||
using StellaOps.Excititor.Core.Observations;
|
||||
|
||||
namespace StellaOps.AdvisoryAI.Providers;
|
||||
|
||||
public sealed class ExcititorVexDocumentProviderOptions
|
||||
{
|
||||
public string Tenant { get; set; } = string.Empty;
|
||||
|
||||
public ImmutableArray<string> ProviderIds { get; set; } = ImmutableArray<string>.Empty;
|
||||
|
||||
public ImmutableArray<VexClaimStatus> Statuses { get; set; } = ImmutableArray<VexClaimStatus>.Empty;
|
||||
|
||||
public int MaxObservations { get; set; } = 25;
|
||||
}
|
||||
|
||||
internal sealed class ExcititorVexDocumentProvider : IAdvisoryDocumentProvider
|
||||
{
|
||||
private static readonly JsonSerializerOptions JsonOptions = new(JsonSerializerDefaults.Web)
|
||||
{
|
||||
WriteIndented = false,
|
||||
};
|
||||
|
||||
private readonly IVexObservationQueryService _queryService;
|
||||
private readonly ExcititorVexDocumentProviderOptions _options;
|
||||
private readonly ILogger<ExcititorVexDocumentProvider>? _logger;
|
||||
|
||||
public ExcititorVexDocumentProvider(
|
||||
IVexObservationQueryService queryService,
|
||||
IOptions<ExcititorVexDocumentProviderOptions> options,
|
||||
ILogger<ExcititorVexDocumentProvider>? logger = null)
|
||||
{
|
||||
_queryService = queryService ?? throw new ArgumentNullException(nameof(queryService));
|
||||
_options = options?.Value ?? throw new ArgumentNullException(nameof(options));
|
||||
_logger = logger;
|
||||
|
||||
if (string.IsNullOrWhiteSpace(_options.Tenant))
|
||||
{
|
||||
throw new ArgumentException("Tenant must be configured.", nameof(options));
|
||||
}
|
||||
|
||||
if (_options.MaxObservations <= 0)
|
||||
{
|
||||
throw new ArgumentOutOfRangeException(nameof(options), "MaxObservations must be positive.");
|
||||
}
|
||||
}
|
||||
|
||||
public async Task<IReadOnlyList<AdvisoryDocument>> GetDocumentsAsync(string advisoryKey, CancellationToken cancellationToken)
|
||||
{
|
||||
ArgumentException.ThrowIfNullOrWhiteSpace(advisoryKey);
|
||||
|
||||
var normalizedKey = advisoryKey.Trim();
|
||||
var lookup = ImmutableArray.Create(normalizedKey);
|
||||
|
||||
var providerIds = _options.ProviderIds.IsDefaultOrEmpty
|
||||
? ImmutableArray<string>.Empty
|
||||
: _options.ProviderIds;
|
||||
var statuses = _options.Statuses.IsDefaultOrEmpty
|
||||
? ImmutableArray<VexClaimStatus>.Empty
|
||||
: _options.Statuses;
|
||||
|
||||
var options = new VexObservationQueryOptions(
|
||||
_options.Tenant,
|
||||
observationIds: lookup,
|
||||
vulnerabilityIds: lookup,
|
||||
productKeys: lookup,
|
||||
purls: ImmutableArray<string>.Empty,
|
||||
cpes: ImmutableArray<string>.Empty,
|
||||
providerIds: providerIds,
|
||||
statuses: statuses,
|
||||
limit: _options.MaxObservations);
|
||||
|
||||
var result = await _queryService.QueryAsync(options, cancellationToken).ConfigureAwait(false);
|
||||
if (result.Observations.IsDefaultOrEmpty)
|
||||
{
|
||||
_logger?.LogDebug("No VEX observations returned for advisory key {AdvisoryKey}", normalizedKey);
|
||||
return Array.Empty<AdvisoryDocument>();
|
||||
}
|
||||
|
||||
var documents = new List<AdvisoryDocument>(result.Observations.Length);
|
||||
foreach (var observation in result.Observations)
|
||||
{
|
||||
var format = DocumentFormatMapper.Map(observation.Content.Format);
|
||||
if (format == DocumentFormat.Unknown)
|
||||
{
|
||||
_logger?.LogWarning(
|
||||
"Unsupported VEX content format {Format} for observation {ObservationId}",
|
||||
observation.Content.Format,
|
||||
observation.ObservationId);
|
||||
continue;
|
||||
}
|
||||
|
||||
var content = observation.Content.Raw.ToJsonString(JsonOptions);
|
||||
var metadata = BuildMetadata(observation);
|
||||
|
||||
documents.Add(AdvisoryDocument.Create(
|
||||
observation.ObservationId,
|
||||
format,
|
||||
observation.ProviderId,
|
||||
content,
|
||||
metadata));
|
||||
}
|
||||
|
||||
return documents;
|
||||
}
|
||||
|
||||
private static IReadOnlyDictionary<string, string> BuildMetadata(VexObservation observation)
|
||||
{
|
||||
var metadata = new Dictionary<string, string>(StringComparer.Ordinal)
|
||||
{
|
||||
["tenant"] = observation.Tenant,
|
||||
["provider"] = observation.ProviderId,
|
||||
["stream"] = observation.StreamId,
|
||||
["created_at"] = observation.CreatedAt.ToString("O", CultureInfo.InvariantCulture),
|
||||
["statement_count"] = observation.Statements.Length.ToString(CultureInfo.InvariantCulture),
|
||||
["content_format"] = observation.Content.Format,
|
||||
["content_hash"] = observation.Upstream.ContentHash,
|
||||
};
|
||||
|
||||
if (!string.IsNullOrWhiteSpace(observation.Content.SpecVersion))
|
||||
{
|
||||
metadata["spec_version"] = observation.Content.SpecVersion!;
|
||||
}
|
||||
|
||||
if (!string.IsNullOrWhiteSpace(observation.Upstream.DocumentVersion))
|
||||
{
|
||||
metadata["document_version"] = observation.Upstream.DocumentVersion!;
|
||||
}
|
||||
|
||||
if (observation.Supersedes.Length > 0)
|
||||
{
|
||||
metadata["supersedes"] = string.Join(",", observation.Supersedes);
|
||||
}
|
||||
|
||||
if (observation.Linkset.Aliases.Length > 0)
|
||||
{
|
||||
metadata["aliases"] = string.Join(",", observation.Linkset.Aliases);
|
||||
}
|
||||
|
||||
if (observation.Linkset.Purls.Length > 0)
|
||||
{
|
||||
metadata["purls"] = string.Join(",", observation.Linkset.Purls);
|
||||
}
|
||||
|
||||
if (observation.Linkset.Cpes.Length > 0)
|
||||
{
|
||||
metadata["cpes"] = string.Join(",", observation.Linkset.Cpes);
|
||||
}
|
||||
|
||||
var statusSummary = BuildStatusSummary(observation.Statements);
|
||||
if (statusSummary.Length > 0)
|
||||
{
|
||||
metadata["status_counts"] = statusSummary;
|
||||
}
|
||||
|
||||
return metadata;
|
||||
}
|
||||
|
||||
private static string BuildStatusSummary(ImmutableArray<VexObservationStatement> statements)
|
||||
{
|
||||
if (statements.IsDefaultOrEmpty)
|
||||
{
|
||||
return string.Empty;
|
||||
}
|
||||
|
||||
var counts = new SortedDictionary<string, int>(StringComparer.Ordinal);
|
||||
foreach (var statement in statements)
|
||||
{
|
||||
var key = ToStatusKey(statement.Status);
|
||||
counts.TryGetValue(key, out var current);
|
||||
counts[key] = current + 1;
|
||||
}
|
||||
|
||||
if (counts.Count == 0)
|
||||
{
|
||||
return string.Empty;
|
||||
}
|
||||
|
||||
return string.Join(
|
||||
';',
|
||||
counts.Select(pair => $"{pair.Key}:{pair.Value.ToString(CultureInfo.InvariantCulture)}"));
|
||||
}
|
||||
|
||||
private static string ToStatusKey(VexClaimStatus status)
|
||||
=> status switch
|
||||
{
|
||||
VexClaimStatus.Affected => "affected",
|
||||
VexClaimStatus.NotAffected => "not_affected",
|
||||
VexClaimStatus.Fixed => "fixed",
|
||||
VexClaimStatus.UnderInvestigation => "under_investigation",
|
||||
_ => status.ToString().ToLowerInvariant(),
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,196 @@
|
||||
|
||||
using System;
|
||||
using System.Collections.Immutable;
|
||||
using System.Threading;
|
||||
using System.Threading.Tasks;
|
||||
|
||||
namespace StellaOps.AdvisoryAI.Providers;
|
||||
|
||||
public interface ISbomContextClient
|
||||
{
|
||||
Task<SbomContextDocument?> GetContextAsync(SbomContextQuery query, CancellationToken cancellationToken);
|
||||
}
|
||||
|
||||
public sealed class SbomContextQuery
|
||||
{
|
||||
public SbomContextQuery(
|
||||
string artifactId,
|
||||
string? purl,
|
||||
int maxTimelineEntries,
|
||||
int maxDependencyPaths,
|
||||
bool includeEnvironmentFlags,
|
||||
bool includeBlastRadius)
|
||||
{
|
||||
if (string.IsNullOrWhiteSpace(artifactId))
|
||||
{
|
||||
throw new ArgumentException("ArtifactId must be provided.", nameof(artifactId));
|
||||
}
|
||||
|
||||
ArtifactId = artifactId.Trim();
|
||||
Purl = string.IsNullOrWhiteSpace(purl) ? null : purl.Trim();
|
||||
MaxTimelineEntries = Math.Max(0, maxTimelineEntries);
|
||||
MaxDependencyPaths = Math.Max(0, maxDependencyPaths);
|
||||
IncludeEnvironmentFlags = includeEnvironmentFlags;
|
||||
IncludeBlastRadius = includeBlastRadius;
|
||||
}
|
||||
|
||||
public string ArtifactId { get; }
|
||||
|
||||
public string? Purl { get; }
|
||||
|
||||
public int MaxTimelineEntries { get; }
|
||||
|
||||
public int MaxDependencyPaths { get; }
|
||||
|
||||
public bool IncludeEnvironmentFlags { get; }
|
||||
|
||||
public bool IncludeBlastRadius { get; }
|
||||
}
|
||||
|
||||
public sealed class SbomContextDocument
|
||||
{
|
||||
public SbomContextDocument(
|
||||
string artifactId,
|
||||
string? purl,
|
||||
ImmutableArray<SbomVersionRecord> versions,
|
||||
ImmutableArray<SbomDependencyPathRecord> dependencyPaths,
|
||||
ImmutableDictionary<string, string> environmentFlags,
|
||||
SbomBlastRadiusRecord? blastRadius,
|
||||
ImmutableDictionary<string, string> metadata)
|
||||
{
|
||||
if (string.IsNullOrWhiteSpace(artifactId))
|
||||
{
|
||||
throw new ArgumentException("ArtifactId must be provided.", nameof(artifactId));
|
||||
}
|
||||
|
||||
ArtifactId = artifactId.Trim();
|
||||
Purl = string.IsNullOrWhiteSpace(purl) ? null : purl.Trim();
|
||||
Versions = versions.IsDefault ? ImmutableArray<SbomVersionRecord>.Empty : versions;
|
||||
DependencyPaths = dependencyPaths.IsDefault ? ImmutableArray<SbomDependencyPathRecord>.Empty : dependencyPaths;
|
||||
EnvironmentFlags = environmentFlags == default ? ImmutableDictionary<string, string>.Empty : environmentFlags;
|
||||
BlastRadius = blastRadius;
|
||||
Metadata = metadata == default ? ImmutableDictionary<string, string>.Empty : metadata;
|
||||
}
|
||||
|
||||
public string ArtifactId { get; }
|
||||
|
||||
public string? Purl { get; }
|
||||
|
||||
public ImmutableArray<SbomVersionRecord> Versions { get; }
|
||||
|
||||
public ImmutableArray<SbomDependencyPathRecord> DependencyPaths { get; }
|
||||
|
||||
public ImmutableDictionary<string, string> EnvironmentFlags { get; }
|
||||
|
||||
public SbomBlastRadiusRecord? BlastRadius { get; }
|
||||
|
||||
public ImmutableDictionary<string, string> Metadata { get; }
|
||||
}
|
||||
|
||||
public sealed class SbomVersionRecord
|
||||
{
|
||||
public SbomVersionRecord(
|
||||
string version,
|
||||
DateTimeOffset firstObserved,
|
||||
DateTimeOffset? lastObserved,
|
||||
string status,
|
||||
string source,
|
||||
bool isFixAvailable,
|
||||
ImmutableDictionary<string, string> metadata)
|
||||
{
|
||||
if (string.IsNullOrWhiteSpace(version))
|
||||
{
|
||||
throw new ArgumentException("Version must be provided.", nameof(version));
|
||||
}
|
||||
|
||||
Version = version.Trim();
|
||||
FirstObserved = firstObserved;
|
||||
LastObserved = lastObserved;
|
||||
Status = string.IsNullOrWhiteSpace(status) ? "unknown" : status.Trim();
|
||||
Source = string.IsNullOrWhiteSpace(source) ? "unknown" : source.Trim();
|
||||
IsFixAvailable = isFixAvailable;
|
||||
Metadata = metadata == default ? ImmutableDictionary<string, string>.Empty : metadata;
|
||||
}
|
||||
|
||||
public string Version { get; }
|
||||
|
||||
public DateTimeOffset FirstObserved { get; }
|
||||
|
||||
public DateTimeOffset? LastObserved { get; }
|
||||
|
||||
public string Status { get; }
|
||||
|
||||
public string Source { get; }
|
||||
|
||||
public bool IsFixAvailable { get; }
|
||||
|
||||
public ImmutableDictionary<string, string> Metadata { get; }
|
||||
}
|
||||
|
||||
public sealed class SbomDependencyPathRecord
|
||||
{
|
||||
public SbomDependencyPathRecord(
|
||||
ImmutableArray<SbomDependencyNodeRecord> nodes,
|
||||
bool isRuntime,
|
||||
string? source,
|
||||
ImmutableDictionary<string, string> metadata)
|
||||
{
|
||||
Nodes = nodes.IsDefault ? ImmutableArray<SbomDependencyNodeRecord>.Empty : nodes;
|
||||
IsRuntime = isRuntime;
|
||||
Source = string.IsNullOrWhiteSpace(source) ? null : source.Trim();
|
||||
Metadata = metadata == default ? ImmutableDictionary<string, string>.Empty : metadata;
|
||||
}
|
||||
|
||||
public ImmutableArray<SbomDependencyNodeRecord> Nodes { get; }
|
||||
|
||||
public bool IsRuntime { get; }
|
||||
|
||||
public string? Source { get; }
|
||||
|
||||
public ImmutableDictionary<string, string> Metadata { get; }
|
||||
}
|
||||
|
||||
public sealed class SbomDependencyNodeRecord
|
||||
{
|
||||
public SbomDependencyNodeRecord(string identifier, string? version)
|
||||
{
|
||||
if (string.IsNullOrWhiteSpace(identifier))
|
||||
{
|
||||
throw new ArgumentException("Identifier must be provided.", nameof(identifier));
|
||||
}
|
||||
|
||||
Identifier = identifier.Trim();
|
||||
Version = string.IsNullOrWhiteSpace(version) ? null : version.Trim();
|
||||
}
|
||||
|
||||
public string Identifier { get; }
|
||||
|
||||
public string? Version { get; }
|
||||
}
|
||||
|
||||
public sealed class SbomBlastRadiusRecord
|
||||
{
|
||||
public SbomBlastRadiusRecord(
|
||||
int impactedAssets,
|
||||
int impactedWorkloads,
|
||||
int impactedNamespaces,
|
||||
double? impactedPercentage,
|
||||
ImmutableDictionary<string, string> metadata)
|
||||
{
|
||||
ImpactedAssets = impactedAssets;
|
||||
ImpactedWorkloads = impactedWorkloads;
|
||||
ImpactedNamespaces = impactedNamespaces;
|
||||
ImpactedPercentage = impactedPercentage;
|
||||
Metadata = metadata == default ? ImmutableDictionary<string, string>.Empty : metadata;
|
||||
}
|
||||
|
||||
public int ImpactedAssets { get; }
|
||||
|
||||
public int ImpactedWorkloads { get; }
|
||||
|
||||
public int ImpactedNamespaces { get; }
|
||||
|
||||
public double? ImpactedPercentage { get; }
|
||||
|
||||
public ImmutableDictionary<string, string> Metadata { get; }
|
||||
}
|
||||
@@ -0,0 +1,71 @@
|
||||
using System.Collections.Immutable;
|
||||
using System.Linq;
|
||||
using Microsoft.Extensions.Logging;
|
||||
using StellaOps.AdvisoryAI.Abstractions;
|
||||
using StellaOps.AdvisoryAI.Chunking;
|
||||
using StellaOps.AdvisoryAI.Documents;
|
||||
|
||||
namespace StellaOps.AdvisoryAI.Retrievers;
|
||||
|
||||
internal sealed class AdvisoryStructuredRetriever : IAdvisoryStructuredRetriever
|
||||
{
|
||||
private readonly IAdvisoryDocumentProvider _documentProvider;
|
||||
private readonly DocumentChunkerFactory _chunkerFactory;
|
||||
private readonly ILogger<AdvisoryStructuredRetriever>? _logger;
|
||||
|
||||
public AdvisoryStructuredRetriever(
|
||||
IAdvisoryDocumentProvider documentProvider,
|
||||
IEnumerable<IDocumentChunker> chunkers,
|
||||
ILogger<AdvisoryStructuredRetriever>? logger = null)
|
||||
{
|
||||
_documentProvider = documentProvider ?? throw new ArgumentNullException(nameof(documentProvider));
|
||||
_chunkerFactory = new DocumentChunkerFactory(chunkers ?? throw new ArgumentNullException(nameof(chunkers)));
|
||||
_logger = logger;
|
||||
}
|
||||
|
||||
public async Task<AdvisoryRetrievalResult> RetrieveAsync(AdvisoryRetrievalRequest request, CancellationToken cancellationToken)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(request);
|
||||
|
||||
var documents = await _documentProvider.GetDocumentsAsync(request.AdvisoryKey, cancellationToken).ConfigureAwait(false);
|
||||
if (documents.Count == 0)
|
||||
{
|
||||
_logger?.LogWarning("No documents returned for advisory {AdvisoryKey}", request.AdvisoryKey);
|
||||
return AdvisoryRetrievalResult.Create(request.AdvisoryKey, Array.Empty<AdvisoryChunk>());
|
||||
}
|
||||
|
||||
var preferredSections = request.PreferredSections is null
|
||||
? null
|
||||
: request.PreferredSections.Select(section => section.Trim()).Where(static s => s.Length > 0).ToHashSet(StringComparer.OrdinalIgnoreCase);
|
||||
|
||||
var chunks = new List<AdvisoryChunk>();
|
||||
foreach (var document in documents)
|
||||
{
|
||||
var chunker = _chunkerFactory.Resolve(document.Format);
|
||||
foreach (var chunk in chunker.Chunk(document))
|
||||
{
|
||||
if (preferredSections is not null && !preferredSections.Contains(chunk.Section))
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
chunks.Add(chunk);
|
||||
}
|
||||
}
|
||||
|
||||
chunks.Sort(static (left, right) => string.CompareOrdinal(left.ChunkId, right.ChunkId));
|
||||
|
||||
if (request.MaxChunks is int max && max > 0 && chunks.Count > max)
|
||||
{
|
||||
chunks = chunks.Take(max).ToList();
|
||||
}
|
||||
|
||||
var metadata = new Dictionary<string, string>(StringComparer.Ordinal)
|
||||
{
|
||||
["documents"] = string.Join(",", documents.Select(d => d.DocumentId)),
|
||||
["chunk_count"] = chunks.Count.ToString(),
|
||||
};
|
||||
|
||||
return AdvisoryRetrievalResult.Create(request.AdvisoryKey, chunks, metadata);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,73 @@
|
||||
using StellaOps.AdvisoryAI.Abstractions;
|
||||
using StellaOps.AdvisoryAI.Vectorization;
|
||||
|
||||
namespace StellaOps.AdvisoryAI.Retrievers;
|
||||
|
||||
internal sealed class AdvisoryVectorRetriever : IAdvisoryVectorRetriever
|
||||
{
|
||||
private readonly IAdvisoryStructuredRetriever _structuredRetriever;
|
||||
private readonly IVectorEncoder _encoder;
|
||||
|
||||
public AdvisoryVectorRetriever(IAdvisoryStructuredRetriever structuredRetriever, IVectorEncoder encoder)
|
||||
{
|
||||
_structuredRetriever = structuredRetriever ?? throw new ArgumentNullException(nameof(structuredRetriever));
|
||||
_encoder = encoder ?? throw new ArgumentNullException(nameof(encoder));
|
||||
}
|
||||
|
||||
public async Task<IReadOnlyList<VectorRetrievalMatch>> SearchAsync(VectorRetrievalRequest request, CancellationToken cancellationToken)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(request);
|
||||
if (request.TopK <= 0)
|
||||
{
|
||||
throw new ArgumentOutOfRangeException(nameof(request.TopK), "TopK must be a positive integer.");
|
||||
}
|
||||
|
||||
var retrieval = await _structuredRetriever.RetrieveAsync(request.Retrieval, cancellationToken).ConfigureAwait(false);
|
||||
if (retrieval.Chunks.Count == 0)
|
||||
{
|
||||
return Array.Empty<VectorRetrievalMatch>();
|
||||
}
|
||||
|
||||
var queryVector = _encoder.Encode(request.Query);
|
||||
var matches = new List<VectorRetrievalMatch>(retrieval.Chunks.Count);
|
||||
|
||||
foreach (var chunk in retrieval.Chunks)
|
||||
{
|
||||
var vector = chunk.Embedding ?? _encoder.Encode(chunk.Text);
|
||||
var score = CosineSimilarity(queryVector, vector);
|
||||
matches.Add(new VectorRetrievalMatch(chunk.DocumentId, chunk.ChunkId, chunk.Text, score, chunk.Metadata));
|
||||
}
|
||||
|
||||
matches.Sort(static (left, right) => right.Score.CompareTo(left.Score));
|
||||
if (matches.Count > request.TopK)
|
||||
{
|
||||
matches.RemoveRange(request.TopK, matches.Count - request.TopK);
|
||||
}
|
||||
|
||||
return matches;
|
||||
}
|
||||
|
||||
private static double CosineSimilarity(float[] left, float[] right)
|
||||
{
|
||||
var length = Math.Min(left.Length, right.Length);
|
||||
double dot = 0;
|
||||
double leftNorm = 0;
|
||||
double rightNorm = 0;
|
||||
|
||||
for (var i = 0; i < length; i++)
|
||||
{
|
||||
var l = left[i];
|
||||
var r = right[i];
|
||||
dot += l * r;
|
||||
leftNorm += l * l;
|
||||
rightNorm += r * r;
|
||||
}
|
||||
|
||||
if (leftNorm <= 0 || rightNorm <= 0)
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
|
||||
return dot / Math.Sqrt(leftNorm * rightNorm);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,209 @@
|
||||
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.Collections.Immutable;
|
||||
using System.Linq;
|
||||
using System.Threading;
|
||||
using System.Threading.Tasks;
|
||||
using Microsoft.Extensions.Logging;
|
||||
using StellaOps.AdvisoryAI.Abstractions;
|
||||
using StellaOps.AdvisoryAI.Context;
|
||||
using StellaOps.AdvisoryAI.Providers;
|
||||
|
||||
namespace StellaOps.AdvisoryAI.Retrievers;
|
||||
|
||||
internal sealed class SbomContextRetriever : ISbomContextRetriever
|
||||
{
|
||||
private readonly ISbomContextClient _client;
|
||||
private readonly ILogger<SbomContextRetriever>? _logger;
|
||||
|
||||
public SbomContextRetriever(ISbomContextClient client, ILogger<SbomContextRetriever>? logger = null)
|
||||
{
|
||||
_client = client ?? throw new ArgumentNullException(nameof(client));
|
||||
_logger = logger;
|
||||
}
|
||||
|
||||
public async Task<SbomContextResult> RetrieveAsync(SbomContextRequest request, CancellationToken cancellationToken)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(request);
|
||||
|
||||
var query = new SbomContextQuery(
|
||||
request.ArtifactId,
|
||||
request.Purl,
|
||||
request.MaxTimelineEntries,
|
||||
request.MaxDependencyPaths,
|
||||
request.IncludeEnvironmentFlags,
|
||||
request.IncludeBlastRadius);
|
||||
|
||||
SbomContextDocument? document;
|
||||
try
|
||||
{
|
||||
document = await _client.GetContextAsync(query, cancellationToken).ConfigureAwait(false);
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
_logger?.LogError(ex, "Failed to retrieve SBOM context for artifact {ArtifactId}", request.ArtifactId);
|
||||
document = null;
|
||||
}
|
||||
|
||||
if (document is null)
|
||||
{
|
||||
_logger?.LogWarning("No SBOM context returned for artifact {ArtifactId}", request.ArtifactId);
|
||||
return SbomContextResult.Empty(request.ArtifactId, request.Purl);
|
||||
}
|
||||
|
||||
var timeline = ShapeTimeline(document.Versions, request.MaxTimelineEntries);
|
||||
var paths = ShapeDependencyPaths(document.DependencyPaths, request.MaxDependencyPaths);
|
||||
var environmentFlags = request.IncludeEnvironmentFlags
|
||||
? NormalizeEnvironmentFlags(document.EnvironmentFlags)
|
||||
: ImmutableDictionary<string, string>.Empty;
|
||||
var blastRadius = request.IncludeBlastRadius ? ShapeBlastRadius(document.BlastRadius) : null;
|
||||
var metadata = BuildMetadata(document, timeline.Count, paths.Count, environmentFlags.Count, blastRadius is not null);
|
||||
|
||||
return SbomContextResult.Create(
|
||||
document.ArtifactId,
|
||||
document.Purl,
|
||||
timeline,
|
||||
paths,
|
||||
environmentFlags,
|
||||
blastRadius,
|
||||
metadata);
|
||||
}
|
||||
|
||||
private static IReadOnlyList<SbomVersionTimelineEntry> ShapeTimeline(ImmutableArray<SbomVersionRecord> versions, int max)
|
||||
{
|
||||
if (versions.IsDefaultOrEmpty || max == 0)
|
||||
{
|
||||
return Array.Empty<SbomVersionTimelineEntry>();
|
||||
}
|
||||
|
||||
return versions
|
||||
.OrderBy(static v => v.FirstObserved)
|
||||
.ThenBy(static v => v.Version, StringComparer.Ordinal)
|
||||
.Take(max > 0 ? max : int.MaxValue)
|
||||
.Select(static v => new SbomVersionTimelineEntry(
|
||||
v.Version,
|
||||
v.FirstObserved,
|
||||
v.LastObserved,
|
||||
string.IsNullOrWhiteSpace(v.Status)
|
||||
? (v.IsFixAvailable ? "fixed" : "unknown")
|
||||
: v.Status.Trim(),
|
||||
string.IsNullOrWhiteSpace(v.Source) ? "sbom" : v.Source.Trim()))
|
||||
.ToImmutableArray();
|
||||
}
|
||||
|
||||
private static IReadOnlyList<SbomDependencyPath> ShapeDependencyPaths(ImmutableArray<SbomDependencyPathRecord> paths, int max)
|
||||
{
|
||||
if (paths.IsDefaultOrEmpty || max == 0)
|
||||
{
|
||||
return Array.Empty<SbomDependencyPath>();
|
||||
}
|
||||
|
||||
var distinct = new SortedDictionary<string, SbomDependencyPath>(StringComparer.Ordinal);
|
||||
foreach (var path in paths)
|
||||
{
|
||||
if (path.Nodes.IsDefaultOrEmpty)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
var nodeList = path.Nodes
|
||||
.Select(static node => new SbomDependencyNode(node.Identifier, node.Version))
|
||||
.ToImmutableArray();
|
||||
|
||||
if (nodeList.IsDefaultOrEmpty)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
var key = string.Join(
|
||||
"|",
|
||||
nodeList.Select(static n => string.Concat(n.Identifier, "@", n.Version ?? string.Empty)));
|
||||
|
||||
if (distinct.ContainsKey(key))
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
var dependencyPath = new SbomDependencyPath(
|
||||
nodeList,
|
||||
path.IsRuntime,
|
||||
string.IsNullOrWhiteSpace(path.Source) ? null : path.Source.Trim());
|
||||
|
||||
distinct[key] = dependencyPath;
|
||||
}
|
||||
|
||||
return distinct.Values
|
||||
.OrderBy(p => p.IsRuntime ? 0 : 1)
|
||||
.ThenBy(p => p.Nodes.Length)
|
||||
.ThenBy(p => string.Join("|", p.Nodes.Select(n => n.Identifier)), StringComparer.Ordinal)
|
||||
.Take(max > 0 ? max : int.MaxValue)
|
||||
.ToImmutableArray();
|
||||
}
|
||||
|
||||
private static IReadOnlyDictionary<string, string> NormalizeEnvironmentFlags(ImmutableDictionary<string, string> flags)
|
||||
{
|
||||
if (flags == default || flags.IsEmpty)
|
||||
{
|
||||
return ImmutableDictionary<string, string>.Empty;
|
||||
}
|
||||
|
||||
var builder = ImmutableSortedDictionary.CreateBuilder<string, string>(StringComparer.Ordinal);
|
||||
foreach (var pair in flags)
|
||||
{
|
||||
if (string.IsNullOrWhiteSpace(pair.Key) || pair.Value is null)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
builder[pair.Key.Trim()] = pair.Value.Trim();
|
||||
}
|
||||
|
||||
return builder.ToImmutable();
|
||||
}
|
||||
|
||||
private static SbomBlastRadiusSummary? ShapeBlastRadius(SbomBlastRadiusRecord? record)
|
||||
{
|
||||
if (record is null)
|
||||
{
|
||||
return null;
|
||||
}
|
||||
|
||||
var metadata = record.Metadata == default
|
||||
? ImmutableDictionary<string, string>.Empty
|
||||
: record.Metadata.ToImmutableDictionary(StringComparer.Ordinal);
|
||||
|
||||
return new SbomBlastRadiusSummary(
|
||||
record.ImpactedAssets,
|
||||
record.ImpactedWorkloads,
|
||||
record.ImpactedNamespaces,
|
||||
record.ImpactedPercentage,
|
||||
metadata);
|
||||
}
|
||||
|
||||
private static IReadOnlyDictionary<string, string> BuildMetadata(
|
||||
SbomContextDocument document,
|
||||
int timelineCount,
|
||||
int pathCount,
|
||||
int environmentFlagCount,
|
||||
bool hasBlastRadius)
|
||||
{
|
||||
var builder = ImmutableDictionary.CreateBuilder<string, string>(StringComparer.Ordinal);
|
||||
foreach (var pair in document.Metadata)
|
||||
{
|
||||
if (string.IsNullOrWhiteSpace(pair.Key) || pair.Value is null)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
builder[pair.Key.Trim()] = pair.Value.Trim();
|
||||
}
|
||||
|
||||
builder["version_count"] = timelineCount.ToString();
|
||||
builder["dependency_path_count"] = pathCount.ToString();
|
||||
builder["environment_flag_count"] = environmentFlagCount.ToString();
|
||||
builder["blast_radius_present"] = hasBlastRadius.ToString();
|
||||
|
||||
return builder.ToImmutable();
|
||||
}
|
||||
}
|
||||
@@ -10,6 +10,11 @@
|
||||
<ItemGroup>
|
||||
<PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.0-rc.2.25502.107" />
|
||||
<PackageReference Include="Microsoft.Extensions.Options" Version="10.0.0-rc.2.25502.107" />
|
||||
<PackageReference Include="System.Text.Json" Version="10.0.0-rc.2.25502.2" />
|
||||
<PackageReference Include="System.Text.Json" Version="10.0.0-rc.2.25502.107" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ProjectReference Include="..\..\Concelier\__Libraries\StellaOps.Concelier.Core\StellaOps.Concelier.Core.csproj" />
|
||||
<ProjectReference Include="..\..\Concelier\__Libraries\StellaOps.Concelier.RawModels\StellaOps.Concelier.RawModels.csproj" />
|
||||
<ProjectReference Include="..\..\Excititor\__Libraries\StellaOps.Excititor.Core\StellaOps.Excititor.Core.csproj" />
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
|
||||
@@ -1,12 +1,16 @@
|
||||
# Advisory AI Task Board — Epic 8
|
||||
| ID | Status | Owner(s) | Depends on | Description | Exit Criteria |
|
||||
|----|--------|----------|------------|-------------|---------------|
|
||||
| AIAI-31-001 | DOING (2025-11-02) | Advisory AI Guild | CONCELIER-VULN-29-001, EXCITITOR-VULN-29-001 | Implement structured and vector retrievers for advisories/VEX with paragraph anchors and citation metadata. | Retrievers return deterministic chunks with source IDs/sections; unit tests cover CSAF/OSV/vendor formats. |
|
||||
| AIAI-31-002 | TODO | Advisory AI Guild, SBOM Service Guild | SBOM-VULN-29-001 | Build SBOM context retriever (purl version timelines, dependency paths, env flags, blast radius estimator). | Retriever returns paths/metrics under SLA; tests cover ecosystems. |
|
||||
| AIAI-31-003 | TODO | Advisory AI Guild | AIAI-31-001..002 | Implement deterministic toolset (version comparators, range checks, dependency analysis, policy lookup) exposed via orchestrator. | Tools validated with property tests; outputs cached; docs updated. |
|
||||
| AIAI-31-004 | TODO | Advisory AI Guild | AIAI-31-001..003, AUTH-VULN-29-001 | Build orchestration pipeline for Summary/Conflict/Remediation tasks (prompt templates, tool calls, token budgets, caching). | Pipeline executes tasks deterministically; caches keyed by tuple+policy; integration tests cover tasks. |
|
||||
| AIAI-31-005 | TODO | Advisory AI Guild, Security Guild | AIAI-31-004 | Implement guardrails (redaction, injection defense, output validation, citation enforcement) and fail-safe handling. | Guardrails block adversarial inputs; output validator enforces schemas; security tests pass. |
|
||||
| AIAI-31-006 | TODO | Advisory AI Guild | AIAI-31-004..005 | Expose REST API endpoints (`/advisory/ai/*`) with RBAC, rate limits, OpenAPI schemas, and batching support. | Endpoints deployed with schema validation; rate limits enforced; integration tests cover error codes. |
|
||||
| AIAI-31-007 | TODO | Advisory AI Guild, Observability Guild | AIAI-31-004..006 | Instrument metrics (`advisory_ai_latency`, `guardrail_blocks`, `validation_failures`, `citation_coverage`), logs, and traces; publish dashboards/alerts. | Telemetry live; dashboards approved; alerts configured. |
|
||||
| AIAI-31-008 | TODO | Advisory AI Guild, DevOps Guild | AIAI-31-006..007 | Package inference on-prem container, remote inference toggle, Helm/Compose manifests, scaling guidance, offline kit instructions. | Deployment docs merged; smoke deploy executed; offline kit updated; feature flags documented. |
|
||||
| AIAI-31-009 | TODO | Advisory AI Guild, QA Guild | AIAI-31-001..006 | Develop unit/golden/property/perf tests, injection harness, and regression suite; ensure determinism with seeded caches. | Test suite green; golden outputs stored; injection tests pass; perf targets documented. |
|
||||
# Advisory AI Task Board — Epic 8
|
||||
| ID | Status | Owner(s) | Depends on | Description | Exit Criteria |
|
||||
|----|--------|----------|------------|-------------|---------------|
|
||||
| AIAI-31-001 | DONE (2025-11-02) | Advisory AI Guild | CONCELIER-VULN-29-001, EXCITITOR-VULN-29-001 | Implement structured and vector retrievers for advisories/VEX with paragraph anchors and citation metadata. | Retrievers return deterministic chunks with source IDs/sections; unit tests cover CSAF/OSV/vendor formats. |
|
||||
| AIAI-31-002 | DOING | Advisory AI Guild, SBOM Service Guild | SBOM-VULN-29-001 | Build SBOM context retriever (purl version timelines, dependency paths, env flags, blast radius estimator). | Retriever returns paths/metrics under SLA; tests cover ecosystems. |
|
||||
| AIAI-31-003 | TODO | Advisory AI Guild | AIAI-31-001..002 | Implement deterministic toolset (version comparators, range checks, dependency analysis, policy lookup) exposed via orchestrator. | Tools validated with property tests; outputs cached; docs updated. |
|
||||
| AIAI-31-004 | TODO | Advisory AI Guild | AIAI-31-001..003, AUTH-VULN-29-001 | Build orchestration pipeline for Summary/Conflict/Remediation tasks (prompt templates, tool calls, token budgets, caching). | Pipeline executes tasks deterministically; caches keyed by tuple+policy; integration tests cover tasks. |
|
||||
| AIAI-31-005 | TODO | Advisory AI Guild, Security Guild | AIAI-31-004 | Implement guardrails (redaction, injection defense, output validation, citation enforcement) and fail-safe handling. | Guardrails block adversarial inputs; output validator enforces schemas; security tests pass. |
|
||||
| AIAI-31-006 | TODO | Advisory AI Guild | AIAI-31-004..005 | Expose REST API endpoints (`/advisory/ai/*`) with RBAC, rate limits, OpenAPI schemas, and batching support. | Endpoints deployed with schema validation; rate limits enforced; integration tests cover error codes. |
|
||||
| AIAI-31-007 | TODO | Advisory AI Guild, Observability Guild | AIAI-31-004..006 | Instrument metrics (`advisory_ai_latency`, `guardrail_blocks`, `validation_failures`, `citation_coverage`), logs, and traces; publish dashboards/alerts. | Telemetry live; dashboards approved; alerts configured. |
|
||||
| AIAI-31-008 | TODO | Advisory AI Guild, DevOps Guild | AIAI-31-006..007 | Package inference on-prem container, remote inference toggle, Helm/Compose manifests, scaling guidance, offline kit instructions. | Deployment docs merged; smoke deploy executed; offline kit updated; feature flags documented. |
|
||||
| AIAI-31-010 | DONE (2025-11-02) | Advisory AI Guild | CONCELIER-VULN-29-001, EXCITITOR-VULN-29-001 | Implement Concelier advisory raw document provider mapping CSAF/OSV payloads into structured chunks for retrieval. | Provider resolves content format, preserves metadata, and passes unit tests covering CSAF/OSV cases. |
|
||||
| AIAI-31-011 | DONE (2025-11-02) | Advisory AI Guild | EXCITITOR-LNM-21-201, EXCITITOR-CORE-AOC-19-002 | Implement Excititor VEX document provider to surface structured VEX statements for vector retrieval. | Provider returns conflict-aware VEX chunks with deterministic metadata and tests for representative statements. |
|
||||
| AIAI-31-009 | TODO | Advisory AI Guild, QA Guild | AIAI-31-001..006 | Develop unit/golden/property/perf tests, injection harness, and regression suite; ensure determinism with seeded caches. | Test suite green; golden outputs stored; injection tests pass; perf targets documented. |
|
||||
|
||||
> 2025-11-02: AIAI-31-002 – SBOM context domain models finalized with limiter guards; retriever tests now cover flag toggles and path dedupe. Service client integration still pending with SBOM guild.
|
||||
|
||||
@@ -0,0 +1,77 @@
|
||||
using System.Buffers;
|
||||
using System.Security.Cryptography;
|
||||
using System.Text;
|
||||
using System.Text.RegularExpressions;
|
||||
|
||||
namespace StellaOps.AdvisoryAI.Vectorization;
|
||||
|
||||
internal interface IVectorEncoder
|
||||
{
|
||||
float[] Encode(string text);
|
||||
}
|
||||
|
||||
internal sealed class DeterministicHashVectorEncoder : IVectorEncoder, IDisposable
|
||||
{
|
||||
private const int DefaultDimensions = 64;
|
||||
private static readonly Regex TokenRegex = new("[A-Za-z0-9]+", RegexOptions.Compiled | RegexOptions.CultureInvariant);
|
||||
private readonly IncrementalHash _hash;
|
||||
private readonly int _dimensions;
|
||||
|
||||
public DeterministicHashVectorEncoder(int dimensions = DefaultDimensions)
|
||||
{
|
||||
if (dimensions <= 0)
|
||||
{
|
||||
throw new ArgumentOutOfRangeException(nameof(dimensions));
|
||||
}
|
||||
|
||||
_dimensions = dimensions;
|
||||
_hash = IncrementalHash.CreateHash(HashAlgorithmName.SHA256);
|
||||
}
|
||||
|
||||
public float[] Encode(string text)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(text);
|
||||
|
||||
var vector = new float[_dimensions];
|
||||
var tokenMatches = TokenRegex.Matches(text);
|
||||
if (tokenMatches.Count == 0)
|
||||
{
|
||||
return vector;
|
||||
}
|
||||
|
||||
Span<byte> hash = stackalloc byte[32];
|
||||
|
||||
foreach (Match match in tokenMatches)
|
||||
{
|
||||
var token = match.Value.ToLowerInvariant();
|
||||
var bytes = Encoding.UTF8.GetBytes(token);
|
||||
_hash.AppendData(bytes);
|
||||
_hash.GetHashAndReset(hash);
|
||||
var index = (int)(BitConverter.ToUInt32(hash[..4]) % (uint)_dimensions);
|
||||
vector[index] += 1f;
|
||||
}
|
||||
|
||||
Normalize(vector);
|
||||
return vector;
|
||||
}
|
||||
|
||||
private static void Normalize(float[] vector)
|
||||
{
|
||||
var sumSquares = vector.Sum(v => v * v);
|
||||
if (sumSquares <= 0f)
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
var length = MathF.Sqrt(sumSquares);
|
||||
for (var i = 0; i < vector.Length; i++)
|
||||
{
|
||||
vector[i] /= length;
|
||||
}
|
||||
}
|
||||
|
||||
public void Dispose()
|
||||
{
|
||||
_hash.Dispose();
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,142 @@
|
||||
using System.Text.Json;
|
||||
using FluentAssertions;
|
||||
using Microsoft.Extensions.Logging.Abstractions;
|
||||
using StellaOps.AdvisoryAI.Abstractions;
|
||||
using StellaOps.AdvisoryAI.Chunking;
|
||||
using StellaOps.AdvisoryAI.Documents;
|
||||
using StellaOps.AdvisoryAI.Retrievers;
|
||||
using Xunit;
|
||||
|
||||
namespace StellaOps.AdvisoryAI.Tests;
|
||||
|
||||
public sealed class AdvisoryStructuredRetrieverTests
|
||||
{
|
||||
[Fact]
|
||||
public async Task RetrieveAsync_ReturnsCsafChunksWithMetadata()
|
||||
{
|
||||
var provider = CreateProvider(
|
||||
"test-advisory",
|
||||
AdvisoryDocument.Create(
|
||||
"CSA-2024-0001",
|
||||
DocumentFormat.Csaf,
|
||||
"csaf",
|
||||
await LoadAsync("sample-csaf.json")));
|
||||
|
||||
var retriever = CreateRetriever(provider);
|
||||
var result = await retriever.RetrieveAsync(new AdvisoryRetrievalRequest("test-advisory"), CancellationToken.None);
|
||||
|
||||
result.Chunks.Should().NotBeEmpty();
|
||||
result.Chunks.Should().HaveCountGreaterThan(4);
|
||||
result.Chunks.Select(c => c.ChunkId).Should().BeInAscendingOrder();
|
||||
result.Chunks.All(c => c.Metadata["format"] == "csaf").Should().BeTrue();
|
||||
result.Chunks.Any(c => c.Section == "vulnerabilities.remediations").Should().BeTrue();
|
||||
result.Chunks.Any(c => c.Section == "document.notes").Should().BeTrue();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task RetrieveAsync_ReturnsOsvChunksWithAffectedMetadata()
|
||||
{
|
||||
var provider = CreateProvider(
|
||||
"osv-advisory",
|
||||
AdvisoryDocument.Create(
|
||||
"OSV-2024-0001",
|
||||
DocumentFormat.Osv,
|
||||
"osv",
|
||||
await LoadAsync("sample-osv.json")));
|
||||
|
||||
var retriever = CreateRetriever(provider);
|
||||
var result = await retriever.RetrieveAsync(new AdvisoryRetrievalRequest("osv-advisory"), CancellationToken.None);
|
||||
|
||||
result.Chunks.Should().NotBeEmpty();
|
||||
result.Chunks.Should().ContainSingle(c => c.Section == "summary");
|
||||
result.Chunks.Should().Contain(c => c.Section == "affected.ranges");
|
||||
result.Chunks.First(c => c.Section == "affected.ranges").Metadata.Should().ContainKey("package");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task RetrieveAsync_ReturnsOpenVexChunksWithStatusMetadata()
|
||||
{
|
||||
var provider = CreateProvider(
|
||||
"openvex-advisory",
|
||||
AdvisoryDocument.Create(
|
||||
"OPENVEX-2024-0001",
|
||||
DocumentFormat.OpenVex,
|
||||
"exc-provider",
|
||||
await LoadAsync("sample-openvex.json")));
|
||||
|
||||
var retriever = CreateRetriever(provider);
|
||||
var result = await retriever.RetrieveAsync(new AdvisoryRetrievalRequest("openvex-advisory"), CancellationToken.None);
|
||||
|
||||
result.Chunks.Should().HaveCount(2);
|
||||
result.Chunks.Select(c => c.Metadata["status"]).Should().Contain(new[] { "not_affected", "affected" });
|
||||
result.Chunks.First().Metadata.Should().ContainKey("justification");
|
||||
result.Chunks.Should().AllSatisfy(chunk => chunk.Section.Should().Be("vex.statements"));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task RetrieveAsync_FiltersToPreferredSections()
|
||||
{
|
||||
var provider = CreateProvider(
|
||||
"markdown-advisory",
|
||||
AdvisoryDocument.Create(
|
||||
"VENDOR-2024-0001",
|
||||
DocumentFormat.Markdown,
|
||||
"vendor",
|
||||
await LoadAsync("sample-vendor.md")));
|
||||
|
||||
var retriever = CreateRetriever(provider);
|
||||
var request = new AdvisoryRetrievalRequest(
|
||||
"markdown-advisory",
|
||||
PreferredSections: new[] { "Impact" });
|
||||
|
||||
var result = await retriever.RetrieveAsync(request, CancellationToken.None);
|
||||
|
||||
result.Chunks.Should().NotBeEmpty();
|
||||
result.Chunks.Should().OnlyContain(chunk => chunk.Section.StartsWith("Impact", StringComparison.Ordinal));
|
||||
}
|
||||
|
||||
private static AdvisoryStructuredRetriever CreateRetriever(IAdvisoryDocumentProvider provider)
|
||||
{
|
||||
var chunkers = new IDocumentChunker[]
|
||||
{
|
||||
new CsafDocumentChunker(),
|
||||
new OsvDocumentChunker(),
|
||||
new MarkdownDocumentChunker(),
|
||||
new OpenVexDocumentChunker(),
|
||||
};
|
||||
|
||||
return new AdvisoryStructuredRetriever(provider, chunkers, NullLogger<AdvisoryStructuredRetriever>.Instance);
|
||||
}
|
||||
|
||||
private static async Task<string> LoadAsync(string fileName)
|
||||
{
|
||||
var path = Path.Combine(AppContext.BaseDirectory, "TestData", fileName);
|
||||
return await File.ReadAllTextAsync(path);
|
||||
}
|
||||
|
||||
private static IAdvisoryDocumentProvider CreateProvider(string key, params AdvisoryDocument[] documents)
|
||||
=> new InMemoryAdvisoryDocumentProvider(new Dictionary<string, IReadOnlyList<AdvisoryDocument>>(StringComparer.Ordinal)
|
||||
{
|
||||
[key] = documents,
|
||||
});
|
||||
|
||||
private sealed class InMemoryAdvisoryDocumentProvider : IAdvisoryDocumentProvider
|
||||
{
|
||||
private readonly IReadOnlyDictionary<string, IReadOnlyList<AdvisoryDocument>> _documents;
|
||||
|
||||
public InMemoryAdvisoryDocumentProvider(IReadOnlyDictionary<string, IReadOnlyList<AdvisoryDocument>> documents)
|
||||
{
|
||||
_documents = documents;
|
||||
}
|
||||
|
||||
public Task<IReadOnlyList<AdvisoryDocument>> GetDocumentsAsync(string advisoryKey, CancellationToken cancellationToken)
|
||||
{
|
||||
if (_documents.TryGetValue(advisoryKey, out var documents))
|
||||
{
|
||||
return Task.FromResult(documents);
|
||||
}
|
||||
|
||||
return Task.FromResult<IReadOnlyList<AdvisoryDocument>>(Array.Empty<AdvisoryDocument>());
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,82 @@
|
||||
using FluentAssertions;
|
||||
using StellaOps.AdvisoryAI.Abstractions;
|
||||
using StellaOps.AdvisoryAI.Chunking;
|
||||
using StellaOps.AdvisoryAI.Documents;
|
||||
using StellaOps.AdvisoryAI.Retrievers;
|
||||
using StellaOps.AdvisoryAI.Vectorization;
|
||||
using Xunit;
|
||||
|
||||
namespace StellaOps.AdvisoryAI.Tests;
|
||||
|
||||
public sealed class AdvisoryVectorRetrieverTests
|
||||
{
|
||||
[Fact]
|
||||
public async Task SearchAsync_ReturnsBestMatchingChunk()
|
||||
{
|
||||
var advisoryContent = """
|
||||
# Advisory
|
||||
|
||||
## Impact
|
||||
The vulnerability allows remote attackers to execute arbitrary code.
|
||||
|
||||
## Remediation
|
||||
Update to version 2.1.3 or later and restart the service.
|
||||
""";
|
||||
|
||||
var provider = new InMemoryAdvisoryDocumentProvider(new Dictionary<string, IReadOnlyList<AdvisoryDocument>>(StringComparer.Ordinal)
|
||||
{
|
||||
["adv"] = new[]
|
||||
{
|
||||
AdvisoryDocument.Create("VENDOR-1", DocumentFormat.Markdown, "vendor", advisoryContent)
|
||||
}
|
||||
});
|
||||
|
||||
var structuredRetriever = new AdvisoryStructuredRetriever(
|
||||
provider,
|
||||
new IDocumentChunker[]
|
||||
{
|
||||
new CsafDocumentChunker(),
|
||||
new OsvDocumentChunker(),
|
||||
new MarkdownDocumentChunker(),
|
||||
});
|
||||
|
||||
using var encoder = new DeterministicHashVectorEncoder();
|
||||
var vectorRetriever = new AdvisoryVectorRetriever(structuredRetriever, encoder);
|
||||
|
||||
var matches = await vectorRetriever.SearchAsync(
|
||||
new VectorRetrievalRequest(
|
||||
new AdvisoryRetrievalRequest("adv"),
|
||||
Query: "How do I remediate the vulnerability?",
|
||||
TopK: 1),
|
||||
CancellationToken.None);
|
||||
|
||||
matches.Should().HaveCount(1);
|
||||
matches[0].Section().Should().Be("Remediation");
|
||||
}
|
||||
}
|
||||
|
||||
file static class VectorRetrievalMatchExtensions
|
||||
{
|
||||
public static string Section(this VectorRetrievalMatch match)
|
||||
=> match.Metadata.TryGetValue("section", out var value) ? value : string.Empty;
|
||||
}
|
||||
|
||||
file sealed class InMemoryAdvisoryDocumentProvider : IAdvisoryDocumentProvider
|
||||
{
|
||||
private readonly IReadOnlyDictionary<string, IReadOnlyList<AdvisoryDocument>> _documents;
|
||||
|
||||
public InMemoryAdvisoryDocumentProvider(IReadOnlyDictionary<string, IReadOnlyList<AdvisoryDocument>> documents)
|
||||
{
|
||||
_documents = documents;
|
||||
}
|
||||
|
||||
public Task<IReadOnlyList<AdvisoryDocument>> GetDocumentsAsync(string advisoryKey, CancellationToken cancellationToken)
|
||||
{
|
||||
if (_documents.TryGetValue(advisoryKey, out var documents))
|
||||
{
|
||||
return Task.FromResult(documents);
|
||||
}
|
||||
|
||||
return Task.FromResult<IReadOnlyList<AdvisoryDocument>>(Array.Empty<AdvisoryDocument>());
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,75 @@
|
||||
using System.Collections.Immutable;
|
||||
using System.Text.Json;
|
||||
using FluentAssertions;
|
||||
using Microsoft.Extensions.Logging.Abstractions;
|
||||
using Microsoft.Extensions.Options;
|
||||
using StellaOps.AdvisoryAI.Providers;
|
||||
using StellaOps.Concelier.Core.Raw;
|
||||
using StellaOps.Concelier.RawModels;
|
||||
using Xunit;
|
||||
|
||||
namespace StellaOps.AdvisoryAI.Tests;
|
||||
|
||||
public sealed class ConcelierAdvisoryDocumentProviderTests
|
||||
{
|
||||
[Fact]
|
||||
public async Task GetDocumentsAsync_ReturnsMappedDocuments()
|
||||
{
|
||||
var rawDocument = RawDocumentFactory.CreateAdvisory(
|
||||
tenant: "tenant-a",
|
||||
source: new RawSourceMetadata("vendor-a", "connector", "1.0"),
|
||||
upstream: new RawUpstreamMetadata(
|
||||
"UP-1",
|
||||
"1",
|
||||
DateTimeOffset.UtcNow,
|
||||
"hash-123",
|
||||
new RawSignatureMetadata(false),
|
||||
ImmutableDictionary<string, string>.Empty),
|
||||
content: new RawContent("csaf", "2.0", JsonDocument.Parse("{\"document\": {\"notes\": []}, \"vulnerabilities\": []}").RootElement),
|
||||
identifiers: new RawIdentifiers(ImmutableArray<string>.Empty, "UP-1"),
|
||||
linkset: new RawLinkset());
|
||||
|
||||
var records = new[]
|
||||
{
|
||||
new AdvisoryRawRecord("id-1", rawDocument, DateTimeOffset.UtcNow, DateTimeOffset.UtcNow)
|
||||
};
|
||||
|
||||
var service = new FakeAdvisoryRawService(records);
|
||||
var provider = new ConcelierAdvisoryDocumentProvider(
|
||||
service,
|
||||
Options.Create(new ConcelierAdvisoryDocumentProviderOptions
|
||||
{
|
||||
Tenant = "tenant-a",
|
||||
MaxDocuments = 5,
|
||||
}),
|
||||
NullLogger<ConcelierAdvisoryDocumentProvider>.Instance);
|
||||
|
||||
var results = await provider.GetDocumentsAsync("UP-1", CancellationToken.None);
|
||||
|
||||
results.Should().HaveCount(1);
|
||||
results[0].Format.Should().Be(Documents.DocumentFormat.Csaf);
|
||||
results[0].Source.Should().Be("vendor-a");
|
||||
}
|
||||
|
||||
private sealed class FakeAdvisoryRawService : IAdvisoryRawService
|
||||
{
|
||||
private readonly IReadOnlyList<AdvisoryRawRecord> _records;
|
||||
|
||||
public FakeAdvisoryRawService(IReadOnlyList<AdvisoryRawRecord> records)
|
||||
{
|
||||
_records = records;
|
||||
}
|
||||
|
||||
public Task<AdvisoryRawRecord?> FindByIdAsync(string tenant, string id, CancellationToken cancellationToken)
|
||||
=> Task.FromResult<AdvisoryRawRecord?>(null);
|
||||
|
||||
public Task<AdvisoryRawUpsertResult> IngestAsync(AdvisoryRawDocument document, CancellationToken cancellationToken)
|
||||
=> throw new NotImplementedException();
|
||||
|
||||
public Task<AdvisoryRawQueryResult> QueryAsync(AdvisoryRawQueryOptions options, CancellationToken cancellationToken)
|
||||
=> Task.FromResult(new AdvisoryRawQueryResult(_records, nextCursor: null, hasMore: false));
|
||||
|
||||
public Task<AdvisoryRawVerificationResult> VerifyAsync(AdvisoryRawVerificationRequest request, CancellationToken cancellationToken)
|
||||
=> throw new NotImplementedException();
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,148 @@
|
||||
using System.Collections.Immutable;
|
||||
using System.Text.Json.Nodes;
|
||||
using FluentAssertions;
|
||||
using Microsoft.Extensions.Logging.Abstractions;
|
||||
using Microsoft.Extensions.Options;
|
||||
using StellaOps.AdvisoryAI.Documents;
|
||||
using StellaOps.AdvisoryAI.Providers;
|
||||
using StellaOps.Excititor.Core;
|
||||
using StellaOps.Excititor.Core.Observations;
|
||||
using Xunit;
|
||||
|
||||
namespace StellaOps.AdvisoryAI.Tests;
|
||||
|
||||
public sealed class ExcititorVexDocumentProviderTests
|
||||
{
|
||||
[Fact]
|
||||
public async Task GetDocumentsAsync_ReturnsMappedObservation()
|
||||
{
|
||||
const string vulnerabilityId = "CVE-2024-9999";
|
||||
const string productKey = "product-key";
|
||||
const string packageUrl = "pkg:docker/sample@1.0.0";
|
||||
const string cpe = "cpe:/a:sample:service";
|
||||
const string providerId = "exc-provider";
|
||||
const string tenantId = "tenant-a";
|
||||
|
||||
var observation = CreateObservation(vulnerabilityId, productKey, packageUrl, cpe, providerId, tenantId);
|
||||
var aggregate = new VexObservationAggregate(
|
||||
ImmutableArray.Create(vulnerabilityId),
|
||||
ImmutableArray.Create(productKey),
|
||||
ImmutableArray.Create(packageUrl),
|
||||
ImmutableArray.Create(cpe),
|
||||
ImmutableArray<VexObservationReference>.Empty,
|
||||
ImmutableArray.Create(providerId));
|
||||
|
||||
var queryResult = new VexObservationQueryResult(
|
||||
ImmutableArray.Create(observation),
|
||||
aggregate,
|
||||
NextCursor: null,
|
||||
HasMore: false);
|
||||
|
||||
var service = new FakeVexObservationQueryService(queryResult);
|
||||
var provider = new ExcititorVexDocumentProvider(
|
||||
service,
|
||||
Options.Create(new ExcititorVexDocumentProviderOptions
|
||||
{
|
||||
Tenant = tenantId,
|
||||
MaxObservations = 5,
|
||||
ProviderIds = ImmutableArray.Create(providerId),
|
||||
Statuses = ImmutableArray.Create(VexClaimStatus.NotAffected),
|
||||
}),
|
||||
NullLogger<ExcititorVexDocumentProvider>.Instance);
|
||||
|
||||
var documents = await provider.GetDocumentsAsync(vulnerabilityId, CancellationToken.None);
|
||||
|
||||
documents.Should().HaveCount(1);
|
||||
var document = documents[0];
|
||||
document.DocumentId.Should().Be("obs-1");
|
||||
document.Format.Should().Be(DocumentFormat.OpenVex);
|
||||
document.Source.Should().Be(providerId);
|
||||
document.Metadata.Should().ContainKey("status_counts");
|
||||
document.Metadata["status_counts"].Should().Be("not_affected:1");
|
||||
document.Metadata.Should().ContainKey("aliases");
|
||||
|
||||
service.LastOptions.Should().NotBeNull();
|
||||
service.LastOptions!.Tenant.Should().Be(tenantId);
|
||||
service.LastOptions.ProviderIds.Should().ContainSingle().Which.Should().Be(providerId);
|
||||
service.LastOptions.Statuses.Should().ContainSingle(VexClaimStatus.NotAffected);
|
||||
service.LastOptions.VulnerabilityIds.Should().Contain(vulnerabilityId);
|
||||
service.LastOptions.Limit.Should().Be(5);
|
||||
}
|
||||
|
||||
private static VexObservation CreateObservation(
|
||||
string vulnerabilityId,
|
||||
string productKey,
|
||||
string packageUrl,
|
||||
string cpe,
|
||||
string providerId,
|
||||
string tenantId)
|
||||
{
|
||||
var upstream = new VexObservationUpstream(
|
||||
"VEX-1",
|
||||
1,
|
||||
DateTimeOffset.Parse("2025-10-10T08:00:00Z"),
|
||||
DateTimeOffset.Parse("2025-10-10T08:05:00Z"),
|
||||
"hash-abc123",
|
||||
new VexObservationSignature(true, "dsse", "key-1", "signature"));
|
||||
|
||||
var evidence = ImmutableArray.Create<JsonNode>(JsonNode.Parse("{\"note\":\"deterministic\"}")!);
|
||||
|
||||
var statement = new VexObservationStatement(
|
||||
vulnerabilityId,
|
||||
productKey,
|
||||
VexClaimStatus.NotAffected,
|
||||
DateTimeOffset.Parse("2025-10-10T08:00:00Z"),
|
||||
locator: "selector",
|
||||
justification: VexJustification.ComponentNotPresent,
|
||||
introducedVersion: null,
|
||||
fixedVersion: null,
|
||||
purl: packageUrl,
|
||||
cpe: cpe,
|
||||
evidence: evidence,
|
||||
metadata: ImmutableDictionary<string, string>.Empty);
|
||||
|
||||
var content = new VexObservationContent(
|
||||
"openvex",
|
||||
"0.2",
|
||||
JsonNode.Parse("{\"statements\":[{\"status\":\"not_affected\"}]}")!);
|
||||
|
||||
var linkset = new VexObservationLinkset(
|
||||
aliases: new[] { vulnerabilityId },
|
||||
purls: new[] { packageUrl },
|
||||
cpes: new[] { cpe },
|
||||
references: null);
|
||||
|
||||
return new VexObservation(
|
||||
"obs-1",
|
||||
tenantId,
|
||||
providerId,
|
||||
"default",
|
||||
upstream,
|
||||
ImmutableArray.Create(statement),
|
||||
content,
|
||||
linkset,
|
||||
DateTimeOffset.Parse("2025-10-11T09:00:00Z"),
|
||||
supersedes: ImmutableArray<string>.Empty,
|
||||
attributes: ImmutableDictionary<string, string>.Empty);
|
||||
}
|
||||
|
||||
private sealed class FakeVexObservationQueryService : IVexObservationQueryService
|
||||
{
|
||||
private readonly VexObservationQueryResult _result;
|
||||
|
||||
public FakeVexObservationQueryService(VexObservationQueryResult result)
|
||||
{
|
||||
_result = result;
|
||||
}
|
||||
|
||||
public VexObservationQueryOptions? LastOptions { get; private set; }
|
||||
|
||||
public ValueTask<VexObservationQueryResult> QueryAsync(
|
||||
VexObservationQueryOptions options,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
LastOptions = options;
|
||||
return ValueTask.FromResult(_result);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
using FluentAssertions;
|
||||
using StellaOps.AdvisoryAI.Abstractions;
|
||||
using Xunit;
|
||||
|
||||
namespace StellaOps.AdvisoryAI.Tests;
|
||||
|
||||
public sealed class SbomContextRequestTests
|
||||
{
|
||||
[Fact]
|
||||
public void Constructor_NormalizesWhitespaceAndLimits()
|
||||
{
|
||||
var request = new SbomContextRequest(
|
||||
artifactId: " scan-42 ",
|
||||
purl: " pkg:docker/sample@1.2.3 ",
|
||||
maxTimelineEntries: 600,
|
||||
maxDependencyPaths: -5,
|
||||
includeEnvironmentFlags: false,
|
||||
includeBlastRadius: false);
|
||||
|
||||
request.ArtifactId.Should().Be("scan-42");
|
||||
request.Purl.Should().Be("pkg:docker/sample@1.2.3");
|
||||
request.MaxTimelineEntries.Should().Be(SbomContextRequest.TimelineLimitCeiling);
|
||||
request.MaxDependencyPaths.Should().Be(0);
|
||||
request.IncludeEnvironmentFlags.Should().BeFalse();
|
||||
request.IncludeBlastRadius.Should().BeFalse();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Constructor_AllowsNullPurlAndDefaults()
|
||||
{
|
||||
var request = new SbomContextRequest(artifactId: "scan-123", purl: null);
|
||||
|
||||
request.Purl.Should().BeNull();
|
||||
request.MaxTimelineEntries.Should().BeGreaterThan(0);
|
||||
request.MaxDependencyPaths.Should().BeGreaterThan(0);
|
||||
request.IncludeEnvironmentFlags.Should().BeTrue();
|
||||
request.IncludeBlastRadius.Should().BeTrue();
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,212 @@
|
||||
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.Collections.Immutable;
|
||||
using System.Linq;
|
||||
using System.Threading;
|
||||
using System.Threading.Tasks;
|
||||
using FluentAssertions;
|
||||
using StellaOps.AdvisoryAI.Abstractions;
|
||||
using StellaOps.AdvisoryAI.Context;
|
||||
using StellaOps.AdvisoryAI.Providers;
|
||||
using StellaOps.AdvisoryAI.Retrievers;
|
||||
using Xunit;
|
||||
|
||||
namespace StellaOps.AdvisoryAI.Tests;
|
||||
|
||||
public sealed class SbomContextRetrieverTests
|
||||
{
|
||||
[Fact]
|
||||
public async Task RetrieveAsync_ReturnsDeterministicOrderingAndMetadata()
|
||||
{
|
||||
var document = new SbomContextDocument(
|
||||
"artifact-123",
|
||||
"pkg:docker/sample@1.0.0",
|
||||
ImmutableArray.Create(
|
||||
new SbomVersionRecord(
|
||||
"1.0.1",
|
||||
new DateTimeOffset(2025, 10, 15, 12, 0, 0, TimeSpan.Zero),
|
||||
null,
|
||||
"affected",
|
||||
"scanner",
|
||||
false,
|
||||
ImmutableDictionary<string, string>.Empty),
|
||||
new SbomVersionRecord(
|
||||
"1.0.0",
|
||||
new DateTimeOffset(2025, 9, 10, 8, 0, 0, TimeSpan.Zero),
|
||||
new DateTimeOffset(2025, 10, 15, 11, 0, 0, TimeSpan.Zero),
|
||||
"fixed",
|
||||
"inventory",
|
||||
true,
|
||||
ImmutableDictionary<string, string>.Empty)),
|
||||
ImmutableArray.Create(
|
||||
new SbomDependencyPathRecord(
|
||||
ImmutableArray.Create(
|
||||
new SbomDependencyNodeRecord("app", "1.0.0"),
|
||||
new SbomDependencyNodeRecord("lib-a", "2.1.3"),
|
||||
new SbomDependencyNodeRecord("lib-b", "3.4.5")),
|
||||
true,
|
||||
"runtime",
|
||||
ImmutableDictionary<string, string>.Empty),
|
||||
new SbomDependencyPathRecord(
|
||||
ImmutableArray.Create(
|
||||
new SbomDependencyNodeRecord("app", "1.0.0"),
|
||||
new SbomDependencyNodeRecord("test-helper", "0.9.0")),
|
||||
false,
|
||||
"dev",
|
||||
ImmutableDictionary<string, string>.Empty),
|
||||
new SbomDependencyPathRecord(
|
||||
ImmutableArray.Create(
|
||||
new SbomDependencyNodeRecord("app", "1.0.0"),
|
||||
new SbomDependencyNodeRecord("lib-a", "2.1.3"),
|
||||
new SbomDependencyNodeRecord("lib-b", "3.4.5")),
|
||||
true,
|
||||
"runtime",
|
||||
ImmutableDictionary<string, string>.Empty)),
|
||||
ImmutableDictionary.CreateRange(new[]
|
||||
{
|
||||
new KeyValuePair<string, string>("environment/prod", "true"),
|
||||
new KeyValuePair<string, string>("environment/dev", "false"),
|
||||
}),
|
||||
new SbomBlastRadiusRecord(
|
||||
12,
|
||||
8,
|
||||
4,
|
||||
0.25,
|
||||
ImmutableDictionary<string, string>.Empty),
|
||||
ImmutableDictionary<string, string>.Empty);
|
||||
|
||||
var client = new FakeSbomContextClient(document);
|
||||
var retriever = new SbomContextRetriever(client);
|
||||
|
||||
var request = new SbomContextRequest(
|
||||
artifactId: "artifact-123",
|
||||
purl: "pkg:docker/sample@1.0.0",
|
||||
maxTimelineEntries: 2,
|
||||
maxDependencyPaths: 2);
|
||||
|
||||
var result = await retriever.RetrieveAsync(request, CancellationToken.None);
|
||||
|
||||
result.ArtifactId.Should().Be("artifact-123");
|
||||
result.Purl.Should().Be("pkg:docker/sample@1.0.0");
|
||||
result.VersionTimeline.Select(v => v.Version).Should().ContainInOrder("1.0.0", "1.0.1");
|
||||
result.DependencyPaths.Should().HaveCount(2);
|
||||
result.DependencyPaths.First().IsRuntime.Should().BeTrue();
|
||||
result.DependencyPaths.First().Nodes.Select(n => n.Identifier).Should().Equal("app", "lib-a", "lib-b");
|
||||
result.EnvironmentFlags.Keys.Should().Equal(new[] { "environment/dev", "environment/prod" });
|
||||
result.EnvironmentFlags["environment/prod"].Should().Be("true");
|
||||
result.BlastRadius.Should().NotBeNull();
|
||||
result.BlastRadius!.ImpactedAssets.Should().Be(12);
|
||||
result.Metadata["version_count"].Should().Be("2");
|
||||
result.Metadata["dependency_path_count"].Should().Be("2");
|
||||
result.Metadata["environment_flag_count"].Should().Be("2");
|
||||
result.Metadata["blast_radius_present"].Should().Be(bool.TrueString);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task RetrieveAsync_ReturnsEmptyWhenNoDocument()
|
||||
{
|
||||
var client = new FakeSbomContextClient(null);
|
||||
var retriever = new SbomContextRetriever(client);
|
||||
|
||||
var request = new SbomContextRequest("missing-artifact");
|
||||
var result = await retriever.RetrieveAsync(request, CancellationToken.None);
|
||||
|
||||
result.ArtifactId.Should().Be("missing-artifact");
|
||||
result.VersionTimeline.Should().BeEmpty();
|
||||
result.DependencyPaths.Should().BeEmpty();
|
||||
result.EnvironmentFlags.Should().BeEmpty();
|
||||
result.BlastRadius.Should().BeNull();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task RetrieveAsync_HonorsEnvironmentFlagToggle()
|
||||
{
|
||||
var document = new SbomContextDocument(
|
||||
"artifact-flag",
|
||||
null,
|
||||
ImmutableArray<SbomVersionRecord>.Empty,
|
||||
ImmutableArray<SbomDependencyPathRecord>.Empty,
|
||||
ImmutableDictionary.CreateRange(new[]
|
||||
{
|
||||
new KeyValuePair<string, string>("environment/prod", "true"),
|
||||
}),
|
||||
blastRadius: null,
|
||||
metadata: ImmutableDictionary<string, string>.Empty);
|
||||
|
||||
var client = new FakeSbomContextClient(document);
|
||||
var retriever = new SbomContextRetriever(client);
|
||||
|
||||
var request = new SbomContextRequest(
|
||||
artifactId: "artifact-flag",
|
||||
includeEnvironmentFlags: false,
|
||||
includeBlastRadius: false);
|
||||
|
||||
var result = await retriever.RetrieveAsync(request, CancellationToken.None);
|
||||
|
||||
result.EnvironmentFlags.Should().BeEmpty();
|
||||
result.Metadata["environment_flag_count"].Should().Be("0");
|
||||
|
||||
client.LastQuery.Should().NotBeNull();
|
||||
client.LastQuery!.IncludeEnvironmentFlags.Should().BeFalse();
|
||||
client.LastQuery.IncludeBlastRadius.Should().BeFalse();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task RetrieveAsync_DeduplicatesDependencyPaths()
|
||||
{
|
||||
var duplicatePath = ImmutableArray.Create(
|
||||
new SbomDependencyNodeRecord("app", "1.0.0"),
|
||||
new SbomDependencyNodeRecord("lib-a", "2.0.0"));
|
||||
|
||||
var document = new SbomContextDocument(
|
||||
"artifact-paths",
|
||||
null,
|
||||
ImmutableArray<SbomVersionRecord>.Empty,
|
||||
ImmutableArray.Create(
|
||||
new SbomDependencyPathRecord(duplicatePath, true, "runtime", ImmutableDictionary<string, string>.Empty),
|
||||
new SbomDependencyPathRecord(duplicatePath, true, "runtime", ImmutableDictionary<string, string>.Empty),
|
||||
new SbomDependencyPathRecord(
|
||||
ImmutableArray.Create(
|
||||
new SbomDependencyNodeRecord("app", "1.0.0"),
|
||||
new SbomDependencyNodeRecord("dev-tool", "0.1.0")),
|
||||
false,
|
||||
"dev",
|
||||
ImmutableDictionary<string, string>.Empty)),
|
||||
ImmutableDictionary<string, string>.Empty,
|
||||
blastRadius: null,
|
||||
metadata: ImmutableDictionary<string, string>.Empty);
|
||||
|
||||
var client = new FakeSbomContextClient(document);
|
||||
var retriever = new SbomContextRetriever(client);
|
||||
|
||||
var request = new SbomContextRequest(
|
||||
artifactId: "artifact-paths",
|
||||
maxDependencyPaths: 5);
|
||||
|
||||
var result = await retriever.RetrieveAsync(request, CancellationToken.None);
|
||||
|
||||
result.DependencyPaths.Should().HaveCount(2);
|
||||
result.DependencyPaths.First().IsRuntime.Should().BeTrue();
|
||||
result.DependencyPaths.Last().IsRuntime.Should().BeFalse();
|
||||
result.Metadata["dependency_path_count"].Should().Be("2");
|
||||
}
|
||||
|
||||
private sealed class FakeSbomContextClient : ISbomContextClient
|
||||
{
|
||||
private readonly SbomContextDocument? _document;
|
||||
|
||||
public FakeSbomContextClient(SbomContextDocument? document)
|
||||
{
|
||||
_document = document;
|
||||
}
|
||||
|
||||
public SbomContextQuery? LastQuery { get; private set; }
|
||||
|
||||
public Task<SbomContextDocument?> GetContextAsync(SbomContextQuery query, CancellationToken cancellationToken)
|
||||
{
|
||||
LastQuery = query;
|
||||
return Task.FromResult(_document);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,31 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project Sdk="Microsoft.NET.Sdk">
|
||||
<PropertyGroup>
|
||||
<TargetFramework>net10.0</TargetFramework>
|
||||
<LangVersion>preview</LangVersion>
|
||||
<IsPackable>false</IsPackable>
|
||||
<Nullable>enable</Nullable>
|
||||
<ImplicitUsings>enable</ImplicitUsings>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
|
||||
<PackageReference Include="xunit" Version="2.9.2" />
|
||||
<PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
|
||||
<PackageReference Include="FluentAssertions" Version="6.12.0" />
|
||||
<PackageReference Include="coverlet.collector" Version="6.0.4" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ProjectReference Include="..\..\StellaOps.AdvisoryAI\StellaOps.AdvisoryAI.csproj" />
|
||||
<ProjectReference Include="..\..\Concelier\__Libraries\StellaOps.Concelier.Core\StellaOps.Concelier.Core.csproj" />
|
||||
<ProjectReference Include="..\..\Concelier\__Libraries\StellaOps.Concelier.RawModels\StellaOps.Concelier.RawModels.csproj" />
|
||||
<ProjectReference Include="..\..\Excititor\__Libraries\StellaOps.Excititor.Core\StellaOps.Excititor.Core.csproj" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<None Update="TestData/*.json">
|
||||
<CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
|
||||
</None>
|
||||
<None Update="TestData/*.md">
|
||||
<CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
|
||||
</None>
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
@@ -0,0 +1,43 @@
|
||||
{
|
||||
"document": {
|
||||
"tracking": {
|
||||
"id": "CSA-2024-0001"
|
||||
},
|
||||
"notes": [
|
||||
{
|
||||
"category": "summary",
|
||||
"text": "The vendor has published guidance for CVE-2024-1234."
|
||||
},
|
||||
{
|
||||
"category": "description",
|
||||
"text": "Additional context for operators."
|
||||
},
|
||||
{
|
||||
"category": "other",
|
||||
"text": "This note should be ignored."
|
||||
}
|
||||
]
|
||||
},
|
||||
"vulnerabilities": [
|
||||
{
|
||||
"id": "CVE-2024-1234",
|
||||
"title": "Important vulnerability in component",
|
||||
"description": "Remote attackers may execute arbitrary code.",
|
||||
"notes": [
|
||||
{
|
||||
"category": "description",
|
||||
"text": "Applies to installations using default configuration."
|
||||
}
|
||||
],
|
||||
"remediations": [
|
||||
{
|
||||
"category": "mitigation",
|
||||
"details": "Apply patch level QFE-2024-11 or later.",
|
||||
"product_ids": [
|
||||
"pkg:deb/debian/component@1.2.3"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,30 @@
|
||||
{
|
||||
"openvex": "https://openvex.dev/ns/v0.2",
|
||||
"timestamp": "2025-10-15T12:00:00Z",
|
||||
"version": "1",
|
||||
"statements": [
|
||||
{
|
||||
"vulnerability": "CVE-2024-9999",
|
||||
"products": [
|
||||
{
|
||||
"product_id": "pkg:docker/sample@1.0.0"
|
||||
}
|
||||
],
|
||||
"status": "not_affected",
|
||||
"justification": "component_not_present",
|
||||
"impact_statement": "Component not shipped",
|
||||
"status_notes": "Distribution excludes this component",
|
||||
"timestamp": "2025-10-10T08:00:00Z",
|
||||
"last_updated": "2025-10-11T09:00:00Z"
|
||||
},
|
||||
{
|
||||
"vulnerability": "CVE-2024-8888",
|
||||
"products": [
|
||||
"component://sample/service"
|
||||
],
|
||||
"status": "affected",
|
||||
"status_notes": "Patch scheduled",
|
||||
"timestamp": "2025-10-12T13:30:00Z"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,33 @@
|
||||
{
|
||||
"id": "OSV-2024-0001",
|
||||
"summary": "Vulnerability in package affects multiple versions.",
|
||||
"details": "Remote attackers may exploit the issue under specific conditions.",
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"name": "example",
|
||||
"ecosystem": "npm"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "SEMVER",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"fixed": "1.2.3"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"versions": ["0.9.0", "1.0.0"]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://example.org/advisory"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,12 @@
|
||||
# Vendor Advisory 2024-01
|
||||
|
||||
Initial notice describing the vulnerability and affected platforms.
|
||||
|
||||
## Impact
|
||||
End-users may experience remote compromise when default credentials are unchanged.
|
||||
|
||||
## Remediation
|
||||
Apply hotfix package 2024.11.5 and rotate secrets within 24 hours.
|
||||
|
||||
## References
|
||||
- https://vendor.example.com/advisories/2024-01
|
||||
Reference in New Issue
Block a user