Skip to content

Feat/poam phase1 #338

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AKAbdulHanif wants to merge 28 commits into
base: main
Choose a base branch
from
Open

Feat/poam phase1 #338

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
28 commits
Select commit Hold shift + click to select a range
aa208db
feat(profile): add BuildByProps endpoint to profiles handler (local b…
AKAbdulHanif Jan 20, 2026
08fbeb2
feat(profile): accept kebab-case keys in BuildByProps request
AKAbdulHanif Jan 20, 2026
13402d1
feat(profile): BuildByProps creates import and back-matter; validates…
AKAbdulHanif Jan 21, 2026
c3b064f
fix(profile): persist import include-controls and back-matter resourc…
AKAbdulHanif Jan 21, 2026
58b3bda
fix(profile): avoid duplicate imports/back-matter; persist associatio…
AKAbdulHanif Jan 21, 2026
4fe715e
fix(profile): prevent duplicate include-controls groups by creating a…
AKAbdulHanif Jan 21, 2026
12bb414
test(api): add integration test for BuildByProps to assert import and…
AKAbdulHanif Jan 22, 2026
0a5078e
lint(api): fix error string casing and remove debug print in integrat…
AKAbdulHanif Jan 25, 2026
a71bdfd
ci(api): fix golangci-lint inputs; commit generated swagger docs to s…
AKAbdulHanif Jan 26, 2026
1239f6b
lint(api): use strings.EqualFold for case-insensitive prop name/ns co…
AKAbdulHanif Jan 26, 2026
dcd2b51
docs(api): define BuildByPropsRequest/Response types and regenerate s…
AKAbdulHanif Jan 27, 2026
85db390
feat(poam): Phase 1 foundation – models, CRUD, swagger
AKAbdulHanif Mar 4, 2026
44a2f04
docs(poam): add API design document
AKAbdulHanif Mar 4, 2026
86bf0c0
fix(poam): align Phase 1 implementation to Confluence authoritative d…
AKAbdulHanif Mar 8, 2026
bde786a
fix(poam): remove duplicate last_status_change_at in Update handler
AKAbdulHanif Mar 9, 2026
6f75d2d
fix(poam): remove invalid GORM check: constraints causing migration f…
AKAbdulHanif Mar 9, 2026
0a5f9b7
refactor(poam): introduce DDD service layer; add all link CRUD endpoints
AKAbdulHanif Mar 9, 2026
6728e43
fix(poam): address all Copilot and Gus PR review feedback
AKAbdulHanif Mar 9, 2026
af09b3b
fix(poam): stage remaining review fixes (api.go wiring, queries.go, t…
AKAbdulHanif Mar 9, 2026
8fe16dc
fix(poam): correct stale type names in integration test
AKAbdulHanif Mar 9, 2026
85ef362
chore(poam): regenerate swagger docs and apply swag fmt
AKAbdulHanif Mar 9, 2026
3d408ac
fix(poam): rename poamAddControlLinkRequest -> poamControlRefRequest …
AKAbdulHanif Mar 9, 2026
223385c
fix(poam): add JWT auth tokens to all integration test requests
AKAbdulHanif Mar 9, 2026
0aa46bf
fix(poam): seed SSP record in TestCreate_* integration tests
AKAbdulHanif Mar 9, 2026
a099859
fix(poam): correct dueBefore query param to deadlineBefore in test
AKAbdulHanif Mar 9, 2026
ac30f8a
fix: address PR review comments
AKAbdulHanif Mar 10, 2026
b94c643
fix(api): restore SSP-scoped risk routes dropped during rebase confli…
AKAbdulHanif Mar 10, 2026
1e95b26
fix(oscal): use composite catalog+ID key in mergeControls/mergeGroups…
AKAbdulHanif Mar 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2,641 changes: 2,178 additions & 463 deletions docs/docs.go
View file
Open in desktop

Large diffs are not rendered by default.

2,641 changes: 2,178 additions & 463 deletions docs/swagger.json
View file
Open in desktop

Large diffs are not rendered by default.

1,181 changes: 1,136 additions & 45 deletions docs/swagger.yaml
View file
Open in desktop

Large diffs are not rendered by default.

15 changes: 13 additions & 2 deletions internal/api/handler/api.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ import (
"github.com/compliance-framework/api/internal/config"
"github.com/compliance-framework/api/internal/service/digest"
evidencesvc "github.com/compliance-framework/api/internal/service/relational/evidence"
poamsvc "github.com/compliance-framework/api/internal/service/relational/poam"
workflowsvc "github.com/compliance-framework/api/internal/service/relational/workflows"
"github.com/compliance-framework/api/internal/workflow"
"github.com/labstack/echo/v4"
Expand Down Expand Up @@ -48,15 +49,25 @@ func RegisterHandlers(server *api.Server, logger *zap.SugaredLogger, db *gorm.DB
evidenceHandler := NewEvidenceHandler(logger, services.EvidenceService)
evidenceHandler.Register(server.API().Group("/evidence"))

poamService := poamsvc.NewPoamService(db)
poamHandler := NewPoamItemsHandler(poamService, logger)
// Flat route: /api/poam-items (supports ?sspId= query filter)
poamGroup := server.API().Group("/poam-items")
Copy link
Contributor

@gusfcarvalho gusfcarvalho Mar 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this route should be under spp/<id>/poam-items right? As in - the plan of actions depends on the risk, which belongs to a given ssp. This was one of the things I fixed under risks this morning (supporting that other route)

poamGroup.Use(middleware.JWTMiddleware(config.JWTPublicKey))
poamHandler.Register(poamGroup)
// SSP-scoped route: /api/system-security-plans/:sspId/poam-items
// The :sspId path param is automatically injected into list/create filters.
sspPoamGroup := server.API().Group("/system-security-plans/:sspId/poam-items")
sspPoamGroup.Use(middleware.JWTMiddleware(config.JWTPublicKey))
poamHandler.RegisterSSPScoped(sspPoamGroup)

riskHandler := NewRiskHandler(logger, db)
riskGroup := server.API().Group("/risks")
riskGroup.Use(middleware.JWTMiddleware(config.JWTPublicKey))
riskHandler.Register(riskGroup)

sspRiskGroup := server.API().Group("/ssp/:sspId/risks")
sspRiskGroup.Use(middleware.JWTMiddleware(config.JWTPublicKey))
riskHandler.RegisterSSPScoped(sspRiskGroup)

riskTemplateHandler := templatehandlers.NewRiskTemplateHandler(logger, db)
riskTemplateGroup := server.API().Group("/risk-templates")
riskTemplateGroup.Use(middleware.JWTMiddleware(config.JWTPublicKey))
Expand Down
Loading