BCH-1346: Inherited Capabilities panel for downstream SSPs - #283
Conversation
Renders each leveraged control/statement from the projection endpoint: a non-actionable "Covered by X vN" badge, satisfaction, and outstanding responsibilities with per-responsibility posture (BCH-1339). Drifted links show a warning, a link to the drift risk, and a Re-attest action (gated on ssp:update); revoked links show the warning only, since the API only allows re-attesting from drifted. No catalog/profile endpoint is ever fetched — the projection response is the only data source, per the "no upstream dashboards, just the guarantee" scope. Depends on api PR #455 for the id/status/driftRiskId fields this panel needs.
|
Warning Review limit reached
Next review available in: 24 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (16)
📝 WalkthroughWalkthroughAdds an inherited-capabilities editor tab and lazy-loaded route. The new view fetches leveraged controls, displays inheritance and responsibility status, supports drift-risk links and permission-gated re-attestation, and includes comprehensive rendering and interaction tests. ChangesInherited capabilities
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant Editor as SSP editor
participant View as Inherited capabilities view
participant API as Data API
participant Toasts as PrimeVue toasts
Editor->>View: Open inherited capabilities with SSP id
View->>API: Fetch leveraged-controls projection
API-->>View: Return leveraged controls
View->>View: Render statuses and responsibilities
View->>API: Post re-attestation
API-->>View: Return attestation result
View->>API: Refresh projection
View->>Toasts: Show success or error
Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@CodeRabbit review |
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@src/views/system-security-plans/__tests__/SystemSecurityPlanInheritedCapabilitiesView.spec.ts`:
- Around line 178-198: Add a failure-path test alongside the existing
re-attestation test that configures postMock to reject, invokes the confirmation
accept callback for re-attest, and flushes pending promises. Assert that
toastAddMock is called with an object containing severity: 'error', covering the
catch branch in reAttest.
In
`@src/views/system-security-plans/SystemSecurityPlanInheritedCapabilitiesView.vue`:
- Line 123: Rename or alias the imported getIdFromRoute utility to a
domain-neutral name, updating its defining export and all usages including
SystemSecurityPlanInheritedCapabilitiesView. Preserve the existing route-ID
extraction behavior while removing the misleading POAM-specific naming.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: b4ebe0ec-cb44-4a27-bd8f-fd3f26886310
📒 Files selected for processing (5)
src/router/index.tssrc/types/ssp-leverage.tssrc/views/system-security-plans/SystemSecurityPlanEditorView.vuesrc/views/system-security-plans/SystemSecurityPlanInheritedCapabilitiesView.vuesrc/views/system-security-plans/__tests__/SystemSecurityPlanInheritedCapabilitiesView.spec.ts
…tility naming Add a failure-path test for reAttest's catch branch, and rename the misleadingly POAM-specific get-poam-id-from-route.ts to get-id-from-route.ts (the exported function itself was already domain-neutral) across all 13 import sites.
…plementation Node's own experimental global localStorage (present without a CLI flag but non-functional, warning and resolving to undefined) was shadowing jsdom's working shim in this Node version, breaking every test that touches localStorage directly. Passing --localstorage-file via NODE_OPTIONS activates Node's native implementation instead, resolving the conflict.
… CLI flag The previous fix (NODE_OPTIONS=--localstorage-file=...) fails in CI: Node explicitly disallows that flag via NODE_OPTIONS on the Node version CI runs (20), even though it's silently accepted on newer local Node versions — and regardless of version, the flag never actually reaches jsdom's per-test sandboxed global scope anyway, since Node's native localStorage lives on the outer process only. Replacing it with a small in-memory Storage polyfill in vitest.setup.ts, applied whenever the host's localStorage is missing or broken, works identically on every Node version with no CLI flags at all.
1 participant
Summary
GET /oscal/system-security-plans/:id/leveraged-controls: a non-actionable "Covered by X vN" badge, satisfaction, and outstanding responsibilities with per-responsibility posture (satisfied/not-satisfied/unknown, BCH-1339).driftedandrevokedlinks, a "View drift risk" link whendriftRiskIdis present, and a Re-attest action — only fordrifted(the API 400s re-attesting arevokedlink; showing the button there would be a guaranteed-failing action).ssp:updateviaPermissionGate, matching the API's own guard on that route exactly.Depends on
compliance-framework/api#455, which adds theid/status/driftRiskIdfields this panel needs on the projection response — a real gap I found and confirmed with the user before writing any UI code (the endpoint had no way to identify a link or detect drift at all).Caught and fixed one bug during implementation:
ReAttest's response is a rawSSPLeverageLink, not the richer projection shape — merging it in place would have wipedinheritedFrom/outstandingResponsibilities/responsibilityPosturefor that entry. Fixed by refetching the projection list after a successful re-attest instead of merging.Test plan
vue-tsc --buildcleaneslintcleanssp:updatenpm run test:unitsuite green aside from one pre-existing, unrelatedLoginView.spec.tsfailure (localStorageenv issue predating this change)Summary by CodeRabbit
New Features
Tests