Fix analytics scopes

backend/core/helpers.py

@@ -748,15 +748,38 @@ def risks_per_project_groups(user: User):
 
 
 def get_counters(user: User):
+    print()
     return {
-        "domains": Folder.objects.filter(
-            content_type=Folder.ContentType.DOMAIN
-        ).count(),
-        "projects": Project.objects.all().count(),
-        "applied_controls": AppliedControl.objects.all().count(),
-        "risk_assessments": RiskAssessment.objects.all().count(),
-        "compliance_assessments": ComplianceAssessment.objects.all().count(),
-        "policies": Policy.objects.all().count(),
+        "domains": len(
+            RoleAssignment.get_accessible_object_ids(
+                Folder.get_root_folder(), user, Folder
+            )[0]
+        ),
+        "projects": len(
+            RoleAssignment.get_accessible_object_ids(
+                Folder.get_root_folder(), user, Project
+            )[0]
+        ),
+        "applied_controls": len(
+            RoleAssignment.get_accessible_object_ids(
+                Folder.get_root_folder(), user, AppliedControl
+            )[0]
+        ),
+        "risk_assessments": len(
+            RoleAssignment.get_accessible_object_ids(
+                Folder.get_root_folder(), user, RiskAssessment
+            )[0]
+        ),
+        "compliance_assessments": len(
+            RoleAssignment.get_accessible_object_ids(
+                Folder.get_root_folder(), user, ComplianceAssessment
+            )[0]
+        ),
+        "policies": len(
+            RoleAssignment.get_accessible_object_ids(
+                Folder.get_root_folder(), user, Policy
+            )[0]
+        ),
     }
 
 
@@ -964,11 +987,18 @@ def threats_count_per_name(user: User):
         _,
         _,
     ) = RoleAssignment.get_accessible_object_ids(Folder.get_root_folder(), user, Threat)
+    viewable_scenarios = RoleAssignment.get_accessible_object_ids(
+        Folder.get_root_folder(), user, RiskScenario
+    )[0]
 
     # expected by echarts to send the threats names in labels and the count of each threat in values
 
     for threat in Threat.objects.filter(id__in=object_ids_view).order_by("name"):
-        val = RiskScenario.objects.filter(threats=threat).count()
+        val = (
+            RiskScenario.objects.filter(threats=threat)
+            .filter(id__in=viewable_scenarios)
+            .count()
+        )
         if val > 0:
             labels.append({"name": threat.name})
             values.append(val)

backend/core/views.py

@@ -283,14 +283,25 @@ def colors(self, request):
 
     @action(detail=False, name="Get used risk matrices")
     def used(self, request):
-        _used_matrices = RiskMatrix.objects.filter(
-            riskassessment__isnull=False
-        ).distinct()
+        viewable_matrices = RoleAssignment.get_accessible_object_ids(
+            Folder.get_root_folder(), request.user, RiskMatrix
+        )[0]
+        viewable_assessments = RoleAssignment.get_accessible_object_ids(
+            Folder.get_root_folder(), request.user, RiskAssessment
+        )[0]
+        _used_matrices = (
+            RiskMatrix.objects.filter(riskassessment__isnull=False)
+            .filter(id__in=viewable_matrices)
+            .filter(riskassessment__id__in=viewable_assessments)
+            .distinct()
+        )
         used_matrices = _used_matrices.values("id", "name")
         for i in range(len(used_matrices)):
-            used_matrices[i]["risk_assessments_count"] = _used_matrices.get(
-                id=used_matrices[i]["id"]
-            ).riskassessment_set.count()
+            used_matrices[i]["risk_assessments_count"] = (
+                RiskAssessment.objects.filter(risk_matrix=_used_matrices[i].id)
+                .filter(id__in=viewable_assessments)
+                .count()
+            )
         return Response({"results": used_matrices})
 
 
@@ -1060,14 +1071,25 @@ def tree(self, request, pk):
 
     @action(detail=False, name="Get used frameworks")
     def used(self, request):
-        _used_frameworks = Framework.objects.filter(
-            complianceassessment__isnull=False
-        ).distinct()
+        viewable_framework = RoleAssignment.get_accessible_object_ids(
+            Folder.get_root_folder(), request.user, Framework
+        )[0]
+        viewable_assessments = RoleAssignment.get_accessible_object_ids(
+            Folder.get_root_folder(), request.user, ComplianceAssessment
+        )[0]
+        _used_frameworks = (
+            Framework.objects.filter(complianceassessment__isnull=False)
+            .filter(id__in=viewable_framework)
+            .filter(complianceassessment__id__in=viewable_assessments)
+            .distinct()
+        )
         used_frameworks = _used_frameworks.values("id", "name")
         for i in range(len(used_frameworks)):
-            used_frameworks[i]["compliance_assessments_count"] = _used_frameworks.get(
-                id=used_frameworks[i]["id"]
-            ).complianceassessment_set.count()
+            used_frameworks[i]["compliance_assessments_count"] = (
+                ComplianceAssessment.objects.filter(framework=_used_frameworks[i].id)
+                .filter(id__in=viewable_assessments)
+                .count()
+            )
         return Response({"results": used_frameworks})
 
 

frontend/src/routes/(app)/analytics/ComposerSelect.svelte

@@ -15,7 +15,7 @@
 
 	onMount(async () => {
 		const riskAssessments = await fetch('/risk-assessments').then((res) => res.json());
-		options = getOptions({ objects: riskAssessments });
+		options = getOptions({ objects: riskAssessments, extra_fields: [['project', 'str']] });
 	});
 </script>
 

frontend/src/routes/(app)/analytics/composer/+page.svelte

@@ -20,7 +20,7 @@
 	}
 </script>
 
-<div class="flex flex-col space-y-4">
+<div class="flex flex-col space-y-4 p-2">
 	<div>
 		<div class="px-2 mx-2 font-semibold text-xl">{m.yourSelection()}</div>
 		<div class="px-2 mx-2 text-sm">
@@ -126,7 +126,7 @@
 							{/if}
 						</div>
 						<button class=" text-gray-700 font-semibold focus:outline-none" type="button">
-							{item.risk_assessment.name}
+							{item.risk_assessment.project.str}/{item.risk_assessment.name}
 						</button>
 						<div>
 							{#if item.risk_assessment.quality_check.count > 0}