Ca 210 fix access control model in api

backend/.gitignore

@@ -4,6 +4,7 @@ __pycache__
 *.DS_Store
 *~$*
 staticfiles/*
+static/
 *.mo
 .env
 .vscode

backend/app_tests/api/test_api.py

@@ -419,6 +419,13 @@ def create_object(
             # Uses the API endpoint to create an object with authentication
             response = authenticated_client.post(url, build_params, format=query_format)
 
+            if fails:
+                # Asserts that the object was not created
+                assert (
+                    response.status_code == expected_status
+                ), f"{verbose_name} can not be created with authentication"
+                return
+
             # Asserts that the object was created successfully
             assert (
                 response.status_code == expected_status

backend/app_tests/api/test_api_requirement_assessments.py

@@ -1,4 +1,5 @@
 import pytest
+from rest_framework.status import HTTP_400_BAD_REQUEST
 from rest_framework.test import APIClient
 from core.models import (
     ComplianceAssessment,
@@ -41,7 +42,9 @@ def test_get_requirement_assessments(self, authenticated_client):
                     project=Project.objects.create(name="test", folder=folder),
                     framework=Framework.objects.all()[0],
                 ),
-                "requirement": RequirementNode.objects.create(name="test", folder=folder, assessable=False),
+                "requirement": RequirementNode.objects.create(
+                    name="test", folder=folder, assessable=False
+                ),
             },
         )
 
@@ -76,7 +79,9 @@ def test_update_requirement_assessments(self, authenticated_client):
                     project=Project.objects.create(name="test", folder=folder),
                     framework=Framework.objects.all()[0],
                 ),
-                "requirement": RequirementNode.objects.create(name="test", folder=folder, assessable=False),
+                "requirement": RequirementNode.objects.create(
+                    name="test", folder=folder, assessable=False
+                ),
             },
             {
                 "status": REQUIREMENT_ASSESSMENT_STATUS2,
@@ -113,14 +118,18 @@ def test_get_requirement_assessments(self, authenticated_client):
             },
             {
                 "folder": str(folder.id),
-                "compliance_assessment": {"id": str(compliance_assessment.id), "str": compliance_assessment.name},
+                "compliance_assessment": {
+                    "id": str(compliance_assessment.id),
+                    "str": compliance_assessment.name,
+                },
                 "requirement": str(RequirementNode.objects.all()[0].id),
             },
             -1,
         )
 
     def test_create_requirement_assessments(self, authenticated_client):
         """test to create requirement assessments with the API with authentication"""
+        """nobody has permission to do that, so it will fail"""
 
         EndpointTestsQueries.Auth.import_object(authenticated_client, "Framework")
         folder = Folder.objects.create(name="test")
@@ -144,9 +153,14 @@ def test_create_requirement_assessments(self, authenticated_client):
                 "security_measures": [str(security_measure.id)],
             },
             {
-                "compliance_assessment": {"id": str(compliance_assessment.id), "str": compliance_assessment.name}
+                "compliance_assessment": {
+                    "id": str(compliance_assessment.id),
+                    "str": compliance_assessment.name,
+                }
             },
             base_count=-1,
+            fails=True,
+            expected_status=HTTP_400_BAD_REQUEST
         )
 
     def test_update_requirement_assessments(self, authenticated_client):
@@ -189,7 +203,10 @@ def test_update_requirement_assessments(self, authenticated_client):
             },
             {
                 "folder": str(Folder.get_root_folder().id),
-                "compliance_assessment": {"id": str(compliance_assessment.id), "str": compliance_assessment.name},
+                "compliance_assessment": {
+                    "id": str(compliance_assessment.id),
+                    "str": compliance_assessment.name,
+                },
                 "requirement": str(RequirementNode.objects.all()[0].id),
             },
         )

backend/cal/migrations/0001_initial.py

@@ -1,4 +1,4 @@
-# Generated by Django 5.0.2 on 2024-02-10 02:00
+# Generated by Django 5.0.2 on 2024-02-23 00:51
 
 from django.db import migrations, models
 

backend/ciso_assistant/settings.py

@@ -193,10 +193,14 @@ def set_ciso_assistant_url(_, __, event_dict):
     "PAGE_SIZE": PAGINATE_BY,
 }
 
-# templates are still used to send email
-REST_FRAMEWORK["DEFAULT_RENDERER_CLASSES"].append(
-    "rest_framework.renderers.BrowsableAPIRenderer"
-)
+if DEBUG:
+    REST_FRAMEWORK["DEFAULT_RENDERER_CLASSES"].append(
+        "rest_framework.renderers.BrowsableAPIRenderer"
+    )
+    INSTALLED_APPS.append("django.contrib.staticfiles")
+    STATIC_URL = "/static/"
+    STATIC_ROOT = BASE_DIR / "static"
+
 TEMPLATES = [
     {
         "BACKEND": "django.template.backends.django.DjangoTemplates",

backend/core/apps.py

@@ -1,14 +1,18 @@
 from django.apps import AppConfig
+from django.db.models.signals import post_migrate
+from ciso_assistant.settings import CISO_ASSISTANT_SUPERUSER_EMAIL
 
 
-def startup():
-    """Implement CISO Assistant 1.0 default Roles and User Groups"""
+def startup(**kwargs):
+    """
+        Implement CISO Assistant 1.0 default Roles and User Groups during migrate
+        This makes sure root folder and global groups are defined before any other object is created
+        Create superuser if CISO_ASSISTANT_SUPERUSER_EMAIL defined
+    """
 
-    from ciso_assistant.settings import (
-        CISO_ASSISTANT_SUPERUSER_EMAIL,
-    )
     from django.contrib.auth.models import Permission
     from iam.models import Folder, Role, RoleAssignment, User, UserGroup
+    print("post-migrate handler: initialize database")
 
     auditor_permissions = Permission.objects.filter(
         codename__in=[
@@ -28,6 +32,7 @@ def startup():
             "view_requirement",
             "view_evidence",
             "view_framework",
+            "view_library",
         ]
     )
 
@@ -51,6 +56,7 @@ def startup():
             "view_requirement",
             "view_evidence",
             "view_framework",
+            "view_library",
         ]
     )
 
@@ -98,6 +104,7 @@ def startup():
             "view_riskmatrix",
             "view_requirement",
             "view_framework",
+            "view_library",
         ]
     )
 
@@ -150,6 +157,7 @@ def startup():
             "delete_evidence",
             "view_requirement",
             "view_framework",
+            "view_library",
         ]
     )
 
@@ -227,23 +235,14 @@ def startup():
             "delete_framework",
             "view_requirementnode",
             "view_requirementlevel",  # Permits to see the object on api by an admin
+            "view_library",
+            "add_library",
             "delete_library",
             "backup",
             "restore",
         ]
     )
 
-    # if superuser defined and does not exist, then create it
-    if (
-        CISO_ASSISTANT_SUPERUSER_EMAIL
-        and not User.objects.filter(email=CISO_ASSISTANT_SUPERUSER_EMAIL).exists()
-    ):
-        try:
-            User.objects.create_superuser(
-                email=CISO_ASSISTANT_SUPERUSER_EMAIL, is_superuser=True
-            )
-        except Exception as e:
-            print(e) #NOTE: Add this exception in the logger
     # if root folder does not exist, then create it
     if not Folder.objects.filter(content_type=Folder.ContentType.ROOT).exists():
         Folder.objects.create(
@@ -308,12 +307,18 @@ def startup():
             folder=Folder.get_root_folder(),
         )
         ra2.perimeter_folders.add(global_validators.folder)
-    # add any superuser to the global administrors group, in case it is not yet done
-    for superuser in User.objects.filter(is_superuser=True):
-        UserGroup.objects.get(name="BI-UG-ADM").user_set.add(superuser)
-    # fix administrator role, to facilitate migrations
-    administrator = Role.objects.filter(name="BI-RL-ADM").first()
-    administrator.permissions.set(administrator_permissions)
+
+    # if superuser defined and does not exist, then create it
+    if (
+        CISO_ASSISTANT_SUPERUSER_EMAIL
+        and not User.objects.filter(email=CISO_ASSISTANT_SUPERUSER_EMAIL).exists()
+    ):
+        try:
+            User.objects.create_superuser(
+                email=CISO_ASSISTANT_SUPERUSER_EMAIL, is_superuser=True
+            )
+        except Exception as e:
+            print(e) #NOTE: Add this exception in the logger
 
 
 class CoreConfig(AppConfig):
@@ -322,8 +327,4 @@ class CoreConfig(AppConfig):
     verbose_name = "Core"
 
     def ready(self):
-        import os
-
-        if os.environ.get("RUN_MAIN"):
-            """Only called in main, not during makemigrations or migrate"""
-            startup()
+        post_migrate.connect(startup, sender=self)

backend/core/migrations/0001_initial.py

@@ -1,4 +1,4 @@
-# Generated by Django 5.0.2 on 2024-02-10 02:00
+# Generated by Django 5.0.2 on 2024-02-23 00:51
 
 import core.validators
 import uuid

backend/core/migrations/0002_initial.py

@@ -1,4 +1,4 @@
-# Generated by Django 5.0.2 on 2024-02-10 02:00
+# Generated by Django 5.0.2 on 2024-02-23 00:51
 
 import django.db.models.deletion
 import iam.models
@@ -52,6 +52,11 @@ class Migration(migrations.Migration):
             name='framework',
             field=models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='core.framework', verbose_name='Framework'),
         ),
+        migrations.AddField(
+            model_name='library',
+            name='dependencies',
+            field=models.ManyToManyField(blank=True, to='core.library', verbose_name='Dependencies'),
+        ),
         migrations.AddField(
             model_name='library',
             name='folder',
@@ -75,7 +80,7 @@ class Migration(migrations.Migration):
         migrations.AddField(
             model_name='requirementassessment',
             name='compliance_assessment',
-            field=models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='core.complianceassessment', verbose_name='Compliance assessment'),
+            field=models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='requirement_assessments', to='core.complianceassessment', verbose_name='Compliance assessment'),
         ),
         migrations.AddField(
             model_name='requirementassessment',
@@ -207,6 +212,19 @@ class Migration(migrations.Migration):
             name='security_measures',
             field=models.ManyToManyField(blank=True, related_name='requirement_assessments', to='core.securitymeasure', verbose_name='Security measures'),
         ),
+        migrations.CreateModel(
+            name='Policy',
+            fields=[
+            ],
+            options={
+                'verbose_name': 'Policy',
+                'verbose_name_plural': 'Policies',
+                'proxy': True,
+                'indexes': [],
+                'constraints': [],
+            },
+            bases=('core.securitymeasure',),
+        ),
         migrations.AddField(
             model_name='threat',
             name='folder',

backend/core/permissions.py

@@ -20,6 +20,8 @@ class RBACPermissions(permissions.DjangoObjectPermissions):
     }
 
     def has_permission(self, request: Request, view) -> bool:
+        """ we don't need this check, as we have queryset for list and serializers for create
+        see https://www.django-rest-framework.org/api-guide/permissions/ """
         return True
 
     def has_object_permission(self, request: Request, view, obj):
@@ -30,8 +32,6 @@ def has_object_permission(self, request: Request, view, obj):
         if not perms:
             return False
         _codename = perms[0].split(".")[1]
-        if queryset.model == User:
-            return RoleAssignment.has_permission(user=request.user, codename=_codename)
         return RoleAssignment.is_access_allowed(
             user=request.user,
             perm=Permission.objects.get(codename=_codename),