Added new text field remediation_time to Finding and FindingDefinition

kraken/migrations/0023_placeholder.toml

@@ -0,0 +1,24 @@
+[Migration]
+Hash = "4514739181779073952"
+Initial = false
+Dependency = 22
+Replaces = []
+
+[[Migration.Operations]]
+Type = "CreateField"
+Model = "findingdefinition"
+
+[Migration.Operations.Field]
+Name = "remediation_duration"
+Type = "varchar"
+
+[[Migration.Operations.Field.Annotations]]
+Type = "default_value"
+Value = ""
+
+[[Migration.Operations.Field.Annotations]]
+Type = "max_length"
+Value = 255
+
+[[Migration.Operations.Field.Annotations]]
+Type = "not_null"

kraken/migrations/0024_placeholder.toml

@@ -0,0 +1,24 @@
+[Migration]
+Hash = "16214129463165444321"
+Initial = false
+Dependency = 23
+Replaces = []
+
+[[Migration.Operations]]
+Type = "CreateField"
+Model = "finding"
+
+[Migration.Operations.Field]
+Name = "remediation_duration"
+Type = "varchar"
+
+[[Migration.Operations.Field.Annotations]]
+Type = "default_value"
+Value = ""
+
+[[Migration.Operations.Field.Annotations]]
+Type = "max_length"
+Value = 255
+
+[[Migration.Operations.Field.Annotations]]
+Type = "not_null"

kraken/src/api/handler/data_export/handler.rs

@@ -323,38 +323,42 @@ pub(crate) async fn export_workspace(
             Finding::F.definition.name,
             Finding::F.definition.cve,
             Finding::F.severity,
+            Finding::F.remediation_duration,
+            Finding::F.sorting_weight,
             Finding::F.created_at,
         )
     )
     .condition(Finding::F.workspace.equals(path.uuid))
-    .order_desc(Finding::F.severity)
-    .order_desc(Finding::F.sorting_weight)
     .stream()
-    .and_then(|(uuid, name, cve, severity, created_at)| {
-        let affected = affected.remove(&uuid).unwrap_or_default();
-        let categories = categories.remove(&uuid).unwrap_or_default();
-        async move {
-            let (details, _) = GLOBAL
-                .editor_cache
-                .finding_export_details
-                .get(uuid)
-                .await?
-                .unwrap_or_default();
-            Ok((
-                uuid,
-                AggregatedFinding {
+    .and_then(
+        |(uuid, name, cve, severity, remediation_duration, sorting_weight, created_at)| {
+            let affected = affected.remove(&uuid).unwrap_or_default();
+            let categories = categories.remove(&uuid).unwrap_or_default();
+            async move {
+                let (details, _) = GLOBAL
+                    .editor_cache
+                    .finding_export_details
+                    .get(uuid)
+                    .await?
+                    .unwrap_or_default();
+                Ok((
                     uuid,
-                    name,
-                    cve,
-                    severity: FromDb::from_db(severity),
-                    details,
-                    affected,
-                    created_at,
-                    categories,
-                },
-            ))
-        }
-    })
+                    AggregatedFinding {
+                        uuid,
+                        name,
+                        cve,
+                        severity: FromDb::from_db(severity),
+                        remediation_duration,
+                        sorting_weight,
+                        details,
+                        affected,
+                        created_at,
+                        categories,
+                    },
+                ))
+            }
+        },
+    )
     .try_collect()
     .await?;
 

kraken/src/api/handler/data_export/schema.rs

@@ -252,6 +252,12 @@ pub struct AggregatedFinding {
     /// The finding's severity
     pub severity: FindingSeverity,
 
+    /// Expected time duration required for the remediation
+    pub remediation_duration: String,
+
+    /// A weight without semantic used to sort findings
+    pub sorting_weight: i32,
+
     /// The details of this finding
     pub details: String,
 

kraken/src/api/handler/finding_affected/handler.rs

@@ -38,6 +38,7 @@ use crate::models::DomainGlobalTag;
 use crate::models::DomainWorkspaceTag;
 use crate::models::Finding;
 use crate::models::FindingAffected;
+use crate::models::FindingDefinition;
 use crate::models::FindingDefinitionCategoryRelation;
 use crate::models::FindingDetails;
 use crate::models::FindingFindingCategoryRelation;
@@ -152,49 +153,52 @@ pub async fn get_finding_affected(
         return Err(ApiError::NotFound);
     }
 
+    let (finding, finding_details, domain, host, port, service, http_service, details, created_at) =
+        query_finding_affected(
+            &mut tx,
+            (
+                FindingAffected::F.finding.select_as::<Finding>(),
+                FindingAffected::F
+                    .finding
+                    .details
+                    .select_as::<FindingDetails>(),
+                FindingAffected::F.domain,
+                FindingAffected::F.host,
+                FindingAffected::F.port,
+                FindingAffected::F.service,
+                FindingAffected::F.http_service,
+                FindingAffected::F.details,
+                FindingAffected::F.created_at,
+            ),
+            f_uuid,
+            a_uuid,
+        )
+        .await?
+        .ok_or(ApiError::NotFound)?;
+
     let (
-        finding,
-        finding_details,
         finding_definition_uuid,
         finding_definition_name,
         finding_definition_cve,
         finding_definition_severity,
         finding_definition_summary,
+        finding_definition_remediation_duration,
         finding_definition_created_at,
-        domain,
-        host,
-        port,
-        service,
-        http_service,
-        details,
-        created_at,
-    ) = query_finding_affected(
+    ) = query!(
         &mut tx,
         (
-            FindingAffected::F.finding.select_as::<Finding>(),
-            FindingAffected::F
-                .finding
-                .details
-                .select_as::<FindingDetails>(),
-            FindingAffected::F.finding.definition.uuid,
-            FindingAffected::F.finding.definition.name,
-            FindingAffected::F.finding.definition.cve,
-            FindingAffected::F.finding.definition.severity,
-            FindingAffected::F.finding.definition.summary,
-            FindingAffected::F.finding.definition.created_at,
-            FindingAffected::F.domain,
-            FindingAffected::F.host,
-            FindingAffected::F.port,
-            FindingAffected::F.service,
-            FindingAffected::F.http_service,
-            FindingAffected::F.details,
-            FindingAffected::F.created_at,
-        ),
-        f_uuid,
-        a_uuid,
+            FindingDefinition::F.uuid,
+            FindingDefinition::F.name,
+            FindingDefinition::F.cve,
+            FindingDefinition::F.severity,
+            FindingDefinition::F.summary,
+            FindingDefinition::F.remediation_duration,
+            FindingDefinition::F.created_at,
+        )
     )
-    .await?
-    .ok_or(ApiError::NotFound)?;
+    .condition(FindingDefinition::F.uuid.equals(*finding.definition.key()))
+    .one()
+    .await?;
 
     let mut details = if let Some(details) = details {
         Some(
@@ -453,10 +457,12 @@ pub async fn get_finding_affected(
                 cve: finding_definition_cve,
                 severity: FromDb::from_db(finding_definition_severity),
                 summary: finding_definition_summary,
+                remediation_duration: finding_definition_remediation_duration,
                 created_at: finding_definition_created_at,
                 categories: finding_definition_categories,
             },
             severity: FromDb::from_db(finding.severity),
+            remediation_duration: finding.remediation_duration,
             sorting_weight: finding.sorting_weight,
             affected: finding_affected,
             #[rustfmt::skip]

kraken/src/api/handler/finding_definitions/handler.rs

@@ -64,6 +64,7 @@ pub async fn create_finding_definition(
         impact,
         remediation,
         references,
+        remediation_duration,
         categories,
     } = req.into_inner();
 
@@ -89,6 +90,7 @@ pub async fn create_finding_definition(
             impact,
             remediation,
             references,
+            remediation_duration,
         })
         .await?;
 
@@ -177,6 +179,7 @@ pub async fn get_finding_definition(
         remediation: GLOBAL.editor_cache.fd_remediation.get(uuid).await?.ok_or(ApiError::InvalidUuid)?.0,
         #[rustfmt::skip]
         references: GLOBAL.editor_cache.fd_references.get(uuid).await?.ok_or(ApiError::InvalidUuid)?.0,
+        remediation_duration: finding_definition.remediation_duration,
         created_at: finding_definition.created_at,
         categories,
     }))
@@ -229,6 +232,7 @@ pub async fn get_all_finding_definitions() -> ApiResult<Json<ListFindingDefiniti
             summary: fd.summary,
             severity: FromDb::from_db(fd.severity),
             created_at: fd.created_at,
+            remediation_duration: fd.remediation_duration,
             categories: categories.remove(&fd.uuid).unwrap_or_default(),
         })
         .try_collect()
@@ -278,6 +282,7 @@ pub async fn update_finding_definition(
             name: None,
             severity: None,
             cve: None,
+            remediation_duration: None,
             categories: None,
         }
     ) {
@@ -315,6 +320,10 @@ pub async fn update_finding_definition(
             FindingDefinition::F.severity,
             request.severity.map(IntoDb::into_db),
         )
+        .set_if(
+            FindingDefinition::F.remediation_duration,
+            request.remediation_duration.clone(),
+        )
         .finish_dyn_set()
     {
         update.exec().await?;

kraken/src/api/handler/finding_definitions/schema.rs

@@ -42,6 +42,8 @@ pub struct CreateFindingDefinitionRequest {
     ///
     /// Can link to resources like Mitre's Attack or CME explanations, etc.
     pub references: String,
+    /// Expected time duration required for the remediation
+    pub remediation_duration: String,
     /// List of categories
     pub categories: Vec<Uuid>,
 }
@@ -67,6 +69,8 @@ pub struct FullFindingDefinition {
     pub remediation: String,
     /// Any references to get more information about the definition of a finding.
     pub references: String,
+    /// Expected time duration required for the remediation
+    pub remediation_duration: String,
     /// The point in time this finding definition was created
     pub created_at: DateTime<Utc>,
     /// The list of categories this finding definition falls into
@@ -86,6 +90,8 @@ pub struct SimpleFindingDefinition {
     pub severity: FindingSeverity,
     /// Short summary of the finding
     pub summary: String,
+    /// Expected time duration required for the remediation
+    pub remediation_duration: String,
     /// The point in time this finding definition was created
     pub created_at: DateTime<Utc>,
     /// The list of categories this finding falls into
@@ -155,6 +161,10 @@ pub struct UpdateFindingDefinitionRequest {
     #[serde(default, deserialize_with = "de_optional")]
     pub cve: Option<Option<String>>,
 
+    /// Expected time duration required for the remediation
+    #[serde(skip_serializing_if = "Option::is_none")] // see above
+    pub remediation_duration: Option<String>,
+
     /// List of categories
     #[serde(skip_serializing_if = "Option::is_none")] // see above
     pub categories: Option<Vec<Uuid>>,

kraken/src/api/handler/finding_factory/handler_admin.rs

@@ -99,6 +99,7 @@ pub async fn get_finding_factory_entries() -> ApiResult<Json<GetFindingFactoryEn
                         cve: finding.cve,
                         severity: FromDb::from_db(finding.severity),
                         summary: finding.summary,
+                        remediation_duration: finding.remediation_duration,
                         created_at: finding.created_at,
                         categories,
                     }),

kraken/src/api/handler/findings/handler.rs

@@ -76,6 +76,7 @@ pub async fn create_finding(
         workspace_uuid,
         request.definition,
         request.severity.into_db(),
+        request.remediation_duration,
         request.export_details,
         request.user_details,
         None,
@@ -295,10 +296,12 @@ pub async fn get_finding(
             severity: FromDb::from_db(definition.severity),
             #[rustfmt::skip]
             summary: GLOBAL.editor_cache.fd_summary.get(*finding.definition.key()).await?.ok_or(ApiError::InvalidUuid)?.0,
+            remediation_duration: definition.remediation_duration,
             created_at: definition.created_at,
             categories: definition_categories,
         },
         severity: FromDb::from_db(finding.severity),
+        remediation_duration: finding.remediation_duration,
         sorting_weight: finding.sorting_weight,
         affected,
         #[rustfmt::skip]
@@ -344,6 +347,7 @@ pub async fn update_finding(
         UpdateFindingRequest {
             definition: None,
             severity: None,
+            remediation_duration: None,
             sorting_weight: None,
             screenshot: None,
             log_file: None,
@@ -369,6 +373,10 @@ pub async fn update_finding(
             request.definition.map(ForeignModelByField::Key),
         )
         .set_if(Finding::F.severity, request.severity.map(IntoDb::into_db))
+        .set_if(
+            Finding::F.remediation_duration,
+            request.remediation_duration.clone(),
+        )
         .set_if(Finding::F.sorting_weight, request.sorting_weight)
         .finish_dyn_set()
     {