feat: implement group-based access control (Admin, Standard_User, Leadership, Read_Only)
- Add user_group migration and created_by column migration - Replace requireRole middleware with requireGroup - Update all backend routes to use group-based authorization - Add Standard_User conditional delete with ownership, state, and compliance checks - Add cascade impact check for CVE deletes - Update AuthContext with group-based permission helpers - Update all frontend components for group-based rendering - Update UserManagement UI with group dropdown, confirmation dialogs, self-demotion prevention
This commit is contained in:
jramos
@@ -12,7 +12,7 @@ const path = require('path');
|
||||
const fs = require('fs');
|
||||
|
||||
// Auth imports
|
||||
const { requireAuth, requireRole } = require('./middleware/auth');
|
||||
const { requireAuth, requireGroup } = require('./middleware/auth');
|
||||
const createAuthRouter = require('./routes/auth');
|
||||
const createUsersRouter = require('./routes/users');
|
||||
const createAuditLogRouter = require('./routes/auditLog');
|
||||
@@ -161,10 +161,10 @@ const db = new sqlite3.Database('./cve_database.db', (err) => {
|
||||
app.use('/api/auth', createAuthRouter(db, logAudit));
|
||||
|
||||
// User management routes (admin only)
|
||||
app.use('/api/users', createUsersRouter(db, requireAuth, requireRole, logAudit));
|
||||
app.use('/api/users', createUsersRouter(db, requireAuth, requireGroup, logAudit));
|
||||
|
||||
// Audit log routes (admin only)
|
||||
app.use('/api/audit-logs', createAuditLogRouter(db, requireAuth, requireRole));
|
||||
app.use('/api/audit-logs', createAuditLogRouter(db, requireAuth, requireGroup));
|
||||
|
||||
// NVD lookup routes (authenticated users)
|
||||
app.use('/api/nvd', createNvdLookupRouter(db, requireAuth));
|
||||
@@ -224,7 +224,7 @@ app.use('/api/ivanti/todo-queue', createIvantiTodoQueueRouter(db, requireAuth));
|
||||
app.use('/api/ivanti/archive', createIvantiArchiveRouter(db, requireAuth));
|
||||
|
||||
// AEO compliance routes — xlsx upload, non-compliant item tracking, notes
|
||||
app.use('/api/compliance', createComplianceRouter(db, upload, requireAuth, requireRole));
|
||||
app.use('/api/compliance', createComplianceRouter(db, upload, requireAuth, requireGroup));
|
||||
|
||||
// ========== CVE ENDPOINTS ==========
|
||||
|
||||
@@ -353,7 +353,7 @@ app.get('/api/cves/compliance', requireAuth(db), (req, res) => {
|
||||
});
|
||||
|
||||
// Create new CVE entry - ALLOW MULTIPLE VENDORS (editor or admin)
|
||||
app.post('/api/cves', requireAuth(db), requireRole('editor', 'admin'), (req, res) => {
|
||||
app.post('/api/cves', requireAuth(db), requireGroup('Admin', 'Standard_User'), (req, res) => {
|
||||
const { cve_id, vendor, severity, description, published_date } = req.body;
|
||||
|
||||
// Input validation
|
||||
@@ -374,11 +374,11 @@ app.post('/api/cves', requireAuth(db), requireRole('editor', 'admin'), (req, res
|
||||
}
|
||||
|
||||
const query = `
|
||||
INSERT INTO cves (cve_id, vendor, severity, description, published_date)
|
||||
VALUES (?, ?, ?, ?, ?)
|
||||
INSERT INTO cves (cve_id, vendor, severity, description, published_date, created_by)
|
||||
VALUES (?, ?, ?, ?, ?, ?)
|
||||
`;
|
||||
|
||||
db.run(query, [cve_id, vendor, severity, description, published_date], function(err) {
|
||||
db.run(query, [cve_id, vendor, severity, description, published_date, req.user.id], function(err) {
|
||||
if (err) {
|
||||
console.error('DATABASE ERROR:', err);
|
||||
if (err.message.includes('UNIQUE constraint failed')) {
|
||||
@@ -407,7 +407,7 @@ app.post('/api/cves', requireAuth(db), requireRole('editor', 'admin'), (req, res
|
||||
|
||||
|
||||
// Update CVE status (editor or admin)
|
||||
app.patch('/api/cves/:cveId/status', requireAuth(db), requireRole('editor', 'admin'), (req, res) => {
|
||||
app.patch('/api/cves/:cveId/status', requireAuth(db), requireGroup('Admin', 'Standard_User'), (req, res) => {
|
||||
const { cveId } = req.params;
|
||||
const { status } = req.body;
|
||||
|
||||
@@ -435,7 +435,7 @@ app.patch('/api/cves/:cveId/status', requireAuth(db), requireRole('editor', 'adm
|
||||
});
|
||||
|
||||
// Bulk sync CVE data from NVD (editor or admin)
|
||||
app.post('/api/cves/nvd-sync', requireAuth(db), requireRole('editor', 'admin'), (req, res) => {
|
||||
app.post('/api/cves/nvd-sync', requireAuth(db), requireGroup('Admin', 'Standard_User'), (req, res) => {
|
||||
const { updates } = req.body;
|
||||
if (!Array.isArray(updates) || updates.length === 0) {
|
||||
return res.status(400).json({ error: 'No updates provided' });
|
||||
@@ -505,7 +505,7 @@ app.post('/api/cves/nvd-sync', requireAuth(db), requireRole('editor', 'admin'),
|
||||
// ========== CVE EDIT & DELETE ENDPOINTS ==========
|
||||
|
||||
// Edit single CVE entry (editor or admin)
|
||||
app.put('/api/cves/:id', requireAuth(db), requireRole('editor', 'admin'), (req, res) => {
|
||||
app.put('/api/cves/:id', requireAuth(db), requireGroup('Admin', 'Standard_User'), (req, res) => {
|
||||
const { id } = req.params;
|
||||
const { cve_id, vendor, severity, description, published_date, status } = req.body;
|
||||
|
||||
@@ -649,7 +649,7 @@ app.put('/api/cves/:id', requireAuth(db), requireRole('editor', 'admin'), (req,
|
||||
});
|
||||
|
||||
// Delete entire CVE - all vendors (editor or admin) - MUST be before /:id route
|
||||
app.delete('/api/cves/by-cve-id/:cveId', requireAuth(db), requireRole('editor', 'admin'), (req, res) => {
|
||||
app.delete('/api/cves/by-cve-id/:cveId', requireAuth(db), requireGroup('Admin', 'Standard_User'), (req, res) => {
|
||||
const { cveId } = req.params;
|
||||
|
||||
// Get all rows for this CVE ID to know what we're deleting
|
||||
@@ -657,6 +657,151 @@ app.delete('/api/cves/by-cve-id/:cveId', requireAuth(db), requireRole('editor',
|
||||
if (err) { console.error(err); return res.status(500).json({ error: 'Internal server error.' }); }
|
||||
if (!rows || rows.length === 0) return res.status(404).json({ error: 'No CVE entries found for this CVE ID' });
|
||||
|
||||
// Ownership check: Standard_User can only delete CVEs they created
|
||||
if (req.user.group === 'Standard_User') {
|
||||
const notOwned = rows.some(row => row.created_by !== req.user.id);
|
||||
if (notOwned) {
|
||||
return res.status(403).json({ error: 'You can only delete resources you created' });
|
||||
}
|
||||
|
||||
// Cascade impact check for Standard_User
|
||||
// Query all three cascade-deleted resource types in parallel
|
||||
db.all('SELECT id, exc_number, cve_id, vendor FROM archer_tickets WHERE cve_id = ?', [cveId], (archerErr, archerTickets) => {
|
||||
if (archerErr) { console.error(archerErr); return res.status(500).json({ error: 'Internal server error.' }); }
|
||||
|
||||
db.all('SELECT id, cve_id, vendor, ticket_key, status FROM jira_tickets WHERE cve_id = ?', [cveId], (jiraErr, jiraTickets) => {
|
||||
// If jira_tickets table doesn't exist yet, treat as empty
|
||||
if (jiraErr && jiraErr.message && jiraErr.message.includes('no such table')) {
|
||||
jiraTickets = [];
|
||||
} else if (jiraErr) {
|
||||
console.error(jiraErr);
|
||||
return res.status(500).json({ error: 'Internal server error.' });
|
||||
}
|
||||
|
||||
db.all('SELECT id, name, type FROM documents WHERE cve_id = ?', [cveId], (docErr, docs) => {
|
||||
if (docErr) { console.error(docErr); return res.status(500).json({ error: 'Internal server error.' }); }
|
||||
|
||||
const allTickets = [
|
||||
...(archerTickets || []).map(t => ({ ...t, source: 'archer', key: t.exc_number })),
|
||||
...(jiraTickets || []).map(t => ({ ...t, source: 'jira', key: t.ticket_key }))
|
||||
];
|
||||
|
||||
// If no tickets at all, no compliance linkage possible — return cascade info
|
||||
if (allTickets.length === 0) {
|
||||
return res.json({
|
||||
cascade_impact: {
|
||||
archer_tickets: [],
|
||||
jira_tickets: [],
|
||||
documents: (docs || []).map(d => ({ id: d.id, name: d.name, type: d.type })),
|
||||
blocked: false,
|
||||
blocked_reason: null
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
// Check compliance linkage for each ticket
|
||||
// A ticket is compliance-linked if its key (exc_number or ticket_key) or cve_id
|
||||
// appears in active compliance_items extra_json
|
||||
const likeConditions = [];
|
||||
const likeParams = [];
|
||||
for (const t of allTickets) {
|
||||
likeConditions.push('ci.extra_json LIKE ?');
|
||||
likeParams.push(`%${t.key}%`);
|
||||
}
|
||||
// Also check if the CVE ID itself appears in compliance extra_json
|
||||
likeConditions.push('ci.extra_json LIKE ?');
|
||||
likeParams.push(`%${cveId}%`);
|
||||
|
||||
db.all(
|
||||
`SELECT ci.id, ci.extra_json, cu.report_date
|
||||
FROM compliance_items ci
|
||||
JOIN compliance_uploads cu ON ci.upload_id = cu.id
|
||||
WHERE ci.status = 'active' AND (${likeConditions.join(' OR ')})`,
|
||||
likeParams,
|
||||
(compErr, compLinks) => {
|
||||
// If compliance_items table doesn't exist yet, treat as no linkage
|
||||
if (compErr && compErr.message && compErr.message.includes('no such table')) {
|
||||
compLinks = [];
|
||||
} else if (compErr) {
|
||||
console.error(compErr);
|
||||
return res.status(500).json({ error: 'Internal server error.' });
|
||||
}
|
||||
|
||||
// Determine which tickets are compliance-linked by checking extra_json matches
|
||||
const linkedTicketKeys = new Set();
|
||||
for (const cl of (compLinks || [])) {
|
||||
const json = cl.extra_json || '';
|
||||
for (const t of allTickets) {
|
||||
if (json.includes(t.key)) {
|
||||
linkedTicketKeys.add(`${t.source}:${t.id}`);
|
||||
}
|
||||
}
|
||||
// If CVE ID itself is in compliance data, all tickets are considered linked
|
||||
if (json.includes(cveId)) {
|
||||
for (const t of allTickets) {
|
||||
linkedTicketKeys.add(`${t.source}:${t.id}`);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
const archerTicketsResult = (archerTickets || []).map(t => ({
|
||||
id: t.id,
|
||||
exc_number: t.exc_number,
|
||||
compliance_linked: linkedTicketKeys.has(`archer:${t.id}`)
|
||||
}));
|
||||
|
||||
const jiraTicketsResult = (jiraTickets || []).map(t => ({
|
||||
id: t.id,
|
||||
ticket_key: t.ticket_key,
|
||||
compliance_linked: linkedTicketKeys.has(`jira:${t.id}`)
|
||||
}));
|
||||
|
||||
const documentsResult = (docs || []).map(d => ({
|
||||
id: d.id,
|
||||
name: d.name,
|
||||
type: d.type
|
||||
}));
|
||||
|
||||
const hasComplianceLink = archerTicketsResult.some(t => t.compliance_linked)
|
||||
|| jiraTicketsResult.some(t => t.compliance_linked);
|
||||
|
||||
if (hasComplianceLink) {
|
||||
const blockedArcher = archerTicketsResult.find(t => t.compliance_linked);
|
||||
const blockedJira = jiraTicketsResult.find(t => t.compliance_linked);
|
||||
const blockedLabel = blockedArcher
|
||||
? `Archer ticket ${blockedArcher.exc_number}`
|
||||
: `JIRA ticket ${blockedJira.ticket_key}`;
|
||||
return res.status(403).json({
|
||||
error: 'CVE deletion blocked: associated ticket linked to compliance report',
|
||||
cascade_impact: {
|
||||
archer_tickets: archerTicketsResult,
|
||||
jira_tickets: jiraTicketsResult,
|
||||
documents: documentsResult,
|
||||
blocked: true,
|
||||
blocked_reason: `${blockedLabel} is linked to a compliance report`
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
// Not blocked — return cascade impact for frontend warning
|
||||
return res.json({
|
||||
cascade_impact: {
|
||||
archer_tickets: archerTicketsResult,
|
||||
jira_tickets: jiraTicketsResult,
|
||||
documents: documentsResult,
|
||||
blocked: false,
|
||||
blocked_reason: null
|
||||
}
|
||||
});
|
||||
}
|
||||
);
|
||||
});
|
||||
});
|
||||
});
|
||||
return; // Exit early — Standard_User flow handled above
|
||||
}
|
||||
|
||||
// Admin flow: proceed directly with deletion (no cascade check)
|
||||
// Delete all documents from DB
|
||||
db.run('DELETE FROM documents WHERE cve_id = ?', [cveId], (docErr) => {
|
||||
if (docErr) console.error('Error deleting documents:', docErr);
|
||||
@@ -689,13 +834,18 @@ app.delete('/api/cves/by-cve-id/:cveId', requireAuth(db), requireRole('editor',
|
||||
});
|
||||
|
||||
// Delete single CVE vendor entry (editor or admin)
|
||||
app.delete('/api/cves/:id', requireAuth(db), requireRole('editor', 'admin'), (req, res) => {
|
||||
app.delete('/api/cves/:id', requireAuth(db), requireGroup('Admin', 'Standard_User'), (req, res) => {
|
||||
const { id } = req.params;
|
||||
|
||||
db.get('SELECT * FROM cves WHERE id = ?', [id], (err, cve) => {
|
||||
if (err) { console.error(err); return res.status(500).json({ error: 'Internal server error.' }); }
|
||||
if (!cve) return res.status(404).json({ error: 'CVE entry not found' });
|
||||
|
||||
// Ownership check: Standard_User can only delete CVEs they created
|
||||
if (req.user.group === 'Standard_User' && cve.created_by !== req.user.id) {
|
||||
return res.status(403).json({ error: 'You can only delete resources you created' });
|
||||
}
|
||||
|
||||
// Delete associated documents from DB
|
||||
db.all('SELECT id, file_path FROM documents WHERE cve_id = ? AND vendor = ?', [cve.cve_id, cve.vendor], (docErr, docs) => {
|
||||
if (docErr) console.error('Error fetching documents:', docErr);
|
||||
@@ -771,7 +921,7 @@ app.get('/api/cves/:cveId/documents', requireAuth(db), (req, res) => {
|
||||
});
|
||||
|
||||
// Upload document - ADD ERROR HANDLING FOR MULTER (editor or admin)
|
||||
app.post('/api/cves/:cveId/documents', requireAuth(db), requireRole('editor', 'admin'), (req, res, next) => {
|
||||
app.post('/api/cves/:cveId/documents', requireAuth(db), requireGroup('Admin', 'Standard_User'), (req, res, next) => {
|
||||
upload.single('file')(req, res, (err) => {
|
||||
if (err) {
|
||||
console.error('Upload error:', err.message);
|
||||
@@ -879,7 +1029,7 @@ app.post('/api/cves/:cveId/documents', requireAuth(db), requireRole('editor', 'a
|
||||
});
|
||||
});
|
||||
// Delete document (admin only)
|
||||
app.delete('/api/documents/:id', requireAuth(db), requireRole('admin'), (req, res) => {
|
||||
app.delete('/api/documents/:id', requireAuth(db), requireGroup('Admin'), (req, res) => {
|
||||
const { id } = req.params;
|
||||
|
||||
// First get the file path to delete the actual file
|
||||
@@ -981,7 +1131,7 @@ app.get('/api/jira-tickets', requireAuth(db), (req, res) => {
|
||||
});
|
||||
|
||||
// Create JIRA ticket
|
||||
app.post('/api/jira-tickets', requireAuth(db), requireRole('editor', 'admin'), (req, res) => {
|
||||
app.post('/api/jira-tickets', requireAuth(db), requireGroup('Admin', 'Standard_User'), (req, res) => {
|
||||
const { cve_id, vendor, ticket_key, url, summary, status } = req.body;
|
||||
|
||||
// Validation
|
||||
@@ -1007,11 +1157,11 @@ app.post('/api/jira-tickets', requireAuth(db), requireRole('editor', 'admin'), (
|
||||
const ticketStatus = status || 'Open';
|
||||
|
||||
const query = `
|
||||
INSERT INTO jira_tickets (cve_id, vendor, ticket_key, url, summary, status)
|
||||
VALUES (?, ?, ?, ?, ?, ?)
|
||||
INSERT INTO jira_tickets (cve_id, vendor, ticket_key, url, summary, status, created_by)
|
||||
VALUES (?, ?, ?, ?, ?, ?, ?)
|
||||
`;
|
||||
|
||||
db.run(query, [cve_id, vendor, ticket_key.trim(), url || null, summary || null, ticketStatus], function(err) {
|
||||
db.run(query, [cve_id, vendor, ticket_key.trim(), url || null, summary || null, ticketStatus, req.user.id], function(err) {
|
||||
if (err) {
|
||||
console.error('Error creating JIRA ticket:', err);
|
||||
return res.status(500).json({ error: 'Internal server error.' });
|
||||
@@ -1035,7 +1185,7 @@ app.post('/api/jira-tickets', requireAuth(db), requireRole('editor', 'admin'), (
|
||||
});
|
||||
|
||||
// Update JIRA ticket
|
||||
app.put('/api/jira-tickets/:id', requireAuth(db), requireRole('editor', 'admin'), (req, res) => {
|
||||
app.put('/api/jira-tickets/:id', requireAuth(db), requireGroup('Admin', 'Standard_User'), (req, res) => {
|
||||
const { id } = req.params;
|
||||
const { ticket_key, url, summary, status } = req.body;
|
||||
|
||||
@@ -1100,7 +1250,7 @@ app.put('/api/jira-tickets/:id', requireAuth(db), requireRole('editor', 'admin')
|
||||
});
|
||||
|
||||
// Delete JIRA ticket
|
||||
app.delete('/api/jira-tickets/:id', requireAuth(db), requireRole('editor', 'admin'), (req, res) => {
|
||||
app.delete('/api/jira-tickets/:id', requireAuth(db), requireGroup('Admin', 'Standard_User'), (req, res) => {
|
||||
const { id } = req.params;
|
||||
|
||||
db.get('SELECT * FROM jira_tickets WHERE id = ?', [id], (err, ticket) => {
|
||||
@@ -1112,24 +1262,66 @@ app.delete('/api/jira-tickets/:id', requireAuth(db), requireRole('editor', 'admi
|
||||
return res.status(404).json({ error: 'JIRA ticket not found.' });
|
||||
}
|
||||
|
||||
db.run('DELETE FROM jira_tickets WHERE id = ?', [id], function(deleteErr) {
|
||||
if (deleteErr) {
|
||||
console.error('Error deleting JIRA ticket:', deleteErr);
|
||||
return res.status(500).json({ error: 'Internal server error.' });
|
||||
// Admin bypasses all delete restrictions
|
||||
if (req.user.group === 'Admin') {
|
||||
return performJiraDelete();
|
||||
}
|
||||
|
||||
// Standard_User: ownership check
|
||||
if (ticket.created_by && ticket.created_by !== req.user.id) {
|
||||
return res.status(403).json({ error: 'You can only delete resources you created' });
|
||||
}
|
||||
|
||||
// Standard_User: compliance linkage check
|
||||
const ticketKey = ticket.ticket_key;
|
||||
db.all(
|
||||
`SELECT ci.id, ci.extra_json
|
||||
FROM compliance_items ci
|
||||
JOIN compliance_uploads cu ON ci.upload_id = cu.id
|
||||
WHERE ci.status = 'active' AND ci.extra_json LIKE ?`,
|
||||
[`%${ticketKey}%`],
|
||||
(compErr, compLinks) => {
|
||||
// If compliance_items table doesn't exist yet, treat as no linkage
|
||||
if (compErr && compErr.message && compErr.message.includes('no such table')) {
|
||||
compLinks = [];
|
||||
} else if (compErr) {
|
||||
console.error(compErr);
|
||||
return res.status(500).json({ error: 'Internal server error.' });
|
||||
}
|
||||
|
||||
const isLinked = (compLinks || []).some(cl => {
|
||||
const json = cl.extra_json || '';
|
||||
return json.includes(ticketKey);
|
||||
});
|
||||
|
||||
if (isLinked) {
|
||||
return res.status(403).json({ error: 'Cannot delete ticket linked to compliance report. Contact an admin.' });
|
||||
}
|
||||
|
||||
return performJiraDelete();
|
||||
}
|
||||
);
|
||||
|
||||
logAudit(db, {
|
||||
userId: req.user.id,
|
||||
username: req.user.username,
|
||||
action: 'jira_ticket_delete',
|
||||
entityType: 'jira_ticket',
|
||||
entityId: id,
|
||||
details: { ticket_key: ticket.ticket_key, cve_id: ticket.cve_id, vendor: ticket.vendor },
|
||||
ipAddress: req.ip
|
||||
function performJiraDelete() {
|
||||
db.run('DELETE FROM jira_tickets WHERE id = ?', [id], function(deleteErr) {
|
||||
if (deleteErr) {
|
||||
console.error('Error deleting JIRA ticket:', deleteErr);
|
||||
return res.status(500).json({ error: 'Internal server error.' });
|
||||
}
|
||||
|
||||
logAudit(db, {
|
||||
userId: req.user.id,
|
||||
username: req.user.username,
|
||||
action: 'jira_ticket_delete',
|
||||
entityType: 'jira_ticket',
|
||||
entityId: id,
|
||||
details: { ticket_key: ticket.ticket_key, cve_id: ticket.cve_id, vendor: ticket.vendor },
|
||||
ipAddress: req.ip
|
||||
});
|
||||
|
||||
res.json({ message: 'JIRA ticket deleted successfully' });
|
||||
});
|
||||
|
||||
res.json({ message: 'JIRA ticket deleted successfully' });
|
||||
});
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
|
||||
Reference in New Issue
Block a user