feat: add hostname and IP display to Ivanti queue panel

- Add migration to add hostname column to ivanti_todo_queue table
- Update POST and batch POST endpoints to accept and store hostname
- Pass hostName from findings data when adding items to queue
- Display hostname and IP address in CARD queue section
- Display hostname and IP address in vendor (FP/Archer) queue sections

.gitignore

@@ -51,3 +51,6 @@ backend/add_vendor_to_documents.js
 backend/fix_multivendor_constraint.js
 backend/server.js-backup
 backend/setup.js-backup
+
+# Kiro implementation summary (internal only)
+docs/kiro-implementation-summary.md

.kiro/specs/batch-finding-disposition/.config.kiro

@@ -0,0 +1 @@
+{"specId": "9f5c16d4-43ea-4d7a-beb1-9329d79a5acc", "workflowType": "requirements-first", "specType": "feature"}

.kiro/specs/batch-finding-disposition/design.md

@@ -0,0 +1,331 @@
+# Design Document: Batch Finding Disposition
+
+## Overview
+
+This feature adds multi-select capability to the Vulnerability Triage page's findings table, enabling engineers to select multiple findings and add them all to the Ivanti Queue in a single operation. The current flow requires clicking each finding individually, configuring a popover, and submitting one at a time — this design replaces that with a batch selection toolbar and a bulk-add API endpoint while preserving the existing single-select popover for one-off additions.
+
+The design touches three layers:
+1. A new `POST /api/ivanti/todo-queue/batch` backend endpoint that accepts an array of findings in a single transactional insert
+2. Frontend multi-select state management (selection set, shift-click range select, select-all)
+3. A sticky Selection Toolbar component with workflow type toggles, vendor input, and batch submit
+
+## Architecture
+
+The feature extends the existing Ivanti Queue subsystem without introducing new services or tables. The `ivanti_todo_queue` table schema is unchanged — batch add simply inserts multiple rows in a single SQLite transaction.
+
+```mermaid
+flowchart TD
+    subgraph Frontend ["Frontend (ReportingPage.js)"]
+        CB[Row Checkboxes] --> SS[Selection State<br/>Set of finding IDs]
+        SS --> ST[Selection Toolbar]
+        ST -->|"Add to Queue"| BA[Batch API Call]
+        CB -->|"No selection + click"| PO[AddToQueuePopover<br/>existing single-add]
+    end
+
+    subgraph Backend ["Backend (ivantiTodoQueue.js)"]
+        BA -->|"POST /batch"| BH[Batch Handler]
+        BH -->|"BEGIN TRANSACTION"| DB[(ivanti_todo_queue)]
+        BH -->|"logAudit()"| AL[(audit_logs)]
+        PO -->|"POST /"| SH[Single Handler<br/>existing]
+        SH --> DB
+    end
+```
+
+### Key Design Decisions
+
+1. **No new database table or migration** — batch insert reuses the existing `ivanti_todo_queue` schema. Each finding becomes its own row, identical to what the single-add endpoint creates.
+
+2. **SQLite transaction for atomicity** — all findings in a batch are inserted inside `db.serialize()` with `BEGIN TRANSACTION` / `COMMIT`. If any insert fails, the entire batch is rolled back. This satisfies the all-or-nothing requirement (Req 3.7, 3.8, 3.11).
+
+3. **Selection state lives in the VulnerabilityTriagePage component** — a `Set<string>` of finding IDs managed via `useState`. This keeps the selection co-located with the existing `findings`, `sorted`, `filtered`, and `queueItems` state. No new context or global store needed.
+
+4. **Dual-mode checkbox behavior** — when no findings are selected, clicking a checkbox opens the existing `AddToQueuePopover` (preserving the single-select flow per Req 5). Once one or more findings are selected, subsequent checkbox clicks toggle selection instead. This is the simplest UX that satisfies both Req 1 and Req 5.
+
+5. **Selection Toolbar as inline sticky bar** — rendered between the table header controls and the `<table>` element, using `position: sticky` to stay visible during scroll. This avoids portal complexity and keeps the toolbar visually anchored to the table.
+
+6. **200-item batch limit** — prevents oversized payloads and keeps SQLite transaction time reasonable. The findings table typically has 200-800 rows, so this covers most realistic batch sizes.
+
+## Components and Interfaces
+
+### Backend
+
+#### `POST /api/ivanti/todo-queue/batch`
+
+Added to the existing `createIvantiTodoQueueRouter` factory in `backend/routes/ivantiTodoQueue.js`.
+
+**Request body:**
+```json
+{
+  "findings": [
+    {
+      "finding_id": "FID-12345",
+      "finding_title": "OpenSSL vulnerability",
+      "cves": ["CVE-2024-0001"],
+      "ip_address": "10.0.1.50"
+    }
+  ],
+  "workflow_type": "FP",
+  "vendor": "Juniper"
+}
+```
+
+**Validation rules:**
+- `findings` — array, 1–200 items
+- Each item: `finding_id` required, non-empty string; `finding_title`, `cves`, `ip_address` optional
+- `workflow_type` — must be `FP`, `Archer`, or `CARD`
+- `vendor` — required non-empty string (≤200 chars) for FP/Archer; ignored for CARD
+- If any finding fails validation, reject entire batch with 400
+
+**Auth:** `requireAuth(db)`, `requireGroup('Admin', 'Standard_User')`
+
+**Response (201):**
+```json
+{
+  "items": [
+    {
+      "id": 42,
+      "user_id": 1,
+      "finding_id": "FID-12345",
+      "finding_title": "OpenSSL vulnerability",
+      "cves_json": "[\"CVE-2024-0001\"]",
+      "ip_address": "10.0.1.50",
+      "vendor": "Juniper",
+      "workflow_type": "FP",
+      "status": "pending",
+      "created_at": "2025-01-15 12:00:00",
+      "updated_at": "2025-01-15 12:00:00",
+      "cves": ["CVE-2024-0001"]
+    }
+  ]
+}
+```
+
+**Error responses:**
+- `400` — validation failure (descriptive message)
+- `401` — not authenticated
+- `403` — insufficient permissions
+- `500` — database transaction failure (all inserts rolled back)
+
+### Frontend
+
+#### Selection State (in VulnerabilityTriagePage)
+
+New state variables added to the main component:
+
+```javascript
+const [selectedIds, setSelectedIds] = useState(new Set());    // Set<string> of finding IDs
+const [lastClickedId, setLastClickedId] = useState(null);     // for shift-click range select
+const [batchSubmitting, setBatchSubmitting] = useState(false); // loading state
+const [batchError, setBatchError] = useState(null);            // error message from failed batch
+const [batchWorkflowType, setBatchWorkflowType] = useState('FP');
+const [batchVendor, setBatchVendor] = useState('');
+```
+
+#### Checkbox Click Logic
+
+```
+onClick(finding, event):
+  if finding is already queued → return (no-op)
+  if selectedIds.size === 0 AND not shift-click:
+    → open AddToQueuePopover (existing single-select flow)
+  else:
+    if shift-click AND lastClickedId exists:
+      → range-select all visible findings between lastClickedId and finding.id
+    else:
+      → toggle finding.id in selectedIds
+    set lastClickedId = finding.id
+```
+
+#### SelectionToolbar Component
+
+Rendered inline above the table when `selectedIds.size > 0`. Contains:
+- Selected count badge
+- "Clear Selection" button
+- Workflow type toggle buttons (FP / Archer / CARD) with existing color scheme
+- Vendor text input (hidden when CARD selected)
+- "Add to Queue" submit button (disabled until valid)
+- Error message display area
+
+#### Selection Persistence Across Filters
+
+When `columnFilters`, `actionFilter`, or `excFilter` change, the selection set is pruned to only include IDs that remain in the `filtered` array. This is done via a `useEffect` that intersects `selectedIds` with the current filtered finding IDs.
+
+#### Select All / Deselect All
+
+The checkbox column header renders a "Select All" control when `selectedIds.size > 0` or as a standard header otherwise. Clicking it:
+- If not all visible non-queued findings are selected → selects all visible non-queued findings
+- If all are already selected → deselects all
+
+## Data Models
+
+### Database Schema (unchanged)
+
+The `ivanti_todo_queue` table is reused as-is:
+
+```sql
+CREATE TABLE ivanti_todo_queue (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id INTEGER NOT NULL,
+    finding_id TEXT NOT NULL,
+    finding_title TEXT,
+    cves_json TEXT,
+    ip_address TEXT,
+    vendor TEXT NOT NULL,
+    workflow_type TEXT NOT NULL CHECK(workflow_type IN ('FP', 'Archer', 'CARD')),
+    status TEXT NOT NULL DEFAULT 'pending' CHECK(status IN ('pending', 'complete')),
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+);
+```
+
+Each batch-added finding creates one row, identical to single-add. The `vendor` and `workflow_type` are shared across all findings in a batch (set once in the toolbar).
+
+### API Request Schema
+
+```
+BatchAddRequest {
+  findings: Array<{
+    finding_id: string (required, non-empty, trimmed)
+    finding_title: string | null (max 500 chars)
+    cves: string[] | null
+    ip_address: string | null (max 64 chars)
+  }> (1–200 items)
+  workflow_type: "FP" | "Archer" | "CARD"
+  vendor: string (required for FP/Archer, ≤200 chars; empty/absent for CARD)
+}
+```
+
+### Frontend State Shape
+
+```
+Selection State:
+  selectedIds: Set<string>        — finding IDs currently selected
+  lastClickedId: string | null    — last checkbox clicked (for shift-range)
+  batchSubmitting: boolean        — true while POST /batch in flight
+  batchError: string | null       — error message from last failed batch
+  batchWorkflowType: "FP" | "Archer" | "CARD"
+  batchVendor: string
+```
+
+
+## Correctness Properties
+
+*A property is a characteristic or behavior that should hold true across all valid executions of a system — essentially, a formal statement about what the system should do. Properties serve as the bridge between human-readable specifications and machine-verifiable correctness guarantees.*
+
+### Property 1: Selection pruning preserves only visible findings
+
+*For any* set of selected finding IDs and any set of currently visible (filtered) finding IDs, pruning the selection after a filter change should produce exactly the intersection of the two sets — every ID in the result is both selected and visible, and no visible selected ID is lost.
+
+**Validates: Requirements 1.4**
+
+### Property 2: Select-all produces the complete visible non-queued set
+
+*For any* list of visible findings and any set of queued finding IDs, the select-all operation should produce a set containing exactly the IDs of visible findings that are not in the queued set — no queued findings included, no non-queued visible findings omitted.
+
+**Validates: Requirements 1.6**
+
+### Property 3: Submit button enabled state matches validation rule
+
+*For any* workflow type (FP, Archer, CARD) and any vendor string, the "Add to Queue" button should be enabled if and only if the workflow type is CARD, or the vendor string trimmed is non-empty. No other combination should enable the button.
+
+**Validates: Requirements 2.7**
+
+### Property 4: Batch size validation accepts only 1–200 items
+
+*For any* integer N representing the number of findings in a batch request, the endpoint should accept the request (assuming all other fields are valid) if and only if 1 ≤ N ≤ 200. Arrays of size 0 or greater than 200 should be rejected with a 400 response.
+
+**Validates: Requirements 3.2**
+
+### Property 5: Vendor validation is conditional on workflow type
+
+*For any* workflow type and any vendor string, the batch endpoint should require a non-empty vendor of 200 characters or fewer when workflow_type is FP or Archer, and should accept any vendor value (including empty or absent) when workflow_type is CARD.
+
+**Validates: Requirements 3.5, 3.6**
+
+### Property 6: One invalid finding rejects the entire batch
+
+*For any* valid batch of findings, if exactly one finding is replaced with an invalid finding (empty finding_id, missing finding_id, or non-string finding_id) at any position in the array, the entire batch should be rejected with a 400 response and zero rows should be inserted.
+
+**Validates: Requirements 3.3, 3.8**
+
+### Property 7: Successful batch response matches request
+
+*For any* valid batch request of N findings, the 201 response should contain exactly N items, each with a unique numeric `id`, and the set of `finding_id` values in the response should equal the set of `finding_id` values in the request.
+
+**Validates: Requirements 3.9**
+
+### Property 8: Shift-click range select covers exactly the between range
+
+*For any* sorted list of visible findings, any last-clicked index, and any current-click index, the shift-click range select should produce a set containing exactly the non-queued findings between those two indices (inclusive), regardless of which index is larger.
+
+**Validates: Requirements 6.1**
+
+## Error Handling
+
+### Backend Errors
+
+| Scenario | Response | Behavior |
+|----------|----------|----------|
+| Empty findings array or > 200 items | 400 | `{ error: "findings array must contain 1-200 items." }` |
+| Any finding missing/empty finding_id | 400 | `{ error: "Each finding must have a non-empty finding_id string." }` |
+| Invalid workflow_type | 400 | `{ error: "workflow_type must be FP, Archer, or CARD." }` |
+| Missing vendor for FP/Archer | 400 | `{ error: "vendor is required for FP and Archer workflows." }` |
+| Vendor exceeds 200 chars | 400 | `{ error: "vendor must be under 200 chars." }` |
+| Not authenticated | 401 | Standard auth middleware response |
+| Insufficient permissions (Read_Only) | 403 | Standard group middleware response |
+| SQLite transaction failure | 500 | Transaction rolled back, `{ error: "Internal server error." }` |
+
+### Frontend Errors
+
+| Scenario | Behavior |
+|----------|----------|
+| Batch POST returns 4xx/5xx | Display error message in Selection Toolbar, keep selection intact |
+| Network failure during batch POST | Display "Network error — please try again" in toolbar, keep selection |
+| Batch POST timeout | Same as network failure handling |
+
+### Edge Cases
+
+- **Duplicate finding_ids in batch**: Allowed — the same finding could appear on multiple hosts. The backend does not enforce uniqueness on finding_id within a batch.
+- **Finding already in queue**: The frontend prevents selecting already-queued findings (checkbox is disabled), so duplicates should not reach the API. No server-side duplicate check is added to keep the endpoint simple.
+- **Concurrent batch submissions**: The SQLite transaction serializes writes. If two users submit overlapping batches, both succeed independently (each user has their own queue scoped by user_id).
+- **Selection of 0 findings**: The "Add to Queue" button is only rendered when selectedIds.size > 0, so this state cannot be reached through the UI. The backend still validates for it.
+
+## Testing Strategy
+
+### Unit Tests
+
+Focus on specific examples and edge cases:
+
+- **Backend validation**: Test each validation rule with concrete valid/invalid inputs (empty array, 201 items, missing finding_id, invalid workflow_type, vendor edge cases)
+- **Transaction rollback**: Mock a database error mid-insert, verify no rows are committed
+- **Frontend checkbox dual-mode**: Test that clicking with empty selection opens popover, clicking with existing selection toggles selection
+- **Toolbar visibility**: Test toolbar appears/disappears based on selection state
+- **Clear selection**: Test that clear button empties selection
+- **Escape key**: Test that Escape clears selection
+- **Select-all toggle**: Test select-all and deselect-all behavior
+- **Queue panel update**: Test that successful batch updates queueItems state
+
+### Property-Based Tests
+
+Using [fast-check](https://github.com/dubzzz/fast-check) for JavaScript property-based testing.
+
+Each property test runs a minimum of 100 iterations with randomly generated inputs. Tests are tagged with their corresponding design property.
+
+| Property | What's Generated | What's Verified |
+|----------|-----------------|-----------------|
+| Property 1: Selection pruning | Random sets of selected IDs and filtered IDs | Result = intersection of both sets |
+| Property 2: Select-all | Random finding lists and queued ID sets | Result = visible IDs minus queued IDs |
+| Property 3: Submit enabled | Random workflow types and vendor strings | Enabled iff CARD or non-empty vendor |
+| Property 4: Batch size | Random integers 0–300 | Accepted iff 1 ≤ N ≤ 200 |
+| Property 5: Vendor validation | Random workflow types and vendor strings (0–300 chars) | Conditional acceptance rule |
+| Property 6: Invalid finding rejection | Valid batches with one injected invalid item | Entire batch rejected, 0 rows inserted |
+| Property 7: Response shape | Valid batches of 1–50 findings | Response count matches, IDs match |
+| Property 8: Range select | Random sorted lists and two index positions | Correct range of non-queued findings |
+
+### Integration Tests
+
+- End-to-end batch submission: POST valid batch, verify rows in database, verify response shape
+- Auth enforcement: Verify 401 for unauthenticated, 403 for Read_Only users
+- Transaction atomicity: Verify rollback on database error
+- Frontend → Backend: Mock API, verify correct request payload from toolbar submit

.kiro/specs/batch-finding-disposition/requirements.md

@@ -0,0 +1,97 @@
+# Requirements Document
+
+## Introduction
+
+The Batch Finding Disposition feature adds multi-select capability to the Vulnerability Triage page's findings table, allowing engineers to select multiple findings at once and add them all to the Ivanti Queue with a shared workflow type and vendor in a single operation. Currently, each finding must be individually clicked, configured via a popover, and submitted — a repetitive process that slows down triage when working through many findings. This feature replaces that one-at-a-time flow with a batch selection toolbar and a bulk-add API endpoint.
+
+## Glossary
+
+- **Findings_Table**: The sortable, filterable table of Ivanti host findings rendered in the VulnerabilityTriagePage component (`ReportingPage.js`), where each row represents one finding.
+- **Selection_Toolbar**: A floating toolbar that appears above the Findings_Table when one or more findings are selected via their row checkboxes, displaying the count of selected findings and batch action controls.
+- **Batch_Add_Panel**: The inline panel within the Selection_Toolbar that provides workflow type selection (FP, Archer, CARD), an optional vendor input, and a submit button for adding all selected findings to the queue in one operation.
+- **Todo_Queue_API**: The backend Express router at `/api/ivanti/todo-queue` that manages CRUD operations on the `ivanti_todo_queue` table.
+- **Queue_Panel**: The existing right-side slide-out panel (`QueuePanel` component) that displays the user's current queue items grouped by vendor.
+- **Workflow_Type**: One of three disposition categories: FP (false positive), Archer (risk acceptance), or CARD (remediation card). Each finding added to the queue is assigned exactly one Workflow_Type.
+- **Finding**: A single Ivanti host vulnerability record containing an ID, title, CVEs, IP address, severity, and other metadata.
+
+## Requirements
+
+### Requirement 1: Multi-Select Findings via Row Checkboxes
+
+**User Story:** As an engineer, I want to select multiple findings using checkboxes so that I can batch-process them instead of handling each one individually.
+
+#### Acceptance Criteria
+
+1. THE Findings_Table SHALL render a checkbox in the first column of each finding row that is not already in the queue.
+2. WHEN a user clicks a finding row's checkbox, THE Findings_Table SHALL toggle that Finding's selected state without opening the AddToQueuePopover.
+3. WHEN one or more findings are selected, THE Findings_Table SHALL visually distinguish selected rows from unselected rows using a highlighted background.
+4. THE Findings_Table SHALL maintain the selected findings set across sort and filter changes, removing only findings that are no longer visible after filtering.
+5. WHEN a finding is already in the queue, THE Findings_Table SHALL display that row's checkbox as checked and disabled, preventing re-selection.
+6. WHILE findings are selected, THE Findings_Table SHALL display a "Select All (visible)" control in the checkbox column header that selects all visible, non-queued findings.
+7. WHEN the "Select All" control is clicked while all visible non-queued findings are already selected, THE Findings_Table SHALL deselect all findings.
+
+### Requirement 2: Selection Toolbar with Batch Actions
+
+**User Story:** As an engineer, I want a toolbar that appears when I have findings selected so that I can see how many are selected and take batch actions on them.
+
+#### Acceptance Criteria
+
+1. WHEN one or more findings are selected, THE Selection_Toolbar SHALL appear as a sticky bar above the Findings_Table header row.
+2. THE Selection_Toolbar SHALL display the count of currently selected findings.
+3. THE Selection_Toolbar SHALL provide a "Clear Selection" button that deselects all findings and hides the Selection_Toolbar.
+4. THE Selection_Toolbar SHALL provide workflow type toggle buttons for FP, Archer, and CARD, matching the existing color scheme (FP: amber, Archer: blue, CARD: green).
+5. WHEN the selected Workflow_Type is FP or Archer, THE Selection_Toolbar SHALL display a vendor text input field.
+6. WHEN the selected Workflow_Type is CARD, THE Selection_Toolbar SHALL hide the vendor input field and display a "No vendor required" indicator.
+7. THE Selection_Toolbar SHALL provide an "Add to Queue" submit button that is enabled only when a Workflow_Type is selected and vendor is provided (for FP/Archer) or Workflow_Type is CARD.
+8. THE Selection_Toolbar SHALL follow the existing dark theme design system (monospace fonts, dark gradient backgrounds, accent-colored borders).
+
+### Requirement 3: Bulk Add to Queue API Endpoint
+
+**User Story:** As an engineer, I want the backend to accept multiple findings in a single request so that batch additions are processed efficiently.
+
+#### Acceptance Criteria
+
+1. THE Todo_Queue_API SHALL expose a `POST /api/ivanti/todo-queue/batch` endpoint that accepts an array of finding objects with a shared workflow_type and vendor.
+2. THE Todo_Queue_API SHALL validate that the findings array contains between 1 and 200 items.
+3. THE Todo_Queue_API SHALL validate that each finding object contains a non-empty finding_id string.
+4. THE Todo_Queue_API SHALL validate that workflow_type is one of FP, Archer, or CARD.
+5. WHEN workflow_type is FP or Archer, THE Todo_Queue_API SHALL validate that vendor is a non-empty string of 200 characters or fewer.
+6. WHEN workflow_type is CARD, THE Todo_Queue_API SHALL accept an empty or absent vendor field.
+7. THE Todo_Queue_API SHALL insert all valid findings into the `ivanti_todo_queue` table within a single database transaction.
+8. IF any finding in the batch fails validation, THEN THE Todo_Queue_API SHALL reject the entire batch and return a 400 response with a descriptive error message.
+9. THE Todo_Queue_API SHALL return a 201 response containing the array of newly created queue items with their assigned IDs.
+10. THE Todo_Queue_API SHALL require authentication and the Admin or Standard_User group.
+11. IF a database error occurs during the transaction, THEN THE Todo_Queue_API SHALL roll back all inserts and return a 500 response.
+
+### Requirement 4: Frontend Batch Submission Flow
+
+**User Story:** As an engineer, I want clicking "Add to Queue" on the toolbar to submit all selected findings at once so that I save time during triage.
+
+#### Acceptance Criteria
+
+1. WHEN the user clicks "Add to Queue" on the Selection_Toolbar, THE Findings_Table SHALL send a single POST request to `POST /api/ivanti/todo-queue/batch` containing all selected findings with the chosen workflow_type and vendor.
+2. WHILE the batch request is in progress, THE Selection_Toolbar SHALL disable the "Add to Queue" button and display a loading indicator.
+3. WHEN the batch request succeeds, THE Findings_Table SHALL add all returned queue items to the local queue state, clear the selection, and hide the Selection_Toolbar.
+4. WHEN the batch request succeeds, THE Findings_Table SHALL update each newly queued finding's row checkbox to show the checked-and-disabled (already queued) state.
+5. IF the batch request fails, THEN THE Selection_Toolbar SHALL display the error message returned by the API and keep the current selection intact.
+6. WHEN the batch request succeeds and the Queue_Panel is open, THE Queue_Panel SHALL reflect the newly added items immediately without requiring a manual refresh.
+
+### Requirement 5: Preserve Single-Select Popover Flow
+
+**User Story:** As an engineer, I want to still be able to add a single finding to the queue quickly without going through the batch flow, so that simple one-off additions remain fast.
+
+#### Acceptance Criteria
+
+1. WHEN no findings are currently selected and a user clicks a finding row's checkbox, THE Findings_Table SHALL open the existing AddToQueuePopover for that single finding.
+2. WHEN one or more findings are already selected and a user clicks another finding row's checkbox, THE Findings_Table SHALL add that finding to the selection set instead of opening the AddToQueuePopover.
+3. THE AddToQueuePopover SHALL continue to use the existing single-item `POST /api/ivanti/todo-queue` endpoint for individual additions.
+
+### Requirement 6: Keyboard Accessibility for Multi-Select
+
+**User Story:** As an engineer, I want to use keyboard shortcuts to speed up multi-select so that I can triage even faster.
+
+#### Acceptance Criteria
+
+1. WHEN a user holds Shift and clicks a finding row's checkbox, THE Findings_Table SHALL select all visible findings between the last clicked checkbox and the current checkbox (range select).
+2. THE Selection_Toolbar SHALL be navigable via keyboard Tab order, with all interactive elements (workflow buttons, vendor input, submit button) reachable by Tab key.
+3. WHEN the Escape key is pressed while the Selection_Toolbar is visible, THE Findings_Table SHALL clear the selection and hide the Selection_Toolbar.

.kiro/specs/batch-finding-disposition/tasks.md

@@ -0,0 +1,116 @@
+# Implementation Plan: Batch Finding Disposition
+
+## Overview
+
+Add multi-select capability to the Vulnerability Triage findings table with a batch-add-to-queue API endpoint. The backend gets a new `POST /api/ivanti/todo-queue/batch` route in `ivantiTodoQueue.js`. The frontend gets selection state, checkbox dual-mode logic, a SelectionToolbar component, shift-click range select, select-all, and Escape-to-clear — all within `ReportingPage.js`.
+
+## Tasks
+
+- [x] 1. Add `POST /api/ivanti/todo-queue/batch` endpoint
+  - [x] 1.1 Add batch route handler to `backend/routes/ivantiTodoQueue.js`
+    - Add `POST /batch` route inside `createIvantiTodoQueueRouter`, before the `POST /` route
+    - Apply `requireAuth(db)` and `requireGroup('Admin', 'Standard_User')` middleware
+    - Validate request body: `findings` array (1–200 items), each with non-empty `finding_id` string
+    - Validate `workflow_type` is one of `FP`, `Archer`, `CARD`
+    - Validate `vendor`: required non-empty string ≤200 chars for FP/Archer; ignored for CARD
+    - If any validation fails, return 400 with descriptive error message and reject entire batch
+    - _Requirements: 3.1, 3.2, 3.3, 3.4, 3.5, 3.6, 3.8, 3.10_
+  - [x] 1.2 Implement transactional batch insert with SQLite
+    - Use `db.serialize()` with `BEGIN TRANSACTION` / `COMMIT` to insert all findings atomically
+    - For each finding: insert row into `ivanti_todo_queue` with `user_id`, `finding_id`, `finding_title`, `cves_json`, `ip_address`, `vendor`, `workflow_type`
+    - On success: fetch all inserted rows, parse `cves_json` back to arrays, return 201 with `{ items: [...] }`
+    - On any DB error: `ROLLBACK` the transaction and return 500
+    - _Requirements: 3.7, 3.8, 3.9, 3.11_
+  - [x] 1.3 Add audit logging for batch additions
+    - After successful commit, call `logAudit(db, { ... })` with action `'batch_add_to_queue'`, entityType `'ivanti_todo_queue'`, and details including the count and workflow_type
+    - Import `logAudit` from `../helpers/auditLog`
+    - _Requirements: 3.7_
+
+- [x] 2. Checkpoint — Verify backend endpoint
+  - Ensure the batch endpoint is syntactically correct and the route file has no errors. Ask the user if questions arise.
+
+- [x] 3. Add multi-select state and checkbox dual-mode logic to `ReportingPage.js`
+  - [x] 3.1 Add selection state variables to `VulnerabilityTriagePage`
+    - Add `selectedIds` (`new Set()`), `lastClickedId` (null), `batchSubmitting` (false), `batchError` (null), `batchWorkflowType` ('FP'), `batchVendor` ('') as new `useState` hooks
+    - _Requirements: 1.1, 2.1_
+  - [x] 3.2 Implement checkbox dual-mode click handler
+    - Replace the existing `<td>` onClick in the checkbox cell with new logic:
+      - If finding is already queued → no-op (existing behavior)
+      - If `selectedIds.size === 0` AND not shift-click → open `AddToQueuePopover` (preserves single-select flow)
+      - If shift-click AND `lastClickedId` exists → range-select all visible non-queued findings between `lastClickedId` and current finding in the `sorted` array
+      - Otherwise → toggle finding.id in `selectedIds`
+    - Always update `lastClickedId` when toggling selection
+    - _Requirements: 1.1, 1.2, 5.1, 5.2, 6.1_
+  - [x] 3.3 Add visual highlighting for selected rows
+    - When a finding's ID is in `selectedIds`, apply a highlighted background (e.g. `rgba(14,165,233,0.12)`) to the row
+    - Override the existing alternating row background and hover for selected rows
+    - _Requirements: 1.3_
+  - [x] 3.4 Disable checkbox for already-queued findings
+    - Keep existing behavior: queued findings show checked + disabled checkbox, preventing re-selection
+    - Ensure queued findings are excluded from shift-click range select and select-all
+    - _Requirements: 1.5_
+
+- [x] 4. Implement Select All / Deselect All in column header
+  - Modify the checkbox column `<th>` to render a clickable "Select All" checkbox when `selectedIds.size > 0` or when the user interacts with it
+  - Click behavior: if not all visible non-queued findings are selected → select all visible non-queued; if all are selected → deselect all
+  - _Requirements: 1.6, 1.7_
+
+- [x] 5. Add selection pruning on filter changes
+  - Add a `useEffect` that watches `filtered` (the filtered findings array) and prunes `selectedIds` to only include IDs still present in the filtered set
+  - This ensures selection stays consistent when `columnFilters`, `actionFilter`, or `excFilter` change
+  - _Requirements: 1.4_
+
+- [x] 6. Implement SelectionToolbar component
+  - [x] 6.1 Create the `SelectionToolbar` inline component in `ReportingPage.js`
+    - Render between the panel header controls and the `<table>` element, only when `selectedIds.size > 0`
+    - Use `position: sticky` with appropriate `top` value to stay visible during scroll
+    - Follow the dark theme design system: monospace fonts, dark gradient background, accent-colored borders
+    - _Requirements: 2.1, 2.8_
+  - [x] 6.2 Add toolbar controls: count badge, Clear Selection, workflow toggles, vendor input, submit button
+    - Display selected count badge (e.g. "12 selected")
+    - "Clear Selection" button that empties `selectedIds` and hides toolbar
+    - Workflow type toggle buttons (FP / Archer / CARD) using existing color scheme: FP = amber (`#F59E0B`), Archer = blue (`#0EA5E9`), CARD = green (`#10B981`)
+    - Vendor text input (hidden when CARD is selected, show "No vendor required" indicator for CARD)
+    - "Add to Queue" submit button — enabled only when workflow_type is CARD, or vendor is non-empty
+    - _Requirements: 2.2, 2.3, 2.4, 2.5, 2.6, 2.7_
+
+- [x] 7. Implement batch submission flow
+  - [x] 7.1 Add `submitBatch` async function to `VulnerabilityTriagePage`
+    - Build request payload from `selectedIds` (map each ID to its finding object from `sorted`/`filtered` for `finding_id`, `finding_title`, `cves`, `ip_address`), plus `batchWorkflowType` and `batchVendor`
+    - POST to `${API_BASE}/ivanti/todo-queue/batch` with `credentials: 'include'`
+    - Set `batchSubmitting = true` before request, `false` after
+    - _Requirements: 4.1, 4.2_
+  - [x] 7.2 Handle batch success response
+    - On 201: merge returned items into `queueItems` state (sorted by vendor then id, matching existing pattern)
+    - Clear `selectedIds`, reset `batchWorkflowType` to 'FP', reset `batchVendor` to '', clear `batchError`
+    - The newly queued findings will automatically show as checked+disabled via the existing `isQueued()` helper
+    - _Requirements: 4.3, 4.4, 4.6_
+  - [x] 7.3 Handle batch error response
+    - On 4xx/5xx: parse error message from response JSON, set `batchError` to display in toolbar
+    - On network failure: set `batchError` to "Network error — please try again"
+    - Keep selection intact on error so user can retry
+    - _Requirements: 4.5_
+
+- [x] 8. Add Escape key handler to clear selection
+  - Add a `useEffect` with a `keydown` listener for Escape that clears `selectedIds` when the SelectionToolbar is visible (i.e. `selectedIds.size > 0`)
+  - Ensure it doesn't conflict with the existing Escape handler on `AddToQueuePopover`
+  - _Requirements: 6.3_
+
+- [x] 9. Ensure keyboard Tab accessibility for SelectionToolbar
+  - Verify all interactive elements in the toolbar (workflow buttons, vendor input, submit button, clear button) are focusable via Tab key
+  - Use native `<button>` and `<input>` elements (which are inherently tabbable) rather than `<div>` with onClick
+  - _Requirements: 6.2_
+
+- [x] 10. Final checkpoint — Full integration verification
+  - Ensure all files have no syntax errors or diagnostic issues
+  - Verify the checkbox dual-mode logic: no selection → popover, existing selection → toggle
+  - Verify the SelectionToolbar renders/hides correctly based on selection state
+  - Verify batch submit wires through to the backend endpoint and updates queue state
+  - Ensure all tests pass, ask the user if questions arise.
+
+## Notes
+
+- No new database migration needed — batch insert reuses the existing `ivanti_todo_queue` schema
+- The batch endpoint must be registered before `POST /` in the router to avoid Express route conflicts
+- All testing is done on the dev server after push — no local test tasks included
+- Each task references specific acceptance criteria from the requirements document for traceability

.kiro/specs/ivanti-fp-workflow-submission/design.md

@@ -0,0 +1,321 @@
+# Design Document: Ivanti FP Workflow Submission
+
+## Overview
+
+This feature extends the existing Ivanti Queue (QueuePanel) in the Reporting Page to allow users to submit False Positive (FP) workflows directly to the Ivanti/RiskSense API. The implementation adds a submission modal triggered from the queue panel, a backend API endpoint that proxies the workflow creation and attachment upload to Ivanti, and local tracking of submissions in SQLite.
+
+The design follows existing codebase conventions: factory-pattern Express routes, inline React styles with the dark tactical theme, Multer for file uploads, and the `ivantiPost()` HTTP helper for Ivanti API calls.
+
+## Architecture
+
+```mermaid
+sequenceDiagram
+    participant U as User (Browser)
+    participant FE as React Frontend
+    participant BE as Express Backend
+    participant IV as Ivanti API
+    participant DB as SQLite
+
+    U->>FE: Select FP queue items, click "Create FP Workflow"
+    FE->>FE: Open FpWorkflowModal with selected items
+    U->>FE: Fill form, attach files, click Submit
+    FE->>BE: POST /api/ivanti/fp-workflow (multipart/form-data)
+    BE->>BE: Validate input, check auth
+    BE->>IV: POST /client/{clientId}/workflowBatch (create FP workflow)
+    IV-->>BE: 200 + workflow batch response (id, generatedId)
+    alt Attachments present
+        loop For each attachment
+            BE->>IV: POST /client/{clientId}/workflowBatch/{id}/attachment
+            IV-->>BE: 200 OK
+        end
+    end
+    BE->>DB: INSERT into ivanti_fp_submissions
+    BE->>DB: INSERT audit log entry
+    BE->>DB: UPDATE ivanti_todo_queue SET status='complete'
+    BE-->>FE: 200 + { workflowBatchId, generatedId, status }
+    FE->>FE: Show success, refresh queue panel
+```
+
+## Components and Interfaces
+
+### Backend
+
+#### New Route Module: `backend/routes/ivantiFpWorkflow.js`
+
+Exports `createIvantiFpWorkflowRouter(db, requireAuth)` following the existing factory pattern.
+
+**Endpoint: `POST /api/ivanti/fp-workflow`**
+
+- Auth: `requireAuth(db)`, `requireGroup('Admin', 'Standard_User')`
+- Content-Type: `multipart/form-data` (handled by Multer)
+- Request fields:
+  - `name` (string, required) — workflow name, max 255 chars
+  - `reason` (string, required) — justification text
+  - `description` (string, optional) — additional details, max 2000 chars
+  - `expirationDate` (string, required) — ISO date string, must be future
+  - `scopeOverride` (string, optional) — "Authorized" (default) or "None"
+  - `findingIds` (string, required) — JSON-encoded array of finding ID strings
+  - `queueItemIds` (string, required) — JSON-encoded array of local queue item IDs
+  - `attachments` (files, optional) — up to 10 files, 10MB each
+
+- Response (success):
+  ```json
+  {
+    "success": true,
+    "workflowBatchId": 12345,
+    "generatedId": "FP#12345",
+    "attachmentResults": [
+      { "filename": "evidence.pdf", "success": true },
+      { "filename": "screenshot.png", "success": true }
+    ],
+    "queueItemsUpdated": 3
+  }
+  ```
+
+- Response (error):
+  ```json
+  {
+    "success": false,
+    "error": "Ivanti API returned status 401",
+    "step": "create_workflow",
+    "details": "..."
+  }
+  ```
+
+**Internal flow:**
+
+1. Parse and validate all form fields
+2. Verify all `queueItemIds` belong to the requesting user and are FP-type with pending status
+3. Call Ivanti API to create the workflow batch
+4. If attachments exist, upload each to the created workflow batch
+5. Insert a submission record into `ivanti_fp_submissions`
+6. Log audit entry via `logAudit()`
+7. Mark queue items as complete
+8. Return combined result
+
+#### Ivanti API Calls
+
+Reuses the existing `ivantiPost()` helper pattern from `ivantiWorkflows.js`. Adds a new `ivantiMultipartPost()` helper for attachment uploads that sends `multipart/form-data` instead of JSON.
+
+**Create Workflow Batch:**
+```
+POST /client/{clientId}/workflowBatch
+```
+```json
+{
+  "name": "FP - CVE-2024-1234 - Vendor X",
+  "type": "FALSE_POSITIVE",
+  "reason": "Scanner false positive confirmed by manual investigation",
+  "description": "Additional context...",
+  "expirationDate": "2025-12-31",
+  "scopeOverrideAuthorization": "AUTHORIZED",
+  "hostFindingIds": [123456, 789012],
+  "subType": "FALSE_POSITIVE"
+}
+```
+
+**Upload Attachment:**
+```
+POST /client/{clientId}/workflowBatch/{workflowBatchId}/attachment
+Content-Type: multipart/form-data
+```
+Form field: `file` — the binary file content.
+
+#### Shared HTTP Helpers
+
+The existing `ivantiPost()` function is duplicated across `ivantiWorkflows.js` and `ivantiFindings.js`. This design extracts it into a shared helper at `backend/helpers/ivantiApi.js` alongside the new multipart helper:
+
+- `ivantiPost(urlPath, body, apiKey, skipTls)` — JSON POST (existing logic)
+- `ivantiMultipartPost(urlPath, fileBuffer, fileName, apiKey, skipTls)` — multipart file upload
+
+### Frontend
+
+#### New Component: `FpWorkflowModal`
+
+Located in `frontend/src/components/pages/ReportingPage.js` (inline, following the existing pattern where QueuePanel and AddToQueuePopover are defined in the same file).
+
+**Props:**
+- `open` (boolean) — controls visibility
+- `onClose` (function) — close handler
+- `selectedItems` (array) — FP queue items selected for submission
+- `onSuccess` (function) — callback after successful submission, triggers queue refresh
+
+**State:**
+- `name`, `reason`, `description`, `expirationDate`, `scopeOverride` — form fields
+- `files` — array of File objects for upload
+- `submitting` — boolean, disables form during submission
+- `progress` — object tracking current step and attachment progress
+- `errors` — validation error map
+- `result` — submission result (success/failure details)
+
+**UI Layout:**
+- Modal overlay with dark backdrop (matching existing modal patterns)
+- Header: "Create FP Workflow" with close button
+- Body sections:
+  1. Selected findings summary (read-only list with finding_id, title, CVEs)
+  2. Workflow configuration form (name, reason, description, expiration, scope override toggle)
+  3. File upload area (drag-and-drop zone + file list)
+- Footer: Cancel and Submit buttons, progress indicator when submitting
+
+#### QueuePanel Modifications
+
+- Add a "Create FP Workflow" button in the footer, next to existing "Delete Selected" and "Clear Completed" buttons
+- Button enabled only when `selectedIds` contains at least one pending FP-type item
+- Clicking opens `FpWorkflowModal` with the filtered FP items
+- After successful submission, the `onSuccess` callback triggers queue refresh
+
+## Data Models
+
+### New Table: `ivanti_fp_submissions`
+
+```sql
+CREATE TABLE IF NOT EXISTS ivanti_fp_submissions (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id INTEGER NOT NULL,
+    username TEXT NOT NULL,
+    ivanti_workflow_batch_id INTEGER,
+    ivanti_generated_id TEXT,
+    workflow_name TEXT NOT NULL,
+    reason TEXT NOT NULL,
+    description TEXT,
+    expiration_date TEXT NOT NULL,
+    scope_override TEXT NOT NULL DEFAULT 'Authorized',
+    finding_ids_json TEXT NOT NULL,
+    queue_item_ids_json TEXT NOT NULL,
+    attachment_count INTEGER DEFAULT 0,
+    attachment_results_json TEXT,
+    status TEXT NOT NULL DEFAULT 'success' CHECK(status IN ('success', 'partial', 'failed')),
+    error_message TEXT,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX IF NOT EXISTS idx_fp_submissions_user ON ivanti_fp_submissions(user_id);
+CREATE INDEX IF NOT EXISTS idx_fp_submissions_ivanti_id ON ivanti_fp_submissions(ivanti_generated_id);
+```
+
+**Status values:**
+- `success` — workflow created and all attachments uploaded
+- `partial` — workflow created but one or more attachments failed
+- `failed` — workflow creation itself failed (record kept for audit)
+
+### Migration Script: `backend/migrations/add_fp_submissions_table.js`
+
+Standard migration script following the existing pattern (e.g., `add_ivanti_todo_queue_table.js`).
+
+
+## Correctness Properties
+
+*A property is a characteristic or behavior that should hold true across all valid executions of a system — essentially, a formal statement about what the system should do. Properties serve as the bridge between human-readable specifications and machine-verifiable correctness guarantees.*
+
+### Property 1: FP Workflow Button Enabled State
+
+*For any* set of queue items and any selection of item IDs, the "Create FP Workflow" button should be enabled if and only if the selection contains at least one queue item that has `workflow_type === 'FP'` and `status === 'pending'`.
+
+**Validates: Requirements 1.1**
+
+### Property 2: FP-Only Item Filtering
+
+*For any* set of selected queue items containing a mix of workflow types (FP, Archer, CARD), the items passed to the FP workflow submission modal should contain only items where `workflow_type === 'FP'`, and the count of filtered items should be less than or equal to the count of selected items.
+
+**Validates: Requirements 1.2**
+
+### Property 3: Form Validation Correctness
+
+*For any* form state (name, reason, description, expirationDate, scopeOverride), validation should pass if and only if: name is a non-empty string of at most 255 characters, reason is a non-empty string, description (if provided) is at most 2000 characters, and expirationDate is a valid date strictly after today. When validation fails, the returned error map should contain a key for each invalid field and no keys for valid fields.
+
+**Validates: Requirements 2.4, 2.5**
+
+### Property 4: File Extension Validation
+
+*For any* filename string, the file acceptance function should return true if and only if the file's extension (case-insensitive) is one of: .pdf, .png, .jpg, .jpeg, .gif, .doc, .docx, .xlsx, .csv, .txt, .zip. Files with disallowed extensions should be rejected.
+
+**Validates: Requirements 3.3**
+
+### Property 5: API Payload Construction
+
+*For any* valid form input (name, reason, description, expirationDate, scopeOverride, findingIds), the constructed Ivanti API request body should contain: `type` equal to "FALSE_POSITIVE", `name` equal to the input name, `reason` equal to the input reason, `expirationDate` equal to the input date, `scopeOverrideAuthorization` mapped from the input scopeOverride value, and `hostFindingIds` equal to the input finding IDs parsed as integers.
+
+**Validates: Requirements 4.1**
+
+### Property 6: Queue Items Marked Complete on Success
+
+*For any* set of queue item IDs associated with a successful FP workflow submission, after the post-submission handler runs, all those queue items should have `status === 'complete'`.
+
+**Validates: Requirements 5.1**
+
+### Property 7: Post-Submission Persistence Completeness
+
+*For any* successful FP workflow submission with a given workflow batch ID, name, user ID, and finding IDs, the resulting submission record should contain all of: ivanti_workflow_batch_id, workflow_name, user_id, finding_ids_json (parseable to the original finding IDs array), and a non-null created_at timestamp. Additionally, the audit log entry should have action "ivanti_fp_workflow_created", entity_type "ivanti_workflow", and details containing the workflow name and finding IDs.
+
+**Validates: Requirements 6.1, 6.2**
+
+### Property 8: Role-Based UI Visibility
+
+*For any* user role, the "Create FP Workflow" button should be visible if and only if the user's role is "editor" or "admin". Users with the "viewer" role should not see the button.
+
+**Validates: Requirements 7.2**
+
+## Error Handling
+
+### Ivanti API Errors
+
+| HTTP Status | Error Type | User-Facing Message | System Behavior |
+|-------------|-----------|---------------------|-----------------|
+| 401 | Auth failure | "Ivanti API key is invalid or missing. Contact your administrator." | Log error, preserve form state |
+| 419 | Insufficient privileges | "API key lacks workflow creation permissions." | Log error, preserve form state |
+| 429 | Rate limited | "Ivanti API rate limit reached. Please try again in a few minutes." | Log error, preserve form state |
+| 5xx | Server error | "Ivanti API is temporarily unavailable. Please try again later." | Log error, preserve form state |
+| Other | Unknown | "Workflow creation failed: {status} — {message}" | Log error with full response, preserve form state |
+
+### Partial Failure (Attachment Upload)
+
+When the workflow batch is created successfully but one or more attachment uploads fail:
+- The submission record is saved with `status = 'partial'`
+- The response includes the workflow batch ID and per-attachment success/failure details
+- The UI shows which attachments failed and allows retry
+- The queue items are still marked complete (the workflow itself was created)
+
+### Local Database Errors
+
+- If the submission record INSERT fails: log error, still return success to user (Ivanti workflow was created)
+- If queue item status UPDATE fails: return success with a warning that local queue state may be stale
+- If audit log INSERT fails: fire-and-forget (existing pattern from `logAudit()`)
+
+### Input Validation Errors
+
+- All validation errors return 400 with a structured error object mapping field names to error messages
+- Frontend validates before sending to prevent unnecessary API calls
+- Backend re-validates all inputs as a security measure
+
+## Testing Strategy
+
+### Property-Based Testing
+
+Use `fast-check` as the property-based testing library for JavaScript.
+
+Each correctness property maps to a single property-based test with a minimum of 100 iterations. Tests are tagged with the format: **Feature: ivanti-fp-workflow-submission, Property {number}: {title}**.
+
+Property tests focus on pure functions extracted from the implementation:
+- `isCreateFpButtonEnabled(items, selectedIds)` — Property 1
+- `filterFpItems(items)` — Property 2
+- `validateFpWorkflowForm(formData)` — Property 3
+- `isAllowedFileExtension(filename)` — Property 4
+- `buildIvantiPayload(formData, findingIds)` — Property 5
+- Queue item status update logic — Property 6
+- Submission record creation — Property 7
+- Role-based visibility check — Property 8
+
+### Unit Testing
+
+Unit tests complement property tests by covering:
+- Specific examples: known-good form submissions, known-bad inputs
+- Edge cases: empty finding lists, maximum file size boundary, expiration date exactly tomorrow
+- Error code mapping: verify each Ivanti HTTP status maps to the correct error message
+- Integration points: Multer file handling, multipart form construction
+- API response parsing: various Ivanti response formats
+
+### Test File Locations
+
+- `backend/__tests__/ivantiFpWorkflow.test.js` — backend route handler tests, validation, payload construction
+- `backend/__tests__/ivantiFpWorkflow.property.test.js` — property-based tests for backend logic
+- `frontend/src/__tests__/fpWorkflowModal.test.js` — frontend component and validation tests

.kiro/specs/ivanti-fp-workflow-submission/requirements.md

@@ -0,0 +1,99 @@
+# Requirements Document
+
+## Introduction
+
+This feature adds the ability for users to select items from the Ivanti Queue (QueuePanel) and submit False Positive (FP) workflows directly to the Ivanti/RiskSense API. Users can configure the FP workflow with a name, reason, description, expiration date, and the "Authorized" scope override option. Supporting documentation and artifacts can be uploaded and attached to the workflow via the API. Successful submissions mark the corresponding queue items as complete and are tracked locally with full audit logging.
+
+## Glossary
+
+- **Dashboard**: The STEAM Security Dashboard application
+- **Queue_Panel**: The slide-out panel in the Reporting Page that displays the user's Ivanti todo queue items grouped by vendor/CARD
+- **Queue_Item**: A single entry in the ivanti_todo_queue table representing a host finding staged for workflow processing, with fields including finding_id, finding_title, cves_json, ip_address, vendor, workflow_type, and status
+- **FP_Workflow**: A False Positive workflow batch created in the Ivanti/RiskSense platform to mark host findings as false positives, removing them from risk calculations
+- **Ivanti_API**: The Ivanti/RiskSense REST API at https://platform4.risksense.com/api/v1, authenticated via x-api-key header
+- **Workflow_Batch**: An Ivanti API resource representing a group of findings submitted together under a single workflow request
+- **Scope_Override_Authorization**: An Ivanti workflow property that controls whether additional findings can be added to or removed from the workflow after creation; values are "None" or "Authorized"
+- **Submission_Record**: A local database record tracking the details and outcome of an FP workflow submission made through the Dashboard
+- **Attachment**: A supporting document or artifact (PDF, screenshot, etc.) uploaded alongside an FP workflow submission as evidence or justification
+
+## Requirements
+
+### Requirement 1: Select FP Queue Items for Workflow Submission
+
+**User Story:** As an editor or admin, I want to select one or more FP-type items from the Ivanti Queue, so that I can batch them into a single False Positive workflow submission.
+
+#### Acceptance Criteria
+
+1. WHEN the Queue_Panel is open and contains FP-type Queue_Items, THE Dashboard SHALL display a "Create FP Workflow" action button that is enabled only when at least one pending FP-type Queue_Item is selected
+2. WHEN a user selects Queue_Items of mixed workflow_type (FP and non-FP), THE Dashboard SHALL only include FP-type Queue_Items in the FP workflow submission and SHALL visually indicate which items are eligible
+3. IF no pending FP-type Queue_Items are selected, THEN THE Dashboard SHALL disable the "Create FP Workflow" action button and display a tooltip explaining the requirement
+4. WHEN the "Create FP Workflow" button is clicked, THE Dashboard SHALL open the FP Workflow Submission modal pre-populated with the selected finding IDs
+
+### Requirement 2: Configure FP Workflow Details
+
+**User Story:** As an editor or admin, I want to configure the FP workflow properties before submission, so that I can provide the required justification and metadata for the false positive request.
+
+#### Acceptance Criteria
+
+1. THE FP_Workflow submission modal SHALL present input fields for: workflow name (required, max 255 characters), reason/justification (required), description (optional, max 2000 characters), and expiration date (required, must be a future date)
+2. THE FP_Workflow submission modal SHALL include a Scope_Override_Authorization toggle defaulting to "Authorized"
+3. THE FP_Workflow submission modal SHALL display a summary list of the selected Queue_Items including finding_id, finding_title, and associated CVEs
+4. WHEN a user attempts to submit with missing required fields, THE Dashboard SHALL display inline validation errors for each invalid field and prevent submission
+5. IF the expiration date is set to a date in the past or today, THEN THE Dashboard SHALL reject the value and display a validation message indicating the date must be in the future
+
+### Requirement 3: Upload Supporting Documentation
+
+**User Story:** As an editor or admin, I want to upload supporting documents and artifacts with my FP workflow submission, so that reviewers have the evidence needed to approve the false positive request.
+
+#### Acceptance Criteria
+
+1. THE FP_Workflow submission modal SHALL include a file upload area that accepts multiple files with a maximum size of 10 MB per file
+2. WHEN files are added to the upload area, THE Dashboard SHALL display each file name, size, and a remove button
+3. THE Dashboard SHALL accept files with extensions: .pdf, .png, .jpg, .jpeg, .gif, .doc, .docx, .xlsx, .csv, .txt, .zip
+4. IF a user attempts to upload a file exceeding 10 MB, THEN THE Dashboard SHALL reject the file and display an error message stating the size limit
+5. IF a user attempts to upload a file with a disallowed extension, THEN THE Dashboard SHALL reject the file and display an error message listing the allowed file types
+
+### Requirement 4: Submit FP Workflow to Ivanti API
+
+**User Story:** As an editor or admin, I want to submit the configured FP workflow to the Ivanti API, so that the false positive request is created in the Ivanti/RiskSense platform with all associated findings and attachments.
+
+#### Acceptance Criteria
+
+1. WHEN the user clicks Submit, THE Dashboard SHALL send a POST request to the Ivanti_API to create a Workflow_Batch of type "False Positive" with the configured name, reason, description, expiration date, Scope_Override_Authorization setting, and the list of host finding IDs
+2. WHEN the Workflow_Batch is created successfully and attachments are present, THE Dashboard SHALL upload each Attachment to the Ivanti_API associated with the created Workflow_Batch
+3. WHEN the submission is in progress, THE Dashboard SHALL display a progress indicator showing the current step (creating workflow, uploading attachment 1 of N, etc.) and disable the Submit button to prevent duplicate submissions
+4. WHEN the entire submission completes successfully, THE Dashboard SHALL display a success message including the Ivanti-generated workflow batch ID (e.g., "FP#12345")
+5. IF the Ivanti_API returns a 401 status, THEN THE Dashboard SHALL display an error message indicating the API key is invalid or missing
+6. IF the Ivanti_API returns a 429 status, THEN THE Dashboard SHALL display an error message indicating rate limiting and suggest retrying later
+7. IF the Ivanti_API returns any other error status during workflow creation, THEN THE Dashboard SHALL display the error details and preserve the user's form input so they can retry without re-entering data
+8. IF an attachment upload fails after the workflow is created, THEN THE Dashboard SHALL report which attachments failed, display the workflow batch ID for the successfully created workflow, and allow the user to retry the failed uploads
+
+### Requirement 5: Post-Submission Queue Item Updates
+
+**User Story:** As an editor or admin, I want queue items to be automatically marked complete after a successful FP workflow submission, so that my queue reflects the current processing state.
+
+#### Acceptance Criteria
+
+1. WHEN an FP workflow submission completes successfully, THE Dashboard SHALL mark all associated Queue_Items as "complete" status
+2. WHEN Queue_Items are marked complete after submission, THE Dashboard SHALL refresh the Queue_Panel to reflect the updated statuses
+3. IF marking a Queue_Item as complete fails locally, THEN THE Dashboard SHALL display a warning that the workflow was submitted successfully but the local queue status could not be updated
+
+### Requirement 6: Local Submission Tracking
+
+**User Story:** As an editor or admin, I want FP workflow submissions to be tracked locally, so that I can review submission history and audit past actions.
+
+#### Acceptance Criteria
+
+1. WHEN an FP workflow submission completes successfully, THE Dashboard SHALL create a Submission_Record in the local database containing: the Ivanti workflow batch ID, workflow name, submitting user ID, list of finding IDs, submission timestamp, and status
+2. WHEN an FP workflow submission completes successfully, THE Dashboard SHALL log an audit entry with action "ivanti_fp_workflow_created", entity type "ivanti_workflow", the workflow batch ID as entity ID, and details including the finding IDs and workflow name
+3. IF an FP workflow submission fails, THEN THE Dashboard SHALL log an audit entry with action "ivanti_fp_workflow_failed" including the error details
+
+### Requirement 7: Authorization and Access Control
+
+**User Story:** As a system administrator, I want FP workflow submission restricted to authorized users, so that only editors and admins can create workflows in the Ivanti platform.
+
+#### Acceptance Criteria
+
+1. THE Dashboard SHALL restrict the FP workflow submission API endpoint to users with the "Admin" or "Standard_User" group membership
+2. THE Dashboard SHALL restrict the FP workflow submission UI controls to users with editor or admin roles
+3. WHILE a user has the viewer role, THE Dashboard SHALL hide the "Create FP Workflow" button from the Queue_Panel

.kiro/specs/ivanti-fp-workflow-submission/tasks.md

@@ -0,0 +1,109 @@
+# Implementation Plan: Ivanti FP Workflow Submission
+
+## Overview
+
+Implement the ability to select FP-type items from the Ivanti Queue and submit False Positive workflows to the Ivanti/RiskSense API, with file attachment support, local submission tracking, and audit logging. The implementation follows existing codebase conventions: factory-pattern Express routes, Multer for file uploads, inline React component styles with the dark tactical theme, and the `ivantiPost()` HTTP helper for Ivanti API calls.
+
+## Tasks
+
+- [x] 1. Database migration and shared helpers
+  - [x] 1.1 Create migration script `backend/migrations/add_fp_submissions_table.js`
+    - Create `ivanti_fp_submissions` table with columns: id, user_id, username, ivanti_workflow_batch_id, ivanti_generated_id, workflow_name, reason, description, expiration_date, scope_override, finding_ids_json, queue_item_ids_json, attachment_count, attachment_results_json, status (success/partial/failed), error_message, created_at
+    - Add indexes on user_id and ivanti_generated_id
+    - Follow existing migration pattern from `add_ivanti_todo_queue_table.js`
+    - _Requirements: 6.1_
+
+  - [x] 1.2 Extract shared Ivanti API helpers into `backend/helpers/ivantiApi.js`
+    - Move the `ivantiPost()` function from `ivantiWorkflows.js` into a shared module
+    - Add `ivantiMultipartPost(urlPath, fileBuffer, fileName, apiKey, skipTls)` for attachment uploads using Node.js `https` module with multipart/form-data boundary construction
+    - Export both functions; update `ivantiWorkflows.js` and `ivantiFindings.js` to import from the shared module
+    - _Requirements: 4.1, 4.2_
+
+- [x] 2. Backend route — validation and payload construction
+  - [x] 2.1 Create `backend/routes/ivantiFpWorkflow.js` with validation and payload builder
+    - Export `createIvantiFpWorkflowRouter(db, requireAuth)` factory function
+    - Implement `POST /` route with `requireAuth(db)` and `requireGroup('Admin', 'Standard_User')` middleware
+    - Configure Multer for up to 10 file uploads, 10MB each, with allowed extensions: .pdf, .png, .jpg, .jpeg, .gif, .doc, .docx, .xlsx, .csv, .txt, .zip
+    - Implement `validateFpWorkflowForm(body)` — returns error map for invalid fields (name required max 255, reason required, description max 2000, expirationDate required and must be future date)
+    - Implement `buildIvantiPayload(formData, findingIds)` — constructs the Ivanti API request body with type "FALSE_POSITIVE", scopeOverrideAuthorization mapping, and hostFindingIds as integers
+    - Implement `isAllowedFileExtension(filename)` — checks against the allowed extensions list (case-insensitive)
+    - Verify all queueItemIds belong to the requesting user, are FP-type, and have pending status
+    - _Requirements: 2.4, 2.5, 3.3, 3.4, 3.5, 4.1, 7.1_
+
+  - [ ]* 2.2 Write property tests for validation and payload construction
+    - **Property 3: Form Validation Correctness** — For any form state, validation passes iff all required fields present and expiration date is future; error map keys match invalid fields only
+    - **Property 4: File Extension Validation** — For any filename, acceptance returns true iff extension is in the allowed set (case-insensitive)
+    - **Property 5: API Payload Construction** — For any valid form input, the constructed payload contains correct type, name, reason, expirationDate, scopeOverrideAuthorization, and hostFindingIds as integers
+    - Use `fast-check` library with minimum 100 iterations per property
+    - **Validates: Requirements 2.4, 2.5, 3.3, 4.1**
+
+- [x] 3. Backend route — Ivanti API submission and local persistence
+  - [x] 3.1 Implement the submission flow in `ivantiFpWorkflow.js`
+    - Call Ivanti API `POST /client/{clientId}/workflowBatch` to create the FP workflow batch
+    - If attachments present, upload each via `ivantiMultipartPost()` to `/client/{clientId}/workflowBatch/{id}/attachment`
+    - Handle Ivanti API error responses: 401 (invalid key), 419 (insufficient privileges), 429 (rate limited), other errors
+    - On success: insert submission record into `ivanti_fp_submissions`, call `logAudit()` with action "ivanti_fp_workflow_created"
+    - On failure: call `logAudit()` with action "ivanti_fp_workflow_failed"
+    - Mark associated queue items as complete via `UPDATE ivanti_todo_queue SET status='complete'`
+    - Handle partial failures (workflow created but attachment upload failed) — save with status "partial"
+    - Return structured response with workflowBatchId, generatedId, attachmentResults, queueItemsUpdated
+    - _Requirements: 4.1, 4.2, 4.5, 4.6, 4.7, 4.8, 5.1, 6.1, 6.2, 6.3_
+
+  - [ ]* 3.2 Write property tests for queue item completion and submission persistence
+    - **Property 6: Queue Items Marked Complete on Success** — For any set of queue item IDs after successful submission, all items have status "complete"
+    - **Property 7: Post-Submission Persistence Completeness** — For any successful submission, the record contains all required fields (ivanti_workflow_batch_id, workflow_name, user_id, finding_ids_json, created_at) and audit entry has correct action/entity_type/details
+    - Use in-memory SQLite for test isolation
+    - **Validates: Requirements 5.1, 6.1, 6.2**
+
+- [x] 4. Wire backend route into server.js
+  - [x] 4.1 Register the new route in `backend/server.js`
+    - Add `const createIvantiFpWorkflowRouter = require('./routes/ivantiFpWorkflow');`
+    - Mount at `app.use('/api/ivanti/fp-workflow', createIvantiFpWorkflowRouter(db, requireAuth));`
+    - Place near the existing Ivanti route registrations
+    - _Requirements: 7.1_
+
+- [x] 5. Checkpoint — Backend complete
+  - Ensure all tests pass, ask the user if questions arise.
+
+- [x] 6. Frontend — FP Workflow Modal component
+  - [x] 6.1 Implement `FpWorkflowModal` in `frontend/src/components/pages/ReportingPage.js`
+    - Add the modal component inline in ReportingPage.js following the existing pattern (QueuePanel, AddToQueuePopover are in the same file)
+    - Props: open, onClose, selectedItems (FP queue items), onSuccess
+    - Form fields: workflow name (text input, required), reason (textarea, required), description (textarea, optional), expiration date (date input, required), scope override toggle (Authorized/None, default Authorized)
+    - Display selected findings summary: finding_id, finding_title, CVEs for each item
+    - File upload area: drag-and-drop zone, file list with name/size/remove button, validate extensions and 10MB limit client-side
+    - Submit button with progress indicator (creating workflow → uploading attachment N of M)
+    - Error display: inline validation errors, API error messages with form state preservation
+    - Success display: workflow batch ID (e.g., "FP#12345") with close/done action
+    - Style with inline style objects matching the dark tactical theme from DESIGN_SYSTEM.md
+    - Icons from lucide-react (Upload, FileText, X, Check, AlertTriangle, Loader)
+    - _Requirements: 2.1, 2.2, 2.3, 2.4, 2.5, 3.1, 3.2, 3.3, 3.4, 3.5, 4.3, 4.4, 4.7, 4.8_
+
+  - [ ]* 6.2 Write property tests for frontend validation helpers
+    - **Property 1: FP Workflow Button Enabled State** — For any set of queue items and selection, button enabled iff selection contains at least one pending FP item
+    - **Property 2: FP-Only Item Filtering** — For any mixed-type selection, filtered result contains only FP items
+    - **Property 8: Role-Based UI Visibility** — For any user role, button visible iff role is editor or admin
+    - Extract `isCreateFpButtonEnabled`, `filterFpItems`, `shouldShowFpButton` as testable pure functions
+    - Use `fast-check` with minimum 100 iterations
+    - **Validates: Requirements 1.1, 1.2, 7.2**
+
+- [x] 7. Frontend — QueuePanel integration
+  - [x] 7.1 Add "Create FP Workflow" button and modal wiring in QueuePanel
+    - Add "Create FP Workflow" button in QueuePanel footer, styled with amber/FP accent color
+    - Button enabled only when selectedIds contains at least one pending FP-type item
+    - Disabled state shows tooltip: "Select pending FP items to create a workflow"
+    - Hide button entirely for viewer role users (check via useAuth context)
+    - On click: filter selected items to FP-only, open FpWorkflowModal with filtered items
+    - Wire onSuccess callback to trigger queue refresh (call existing fetch function from parent)
+    - _Requirements: 1.1, 1.2, 1.3, 1.4, 5.2, 7.2, 7.3_
+
+- [x] 8. Final checkpoint — Full integration
+  - Ensure all tests pass, ask the user if questions arise.
+
+## Notes
+
+- Tasks marked with `*` are optional and can be skipped for faster MVP
+- Each task references specific requirements for traceability
+- Property tests use `fast-check` library — install via `npm install --save-dev fast-check` in both backend and frontend
+- The shared Ivanti API helper (task 1.2) updates existing imports in ivantiWorkflows.js and ivantiFindings.js — test those routes still work after the refactor
+- Multer is already a project dependency (used for document uploads in server.js)

.kiro/specs/queue-hostname-ip-display/.config.kiro

@@ -0,0 +1 @@
+{"specId": "b8855eb4-3949-426e-86ac-36fe069a6bb1", "workflowType": "requirements-first", "specType": "feature"}

.kiro/specs/queue-hostname-ip-display/design.md

@@ -0,0 +1,175 @@
+# Design Document: Queue Hostname & IP Display
+
+## Overview
+
+This feature adds hostname tracking to the Ivanti todo queue. Currently the queue stores `ip_address` but not `hostname`. The change spans three layers:
+
+1. **Database** — A migration adds a `hostname TEXT` column to `ivanti_todo_queue`.
+2. **Backend API** — The POST (single + batch) endpoints accept and store an optional `hostname` field. The GET endpoint already uses `SELECT *`, so hostname is returned automatically once the column exists.
+3. **Frontend** — The `addToQueue` and `submitBatch` functions pass `finding.hostName` as `hostname`. The QueuePanel renders hostname and IP address for both CARD and vendor-grouped (FP/Archer) sections.
+
+The change is additive and backward-compatible. Existing rows get `NULL` for hostname. No existing behavior changes unless both hostname and ip_address are present.
+
+## Architecture
+
+The data flows through three layers in a straight pipeline:
+
+```mermaid
+flowchart LR
+    A[Ivanti Finding<br/>hostName, ipAddress] -->|POST /todo-queue| B[Express Route<br/>ivantiTodoQueue.js]
+    B -->|INSERT hostname, ip_address| C[SQLite<br/>ivanti_todo_queue]
+    C -->|SELECT *| B
+    B -->|GET response| D[QueuePanel<br/>ReportingPage.js]
+```
+
+No new services, tables, or route modules are introduced. The migration script is a standalone Node.js file following the existing pattern in `backend/migrations/`.
+
+## Components and Interfaces
+
+### Migration Script: `backend/migrations/add_todo_queue_hostname.js`
+
+Follows the exact pattern of `add_todo_queue_ip_address.js`:
+
+- Opens `cve_database.db` via `sqlite3`
+- Runs `ALTER TABLE ivanti_todo_queue ADD COLUMN hostname TEXT`
+- Catches `duplicate column name` error to make it idempotent
+- Closes the database connection
+
+### Backend Route: `backend/routes/ivantiTodoQueue.js`
+
+Changes to two endpoints:
+
+**POST `/` (single-item)**
+- Extract `hostname` from `req.body`
+- Sanitize: if present and a string, trim and slice to 255 chars; otherwise `null`
+- Add to the INSERT column list and parameter array
+
+**POST `/batch`**
+- For each finding in the `findings` array, extract `hostname` from `f.hostname`
+- Same sanitization as single-item
+- Add to the per-row INSERT column list and parameter array
+
+**GET `/`** — No code change needed. `SELECT *` already returns all columns.
+
+**PUT `/:id`** — No change. Hostname is set at insert time and not editable.
+
+### Frontend: `ReportingPage.js`
+
+**`addToQueue` function**
+- Add `hostname: finding.hostName || null` to the POST body
+
+**`submitBatch` function**
+- Add `hostname: f.hostName || null` to each finding object in `findingsPayload`
+
+**QueuePanel rendering (per item)**
+
+For CARD items, the content `<div>` currently shows:
+1. `finding_id`
+2. `ip_address` (if present)
+
+New rendering for CARD items:
+1. `finding_id`
+2. `hostname` (if present)
+3. `ip_address` (if present)
+
+For vendor-grouped items (FP/Archer), the content `<div>` currently shows:
+1. `finding_id`
+2. CVE list (if present)
+
+New rendering for vendor-grouped items:
+1. `finding_id`
+2. CVE list (if present)
+3. `hostname` (if present)
+4. `ip_address` (if present)
+
+Both hostname and IP use the same monospace styling at `0.68rem` / `0.62rem` with muted colors consistent with the existing design system.
+
+## Data Models
+
+### `ivanti_todo_queue` table (after migration)
+
+| Column | Type | Nullable | Notes |
+|--------|------|----------|-------|
+| id | INTEGER | NO | PRIMARY KEY AUTOINCREMENT |
+| user_id | INTEGER | NO | FK → users(id) |
+| finding_id | TEXT | NO | |
+| finding_title | TEXT | YES | max 500 chars |
+| cves_json | TEXT | YES | JSON array string |
+| ip_address | TEXT | YES | max 64 chars |
+| **hostname** | **TEXT** | **YES** | **max 255 chars (new)** |
+| vendor | TEXT | NO | |
+| workflow_type | TEXT | NO | FP, Archer, or CARD |
+| status | TEXT | NO | pending or complete |
+| created_at | DATETIME | NO | DEFAULT CURRENT_TIMESTAMP |
+| updated_at | DATETIME | NO | DEFAULT CURRENT_TIMESTAMP |
+
+### API Request/Response Changes
+
+**POST `/api/ivanti/todo-queue` body** — adds optional field:
+```json
+{
+  "finding_id": "...",
+  "finding_title": "...",
+  "cves": [],
+  "ip_address": "...",
+  "hostname": "server01.example.com",
+  "vendor": "...",
+  "workflow_type": "CARD"
+}
+```
+
+**POST `/api/ivanti/todo-queue/batch` body** — adds optional field per finding:
+```json
+{
+  "findings": [
+    { "finding_id": "...", "ip_address": "...", "hostname": "server01.example.com" }
+  ],
+  "workflow_type": "FP",
+  "vendor": "VendorName"
+}
+```
+
+**GET response** — `hostname` field included automatically via `SELECT *`:
+```json
+{
+  "id": 1,
+  "finding_id": "...",
+  "hostname": "server01.example.com",
+  "ip_address": "10.0.0.1",
+  "..."
+}
+```
+
+
+## Correctness Properties
+
+*A property is a characteristic or behavior that should hold true across all valid executions of a system — essentially, a formal statement about what the system should do. Properties serve as the bridge between human-readable specifications and machine-verifiable correctness guarantees.*
+
+### Property 1: Hostname storage round-trip
+
+*For any* valid hostname string (up to 255 characters), storing it via the queue API (single or batch endpoint) and then retrieving it via GET should return the exact same trimmed string. When the hostname is omitted, null, or empty, the stored and returned value should be null.
+
+**Validates: Requirements 2.1, 2.2, 2.3, 2.4**
+
+### Property 2: Hostname display presence
+
+*For any* queue item with a non-null hostname value, the rendered QueuePanel output should contain the hostname text, regardless of whether the item is a CARD item or a vendor-grouped (FP/Archer) item.
+
+**Validates: Requirements 4.1, 5.1**
+
+## Error Handling
+
+| Scenario | Handling |
+|----------|----------|
+| Migration run when column already exists | Catch `duplicate column name` SQLite error, log skip message, exit cleanly |
+| `hostname` field is not a string | Treat as null — store NULL in database |
+| `hostname` exceeds 255 characters | Truncate to 255 characters via `.slice(0, 255)` |
+| `hostname` is undefined/null/empty string | Store NULL in database |
+| GET returns item with null hostname | Frontend conditionally renders — no hostname line shown |
+| GET returns item with null ip_address and null hostname | CARD: show only finding_id. Vendor: show finding_id + CVEs only |
+
+No new error codes or HTTP status changes are introduced. The hostname field is optional and its absence is a normal case, not an error.
+
+## Testing Strategy
+
+Testing is out of scope for this feature. Manual verification will be performed after implementation.

.kiro/specs/queue-hostname-ip-display/requirements.md

@@ -0,0 +1,70 @@
+# Requirements Document
+
+## Introduction
+
+The Ivanti Queue (todo queue) in the STEAM Security Dashboard currently stores and displays `ip_address` for CARD workflow items but omits hostname entirely. Vendor-grouped sections (FP/Archer) display only `finding_id` and CVEs, hiding the `ip_address` that is already stored. This feature adds a `hostname` column to the database, passes hostname through the backend API, and displays both hostname and IP address across all queue sections (CARD, FP, Archer).
+
+## Glossary
+
+- **Queue_Panel**: The slide-out side panel (`QueuePanel` component) that displays the user's staged Ivanti findings grouped by workflow type and vendor.
+- **Queue_API**: The Express route module (`ivantiTodoQueue.js`) that handles CRUD operations on the `ivanti_todo_queue` table.
+- **Queue_Table**: The SQLite table `ivanti_todo_queue` that persists per-user queue items.
+- **CARD_Section**: The top group in the Queue_Panel that displays items with `workflow_type = 'CARD'`.
+- **Vendor_Section**: Groups in the Queue_Panel for FP and Archer workflow items, organized by vendor name.
+- **Finding**: An Ivanti host finding record containing fields such as `id`, `title`, `hostName`, `ipAddress`, `cves`, and `severity`.
+- **Migration_Script**: A standalone Node.js script in `backend/migrations/` that alters the SQLite schema.
+
+## Requirements
+
+### Requirement 1: Add hostname column to the queue database table
+
+**User Story:** As a developer, I want the queue table to have a `hostname` column, so that hostname data can be persisted alongside each queued finding.
+
+#### Acceptance Criteria
+
+1. THE Migration_Script SHALL add a `hostname` TEXT column to the Queue_Table.
+2. WHEN the `hostname` column already exists, THE Migration_Script SHALL skip the alteration and log a message indicating the column already exists.
+3. THE Migration_Script SHALL preserve all existing rows and column data in the Queue_Table.
+
+### Requirement 2: Accept and store hostname in queue API endpoints
+
+**User Story:** As a developer, I want the queue API to accept a `hostname` field, so that hostname data is stored when findings are added to the queue.
+
+#### Acceptance Criteria
+
+1. WHEN a POST request is received at the single-item endpoint, THE Queue_API SHALL accept an optional `hostname` string field (max 255 characters) and store it in the Queue_Table.
+2. WHEN a POST request is received at the batch endpoint, THE Queue_API SHALL accept an optional `hostname` string field on each finding object (max 255 characters) and store it in the Queue_Table.
+3. WHEN the `hostname` field is omitted or empty, THE Queue_API SHALL store NULL for the `hostname` column.
+4. WHEN a GET request is received, THE Queue_API SHALL return the `hostname` field for each queue item in the response.
+
+### Requirement 3: Pass hostname from the frontend to the queue API
+
+**User Story:** As a developer, I want the frontend to send hostname data when adding findings to the queue, so that hostname is captured from the Ivanti findings data.
+
+#### Acceptance Criteria
+
+1. WHEN a single finding is added to the queue, THE ReportingPage SHALL include the finding's `hostName` value in the `hostname` field of the POST request body.
+2. WHEN findings are added via batch submission, THE ReportingPage SHALL include each finding's `hostName` value in the `hostname` field of the corresponding finding object in the POST request body.
+
+### Requirement 4: Display hostname and IP address in the CARD section
+
+**User Story:** As a security analyst, I want to see both hostname and IP address for CARD items in the queue, so that I can identify the affected host at a glance.
+
+#### Acceptance Criteria
+
+1. WHEN a CARD item has a `hostname` value, THE CARD_Section SHALL display the hostname below the finding ID.
+2. WHEN a CARD item has an `ip_address` value, THE CARD_Section SHALL display the IP address below the hostname.
+3. WHEN a CARD item has both `hostname` and `ip_address`, THE CARD_Section SHALL display hostname on one line and IP address on the next line.
+4. WHEN a CARD item has only `ip_address` and no `hostname`, THE CARD_Section SHALL display the IP address (preserving current behavior).
+5. WHEN a CARD item has only `hostname` and no `ip_address`, THE CARD_Section SHALL display the hostname.
+
+### Requirement 5: Display hostname and IP address in vendor sections (FP/Archer)
+
+**User Story:** As a security analyst, I want to see hostname and IP address for FP and Archer items in the queue, so that I can identify affected hosts without leaving the queue panel.
+
+#### Acceptance Criteria
+
+1. WHEN a vendor-grouped item has a `hostname` value, THE Vendor_Section SHALL display the hostname below the CVE list.
+2. WHEN a vendor-grouped item has an `ip_address` value, THE Vendor_Section SHALL display the IP address below the hostname (or below the CVE list if no hostname exists).
+3. WHEN a vendor-grouped item has both `hostname` and `ip_address`, THE Vendor_Section SHALL display hostname on one line and IP address on the next line, both below the CVE list.
+4. WHEN a vendor-grouped item has neither `hostname` nor `ip_address`, THE Vendor_Section SHALL display only the finding ID and CVE list (preserving current behavior).

.kiro/specs/queue-hostname-ip-display/tasks.md

@@ -0,0 +1,56 @@
+# Implementation Plan: Queue Hostname & IP Display
+
+## Overview
+
+Add hostname tracking to the Ivanti todo queue across database, backend API, and frontend display layers. All changes are additive and backward-compatible.
+
+## Tasks
+
+- [x] 1. Create database migration to add hostname column
+  - Create `backend/migrations/add_todo_queue_hostname.js` following the exact pattern of `add_todo_queue_ip_address.js`
+  - Use `ALTER TABLE ivanti_todo_queue ADD COLUMN hostname TEXT`
+  - Handle `duplicate column name` error for idempotency
+  - Log appropriate messages for success and skip scenarios
+  - _Requirements: 1.1, 1.2, 1.3_
+
+- [x] 2. Update backend API endpoints to accept and store hostname
+  - [x] 2.1 Update POST `/` (single-item) endpoint in `backend/routes/ivantiTodoQueue.js`
+    - Extract `hostname` from `req.body`
+    - Sanitize: if present and a string, trim and slice to 255 chars; otherwise `null`
+    - Add `hostname` to the INSERT column list and parameter array
+    - _Requirements: 2.1, 2.3_
+
+  - [x] 2.2 Update POST `/batch` endpoint in `backend/routes/ivantiTodoQueue.js`
+    - For each finding, extract `hostname` from `f.hostname`
+    - Apply same sanitization as single-item (trim, slice to 255, or null)
+    - Add `hostname` to the per-row INSERT column list and parameter array
+    - _Requirements: 2.2, 2.3_
+
+- [x] 3. Checkpoint
+  - Ensure all backend changes are consistent, ask the user if questions arise.
+
+- [x] 4. Update frontend to pass hostname and display it in the queue panel
+  - [x] 4.1 Update `addToQueue` function in `ReportingPage.js`
+    - Add `hostname: finding.hostName || null` to the POST request body
+    - _Requirements: 3.1_
+
+  - [x] 4.2 Update `submitBatch` function in `ReportingPage.js`
+    - Add `hostname: f.hostName || null` to each finding object in the payload
+    - _Requirements: 3.2_
+
+  - [x] 4.3 Update CARD section rendering in QueuePanel (`ReportingPage.js`)
+    - Display `hostname` below finding_id (when present)
+    - Display `ip_address` below hostname (when present)
+    - Handle all combinations: both present, only hostname, only ip_address, neither
+    - Use monospace styling at `0.68rem` consistent with existing ip_address display
+    - _Requirements: 4.1, 4.2, 4.3, 4.4, 4.5_
+
+  - [x] 4.4 Update vendor section (FP/Archer) rendering in QueuePanel (`ReportingPage.js`)
+    - Display `hostname` below the CVE list (when present)
+    - Display `ip_address` below hostname or below CVE list if no hostname
+    - Handle all combinations: both present, only one, neither
+    - Use monospace styling at `0.62rem` / `0.68rem` with muted colors matching existing design
+    - _Requirements: 5.1, 5.2, 5.3, 5.4_
+
+- [x] 5. Final checkpoint
+  - Ensure all changes are wired together end-to-end, ask the user if questions arise.

README.md

@@ -13,7 +13,7 @@ A self-hosted vulnerability management dashboard for the NTS-AEO-STEAM and NTS-A
 - [Configuration](#configuration)
 - [Running the Application](#running-the-application)
 - [Features](#features)
-  - [Authentication and User Roles](#authentication-and-user-roles)
+  - [Authentication and User Groups](#authentication-and-user-groups)
   - [Home — CVE Management](#home--cve-management)
   - [Reporting — Host Findings](#reporting--host-findings)
   - [Ivanti Queue](#ivanti-queue)
@@ -28,7 +28,9 @@ A self-hosted vulnerability management dashboard for the NTS-AEO-STEAM and NTS-A
 - [Architecture](#architecture)
 - [Database Schema](#database-schema)
 - [Security Model](#security-model)
+- [Upgrading an Existing Deployment](#upgrading-an-existing-deployment)
 - [Migrations](#migrations)
+- [Troubleshooting](#troubleshooting)
 
 ---
 
@@ -46,7 +48,7 @@ The application provides:
 - **AEO Compliance page** — weekly xlsx upload, diff preview, per-team metric health cards, device-level violation tracking with notes history
 - Archer risk acceptance ticket tracking (EXC numbers) linked to CVE/vendor pairs
 - A knowledge base for internal documentation and policies
-- Role-based access control with a full audit trail
+- Group-based access control (Admin, Standard_User, Leadership, Read_Only) with a full audit trail
 
 ---
 
@@ -54,11 +56,11 @@ The application provides:
 
 | Layer | Technology |
 |---|---|
-| Backend | Node.js, Express 5 |
+| Backend | Node.js 18+, Express 5 |
 | Database | SQLite3 |
 | File uploads | Multer 2 |
-| Auth | bcryptjs, cookie-based sessions |
-| Frontend | React 19, lucide-react, xlsx |
+| Auth | bcryptjs, cookie-based sessions, express-rate-limit |
+| Frontend | React 19, lucide-react, xlsx, rehype-sanitize |
 | Compliance xlsx parsing | Python 3, pandas, openpyxl |
 | Bulk notes import | Python 3 (stdlib only) |
 
@@ -84,7 +86,6 @@ cd cve-dashboard
 ### 2. Install backend dependencies
 
 ```bash
-cd backend
 npm install
 ```
 
@@ -107,7 +108,20 @@ apt install -y python3-pandas python3-openpyxl
 
 > The bulk notes import script (`import_notes_from_csv.py`) uses only Python stdlib and does **not** require these packages.
 
-### 5. Initialize the database
+### 5. Configure environment variables
+
+Create `backend/.env` — the server will refuse to start without `SESSION_SECRET`:
+
+```bash
+cd backend
+cp .env.example .env
+# Edit .env and set SESSION_SECRET to a random string:
+#   openssl rand -base64 32
+```
+
+See [Configuration](#configuration) for all available options.
+
+### 6. Initialize the database
 
 Run once from the `backend/` directory to create the SQLite database, all tables, indexes, and a default admin user:
 
@@ -116,13 +130,9 @@ cd backend
 node setup.js
 ```
 
-This creates `backend/cve_database.db` and a default admin account:
-- Username: `admin`
-- Password: `admin123`
+This creates `backend/cve_database.db` and generates a random admin password printed to stdout. **Save the password — it is only shown once.**
 
-**Change the admin password immediately after first login.**
-
-### 6. Run database migrations
+### 7. Run database migrations
 
 Apply all feature migrations in order:
 
@@ -136,9 +146,14 @@ node migrations/add_ivanti_todo_queue_table.js
 node migrations/add_card_workflow_type.js
 node migrations/add_todo_queue_ip_address.js
 node migrations/add_compliance_tables.js
+node migrations/add_finding_archive_tables.js
+node migrations/add_archer_tickets_timestamps.js
+node migrations/add_ivanti_counts_history_table.js
+node migrations/add_user_groups.js
+node migrations/add_created_by_columns.js
 ```
 
-### 7. Build the frontend
+### 8. Build the frontend
 
 ```bash
 cd frontend
@@ -159,8 +174,8 @@ The application is configured via `.env` files. These files are gitignored and m
 PORT=3001
 API_HOST=localhost
 CORS_ORIGINS=http://YOUR_IP:3000
-SESSION_SECRET=change-this-to-a-long-random-string
-NODE_ENV=production
+SESSION_SECRET=<generate with: openssl rand -base64 32>
+# NODE_ENV=production  — see note below
 
 # Optional: NVD API key for higher rate limits (50 req/30s vs 5 req/30s)
 # Register at https://nvd.nist.gov/developers/request-an-api-key
@@ -176,6 +191,10 @@ IVANTI_LAST_NAME=
 IVANTI_SKIP_TLS=false
 ```
 
+**`SESSION_SECRET` is required.** The server will exit on startup if it is not set. Generate one with `openssl rand -base64 32`.
+
+**`NODE_ENV` and the Secure cookie flag:** When `NODE_ENV=production`, session cookies are set with the `Secure` flag, which means the browser will only send them over HTTPS connections. If you are running the application over plain HTTP (no TLS/SSL), you **must** leave `NODE_ENV` unset or set it to `development` — otherwise login will succeed but every subsequent API request will return 401 because the browser silently drops the cookie. Only set `NODE_ENV=production` when the application is served behind HTTPS (e.g., via a reverse proxy with TLS termination).
+
 ### Frontend: `frontend/.env`
 
 ```env
@@ -225,17 +244,26 @@ npm start
 
 ## Features
 
-### Authentication and User Roles
+### Authentication and User Groups
 
-All routes require authentication. Three roles are supported:
+All routes require authentication. Four user groups are supported:
 
-| Role | Permissions |
+| Group | Permissions |
 |---|---|
-| `viewer` | Read-only: CVEs, documents, findings, reports, knowledge base, Archer tickets, compliance data |
-| `editor` | All viewer permissions plus: create/update CVEs, upload documents, sync Ivanti findings, save notes and overrides, manage knowledge base, manage Archer tickets, upload compliance reports, manage Ivanti Queue |
-| `admin` | All editor permissions plus: delete documents, delete reports, manage users, view audit logs |
+| `Admin` | Full CRUD on all resources, user management, audit log access, export all data, delete any resource regardless of ownership |
+| `Standard_User` | View all data, create and edit resources, delete own resources (with state and compliance restrictions), basic export (CSV/XLSX) |
+| `Leadership` | View all data, export reports/compliance/visualizations, no create/edit/delete |
+| `Read_Only` | View all data only — no create, edit, delete, or export |
 
-Sessions expire after 24 hours. Session tokens are stored in `httpOnly` cookies.
+**Standard User delete restrictions:**
+- Can only delete resources they created (`created_by` ownership check)
+- Cannot delete findings marked as resolved or closed
+- Cannot delete tickets linked to compliance reports
+- CVE deletion triggers a cascade impact check — if any associated Archer or JIRA ticket is compliance-linked, deletion is blocked and requires Admin intervention
+
+Sessions expire after 24 hours. Session tokens are stored in `httpOnly` cookies. Login is rate-limited to 20 attempts per 15-minute window.
+
+**Migration from legacy roles:** The `add_user_groups.js` migration automatically maps existing users: `admin` → `Admin`, `editor` → `Standard_User`, `viewer` → `Read_Only`. Unrecognized or NULL roles default to `Read_Only`.
 
 ---
 
@@ -249,11 +277,11 @@ The home page is the primary CVE research and tracking tool.
 - Color-coded severity badges: Critical (red), High (amber), Medium (sky blue), Low (green)
 - Paginated list view
 
-**CVE Operations (editor/admin)**
+**CVE Operations (Admin/Standard_User)**
 - Add a new CVE entry — NVD auto-fill populates description, severity, and published date automatically
 - Edit any field on an existing CVE entry
 - Update status for all vendor rows matching a CVE ID in one click
-- Delete a single vendor entry or all vendor entries for a CVE ID
+- Delete a single vendor entry or all vendor entries for a CVE ID (ownership restrictions apply for Standard_User)
 - The same CVE ID can be tracked across multiple vendors independently
 
 **Document Management**
@@ -265,7 +293,7 @@ The home page is the primary CVE research and tracking tool.
 
 **NVD Integration**
 - Auto-fill CVE description, severity, and published date from the NIST NVD API 2.0 when adding a new CVE
-- Bulk NVD Sync (editor/admin): fetch updated metadata for all CVEs in the database in one operation
+- Bulk NVD Sync (Admin/Standard_User): fetch updated metadata for all CVEs in the database in one operation
 - CVSS severity cascade: v3.1 preferred, then v3.0, then v2.0
 - Rate-limit aware: respects NVD's 5 req/30s unauthenticated limit; with `NVD_API_KEY` the limit increases to 50 req/30s
 
@@ -285,7 +313,7 @@ The Reporting page is the core operational view for remediation tracking. It int
 
 #### Syncing Data
 
-Click **Sync** (top right) to pull the latest findings from Ivanti. The sync:
+Click **Sync** (top right) to pull the latest findings from Ivanti. Sync requires Admin or Standard_User group. The sync:
 1. Fetches all open host findings matching your BU filters and severity range (8.5–9.9 VRR)
 2. Fetches the closed finding count separately
 3. Sweeps closed findings to capture FP workflow states (including Approved FPs now closed)
@@ -324,19 +352,19 @@ Each row represents a single Ivanti host finding.
 | Last Found | Last detection date from Ivanti |
 | Notes | Free-form notes — inline editable, persists across syncs |
 
-**Inline editing:** Click a Host or DNS cell to override the Ivanti value. An amber dot (●) marks overridden cells; use the revert button (↻) to restore the original. Overrides survive re-syncs.
+**Inline editing:** Click a Host or DNS cell to override the Ivanti value. An amber dot (●) marks overridden cells; use the revert button (↻) to restore the original. Overrides survive re-syncs. Requires Admin or Standard_User group.
 
 **Filtering:** Click ⊙ on any column header for multi-select filtering. The `— empty —` option filters to findings with no value in that column. Multiple filters are ANDed. The Action Coverage chart also acts as a filter.
 
 **Column management:** Toggle visibility and drag to reorder via the **Columns** button. Order and visibility persist to `localStorage`.
 
-**Export:** Click **Export** to download the current filtered view as CSV or XLSX.
+**Export:** Click **Export** to download the current filtered view as CSV or XLSX. Requires Admin, Standard_User, or Leadership group.
 
 ---
 
 ### Ivanti Queue
 
-A personal staging list for batch-processing FP, Archer, and CARD workflows without context-switching into Ivanti mid-review.
+A personal staging list for batch-processing FP, Archer, and CARD workflows without context-switching into Ivanti mid-review. Requires Admin or Standard_User group.
 
 **Adding items:** Check the checkbox at the far left of any finding row. A popover appears:
 - For **FP** and **Archer** items: enter the Vendor / Platform (e.g., "Juniper MX", "Cisco IOS-XE")
@@ -364,7 +392,7 @@ The Compliance page tracks NTS-AEO team posture against the AEO compliance frame
 
 #### Upload Workflow
 
-Editors and admins can upload a new compliance report via the **Upload Report** button:
+Admin and Standard_User groups can upload a new compliance report via the **Upload Report** button:
 
 1. Drop or browse for the `NTS_AEO_YYYY_MM_DD.xlsx` file
 2. The report is parsed server-side and a **diff preview** is shown — new violations, resolved items, and recurring items since the last upload
@@ -391,7 +419,7 @@ A slide-out panel for a selected device showing:
 - For **2.3.x vulnerability metrics**: the `Ivanti_Vulnerability_ID` is displayed with a **View in Reporting →** button that navigates directly to the Reporting page
 - **Resolved Metrics** — previously failing metrics now back in compliance
 - **History** — how many times the device has appeared on the report and since when
-- **Notes** — timestamped notes per metric with a multi-metric selector if multiple metrics are failing
+- **Notes** — timestamped notes per metric with a multi-metric selector if multiple metrics are failing. Requires Admin or Standard_User group.
 
 Notes persist across uploads and are keyed to the device hostname and metric ID.
 
@@ -405,11 +433,12 @@ Only **STEAM** and **ACCESS-ENG** teams are tracked. The team selector at the to
 
 A document library for internal reference material — policies, runbooks, vendor advisories, and process guides.
 
-- Upload documents with a title, optional description, and category
-- View documents inline in the browser (PDFs render in an iframe; Markdown files render as HTML)
+- Upload documents with a title, optional description, and category (Admin/Standard_User)
+- View documents inline in the browser (PDFs render in a sandboxed iframe; Markdown files render as sanitized HTML)
 - Download any document
 - Filter and browse by category
-- Editors and admins can upload and delete; all authenticated users can view
+- Admin can delete any article; Standard_User can delete articles they created
+- All authenticated users can view
 
 Allowed file types: PDF, Markdown, TXT, Office documents (DOC, DOCX, XLS, XLSX, PPT, PPTX), HTML, JSON, YAML, and images (PNG, JPG, GIF).
 
@@ -417,7 +446,7 @@ Allowed file types: PDF, Markdown, TXT, Office documents (DOC, DOCX, XLS, XLSX,
 
 ### Exports
 
-Bulk export tools for reports and data extracts.
+Bulk export tools for reports and data extracts. Available to Admin, Standard_User, and Leadership groups. Read_Only users cannot access the Exports page.
 
 ---
 
@@ -430,15 +459,18 @@ Track Archer exception tickets (EXC numbers) linked to specific CVE/vendor pairs
 - Optional Archer URL field for deep-linking to the Archer record
 - Filter tickets by CVE ID, vendor, or status
 - Clicking an EXC badge on the Home page navigates to the Reporting page pre-filtered to findings with that EXC number in their notes
+- Admin/Standard_User can create, edit, and delete tickets (Standard_User delete subject to ownership and compliance linkage checks)
 
 ---
 
 ### User Management (Admin)
 
-- Create users with a role assignment
-- Change username, email, password, role, or active status
+- Create users with a group assignment (Admin, Standard_User, Leadership, Read_Only)
+- Change username, email, password, group, or active status
+- Group changes require confirmation; downgrading an Admin shows an additional warning
 - Deactivating a user immediately invalidates all their active sessions
 - Admins cannot demote themselves or deactivate their own account
+- All group changes are audit-logged with previous and new group values
 
 ---
 
@@ -506,130 +538,147 @@ python3 import_notes_from_csv.py input.csv --db /path/to/cve_database.db
 
 ## API Reference
 
-All endpoints are prefixed with `/api`. All endpoints except `/api/auth/login` and `/api/auth/logout` require a valid session cookie.
+All endpoints are prefixed with `/api`. All endpoints except `/api/auth/login` and `/api/auth/logout` require a valid session cookie. Group requirements are listed per endpoint.
 
 ### Auth
 
-| Method | Path | Auth | Description |
+| Method | Path | Group | Description |
 |---|---|---|---|
-| POST | `/api/auth/login` | Public | Log in, receive session cookie |
+| POST | `/api/auth/login` | Public | Log in, receive session cookie (rate-limited: 20/15min) |
 | POST | `/api/auth/logout` | Public | Invalidate session |
-| GET | `/api/auth/me` | Session | Get current user info |
-| POST | `/api/auth/cleanup-sessions` | Session | Delete expired sessions |
+| GET | `/api/auth/me` | Any | Get current user info (returns `group` field) |
+| POST | `/api/auth/cleanup-sessions` | Admin | Delete expired sessions |
 
 ### CVEs
 
-| Method | Path | Role | Description |
+| Method | Path | Group | Description |
 |---|---|---|---|
-| GET | `/api/cves` | viewer+ | List CVEs; query params: `search`, `vendor`, `severity`, `status` |
-| POST | `/api/cves` | editor+ | Create a new CVE entry |
-| PUT | `/api/cves/:id` | editor+ | Update a CVE entry by row ID |
-| PATCH | `/api/cves/:cveId/status` | editor+ | Update status for all vendor rows matching a CVE ID |
-| DELETE | `/api/cves/:id` | editor+ | Delete a single CVE vendor entry |
-| DELETE | `/api/cves/by-cve-id/:cveId` | editor+ | Delete all vendor entries for a CVE ID |
-| GET | `/api/cves/check/:cveId` | viewer+ | Quick check: existence and status of a CVE |
-| GET | `/api/cves/distinct-ids` | viewer+ | All distinct CVE IDs (used by NVD sync) |
-| GET | `/api/cves/:cveId/vendors` | viewer+ | All vendor entries for a specific CVE ID |
+| GET | `/api/cves` | Any | List CVEs; query params: `search`, `vendor`, `severity`, `status` |
+| POST | `/api/cves` | Admin, Standard_User | Create a new CVE entry |
+| PUT | `/api/cves/:id` | Admin, Standard_User | Update a CVE entry by row ID |
+| PATCH | `/api/cves/:cveId/status` | Admin, Standard_User | Update status for all vendor rows matching a CVE ID |
+| DELETE | `/api/cves/:id` | Admin, Standard_User | Delete a single CVE vendor entry (ownership + cascade check for Standard_User) |
+| DELETE | `/api/cves/by-cve-id/:cveId` | Admin, Standard_User | Delete all vendor entries for a CVE ID (ownership + cascade check for Standard_User) |
+| GET | `/api/cves/check/:cveId` | Any | Quick check: existence and status of a CVE |
+| GET | `/api/cves/distinct-ids` | Any | All distinct CVE IDs (used by NVD sync) |
+| GET | `/api/cves/:cveId/vendors` | Any | All vendor entries for a specific CVE ID |
+| GET | `/api/cves/compliance` | Any | Document compliance status view |
 
 ### Documents
 
-| Method | Path | Role | Description |
+| Method | Path | Group | Description |
 |---|---|---|---|
-| GET | `/api/cves/:cveId/documents` | viewer+ | List documents for a CVE; optional `?vendor=` filter |
-| POST | `/api/cves/:cveId/documents` | editor+ | Upload a document for a CVE/vendor pair |
-| DELETE | `/api/documents/:id` | admin | Delete a document and its file from disk |
+| GET | `/api/cves/:cveId/documents` | Any | List documents for a CVE; optional `?vendor=` filter |
+| POST | `/api/cves/:cveId/documents` | Admin, Standard_User | Upload a document for a CVE/vendor pair |
+| DELETE | `/api/documents/:id` | Admin | Delete a document and its file from disk |
 
 ### NVD
 
-| Method | Path | Role | Description |
+| Method | Path | Group | Description |
 |---|---|---|---|
-| GET | `/api/nvd/lookup/:cveId` | viewer+ | Look up a single CVE in the NVD 2.0 API |
-| POST | `/api/cves/nvd-sync` | editor+ | Bulk update CVE metadata from NVD |
+| GET | `/api/nvd/lookup/:cveId` | Any | Look up a single CVE in the NVD 2.0 API |
+| POST | `/api/cves/nvd-sync` | Admin, Standard_User | Bulk update CVE metadata from NVD |
+
+### JIRA Tickets
+
+| Method | Path | Group | Description |
+|---|---|---|---|
+| GET | `/api/jira-tickets` | Any | List tickets; optional filters: `cve_id`, `vendor`, `status` |
+| POST | `/api/jira-tickets` | Admin, Standard_User | Create a JIRA ticket |
+| PUT | `/api/jira-tickets/:id` | Admin, Standard_User | Update a JIRA ticket |
+| DELETE | `/api/jira-tickets/:id` | Admin, Standard_User | Delete a JIRA ticket (ownership + compliance check for Standard_User) |
 
 ### Ivanti — Host Findings
 
-| Method | Path | Role | Description |
+| Method | Path | Group | Description |
 |---|---|---|---|
-| GET | `/api/ivanti/findings` | viewer+ | Get cached findings with notes and overrides merged in |
-| POST | `/api/ivanti/findings/sync` | viewer+ | Trigger an immediate findings sync from Ivanti |
-| GET | `/api/ivanti/findings/counts` | viewer+ | Open vs closed finding totals |
-| GET | `/api/ivanti/findings/fp-workflow-counts` | viewer+ | FP workflow state breakdown |
-| PUT | `/api/ivanti/findings/:findingId/override` | editor+ | Override `hostName` or `dns`; empty value clears the override |
-| PUT | `/api/ivanti/findings/:findingId/note` | viewer+ | Save or update a finding note (max 255 chars) |
+| GET | `/api/ivanti/findings` | Any | Get cached findings with notes and overrides merged in |
+| POST | `/api/ivanti/findings/sync` | Admin, Standard_User | Trigger an immediate findings sync from Ivanti |
+| GET | `/api/ivanti/findings/counts` | Any | Open vs closed finding totals |
+| GET | `/api/ivanti/findings/fp-workflow-counts` | Any | FP workflow state breakdown |
+| PUT | `/api/ivanti/findings/:findingId/override` | Admin, Standard_User | Override `hostName` or `dns`; empty value clears the override |
+| PUT | `/api/ivanti/findings/:findingId/note` | Admin, Standard_User | Save or update a finding note (max 255 chars) |
 
 ### Ivanti — Workflows
 
-| Method | Path | Role | Description |
+| Method | Path | Group | Description |
 |---|---|---|---|
-| GET | `/api/ivanti/workflows` | viewer+ | Get cached workflow data |
-| POST | `/api/ivanti/workflows/sync` | viewer+ | Trigger an immediate workflow sync |
+| GET | `/api/ivanti/workflows` | Any | Get cached workflow data |
+| POST | `/api/ivanti/workflows/sync` | Admin, Standard_User | Trigger an immediate workflow sync |
 
-### Ivanti Queue
+### Ivanti — Todo Queue
 
-| Method | Path | Role | Description |
+| Method | Path | Group | Description |
 |---|---|---|---|
-| GET | `/api/ivanti/queue` | viewer+ | Get all queue items for the current user |
-| POST | `/api/ivanti/queue` | editor+ | Add a finding to the queue |
-| PATCH | `/api/ivanti/queue/:id` | editor+ | Update a queue item (mark complete, edit vendor/type) |
-| DELETE | `/api/ivanti/queue/:id` | editor+ | Delete a single queue item |
-| DELETE | `/api/ivanti/queue` | editor+ | Delete multiple queue items (body: `{ ids: [...] }`) |
+| GET | `/api/ivanti/todo-queue` | Any | Get all queue items for the current user |
+| POST | `/api/ivanti/todo-queue` | Admin, Standard_User | Add a finding to the queue |
+| PUT | `/api/ivanti/todo-queue/:id` | Admin, Standard_User | Update a queue item (mark complete, edit vendor/type) |
+| DELETE | `/api/ivanti/todo-queue/:id` | Admin, Standard_User | Delete a single queue item |
+| DELETE | `/api/ivanti/todo-queue/completed` | Admin, Standard_User | Delete all completed queue items |
+
+### Ivanti — Archive
+
+| Method | Path | Group | Description |
+|---|---|---|---|
+| GET | `/api/ivanti/archive` | Any | Get finding archive data for severity score drift tracking |
 
 ### Compliance
 
-| Method | Path | Role | Description |
+| Method | Path | Group | Description |
 |---|---|---|---|
-| POST | `/api/compliance/preview` | editor+ | Parse an xlsx upload and return diff + temp file path |
-| POST | `/api/compliance/commit` | editor+ | Commit a previewed upload to the database |
-| GET | `/api/compliance/uploads` | viewer+ | List all compliance upload records |
-| GET | `/api/compliance/summary` | viewer+ | Metric health summary; `?team=STEAM` |
-| GET | `/api/compliance/items` | viewer+ | Device list; `?team=STEAM&status=active` |
-| GET | `/api/compliance/items/:hostname` | viewer+ | Full detail for a device (metrics + notes) |
-| GET | `/api/compliance/notes/:hostname/:metricId` | viewer+ | Notes for a specific hostname/metric |
-| POST | `/api/compliance/notes` | editor+ | Add a note for a hostname/metric |
+| POST | `/api/compliance/preview` | Admin, Standard_User | Parse an xlsx upload and return diff + temp file path |
+| POST | `/api/compliance/commit` | Admin, Standard_User | Commit a previewed upload to the database |
+| GET | `/api/compliance/uploads` | Any | List all compliance upload records |
+| GET | `/api/compliance/summary` | Any | Metric health summary; `?team=STEAM` |
+| GET | `/api/compliance/items` | Any | Device list; `?team=STEAM&status=active` |
+| GET | `/api/compliance/items/:hostname` | Any | Full detail for a device (metrics + notes) |
+| GET | `/api/compliance/notes/:hostname/:metricId` | Any | Notes for a specific hostname/metric |
+| POST | `/api/compliance/notes` | Admin, Standard_User | Add a note for a hostname/metric |
 
 ### Knowledge Base
 
-| Method | Path | Role | Description |
+| Method | Path | Group | Description |
 |---|---|---|---|
-| POST | `/api/knowledge-base/upload` | editor+ | Upload a new knowledge base document |
-| GET | `/api/knowledge-base` | viewer+ | List all articles |
-| GET | `/api/knowledge-base/:id` | viewer+ | Get article metadata |
-| GET | `/api/knowledge-base/:id/content` | viewer+ | Get file content for inline display |
-| GET | `/api/knowledge-base/:id/download` | viewer+ | Download the file |
-| DELETE | `/api/knowledge-base/:id` | editor+ | Delete article and file |
+| POST | `/api/knowledge-base/upload` | Admin, Standard_User | Upload a new knowledge base document |
+| GET | `/api/knowledge-base` | Any | List all articles |
+| GET | `/api/knowledge-base/:id` | Any | Get article metadata |
+| GET | `/api/knowledge-base/:id/content` | Any | Get file content for inline display |
+| GET | `/api/knowledge-base/:id/download` | Any | Download the file |
+| DELETE | `/api/knowledge-base/:id` | Admin, Standard_User | Delete article and file (Standard_User: own articles only) |
 
 ### Archer Tickets
 
-| Method | Path | Role | Description |
+| Method | Path | Group | Description |
 |---|---|---|---|
-| GET | `/api/archer-tickets` | viewer+ | List tickets; optional filters: `cve_id`, `vendor`, `status` |
-| POST | `/api/archer-tickets` | editor+ | Create a new Archer ticket |
-| PUT | `/api/archer-tickets/:id` | editor+ | Update an Archer ticket |
-| DELETE | `/api/archer-tickets/:id` | editor+ | Delete an Archer ticket |
+| GET | `/api/archer-tickets` | Any | List tickets; optional filters: `cve_id`, `vendor`, `status` |
+| GET | `/api/archer-tickets/status-trend` | Any | Ticket counts by date and status for pipeline chart |
+| POST | `/api/archer-tickets` | Admin, Standard_User | Create a new Archer ticket |
+| PUT | `/api/archer-tickets/:id` | Admin, Standard_User | Update an Archer ticket |
+| DELETE | `/api/archer-tickets/:id` | Admin, Standard_User | Delete an Archer ticket (ownership + compliance check for Standard_User) |
 
 ### Users (Admin only)
 
-| Method | Path | Role | Description |
+| Method | Path | Group | Description |
 |---|---|---|---|
-| GET | `/api/users` | admin | List all users |
-| GET | `/api/users/:id` | admin | Get a single user |
-| POST | `/api/users` | admin | Create a user |
-| PATCH | `/api/users/:id` | admin | Update a user |
-| DELETE | `/api/users/:id` | admin | Delete a user |
+| GET | `/api/users` | Admin | List all users |
+| GET | `/api/users/:id` | Admin | Get a single user |
+| POST | `/api/users` | Admin | Create a user |
+| PATCH | `/api/users/:id` | Admin | Update a user |
+| DELETE | `/api/users/:id` | Admin | Delete a user |
 
 ### Audit Logs (Admin only)
 
-| Method | Path | Role | Description |
+| Method | Path | Group | Description |
 |---|---|---|---|
-| GET | `/api/audit-logs` | admin | Paginated audit log; filters: `user`, `action`, `entityType`, `startDate`, `endDate` |
-| GET | `/api/audit-logs/actions` | admin | List distinct action types for filter dropdowns |
+| GET | `/api/audit-logs` | Admin | Paginated audit log; filters: `user`, `action`, `entityType`, `startDate`, `endDate` |
+| GET | `/api/audit-logs/actions` | Admin | List distinct action types for filter dropdowns |
 
 ### Utility
 
-| Method | Path | Role | Description |
+| Method | Path | Group | Description |
 |---|---|---|---|
-| GET | `/api/vendors` | viewer+ | List all distinct vendor names |
-| GET | `/api/stats` | viewer+ | Dashboard statistics |
+| GET | `/api/vendors` | Any | List all distinct vendor names |
+| GET | `/api/stats` | Any | Dashboard statistics |
 
 ---
 
@@ -639,6 +688,7 @@ All endpoints are prefixed with `/api`. All endpoints except `/api/auth/login` a
 cve-dashboard/
 ├── start-servers.sh          # Start backend + frontend in background
 ├── stop-servers.sh           # Stop all servers
+├── package.json              # Root package.json (backend dependencies)
 │
 ├── backend/
 │   ├── server.js             # Express app — routes, middleware, security headers
@@ -649,7 +699,7 @@ cve-dashboard/
 │   │   ├── knowledge_base/       # Knowledge base documents
 │   │   └── temp/                 # Temporary upload staging
 │   ├── routes/
-│   │   ├── auth.js               # Login, logout, session check
+│   │   ├── auth.js               # Login, logout, session check, rate limiting
 │   │   ├── users.js              # User CRUD (admin)
 │   │   ├── auditLog.js           # Audit log viewer (admin)
 │   │   ├── nvdLookup.js          # NVD API proxy
@@ -658,20 +708,13 @@ cve-dashboard/
 │   │   ├── ivantiWorkflows.js    # Ivanti workflow batch sync and cache
 │   │   ├── ivantiFindings.js     # Ivanti host findings sync, notes, overrides, FP counts
 │   │   ├── ivantiTodoQueue.js    # Ivanti Queue — personal FP/Archer/CARD staging list
+│   │   ├── ivantiArchive.js      # Finding archive for severity score drift
 │   │   └── compliance.js         # AEO compliance upload, diff, device tracking, notes
 │   ├── middleware/
-│   │   └── auth.js               # requireAuth and requireRole middleware
+│   │   └── auth.js               # requireAuth and requireGroup middleware
 │   ├── helpers/
-│   │   ├── auditLog.js           # logAudit helper (fire-and-forget)
-│   ├── migrations/
-│   │   ├── add_knowledge_base_table.js
-│   │   ├── add_archer_tickets_table.js
-│   │   ├── add_ivanti_sync_table.js
-│   │   ├── add_ivanti_findings_tables.js
-│   │   ├── add_ivanti_todo_queue_table.js  # Ivanti Queue table
-│   │   ├── add_card_workflow_type.js       # CARD workflow type support
-│   │   ├── add_todo_queue_ip_address.js    # IP address column on queue items
-│   │   └── add_compliance_tables.js        # AEO compliance tables
+│   │   └── auditLog.js           # logAudit helper (fire-and-forget)
+│   ├── migrations/               # Sequential migration scripts (run manually with node)
 │   └── scripts/
 │       ├── parse_compliance_xlsx.py      # Parses NTS_AEO xlsx compliance reports
 │       ├── import_notes_from_csv.py      # Bulk-import finding notes from CSV
@@ -682,24 +725,27 @@ cve-dashboard/
         ├── App.js                    # Home dashboard — CVE list, filters, modals, calendar
         ├── App.css                   # Global styles and CSS variables
         ├── contexts/
-        │   └── AuthContext.js        # Auth state provider (login, logout, role helpers)
+        │   └── AuthContext.js        # Auth state provider (login, logout, group helpers)
         └── components/
             ├── LoginForm.js              # Login page
-            ├── NavDrawer.js              # Side navigation drawer
-            ├── UserMenu.js               # User dropdown in header
+            ├── NavDrawer.js              # Side navigation drawer (Admin Panel link for Admin group)
+            ├── UserMenu.js               # User dropdown in header (shows group badge)
             ├── CalendarWidget.js         # Due-date calendar with Ivanti finding indicators
-            ├── UserManagement.js         # Admin user management panel
+            ├── UserManagement.js         # Admin user management panel (group assignment)
             ├── AuditLog.js               # Admin audit log viewer
             ├── NvdSyncModal.js           # Bulk NVD sync dialog
             ├── KnowledgeBaseModal.js     # Knowledge base upload/list modal
-            ├── KnowledgeBaseViewer.js    # Inline document viewer
+            ├── KnowledgeBaseViewer.js    # Inline document viewer (sandboxed iframe, sanitized markdown)
             └── pages/
                 ├── ReportingPage.js          # Host findings: charts, table, queue, export
                 ├── CompliancePage.js         # AEO compliance: metric cards, device table
                 ├── ComplianceUploadModal.js  # xlsx upload with diff preview
                 ├── ComplianceDetailPanel.js  # Per-device metrics, history, notes
+                ├── ComplianceChartsPanel.js  # Compliance trend charts
+                ├── IvantiCountsChart.js      # Ivanti counts history chart
+                ├── ArchiveSummaryBar.js      # Finding archive summary
                 ├── KnowledgeBasePage.js      # Knowledge base page
-                └── ExportsPage.js            # Exports page
+                └── ExportsPage.js            # Exports page (group-gated)
 ```
 
 ---
@@ -708,13 +754,13 @@ cve-dashboard/
 
 ### Core tables (created by `setup.js`)
 
-**`cves`** — One row per CVE/vendor pair. `UNIQUE(cve_id, vendor)`.
+**`cves`** — One row per CVE/vendor pair. `UNIQUE(cve_id, vendor)`. Includes `created_by` column for ownership tracking.
 
-**`documents`** — Files attached to a CVE/vendor pair. Foreign key to `cves(cve_id)`.
+**`documents`** — Files attached to a CVE/vendor pair. Foreign key to `cves(cve_id)` with `ON DELETE CASCADE`.
 
 **`required_documents`** — Vendor-specific document requirements.
 
-**`users`** — Accounts with roles: `admin`, `editor`, `viewer`.
+**`users`** — Accounts with group-based access control. `user_group` column with values: `Admin`, `Standard_User`, `Leadership`, `Read_Only`. Enforced by INSERT/UPDATE triggers. Legacy `role` column retained for rollback safety.
 
 **`sessions`** — Active sessions with 24-hour expiry.
 
@@ -722,9 +768,11 @@ cve-dashboard/
 
 ### Feature tables (added by migrations)
 
-**`knowledge_base`** — Document library entries with title, slug, category, description, and file metadata.
+**`knowledge_base`** — Document library entries with title, slug, category, description, file metadata, and `created_by`.
 
-**`archer_tickets`** — Archer EXC exception tickets linked to CVE/vendor pairs. `UNIQUE(exc_number)`.
+**`archer_tickets`** — Archer EXC exception tickets linked to CVE/vendor pairs. `UNIQUE(exc_number)`. Includes `created_by` for ownership tracking. Foreign key to `cves(cve_id, vendor)` with `ON DELETE CASCADE`.
+
+**`jira_tickets`** — JIRA tickets linked to CVE/vendor pairs. Includes `created_by`. Foreign key to `cves(cve_id, vendor)` with `ON DELETE CASCADE`.
 
 **`ivanti_sync_state`** — Single-row cache for Ivanti workflow batch data.
 
@@ -752,18 +800,47 @@ cve-dashboard/
 
 ## Security Model
 
+### Authentication
+
+- Cookie-based sessions with `httpOnly: true`, `sameSite: lax`, `secure: true` (in production)
+- Sessions expire after 24 hours
+- Login rate-limited to 20 attempts per 15-minute window via `express-rate-limit`
+- `SESSION_SECRET` is required — server refuses to start without it
+
+### Group-based access control
+
+Four groups with distinct permission boundaries enforced server-side via `requireGroup` middleware:
+
+| Capability | Admin | Standard_User | Leadership | Read_Only |
+|---|---|---|---|---|
+| View all data | ✓ | ✓ | ✓ | ✓ |
+| Create/edit resources | ✓ | ✓ | ✗ | ✗ |
+| Delete own resources | ✓ | ✓ (restricted) | ✗ | ✗ |
+| Delete any resource | ✓ | ✗ | ✗ | ✗ |
+| Export (CSV/XLSX) | ✓ | ✓ | ✓ | ✗ |
+| Admin panel / user management | ✓ | ✗ | ✗ | ✗ |
+
+Standard_User delete restrictions are enforced at the API level: ownership check, finding state check, compliance linkage check, and cascade impact check for CVEs.
+
 ### File upload security
 
 - Extension allowlist enforced by Multer; executables (`.exe`, `.js`, `.sh`, `.py`, `.bat`, etc.) are blocked
 - MIME type prefix validation in addition to extension checking
 - 10 MB per-file size limit
 - Filenames are sanitized: path separators, `..` sequences, null bytes, and non-alphanumeric characters are removed
+- Content-Disposition headers sanitize filenames to prevent header injection
 
 ### Path traversal prevention
 
 - `sanitizePathSegment()` strips `/`, `\`, `..`, and null bytes from any value used in `path.join()`
 - `isPathWithinUploads()` verifies resolved paths stay within the uploads root before any file operation
 
+### Content security
+
+- Knowledge base PDF iframe uses `sandbox="allow-same-origin"` to prevent script execution
+- Markdown rendering uses `rehype-sanitize` to strip dangerous HTML
+- CSP `frame-ancestors` header derived from `CORS_ORIGINS` environment variable
+
 ### Input validation
 
 - CVE ID must match `/^CVE-\d{4}-\d{4,}$/`
@@ -771,14 +848,10 @@ cve-dashboard/
 - Status must be one of: `Open`, `Addressed`, `In Progress`, `Resolved`
 - Archer EXC numbers must match `/^EXC-\d+$/`
 - Finding override field must be one of: `hostName`, `dns`
+- User group validated against: `Admin`, `Standard_User`, `Leadership`, `Read_Only` (enforced by DB triggers and app-level validation)
+- Hostname format validated with `/^[a-zA-Z0-9._-]+$/` in compliance notes
 - All database operations use prepared statements — no string interpolation in SQL
 
-### Error handling
-
-- 500 responses never expose internal error messages to the client
-- Full errors are logged server-side only
-- Descriptive 400/409 responses contain only application-authored validation messages
-
 ### Security headers
 
 Applied to all responses:
@@ -789,15 +862,69 @@ Applied to all responses:
 - `Referrer-Policy: strict-origin-when-cross-origin`
 - `Permissions-Policy: camera=(), microphone=(), geolocation=()`
 
-### Session cookies
+---
 
-`httpOnly: true`, `sameSite: lax`, `secure: true` in production (`NODE_ENV=production`).
+## Upgrading an Existing Deployment
+
+This procedure updates the application code and schema while preserving all existing data. The database file (`backend/cve_database.db`) is never overwritten by `git pull` — it is gitignored.
+
+```bash
+# 1. Stop the running servers
+cd /home/cve-dashboard
+./stop-servers.sh
+
+# 2. Pull latest code
+git pull origin master
+
+# 3. Install backend dependencies (picks up any new packages)
+npm install
+
+# 4. Install frontend dependencies
+cd frontend
+npm install
+cd ..
+
+# 5. Ensure SESSION_SECRET is set in backend/.env
+#    If missing:
+#    echo "SESSION_SECRET=$(openssl rand -base64 32)" >> backend/.env
+
+# 6. Run all migrations (idempotent — safe to re-run, skips already-applied changes)
+cd backend
+node migrations/add_knowledge_base_table.js
+node migrations/add_archer_tickets_table.js
+node migrations/add_ivanti_sync_table.js
+node migrations/add_ivanti_findings_tables.js
+node migrations/add_ivanti_todo_queue_table.js
+node migrations/add_card_workflow_type.js
+node migrations/add_todo_queue_ip_address.js
+node migrations/add_compliance_tables.js
+node migrations/add_finding_archive_tables.js
+node migrations/add_archer_tickets_timestamps.js
+node migrations/add_ivanti_counts_history_table.js
+node migrations/add_user_groups.js
+node migrations/add_created_by_columns.js
+cd ..
+
+# 7. Rebuild the frontend
+cd frontend
+npm run build
+cd ..
+
+# 8. Start servers
+./start-servers.sh
+```
+
+After upgrading, clear your browser cookies and log in fresh — session format changes between versions will invalidate old sessions.
+
+> **Do not re-run `node setup.js`** on an existing deployment. It is only for first-time initialization. Re-running it will not destroy data (it checks for existing tables/users), but it is unnecessary and may create a duplicate admin account.
+
+> **NODE_ENV reminder:** If you are running over plain HTTP (no TLS), make sure `NODE_ENV` is **not** set to `production` in `backend/.env`. See [Troubleshooting](#troubleshooting) for details.
 
 ---
 
 ## Migrations
 
-Migrations are standalone Node.js scripts. Run them in the listed order on a fresh install. All use `CREATE TABLE IF NOT EXISTS` or `ALTER TABLE ... ADD COLUMN IF NOT EXISTS` and are safe to re-run.
+Migrations are standalone Node.js scripts. Run them in the listed order on a fresh install. All are idempotent and safe to re-run.
 
 ```bash
 cd backend
@@ -809,6 +936,11 @@ node migrations/add_ivanti_todo_queue_table.js
 node migrations/add_card_workflow_type.js
 node migrations/add_todo_queue_ip_address.js
 node migrations/add_compliance_tables.js
+node migrations/add_finding_archive_tables.js
+node migrations/add_archer_tickets_timestamps.js
+node migrations/add_ivanti_counts_history_table.js
+node migrations/add_user_groups.js
+node migrations/add_created_by_columns.js
 ```
 
 For deployments upgrading from an older schema, the following legacy migration scripts are also available in `backend/`:
@@ -818,3 +950,38 @@ For deployments upgrading from an older schema, the following legacy migration s
 - `migrate-to-1.1.js` — General 1.0 → 1.1 schema update
 
 > Several columns (`fp_workflow_counts_json`, `fp_id_counts_json`, `seen_count`, `summary_json`) are added automatically via idempotent `ALTER TABLE` statements each time the server starts. No manual re-run is needed.
+
+---
+
+## Troubleshooting
+
+### Login succeeds but all pages show "Error Loading" / 401 Unauthorized
+
+**Symptom:** You can log in successfully, but the dashboard shows "Error Loading CVEs", "Failed to fetch", and the browser console shows 401 on every API call.
+
+**Cause:** The session cookie has the `Secure` flag set (because `NODE_ENV=production` in `backend/.env`), but the application is being accessed over plain HTTP. Browsers silently refuse to send `Secure` cookies over non-HTTPS connections, so every request after login arrives without a session cookie.
+
+**Fix:** Either:
+1. Remove `NODE_ENV=production` from `backend/.env` (or set it to `development`) and restart the backend, **or**
+2. Set up HTTPS (e.g., via nginx reverse proxy with TLS termination) and access the app over `https://`
+
+### Login fails with "Too many login attempts"
+
+**Cause:** The login endpoint is rate-limited to 20 attempts per 15-minute window. Wait 15 minutes or restart the backend to reset the counter.
+
+### Server refuses to start: "SESSION_SECRET environment variable must be set"
+
+**Fix:** Add a `SESSION_SECRET` to `backend/.env`:
+```bash
+echo "SESSION_SECRET=$(openssl rand -base64 32)" >> backend/.env
+```
+
+### After upgrading: "user_group" errors or missing group data
+
+**Fix:** Run the group migration:
+```bash
+cd backend
+node migrations/add_user_groups.js
+node migrations/add_created_by_columns.js
+```
+This maps existing roles to groups automatically (admin→Admin, editor→Standard_User, viewer→Read_Only).

backend/helpers/ivantiApi.js

@@ -0,0 +1,154 @@
+// Shared Ivanti / RiskSense API helpers
+// Centralizes HTTP calls so ivantiWorkflows.js, ivantiFindings.js, and
+// ivantiFpWorkflow.js all use the same implementation.
+
+const https = require('https');
+
+const IVANTI_URL_BASE = 'https://platform4.risksense.com/api/v1';
+
+// ---------------------------------------------------------------------------
+// JSON POST — used for search, workflow creation, etc.
+// ---------------------------------------------------------------------------
+function ivantiPost(urlPath, body, apiKey, skipTls) {
+    const bodyStr = JSON.stringify(body);
+    const fullUrl = new URL(IVANTI_URL_BASE + urlPath);
+
+    return new Promise((resolve, reject) => {
+        const options = {
+            hostname: fullUrl.hostname,
+            path: fullUrl.pathname + fullUrl.search,
+            method: 'POST',
+            headers: {
+                'accept': '*/*',
+                'content-type': 'application/json',
+                'x-api-key': apiKey,
+                'x-http-client-type': 'browser',
+                'content-length': Buffer.byteLength(bodyStr)
+            },
+            rejectUnauthorized: !skipTls,
+            timeout: 15000
+        };
+
+        const req = https.request(options, (res) => {
+            let data = '';
+            res.on('data', (chunk) => { data += chunk; });
+            res.on('end', () => resolve({ status: res.statusCode, body: data }));
+        });
+
+        req.on('timeout', () => req.destroy(new Error('Request timed out')));
+        req.on('error', reject);
+        req.write(bodyStr);
+        req.end();
+    });
+}
+
+// ---------------------------------------------------------------------------
+// Multipart POST — used for file attachment uploads.
+// Constructs multipart/form-data manually using Node's https module.
+// ---------------------------------------------------------------------------
+function ivantiMultipartPost(urlPath, fileBuffer, fileName, apiKey, skipTls) {
+    const boundary = '----IvantiUpload' + Date.now().toString(36) + Math.random().toString(36).slice(2);
+    const fullUrl = new URL(IVANTI_URL_BASE + urlPath);
+
+    // Build multipart body
+    const preamble = Buffer.from(
+        `--${boundary}\r\n` +
+        `Content-Disposition: form-data; name="file"; filename="${fileName}"\r\n` +
+        `Content-Type: application/octet-stream\r\n\r\n`
+    );
+    const epilogue = Buffer.from(`\r\n--${boundary}--\r\n`);
+    const bodyBuffer = Buffer.concat([preamble, fileBuffer, epilogue]);
+
+    return new Promise((resolve, reject) => {
+        const options = {
+            hostname: fullUrl.hostname,
+            path: fullUrl.pathname + fullUrl.search,
+            method: 'POST',
+            headers: {
+                'accept': '*/*',
+                'content-type': `multipart/form-data; boundary=${boundary}`,
+                'x-api-key': apiKey,
+                'x-http-client-type': 'browser',
+                'content-length': bodyBuffer.length
+            },
+            rejectUnauthorized: !skipTls,
+            timeout: 30000
+        };
+
+        const req = https.request(options, (res) => {
+            let data = '';
+            res.on('data', (chunk) => { data += chunk; });
+            res.on('end', () => resolve({ status: res.statusCode, body: data }));
+        });
+
+        req.on('timeout', () => req.destroy(new Error('Request timed out')));
+        req.on('error', reject);
+        req.write(bodyBuffer);
+        req.end();
+    });
+}
+
+// ---------------------------------------------------------------------------
+// Multipart form POST — used for endpoints that accept mixed form fields + files.
+// fields: array of { name, value } for text form fields
+// files:  array of { name, buffer, filename } for file uploads
+// ---------------------------------------------------------------------------
+function ivantiFormPost(urlPath, fields, files, apiKey, skipTls) {
+    const boundary = '----IvantiForm' + Date.now().toString(36) + Math.random().toString(36).slice(2);
+    const fullUrl = new URL(IVANTI_URL_BASE + urlPath);
+
+    const parts = [];
+
+    // Text fields
+    for (const { name, value } of fields) {
+        parts.push(Buffer.from(
+            `--${boundary}\r\n` +
+            `Content-Disposition: form-data; name="${name}"\r\n\r\n` +
+            `${value}\r\n`
+        ));
+    }
+
+    // File fields
+    for (const { name, buffer, filename } of files) {
+        parts.push(Buffer.from(
+            `--${boundary}\r\n` +
+            `Content-Disposition: form-data; name="${name}"; filename="${filename}"\r\n` +
+            `Content-Type: application/octet-stream\r\n\r\n`
+        ));
+        parts.push(buffer);
+        parts.push(Buffer.from('\r\n'));
+    }
+
+    parts.push(Buffer.from(`--${boundary}--\r\n`));
+    const bodyBuffer = Buffer.concat(parts);
+
+    return new Promise((resolve, reject) => {
+        const options = {
+            hostname: fullUrl.hostname,
+            path: fullUrl.pathname + fullUrl.search,
+            method: 'POST',
+            headers: {
+                'accept': '*/*',
+                'content-type': `multipart/form-data; boundary=${boundary}`,
+                'x-api-key': apiKey,
+                'x-http-client-type': 'browser',
+                'content-length': bodyBuffer.length
+            },
+            rejectUnauthorized: !skipTls,
+            timeout: 60000
+        };
+
+        const req = https.request(options, (res) => {
+            let data = '';
+            res.on('data', (chunk) => { data += chunk; });
+            res.on('end', () => resolve({ status: res.statusCode, body: data }));
+        });
+
+        req.on('timeout', () => req.destroy(new Error('Request timed out')));
+        req.on('error', reject);
+        req.write(bodyBuffer);
+        req.end();
+    });
+}
+
+module.exports = { IVANTI_URL_BASE, ivantiPost, ivantiMultipartPost, ivantiFormPost };

backend/migrations/add_fp_submissions_table.js

@@ -0,0 +1,57 @@
+// Migration: Add ivanti_fp_submissions table
+const sqlite3 = require('sqlite3').verbose();
+const path = require('path');
+
+const dbPath = path.join(__dirname, '..', 'cve_database.db');
+const db = new sqlite3.Database(dbPath);
+
+console.log('Starting ivanti_fp_submissions migration...');
+
+db.serialize(() => {
+    db.run(`
+        CREATE TABLE IF NOT EXISTS ivanti_fp_submissions (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            user_id INTEGER NOT NULL,
+            username TEXT NOT NULL,
+            ivanti_workflow_batch_id INTEGER,
+            ivanti_generated_id TEXT,
+            workflow_name TEXT NOT NULL,
+            reason TEXT NOT NULL,
+            description TEXT,
+            expiration_date TEXT NOT NULL,
+            scope_override TEXT NOT NULL DEFAULT 'Authorized',
+            finding_ids_json TEXT NOT NULL,
+            queue_item_ids_json TEXT NOT NULL,
+            attachment_count INTEGER DEFAULT 0,
+            attachment_results_json TEXT,
+            status TEXT NOT NULL DEFAULT 'success' CHECK(status IN ('success', 'partial', 'failed')),
+            error_message TEXT,
+            created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+        )
+    `, (err) => {
+        if (err) console.error('Error creating table:', err);
+        else console.log('✓ ivanti_fp_submissions table created');
+    });
+
+    db.run(
+        'CREATE INDEX IF NOT EXISTS idx_fp_submissions_user ON ivanti_fp_submissions(user_id)',
+        (err) => {
+            if (err) console.error('Error creating index:', err);
+            else console.log('✓ user_id index created');
+        }
+    );
+
+    db.run(
+        'CREATE INDEX IF NOT EXISTS idx_fp_submissions_ivanti_id ON ivanti_fp_submissions(ivanti_generated_id)',
+        (err) => {
+            if (err) console.error('Error creating index:', err);
+            else console.log('✓ ivanti_generated_id index created');
+        }
+    );
+
+    console.log('✓ Migration statements queued');
+});
+
+db.close(() => {
+    console.log('Migration complete!');
+});

backend/migrations/add_todo_queue_hostname.js

@@ -0,0 +1,25 @@
+// Migration: Add hostname column to ivanti_todo_queue
+const sqlite3 = require('sqlite3').verbose();
+const path = require('path');
+
+const dbPath = path.join(__dirname, '..', 'cve_database.db');
+const db = new sqlite3.Database(dbPath);
+
+console.log('Starting add_todo_queue_hostname migration...');
+
+db.run(
+    'ALTER TABLE ivanti_todo_queue ADD COLUMN hostname TEXT',
+    (err) => {
+        if (err) {
+            // Column may already exist if migration was run before
+            if (err.message.includes('duplicate column name')) {
+                console.log('✓ hostname column already exists, skipping');
+            } else {
+                console.error('Error adding column:', err);
+            }
+        } else {
+            console.log('✓ hostname column added');
+        }
+        db.close(() => console.log('Migration complete!'));
+    }
+);

backend/routes/auth.js

@@ -2,13 +2,35 @@
 const express = require('express');
 const bcrypt = require('bcryptjs');
 const crypto = require('crypto');
+const rateLimit = require('express-rate-limit');
 const { requireAuth, requireGroup } = require('../middleware/auth');
 
+const loginLimiter = rateLimit({
+    windowMs: 15 * 60 * 1000, // 15 minutes
+    max: 20, // 20 attempts per window
+    standardHeaders: true,
+    legacyHeaders: false,
+    message: { error: 'Too many login attempts. Please try again in 15 minutes.' }
+});
+
 function createAuthRouter(db, logAudit) {
     const router = express.Router();
 
-    // Login
-    router.post('/login', async (req, res) => {
+    /**
+     * POST /api/auth/login
+     *
+     * Authenticates a user with username and password, creates a session,
+     * and sets an httpOnly session cookie. Rate-limited to 20 attempts per 15 minutes.
+     *
+     * @body {string} username - The user's login username
+     * @body {string} password - The user's password
+     * @returns {object} 200 - { message: 'Login successful', user: { id, username, email, group } }
+     * @returns {object} 400 - { error: 'Username and password are required' }
+     * @returns {object} 401 - { error: 'Invalid username or password' } | { error: 'Account is disabled' }
+     * @returns {object} 429 - { error: 'Too many login attempts. Please try again in 15 minutes.' }
+     * @returns {object} 500 - { error: 'Login failed' }
+     */
+    router.post('/login', loginLimiter, async (req, res) => {
         const { username, password } = req.body;
 
         if (!username || !password) {
@@ -130,7 +152,14 @@ function createAuthRouter(db, logAudit) {
         }
     });
 
-    // Logout
+    /**
+     * POST /api/auth/logout
+     *
+     * Ends the current user session by deleting it from the database
+     * and clearing the session cookie.
+     *
+     * @returns {object} 200 - { message: 'Logged out successfully' }
+     */
     router.post('/logout', async (req, res) => {
         const sessionId = req.cookies?.session_id;
 
@@ -173,7 +202,16 @@ function createAuthRouter(db, logAudit) {
         res.json({ message: 'Logged out successfully' });
     });
 
-    // Get current user
+    /**
+     * GET /api/auth/me
+     *
+     * Returns the currently authenticated user based on the session cookie.
+     * Clears the cookie and returns 401 if the session is expired or the account is disabled.
+     *
+     * @returns {object} 200 - { user: { id, username, email, group } }
+     * @returns {object} 401 - { error: 'Not authenticated' } | { error: 'Session expired' } | { error: 'Account is disabled' }
+     * @returns {object} 500 - { error: 'Failed to get user' }
+     */
     router.get('/me', async (req, res) => {
         const sessionId = req.cookies?.session_id;
 
@@ -220,7 +258,16 @@ function createAuthRouter(db, logAudit) {
         }
     });
 
-    // Clean up expired sessions (admin only)
+    /**
+     * POST /api/auth/cleanup-sessions
+     *
+     * Deletes all expired sessions from the database. Requires Admin group.
+     *
+     * @returns {object} 200 - { message: 'Expired sessions cleaned up' }
+     * @returns {object} 401 - { error: 'Authentication required' }
+     * @returns {object} 403 - { error: 'Insufficient permissions', required: ['Admin'], current: '...' }
+     * @returns {object} 500 - { error: 'Cleanup failed' }
+     */
     router.post('/cleanup-sessions', requireAuth(db), requireGroup('Admin'), async (req, res) => {
         try {
             await new Promise((resolve, reject) => {

backend/routes/compliance.js

@@ -260,7 +260,7 @@ function createComplianceRouter(db, upload, requireAuth, requireGroup) {
                     items:       parsed.items,
                     summary:     parsed.summary,
                     report_date: parsed.report_date,
-                    filename:    req.file.originalname,
+                    filename:    req.file.originalname.replace(/[^\w.\-() ]/g, '_'),
                 }));
 
                 // Delete the original xlsx from temp (we only need the JSON now)
@@ -523,8 +523,8 @@ function createComplianceRouter(db, upload, requireAuth, requireGroup) {
     router.post('/notes', requireGroup('Admin', 'Standard_User'), async (req, res) => {
         const { hostname, metric_id, note } = req.body;
 
-        if (!hostname || typeof hostname !== 'string' || hostname.length > 300) {
-            return res.status(400).json({ error: 'Invalid hostname' });
+        if (!hostname || typeof hostname !== 'string' || hostname.length > 300 || !/^[a-zA-Z0-9._-]+$/.test(hostname)) {
+            return res.status(400).json({ error: 'Invalid hostname format' });
         }
         if (!metric_id || typeof metric_id !== 'string' || metric_id.length > 50) {
             return res.status(400).json({ error: 'Invalid metric_id' });

backend/routes/ivantiFindings.js

@@ -3,10 +3,9 @@
 // Notes are stored separately so they survive cache refreshes.
 
 const express = require('express');
-const https = require('https');
 const { requireGroup } = require('../middleware/auth');
+const { ivantiPost } = require('../helpers/ivantiApi');
 
-const IVANTI_URL_BASE = 'https://platform4.risksense.com/api/v1';
 const SYNC_INTERVAL_MS = 24 * 60 * 60 * 1000;
 
 const FINDINGS_FILTERS = [
@@ -71,42 +70,6 @@ const CLOSED_COUNT_FILTERS = [
     }
 ];
 
-// ---------------------------------------------------------------------------
-// HTTP helper — mirrors the one in ivantiWorkflows.js
-// ---------------------------------------------------------------------------
-function ivantiPost(urlPath, body, apiKey, skipTls) {
-    const bodyStr = JSON.stringify(body);
-    const fullUrl = new URL(IVANTI_URL_BASE + urlPath);
-
-    return new Promise((resolve, reject) => {
-        const options = {
-            hostname: fullUrl.hostname,
-            path: fullUrl.pathname + fullUrl.search,
-            method: 'POST',
-            headers: {
-                'accept': '*/*',
-                'content-type': 'application/json',
-                'x-api-key': apiKey,
-                'x-http-client-type': 'browser',
-                'content-length': Buffer.byteLength(bodyStr)
-            },
-            rejectUnauthorized: !skipTls,
-            timeout: 20000
-        };
-
-        const req = https.request(options, (res) => {
-            let data = '';
-            res.on('data', (chunk) => { data += chunk; });
-            res.on('end', () => resolve({ status: res.statusCode, body: data }));
-        });
-
-        req.on('timeout', () => req.destroy(new Error('Request timed out')));
-        req.on('error', reject);
-        req.write(bodyStr);
-        req.end();
-    });
-}
-
 // ---------------------------------------------------------------------------
 // Table init
 // ---------------------------------------------------------------------------

backend/routes/ivantiFpWorkflow.js

@@ -0,0 +1,395 @@
+// routes/ivantiFpWorkflow.js
+const express = require('express');
+const multer = require('multer');
+const path = require('path');
+const { requireGroup } = require('../middleware/auth');
+const { ivantiFormPost } = require('../helpers/ivantiApi');
+const logAudit = require('../helpers/auditLog');
+
+// ---------------------------------------------------------------------------
+// Pure helpers (exported for testing)
+// ---------------------------------------------------------------------------
+
+const ALLOWED_EXTENSIONS = new Set([
+    '.pdf', '.png', '.jpg', '.jpeg', '.gif',
+    '.doc', '.docx', '.xlsx', '.csv', '.txt', '.zip'
+]);
+
+/**
+ * Returns true if the filename has an allowed extension (case-insensitive).
+ */
+function isAllowedFileExtension(filename) {
+    if (!filename || typeof filename !== 'string') return false;
+    const ext = path.extname(filename).toLowerCase();
+    return ALLOWED_EXTENSIONS.has(ext);
+}
+
+/**
+ * Validates the FP workflow form body.
+ * Returns {} if valid, or { fieldName: 'error message' } for each invalid field.
+ */
+function validateFpWorkflowForm(body) {
+    const errors = {};
+
+    // name: required, non-empty, max 255
+    if (!body.name || typeof body.name !== 'string' || body.name.trim().length === 0) {
+        errors.name = 'Workflow name is required.';
+    } else if (body.name.trim().length > 255) {
+        errors.name = 'Workflow name must be 255 characters or fewer.';
+    }
+
+    // reason: required, non-empty
+    if (!body.reason || typeof body.reason !== 'string' || body.reason.trim().length === 0) {
+        errors.reason = 'Reason is required.';
+    }
+
+    // description: optional, max 2000 if provided
+    if (body.description !== undefined && body.description !== null && body.description !== '') {
+        if (typeof body.description !== 'string') {
+            errors.description = 'Description must be a string.';
+        } else if (body.description.length > 2000) {
+            errors.description = 'Description must be 2000 characters or fewer.';
+        }
+    }
+
+    // expirationDate: required, valid date, strictly after today
+    if (!body.expirationDate || typeof body.expirationDate !== 'string' || body.expirationDate.trim().length === 0) {
+        errors.expirationDate = 'Expiration date is required.';
+    } else {
+        const parsed = new Date(body.expirationDate);
+        if (isNaN(parsed.getTime())) {
+            errors.expirationDate = 'Expiration date must be a valid date.';
+        } else {
+            const today = new Date();
+            today.setHours(0, 0, 0, 0);
+            const expDay = new Date(parsed);
+            expDay.setHours(0, 0, 0, 0);
+            if (expDay <= today) {
+                errors.expirationDate = 'Expiration date must be in the future.';
+            }
+        }
+    }
+
+    return errors;
+}
+
+/**
+ * Builds the subjectFilterRequest JSON for the Ivanti FP workflow endpoint.
+ * Format: { subject, filterRequest: { filters } }
+ */
+function buildSubjectFilterRequest(findingIds) {
+    return JSON.stringify({
+        subject: 'hostFinding',
+        filterRequest: {
+            filters: [{
+                field: 'id',
+                exclusive: false,
+                operator: 'IN',
+                value: findingIds.map(id => String(id)).join(',')
+            }]
+        }
+    });
+}
+
+/**
+ * Builds the multipart form fields array for the Ivanti FP workflow request.
+ */
+function buildIvantiFormFields(formData, findingIds) {
+    const scopeMap = {
+        'Authorized': 'AUTHORIZED',
+        'None': 'NONE',
+        'Automated': 'AUTOMATED'
+    };
+
+    return [
+        { name: 'name', value: formData.name },
+        { name: 'reason', value: formData.reason },
+        { name: 'description', value: formData.description || '' },
+        { name: 'expirationDate', value: formData.expirationDate },
+        { name: 'overrideControl', value: scopeMap[formData.scopeOverride] || 'AUTHORIZED' },
+        { name: 'subjectFilterRequest', value: buildSubjectFilterRequest(findingIds) },
+        { name: 'isEmptyWorkflow', value: findingIds.length === 0 ? 'true' : 'false' }
+    ];
+}
+
+// ---------------------------------------------------------------------------
+// Multer configuration
+// ---------------------------------------------------------------------------
+
+const uploadStorage = multer.memoryStorage();
+
+const fpUpload = multer({
+    storage: uploadStorage,
+    limits: { fileSize: 10 * 1024 * 1024 }, // 10 MB per file
+    fileFilter: (req, file, cb) => {
+        if (isAllowedFileExtension(file.originalname)) {
+            cb(null, true);
+        } else {
+            cb(new Error(`File type not allowed: ${path.extname(file.originalname)}`));
+        }
+    }
+}).array('attachments', 10); // up to 10 files
+
+// ---------------------------------------------------------------------------
+// Router factory
+// ---------------------------------------------------------------------------
+
+function createIvantiFpWorkflowRouter(db, requireAuth) {
+    const router = express.Router();
+
+    /**
+     * POST /api/ivanti/fp-workflow
+     *
+     * Creates a False Positive workflow batch in the Ivanti/RiskSense API,
+     * optionally uploads file attachments, records the submission locally,
+     * and marks the associated queue items as complete.
+     *
+     * Content-Type: multipart/form-data
+     *
+     * @param {string}   req.body.name            - Workflow name (required, max 255 chars)
+     * @param {string}   req.body.reason          - Reason for the FP determination (required)
+     * @param {string}   [req.body.description]   - Additional description (optional, max 2000 chars)
+     * @param {string}   req.body.expirationDate  - ISO date string, must be a future date (required)
+     * @param {string}   [req.body.scopeOverride] - "Authorized" (default) or "None"
+     * @param {string}   req.body.findingIds      - JSON-encoded array of Ivanti finding IDs
+     * @param {string}   req.body.queueItemIds    - JSON-encoded array of local queue item IDs
+     * @param {File[]}   [req.files]              - Up to 10 file attachments (max 10 MB each);
+     *                                              allowed extensions: .pdf .png .jpg .jpeg .gif
+     *                                              .doc .docx .xlsx .csv .txt .zip
+     *
+     * @returns {object} 200 - Success
+     *   { success: true, workflowBatchId: number, generatedId: string,
+     *     attachmentResults: Array<{ filename: string, success: boolean, error?: string }>,
+     *     queueItemsUpdated: number, status: 'success' | 'partial' }
+     * @returns {object} 400 - Validation error
+     *   { error: string } or { success: false, errors: { [field]: string } }
+     * @returns {object} 403 - Queue item ownership violation
+     *   { error: string }
+     * @returns {object} 429 - Ivanti rate limit
+     *   { success: false, error: string, step: 'create_workflow' }
+     * @returns {object} 500 - Server configuration error
+     *   { success: false, error: string, step: 'create_workflow' }
+     * @returns {object} 502 - Ivanti API error
+     *   { success: false, error: string, step: 'create_workflow', details?: string }
+     */
+    router.post('/', requireAuth(db), requireGroup('Admin', 'Standard_User'), (req, res) => {
+        fpUpload(req, res, (multerErr) => {
+            if (multerErr) {
+                if (multerErr.code === 'LIMIT_FILE_SIZE') {
+                    return res.status(400).json({ error: 'File exceeds the 10 MB size limit.' });
+                }
+                return res.status(400).json({ error: multerErr.message });
+            }
+
+            // --- Parse JSON-encoded arrays from the multipart body ---
+            let findingIds, queueItemIds;
+            try {
+                findingIds = JSON.parse(req.body.findingIds || '[]');
+                queueItemIds = JSON.parse(req.body.queueItemIds || '[]');
+            } catch (e) {
+                return res.status(400).json({ error: 'findingIds and queueItemIds must be valid JSON arrays.' });
+            }
+
+            if (!Array.isArray(findingIds) || findingIds.length === 0) {
+                return res.status(400).json({ error: 'At least one finding ID is required.' });
+            }
+            if (!Array.isArray(queueItemIds) || queueItemIds.length === 0) {
+                return res.status(400).json({ error: 'At least one queue item ID is required.' });
+            }
+
+            // --- Validate form fields ---
+            const validationErrors = validateFpWorkflowForm(req.body);
+            if (Object.keys(validationErrors).length > 0) {
+                return res.status(400).json({ success: false, errors: validationErrors });
+            }
+
+            // --- Validate file extensions (belt-and-suspenders with Multer filter) ---
+            const files = req.files || [];
+            for (const file of files) {
+                if (!isAllowedFileExtension(file.originalname)) {
+                    return res.status(400).json({
+                        error: `File type not allowed: ${file.originalname}. Allowed: ${[...ALLOWED_EXTENSIONS].join(', ')}`
+                    });
+                }
+            }
+
+            // --- Verify queue items belong to user, are FP type, and pending ---
+            const placeholders = queueItemIds.map(() => '?').join(',');
+            db.all(
+                `SELECT id, workflow_type, status, user_id
+                 FROM ivanti_todo_queue
+                 WHERE id IN (${placeholders})`,
+                queueItemIds,
+                (err, rows) => {
+                    if (err) {
+                        console.error('Error verifying queue items:', err);
+                        return res.status(500).json({ error: 'Internal server error.' });
+                    }
+
+                    // Check all items were found
+                    if (!rows || rows.length !== queueItemIds.length) {
+                        return res.status(400).json({ error: 'One or more queue items not found.' });
+                    }
+
+                    // Check ownership, type, and status
+                    for (const row of rows) {
+                        if (row.user_id !== req.user.id) {
+                            return res.status(403).json({ error: 'You can only submit your own queue items.' });
+                        }
+                        if (row.workflow_type !== 'FP') {
+                            return res.status(400).json({ error: `Queue item ${row.id} is not an FP workflow type.` });
+                        }
+                        if (row.status !== 'pending') {
+                            return res.status(400).json({ error: `Queue item ${row.id} is not in pending status.` });
+                        }
+                    }
+
+                    // --- Validation passed — submit to Ivanti API ---
+                    (async () => {
+                        const apiKey = process.env.IVANTI_API_KEY;
+                        const clientId = process.env.IVANTI_CLIENT_ID || '1550';
+                        const skipTls = process.env.IVANTI_SKIP_TLS === 'true';
+
+                        if (!apiKey) {
+                            return res.status(500).json({ success: false, error: 'Ivanti API key is not configured.', step: 'create_workflow' });
+                        }
+
+                        // 1. Build form fields and call Ivanti API (multipart/form-data)
+                        const formFields = buildIvantiFormFields(req.body, findingIds);
+                        const formFiles = files.map(f => ({ name: 'files', buffer: f.buffer, filename: f.originalname }));
+                        const createUrl = `/client/${encodeURIComponent(clientId)}/workflowBatch/falsePositive/request`;
+
+                        let createResult;
+                        try {
+                            createResult = await ivantiFormPost(createUrl, formFields, formFiles, apiKey, skipTls);
+                        } catch (networkErr) {
+                            logAudit(db, {
+                                userId: req.user.id, username: req.user.username,
+                                action: 'ivanti_fp_workflow_failed', entityType: 'ivanti_workflow',
+                                details: { error: networkErr.message, findingIds },
+                                ipAddress: req.ip
+                            });
+                            return res.status(502).json({ success: false, error: 'Failed to connect to Ivanti API.', step: 'create_workflow', details: networkErr.message });
+                        }
+
+                        // Handle error responses from Ivanti
+                        if (createResult.status !== 200 && createResult.status !== 201 && createResult.status !== 202) {
+                            const errorMap = {
+                                401: 'Ivanti API key is invalid or missing.',
+                                419: 'API key lacks workflow creation permissions.',
+                                429: 'Ivanti API rate limit reached. Please try again in a few minutes.'
+                            };
+                            const errorMsg = errorMap[createResult.status] || `Workflow creation failed: ${createResult.status}`;
+                            const errorResponse = { success: false, error: errorMsg, step: 'create_workflow' };
+                            if (!errorMap[createResult.status]) {
+                                errorResponse.details = createResult.body;
+                            }
+
+                            logAudit(db, {
+                                userId: req.user.id, username: req.user.username,
+                                action: 'ivanti_fp_workflow_failed', entityType: 'ivanti_workflow',
+                                details: { error: errorMsg, status: createResult.status, findingIds },
+                                ipAddress: req.ip
+                            });
+
+                            return res.status(createResult.status === 429 ? 429 : 502).json(errorResponse);
+                        }
+
+                        // 2. Parse workflow batch response — API returns { id, created }
+                        let workflowBatchId;
+                        try {
+                            const createData = JSON.parse(createResult.body);
+                            workflowBatchId = createData.id;
+                        } catch (parseErr) {
+                            logAudit(db, {
+                                userId: req.user.id, username: req.user.username,
+                                action: 'ivanti_fp_workflow_failed', entityType: 'ivanti_workflow',
+                                details: { error: 'Failed to parse Ivanti response', responseBody: createResult.body },
+                                ipAddress: req.ip
+                            });
+                            return res.status(502).json({ success: false, error: 'Failed to parse Ivanti API response.', step: 'create_workflow' });
+                        }
+
+                        // 3. Determine submission status (files sent inline, so success if we got here)
+                        const status = 'success';
+
+                        // 4. Insert submission record
+                        try {
+                            await new Promise((resolve, reject) => {
+                                db.run(
+                                    `INSERT INTO ivanti_fp_submissions (user_id, username, ivanti_workflow_batch_id, ivanti_generated_id, workflow_name, reason, description, expiration_date, scope_override, finding_ids_json, queue_item_ids_json, attachment_count, attachment_results_json, status, error_message)
+                                     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+                                    [
+                                        req.user.id,
+                                        req.user.username,
+                                        workflowBatchId,
+                                        null, // generatedId not returned by this endpoint
+                                        req.body.name,
+                                        req.body.reason,
+                                        req.body.description || null,
+                                        req.body.expirationDate,
+                                        req.body.scopeOverride || 'Authorized',
+                                        JSON.stringify(findingIds),
+                                        JSON.stringify(queueItemIds),
+                                        files.length,
+                                        JSON.stringify(files.map(f => ({ filename: f.originalname, success: true }))),
+                                        status,
+                                        null
+                                    ],
+                                    (err) => { if (err) reject(err); else resolve(); }
+                                );
+                            });
+                        } catch (dbErr) {
+                            console.error('Failed to insert submission record:', dbErr);
+                            // Don't fail the response — the Ivanti workflow was created
+                        }
+
+                        // 5. Log audit entry
+                        logAudit(db, {
+                            userId: req.user.id, username: req.user.username,
+                            action: 'ivanti_fp_workflow_created', entityType: 'ivanti_workflow',
+                            entityId: String(workflowBatchId),
+                            details: { workflowName: req.body.name, findingIds, attachmentCount: files.length, status },
+                            ipAddress: req.ip
+                        });
+
+                        // 6. Mark queue items as complete
+                        let queueItemsUpdated = 0;
+                        try {
+                            const queuePlaceholders = queueItemIds.map(() => '?').join(',');
+                            queueItemsUpdated = await new Promise((resolve, reject) => {
+                                db.run(
+                                    `UPDATE ivanti_todo_queue SET status='complete', updated_at=CURRENT_TIMESTAMP WHERE id IN (${queuePlaceholders}) AND user_id=?`,
+                                    [...queueItemIds, req.user.id],
+                                    function (err) { if (err) reject(err); else resolve(this.changes); }
+                                );
+                            });
+                        } catch (queueErr) {
+                            console.error('Failed to update queue items:', queueErr);
+                            // Don't fail — workflow was created
+                        }
+
+                        // 7. Return response
+                        res.json({
+                            success: true,
+                            workflowBatchId,
+                            queueItemsUpdated,
+                            status
+                        });
+                    })().catch((unexpectedErr) => {
+                        console.error('Unexpected error in FP workflow submission:', unexpectedErr);
+                        res.status(500).json({ success: false, error: 'Internal server error.' });
+                    });
+                }
+            );
+        });
+    });
+
+    return router;
+}
+
+module.exports = createIvantiFpWorkflowRouter;
+module.exports.validateFpWorkflowForm = validateFpWorkflowForm;
+module.exports.buildIvantiFormFields = buildIvantiFormFields;
+module.exports.buildSubjectFilterRequest = buildSubjectFilterRequest;
+module.exports.isAllowedFileExtension = isAllowedFileExtension;

backend/routes/ivantiTodoQueue.js

@@ -1,19 +1,30 @@
 // routes/ivantiTodoQueue.js
 const express = require('express');
 const { requireGroup } = require('../middleware/auth');
+const logAudit = require('../helpers/auditLog');
 
 const VALID_WORKFLOW_TYPES = ['FP', 'Archer', 'CARD'];
 const VALID_STATUSES       = ['pending', 'complete'];
 
 function isValidVendor(vendor) {
-    return typeof vendor === 'string' && vendor.trim().length > 0 && vendor.length <= 200;
+    if (typeof vendor !== 'string') return false;
+    const trimmed = vendor.trim();
+    return trimmed.length > 0 && trimmed.length <= 200;
 }
 
 function createIvantiTodoQueueRouter(db, requireAuth) {
     const router = express.Router();
 
-    // GET /api/ivanti/todo-queue
-    // Fetch current user's queue items, ordered by vendor then created_at
+    /**
+     * GET /api/ivanti/todo-queue
+     *
+     * Fetch the current user's queue items, ordered by vendor then created_at.
+     *
+     * @returns {Array<Object>} 200 - Array of queue items, each with:
+     *   id, user_id, finding_id, finding_title, cves_json, ip_address,
+     *   vendor, workflow_type, status, created_at, updated_at, cves (parsed array)
+     * @returns {Object} 500 - { error: string } on database error
+     */
     router.get('/', requireAuth(db), (req, res) => {
         db.all(
             `SELECT * FROM ivanti_todo_queue
@@ -35,10 +46,174 @@ function createIvantiTodoQueueRouter(db, requireAuth) {
         );
     });
 
-    // POST /api/ivanti/todo-queue
-    // Add a finding to the queue
+    /**
+     * POST /api/ivanti/todo-queue/batch
+     *
+     * Add multiple findings to the current user's queue in a single transaction.
+     *
+     * @body {Object[]} findings        - Required array of 1–200 finding objects
+     * @body {string} findings[].finding_id    - Required, non-empty finding identifier
+     * @body {string} [findings[].finding_title] - Optional finding title (max 500 chars)
+     * @body {string[]} [findings[].cves]        - Optional array of CVE identifiers
+     * @body {string} [findings[].ip_address]    - Optional IP address (max 64 chars)
+     * @body {string} [findings[].hostname]      - Optional hostname (max 255 chars)
+     * @body {string} workflow_type     - One of 'FP', 'Archer', 'CARD'
+     * @body {string} vendor            - Required for FP/Archer (max 200 chars); optional for CARD
+     *
+     * @returns {Object} 201 - { items: Array<Object> } array of created queue items,
+     *   each with: id, user_id, finding_id, finding_title, cves_json, ip_address,
+     *   vendor, workflow_type, status, created_at, updated_at, cves (parsed array)
+     * @returns {Object} 400 - { error: string } on validation failure
+     * @returns {Object} 500 - { error: string } on database/transaction error (all inserts rolled back)
+     */
+    router.post('/batch', requireAuth(db), requireGroup('Admin', 'Standard_User'), (req, res) => {
+        const { findings, workflow_type, vendor } = req.body;
+
+        // --- Validation ---
+        if (!Array.isArray(findings) || findings.length < 1 || findings.length > 200) {
+            return res.status(400).json({ error: 'findings array must contain 1-200 items.' });
+        }
+
+        for (let i = 0; i < findings.length; i++) {
+            const f = findings[i];
+            if (!f || typeof f.finding_id !== 'string' || f.finding_id.trim().length === 0) {
+                return res.status(400).json({ error: 'Each finding must have a non-empty finding_id string.' });
+            }
+        }
+
+        if (!VALID_WORKFLOW_TYPES.includes(workflow_type)) {
+            return res.status(400).json({ error: 'workflow_type must be FP, Archer, or CARD.' });
+        }
+
+        if (workflow_type !== 'CARD') {
+            if (!isValidVendor(vendor)) {
+                return res.status(400).json({ error: 'vendor is required for FP and Archer workflows.' });
+            }
+        }
+
+        if (vendor !== undefined && vendor !== '' && typeof vendor === 'string' && vendor.trim().length > 200) {
+            return res.status(400).json({ error: 'vendor must be under 200 chars.' });
+        }
+
+        const vendorVal = workflow_type === 'CARD' ? '' : vendor.trim();
+        const userId = req.user.id;
+
+        // --- Transactional batch insert ---
+        // Prepare all row values upfront
+        const rows = findings.map((f) => {
+            const findingId = f.finding_id.trim();
+            const title = f.finding_title && typeof f.finding_title === 'string'
+                ? f.finding_title.slice(0, 500)
+                : null;
+            const cvesJson = Array.isArray(f.cves) ? JSON.stringify(f.cves) : null;
+            const ipVal = f.ip_address && typeof f.ip_address === 'string'
+                ? f.ip_address.trim().slice(0, 64)
+                : null;
+            const hostVal = f.hostname && typeof f.hostname === 'string'
+                ? f.hostname.trim().slice(0, 255)
+                : null;
+            return [userId, findingId, title, cvesJson, ipVal, hostVal, vendorVal, workflow_type];
+        });
+
+        const insertedIds = [];
+        let insertError = null;
+        let remaining = rows.length;
+
+        db.serialize(() => {
+            db.run('BEGIN TRANSACTION');
+
+            rows.forEach((params) => {
+                db.run(
+                    `INSERT INTO ivanti_todo_queue
+                         (user_id, finding_id, finding_title, cves_json, ip_address, hostname, vendor, workflow_type)
+                     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+                    params,
+                    function (err) {
+                        if (err && !insertError) {
+                            insertError = err;
+                        } else if (!err) {
+                            insertedIds.push(this.lastID);
+                        }
+                        remaining--;
+
+                        // After all insert callbacks have fired, commit or rollback
+                        if (remaining === 0) {
+                            if (insertError) {
+                                db.run('ROLLBACK', () => {
+                                    console.error('Batch insert error:', insertError);
+                                    return res.status(500).json({ error: 'Internal server error.' });
+                                });
+                            } else {
+                                db.run('COMMIT', (commitErr) => {
+                                    if (commitErr) {
+                                        console.error('Batch commit error:', commitErr);
+                                        db.run('ROLLBACK', () => {});
+                                        return res.status(500).json({ error: 'Internal server error.' });
+                                    }
+
+                                    // Fetch all inserted rows
+                                    const placeholders = insertedIds.map(() => '?').join(',');
+                                    db.all(
+                                        `SELECT * FROM ivanti_todo_queue WHERE id IN (${placeholders})`,
+                                        insertedIds,
+                                        (fetchErr, fetchedRows) => {
+                                            if (fetchErr) {
+                                                console.error('Error fetching inserted batch rows:', fetchErr);
+                                                return res.status(500).json({ error: 'Internal server error.' });
+                                            }
+
+                                            const items = (fetchedRows || []).map((r) => ({
+                                                ...r,
+                                                cves: r.cves_json ? JSON.parse(r.cves_json) : [],
+                                            }));
+
+                                            // Audit log (fire-and-forget)
+                                            logAudit(db, {
+                                                userId: req.user.id,
+                                                username: req.user.username,
+                                                action: 'batch_add_to_queue',
+                                                entityType: 'ivanti_todo_queue',
+                                                entityId: null,
+                                                details: {
+                                                    count: insertedIds.length,
+                                                    workflow_type: workflow_type,
+                                                    finding_ids: findings.map((f) => f.finding_id.trim()),
+                                                },
+                                                ipAddress: req.ip,
+                                            });
+
+                                            return res.status(201).json({ items });
+                                        }
+                                    );
+                                });
+                            }
+                        }
+                    }
+                );
+            });
+        });
+    });
+
+    /**
+     * POST /api/ivanti/todo-queue
+     *
+     * Add a single finding to the current user's queue.
+     *
+     * @body {string} finding_id       - Required, non-empty finding identifier
+     * @body {string} [finding_title]   - Optional finding title (max 500 chars)
+     * @body {string[]} [cves]          - Optional array of CVE identifiers
+     * @body {string} [ip_address]      - Optional IP address (max 64 chars)
+     * @body {string} [hostname]        - Optional hostname (max 255 chars)     * @body {string} vendor            - Required for FP/Archer (max 200 chars); optional for CARD
+     * @body {string} workflow_type     - One of 'FP', 'Archer', 'CARD'
+     *
+     * @returns {Object} 201 - Created queue item with parsed cves array:
+     *   id, user_id, finding_id, finding_title, cves_json, ip_address,
+     *   vendor, workflow_type, status, created_at, updated_at, cves
+     * @returns {Object} 400 - { error: string } on validation failure
+     * @returns {Object} 500 - { error: string } on database error
+     */
     router.post('/', requireAuth(db), requireGroup('Admin', 'Standard_User'), (req, res) => {
-        const { finding_id, finding_title, cves, ip_address, vendor, workflow_type } = req.body;
+        const { finding_id, finding_title, cves, ip_address, hostname, vendor, workflow_type } = req.body;
 
         if (!finding_id || typeof finding_id !== 'string' || finding_id.trim().length === 0) {
             return res.status(400).json({ error: 'finding_id is required.' });
@@ -57,15 +232,16 @@ function createIvantiTodoQueueRouter(db, requireAuth) {
         const vendorVal = workflow_type === 'CARD' ? '' : vendor.trim();
         const cvesJson  = Array.isArray(cves) ? JSON.stringify(cves) : null;
         const ipVal     = ip_address && typeof ip_address === 'string' ? ip_address.trim().slice(0, 64) : null;
+        const hostVal   = hostname && typeof hostname === 'string' ? hostname.trim().slice(0, 255) : null;
         const title     = finding_title && typeof finding_title === 'string'
             ? finding_title.slice(0, 500)
             : null;
 
         db.run(
             `INSERT INTO ivanti_todo_queue
-                 (user_id, finding_id, finding_title, cves_json, ip_address, vendor, workflow_type)
-             VALUES (?, ?, ?, ?, ?, ?, ?)`,
-            [req.user.id, finding_id.trim(), title, cvesJson, ipVal, vendorVal, workflow_type],
+                 (user_id, finding_id, finding_title, cves_json, ip_address, hostname, vendor, workflow_type)
+             VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+            [req.user.id, finding_id.trim(), title, cvesJson, ipVal, hostVal, vendorVal, workflow_type],
             function (err) {
                 if (err) {
                     console.error('Error adding to queue:', err);
@@ -85,8 +261,23 @@ function createIvantiTodoQueueRouter(db, requireAuth) {
         );
     });
 
-    // PUT /api/ivanti/todo-queue/:id
-    // Update vendor, workflow_type, or status — scoped to current user
+    /**
+     * PUT /api/ivanti/todo-queue/:id
+     *
+     * Update vendor, workflow_type, or status on a queue item — scoped to current user.
+     *
+     * @param {string} id               - Queue item ID (URL parameter)
+     * @body {string} [vendor]          - New vendor string (max 200 chars)
+     * @body {string} [workflow_type]   - One of 'FP', 'Archer', 'CARD'
+     * @body {string} [status]          - One of 'pending', 'complete'
+     *
+     * @returns {Object} 200 - Updated queue item with parsed cves array:
+     *   id, user_id, finding_id, finding_title, cves_json, ip_address,
+     *   vendor, workflow_type, status, created_at, updated_at, cves
+     * @returns {Object} 400 - { error: string } on validation failure or no fields to update
+     * @returns {Object} 404 - { error: string } if item not found for current user
+     * @returns {Object} 500 - { error: string } on database error
+     */
     router.put('/:id', requireAuth(db), requireGroup('Admin', 'Standard_User'), (req, res) => {
         const { id } = req.params;
         const { vendor, workflow_type, status } = req.body;
@@ -160,9 +351,15 @@ function createIvantiTodoQueueRouter(db, requireAuth) {
         );
     });
 
-    // DELETE /api/ivanti/todo-queue/completed
-    // Bulk-delete all completed items for the current user
-    // IMPORTANT: This route must be registered BEFORE DELETE /:id
+    /**
+     * DELETE /api/ivanti/todo-queue/completed
+     *
+     * Bulk-delete all completed items for the current user.
+     * IMPORTANT: This route must be registered BEFORE DELETE /:id.
+     *
+     * @returns {Object} 200 - { message: string, deleted: number }
+     * @returns {Object} 500 - { error: string } on database error
+     */
     router.delete('/completed', requireAuth(db), requireGroup('Admin', 'Standard_User'), (req, res) => {
         db.run(
             "DELETE FROM ivanti_todo_queue WHERE user_id = ? AND status = 'complete'",
@@ -177,8 +374,17 @@ function createIvantiTodoQueueRouter(db, requireAuth) {
         );
     });
 
-    // DELETE /api/ivanti/todo-queue/:id
-    // Delete a single item — scoped to current user
+    /**
+     * DELETE /api/ivanti/todo-queue/:id
+     *
+     * Delete a single queue item — scoped to current user.
+     *
+     * @param {string} id - Queue item ID (URL parameter)
+     *
+     * @returns {Object} 200 - { message: string }
+     * @returns {Object} 404 - { error: string } if item not found for current user
+     * @returns {Object} 500 - { error: string } on database error
+     */
     router.delete('/:id', requireAuth(db), requireGroup('Admin', 'Standard_User'), (req, res) => {
         const { id } = req.params;
 

backend/routes/ivantiWorkflows.js

@@ -4,49 +4,11 @@
 // Error codes: 401 bad key, 419 insufficient privileges, 429 rate limited
 
 const express = require('express');
-const https = require('https');
 const { requireGroup } = require('../middleware/auth');
+const { ivantiPost } = require('../helpers/ivantiApi');
 
-const IVANTI_URL_BASE = 'https://platform4.risksense.com/api/v1';
 const SYNC_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24 hours
 
-// ---------------------------------------------------------------------------
-// HTTP helper — uses Node's https module directly so we can toggle
-// rejectUnauthorized for Charter's SSL inspection proxy (IVANTI_SKIP_TLS=true)
-// ---------------------------------------------------------------------------
-function ivantiPost(urlPath, body, apiKey, skipTls) {
-    const bodyStr = JSON.stringify(body);
-    const fullUrl = new URL(IVANTI_URL_BASE + urlPath);
-
-    return new Promise((resolve, reject) => {
-        const options = {
-            hostname: fullUrl.hostname,
-            path: fullUrl.pathname + fullUrl.search,
-            method: 'POST',
-            headers: {
-                'accept': '*/*',
-                'content-type': 'application/json',
-                'x-api-key': apiKey,
-                'x-http-client-type': 'browser',
-                'content-length': Buffer.byteLength(bodyStr)
-            },
-            rejectUnauthorized: !skipTls,
-            timeout: 15000
-        };
-
-        const req = https.request(options, (res) => {
-            let data = '';
-            res.on('data', (chunk) => { data += chunk; });
-            res.on('end', () => resolve({ status: res.statusCode, body: data }));
-        });
-
-        req.on('timeout', () => req.destroy(new Error('Request timed out')));
-        req.on('error', reject);
-        req.write(bodyStr);
-        req.end();
-    });
-}
-
 // ---------------------------------------------------------------------------
 // Ensure the sync state table exists (idempotent — safe to call on every start)
 // ---------------------------------------------------------------------------

backend/routes/knowledgeBase.js

@@ -92,22 +92,15 @@ function createKnowledgeBaseRouter(db, upload) {
     const slug = generateSlug(title);
     const kbDir = path.join(__dirname, '..', 'uploads', 'knowledge_base');
 
-    // Create directory if it doesn't exist
-    if (!fs.existsSync(kbDir)) {
-      fs.mkdirSync(kbDir, { recursive: true });
-    }
-
     const filename = `${timestamp}_${sanitizedName}`;
     const filePath = path.join(kbDir, filename);
 
     try {
-      // Move uploaded file to permanent location
-      fs.renameSync(uploadedFile.path, filePath);
-
+      // Keep file in temp location until DB insert succeeds
       // Check if slug already exists
       db.get('SELECT id FROM knowledge_base WHERE slug = ?', [slug], (err, row) => {
         if (err) {
-          fs.unlinkSync(filePath);
+          fs.unlinkSync(uploadedFile.path);
           console.error('Error checking slug:', err);
           return res.status(500).json({ error: 'Database error' });
         }
@@ -138,11 +131,22 @@ function createKnowledgeBaseRouter(db, upload) {
           ],
           function (err) {
             if (err) {
-              fs.unlinkSync(filePath);
+              fs.unlinkSync(uploadedFile.path);
               console.error('Error inserting knowledge base entry:', err);
               return res.status(500).json({ error: 'Failed to save document metadata' });
             }
 
+            // DB insert succeeded — now move file to permanent location
+            try {
+              if (!fs.existsSync(kbDir)) {
+                fs.mkdirSync(kbDir, { recursive: true });
+              }
+              fs.renameSync(uploadedFile.path, filePath);
+            } catch (moveErr) {
+              console.error('Error moving file to permanent location:', moveErr);
+              // File is orphaned in temp but DB record exists — log and continue
+            }
+
             // Log audit entry
             logAudit(db, {
               userId: req.user.id,
@@ -165,8 +169,8 @@ function createKnowledgeBaseRouter(db, upload) {
         );
       });
     } catch (error) {
-      // Clean up file on error
-      if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
+      // Clean up temp file on error
+      if (uploadedFile && fs.existsSync(uploadedFile.path)) fs.unlinkSync(uploadedFile.path);
       console.error('Error uploading knowledge base document:', error);
       res.status(500).json({ error: error.message || 'Failed to upload document' });
     }
@@ -288,12 +292,14 @@ function createKnowledgeBaseRouter(db, upload) {
         contentType = 'text/plain; charset=utf-8';
       }
 
+      const safeFileName = row.file_name.replace(/["\r\n\\]/g, '');
       res.setHeader('Content-Type', contentType);
       // Use inline instead of attachment to allow browser to display
-      res.setHeader('Content-Disposition', `inline; filename="${row.file_name}"`);
+      res.setHeader('Content-Disposition', `inline; filename="${safeFileName}"`);
       // Allow iframe embedding from frontend origin
       res.removeHeader('X-Frame-Options');
-      res.setHeader('Content-Security-Policy', "frame-ancestors 'self' http://71.85.90.9:3000 http://localhost:3000");
+      const corsOrigins = process.env.CORS_ORIGINS ? process.env.CORS_ORIGINS.split(',').join(' ') : 'http://localhost:3000';
+      res.setHeader('Content-Security-Policy', `frame-ancestors 'self' ${corsOrigins}`);
       res.sendFile(row.file_path);
     });
   });
@@ -338,8 +344,9 @@ function createKnowledgeBaseRouter(db, upload) {
         ipAddress: req.ip
       });
 
+      const safeDownloadName = row.file_name.replace(/["\r\n\\]/g, '');
       res.setHeader('Content-Type', row.file_type || 'application/octet-stream');
-      res.setHeader('Content-Disposition', `attachment; filename="${row.file_name}"`);
+      res.setHeader('Content-Disposition', `attachment; filename="${safeDownloadName}"`);
       res.sendFile(row.file_path);
     });
   });

backend/routes/users.js

@@ -124,12 +124,12 @@ function createUsersRouter(db, requireAuth, requireGroup, logAudit) {
         }
 
         // Prevent admin self-demotion
-        if (userId == req.user.id && group && group !== 'Admin') {
+        if (String(userId) === String(req.user.id) && group && group !== 'Admin') {
             return res.status(400).json({ error: 'Cannot remove your own admin group' });
         }
 
         // Prevent self-deactivation
-        if (userId == req.user.id && is_active === false) {
+        if (String(userId) === String(req.user.id) && is_active === false) {
             return res.status(400).json({ error: 'Cannot deactivate your own account' });
         }
 
@@ -247,7 +247,7 @@ function createUsersRouter(db, requireAuth, requireGroup, logAudit) {
         const userId = req.params.id;
 
         // Prevent self-deletion
-        if (userId == req.user.id) {
+        if (String(userId) === String(req.user.id)) {
             return res.status(400).json({ error: 'Cannot delete your own account' });
         }
 

backend/server.js

@@ -23,13 +23,18 @@ const createArcherTicketsRouter = require('./routes/archerTickets');
 const createIvantiWorkflowsRouter = require('./routes/ivantiWorkflows');
 const createIvantiFindingsRouter = require('./routes/ivantiFindings');
 const createIvantiTodoQueueRouter = require('./routes/ivantiTodoQueue');
-const createIvantiArchiveRouter   = require('./routes/ivantiArchive');
-const createComplianceRouter      = require('./routes/compliance');
+const createIvantiArchiveRouter       = require('./routes/ivantiArchive');
+const createIvantiFpWorkflowRouter   = require('./routes/ivantiFpWorkflow');
+const createComplianceRouter          = require('./routes/compliance');
 
 const app = express();
 const PORT = process.env.PORT || 3001;
 const API_HOST = process.env.API_HOST || 'localhost';
-const SESSION_SECRET = process.env.SESSION_SECRET || 'default-secret-change-me';
+const SESSION_SECRET = process.env.SESSION_SECRET;
+if (!SESSION_SECRET) {
+    console.error('FATAL: SESSION_SECRET environment variable must be set');
+    process.exit(1);
+}
 const CORS_ORIGINS = process.env.CORS_ORIGINS
     ? process.env.CORS_ORIGINS.split(',')
     : ['http://localhost:3000'];
@@ -223,6 +228,9 @@ app.use('/api/ivanti/todo-queue', createIvantiTodoQueueRouter(db, requireAuth));
 // Ivanti archive routes — finding archive tracking for severity score drift
 app.use('/api/ivanti/archive', createIvantiArchiveRouter(db, requireAuth));
 
+// Ivanti FP workflow routes — submit False Positive workflows to Ivanti API
+app.use('/api/ivanti/fp-workflow', createIvantiFpWorkflowRouter(db, requireAuth));
+
 // AEO compliance routes — xlsx upload, non-compliant item tracking, notes
 app.use('/api/compliance', createComplianceRouter(db, upload, requireAuth, requireGroup));
 

backend/setup.js

@@ -3,6 +3,7 @@
 
 const sqlite3 = require('sqlite3').verbose();
 const bcrypt = require('bcryptjs');
+const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
 
@@ -172,8 +173,9 @@ async function createDefaultAdmin(db) {
                 return;
             }
 
-            // Create admin user with password 'admin123'
-            const passwordHash = await bcrypt.hash('admin123', 10);
+            // Generate a random admin password on first run
+            const generatedPassword = crypto.randomBytes(12).toString('base64url');
+            const passwordHash = await bcrypt.hash(generatedPassword, 10);
 
             db.run(
                 `INSERT INTO users (username, email, password_hash, role, is_active)
@@ -183,7 +185,12 @@ async function createDefaultAdmin(db) {
                     if (err) {
                         reject(err);
                     } else {
-                        console.log('✓ Created default admin user (admin/admin123)');
+                        console.log('✓ Created default admin user');
+                        console.log(`\n  ╔══════════════════════════════════════════╗`);
+                        console.log(`  ║  Admin credentials (save these now!)     ║`);
+                        console.log(`  ║  Username: admin                         ║`);
+                        console.log(`  ║  Password: ${generatedPassword.padEnd(29)}║`);
+                        console.log(`  ╚══════════════════════════════════════════╝\n`);
                         resolve();
                     }
                 }
@@ -269,7 +276,7 @@ function displaySummary() {
     console.log('   ✓ Indexes for fast queries');
     console.log('   ✓ Document compliance view');
     console.log('   ✓ Uploads directory for file storage');
-    console.log('   ✓ Default admin user (admin/admin123)');
+    console.log('   ✓ Default admin user (see credentials above)');
     console.log('\n📁 File structure will be:');
     console.log('   uploads/');
     console.log('     └── CVE-XXXX-XXXX/');

docs/ivanti-api-reference.md

@@ -0,0 +1,106 @@
+# Ivanti / RiskSense API Reference
+
+Base URL: `https://platform4.risksense.com/api/v1`
+Swagger: `https://platform4.risksense.com/doc/swagger.json`
+
+Auth: `x-api-key` header. Error codes: 401 bad key, 419 insufficient privileges, 429 rate limited.
+
+## Endpoints Used
+
+### Search Workflow Batches
+
+```
+POST /client/{clientId}/workflowBatch/search
+Content-Type: application/json
+```
+
+Standard JSON body with filters, projection, sort, page, size. Used by `ivantiWorkflows.js` for the daily sync.
+
+### Create False Positive Workflow
+
+```
+POST /client/{clientId}/workflowBatch/falsePositive/request
+Content-Type: multipart/form-data
+```
+
+This endpoint does NOT accept JSON. It requires `multipart/form-data` with the following fields:
+
+| Field | Type | Required | Notes |
+|-------|------|----------|-------|
+| `name` | string | yes | Workflow batch name (max 255) |
+| `reason` | string | yes | Reason for the FP determination |
+| `description` | string | yes | Description (can be empty string but field must be present) |
+| `expirationDate` | string | yes | ISO-8601 date, e.g. `2026-06-01` |
+| `overrideControl` | string | yes | `AUTHORIZED`, `NONE`, or `AUTOMATED`. Use `AUTHORIZED` for standard FP workflows. `NONE` with `isEmptyWorkflow=true` is rejected (400). |
+| `isEmptyWorkflow` | boolean | yes | `true` if no findings attached, `false` otherwise |
+| `subjectFilterRequest` | string | yes | Stringified JSON (see format below) |
+| `files` | file | no | Attachments sent inline in the same request |
+
+#### subjectFilterRequest format
+
+This is the critical field. It must be a stringified JSON object with this exact structure:
+
+```json
+{
+  "subject": "hostFinding",
+  "filterRequest": {
+    "filters": [
+      {
+        "field": "id",
+        "exclusive": false,
+        "operator": "IN",
+        "value": "2283734550,2283734551"
+      }
+    ]
+  }
+}
+```
+
+Key details:
+- `subject` must be `"hostFinding"` — without this, the API returns 500
+- `filters` is nested inside `filterRequest`, NOT at the top level — `{"filters":[]}` at the top level returns 500
+- `value` for multiple IDs is comma-separated as a single string, not an array
+- `operator` values: `EXACT`, `IN`, `LIKE`, `WILDCARD`, `RANGE`, `CIDR`
+- For empty workflows, use `{"subject":"hostFinding","filterRequest":{"filters":[]}}` with `isEmptyWorkflow=true`
+
+#### Response (200/202)
+
+```json
+{
+  "id": 33418832,
+  "created": "2026-04-08T18:16:08"
+}
+```
+
+Returns HTTP 200 or 202 (Accepted — async job creation). Response contains a numeric `id` (the workflow batch job ID) and `created` timestamp. No `generatedId` or `uuid` in this response.
+
+### Other Workflow Endpoints (from Swagger)
+
+These are available but not currently used by the dashboard:
+
+| Endpoint | Purpose |
+|----------|---------|
+| `/workflowBatch/acceptance/request` | Risk acceptance workflow |
+| `/workflowBatch/remediation/request` | Remediation workflow |
+| `/workflowBatch/severityChange/request` | Severity change workflow |
+| `/workflowBatch/{workflowType}/approve` | Approve a workflow (needs `workflowBatchUuid`) |
+| `/workflowBatch/{workflowType}/reject` | Reject a workflow |
+| `/workflowBatch/{workflowType}/rework` | Send back for rework |
+| `/workflowBatch/{workflowType}/update` | Update a workflow |
+| `/workflowBatch/{workflowType}/{workflowBatchUuid}/map` | Map findings to workflow |
+| `/workflowBatch/{workflowType}/{workflowBatchUuid}/unmap` | Unmap findings |
+| `/workflowBatch/{workflowType}/{workflowBatchUuid}/attach` | Attach file to existing workflow |
+| `/workflowBatch/{workflowType}/{workflowBatchUuid}/detach` | Detach file |
+| `/workflowBatch/model` | Get model/schema |
+| `/workflowBatch/filter` | Get available filter fields |
+| `/workflowBatch/suggest` | Get suggested values for a filter field |
+
+## Environment Variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `IVANTI_API_KEY` | — | Required. API key for authentication |
+| `IVANTI_CLIENT_ID` | `1550` | Client ID in the Ivanti platform |
+| `IVANTI_SKIP_TLS` | `false` | Set `true` to skip TLS verification |
+| `IVANTI_FIRST_NAME` | — | Used for workflow search filter (sync) |
+| `IVANTI_LAST_NAME` | — | Used for workflow search filter (sync) |

frontend/package.json

@@ -14,6 +14,7 @@
     "react-markdown": "^10.1.0",
     "react-scripts": "5.0.1",
     "recharts": "^3.8.1",
+    "rehype-sanitize": "^6.0.0",
     "web-vitals": "^2.1.4",
     "xlsx": "^0.18.5"
   },

frontend/src/components/KnowledgeBaseViewer.js

@@ -1,5 +1,6 @@
 import React, { useState, useEffect, useRef } from 'react';
 import ReactMarkdown from 'react-markdown';
+import rehypeSanitize from 'rehype-sanitize';
 import mermaid from 'mermaid';
 import { X, Download, Loader, AlertCircle, FileText, File } from 'lucide-react';
 
@@ -233,6 +234,7 @@ export default function KnowledgeBaseViewer({ article, onClose }) {
             {isMarkdown && (
               <div className="markdown-content">
                 <ReactMarkdown
+                  rehypePlugins={[rehypeSanitize]}
                   components={{
                     code({ inline, className, children }) {
                       const lang = /language-(\w+)/.exec(className || '')?.[1];
@@ -277,6 +279,7 @@ export default function KnowledgeBaseViewer({ article, onClose }) {
             {isPDF && (
               <div className="w-full" style={{ height: '700px' }}>
                 <iframe
+                  sandbox="allow-same-origin"
                   src={`${API_BASE}/knowledge-base/${article.id}/content`}
                   title={article.title}
                   className="w-full h-full rounded"

frontend/src/components/LoginForm.js

@@ -98,12 +98,6 @@ export default function LoginForm() {
                         )}
                     </button>
                 </form>
-
-                <div className="mt-6 pt-6 border-t border-intel-grid">
-                    <p className="text-sm text-gray-500 text-center font-mono">
-                        Default: <span className="text-intel-accent">admin</span> / <span className="text-intel-accent">admin123</span>
-                    </p>
-                </div>
             </div>
         </div>
     );

package.json

@@ -15,6 +15,7 @@
     "cors": "^2.8.6",
     "dotenv": "^16.6.1",
     "express": "^5.2.1",
+    "express-rate-limit": "^7.5.0",
     "multer": "^2.0.2",
     "sqlite3": "^5.1.7"
   }