cve-dashboard/.kiro/specs/compliance-metric-estimated-resolution-date/requirements.md

Requirements Document

Introduction

This feature surfaces the estimated resolution date for each noncompliant metric directly at the top of that metric's section in the asset sidebar on the compliance page. Today, an asset's resolution date is only visible through the editable Resolution Date metadata field lower in the sidebar, where it is computed as a shared value across selected metrics and collapses to "Multiple values" when metrics disagree. This feature instead displays each metric's own resolution_date inline with the metric, so a viewer can see the projected compliance date (for example "2026-07-01") for metrics such as 2.3.6i, 2.3.8i, and Vulns_Aging without scrolling to or interacting with the metadata editor.

This is a read and display oriented feature. It surfaces the existing per-metric resolution_date value already tracked in the data model; it does not introduce new persistence, new editing surfaces, or changes to how the date is stored or computed.

Traceability: GitLab issue #20 — "[Feature Request] Show estimated resolution date in sidebar per metric" (http://steam-gitlab.charterlab.com/steam/cve-dashboard/-/issues/20).

Glossary

• Compliance_Page: The AEO Compliance page in the frontend that lists noncompliant assets and their metrics.
• Asset_Sidebar: The detail panel rendered by ComplianceDetailPanel.js that opens for a single asset (hostname) and lists that asset's metrics, metadata, history, and notes.
• Metric: A single AEO compliance check tracked for an asset, identified by a metric_id (for example 2.3.6i, 2.3.8i, Vulns_Aging). Each metric has a status of active (noncompliant) or resolved (compliant).
• Noncompliant_Metric: A metric with status equal to active.
• Compliant_Metric: A metric with status equal to resolved.
• Estimated_Resolution_Date: The projected date by which a metric is expected to return to compliance, stored per metric in the resolution_date field and derived from the per-metric remediation notes/date metadata.
• Resolution_Date_Field: The existing per-metric resolution_date data field returned by the compliance API for each metric.
• Viewer: A user with read-only access to all data.
• Editor: A user with viewer permissions plus create and update operations.
• Admin: A user with editor permissions plus delete, user management, and audit log access.
• Team: A compliance business unit. Only STEAM and ACCESS-ENG are tracked.

Requirements

Requirement 1: Display estimated resolution date per noncompliant metric

User Story: As a viewer reviewing an asset's compliance posture, I want to see each noncompliant metric's estimated resolution date at the top of that metric's section, so that I can understand the projected compliance date for each metric without scrolling to or interacting with the metadata editor.

Acceptance Criteria

1. WHEN the Asset_Sidebar renders a Noncompliant_Metric whose Resolution_Date_Field contains a value parseable as a calendar date, THE Asset_Sidebar SHALL display that metric's Estimated_Resolution_Date within that metric's section.
2. WHEN the Asset_Sidebar renders a Noncompliant_Metric whose Resolution_Date_Field contains a value parseable as a calendar date, THE Asset_Sidebar SHALL position that metric's Estimated_Resolution_Date at the top of that metric's section, above the metric description and above all other fields belonging to that metric.
3. THE Asset_Sidebar SHALL display the Estimated_Resolution_Date for each Noncompliant_Metric using the value of that same metric's Resolution_Date_Field.
4. THE Asset_Sidebar SHALL display the Estimated_Resolution_Date as a calendar date in YYYY-MM-DD format (four-digit year, two-digit month, and two-digit day separated by hyphens).
5. WHEN the Asset_Sidebar displays a Noncompliant_Metric's Estimated_Resolution_Date, THE Asset_Sidebar SHALL render a visible text label adjacent to that value identifying it as the estimated resolution date.
6. IF a Noncompliant_Metric's Resolution_Date_Field is non-empty but does not contain a value parseable as a calendar date, THEN THE Asset_Sidebar SHALL omit the Estimated_Resolution_Date value for that metric and display a placeholder indicating that no valid estimated resolution date is available, while continuing to render the remainder of that metric's section.

Requirement 2: Handle metrics with no estimated resolution date

User Story: As a viewer, I want a clear indication when a noncompliant metric has no estimated resolution date set, so that I can distinguish metrics with a plan from metrics that still need one.

Acceptance Criteria

1. IF a Noncompliant_Metric has a Resolution_Date_Field that is null, an empty string, or contains only whitespace, THEN THE Asset_Sidebar SHALL display, at the top of that metric's section, a text placeholder that identifies the value as the estimated resolution date and indicates that no estimated resolution date is set for that metric.
2. WHEN the Asset_Sidebar opens for an asset, THE Asset_Sidebar SHALL render every Noncompliant_Metric for that asset regardless of whether that metric's Resolution_Date_Field is populated, null, empty, or whitespace-only.

Requirement 3: Scope display to noncompliant metrics

User Story: As a viewer, I want the estimated resolution date emphasized only for noncompliant metrics, so that the sidebar focuses attention on metrics that still require remediation.

Acceptance Criteria

1. IF a Metric is a Compliant_Metric (status = resolved), THEN THE Asset_Sidebar SHALL NOT display the top-of-section Estimated_Resolution_Date (positioned above the metric description and supplementary fields) for that metric, regardless of whether that metric has a populated Resolution_Date_Field.
2. WHEN the Asset_Sidebar renders the set of Noncompliant_Metric entries, THE Asset_Sidebar SHALL derive each metric's Estimated_Resolution_Date using only that same metric's Resolution_Date_Field value.
3. WHEN two Noncompliant_Metric entries have different Resolution_Date_Field values, THE Asset_Sidebar SHALL display each metric's own Estimated_Resolution_Date without collapsing the values into a combined or "Multiple values" representation.
4. WHEN the Asset_Sidebar renders an asset containing both Compliant_Metric and Noncompliant_Metric entries, THE Asset_Sidebar SHALL display the top-of-section Estimated_Resolution_Date only within Noncompliant_Metric sections.

Requirement 4: Preserve existing metadata editing behavior

User Story: As an editor, I want the existing resolution date editing workflow to continue functioning unchanged, so that surfacing the per-metric date for display does not regress my ability to update it.

Acceptance Criteria

1. THE Asset_Sidebar SHALL continue to render the existing editable Resolution Date metadata field.
2. WHEN an Editor successfully saves an updated Resolution_Date_Field for a Noncompliant_Metric, THE Asset_Sidebar SHALL display the updated Estimated_Resolution_Date for that metric within 2 seconds of the successful save.
3. THE Asset_Sidebar SHALL derive the displayed Estimated_Resolution_Date from the same per-metric Resolution_Date_Field used by the existing metadata editing workflow.
4. IF an Editor's save of an updated Resolution_Date_Field fails, THEN THE Asset_Sidebar SHALL retain the previously displayed Estimated_Resolution_Date and display an error indication for the failed save.
5. WHEN an Editor clears the Resolution_Date_Field for a Noncompliant_Metric and the save succeeds, THE Asset_Sidebar SHALL display the no-date placeholder for that metric consistent with Requirement 2.

Requirement 5: Role-based access to the display

User Story: As a security stakeholder, I want the estimated resolution date display to honor existing role-based access controls, so that read-only users can see the information without gaining editing capability.

Acceptance Criteria

1. WHILE the current user is a Viewer, THE Asset_Sidebar SHALL display each Noncompliant_Metric's Estimated_Resolution_Date using the same value and YYYY-MM-DD format presented to Editor and Admin users.
2. WHILE the current user is an Editor or Admin, THE Asset_Sidebar SHALL display each Noncompliant_Metric's Estimated_Resolution_Date using the same value and YYYY-MM-DD format presented to a Viewer.
3. THE Asset_Sidebar SHALL present the top-of-section Estimated_Resolution_Date display as read-only content that contains no input field, button, link, or other interactive control capable of modifying a Resolution_Date_Field, regardless of the current user's role.
4. WHILE the current user is a Viewer, THE Asset_Sidebar SHALL present no enabled control that creates or updates a Resolution_Date_Field value.