Add Rust risk register bridge

Author: ewilhelm1979-netizen

Makefile

@@ -3,7 +3,7 @@ COMPOSE_STAGE=docker compose -f docker-compose.yml -f docker-compose.stage.yml
 COMPOSE_PROD=docker compose -f docker-compose.yml -f docker-compose.prod.yml
 COMPOSE_PROD_LLM=docker compose -f docker-compose.yml -f docker-compose.prod.yml -f docker-compose.llm.yml
 PYTHON_BIN=$(shell if [ -x .venv/bin/python ]; then echo .venv/bin/python; else echo python; fi)
-TEAM_TEST_ENV=GUIDANCE_SCORING_BACKEND=local RISK_SCORING_BACKEND=local REPORT_SUMMARY_BACKEND=local REPORT_SNAPSHOT_BACKEND=local DASHBOARD_SUMMARY_BACKEND=local ASSET_INVENTORY_BACKEND=local PROCESS_REGISTER_BACKEND=local RUST_BACKEND_URL=
+TEAM_TEST_ENV=GUIDANCE_SCORING_BACKEND=local RISK_SCORING_BACKEND=local REPORT_SUMMARY_BACKEND=local REPORT_SNAPSHOT_BACKEND=local DASHBOARD_SUMMARY_BACKEND=local ASSET_INVENTORY_BACKEND=local PROCESS_REGISTER_BACKEND=local RISK_REGISTER_BACKEND=local RUST_BACKEND_URL=
 
 .PHONY: dev-up dev-down stage-up stage-down prod-up prod-down prod-up-llm llm-download backup restore health handbook-pdf local-bootstrap local-check local-test team-test docker-check docker-smoke easy-start prod-readiness rust-build rust-test rust-run canary-daily rust-import-collection rust-sync-recent rust-canary-parity rust-canary-trend rust-canary-import
 
@@ -20,7 +20,7 @@ local-test:
 
 team-test:
 	$(TEAM_TEST_ENV) $(PYTHON_BIN) manage.py check
-	$(TEAM_TEST_ENV) $(PYTHON_BIN) manage.py test apps.core apps.reports apps.product_security apps.guidance apps.dashboard apps.assets_app apps.processes apps.vulnerability_intelligence
+	$(TEAM_TEST_ENV) $(PYTHON_BIN) manage.py test apps.core apps.reports apps.product_security apps.guidance apps.dashboard apps.assets_app apps.processes apps.risks apps.vulnerability_intelligence
 
 docker-check:
 	$(COMPOSE_DEV) config >/dev/null

README.md

@@ -160,6 +160,7 @@ Der funktionierende Referenzpfad auf Ubuntu 24.04 ist:
 - `DASHBOARD_SUMMARY_BACKEND=rust_service`
 - `ASSET_INVENTORY_BACKEND=rust_service`
 - `PROCESS_REGISTER_BACKEND=rust_service`
+- `RISK_REGISTER_BACKEND=rust_service`
 - `RUST_STRICT_MODE=True` (erzwingt Rust-Backends ohne Fallback)
 
 Danach kann weiter wie gewohnt gestartet werden:

apps/risks/services.py

@@ -1,5 +1,317 @@
 """V20: Risk-Matrix-Service fuer 5x5 Heatmap."""
 from collections import defaultdict
+import json
+from dataclasses import dataclass
+from datetime import date, datetime
+from urllib.error import HTTPError
+from urllib.request import Request, urlopen
+
+from django.conf import settings
+
+from .models import Risk
+
+
+IMPACT_LABELS = dict(Risk.IMPACT_CHOICES)
+LIKELIHOOD_LABELS = dict(Risk.LIKELIHOOD_CHOICES)
+STATUS_LABELS = dict(Risk.Status.choices)
+TREATMENT_LABELS = dict(Risk.Treatment.choices)
+
+
+@dataclass(frozen=True)
+class RiskRelatedRef:
+    id: int | None
+    name: str
+
+    def __str__(self) -> str:
+        return self.name
+
+
+@dataclass(frozen=True)
+class RiskBridgeItem:
+    id: int
+    tenant: object
+    tenant_id: int
+    category: RiskRelatedRef | None
+    category_id: int | None
+    process: RiskRelatedRef | None
+    process_id: int | None
+    asset: RiskRelatedRef | None
+    asset_id: int | None
+    owner: RiskRelatedRef | None
+    owner_id: int | None
+    title: str
+    description: str
+    threat: str
+    vulnerability: str
+    impact: int
+    impact_label: str
+    likelihood: int
+    likelihood_label: str
+    residual_impact: int | None
+    residual_impact_label: str | None
+    residual_likelihood: int | None
+    residual_likelihood_label: str | None
+    status: str
+    status_label: str
+    treatment_strategy: str
+    treatment_strategy_label: str
+    treatment_plan: str
+    treatment_due_date: date | None
+    accepted_by: RiskRelatedRef | None
+    accepted_by_id: int | None
+    accepted_at: datetime | None
+    review_date: date | None
+    created_at: str
+    updated_at: str
+
+    @property
+    def pk(self) -> int:
+        return self.id
+
+    @property
+    def score(self) -> int:
+        return self.impact * self.likelihood
+
+    @property
+    def residual_score(self) -> int | None:
+        if self.residual_impact and self.residual_likelihood:
+            return self.residual_impact * self.residual_likelihood
+        return None
+
+    @property
+    def risk_level(self) -> str:
+        score = self.score
+        if score >= 20:
+            return 'CRITICAL'
+        if score >= 12:
+            return 'HIGH'
+        if score >= 6:
+            return 'MEDIUM'
+        return 'LOW'
+
+    @property
+    def risk_level_label(self) -> str:
+        return {'CRITICAL': 'Kritisch', 'HIGH': 'Hoch', 'MEDIUM': 'Mittel', 'LOW': 'Niedrig'}.get(
+            self.risk_level,
+            '–',
+        )
+
+    @property
+    def severity(self) -> int:
+        return self.impact
+
+    def get_impact_display(self) -> str:
+        return self.impact_label or IMPACT_LABELS.get(self.impact, str(self.impact))
+
+    def get_likelihood_display(self) -> str:
+        return self.likelihood_label or LIKELIHOOD_LABELS.get(self.likelihood, str(self.likelihood))
+
+    def get_status_display(self) -> str:
+        return self.status_label or STATUS_LABELS.get(self.status, self.status)
+
+    def get_treatment_strategy_display(self) -> str:
+        return self.treatment_strategy_label or TREATMENT_LABELS.get(self.treatment_strategy, self.treatment_strategy)
+
+
+class RiskRustClient:
+    @staticmethod
+    def _base_url() -> str:
+        base = (getattr(settings, 'RUST_BACKEND_URL', '') or '').strip()
+        return base.rstrip('/')
+
+    @staticmethod
+    def fetch_risks(request, tenant, timeout: int = 8) -> list[RiskBridgeItem]:
+        base = RiskRustClient._base_url()
+        if not base:
+            raise RuntimeError('RUST_BACKEND_URL ist nicht gesetzt.')
+
+        rust_request = RiskRustClient._authenticated_request(request, tenant, f'{base}/api/v1/risks')
+        with urlopen(rust_request, timeout=timeout) as response:
+            payload = json.loads(response.read().decode('utf-8'))
+
+        tenant_id = RiskRustClient._int_field(payload, 'tenant_id')
+        if tenant_id != int(tenant.id):
+            raise RuntimeError('Rust-Risikoliste gehoert nicht zum angefragten Tenant.')
+
+        return [
+            RiskRustClient._risk_from_payload(item, tenant)
+            for item in payload.get('risks', [])
+            if isinstance(item, dict)
+        ]
+
+    @staticmethod
+    def fetch_risk_detail(request, tenant, risk_id: int, timeout: int = 8):
+        base = RiskRustClient._base_url()
+        if not base:
+            raise RuntimeError('RUST_BACKEND_URL ist nicht gesetzt.')
+
+        rust_request = RiskRustClient._authenticated_request(request, tenant, f'{base}/api/v1/risks/{int(risk_id)}')
+        try:
+            with urlopen(rust_request, timeout=timeout) as response:
+                payload = json.loads(response.read().decode('utf-8'))
+        except HTTPError as exc:
+            if exc.code == 404:
+                return None
+            raise
+
+        risk = payload.get('risk') or {}
+        if not isinstance(risk, dict):
+            raise RuntimeError('Rust-Risikodetail hat kein risk-Objekt geliefert.')
+        risk_tenant_id = RiskRustClient._int_field(risk, 'tenant_id')
+        if risk_tenant_id != int(tenant.id):
+            raise RuntimeError('Rust-Risikodetail gehoert nicht zum angefragten Tenant.')
+        return RiskRustClient._risk_from_payload(risk, tenant)
+
+    @staticmethod
+    def _risk_from_payload(item: dict, tenant) -> RiskBridgeItem:
+        category_id = RiskRustClient._optional_int_field(item, 'category_id')
+        process_id = RiskRustClient._optional_int_field(item, 'process_id')
+        asset_id = RiskRustClient._optional_int_field(item, 'asset_id')
+        owner_id = RiskRustClient._optional_int_field(item, 'owner_id')
+        accepted_by_id = RiskRustClient._optional_int_field(item, 'accepted_by_id')
+        category_name = str(item.get('category_name') or '').strip()
+        process_name = str(item.get('process_name') or '').strip()
+        asset_name = str(item.get('asset_name') or '').strip()
+        owner_display = str(item.get('owner_display') or '').strip()
+        accepted_by_display = str(item.get('accepted_by_display') or '').strip()
+        impact = RiskRustClient._int_field(item, 'impact')
+        likelihood = RiskRustClient._int_field(item, 'likelihood')
+        status = str(item.get('status') or Risk.Status.IDENTIFIED)
+        treatment_strategy = str(item.get('treatment_strategy') or '')
+        return RiskBridgeItem(
+            id=RiskRustClient._int_field(item, 'id'),
+            tenant=tenant,
+            tenant_id=RiskRustClient._int_field(item, 'tenant_id'),
+            category=RiskRelatedRef(category_id, category_name) if category_name else None,
+            category_id=category_id,
+            process=RiskRelatedRef(process_id, process_name) if process_name else None,
+            process_id=process_id,
+            asset=RiskRelatedRef(asset_id, asset_name) if asset_name else None,
+            asset_id=asset_id,
+            owner=RiskRelatedRef(owner_id, owner_display) if owner_display else None,
+            owner_id=owner_id,
+            title=str(item.get('title') or ''),
+            description=str(item.get('description') or ''),
+            threat=str(item.get('threat') or ''),
+            vulnerability=str(item.get('vulnerability') or ''),
+            impact=impact,
+            impact_label=str(item.get('impact_label') or IMPACT_LABELS.get(impact, impact)),
+            likelihood=likelihood,
+            likelihood_label=str(item.get('likelihood_label') or LIKELIHOOD_LABELS.get(likelihood, likelihood)),
+            residual_impact=RiskRustClient._optional_int_field(item, 'residual_impact'),
+            residual_impact_label=RiskRustClient._optional_str_field(item, 'residual_impact_label'),
+            residual_likelihood=RiskRustClient._optional_int_field(item, 'residual_likelihood'),
+            residual_likelihood_label=RiskRustClient._optional_str_field(item, 'residual_likelihood_label'),
+            status=status,
+            status_label=str(item.get('status_label') or STATUS_LABELS.get(status, status)),
+            treatment_strategy=treatment_strategy,
+            treatment_strategy_label=str(
+                item.get('treatment_strategy_label') or TREATMENT_LABELS.get(treatment_strategy, treatment_strategy)
+            ),
+            treatment_plan=str(item.get('treatment_plan') or ''),
+            treatment_due_date=RiskRustClient._date_field(item, 'treatment_due_date'),
+            accepted_by=RiskRelatedRef(accepted_by_id, accepted_by_display) if accepted_by_display else None,
+            accepted_by_id=accepted_by_id,
+            accepted_at=RiskRustClient._datetime_field(item, 'accepted_at'),
+            review_date=RiskRustClient._date_field(item, 'review_date'),
+            created_at=str(item.get('created_at') or ''),
+            updated_at=str(item.get('updated_at') or ''),
+        )
+
+    @staticmethod
+    def _authenticated_request(request, tenant, url: str) -> Request:
+        user = getattr(request, 'user', None)
+        user_id = getattr(user, 'id', None)
+        if not user_id:
+            raise RuntimeError('Risk-Rust-Bridge braucht einen authentifizierten User.')
+
+        rust_request = Request(url)
+        rust_request.add_header('Accept', 'application/json')
+        rust_request.add_header('X-ISCY-Tenant-ID', str(tenant.id))
+        rust_request.add_header('X-ISCY-User-ID', str(user_id))
+        user_email = (getattr(user, 'email', '') or '').strip()
+        if user_email:
+            rust_request.add_header('X-ISCY-User-Email', user_email)
+        return rust_request
+
+    @staticmethod
+    def _int_field(payload: dict, key: str) -> int:
+        return int(payload.get(key) or 0)
+
+    @staticmethod
+    def _optional_int_field(payload: dict, key: str) -> int | None:
+        value = payload.get(key)
+        if value in (None, ''):
+            return None
+        return int(value)
+
+    @staticmethod
+    def _optional_str_field(payload: dict, key: str) -> str | None:
+        value = str(payload.get(key) or '').strip()
+        return value or None
+
+    @staticmethod
+    def _date_field(payload: dict, key: str) -> date | None:
+        value = str(payload.get(key) or '').strip()
+        if not value:
+            return None
+        return date.fromisoformat(value[:10])
+
+    @staticmethod
+    def _datetime_field(payload: dict, key: str) -> datetime | None:
+        value = str(payload.get(key) or '').strip()
+        if not value:
+            return None
+        normalized = value.replace('Z', '+00:00')
+        return datetime.fromisoformat(normalized)
+
+
+class RiskRegisterBridge:
+    @staticmethod
+    def fetch_list(request, tenant):
+        if tenant is None:
+            return None
+
+        backend = str(getattr(settings, 'RISK_REGISTER_BACKEND', 'rust_service') or '').strip().lower()
+        if backend != 'rust_service':
+            return None
+
+        if not RiskRustClient._base_url():
+            if RiskRegisterBridge._strict_rust_mode():
+                raise RuntimeError('Rust risk register backend ist aktiv, aber RUST_BACKEND_URL ist nicht gesetzt.')
+            return None
+
+        try:
+            return RiskRustClient.fetch_risks(request, tenant)
+        except Exception as exc:
+            if RiskRegisterBridge._strict_rust_mode():
+                raise RuntimeError('Rust risk register backend ist aktiv, aber nicht erreichbar.') from exc
+            return None
+
+    @staticmethod
+    def fetch_detail(request, tenant, risk_id: int):
+        if tenant is None:
+            return None
+
+        backend = str(getattr(settings, 'RISK_REGISTER_BACKEND', 'rust_service') or '').strip().lower()
+        if backend != 'rust_service':
+            return None
+
+        if not RiskRustClient._base_url():
+            if RiskRegisterBridge._strict_rust_mode():
+                raise RuntimeError('Rust risk register backend ist aktiv, aber RUST_BACKEND_URL ist nicht gesetzt.')
+            return None
+
+        try:
+            return RiskRustClient.fetch_risk_detail(request, tenant, risk_id)
+        except Exception as exc:
+            if RiskRegisterBridge._strict_rust_mode():
+                raise RuntimeError('Rust risk register backend ist aktiv, aber nicht erreichbar.') from exc
+            return None
+
+    @staticmethod
+    def _strict_rust_mode() -> bool:
+        return bool(getattr(settings, 'RUST_STRICT_MODE', False))
 
 
 class RiskMatrixService: