Asset-based ISO 27005:2022 alignment#79
Open
ruslanbaidan wants to merge 11 commits into
Open
Conversation
…translations for the risk sources.
…ded the default ones in the migration.
Asset-based ISO 27005:2022 alignment
There was a problem hiding this comment.
Pull request overview
This PR introduces “risk sources” and “reassessment triggers” as first-class, asset-oriented risk review concepts, including persistence, validation/formatting, and selection/listing support aligned with ISO 27005:2022-style review triggers.
Changes:
- Add new domain objects for Risk Sources and Reassessment Triggers (entities, tables, services) plus query/input formatting and validation.
- Extend instance-risk querying with subclass hooks for extra joins/keyword filtering/custom ordering.
- Add DB migrations to create/populate the new tables and add reassessment trigger monitoring-approach metadata, plus unit tests for validators/services/formatters.
Reviewed changes
Copilot reviewed 32 out of 32 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/Unit/Validator/InputValidator/RiskSource/RiskSourceInputValidatorTest.php | Adds unit tests for RiskSource POST/PATCH validation behavior (trimming, boolean casting, defaults). |
| tests/Unit/Validator/InputValidator/ReassessmentTrigger/ReassessmentTriggerInputValidatorTest.php | Adds unit tests for ReassessmentTrigger POST/PATCH validation and translation-field handling. |
| tests/Unit/Validator/InputValidator/InstanceRisk/UpdateInstanceRiskDataInputValidatorTest.php | Adds tests for InstanceRisk validator, including new risk-review fields (currently mismatched with implementation). |
| tests/Unit/Service/RiskSourceServiceTest.php | Adds unit tests for RiskSourceService create/update/delete and language fallback behavior. |
| tests/Unit/Service/ReassessmentTriggerServiceTest.php | Adds unit tests for ReassessmentTriggerService translation handling and monitoring-approach clearing. |
| tests/Unit/InputFormatter/RiskSource/GetRiskSourcesInputFormatterTest.php | Adds unit tests for RiskSource list formatter filtering/search/order defaults. |
| tests/Unit/InputFormatter/ReassessmentTrigger/GetReassessmentTriggersInputFormatterTest.php | Adds unit tests for ReassessmentTrigger list formatter filtering/search/order defaults. |
| src/Validator/InputValidator/RiskSource/PostRiskSourceDataInputValidator.php | Introduces POST validation rules for risk source payloads (label + isActive casting/default). |
| src/Validator/InputValidator/RiskSource/PatchRiskSourceDataInputValidator.php | Introduces PATCH validation rules for risk source payloads (partial updates + nullable boolean). |
| src/Validator/InputValidator/ReassessmentTrigger/PostReassessmentTriggerDataInputValidator.php | Introduces POST validation rules for reassessment trigger payloads including translation arrays. |
| src/Validator/InputValidator/ReassessmentTrigger/PatchReassessmentTriggerDataInputValidator.php | Introduces PATCH validation rules plus getValidData() override to drop non-provided fields. |
| src/Traits/TranslationNormalizationTrait.php | Adds shared translation-array normalization (trim + drop empty values). |
| src/Table/TranslationTable.php | Adds new translation lookup and deletion helpers (common-db translations, keyed results). |
| src/Table/RiskSourceTable.php | Adds RiskSource table accessors including filter-based lookup and a label lookup method. |
| src/Table/ReassessmentTriggerTable.php | Adds ordered retrieval of reassessment triggers with optional inclusion of inactive rows. |
| src/Table/InstanceRiskTable.php | Adds extensibility hooks for joins/keywords/order and improves default ordering behavior. |
| src/Service/RiskSourceService.php | Adds RiskSourceService CRUD and label resolution with language fallback. |
| src/Service/ReassessmentTriggerService.php | Adds ReassessmentTriggerService CRUD, selection-data generation, and translation display helpers. |
| src/Service/InstanceRiskService.php | Adds imports for upcoming risk-review metadata work (currently unused). |
| src/InputFormatter/RiskSource/GetRiskSourcesInputFormatter.php | Adds list formatter for RiskSources (status mapping/default + ordering). |
| src/InputFormatter/ReassessmentTrigger/GetReassessmentTriggersInputFormatter.php | Adds list formatter for ReassessmentTriggers (status mapping + ordering). |
| src/Entity/RiskSourceSuperClass.php | Adds RiskSource mapped superclass storing label translations inline as JSON. |
| src/Entity/RiskSource.php | Adds RiskSource entity mapping. |
| src/Entity/ReassessmentTriggerSuperClass.php | Adds ReassessmentTrigger mapped superclass storing translations inline as JSON. |
| src/Entity/ReassessmentTrigger.php | Adds ReassessmentTrigger entity mapping. |
| migrations/db/20260515100000_add_risk_review_metadata.php | Adds monitoring_approach column and backfills defaults by trigger position. |
| migrations/db/20260511100000_add_reassessment_triggers.php | Creates reassessment triggers table and inserts default triggers/translations. |
| migrations/db/20260505100000_add_risk_sources.php | Creates risk sources table, inserts defaults, and adds risk_source_id FK to instances_risks. |
| migrations/db/20230901112005_fix_positions_cleanup_db.php | Makes cleanup migration idempotent for rolf tables (safe column/index handling). |
| migrations/db/20211129110500_fix_op_scales_translations.php | Makes translation-fixing migration respect configured language list. |
| migrations/db/20210521090000_changeable_operational_impact.php | Makes operational-impact migration respect configured language index→code mapping. |
| config/module.config.php | Wires new services/tables/validators into the Laminas module configuration. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+48
to
+61
| public function create(array $data): ReassessmentTrigger | ||
| { | ||
| $reassessmentTrigger = (new ReassessmentTrigger()) | ||
| ->setTriggerTypeTranslations($data['triggerTypes']) | ||
| ->setDescriptionTranslations($data['descriptions']) | ||
| ->setMonitoringApproachTranslations($data['monitoringApproaches']) | ||
| ->setIsActive((bool)($data['isActive'] ?? true)) | ||
| ->setCreator($this->connectedUser->getEmail()); | ||
|
|
||
| $this->applyCreatePosition($reassessmentTrigger, $data); | ||
| $this->reassessmentTriggerTable->save($reassessmentTrigger); | ||
|
|
||
| return $reassessmentTrigger; | ||
| } |
Comment on lines
+140
to
+145
| public function setTriggerTypeTranslations(array $triggerTypeTranslations): self | ||
| { | ||
| $this->triggerType = $this->encodeTranslations($triggerTypeTranslations); | ||
|
|
||
| return $this; | ||
| } |
Comment on lines
+31
to
+35
| self::assertTrue($validator->isValid([ | ||
| 'riskSourceId' => '5', | ||
| 'threatRate' => '3', | ||
| 'vulnerabilityRate' => '-', | ||
| 'lastReviewDate' => '2026-05-15', |
Comment on lines
+10
to
+12
| use DateTime; | ||
| use Monarc\Core\Entity; | ||
| use Monarc\Core\Exception\Exception; |
Comment on lines
+47
to
+51
| public function findOneByLabel(string $label): ?RiskSource | ||
| { | ||
| return $this->getRepository()->createQueryBuilder('rs') | ||
| ->where('LOWER(rs.label) = :label') | ||
| ->setParameter('label', mb_strtolower(trim($label))) |
Comment on lines
+73
to
+75
| if (array_key_exists('monitoringApproaches', $data)) { | ||
| $reassessmentTrigger->setMonitoringApproachTranslations($data['monitoringApproaches']); | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.