feat(m1): DB schema, migrations, diag visibility
23 tables + alembic_version covering the v1 data model:
- Auth/RBAC (8): users, groups, permissions, user_groups, group_permissions,
invitations, invitation_groups, refresh_tokens.
- MITRE (4): mitre_tactics, mitre_techniques, mitre_subtechniques + the
technique↔tactic many-to-many.
- Templates (4): test_templates, test_template_mitre_tags (3 nullable FKs +
CHECK exactly_one_mitre_fk), scenario_templates, scenario_template_tests
(UUID PK + UNIQUE(scenario_id, position) so a test can appear at multiple
positions).
- Missions (6): missions, mission_members, mission_scenarios, mission_tests,
mission_test_mitre_tags (deliberately denormalised — copies external_id +
name + url, no FK to mitre_* — so a re-sync of the catalogue can't purge
historical tags), mission_categories.
- Evidence/settings/notifications (5): evidence_files, settings (JSONB
value), detection_levels, notifications.
SQLAlchemy 2.x with Mapped[]/mapped_column(), pk_/fk_/ck_/uq_/ix_ naming
convention. Reusable mixins (UuidPkMixin, TimestampMixin, SoftDeleteMixin —
no auto __table_args__ since classes silently clobber the mixin's).
Soft delete: deleted_at + partial indexes ix_<table>_active WHERE deleted_at
IS NULL on 9 tables (users, groups, test_templates, scenario_templates,
missions, mission_scenarios, mission_tests, mission_categories,
evidence_files). Notifications gets ix_..._unread WHERE read_at IS NULL.
CHECK constraints for status / state / opsec_level / mitre_kind enums.
New API endpoint GET /api/v1/diag/db: returns alembic_revision (short hash)
and the public-schema table_count. 503 with {"reachable": false} on a DB
outage. Database card on the SPA home consumes it.
Test stage in backend/Dockerfile (--target test): runtime + dev extras +
tests/. New make test-api spins an ephemeral pytest container against the
live DB on the compose network. backend/tests/test_schema.py: 8 integration
tests (tables, FK pairs, CHECK constraints, partial indexes, alembic-at-head,
negative INSERT proving the exactly_one_mitre_fk CHECK fires).
e2e/tests/m1-db.spec.ts: 4 Playwright tests covering the diag endpoint
contract + the Database card + footer/roadmap labels.
DoD: make clean && make up && make migrate → 23 tables, 32 FKs, 9 CHECKs,
make test-api → 9 passed, make e2e → 12 passed.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Knacky
316
backend/app/models/mission.py
Normal file
316
backend/app/models/mission.py
Normal file
@@ -0,0 +1,316 @@
|
||||
"""Missions and snapshots.
|
||||
|
||||
A `Mission` references members and a tree of snapshot rows:
|
||||
mission ─< mission_scenarios ─< mission_tests ─< (red/blue annotations)
|
||||
|
||||
Snapshots copy template fields verbatim so editing a template doesn't drift
|
||||
already-running missions. `source_*_template_id` keep a soft pointer for
|
||||
analytics, but the source rows can be soft-deleted without breaking the mission.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import uuid
|
||||
from datetime import date, datetime
|
||||
from typing import Any
|
||||
|
||||
from sqlalchemy import (
|
||||
ARRAY,
|
||||
CheckConstraint,
|
||||
Date,
|
||||
DateTime,
|
||||
ForeignKey,
|
||||
Index,
|
||||
Integer,
|
||||
String,
|
||||
Text,
|
||||
UniqueConstraint,
|
||||
Uuid,
|
||||
)
|
||||
from sqlalchemy.orm import Mapped, mapped_column, relationship
|
||||
|
||||
from app.db.base import Base
|
||||
from app.db.mixins import SoftDeleteMixin, TimestampMixin, UuidPkMixin
|
||||
|
||||
# DateTime is no longer needed since MissionMember now uses TimestampMixin.
|
||||
# The remaining DateTime usages in MissionTest (executed_at) keep the import below.
|
||||
from app.db.types import (
|
||||
MISSION_ROLE_HINTS,
|
||||
MISSION_STATUSES,
|
||||
MISSION_TEST_STATES,
|
||||
MISSION_VISIBILITY_MODES,
|
||||
MITRE_KINDS,
|
||||
OPSEC_LEVELS,
|
||||
)
|
||||
|
||||
# `mission_test_mitre_tags` deliberately denormalises the MITRE labels so a
|
||||
# mission's tags survive a MITRE re-sync that drops the original entry. The
|
||||
# FK columns were removed in favour of frozen `mitre_external_id` + `mitre_name`
|
||||
# snapshots — see spec §11 ("snapshot vs reference" risk).
|
||||
|
||||
|
||||
class Mission(Base, UuidPkMixin, TimestampMixin, SoftDeleteMixin):
|
||||
__tablename__ = "missions"
|
||||
|
||||
name: Mapped[str] = mapped_column(String(255), nullable=False)
|
||||
client_target: Mapped[str | None] = mapped_column(String(255), nullable=True)
|
||||
date_start: Mapped[date | None] = mapped_column(Date, nullable=True)
|
||||
date_end: Mapped[date | None] = mapped_column(Date, nullable=True)
|
||||
status: Mapped[str] = mapped_column(String(16), default="draft", nullable=False)
|
||||
description_md: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||||
visibility_mode: Mapped[str] = mapped_column(
|
||||
String(16), default="whitebox", nullable=False
|
||||
)
|
||||
|
||||
members: Mapped[list["MissionMember"]] = relationship(
|
||||
back_populates="mission",
|
||||
cascade="all, delete-orphan",
|
||||
)
|
||||
scenarios: Mapped[list["MissionScenario"]] = relationship(
|
||||
back_populates="mission",
|
||||
cascade="all, delete-orphan",
|
||||
order_by="MissionScenario.position",
|
||||
)
|
||||
categories: Mapped[list["MissionCategory"]] = relationship(
|
||||
back_populates="mission",
|
||||
cascade="all, delete-orphan",
|
||||
order_by="MissionCategory.position",
|
||||
)
|
||||
|
||||
__table_args__ = (
|
||||
CheckConstraint(
|
||||
f"status IN ({', '.join(repr(v) for v in MISSION_STATUSES)})",
|
||||
name="status_valid",
|
||||
),
|
||||
CheckConstraint(
|
||||
f"visibility_mode IN ({', '.join(repr(v) for v in MISSION_VISIBILITY_MODES)})",
|
||||
name="visibility_mode_valid",
|
||||
),
|
||||
Index("ix_missions_active", "deleted_at", postgresql_where="deleted_at IS NULL"),
|
||||
Index("ix_missions_status", "status"),
|
||||
)
|
||||
|
||||
|
||||
class MissionMember(Base, TimestampMixin):
|
||||
"""A user's membership in a mission with a hint about their team side."""
|
||||
|
||||
__tablename__ = "mission_members"
|
||||
|
||||
mission_id: Mapped[uuid.UUID] = mapped_column(
|
||||
Uuid(as_uuid=True),
|
||||
ForeignKey("missions.id", ondelete="CASCADE"),
|
||||
primary_key=True,
|
||||
)
|
||||
user_id: Mapped[uuid.UUID] = mapped_column(
|
||||
Uuid(as_uuid=True),
|
||||
ForeignKey("users.id", ondelete="CASCADE"),
|
||||
primary_key=True,
|
||||
)
|
||||
role_hint: Mapped[str] = mapped_column(String(8), nullable=False)
|
||||
|
||||
mission: Mapped[Mission] = relationship(back_populates="members")
|
||||
|
||||
__table_args__ = (
|
||||
CheckConstraint(
|
||||
f"role_hint IN ({', '.join(repr(v) for v in MISSION_ROLE_HINTS)})",
|
||||
name="role_hint_valid",
|
||||
),
|
||||
Index("ix_mission_members_user", "user_id"),
|
||||
)
|
||||
|
||||
|
||||
class MissionScenario(Base, UuidPkMixin, TimestampMixin, SoftDeleteMixin):
|
||||
"""Snapshot of a `scenario_template` instantiated within a mission."""
|
||||
|
||||
__tablename__ = "mission_scenarios"
|
||||
|
||||
mission_id: Mapped[uuid.UUID] = mapped_column(
|
||||
Uuid(as_uuid=True),
|
||||
ForeignKey("missions.id", ondelete="CASCADE"),
|
||||
nullable=False,
|
||||
)
|
||||
source_scenario_template_id: Mapped[uuid.UUID | None] = mapped_column(
|
||||
Uuid(as_uuid=True),
|
||||
ForeignKey("scenario_templates.id", ondelete="SET NULL"),
|
||||
nullable=True,
|
||||
)
|
||||
snapshot_name: Mapped[str] = mapped_column(String(255), nullable=False)
|
||||
snapshot_description: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||||
position: Mapped[int] = mapped_column(Integer, nullable=False)
|
||||
|
||||
mission: Mapped[Mission] = relationship(back_populates="scenarios")
|
||||
tests: Mapped[list["MissionTest"]] = relationship(
|
||||
back_populates="scenario",
|
||||
cascade="all, delete-orphan",
|
||||
order_by="MissionTest.position",
|
||||
)
|
||||
|
||||
__table_args__ = (
|
||||
UniqueConstraint(
|
||||
"mission_id", "position", name="uq_mission_scenarios_position"
|
||||
),
|
||||
Index("ix_mission_scenarios_mission", "mission_id"),
|
||||
Index(
|
||||
"ix_mission_scenarios_active",
|
||||
"deleted_at",
|
||||
postgresql_where="deleted_at IS NULL",
|
||||
),
|
||||
)
|
||||
|
||||
|
||||
class MissionTest(Base, UuidPkMixin, TimestampMixin, SoftDeleteMixin):
|
||||
"""Snapshot of a `test_template` + execution state + red/blue annotations."""
|
||||
|
||||
__tablename__ = "mission_tests"
|
||||
|
||||
scenario_id: Mapped[uuid.UUID] = mapped_column(
|
||||
Uuid(as_uuid=True),
|
||||
ForeignKey("mission_scenarios.id", ondelete="CASCADE"),
|
||||
nullable=False,
|
||||
)
|
||||
source_test_template_id: Mapped[uuid.UUID | None] = mapped_column(
|
||||
Uuid(as_uuid=True),
|
||||
ForeignKey("test_templates.id", ondelete="SET NULL"),
|
||||
nullable=True,
|
||||
)
|
||||
position: Mapped[int] = mapped_column(Integer, nullable=False)
|
||||
|
||||
# --- Snapshot of the template (immutable after creation) ---
|
||||
snapshot_name: Mapped[str] = mapped_column(String(255), nullable=False)
|
||||
snapshot_description: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||||
snapshot_objective: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||||
snapshot_procedure_md: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||||
snapshot_prerequisites_md: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||||
snapshot_expected_red_md: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||||
snapshot_expected_blue_md: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||||
snapshot_opsec_level: Mapped[str] = mapped_column(
|
||||
String(8), default="medium", nullable=False
|
||||
)
|
||||
snapshot_tags: Mapped[list[str]] = mapped_column(
|
||||
ARRAY(String(64)), nullable=False, server_default="{}"
|
||||
)
|
||||
snapshot_expected_iocs: Mapped[list[str]] = mapped_column(
|
||||
ARRAY(String(255)), nullable=False, server_default="{}"
|
||||
)
|
||||
|
||||
# --- Execution state ---
|
||||
state: Mapped[str] = mapped_column(String(24), default="pending", nullable=False)
|
||||
executed_at: Mapped[datetime | None] = mapped_column(
|
||||
DateTime(timezone=True), nullable=True
|
||||
)
|
||||
executed_at_overridden: Mapped[bool] = mapped_column(default=False, nullable=False)
|
||||
|
||||
# --- Red side (text-only per spec §4) ---
|
||||
red_command: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||||
red_output: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||||
red_comment_md: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||||
|
||||
# --- Blue side ---
|
||||
blue_comment_md: Mapped[str | None] = mapped_column(Text, nullable=True)
|
||||
detection_level_id: Mapped[uuid.UUID | None] = mapped_column(
|
||||
Uuid(as_uuid=True),
|
||||
ForeignKey("detection_levels.id", ondelete="SET NULL"),
|
||||
nullable=True,
|
||||
)
|
||||
category_id: Mapped[uuid.UUID | None] = mapped_column(
|
||||
Uuid(as_uuid=True),
|
||||
ForeignKey("mission_categories.id", ondelete="SET NULL"),
|
||||
nullable=True,
|
||||
)
|
||||
|
||||
scenario: Mapped[MissionScenario] = relationship(back_populates="tests")
|
||||
mitre_tags: Mapped[list["MissionTestMitreTag"]] = relationship(
|
||||
back_populates="mission_test",
|
||||
cascade="all, delete-orphan",
|
||||
lazy="selectin",
|
||||
)
|
||||
|
||||
__table_args__ = (
|
||||
CheckConstraint(
|
||||
f"snapshot_opsec_level IN ({', '.join(repr(v) for v in OPSEC_LEVELS)})",
|
||||
name="snapshot_opsec_level_valid",
|
||||
),
|
||||
CheckConstraint(
|
||||
f"state IN ({', '.join(repr(v) for v in MISSION_TEST_STATES)})",
|
||||
name="state_valid",
|
||||
),
|
||||
UniqueConstraint("scenario_id", "position", name="uq_mission_tests_position"),
|
||||
Index("ix_mission_tests_state", "state"),
|
||||
Index(
|
||||
"ix_mission_tests_active",
|
||||
"deleted_at",
|
||||
postgresql_where="deleted_at IS NULL",
|
||||
),
|
||||
)
|
||||
|
||||
|
||||
class MissionCategory(Base, UuidPkMixin, TimestampMixin, SoftDeleteMixin):
|
||||
"""Optional custom grouping override for the slide synthesis."""
|
||||
|
||||
__tablename__ = "mission_categories"
|
||||
|
||||
mission_id: Mapped[uuid.UUID] = mapped_column(
|
||||
Uuid(as_uuid=True),
|
||||
ForeignKey("missions.id", ondelete="CASCADE"),
|
||||
nullable=False,
|
||||
)
|
||||
name: Mapped[str] = mapped_column(String(120), nullable=False)
|
||||
color_token: Mapped[str | None] = mapped_column(String(16), nullable=True)
|
||||
position: Mapped[int] = mapped_column(Integer, nullable=False)
|
||||
|
||||
mission: Mapped[Mission] = relationship(back_populates="categories")
|
||||
|
||||
__table_args__ = (
|
||||
UniqueConstraint(
|
||||
"mission_id", "position", name="uq_mission_categories_position"
|
||||
),
|
||||
UniqueConstraint("mission_id", "name", name="uq_mission_categories_name"),
|
||||
Index(
|
||||
"ix_mission_categories_active",
|
||||
"deleted_at",
|
||||
postgresql_where="deleted_at IS NULL",
|
||||
),
|
||||
)
|
||||
|
||||
|
||||
class MissionTestMitreTag(Base):
|
||||
"""Frozen MITRE tag attached to a mission test.
|
||||
|
||||
DELIBERATELY DENORMALISED — no FK to mitre_* tables. The MITRE
|
||||
`external_id` and human label are copied at tag-creation time so that a
|
||||
later MITRE re-sync that drops the original entry cannot purge or alter
|
||||
a mission's tags. See spec §11 (snapshot vs reference).
|
||||
|
||||
The companion `test_template_mitre_tags` table keeps the FK relationship
|
||||
because templates are editable and admins can re-tag them after a sync.
|
||||
"""
|
||||
|
||||
__tablename__ = "mission_test_mitre_tags"
|
||||
|
||||
id: Mapped[uuid.UUID] = mapped_column(
|
||||
Uuid(as_uuid=True), primary_key=True, default=uuid.uuid4, nullable=False
|
||||
)
|
||||
mission_test_id: Mapped[uuid.UUID] = mapped_column(
|
||||
Uuid(as_uuid=True),
|
||||
ForeignKey("mission_tests.id", ondelete="CASCADE"),
|
||||
nullable=False,
|
||||
)
|
||||
mitre_kind: Mapped[str] = mapped_column(String(16), nullable=False)
|
||||
mitre_external_id: Mapped[str] = mapped_column(String(16), nullable=False)
|
||||
mitre_name: Mapped[str] = mapped_column(String(255), nullable=False)
|
||||
mitre_url: Mapped[str | None] = mapped_column(String(512), nullable=True)
|
||||
|
||||
mission_test: Mapped[MissionTest] = relationship(back_populates="mitre_tags")
|
||||
|
||||
__table_args__: Any = (
|
||||
CheckConstraint(
|
||||
f"mitre_kind IN ({', '.join(repr(v) for v in MITRE_KINDS)})",
|
||||
name="mitre_kind_valid",
|
||||
),
|
||||
UniqueConstraint(
|
||||
"mission_test_id",
|
||||
"mitre_external_id",
|
||||
name="uq_mission_test_mitre_tag",
|
||||
),
|
||||
Index("ix_mission_test_mitre_tags_test", "mission_test_id"),
|
||||
)
|
||||
Reference in New Issue
Block a user