Repository navigation
feat(action-center): action center from the October 2026 redesign (#902) - #927
Merged
Merged
Conversation
The redesigned queue and the action center show how long is left to fix each finding, and nothing held that date. sla_due_at is the first-seen date plus the owner's default window for the severity (critical 7 days, high 14, medium 30, low 60), capped at 14 days for a KEV-listed flaw as in CISA BOD 22-01. A save hook recomputes it, so a severity change moves it; migration 0070 adds the column and backfills existing rows. Informational findings get no deadline unless they are on the KEV list. Signed-off-by: alex-dembele <alexandredembele16@gmail.com>
…eviews (#902) The redesigned action center lists the work an RSSI actually chases, and three kinds of it had no source here: - vulnerability_sla: open findings whose remediation deadline has passed or falls within the week, earliest first, KEV first at equal deadline; - vendor_followup: questionnaires sent and unanswered past or near their due date, titled with the vendor's name (the vendor is matched on the tenant too); - mitigation_review: plans waiting for someone to validate them. Organisation admins and owners now see every category of the tenant (owner decision); before, an admin with no business role saw only their own approvals, an empty list. Security analysts and the DSI get the vulnerability deadlines, risk managers and compliance officers the vendor follow-ups. The ratchet that no role is shown a category it cannot open covers the three new ones. Each item now carries a meta map of facts (status, severity, CVE, asset, KEV) so the row can word them, and the status is what lets the client complete and undo. Open incidents now include the in_progress status the incident API writes; only 'investigating', which nothing writes, was read before. Signed-off-by: alex-dembele <alexandredembele16@gmail.com>
…design (#902) One column at 1000 px: how much is waiting and how much is late, kind chips with their counts (approvals, vulnerabilities, risks and plans, compliance, third parties, and incidents when there are some), then the work grouped by deadline: overdue, this week, later, no date. Within a group the server's order stands. Each row has the type's tile, the record's title, a line of facts worded from the server's meta (KEV, SLA breached, CVE, asset, days without a vendor answer), the due pill, one verb that opens the record and, when the work can be finished from the list, a tick. The tick does the real work after a 5 s undo window, through the record's own endpoint (mitigation to Done, finding to Remediated, incident to Resolved, remediation plan to Completed); approvals, critical risks, evidence and vendors have none (owner decision). The page reads the API's full 100-item page so the chips and groups count everything; the pager takes over past that. The deep-link guard and its tests are unchanged, and the dashboard's priority list shares the icons, wording and due pill. useSoftDelete takes a failure message, so a failed completion no longer says the delete failed. The generated API types are regenerated from docs/openapi.yaml, which also brings in schema changes already on master. Signed-off-by: alex-dembele <alexandredembele16@gmail.com>
This was referenced Oct 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Third screen of the redesign epic (#899). Stacked on #926 (dashboard), itself on #925 (shell): the base is
feat/901-dashboard, so the diff shows only this issue.What changes for the user
The Action Center now looks and reads like the mockup: a sentence with how much is waiting and how much is late, kind chips with counts, the work grouped by deadline (overdue, this week, later, no date), and on each row the type's tile, the title, a facts line ("Vulnérabilité · KEV · SLA dépassé · CVE-2025-55241 · Contrôleur de domaine AD"), the due pill, one verb (Ouvrir, Examiner, Valider, Revoir, Renouveler, Relancer) and a tick where the work can be finished from the list.
Owner decisions (2026-10-08) built in
sla_due_atand backfills it; a save hook keeps it in step with severity.Backend
vulnerability_sla(deadline passed or within 7 days),vendor_followup(questionnaire unanswered past or near its due date, titled with the vendor name, vendor matched on the tenant),mitigation_review(plans in REVIEW).metaon each item: facts only (status, severity, CVE, asset, KEV, sent date), never a sentence. OpenAPI contract updated, TS types regenerated. The regeneration also picks up schema changes that were already on master but not in the generated file.openorin_progress. The query looked forinvestigating, which the incident API never writes, so incidents under way were missing.Verified
go test ./...: all packages pass, including new use-case tests (admin sees all, meta and links, role perimeters) and repository tests for the three new queries with a second tenant seeded.npx tsc -b --noEmitclean,npx vitest run111 files / 1008 tests, lint at its ceiling (96).remediated. 414 px without overflow, axe onmain0 serious/critical in both themes.Not done here
POST /risks/:id/mitigationssilently drops a date-onlydue_date("2026-11-15") because it only parses RFC 3339. Noted for feat(frontend): mitigations board on the redesign layout, with Gantt and table kept #914.Closes #902