Skip to content

feat(validation): add CRUD endpoints for validation bypass rules#481

Open
seansica wants to merge 3 commits into
nextfrom
feature/add-crud-endpoints-for-managing-validation-bypass-rules
Open

feat(validation): add CRUD endpoints for validation bypass rules#481
seansica wants to merge 3 commits into
nextfrom
feature/add-crud-endpoints-for-managing-validation-bypass-rules

Conversation

@seansica

@seansica seansica commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

This PR includes two changes, both of which are complementary to mitre-attack/attack-workbench-frontend#876

(1) Adds CRUD endpoints for validation bypass rules

  • added PUT endpoint and completed controller/service/repo implementations
  • wired up the routes in validation-bypasses-routes.js
  • added OpenAPI tag/path/schema coverage
  • added regression tests

These make it possible to manage the ADM validation bypass rules. Currently they get loaded at runtime via a server-side JSON-based config file. Now, they can be dynamically managed by clients w/o having to restart the server.

Closes #480


(2) Overhaul the identity service

  • The backend now tracks a new key, mitre_identity_writes_enabled: bool, in the systemconfigurations collection entities.
  • New GET and POST requests are added to toggle the value of the new mitre_identity_writes_enabled key: {GET,POST} /api/config/mitre-identity-writes
  • The mitre_identity_writes_enabled key acts as a guard for the MITRE identity object. The REST API will block POST, UPDATE, and DELETE requests for the MITRE identity object when writes are disabled (set to false). The server will return 400 Bad Request with message Cannot create, update, or delete protected MITRE identity identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5. Enable MITRE identity writes to modify this identity.
  • New values have been added to allowed-values.json to support new form fields for identity objects. These correspond to supported values in the official identitySchema

- added put endpoint and completed controller/service/repo implementations
- wired up the routes in validation-bypasses-routes
- added openapi tag/path/schema coverage
- added regression tests
- verified regression tests passing and linting successful
@seansica seansica self-assigned this Jun 23, 2026
@codecov

codecov Bot commented Jun 23, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 88.30409% with 40 lines in your changes missing coverage. Please review.
✅ Project coverage is 69.66%. Comparing base (f3fd8f1) to head (ffe610e).

Files with missing lines Patch % Lines
app/repository/validation-bypasses-repository.js 66.66% 12 Missing ⚠️
app/controllers/system-configuration-controller.js 62.96% 10 Missing ⚠️
...pp/services/system/system-configuration-service.js 78.37% 8 Missing ⚠️
app/controllers/validation-bypasses-controller.js 84.21% 6 Missing ⚠️
app/repository/attack-objects-repository.js 90.00% 3 Missing ⚠️
app/services/stix/identities-service.js 98.36% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             next     #481      +/-   ##
==========================================
+ Coverage   69.15%   69.66%   +0.51%     
==========================================
  Files         220      220              
  Lines       30832    31102     +270     
  Branches     2676     2765      +89     
==========================================
+ Hits        21321    21667     +346     
+ Misses       9474     9395      -79     
- Partials       37       40       +3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

seansica added 2 commits June 24, 2026 09:29
Add dynamic MITRE identity write configuration and protected identity safeguards.

Expose identity allowed values and cover the new behavior in API tests.
Refactor identity create, update, and delete behavior into lifecycle hooks.

Wire delete lifecycle hooks through BaseService so protected MITRE identity checks apply to DELETE requests.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant