Repository navigation
feat: show closed findings and the reasons given for them - #108
Merged
Merged
Conversation
Acknowledging a finding requires a reason, and the reason was displayed only while the finding stayed open. Once it resolved, the card went with it, and the audit log printed finding.acknowledged with nothing to say which finding or why. The audit-action row, shared by the site Audit tab and the fleet Activity log, now names the finding under its acknowledged, reopened and resolved events and shows the reason on an acknowledgement. The title is added to those three events' recorded detail, so entries written before this fall back to the rule key; nothing already written is touched and the chain still verifies. On a site's Security tab, "Recently resolved" now shows severity and who acknowledged the finding, when, and why, and ?history=all pages through every resolved finding. The acknowledgement columns already survive resolution, so there is no migration. Version 1.9.0 in the changelog and the documented examples.
# Conflicts: # CHANGELOG.md # docs/getting-started.md # docs/upgrade.md # public/build/manifest.json # resources/views/sites/security.blade.php
Rebuilt from a clean clone after composer install and npm ci, repeated until the stylesheet rebuilt to itself, which is what the Compiled assets check compares against.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Acknowledging a finding requires a reason, and that reason was only visible while the finding stayed open. After it resolved the card went away, and the audit log showed
finding.acknowledgedwith no hint of which finding or why.Audit log. The row component shared by a site's Audit tab and the fleet Activity log now names the finding under its acknowledged, reopened and resolved events, and shows the reason on an acknowledgement. Output is escaped. The title is now stored in those three events' detail, so entries written earlier fall back to the rule key. Nothing already written changes, and the hash chain still verifies (there is a test for it).
Security tab. "Recently resolved" now shows severity, plus who acknowledged the finding, when, and why. When there are more than five, "Show all" links to
?history=allon the same page: every resolved finding, newest first, 25 to a page. The acknowledgement columns already survive resolution, so there is no migration.A finding is one row per rule, so the tab's history is the latest closure of each rule; an earlier closure of a rule that has since reopened is in the audit log only. The changelog says so.
Version 1.9.0, with the worked examples in
docs/getting-started.md,docs/upgrade.mdanddocs/rollback.mdmoved to match. The stylesheet is rebuilt.Verified: full suite (1484 passed, including the Invariants suite and
TenantIsolationTest), pint, phpstan. New tests intests/Feature/FindingHistoryTest.phpcover the reason on the Security tab, the five-row tail and "Show all", pagination across pages, escaping on both screens, the Activity log, the pre-title fallback, chain verification, and that another organisation's or sibling site's findings and events never appear.