BCH-1346: Expose id/status/driftRiskId on the leveraged-controls projection

[saltpy-cs]

Summary

• Adds id, status, and driftRiskId to leveragedControlResponse (GET /oscal/system-security-plans/:id/leveraged-controls, BCH-1338/1339/1341).
• Small, additive, backward-compatible: existing consumers unaffected.
• Motivation: the downstream UI's Inherited Capability panel (BCH-1346, compliance-framework/ui) needs the link's own id to call POST .../leveraged-controls/:linkId/attest, and status to know a link is drifted at all — neither existed on this response before. driftRiskId is resolved via a batched query using the same dedupe-key = "leverage-drift:<linkId>" convention ReAttest already uses, so a drifted link's UI warning can link directly to the risk record, not just show a status label.

Test plan

• go build ./..., go vet ./... clean
• golangci-lint run ./internal/api/handler/oscal/... — 0 issues
• New tests: active link (no driftRiskId), drifted link with an open drift risk (driftRiskId populated, verified against the actual risk id), revoked link (no driftRiskId)
• Full go test ./... green
• make reviewable (swag + lint + integration tests against real Postgres) passes
• Manually verified in a local demo environment: triggered real drift on an existing subscription and confirmed the projection response carries the correct status: "drifted" and a resolvable driftRiskId

Summary by CodeRabbit

• New Features

  • Leveraged control responses now include each link’s ID and status.
  • Drifted links include the associated open drift risk ID when applicable.
  • Updated API documentation describes the new response fields and status values.

• Bug Fixes

  • Drift risk IDs are omitted for active and revoked links, and when no matching open risk exists.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ef44f3bd-b636-450a-a3b4-7c5b01ad464e

📥 Commits

Reviewing files that changed from the base of the PR and between 0d920c2 and d73c875.

📒 Files selected for processing (5)

• docs/docs.go
• docs/swagger.json
• docs/swagger.yaml
• internal/api/handler/oscal/ssp_leverage.go
• internal/api/handler/oscal/ssp_leverage_reattest_test.go

---

📝 Walkthrough

Walkthrough

LeveragedControls now returns each leverage link’s ID and status, plus driftRiskId only when a matching open drift risk exists. Swagger schemas and tests document and verify the new projection behavior.

Changes

LeveragedControls projection

Layer / File(s)	Summary
Response fields and schema internal/api/handler/oscal/ssp_leverage.go, docs/docs.go, docs/swagger.json, docs/swagger.yaml	The response and Swagger schemas define link ID, status, and optional driftRiskId fields.
Drift risk resolution and validation internal/api/handler/oscal/ssp_leverage.go, internal/api/handler/oscal/ssp_leverage_reattest_test.go	The handler batch-resolves open risks for drifted links, and tests verify drifted, active, and revoked response behavior.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• compliance-framework/api#447: Introduces the SSP leverage projection extended by this change.
• compliance-framework/api#451: Adds the drift-risk creation and dedupe-key behavior used by this projection.

Suggested reviewers: gusfcarvalho, ccf-lisa[bot], reecebedding, akabdulhanif, onselakin

Poem

I’m a rabbit with links in my queue,
Now IDs and statuses hop through.
Drift risks appear when the drift paths align,
But revoked and active stay nil by design.
Swagger sprouts fields, tests thump with delight!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: exposing id, status, and driftRiskId in the leveraged-controls projection.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[saltpy-cs]

@CodeRabbit review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.