Web Scaffolding for the Companion Edition on OWASP Cornucopia website

[ayman-art]

Description

Implements web pages for the Companion Edition on the OWASP Cornucopia website, closing #2393.

• Closes Create the web scaffolding for the Companion Edition #2393

Changes

Data scaffolding — cornucopia.owasp.org/data/cards/companion-cards-1.0-en/

• Created companion edition data folder with 91 cards across 7 suits: llm, agentic-ai, cloud, frontend, devops, social-engineering, automated-threats
• Each card folder (e.g. LLM2, AAI3) contains two files:
  • explanation.md — pre-filled with a Scenario/Threat Modeling template
  • technical-note.md — intentionally empty, to be filled later
• Renamed companion-cards-1.0.yaml → companion-cards-1.0-en.yaml to match the expected naming convention used by the deck loader

cornucopia.owasp.org/src/domain/card/cardColor.ts

• Added color mappings for all 7 companion suits using grey (#dbdbdb) for standard cards and a lighter grey (#e8e8e8) for royal cards for now.

cornucopia.owasp.org/src/domain/card/order.ts

• Added card ordering for all companion edition cards across all 7 suits (91 new entries)

cornucopia.owasp.org/src/domain/suit/order.ts

• Added suit ordering for companion suits

cornucopia.owasp.org/src/domain/suit/suitController.ts

• Registered companion edition with version 1.0 and language en

cornucopia.owasp.org/src/lib/services/deckService.ts

• Added companion edition (companion, 1.0, ['en']) to both latests and decks arrays

cornucopia.owasp.org/src/lib/components/companionCardMapping.svelte (new)

• New component to render mapping rows for companion cards in a dynamic way
• Filters out display-irrelevant keys (id, value, url, *_print), as in other editions, keys with _print is not displayed. this is handled dynamically
• Handles missing/null mapping values gracefully with a fallback '-'
• Formats the capec key with proper CAPEC™ label

cornucopia.owasp.org/src/lib/components/companionCardTaxonomy.svelte (new)

• New taxonomy component for companion cards, modeled after mobileAppCardTaxonomy.svelte
• Displays Mappings section and Attacks section using MappingsList and Attacks components
• Pulls translation strings from cards.companionCardTaxonomy.h1.1 and .h1.2

cornucopia.owasp.org/src/lib/components/cardFound.svelte

• Added conditional rendering for companion edition using CompanionCardTaxonomy

cornucopia.owasp.org/src/lib/components/cardPreview.svelte

• Added CSS classes for all 7 companion suits (normal + text + royal variants)
• Plugged in CompanionCardMapping for companion edition card previews

cornucopia.owasp.org/data/website/pages/cards/en.json

• Added button.3 and h2.3 entries for the Companion version selector button and section heading
• Added p4 paragraph describing the Companion Edition
• Added companionCardTaxonomy.h1 translation keys for Mappings and Attacks headings

cornucopia.owasp.org/src/routes/cards/+page.server.ts

• Loads companion cards alongside webapp and mobileapp cards and merges them into the deck map

cornucopia.owasp.org/src/routes/cards/+page.svelte

• Added VERSION_COMPANION constant and companionSuits derived store
• Added third version selector button for Companion Edition
• On version switch to companion, defaults preview to card AAI2

cornucopia.owasp.org/src/routes/cards/[card]/+page.server.ts

• Loads companion cards so individual card routes resolve correctly for companion card codes

cornucopia.owasp.org/src/routes/cards/[card]/+page.svelte

• Added all 91 companion card IDs to cards_options
• Added "companion" → "Companion Edition" mapping in getEdition()

cornucopia.owasp.org/src/routes/edition/[edition]/+page.svelte

• Registered VERSION_COMPANION constant
• Added Companion Edition heading and description block
• Companion version switch defaults to AAI2
• Companion suits rendered in both JS tree view and no-JS checkbox view

cornucopia.owasp.org/src/routes/edition/[edition]/[card]/+page.server.ts

• Updated version resolution: companion edition now correctly maps to version 1.0

cornucopia.owasp.org/src/routes/edition/[edition]/[card]/ :

(+page.svelte, [version]/+page.svelte, [version]/[lang]/+page.svelte)

• Added all companion card IDs to cards_options in each route
• Added "companion" → "Companion Edition" to getEdition() in each route

cornucopia.owasp.org/src/lib/services/deckService.test.ts

• Added tests for companion edition: hasEdition, hasVersion, hasLanguage, getDecks, getLatestVersion, getLatestEditions, getLanguages, getLanguagesForEditionVersion, getVersions
• Updated getDecks expected length from 3 → 4, getLatestEditions from 2 → 3

cornucopia.owasp.org/src/lib/services/decService.integration.test.ts

• Added assertion that companion edition 1.0 / en data loads without error
• Updated card count assertion from 160 → 251

Routes implemented

The following routes now work for the Companion Edition:

• https://cornucopia.owasp.org/cards/{card code}
• https://cornucopia.owasp.org/edition/companion/{card code}/1.0/en
• https://cornucopia.owasp.org/edition/companion/{card code}/1.0
• https://cornucopia.owasp.org/edition/companion/{card code}
• https://cornucopia.owasp.org/edition/companion

Cards are also browsable from https://cornucopia.owasp.org/cards via the new "Companion version" tab.

Screenshots

browsing from cards/:

browsing from edition/companion:

route edition/companion/[card]/[version]/[lang] and similarly edition/companion/[card]/[version] and edition/companion/[card]:


route card/[card]:

Notes

• All companion suit colors are grey (#dbdbdb) for now, as specified.
• As mapping values vary per suit, the taxonomy component handles missing/optional fields gracefully. This is done by displaying all mappings. (no static map used)
• Mapping are now text not linked to anywhere, as specified.
• technical-note.md files are intentionally empty; explanation.md files carry the agreed Scenario/Threat Modeling template as specified.
• The companion-cards-1.0-en.yaml rename was required to match the deck loader's existing logic.