From 358b3c62e411191fc964500a01efb84b37df398c Mon Sep 17 00:00:00 2001 From: Tamar Weisskopf Date: Wed, 24 Jun 2026 02:15:43 +0300 Subject: [PATCH 01/46] Rename ExploitIQ/Agent morpheus to Exploit Intelligence --- .tekton/on-pull-request.yaml | 2 +- .tekton/on-push.yaml | 2 +- .tekton/on-tag.yaml | 2 +- README.md | 10 ++--- deploy/agent_morpheus_client.yaml | 2 +- docs/authentication.md | 38 +++++++++--------- openspec/project.md | 11 ++--- openspec/specs/feedback-report/spec.md | 3 +- openspec/specs/new-rpm-report-api/spec.md | 8 ++-- openspec/specs/reports-table/spec.md | 2 +- .../specs/repository-reports-table/spec.md | 8 ++-- openspec/specs/ui-layout/spec.md | 2 +- pom.xml | 4 +- .../META-INF/resources/error/403.html | 4 +- src/main/resources/application.properties | 40 +++++++++---------- src/main/resources/preProcessingTemplate.json | 2 +- src/main/webui/package.json | 2 +- .../src/components/FeedbackReportCard.tsx | 2 +- .../webui/src/components/GetStartedCard.tsx | 4 +- src/main/webui/src/components/PageHeader.tsx | 2 +- src/test/README.md | 10 ++--- src/test/resources/application.properties | 12 +++--- .../reports/test-sbom-report-6-report-1.json | 6 +-- .../reports/test-sbom-report-8-report-1.json | 6 +-- 24 files changed, 92 insertions(+), 92 deletions(-) diff --git a/.tekton/on-pull-request.yaml b/.tekton/on-pull-request.yaml index e2b987d2..36afe756 100644 --- a/.tekton/on-pull-request.yaml +++ b/.tekton/on-pull-request.yaml @@ -28,7 +28,7 @@ spec: - name: image-expires-after value: 5d - name: output-image - value: quay.io/ecosystem-appeng/agent-morpheus-client:on-pr-{{revision}} + value: quay.io/ecosystem-appeng/rhtpa-exploit-intelligence-client:on-pr-{{revision}} - name: path-context value: . - name: dockerfile diff --git a/.tekton/on-push.yaml b/.tekton/on-push.yaml index 0b18182c..812d4513 100644 --- a/.tekton/on-push.yaml +++ b/.tekton/on-push.yaml @@ -26,7 +26,7 @@ spec: - name: revision value: "{{ revision }}" - name: output-image - value: quay.io/ecosystem-appeng/agent-morpheus-client:latest + value: quay.io/ecosystem-appeng/rhtpa-exploit-intelligence-client:latest - name: path-context value: . - name: dockerfile diff --git a/.tekton/on-tag.yaml b/.tekton/on-tag.yaml index c3322cb8..6e13f4a6 100644 --- a/.tekton/on-tag.yaml +++ b/.tekton/on-tag.yaml @@ -26,7 +26,7 @@ spec: - name: revision value: "{{ revision }}" - name: output-image - value: quay.io/ecosystem-appeng/agent-morpheus-client + value: quay.io/ecosystem-appeng/rhtpa-exploit-intelligence-client - name: tag-name value: "{{git_tag}}" - name: path-context diff --git a/README.md b/README.md index baa7f379..4806764a 100644 --- a/README.md +++ b/README.md @@ -12,9 +12,9 @@ See the License for the specific language governing permissions and limitations under the License. --> -# Red Hat Exploit Intelligence- client +# Red Hat Trusted Profile Analyzer exploit intelligence - client -This project is a Quarkus + React web application implemented to interact with ExploitIQ service +This project is a Quarkus + React web application implemented to interact with Exploit Intelligence service for sending requests to evaluate vulnerabilities on specific SBOMs. For product documentation and deeper context, see the [Exploit Intelligence documentation](https://github.com/RHEcosystemAppEng/exploitiq-docs). @@ -38,7 +38,7 @@ Open http://localhost:8080/ On the Home page, you will find a central dashboard designed to manage your exploitability analysis workflow and monitor recent system performance. -**Get Started with ExploitIQ** +**Get Started with Exploit Intelligence** In this section, you will find quick-access links to the core functions of the application: Request Analysis, View Reports, and Learn More. @@ -167,7 +167,7 @@ flowchart TB SYFT_FAIL[[Syft failed
submission failure / excluded]] CYCLONE_VAL["Parse & validate CycloneDX
from Syft output"] CYCLONE_FAIL[[CycloneDX parse / validation failed
submission failure / excluded]] - TO_AGENT["Save report & submit for analysis
Morpheus queue"] + TO_AGENT["Save report & submit for analysis
Exploit Intelligence queue"] PER_CAPTION --> SYFT end @@ -188,7 +188,7 @@ flowchart TB SC_CYCLONE_ERR[[CycloneDX parse failed
immediate error to client]] end - subgraph AGENT["Shared — Submit & agent pipeline
(RequestQueueService → Morpheus)"] + subgraph AGENT["Shared — Submit & agent pipeline
(RequestQueueService → Exploit Intelligence)"] direction TB QUEUE_GATE["Is queue full?
active reports >= max active"] PEND_CAP[Pending queue
below max size?] diff --git a/deploy/agent_morpheus_client.yaml b/deploy/agent_morpheus_client.yaml index 5d6266b4..60c6ae14 100644 --- a/deploy/agent_morpheus_client.yaml +++ b/deploy/agent_morpheus_client.yaml @@ -68,7 +68,7 @@ spec: spec: containers: - name: agent-morpheus-client - image: quay.io/ecosystem-appeng/agent-morpheus-client:latest + image: quay.io/ecosystem-appeng/rhtpa-exploit-intelligence-client:latest imagePullPolicy: Always ports: - name: http diff --git a/docs/authentication.md b/docs/authentication.md index b810fcfc..f2bed946 100644 --- a/docs/authentication.md +++ b/docs/authentication.md @@ -14,11 +14,11 @@ limitations under the License. # Authentication -This guide covers authentication configuration for ExploitIQ Client, including OpenShift OAuth, external identity providers, and development setups. +This guide covers authentication configuration for exploit intelligence, including OpenShift OAuth, external identity providers, and development setups. ## Overview -ExploitIQ supports multiple authentication modes via Quarkus profiles: +Exploit intelligence supports multiple authentication modes via Quarkus profiles: | Profile | Use Case | Identity Provider | |---------|----------|-------------------| @@ -53,11 +53,11 @@ Create an `OAuthClient` resource in your OpenShift cluster: apiVersion: oauth.openshift.io/v1 kind: OAuthClient metadata: - name: exploit-iq-client + name: exploit-intelligence-client grantMethod: prompt secret: redirectURIs: - - "https://exploit-iq-client." + - "https://exploit-intelligence-client." ``` ### Environment Variables @@ -72,7 +72,7 @@ redirectURIs: ```yaml spec: containers: - - name: exploit-iq-client + - name: exploit-intelligence-client env: - name: OPENSHIFT_DOMAIN valueFrom: @@ -93,7 +93,7 @@ For API access in OpenShift, use your user token: ```bash # After oc login TOKEN=$(oc whoami -t) -curl -H "Authorization: Bearer $TOKEN" https://exploit-iq-client.apps.example.com/api/v1/reports +curl -H "Authorization: Bearer $TOKEN" https://exploit-intelligence-client.apps.example.com/api/v1/reports ``` ## External Identity Providers @@ -120,7 +120,7 @@ Create an OIDC client in Keycloak with the following settings: ```json { - "clientId": "exploit-iq-client", + "clientId": "exploit-intelligence-client", "enabled": true, "clientAuthenticatorType": "client-secret", "secret": "", @@ -204,7 +204,7 @@ Use the password grant to obtain a token for a specific user: # Configuration (match your Keycloak setup) KC_URL="http://localhost:8190" # Keycloak URL KC_REALM="quarkus" # Realm name -CLIENT_ID="exploit-iq-client" # Client ID +CLIENT_ID="exploit-intelligence-client" # Client ID CLIENT_SECRET="example-credentials" # Client secret USERNAME="bruce" # User PASSWORD="wayne" # Password @@ -358,7 +358,7 @@ After running a scenario with Keycloak, test API authentication: # 1. Get user token (uses bruce/wayne created by the script) USER_TOKEN=$(curl -s -X POST \ "http://localhost:8190/realms/quarkus/protocol/openid-connect/token" \ - -d "client_id=exploit-iq-client" \ + -d "client_id=exploit-intelligence-client" \ -d "client_secret=example-credentials" \ -d "username=bruce" \ -d "password=wayne" \ @@ -388,21 +388,21 @@ Ensure your identity provider or Keycloak is configured to include the `email` c The application implements a **Unified Role Mapping** strategy, allowing you to manage permissions using either OpenShift Groups or OIDC Roles (Keycloak), depending on your environment. -The application looks for specific **Target Roles** (configurable via `exploit-iq.security.target-roles`): -- `exploit-iq-admin`: Admin access -- `exploit-iq-view`: Read-only access -- `exploit-iq-prodsec`: Product Security access +The application looks for specific **Target Roles** (configurable via `exploit-intelligence.security.target-roles`): +- `exploit-intelligence-admin`: Admin access +- `exploit-intelligence-view`: Read-only access +- `exploit-intelligence-prodsec`: Product Security access ### OpenShift Groups (Production) In the `prod` profile, OpenShift Groups are automatically mapped to these roles. -- Group `exploit-iq-admin` -> Mapped to `exploit-iq-admin` -- Group `exploit-iq-view` -> Mapped to `exploit-iq-view` -- Group `exploit-iq-prodsec` -> Mapped to `exploit-iq-prodsec` +- Group `exploit-intelligence-admin` -> Mapped to `exploit-intelligence-admin` +- Group `exploit-intelligence-view` -> Mapped to `exploit-intelligence-view` +- Group `exploit-intelligence-prodsec` -> Mapped to `exploit-intelligence-prodsec` ### OIDC Roles (Keycloak / External) In `external-idp` or `dev` profiles, roles are extracted from the OIDC token: -- **Realm Roles:** `exploit-iq-admin`, `exploit-iq-view` -- **Resource Access (Client Roles):** Roles defined specifically for the `exploit-iq-client` client. +- **Realm Roles:** `exploit-intelligence-admin`, `exploit-intelligence-view` +- **Resource Access (Client Roles):** Roles defined specifically for the `exploit-intelligence-client` client. This flexibility allows you to choose the management style that fits your platform: - **OpenShift Native:** Access is controlled by OpenShift Groups. @@ -471,4 +471,4 @@ Or run the testing script with debug flag: - [Quarkus Configuring Well-Known OpenID Connect Providers](https://quarkus.io/guides/security-openid-connect-providers) - [Keycloak Documentation](https://www.keycloak.org/documentation) - [GitHub OAuth Apps](https://docs.github.com/en/developers/apps/building-oauth-apps) -- [Google OAuth 2.0](https://developers.google.com/identity/protocols/oauth2) +- [Google OAuth 2.0](https://developers.google.com/identity/protocols/oauth2) \ No newline at end of file diff --git a/openspec/project.md b/openspec/project.md index c0736fba..87d335f1 100644 --- a/openspec/project.md +++ b/openspec/project.md @@ -1,12 +1,13 @@ # Project Context ## Purpose -ExploitIQ Client is a Quarkus + React web application that interacts with the ExploitIQ (Agent Morpheus) service to evaluate vulnerabilities on Software Bill of Materials (SBOMs). The application allows users to: +Exploit Intelligence Client is a Quarkus + React web application that interacts with the Exploit Intelligence +service to evaluate vulnerabilities on Software Bill of Materials (SBOMs). The application allows users to: - Submit CycloneDX SBOMs and CVE for vulnerability analysis - Manage and view vulnerability analysis reports - Track products and components across multiple reports -The application serves as a client interface for the Agent Morpheus vulnerability analysis service, providing request queuing, report management, and a web-based UI for interacting with analysis results. +The application serves as a client interface for the Exploit Intelligence vulnerability analysis service, providing request queuing, report management, and a web-based UI for interacting with analysis results. ## Tech Stack @@ -179,11 +180,11 @@ Standard labels used to categorize vulnerability analysis results: #### Vulnerabilities - Additional vulnerability intelligence data -- Can be used as an Intel Source for Morpheus +- Can be used as an Intel Source for Exploit Intelligence - Include free-text descriptions and metadata ### Key Workflows -1. **Request Submission**: User submits SBOM + CVEs → Request queued → Sent to Morpheus → Callback received → Report completed +1. **Request Submission**: User submits SBOM + CVEs → Request queued → Sent to Exploit Intelligence → Callback received → Report completed 2. **Report Management**: View, filter, sort, retry, delete reports 3. **Product Tracking**: Reports grouped by product/image for analysis 4. **Metadata Management**: Add custom metadata including git source location and commit ID @@ -213,7 +214,7 @@ Standard labels used to categorize vulnerability analysis results: ## External Dependencies ### Services -- **Agent Morpheus/ExploitIQ Service**: Primary vulnerability analysis service +- **Exploit Intelligence Service**: Primary vulnerability analysis service - Endpoint: Configurable via `quarkus.rest-client.morpheus.url` - Handles SBOM analysis and CVE evaluation - Sends callback responses with analysis results diff --git a/openspec/specs/feedback-report/spec.md b/openspec/specs/feedback-report/spec.md index 4eee3912..d2e2c524 100644 --- a/openspec/specs/feedback-report/spec.md +++ b/openspec/specs/feedback-report/spec.md @@ -15,8 +15,7 @@ The Feedback card SHALL display the title "Feedback" and the subtitle "Your feed ### Requirement: Feedback Form Fields The card SHALL collect the following. Required fields SHALL be marked with an asterisk. The Submit Feedback button SHALL be disabled until all required fields are set, then enabled and primary. -- **Accuracy** (dropdown, required): “How accurate do you find ExploitIQ's assessment? *” — options: Very Accurate, Mostly Accurate, Somewhat Inaccurate, Incorrect. -- **Reasoning** (dropdown, required): “Is the reasoning and summary of findings clear, complete, and well-supported? *” — options: Yes, Mostly, Somewhat, No. +- **Accuracy** (dropdown, required): “How accurate do you find the exploit intelligence assessment? *” — options: Very Accurate, Mostly Accurate, Somewhat Inaccurate, Incorrect.- **Reasoning** (dropdown, required): “Is the reasoning and summary of findings clear, complete, and well-supported? *” — options: Yes, Mostly, Somewhat, No. - **Checklist** (dropdown, required): “Were the checklist questions and explanations easy to understand? *” — options: Yes, Mostly, Somewhat, No. - **Rating** (1–5, required): “Rate the response (1 = Poor, 5 = Excellent): *” - **Comment** (TextArea, optional): “Do you have any additional feedback or suggestions to improve the analysis?” diff --git a/openspec/specs/new-rpm-report-api/spec.md b/openspec/specs/new-rpm-report-api/spec.md index 349be33e..d9007941 100644 --- a/openspec/specs/new-rpm-report-api/spec.md +++ b/openspec/specs/new-rpm-report-api/spec.md @@ -62,9 +62,9 @@ The new endpoint SHALL be documented in the application OpenAPI/Swagger specific - **THEN** the request and response types for `POST /api/v1/reports/new-rpm-report` are available to TypeScript consumers without manually duplicating DTO shapes - **AND** the generated type for **`arch`** reflects the documented enumeration of allowed RPM architectures -### Requirement: Morpheus `input.image` for rpm_package_checker +### Requirement: Exploit Intelligence `input.image` for rpm_package_checker -When the system builds the Morpheus `input` document for **`POST /api/v1/reports/new-rpm-report`**, the persisted **`report.input.image`** for **`rpm_package_checker`** SHALL include these mandatory fields for Agent Morpheus **`ImageInfoInput`** (upstream **`ImageInfoInput`** in the agent codebase’s **`input.py`**): +When the system builds the Exploit Intelligence `input` document for **`POST /api/v1/reports/new-rpm-report`**, the persisted **`report.input.image`** for **`rpm_package_checker`** SHALL include these mandatory fields for Exploit Intelligence **`ImageInfoInput`** (upstream **`ImageInfoInput`** in the agent codebase’s **`input.py`**): - **`pipeline_mode`**: literal **`rpm_package_checker`** - **`analysis_type`**: literal **`source`** (corresponding to **`AnalysisType.SOURCE`**) @@ -81,8 +81,8 @@ The public request body for **`new-rpm-report`** SHALL remain limited to **`name - **AND** **`report.input.image.analysis_type`** is **`source`** - **AND** **`report.input.image.target_package`** equals **`{ name, version, release, ecosystem: "rpm", arch }`** as specified in this capability spec -#### Scenario: Morpheus generate accepts rpm checker payload +#### Scenario: Exploit Intelligence generate accepts rpm checker payload -- **WHEN** the stored **`input`** for a successfully created RPM report is submitted to Agent Morpheus ingest / generate APIs that validate against **`AgentMorpheusInput`** / **`ImageInfoInput`** +- **WHEN** the stored **`input`** for a successfully created RPM report is submitted to Exploit Intelligence ingest / generate APIs that validate against **`ExploitIntelligenceInput`** / **`ImageInfoInput`** - **THEN** validation errors SHALL NOT occur for missing mandatory **`pipeline_mode`**, **`analysis_type`**, or **`target_package`** on **`image`** diff --git a/openspec/specs/reports-table/spec.md b/openspec/specs/reports-table/spec.md index ea1e173d..7a050c0e 100644 --- a/openspec/specs/reports-table/spec.md +++ b/openspec/specs/reports-table/spec.md @@ -1,7 +1,7 @@ # reports-table Specification ## Purpose -The reports table displays vulnerability analysis reports in a tabular format, allowing users to view SBOM report-level analysis results. The table provides aggregate ExploitIQ status indicators that summarize the overall vulnerability posture of each SBOM report. +The reports table displays vulnerability analysis reports in a tabular format, allowing users to view SBOM report-level analysis results. The table provides aggregate exploit intelligence status indicators that summarize the overall vulnerability posture of each SBOM report. ## Requirements ### Requirement: Reports Table Display The reports table SHALL support sorting by the following columns: diff --git a/openspec/specs/repository-reports-table/spec.md b/openspec/specs/repository-reports-table/spec.md index 001153bb..c47c4458 100644 --- a/openspec/specs/repository-reports-table/spec.md +++ b/openspec/specs/repository-reports-table/spec.md @@ -29,7 +29,7 @@ The repository reports table SHALL display columns: **ID** (first column, width The ID column SHALL display `report.id` as a link to the report page (component route: `/reports/component/{cveId}/{report.id}`; product route: `/reports/product/{productId}/{cveId}/{report.id}`). The **Date Requested** column SHALL display `metadata.submitted_at` when present, in the format "DD Month YYYY, HH:MM:SS AM/PM"; when `metadata.submitted_at` is missing, the cell SHALL display "-". The **Date Completed** column SHALL display `report.completedAt` in the same format. All date fields SHALL use the format "DD Month YYYY, HH:MM:SS AM/PM" (e.g., "07 July 2025, 10:14:02 PM"). -The table SHALL display a single **Finding** column (no separate "Analysis state" or "ExploitIQ Status" column). The Finding cell SHALL show, per row: if the report's analysis state is **completed**, the ExploitIQ status (Vulnerable, Not vulnerable, or Uncertain) from the vulnerability justification; if the report's analysis state is **pending**, **queued**, or **sent**, "In progress" using the shared InProgressStatus component (grey outline label, InProgressIcon); if the report's analysis state is **expired** or **failed**, "Failed" using the shared FailedStatus component (grey filled label, ExclamationCircleIcon). Styling SHALL match the Finding column in the reports table for in-progress and failed states. +The table SHALL display a single **Finding** column (no separate "Analysis state" or "Exploit Intelligence Status" column). The Finding cell SHALL show, per row: if the report's analysis state is **completed**, the Exploit Intelligence status (Vulnerable, Not vulnerable, or Uncertain) from the vulnerability justification; if the report's analysis state is **pending**, **queued**, or **sent**, "In progress" using the shared InProgressStatus component (grey outline label, InProgressIcon); if the report's analysis state is **expired** or **failed**, "Failed" using the shared FailedStatus component (grey filled label, ExclamationCircleIcon). Styling SHALL match the Finding column in the reports table for in-progress and failed states. #### Scenario: Repository reports table columns - **WHEN** a user views the repository reports table @@ -41,14 +41,14 @@ The table SHALL display a single **Finding** column (no separate "Analysis state - **AND** In progress and Failed use the shared InProgressStatus and FailedStatus components so styling matches the reports table Finding column ### Requirement: Finding filter and toolbar -The repository reports table toolbar SHALL provide a single **Finding** filter (not separate Analysis state and ExploitIQ Status filters); **RPM** **`/reports/rpm`** layouts SHALL NOT expose **`git_repo`** / Repository Name filter controls (see **RPM Reports tab table variant** above). The Finding filter SHALL allow selecting exactly one finding value (e.g. Vulnerable, Not vulnerable, Uncertain, In progress, Failed), or none. When the user selects a Finding value, the table SHALL pass the corresponding backend parameter(s) to the reports API: "In progress" maps to status values for pending, queued, sent; "Failed" maps to status values for expired, failed; "Vulnerable", "Not vulnerable", and "Uncertain" map to exploitIqStatus (or equivalent API parameter) so that the backend returns only rows matching the selected finding. When no Finding value is selected, the table SHALL not apply a finding filter (no status/exploitIqStatus restriction from this filter). +The repository reports table toolbar SHALL provide a single **Finding** filter (not separate Analysis state and Exploit Intelligence Status filters); **RPM** **`/reports/rpm`** layouts SHALL NOT expose **`git_repo`** / Repository Name filter controls (see **RPM Reports tab table variant** above). The Finding filter SHALL allow selecting exactly one finding value (e.g. Vulnerable, Not vulnerable, Uncertain, In progress, Failed), or none. When the user selects a Finding value, the table SHALL pass the corresponding backend parameter(s) to the reports API: "In progress" maps to status values for pending, queued, sent; "Failed" maps to status values for expired, failed; "Vulnerable", "Not vulnerable", and "Uncertain" map to exploitIntelligenceStatus (or equivalent API parameter) so that the backend returns only rows matching the selected finding. When no Finding value is selected, the table SHALL not apply a finding filter (no status/exploitIntelligenceStatus restriction from this filter). #### Scenario: Finding filter and backend parameters - **WHEN** the repository reports table toolbar displays filters -- **THEN** a single **Finding** filter is shown (replacing separate Analysis state and ExploitIQ status filters) +- **THEN** a single **Finding** filter is shown (replacing separate Analysis state and Exploit Intelligence status filters) - **AND** the Finding filter SHALL allow selecting exactly one finding value (e.g. Vulnerable, Not vulnerable, Uncertain, In progress, Failed), or none - **AND** when the user selects a Finding value, the table SHALL pass the corresponding backend parameter(s) to the reports API so that the backend returns only rows matching the selected finding -- **AND** when the user clears the Finding filter (no value selected), the table SHALL request data without finding-based status or exploitIqStatus filter parameters +- **AND** when the user clears the Finding filter (no value selected), the table SHALL request data without finding-based status or exploitIntelligence Status filter parameters ### Requirement: RPM package substring filter diff --git a/openspec/specs/ui-layout/spec.md b/openspec/specs/ui-layout/spec.md index 51599f8e..c063f87a 100644 --- a/openspec/specs/ui-layout/spec.md +++ b/openspec/specs/ui-layout/spec.md @@ -23,7 +23,7 @@ The application SHALL display consistent product branding in the page header. #### Scenario: Product name and icon display - **WHEN** a user views any page -- **THEN** the product name "Red Hat Trusted Profile Analyzer ExploitIQ" and icon are visible in the header +- **THEN** the product name "Red Hat Trusted Profile Analyzer exploit intelligence" and icon are visible in the header ### Requirement: Application Navigation The application SHALL provide consistent navigation routes using lowercase paths. All routes SHALL use lowercase letters to follow REST conventions and maintain consistency. diff --git a/pom.xml b/pom.xml index ca5a52fb..1400670e 100644 --- a/pom.xml +++ b/pom.xml @@ -1,8 +1,8 @@ 4.0.0 - com.redhat.ecosystemappeng.morpheus - agent-morpheus-client + com.redhat.ecosystemappeng.exploit-intelligence + exploit-intelligence 1.0.0-SNAPSHOT diff --git a/src/main/resources/META-INF/resources/error/403.html b/src/main/resources/META-INF/resources/error/403.html index 400e92c6..9380117f 100644 --- a/src/main/resources/META-INF/resources/error/403.html +++ b/src/main/resources/META-INF/resources/error/403.html @@ -17,7 +17,7 @@ - Access Denied - ExploitIQ + Access Denied - RHTPA exploit intelligence