+
@@ -193,7 +198,7 @@ Because the report aggregates many scans, it is generated **asynchronously**:
A report already generated for a given set of filters does not need to be generated again. When you open the detail page with a filter combination that was reported before, Prowler detects the existing report and surfaces **Report → Download latest** so you can download it immediately, without launching a new job. You only need to generate a fresh report when:
* You apply a filter combination that has never been reported before, or
-* A contributing provider has run a new scan since the report was generated. The report is tied to the specific scans it was built from, so a newer scan makes the previous report stale; Prowler recognizes it no longer matches the current selection and offers to generate an up-to-date one.
+* A contributing provider has completed a new scan since the report was generated. The report is tied to the specific scans it was built from, so a newer completed scan makes the previous report stale; Prowler recognizes it no longer matches the current selection and offers to generate an up-to-date one.
"Download latest" reuses an existing report only when it matches the framework, the exact resolved scan set for the current filters, and the same report options. This guarantees the PDF you download reflects the posture you are looking at, rather than a report generated for a different filter or an older scan.
@@ -201,6 +206,27 @@ A report already generated for a given set of filters does not need to be genera
The PDF detail section renders only **failed** requirements by default so the report stays focused as an executive/auditor document. As with every Prowler PDF, the detail section is capped at the first 100 failed findings per check; use the per-scan CSV or JSON-OCSF exports for the complete, untruncated list. See [Downloading Compliance Reports](/user-guide/compliance/tutorials/compliance#downloading-compliance-reports) for the full PDF behavior and the `DJANGO_PDF_MAX_FINDINGS_PER_CHECK` setting.
+## Aggregating a Single-Provider Framework Across Providers
+
+Universal frameworks answer the cross-provider-type question, but most compliance frameworks target a single provider type — CIS AWS, CIS GCP, ENS for Azure. The **Across providers** section of the Multiple Scans tab answers the sibling question for those frameworks: **"How compliant are all of my AWS accounts against CIS AWS, together?"**
+
+For every provider type with **two or more connected providers**, the section shows a collapsible group headed by the provider type and its counts (frameworks available and providers connected). Expanding a group reveals one card per single-provider framework available for that type, keeping the section compact even when several multi-provider types are connected. Selecting a card opens a detail page with the same layout as the cross-provider detail, with the column axis swapped from provider type to provider:
+
+* **One column per provider:** Prowler auto-selects the latest completed scan of every provider of that type you are allowed to see, and each requirement shows a status chip per provider (labeled with its alias or account ID).
+* **Account Coverage:** The coverage card ranks each provider's individual posture so the weakest account is visible at a glance.
+* **Filters:** Narrow the aggregation to specific providers or provider groups. The provider type is fixed by the framework, so there is no type filter here.
+* **Findings drill-down:** Expanding a requirement queries the findings of every contributing provider's scan and merges them into a single table.
+
+The roll-up rules are identical to the cross-provider ones (**FAIL > PASS > MANUAL**, only providers that contributed a result count), applied per provider instead of per provider type. Scan selection, RBAC scoping, and staleness behavior also match: the view always reflects each provider's most recent completed scan, scoped to your role's visibility.
+
+
## Step 6: Scan Started
-After successfully adding and testing your credentials, Prowler will start scanning your cloud environment, click the `Go to Scans` button to see the progress:
+After the connection check succeeds, save the provider and start your first scan with the `Launch Scan` button. The `Scans` section shows the scan in progress:
@@ -127,20 +127,14 @@ While the scan is running, start exploring the findings in these sections:
-- **Issues**: Types of issues detected.
-
- 
-
-- **Browse All Findings**: Detailed list of findings detected, where you can filter by severity, service, and more.
+- **Findings**: Detailed list of findings detected, where you can filter by severity, service, and more.
To view all `new` findings that have not been seen prior to this scan, click the `Delta` filter and select `new`. To view all `changed` findings that have had a status change (from `PASS` to `FAIL` for example), click the `Delta` filter and select `changed`.
## Step 9: Download the Outputs
-Once a scan is complete, navigate to the Scan Jobs section to download the output files generated by Prowler:
-
-
+Once a scan is complete, navigate to the `Scans` section to download the output files generated by Prowler:
You can download the output files generated by Prowler as a single `zip` file. This archive contains the CSV, JSON-OSCF, and HTML reports detailing the findings.
@@ -163,8 +157,6 @@ Once your scan has finished, you don’t need to grab the entire ZIP—just pull
- Navigate to the **Compliance** section of the UI.
-
-
- Find the Framework report you need.
- Click its **Download** icon to retrieve that report’s CSV file with all the detailed findings.
diff --git a/mcp_server/README.md b/mcp_server/README.md
index c0e4fdb0fe..48ed370dcf 100644
--- a/mcp_server/README.md
+++ b/mcp_server/README.md
@@ -16,6 +16,7 @@ Full access to your Prowler data (Prowler Cloud, Prowler Private Cloud, or Prowl
- **Resource Inventory**: Search and view detailed information about your audited resources
- **Muting Management**: Create and manage muting rules to suppress non-critical findings
- **Compliance Reporting**: View compliance status across frameworks and drill into requirement-level details
+- **User & Role Management**: List the users in your tenant, identify the authenticated user, browse RBAC roles, and set the role a user holds
### Prowler Hub
diff --git a/mcp_server/changelog.d/roles-tools.added.md b/mcp_server/changelog.d/roles-tools.added.md
new file mode 100644
index 0000000000..f06343dfb0
--- /dev/null
+++ b/mcp_server/changelog.d/roles-tools.added.md
@@ -0,0 +1 @@
+RBAC role tools `prowler_list_roles`, `prowler_get_role`, `prowler_get_user_roles`, and `prowler_set_user_role` for browsing roles and setting the role a user holds
diff --git a/mcp_server/changelog.d/users-read-tools.added.md b/mcp_server/changelog.d/users-read-tools.added.md
new file mode 100644
index 0000000000..3bc55952d8
--- /dev/null
+++ b/mcp_server/changelog.d/users-read-tools.added.md
@@ -0,0 +1 @@
+Read-only user management tools `prowler_list_users`, `prowler_get_user`, and `prowler_get_current_user` for listing tenant users with their emails and identifying the authenticated user
diff --git a/mcp_server/prowler_mcp_server/prowler_app/models/roles.py b/mcp_server/prowler_mcp_server/prowler_app/models/roles.py
new file mode 100644
index 0000000000..91499243c5
--- /dev/null
+++ b/mcp_server/prowler_mcp_server/prowler_app/models/roles.py
@@ -0,0 +1,230 @@
+"""Data models for Prowler RBAC roles.
+
+This module provides Pydantic models for representing Prowler roles with
+two-tier complexity:
+- SimplifiedRole: For list operations with essential identification fields
+- DetailedRole: Extends simplified with the capabilities the role grants and
+ its related users / provider groups
+
+It also provides UserRolesResult, used by the tools that read or change the
+roles assigned to a specific user.
+
+All models inherit from MinimalSerializerMixin to exclude None/empty values
+for optimal LLM token usage.
+"""
+
+from typing import Any
+
+from pydantic import BaseModel, ConfigDict, Field
+
+from prowler_mcp_server.prowler_app.models.base import MinimalSerializerMixin
+from prowler_mcp_server.prowler_app.models.utils import extract_relationship_ids
+
+# Role capabilities are exposed by the API as boolean "manage_*" attributes.
+_PERMISSION_ATTRIBUTE_PREFIX = "manage_"
+
+
+class SimplifiedRole(MinimalSerializerMixin, BaseModel):
+ """Simplified role representation for list operations.
+
+ Includes core identification fields for efficient overview.
+ Used by list_roles() tool.
+ """
+
+ model_config = ConfigDict(frozen=True)
+
+ id: str = Field(
+ description="Unique UUIDv4 identifier for this role in Prowler database"
+ )
+ name: str = Field(description="Human-readable name of the role")
+ permission_state: str | None = Field(
+ default=None,
+ description="Summary of the role's permissions: 'unlimited' (all), 'limited' (some), or 'none'",
+ )
+
+ @classmethod
+ def from_api_response(cls, data: dict[str, Any]) -> "SimplifiedRole":
+ """Transform a JSON:API role resource into a simplified model.
+
+ Args:
+ data: Role data from API response['data'] (single item or list item)
+
+ Returns:
+ SimplifiedRole instance
+ """
+ attributes = data["attributes"]
+
+ return cls(
+ id=data["id"],
+ name=attributes["name"],
+ permission_state=attributes.get("permission_state"),
+ )
+
+
+class DetailedRole(SimplifiedRole):
+ """Detailed role representation with granted capabilities and relationships.
+
+ Extends SimplifiedRole with the concrete management capabilities the role
+ grants, its visibility scope, and the IDs of related users and provider
+ groups. Used by get_role(), get_user_roles() and set_user_role().
+ """
+
+ model_config = ConfigDict(frozen=True)
+
+ permissions: list[str] | None = Field(
+ default=None,
+ description="Management capabilities granted by this role, as reported by the API (only the enabled ones), e.g. ['manage_users', 'manage_scans']. Deployments do not all expose the same capabilities, so read `permission_state` for the authoritative summary: 'unlimited' means the role grants every capability, including any not listed here.",
+ )
+ unlimited_visibility: bool | None = Field(
+ default=None,
+ description="Whether the role can see all providers (True) or only those in its provider groups (False)",
+ )
+ provider_group_ids: list[str] | None = Field(
+ default=None,
+ description="UUIDv4 identifiers of the provider groups this role is scoped to. An empty list means the role is not scoped to any provider group.",
+ )
+ user_ids: list[str] | None = Field(
+ default=None,
+ description="UUIDv4 identifiers of the users this role is assigned to. An empty list means the role is not assigned to any user.",
+ )
+ inserted_at: str | None = Field(
+ default=None, description="ISO 8601 timestamp when the role was created"
+ )
+ updated_at: str | None = Field(
+ default=None, description="ISO 8601 timestamp when the role was last modified"
+ )
+
+ def _should_exclude(self, key: str, value: Any) -> bool:
+ """Keep fields whose "empty" form carries meaning.
+
+ ``unlimited_visibility`` is kept even when ``False``, and ``permissions``
+ and the relationship lists are kept even when empty so that an empty
+ ``permissions``/``user_ids``/``provider_group_ids`` explicitly signals
+ "grants no capabilities / not assigned to any user / not scoped to any
+ provider group" instead of looking like an omitted, unknown field to an
+ agent.
+ """
+ if key in (
+ "unlimited_visibility",
+ "permissions",
+ "user_ids",
+ "provider_group_ids",
+ ):
+ return value is None
+ return super()._should_exclude(key, value)
+
+ @classmethod
+ def from_api_response(cls, data: dict[str, Any]) -> "DetailedRole":
+ """Transform a JSON:API role resource into a detailed model.
+
+ Args:
+ data: Role data from API response['data'] or an included role
+
+ Returns:
+ DetailedRole instance with all fields populated
+ """
+ attributes = data["attributes"]
+ relationships = data.get("relationships", {})
+
+ permissions = [
+ name
+ for name, enabled in attributes.items()
+ if name.startswith(_PERMISSION_ATTRIBUTE_PREFIX) and enabled
+ ]
+
+ return cls(
+ id=data["id"],
+ name=attributes["name"],
+ permission_state=attributes.get("permission_state"),
+ permissions=permissions,
+ unlimited_visibility=attributes.get("unlimited_visibility"),
+ provider_group_ids=extract_relationship_ids(
+ relationships, "provider_groups"
+ ),
+ user_ids=extract_relationship_ids(relationships, "users"),
+ inserted_at=attributes.get("inserted_at"),
+ updated_at=attributes.get("updated_at"),
+ )
+
+
+class RolesListResponse(BaseModel):
+ """Response model for list_roles() with pagination metadata.
+
+ Follows the established pattern from ScansListResponse and UsersListResponse.
+ """
+
+ roles: list[SimplifiedRole]
+ total_num_roles: int
+ total_num_pages: int
+ current_page: int
+
+ @classmethod
+ def from_api_response(cls, response: dict[str, Any]) -> "RolesListResponse":
+ """Transform a JSON:API list response into a roles list with pagination.
+
+ Args:
+ response: Full API response with data and meta
+
+ Returns:
+ RolesListResponse with simplified roles and pagination metadata
+ """
+ data = response.get("data", [])
+ meta = response.get("meta", {})
+ pagination = meta.get("pagination", {})
+
+ roles = [SimplifiedRole.from_api_response(item) for item in data]
+
+ return cls(
+ roles=roles,
+ total_num_roles=pagination.get("count", 0),
+ total_num_pages=pagination.get("pages", 0),
+ current_page=pagination.get("page", 1),
+ )
+
+
+class UserRolesResult(MinimalSerializerMixin, BaseModel):
+ """The roles currently assigned to a user.
+
+ Used by get_user_roles() to report a user's roles, and by set_user_role()
+ to report the authoritative role set after a change (with `changed` and
+ `message` describing the outcome).
+ """
+
+ user_id: str = Field(description="UUIDv4 identifier of the user")
+ total_num_roles: int = Field(
+ description="Number of roles currently assigned to the user"
+ )
+ roles: list[DetailedRole] = Field(
+ description="The roles currently assigned to the user, with their granted capabilities"
+ )
+ changed: bool | None = Field(
+ default=None,
+ description="For assignment operations: whether this call actually modified the user's roles",
+ )
+ message: str | None = Field(
+ default=None,
+ description="For assignment operations: human-readable description of the outcome",
+ )
+
+ def _should_exclude(self, key: str, value: Any) -> bool:
+ """Always include the roles list, even when empty (explicit 'no roles')."""
+ if key == "roles":
+ return False
+ return super()._should_exclude(key, value)
+
+ @classmethod
+ def build(
+ cls,
+ user_id: str,
+ roles: list[DetailedRole],
+ changed: bool | None = None,
+ message: str | None = None,
+ ) -> "UserRolesResult":
+ """Assemble a result from a user's role list, filling the count."""
+ return cls(
+ user_id=user_id,
+ total_num_roles=len(roles),
+ roles=roles,
+ changed=changed,
+ message=message,
+ )
diff --git a/mcp_server/prowler_mcp_server/prowler_app/models/users.py b/mcp_server/prowler_mcp_server/prowler_app/models/users.py
new file mode 100644
index 0000000000..0dcd4ac501
--- /dev/null
+++ b/mcp_server/prowler_mcp_server/prowler_app/models/users.py
@@ -0,0 +1,143 @@
+"""Data models for Prowler users.
+
+This module provides Pydantic models for representing Prowler users with
+two-tier complexity:
+- SimplifiedUser: For list operations with essential identification fields
+- DetailedUser: Extends simplified with account metadata and role/membership links
+
+All models inherit from MinimalSerializerMixin to exclude None/empty values
+for optimal LLM token usage.
+"""
+
+from typing import Any
+
+from pydantic import BaseModel, ConfigDict, Field
+
+from prowler_mcp_server.prowler_app.models.base import MinimalSerializerMixin
+from prowler_mcp_server.prowler_app.models.utils import extract_relationship_ids
+
+
+class SimplifiedUser(MinimalSerializerMixin, BaseModel):
+ """Simplified user representation for list operations.
+
+ Includes core identification fields for efficient overview.
+ Used by list_users() tool.
+ """
+
+ model_config = ConfigDict(frozen=True)
+
+ id: str = Field(
+ description="Unique UUIDv4 identifier for this user in Prowler database"
+ )
+ name: str = Field(description="Display name of the user")
+ email: str = Field(description="Email address of the user")
+ company_name: str | None = Field(
+ default=None, description="Company the user belongs to, if provided"
+ )
+
+ @classmethod
+ def from_api_response(cls, data: dict[str, Any]) -> "SimplifiedUser":
+ """Transform a JSON:API user resource into a simplified model.
+
+ Args:
+ data: User data from API response['data'] (single item or list item)
+
+ Returns:
+ SimplifiedUser instance
+ """
+ attributes = data["attributes"]
+
+ return cls(
+ id=data["id"],
+ name=attributes["name"],
+ email=attributes["email"],
+ company_name=attributes.get("company_name"),
+ )
+
+
+class DetailedUser(SimplifiedUser):
+ """Detailed user representation with account metadata and relationships.
+
+ Extends SimplifiedUser with the join date and the IDs of the roles and
+ memberships associated with the user.
+ Used by get_user() and get_current_user() tools.
+
+ Note: ``role_ids`` and ``membership_ids`` are omitted when empty because an
+ empty list is ambiguous here. The API hides another user's roles/memberships
+ from callers without MANAGE_ACCOUNT (returning them empty rather than
+ forbidden), so an empty list cannot be told apart from "genuinely none". They
+ are only reported when at least one ID is visible.
+ """
+
+ model_config = ConfigDict(frozen=True)
+
+ date_joined: str | None = Field(
+ default=None,
+ description="ISO 8601 timestamp when the user joined",
+ )
+ role_ids: list[str] | None = Field(
+ default=None,
+ description="UUIDv4 identifiers of the roles assigned to the user (omitted when none are visible)",
+ )
+ membership_ids: list[str] | None = Field(
+ default=None,
+ description="UUIDv4 identifiers of the tenant memberships of the user (omitted when none are visible)",
+ )
+
+ @classmethod
+ def from_api_response(cls, data: dict[str, Any]) -> "DetailedUser":
+ """Transform a JSON:API user resource into a detailed model.
+
+ Args:
+ data: User data from API response['data']
+
+ Returns:
+ DetailedUser instance with all fields populated
+ """
+ attributes = data["attributes"]
+ relationships = data.get("relationships", {})
+
+ return cls(
+ id=data["id"],
+ name=attributes["name"],
+ email=attributes["email"],
+ company_name=attributes.get("company_name"),
+ date_joined=attributes.get("date_joined"),
+ role_ids=extract_relationship_ids(relationships, "roles"),
+ membership_ids=extract_relationship_ids(relationships, "memberships"),
+ )
+
+
+class UsersListResponse(BaseModel):
+ """Response model for list_users() with pagination metadata.
+
+ Follows the established pattern from ScansListResponse and ProvidersListResponse.
+ """
+
+ users: list[SimplifiedUser]
+ total_num_users: int
+ total_num_pages: int
+ current_page: int
+
+ @classmethod
+ def from_api_response(cls, response: dict[str, Any]) -> "UsersListResponse":
+ """Transform a JSON:API list response into a users list with pagination.
+
+ Args:
+ response: Full API response with data and meta
+
+ Returns:
+ UsersListResponse with simplified users and pagination metadata
+ """
+ data = response.get("data", [])
+ meta = response.get("meta", {})
+ pagination = meta.get("pagination", {})
+
+ users = [SimplifiedUser.from_api_response(item) for item in data]
+
+ return cls(
+ users=users,
+ total_num_users=pagination.get("count", 0),
+ total_num_pages=pagination.get("pages", 0),
+ current_page=pagination.get("page", 1),
+ )
diff --git a/mcp_server/prowler_mcp_server/prowler_app/models/utils.py b/mcp_server/prowler_mcp_server/prowler_app/models/utils.py
new file mode 100644
index 0000000000..a20687c03a
--- /dev/null
+++ b/mcp_server/prowler_mcp_server/prowler_app/models/utils.py
@@ -0,0 +1,45 @@
+"""Shared helpers for building models from Prowler API responses.
+
+Stateless utilities used by the models' ``from_api_response()`` factory methods
+to read the JSON:API document structure (relationships, linkage, etc.). Keeping
+them here leaves ``base.py`` focused on the base model/mixin and gives these
+response-parsing helpers a single, discoverable home.
+"""
+
+from typing import Any
+
+
+def extract_relationship_ids(
+ relationships: dict[str, Any], relationship_name: str
+) -> list[str] | None:
+ """Extract related resource IDs from a JSON:API relationship.
+
+ Handles both to-one (``data`` is an object) and to-many (``data`` is a list)
+ relationships, returning a flat list of IDs in either case.
+
+ The absent and present-but-empty cases are deliberately distinguished so
+ callers can tell "the relationship was not part of this document" from "the
+ relationship is genuinely empty":
+
+ - Relationship key absent → ``None`` (unknown; the serializer did not expose
+ it, e.g. a role included via ``?include=roles`` carries no ``users``).
+ - Relationship key present but with no members → ``[]`` (explicitly none).
+
+ Args:
+ relationships: The ``relationships`` object from a JSON:API resource
+ relationship_name: The relationship key to read (e.g. ``"roles"``)
+
+ Returns:
+ List of related resource IDs, ``[]`` if the relationship is present but
+ empty, or ``None`` if the relationship is absent from the document.
+ """
+ relationship = relationships.get(relationship_name)
+ if relationship is None:
+ return None
+ data = relationship.get("data")
+ if not data:
+ return []
+ if isinstance(data, list):
+ return [item["id"] for item in data if item and item.get("id")]
+ # to-one relationship
+ return [data["id"]] if data.get("id") else []
diff --git a/mcp_server/prowler_mcp_server/prowler_app/tools/roles.py b/mcp_server/prowler_mcp_server/prowler_app/tools/roles.py
new file mode 100644
index 0000000000..113694d8e8
--- /dev/null
+++ b/mcp_server/prowler_mcp_server/prowler_app/tools/roles.py
@@ -0,0 +1,222 @@
+"""Role (RBAC) tools for Prowler MCP Server.
+
+This module provides read tools for browsing roles and inspecting the role a
+user holds, plus a tool for setting it.
+
+A user holds exactly one role: the API resolves a user's permissions from a
+single role (`get_role` in `api.rbac.permissions`) and the UI only ever assigns
+one, so setting a role replaces the one the user currently holds instead of
+adding to it.
+"""
+
+from typing import Any
+
+from pydantic import Field
+
+from prowler_mcp_server.prowler_app.models.roles import (
+ DetailedRole,
+ RolesListResponse,
+ UserRolesResult,
+)
+from prowler_mcp_server.prowler_app.tools.base import BaseTool
+
+
+class RolesTools(BaseTool):
+ """Tools for RBAC role operations.
+
+ Provides tools for:
+ - prowler_list_roles: List the roles defined in the tenant
+ - prowler_get_role: Get detailed information about a specific role by ID
+ - prowler_get_user_roles: List the roles assigned to a specific user
+ - prowler_set_user_role: Set the role a user holds (idempotent)
+ """
+
+ async def list_roles(
+ self,
+ page_size: int = Field(
+ default=50, description="Number of results to return per page"
+ ),
+ page_number: int = Field(
+ default=1, description="Page number to retrieve (1-indexed)"
+ ),
+ ) -> dict[str, Any]:
+ """List the RBAC roles defined in the authenticated tenant.
+
+ Use this to discover which roles exist and their permission scope before
+ assigning one to a user. Returns LIGHTWEIGHT role information.
+
+ Each role includes:
+ - id: Prowler internal UUID (v4), used with `prowler_get_role` and the assignment tools
+ - name: Human-readable role name
+ - permission_state: Summary of what the role grants ('unlimited', 'limited' or 'none')
+
+ For the concrete capabilities a role grants and the users/provider groups
+ it relates to, use `prowler_get_role`.
+ """
+ self.api_client.validate_page_size(page_size)
+
+ params: dict[str, Any] = {
+ "fields[roles]": "name,permission_state",
+ "page[number]": page_number,
+ "page[size]": page_size,
+ }
+
+ clean_params = self.api_client.build_filter_params(params)
+
+ api_response = await self.api_client.get("/roles", params=clean_params)
+ simplified_response = RolesListResponse.from_api_response(api_response)
+
+ return simplified_response.model_dump()
+
+ async def get_role(
+ self,
+ role_id: str = Field(
+ description="Prowler's internal UUID (v4) for the role to retrieve. Use `prowler_list_roles` to find role IDs if you only know a name."
+ ),
+ ) -> dict[str, Any]:
+ """Retrieve detailed information about a specific role by its ID.
+
+ Returns everything `prowler_list_roles` returns PLUS:
+ - permissions: The management capabilities the role grants (only the enabled ones). Read `permission_state` for the authoritative summary: 'unlimited' means the role grants every capability, including any this deployment does not list individually
+
+ - unlimited_visibility: Whether the role can see all providers or only its provider groups
+ - provider_group_ids: Provider groups the role is scoped to (empty list means it is scoped to no provider group)
+ - user_ids: Users the role is assigned to (empty list means it is assigned to no user)
+ - inserted_at / updated_at: Lifecycle timestamps
+
+ The `user_ids` and `provider_group_ids` fields are always present: an
+ empty list means "none", not "unknown".
+
+ Workflow:
+ 1. Use `prowler_list_roles` to browse roles and find the target role 'id'
+ 2. Use this tool with that 'id' to inspect exactly what the role grants
+ """
+ api_response = await self.api_client.get(f"/roles/{role_id}")
+ detailed_role = DetailedRole.from_api_response(api_response["data"])
+
+ return detailed_role.model_dump()
+
+ async def get_user_roles(
+ self,
+ user_id: str = Field(
+ description="Prowler's internal UUID (v4) for the user whose roles you want. Use `prowler_list_users` to find user IDs, or `prowler_get_current_user` for the caller."
+ ),
+ ) -> dict[str, Any]:
+ """List the roles currently assigned to a specific user.
+
+ Returns the user's roles with the concrete capabilities each one grants,
+ so you can see what the user is allowed to do in the tenant. A user
+ normally holds a single role.
+
+ Note: this reads the user's record, so it requires MANAGE_USERS (the same
+ permission `prowler_get_user` needs). Each role's `user_ids` and
+ `provider_group_ids` are not resolved here; use `prowler_get_role` for a
+ role's full assignment and provider-group scope.
+
+ Workflow:
+ 1. Use `prowler_list_users` (or `prowler_get_current_user`) to find the user 'id'
+ 2. Use this tool to see which role they hold and what it grants
+ 3. Use `prowler_set_user_role` to change it
+ """
+ roles = await self._fetch_user_roles(user_id)
+
+ return UserRolesResult.build(user_id=user_id, roles=roles).model_dump()
+
+ async def set_user_role(
+ self,
+ user_id: str = Field(
+ description="Prowler's internal UUID (v4) for the user whose role you want to set. Use `prowler_list_users` to find user IDs."
+ ),
+ role_id: str = Field(
+ description="Prowler's internal UUID (v4) for the role the user should hold. Use `prowler_list_roles` to find role IDs."
+ ),
+ ) -> dict[str, Any]:
+ """Set the role a user holds, replacing the role they had before.
+
+ A user holds exactly one role in Prowler: their permissions are resolved
+ from a single role, so granting a new one REPLACES the previous one
+ instead of adding to it. To change what a user can do, set the role that
+ grants the capabilities they should have.
+
+ This tool is idempotent: if the user already holds only this role, it
+ makes no change and reports `changed: false`. It always returns the
+ user's up-to-date role after the operation.
+
+ Note: this operation requires both MANAGE_ACCOUNT (to change role
+ assignments) and MANAGE_USERS (to read the user's current role). The API
+ rejects the change when it would leave the tenant without a user holding
+ MANAGE_ACCOUNT; such rejections are surfaced as errors.
+
+ Workflow:
+ 1. Use `prowler_list_roles` to find the role 'id' to grant
+ 2. Use `prowler_list_users` to find the target user 'id'
+ 3. Use this tool to set the user's role
+ """
+ current_roles = await self._fetch_user_roles(user_id)
+ if [role.id for role in current_roles] == [role_id]:
+ return UserRolesResult.build(
+ user_id=user_id,
+ roles=current_roles,
+ changed=False,
+ message=f"User {user_id} already holds role {role_id}; no change made.",
+ ).model_dump()
+
+ # The relationship endpoint accepts any well-formed UUID and silently
+ # drops role IDs that do not exist in this tenant, which would leave the
+ # user with no role at all. Confirm the role exists before replacing.
+ try:
+ await self.api_client.get(f"/roles/{role_id}")
+ except Exception as e:
+ raise ValueError(
+ f"Role {role_id} could not be read ({e}), so user {user_id} was left "
+ f"unchanged. Use `prowler_list_roles` to find a valid role ID."
+ ) from e
+
+ # PATCH replaces the user's whole role set with this single role, the
+ # same call the Prowler UI makes when changing a user's role.
+ await self.api_client.patch(
+ f"/users/{user_id}/relationships/roles",
+ json_data={"data": [{"type": "roles", "id": role_id}]},
+ )
+
+ # After the change, fetch the user's roles again to report the authoritative state
+ updated_roles = await self._fetch_user_roles(user_id)
+
+ return UserRolesResult.build(
+ user_id=user_id,
+ roles=updated_roles,
+ changed=True,
+ message=f"Role {role_id} set for user {user_id}.",
+ ).model_dump()
+
+ # Private helper methods
+
+ async def _fetch_user_roles(self, user_id: str) -> list[DetailedRole]:
+ """Fetch the roles currently assigned to a user.
+
+ Uses a single `GET /users/{id}?include=roles` request and reads the
+ role resources from the JSON:API `included` section. This request
+ requires MANAGE_USERS (it reads the user record).
+
+ The included role resources do not carry their `users` /
+ `provider_groups` relationships, so the returned `DetailedRole`
+ instances omit `user_ids` / `provider_group_ids` (unknown here)
+ rather than reporting them as empty. Use `get_role` for a role's full
+ assignment and provider-group scope.
+
+ Args:
+ user_id: The Prowler UUID of the user
+
+ Returns:
+ The user's roles as DetailedRole instances (empty list if none)
+ """
+ response = await self.api_client.get(
+ f"/users/{user_id}", params={"include": "roles"}
+ )
+ included = response.get("included", []) or []
+
+ return [
+ DetailedRole.from_api_response(item)
+ for item in included
+ if item.get("type") == "roles"
+ ]
diff --git a/mcp_server/prowler_mcp_server/prowler_app/tools/users.py b/mcp_server/prowler_mcp_server/prowler_app/tools/users.py
new file mode 100644
index 0000000000..a7e31b60ad
--- /dev/null
+++ b/mcp_server/prowler_mcp_server/prowler_app/tools/users.py
@@ -0,0 +1,121 @@
+"""User management tools for Prowler MCP Server.
+
+This module provides read-only tools for viewing the users that belong to the
+authenticated tenant, including identifying which user the current credentials
+(API key or JWT) authenticate as.
+"""
+
+from typing import Any
+
+from pydantic import Field
+
+from prowler_mcp_server.prowler_app.models.users import (
+ DetailedUser,
+ UsersListResponse,
+)
+from prowler_mcp_server.prowler_app.tools.base import BaseTool
+
+
+class UsersTools(BaseTool):
+ """Tools for user management operations (read-only).
+
+ Provides tools for:
+ - prowler_list_users: List the users in the tenant with their names and emails
+ - prowler_get_user: Get detailed information about a specific user by ID
+ - prowler_get_current_user: Identify which user the current credentials authenticate as
+ """
+
+ async def list_users(
+ self,
+ name: str | None = Field(
+ default=None,
+ description="Filter by user display name. Partial match supported (case-insensitive).",
+ ),
+ email: str | None = Field(
+ default=None,
+ description="Filter by user email address. Partial match supported (case-insensitive).",
+ ),
+ page_size: int = Field(
+ default=50, description="Number of results to return per page"
+ ),
+ page_number: int = Field(
+ default=1, description="Page number to retrieve (1-indexed)"
+ ),
+ ) -> dict[str, Any]:
+ """List the users that belong to the authenticated tenant.
+
+ Use this to see who has access to the tenant and to look up their email
+ addresses. Returns LIGHTWEIGHT user information optimized for browsing.
+
+ Each user includes:
+ - id: Prowler internal UUID (v4), used with `prowler_get_user`
+ - name: Display name
+ - email: Email address
+ - company_name: Company the user belongs to, when set
+
+ To find out which user the current credentials authenticate as, use
+ `prowler_get_current_user`. For a single user's roles, membership links
+ and join date, use `prowler_get_user`.
+ """
+ self.api_client.validate_page_size(page_size)
+
+ params: dict[str, Any] = {
+ "fields[users]": "name,email,company_name",
+ "page[number]": page_number,
+ "page[size]": page_size,
+ }
+
+ if name:
+ params["filter[name__icontains]"] = name
+ if email:
+ params["filter[email__icontains]"] = email
+
+ clean_params = self.api_client.build_filter_params(params)
+
+ api_response = await self.api_client.get("/users", params=clean_params)
+ simplified_response = UsersListResponse.from_api_response(api_response)
+
+ return simplified_response.model_dump()
+
+ async def get_user(
+ self,
+ user_id: str = Field(
+ description="Prowler's internal UUID (v4) for the user to retrieve. Use `prowler_list_users` to find user IDs if you only know a name or email."
+ ),
+ ) -> dict[str, Any]:
+ """Retrieve detailed information about a specific user by their ID.
+
+ Returns everything `prowler_list_users` returns PLUS:
+ - date_joined: When the user joined
+ - role_ids: UUIDs of the roles assigned to the user
+ - membership_ids: UUIDs of the user's tenant memberships
+
+ Reading another user's roles/memberships requires MANAGE_ACCOUNT; without
+ it the API hides them and `role_ids`/`membership_ids` are omitted rather
+ than reported as empty.
+
+ Workflow:
+ 1. Use `prowler_list_users` to browse users and find the target user 'id'
+ 2. Use this tool with that 'id' to inspect the user's roles and account details
+ """
+ api_response = await self.api_client.get(f"/users/{user_id}")
+ detailed_user = DetailedUser.from_api_response(api_response["data"])
+
+ return detailed_user.model_dump()
+
+ async def get_current_user(self) -> dict[str, Any]:
+ """Identify which user the current credentials authenticate as.
+
+ Use this to determine the identity behind the credentials this MCP server
+ is currently using, e.g. before performing actions on behalf of that user
+ or when reporting who is connected.
+
+ Returns the same detailed information as `prowler_get_user`:
+ - id, name, email, company_name
+ - date_joined
+ - role_ids, membership_ids
+ """
+ api_response = await self.api_client.get("/users/me")
+ detailed_user = DetailedUser.from_api_response(api_response["data"])
+
+ return detailed_user.model_dump()
diff --git a/mcp_server/prowler_mcp_server/prowler_app/utils/api_client.py b/mcp_server/prowler_mcp_server/prowler_app/utils/api_client.py
index 187364bee1..3222454dcb 100644
--- a/mcp_server/prowler_mcp_server/prowler_app/utils/api_client.py
+++ b/mcp_server/prowler_mcp_server/prowler_app/utils/api_client.py
@@ -176,13 +176,19 @@ class ProwlerAPIClient(metaclass=SingletonMeta):
)
async def delete(
- self, path: str, params: dict[str, any] | None = None
+ self,
+ path: str,
+ params: dict[str, any] | None = None,
+ json_data: dict[str, any] | None = None,
) -> dict[str, any]:
"""Make DELETE request.
Args:
path: API endpoint path
params: Optional query parameters
+ json_data: Optional JSON body data. Some JSON:API relationship
+ endpoints (e.g. ``/users/{id}/relationships/roles``) accept a
+ body listing the specific members to remove.
Returns:
API response as dictionary
@@ -190,7 +196,9 @@ class ProwlerAPIClient(metaclass=SingletonMeta):
Raises:
Exception: If API request fails
"""
- return await self._make_request(HTTPMethod.DELETE, path, params=params)
+ return await self._make_request(
+ HTTPMethod.DELETE, path, params=params, json_data=json_data
+ )
async def fetch_external_url(self, url: str) -> str:
"""Fetch content from an allowed external URL (unauthenticated).
diff --git a/prowler/changelog.d/gcp-cloudfunction-gen2-iam-thread-safety.fixed.md b/prowler/changelog.d/gcp-cloudfunction-gen2-iam-thread-safety.fixed.md
new file mode 100644
index 0000000000..f5ec21ab0b
--- /dev/null
+++ b/prowler/changelog.d/gcp-cloudfunction-gen2-iam-thread-safety.fixed.md
@@ -0,0 +1 @@
+GCP Cloud Functions gen2 IAM policy retrieval now uses a per-request HTTP client, preventing a process crash from concurrent thread-unsafe `httplib2` access when a project has several gen2 functions
diff --git a/prowler/changelog.d/jira-adf-metadata.fixed.md b/prowler/changelog.d/jira-adf-metadata.fixed.md
new file mode 100644
index 0000000000..c227c4a473
--- /dev/null
+++ b/prowler/changelog.d/jira-adf-metadata.fixed.md
@@ -0,0 +1 @@
+Jira descriptions with inline code nested in bold or italic Markdown now render as valid ADF
diff --git a/prowler/lib/outputs/jira/jira.py b/prowler/lib/outputs/jira/jira.py
index 601120cdfc..9fb4c7d6ad 100644
--- a/prowler/lib/outputs/jira/jira.py
+++ b/prowler/lib/outputs/jira/jira.py
@@ -203,7 +203,9 @@ class MarkdownToADFConverter:
if token_type == "text":
result.extend(self._text_to_nodes(token.content, marks_stack))
elif token_type == "code_inline":
- marks = self._clone_marks(marks_stack)
+ marks = self._clone_marks(
+ [mark for mark in marks_stack if mark["type"] == "link"]
+ )
marks.append({"type": "code"})
result.append(self._create_text_node(token.content, marks))
elif token_type in {"softbreak", "hardbreak"}:
diff --git a/prowler/lib/outputs/ocsf/ocsf.py b/prowler/lib/outputs/ocsf/ocsf.py
index 29898ce813..6d271d9bce 100644
--- a/prowler/lib/outputs/ocsf/ocsf.py
+++ b/prowler/lib/outputs/ocsf/ocsf.py
@@ -1,8 +1,9 @@
import json
import os
from datetime import datetime, timezone
+from functools import lru_cache
from random import getrandbits
-from typing import List, Optional
+from typing import Dict, List, Optional
from py_ocsf_models.events.base_event import SeverityID, StatusID
from py_ocsf_models.events.findings.detection_finding import (
@@ -345,36 +346,68 @@ def _build_analytic(finding: Finding) -> Analytic:
)
+@lru_cache(maxsize=None)
+def _load_mitre_technique_map(provider: str) -> Dict[str, dict]:
+ """Load and cache MITRE ATT&CK techniques for a provider."""
+ try:
+ mitre_file = os.path.join(
+ os.path.dirname(__file__),
+ "..",
+ "..",
+ "..",
+ "compliance",
+ provider,
+ f"mitre_attack_{provider}.json",
+ )
+ with open(mitre_file) as file:
+ data = json.load(file)
+ return {
+ requirement["Id"]: requirement
+ for requirement in data.get("Requirements", [])
+ }
+ except Exception as error:
+ logger.error(
+ f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+ return {}
+
+
def _build_mitre_attacks(finding: Finding) -> Optional[List[MITREAttack]]:
- """Build OCSF MITREAttack objects from MITRE-ATTACK metadata.
+ """Build OCSF MITREAttack objects from finding compliance technique IDs.
Args:
- finding (Finding): Finding with compliance metadata attached to its check metadata.
+ finding (Finding): Finding with MITRE ATT&CK compliance technique IDs.
Returns:
- Optional[List[MITREAttack]]: MITRE attacks derived from metadata, or None
- when the finding has no MITRE-ATTACK metadata.
+ Optional[List[MITREAttack]]: MITRE attacks for known provider techniques,
+ or None when none can be built.
"""
+ technique_map = _load_mitre_technique_map(finding.provider)
attacks = []
- for compliance in finding.metadata.Compliance or []:
- if compliance.Framework.upper() != "MITRE-ATTACK":
+ for technique_id in finding.compliance.get("MITRE-ATTACK", []):
+ requirement = technique_map.get(technique_id)
+ if not requirement:
continue
-
- for requirement in compliance.Requirements:
- technique = Technique(
- uid=requirement.Id,
- name=requirement.Name,
- src_url=requirement.TechniqueURL,
+ technique_name = requirement.get("Name")
+ if not technique_name:
+ logger.warning(
+ f"Skipping MITRE ATT&CK technique {technique_id} for provider {finding.provider}: missing Name"
)
- for tactic_name in requirement.Tactics:
- attacks.append(
- MITREAttack(
- technique=technique,
- tactic=Tactic(name=tactic_name),
- )
+ continue
+ technique = Technique(
+ uid=technique_id,
+ name=technique_name,
+ src_url=requirement.get("TechniqueURL"),
+ )
+ for tactic_name in requirement.get("Tactics", []):
+ attacks.append(
+ MITREAttack(
+ technique=technique,
+ tactic=Tactic(name=tactic_name),
)
+ )
- return attacks if attacks else None
+ return attacks or None
# NOTE: Copied from api/src/backend/api/uuid_utils.py (datetime_to_uuid7)
diff --git a/prowler/providers/gcp/services/cloudfunction/cloudfunction_service.py b/prowler/providers/gcp/services/cloudfunction/cloudfunction_service.py
index 9905c98748..9808f63ff8 100644
--- a/prowler/providers/gcp/services/cloudfunction/cloudfunction_service.py
+++ b/prowler/providers/gcp/services/cloudfunction/cloudfunction_service.py
@@ -108,7 +108,10 @@ class CloudFunction(GCPService):
.locations()
.services()
.getIamPolicy(resource=function.service)
- .execute(num_retries=DEFAULT_RETRY_ATTEMPTS)
+ .execute(
+ http=self.__get_AuthorizedHttp_client__(),
+ num_retries=DEFAULT_RETRY_ATTEMPTS,
+ )
)
else:
response = (
diff --git a/skills/prowler-attack-paths-query/SKILL.md b/skills/prowler-attack-paths-query/SKILL.md
index a70734aa6f..12bac88770 100644
--- a/skills/prowler-attack-paths-query/SKILL.md
+++ b/skills/prowler-attack-paths-query/SKILL.md
@@ -9,7 +9,7 @@ description: >
license: Apache-2.0
metadata:
author: prowler-cloud
- version: "3.0"
+ version: "3.1"
scope: [root, api]
auto_invoke:
- "Creating Attack Paths queries"
@@ -22,6 +22,8 @@ allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, Task
Attack Paths queries are read-only openCypher queries over a Cartography-ingested cloud graph that detect privilege escalation chains, network exposure, and other graph-shaped security risks. Queries are written in openCypher Version 9 so they run on both Neo4j and Amazon Neptune sinks.
+This skill is the concise, action-oriented reference for building queries. For the complete human-readable reference (graph model, list-typed and JSON-encoded properties, compatibility, and worked examples), see `docs/developer-guide/attack-paths-queries.mdx`.
+
---
## Two query audiences
@@ -126,12 +128,16 @@ AWS_{QUERY_NAME} = AttackPathsQueryDefinition(
OR act.value = '*'
WITH DISTINCT aws, principal, stmt, path_principal
- // Target resources attached to the same principal (sub-patterns below)
- MATCH path_target = (aws)--(target_policy:AWSPolicy)--(principal)
- WHERE target_policy.arn CONTAINS $provider_uid
+ // Pre-aggregate the statement's resource values (see "Avoiding cartesian products")
MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
- WHERE res.value = '*'
- OR target_policy.arn CONTAINS res.value
+ WITH aws, principal, path_principal, collect(DISTINCT res.value) AS res_values
+ WITH aws, principal, path_principal, res_values, ('*' IN res_values) AS res_wildcard
+
+ // Target policies attached to the principal, matched once against the resource list
+ MATCH path_target = (aws)--(target_policy:AWSPolicy)--(principal)
+ WITH path_principal, path_target, res_values, res_wildcard, target_policy.arn AS parn
+ WHERE parn CONTAINS $provider_uid
+ AND (res_wildcard OR size([rv IN res_values WHERE parn CONTAINS rv]) > 0)
WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
@@ -160,6 +166,33 @@ Key points:
---
+## Avoiding cartesian products
+
+Matching a target set (`AWSRole`, `AWSUser`, `AWSGroup`) and then filtering each target against a statement's `HAS_RESOURCE` items in a separate, unconnected `MATCH` builds a cartesian product: every target is paired with every resource item before the filter runs. On accounts with many principals this errors or times out. Pre-aggregate the resource values into a list, then match each target once:
+
+```cypher
+// Pre-aggregate the statement's resource values into a list
+MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+WITH aws, path_principal, collect(DISTINCT res.value) AS res_values
+WITH aws, path_principal, res_values, ('*' IN res_values) AS res_wildcard
+
+// Match each target once; bind name/arn to locals so the predicate reads them once
+MATCH path_target = (aws)--(target_role:AWSRole)
+WITH path_principal, path_target, res_values, res_wildcard,
+ target_role.name AS rname, target_role.arn AS rarn
+WHERE res_wildcard
+ OR size([rv IN res_values WHERE rv CONTAINS rname OR rarn CONTAINS rv]) > 0
+```
+
+- Aggregate resources before matching targets; cost becomes `targets + resources`, not `targets × resources`. This is a pure rewrite, the result set is identical.
+- `('*' IN res_values)` short-circuits the wildcard grant so the list scan runs only when needed.
+- Bind `target.name` / `target.arn` to locals so the list comprehension reads them once per target, not once per resource value.
+- `size([...]) > 0` is the Neptune-compatible form of `any()` (see "openCypher compatibility").
+- Two-statement queries aggregate each statement's resources into its own list (`res_values`, `res2_values`) and combine the two `size([...]) > 0` checks with `AND`.
+- Targets already constrained by a relationship (`STS_ASSUMEROLE_ALLOW`, `TRUSTS_AWS_PRINCIPAL`) need no aggregation: the relationship already bounds the set.
+
+---
+
## Privilege escalation sub-patterns
Four `path_target` shapes cover the common attack types. Each shares the canonical template's `path_principal`, deduplication tail, and `RETURN`; only the `path_target` MATCH and its resource predicate differ.
@@ -273,17 +306,9 @@ The literal-action list is case-folded with `toLower(act.value)` because IAM aut
### Example - resource ARN match
-Find statements whose resource can target a specific role:
+To find statements whose resource can target a specific role, pre-aggregate the resource values and test the target against the list once (see "Avoiding cartesian products"). Do not pair the target set with the `HAS_RESOURCE` items in a separate `MATCH`; that builds a cartesian product.
-```cypher
-MATCH path_target = (aws)--(target_role:AWSRole)
-MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
-WHERE res.value = '*'
- OR res.value CONTAINS target_role.name
- OR target_role.arn CONTAINS res.value
-```
-
-Three predicates cover the cases: full wildcard (`*`), pattern containing the role name (`arn:aws:iam::*:role/admin*`), and pattern that is a prefix or component of the actual ARN.
+Three predicates cover the resource cases: full wildcard (`*`), a pattern containing the target name (`arn:aws:iam::*:role/admin*`), and a pattern that is a prefix or component of the actual ARN.
### Catalog of list properties
@@ -293,25 +318,7 @@ The provider catalog lives in `api/src/backend/tasks/jobs/attack_paths/provider_
## Common openCypher patterns
-### Match account and principal
-
-```cypher
-MATCH path_principal = (aws:AWSAccount {id: $provider_uid})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {effect: 'Allow'})
-```
-
-The `(aws)--(principal)` hop stays anonymous; the `POLICY` and `STATEMENT` hops are typed.
-
-### Roles trusting a service
-
-```cypher
-MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]-(:AWSPrincipal {arn: 'ec2.amazonaws.com'})
-```
-
-### Roles a principal can assume
-
-```cypher
-MATCH path_target = (aws)--(target_role:AWSRole)-[:STS_ASSUMEROLE_ALLOW]-(principal)
-```
+The account/principal match and the service-trust and assume-role target shapes appear in the template and sub-patterns above. Additional reusable patterns:
### JSON-encoded properties
diff --git a/tests/lib/outputs/jira/jira_test.py b/tests/lib/outputs/jira/jira_test.py
index f38c1ba376..9abd2d26a1 100644
--- a/tests/lib/outputs/jira/jira_test.py
+++ b/tests/lib/outputs/jira/jira_test.py
@@ -23,11 +23,55 @@ from prowler.lib.outputs.jira.exceptions.exceptions import (
JiraSendFindingsResponseError,
JiraTestConnectionError,
)
-from prowler.lib.outputs.jira.jira import Jira
+from prowler.lib.outputs.jira.jira import Jira, MarkdownToADFConverter
TEST_DATETIME = "2023-01-01T12:01:01+00:00"
+class TestMarkdownToADFConverter:
+ def setup_method(self):
+ self.converter = MarkdownToADFConverter()
+
+ def test_inline_code_nested_in_strong_has_only_code_mark(self):
+ result = self.converter.convert("**before `code` after**")
+
+ assert result[0]["content"] == [
+ {"type": "text", "text": "before ", "marks": [{"type": "strong"}]},
+ {"type": "text", "text": "code", "marks": [{"type": "code"}]},
+ {"type": "text", "text": " after", "marks": [{"type": "strong"}]},
+ ]
+
+ def test_inline_code_nested_in_emphasis_has_only_code_mark(self):
+ result = self.converter.convert("*before `code` after*")
+
+ assert result[0]["content"] == [
+ {"type": "text", "text": "before ", "marks": [{"type": "em"}]},
+ {"type": "text", "text": "code", "marks": [{"type": "code"}]},
+ {"type": "text", "text": " after", "marks": [{"type": "em"}]},
+ ]
+
+ def test_inline_code_in_link_preserves_link_and_code_marks(self):
+ result = self.converter.convert("[`code`](https://example.com)")
+
+ assert result[0]["content"][0]["marks"] == [
+ {"type": "link", "attrs": {"href": "https://example.com"}},
+ {"type": "code"},
+ ]
+
+ def test_inline_code_in_emphasized_link_preserves_link_and_code_marks(self):
+ result = self.converter.convert("*[`code`](https://example.com)*")
+
+ assert result[0]["content"][0]["marks"] == [
+ {"type": "link", "attrs": {"href": "https://example.com"}},
+ {"type": "code"},
+ ]
+
+ def test_standalone_inline_code_has_code_mark(self):
+ result = self.converter.convert("`code`")
+
+ assert result[0]["content"][0]["marks"] == [{"type": "code"}]
+
+
class TestJiraIntegration:
@pytest.fixture(autouse=True)
@patch.object(Jira, "get_auth", return_value=None)
diff --git a/tests/lib/outputs/ocsf/ocsf_test.py b/tests/lib/outputs/ocsf/ocsf_test.py
index cd1ba289ea..359e60957c 100644
--- a/tests/lib/outputs/ocsf/ocsf_test.py
+++ b/tests/lib/outputs/ocsf/ocsf_test.py
@@ -1,4 +1,5 @@
import json
+import re
from datetime import datetime, timezone
from io import StringIO
from typing import Optional
@@ -28,11 +29,6 @@ from py_ocsf_models.objects.resource_details import ResourceDetails
from pydantic.v1 import BaseModel as V1BaseModel
from prowler.config.config import prowler_version
-from prowler.lib.check.compliance_models import (
- Compliance,
- Mitre_Requirement,
- Mitre_Requirement_Attribute_AWS,
-)
from prowler.lib.outputs.ocsf.ocsf import OCSF
from tests.lib.outputs.fixtures.fixtures import generate_finding_output
from tests.providers.aws.utils import AWS_REGION_EU_WEST_1
@@ -148,89 +144,150 @@ class TestOCSF:
1619600000, tz=timezone.utc
)
- def test_transform_mitre_attacks_populated(self):
+ def test_transform_mitre_attacks_from_multiple_finding_compliance_ids(self):
finding = generate_finding_output(
provider="aws",
- compliance={"MITRE-ATTACK": ["T4242"]},
+ compliance={"MITRE-ATTACK": ["T1078", "T1098"]},
check_id="iam_user_mfa_enabled_console_access",
check_title="IAM users with console access have MFA enabled",
service_name="iam",
)
- finding.metadata.Compliance = [
- Compliance(
- Framework="MITRE-ATTACK",
- Name="MITRE ATT&CK compliance framework",
- Provider="AWS",
- Version="",
- Description="MITRE ATT&CK test framework",
- Requirements=[
- Mitre_Requirement(
- Name="Synthetic Valid Accounts",
- Id="T4242",
- Tactics=["Persistence", "Privilege Escalation"],
- SubTechniques=[],
- Description="Synthetic MITRE technique for OCSF tests.",
- Platforms=["IaaS"],
- TechniqueURL="https://attack.mitre.org/techniques/T4242/",
- Attributes=[
- Mitre_Requirement_Attribute_AWS(
- AWSService="AWS IAM",
- Category="Protect",
- Value="Significant",
- Comment="Test mapping",
- )
- ],
- Checks=["iam_user_mfa_enabled_console_access"],
- )
- ],
- )
- ]
- ocsf = OCSF([finding])
+ technique_map = {
+ "T1078": {
+ "Name": "Valid Accounts",
+ "TechniqueURL": "https://attack.mitre.org/techniques/T1078/",
+ "Tactics": [
+ "Defense Evasion",
+ "Persistence",
+ "Privilege Escalation",
+ "Initial Access",
+ ],
+ },
+ "T1098": {
+ "Name": "Account Manipulation",
+ "TechniqueURL": "https://attack.mitre.org/techniques/T1098/",
+ "Tactics": ["Persistence"],
+ },
+ }
+
+ with patch(
+ "prowler.lib.outputs.ocsf.ocsf._load_mitre_technique_map",
+ return_value=technique_map,
+ ):
+ ocsf = OCSF([finding])
output_data = ocsf.data[0]
assert output_data.finding_info.attacks is not None
- assert len(output_data.finding_info.attacks) == 2
+ assert len(output_data.finding_info.attacks) == 5
attack = output_data.finding_info.attacks[0]
assert isinstance(attack, MITREAttack)
- assert attack.technique.uid == "T4242"
- assert attack.technique.name == "Synthetic Valid Accounts"
- assert attack.technique.src_url == "https://attack.mitre.org/techniques/T4242/"
+ assert attack.technique.uid == "T1078"
+ assert attack.technique.name == "Valid Accounts"
+ assert attack.technique.src_url == "https://attack.mitre.org/techniques/T1078/"
assert attack.tactic is not None
assert [attack.tactic.name for attack in output_data.finding_info.attacks] == [
+ "Defense Evasion",
"Persistence",
"Privilege Escalation",
+ "Initial Access",
+ "Persistence",
+ ]
+ assert [
+ attack.technique.uid for attack in output_data.finding_info.attacks
+ ] == [
+ "T1078",
+ "T1078",
+ "T1078",
+ "T1078",
+ "T1098",
]
- def test_transform_mitre_attacks_unknown_technique(self):
+ def test_transform_mitre_attacks_ignores_unknown_technique(self):
finding = generate_finding_output(
provider="aws",
- compliance={"MITRE-ATTACK": ["T9999"]},
+ compliance={"MITRE-ATTACK": ["T9999", "T1098"]},
)
- finding.metadata.Compliance = [
- Compliance(
- Framework="MITRE-ATTACK",
- Name="MITRE ATT&CK compliance framework",
- Provider="AWS",
- Version="",
- Description="MITRE ATT&CK test framework",
- Requirements=[],
- )
- ]
- ocsf = OCSF([finding])
- assert ocsf.data[0].finding_info.attacks is None
+ with patch(
+ "prowler.lib.outputs.ocsf.ocsf._load_mitre_technique_map",
+ return_value={
+ "T1098": {
+ "Name": "Account Manipulation",
+ "Tactics": ["Persistence"],
+ }
+ },
+ ):
+ ocsf = OCSF([finding])
+ attacks = ocsf.data[0].finding_info.attacks
- def test_transform_mitre_attacks_without_mitre_metadata(self):
+ assert attacks is not None
+ assert len(attacks) == 1
+ assert attacks[0].technique.uid == "T1098"
+
+ def test_transform_mitre_attacks_provider_without_catalog(self):
finding = generate_finding_output(
provider="kubernetes",
compliance={"MITRE-ATTACK": ["T1078"]},
check_type=[],
)
- ocsf = OCSF([finding])
+ with patch(
+ "prowler.lib.outputs.ocsf.ocsf._load_mitre_technique_map",
+ return_value={},
+ ):
+ ocsf = OCSF([finding])
assert ocsf.data[0].finding_info.attacks is None
+ def test_load_mitre_technique_map_logs_failure(self):
+ from prowler.lib.outputs.ocsf.ocsf import _load_mitre_technique_map
+
+ _load_mitre_technique_map.cache_clear()
+ try:
+ with (
+ patch("builtins.open", side_effect=OSError("catalog unavailable")),
+ patch("prowler.lib.outputs.ocsf.ocsf.logger.error") as mock_error,
+ ):
+ assert _load_mitre_technique_map("aws") == {}
+
+ message = mock_error.call_args.args[0]
+ assert re.fullmatch(r"OSError\[\d+\]: catalog unavailable", message)
+ finally:
+ _load_mitre_technique_map.cache_clear()
+
+ def test_transform_mitre_attacks_skips_technique_without_name(self):
+ findings = [
+ generate_finding_output(
+ provider="aws",
+ compliance={"MITRE-ATTACK": ["T1078", "T1098"]},
+ ),
+ generate_finding_output(provider="aws"),
+ ]
+ technique_map = {
+ "T1078": {"Tactics": ["Initial Access"]},
+ "T1098": {
+ "Name": "Account Manipulation",
+ "Tactics": ["Persistence"],
+ },
+ }
+
+ with (
+ patch(
+ "prowler.lib.outputs.ocsf.ocsf._load_mitre_technique_map",
+ return_value=technique_map,
+ ),
+ patch("prowler.lib.outputs.ocsf.ocsf.logger.warning") as mock_warning,
+ ):
+ ocsf = OCSF(findings)
+
+ assert len(ocsf.data) == 2
+ attacks = ocsf.data[0].finding_info.attacks
+ assert attacks is not None
+ assert [attack.technique.uid for attack in attacks] == ["T1098"]
+ mock_warning.assert_called_once_with(
+ "Skipping MITRE ATT&CK technique T1078 for provider aws: missing Name"
+ )
+
def test_scan_id_is_unique_per_provider_and_account(self):
findings = [
generate_finding_output(provider="aws", account_uid="111111111111"),
diff --git a/tests/providers/gcp/services/cloudfunction/cloudfunction_service_test.py b/tests/providers/gcp/services/cloudfunction/cloudfunction_service_test.py
index d97b80336b..99cda27ae2 100644
--- a/tests/providers/gcp/services/cloudfunction/cloudfunction_service_test.py
+++ b/tests/providers/gcp/services/cloudfunction/cloudfunction_service_test.py
@@ -1,5 +1,7 @@
-from unittest.mock import MagicMock, patch
+from unittest.mock import MagicMock, call, patch
+from prowler.providers.gcp.config import DEFAULT_RETRY_ATTEMPTS
+from prowler.providers.gcp.lib.service.service import GCPService
from prowler.providers.gcp.services.cloudfunction.cloudfunction_service import (
CloudFunction,
)
@@ -148,6 +150,90 @@ class TestCloudFunctionService:
assert fn.vpc_connector is None
assert fn.publicly_accessible is False
+ def test_get_functions_iam_policy_gen2_uses_distinct_per_request_http(self):
+ """Regression: the gen2 IAM lookup must pass a per-request HTTP client.
+
+ _get_function_iam_policy runs once per function across a thread pool
+ (GCPService.__threading_call__), and httplib2 is not thread-safe. The
+ gen1 branch isolates each thread with its own AuthorizedHttp via
+ __get_AuthorizedHttp_client__; the gen2 branch must do the same. Sharing
+ the single self._run_client transport across threads corrupts the
+ process heap and aborts the scan (SIGABRT/SIGSEGV).
+ """
+ second_function_name = "second-function"
+ second_function_id = f"projects/{GCP_PROJECT_ID}/locations/{_LOCATION_ID}/functions/{second_function_name}"
+ second_run_service = f"projects/{GCP_PROJECT_ID}/locations/{_LOCATION_ID}/services/{second_function_name}"
+ first_http = object()
+ second_http = object()
+
+ first_request = MagicMock()
+ first_request.execute.return_value = {"bindings": []}
+ second_request = MagicMock()
+ second_request.execute.return_value = {"bindings": []}
+ run_client = MagicMock()
+ get_iam_policy = run_client.projects().locations().services().getIamPolicy
+ get_iam_policy.side_effect = [first_request, second_request]
+
+ def run_sequentially(self, callback, iterator):
+ for value in iterator:
+ callback(value)
+
+ def mock_api_client(*args, **kwargs):
+ return _make_cloudfunction_client(
+ functions_list=[
+ {
+ "name": _FUNCTION_ID,
+ "state": "ACTIVE",
+ "environment": "GEN_2",
+ "serviceConfig": {"service": _RUN_SERVICE},
+ },
+ {
+ "name": second_function_id,
+ "state": "ACTIVE",
+ "environment": "GEN_2",
+ "serviceConfig": {"service": second_run_service},
+ },
+ ]
+ )
+
+ with (
+ patch(
+ "prowler.providers.gcp.lib.service.service.GCPService.__is_api_active__",
+ new=mock_is_api_active,
+ ),
+ patch(
+ "prowler.providers.gcp.lib.service.service.GCPService.__generate_client__",
+ new=mock_api_client,
+ ),
+ patch(
+ "prowler.providers.gcp.services.cloudfunction.cloudfunction_service.discovery.build",
+ return_value=run_client,
+ ),
+ patch.object(
+ GCPService,
+ "__get_AuthorizedHttp_client__",
+ side_effect=[first_http, second_http],
+ ),
+ patch.object(
+ GCPService,
+ "__threading_call__",
+ new=run_sequentially,
+ ),
+ ):
+ CloudFunction(set_mocked_gcp_provider(project_ids=[GCP_PROJECT_ID]))
+
+ get_iam_policy.assert_has_calls(
+ [call(resource=_RUN_SERVICE), call(resource=second_run_service)]
+ )
+ first_request.execute.assert_called_once_with(
+ http=first_http,
+ num_retries=DEFAULT_RETRY_ATTEMPTS,
+ )
+ second_request.execute.assert_called_once_with(
+ http=second_http,
+ num_retries=DEFAULT_RETRY_ATTEMPTS,
+ )
+
def test_get_functions_iam_policy_gen2_all_users(self):
"""Gen2 functions: allUsers binding lives on the Cloud Run service."""
diff --git a/ui/Dockerfile b/ui/Dockerfile
index 41484a3fbe..b3677bfbc3 100644
--- a/ui/Dockerfile
+++ b/ui/Dockerfile
@@ -87,7 +87,7 @@ ENV HOSTNAME="0.0.0.0"
# NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID, POSTHOG_KEY/HOST) still work:
# UI_SENTRY_ENABLED + UI_SENTRY_DSN (+ optional UI_SENTRY_ENVIRONMENT)
# UI_GOOGLE_TAG_MANAGER_ENABLED + UI_GOOGLE_TAG_MANAGER_ID
-# UI_POSTHOG_ENABLED + UI_POSTHOG_KEY + UI_POSTHOG_HOST (no consumer yet)
+# UI_POSTHOG_ENABLED + UI_POSTHOG_KEY + UI_POSTHOG_HOST (feedback survey)
# - reserved: REO_DEV_CLIENT_ID (no consumer yet)
# server.js is created by next build from the standalone output
# https://nextjs.org/docs/pages/api-reference/next-config-js/output
diff --git a/ui/app/(prowler)/_overview/threat-score/threat-score.ssr.test.tsx b/ui/app/(prowler)/_overview/threat-score/threat-score.ssr.test.tsx
new file mode 100644
index 0000000000..a89c59eec9
--- /dev/null
+++ b/ui/app/(prowler)/_overview/threat-score/threat-score.ssr.test.tsx
@@ -0,0 +1,40 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+
+import { ThreatScoreSSR } from "./threat-score.ssr";
+
+vi.mock("@/actions/overview", () => ({
+ getThreatScore: vi.fn(async () => ({
+ data: [
+ {
+ attributes: {
+ overall_score: "72",
+ score_delta: "2",
+ section_scores: {},
+ critical_requirements: [],
+ },
+ },
+ ],
+ })),
+}));
+
+vi.mock("@/components/lighthouse/context-contributor", () => ({
+ LighthouseContextContributor: ({ item }: { item: unknown }) => (
+
+ ),
+}));
+
+vi.mock("./_components/threat-score", () => ({
+ ThreatScore: ({ score }: { score?: number }) => Score {score}
,
+}));
+
+describe("ThreatScoreSSR", () => {
+ it("publishes the loaded overview score as Lighthouse context", async () => {
+ render(await ThreatScoreSSR({ searchParams: {} }));
+
+ expect(screen.getByTestId("overview-context")).toHaveTextContent(
+ '"score":72',
+ );
+ expect(screen.getByText("Score 72")).toBeInTheDocument();
+ });
+});
diff --git a/ui/app/(prowler)/_overview/threat-score/threat-score.ssr.tsx b/ui/app/(prowler)/_overview/threat-score/threat-score.ssr.tsx
index 244c50527e..98af813406 100644
--- a/ui/app/(prowler)/_overview/threat-score/threat-score.ssr.tsx
+++ b/ui/app/(prowler)/_overview/threat-score/threat-score.ssr.tsx
@@ -1,4 +1,6 @@
import { getThreatScore } from "@/actions/overview";
+import { LighthouseContextContributor } from "@/components/lighthouse/context-contributor";
+import { buildComplianceContext } from "@/lib/lighthouse/context/contributions";
import { pickFilterParams } from "../_lib/filter-params";
import { SSRComponentProps } from "../_types";
@@ -25,11 +27,23 @@ export const ThreatScoreSSR = async ({ searchParams }: SSRComponentProps) => {
: null;
return (
- {query.attributes.description}
+ {hubUrl && ( + + )} + {documentationLink && ({isSafeUrl(documentationLink.link) ? ( @@ -42,28 +64,6 @@ export const QueryDescription = ({ query }: QueryDescriptionProps) => { )}
)} - - {attribution && ( -- {isSafeUrl(attribution.link) ? ( - <> - Source:{" "} - - {attribution.text} - - - ) : ( - <> - Source: {attribution.text} - - )} -
- )}
Select a scan, build a query, and visualize Attack Paths in your
diff --git a/ui/app/(prowler)/compliance/[compliancetitle]/page.tsx b/ui/app/(prowler)/compliance/[compliancetitle]/page.tsx
index d1d734ea66..d5ad1b1c5b 100644
--- a/ui/app/(prowler)/compliance/[compliancetitle]/page.tsx
+++ b/ui/app/(prowler)/compliance/[compliancetitle]/page.tsx
@@ -26,6 +26,7 @@ import {
TopFailedSectionsCardSkeleton,
} from "@/components/compliance";
import { getComplianceIcon } from "@/components/icons/compliance/IconCompliance";
+import { LighthouseContextContributor } from "@/components/lighthouse/context-contributor";
import { Button } from "@/components/shadcn/button/button";
import { Card } from "@/components/shadcn/card/card";
import { ContentLayout } from "@/components/shadcn/content-layout";
@@ -34,6 +35,8 @@ import {
getReportTypeForCompliance,
pickLatestCisPerProvider,
} from "@/lib/compliance/compliance-report-types";
+import { LIGHTHOUSE_COMPLIANCE_CONTEXT_MODE } from "@/lib/lighthouse/context/constants";
+import { buildComplianceContext } from "@/lib/lighthouse/context/contributions";
import { isCloud } from "@/lib/shared/env";
import { cn } from "@/lib/utils";
import type { SearchParamsProps } from "@/types";
@@ -42,8 +45,10 @@ import {
Framework,
RequirementsTotals,
} from "@/types/compliance";
+import { isKnownProviderType } from "@/types/providers";
import { ScanEntity } from "@/types/scans";
+import { CrossAccountDetail } from "../_components/cross-account-detail";
import { CrossProviderDetail } from "../_components/cross-provider-detail";
import { resolveCrossProviderFramework } from "../_lib/cross-provider-frameworks";
import { buildSearchParamsKey } from "../_lib/search-params-key";
@@ -75,7 +80,7 @@ export default async function ComplianceDetail({
// Cross-provider mode replaces the per-scan pipeline with the universal
// roll-up view. Prowler Cloud-only: the OSS API has no such endpoint, so
// the route is blocked in OSS the same way the compliance tab is.
- if (mode === "cross-provider") {
+ if (mode === LIGHTHOUSE_COMPLIANCE_CONTEXT_MODE.CROSS_PROVIDER) {
if (!isCloud()) {
redirect("/compliance");
}
@@ -113,6 +118,51 @@ export default async function ComplianceDetail({
);
}
+ // Cross-account mode: one regular framework aggregated across every
+ // account of one provider type. Cloud-only, like cross-provider.
+ if (mode === LIGHTHOUSE_COMPLIANCE_CONTEXT_MODE.CROSS_ACCOUNT) {
+ if (!isCloud()) {
+ redirect("/compliance");
+ }
+
+ const providerType = getSingleSearchParam(
+ resolvedSearchParams.providerType,
+ );
+ if (!providerType || !isKnownProviderType(providerType)) {
+ notFound();
+ }
+
+ const crossAccountTitle = compliancetitle.split("-").join(" ");
+ return (
+
+
+
({
+ captureExceptionMock: vi.fn(),
+ fetchMock: vi.fn(),
+ getAuthHeadersMock: vi.fn(),
+ handleApiResponseMock: vi.fn(),
+}));
+
+vi.mock("@/lib", () => ({
+ apiBaseUrl: "https://api.test/api/v1",
+ GENERIC_SERVER_ERROR_MESSAGE: "Generic server error.",
+ getErrorMessage: (error: unknown) =>
+ error instanceof Error ? error.message : String(error),
+}));
+
+vi.mock("@/lib/auth-headers", () => ({
+ getAuthHeaders: getAuthHeadersMock,
+}));
+
+vi.mock("@/lib/server-actions-helper", () => ({
+ handleApiResponse: handleApiResponseMock,
+}));
+
+vi.mock("@sentry/nextjs", () => ({
+ captureException: captureExceptionMock,
+}));
+
+import {
+ generateCrossAccountPdf,
+ getCrossAccountComplianceOverview,
+ getCrossAccountPdfBinary,
+ getLatestCrossAccountPdf,
+} from "./cross-account";
+
+const jsonResponse = (body: unknown, status = 200) =>
+ new Response(JSON.stringify(body), {
+ status,
+ headers: { "Content-Type": "application/vnd.api+json" },
+ });
+
+const lastFetchUrl = () => {
+ const call = fetchMock.mock.calls.at(-1);
+ if (!call) throw new Error("fetch was not called");
+ return new URL(String(call[0]));
+};
+
+const fetchCallAt = (index: number) => {
+ const call = fetchMock.mock.calls[index];
+ if (!call) throw new Error(`fetch call ${index} was not found`);
+ return {
+ init: call[1] as RequestInit,
+ url: new URL(String(call[0])),
+ };
+};
+
+beforeEach(() => {
+ vi.clearAllMocks();
+ vi.stubGlobal("fetch", fetchMock);
+ fetchMock.mockResolvedValue(jsonResponse({ data: null }));
+ getAuthHeadersMock.mockResolvedValue({ Authorization: "Bearer test-token" });
+ handleApiResponseMock.mockResolvedValue({ data: null });
+});
+
+afterEach(() => {
+ vi.useRealTimers();
+});
+
+describe("cross-account compliance actions", () => {
+ it("loads the overview with its identity and account filters", async () => {
+ const payload = { data: { id: "cis_2.0_aws" } };
+ handleApiResponseMock.mockResolvedValue(payload);
+
+ const result = await getCrossAccountComplianceOverview({
+ complianceId: "cis_2.0_aws",
+ providerType: "aws",
+ filters: {
+ scanIds: ["scan-1", "scan-2"],
+ providerIds: "provider-1,provider-2",
+ providerGroups: "group-1",
+ },
+ });
+
+ expect(result).toEqual({ status: "success", response: payload });
+ const url = lastFetchUrl();
+ expect(url.pathname).toBe("/api/v1/cross-account-compliance-overviews");
+ expect(url.searchParams.get("filter[compliance_id]")).toBe("cis_2.0_aws");
+ expect(url.searchParams.get("filter[provider_type]")).toBe("aws");
+ expect(url.searchParams.get("filter[scan__in]")).toBe("scan-1,scan-2");
+ expect(url.searchParams.get("filter[provider_id__in]")).toBe(
+ "provider-1,provider-2",
+ );
+ expect(url.searchParams.get("filter[provider_groups__in]")).toBe("group-1");
+ });
+
+ it("routes PDF operations through the cross-account endpoints", async () => {
+ fetchMock
+ .mockResolvedValueOnce(
+ jsonResponse({ data: { type: "tasks", id: "task-1" } }, 202),
+ )
+ .mockResolvedValueOnce(
+ new Response(Buffer.from("pdf-bytes"), {
+ headers: {
+ "Content-Disposition": 'attachment; filename="report.pdf"',
+ "Content-Type": "application/pdf",
+ },
+ }),
+ )
+ .mockResolvedValueOnce(
+ jsonResponse({
+ data: {
+ id: "task-2",
+ attributes: { result: { filename: "latest.pdf" } },
+ },
+ }),
+ );
+
+ await generateCrossAccountPdf({
+ complianceId: "cis_2.0_aws",
+ providerType: "aws",
+ filters: { scanIds: ["scan-1"] },
+ reportName: "report.pdf",
+ });
+ await getCrossAccountPdfBinary("task-1");
+ await getLatestCrossAccountPdf({
+ complianceId: "cis_2.0_aws",
+ providerType: "aws",
+ filters: { providerIds: "provider-1" },
+ });
+
+ const generation = fetchCallAt(0);
+ expect(generation.init.method).toBe("POST");
+ expect(generation.url.pathname).toBe(
+ "/api/v1/cross-account-compliance-overviews/pdf",
+ );
+ expect(generation.url.searchParams.get("filter[compliance_id]")).toBe(
+ "cis_2.0_aws",
+ );
+ expect(generation.url.searchParams.get("filter[provider_type]")).toBe(
+ "aws",
+ );
+ expect(generation.url.searchParams.get("filter[scan__in]")).toBe("scan-1");
+ expect(generation.url.searchParams.get("report_name")).toBe("report.pdf");
+
+ const binary = fetchCallAt(1);
+ expect(binary.url.pathname).toBe(
+ "/api/v1/cross-account-compliance-overviews/pdf/task-1",
+ );
+
+ const latest = fetchCallAt(2);
+ expect(latest.url.pathname).toBe(
+ "/api/v1/cross-account-compliance-overviews/pdf/latest",
+ );
+ expect(latest.url.searchParams.get("filter[provider_id__in]")).toBe(
+ "provider-1",
+ );
+
+ expect([generation, binary, latest].every(({ init }) => init.signal)).toBe(
+ true,
+ );
+ });
+
+ it("aborts a stalled request and reports the network failure", async () => {
+ vi.useFakeTimers();
+ let requestSignal: AbortSignal | undefined;
+ fetchMock.mockImplementation(
+ (_input: RequestInfo | URL, init?: RequestInit) =>
+ new Promise((_resolve, reject) => {
+ requestSignal = init?.signal ?? undefined;
+ requestSignal?.addEventListener("abort", () => {
+ reject(requestSignal?.reason ?? new Error("aborted"));
+ });
+ }),
+ );
+
+ const request = getCrossAccountComplianceOverview({
+ complianceId: "cis_2.0_aws",
+ providerType: "aws",
+ });
+ await vi.advanceTimersByTimeAsync(30_000);
+
+ await expect(request).resolves.toEqual({
+ status: "load-error",
+ message:
+ "Could not load cross-provider compliance data. Try again later.",
+ });
+ expect(requestSignal?.aborted).toBe(true);
+ expect(captureExceptionMock).toHaveBeenCalledTimes(1);
+ });
+});
diff --git a/ui/app/(prowler)/compliance/_actions/cross-account.ts b/ui/app/(prowler)/compliance/_actions/cross-account.ts
new file mode 100644
index 0000000000..06568bba70
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_actions/cross-account.ts
@@ -0,0 +1,126 @@
+"use server";
+
+import type { ScanBinaryResult } from "@/actions/scans/scans";
+import { apiBaseUrl } from "@/lib";
+
+import {
+ generateAggregatedCompliancePdf,
+ getAggregatedComplianceOverview,
+ getAggregatedCompliancePdfBinary,
+ getLatestAggregatedCompliancePdf,
+} from "../_lib/aggregated-compliance-actions";
+import type {
+ CrossAccountApiFilters,
+ CrossAccountOverviewResponse,
+ CrossAccountOverviewResult,
+ LatestCrossProviderPdf,
+} from "../_types";
+
+const CROSS_ACCOUNT_API_PATH = "/cross-account-compliance-overviews";
+
+const applyCrossAccountParams = (
+ url: URL,
+ complianceId: string,
+ providerType: string,
+ filters?: CrossAccountApiFilters,
+) => {
+ url.searchParams.set("filter[compliance_id]", complianceId);
+ url.searchParams.set("filter[provider_type]", providerType);
+
+ if (filters?.scanIds?.length) {
+ url.searchParams.set("filter[scan__in]", filters.scanIds.join(","));
+ }
+
+ const params = {
+ "filter[provider_id__in]": filters?.providerIds,
+ "filter[provider_groups__in]": filters?.providerGroups,
+ };
+ for (const [key, value] of Object.entries(params)) {
+ if (value?.trim()) url.searchParams.set(key, value);
+ }
+};
+
+const buildCrossAccountUrl = (
+ suffix: string,
+ complianceId: string,
+ providerType: string,
+ filters?: CrossAccountApiFilters,
+) => {
+ const url = new URL(`${apiBaseUrl}${CROSS_ACCOUNT_API_PATH}${suffix}`);
+ applyCrossAccountParams(url, complianceId, providerType, filters);
+ return url;
+};
+
+export const getCrossAccountComplianceOverview = async ({
+ complianceId,
+ providerType,
+ filters,
+}: {
+ complianceId: string;
+ providerType: string;
+ filters?: CrossAccountApiFilters;
+}): Promise => {
+ const url = buildCrossAccountUrl("", complianceId, providerType, filters);
+ return getAggregatedComplianceOverview(
+ url,
+ `GET ${CROSS_ACCOUNT_API_PATH}`,
+ );
+};
+
+export const generateCrossAccountPdf = async ({
+ complianceId,
+ providerType,
+ filters,
+ reportName,
+}: {
+ complianceId: string;
+ providerType: string;
+ filters?: CrossAccountApiFilters;
+ reportName?: string;
+}): Promise<{ taskId: string } | { error: string }> => {
+ const url = buildCrossAccountUrl("/pdf", complianceId, providerType, filters);
+ if (reportName) url.searchParams.set("report_name", reportName);
+ return generateAggregatedCompliancePdf(
+ url,
+ `POST ${CROSS_ACCOUNT_API_PATH}/pdf`,
+ );
+};
+
+export const getCrossAccountPdfBinary = async (
+ taskId: string,
+): Promise => {
+ const safeTaskId = taskId.trim();
+ if (!/^[A-Za-z0-9_-]+$/.test(safeTaskId)) {
+ return { error: "Invalid task identifier." };
+ }
+
+ const url = new URL(
+ `${apiBaseUrl}${CROSS_ACCOUNT_API_PATH}/pdf/${encodeURIComponent(safeTaskId)}`,
+ );
+ return getAggregatedCompliancePdfBinary({
+ url,
+ operation: `GET ${CROSS_ACCOUNT_API_PATH}/pdf/{taskId}`,
+ defaultFilename: "cross-account-compliance.pdf",
+ });
+};
+
+export const getLatestCrossAccountPdf = async ({
+ complianceId,
+ providerType,
+ filters,
+}: {
+ complianceId: string;
+ providerType: string;
+ filters?: CrossAccountApiFilters;
+}): Promise => {
+ const url = buildCrossAccountUrl(
+ "/pdf/latest",
+ complianceId,
+ providerType,
+ filters,
+ );
+ return getLatestAggregatedCompliancePdf(
+ url,
+ `GET ${CROSS_ACCOUNT_API_PATH}/pdf/latest`,
+ );
+};
diff --git a/ui/app/(prowler)/compliance/_actions/cross-provider.ts b/ui/app/(prowler)/compliance/_actions/cross-provider.ts
index 90a81a9580..1cd9f77fac 100644
--- a/ui/app/(prowler)/compliance/_actions/cross-provider.ts
+++ b/ui/app/(prowler)/compliance/_actions/cross-provider.ts
@@ -1,119 +1,54 @@
"use server";
-import * as Sentry from "@sentry/nextjs";
-
import type { ScanBinaryResult } from "@/actions/scans/scans";
-import {
- apiBaseUrl,
- GENERIC_SERVER_ERROR_MESSAGE,
- getErrorMessage,
-} from "@/lib";
-import { hasActionError } from "@/lib/action-errors";
-import { getAuthHeaders } from "@/lib/auth-headers";
-import { handleApiResponse } from "@/lib/server-actions-helper";
-import { SentryErrorSource, SentryErrorType } from "@/sentry";
+import { apiBaseUrl } from "@/lib";
+import {
+ generateAggregatedCompliancePdf,
+ getAggregatedComplianceOverview,
+ getAggregatedCompliancePdfBinary,
+ getLatestAggregatedCompliancePdf,
+} from "../_lib/aggregated-compliance-actions";
import type {
CrossProviderApiFilters,
CrossProviderOverviewResponse,
CrossProviderOverviewResult,
LatestCrossProviderPdf,
} from "../_types";
-import {
- CROSS_PROVIDER_OVERVIEW_LOAD_ERROR_MESSAGE,
- CROSS_PROVIDER_OVERVIEW_RESULT_STATUS,
-} from "../_types";
const CROSS_PROVIDER_API_PATH = "/cross-provider-compliance-overviews";
-/** Error payload shapes the PDF endpoints emit (JSON:API or plain). */
-interface PdfEndpointErrorBody {
- errors?: Array<{ detail?: string }>;
- error?: string;
- message?: string;
-}
+const applyCrossProviderParams = (
+ url: URL,
+ complianceId: string,
+ filters?: CrossProviderApiFilters,
+) => {
+ url.searchParams.set("filter[compliance_id]", complianceId);
-/**
- * Extracts a user-safe message from a failed PDF endpoint response and, for
- * unexpected failures, reports it to Sentry. `operation` must be a STATIC
- * route template (e.g. `GET .../pdf/{taskId}`) — never the
- * resolved URL, which would carry the task id or a user-typed report name.
- */
-const getPdfEndpointErrorMessage = async (
- response: Response,
- fallbackMessage: string,
- operation: string,
-): Promise => {
- const contentType = response.headers.get("content-type")?.toLowerCase() || "";
- const errorData: PdfEndpointErrorBody | null = contentType.includes(
- "text/html",
- )
- ? null
- : await response.json().catch(() => null);
-
- // These endpoints bypass handleApiResponse (binary/task protocol), so
- // server failures would otherwise go unmonitored.
- if (response.status >= 500) {
- Sentry.captureException(
- new Error(
- `Cross-provider PDF request failed (${response.status}) at ${operation}`,
- ),
- {
- tags: {
- api_error: true,
- status_code: response.status.toString(),
- error_type: SentryErrorType.SERVER_ERROR,
- error_source: SentryErrorSource.SERVER_ACTION,
- },
- level: "error",
- contexts: {
- api_response: {
- status: response.status,
- statusText: response.statusText,
- operation,
- },
- },
- },
- );
- return GENERIC_SERVER_ERROR_MESSAGE;
- }
-
- return (
- errorData?.errors?.[0]?.detail ||
- errorData?.error ||
- errorData?.message ||
- fallbackMessage
- );
-};
-
-/** Appends the shared cross-provider filter params to a request URL. */
-const applyFilters = (url: URL, filters?: CrossProviderApiFilters) => {
- if (!filters) return;
-
- if (filters.scanIds && filters.scanIds.length > 0) {
+ if (filters?.scanIds?.length) {
url.searchParams.set("filter[scan__in]", filters.scanIds.join(","));
}
- const paramMap = {
- "filter[provider_type__in]": filters.providerTypes,
- "filter[provider_id__in]": filters.providerIds,
- "filter[provider_groups__in]": filters.providerGroups,
+ const params = {
+ "filter[provider_type__in]": filters?.providerTypes,
+ "filter[provider_id__in]": filters?.providerIds,
+ "filter[provider_groups__in]": filters?.providerGroups,
};
- for (const [key, value] of Object.entries(paramMap)) {
- if (value && value.trim().length > 0) {
- url.searchParams.set(key, value);
- }
+ for (const [key, value] of Object.entries(params)) {
+ if (value?.trim()) url.searchParams.set(key, value);
}
};
-/**
- * Aggregate a universal compliance framework across one scan per compatible
- * provider (Prowler Cloud only — the OSS API has no such endpoint).
- *
- * When `filters.scanIds` is omitted the API auto-selects the latest COMPLETED
- * scan per compatible provider. Non-2xx responses are returned as structured
- * action errors so callers can reuse the app-wide 402/403 handlers.
- */
+const buildCrossProviderUrl = (
+ suffix: string,
+ complianceId: string,
+ filters?: CrossProviderApiFilters,
+) => {
+ const url = new URL(`${apiBaseUrl}${CROSS_PROVIDER_API_PATH}${suffix}`);
+ applyCrossProviderParams(url, complianceId, filters);
+ return url;
+};
+
export const getCrossProviderComplianceOverview = async ({
complianceId,
filters,
@@ -121,45 +56,13 @@ export const getCrossProviderComplianceOverview = async ({
complianceId: string;
filters?: CrossProviderApiFilters;
}): Promise => {
- const headers = await getAuthHeaders({ contentType: false });
- const url = new URL(`${apiBaseUrl}${CROSS_PROVIDER_API_PATH}`);
- url.searchParams.set("filter[compliance_id]", complianceId);
- applyFilters(url, filters);
-
- try {
- const response = await fetch(url.toString(), { headers });
- const responseData = await handleApiResponse(response);
-
- if (hasActionError(responseData)) {
- return {
- status: CROSS_PROVIDER_OVERVIEW_RESULT_STATUS.ACTION_ERROR,
- result: responseData,
- };
- }
-
- return {
- status: CROSS_PROVIDER_OVERVIEW_RESULT_STATUS.SUCCESS,
- response: responseData as CrossProviderOverviewResponse,
- };
- } catch (error) {
- console.error("Error fetching cross-provider compliance overview:", error);
- return {
- status: CROSS_PROVIDER_OVERVIEW_RESULT_STATUS.LOAD_ERROR,
- message: CROSS_PROVIDER_OVERVIEW_LOAD_ERROR_MESSAGE,
- };
- }
+ const url = buildCrossProviderUrl("", complianceId, filters);
+ return getAggregatedComplianceOverview(
+ url,
+ `GET ${CROSS_PROVIDER_API_PATH}`,
+ );
};
-/**
- * Trigger ad-hoc generation of the combined cross-provider compliance PDF.
- *
- * The PDF is built asynchronously by a backend task: this returns the task id
- * so the caller can poll it and then download via
- * {@link getCrossProviderPdfBinary}. Pass the exact `scanIds` currently on
- * screen (`attributes.scan_ids`) so the report matches the displayed data
- * instead of re-resolving "latest scan per provider", which could race a scan
- * completing in between.
- */
export const generateCrossProviderPdf = async ({
complianceId,
filters,
@@ -167,109 +70,34 @@ export const generateCrossProviderPdf = async ({
}: {
complianceId: string;
filters?: CrossProviderApiFilters;
- /** Optional download filename; sanitized server-side. */
reportName?: string;
}): Promise<{ taskId: string } | { error: string }> => {
- const headers = await getAuthHeaders({ contentType: false });
- const url = new URL(`${apiBaseUrl}${CROSS_PROVIDER_API_PATH}/pdf`);
- url.searchParams.set("filter[compliance_id]", complianceId);
- applyFilters(url, filters);
+ const url = buildCrossProviderUrl("/pdf", complianceId, filters);
if (reportName) url.searchParams.set("report_name", reportName);
-
- try {
- const response = await fetch(url.toString(), { method: "POST", headers });
-
- if (!response.ok) {
- throw new Error(
- await getPdfEndpointErrorMessage(
- response,
- "Unable to start PDF generation. Contact support if the issue continues.",
- `POST ${CROSS_PROVIDER_API_PATH}/pdf`,
- ),
- );
- }
-
- const json = await response.json();
- const taskId = json?.data?.id;
- if (!taskId) {
- throw new Error("Unexpected response starting PDF generation.");
- }
-
- return { taskId };
- } catch (error) {
- return { error: getErrorMessage(error) };
- }
+ return generateAggregatedCompliancePdf(
+ url,
+ `POST ${CROSS_PROVIDER_API_PATH}/pdf`,
+ );
};
-/**
- * Fetch the finished cross-provider PDF for a task started by
- * {@link generateCrossProviderPdf}. Speaks the same 202-pending /
- * 2xx-binary / error-JSON protocol as the per-scan report endpoints, so it
- * returns the shared {@link ScanBinaryResult} shape and callers can reuse the
- * existing download plumbing unchanged.
- */
export const getCrossProviderPdfBinary = async (
taskId: string,
): Promise => {
- // The task id reaches the URL path: constrain it to the task-id charset
- // (UUIDs) so a crafted value cannot smuggle `/`, `..` or a host.
const safeTaskId = taskId.trim();
if (!/^[A-Za-z0-9_-]+$/.test(safeTaskId)) {
return { error: "Invalid task identifier." };
}
- const headers = await getAuthHeaders({ contentType: false });
const url = new URL(
`${apiBaseUrl}${CROSS_PROVIDER_API_PATH}/pdf/${encodeURIComponent(safeTaskId)}`,
);
-
- try {
- const response = await fetch(url.toString(), { headers });
-
- if (response.status === 202) {
- const json = await response.json();
- return {
- pending: true,
- state: json?.data?.attributes?.state,
- taskId: json?.data?.id,
- };
- }
-
- if (!response.ok) {
- throw new Error(
- await getPdfEndpointErrorMessage(
- response,
- "Unable to retrieve the compliance PDF report. Contact support if the issue continues.",
- `GET ${CROSS_PROVIDER_API_PATH}/pdf/{taskId}`,
- ),
- );
- }
-
- const contentDisposition =
- response.headers.get("content-disposition") || "";
- const filenameMatch = contentDisposition.match(/filename="?([^";]+)"?/i);
- const filename = filenameMatch?.[1] || "cross-provider-compliance.pdf";
-
- const arrayBuffer = await response.arrayBuffer();
- const base64 = Buffer.from(arrayBuffer).toString("base64");
-
- return { success: true, data: base64, filename };
- } catch (error) {
- return { error: getErrorMessage(error) };
- }
+ return getAggregatedCompliancePdfBinary({
+ url,
+ operation: `GET ${CROSS_PROVIDER_API_PATH}/pdf/{taskId}`,
+ defaultFilename: "cross-provider-compliance.pdf",
+ });
};
-/**
- * Check whether a cross-provider PDF already exists for the given filters so
- * the UI can offer "Download" immediately instead of forcing a re-generate.
- *
- * 404 means "not generated yet" — a normal state, returned as `null` rather
- * than an error. The backend only matches reports built from the exact scan
- * set the filters resolve to, so a report goes stale (→ `null`) as soon as a
- * contributing provider completes a new scan. Failures also degrade to
- * `null`: this is an optional availability check and the caller's fallback
- * (show "Generate") is always safe.
- */
export const getLatestCrossProviderPdf = async ({
complianceId,
filters,
@@ -277,39 +105,9 @@ export const getLatestCrossProviderPdf = async ({
complianceId: string;
filters?: CrossProviderApiFilters;
}): Promise => {
- const headers = await getAuthHeaders({ contentType: false });
- const url = new URL(`${apiBaseUrl}${CROSS_PROVIDER_API_PATH}/pdf/latest`);
- url.searchParams.set("filter[compliance_id]", complianceId);
- applyFilters(url, filters);
-
- try {
- const response = await fetch(url.toString(), { headers });
-
- if (response.status === 404) return null;
-
- if (!response.ok) {
- throw new Error(
- await getPdfEndpointErrorMessage(
- response,
- "Unable to check for an existing PDF report.",
- `GET ${CROSS_PROVIDER_API_PATH}/pdf/latest`,
- ),
- );
- }
-
- const json = await response.json();
- const taskId = json?.data?.id;
- if (!taskId) return null;
-
- return {
- taskId,
- filename: json?.data?.attributes?.result?.filename,
- completedAt: json?.data?.attributes?.completed_at,
- };
- } catch (error) {
- // Degraded on purpose, but logged: without this a systematically failing
- // endpoint would be indistinguishable from "never generated".
- console.error("Error checking for an existing cross-provider PDF:", error);
- return null;
- }
+ const url = buildCrossProviderUrl("/pdf/latest", complianceId, filters);
+ return getLatestAggregatedCompliancePdf(
+ url,
+ `GET ${CROSS_PROVIDER_API_PATH}/pdf/latest`,
+ );
};
diff --git a/ui/app/(prowler)/compliance/_components/aggregated-compliance-detail.test.tsx b/ui/app/(prowler)/compliance/_components/aggregated-compliance-detail.test.tsx
new file mode 100644
index 0000000000..08643b3937
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_components/aggregated-compliance-detail.test.tsx
@@ -0,0 +1,141 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+
+import { AggregatedComplianceDetail } from "./aggregated-compliance-detail";
+
+vi.mock("@/components/compliance", () => ({
+ ClientAccordionWrapper: () => ,
+ RequirementsStatusCard: () => ,
+ TopFailedSectionsCard: () => ,
+}));
+
+describe("AggregatedComplianceDetail", () => {
+ it("stacks actions on mobile and keeps the link after the title on desktop", () => {
+ // Given / When
+ const { container } = render(
+ CSA Cloud Controls Matrix}
+ description={(
+ '[data-slot="aggregated-compliance-header"]',
+ );
+ const heading = container.querySelector(
+ '[data-slot="aggregated-compliance-heading"]',
+ );
+ const title = container.querySelector(
+ '[data-slot="aggregated-compliance-title"]',
+ );
+ const description = container.querySelector(
+ '[data-slot="aggregated-compliance-description"]',
+ );
+ const headerLink = container.querySelector(
+ '[data-slot="aggregated-compliance-header-link"]',
+ );
+ const reportAction = container.querySelector(
+ '[data-slot="aggregated-compliance-report-action"]',
+ );
+ if (
+ !header ||
+ !heading ||
+ !title ||
+ !description ||
+ !headerLink ||
+ !reportAction
+ ) {
+ throw new Error("Expected every aggregated compliance header region");
+ }
+
+ expect(header).toHaveClass("sm:grid-cols-[auto_minmax(0,1fr)_auto]");
+ expect(heading).toHaveClass(
+ "contents",
+ "sm:grid",
+ "sm:grid-cols-[minmax(0,max-content)_auto]",
+ "sm:items-center",
+ "sm:justify-start",
+ "sm:gap-x-4",
+ );
+ expect(heading).toContainElement(title);
+ expect(heading).toContainElement(description);
+ expect(heading).toContainElement(headerLink);
+ expect(title).toHaveClass(
+ "col-start-2",
+ "row-start-1",
+ "min-w-0",
+ "truncate",
+ );
+ expect(description).toHaveClass("col-span-2", "row-start-2");
+ expect(headerLink).toHaveClass("col-span-2", "row-start-3");
+ expect(reportAction).toHaveClass(
+ "col-span-2",
+ "row-start-4",
+ "sm:col-start-3",
+ );
+
+ const orderedElements = [
+ logo,
+ title,
+ description,
+ headerLink,
+ reportAction,
+ ];
+ orderedElements.slice(0, -1).forEach((element, index) => {
+ expect(
+ element.compareDocumentPosition(orderedElements[index + 1]!) &
+ Node.DOCUMENT_POSITION_FOLLOWING,
+ ).toBeTruthy();
+ });
+ });
+
+ it("places the report directly after information when no header link exists", () => {
+ // Given / When
+ const { container } = render(
+ Custom Framework}
+ description={["src"];
+ title: ReactNode;
+ description: ReactNode;
+ headerLink?: ReactNode;
+ reportAction: ReactNode;
+ filters: ReactNode;
+ totals: RequirementsTotals;
+ coverage: ReactNode;
+ topFailed: ComponentProps;
+ accordionItems: AccordionItemProps[];
+ initialExpandedKeys: string[];
+}
+
+export const AggregatedComplianceDetail = ({
+ compliancetitle,
+ logoPath,
+ title,
+ description,
+ headerLink,
+ reportAction,
+ filters,
+ totals,
+ coverage,
+ topFailed,
+ accordionItems,
+ initialExpandedKeys,
+}: AggregatedComplianceDetailProps) => (
+ = (event) => {
+ if (event.key === "Enter" || event.key === " ") {
+ event.preventDefault();
+ onActivate();
+ }
+ };
+ const logo = getComplianceIcon(frameworkTitle);
+ const title = (
+
+
+
+
+ );
+};
diff --git a/ui/app/(prowler)/compliance/_components/aggregated-requirement-content.tsx b/ui/app/(prowler)/compliance/_components/aggregated-requirement-content.tsx
new file mode 100644
index 0000000000..e3975b36d7
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_components/aggregated-requirement-content.tsx
@@ -0,0 +1,32 @@
+"use client";
+
+import { ClientAccordionContent } from "@/components/compliance/compliance-accordion/client-accordion-content";
+import type { CheckProviderTypesMap, Requirement } from "@/types/compliance";
+
+interface AggregatedRequirementContentProps {
+ requirement: Requirement;
+ framework: string;
+ scanIds: string[];
+ emptyMessage: string;
+ checkProviders?: CheckProviderTypesMap;
+}
+
+export const AggregatedRequirementContent = ({
+ requirement,
+ framework,
+ scanIds,
+ emptyMessage,
+ checkProviders,
+}: AggregatedRequirementContentProps) => {
+ if (scanIds.length === 0) return Per scan content
}
- crossProviderContent={5 of 5 compatible providers scanned
} + headerLink={View on Prowler Hub} + reportAction={} + filters={Filters
}
+ totals={{ pass: 1, fail: 2, manual: 3 }}
+ coverage={Coverage
}
+ topFailed={{ sections: [], dataType: "sections" }}
+ accordionItems={[]}
+ initialExpandedKeys={[]}
+ />,
+ );
+
+ // Then
+ const logo = screen.getByAltText("CSA-CCM logo");
+ const header = container.querySelector2 accounts aggregated
} + reportAction={} + filters={Filters
}
+ totals={{ pass: 1, fail: 2, manual: 3 }}
+ coverage={Coverage
}
+ topFailed={{ sections: [], dataType: "sections" }}
+ accordionItems={[]}
+ initialExpandedKeys={[]}
+ />,
+ );
+
+ // Then
+ expect(
+ container.querySelector('[data-slot="aggregated-compliance-title"]'),
+ ).toHaveClass("col-start-1", "row-start-1");
+ expect(
+ container.querySelector(
+ '[data-slot="aggregated-compliance-description"]',
+ ),
+ ).toHaveClass("col-start-1", "row-start-2");
+ expect(
+ container.querySelector(
+ '[data-slot="aggregated-compliance-report-action"]',
+ ),
+ ).toHaveClass("col-start-1", "row-start-3");
+ expect(
+ container.querySelector(
+ '[data-slot="aggregated-compliance-header-link"]',
+ ),
+ ).not.toBeInTheDocument();
+ });
+});
diff --git a/ui/app/(prowler)/compliance/_components/aggregated-compliance-detail.tsx b/ui/app/(prowler)/compliance/_components/aggregated-compliance-detail.tsx
new file mode 100644
index 0000000000..1a6380cee5
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_components/aggregated-compliance-detail.tsx
@@ -0,0 +1,160 @@
+import Image from "next/image";
+import type { ComponentProps, ReactNode } from "react";
+
+import {
+ ClientAccordionWrapper,
+ RequirementsStatusCard,
+ TopFailedSectionsCard,
+} from "@/components/compliance";
+import type { AccordionItemProps } from "@/components/shadcn/accordion/Accordion";
+import { Card } from "@/components/shadcn/card/card";
+import { cn } from "@/lib/utils";
+import type { RequirementsTotals } from "@/types/compliance";
+
+interface AggregatedComplianceDetailProps {
+ compliancetitle: string;
+ logoPath?: ComponentProps
+
+
+
+
+);
diff --git a/ui/app/(prowler)/compliance/_components/aggregated-framework-card.tsx b/ui/app/(prowler)/compliance/_components/aggregated-framework-card.tsx
new file mode 100644
index 0000000000..6c71db3822
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_components/aggregated-framework-card.tsx
@@ -0,0 +1,85 @@
+import Image from "next/image";
+import type { KeyboardEventHandler, ReactNode } from "react";
+
+import { getComplianceIcon } from "@/components/icons/compliance/IconCompliance";
+import { Card, CardContent } from "@/components/shadcn/card/card";
+import {
+ Tooltip,
+ TooltipContent,
+ TooltipTrigger,
+} from "@/components/shadcn/tooltip";
+
+interface AggregatedFrameworkCardProps {
+ frameworkTitle: string;
+ formattedTitle: string;
+ ariaLabel: string;
+ onActivate: () => void;
+ subtitle: ReactNode;
+ tooltip?: string;
+ children: ReactNode;
+}
+
+export const AggregatedFrameworkCard = ({
+ frameworkTitle,
+ formattedTitle,
+ ariaLabel,
+ onActivate,
+ subtitle,
+ tooltip,
+ children,
+}: AggregatedFrameworkCardProps) => {
+ const handleKeyDown: KeyboardEventHandler
+
+
+ {logoPath && (
+
+ {filters}
+
+
+ )}
+ {headerLink ? (
+
+
+ ) : (
+ <>
+
+ {title}
+
+
+ {description}
+
+
+ {headerLink}
+
+
+ {title}
+
+
+ {description}
+
+
+ )}
+
+ {reportAction}
+
+
+
+
+ {formattedTitle}
+ ); + + return ( +
+
+
+ {logo && (
+
+ {children}
+
+
+ )}
+
+ {tooltip ? (
+
+ {title}
+ {tooltip}
+
+ ) : (
+ title
+ )}
+ {subtitle}
+
+ {emptyMessage}
; + + return ( +Cross provider content
}
- />,
- );
-
- await user.click(screen.getByRole("tab", { name: /cross-provider/i }));
- expect(pushMock).toHaveBeenCalledWith("/compliance?tab=cross-provider");
-
- rerender(
+ it("renders Multiple Scans as the first tab", () => {
+ render(
Cross provider content
}
+ />,
+ );
+
+ await user.click(screen.getByRole("tab", { name: /single scan/i }));
+ expect(pushMock).toHaveBeenCalledWith("/compliance?tab=per-scan");
+
+ rerender(
+ Cross provider content
}
+ />,
+ );
+
+ await user.click(screen.getByRole("tab", { name: /multiple scans/i }));
expect(pushMock).toHaveBeenCalledWith("/compliance");
});
@@ -79,7 +108,7 @@ describe("CompliancePageTabs", () => {
);
const crossProviderTab = screen.getByRole("tab", {
- name: /cross-provider/i,
+ name: /multiple scans/i,
});
await user.click(crossProviderTab);
diff --git a/ui/app/(prowler)/compliance/_components/compliance-page-tabs.tsx b/ui/app/(prowler)/compliance/_components/compliance-page-tabs.tsx
index 79e5d8af00..6fc7112bce 100644
--- a/ui/app/(prowler)/compliance/_components/compliance-page-tabs.tsx
+++ b/ui/app/(prowler)/compliance/_components/compliance-page-tabs.tsx
@@ -10,10 +10,10 @@ import {
TabsList,
TabsTrigger,
} from "@/components/shadcn";
+import { buildPerScanComplianceHref } from "@/lib/compliance/compliance-tab-url";
import { useCloudUpgradeStore } from "@/store";
import { CLOUD_UPGRADE_FEATURE } from "@/types/cloud-upgrade";
-
-import { COMPLIANCE_TAB, type ComplianceTab } from "../_types";
+import { COMPLIANCE_TAB, type ComplianceTab } from "@/types/compliance";
interface CompliancePageTabsProps {
activeTab: ComplianceTab;
@@ -47,42 +47,43 @@ export const CompliancePageTabs = ({
return;
}
- // Per Scan renders without the query param so existing bookmarks and
- // shared links keep resolving to the default view.
- if (typedTab === COMPLIANCE_TAB.PER_SCAN) {
- router.push("/compliance");
- } else {
- router.push(`/compliance?tab=${typedTab}`);
- }
+ // Multiple Scans is the landing view, so it owns the bare route; Single
+ // Scan pins `?tab=` to stay linkable.
+ router.push(
+ typedTab === COMPLIANCE_TAB.CROSS_PROVIDER
+ ? "/compliance"
+ : buildPerScanComplianceHref(),
+ );
};
return (
- // Same layout spacing as the scans view tabs (scans-page-shell.tsx).
-
+
- {perScanContent}
-
-
- {crossProviderContent}
-
+
+ {crossProviderContent}
+
+
+ {perScanContent}
+
+
+
+ Cloud
+ ) : undefined
+ }
+ >
+ Multiple Scans
+
+
+ Single Scan
+
+
+
-
+
+
+
+
+ {providerType}:{complianceId}
+
+ ),
+}));
+
+// Only the fields the section reads; the full ProviderProps shape is not
+// needed for these tests.
+type ProvidersResponse = Awaited
+ {entries.map((entry) => (
+
+ ),
+ items: [],
+ };
+ });
+
+ return (
+
- {/* Header card — same structure as the per-scan detail: identity row
- (logo + context) with the report action top-right, filters below
- (lighthouse-settings card pattern). */}
-
-
-
-
+
);
};
diff --git a/ui/app/(prowler)/compliance/_components/cross-provider-filters.tsx b/ui/app/(prowler)/compliance/_components/cross-provider-filters.tsx
index 44c477837b..8e1ae405a8 100644
--- a/ui/app/(prowler)/compliance/_components/cross-provider-filters.tsx
+++ b/ui/app/(prowler)/compliance/_components/cross-provider-filters.tsx
@@ -31,8 +31,10 @@ export interface CrossProviderGroupOption {
}
interface CrossProviderFiltersProps {
- /** Provider types offered by the visible universal frameworks. */
- providerTypes: readonly KnownProviderType[];
+ /** Provider types offered by the visible universal frameworks. Omit (or
+ * pass empty) to hide the type select — the cross-account detail does,
+ * since its provider type is fixed by the framework being viewed. */
+ providerTypes?: readonly KnownProviderType[];
providerAccounts: CrossProviderAccountOption[];
providerGroups: CrossProviderGroupOption[];
}
@@ -89,14 +91,16 @@ export const CrossProviderFilters = ({
}: CrossProviderFiltersProps) => {
return (
-
+ {attrs.name || compliancetitle.split("-").join(" ")}
+
+ }
+ description={
+
-
-
-
+ <>
+
- {logoPath && (
-
-
-
- )}
-
-
-
-
- {attrs.name || compliancetitle.split("-").join(" ")}
-
-
- - {attrs.providers.length} of {compatibleTypes.length}{" "} - compatible providers scanned · {attrs.scan_ids.length}{" "} - {attrs.scan_ids.length === 1 ? "scan" : "scans"} aggregated -
-
-
- + {attrs.providers.length} of {compatibleTypes.length} compatible + providers scanned · {attrs.scan_ids.length}{" "} + {attrs.scan_ids.length === 1 ? "scan" : "scans"} aggregated +
+ } + headerLink={
-
-
-
- ({
- value: type,
- label: PROVIDER_DISPLAY_NAMES[type],
- }))}
- />
+ {providerTypes && providerTypes.length > 0 && (
+ ({
+ value: type,
+ label: PROVIDER_DISPLAY_NAMES[type],
+ }))}
+ />
+ )}
{
- if (event.key === "Enter" || event.key === " ") {
- event.preventDefault();
- navigateToDetail();
- }
- }}
+
+
+ {requirementsPassed} / {totalRequirements}
+
+ Passing Requirements
+
+ }
>
-
-
-
- {getComplianceIcon(title) && (
-
-
-
-
- )}
-
-
-
-
- {description}
-
-
-
- {requirementsPassed} / {totalRequirements}
-
- Passing Requirements
-
-
- - {formattedTitle} -
-
-
-
-
-
- Score:
-
-
- {ratingPercentage}%
-
-
-
-
-
+
- {providerBreakdown.map((entry) => (
-
-
-
-
-
- {PROVIDER_DISPLAY_NAMES[entry.provider]}
- {entry.unscanned
- ? " — no completed scan yet"
- : ` — ${entry.score}% passing`}
-
-
- ))}
-
-
- {requirementsFailed} failed · {requirementsManual} manual
-
-
+
+
+
+
+ Score:
+
+
+ {ratingPercentage}%
+
-
-
+
+
+
+
);
};
diff --git a/ui/app/(prowler)/compliance/_components/cross-provider-overview.tsx b/ui/app/(prowler)/compliance/_components/cross-provider-overview.tsx
index d115ed4e0e..4c93ef2153 100644
--- a/ui/app/(prowler)/compliance/_components/cross-provider-overview.tsx
+++ b/ui/app/(prowler)/compliance/_components/cross-provider-overview.tsx
@@ -2,7 +2,20 @@ import { AlertTriangle, Info } from "lucide-react";
import { getAllProviderGroups } from "@/actions/manage-groups/manage-groups";
import { getAllProviders } from "@/actions/providers";
+import { LighthouseContextContributor } from "@/components/lighthouse/context-contributor";
import { Alert, AlertDescription } from "@/components/shadcn/alert";
+import {
+ Section,
+ SectionContent,
+ SectionDescription,
+ SectionHeader,
+ SectionTitle,
+} from "@/components/shadcn/section/section";
+import {
+ LIGHTHOUSE_COMPLIANCE_CONTEXT_MODE,
+ LIGHTHOUSE_CONTEXT_CONTRIBUTOR_LIMIT,
+} from "@/lib/lighthouse/context/constants";
+import { buildComplianceContext } from "@/lib/lighthouse/context/contributions";
import { SearchParamsProps } from "@/types";
import type { KnownProviderType } from "@/types/providers";
@@ -151,6 +164,24 @@ export const CrossProviderOverview = async ({
return (
+ {providerBreakdown.map((entry) => (
+
+
+
+
+
+ {PROVIDER_DISPLAY_NAMES[entry.provider]}
+ {entry.unscanned
+ ? " — no completed scan yet"
+ : ` — ${entry.score}% passing`}
+
+
+ ))}
+
+
+ {requirementsFailed} failed · {requirementsManual} manual
+
+
+ {summaries
+ .slice(0, LIGHTHOUSE_CONTEXT_CONTRIBUTOR_LIMIT.AFTER_PAGE)
+ .map((summary) => (
+
)}
-
+
+ Across provider types
+
+ Universal frameworks aggregated across every compatible provider
+ type, using the latest completed scan of each provider.
+
+
+
+
+
);
};
diff --git a/ui/app/(prowler)/compliance/_components/cross-provider-pdf-button.test.tsx b/ui/app/(prowler)/compliance/_components/cross-provider-pdf-button.test.tsx
index 2f04c202db..12b74a41bf 100644
--- a/ui/app/(prowler)/compliance/_components/cross-provider-pdf-button.test.tsx
+++ b/ui/app/(prowler)/compliance/_components/cross-provider-pdf-button.test.tsx
@@ -27,14 +27,18 @@ beforeAll(() => {
const {
generatePdfMock,
+ generateAccountPdfMock,
trackAndPollMock,
downloadPdfMock,
+ downloadAccountPdfMock,
toastMock,
storeState,
} = vi.hoisted(() => ({
generatePdfMock: vi.fn(),
+ generateAccountPdfMock: vi.fn(),
trackAndPollMock: vi.fn(),
downloadPdfMock: vi.fn(),
+ downloadAccountPdfMock: vi.fn(),
toastMock: vi.fn(),
storeState: {
tasks: {} as Record<
@@ -54,6 +58,10 @@ vi.mock("../_actions/cross-provider", () => ({
generateCrossProviderPdf: generatePdfMock,
}));
+vi.mock("../_actions/cross-account", () => ({
+ generateCrossAccountPdf: generateAccountPdfMock,
+}));
+
vi.mock("../_lib/cross-provider-pdf", () => ({
CROSS_PROVIDER_PDF_TASK_KIND: "cross-provider-pdf",
buildCrossProviderPdfTaskScope: vi.fn(() => "scope-1"),
@@ -61,6 +69,13 @@ vi.mock("../_lib/cross-provider-pdf", () => ({
crossProviderPdfHandler: { onReady: vi.fn(), onError: vi.fn() },
}));
+vi.mock("../_lib/cross-account-pdf", () => ({
+ CROSS_ACCOUNT_PDF_TASK_KIND: "cross-account-pdf",
+ buildCrossAccountPdfTaskScope: vi.fn(() => "account-scope-1"),
+ downloadCrossAccountPdf: downloadAccountPdfMock,
+ crossAccountPdfHandler: { onReady: vi.fn(), onError: vi.fn() },
+}));
+
vi.mock("@/store/task-watcher/store", () => ({
TASK_WATCHER_STATUS: { PENDING: "pending", READY: "ready", ERROR: "error" },
trackAndPollTask: trackAndPollMock,
@@ -205,6 +220,56 @@ describe("CrossProviderPdfButton", () => {
await waitFor(() => expect(downloadPdfMock).toHaveBeenCalledWith("task-8"));
});
+ it("switches to the cross-account plumbing when providerType is set", async () => {
+ // Given
+ generateAccountPdfMock.mockResolvedValue({ taskId: "task-acc-1" });
+ const user = userEvent.setup();
+ render(
- {summaries.map((summary) => (
-
+
+ {summaries.map((summary) => (
+
+