cisagov / cyhy-system

Cyber Hygiene system and overall documentation/issue tracking
Creative Commons Zero v1.0 Universal
6 stars 0 forks source link

International Stakeholders Not Included in Stakeholders Export #66

Open climber-girl opened 2 years ago

climber-girl commented 2 years ago

πŸ› Summary

Based on the way the report templates are pushed to stakeholders, International had to be created as its own category (any children under the "Federal" hierarchy receive the Federal VS report template, meaning some third party report sharers and international stakeholders were mistakenly receiving the Federal VS report layout). Fusion Dev recommended creating a new category for those being impacted by this.

The CyHy VS team created an INTERNATIONAL category with sub-categories that we've placed the international stakeholders into (similar to how FEDERAL stakeholders get placed in a sub-category). However, the Stakeholder Report (stakeholders.csv) that gets exported from the CyHy Dashboard (localhost:4200) no longer includes the organizations moved under any International sub-categories. Third party sharers are not impacted as the third party profiles they are sub-orged under are not considered stakeholders and wouldn't be expected to be seen in the Stakeholder Report.

To reproduce

Steps to reproduce the behavior:

  1. List-all-descendants of INTERNATIONAL
  2. Export the stakeholders.csv from the dashboard
  3. Note that the majority of international stakeholders are not included in the exported file (oddly there are three that were previously listed as Private, have been corrected both by category and in agency.type, but which continue to show as Private)

Expected behavior

Any request doc where stakeholder=true should be included in the stakeholders.csv export from the dashboard regardless of the agency.type or category they are sub-orged under. If their agency.type=INTERNATIONAL, column G (Organization Type) should reflect such.

mcdonnnj commented 2 years ago

I believe that this function creates the CSV. It relies on this method which in turn uses this Enumerator to determine what it pulls from the database. I think adding INTERNATIONAL as a new agency type is the "path forward" here, but it would need heavy testing because this code is used in a number of places.

climber-girl commented 2 years ago

@mcdonnnj could we somehow simplify to not use the enumerator and instead just report out what the agency.type reads in the stakeholder's request doc? Hoping that might be relatively easy and then not have to depend on any lengthy testing for impacts to other places that use the enumerator

mcdonnnj commented 2 years ago

@climber-girl The Enumerator is used to "discover" the organizations that are ultimately added to the CSV in this particular case. Changing that would require a rewrite of how that CSV is built as tight now it is leveraging existing functions to populate the CSV. Due to the interactions I think a rewrite of this functionality creates more problems than it solves. The current work to resolve this is essentially a single line change and then testing to ensure there are no unexpected side effects in scanning orchestration and report generation. A rewrite would involve testing different datasets to ensure that everything populates as expected with the new logic, and that new logic would likely be re-implementing a lot of what is already leveraged in the first place.

king-alexander commented 2 years ago

I made the change on my local copy of cyhy-core. When I get a chance, I'll start testing.

mcdonnnj commented 2 years ago

@king-alexander I forgot that last month I made this branch if you wanted to work out of that to test so you can just add commits if you notice any necessary changes.

king-alexander commented 2 years ago

@mcdonnnj I didn't see any issues while generating reports -- one anonymized sample and one international stakeholder. Let me know if there's anything else report-wise you want me to try.