@x12i/map-store-playground 0.1.2 → 0.1.3

package/README.md

@@ -38,3 +38,5 @@ createPlaygroundServer({
 ```
 
 Product-specific catalogs (e.g. Synapix UI flows / how-to guides) stay in the consumer app.
+
+The **Tenant queries** group holds the two POST routes the Pre-AI pages use on top of the working products: `findings:query` (scanner severity, CVSS, KEV, EPSS) and `vulnerabilities:briefing` (ranked CVE hubs). Both take the covering pair from `working/bootstrap`. The matching client calls are `queryFindings` and `fetchVulnerabilitiesBriefing` in `@x12i/map-store-client`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@x12i/map-store-playground",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Map-store /map-store/v1 catalog and response previews for @x12i/api-playground",
   "type": "module",
   "license": "UNLICENSED",

package/src/catalog.js

@@ -11,6 +11,7 @@ export const groups = [
   { id: "objects", label: "Objects" },
   { id: "investigation", label: "Investigation packets" },
   { id: "counts", label: "Counts (Countex)" },
+  { id: "queries", label: "Tenant queries" },
   { id: "advanced", label: "Advanced / lab" },
 ];
 
@@ -778,4 +779,116 @@ export const endpoints = [
     responseViews: ["json"],
     submitLabel: "Fetch (lab only)",
   }),
+
+  ep({
+    id: "findings-query",
+    group: "queries",
+    name: "Findings query",
+    method: "POST",
+    path: "/map-store/v1/tenants/{tenant}/findings:query",
+    family: "queries",
+    summary: "Scanner fields for the open vulnerability findings of one covering pair.",
+    purpose:
+      "Severity, CVSS, KEV, EPSS, and the vendor description for the open vulnerability findings. The catalog joins these onto the walked findings-query rows by finding id and by CVE id.",
+    useWhen: ["Vulnerability catalog rows", "CVE panel scanner facts"],
+    avoidWhen: ["Do not send current, latest, or scs:… as pins", HONESTY.opaqueTokens],
+    internalFlow: [
+      { title: "Pin", description: "snapshotSetId and analysisSnapshotId come from the session bootstrap." },
+      { title: "Query", description: "Open vulnerability findings, JSON, up to the limit." },
+    ],
+    requestUi: {
+      tenant: {
+        label: "tenant",
+        description: "Tenant segment. The Pre-AI app sends tgi.",
+        section: "primary",
+        order: 1,
+        required: true,
+        type: "path",
+        default: "tgi",
+      },
+      body: {
+        label: "JSON body",
+        description: "Covering pair from bootstrap, plus the open vulnerability filter.",
+        section: "primary",
+        order: 2,
+        required: true,
+        type: "json",
+        example: JSON.stringify(
+          {
+            snapshotSetId: "ss:…",
+            analysisSnapshotId: "as:…",
+            status: "open",
+            findingType: "vulnerability",
+            format: "json",
+            limit: 200,
+          },
+          null,
+          2
+        ),
+      },
+    },
+    inputs: [
+      { name: "tenant", required: true, meaning: "Tenant id", type: "path", default: "tgi" },
+      { name: "body", required: true, meaning: "Findings query body", type: "json" },
+    ],
+    responseDescription: "items[] of findings with severity, cvssScore, kevListed, epss, exprtRating, description, descriptionStatus.",
+    responseViews: ["preview", "json"],
+    submitLabel: "Run query",
+  }),
+
+  ep({
+    id: "vulnerabilities-briefing",
+    group: "queries",
+    name: "Vulnerabilities briefing",
+    method: "POST",
+    path: "/map-store/v1/tenants/{tenant}/vulnerabilities:briefing",
+    family: "queries",
+    summary: "Ranked CVE hubs for one covering pair.",
+    purpose:
+      "relevantCriticals[] ranked by host count, plus gaps. The CVE catalog paints these before the walked cve-catalog and the bundled CVE text. A gap id of gap:soes:cve-name-unavailable means the vendor gave no description.",
+    useWhen: ["CVE board", "CVE panel header"],
+    avoidWhen: ["Do not invent a description when descriptionStatus is VENDOR_NOT_PROVIDED"],
+    internalFlow: [
+      { title: "Pin", description: "snapshotSetId and analysisSnapshotId come from the session bootstrap." },
+      { title: "Brief", description: "Open vulnerability findings, rolled up to the relevant criticals." },
+    ],
+    requestUi: {
+      tenant: {
+        label: "tenant",
+        description: "Tenant segment. The Pre-AI app sends tgi.",
+        section: "primary",
+        order: 1,
+        required: true,
+        type: "path",
+        default: "tgi",
+      },
+      body: {
+        label: "JSON body",
+        description: "Covering pair from bootstrap, plus how many hubs to return.",
+        section: "primary",
+        order: 2,
+        required: true,
+        type: "json",
+        example: JSON.stringify(
+          {
+            snapshotSetId: "ss:…",
+            analysisSnapshotId: "as:…",
+            status: "open",
+            findingType: "vulnerability",
+            format: "json",
+            relevantLimit: 10,
+          },
+          null,
+          2
+        ),
+      },
+    },
+    inputs: [
+      { name: "tenant", required: true, meaning: "Tenant id", type: "path", default: "tgi" },
+      { name: "body", required: true, meaning: "Briefing body", type: "json" },
+    ],
+    responseDescription: "briefing.relevantCriticals[] and briefing.gaps[].",
+    responseViews: ["preview", "json"],
+    submitLabel: "Run briefing",
+  }),
 ];