lula2 0.4.0-nightly.0 → 0.5.0-nightly.0

package/dist/cli/server/spreadsheetRoutes.js

@@ -7,7 +7,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { glob } from "glob";
 import * as yaml4 from "js-yaml";
 import multer from "multer";
-import { dirname, join, relative } from "path";
+import { dirname, join as join2, relative } from "path";
 
 // cli/utils/debug.ts
 var debugEnabled = false;
@@ -17,6 +17,9 @@ function debug(...args) {
   }
 }
 
+// cli/server/serverState.ts
+import { join } from "path";
+
 // cli/server/infrastructure/fileStore.ts
 import * as yaml2 from "js-yaml";
 
@@ -37,6 +40,10 @@ function getServerState() {
   }
   return serverState;
 }
+function getCurrentControlSetPath() {
+  const state = getServerState();
+  return state.currentSubdir === "." ? state.CONTROL_SET_DIR : join(state.CONTROL_SET_DIR, state.currentSubdir);
+}
 
 // cli/server/spreadsheetRoutes.ts
 var router = express.Router();
@@ -55,7 +62,7 @@ async function scanControlSets() {
     maxDepth: 5
   });
   const controlSets = files.map((file) => {
-    const fullPath = join(baseDir, file);
+    const fullPath = join2(baseDir, file);
     const dirPath = dirname(fullPath);
     const relativePath = relative(baseDir, dirPath) || ".";
     try {
@@ -225,7 +232,7 @@ router.post("/import-spreadsheet", upload.single("file"), async (req, res) => {
     }
     const state = getServerState();
     const folderName = toKebabCase(controlSetName || "imported-controls");
-    const baseDir = join(state.CONTROL_SET_DIR || process.cwd(), folderName);
+    const baseDir = join2(state.CONTROL_SET_DIR || process.cwd(), folderName);
     if (!existsSync(baseDir)) {
       mkdirSync(baseDir, { recursive: true });
     }
@@ -348,12 +355,12 @@ router.post("/import-spreadsheet", upload.single("file"), async (req, res) => {
       families: uniqueFamilies,
       fieldSchema
     };
-    writeFileSync(join(baseDir, "lula.yaml"), yaml4.dump(controlSetData));
-    const controlsDir = join(baseDir, "controls");
-    const mappingsDir = join(baseDir, "mappings");
+    writeFileSync(join2(baseDir, "lula.yaml"), yaml4.dump(controlSetData));
+    const controlsDir = join2(baseDir, "controls");
+    const mappingsDir = join2(baseDir, "mappings");
     families.forEach((familyControls, family) => {
-      const familyDir = join(controlsDir, family);
-      const familyMappingsDir = join(mappingsDir, family);
+      const familyDir = join2(controlsDir, family);
+      const familyMappingsDir = join2(mappingsDir, family);
       if (!existsSync(familyDir)) {
         mkdirSync(familyDir, { recursive: true });
       }
@@ -368,9 +375,9 @@ router.post("/import-spreadsheet", upload.single("file"), async (req, res) => {
         }
         const controlIdStr = String(controlId).slice(0, 50);
         const fileName2 = `${controlIdStr.replace(/[^a-zA-Z0-9-]/g, "_")}.yaml`;
-        const filePath = join(familyDir, fileName2);
+        const filePath = join2(familyDir, fileName2);
         const mappingFileName = `${controlIdStr.replace(/[^a-zA-Z0-9-]/g, "_")}-mappings.yaml`;
-        const mappingFilePath = join(familyMappingsDir, mappingFileName);
+        const mappingFilePath = join2(familyMappingsDir, mappingFileName);
         const filteredControl = {};
         const mappingData = {
           control_id: controlIdStr,
@@ -508,6 +515,7 @@ function extractFamilyFromControlId(controlId) {
 router.get("/export-controls", async (req, res) => {
   try {
     const format = req.query.format || "csv";
+    const mappingsColumn = req.query.mappingsColumn || "Mappings";
     const state = getServerState();
     const fileStore = state.fileStore;
     if (!fileStore) {
@@ -517,7 +525,8 @@ router.get("/export-controls", async (req, res) => {
     const mappings = await fileStore.loadMappings();
     let metadata = {};
     try {
-      const metadataPath = join(state.CONTROL_SET_DIR, "lula.yaml");
+      const controlSetPath = getCurrentControlSetPath();
+      const metadataPath = join2(controlSetPath, "lula.yaml");
       if (existsSync(metadataPath)) {
         const metadataContent = readFileSync(metadataPath, "utf8");
         metadata = yaml4.load(metadataContent);
@@ -545,10 +554,10 @@ router.get("/export-controls", async (req, res) => {
     debug(`Exporting ${controlsWithMappings.length} controls as ${format}`);
     switch (format.toLowerCase()) {
       case "csv":
-        return exportAsCSV(controlsWithMappings, metadata, res);
+        return exportAsCSV(controlsWithMappings, metadata, mappingsColumn, res);
       case "excel":
       case "xlsx":
-        return await exportAsExcel(controlsWithMappings, metadata, res);
+        return await exportAsExcel(controlsWithMappings, metadata, mappingsColumn, res);
       case "json":
         return exportAsJSON(controlsWithMappings, metadata, res);
       default:
@@ -559,7 +568,10 @@ router.get("/export-controls", async (req, res) => {
     res.status(500).json({ error: error.message });
   }
 });
-function exportAsCSV(controls, metadata, res) {
+function exportAsCSV(controls, metadata, mappingsColumn, res) {
+  return exportAsCSVWithMapping(controls, metadata, { mappings: mappingsColumn }, res);
+}
+function exportAsCSVWithMapping(controls, metadata, columnMappings, res) {
   const fieldSchema = metadata?.fieldSchema?.fields || {};
   const controlIdField = metadata?.control_id_field || "id";
   const allFields = /* @__PURE__ */ new Set();
@@ -567,49 +579,91 @@ function exportAsCSV(controls, metadata, res) {
     Object.keys(control).forEach((key) => allFields.add(key));
   });
   const fieldMapping = [];
+  const usedDisplayNames = /* @__PURE__ */ new Set();
   if (allFields.has(controlIdField)) {
     const idSchema = fieldSchema[controlIdField];
-    fieldMapping.push({
-      fieldName: controlIdField,
-      displayName: idSchema?.original_name || "Control ID"
-    });
+    const displayName = idSchema?.original_name || "Control ID";
+    let isMappingColumn = false;
+    if (columnMappings["mappings"]) {
+      const targetDisplayName = columnMappings["mappings"];
+      if (displayName.toLowerCase() === targetDisplayName.toLowerCase()) {
+        isMappingColumn = true;
+      }
+    }
+    fieldMapping.push({ fieldName: controlIdField, displayName, isMappingColumn });
+    usedDisplayNames.add(displayName.toLowerCase());
     allFields.delete(controlIdField);
   } else if (allFields.has("id")) {
-    fieldMapping.push({
-      fieldName: "id",
-      displayName: "Control ID"
-    });
+    let isMappingColumn = false;
+    const displayName = "Control ID";
+    if (columnMappings["mappings"]) {
+      const targetDisplayName = columnMappings["mappings"];
+      if (displayName.toLowerCase() === targetDisplayName.toLowerCase()) {
+        isMappingColumn = true;
+      }
+    }
+    fieldMapping.push({ fieldName: "id", displayName, isMappingColumn });
+    usedDisplayNames.add("control id");
     allFields.delete("id");
   }
   if (allFields.has("family")) {
     const familySchema = fieldSchema["family"];
-    fieldMapping.push({
-      fieldName: "family",
-      displayName: familySchema?.original_name || "Family"
-    });
+    const displayName = familySchema?.original_name || "Family";
+    fieldMapping.push({ fieldName: "family", displayName });
+    usedDisplayNames.add(displayName.toLowerCase());
     allFields.delete("family");
   }
   Array.from(allFields).filter((field) => field !== "mappings" && field !== "mappings_count").sort().forEach((field) => {
     const schema = fieldSchema[field];
-    const displayName = schema?.original_name || field.replace(/-/g, " ").replace(/\b\w/g, (l) => l.toUpperCase());
-    fieldMapping.push({ fieldName: field, displayName });
+    const defaultDisplayName = schema?.original_name || field.replace(/-/g, " ").replace(/\b\w/g, (l) => l.toUpperCase());
+    let isMappingColumn = false;
+    let finalDisplayName = defaultDisplayName;
+    if (columnMappings["mappings"]) {
+      const targetDisplayName = columnMappings["mappings"];
+      if (defaultDisplayName.toLowerCase() === targetDisplayName.toLowerCase()) {
+        isMappingColumn = true;
+        finalDisplayName = targetDisplayName;
+      }
+    }
+    if (!usedDisplayNames.has(finalDisplayName.toLowerCase())) {
+      fieldMapping.push({
+        fieldName: field,
+        displayName: finalDisplayName,
+        isMappingColumn
+      });
+      usedDisplayNames.add(finalDisplayName.toLowerCase());
+    }
   });
-  if (allFields.has("mappings_count")) {
-    fieldMapping.push({ fieldName: "mappings_count", displayName: "Mappings Count" });
-  }
-  if (allFields.has("mappings")) {
+  if (allFields.has("mappings") && (!columnMappings["mappings"] || columnMappings["mappings"] === "Mappings")) {
     fieldMapping.push({ fieldName: "mappings", displayName: "Mappings" });
   }
   const csvRows = [];
   csvRows.push(fieldMapping.map((field) => `"${field.displayName}"`).join(","));
   controls.forEach((control) => {
-    const row = fieldMapping.map(({ fieldName }) => {
-      const value = control[fieldName];
+    const row = fieldMapping.map(({ fieldName, isMappingColumn }) => {
+      let value;
+      if (isMappingColumn) {
+        const mappingsValue = control["mappings"];
+        if (Array.isArray(mappingsValue) && mappingsValue.length > 0) {
+          const mappingsStr = mappingsValue.map((m) => m.description || m.justification || "").filter((desc) => desc && desc.trim() !== "").join("\n");
+          if (mappingsStr.trim() !== "") {
+            value = mappingsStr;
+          } else {
+            value = control[fieldName];
+          }
+        } else {
+          value = control[fieldName];
+        }
+      } else {
+        value = control[fieldName];
+      }
       if (value === void 0 || value === null) return '""';
       if (fieldName === "mappings" && Array.isArray(value)) {
-        const mappingsStr = value.map(
-          (m) => `${m.status}: ${m.description.substring(0, 50)}${m.description.length > 50 ? "..." : ""}`
-        ).join("; ");
+        const mappingsStr = value.map((m) => {
+          const justification = m.description || m.justification || "";
+          const status = m.status || "Unknown";
+          return justification.trim() !== "" ? justification : `[${status}]`;
+        }).join("\n");
         return `"${mappingsStr.replace(/"/g, '""')}"`;
       }
       if (Array.isArray(value)) return `"${value.join("; ").replace(/"/g, '""')}"`;
@@ -624,32 +678,101 @@ function exportAsCSV(controls, metadata, res) {
   res.setHeader("Content-Disposition", `attachment; filename="${fileName}"`);
   res.send(csvContent);
 }
-async function exportAsExcel(controls, metadata, res) {
+async function exportAsExcel(controls, metadata, mappingsColumn, res) {
+  return await exportAsExcelWithMapping(controls, metadata, { mappings: mappingsColumn }, res);
+}
+async function exportAsExcelWithMapping(controls, metadata, columnMappings, res) {
   const fieldSchema = metadata?.fieldSchema?.fields || {};
   const controlIdField = metadata?.control_id_field || "id";
+  const allFields = /* @__PURE__ */ new Set();
+  controls.forEach((control) => {
+    Object.keys(control).forEach((key) => allFields.add(key));
+  });
+  const fieldMapping = [];
+  const usedDisplayNames = /* @__PURE__ */ new Set();
+  if (allFields.has(controlIdField)) {
+    const idSchema = fieldSchema[controlIdField];
+    const displayName = idSchema?.original_name || "Control ID";
+    let isMappingColumn = false;
+    if (columnMappings["mappings"]) {
+      const targetDisplayName = columnMappings["mappings"];
+      if (displayName.toLowerCase() === targetDisplayName.toLowerCase()) {
+        isMappingColumn = true;
+      }
+    }
+    fieldMapping.push({ fieldName: controlIdField, displayName, isMappingColumn });
+    usedDisplayNames.add(displayName.toLowerCase());
+    allFields.delete(controlIdField);
+  } else if (allFields.has("id")) {
+    let isMappingColumn = false;
+    const displayName = "Control ID";
+    if (columnMappings["mappings"]) {
+      const targetDisplayName = columnMappings["mappings"];
+      if (displayName.toLowerCase() === targetDisplayName.toLowerCase()) {
+        isMappingColumn = true;
+      }
+    }
+    fieldMapping.push({ fieldName: "id", displayName, isMappingColumn });
+    usedDisplayNames.add("control id");
+    allFields.delete("id");
+  }
+  if (allFields.has("family")) {
+    const familySchema = fieldSchema["family"];
+    const displayName = familySchema?.original_name || "Family";
+    fieldMapping.push({ fieldName: "family", displayName });
+    usedDisplayNames.add(displayName.toLowerCase());
+    allFields.delete("family");
+  }
+  Array.from(allFields).filter((field) => field !== "mappings" && field !== "mappings_count").sort().forEach((field) => {
+    const schema = fieldSchema[field];
+    const defaultDisplayName = schema?.original_name || field.replace(/-/g, " ").replace(/\b\w/g, (l) => l.toUpperCase());
+    let isMappingColumn = false;
+    let finalDisplayName = defaultDisplayName;
+    if (columnMappings["mappings"]) {
+      const targetDisplayName = columnMappings["mappings"];
+      if (defaultDisplayName.toLowerCase() === targetDisplayName.toLowerCase()) {
+        isMappingColumn = true;
+        finalDisplayName = targetDisplayName;
+      }
+    }
+    if (!usedDisplayNames.has(finalDisplayName.toLowerCase())) {
+      fieldMapping.push({
+        fieldName: field,
+        displayName: finalDisplayName,
+        isMappingColumn
+      });
+      usedDisplayNames.add(finalDisplayName.toLowerCase());
+    }
+  });
+  if (allFields.has("mappings") && (!columnMappings["mappings"] || columnMappings["mappings"] === "Mappings")) {
+    fieldMapping.push({ fieldName: "mappings", displayName: "Mappings" });
+  }
   const worksheetData = controls.map((control) => {
     const exportControl = {};
-    if (control[controlIdField]) {
-      const idSchema = fieldSchema[controlIdField];
-      const idDisplayName = idSchema?.original_name || "Control ID";
-      exportControl[idDisplayName] = control[controlIdField];
-    } else if (control.id) {
-      exportControl["Control ID"] = control.id;
-    }
-    if (control.family) {
-      const familySchema = fieldSchema["family"];
-      const familyDisplayName = familySchema?.original_name || "Family";
-      exportControl[familyDisplayName] = control.family;
-    }
-    Object.keys(control).forEach((key) => {
-      if (key === controlIdField || key === "id" || key === "family") return;
-      const schema = fieldSchema[key];
-      const displayName = schema?.original_name || (key === "mappings_count" ? "Mappings Count" : key === "mappings" ? "Mappings" : key.replace(/-/g, " ").replace(/\b\w/g, (l) => l.toUpperCase()));
-      const value = control[key];
-      if (key === "mappings" && Array.isArray(value)) {
-        exportControl[displayName] = value.map(
-          (m) => `${m.status}: ${m.description.substring(0, 100)}${m.description.length > 100 ? "..." : ""}`
-        ).join("\n");
+    fieldMapping.forEach(({ fieldName, displayName, isMappingColumn }) => {
+      let value;
+      if (isMappingColumn) {
+        const mappingsValue = control["mappings"];
+        if (Array.isArray(mappingsValue) && mappingsValue.length > 0) {
+          const mappingsStr = mappingsValue.map((m) => m.description || m.justification || "").filter((desc) => desc && desc.trim() !== "").join("\n");
+          if (mappingsStr.trim() !== "") {
+            value = mappingsStr;
+          } else {
+            value = control[fieldName];
+          }
+        } else {
+          value = control[fieldName];
+        }
+      } else {
+        value = control[fieldName];
+      }
+      if (fieldName === "mappings" && Array.isArray(value)) {
+        const mappingsStr = value.map((m) => {
+          const justification = m.description || m.justification || "";
+          const status = m.status || "Unknown";
+          return justification.trim() !== "" ? justification : `[${status}]`;
+        }).join("\n");
+        exportControl[displayName] = mappingsStr;
       } else if (Array.isArray(value)) {
         exportControl[displayName] = value.join("; ");
       } else if (typeof value === "object" && value !== null) {
@@ -717,6 +840,106 @@ function exportAsJSON(controls, metadata, res) {
   res.setHeader("Content-Disposition", `attachment; filename="${fileName}"`);
   res.json(exportData);
 }
+router.get("/export-column-headers", async (req, res) => {
+  try {
+    let metadata = {};
+    try {
+      const controlSetPath = getCurrentControlSetPath();
+      const metadataPath = join2(controlSetPath, "lula.yaml");
+      if (existsSync(metadataPath)) {
+        const metadataContent = readFileSync(metadataPath, "utf8");
+        metadata = yaml4.load(metadataContent);
+      } else {
+        return res.status(404).json({ error: `No lula.yaml file found in control set path: ${controlSetPath}` });
+      }
+    } catch {
+      return res.status(500).json({ error: "Failed to read lula.yaml file" });
+    }
+    const fieldSchema = metadata?.fieldSchema?.fields || {};
+    const controlIdField = metadata?.control_id_field || "id";
+    const columnHeaders = [];
+    if (fieldSchema[controlIdField]) {
+      const idSchema = fieldSchema[controlIdField];
+      const displayName = idSchema?.original_name || "Control ID";
+      columnHeaders.push({
+        value: displayName,
+        label: displayName
+      });
+    } else {
+      columnHeaders.push({ value: "Control ID", label: "Control ID" });
+    }
+    if (fieldSchema["family"]) {
+      const familySchema = fieldSchema["family"];
+      const displayName = familySchema?.original_name || "Family";
+      columnHeaders.push({
+        value: displayName,
+        label: displayName
+      });
+    }
+    Object.entries(fieldSchema).forEach(([fieldName, schema]) => {
+      if (fieldName === controlIdField || fieldName === "family" || fieldName === "mappings" || fieldName === "mappings_count") {
+        return;
+      }
+      const displayName = schema?.original_name || fieldName.replace(/-/g, " ").replace(/\b\w/g, (l) => l.toUpperCase());
+      columnHeaders.push({
+        value: displayName,
+        label: displayName
+      });
+    });
+    columnHeaders.push({ value: "Mappings", label: "Mappings (Default)" });
+    res.json({
+      columnHeaders,
+      defaultColumn: "Mappings"
+    });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+router.post("/export-csv", async (req, res) => {
+  try {
+    const { format = "csv", _columns = [], columnMappings = {} } = req.body;
+    const state = getServerState();
+    const fileStore = state.fileStore;
+    if (!fileStore) {
+      return res.status(500).json({ error: "No control set loaded" });
+    }
+    const controls = await fileStore.loadAllControls();
+    const mappings = await fileStore.loadMappings();
+    let metadata = {};
+    try {
+      const controlSetPath = getCurrentControlSetPath();
+      const metadataPath = join2(controlSetPath, "lula.yaml");
+      if (existsSync(metadataPath)) {
+        const metadataContent = readFileSync(metadataPath, "utf8");
+        metadata = yaml4.load(metadataContent);
+      }
+    } catch (err) {
+      debug("Could not load metadata:", err);
+    }
+    if (!controls || controls.length === 0) {
+      return res.status(404).json({ error: "No controls found" });
+    }
+    const controlIdField = metadata?.control_id_field || "id";
+    const controlsWithMappings = controls.map((control) => {
+      const controlId = control[controlIdField] || control.id;
+      const controlMappings = mappings.filter((m) => m.control_id === controlId);
+      return {
+        ...control,
+        mappings_count: controlMappings.length,
+        mappings: controlMappings.map((m) => ({
+          uuid: m.uuid,
+          status: m.status,
+          description: m.justification || ""
+        }))
+      };
+    });
+    debug(`Exporting ${controlsWithMappings.length} controls as ${format} with column mappings`);
+    return exportAsCSVWithMapping(controlsWithMappings, metadata, columnMappings, res);
+  } catch (error) {
+    console.error("Export error:", error);
+    res.status(500).json({ error: error.message });
+  }
+});
 router.post("/parse-excel", upload.single("file"), async (req, res) => {
   try {
     if (!req.file) {