umbermark-cli 1.0.0rc1__py3-none-any.whl

umbermark/core/accepted.py

@@ -0,0 +1,61 @@
+"""Accepted risks: a finding the owner has decided to live with, with a reason and an expiry (UMBR-66).
+
+The stored scan is never rewritten. The raw score stays what the scanner measured; the "score with accepted risks"
+is computed at read time from the scan's own deductions, leaving out the points of every check that has an active
+(unexpired) acceptance on that server. When an acceptance expires it simply stops applying.
+
+Only the owner's pages show it. A public /r share link keeps the raw score and says nothing about acceptances
+(their reasons may describe internal decisions).
+"""
+from __future__ import annotations
+
+import datetime as dt
+import re
+from dataclasses import dataclass
+
+from umbermark.core.scoring import _band
+
+CHECK_ID_RE = re.compile(r"^[a-z0-9_]{1,64}$")
+REASON_MAX = 500
+DURATIONS_DAYS: tuple[int, ...] = (30, 90, 180, 365)  # the choices the form offers; no open-ended acceptance
+
+
+@dataclass(frozen=True, slots=True)
+class Adjusted:
+    score: int
+    band: str
+    points_back: int  # points the accepted checks cost in the raw score
+    accepted: tuple[str, ...]  # check ids that were left out (only those the scan actually deducted for)
+
+
+def expires_at(days: int, now: dt.datetime | None = None) -> str:
+    now = now or dt.datetime.now(dt.UTC)
+    return (now + dt.timedelta(days=days)).isoformat()
+
+
+def is_active(expires_iso: str, now: dt.datetime | None = None) -> bool:
+    now = now or dt.datetime.now(dt.UTC)
+    try:
+        exp = dt.datetime.fromisoformat(expires_iso)
+    except ValueError:
+        return False  # unreadable expiry: treat as expired (fail closed: the raw score applies)
+    if exp.tzinfo is None:
+        exp = exp.replace(tzinfo=dt.UTC)
+    return exp > now
+
+
+def adjust(payload: dict, accepted_ids: set[str], coverage: float) -> Adjusted | None:
+    """The score with `accepted_ids` left out, or None when no accepted check cost points in this scan.
+
+    Rebuilt from the scan's own deduction list (100 minus every remaining deduction, clamped to 0..100), so it
+    matches the scoring engine exactly. The band follows the engine's rule, including 'incomplete' on low coverage.
+    """
+    deductions = (payload.get("result") or {}).get("deductions") or []
+    hit = tuple(sorted({d.get("check_id", "") for d in deductions
+                        if d.get("check_id") in accepted_ids and int(d.get("points_lost", 0) or 0) > 0}))
+    if not hit:
+        return None
+    kept = sum(int(d.get("points_lost", 0) or 0) for d in deductions if d.get("check_id") not in accepted_ids)
+    back = sum(int(d.get("points_lost", 0) or 0) for d in deductions if d.get("check_id") in accepted_ids)
+    score = max(0, min(100, 100 - kept))
+    return Adjusted(score=score, band=_band(score, coverage), points_back=back, accepted=hit)