From 849b0c6d23c77adf5132a38711d784f174d71595 Mon Sep 17 00:00:00 2001 From: ogt Date: Wed, 15 Jul 2026 11:36:38 +0800 Subject: [PATCH] fix(iwooos): correlate canonical ansible candidates --- .../iwooos_security_asset_control_plane.py | 20 ++++++++++++++++++- ...est_iwooos_security_asset_control_plane.py | 3 +++ 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/apps/api/src/services/iwooos_security_asset_control_plane.py b/apps/api/src/services/iwooos_security_asset_control_plane.py index 826b801de..68ed4315b 100644 --- a/apps/api/src/services/iwooos_security_asset_control_plane.py +++ b/apps/api/src/services/iwooos_security_asset_control_plane.py @@ -1959,7 +1959,25 @@ class IwoooSSecurityAssetControlPlaneService: NULLIF(route.incident_id::text, ''), NULLIF(route.input ->> 'incident_id', '') ) IS NOT NULL - AND NULLIF(route.input ->> 'catalog_id', '') IS NOT NULL) + AND ( + NULLIF(route.input ->> 'catalog_id', '') IS NOT NULL + OR EXISTS ( + SELECT 1 + FROM jsonb_array_elements( + CASE + WHEN jsonb_typeof( + route.input -> 'executor_candidates' + ) = 'array' + THEN route.input -> 'executor_candidates' + ELSE '[]'::jsonb + END + ) candidate(candidate_payload) + WHERE NULLIF( + candidate.candidate_payload ->> 'catalog_id', + '' + ) IS NOT NULL + ) + )) AS correlated_controlled_route_count_24h, (SELECT count(*) FROM incident_evidence verifier WHERE verifier.collected_at >= NOW() - INTERVAL '24 hours' diff --git a/apps/api/tests/test_iwooos_security_asset_control_plane.py b/apps/api/tests/test_iwooos_security_asset_control_plane.py index f121075f2..9e724ed12 100644 --- a/apps/api/tests/test_iwooos_security_asset_control_plane.py +++ b/apps/api/tests/test_iwooos_security_asset_control_plane.py @@ -744,6 +744,9 @@ def test_service_bounds_source_concurrency_for_database_budget(monkeypatch) -> N ) assert "correlated_controlled_route_count_24h" in siem_query assert "ansible_candidate_matched" in siem_query + assert "jsonb_array_elements" in siem_query + assert "executor_candidates" in siem_query + assert "candidate_payload ->> 'catalog_id'" in siem_query assert "independent_verifier_pass_count_24h" in siem_query assert "all_postconditions_passed" in siem_query assert "executor_returncode_trusted" in siem_query