feat: DORA ROI report and multiple new concepts for third parties

backend/core/migrations/0112_asset_is_critical.py

@@ -0,0 +1,17 @@
+# Generated by Django 5.2.7 on 2025-11-07 17:17
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("core", "0111_finding_priority"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="asset",
+            name="is_critical",
+            field=models.BooleanField(default=False, verbose_name="is_critical"),
+        ),
+    ]

backend/core/models.py

@@ -2149,6 +2149,8 @@ class Type(models.TextChoices):
     is_published = models.BooleanField(_("published"), default=True)
     observation = models.TextField(null=True, blank=True, verbose_name=_("Observation"))
 
+    is_critical = models.BooleanField("is_critical", default=False)
+
     fields_to_check = ["name"]
 
     class Meta:

backend/core/serializers.py

@@ -14,6 +14,7 @@
 )
 from core.utils import time_state
 from ebios_rm.models import EbiosRMStudy, Stakeholder
+from tprm.models import Solution
 from global_settings.utils import ff_is_enabled
 from iam.models import *
 from django.contrib.auth.models import Permission
@@ -390,6 +391,11 @@ class AssetWriteSerializer(BaseModelSerializer):
         queryset=Asset.objects.all(),
         required=False,
     )
+    solutions = serializers.PrimaryKeyRelatedField(
+        many=True,
+        queryset=Solution.objects.all(),
+        required=False,
+    )
 
     class Meta:
         model = Asset
@@ -454,6 +460,7 @@ class AssetReadSerializer(AssetWriteSerializer):
     personal_data = FieldsRelatedField(many=True)
     asset_class = FieldsRelatedField(["name"])
     overridden_children_capabilities = FieldsRelatedField(many=True)
+    solutions = FieldsRelatedField(many=True)
 
     children_assets = serializers.SerializerMethodField()
     security_objectives = serializers.SerializerMethodField()

backend/core/startup.py

@@ -34,6 +34,7 @@
     "view_riskmatrix",
     "view_riskscenario",
     "view_solution",
+    "view_contract",
     "view_storedlibrary",
     "view_threat",
     "view_vulnerability",
@@ -175,6 +176,7 @@
     "add_riskassessment",
     "add_riskscenario",
     "add_solution",
+    "add_contract",
     "add_threat",
     "add_vulnerability",
     "change_appliedcontrol",
@@ -193,6 +195,7 @@
     "change_riskassessment",
     "change_riskscenario",
     "change_solution",
+    "change_contract",
     "change_threat",
     "delete_appliedcontrol",
     "delete_asset",
@@ -209,6 +212,7 @@
     "delete_riskassessment",
     "delete_riskscenario",
     "delete_solution",
+    "delete_contract",
     "delete_threat",
     "view_appliedcontrol",
     "view_asset",
@@ -233,6 +237,7 @@
     "view_riskmatrix",
     "view_riskscenario",
     "view_solution",
+    "view_contract",
     "view_storedlibrary",
     "view_threat",
     "view_user",
@@ -414,6 +419,7 @@
     "add_riskmatrix",
     "add_riskscenario",
     "add_solution",
+    "add_contract",
     "add_threat",
     "change_appliedcontrol",
     "change_asset",
@@ -432,6 +438,7 @@
     "change_riskmatrix",
     "change_riskscenario",
     "change_solution",
+    "change_contract",
     "change_threat",
     "delete_appliedcontrol",
     "delete_asset",
@@ -453,6 +460,7 @@
     "delete_vulnerability",
     "delete_riskscenario",
     "delete_solution",
+    "delete_contract",
     "delete_threat",
     "view_appliedcontrol",
     "view_asset",
@@ -476,6 +484,7 @@
     "view_riskmatrix",
     "view_riskscenario",
     "view_solution",
+    "view_contract",
     "view_storedlibrary",
     "view_threat",
     "view_user",
@@ -770,6 +779,10 @@
     "change_solution",
     "view_solution",
     "delete_solution",
+    "add_contract",
+    "change_contract",
+    "view_contract",
+    "delete_contract",
     "add_entityassessment",
     "change_entityassessment",
     "view_entityassessment",

backend/core/urls.py

@@ -4,6 +4,7 @@
     RepresentativeViewSet,
     SolutionViewSet,
     EntityAssessmentViewSet,
+    ContractViewSet,
 )
 from library.views import StoredLibraryViewSet, LoadedLibraryViewSet
 import importlib
@@ -23,6 +24,7 @@
 )
 router.register(r"solutions", SolutionViewSet, basename="solutions")
 router.register(r"representatives", RepresentativeViewSet, basename="representatives")
+router.register(r"contracts", ContractViewSet, basename="contracts")
 router.register(r"perimeters", PerimeterViewSet, basename="perimeters")
 router.register(r"risk-matrices", RiskMatrixViewSet, basename="risk-matrices")
 router.register(r"vulnerabilities", VulnerabilityViewSet, basename="vulnerabilities")

backend/core/views.py

@@ -675,6 +675,7 @@ class Meta:
             "filtering_labels",
             "asset_class",
             "personal_data",
+            "is_critical",
         ]
 
 
@@ -5796,6 +5797,7 @@ class EvidenceViewSet(BaseModelViewSet):
         "owner",
         "status",
         "expiry_date",
+        "contracts",
     ]
 
     @action(detail=False, name="Get all evidences owners")

backend/tprm/migrations/0008_entity_legal_identifiers.py

@@ -0,0 +1,22 @@
+# Generated by Django 5.2.7 on 2025-11-07 18:56
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("tprm", "0007_entity_relationship"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="entity",
+            name="legal_identifiers",
+            field=models.JSONField(
+                blank=True,
+                default=dict,
+                help_text="Legal identifiers (LEI, EUID, VAT, DUNS, etc.)",
+                verbose_name="Legal identifiers",
+            ),
+        ),
+    ]

backend/tprm/migrations/0009_contract.py

@@ -0,0 +1,139 @@
+# Generated by Django 5.2.7 on 2025-11-07 20:57
+
+import django.db.models.deletion
+import iam.models
+import uuid
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("core", "0112_asset_is_critical"),
+        ("iam", "0016_folder_filtering_labels"),
+        ("tprm", "0008_entity_legal_identifiers"),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="Contract",
+            fields=[
+                (
+                    "id",
+                    models.UUIDField(
+                        default=uuid.uuid4,
+                        editable=False,
+                        primary_key=True,
+                        serialize=False,
+                    ),
+                ),
+                (
+                    "created_at",
+                    models.DateTimeField(auto_now_add=True, verbose_name="Created at"),
+                ),
+                (
+                    "updated_at",
+                    models.DateTimeField(auto_now=True, verbose_name="Updated at"),
+                ),
+                (
+                    "is_published",
+                    models.BooleanField(default=False, verbose_name="published"),
+                ),
+                ("name", models.CharField(max_length=200, verbose_name="Name")),
+                (
+                    "description",
+                    models.TextField(blank=True, null=True, verbose_name="Description"),
+                ),
+                (
+                    "status",
+                    models.CharField(
+                        choices=[
+                            ("draft", "Draft"),
+                            ("active", "Active"),
+                            ("expired", "Expired"),
+                            ("terminated", "Terminated"),
+                        ],
+                        default="draft",
+                        max_length=20,
+                        verbose_name="Status",
+                    ),
+                ),
+                (
+                    "start_date",
+                    models.DateField(blank=True, null=True, verbose_name="Start date"),
+                ),
+                (
+                    "end_date",
+                    models.DateField(blank=True, null=True, verbose_name="End date"),
+                ),
+                (
+                    "ref_id",
+                    models.CharField(
+                        blank=True,
+                        help_text="Contract reference number or identifier",
+                        max_length=255,
+                        verbose_name="Reference ID",
+                    ),
+                ),
+                (
+                    "entities",
+                    models.ManyToManyField(
+                        blank=True,
+                        help_text="Entities involved in this contract",
+                        related_name="contracts",
+                        to="tprm.entity",
+                        verbose_name="Entities",
+                    ),
+                ),
+                (
+                    "evidences",
+                    models.ManyToManyField(
+                        blank=True,
+                        help_text="Supporting evidence for this contract",
+                        related_name="contracts",
+                        to="core.evidence",
+                        verbose_name="Evidences",
+                    ),
+                ),
+                (
+                    "filtering_labels",
+                    models.ManyToManyField(
+                        blank=True, to="core.filteringlabel", verbose_name="Labels"
+                    ),
+                ),
+                (
+                    "folder",
+                    models.ForeignKey(
+                        default=iam.models.Folder.get_root_folder_id,
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="%(class)s_folder",
+                        to="iam.folder",
+                    ),
+                ),
+                (
+                    "owner",
+                    models.ManyToManyField(
+                        blank=True,
+                        related_name="contracts",
+                        to=settings.AUTH_USER_MODEL,
+                        verbose_name="Owner",
+                    ),
+                ),
+                (
+                    "solutions",
+                    models.ManyToManyField(
+                        blank=True,
+                        help_text="Solutions covered by this contract",
+                        related_name="contracts",
+                        to="tprm.solution",
+                        verbose_name="Solutions",
+                    ),
+                ),
+            ],
+            options={
+                "verbose_name": "Contract",
+                "verbose_name_plural": "Contracts",
+            },
+        ),
+    ]