wulf-pulse/lib/services/remediation-default-params.ts
lorentz 14ed8ca248 feat(23-01): add USER_AWARENESS verdict + acknowledge_user action mapping
- Add USER_AWARENESS to the Verdict union in campaign-classifier.ts
- mapVerdictToActions('USER_AWARENESS') returns ['acknowledge_user']; not added to DESTRUCTIVE_ACTIONS so requires_approval computes false
- classifyCampaign's simulation branch now assigns verdict = 'USER_AWARENESS' directly instead of falling through to evaluateSpamVsUnwanted
- deriveDefaultParams('acknowledge_user') returns {} (no operator-editable params)
- Widen TriageNoteEvidence.verdict to admit 'USER_AWARENESS' (pure type widen, no formatting change)
- Tests: classifier simulation fixtures now assert USER_AWARENESS/acknowledge_user/requiresApproval=false; new mapVerdictToActions/computeRequiresApproval/deriveDefaultParams cases
2026-07-16 19:36:53 -04:00

44 lines
1.6 KiB
TypeScript

/**
* Remediation Default-Params Derivation (Phase 22, Wave 0)
*
* Pure transform: given an action type (from campaign-classifier.ts's
* `mapVerdictToActions` vocabulary) and bounded evidence fields, returns the
* default `params` object an operator sees pre-filled in the Action Area
* before approving (feeds `ApproveActionInput.params` in
* lib/services/remediation-service.ts). No DB/fetch imports — pure function.
*/
export interface DefaultParamEvidence {
requesterEmail: string | null;
senderEmail: string | null;
senderDomain: string | null;
messageId: string | null;
}
/**
* Exhaustive per-action-type default-params table (UI-SPEC Action Area
* Spec). Unknown/future action types fall through to `{}` rather than
* throwing, so newly introduced action types never break the Action Area.
*/
export function deriveDefaultParams(actionType: string, evidence: DefaultParamEvidence): Record<string, unknown> {
switch (actionType) {
case 'no_action':
return {};
case 'warn_user':
return { recipientEmail: evidence.requesterEmail ?? '', message: '' };
case 'block_sender':
return { senderEmail: evidence.senderEmail ?? '', senderDomain: evidence.senderDomain ?? '' };
case 'purge_message':
return { messageId: evidence.messageId ?? '', mailboxes: [] };
case 'reset_password':
return { userPrincipalName: evidence.requesterEmail ?? '' };
case 'isolate_endpoint':
return { deviceId: '' };
case 'disable_forwarding_rule':
return { userPrincipalName: evidence.requesterEmail ?? '', ruleName: '' };
case 'acknowledge_user':
return {};
default:
return {};
}
}