13 KiB
13 KiB
| phase | plan | type | wave | depends_on | files_modified | autonomous | requirements | must_haves | ||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| quick-260721-n49 | 01 | execute | 1 |
|
true |
|
|
Purpose: classifyCampaign() runs automatically on ticket creation/webhook and persists verdict+confidence to classifications. Today, any company with its own mimecast_tenants row has its auto-classification computed against the WRONG tenant's Mimecast data — a silent, systemic false-"clean" signal (verified live against ticket 700716 / company 29683407 "Seubert and Associates"). The correct, already-shipped, already-tested pattern lives in app/api/phishing/campaigns/[id]/route.ts (marked "Bug 2 (D-05)") — mirror it, do not invent a new one.
Output: gatherCampaignEvidence() threads company_id through and resolves a per-company tenant client exactly as the route does; tests cover both the tenant-scoped and global-fallback branches.
<execution_context> @$HOME/.claude/get-shit-done/workflows/execute-plan.md @$HOME/.claude/get-shit-done/templates/summary.md </execution_context>
@.planning/STATE.mdThe file to fix (evidence-gathering path only): @lib/services/campaign-classifier.ts
The ALREADY-CORRECT reference to mirror (tenant-resolution block, roughly lines 256-313, "Bug 2 (D-05)"): @app/api/phishing/campaigns/[id]/route.ts
From lib/services/mimecast-client.ts:
export function getMimecastClientForTenant(tenant: {
client_id: string;
client_secret: string;
base_url?: string;
}): MimecastClient;
From lib/services/mimecast-blast-radius.ts:
export async function getBlastRadius(
input: { sender: string; recipient: string; subject: string; dateWindow: { start: Date; end: Date } },
options?: { client?: MimecastClient; cacheScope?: string }
): Promise<BlastRadiusResult>;
// When options is omitted, falls back to the global env-configured getMimecastClient()
// (gated by isMimecastConfigured()). This is the current classifier behavior for ALL companies.
The exact tenant row shape + query used by the route (mirror verbatim):
interface MimecastTenantRow {
client_id: string;
client_secret: string;
base_url: string | null;
}
// SELECT client_id, client_secret, base_url
// FROM mimecast_tenants
// WHERE company_id = $1 AND enabled = true
// ORDER BY id LIMIT 1
Route's tenantOptions build (mirror verbatim in the classifier):
let tenantOptions: { client: ReturnType<typeof getMimecastClientForTenant>; cacheScope: string } | undefined;
if (primaryReport.companyId) {
const tenantRes = await postgresClient.query<MimecastTenantRow>(/* query above */, [primaryReport.companyId]);
const tenantRow = tenantRes.rows[0];
if (tenantRow) {
tenantOptions = {
client: getMimecastClientForTenant({
client_id: tenantRow.client_id,
client_secret: tenantRow.client_secret,
base_url: tenantRow.base_url ?? undefined,
}),
cacheScope: primaryReport.companyId,
};
}
}
1. Add `import { getMimecastClientForTenant } from './mimecast-client';` (relative sibling import — this file already imports getBlastRadius from './mimecast-blast-radius' the same way).
2. Add a local `MimecastTenantRow` interface matching the route's shape ({ client_id: string; client_secret: string; base_url: string | null }).
3. Extend the `ReportDbRow` interface with `company_id: string | null` and add `r.company_id::text AS company_id` to the reports SELECT list in gatherCampaignEvidence().
4. Extend `CampaignReportSummary` with `companyId: string | null` and set it in the `reportsRes.rows.map(...)` mapping (`companyId: r.company_id`).
5. Inside the `if (primaryReport) { ... }` branch, BEFORE the `getBlastRadius(...)` call, build `tenantOptions` exactly as the route does: if `primaryReport.companyId` is truthy, query `mimecast_tenants` (`WHERE company_id = $1 AND enabled = true ORDER BY id LIMIT 1`), and if a row exists, build the client via `getMimecastClientForTenant({ client_id, client_secret, base_url: tenantRow.base_url ?? undefined })` with `cacheScope: primaryReport.companyId`.
6. Pass `tenantOptions` as the second argument to `getBlastRadius(...)`. Keep the existing input object (sender/recipient/subject/dateWindow) untouched. When tenantOptions is undefined, passing it as the second arg is equivalent to today's no-arg call — getBlastRadius already treats `options?.client` and `options?.cacheScope` as optional; the global fallback is preserved.
Judgment note on the optional shared helper (`resolveMimecastTenantOptions(companyId)`): default to an equivalent inline block in the classifier — it is the safe drop-in and matches the route's own inline style. Only extract a shared helper if it is a clean, behavior-preserving drop-in for BOTH call sites; if extracting would require editing the route's already-correct/already-tested block in any behavior-affecting way, do NOT extract — leave the route alone and keep the classifier's block inline.
Add a short inline comment tagging this as the same "Bug 2 (D-05)" per-company tenant resolution mirrored from the campaigns/[id] route, so the parity is discoverable.
1. In `stageQueries`, add a routing branch for the tenant lookup: `if (sql.includes('FROM mimecast_tenants'))` returns a staged tenant row array (default empty). Add an optional `mimecastTenants?: Array<{ client_id: string; client_secret: string; base_url: string | null }>` field to the `StagedRows` interface and route it through. Order the branch so it does not collide with the existing `FROM reports` / `FROM messages` / `FROM indicators` checks (the mimecast_tenants SQL contains none of those substrings, so any position before the final throw works).
2. Add `company_id` to the `ReportFixtureRow` interface (`company_id: string | null`) and include it in the report fixtures used by the two new tests.
3. New test A (tenant-scoped): stage a report with `company_id: '29683407'` and an enabled `mimecastTenants` row (`client_id`, `client_secret`, `base_url`). After `classifyCampaign('campaign-1')`, assert `getBlastRadiusMock` was called with a second argument whose `cacheScope === '29683407'` and whose `client` is defined (truthy). Assert the tenant SQL was actually issued (a queryMock call whose SQL includes `FROM mimecast_tenants` and `company_id = $1 AND enabled = true`).
4. New test B (global fallback preserved): stage a report whose company has NO enabled tenant row — cover both sub-cases in one or two tests: (b1) `company_id: null`, and (b2) `company_id` set but `mimecastTenants: []`. After classify, assert `getBlastRadiusMock` was called with either exactly one argument or a second argument of `undefined` (i.e. no tenant scoping) — inspect `getBlastRadiusMock.mock.calls[0]` and assert `calls[0][1]` is `undefined`.
5. Keep existing tests green — the current report fixtures omit `company_id`; ensure the added interface field is optional-compatible or updated in-place so existing `stageQueries` calls still typecheck (prefer making `company_id` present on fixtures, or `string | null` with existing rows getting `company_id: null`).
Do not use real Mimecast/Postgres — everything stays mocked, same as the existing file.
<success_criteria>
- Auto-classification (
classifyCampaign→gatherCampaignEvidence) queries the reporting company's own Mimecast tenant when one exists, matching the live blast-radius display path. - Global env fallback is preserved unchanged for companies without an enabled
mimecast_tenantsrow and for reports without a companyId. - No change to confidence semantics or the already-shipped query-scope fix (260721-mmf).
- Tests prove both branches. </success_criteria>