feat(lib): enisa cyber resiliency maturity assessment framework and adjustments to make it more usable (#4567)

* feat(lib): enisa cyber resiliency maturity assessment framework and adjustments to make it more usable

* fix excel typo based on the pdf

Author: ab-smith

backend/library/libraries/enisa-sme-cra-maturity.yaml

@@ -0,0 +1,100 @@
+"""Framework `field_visibility` template: YAML import and CA seeding."""
+
+import pytest
+from core.models import ComplianceAssessment, Framework, Perimeter, StoredLibrary
+from core.utils import build_initial_field_visibility, is_field_visible_to
+from iam.models import Folder
+
+LIB_WITH_FIELD_VISIBILITY = """
+urn: urn:test:risk:library:fv-lib
+locale: en
+ref_id: FV-LIB
+name: Field visibility test library
+description: Framework carrying a field_visibility template
+version: 1
+publication_date: 2026-07-24
+copyright: test
+provider: test
+packager: test
+objects:
+  framework:
+    urn: urn:test:risk:framework:fv-lib
+    ref_id: FV-LIB
+    name: Field visibility test framework
+    description: test
+    min_score: 1
+    max_score: 5
+    field_visibility:
+      score:
+        auditor: edit
+        respondent: hidden
+      is_scored:
+        auditor: edit
+        respondent: hidden
+      result:
+        auditor: hidden
+        respondent: hidden
+      extended_result:
+        auditor: hidden
+        respondent: hidden
+    requirement_nodes:
+    - urn: urn:test:risk:req_node:fv-lib:1
+      assessable: true
+      depth: 1
+      ref_id: '1'
+      name: Requirement one
+""".lstrip().encode("utf-8")
+
+
+@pytest.mark.django_db
+def test_field_visibility_imports_and_seeds_new_assessments():
+    stored, error = StoredLibrary.store_library_content(LIB_WITH_FIELD_VISIBILITY)
+    assert error is None, error
+    assert stored.load() is None
+
+    fw = Framework.objects.get(urn="urn:test:risk:framework:fv-lib")
+    assert fw.field_visibility["score"] == {"auditor": "edit", "respondent": "hidden"}
+    assert fw.field_visibility["result"] == {
+        "auditor": "hidden",
+        "respondent": "hidden",
+    }
+
+    folder = Folder.get_root_folder()
+    perimeter = Perimeter.objects.create(name="P", folder=folder)
+    ca = ComplianceAssessment.objects.create(
+        name="CA",
+        framework=fw,
+        perimeter=perimeter,
+        folder=folder,
+        field_visibility=build_initial_field_visibility(fw),
+    )
+    assert ca.scoring_enabled is True
+    assert ca.extended_result_enabled is False
+    assert ca.progress_status_enabled is True
+    assert is_field_visible_to(ca, "result", "auditor") is False
+    assert is_field_visible_to(ca, "score", "auditor") is True
+    assert is_field_visible_to(ca, "answers", "respondent") is True
+
+
+@pytest.mark.django_db
+def test_framework_without_field_visibility_gets_empty_template():
+    lib = LIB_WITH_FIELD_VISIBILITY.replace(b"fv-lib", b"fv-lib2")
+    lib = b"\n".join(
+        line
+        for line in lib.split(b"\n")
+        if b"field_visibility" not in line
+        and b"auditor:" not in line
+        and b"respondent:" not in line
+        and not line.strip().startswith(b"score:")
+        and not line.strip().startswith(b"is_scored:")
+        and not line.strip().startswith(b"result:")
+        and not line.strip().startswith(b"extended_result:")
+    )
+    stored, error = StoredLibrary.store_library_content(lib)
+    assert error is None, error
+    assert stored.load() is None
+
+    fw = Framework.objects.get(urn="urn:test:risk:framework:fv-lib2")
+    assert fw.field_visibility == {}
+    template = build_initial_field_visibility(fw)
+    assert template["score"] == {"auditor": "hidden", "respondent": "hidden"}

backend/library/tests/test_field_visibility_import.py

@@ -427,6 +427,7 @@ def import_framework(self, library_object: LoadedLibrary):
                     "implementation_groups_definition"
                 ),
                 outcomes_definition=self.framework_data.get("outcomes_definition", []),
+                field_visibility=self.framework_data.get("field_visibility") or {},
                 provider=library_object.provider,
                 locale=library_object.locale,
                 default_locale=library_object.default_locale,

backend/library/utils.py

@@ -21,6 +21,7 @@
 
 import sys
 import re
+import json
 import yaml
 import datetime
 import argparse
@@ -1040,6 +1041,18 @@ def _handle_framework(obj, library, object_blocks, prefix_to_urn, compat_mode, v
     if "max_score" in meta:
         framework["max_score"] = int(meta["max_score"])
 
+    if meta.get("field_visibility"):
+        try:
+            field_visibility = json.loads(meta["field_visibility"])
+        except json.JSONDecodeError as e:
+            raise ValueError(f"(framework) Invalid field_visibility JSON: {e}")
+        if not isinstance(field_visibility, dict):
+            raise ValueError(
+                "(framework) field_visibility must be a JSON object "
+                '({"field": {"role": "edit"|"read"|"hidden"}})'
+            )
+        framework["field_visibility"] = field_visibility
+
     score_name = meta.get("scores_definition")
     if score_name and score_name in object_blocks:
         score_header, score_rows_data = parse_content_rows(

backend/scripts/convert_library_v2.py

@@ -91,7 +91,7 @@ export function getScoreHexColor(
 }
 
 export function formatScoreValue(
-	value: number,
+	value: number | null,
 	max_score: number,
 	fullDonut = false,
 	min_score = 0

frontend/src/lib/utils/helpers.ts

@@ -398,7 +398,7 @@
 			</div>
 		{/if}
 		{#if hasAssessableChildren}
-			<div class="flex max-w-96 grow items-center space-x-2">
+			<div class="flex max-w-96 grow items-center space-x-2 {showResult ? '' : 'justify-end'}">
 				{#if showResult}
 					<div
 						class="flex max-w-96 grow bg-surface-200-800 rounded-full overflow-hidden h-4 shrink self-center"

frontend/src/routes/(app)/(third-party)/compliance-assessments/[id=uuid]/TreeViewItemContent.svelte

@@ -41,6 +41,7 @@
 		computeRequirementScoreAndResult,
 		formatScoreValue,
 		displayScoreColor,
+		hasComputedScore,
 		resultBadgeStyle,
 		filterResultChoices
 	} from '$lib/utils/helpers';
@@ -787,13 +788,13 @@
 						</div>
 					{/if}
 					{#if page.data.compliance_assessment_score.scoring_enabled}
-						{#if computedScore !== null}
+						{#if computedScore !== null || hasComputedScore(page.data.requirementAssessment.requirement.questions)}
 							{#if showScore}
 								<div class="flex flex-row items-center space-x-4">
 									<span class="font-medium">{m.score()}</span>
 									<div class="shrink-0 relative">
 										<Progress
-											value={formatScoreValue(computedScore || 0, resolvedMax, false, resolvedMin)}
+											value={formatScoreValue(computedScore, resolvedMax, false, resolvedMin)}
 											min={0}
 											max={100}
 										>
@@ -804,7 +805,7 @@
 												/>
 											</Progress.Circle>
 											<div class="absolute inset-0 flex items-center justify-center">
-												<span class="text-xs font-bold">{computedScore}</span>
+												<span class="text-xs font-bold">{computedScore ?? '–'}</span>
 											</div>
 										</Progress>
 									</div>