diff --git a/public/admin/audit-analytics.html b/public/admin/audit-analytics.html index b5d7e2be..699e72b6 100644 --- a/public/admin/audit-analytics.html +++ b/public/admin/audit-analytics.html @@ -64,12 +64,12 @@
-
+
-

Total Decisions

+

Total Actions

-

@@ -80,12 +80,13 @@
- +
-

Allowed Rate

-

-

+

Allowed

+

-

+

-

@@ -95,15 +96,31 @@
+ +
+
+
+

Blocked

+

-

+

-

+
+
+ + + +
+
+
+

Violations

-

-

+

-

-
- +
+
@@ -126,6 +143,142 @@
+ +
+
+
+
+ + + +
+
+

Risk Management ROI Platform

+

Cost avoidance, compliance evidence, team productivity

+
+
+ +
+ + +
+ +
+
+

Cost Avoidance This Period

+ + + +
+
$0
+
+ +
+
+ + +
+

Framework Maturity Score

+
+
-
+
+ +
+
+
+ +
+
+
+
+
+
+ + +
+

Team Performance Comparison

+
+ +
+
+ + +
+

Activity Type Analysis

+
+ +
+
+ + +
+

ROI Projection: Enterprise Deployment

+

Estimated violations prevented at scale based on current block rate

+
+ +
+
+ + +
+
🔬 Current Research Focus Areas:
+
+ • Tiered Pattern Recognition (session, sequential, temporal anomalies)
+ • Feedback Loop Analysis (learning rates, recidivism tracking, rule effectiveness)
+ • Organizational Benchmarking (cross-org anonymized data sharing) +
+
+
+ + +
+
+
+
+ + + +
+
+

Framework Saves

+

High-severity blocks prevented

+
+
+ - +
+
+ +
+
+ + +
+ +
+
+

Top Block Reasons

+ +
+
+ +
+
+ + +
+

Blocks by Severity

+
+ +
+
+
+
@@ -213,6 +366,26 @@
+ + + diff --git a/public/js/admin/audit-analytics.js b/public/js/admin/audit-analytics.js index 30931eab..d68fe1f4 100644 --- a/public/js/admin/audit-analytics.js +++ b/public/js/admin/audit-analytics.js @@ -5,6 +5,38 @@ let auditData = []; +// Rule descriptions for tooltips and legend +const RULE_DESCRIPTIONS = { + 'inst_072': { + title: 'Defense-in-Depth Credential Protection', + description: 'Multi-layer security protection for credentials and sensitive data. Prevents credential leaks through 5 layers: prevention, mitigation, detection, backstop, and recovery.' + }, + 'inst_084': { + title: 'GitHub Repository URL Protection', + description: 'Hard block on GitHub URL modifications. Prevents accidental exposure of private repository structure or incorrect links.' + }, + 'inst_038': { + title: 'Pre-Action Validation Required', + description: 'Mandatory pre-action checks before file modifications. Validates context pressure, instruction history, token checkpoints, and CSP compliance.' + }, + 'inst_008': { + title: 'Content Security Policy (CSP) Compliance', + description: 'Enforces strict CSP rules to prevent XSS attacks. No inline scripts or styles allowed in HTML/JS files.' + }, + 'inst_016': { + title: 'Prohibited Terms: "Guardrails"', + description: 'Bans "guardrails" terminology as conceptually inadequate for AI safety. Use "governance framework" instead.' + }, + 'inst_017': { + title: 'Prohibited Terms: "Alignment"', + description: 'Bans single "alignment" in favor of explicit pluralistic deliberation. Prevents false consensus assumptions.' + }, + 'inst_018': { + title: 'Prohibited Terms: "Safety Measures"', + description: 'Bans vague "safety measures" language. Requires specific, verifiable safety mechanisms.' + } +}; + // Get auth token from localStorage function getAuthToken() { return localStorage.getItem('admin_token'); @@ -62,8 +94,12 @@ async function loadAuditData() { } // Render dashboard -function renderDashboard() { +async function renderDashboard() { updateSummaryCards(); + await renderBusinessIntelligence(); + renderFrameworkSaves(); + renderBlockReasons(); + renderSeverityBreakdown(); renderActionChart(); renderServiceChart(); renderServiceHealth24h(); @@ -76,17 +112,378 @@ function renderDashboard() { function updateSummaryCards() { const totalDecisions = auditData.length; const allowedCount = auditData.filter(d => d.allowed).length; + const blockedCount = auditData.filter(d => !d.allowed).length; const violationsCount = auditData.filter(d => d.violations && d.violations.length > 0).length; const servicesSet = new Set(auditData.map(d => d.service).filter(s => s && s !== 'unknown')); document.getElementById('total-decisions').textContent = totalDecisions; + + document.getElementById('allowed-count').textContent = allowedCount; document.getElementById('allowed-rate').textContent = totalDecisions > 0 ? `${((allowedCount / totalDecisions) * 100).toFixed(1)}%` : '0%'; + + document.getElementById('blocked-count').textContent = blockedCount; + document.getElementById('block-rate').textContent = totalDecisions > 0 + ? `${((blockedCount / totalDecisions) * 100).toFixed(1)}%` + : '0%'; + document.getElementById('violations-count').textContent = violationsCount; document.getElementById('services-count').textContent = servicesSet.size || 0; } +// Render Business Intelligence +async function renderBusinessIntelligence() { + // Activity Type Breakdown + const byActivityType = {}; + auditData.forEach(d => { + const type = d.activityType || 'Unknown'; + if (!byActivityType[type]) { + byActivityType[type] = { total: 0, allowed: 0, blocked: 0 }; + } + byActivityType[type].total++; + if (d.allowed) { + byActivityType[type].allowed++; + } else { + byActivityType[type].blocked++; + } + }); + + const activityEl = document.getElementById('activity-type-breakdown'); + activityEl.innerHTML = ''; + + const sortedActivity = Object.entries(byActivityType).sort((a, b) => b[1].blocked - a[1].blocked); + + if (sortedActivity.length === 0) { + activityEl.innerHTML = '

No activity data available

'; + } else { + sortedActivity.forEach(([type, data]) => { + const blockRate = (data.blocked / data.total * 100).toFixed(1); + const isHighRisk = data.blocked > 0; + + const activityDiv = document.createElement('div'); + activityDiv.className = `flex items-center justify-between p-3 rounded-lg border ${isHighRisk ? 'border-orange-200 bg-orange-50' : 'border-gray-200 bg-gray-50'}`; + + const leftDiv = document.createElement('div'); + leftDiv.innerHTML = ` +
${type}
+
+ ${data.total} total · ${data.blocked} blocked · ${blockRate}% block rate +
+ `; + + const badge = document.createElement('span'); + badge.className = `px-3 py-1 rounded-full text-xs font-medium ${isHighRisk ? 'bg-orange-200 text-orange-800' : 'bg-green-100 text-green-800'}`; + badge.textContent = isHighRisk ? `${data.blocked} blocks` : 'Clean'; + + activityDiv.appendChild(leftDiv); + activityDiv.appendChild(badge); + activityEl.appendChild(activityDiv); + }); + } + + // Cost Avoidance - load from API + const blockedDecisions = auditData.filter(d => !d.allowed); + let totalCost = 0; + const costByLevel = { CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 0 }; + + // Load cost factors from API (fallback to defaults) + const apiCostFactors = await loadCostConfig(); + const costFactors = apiCostFactors ? { + CRITICAL: apiCostFactors.CRITICAL.amount, + HIGH: apiCostFactors.HIGH.amount, + MEDIUM: apiCostFactors.MEDIUM.amount, + LOW: apiCostFactors.LOW.amount + } : { CRITICAL: 50000, HIGH: 10000, MEDIUM: 2000, LOW: 500 }; + + blockedDecisions.forEach(d => { + if (d.violations && d.violations.length > 0) { + d.violations.forEach(v => { + const severity = v.severity || 'LOW'; + const cost = costFactors[severity] || 0; + totalCost += cost; + costByLevel[severity] += cost; + }); + } + }); + + document.getElementById('cost-avoidance-total').textContent = `$${totalCost.toLocaleString()}`; + const breakdownEl = document.getElementById('cost-avoidance-breakdown'); + breakdownEl.innerHTML = Object.entries(costByLevel) + .filter(([_, cost]) => cost > 0) + .map(([level, cost]) => `
${level}: $${cost.toLocaleString()}
`) + .join(''); + + // Framework Maturity Score + const recentBlockRate = blockedDecisions.length / Math.max(auditData.length, 1); + const maturityScore = Math.max(0, Math.min(100, Math.round(100 - (recentBlockRate * 500)))); + + document.getElementById('maturity-score').textContent = maturityScore; + document.getElementById('maturity-trend').innerHTML = + maturityScore > 80 ? '↑ Excellent' : + maturityScore > 60 ? '→ Good' : + '↗ Learning'; + document.getElementById('maturity-message').textContent = + maturityScore > 80 ? 'Framework teaching good practices' : + maturityScore > 60 ? 'Team adapting well to governance' : + 'Framework actively preventing violations'; + + const progressBar = document.getElementById('maturity-progress'); + progressBar.style.width = maturityScore + '%'; + + // Team Comparison (AI vs Human) + const aiDecisions = auditData.filter(d => + d.service === 'FileEditHook' || d.service === 'BoundaryEnforcer' || + d.service === 'ContextPressureMonitor' || d.service === 'MetacognitiveVerifier' + ); + const humanDecisions = auditData.filter(d => !aiDecisions.includes(d)); + + const comparisonEl = document.getElementById('team-comparison'); + comparisonEl.innerHTML = ''; + + [ + { label: 'AI Assistant', data: aiDecisions, color: 'blue' }, + { label: 'Human Direct', data: humanDecisions, color: 'purple' } + ].forEach(team => { + const blocked = team.data.filter(d => !d.allowed).length; + const blockRate = team.data.length > 0 ? (blocked / team.data.length * 100).toFixed(1) : '0.0'; + + const teamDiv = document.createElement('div'); + teamDiv.className = `border-2 border-${team.color}-200 rounded-lg p-4`; + teamDiv.innerHTML = ` +
${team.label}
+
${blockRate}%
+
Block Rate (${blocked}/${team.data.length})
+
+ ${blocked === 0 ? '✓ Clean performance' : `${blocked} violations prevented`} +
+ `; + comparisonEl.appendChild(teamDiv); + }); + + // ROI Projections + const roiEl = document.getElementById('roi-projections'); + roiEl.innerHTML = ''; + + const blockedCount = auditData.filter(d => !d.allowed).length; + const highSeverityCount = auditData.filter(d => + !d.allowed && d.violations && d.violations.some(v => v.severity === 'HIGH' || v.severity === 'CRITICAL') + ).length; + + const projections = [ + { users: '1,000', decisions: Math.round(totalCount * 10), blocks: Math.round(blockedCount * 10), critical: Math.round(highSeverityCount * 10) }, + { users: '10,000', decisions: Math.round(totalCount * 100), blocks: Math.round(blockedCount * 100), critical: Math.round(highSeverityCount * 100) }, + { users: '70,000', decisions: Math.round(totalCount * 700), blocks: Math.round(blockedCount * 700), critical: Math.round(highSeverityCount * 700) } + ]; + + projections.forEach(proj => { + const projDiv = document.createElement('div'); + projDiv.className = 'border-2 border-purple-200 rounded-lg p-4 bg-white'; + projDiv.innerHTML = ` +
+
${proj.users}
+
Users
+
+
+
+ Decisions/month: + ${proj.decisions.toLocaleString()} +
+
+ Blocks/month: + ${proj.blocks.toLocaleString()} +
+
+ Critical saves: + ${proj.critical.toLocaleString()} +
+
+ `; + roiEl.appendChild(projDiv); + }); +} + +// Render Framework Saves (High severity blocks) +function renderFrameworkSaves() { + const blockedDecisions = auditData.filter(d => !d.allowed); + const highSeverityBlocks = blockedDecisions.filter(d => + d.violations && d.violations.some(v => v.severity === 'HIGH' || v.severity === 'CRITICAL') + ); + + document.getElementById('framework-saves-count').textContent = highSeverityBlocks.length; + + const savesListEl = document.getElementById('framework-saves-list'); + if (highSeverityBlocks.length === 0) { + savesListEl.innerHTML = '

No high-severity blocks in this period

'; + return; + } + + savesListEl.innerHTML = ''; + highSeverityBlocks.slice(0, 10).forEach(block => { + const violation = block.violations.find(v => v.severity === 'HIGH' || v.severity === 'CRITICAL'); + const timestamp = new Date(block.timestamp).toLocaleString(); + const file = block.metadata?.filePath || block.metadata?.file || 'N/A'; + const isCritical = violation.severity === 'CRITICAL'; + + const saveDiv = document.createElement('div'); + saveDiv.className = `flex items-start p-3 bg-white rounded-lg border ${isCritical ? 'border-red-200' : 'border-orange-200'} hover:shadow-md transition`; + + const badge = document.createElement('span'); + badge.className = `inline-flex items-center px-2 py-1 text-xs font-medium rounded-full ${isCritical ? 'bg-red-100 text-red-800' : 'bg-orange-100 text-orange-800'}`; + badge.textContent = violation.severity; + + const badgeContainer = document.createElement('div'); + badgeContainer.className = 'flex-shrink-0 mr-3'; + badgeContainer.appendChild(badge); + + const content = document.createElement('div'); + content.className = 'flex-1 min-w-0'; + content.innerHTML = ` +

${violation.ruleId || 'Unknown Rule'}

+

${violation.details || violation.ruleText || 'No details'}

+

File: ${file}

+

${timestamp}

+ `; + + saveDiv.appendChild(badgeContainer); + saveDiv.appendChild(content); + savesListEl.appendChild(saveDiv); + }); +} + +// Render Block Reasons +function renderBlockReasons() { + const blockedDecisions = auditData.filter(d => !d.allowed); + const reasonCounts = {}; + + blockedDecisions.forEach(d => { + let reason = 'Unknown'; + if (d.violations && d.violations.length > 0) { + reason = d.violations[0].ruleId || d.violations[0].ruleText || 'Unknown'; + } else if (d.metadata?.reason) { + reason = d.metadata.reason; + } + reasonCounts[reason] = (reasonCounts[reason] || 0) + 1; + }); + + const sortedReasons = Object.entries(reasonCounts) + .sort((a, b) => b[1] - a[1]) + .slice(0, 10); + + const reasonsListEl = document.getElementById('block-reasons-list'); + if (sortedReasons.length === 0) { + reasonsListEl.innerHTML = '

No blocks in this period

'; + return; + } + + const maxCount = sortedReasons[0][1]; + reasonsListEl.innerHTML = ''; + + sortedReasons.forEach(([reason, count]) => { + const percentage = (count / blockedDecisions.length * 100).toFixed(1); + const barWidth = (count / maxCount * 100).toFixed(1); + + const container = document.createElement('div'); + container.className = 'flex items-center space-x-3'; + + const innerDiv = document.createElement('div'); + innerDiv.className = 'flex-1'; + + // Get rule description if available + const ruleDesc = RULE_DESCRIPTIONS[reason]; + const tooltip = ruleDesc + ? `${ruleDesc.title}\n\n${ruleDesc.description}` + : reason; + + const header = document.createElement('div'); + header.className = 'flex items-center justify-between mb-1'; + + const reasonSpan = document.createElement('span'); + reasonSpan.className = 'text-sm font-medium text-gray-700 truncate cursor-help'; + reasonSpan.title = tooltip; + reasonSpan.textContent = reason; + + // Add info icon for rules with descriptions + if (ruleDesc) { + const infoIcon = document.createElement('span'); + infoIcon.className = 'ml-2 text-blue-500 text-xs'; + infoIcon.textContent = 'ℹ️'; + infoIcon.title = tooltip; + reasonSpan.appendChild(infoIcon); + } + + const countSpan = document.createElement('span'); + countSpan.className = 'text-sm text-gray-600'; + countSpan.textContent = `${count} (${percentage}%)`; + + header.appendChild(reasonSpan); + header.appendChild(countSpan); + + const progressBg = document.createElement('div'); + progressBg.className = 'w-full bg-gray-200 rounded-full h-2'; + + const progressBar = document.createElement('div'); + progressBar.className = 'bg-red-600 h-2 rounded-full'; + progressBar.style.width = `${barWidth}%`; + + progressBg.appendChild(progressBar); + innerDiv.appendChild(header); + innerDiv.appendChild(progressBg); + container.appendChild(innerDiv); + reasonsListEl.appendChild(container); + }); +} + +// Render Severity Breakdown +function renderSeverityBreakdown() { + const blockedDecisions = auditData.filter(d => !d.allowed); + const severityCounts = { CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 0 }; + + blockedDecisions.forEach(d => { + if (d.violations && d.violations.length > 0) { + d.violations.forEach(v => { + const severity = v.severity || 'MEDIUM'; + severityCounts[severity] = (severityCounts[severity] || 0) + 1; + }); + } + }); + + const severityEl = document.getElementById('severity-breakdown'); + const totalViolations = Object.values(severityCounts).reduce((a, b) => a + b, 0); + + if (totalViolations === 0) { + severityEl.innerHTML = '

No severity data available

'; + return; + } + + const severityConfig = { + CRITICAL: { color: 'red', icon: '🔴', bg: 'bg-red-50', border: 'border-red-200', text: 'text-red-700' }, + HIGH: { color: 'orange', icon: '🟠', bg: 'bg-orange-50', border: 'border-orange-200', text: 'text-orange-700' }, + MEDIUM: { color: 'yellow', icon: '🟡', bg: 'bg-yellow-50', border: 'border-yellow-200', text: 'text-yellow-700' }, + LOW: { color: 'gray', icon: '⚪', bg: 'bg-gray-50', border: 'border-gray-200', text: 'text-gray-700' } + }; + + severityEl.innerHTML = ''; + Object.entries(severityCounts).forEach(([severity, count]) => { + const percentage = (count / totalViolations * 100).toFixed(1); + const config = severityConfig[severity]; + + const div = document.createElement('div'); + div.className = `flex items-center justify-between p-3 ${config.bg} rounded-lg border ${config.border}`; + div.innerHTML = ` +
+ ${config.icon} + ${severity} +
+
+
${count}
+
${percentage}%
+
+ `; + severityEl.appendChild(div); + }); +} + // Render action type chart function renderActionChart() { const actionCounts = {}; @@ -503,6 +900,145 @@ function showError(message) { tbody.innerHTML = `${message}`; } +// Cost Configuration +async function loadCostConfig() { + try { + const token = localStorage.getItem('tractatus_token'); + const response = await fetch('/api/admin/cost-config', { + headers: { 'Authorization': `Bearer ${token}` } + }); + + if (!response.ok) { + throw new Error('Failed to load cost config'); + } + + const data = await response.json(); + return data.costFactors; + } catch (error) { + console.error('Error loading cost config:', error); + return null; + } +} + +async function saveCostConfig(costFactors) { + try { + const token = localStorage.getItem('tractatus_token'); + const response = await fetch('/api/admin/cost-config', { + method: 'POST', + headers: { + 'Authorization': `Bearer ${token}`, + 'Content-Type': 'application/json' + }, + body: JSON.stringify({ costFactors }) + }); + + if (!response.ok) { + throw new Error('Failed to save cost config'); + } + + return await response.json(); + } catch (error) { + console.error('Error saving cost config:', error); + throw error; + } +} + +async function showCostConfigModal() { + const costFactors = await loadCostConfig(); + if (!costFactors) { + alert('Failed to load cost configuration'); + return; + } + + const modal = document.createElement('div'); + modal.className = 'fixed inset-0 bg-black bg-opacity-50 flex items-center justify-center z-50'; + modal.innerHTML = ` +
+
+

Configure Cost Factors

+

Set organizational cost values for different violation severities

+
+ +
+ ${['CRITICAL', 'HIGH', 'MEDIUM', 'LOW'].map(severity => ` +
+ +
+
+ + +
+
+ + +
+
+
+ + +
+
+ `).join('')} + +
+ Note: These values are illustrative placeholders for research purposes. + Organizations should determine appropriate values based on their incident cost data. +
+
+ +
+ + +
+
+ `; + + document.body.appendChild(modal); + + // Close on cancel + modal.querySelector('#cancel-config-btn').addEventListener('click', () => { + document.body.removeChild(modal); + }); + + // Save configuration + modal.querySelector('#save-config-btn').addEventListener('click', async () => { + const updatedCostFactors = {}; + + ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW'].forEach(severity => { + updatedCostFactors[severity] = { + amount: parseFloat(document.getElementById(`cost-${severity}-amount`).value) || 0, + currency: document.getElementById(`cost-${severity}-currency`).value || 'USD', + rationale: document.getElementById(`cost-${severity}-rationale`).value || '' + }; + }); + + try { + await saveCostConfig(updatedCostFactors); + alert('Cost configuration saved successfully!'); + document.body.removeChild(modal); + loadAuditData(); // Reload to show updated calculations + } catch (error) { + alert('Failed to save cost configuration. Please try again.'); + } + }); + + // Close on background click + modal.addEventListener('click', (e) => { + if (e.target === modal) { + document.body.removeChild(modal); + } + }); +} + // Initialize function init() { if (!checkAuth()) return; @@ -519,6 +1055,13 @@ function init() { console.error('[Audit Analytics] Refresh button not found!'); } + // Setup cost configuration button + const configCostsBtn = document.getElementById('configure-costs-btn'); + if (configCostsBtn) { + console.log('[Audit Analytics] Cost config button found, attaching event listener'); + configCostsBtn.addEventListener('click', showCostConfigModal); + } + // Load initial data loadAuditData(); } @@ -556,3 +1099,60 @@ document.addEventListener('click', (e) => { switchTimelineMode(arg0); } }); + +// Show legend modal +function showLegendModal() { + const modal = document.getElementById('legend-modal'); + const content = document.getElementById('legend-content'); + + // Populate legend content + content.innerHTML = ''; + Object.entries(RULE_DESCRIPTIONS).forEach(([ruleId, ruleInfo]) => { + const ruleDiv = document.createElement('div'); + ruleDiv.className = 'border-l-4 border-blue-500 pl-4 py-2'; + + const titleDiv = document.createElement('div'); + titleDiv.className = 'font-semibold text-gray-900'; + titleDiv.textContent = `${ruleId}: ${ruleInfo.title}`; + + const descDiv = document.createElement('div'); + descDiv.className = 'text-sm text-gray-600 mt-1'; + descDiv.textContent = ruleInfo.description; + + ruleDiv.appendChild(titleDiv); + ruleDiv.appendChild(descDiv); + content.appendChild(ruleDiv); + }); + + modal.classList.remove('hidden'); +} + +// Hide legend modal +function hideLegendModal() { + const modal = document.getElementById('legend-modal'); + modal.classList.add('hidden'); +} + +// Add event listeners for modal +document.addEventListener('DOMContentLoaded', () => { + const showBtn = document.getElementById('show-legend-btn'); + const closeBtn = document.getElementById('close-legend-btn'); + const modal = document.getElementById('legend-modal'); + + if (showBtn) { + showBtn.addEventListener('click', showLegendModal); + } + + if (closeBtn) { + closeBtn.addEventListener('click', hideLegendModal); + } + + // Close modal when clicking outside + if (modal) { + modal.addEventListener('click', (e) => { + if (e.target === modal) { + hideLegendModal(); + } + }); + } +});