Extend GET /results to filter by subject and scope

Add optional `subject` and `scopeuuid` query parameters to GET /results.
When subject is provided, accounts can access their own results without
needing the `read_any` role. Update docs accordingly.

Author: guettli

compliance-monitor/README.md

@@ -154,6 +154,9 @@ The return value is a _list of objects_ like the following:
 
 Supports query parameters:
 
+- `subject=SUBJECT`: restrict results to this subject; if given, accounts without role `read_any`
+  may still access their own subject's results; if omitted, role `read_any` is required;
+- `scopeuuid=SCOPEUUID`: restrict results to this scope;
 - `approved=APPROVED`: return only results with approval status `APPROVED` (either 0 or 1);
   default: no such restriction is applied;
 - `limit=N`: return at most N items (default: 10);

compliance-monitor/monitor.py

@@ -799,11 +799,16 @@ async def get_results(
     account: Annotated[tuple[str, str], Depends(auth)],
     conn: Annotated[connection, Depends(get_conn)],
     approved: Optional[bool] = None, limit: int = 10, skip: int = 0,
+    subject: Optional[str] = None, scopeuuid: Optional[str] = None,
 ):
-    """get recent results, potentially filtered by approval status"""
-    check_role(account, roles=ROLES['read_any'])
+    """get recent results, optionally filtered by subject, scope, and approval status"""
+    if subject is None:
+        check_role(account, roles=ROLES['read_any'])
+    else:
+        check_role(account, subject, ROLES['read_any'])
     with conn.cursor() as cur:
-        return db_get_recent_results2(cur, approved, limit, skip, max_age_days=GRACE_PERIOD_DAYS)
+        return db_get_recent_results2(cur, approved, limit, skip, max_age_days=GRACE_PERIOD_DAYS,
+                                      subject=subject, scopeuuid=scopeuuid)
 
 
 @app.post("/results")

compliance-monitor/sql.py

@@ -398,7 +398,7 @@ def db_get_relevant_results2(
     return cur.fetchall()
 
 
-def db_get_recent_results2(cur: cursor, approved, limit, skip, max_age_days=None):
+def db_get_recent_results2(cur: cursor, approved, limit, skip, max_age_days=None, subject=None, scopeuuid=None):
     """list recent test results without grouping by scope/version/check"""
     columns = ('reportuuid', 'subject', 'checked_at', 'scopeuuid', 'version', 'check', 'result', 'approval')
     cur.execute(sql.SQL('''
@@ -414,8 +414,10 @@ def db_get_recent_results2(cur: cursor, approved, limit, skip, max_age_days=None
                 f"checked_at > NOW() - interval '{max_age_days:d} days'"
             ),
             None if approved is None else sql.SQL('approval = %(approved)s'),
+            None if subject is None else sql.SQL('result2.subject = %(subject)s'),
+            None if scopeuuid is None else sql.SQL('result2.scopeuuid = %(scopeuuid)s'),
         ),
-    ), {"limit": limit, "skip": skip, "approved": approved})
+    ), {"limit": limit, "skip": skip, "approved": approved, "subject": subject, "scopeuuid": scopeuuid})
     return [{col: val for col, val in zip(columns, row)} for row in cur.fetchall()]