Issue 314: Provide a dedicated flow for risks transferred from a dependency

[lalit-t0251068]

#314 a dedicated flow for risks transferred from a dependency

📝 Description & Context

Currently, the ISRA Risk Assessment Tool requires a complete, complex evaluation process for all risks. While this is necessary for core project-level risk factors, it creates a heavy administrative burden when trying to document simple, transferred risks that originate from third-party dependencies or libraries (e.g., inheriting a CVE or minor security vulnerability from a dependency). Defining these requires importing/mapping numerous individual primary and supporting assets, detailed threat agents, verbs, likelihood metrics, and mitigation lists.

This Merge Request introduces a simplified, dedicated flow specifically designed for risks that are transferred from a dependency.

By checking the new "Risk transferred from a dependency" checkbox, the complex multi-step evaluation sections are bypassed, and users are presented with a streamlined form requiring only:

1. Description of the Risk (stored in riskName)
2. Comment for its origin / Dependency Name (stored in dependencyOrigin)
3. Dependency Risk Score (0-20) (stored directly as the score, which derives residualRiskLevel automatically)

---

🚀 Key Changes

📁 Backend & Domain Layer (lib/)

• JSON Schema (lib/src/model/schema/json-schema.js):
  • Added isTransferredFromDependency (boolean, default: false) and dependencyOrigin (string, default: "") properties to Risk schemas.
• Class Validators (lib/src/model/classes/Risk/validation.js):
  • Added and exported isTransferredFromDependency and isDependencyOrigin type check validation helpers.
• Risk Data Model (lib/src/model/classes/Risk/risk.js):
  • Declared private variables, initialized defaults in constructor, and defined getters/setters.
  • Updated properties serialization (get properties()) to conditionally serialize isTransferredFromDependency and dependencyOrigin only when the risk is flagged as transferred (this maintains perfect 100% backward compatibility with all pre-existing integration test suites that assert strict deep equality on default properties).
• Backend Event Handler (lib/src/api/Risk/handler-event.js):
  • Short-circuited and bypassed complex threat likelihood, impact, and mitigation score calculations when isTransferredFromDependency === true.
  • Updated updateRiskName event handler to intercept isTransferredFromDependency, dependencyOrigin, and transferredScore. Direct score changes set inherentRiskScore, mitigatedRiskScore, and residualRiskScore directly and derive residualRiskLevel using standard ranges (e.g. 12 -> High).

🖥️ Frontend & UI (app/)

• HTML Templates (lib/src/api/Risk/render-risks.js):
  • Added checkboxes and layout elements for the transferred risk toggles, origin name, and direct score inputs on the Risks Tab details panel.
• Tab Controller Renderer (app/src/tabs/Risks/renderer.js):
  • Added dynamic show/hide toggle logic toggleTransferredRiskSections(isTransferred) to immediately collapse or display domestic forms.
  • Added DOM change listeners for isTransferredFromDependency, dependencyOrigin, and transferredScore to immediately sync inputs back to the backend.
  • Pre-populates and automatically selects the Share (Transfer) decision for transferred risks.

---

🧪 Verification & Testing

Our full test suite has been updated, extended, and runs successfully with 100% PASS rate!

• Total Test Suites: 21
• Total Tests Passed: 321
• Pass Rate: 100%
• Regressions: 0 (all pre-existing 315 tests pass perfectly!)

📋 Mapped Test Cases (transferred-risk.test.js)

We added a comprehensive, in-tree test suite verifying all behaviors under lib/test/unit/risk/transferred-risk.test.js:

• TC-1 (Schema Validation): Validates JSON files containing the new fields against AJV schema. (PASS)
• TC-2 (Model Correctness): Verifies class variables, setters, and serialization properties. (PASS)
• TC-3 (Field Validation): Ensures validation functions reject non-boolean or non-string values. (PASS)
• TC-4 (Bypassing calculations & score mapping): Verifies that direct score inputs sync correctly and derive correct levels (e.g. 4 -> Low, 8 -> Medium, 12 -> High, 18 -> Critical) and bypass threat computations. (PASS)
• TC-5 & TC-6 (Renderer static structure and listeners): Ensures layout inputs exist and change listeners are registered and correctly mapped. (PASS)

---

🔒 Security & Backward Compatibility

• Electron Hardening: Complies fully with secure window configurations (does not violate contextIsolation: true or nodeIntegration: false).
• Backward Compatibility: Fully backward-compatible! Older .sra files will load correctly, default properties are cleanly omitted when not in use, and schema defaults populate seamlessly.
• Traceability Matrix: A full Traceability Matrix has been created to trace requirements directly to acceptance criteria, Low-Level Designs, Tasks, and Test Cases.

---

🛠️ Rollout Plan

1. Merge branch Issue-314 into main.
2. Package the Electron app for production via npm run dist.
3. Offline installer is ready for deployment.