# Copyright (C) 2020 by the Georgia Tech Research Institute (GTRI)
# This software may be modified and distributed under the terms of
# the BSD 3-Clause license. See the LICENSE file for details.
defmodule RiskLogic do
@moduledoc """
RiskLogic contains the functionality for determining risk based on
numeric input values
"""
@doc """
sbom_risk/1: returns text risk level for identified sbom_risk
"""
@spec sbom_risk() :: {:ok, String.t()}
def sbom_risk() do
Application.fetch_env(:lowendinsight, :sbom_risk_level)
end
@doc """
contributor_risk/1: returns text enumeration for count
"""
@spec contributor_risk(non_neg_integer) :: {:ok, String.t()}
def contributor_risk(contributor_count) do
critical_contributor_level =
if Application.fetch_env(:lowendinsight, :critical_contributor_level) == :error,
do: 2,
else: Application.fetch_env!(:lowendinsight, :critical_contributor_level)
high_contributor_level =
if Application.fetch_env(:lowendinsight, :high_contributor_level) == :error,
do: 3,
else: Application.fetch_env!(:lowendinsight, :high_contributor_level)
medium_contributor_level =
if Application.fetch_env(:lowendinsight, :medium_contributor_level) == :error,
do: 5,
else: Application.fetch_env!(:lowendinsight, :medium_contributor_level)
cond do
contributor_count < critical_contributor_level ->
{:ok, "critical"}
contributor_count < high_contributor_level ->
{:ok, "high"}
contributor_count < medium_contributor_level ->
{:ok, "medium"}
contributor_count >= medium_contributor_level ->
{:ok, "low"}
end
end
@doc """
commit_currency_risk/1: returns text enumeration for commit currency risk
"""
@spec commit_currency_risk(non_neg_integer) :: {:ok, String.t()}
def commit_currency_risk(delta_in_weeks) do
medium_currency_level =
if Application.fetch_env(:lowendinsight, :medium_currency_level) == :error,
do: 26,
else: Application.fetch_env!(:lowendinsight, :medium_currency_level)
high_currency_level =
if Application.fetch_env(:lowendinsight, :high_currency_level) == :error,
do: 52,
else: Application.fetch_env!(:lowendinsight, :high_currency_level)
critical_currency_level =
if Application.fetch_env(:lowendinsight, :critical_currency_level) == :error,
do: 52,
else: Application.fetch_env!(:lowendinsight, :critical_currency_level)
cond do
delta_in_weeks < medium_currency_level ->
{:ok, "low"}
delta_in_weeks < high_currency_level ->
{:ok, "medium"}
delta_in_weeks < critical_currency_level ->
{:ok, "high"}
delta_in_weeks >= critical_currency_level ->
{:ok, "critical"}
end
end
@doc """
last_commit_size_risk/1: returns a text enumeration for the risk based on the size of the last commit
"""
@spec commit_change_size_risk(non_neg_integer) :: {:ok, String.t()}
def commit_change_size_risk(change_percent) do
medium_large_commit_level =
if Application.fetch_env(:lowendinsight, :medium_large_commit_level) == :error,
do: 0.2,
else: Application.fetch_env!(:lowendinsight, :medium_large_commit_level)
high_large_commit_level =
if Application.fetch_env(:lowendinsight, :high_large_commit_level) == :error,
do: 0.3,
else: Application.fetch_env!(:lowendinsight, :high_large_commit_level)
critical_large_commit_level =
if Application.fetch_env(:lowendinsight, :critical_large_commit_level) == :error,
do: 0.5,
else: Application.fetch_env!(:lowendinsight, :critical_large_commit_level)
cond do
change_percent < medium_large_commit_level ->
{:ok, "low"}
change_percent < high_large_commit_level ->
{:ok, "medium"}
change_percent < critical_large_commit_level ->
{:ok, "high"}
change_percent >= critical_large_commit_level ->
{:ok, "critical"}
end
end
@doc """
functional_contributors_risk/1: returns the enumerated risk based on input contributors list
"""
@spec functional_contributors_risk(non_neg_integer) :: {:ok, String.t()}
def functional_contributors_risk(contributors) do
medium_functional_contributors_level =
if Application.fetch_env(:lowendinsight, :medium_functional_contributors_level) == :error,
do: 5,
else: Application.fetch_env!(:lowendinsight, :medium_functional_contributors_level)
high_functional_contributors_level =
if Application.fetch_env(:lowendinsight, :high_functional_contributors_level) == :error,
do: 5,
else: Application.fetch_env!(:lowendinsight, :high_functional_contributors_level)
critical_functional_contributors_level =
if Application.fetch_env(:lowendinsight, :critical_functional_contributors_level) == :error,
do: 2,
else: Application.fetch_env!(:lowendinsight, :critical_functional_contributors_level)
cond do
contributors >= medium_functional_contributors_level ->
{:ok, "low"}
contributors >= high_functional_contributors_level ->
{:ok, "medium"}
contributors >= critical_functional_contributors_level ->
{:ok, "high"}
contributors < critical_functional_contributors_level ->
{:ok, "critical"}
end
end
end