Add Evidence Management Dashboard

backend/apps/owasp/api/internal/mutations/board_candidate_claim.py

@@ -90,6 +90,7 @@ class ClaimResult:
     ok: bool
     code: str | None = None
     message: str | None = None
+    claim: BoardCandidateClaimNode | None = None
 
 
 def _validate_reorder_claims(
@@ -167,7 +168,7 @@ def create_board_candidate_claim(
             )
 
         try:
-            BoardCandidateClaim.objects.create(
+            claim = BoardCandidateClaim.objects.create(
                 board=board,
                 candidate=candidate,
                 description=input_data.description,
@@ -194,7 +195,12 @@ def create_board_candidate_claim(
                 message=" ".join(messages),
             )
 
-        return ClaimResult(ok=True, code="SUCCESS", message="Claim created successfully.")
+        return ClaimResult(
+            ok=True,
+            code="SUCCESS",
+            message="Claim created successfully.",
+            claim=claim,
+        )
 
     @strawberry.mutation(permission_classes=[IsAuthenticated])
     @transaction.atomic
@@ -250,7 +256,12 @@ def update_board_candidate_claim(
                 message=" ".join(messages),
             )
 
-        return ClaimResult(ok=True, code="SUCCESS", message="Claim updated successfully.")
+        return ClaimResult(
+            ok=True,
+            code="SUCCESS",
+            message="Claim updated successfully.",
+            claim=claim,
+        )
 
     @strawberry.mutation(permission_classes=[IsAuthenticated])
     @transaction.atomic
@@ -302,7 +313,12 @@ def discard_board_candidate_claim(
                 message=" ".join(messages),
             )
 
-        return ClaimResult(ok=True, code="SUCCESS", message="Claim discarded successfully.")
+        return ClaimResult(
+            ok=True,
+            code="SUCCESS",
+            message="Claim discarded successfully.",
+            claim=claim,
+        )
 
     @strawberry.mutation(permission_classes=[IsAuthenticated])
     @transaction.atomic
@@ -366,6 +382,7 @@ def submit_board_candidate_claim(
                 ok=True,
                 code="SUCCESS",
                 message="Claim submitted successfully.",
+                claim=claim,
             )
 
         return result
@@ -425,7 +442,12 @@ def withdraw_board_candidate_claim(
                 message=" ".join(messages),
             )
 
-        return ClaimResult(ok=True, code="SUCCESS", message="Claim withdrawn successfully.")
+        return ClaimResult(
+            ok=True,
+            code="SUCCESS",
+            message="Claim withdrawn successfully.",
+            claim=claim,
+        )
 
     @strawberry.mutation(permission_classes=[IsAuthenticated])
     @transaction.atomic

backend/apps/owasp/api/internal/nodes/board_candidate_claim.py

@@ -29,6 +29,13 @@ def created_at(self, root: BoardCandidateClaim) -> datetime:
         """Resolve claim creation date."""
         return root.nest_created_at
 
+    @strawberry_django.field
+    def has_evidence(self, root: BoardCandidateClaim) -> bool:
+        """Resolve whether the claim has any evidence."""
+        if hasattr(root, "evidence_exists"):
+            return root.evidence_exists
+        return root.evidences.filter(is_removed=False).exists()
+
     @strawberry_django.field
     def status(self, root: BoardCandidateClaim) -> ClaimStatusEnum:
         """Resolve claim status as GraphQL enum."""

backend/apps/owasp/api/internal/queries/board_candidate_claim.py

@@ -2,9 +2,11 @@
 
 import strawberry
 import strawberry_django
+from django.db.models import Exists, OuterRef
 
 from apps.owasp.api.internal.nodes.board_candidate_claim import BoardCandidateClaimNode
 from apps.owasp.models.board_candidate_claim import BoardCandidateClaim
+from apps.owasp.models.board_candidate_claim_evidence import BoardCandidateClaimEvidence
 
 
 @strawberry.type
@@ -32,10 +34,20 @@ def board_candidate_claims(
             and user.github_user is not None
             and user.github_user.login == login
         )
-        claims = BoardCandidateClaim.objects.filter(
-            board__year=year,
-            candidate__member__login=login,
-        ).order_by("order", "nest_created_at")
+        claims = (
+            BoardCandidateClaim.objects.filter(
+                board__year=year,
+                candidate__member__login=login,
+            )
+            .annotate(
+                evidence_exists=Exists(
+                    BoardCandidateClaimEvidence.objects.filter(
+                        claim=OuterRef("pk"), is_removed=False
+                    )
+                ),
+            )
+            .order_by("order", "nest_created_at")
+        )
 
         if not is_self:
             claims = claims.filter(status=BoardCandidateClaim.Status.APPROVED)
@@ -59,7 +71,13 @@ def board_candidate_claim(
 
         """
         try:
-            claim = BoardCandidateClaim.objects.get(
+            claim = BoardCandidateClaim.objects.annotate(
+                evidence_exists=Exists(
+                    BoardCandidateClaimEvidence.objects.filter(
+                        claim=OuterRef("pk"), is_removed=False
+                    )
+                ),
+            ).get(
                 board__year=year,
                 candidate__member__login=login,
                 key=key,

backend/tests/unit/apps/owasp/api/internal/mutations/board_candidate_claim_test.py

@@ -57,6 +57,7 @@ def test_discard_claim_success(self, mock_claim_model):
 
         assert result.ok
         assert result.code == "SUCCESS"
+        assert result.claim is claim
         assert claim.status == BoardCandidateClaim.Status.DISCARDED
         claim.save.assert_called_once()
 
@@ -130,6 +131,7 @@ def test_submit_claim_success(self, mock_claim_model):
 
         assert result.ok
         assert result.code == "SUCCESS"
+        assert result.claim is claim
         assert claim.status == BoardCandidateClaim.Status.SUBMITTED
         claim.save.assert_called_once()
 
@@ -210,6 +212,7 @@ def test_withdraw_claim_success_submitted(self, mock_timezone, mock_claim_model)
 
         assert result.ok
         assert result.code == "SUCCESS"
+        assert result.claim is claim
         assert claim.status == BoardCandidateClaim.Status.WITHDRAWN
         assert claim.withdrawn_reason == "No longer relevant"
         assert claim.withdrawn_at == now
@@ -238,6 +241,7 @@ def test_withdraw_claim_success_approved(self, mock_timezone, mock_claim_model):
 
         assert result.ok
         assert result.code == "SUCCESS"
+        assert result.claim is claim
         assert claim.status == BoardCandidateClaim.Status.WITHDRAWN
         assert claim.withdrawn_reason == "No longer relevant"
         assert claim.withdrawn_at == now
@@ -548,6 +552,7 @@ def test_create_claim_success(self, mock_claim_model, mock_board_model):
         )
         assert result.ok
         assert result.code == "SUCCESS"
+        assert result.claim is not None
 
     @patch("apps.owasp.api.internal.mutations.board_candidate_claim.BoardOfDirectors")
     def test_create_claim_board_not_found(self, mock_board_model):
@@ -688,6 +693,7 @@ def test_update_claim_success(self, mock_claim_model):
 
         assert result.ok
         assert result.code == "SUCCESS"
+        assert result.claim is claim
         assert claim.name == input_data.name
         assert claim.description == input_data.description
         claim.save.assert_called_once()
@@ -713,6 +719,7 @@ def test_update_claim_partial(self, mock_claim_model):
 
         assert result.ok
         assert result.code == "SUCCESS"
+        assert result.claim is claim
         assert claim.name == "Updated Name"
         claim.save.assert_called_once_with(update_fields=["name", "key"])
 

backend/tests/unit/apps/owasp/api/internal/nodes/board_candidate_claim_test.py

@@ -1,5 +1,7 @@
 """Tests for BoardCandidateClaim GraphQL node."""
 
+from unittest.mock import Mock
+
 from apps.owasp.api.internal.nodes.board_candidate_claim import BoardCandidateClaimNode
 from tests.unit.apps.common.graphql_node_base_test import GraphQLNodeBaseTest
 
@@ -15,6 +17,7 @@ def test_node_fields(self):
             "_id",
             "created_at",
             "description",
+            "has_evidence",
             "is_locked",
             "key",
             "name",
@@ -25,3 +28,32 @@ def test_node_fields(self):
             "withdrawn_reason",
         }
         assert field_names == expected_field_names
+
+    def test_has_evidence_returns_true_when_evidence_exists(self):
+        mock_claim = Mock()
+        mock_claim.evidence_exists = True
+
+        field = self._get_field_by_name("has_evidence", BoardCandidateClaimNode)
+        result = field.base_resolver.wrapped_func(None, mock_claim)
+
+        assert result
+
+    def test_has_evidence_returns_false_when_no_evidence(self):
+        mock_claim = Mock()
+        mock_claim.evidence_exists = False
+
+        field = self._get_field_by_name("has_evidence", BoardCandidateClaimNode)
+        result = field.base_resolver.wrapped_func(None, mock_claim)
+
+        assert not result
+
+    def test_has_evidence_falls_back_to_evidences_filter_when_annotation_missing(self):
+        mock_claim = Mock(spec=[])
+        mock_claim.evidences = Mock()
+        mock_claim.evidences.filter.return_value.exists.return_value = True
+
+        field = self._get_field_by_name("has_evidence", BoardCandidateClaimNode)
+        result = field.base_resolver.wrapped_func(None, mock_claim)
+
+        mock_claim.evidences.filter.assert_called_once_with(is_removed=False)
+        assert result

backend/tests/unit/apps/owasp/api/internal/queries/board_candidate_claim_test.py

@@ -26,6 +26,7 @@ def test_board_candidate_claims_self(self, mock_claim_model):
 
         claims = [MagicMock(), MagicMock()]
         mock_qs = MagicMock()
+        mock_qs.annotate.return_value = mock_qs
         mock_qs.order_by.return_value = claims
         mock_claim_model.objects.filter.return_value = mock_qs
 
@@ -48,6 +49,7 @@ def test_board_candidate_claims_non_self_filters_approved(self, mock_claim_model
         info = _make_info(user)
 
         base_qs = MagicMock()
+        base_qs.annotate.return_value = base_qs
         ordered_qs = MagicMock()
         filtered_qs = MagicMock()
         ordered_qs.filter.return_value = filtered_qs
@@ -68,6 +70,7 @@ def test_board_candidate_claims_anonymous_filters_approved(self, mock_claim_mode
         info = _make_info(user)
 
         base_qs = MagicMock()
+        base_qs.annotate.return_value = base_qs
         ordered_qs = MagicMock()
         filtered_qs = MagicMock()
         ordered_qs.filter.return_value = filtered_qs
@@ -97,12 +100,15 @@ def test_board_candidate_claim_self(self, mock_claim_model):
         claim = MagicMock()
         claim.candidate.member = mock_github_user
         claim.status = BoardCandidateClaim.Status.DRAFT
-        mock_claim_model.objects.get.return_value = claim
+        mock_qs = MagicMock()
+        mock_qs.get.return_value = claim
+        mock_claim_model.objects.annotate.return_value = mock_qs
 
         query = BoardCandidateClaimQuery()
         result = query.board_candidate_claim(info, login="alice", key="test-key", year=2025)
 
-        mock_claim_model.objects.get.assert_called_once_with(
+        mock_claim_model.objects.annotate.assert_called_once()
+        mock_qs.get.assert_called_once_with(
             candidate__member__login="alice", key="test-key", board__year=2025
         )
         assert result == claim
@@ -119,11 +125,14 @@ def test_board_candidate_claim_non_self_approved(self, mock_claim_model):
         claim = MagicMock()
         claim.candidate.member = MagicMock()
         claim.status = BoardCandidateClaim.Status.APPROVED
-        mock_claim_model.objects.get.return_value = claim
+        mock_qs = MagicMock()
+        mock_qs.get.return_value = claim
+        mock_claim_model.objects.annotate.return_value = mock_qs
 
         query = BoardCandidateClaimQuery()
         result = query.board_candidate_claim(info, login="alice", key="test-key", year=2025)
 
+        mock_claim_model.objects.annotate.assert_called_once()
         assert result == claim
 
     @patch("apps.owasp.api.internal.queries.board_candidate_claim.BoardCandidateClaim")
@@ -138,7 +147,9 @@ def test_board_candidate_claim_non_self_not_approved(self, mock_claim_model):
         claim = MagicMock()
         claim.candidate.member = MagicMock()
         claim.status = BoardCandidateClaim.Status.SUBMITTED
-        mock_claim_model.objects.get.return_value = claim
+        mock_qs = MagicMock()
+        mock_qs.get.return_value = claim
+        mock_claim_model.objects.annotate.return_value = mock_qs
 
         query = BoardCandidateClaimQuery()
         result = query.board_candidate_claim(info, login="alice", key="test-key", year=2025)
@@ -154,7 +165,9 @@ def test_board_candidate_claim_not_found(self, mock_claim_model):
         user.github_user = MagicMock()
         info = _make_info(user)
 
-        mock_claim_model.objects.get.side_effect = BoardCandidateClaim.DoesNotExist
+        mock_qs = MagicMock()
+        mock_qs.get.side_effect = BoardCandidateClaim.DoesNotExist
+        mock_claim_model.objects.annotate.return_value = mock_qs
 
         query = BoardCandidateClaimQuery()
         result = query.board_candidate_claim(info, login="alice", key="test-key", year=2025)
@@ -167,13 +180,9 @@ def test_board_candidate_claim_anonymous_approved(self, mock_claim_model):
         mock_claim_model.DoesNotExist = BoardCandidateClaim.DoesNotExist
         user = MagicMock()
         user.is_authenticated = False
-        info = _make_info(user)
 
         claim = MagicMock()
         claim.status = BoardCandidateClaim.Status.APPROVED
-        mock_claim_model.objects.get.return_value = claim
-
-        query = BoardCandidateClaimQuery()
-        result = query.board_candidate_claim(info, login="alice", key="test-key", year=2025)
-
-        assert result == claim
+        mock_qs = MagicMock()
+        mock_qs.get.return_value = claim
+        mock_claim_model.objects.annotate.return_value = mock_qs

e2e/helpers/mockAuthCookies.ts

@@ -0,0 +1,32 @@
+export const authCookies = [
+  {
+    name: 'csrftoken',
+    value: 'abc123',
+    domain: 'localhost',
+    path: '/',
+  },
+  {
+    name: 'nest.session-id',
+    value: 'test-session-id',
+    domain: 'localhost',
+    path: '/',
+  },
+  {
+    name: 'next-auth.csrf-token',
+    value: 'test-csrf-token',
+    domain: 'localhost',
+    path: '/',
+  },
+  {
+    name: 'next-auth.callback-url',
+    value: '/',
+    domain: 'localhost',
+    path: '/',
+  },
+  {
+    name: 'next-auth.session-token',
+    value: 'test-session-token',
+    domain: 'localhost',
+    path: '/',
+  },
+]