Add Evidence Management Dashboard

backend/apps/owasp/api/internal/mutations/board_candidate_claim.py

@@ -90,6 +90,7 @@ class ClaimResult:
     ok: bool
     code: str | None = None
     message: str | None = None
+    claim: BoardCandidateClaimNode | None = None
 
 
 def _validate_reorder_claims(
@@ -167,7 +168,7 @@ def create_board_candidate_claim(
             )
 
         try:
-            BoardCandidateClaim.objects.create(
+            claim = BoardCandidateClaim.objects.create(
                 board=board,
                 candidate=candidate,
                 description=input_data.description,
@@ -194,7 +195,12 @@ def create_board_candidate_claim(
                 message=" ".join(messages),
             )
 
-        return ClaimResult(ok=True, code="SUCCESS", message="Claim created successfully.")
+        return ClaimResult(
+            ok=True,
+            code="SUCCESS",
+            message="Claim created successfully.",
+            claim=claim,
+        )
 
     @strawberry.mutation(permission_classes=[IsAuthenticated])
     @transaction.atomic
@@ -250,7 +256,12 @@ def update_board_candidate_claim(
                 message=" ".join(messages),
             )
 
-        return ClaimResult(ok=True, code="SUCCESS", message="Claim updated successfully.")
+        return ClaimResult(
+            ok=True,
+            code="SUCCESS",
+            message="Claim updated successfully.",
+            claim=claim,
+        )
 
     @strawberry.mutation(permission_classes=[IsAuthenticated])
     @transaction.atomic
@@ -302,7 +313,12 @@ def discard_board_candidate_claim(
                 message=" ".join(messages),
             )
 
-        return ClaimResult(ok=True, code="SUCCESS", message="Claim discarded successfully.")
+        return ClaimResult(
+            ok=True,
+            code="SUCCESS",
+            message="Claim discarded successfully.",
+            claim=claim,
+        )
 
     @strawberry.mutation(permission_classes=[IsAuthenticated])
     @transaction.atomic
@@ -366,6 +382,7 @@ def submit_board_candidate_claim(
                 ok=True,
                 code="SUCCESS",
                 message="Claim submitted successfully.",
+                claim=claim,
             )
 
         return result
@@ -425,7 +442,12 @@ def withdraw_board_candidate_claim(
                 message=" ".join(messages),
             )
 
-        return ClaimResult(ok=True, code="SUCCESS", message="Claim withdrawn successfully.")
+        return ClaimResult(
+            ok=True,
+            code="SUCCESS",
+            message="Claim withdrawn successfully.",
+            claim=claim,
+        )
 
     @strawberry.mutation(permission_classes=[IsAuthenticated])
     @transaction.atomic

backend/apps/owasp/api/internal/nodes/board_candidate_claim.py

@@ -29,6 +29,13 @@ def created_at(self, root: BoardCandidateClaim) -> datetime:
         """Resolve claim creation date."""
         return root.nest_created_at
 
+    @strawberry_django.field
+    def has_evidence(self, root: BoardCandidateClaim) -> bool:
+        """Resolve whether the claim has any evidence."""
+        if hasattr(root, "evidence_exists"):
+            return root.evidence_exists
+        return root.evidences.filter(is_removed=False).exists()
+
     @strawberry_django.field
     def status(self, root: BoardCandidateClaim) -> ClaimStatusEnum:
         """Resolve claim status as GraphQL enum."""

backend/apps/owasp/api/internal/queries/board_candidate_claim.py

@@ -2,9 +2,11 @@
 
 import strawberry
 import strawberry_django
+from django.db.models import Exists, OuterRef
 
 from apps.owasp.api.internal.nodes.board_candidate_claim import BoardCandidateClaimNode
 from apps.owasp.models.board_candidate_claim import BoardCandidateClaim
+from apps.owasp.models.board_candidate_claim_evidence import BoardCandidateClaimEvidence
 
 
 @strawberry.type
@@ -32,10 +34,20 @@ def board_candidate_claims(
             and user.github_user is not None
             and user.github_user.login == login
         )
-        claims = BoardCandidateClaim.objects.filter(
-            board__year=year,
-            candidate__member__login=login,
-        ).order_by("order", "nest_created_at")
+        claims = (
+            BoardCandidateClaim.objects.filter(
+                board__year=year,
+                candidate__member__login=login,
+            )
+            .annotate(
+                evidence_exists=Exists(
+                    BoardCandidateClaimEvidence.objects.filter(
+                        claim=OuterRef("pk"), is_removed=False
+                    )
+                ),
+            )
+            .order_by("order", "nest_created_at")
+        )
 
         if not is_self:
             claims = claims.filter(status=BoardCandidateClaim.Status.APPROVED)

backend/tests/unit/apps/owasp/api/internal/mutations/board_candidate_claim_test.py

@@ -57,6 +57,7 @@ def test_discard_claim_success(self, mock_claim_model):
 
         assert result.ok
         assert result.code == "SUCCESS"
+        assert result.claim is claim
         assert claim.status == BoardCandidateClaim.Status.DISCARDED
         claim.save.assert_called_once()
 
@@ -130,6 +131,7 @@ def test_submit_claim_success(self, mock_claim_model):
 
         assert result.ok
         assert result.code == "SUCCESS"
+        assert result.claim is claim
         assert claim.status == BoardCandidateClaim.Status.SUBMITTED
         claim.save.assert_called_once()
 
@@ -210,6 +212,7 @@ def test_withdraw_claim_success_submitted(self, mock_timezone, mock_claim_model)
 
         assert result.ok
         assert result.code == "SUCCESS"
+        assert result.claim is claim
         assert claim.status == BoardCandidateClaim.Status.WITHDRAWN
         assert claim.withdrawn_reason == "No longer relevant"
         assert claim.withdrawn_at == now
@@ -238,6 +241,7 @@ def test_withdraw_claim_success_approved(self, mock_timezone, mock_claim_model):
 
         assert result.ok
         assert result.code == "SUCCESS"
+        assert result.claim is claim
         assert claim.status == BoardCandidateClaim.Status.WITHDRAWN
         assert claim.withdrawn_reason == "No longer relevant"
         assert claim.withdrawn_at == now
@@ -548,6 +552,7 @@ def test_create_claim_success(self, mock_claim_model, mock_board_model):
         )
         assert result.ok
         assert result.code == "SUCCESS"
+        assert result.claim is not None
 
     @patch("apps.owasp.api.internal.mutations.board_candidate_claim.BoardOfDirectors")
     def test_create_claim_board_not_found(self, mock_board_model):
@@ -688,6 +693,7 @@ def test_update_claim_success(self, mock_claim_model):
 
         assert result.ok
         assert result.code == "SUCCESS"
+        assert result.claim is claim
         assert claim.name == input_data.name
         assert claim.description == input_data.description
         claim.save.assert_called_once()
@@ -713,6 +719,7 @@ def test_update_claim_partial(self, mock_claim_model):
 
         assert result.ok
         assert result.code == "SUCCESS"
+        assert result.claim is claim
         assert claim.name == "Updated Name"
         claim.save.assert_called_once_with(update_fields=["name", "key"])
 

backend/tests/unit/apps/owasp/api/internal/nodes/board_candidate_claim_test.py

@@ -1,5 +1,7 @@
 """Tests for BoardCandidateClaim GraphQL node."""
 
+from unittest.mock import Mock
+
 from apps.owasp.api.internal.nodes.board_candidate_claim import BoardCandidateClaimNode
 from tests.unit.apps.common.graphql_node_base_test import GraphQLNodeBaseTest
 
@@ -15,6 +17,7 @@ def test_node_fields(self):
             "_id",
             "created_at",
             "description",
+            "has_evidence",
             "is_locked",
             "key",
             "name",
@@ -25,3 +28,32 @@ def test_node_fields(self):
             "withdrawn_reason",
         }
         assert field_names == expected_field_names
+
+    def test_has_evidence_returns_true_when_evidence_exists(self):
+        mock_claim = Mock()
+        mock_claim.evidence_exists = True
+
+        field = self._get_field_by_name("has_evidence", BoardCandidateClaimNode)
+        result = field.base_resolver.wrapped_func(None, mock_claim)
+
+        assert result
+
+    def test_has_evidence_returns_false_when_no_evidence(self):
+        mock_claim = Mock()
+        mock_claim.evidence_exists = False
+
+        field = self._get_field_by_name("has_evidence", BoardCandidateClaimNode)
+        result = field.base_resolver.wrapped_func(None, mock_claim)
+
+        assert not result
+
+    def test_has_evidence_falls_back_to_evidences_filter_when_annotation_missing(self):
+        mock_claim = Mock(spec=[])
+        mock_claim.evidences = Mock()
+        mock_claim.evidences.filter.return_value.exists.return_value = True
+
+        field = self._get_field_by_name("has_evidence", BoardCandidateClaimNode)
+        result = field.base_resolver.wrapped_func(None, mock_claim)
+
+        mock_claim.evidences.filter.assert_called_once_with(is_removed=False)
+        assert result

backend/tests/unit/apps/owasp/api/internal/queries/board_candidate_claim_test.py

@@ -26,6 +26,7 @@ def test_board_candidate_claims_self(self, mock_claim_model):
 
         claims = [MagicMock(), MagicMock()]
         mock_qs = MagicMock()
+        mock_qs.annotate.return_value = mock_qs
         mock_qs.order_by.return_value = claims
         mock_claim_model.objects.filter.return_value = mock_qs
 
@@ -48,6 +49,7 @@ def test_board_candidate_claims_non_self_filters_approved(self, mock_claim_model
         info = _make_info(user)
 
         base_qs = MagicMock()
+        base_qs.annotate.return_value = base_qs
         ordered_qs = MagicMock()
         filtered_qs = MagicMock()
         ordered_qs.filter.return_value = filtered_qs
@@ -68,6 +70,7 @@ def test_board_candidate_claims_anonymous_filters_approved(self, mock_claim_mode
         info = _make_info(user)
 
         base_qs = MagicMock()
+        base_qs.annotate.return_value = base_qs
         ordered_qs = MagicMock()
         filtered_qs = MagicMock()
         ordered_qs.filter.return_value = filtered_qs

e2e/helpers/mockAuthCookies.ts

@@ -0,0 +1,32 @@
+export const authCookies = [
+  {
+    name: 'csrftoken',
+    value: 'abc123',
+    domain: 'localhost',
+    path: '/',
+  },
+  {
+    name: 'nest.session-id',
+    value: 'test-session-id',
+    domain: 'localhost',
+    path: '/',
+  },
+  {
+    name: 'next-auth.csrf-token',
+    value: 'test-csrf-token',
+    domain: 'localhost',
+    path: '/',
+  },
+  {
+    name: 'next-auth.callback-url',
+    value: '/',
+    domain: 'localhost',
+    path: '/',
+  },
+  {
+    name: 'next-auth.session-token',
+    value: 'test-session-token',
+    domain: 'localhost',
+    path: '/',
+  },
+]

e2e/helpers/mockClaimAuth.ts

@@ -0,0 +1,42 @@
+import { authCookies } from './mockAuthCookies'
+
+export const mockClaimAuth = async (page, mockData, login = 'testuser', operationNames?: string[]) => {
+  await page.route('**/api/auth/session', async (route) => {
+    await route.fulfill({
+      status: 200,
+      json: {
+        accessToken: 'test-access-token',
+        expires: '2125-08-28T01:33:56.550Z',
+        user: {
+          isOwaspStaff: false,
+          login,
+        },
+      },
+    })
+  })
+  await page.route('**/graphql/', async (route, request) => {
+    const postData = request.postDataJSON()
+    if (postData.operationName === 'SyncDjangoSession') {
+      await route.fulfill({
+        status: 200,
+        json: {
+          data: {
+            githubAuth: {
+              message: 'test message',
+              ok: true,
+              user: { isOwaspStaff: false },
+            },
+          },
+        },
+      })
+    } else if (operationNames && postData.operationName && !operationNames.includes(postData.operationName)) {
+      await route.abort('aborted')
+    } else {
+      await route.fulfill({
+        status: 200,
+        json: { data: mockData },
+      })
+    }
+  })
+  await page.context().addCookies(authCookies)
+}

e2e/helpers/mockDashboardCookies.ts

@@ -1,3 +1,5 @@
+import { authCookies } from './mockAuthCookies'
+
 export const mockDashboardCookies = async (page, mockDashboardData, isOwaspStaff) => {
   await page.route('**/api/auth/session', async (route) => {
     await route.fulfill({
@@ -36,36 +38,5 @@ export const mockDashboardCookies = async (page, mockDashboardData, isOwaspStaff
       })
     }
   })
-  await page.context().addCookies([
-    {
-      name: 'csrftoken',
-      value: 'abc123',
-      domain: 'localhost',
-      path: '/',
-    },
-    {
-      name: 'nest.session-id',
-      value: 'test-session-id',
-      domain: 'localhost',
-      path: '/',
-    },
-    {
-      name: 'next-auth.csrf-token',
-      value: 'test-csrf-token',
-      domain: 'localhost',
-      path: '/',
-    },
-    {
-      name: 'next-auth.callback-url',
-      value: '/',
-      domain: 'localhost',
-      path: '/',
-    },
-    {
-      name: 'next-auth.session-token',
-      value: 'test-session-token',
-      domain: 'localhost',
-      path: '/',
-    },
-  ])
+  await page.context().addCookies(authCookies)
 }