feat(crypto): add PQC policy evaluation for CBOM assets

[jcrossley3]

Create crypto domain module with algorithm listing and policy evaluation endpoints. Algorithms from ingested CBOMs are classified as Compliant (PQC-safe), Warning (classical), or NonCompliant (weak) based on a built-in rules engine.

Implements TC-5851

Summary by Sourcery

Add crypto policy evaluation APIs for assessing CBOM algorithms against post-quantum readiness rules.

New Features:

• Add endpoints to list cryptographic algorithms extracted from CBOM assets and evaluate their post-quantum cryptography policy status.
• Classify algorithms as compliant, warning, or non-compliant using built-in PQC and weak-algorithm rules, with optional SBOM filtering and aggregate results.

Enhancements:

• Expose cryptographic asset types and policy evaluation models in the API schema.

Documentation:

• Document the new crypto algorithm listing and policy evaluation endpoints in the OpenAPI specification.

Tests:

• Add unit and integration coverage for algorithm classification, CBOM-derived listings, SBOM filtering, result summaries, and empty datasets.

[sourcery-ai]

Reviewer's Guide

Adds a registered, authenticated crypto API for listing algorithm assets from ingested CBOMs and evaluating them against a built-in PQC policy engine, with pagination, optional SBOM scoping, OpenAPI schemas, and unit/integration coverage.

Sequence diagram for crypto policy evaluation

sequenceDiagram
    participant Client
    participant API as CryptoAPI
    participant Service as CryptoService
    participant DB as ReadOnlyDB
    participant Policy as PolicyEngine

    Client->>API: POST /v3/crypto/policy/evaluate
    API->>DB: begin()
    API->>Service: evaluate_policy(sbom_id, connection)
    Service->>DB: Load algorithm assets and nodes
    DB-->>Service: CBOM algorithms
    Service->>Policy: evaluate_algorithm(name, properties)
    Policy-->>Service: PolicyVerdict
    Service-->>API: PolicyEvaluationResponse
    API-->>Client: 200 results and summary

Loading

Flow diagram for CBOM algorithm policy classification

flowchart TD
    A[CBOM algorithm asset] --> B[evaluate_algorithm]
    B --> C{PQC-safe pattern?}
    C -->|Yes| D[Compliant]
    C -->|No| E{Weak algorithm or small key?}
    E -->|Yes| F[NonCompliant]
    E -->|No| G[Warning]
    D --> H[Policy result and summary]
    F --> H
    G --> H

Loading

File-Level Changes

Change	Details	Files
Expose crypto algorithm discovery and policy evaluation through authenticated API endpoints.	Register the crypto module and its routes in the fundamental service. Add paginated algorithm listing with query filtering and policy status. Add policy evaluation with optional SBOM filtering and aggregate verdict counts. Document both endpoints and response models in OpenAPI.	modules/fundamental/src/crypto/endpoints/mod.rs modules/fundamental/src/crypto/mod.rs modules/fundamental/src/endpoints.rs modules/fundamental/src/lib.rs openapi.yaml
Implement CBOM algorithm response models and PQC policy classification.	Define API models for algorithm summaries, evaluation requests/results, and verdict summaries. Classify PQC algorithms as compliant, weak algorithms as non-compliant, and classical or unknown algorithms as warnings. Handle SHA-1, weak cipher families, and small RSA/DSA key sizes using algorithm names and CBOM properties. Add unit coverage for PQC, weak, classical, unknown, malformed, and fixture-based algorithm inputs.	modules/fundamental/src/crypto/model.rs modules/fundamental/src/crypto/service/policy.rs
Query ingested CBOM crypto assets and assemble policy-aware results.	Restrict queries to algorithm crypto assets and resolve names through SBOM nodes. Apply deterministic ordering, pagination, filtering, and cached pagination metadata for listing. Evaluate all matching assets or a specified SBOM and compute compliant, warning, and non-compliant totals. Add integration tests covering ingestion, listing, filtering, empty data, verdicts, and summary consistency.	modules/fundamental/src/crypto/service/mod.rs modules/fundamental/src/crypto/endpoints/test.rs
Enable schema generation for crypto asset types.	Derive the OpenAPI schema trait for the existing crypto asset enum.	entity/src/sbom_crypto.rs

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.