cmp307 / project-liamtownsley2

This is a Digital & Hardware Asset Management Panel w/ Login Functionality, Internal API & NIST NVD Integration

ScottishGlen Hardware & Software Management Panel

This is the repository for my submission for Software Engineering Practice (CMP307). It allows for the employees to securely keep track of the Hardware & Software running across the network.

Documentation

Internal API Documentation

Run Locally

Clone the project

  git clone https://github.com/cmp307/project-LiamTownsley2.git ScottishGlen

Go to the project directory

  cd ScottishGlen

Install dependencies

  npm install

Start the server

  npm run start

Running Tests

To run tests, run the following command

  npm run test

Tech Stack

Client: React & Bootstrap

Server: Node, Express, Electron, MongoDB

Download Latest

If you would like to test the program out for yourself now, you can do so by downloading the latest stable version! All you need is the EXE file and you're one click away from launching the application.

Demonstration

Appendix

System Demonstration

---

Created By @LiamTownsley2

project-liamtownsley2's Issues

It must be possible to link Hardware & Software assets together and the current date should be associated with this link.

Ensure that encryption is used throughout the entire process

Create Database Typings

Description

As this project is using TypeScript we will need to create some Database Typing's. This will allow me to more easily manage how the project looks and ensure consistency of objects throughout the project. This will also aid in ensuring that I follow OOP Programming Practices.

Structure

Assets

• Unique Asset Identifier*
• Author's Employee ID
• System Name
• Model
• Manufacturer
• Type
• IP Address
• #16
• Optional: Purchase Date (on Physical Sticker)
• Optional: Note for Asset

Employee

• First Name
• Last Name
• E-Mail Address
• Department (pre-defined list: Finance, Human Resources, Operations, Sales & Information Technology)

* The Unique Asset Identifier can use the MongoDB generated _id field.

dist/ folder is uploaded

Add this file to the .gitignore - I will attach a pre-compiled binary alongside the Source code upon submission.

It should be possible to add/view/edit/delete Hardware Asset Data.

Ensure basic functionality of the website, add in different field types (forms, buttons, etc) and ensure that they all go through to my application as intended.

Ensure that incorrect data cannot be entered into the database.

Input this data into NVD database.

persist login sessions throughout versions

this needs to be done as when the user uses "refresh" buttons, the entire application is refreshed and their session is lossed requiring the user to login again.

this will result in a lot of extra work from users of the software and make the process more annoying than it needs to be

Application should be lightweight and should have minimal response & loading times.

A Hardware Asset Object should be created with the following information: Unique ID, Systen Name, Model, Manufacturer, Type and IP Address. There should also be two optional variables for the purchase date and an extra note.

Implement support for registering a user

Create a login page

The application must be executable on a Windows Machine as a Desktop Application.

Implement a "Scan Software" button on software assets.

Each hardware asset is linked to an employee who is responsible for it.

Encrypt user password & save username & password into database.

Assets & Employees should be linked

Description

The Assets Database Type and the Employee Database type are linked. This is a hard link for the Assets type as it has a REQUIRED field for the Employee's User ID. This ensures that an employee can manage multiple assets at the same time.

MongoDB also has nice support for searching by certain fields meaning that all of the Assets an employee is responsible for can be grabbed quite easily.

Scope

This issue will be complete once you can get the Employee information through the Assets object. I assume this will be done through a .getEmployee() function or something of similar nature.

The information should also be grabbable via the Employee on a .getAssets() function and through a completely independent database function getAssetsByEmployee().

Notes

Further reading into how to do a View Collection (similar to an SQL JOIN statement.):
https://www.mongodb.com/docs/manual/core/views/join-collections-with-view/

Submitting Employee Host Information

Automatically add the current device as an asset. Include the relevant information:

Following data should be collected from end user and stored:

• System Name
• Model
• Manufacturer
• Type
• IP Address
• OPTIONAL: Physical Sticker (Purchase Date)
• OPTIONAL: Additional Note

Application Icon not set

Upon building I am greeted with the above message.

According to config, there should be an icon configured:

Implement Typings for Software Assets, a Software asset should consist of a Unique ID, Operating System Name, Version and Manufacturer.

The data from the system on which it is running should be automatically added to the database.

componentDidMount called twice for every time a component is mounted

This may not be a problem within development however will send excessive requests to the database & make things happen multiple times on the application.

It is intended that componentDidMount works similarly to useEffect, as we are using a Class-based project there is some differences between what we can and cannot use within the react module.

It is likely an issue with how I am implementing it, keep that in mind.

Implement support for logging in as a user

[PROGRESS] Initial Client Brief

The client requests that a software system is designed and developed to track assets within the
company. All asset information should be stored in an online database. It is envisioned that this
database could be used by other company systems in the future and thus descriptive and consistent
naming conventions should be used.

Assets include any hardware being used on the company network. It must be possible to add, view,
edit, or delete asset data. A unique identifier should be automatically generated for each asset. The
client would like the software to automatically get hardware data from the system on which it is
running including system name, model, manufacturer, type, and IP address. Some assets have a
physical sticker with the purchase date, which would be useful to capture. It should also be possible
for a text note to be added, which can contain any extra data the company may want to capture
about the specific asset.

Each asset is linked to an employee who is responsible for it. The first name, last name, and email
address of the employee should be stored. Note that an employee may be responsible for one or
more assets. Employees work within a department, which should also be captured. The departments
within ScottishGlen include finance, human resources, operations, sales, and information
technology.

The system must make data acquisition as easy as possible. It is expected that database
communication will have a minimal response time and that screen refresh time will not delay entry
of data. Clear instructions must be visible to the user who will capture asset data, and a minimal
learning curve is expected (user training time should be less than 30 minutes). The client operates a
Microsoft environment, and the system must be able to run as a desktop application on a Windows
machine.

Todo

• #52
• #53
• #54
• #55

Employee

• #56
  The departments are: Finance, Human Resources, Operations, Sales & Information Technology.

The Initial Client brief also sets out the Non-Functional Requirements in #17.

Implement support for two types of assets Software and hardware assets in the database.

Filter results and only display high / critical vulnerabilities.

finish updating breadcrumb bar on ALL pages.

it has been done on the main 3, however not on any of the rest.
also continue to refactor into classes whilst doing this

username must be visible & setUser must be passed into objects to ensure that user can logout via the button

working:

not working:

An Employee Object should be created with the following information: Unique ID, First Name, Last Name, E-Mail address and department.

[PROGRESS] Non-Functional Requirements

These are the constraints I need to work within whilst developing this application:

• #46
• #47
• #48
• #49
• #50

Integrate Database

Description

The database I have in mind is MongoDB as it is simple to use, free and most importantly. I have experience in using it.

You can see the intended use of this Database by checking issue #2.

Scope

This issue is focused on the basic implementation of the Database. This will focus on read & write requests. Other functionality such as searching the database, or deleting data will be implemented separately in another issue.

Code Testing & Review

• Ensure that the application can indeed connect to the database and has the ability to write.
• Enter dummy data (if data is not already present from last step) to the database and then fetch that data to ensure permissions are working correctly.
• Ensure the program checks for the validity of the specific fields (i.e. e-mail address using regex like ^[\w-\.]+@([\w-]+\.)+[\w-]{2,4}$ to ensure email is valid before inserting to database)

Implement basic database operations

The database should be able to perform the following actions in regards to assets and employees:

Assets

• Create
• Read
• Update
• Delete
• Delete All

Employees

• Create
• Read
• Update
• Delete

add custom pillbutton colours for departments

give departments their own colours instead of them all resorting to the default value

Display NIST result to user.

Render the login page by default & disallow nagivation to other pages unless logged in.

name should be split into first & last

rather than a variable for name it should be split into first_name, last_name as per the client brief. (#51)

Change Implementation of Page Load Event

Description

Currently if you were to push a button on the application it would reload the page and load up the next page slowly. I have seen other implementations in which they edit the DOM and the page content is updated instantly. I believe that this would be beneficial in this project. It would also help to satisfy the requirement of speed in the Client brief.

Scope

This issue should change the implementation of the Page Load Event so that it updates the DOM and loads almost instantly. This issue is not directly within the Client Brief however would help to alleviate loading times throughout the entire application should it become an issue.

Code Testing & Review

• Ensure that Hyperlinks work as intended.
• Ensure that buttons work as intended.
• Ensure that page redirects do not break.
• Check the difference in loading times between DOM loading and reloading the site.

Hardware Asset data should automatically be entered into the database.

CI Test Environment

I am attempting to use Cypress, however the Page Load bug and Component testing doesn't seem to work.
cypress-io/cypress#23903

I'd recommend replacing it with https://www.npmjs.com/package/playwright

Implementation of the React Framework

It would be beneficial from a development standpoint to implement React within this project.

To do so will require the following to be done:

• Add the react package to package.json
• Rework electron to work with react.
• Modify the folder structure of the project to be cleaner
• Convert current HTML pages into to React Components & subdivide into modules.

Executable not receiving html files?

This should display "This is the index page!"

employee assets are not correctly linked

there is an issue where employee's assets are not linked at all to the employee, why?

i'd assume this has something to do with the way that the data is passed into the database however still needs to be confirmed

Add an application icon

Upon first compilation to an exe file it was noticed that the application had no icon. This should be added.
default Electron icon is used reason=application icon is not set

[PROGRESS] Client Requested Changes

The client has identified that it will also be required to track software being used on the company
network. Once again it must be possible to add, view, edit, or delete this asset data.
As before, a unique identifier should be automatically generated for each asset. For now, it would be
sufficient to store data about the operating system name, version, and manufacturer. The client
would like your software to get this data automatically from the system on which it is running. It
should also be possible to link hardware assets with software assets, allowing the client to
determine where software is installed. The current date should be automatically associated with the
link.

For both hardware and software assets, it would be useful if errors in data could be prevented, or
identified and corrected, at the point of entry. Because of security concerns access to the system
must be controlled and any user must be authenticated with an email address and password. Pre-
configured credentials may be used but must be stored securely. Reasonable precautions should be
implemented to ensure the system functions reliably and securely.

The client envisions that asset data will assist in identifying vulnerable assets, which will allow the
information technology department to act. Because it is difficult for the client to track when assets
become vulnerable to new exploits, the system must provide a feature to search for vulnerabilities
to assets in an online database. The security consultant has advised that the NIST National
Vulnerability Database (NVD)1 would be suitable for this purpose. The system should allow checking
a software asset (i.e., operating system) version against the NVD and listing relevant information if a
high or critical severity vulnerability is found.

Software Assets

• #30
• #31
• #32
• #33

Error Checking

• #34

Adding Employee Login

• #35
• #36
• #37
• #38
• #39
• #40
• #41

NIST Vulnerability Database
The client also wants to link the project in with the NIST NVD.

• #42
• #43
• #44
• #45

Create a page to create employee

This should only be possible internally from a user who is already logged in.
Do not allow users to register themselves.

Initialize Basic Electron Application

Description

As per the Client Brief, I will be creating a Desktop application that runs on a Windows PC. To accomplish this I will be using Electron. It will allow me to compact my application into a single Executable file. Allowing me to meet the Client's Specifications however still maintaining the ease of design that having access to HTML & CSS gives me.

This will also allow me to implement hot reloading. Speeding up the development process as I do not need to manually compile the code and refresh my browser each time.

Scope

This issue should focus on getting a basic Electron app initialized, it should be able to display multiple pages, the content is irrelevant to this issue and default Lorem Ipsum text can be used.

Code Testing & Review

• Ensure that the Electron App is able to compile into an executable and be executed.
• Ensure that hot reloading works to speed up the development process.
• #10

Descriptive & consistent naming practices should be followed in Database & Code.

Employees can be responsible for multiple assets.

Application should be easy to learn and require less than 30 minutes of training.

Handle the building of the application automatically

Currently you have to manually switch the DEVELOPMENT const variable to decide what path the app should take, this has now been moved to be completed automatically and using the relevant build script will get you a working version.

As the file structures are different in development than they are in production.