feat: Sync applied controls to their reference control

backend/core/migrations/0115_appliedcontrol_is_synced_from_reference_control_and_more.py

@@ -0,0 +1,24 @@
+# Generated by Django 5.2.7 on 2025-11-18 15:18
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0114_asset_dora_criticality_assessment_and_more'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='appliedcontrol',
+            name='is_synced_from_reference_control',
+            field=models.BooleanField(default=True, verbose_name='Is synced from reference control'),
+        ),
+        migrations.AlterField(
+            model_name='appliedcontrol',
+            name='reference_control',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE, related_name='applied_controls', to='core.referencecontrol', verbose_name='Reference Control'),
+        ),
+    ]

backend/core/models.py

@@ -1452,6 +1452,39 @@ class Meta:
         verbose_name = _("Reference control")
         verbose_name_plural = _("Reference controls")
 
+    def save(self, *args, **kwargs):
+        old_description = ""
+        if self.pk:
+            old_reference_control = ReferenceControl.objects.filter(pk=self.pk).first()
+            if old_reference_control is not None:
+                old_description = old_reference_control.description
+
+        return_value = super().save(*args, **kwargs)
+
+        synced_applied_controls = self.applied_controls.filter(is_synced_from_reference_control=True)
+        for applied_control in synced_applied_controls:
+            applied_control.category = self.category
+            applied_control.csf_function = self.csf_function
+
+        AppliedControl.objects.bulk_update(
+            synced_applied_controls,
+            ["category", "csf_function"],
+            batch_size=1000
+        )
+
+        unset_description_applied_controls = synced_applied_controls.filter(
+            Q(description__isnull=True) | Q(description__in=["", old_description])
+        )
+        for applied_control in unset_description_applied_controls:
+            applied_control.description = self.description
+
+        AppliedControl.objects.bulk_update(
+            unset_description_applied_controls,
+            ["description"],
+            batch_size=1000
+        )
+        return return_value
+
     def is_deletable(self) -> bool:
         """
         Returns True if the framework can be deleted
@@ -3653,8 +3686,10 @@ class Status(models.TextChoices):
         on_delete=models.CASCADE,
         null=True,
         blank=True,
+        related_name="applied_controls",
         verbose_name=_("Reference Control"),
     )
+    is_synced_from_reference_control = models.BooleanField(default=True, verbose_name=_("Is synced from reference control"))
     ref_id = models.CharField(
         max_length=100, null=True, blank=True, verbose_name=_("reference id")
     )

frontend/messages/ar.json

@@ -947,5 +947,7 @@
 	"samlAuthnRequestSignedHelpText": "عند التمكين، يتم توقيع طلب المصادقة SAML بالمفتاح الخاص أدناه. يتم إرسال الشهادة العامة المقابلة إلى موفر الهوية حتى يتمكن من التحقق من التوقيع.",
 	"downloadCertificate": "تنزيل الشهادة",
 	"viewMore": "عرض المزيد",
-	"viewLess": "عرض أقل"
+	"viewLess": "عرض أقل",
+	"syncWithReferenceControl": "المزامنة مع عناصر التحكم المرجعية",
+	"syncWithReferenceControlHelpText": "يحدّث الحقول عند تحديث عنصر التحكم المرجعي."
 }

frontend/messages/cs.json

@@ -967,5 +967,7 @@
 	"samlAuthnRequestSignedHelpText": "Pokud je povoleno, požadavek na ověření SAML je podepsán soukromým klíčem níže. Odpovídající veřejný certifikát je odeslán poskytovateli identity, aby mohl ověřit podpis.",
 	"downloadCertificate": "Stáhnout certifikát",
 	"viewMore": "Zobrazit více",
-	"viewLess": "Zobrazit méně"
+	"viewLess": "Zobrazit méně",
+	"syncWithReferenceControl": "Synchronizovat s referenčními kontrolami",
+	"syncWithReferenceControlHelpText": "Aktualizuje pole při aktualizaci referenční kontroly."
 }

frontend/messages/da.json

@@ -1259,5 +1259,7 @@
 	"samlAuthnRequestSignedHelpText": "Når aktiveret, bliver SAML-autentificeringsanmodningen underskrevet med den private nøgle nedenfor. Det tilsvarende offentlige certifikat sendes til Identity Provider, så det kan verificere underskriften.",
 	"downloadCertificate": "Download certifikat",
 	"viewMore": "Se mere",
-	"viewLess": "Se mindre"
+	"viewLess": "Se mindre",
+	"syncWithReferenceControl": "Synkroniser med referencekontroller",
+	"syncWithReferenceControlHelpText": "Opdaterer felter ved opdatering af referencekontrol."
 }

frontend/messages/de.json

@@ -986,5 +986,7 @@
 	"samlAuthnRequestSignedHelpText": "Wenn aktiviert, wird die SAML-Authentifizierungsanfrage mit dem privaten Schlüssel unten signiert. Das zugehörige öffentliche Zertifikat wird an den Identitätsanbieter gesendet, damit er die Signatur überprüfen kann.",
 	"downloadCertificate": "Zertifikat herunterladen",
 	"viewMore": "Mehr anzeigen",
-	"viewLess": "Weniger anzeigen"
+	"viewLess": "Weniger anzeigen",
+	"syncWithReferenceControl": "Mit Referenzkontrollen synchronisieren",
+	"syncWithReferenceControlHelpText": "Aktualisiert Felder bei Aktualisierung der Referenzkontrolle."
 }

frontend/messages/el.json

@@ -1676,5 +1676,7 @@
 	"samlAuthnRequestSignedHelpText": "Όταν είναι ενεργοποιημένο, το αίτημα αυθεντικοποίησης SAML υπογράφεται με το ιδιωτικό κλειδί παρακάτω. Το αντίστοιχο δημόσιο πιστοποιητικό αποστέλλεται στον πάροχο ταυτότητας ώστε να μπορέσει να επαληθεύσει την υπογραφή.",
 	"downloadCertificate": "Λήψη πιστοποιητικού",
 	"viewMore": "Προβολή περισσότερων",
-	"viewLess": "Προβολή λιγότερων"
+	"viewLess": "Προβολή λιγότερων",
+	"syncWithReferenceControl": "Συγχρονισμός με πρότυπους ελέγχους",
+	"syncWithReferenceControlHelpText": "Ενημερώνει τα πεδία κατά την ενημέρωση του πρότυπου ελέγχου."
 }

frontend/messages/en.json

@@ -209,7 +209,7 @@
 	"strengthOfKnowledge": "Strength of knowledge",
 	"dueDate": "Due date",
 	"startDate": "Start date",
-	"endDate": "End date",
+	"endDate": "End Date",
 	"attachment": "Attachment",
 	"observation": "Observation",
 	"observationHelpText": "Additional notes and comments in markdown format",
@@ -930,7 +930,6 @@
 	"timeline": "Timeline",
 	"timelineEntries": "Timeline",
 	"graph": "Graph",
-	"startDate": "Start date",
 	"startDateHelpText": "Start date (useful for timeline)",
 	"backupLoadingError": "An error occurred while loading the backup.",
 	"backupVersionError": "Can't load the backup, the version of the backup is invalid",
@@ -1695,7 +1694,6 @@
 	"month": "Month",
 	"months": "Months",
 	"year": "Year",
-	"endDate": "End Date",
 	"pending": "Pending",
 	"completed": "Completed",
 	"cancelled": "Cancelled",
@@ -2670,5 +2668,7 @@
 	"doraAlternativeProviders": "Alternative Providers",
 	"doraAttributes": "DORA Attributes",
 	"doraAssessment": "DORA Assessment",
-	"moreOnTerminologiesHelpText": "Hint: more options can be defined through terminologies"
+	"moreOnTerminologiesHelpText": "Hint: more options can be defined through terminologies",
+	"syncWithReferenceControl": "Sync with reference controls",
+	"syncWithReferenceControlHelpText": "Updates fields on reference control update."
 }

frontend/messages/es.json

@@ -986,5 +986,7 @@
 	"samlAuthnRequestSignedHelpText": "Cuando está habilitado, la solicitud de autenticación SAML se firma con la clave privada a continuación. El certificado público correspondiente se envía al Proveedor de Identidad para que pueda verificar la firma.",
 	"downloadCertificate": "Descargar certificado",
 	"viewMore": "Ver más",
-	"viewLess": "Ver menos"
+	"viewLess": "Ver menos",
+	"syncWithReferenceControl": "Sincronizar con controles de referencia",
+	"syncWithReferenceControlHelpText": "Actualiza los campos al actualizar el control de referencia."
 }

frontend/messages/fr.json

@@ -2670,5 +2670,7 @@
 	"webhookEndpointUrlHelpText": "L'URL où l'application recevra les webhooks entrants du service tiers.",
 	"webhookSecret": "Secret webhook",
 	"webhookSecretAlreadySetHelpText": "Le secret webhook est déjà défini.",
-	"webhookUrl": "URL webhook"
+	"webhookUrl": "URL webhook",
+	"syncWithReferenceControl": "Synchroniser avec les mesures de référence",
+	"syncWithReferenceControlHelpText": "Met à jour les champs lors de la mise à jour d’une mesure de référence."
 }

frontend/messages/hi.json

@@ -948,5 +948,7 @@
 	"samlAuthnRequestSignedHelpText": "जब सक्षम किया जाता है, तो SAML प्रमाणीकरण अनुरोध नीचे दिए गए निजी कुंजी के साथ हस्ताक्षरित किया जाता है। संबंधित सार्वजनिक सर्टिफिकेट को पहचान प्रदाता को भेजा जाता है ताकि यह हस्ताक्षर की पुष्टि कर सके।",
 	"downloadCertificate": "सर्टिफिकेट डाउनलोड करें",
 	"viewMore": "और देखें",
-	"viewLess": "कम देखें"
+	"viewLess": "कम देखें",
+	"syncWithReferenceControl": "संदर्भ नियंत्रणों के साथ सिंक करें",
+	"syncWithReferenceControlHelpText": "संदर्भ नियंत्रण अपडेट होने पर फ़ील्ड अपडेट करता है।"
 }

frontend/messages/hr.json

@@ -1945,5 +1945,7 @@
 	"samlPrivateKeyHelpText": "Samo za pisanje: koristite ovo polje samo ako trebate unijeti vlastiti privatni ključ/certifikat. U suprotnom, aplikacija će ga generirati.",
 	"samlCertificateHelpText": "Možete navesti vlastiti certifikat ili pustiti aplikaciju da ga generira.",
 	"samlAuthnRequestSignedHelpText": "Kada je omogućeno, zahtjev za SAML autentifikaciju potpisuje se privatnim ključem ispod. Odgovarajući javni certifikat šalje se Identity Provideru kako bi mogao provjeriti potpis.",
-	"downloadCertificate": "Preuzmi certifikat"
+	"downloadCertificate": "Preuzmi certifikat",
+	"syncWithReferenceControl": "Sinkronizacija s referentnim kontrolama",
+	"syncWithReferenceControlHelpText": "Ažurira polja pri ažuriranju referentne kontrole."
 }

frontend/messages/hu.json

@@ -979,5 +979,7 @@
 	"samlAuthnRequestSignedHelpText": "Ha engedélyezve van, a SAML hitelesítési kérelem aláírva lesz az alábbi privát kulccsal. A megfelelő nyilvános tanúsítvány elküldve lesz az Azonosítószolgáltatónak, hogy ellenőrizhesse az aláírást.",
 	"downloadCertificate": "Tanúsítvány letöltése",
 	"viewMore": "Több megjelenítése",
-	"viewLess": "Kevesebb megjelenítése"
+	"viewLess": "Kevesebb megjelenítése",
+	"syncWithReferenceControl": "Szinkronizálás a referenciaellenőrzésekkel",
+	"syncWithReferenceControlHelpText": "Frissíti a mezőket a referenciaellenőrzés frissítésekor."
 }

frontend/messages/id.json

@@ -1164,5 +1164,7 @@
 	"samlAuthnRequestSignedHelpText": "Ketika diaktifkan, permintaan autentikasi SAML ditandatangani dengan kunci privat di bawah ini. Sertifikat publik yang sesuai dikirimkan ke Penyedia Identitas sehingga dapat memverifikasi tanda tangan.",
 	"downloadCertificate": "Unduh sertifikat",
 	"viewMore": "Lihat lebih banyak",
-	"viewLess": "Lihat lebih sedikit"
+	"viewLess": "Lihat lebih sedikit",
+	"syncWithReferenceControl": "Sinkronkan dengan kontrol referensi",
+	"syncWithReferenceControlHelpText": "Memperbarui bidang saat kontrol referensi diperbarui."
 }

frontend/messages/it.json

@@ -1356,5 +1356,7 @@
 	"samlAuthnRequestSignedHelpText": "Quando abilitato, la richiesta di autenticazione SAML viene firmata con la chiave privata qui sotto. Il certificato pubblico corrispondente viene inviato al Provider di Identità in modo che possa verificare la firma.",
 	"downloadCertificate": "Scarica certificato",
 	"viewMore": "Vedi di più",
-	"viewLess": "Vedi meno"
+	"viewLess": "Vedi meno",
+	"syncWithReferenceControl": "Sincronizza con i controlli di riferimento",
+	"syncWithReferenceControlHelpText": "Aggiorna i campi quando viene aggiornato il controllo di riferimento."
 }

frontend/messages/nl.json

@@ -982,5 +982,7 @@
 	"samlAuthnRequestSignedHelpText": "Wanneer ingeschakeld, wordt het SAML-authenticatieverzoek ondertekend met de privésleutel hieronder. Het bijbehorende openbare certificaat wordt naar de identiteitsprovider verzonden, zodat deze de handtekening kan verifiëren.",
 	"downloadCertificate": "Certificaat downloaden",
 	"viewMore": "Meer weergeven",
-	"viewLess": "Minder weergeven"
+	"viewLess": "Minder weergeven",
+	"syncWithReferenceControl": "Synchroniseren met referentiecontroles",
+	"syncWithReferenceControlHelpText": "Werkt velden bij wanneer de referentiecontrole wordt bijgewerkt."
 }

frontend/messages/pl.json

@@ -1719,5 +1719,7 @@
 	"samlAuthnRequestSignedHelpText": "Gdy włączone, żądanie uwierzytelniania SAML jest podpisywane kluczem prywatnym poniżej. Odpowiedni certyfikat publiczny jest wysyłany do dostawcy tożsamości, aby mógł zweryfikować podpis.",
 	"downloadCertificate": "Pobierz certyfikat",
 	"viewMore": "Pokaż więcej",
-	"viewLess": "Pokaż mniej"
+	"viewLess": "Pokaż mniej",
+	"syncWithReferenceControl": "Synchronizuj z kontrolami referencyjnymi",
+	"syncWithReferenceControlHelpText": "Aktualizuje pola podczas aktualizacji kontroli referencyjnej."
 }

frontend/messages/pt.json

@@ -979,5 +979,7 @@
 	"samlAuthnRequestSignedHelpText": "Quando ativado, a solicitação de autenticação SAML é assinada com a chave privada abaixo. O certificado público correspondente é enviado ao Provedor de Identidade para que ele possa verificar a assinatura.",
 	"downloadCertificate": "Baixar certificado",
 	"viewMore": "Ver mais",
-	"viewLess": "Ver menos"
+	"viewLess": "Ver menos",
+	"syncWithReferenceControl": "Sincronizar com controles de referência",
+	"syncWithReferenceControlHelpText": "Atualiza os campos na atualização do controle de referência."
 }

frontend/messages/ro.json

@@ -976,5 +976,7 @@
 	"samlAuthnRequestSignedHelpText": "Când este activat, cererea de autentificare SAML este semnată cu cheia privată de mai jos. Certificatul public corespunzător este trimis furnizorului de identitate pentru a putea verifica semnătura.",
 	"downloadCertificate": "Descărcați certificatul",
 	"viewMore": "Vizualizați mai mult",
-	"viewLess": "Vizualizați mai puțin"
+	"viewLess": "Vizualizați mai puțin",
+	"syncWithReferenceControl": "Sincronizare cu controalele de referință",
+	"syncWithReferenceControlHelpText": "Actualizează câmpurile la actualizarea controlului de referință."
 }

frontend/messages/sv.json

@@ -970,5 +970,7 @@
 	"samlAuthnRequestSignedHelpText": "När det är aktiverat, signeras SAML-autentiseringsbegäran med den privata nyckeln nedan. Det motsvarande offentliga certifikatet skickas till identitetsleverantören så att den kan verifiera signaturen.",
 	"downloadCertificate": "Ladda ner certifikat",
 	"viewMore": "Visa mer",
-	"viewLess": "Visa mindre"
+	"viewLess": "Visa mindre",
+	"syncWithReferenceControl": "Synkronisera med referenskontroller",
+	"syncWithReferenceControlHelpText": "Uppdaterar fält vid uppdatering av referenskontroll."
 }

frontend/messages/tr.json

@@ -1712,5 +1712,7 @@
 	"samlAuthnRequestSignedHelpText": "Etkinleştirildiğinde, SAML kimlik doğrulama isteği aşağıdaki özel anahtar ile imzalanır. İmzayı doğrulayabilmesi için ilgili genel sertifika Kimlik Sağlayıcıya gönderilir.",
 	"downloadCertificate": "Sertifikayı indir",
 	"viewMore": "Daha fazla görüntüle",
-	"viewLess": "Daha az görüntüle"
+	"viewLess": "Daha az görüntüle",
+	"syncWithReferenceControl": "Referans kontrollerle senkronize et",
+	"syncWithReferenceControlHelpText": "Referans kontrol güncellendiğinde alanları günceller."
 }

frontend/messages/uk.json

@@ -1493,5 +1493,7 @@
 	"samlAuthnRequestSignedHelpText": "Коли увімкнено, запит на аутентифікацію SAML підписується приватним ключем нижче. Відповідний публічний сертифікат надсилається постачальнику ідентифікації, щоб він міг перевірити підпис.",
 	"downloadCertificate": "Завантажити сертифікат",
 	"viewMore": "Переглянути більше",
-	"viewLess": "Переглянути менше"
+	"viewLess": "Переглянути менше",
+	"syncWithReferenceControl": "Синхронізувати з типовими контролями",
+	"syncWithReferenceControlHelpText": "Оновлює поля під час оновлення типового контролю."
 }

frontend/messages/ur.json

@@ -947,5 +947,7 @@
 	"samlAuthnRequestSignedHelpText": "جب فعال ہو، تو SAML توثیق کی درخواست نیچے دی گئی پریویٹ کلی کے ساتھ سائن کی جاتی ہے۔ متعلقہ پبلک سرٹیفکیٹ کو شناخت فراہم کنندہ کو بھیجا جاتا ہے تاکہ وہ دستخط کی تصدیق کر سکے۔",
 	"downloadCertificate": "سرٹیفکیٹ ڈاؤن لوڈ کریں",
 	"viewMore": "مزید دیکھیں",
-	"viewLess": "کم دیکھیں"
+	"viewLess": "کم دیکھیں",
+	"syncWithReferenceControl": "حوالہ کنٹرول کے ساتھ ہم آہنگ کریں",
+	"syncWithReferenceControlHelpText": "حوالہ کنٹرول کی تازہ کاری پر فیلڈز کو اپ ڈیٹ کرتا ہے۔"
 }

frontend/src/lib/components/Forms/ModelForm/AppliedControlPolicyForm.svelte

@@ -69,6 +69,11 @@
 		}
 	});
 
+	let hasReferenceControl = $state(false);
+	form.form.subscribe((newFormData) => {
+		hasReferenceControl = Boolean(newFormData.reference_control);
+	});
+
 	run(() => {
 		if (model?.selectOptions?.priority) {
 			model.selectOptions.priority.forEach((element) => {
@@ -126,6 +131,15 @@
 		label={m.evidences()}
 	/>
 
+	{#if hasReferenceControl}
+		<Checkbox
+			{form}
+			field="is_synced_from_reference_control"
+			label={m.syncWithReferenceControl()}
+			helpText={m.syncWithReferenceControlHelpText()}
+		/>
+	{/if}
+
 	<Dropdown
 		open={false}
 		style="hover:text-primary-700"

frontend/src/lib/utils/schemas.ts

@@ -156,7 +156,7 @@ export const RiskScenarioSchema = z.object({
 
 export const AppliedControlSchema = z.object({
 	...NameDescriptionMixin,
-	ref_id: z.string().optional(),
+	ref_id: z.string().optional().nullable(),
 	category: z.string().optional().nullable(),
 	csf_function: z.string().optional().nullable(),
 	priority: z.number().optional().nullable(),
@@ -195,6 +195,7 @@ export const AppliedControlSchema = z.object({
 		.optional(),
 	folder: z.string(),
 	reference_control: z.string().optional().nullable(),
+	is_synced_from_reference_control: z.boolean().optional().default(true),
 	owner: z.string().uuid().optional().array().optional(),
 	security_exceptions: z.string().uuid().optional().array().optional(),
 	stakeholders: z.string().uuid().optional().array().optional(),