CY10: Capstone: a clinic app you can vouch for

Lesson 2 of 5 · reading 15–25 minutes; practice and project time is on the module page

Project 1: assessing the old server

🎯You'll be able to

Turn the assessment skills from CY1 and CY2 into working code and a report the clinic can act on.

🏠The everyday picture

A home inspector's report: each problem has a photo, a severity and the fix, with the most dangerous first, and a cover page the owner can read in two minutes.

📘What it really is

Code in assess/assess.py:
check_settings for the five settings rules.
parse_version and in_range that compare versions as numbers.
check_dependencies that matches only installed packages.
check_headers that lower-cases header names.
run that sorts findings by severity, numbers them F-001 onwards and adds a summary.
main that writes reports/findings.json.
Rules and severities come from docs/FORMATS.md, not from your judgement on the day.
The report in docs/assessment-report.md has the sections docs/FORMATS.md lists, including the scope, a plain summary, the findings and the limits.
Expected result: 12 findings: 1 critical, 2 high, 4 medium and 5 low.

📝A worked example

Input: the starter's in_range, which compares versions as text.

Steps:

Run python -m pytest tests/test_assessment.py -k 03. It fails, because practice-pdf 0.9.12 is wrongly reported as below 0.9.9.
Rewrite parse_version to return a tuple of integers, and compare tuples.
Rerun tests 3 and 4: both pass, and practice-dates 2.10.0 is no longer flagged.

Expected output: tests 3 and 4 passing, and a line in your report's limits saying the advisory list is a practice list.

🌍Where it's used

Assessment tools built in-house by security teams.
Dependency checks in continuous integration.
Consultancy reports delivered to owners.

📝Case scenario

A junior analyst's first report had 40 findings, many duplicates and two false alarms from text version comparison. After rebuilding the checks with numeric versions and one finding per problem, it had 12 clear findings, and the client fixed the top three that week.

🖱️Try it

Run python3 -m assess.assess after finishing the project and open reports/findings.json. Success: F-001 is the critical template package and the summary counts match.

⚠️Common mistakes

Extra findings for safe packages. Sign: practice-dates flagged. Fix: compare numbers.
Missing lower-case headers. Sign: test 6 fails. Fix: lower-case names first.
A report that repeats the JSON. Sign: no plain summary. Fix: write the top actions for the owner.

🛠️For your project

Project 1 is complete when its 10 tests pass and its marking guide is ticked with evidence.

✅Quick check

How many findings should the finished assessment report, and of which severities?

Show the answer

12: 1 critical, 2 high, 4 medium and 5 low.

Where do the rule IDs and severities come from?

Show the answer

The severity guide in docs/FORMATS.md.