mizcausevic-dev/cyberark-access-review-sync

Purpose and principal workflow: An HTTP client—typically an operator or downstream API consumer—requests a review view or API result. The FastAPI application reads a locally seeded CyberArk-style account inventory, evaluates risk and review readiness, and returns rendered HTML or structured JSON for prioritized queues, findings, and approval-ready evidence. Despite the product’s “sync” framing, the sampled code demonstrates local-data evaluation and presentation, not a live CyberArk extraction or downstream queue write.

Components

HTTP application

• FastAPI application — app/main.py: Defines the web entry point, HTML and JSON routes, and their calls into the review service.

• Uvicorn host — null repository path (external runtime): The module’s executable entry point starts Uvicorn to serve the FastAPI application.

Review data and decisioning

• Seed account inventory — app/data/sample_review_data.json: Supplies the account records loaded by the service; this is local sample state, not evidence of a live vault connection.

• Review decision and payload service — app/services/review_sync_service.py: Loads that inventory and computes risk, verdicts, review readiness, account catalogs, queues, findings, summaries, and approval payloads. Risk scoring and per-account evaluation are internal steps in this main workflow.

Operator and consumer surfaces

• HTML review surfaces — app/render.py: Builds the overview, queue, findings, audit, settings, methodology, and API-summary pages from service data.

• JSON API surfaces — app/main.py: Exposes summary, account listing/detail, review queue, findings, and sample-payload endpoints. This shares the application module with the route entry point, rather than representing a separate backend.

External actors

• HTTP client — null repository path (external caller): Initiates the workflow by requesting a page or API endpoint.

• CyberArk vault — null repository path (external system described by the product): The README describes CyberArk as the metadata source, but the sampled implementation reads the local JSON inventory and shows no vault API call.

• Downstream governance or review systems — null repository path (external systems described by the product): The README describes approval-ready handoffs and target systems, but the sampled implementation does not establish an outbound integration.

Relationships

• HTTP client -> Uvicorn host: Sends an HTTP request to the locally served application; the module’s run block configures Uvicorn.

• Uvicorn host -> FastAPI application: Serves the application specified by the Uvicorn run call.

• FastAPI application -> Review decision and payload service: Calls service methods for API results; route handlers call page renderers for HTML responses.

• FastAPI application -> HTML review surfaces: Invokes the relevant renderer for each HTML route.

• HTML review surfaces -> Review decision and payload service: Calls service methods to assemble page data; the renderer constructs a service instance at import time.

• Review decision and payload service -> Seed account inventory: Opens and parses the JSON file during service construction.

• FastAPI application -> HTTP client: Returns rendered HTML or JSON results, and returns 404 for an unknown account detail request.

• Review decision and payload service -> Downstream governance or review systems: No runtime call is established; the service constructs approval-ready payload data, but sampled code does not transmit it.

• CyberArk vault -> Review decision and payload service: No runtime extraction relationship is established; the described vault source is not called in the sampled implementation.

Coverage limits: The service and renderer excerpts are partial, so details of some returned fields and page construction are not visible. The README documents broader sync and audit-evidence behavior, but the sampled implementation does not establish scheduled execution, live CyberArk access, persistent state beyond the seed file, audit-event replay, or outbound integrations.