Baseline Validation App MVP

A lightweight web application to validate your Data-Classification-to-Control Baseline for SMEs.

Overview

This app has three main parts:

1. Case Checker: Load your cases (C01–C08) and automatically check them against baseline rules. Conflicts are flagged.
2. Reviewer Form: Collect structured feedback from reviewers on four criteria: clarity, consistency, feasibility, and traceability.
3. Export & Report: Generate clean CSV and text reports ready to paste into your thesis.

Quick Start

Prerequisites

• Python 3.8+
• pip

Installation

1. Navigate to the project directory:

   cd validation_app

2. Create a virtual environment:

   python3 -m venv venv

3. Activate the virtual environment:

   • macOS/Linux:

     source venv/bin/activate

   • Windows:

     venv\Scripts\activate

4. Install dependencies:

   pip install -r requirements.txt

Running the App

1. Make sure the virtual environment is activated.

2. Run the app:

   python run.py

3. Open your browser and go to:

   http://127.0.0.1:5000
   

4. The app will create a SQLite database (validation.db) automatically.

Optional: Use PostgreSQL Instead of SQLite

By default, the app uses SQLite (app/validation.db). To store form data in PostgreSQL, set DATABASE_URL before running the app.

Example:

export DATABASE_URL="postgresql+psycopg://postgres:postgres@localhost:5432/validation_app"
python run.py

If DATABASE_URL is set, all app data (cases, baselines, reviews, LLM suggestions, threat models) is stored in PostgreSQL.

Share the Same PostgreSQL Between Local and Render

If you want your local app and Render to show the exact same data, use the same hosted PostgreSQL connection string in both places.

1. Copy the PostgreSQL DATABASE_URL from Render.
2. Create a local .env file in validation_app/.
3. Put this inside the file:

   DATABASE_URL="postgresql+psycopg://USER:PASSWORD@HOST:PORT/DATABASE_NAME"

4. Restart your local app with python run.py.

The app will load .env automatically, so local and Render will point to the same database.

How to Use

Step 1: Define Baseline Rules

Before adding cases, define your baseline rules. Example:

• Level: Top Secret
  • Min Access Rule: Named accounts with role-based access
  • MFA Required: Yes
  • Min Admin Rule: Dual approval for admin access
  • Min Logging Rule: All access, all modifications, failed attempts
  • Encryption Required: Yes

Step 2: Add and Check Cases

1. Go to Case Checker.
2. Fill in the case details (case ID, data level, access rule, etc.).
3. Click Add Case. The app will automatically check it against baseline rules.
4. View results immediately.

Example Case:

• Case ID: C01
• Data Level: Top Secret
• Access Rule: Named accounts with role-based access
• MFA Required: Yes
• Admin Rule: Dual approval
• Logging Rule: All access, all modifications, failed attempts
• Encryption Required: Yes

Step 3: Collect Reviewer Feedback

1. Go to Review Form.
2. Send the link to reviewers.
3. Reviewers fill out the form with:
   • Clarity score (1–5)
   • Consistency score (1–5)
   • Feasibility score (1–5)
   • Traceability score (1–5)
   • Comments for each criterion
   • Overall feedback

Step 4: Export Results

Go to Results & Export and download:

• conflict_log.csv: All case-vs-baseline mismatches. Ready to paste into thesis.
• reviewer_scores.csv: Reviewer scores and averages. Ready to paste into thesis.
• reviewer_comments.txt: All reviewer feedback organized by person. Use for baseline v2 revision.

File Structure

validation_app/
├── run.py                          # Entry point
├── requirements.txt                # Python dependencies
├── validation.db                   # SQLite database (created on first run)
└── app/
    ├── __init__.py                 # Flask app factory
    ├── models.py                   # Database models (Case, Baseline, Review, etc.)
    ├── checker.py                  # Case checker logic
    ├── routes.py                   # All API and web routes
    ├── export.py                   # Export CSV and text reports
    ├── static/
    │   ├── css/
    │   │   └── style.css           # Custom CSS (Bootstrap theme)
    │   └── js/
    │       ├── checker.js          # Case form and checking logic
    │       ├── reviewer.js         # Reviewer form submission
    │       └── results.js          # Results and export display
    └── templates/
        ├── index.html              # Home page
        ├── checker.html            # Case checker page
        ├── reviewer.html           # Reviewer form page
        └── results.html            # Results & export page

API Endpoints

Baseline Management

• GET /api/baseline – Get all baseline rules
• POST /api/baseline – Create or update baseline rule

Case Management

• GET /api/cases – Get all cases
• POST /api/cases – Create a new case
• PUT /api/cases/<case_id> – Update a case
• DELETE /api/cases/<case_id> – Delete a case

Case Checking

• GET /api/checker/check/<case_id> – Check a single case
• GET /api/checker/check-all – Check all cases

Reviewer Management

• POST /api/reviewer – Submit a reviewer's feedback
• GET /api/reviews – Get all reviews

Export

• GET /api/export/conflict-log – Download conflict log (CSV)
• GET /api/export/reviewer-scores – Download reviewer scores (CSV)
• GET /api/export/reviewer-comments – Download reviewer comments (TXT)

Example Workflow

1. Monday: Define baseline rules. Add cases C01–C08. Run checks. See 2 conflicts.
2. Tuesday: Send reviewer form link to 3 reviewers.
3. Wednesday: Reviewers submit feedback.
4. Thursday: Download reports. Review comments. Update baseline v2.
5. Friday: Prepare for interviews using cleaned-up baseline v2.

Customization

Modify Evaluation Criteria

Edit app/templates/reviewer.html to add or change scoring questions. Also update app/models.py Review model.

Change Database

By default, SQLite is used (no server needed). To switch to PostgreSQL:

1. Create a PostgreSQL database (example name: validation_app).
2. Set DATABASE_URL, for example:

   export DATABASE_URL="postgresql+psycopg://postgres:postgres@localhost:5432/validation_app"

3. Run the app. Tables are created automatically on startup.

Run in Docker

Create a Dockerfile and docker-compose.yml if you want to containerize the app. (Example provided on request.)

Troubleshooting

Database Issues

• Delete old data: Remove validation.db and restart the app.
• Migrations: The app auto-creates tables on first run.

Port Already in Use

Change the port in run.py:

app.run(debug=True, host='127.0.0.1', port=5001)  # Use 5001 instead of 5000

CORS Issues

If running the frontend on a different port, add CORS headers. Install:

pip install Flask-CORS

Update app/__init__.py:

from flask_cors import CORS
CORS(app)

Future Enhancements

• User authentication for reviewers
• Mobile app
• Automated email invitations to reviewers

Support

For questions or issues, consult the code, the thesis documentation, or me directly (kelvilikol13@gmail.com)

---

Built for: Data-Classification-to-Control Baseline for SMEs (Master's Thesis)
Created: May 2026