Allow retrieval of detailed scan output

[GCHQDeveloper36]

Is your feature request related to a problem? Please describe.

I'd like to see more detailed output from the scanners, even if the scan is successful.

Describe the solution you would like

For each scan invocation, I want to be able to see as much detail as possible that was provided by the tool. This might be the actual log file from the tool, or a more structured response where the tool is more tightly integrated into Bailo.

The system should be able to be configured globally by default to allow any collaborator to view the detailed scan results, but allow a configuration to require a 'minimum' role - either of the entry, or a global system role.

Describe alternatives you have considered

Any output that wasn't considered an 'issue' is lost after a scan has been executed, so there is no current alternative to getting output from a successful scan.

[PE39806]

This sounds like a good idea. Do you think that adding details?: any[] to ScanInterface (and its inherited types) in https://github.com/gchq/Bailo/tree/main/backend/src/models/Scan.ts which a scanner then populates would suffice? This would allow putting in strings if just going for raw logs and objects for anything structured.
A simple switch case on toolName or even just the type of details could be used to format the details items when presented via the frontend.

[ARADDCC002]

This sounds like a good idea. Do you think that adding details?: any[] to ScanInterface (and its inherited types) in https://github.com/gchq/Bailo/tree/main/backend/src/models/Scan.ts which a scanner then populates would suffice? This would allow putting in strings if just going for raw logs and objects for anything structured. A simple switch case on toolName or even just the type of details could be used to format the details items when presented via the frontend.

I'm not personally a massive fan of having any[] there if we can avoid it. I appreciate it might be a bit restrictive, but I'd rather we decided on a good pattern and type it accordingly. Scanning isn't something I'm hugely clued up on so I'm not in a position to definitively decide on what type to use (as I don't know what's the most useful), but I think it's important to type it so that users know exactly what it's going to accept.

Surely string is OK? It would allow for users to enter markdown etc.

[GCHQDeveloper36]

Agreed on trying to keep 'some' structure in place. Maybe you could namespace it by the tool name? So something like:

details?: ScanDetail[]
problems?: ProblemDetail[]
...
ProblemDetail: {
  name: enum ['clamav', 'modelscan', ...],
  severity: ['Critical', 'High', 'Medium', 'Low', 'Info', 'Unknown'],
  detail: string
}
...
ScanDetail: {
  name: enum ['clamav', 'modelscan', ...],
  output: string[], // raw output e.g. stdout
  [key: string]: any
}

ClamAvDetail extends ScanDetail: {
  name: 'clamav',
  viruses: ...
}

Example severity levels can be seen here and how they might map between different contexts.

This gives you a consolidated list of all 'problems' from the scans, but also the detail if you want to 'dive into' a particular scan's output (and other details if you want to build that, per scanner).