Failing tests for rolling findings up per package and image

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/crates/application/src/tests/vuln_tests.rs

@@ -408,3 +408,62 @@ async fn rescan_refreshes_scanner_details_of_findings_that_are_still_present() {
         "the user's decision is kept"
     );
 }
+
+#[tokio::test]
+async fn host_findings_are_grouped_per_package_and_containers_per_image() {
+    let mut go = raw("CVE-9", "stdlib", "1.21", Severity::High, Some("1.22"));
+    go.source = "gobinary".into();
+    let scanner = FakeScanner::default()
+        .with(
+            "os",
+            Ok(vec![
+                raw("CVE-1", "openssl", "3.0.1", Severity::Critical, Some("3.0.2")),
+                raw("CVE-2", "openssl", "3.0.1", Severity::Low, None),
+                go,
+            ]),
+        )
+        .with(GITEA, Ok(vec![raw("CVE-3", "git", "2.39", Severity::High, None), raw("CVE-4", "curl", "7.8", Severity::Medium, None)]))
+        .with(PG, Ok(vec![raw("CVE-5", "libssl3", "3.0", Severity::Low, None)]));
+    let (_f, svc) = fixture(scanner);
+    svc.scan(&VecLog::default()).await.unwrap();
+
+    let host = svc.groups(FindingFilter { target_kind: Some(TargetKind::Os), ..Default::default() }).await.unwrap();
+    assert_eq!(host.len(), 2, "one row per package, not per CVE");
+    // worst severity first
+    assert_eq!(host[0].key, "openssl");
+    assert_eq!(host[0].counts.critical, 1);
+    assert_eq!(host[0].counts.low, 1);
+    assert_eq!(host[0].total, 2);
+    assert_eq!(host[0].fixable, 1, "only CVE-1 has a fix");
+    assert_eq!(host[0].source, "debian");
+    assert_eq!(host[0].installed, "3.0.1");
+    assert_eq!(host[1].key, "stdlib");
+    assert_eq!(host[1].source, "gobinary");
+
+    let images = svc.groups(FindingFilter { target_kind: Some(TargetKind::Image), ..Default::default() }).await.unwrap();
+    assert_eq!(images.iter().map(|g| g.key.as_str()).collect::<Vec<_>>(), vec![GITEA, PG]);
+    assert_eq!(images[0].total, 2);
+    assert_eq!(images[0].packages, 2, "distinct packages in the image");
+
+    // the group list honours the other filters
+    let high = svc
+        .groups(FindingFilter { target_kind: Some(TargetKind::Os), min_severity: Some(Severity::High), ..Default::default() })
+        .await
+        .unwrap();
+    assert_eq!(high.iter().map(|g| g.key.as_str()).collect::<Vec<_>>(), vec!["openssl", "stdlib"]);
+    assert_eq!(high[0].total, 1, "the low finding is filtered out of the counts");
+}
+
+#[tokio::test]
+async fn findings_of_one_group_can_be_listed() {
+    let scanner = FakeScanner::default()
+        .with("os", Ok(vec![raw("CVE-1", "openssl", "3.0.1", Severity::Critical, None), raw("CVE-2", "bash", "5.2", Severity::Low, None)]))
+        .with(GITEA, Ok(vec![raw("CVE-3", "git", "2.39", Severity::High, None)]));
+    let (_f, svc) = fixture(scanner);
+    svc.scan(&VecLog::default()).await.unwrap();
+
+    let pkg = svc.list(FindingFilter { package: Some("openssl".into()), ..Default::default() }).await.unwrap();
+    assert_eq!(pkg.iter().map(|f| f.raw.cve_id.as_str()).collect::<Vec<_>>(), vec!["CVE-1"]);
+    let image = svc.list(FindingFilter { target: Some(GITEA.into()), ..Default::default() }).await.unwrap();
+    assert_eq!(image.len(), 1);
+}

backend/crates/domain/src/ports.rs

@@ -9,7 +9,9 @@ use crate::host::{Inventory, OsInfo, Package};
 use crate::jobs::{JobKind, JobRun, JobStatus};
 use crate::settings::SmtpSettings;
 use crate::user::{User, UserUpdate};
-use crate::vuln::{Finding, FindingFilter, FindingStatus, RawFinding, SeverityCounts, TargetKind};
+use crate::vuln::{
+    Finding, FindingFilter, FindingGroup, FindingStatus, RawFinding, SeverityCounts, TargetKind,
+};
 use crate::DomainError;
 use std::path::{Path, PathBuf};
 
@@ -150,6 +152,8 @@ pub trait FindingRepository: Send + Sync {
     async fn set_status(&self, id: Uuid, status: FindingStatus) -> Result<(), DomainError>;
     async fn get(&self, id: Uuid) -> Result<Option<Finding>, DomainError>;
     async fn list(&self, filter: &FindingFilter) -> Result<Vec<Finding>, DomainError>;
+    /// Findings rolled up per package (host) or per image (containers), worst first.
+    async fn groups(&self, filter: &FindingFilter) -> Result<Vec<FindingGroup>, DomainError>;
     async fn counts(&self, kind: Option<TargetKind>) -> Result<SeverityCounts, DomainError>;
 }
 

backend/crates/domain/src/vuln.rs

@@ -160,13 +160,15 @@ pub struct FindingFilter {
     pub min_severity: Option<Severity>,
     /// Restrict to one category (host or containers).
     pub target_kind: Option<TargetKind>,
+    /// Restrict to one package (used to expand a host group).
+    pub package: Option<String>,
     pub target: Option<String>,
     pub status: Option<FindingStatus>,
     /// Include fixed findings (default: only open + acknowledged).
     pub include_fixed: bool,
 }
 
-#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize)]
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
 pub struct SeverityCounts {
     pub critical: usize,
     pub high: usize,
@@ -190,6 +192,25 @@ impl SeverityCounts {
     }
 }
 
+/// Findings rolled up per package (host) or per image (containers): one row per
+/// affected thing instead of one row per CVE.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct FindingGroup {
+    /// Package name for host groups, image reference for container groups.
+    pub key: String,
+    pub kind: TargetKind,
+    /// Package source of a host group (`debian`, `gobinary`, …); empty for images.
+    pub source: String,
+    /// Installed version of a host group; empty for images.
+    pub installed: String,
+    pub counts: SeverityCounts,
+    pub total: usize,
+    /// Findings that have a fix version.
+    pub fixable: usize,
+    /// Distinct packages inside an image group; 1 for host groups.
+    pub packages: usize,
+}
+
 /// Outcome of one scan run.
 #[derive(Clone, Debug, Default, PartialEq, Eq)]
 pub struct ScanReport {