Failing tests for rolling findings up per package and image

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/crates/domain/src/ports.rs

@@ -9,7 +9,9 @@ use crate::host::{Inventory, OsInfo, Package};
 use crate::jobs::{JobKind, JobRun, JobStatus};
 use crate::settings::SmtpSettings;
 use crate::user::{User, UserUpdate};
-use crate::vuln::{Finding, FindingFilter, FindingStatus, RawFinding, SeverityCounts, TargetKind};
+use crate::vuln::{
+    Finding, FindingFilter, FindingGroup, FindingStatus, RawFinding, SeverityCounts, TargetKind,
+};
 use crate::DomainError;
 use std::path::{Path, PathBuf};
 
@@ -150,6 +152,8 @@ pub trait FindingRepository: Send + Sync {
     async fn set_status(&self, id: Uuid, status: FindingStatus) -> Result<(), DomainError>;
     async fn get(&self, id: Uuid) -> Result<Option<Finding>, DomainError>;
     async fn list(&self, filter: &FindingFilter) -> Result<Vec<Finding>, DomainError>;
+    /// Findings rolled up per package (host) or per image (containers), worst first.
+    async fn groups(&self, filter: &FindingFilter) -> Result<Vec<FindingGroup>, DomainError>;
     async fn counts(&self, kind: Option<TargetKind>) -> Result<SeverityCounts, DomainError>;
 }
 

backend/crates/domain/src/vuln.rs

@@ -160,13 +160,15 @@ pub struct FindingFilter {
     pub min_severity: Option<Severity>,
     /// Restrict to one category (host or containers).
     pub target_kind: Option<TargetKind>,
+    /// Restrict to one package (used to expand a host group).
+    pub package: Option<String>,
     pub target: Option<String>,
     pub status: Option<FindingStatus>,
     /// Include fixed findings (default: only open + acknowledged).
     pub include_fixed: bool,
 }
 
-#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize)]
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
 pub struct SeverityCounts {
     pub critical: usize,
     pub high: usize,
@@ -190,6 +192,25 @@ impl SeverityCounts {
     }
 }
 
+/// Findings rolled up per package (host) or per image (containers): one row per
+/// affected thing instead of one row per CVE.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct FindingGroup {
+    /// Package name for host groups, image reference for container groups.
+    pub key: String,
+    pub kind: TargetKind,
+    /// Package source of a host group (`debian`, `gobinary`, …); empty for images.
+    pub source: String,
+    /// Installed version of a host group; empty for images.
+    pub installed: String,
+    pub counts: SeverityCounts,
+    pub total: usize,
+    /// Findings that have a fix version.
+    pub fixable: usize,
+    /// Distinct packages inside an image group; 1 for host groups.
+    pub packages: usize,
+}
+
 /// Outcome of one scan run.
 #[derive(Clone, Debug, Default, PartialEq, Eq)]
 pub struct ScanReport {