foreman_cve_scanner 0.5.1 → 0.6.0

data/test/lib/foreman_cve_scanner/profiles_uploader_test.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+require 'test_plugin_helper'
+
+module ForemanCveScanner
+  class ProfilesUploaderTest < ActiveSupport::TestCase
+    class DummyUploader
+      prepend ForemanCveScanner::ProfilesUploader
+
+      def initialize(host:, result:)
+        @host = host
+        @result = result
+      end
+
+      def upload
+        @result
+      end
+    end
+
+    def setup
+      skip 'Katello is not installed' unless Foreman::Plugin.installed?(:katello)
+
+      @host = FactoryBot.create(:host)
+      @previous_preferred_scanner = Setting[:preferred_cve_scanner]
+      @previous_run_after_upload = Setting[:run_cve_scan_after_host_profiles_upload]
+    end
+
+    def teardown
+      return unless Foreman::Plugin.installed?(:katello)
+
+      Setting[:preferred_cve_scanner] = @previous_preferred_scanner
+      Setting[:run_cve_scan_after_host_profiles_upload] = @previous_run_after_upload
+    end
+
+    test 'upload schedules cve scan when setting is enabled' do
+      Setting[:preferred_cve_scanner] = 'grype'
+      Setting[:run_cve_scan_after_host_profiles_upload] = true
+
+      captured = {}
+      triggering = Struct.new(:mode).new
+      composer = Struct.new(:triggering) do
+        attr_reader :triggered
+
+        def trigger!
+          @triggered = true
+        end
+      end.new(triggering)
+
+      JobInvocationComposer.stub(:for_feature, lambda { |feature, host, scanner:|
+        captured[:feature] = feature
+        captured[:host] = host
+        captured[:scanner] = scanner
+        composer
+      }) do
+        assert DummyUploader.new(host: @host, result: true).upload
+      end
+
+      assert_equal [:run_cve_scan, @host, 'grype'],
+        [captured[:feature], captured[:host], captured[:scanner]]
+      assert_equal :future, triggering.mode
+      assert composer.triggered
+    end
+
+    test 'upload keeps upstream result when scan scheduling fails' do
+      Setting[:run_cve_scan_after_host_profiles_upload] = true
+
+      JobInvocationComposer.stub(:for_feature, lambda { |_feature, _host, scanner:|
+        raise StandardError, scanner
+      }) do
+        assert DummyUploader.new(host: @host, result: true).upload
+      end
+    end
+
+    test 'upload does not schedule cve scan when setting is disabled' do
+      Setting[:run_cve_scan_after_host_profiles_upload] = false
+
+      JobInvocationComposer.stub(:for_feature, lambda { |_feature, _host, scanner:|
+        flunk("unexpected scanner #{scanner}")
+      }) do
+        assert DummyUploader.new(host: @host, result: true).upload
+      end
+    end
+  end
+end

data/test/lib/foreman_cve_scanner/template_helpers_test.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require 'test_plugin_helper'
+
+module ForemanCveScanner
+  class TemplateHelpersTest < ActiveSupport::TestCase
+    include ForemanCveScanner::TemplateHelpers
+
+    def setup
+      @previous_preferred_scanner = Setting[:preferred_cve_scanner]
+    end
+
+    def teardown
+      Setting[:preferred_cve_scanner] = @previous_preferred_scanner
+    end
+
+    test 'foreman_cve_scanner returns preferred scanner setting' do
+      Setting[:preferred_cve_scanner] = 'grype'
+
+      assert_equal 'grype', foreman_cve_scanner('preferred_scanner')
+    end
+
+    test 'foreman_cve_scanner raises for unknown setting name' do
+      assert_raises(::Foreman::Exception) do
+        foreman_cve_scanner('unknown_setting')
+      end
+    end
+  end
+end

data/test/models/foreman_cve_scanner/cve_scan_test.rb

@@ -0,0 +1,120 @@
+# frozen_string_literal: true
+
+require 'test_plugin_helper'
+
+module ForemanCveScanner
+  class CveScanTest < ActiveSupport::TestCase
+    def setup
+      @host = FactoryBot.create(:host)
+    end
+
+    test 'is invalid without required host, scanner, source and scanned_at attributes' do
+      scan = CveScan.new
+
+      assert_not scan.valid?
+      assert_includes scan.errors.attribute_names, :host_id
+      assert_includes scan.errors.attribute_names, :scanner
+      assert_includes scan.errors.attribute_names, :source
+      assert_includes scan.errors.attribute_names, :scanned_at
+    end
+
+    test 'is invalid without required raw and summary payload attributes' do
+      scan = CveScan.new
+
+      assert_not scan.valid?
+      assert_includes scan.errors.attribute_names, :raw
+      assert_includes scan.errors.attribute_names, :summary
+    end
+
+    test 'is invalid with nil findings' do
+      scan = CveScan.new(
+        host: @host,
+        scanner: 'trivy',
+        source: 'rex',
+        scanned_at: Time.current,
+        raw: { 'dummy' => true },
+        summary: { 'worst' => 'none' },
+        findings: nil,
+        total: 0,
+        critical: 0,
+        high: 0,
+        medium: 0,
+        low: 0
+      )
+
+      assert_not scan.valid?
+      assert_includes scan.errors.attribute_names, :findings
+    end
+
+    test 'is valid with empty findings' do
+      scan = CveScan.new(
+        host: @host,
+        scanner: 'trivy',
+        source: 'rex',
+        scanned_at: Time.current,
+        raw: { 'dummy' => true },
+        summary: { 'worst' => 'none' },
+        findings: [],
+        total: 0,
+        critical: 0,
+        high: 0,
+        medium: 0,
+        low: 0
+      )
+
+      assert scan.valid?
+    end
+
+    test 'for_host returns only scans for the given host' do
+      other_host = FactoryBot.create(:host)
+      host_scan = create_scan(host: @host, total: 1)
+      other_scan = create_scan(host: other_host, total: 2)
+
+      result = CveScan.for_host(@host.id)
+
+      assert_includes result, host_scan
+      assert_not_includes result, other_scan
+    end
+
+    test 'recent_first orders by scanned_at desc and id desc' do
+      older = create_scan(host: @host, scanned_at: 2.hours.ago)
+      newer = create_scan(host: @host, scanned_at: 1.hour.ago)
+      timestamp = Time.zone.parse('2026-05-13 10:00:00')
+      same_time_a = create_scan(host: @host, scanned_at: timestamp)
+      same_time_b = create_scan(host: @host, scanned_at: timestamp)
+
+      result = CveScan.recent_first.to_a
+
+      assert_operator result.index(newer), :<, result.index(older)
+      assert_operator result.index(same_time_b), :<, result.index(same_time_a)
+    end
+
+    test 'destroying a host destroys its cve scans' do
+      create_scan(host: @host, total: 1)
+      create_scan(host: @host, total: 2)
+
+      assert_difference('ForemanCveScanner::CveScan.count', -2) do
+        @host.destroy
+      end
+    end
+
+    private
+
+    def create_scan(host:, scanned_at: Time.current, total: 0)
+      CveScan.create!(
+        host: host,
+        scanner: 'trivy',
+        source: 'rex',
+        scanned_at: scanned_at,
+        raw: { 'dummy' => true },
+        summary: { 'worst' => 'low' },
+        findings: [{ 'id' => 'CVE-0000-0000' }],
+        total: total,
+        critical: 0,
+        high: 0,
+        medium: 0,
+        low: total
+      )
+    end
+  end
+end

data/test/models/host_status/cve_status_test.rb

@@ -39,6 +39,14 @@ module HostStatus
       assert_equal 1, status.to_status
     end
 
+    test 'zero findings scan returns ok status' do
+      create_scan(critical: 0, high: 0, medium: 0, low: 0)
+      status = @host.get_status(HostStatus::CveStatus)
+      assert_equal 'No CVEs found', status.to_label
+      assert_equal HostStatus::Global::OK, status.to_global
+      assert_equal 0, status.to_status
+    end
+
     test 'status is registered in registry' do
       assert_includes HostStatus.status_registry, HostStatus::CveStatus
     end
@@ -50,10 +58,11 @@ module HostStatus
       ForemanCveScanner::CveScan.create!(
         host: @host,
         scanner: 'trivy',
-        created_at: Time.now.utc,
+        source: 'rex',
+        scanned_at: Time.current,
         raw: { 'dummy' => true },
-        summary: { 'worst' => 'low' },
-        findings: [{ 'id' => 'CVE-0000-0000' }],
+        summary: { 'worst' => total.zero? ? 'none' : 'low' },
+        findings: total.zero? ? [] : [{ 'id' => 'CVE-0000-0000' }],
         total: total,
         critical: critical,
         high: high,

data/test/services/foreman_cve_scanner/scan_cleanup_test.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+require 'test_plugin_helper'
+
+module ForemanCveScanner
+  class ScanCleanupTest < ActiveSupport::TestCase
+    def setup
+      @host = FactoryBot.create(:host)
+      @previous_setting = Setting[:cve_scan_delete_after_days]
+    end
+
+    def teardown
+      Setting[:cve_scan_delete_after_days] = @previous_setting
+    end
+
+    test 'cleanup! does nothing when retention is disabled' do
+      Setting[:cve_scan_delete_after_days] = 0
+      old_scan = create_scan(10.days.ago)
+
+      deleted = ScanCleanup.new(scope: @host.cve_scans).cleanup!
+
+      assert_equal 0, deleted
+      assert ForemanCveScanner::CveScan.exists?(old_scan.id)
+    end
+
+    test 'cleanup! removes scans older than configured retention' do
+      Setting[:cve_scan_delete_after_days] = 5
+      old_scan = create_scan(10.days.ago)
+      recent_scan = create_scan(2.days.ago)
+
+      deleted = ScanCleanup.new(scope: @host.cve_scans).cleanup!
+
+      assert_equal 1, deleted
+      assert_not ForemanCveScanner::CveScan.exists?(old_scan.id)
+      assert ForemanCveScanner::CveScan.exists?(recent_scan.id)
+    end
+
+    test 'cleanup! uses explicit day override' do
+      Setting[:cve_scan_delete_after_days] = 30
+      old_scan = create_scan(10.days.ago)
+      recent_scan = create_scan(2.days.ago)
+
+      deleted = ScanCleanup.new(scope: @host.cve_scans, days: 5).cleanup!
+
+      assert_equal 1, deleted
+      assert_not ForemanCveScanner::CveScan.exists?(old_scan.id)
+      assert ForemanCveScanner::CveScan.exists?(recent_scan.id)
+    end
+
+    private
+
+    def create_scan(scanned_at)
+      ForemanCveScanner::CveScan.create!(
+        host: @host,
+        scanner: 'trivy',
+        source: 'rex',
+        scanned_at: scanned_at,
+        raw: { 'dummy' => true },
+        summary: { 'worst' => 'low' },
+        findings: [{ 'id' => 'CVE-0000-0000' }],
+        total: 1,
+        critical: 0,
+        high: 0,
+        medium: 0,
+        low: 1
+      )
+    end
+  end
+end

data/test/services/foreman_cve_scanner/scan_comparison_test.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+require 'test_plugin_helper'
+
+module ForemanCveScanner
+  class ScanComparisonTest < ActiveSupport::TestCase
+    def setup
+      @host = FactoryBot.create(:host)
+      @first_scan = create_scan(
+        scanned_at: 2.hours.ago,
+        findings: first_findings
+      )
+      @second_scan = create_scan(
+        scanned_at: 1.hour.ago,
+        findings: second_findings
+      )
+    end
+
+    test 'compare builds summary and result rows' do
+      comparison = ScanComparison.compare(@first_scan, @second_scan)
+      statuses = comparison[:results].to_h { |row| [row[:id], row] }
+
+      assert_equal 1, comparison[:summary]['updated']
+      assert_equal 1, comparison[:summary]['resolved']
+      assert_equal 1, comparison[:summary]['new']
+      assert_equal 'updated', statuses['CVE-1'][:status]
+      assert_equal(
+        { old: 'HIGH', new: 'CRITICAL' },
+        statuses['CVE-1'][:diff]['severity']
+      )
+    end
+
+    test 'compare includes previous and current scan metadata' do
+      comparison = ScanComparison.compare(@first_scan, @second_scan)
+
+      assert_equal @first_scan.id, comparison[:previous][:id]
+      assert_equal @second_scan.id, comparison[:current][:id]
+      assert_equal @first_scan.scanner, comparison[:previous][:scanner]
+      assert_equal @second_scan.scanner, comparison[:current][:scanner]
+    end
+
+    private
+
+    def finding(id, name, severity, version)
+      {
+        'id' => id,
+        'name' => name,
+        'severity' => severity,
+        'version' => version,
+      }
+    end
+
+    def first_findings
+      [
+        finding('CVE-1', 'openssl', 'HIGH', '1.0'),
+        finding('CVE-2', 'curl', 'LOW', '1.0'),
+      ]
+    end
+
+    def second_findings
+      [
+        finding('CVE-1', 'openssl', 'CRITICAL', '1.0'),
+        finding('CVE-3', 'glibc', 'HIGH', '1.0'),
+      ]
+    end
+
+    def create_scan(scanned_at:, findings:)
+      ForemanCveScanner::CveScan.create!(
+        host: @host,
+        scanner: 'trivy',
+        source: 'rex',
+        scanned_at: scanned_at,
+        raw: { 'dummy' => true },
+        summary: { 'worst' => 'high' },
+        findings: findings,
+        total: findings.size,
+        critical: findings.count { |finding| finding['severity'] == 'CRITICAL' },
+        high: findings.count { |finding| finding['severity'] == 'HIGH' },
+        medium: findings.count { |finding| finding['severity'] == 'MEDIUM' },
+        low: findings.count { |finding| finding['severity'] == 'LOW' }
+      )
+    end
+  end
+end

data/test/services/foreman_cve_scanner/scan_importer_test.rb

@@ -6,6 +6,11 @@ module ForemanCveScanner
   class ScanImporterTest < ActiveSupport::TestCase
     def setup
       @host = FactoryBot.create(:host)
+      @previous_retention = Setting[:cve_scan_delete_after_days]
+    end
+
+    def teardown
+      Setting[:cve_scan_delete_after_days] = @previous_retention
     end
 
     test 'import_for_host! persists scan from trivy output' do
@@ -19,6 +24,7 @@ module ForemanCveScanner
       assert_not_nil scan
       assert_equal @host.id, scan.host_id
       assert_equal 'trivy', scan.scanner
+      assert_equal 'rex', scan.source
     end
 
     test 'import_for_host! sets totals and findings for trivy output' do
@@ -29,6 +35,7 @@ module ForemanCveScanner
 
       assert_operator scan.total, :>, 0
       assert_equal scan.total, scan.findings.count
+      assert_not_nil scan.scanned_at
     end
 
     test 'import_for_host! persists scan from proxy output' do
@@ -51,20 +58,76 @@ module ForemanCveScanner
       assert_operator scan.total, :>, 0
     end
 
-    test 'import_for_host! returns nil when no json markers' do
+    test 'import_for_host! raises when no json markers' do
       importer = ForemanCveScanner::ScanImporter.new('no markers here')
 
+      assert_raises(::Foreman::Exception) do
+        importer.import_for_host!(@host)
+      end
+    end
+
+    test 'import_for_host! raises when json is invalid' do
+      importer = ForemanCveScanner::ScanImporter.new("===START\n{bad\n===END")
+
+      assert_raises(::Foreman::Exception) do
+        importer.import_for_host!(@host)
+      end
+    end
+
+    test 'import_for_host! raises when marker block is empty' do
+      importer = ForemanCveScanner::ScanImporter.new("===START\n===END")
+
+      assert_raises(::Foreman::Exception) do
+        importer.import_for_host!(@host)
+      end
+    end
+
+    test 'import_for_host! cleans up old scans for the host using retention setting' do
+      Setting[:cve_scan_delete_after_days] = 1
+      old_scan = ForemanCveScanner::CveScan.create!(
+        host: @host,
+        scanner: 'trivy',
+        source: 'rex',
+        scanned_at: 3.days.ago,
+        raw: { 'dummy' => true },
+        summary: { 'worst' => 'low' },
+        findings: [{ 'id' => 'CVE-0000-0000' }],
+        total: 1,
+        critical: 0,
+        high: 0,
+        medium: 0,
+        low: 1
+      )
+      output = wrap_output(load_fixture('trivy.json'))
+      importer = ForemanCveScanner::ScanImporter.new(output)
+
       scan = importer.import_for_host!(@host)
 
-      assert_nil scan
+      assert_not_nil scan
+      assert_not ForemanCveScanner::CveScan.exists?(old_scan.id)
+      assert ForemanCveScanner::CveScan.exists?(scan.id)
     end
 
-    test 'import_for_host! returns nil when json is invalid' do
-      importer = ForemanCveScanner::ScanImporter.new("===START\n{bad\n===END")
+    test 'import_for_host! persists scan with zero findings' do
+      output = wrap_output(
+        {
+          'Results' => [
+            {
+              'Target' => '/',
+              'Class' => 'os-pkgs',
+            },
+          ],
+        }.to_json
+      )
+      importer = ForemanCveScanner::ScanImporter.new(output)
 
       scan = importer.import_for_host!(@host)
 
-      assert_nil scan
+      assert_not_nil scan
+      assert_equal 'trivy', scan.scanner
+      assert_empty scan.findings
+      assert_equal 0, scan.total
+      assert_equal 'none', scan.summary['worst']
     end
 
     private