foreman_cve_scanner 0.5.1 → 0.6.0

data/webpack/components/__tests__/CveDetailsCard.test.js

@@ -32,15 +32,16 @@ describe('CveDetailsCard', () => {
     const hostDetails = { id: 1 };
     const historyResponse = {
       results: [
-        { id: 1, created_at: '2026-02-20', scanner: 'trivy', total: 10 },
-        { id: 2, created_at: '2026-02-21', scanner: 'trivy', total: 12 },
-        { id: 3, created_at: '2026-02-22', scanner: 'grype', total: 8 },
+        { id: 1, scanned_at: '2026-02-20', scanner: 'trivy', source: 'rex', total: 10 },
+        { id: 2, scanned_at: '2026-02-21', scanner: 'trivy', source: 'rex', total: 12 },
+        { id: 3, scanned_at: '2026-02-22', scanner: 'grype', source: 'external', total: 8 },
       ],
     };
     const latestResponse = {
       id: 3,
-      created_at: '2026-02-22',
+      scanned_at: '2026-02-22',
       scanner: 'grype',
+      source: 'external',
       total: 8,
       summary: { worst: 'high' },
       critical: 1,
@@ -67,39 +68,29 @@ describe('CveDetailsCard', () => {
 
     const wrapper = mount(<CveDetailsCard hostDetails={hostDetails} />);
 
-    expect(wrapper.text()).toContain('Recent scans');
     expect(wrapper.find('table').length).toBeGreaterThan(0);
     expect(wrapper.text()).toContain('CVEs');
     expect(wrapper.text()).toContain('pkg');
   });
 
-  it('falls back to history when latest is empty', () => {
+  it('renders empty state when latest is empty', () => {
     const hostDetails = { id: 1 };
-    const historyResponse = {
-      results: [{ id: 1, created_at: '2026-02-20', scanner: 'trivy', total: 10 }],
-    };
-
-    useAPI.mockImplementation((_method, url) => {
-      if (url && url.includes('/latest')) {
-        return { response: {}, status: 'RESOLVED' };
-      }
-      return { response: historyResponse, status: 'RESOLVED' };
-    });
+    useAPI.mockReturnValue({ response: {}, status: 'RESOLVED' });
 
     const wrapper = mount(<CveDetailsCard hostDetails={hostDetails} />);
-    expect(wrapper.text()).toContain('Report');
-    expect(wrapper.text()).toContain('trivy');
+    expect(wrapper.text()).toContain('No CVE reports for this host');
   });
 
   it('prefers latest when present', () => {
     const hostDetails = { id: 1 };
     const historyResponse = {
-      results: [{ id: 1, created_at: '2026-02-20', scanner: 'trivy', total: 10 }],
+      results: [{ id: 1, scanned_at: '2026-02-20', scanner: 'trivy', source: 'rex', total: 10 }],
     };
     const latestResponse = {
       id: 2,
-      created_at: '2026-02-21',
+      scanned_at: '2026-02-21',
       scanner: 'grype',
+      source: 'external',
       total: 8,
       summary: { worst: 'high' },
       findings: [],
@@ -116,6 +107,76 @@ describe('CveDetailsCard', () => {
     expect(wrapper.text()).toContain('grype');
   });
 
+  it('keeps unknown severities out of the preview when ranked CVEs exist', () => {
+    const hostDetails = { id: 1 };
+    const latestResponse = {
+      id: 2,
+      scanned_at: '2026-02-21',
+      scanner: 'grype',
+      source: 'external',
+      total: 6,
+      summary: { worst: 'critical' },
+      findings: [
+        {
+          id: 'CVE-unknown',
+          name: 'unknown-pkg',
+          version: '1.0',
+          severity: 'UNKNOWN',
+          published: '2026-02-20',
+        },
+        {
+          id: 'CVE-critical',
+          name: 'critical-pkg',
+          version: '1.0',
+          severity: 'CRITICAL',
+          published: '2026-02-10',
+        },
+        {
+          id: 'CVE-high',
+          name: 'high-pkg',
+          version: '1.0',
+          severity: 'HIGH',
+          published: '2026-02-11',
+        },
+        {
+          id: 'CVE-medium',
+          name: 'medium-pkg',
+          version: '1.0',
+          severity: 'MEDIUM',
+          published: '2026-02-12',
+        },
+        {
+          id: 'CVE-low-a',
+          name: 'low-a-pkg',
+          version: '1.0',
+          severity: 'LOW',
+          published: '2026-02-13',
+        },
+        {
+          id: 'CVE-low-b',
+          name: 'low-b-pkg',
+          version: '1.0',
+          severity: 'LOW',
+          published: '2026-02-14',
+        },
+      ],
+    };
+
+    useAPI.mockImplementation((_method, url) => {
+      if (url && url.includes('/latest')) {
+        return { response: latestResponse, status: 'RESOLVED' };
+      }
+      return { response: { results: [] }, status: 'RESOLVED' };
+    });
+
+    const wrapper = mount(<CveDetailsCard hostDetails={hostDetails} />);
+
+    expect(wrapper.text()).toContain('critical-pkg');
+    expect(wrapper.text()).toContain('low-b-pkg');
+    expect(wrapper.text()).not.toContain('unknown-pkg');
+    expect(wrapper.text()).toContain('More');
+  });
+
   it('renders empty state when no scans', () => {
     const hostDetails = { id: 1 };
     useAPI.mockReturnValue({ response: null, status: 'RESOLVED' });
@@ -123,4 +184,29 @@ describe('CveDetailsCard', () => {
     const wrapper = mount(<CveDetailsCard hostDetails={hostDetails} />);
     expect(wrapper.text()).toContain('No CVE reports for this host');
   });
+
+  it('renders success state when latest scan has no findings', () => {
+    const hostDetails = { id: 1 };
+    const latestResponse = {
+      id: 2,
+      scanned_at: '2026-02-21',
+      scanner: 'trivy',
+      source: 'rex',
+      total: 0,
+      summary: { worst: 'none' },
+      critical: 0,
+      high: 0,
+      medium: 0,
+      low: 0,
+      findings: [],
+    };
+
+    useAPI.mockReturnValue({ response: latestResponse, status: 'RESOLVED' });
+
+    const wrapper = mount(<CveDetailsCard hostDetails={hostDetails} />);
+    expect(wrapper.text()).toContain('No CVEs found');
+    expect(wrapper.text()).toContain(
+      'The latest CVE scan found no vulnerabilities for this host.'
+    );
+  });
 });

data/webpack/components/__tests__/CveFindingsModal.test.js

@@ -1,6 +1,7 @@
 /* eslint-disable import/no-unresolved */
 import React from 'react';
 import { mount } from 'enzyme';
+import { act } from 'react-dom/test-utils';
 import CveFindingsModal from '../CveFindingsModal';
 
 jest.mock('foremanReact/common/hooks/API/APIHooks', () => ({
@@ -18,7 +19,9 @@ describe('CveFindingsModal', () => {
     useAPI.mockReturnValue({
       response: {
         id: 1,
-        created_at: '2026-02-22T10:00:00Z',
+        scanned_at: '2026-02-22T10:00:00Z',
+        scanner: 'trivy',
+        source: 'rex',
         total: 2,
         findings: [
           { id: 'CVE-1', severity: 'HIGH', name: 'a', version: '1' },
@@ -56,7 +59,9 @@ describe('CveFindingsModal', () => {
     useAPI.mockReturnValue({
       response: {
         id: 1,
-        created_at: '2026-02-22T10:00:00Z',
+        scanned_at: '2026-02-22T10:00:00Z',
+        scanner: 'trivy',
+        source: 'rex',
         total: 0,
         findings: [],
       },
@@ -75,4 +80,51 @@ describe('CveFindingsModal', () => {
 
     expect(wrapper.text()).toContain('No findings for selected filter');
   });
+
+  it('filters findings by search text', () => {
+    useAPI.mockReturnValue({
+      response: {
+        id: 1,
+        scanned_at: '2026-02-22T10:00:00Z',
+        scanner: 'trivy',
+        source: 'rex',
+        total: 2,
+        findings: [
+          {
+            id: 'CVE-1',
+            severity: 'HIGH',
+            name: 'openssl',
+            version: '1.1',
+            title: 'OpenSSL issue',
+          },
+          {
+            id: 'CVE-2',
+            severity: 'LOW',
+            name: 'curl',
+            version: '8.0',
+            title: 'Curl issue',
+          },
+        ],
+      },
+      status: 'RESOLVED',
+    });
+
+    const wrapper = mount(
+      <CveFindingsModal
+        isOpen
+        onClose={() => {}}
+        hostId={1}
+        scanId={1}
+        initialFilter="all"
+      />
+    );
+
+    act(() => {
+      wrapper.find('SearchInput').prop('onChange')('openssl');
+    });
+    wrapper.update();
+
+    expect(wrapper.text()).toContain('CVE-1');
+    expect(wrapper.text()).not.toContain('CVE-2');
+  });
 });

data/webpack/components/__tests__/CveScansTab.test.js

@@ -16,6 +16,9 @@ jest.mock('foremanReact/components/common/dates/RelativeDateTime', () => (
 ) => <span>{date || defaultValue}</span>);
 
 jest.mock('../CveFindingsModal', () => () => <div data-test="modal" />);
+jest.mock('../CveCompareModal', () => ({ isOpen, scanIds }) =>
+  isOpen ? <div data-test="compare-modal">{scanIds.join(',')}</div> : null
+);
 
 const { useAPI } = require('foremanReact/common/hooks/API/APIHooks');
 
@@ -24,13 +27,14 @@ describe('CveScansTab', () => {
     useAPI.mockReset();
   });
 
-  it('renders rows for scans', () => {
+  it('renders overview and reports sub-tabs', () => {
     const scansResponse = {
       results: [
         {
           id: 1,
-          created_at: '2026-02-20',
+          scanned_at: '2026-02-20',
           scanner: 'trivy',
+          source: 'rex',
           total: 10,
           critical: 1,
           high: 2,
@@ -39,8 +43,9 @@ describe('CveScansTab', () => {
         },
         {
           id: 2,
-          created_at: '2026-02-21',
+          scanned_at: '2026-02-21',
           scanner: 'grype',
+          source: 'external',
           total: 5,
           critical: 0,
           high: 1,
@@ -55,9 +60,158 @@ describe('CveScansTab', () => {
 
     const wrapper = mount(<CveScansTab response={{ id: 1 }} />);
 
-    expect(wrapper.text()).toContain('Reported at');
+    expect(wrapper.text()).toContain('Overview');
+    expect(wrapper.text()).toContain('Reports');
+    expect(wrapper.text()).toContain('Trend');
+    expect(wrapper.text()).toContain('Latest total');
+  });
+
+  it('opens compare modal from overview trend selection', () => {
+    const scansResponse = {
+      results: [
+        {
+          id: 1,
+          scanned_at: '2026-02-20',
+          scanner: 'trivy',
+          source: 'rex',
+          total: 10,
+          critical: 1,
+          high: 2,
+          medium: 3,
+          low: 4,
+        },
+        {
+          id: 2,
+          scanned_at: '2026-02-21',
+          scanner: 'grype',
+          source: 'external',
+          total: 5,
+          critical: 0,
+          high: 1,
+          medium: 1,
+          low: 3,
+        },
+      ],
+      total: 2,
+    };
+
+    useAPI.mockReturnValue({ response: scansResponse, status: 'RESOLVED' });
+
+    const wrapper = mount(<CveScansTab response={{ id: 1 }} />);
+
+    wrapper
+      .find('button')
+      .filterWhere(node => node.text() === 'Compare 2 reports')
+      .first()
+      .simulate('click');
+    wrapper.update();
+
+    wrapper.find('button.cve-trend-bar-button').at(0).simulate('click');
+    wrapper.find('button.cve-trend-bar-button').at(1).simulate('click');
+    wrapper.update();
+
+    expect(wrapper.find('[data-test="compare-modal"]').text()).toBe('1,2');
+  });
+
+  it('renders scan rows in the reports sub-tab', () => {
+    const scansResponse = {
+      results: [
+        {
+          id: 1,
+          scanned_at: '2026-02-20',
+          scanner: 'trivy',
+          source: 'rex',
+          total: 10,
+          critical: 1,
+          high: 2,
+          medium: 3,
+          low: 4,
+        },
+        {
+          id: 2,
+          scanned_at: '2026-02-21',
+          scanner: 'grype',
+          source: 'external',
+          total: 5,
+          critical: 0,
+          high: 1,
+          medium: 1,
+          low: 3,
+        },
+      ],
+      total: 2,
+    };
+
+    useAPI.mockReturnValue({ response: scansResponse, status: 'RESOLVED' });
+
+    const wrapper = mount(<CveScansTab response={{ id: 1 }} />);
+
+    wrapper
+      .find('[role="tab"]')
+      .filterWhere(node => node.text() === 'Reports')
+      .first()
+      .simulate('click');
+    wrapper.update();
+
+    expect(wrapper.text()).toContain('Scanned at');
     expect(wrapper.text()).toContain('trivy');
-    expect(wrapper.text()).toContain('grype');
+    expect(wrapper.text()).toContain('grype / external');
+    expect(wrapper.text()).toContain('Export CSV');
+    expect(wrapper.text()).toContain('Compare selected');
+  });
+
+  it('opens compare modal when two scans are selected', () => {
+    const scansResponse = {
+      results: [
+        {
+          id: 1,
+          scanned_at: '2026-02-20',
+          scanner: 'trivy',
+          source: 'rex',
+          total: 10,
+          critical: 1,
+          high: 2,
+          medium: 3,
+          low: 4,
+        },
+        {
+          id: 2,
+          scanned_at: '2026-02-21',
+          scanner: 'grype',
+          source: 'external',
+          total: 5,
+          critical: 0,
+          high: 1,
+          medium: 1,
+          low: 3,
+        },
+      ],
+      total: 2,
+    };
+
+    useAPI.mockReturnValue({ response: scansResponse, status: 'RESOLVED' });
+
+    const wrapper = mount(<CveScansTab response={{ id: 1 }} />);
+
+    wrapper
+      .find('[role="tab"]')
+      .filterWhere(node => node.text() === 'Reports')
+      .first()
+      .simulate('click');
+    wrapper.update();
+
+    wrapper.find('input#cve-scan-select-1').simulate('change');
+    wrapper.find('input#cve-scan-select-2').simulate('change');
+    wrapper.update();
+
+    wrapper
+      .find('button')
+      .filterWhere(node => node.text() === 'Compare selected')
+      .first()
+      .simulate('click');
+    wrapper.update();
+
+    expect(wrapper.find('[data-test="compare-modal"]').text()).toBe('1,2');
   });
 
   it('renders empty state with no scans', () => {
@@ -67,6 +221,32 @@ describe('CveScansTab', () => {
     expect(wrapper.text()).toContain('No CVE reports for this host');
   });
 
+  it('renders trend overview when recent scans have no cves', () => {
+    const scansResponse = {
+      results: [
+        {
+          id: 1,
+          scanned_at: '2026-02-20',
+          scanner: 'trivy',
+          source: 'rex',
+          total: 0,
+          critical: 0,
+          high: 0,
+          medium: 0,
+          low: 0,
+        },
+      ],
+      total: 1,
+    };
+
+    useAPI.mockReturnValue({ response: scansResponse, status: 'RESOLVED' });
+
+    const wrapper = mount(<CveScansTab response={{ id: 1 }} />);
+    expect(wrapper.text()).toContain('Trend');
+    expect(wrapper.text()).toContain('Latest total');
+    expect(wrapper.text()).toContain('0');
+  });
+
   it('does not render when host id is missing', () => {
     useAPI.mockReturnValue({ response: { results: [] }, status: 'RESOLVED' });
 

data/webpack/components/__tests__/CveTrendChart.test.js

@@ -0,0 +1,122 @@
+/* eslint-disable import/no-unresolved */
+import React from 'react';
+import { mount } from 'enzyme';
+import CveTrendChart from '../CveTrendChart';
+
+describe('CveTrendChart', () => {
+  it('renders the last scan summary and legend', () => {
+    const wrapper = mount(
+      <CveTrendChart
+        scans={[
+          {
+            id: 12,
+            scanned_at: '2026-05-14T10:00:00Z',
+            total: 18,
+            critical: 2,
+            high: 4,
+            medium: 5,
+            low: 7,
+          },
+          {
+            id: 11,
+            scanned_at: '2026-05-10T10:00:00Z',
+            total: 15,
+            critical: 1,
+            high: 3,
+            medium: 5,
+            low: 6,
+          },
+        ]}
+      />
+    );
+
+    expect(wrapper.text()).toContain('Trend');
+    expect(wrapper.text()).toContain('Last 2 scans');
+    expect(wrapper.text()).toContain('Latest total');
+    expect(wrapper.text()).toContain('18');
+    expect(wrapper.text()).toContain('Critical');
+    expect(wrapper.text()).toContain('Low');
+  });
+
+  it('opens the selected scan when a bar is clicked', () => {
+    const onOpen = jest.fn();
+    const wrapper = mount(
+      <CveTrendChart
+        scans={[
+          {
+            id: 2,
+            scanned_at: '2026-05-14T10:00:00Z',
+            total: 12,
+            critical: 2,
+            high: 3,
+            medium: 3,
+            low: 4,
+          },
+          {
+            id: 1,
+            scanned_at: '2026-05-10T10:00:00Z',
+            total: 8,
+            critical: 1,
+            high: 1,
+            medium: 2,
+            low: 4,
+          },
+        ]}
+        onOpen={onOpen}
+      />
+    );
+
+    wrapper.find('button.cve-trend-bar-button').at(0).simulate('click');
+
+    expect(onOpen).toHaveBeenCalledWith(1);
+  });
+
+  it('renders compare mode controls and uses bar clicks for selection', () => {
+    const onToggleSelection = jest.fn();
+    const onToggleCompareMode = jest.fn();
+    const onOpen = jest.fn();
+    const wrapper = mount(
+      <CveTrendChart
+        scans={[
+          {
+            id: 2,
+            scanned_at: '2026-05-14T10:00:00Z',
+            total: 12,
+            critical: 2,
+            high: 3,
+            medium: 3,
+            low: 4,
+          },
+          {
+            id: 1,
+            scanned_at: '2026-05-10T10:00:00Z',
+            total: 8,
+            critical: 1,
+            high: 1,
+            medium: 2,
+            low: 4,
+          },
+        ]}
+        compareMode
+        selectedScanIds={[2]}
+        onOpen={onOpen}
+        onToggleSelection={onToggleSelection}
+        onToggleCompareMode={onToggleCompareMode}
+      />
+    );
+
+    expect(wrapper.text()).toContain('Cancel compare');
+    expect(wrapper.text()).toContain('1/2 selected');
+
+    wrapper.find('button.cve-trend-bar-button').at(1).simulate('click');
+    wrapper
+      .find('button')
+      .filterWhere(node => node.text() === 'Cancel compare')
+      .first()
+      .simulate('click');
+
+    expect(onToggleSelection).toHaveBeenCalledWith(2);
+    expect(onOpen).not.toHaveBeenCalled();
+    expect(onToggleCompareMode).toHaveBeenCalled();
+  });
+});

data/webpack/components/__tests__/cve_helpers.test.js

@@ -3,7 +3,10 @@ import {
   severityRank,
   riskLevelFromWorst,
   formatDateTime,
+  formatScanOrigin,
+  formatScannedAt,
   compareStrings,
+  visibleScanSource,
 } from '../cve_helpers';
 
 describe('cve_helpers', () => {
@@ -33,10 +36,25 @@ describe('cve_helpers', () => {
     expect(formatDateTime('not-a-date')).toBe('not-a-date');
   });
 
+  it('formats scan origin without rex source noise', () => {
+    expect(formatScanOrigin('trivy', 'rex')).toBe('trivy');
+    expect(formatScanOrigin('grype', 'external')).toBe('grype / external');
+  });
+
+  it('formats scanned_at with unknown fallback', () => {
+    expect(formatScannedAt('2026-02-22T10:05:00Z')).toContain('2026-02-22');
+    expect(formatScannedAt('')).toBe('Unknown time');
+  });
+
   it('compares strings safely', () => {
     expect(compareStrings('a', 'b')).toBeLessThan(0);
     expect(compareStrings('b', 'a')).toBeGreaterThan(0);
     expect(compareStrings('a', 'a')).toBe(0);
     expect(compareStrings(null, 'a')).toBeLessThan(0);
   });
+
+  it('hides rex source and keeps external source visible', () => {
+    expect(visibleScanSource('rex')).toBe('');
+    expect(visibleScanSource('external')).toBe('external');
+  });
 });