foreman_cve_scanner 0.6.1 → 0.7.0

data/test/services/foreman_cve_scanner/katello_fix_availability_test.rb

@@ -0,0 +1,164 @@
+# frozen_string_literal: true
+
+require 'test_plugin_helper'
+
+module ForemanCveScanner
+  class KatelloFixAvailabilityTest < ActiveSupport::TestCase
+    Erratum = Struct.new(
+      :id,
+      :errata_id,
+      :title,
+      :severity,
+      :cves,
+      :packages,
+      :deb_packages
+    )
+    Cve = Struct.new(:cve_id)
+    Package = Struct.new(:name)
+    ContentFacet = Struct.new(:installable_errata, :applicable_errata)
+
+    class ErrataRelation
+      include Enumerable
+
+      attr_reader :search_queries
+
+      def initialize(errata)
+        @errata = errata
+        @search_queries = []
+      end
+
+      def each(&block)
+        @errata.each(&block)
+      end
+
+      def security
+        self
+      end
+
+      def includes(*)
+        self
+      end
+
+      def search_for(query)
+        @search_queries << query
+        self
+      end
+
+      def distinct
+        @errata.uniq
+      end
+    end
+
+    def setup
+      @host = FactoryBot.create(:host)
+      @findings = [
+        {
+          'id' => 'CVE-2026-0001',
+          'name' => 'openssl',
+          'severity' => 'HIGH',
+        },
+      ]
+    end
+
+    test 'does not add katello enrichment when katello is not installed' do
+      service = KatelloFixAvailability.new(@host, @findings)
+      Foreman::Plugin.stubs(:installed?).with(:katello).returns(false)
+      service.expects(:enabled?).never
+
+      enriched_findings = service.call
+
+      assert_equal @findings, enriched_findings
+      assert_not enriched_findings.first.key?('katello_fix')
+    end
+
+    test 'does not add katello enrichment when disabled' do
+      service = KatelloFixAvailability.new(@host, @findings)
+      service.stubs(:enabled?).returns(false)
+      service.expects(:installable_errata).never
+
+      enriched_findings = service.call
+
+      assert_equal @findings, enriched_findings
+      assert_not enriched_findings.first.key?('katello_fix')
+    end
+
+    test 'adds unknown enrichment when katello lookup fails' do
+      service = KatelloFixAvailability.new(@host, @findings)
+      service.stubs(:enabled?).returns(true)
+      service.stubs(:katello_available?).returns(true)
+      service.stubs(:installable_errata).raises(NameError)
+
+      enriched_findings = service.call
+      fix = enriched_findings.first['katello_fix']
+
+      assert_equal 'unknown', fix['status']
+      assert_equal 'query_failed', fix['reason']
+    end
+
+    test 'marks matching installable errata as installable' do
+      service = KatelloFixAvailability.new(@host, @findings)
+      erratum = erratum_for('CVE-2026-0001', 'openssl')
+      service.stubs(:enabled?).returns(true)
+      service.stubs(:katello_available?).returns(true)
+      service.stubs(:installable_errata).returns([erratum])
+      service.stubs(:applicable_errata).returns([])
+
+      enriched_findings = service.call
+      fix = enriched_findings.first['katello_fix']
+
+      assert_equal 'installable', fix['status']
+      assert_equal 'package_match', fix['confidence']
+      assert_equal(
+        ['RHSA-2026:0001'],
+        fix['errata'].map { |item| item['errata_id'] }
+      )
+    end
+
+    test 'marks matching applicable errata as applicable when not installable' do
+      service = KatelloFixAvailability.new(@host, @findings)
+      erratum = erratum_for('CVE-2026-0001', 'openssl')
+      service.stubs(:enabled?).returns(true)
+      service.stubs(:katello_available?).returns(true)
+      service.stubs(:installable_errata).returns([])
+      service.stubs(:applicable_errata).returns([erratum])
+
+      enriched_findings = service.call
+      fix = enriched_findings.first['katello_fix']
+
+      assert_equal 'applicable', fix['status']
+      assert_equal 'package_match', fix['confidence']
+    end
+
+    test 'looks up errata through host content facet cve search' do
+      installable_erratum = erratum_for('CVE-2026-0001', 'openssl')
+      installable_relation = ErrataRelation.new([installable_erratum])
+      applicable_relation = ErrataRelation.new([])
+      content_facet = ContentFacet.new(installable_relation, applicable_relation)
+
+      @host.stubs(:content_facet).returns(content_facet)
+      service = KatelloFixAvailability.new(@host, @findings)
+      service.stubs(:enabled?).returns(true)
+      service.stubs(:katello_available?).returns(true)
+
+      enriched_findings = service.call
+
+      assert_equal ['cve = "CVE-2026-0001"'], installable_relation.search_queries
+      assert_equal ['cve = "CVE-2026-0001"'], applicable_relation.search_queries
+      assert_equal 'installable', enriched_findings.first['katello_fix']['status']
+    end
+
+    private
+
+    def erratum_for(cve_id, package_name)
+      Erratum.new(
+        1,
+        'RHSA-2026:0001',
+        'Security update',
+        'Important',
+        [Cve.new(cve_id)],
+        [Package.new(package_name)],
+        []
+      )
+    end
+  end
+end

data/test/services/foreman_cve_scanner/latest_scan_summaries_test.rb

@@ -0,0 +1,95 @@
+# frozen_string_literal: true
+
+require 'test_plugin_helper'
+
+module ForemanCveScanner
+  class LatestScanSummariesTest < ActiveSupport::TestCase
+    def setup
+      @host = FactoryBot.create(:host)
+      @other_host = FactoryBot.create(:host)
+    end
+
+    test 'call returns the latest scan summary for each requested host' do
+      create_scan(host: @host, scanned_at: 2.hours.ago, total: 1, metrics: { low: 1 })
+      latest_for_host = create_scan(host: @host, scanned_at: 1.hour.ago, total: 2, metrics: { high: 2 })
+      latest_for_other_host = create_scan(
+        host: @other_host,
+        scanned_at: 30.minutes.ago,
+        total: 3,
+        metrics: { medium: 3 }
+      )
+
+      results = LatestScanSummaries.new(
+        host_scope: Host::Base.where(id: [@host.id, @other_host.id]),
+        host_ids: [@host.id, @other_host.id]
+      ).call
+      summaries = results.index_by { |row| row[:host_id] }
+
+      assert_equal latest_for_host.id, summaries[@host.id][:id]
+      assert_equal latest_for_other_host.id, summaries[@other_host.id][:id]
+      assert_equal 2, summaries[@host.id][:total]
+      assert_equal 3, summaries[@other_host.id][:total]
+      assert_equal 3, summaries[@other_host.id][:medium]
+    end
+
+    test 'call ignores duplicate invalid and out of scope host ids' do
+      latest_for_host = create_scan(host: @host, scanned_at: 1.hour.ago, total: 2, metrics: { high: 2 })
+      create_scan(host: @other_host, scanned_at: 30.minutes.ago, total: 3, metrics: { medium: 3 })
+
+      results = LatestScanSummaries.new(
+        host_scope: Host::Base.where(id: @host.id),
+        host_ids: [@host.id, @host.id, @other_host.id, 'nope', nil]
+      ).call
+
+      assert_equal 1, results.size
+      assert_equal @host.id, results[0][:host_id]
+      assert_equal latest_for_host.id, results[0][:id]
+    end
+
+    test 'call prefers higher id when scans share the same scanned_at' do
+      timestamp = 1.hour.ago
+      older_id_scan = create_scan(host: @host, scanned_at: timestamp, total: 1, metrics: { low: 1 })
+      newer_id_scan = create_scan(host: @host, scanned_at: timestamp, total: 2, metrics: { high: 2 })
+
+      results = LatestScanSummaries.new(
+        host_scope: Host::Base.where(id: @host.id),
+        host_ids: [@host.id]
+      ).call
+
+      assert_equal 1, results.size
+      assert_equal newer_id_scan.id, results[0][:id]
+      assert_operator newer_id_scan.id, :>, older_id_scan.id
+    end
+
+    private
+
+    def create_scan(host:, scanned_at:, total:, metrics: {})
+      critical = metrics.fetch(:critical, 0)
+      high = metrics.fetch(:high, 0)
+      medium = metrics.fetch(:medium, 0)
+      low = metrics.fetch(:low, 0)
+
+      ForemanCveScanner::CveScan.create!(
+        host: host,
+        scanner: 'trivy',
+        source: 'rex',
+        scanned_at: scanned_at,
+        raw: { 'dummy' => true },
+        summary: {
+          'worst' => ForemanCveScanner::CveScan.worst_severity(
+            'critical' => critical,
+            'high' => high,
+            'medium' => medium,
+            'low' => low
+          ),
+        },
+        findings: total.zero? ? [] : [{ 'id' => 'CVE-0000-0000' }],
+        total: total,
+        critical: critical,
+        high: high,
+        medium: medium,
+        low: low
+      )
+    end
+  end
+end

data/test/services/foreman_cve_scanner/scan_comparison_test.rb

@@ -39,6 +39,34 @@ module ForemanCveScanner
       assert_equal @second_scan.scanner, comparison[:current][:scanner]
     end
 
+    test 'compare keeps duplicate cve ids separate across packages' do
+      first_scan = create_scan(
+        scanned_at: 4.hours.ago,
+        findings: [
+          finding('CVE-1', 'openssl', 'HIGH', '1.0'),
+          finding('CVE-1', 'curl', 'LOW', '1.0'),
+        ]
+      )
+      second_scan = create_scan(
+        scanned_at: 3.hours.ago,
+        findings: [
+          finding('CVE-1', 'openssl', 'CRITICAL', '1.0'),
+          finding('CVE-1', 'curl', 'LOW', '1.0'),
+        ]
+      )
+
+      comparison = ScanComparison.compare(first_scan, second_scan)
+      rows = comparison[:results].to_h { |row| [row[:key], row] }
+
+      assert_equal 2, comparison[:results].size
+      assert_equal 'updated', rows['CVE-1::openssl'][:status]
+      assert_equal 'unchanged', rows['CVE-1::curl'][:status]
+      assert_equal(
+        { old: 'HIGH', new: 'CRITICAL' },
+        rows['CVE-1::openssl'][:diff]['severity']
+      )
+    end
+
     private
 
     def finding(id, name, severity, version)

data/test/services/foreman_cve_scanner/scan_importer_test.rb

@@ -58,6 +58,24 @@ module ForemanCveScanner
       assert_operator scan.total, :>, 0
     end
 
+    test 'import_for_host! ignores noise outside markers' do
+      output = [
+        'stderr noise before',
+        '===START',
+        load_fixture('trivy.json'),
+        '===END',
+        'stderr noise after',
+      ].join("\n")
+      importer = ForemanCveScanner::ScanImporter.new(output)
+
+      scan = importer.import_for_host!(@host)
+
+      assert_not_nil scan
+      assert_equal 'trivy', scan.scanner
+      assert_operator scan.total, :>, 0
+      assert_equal scan.total, scan.findings.count
+    end
+
     test 'import_for_host! raises when no json markers' do
       importer = ForemanCveScanner::ScanImporter.new('no markers here')
 
@@ -130,6 +148,43 @@ module ForemanCveScanner
       assert_equal 'none', scan.summary['worst']
     end
 
+    test 'import_for_host! persists duplicate cves for different packages' do
+      output = wrap_output(
+        {
+          'Results' => [
+            {
+              'Vulnerabilities' => [
+                {
+                  'VulnerabilityID' => 'CVE-2026-0001',
+                  'PkgName' => 'openssl',
+                  'InstalledVersion' => '1.0',
+                  'Title' => 'openssl issue',
+                  'Severity' => 'HIGH',
+                  'PrimaryURL' => 'https://example.com/openssl',
+                },
+                {
+                  'VulnerabilityID' => 'CVE-2026-0001',
+                  'PkgName' => 'curl',
+                  'InstalledVersion' => '2.0',
+                  'Title' => 'curl issue',
+                  'Severity' => 'MEDIUM',
+                  'PrimaryURL' => 'https://example.com/curl',
+                },
+              ],
+            },
+          ],
+        }.to_json
+      )
+      importer = ForemanCveScanner::ScanImporter.new(output)
+
+      scan = importer.import_for_host!(@host)
+      findings = scan.findings.map { |finding| [finding['id'], finding['name']] }
+
+      assert_equal 2, scan.findings.size
+      assert_equal [%w[CVE-2026-0001 openssl], %w[CVE-2026-0001 curl]], findings
+      assert_equal [2, 1, 1], [scan.total, scan.high, scan.medium]
+    end
+
     private
 
     def load_fixture(name)

data/test/services/foreman_cve_scanner/scan_post_processor_test.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+require 'test_plugin_helper'
+
+module ForemanCveScanner
+  class ScanPostProcessorTest < ActiveSupport::TestCase
+    def setup
+      @host = FactoryBot.create(:host)
+      @previous_retention = Setting[:cve_scan_delete_after_days]
+    end
+
+    def teardown
+      Setting[:cve_scan_delete_after_days] = @previous_retention
+    end
+
+    test 'refreshes cve host status' do
+      create_scan(critical: 1)
+
+      assert_difference('HostStatus::CveStatus.count', 1) do
+        ScanPostProcessor.new(@host).call
+      end
+
+      status = HostStatus::CveStatus.find_by(host: @host)
+      assert_equal HostStatus::CveStatus::CVE_SCANNER_STATUS_CRITICAL_HIGH, status.status
+    end
+
+    test 'cleans up old scans for host using retention setting' do
+      Setting[:cve_scan_delete_after_days] = 1
+      old_scan = create_scan(scanned_at: 3.days.ago)
+      kept_scan = create_scan(scanned_at: Time.current)
+
+      ScanPostProcessor.new(@host).call
+
+      assert_not CveScan.exists?(old_scan.id)
+      assert CveScan.exists?(kept_scan.id)
+    end
+
+    private
+
+    def create_scan(options = {})
+      critical = options.fetch(:critical, 0)
+      scanned_at = options.fetch(:scanned_at, Time.current)
+      CveScan.create!(
+        host: @host,
+        scanner: 'trivy',
+        source: 'rex',
+        scanned_at: scanned_at,
+        raw: { 'dummy' => true },
+        summary: { 'worst' => critical.positive? ? 'critical' : 'none' },
+        findings: critical.positive? ? [{ 'id' => 'CVE-0000-0000' }] : [],
+        total: critical,
+        critical: critical,
+        high: 0,
+        medium: 0,
+        low: 0
+      )
+    end
+  end
+end

data/webpack/components/CveCompareModal.js

@@ -22,6 +22,8 @@ import { useAPI } from 'foremanReact/common/hooks/API/APIHooks';
 import { foremanUrl } from 'foremanReact/common/helpers';
 import { translate as __ } from 'foremanReact/common/I18n';
 import { STATUS } from 'foremanReact/constants';
+import CveLink from './CveLink';
+import useSortBy from './useSortBy';
 import {
   comparisonDiffEntries,
   comparisonColumns,
@@ -39,10 +41,6 @@ import './cve_scans.scss';
 const CveCompareModal = ({ hostId, isOpen, onClose, scanIds }) => {
   const [filter, setFilter] = useState('all');
   const [search, setSearch] = useState('');
-  const [sortBy, setSortBy] = useState({
-    direction: SortByDirection.desc,
-    column: 'status',
-  });
   const previousScanId = scanIds[0];
   const currentScanId = scanIds[1];
   const compareUrl =
@@ -62,7 +60,7 @@ const CveCompareModal = ({ hostId, isOpen, onClose, scanIds }) => {
       direction: SortByDirection.desc,
       column: 'status',
     });
-  }, [currentScanId, isOpen, previousScanId]);
+  }, [currentScanId, isOpen, previousScanId, setSortBy]);
 
   const comparison = compareRequest.response || {};
   const previousScan = comparison.previous || {};
@@ -88,15 +86,11 @@ const CveCompareModal = ({ hostId, isOpen, onClose, scanIds }) => {
     if (!normalizedSearch) return rows;
     return rows.filter(row => comparisonMatchesSearch(row, normalizedSearch));
   }, [comparisonRows, filter, normalizedSearch]);
-  const sortedRows = useMemo(() => {
-    const rows = [...filteredRows];
-    const sorter = comparisonSorters[sortBy.column] || comparisonSorters.status;
-    rows.sort((a, b) => {
-      const result = sorter(a, b);
-      return sortBy.direction === SortByDirection.asc ? result : -result;
-    });
-    return rows;
-  }, [filteredRows, sortBy]);
+  const { onSort, sortedItems: sortedRows, setSortBy } = useSortBy(
+    'status',
+    comparisonSorters,
+    filteredRows
+  );
   const status = compareRequest.status || STATUS.PENDING;
   const subtitle =
     previousScan.scanned_at && currentScan.scanned_at
@@ -105,13 +99,6 @@ const CveCompareModal = ({ hostId, isOpen, onClose, scanIds }) => {
         )}`
       : __('Compare CVE reports');
 
-  const onSort = column => {
-    const nextDirection =
-      sortBy.column === column && sortBy.direction === SortByDirection.asc
-        ? SortByDirection.desc
-        : SortByDirection.asc;
-    setSortBy({ column, direction: nextDirection });
-  };
   const onSearchChange = (value, event) => {
     setSearch(normalizeSearchInputValue(value, event));
   };
@@ -254,13 +241,7 @@ const CveCompareModal = ({ hostId, isOpen, onClose, scanIds }) => {
                         {comparisonStatusLabels[row.status]}
                       </Td>
                       <Td dataLabel={__('CVE')}>
-                        {row.url ? (
-                          <a href={row.url} target="_blank" rel="noreferrer">
-                            {row.id}
-                          </a>
-                        ) : (
-                          row.id
-                        )}
+                        <CveLink id={row.id} url={row.url} />
                       </Td>
                       <Td dataLabel={__('Package')}>{row.name}</Td>
                       <Td dataLabel={__('Severity')}>{row.severity}</Td>

data/webpack/components/CveDetailsCard.js

@@ -28,18 +28,29 @@ import SeverityIcon from './SeverityIcon';
 import CveFindingsModal from './CveFindingsModal';
 import useModalScan from './useModalScan';
 import {
+  findingIdentity,
   noFindingsBody,
   noFindingsTitle,
   formatScanOrigin,
+  katelloFixCounts,
   noReportsBody,
   noReportsTitle,
   riskLevelFromWorst,
   severityRank,
+  shouldShowKatelloFixColumn,
 } from './cve_helpers';
 import './cve_scans.scss';
 
+const SEVERITY_COUNT_CARDS = [
+  { key: 'critical', label: __('critical') },
+  { key: 'high', label: __('high') },
+  { key: 'medium', label: __('medium') },
+  { key: 'low', label: __('low') },
+];
+
 const CveDetailsCard = ({ hostDetails }) => {
   const hostId = hostDetails?.id;
+  const hostName = hostDetails?.name;
   const latestUrl = hostId
     ? foremanUrl(`/api/v2/hosts/${hostId}/cve_scans/latest`)
     : null;
@@ -71,6 +82,8 @@ const CveDetailsCard = ({ hostDetails }) => {
   const worst = latest?.summary?.worst || 'none';
   const riskLevel = riskLevelFromWorst(worst);
   const origin = formatScanOrigin(latest?.scanner, latest?.source);
+  const showKatelloFixSummary = shouldShowKatelloFixColumn(findings);
+  const fixCounts = katelloFixCounts(findings);
   return (
     <CardTemplate header={__('CVE scan details')} expandable masonryLayout>
       <SkeletonLoader status={latestStatus || STATUS.PENDING}>
@@ -119,72 +132,44 @@ const CveDetailsCard = ({ hostDetails }) => {
                     </span>
                   </DescriptionListDescription>
                 </DescriptionListGroup>
+                {showKatelloFixSummary && (
+                  <DescriptionListGroup>
+                    <DescriptionListTerm>
+                      {__('Fix availability')}
+                    </DescriptionListTerm>
+                    <DescriptionListDescription>
+                      <span className="cve-katello-summary">
+                        <span className="cve-katello-fix cve-katello-fix--installable">
+                          {`${__('Fixable')}: ${fixCounts.installable}`}
+                        </span>
+                        <span className="cve-katello-fix cve-katello-fix--applicable">
+                          {`${__('Applicable')}: ${fixCounts.applicable}`}
+                        </span>
+                      </span>
+                    </DescriptionListDescription>
+                  </DescriptionListGroup>
+                )}
               </DescriptionList>
               <div className="cve-counts cve-counts--compact">
-                <Button
-                  variant="plain"
-                  className="cve-count-card cve-count-card--critical"
-                  onClick={() => openModal(latest.id, 'critical')}
-                  ouiaId="cve-details-critical-button"
-                >
-                  <span className="cve-count">
-                    <span className="cve-count-label">
-                      <SeverityIcon severity="critical" />
-                      <span>{__('critical')}</span>
-                    </span>
-                    <span className="cve-bubble cve-bubble--critical">
-                      {latest.critical}
-                    </span>
-                  </span>
-                </Button>
-                <Button
-                  variant="plain"
-                  className="cve-count-card cve-count-card--medium"
-                  onClick={() => openModal(latest.id, 'medium')}
-                  ouiaId="cve-details-medium-button"
-                >
-                  <span className="cve-count">
-                    <span className="cve-count-label">
-                      <SeverityIcon severity="medium" />
-                      <span>{__('medium')}</span>
-                    </span>
-                    <span className="cve-bubble cve-bubble--medium">
-                      {latest.medium}
-                    </span>
-                  </span>
-                </Button>
-                <Button
-                  variant="plain"
-                  className="cve-count-card cve-count-card--high"
-                  onClick={() => openModal(latest.id, 'high')}
-                  ouiaId="cve-details-high-button"
-                >
-                  <span className="cve-count">
-                    <span className="cve-count-label">
-                      <SeverityIcon severity="high" />
-                      <span>{__('high')}</span>
-                    </span>
-                    <span className="cve-bubble cve-bubble--high">
-                      {latest.high}
-                    </span>
-                  </span>
-                </Button>
-                <Button
-                  variant="plain"
-                  className="cve-count-card cve-count-card--low"
-                  onClick={() => openModal(latest.id, 'low')}
-                  ouiaId="cve-details-low-button"
-                >
-                  <span className="cve-count">
-                    <span className="cve-count-label">
-                      <SeverityIcon severity="low" />
-                      <span>{__('low')}</span>
-                    </span>
-                    <span className="cve-bubble cve-bubble--low">
-                      {latest.low}
+                {SEVERITY_COUNT_CARDS.map(card => (
+                  <Button
+                    key={card.key}
+                    variant="plain"
+                    className={`cve-count-card cve-count-card--${card.key}`}
+                    onClick={() => openModal(latest.id, card.key)}
+                    ouiaId={`cve-details-${card.key}-button`}
+                  >
+                    <span className="cve-count">
+                      <span className="cve-count-label">
+                        <SeverityIcon severity={card.key} />
+                        <span>{card.label}</span>
+                      </span>
+                      <span className={`cve-bubble cve-bubble--${card.key}`}>
+                        {latest[card.key]}
+                      </span>
                     </span>
-                  </span>
-                </Button>
+                  </Button>
+                ))}
               </div>
             </div>
 
@@ -225,7 +210,7 @@ const CveDetailsCard = ({ hostDetails }) => {
                   <Tbody>
                     {visibleFindings.map((finding, index) => (
                       <Tr
-                        key={finding.id}
+                        key={findingIdentity(finding)}
                         ouiaId={`cve-details-finding-row-${index}`}
                       >
                         <Td dataLabel={__('Severity')}>
@@ -263,6 +248,7 @@ const CveDetailsCard = ({ hostDetails }) => {
         isOpen={isOpen}
         onClose={closeModal}
         hostId={hostId}
+        hostName={hostName}
         scanId={scanId}
         initialFilter={filter}
       />
@@ -270,7 +256,10 @@ const CveDetailsCard = ({ hostDetails }) => {
   );
 };
 CveDetailsCard.propTypes = {
-  hostDetails: PropTypes.shape({ id: PropTypes.number }),
+  hostDetails: PropTypes.shape({
+    id: PropTypes.number,
+    name: PropTypes.string,
+  }),
 };
 CveDetailsCard.defaultProps = {
   hostDetails: undefined,