foreman_cve_scanner 0.6.1 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7158a1750507e0b726300cce1fbed2c725aaa81e8e4c9d58733b059ef7729f10
-  data.tar.gz: 432bce08dd6d67c7343ac4e5218e2dfe552fc3cbdf9767f4dca423c9fec5b177
+  metadata.gz: 23c87498422d0e807ebe6db02c5390db04cc8bc8d267eaefc8477ebbb78846ee
+  data.tar.gz: f84b770d2f95428b58e6981ca58a1753f98f4592c652a25376374bcfa45badb1
 SHA512:
-  metadata.gz: 45cad3cdfac54911ad7196a4d0f8ad686ae9f6ea671b73c3e002287e733ef9ccce05854b41796e44c836e426890406fecad678ab42bda44baed5b9305d74e698
-  data.tar.gz: 9e2643ac1f5e2ca20880c58526514dc99e170f345bb6aa62160c21cc9adada4e2707efad8783a1fdf49b31be01b5946dcb9079ddb9e7ee562bb147e8e5de6dcc
+  metadata.gz: 3c7a00415463f41d0b7bf61ebfb6b69d64401f75c194216543c34434f5714900efba97bcd727e1ed94f699d35d0f0a7ae41bad7c0cb2f21fa9ee8100f559ba10
+  data.tar.gz: 9afb073399f02c9874caf8a3fc341e5824b5f0e6344be69790a1095c944b371dfaab1eafc694d052d56cb685386d24d133aa80c30560f8739948af6413a4ab41

data/README.md

@@ -20,6 +20,7 @@ Plugin to:
 - Host Details tab “CVE scans” for full history
 - Hosts overview list column “CVE” with quick summary and modal
 - Integrated in the Host Status
+- Optional Katello integration for managed errata fix availability
 - Export scan results as CSV
 
 ## Installation
@@ -34,10 +35,31 @@ for how to install Foreman plugins
 - You can configure recurring CVE scans via `Monitor -> Jobs`
 - You can configure the default scanner for the `Run CVE scan` template via `Administer -> Settings -> CVE Scanner -> Preferred CVE scanner`
 - The setting `Administer -> Settings -> CVE Scanner -> Run CVE scan after host profiles upload` takes effect only when Katello is installed and triggers a scan after host profiles uploads using the preferred scanner setting
+- The setting `Administer -> Settings -> CVE Scanner -> Show CVE fix availability from content` is enabled by default. When Katello is installed, the latest scan view can show whether a matching managed erratum is installable for the host or only applicable.
 - View results in:
   - Hosts overview list column “CVE” (use 'Manage Columns' to enable)
   - Host Details card and modal
   - Host Details tab “CVE scans”
+- Filter hosts by latest CVE scan data with `cve_scanned`, `cve_total`, `cve_critical`, `cve_high`, `cve_medium`, `cve_low`, `cve_scanner`, `cve_source`, and `cve_scanned_at`
+
+## Scanner installation
+
+The `Install CVE scanners` Remote Execution job installs scanner packages from the host's enabled repositories by default. For Katello-managed hosts, this means `trivy` and `grype` can be delivered through the assigned content view/environment.
+
+Set the job parameter `install_from_github` to `true` to install the scanner release packages directly from GitHub instead. The `trivy_version` and `grype_version` parameters are only used for the GitHub install path.
+
+## Katello fix availability
+
+When Katello is installed and `Show CVE fix availability from content` is enabled, the latest CVE scan is enriched with matching security errata from the host content facet.
+
+The latest scan can show:
+
+- `Installable`: a matching erratum is applicable and available in the host's assigned content view environments. The badge links to Foreman's customized Remote Execution flow for `katello_errata_install_by_search`.
+- `Applicable`: a matching erratum applies to the host, but is not currently installable from the assigned content view environments. The badge links to the erratum details page.
+- `No managed fix`: no matching managed erratum was found for the CVE/package.
+- `Unknown`: fix availability could not be calculated.
+
+If Katello is not installed, no fix availability data or UI is shown.
 
 ## External Push API
 
@@ -135,10 +157,6 @@ Override the configured retention for one run:
 
 - `bundle exec rake foreman_cve_scanner:cleanup_scans DAYS=30`
 
-## TODO
-
-- Deliver Trivy/Grype via Katello
-
 ## Contributing
 
 Fork and send a Pull Request. Thanks!

data/app/controllers/api/v2/cve_scans_controller.rb

@@ -6,7 +6,7 @@ module Api
   module V2
     # API controller for CVE scans per host.
     class CveScansController < V2::BaseController
-      before_action :find_host
+      before_action :find_host, except: :latest_by_hosts
 
       def resource_class
         ::ForemanCveScanner::CveScan
@@ -27,6 +27,19 @@ module Api
       def latest
         @cve_scan = cve_scans_index_scope.first
         head :no_content if @cve_scan.nil?
+        enrich_cve_scan_findings if @cve_scan
+      end
+
+      api :GET, '/cve_scans/latest_by_hosts', N_('Get latest CVE scan summaries for multiple hosts')
+      description N_('Returns the most recent CVE scan summary for each requested host.')
+      param :host_ids, Array, of: Integer, required: true
+      def latest_by_hosts
+        results = ::ForemanCveScanner::LatestScanSummaries.new(
+          host_scope: ::Host::Base.authorized(host_permission),
+          host_ids: params[:host_ids]
+        ).call
+
+        render json: { results: results }
       end
 
       api :GET, '/hosts/:host_id/cve_scans/:id', N_('Show CVE scan for a host')
@@ -60,6 +73,7 @@ module Api
         @cve_scan = resource_class.new(build_import_attributes)
 
         if @cve_scan.save
+          post_process_scan_import
           render 'api/v2/cve_scans/show', status: :created
         else
           render(
@@ -230,6 +244,14 @@ module Api
 
         :view_cve_scans
       end
+
+      def enrich_cve_scan_findings
+        @cve_scan_findings = ::ForemanCveScanner::KatelloFixAvailability.new(@host, @cve_scan.findings).call
+      end
+
+      def post_process_scan_import
+        ::ForemanCveScanner::ScanPostProcessor.new(@host).call
+      end
     end
   end
 end

data/app/models/concerns/foreman_cve_scanner/host_extensions.rb

@@ -1,16 +1,137 @@
 # frozen_string_literal: true
 
 module ForemanCveScanner
-  # Adds CVE scan associations to hosts.
+  # Adds CVE scan associations and search predicates to hosts.
   module HostExtensions
     extend ActiveSupport::Concern
 
+    CVE_SEARCH_COUNT_COLUMNS = %w[total critical high medium low].freeze
+    CVE_SEARCH_TEXT_OPERATORS = ['= ', '!= ', '~ ', '!~ '].freeze
+    CVE_SEARCH_COMPARE_OPERATORS = ['= ', '!= ', '< ', '> ', '<= ', '>= '].freeze
+    CVE_SEARCH_TEXT_SQL_OPERATORS = ['=', '!=', '<>', 'LIKE', 'NOT LIKE', '~', '!~'].freeze
+    CVE_SEARCH_COMPARE_SQL_OPERATORS = ['=', '!=', '<>', '<', '>', '<=', '>='].freeze
+    # Scoped Search autocompletion expects symbol keys here; boolean keys raise during typing.
+    # rubocop:disable Lint/BooleanSymbol
+    CVE_SEARCH_BOOLEAN_VALUES = { true: true, false: false }.freeze
+    # rubocop:enable Lint/BooleanSymbol
+    CVE_SEARCH_SCANNER_VALUES = { trivy: 'trivy', grype: 'grype' }.freeze
+    CVE_SEARCH_SOURCE_VALUES = { rex: 'rex', external: 'external' }.freeze
+
     included do
       has_many :cve_scans,
         class_name: 'ForemanCveScanner::CveScan',
         foreign_key: :host_id,
         dependent: :destroy,
         inverse_of: :host
+
+      scoped_search on: :id, rename: :cve_scanned, only_explicit: true,
+        complete_value: CVE_SEARCH_BOOLEAN_VALUES,
+        operators: ['= ', '!= '], ext_method: :search_by_cve_scanned
+
+      CVE_SEARCH_COUNT_COLUMNS.each do |column|
+        scoped_search on: :id, rename: "cve_#{column}", only_explicit: true,
+          complete_enabled: false, validator: ScopedSearch::Validators::INTEGER,
+          operators: CVE_SEARCH_COMPARE_OPERATORS, ext_method: :"search_by_cve_#{column}"
+      end
+
+      scoped_search on: :id, rename: :cve_scanner, only_explicit: true,
+        complete_value: CVE_SEARCH_SCANNER_VALUES, operators: CVE_SEARCH_TEXT_OPERATORS,
+        ext_method: :search_by_cve_scanner
+      scoped_search on: :id, rename: :cve_source, only_explicit: true,
+        complete_value: CVE_SEARCH_SOURCE_VALUES, operators: CVE_SEARCH_TEXT_OPERATORS,
+        ext_method: :search_by_cve_source
+      scoped_search on: :id, rename: :cve_scanned_at, only_explicit: true,
+        complete_enabled: false, operators: CVE_SEARCH_COMPARE_OPERATORS,
+        ext_method: :search_by_cve_scanned_at
+    end
+
+    module ClassMethods
+      def search_by_cve_scanned(_key, operator, value)
+        scanned = ::Foreman::Cast.to_bool(value)
+        return no_cve_scan_search_results if scanned.nil?
+
+        positive = searched_by_equal_operator?(operator) ? scanned : !scanned
+        cve_scan_host_conditions(latest_cve_scans, positive: positive)
+      end
+
+      def search_by_cve_total(_key, operator, value)
+        search_by_cve_count('total', operator, value)
+      end
+
+      def search_by_cve_critical(_key, operator, value)
+        search_by_cve_count('critical', operator, value)
+      end
+
+      def search_by_cve_high(_key, operator, value)
+        search_by_cve_count('high', operator, value)
+      end
+
+      def search_by_cve_medium(_key, operator, value)
+        search_by_cve_count('medium', operator, value)
+      end
+
+      def search_by_cve_low(_key, operator, value)
+        search_by_cve_count('low', operator, value)
+      end
+
+      def search_by_cve_scanner(_key, operator, value)
+        search_by_cve_text('scanner', operator, value)
+      end
+
+      def search_by_cve_source(_key, operator, value)
+        search_by_cve_text('source', operator, value)
+      end
+
+      def search_by_cve_scanned_at(_key, operator, value)
+        search_by_cve_column('scanned_at', operator, value)
+      end
+
+      private
+
+      def search_by_cve_count(column, operator, value)
+        search_by_cve_column(column, sql_operator(operator, CVE_SEARCH_COMPARE_SQL_OPERATORS), value.to_i)
+      end
+
+      def search_by_cve_text(column, operator, value)
+        operator = sql_operator(operator, CVE_SEARCH_TEXT_SQL_OPERATORS)
+        search_by_cve_column(column, operator, value_to_sql(operator, value))
+      end
+
+      def search_by_cve_column(column, operator, value)
+        scan_table = ::ForemanCveScanner::CveScan.table_name
+        condition = sanitize_sql_for_conditions(["#{scan_table}.#{column} #{operator} ?", value])
+        cve_scan_host_conditions(latest_cve_scans.where(condition))
+      end
+
+      def latest_cve_scans
+        scan_table = ::ForemanCveScanner::CveScan.table_name
+        latest_sql = ::ForemanCveScanner::CveScan
+                     .select("DISTINCT ON (#{scan_table}.host_id) #{scan_table}.*")
+                     .order("#{scan_table}.host_id, #{scan_table}.scanned_at DESC, #{scan_table}.id DESC")
+                     .to_sql
+
+        ::ForemanCveScanner::CveScan.from("(#{latest_sql}) #{scan_table}")
+      end
+
+      def cve_scan_host_conditions(scans, positive: true)
+        host_operator = positive ? 'IN' : 'NOT IN'
+        { conditions: "#{table_name}.id #{host_operator} (#{scans.select(:host_id).to_sql})" }
+      end
+
+      def no_cve_scan_search_results
+        { conditions: '1=0' }
+      end
+
+      def searched_by_equal_operator?(operator)
+        operator.to_s.strip == '='
+      end
+
+      def sql_operator(operator, allowed_operators)
+        operator = operator.to_s.strip.upcase
+        return operator if allowed_operators.include?(operator)
+
+        raise ::ScopedSearch::QueryNotSupported, _("Unsupported CVE scan search operator '%s'") % operator
+      end
     end
   end
 end

data/app/models/host_status/cve_status.rb

@@ -53,6 +53,10 @@ module HostStatus
       end
     end
 
+    def relevant?(_options = {})
+      persisted?
+    end
+
     private
 
     def latest_scan

data/app/services/foreman_cve_scanner/cve_report_scanner.rb

@@ -21,8 +21,8 @@ module ForemanCveScanner
     def generate
       @status = {}
       @logs = []
-      @cve_report_data.each do |id, cve|
-        @logs << generate_log_from_unified(id, cve)
+      @cve_report_data.each do |cve|
+        @logs << generate_log_from_unified(cve['id'], cve)
       end
       @logs
     end
@@ -77,6 +77,7 @@ module ForemanCveScanner
 
     def generate_grype_entry(entry)
       {
+        'id' => entry['vulnerability']['id'],
         'name' => entry['artifact']['name'],
         'version' => entry['artifact']['version'],
         'title' => entry['vulnerability']['description'].to_s.gsub(/[\[\]"\\]/, ''),
@@ -87,6 +88,7 @@ module ForemanCveScanner
 
     def generate_trivy_entry(entry)
       unified = {
+        'id' => entry['VulnerabilityID'],
         'name' => entry['PkgName'],
         'version' => entry['InstalledVersion'],
         'title' => entry['Title'].to_s.gsub(/[\[\]"\\]/, ''),
@@ -99,22 +101,22 @@ module ForemanCveScanner
       unified
     end
 
-    # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+    # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
     def generate_unified_vuls
       raise ::Foreman::Exception, _('Invalid CVE scanner report') unless @raw_data.key?('scan')
 
       j = @raw_data['scan']
-      vuls = {}
+      vuls = []
       if j.key?('matches') # Grype
         j['matches'].each do |vul|
-          vuls[vul['vulnerability']['id']] = generate_grype_entry(vul)
+          vuls << generate_grype_entry(vul)
         end
       elsif j.key?('Results') # Trivy
         j['Results'].each do |r|
           next unless r.key? 'Vulnerabilities'
 
           r['Vulnerabilities'].each do |vul|
-            vuls[vul['VulnerabilityID']] = generate_trivy_entry(vul)
+            vuls << generate_trivy_entry(vul)
           end
         end
       else
@@ -124,6 +126,6 @@ module ForemanCveScanner
 
       vuls
     end
-    # rubocop:enable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+    # rubocop:enable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
   end
 end

data/app/services/foreman_cve_scanner/katello_fix_availability.rb

@@ -0,0 +1,208 @@
+# frozen_string_literal: true
+
+module ForemanCveScanner
+  class KatelloFixAvailability
+    STATUS_INSTALLABLE = 'installable'
+    STATUS_APPLICABLE = 'applicable'
+    STATUS_UNAVAILABLE = 'unavailable'
+    STATUS_UNKNOWN = 'unknown'
+
+    CONFIDENCE_PACKAGE_MATCH = 'package_match'
+    CONFIDENCE_CVE_ONLY = 'cve_only'
+
+    UNKNOWN_MISSING_CVE = 'missing_cve'
+    UNKNOWN_QUERY_FAILED = 'query_failed'
+
+    def initialize(host, findings)
+      @host = host
+      @findings = Array(findings)
+    end
+
+    def call
+      return findings_without_enrichment unless katello_available? && enabled?
+
+      decorate_with_katello
+    rescue StandardError => e
+      Rails.logger.error(
+        "Katello CVE fix lookup failed for host_id=#{@host&.id}: #{e.class}: #{e.message}"
+      )
+      decorate_all_unknown(UNKNOWN_QUERY_FAILED)
+    end
+
+    private
+
+    def decorate_with_katello
+      cve_ids = @findings.filter_map { |finding| cve_id_for(finding) }.uniq
+      return decorate_all_unknown(UNKNOWN_MISSING_CVE) if cve_ids.empty?
+
+      installable_by_cve = errata_by_cve(installable_errata(cve_ids))
+      applicable_by_cve = errata_by_cve(applicable_errata(cve_ids))
+
+      @findings.map do |finding|
+        cve_id = cve_id_for(finding)
+        next decorate_finding(finding, unknown_fix(UNKNOWN_MISSING_CVE)) if cve_id.blank?
+
+        fix = fix_for(finding, installable_by_cve[cve_id], applicable_by_cve[cve_id])
+        decorate_finding(finding, fix)
+      end
+    end
+
+    def fix_for(finding, installable_errata, applicable_errata)
+      return matched_fix(STATUS_INSTALLABLE, finding, installable_errata) if installable_errata.present?
+      return matched_fix(STATUS_APPLICABLE, finding, applicable_errata) if applicable_errata.present?
+
+      {
+        'status' => STATUS_UNAVAILABLE,
+        'reason' => nil,
+        'confidence' => nil,
+        'errata' => [],
+      }
+    end
+
+    def matched_fix(status, finding, errata)
+      matched_errata = errata_matching_package(errata, package_name_for(finding))
+      selected_errata = matched_errata.presence || errata
+
+      {
+        'status' => status,
+        'reason' => nil,
+        'confidence' => confidence_for(matched_errata),
+        'errata' => selected_errata.map { |erratum| erratum_payload(erratum) },
+      }
+    end
+
+    def confidence_for(matched_errata)
+      matched_errata.present? ? CONFIDENCE_PACKAGE_MATCH : CONFIDENCE_CVE_ONLY
+    end
+
+    def decorate_all_unknown(reason)
+      @findings.map { |finding| decorate_finding(finding, unknown_fix(reason)) }
+    end
+
+    def findings_without_enrichment
+      @findings.map { |finding| finding.to_h.deep_dup }
+    end
+
+    def decorate_finding(finding, fix)
+      finding.to_h.deep_dup.merge('katello_fix' => fix)
+    end
+
+    def unknown_fix(reason)
+      {
+        'status' => STATUS_UNKNOWN,
+        'reason' => reason,
+        'confidence' => nil,
+        'errata' => [],
+      }
+    end
+
+    def installable_errata(cve_ids)
+      errata_matching_cves(host_installable_errata, cve_ids)
+    end
+
+    def applicable_errata(cve_ids)
+      errata_matching_cves(host_applicable_errata, cve_ids)
+    end
+
+    def host_installable_errata
+      return ::Katello::Erratum.none unless host_content_facet
+
+      host_content_facet.installable_errata.security
+    end
+
+    def host_applicable_errata
+      return ::Katello::Erratum.none unless host_content_facet
+
+      host_content_facet.applicable_errata.security
+    end
+
+    def host_content_facet
+      return nil unless @host.respond_to?(:content_facet)
+
+      @host.content_facet
+    end
+
+    def errata_matching_cves(scope, cve_ids)
+      scope = scope.includes(:cves, :packages, :deb_packages)
+      cve_filtered_errata(scope, cve_ids).distinct
+    end
+
+    def cve_filtered_errata(scope, cve_ids)
+      return cve_join_filtered_errata(scope, cve_ids) unless scope.respond_to?(:search_for)
+
+      scope.search_for(cve_search_query(cve_ids))
+    rescue StandardError => e
+      Rails.logger.debug do
+        "Katello CVE scoped search failed for host_id=#{@host&.id}: #{e.class}: #{e.message}"
+      end
+      cve_join_filtered_errata(scope, cve_ids)
+    end
+
+    def cve_join_filtered_errata(scope, cve_ids)
+      scope
+        .joins(:cves)
+        .where(::Katello::ErratumCve.table_name => { cve_id: cve_ids })
+    end
+
+    def cve_search_query(cve_ids)
+      cve_ids.map { |cve_id| %(cve = "#{escape_search_value(cve_id)}") }.join(' OR ')
+    end
+
+    def escape_search_value(value)
+      value.to_s.gsub(/[\\"]/) { |char| "\\#{char}" }
+    end
+
+    def errata_by_cve(errata)
+      grouped = Hash.new { |hash, key| hash[key] = [] }
+      errata.each do |erratum|
+        erratum.cves.each { |cve| grouped[cve.cve_id] << erratum }
+      end
+      grouped
+    end
+
+    def errata_matching_package(errata, package_name)
+      return [] if package_name.blank?
+
+      normalized_package_name = normalize_package_name(package_name)
+      errata.select do |erratum|
+        erratum_package_names(erratum).any? do |name|
+          normalize_package_name(name) == normalized_package_name
+        end
+      end
+    end
+
+    def erratum_payload(erratum)
+      {
+        'id' => erratum.id,
+        'errata_id' => erratum.errata_id,
+        'title' => erratum.title,
+        'severity' => erratum.severity,
+        'packages' => erratum_package_names(erratum),
+      }
+    end
+
+    def erratum_package_names(erratum)
+      (erratum.packages.map(&:name) + erratum.deb_packages.map(&:name)).compact.uniq
+    end
+
+    def cve_id_for(finding)
+      finding.to_h['id'].presence
+    end
+
+    def package_name_for(finding)
+      finding.to_h['name'].presence
+    end
+
+    def normalize_package_name(name)
+      name.to_s.downcase.strip
+    end
+
+    def katello_available?
+      Foreman::Plugin.installed?(:katello)
+    end
+
+    def enabled?
+      Setting[:enable_katello_cve_fix_availability]
+    end
+  end
+end

data/app/services/foreman_cve_scanner/latest_scan_summaries.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module ForemanCveScanner
+  class LatestScanSummaries
+    def initialize(host_scope:, host_ids:)
+      @host_scope = host_scope
+      @host_ids = host_ids
+    end
+
+    def call
+      latest_scans.map { |scan| summary_for(scan) }
+    end
+
+    private
+
+    attr_reader :host_scope, :host_ids
+
+    def latest_scans
+      ids = requested_host_ids
+      return [] if ids.empty?
+
+      table = ::ForemanCveScanner::CveScan.table_name
+      ::ForemanCveScanner::CveScan.where(host_id: ids)
+                                  .select("DISTINCT ON (host_id) #{table}.*")
+                                  .order(:host_id, scanned_at: :desc, id: :desc)
+    end
+
+    def requested_host_ids
+      ids = Array(host_ids).map(&:to_s).map(&:strip).grep(/\A\d+\z/).uniq
+      return [] if ids.empty?
+
+      host_scope.where(id: ids).pluck(:id)
+    end
+
+    def summary_for(scan)
+      {
+        id: scan.id,
+        host_id: scan.host_id,
+        scanner: scan.scanner,
+        source: scan.source,
+        scanned_at: scan.scanned_at,
+        total: scan.total,
+        critical: scan.critical,
+        high: scan.high,
+        medium: scan.medium,
+        low: scan.low,
+        summary: scan.summary,
+      }
+    end
+  end
+end

data/app/services/foreman_cve_scanner/scan_importer.rb

@@ -64,18 +64,10 @@ module ForemanCveScanner
       scan = ::ForemanCveScanner::CveScan.create!(
         build_scan_attributes(host, scanner_name, scan_json, metrics, scanner)
       )
-      refresh_host_status(host)
-      cleanup_old_scans(host)
+      ::ForemanCveScanner::ScanPostProcessor.new(host).call
       scan
     end
 
-    def refresh_host_status(host)
-      status = ::HostStatus::CveStatus.find_or_initialize_by(host: host)
-      status.refresh!
-    rescue StandardError => e
-      Rails.logger.error("CVE status refresh failed for host_id=#{host.id}: #{e}")
-    end
-
     def build_scan_attributes(host, scanner_name, scan_json, metrics, scanner)
       summary = metrics.merge('worst' => ::ForemanCveScanner::CveScan.worst_severity(metrics))
       {
@@ -95,13 +87,7 @@ module ForemanCveScanner
     end
 
     def build_findings(scanner)
-      scanner.unified_vulnerabilities.map do |id, entry|
-        entry.merge('id' => id)
-      end
-    end
-
-    def cleanup_old_scans(host)
-      ::ForemanCveScanner::ScanCleanup.new(scope: host.cve_scans).cleanup!
+      scanner.unified_vulnerabilities.map(&:dup)
     end
   end
 end

data/app/services/foreman_cve_scanner/scan_post_processor.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module ForemanCveScanner
+  class ScanPostProcessor
+    def initialize(host)
+      @host = host
+    end
+
+    def call
+      refresh_host_status
+      cleanup_old_scans
+    end
+
+    private
+
+    attr_reader :host
+
+    def refresh_host_status
+      status = ::HostStatus::CveStatus.find_or_initialize_by(host: host)
+      status.refresh!
+    rescue StandardError => e
+      Rails.logger.error("CVE status refresh failed for host_id=#{host.id}: #{e}")
+    end
+
+    def cleanup_old_scans
+      ::ForemanCveScanner::ScanCleanup.new(scope: host.cve_scans).cleanup!
+    end
+  end
+end

data/app/views/api/v2/cve_scans/main.json.rabl

@@ -4,4 +4,6 @@ object @cve_scan
 
 extends 'api/v2/cve_scans/base'
 
-attributes :findings, :updated_at
+attributes :updated_at
+
+node(:findings) { |scan| @cve_scan_findings || scan.findings }