beast-mode(empty-endpoints): wire GET /threat-intel/ to ThreatIntelCorrelator, was 34 → now 33 stub endpoints

Replaced hardcoded `"items": []` with real call to
`_correlator.get_active_threats(org_id)` which queries the SQLite
threat_actors table. count now reflects actual active actors.
2 tests added (actor returned, empty list fallback).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: DevOpsMadDog

suite-api/apps/api/threat_intel_router.py

@@ -802,10 +802,10 @@ async def get_ip_geo(ip: str) -> Dict[str, Any]:
 
 @router.get("/", summary="Threat intel index", tags=["threat-intel"])
 async def threat_intel_index(org_id: str = Query("default")) -> Dict[str, Any]:
-    """Return threat intel summary for the org."""
+    """Return active threat actors and landscape summary for the org."""
     try:
-        actors = _get_engine().list_actors(org_id=org_id) if hasattr(_get_engine(), "list_actors") else []
-        count = len(actors)
+        actors = _correlator.get_active_threats(org_id=org_id)
+        items = [a.model_dump(mode="json") if hasattr(a, "model_dump") else dict(a) for a in actors]
     except Exception:
-        count = 0
-    return {"router": "threat-intel", "org_id": org_id, "items": [], "count": count}
+        items = []
+    return {"router": "threat-intel", "org_id": org_id, "items": items, "count": len(items)}

tests/test_empty_endpoint_34_threat_intel_index.py

@@ -0,0 +1,62 @@
+"""Test: GET /api/v1/threat-intel/ wired to ThreatIntelCorrelator.get_active_threats"""
+import sys
+sys.path.insert(0, "/Users/devops.ai/fixops/Fixops")
+sys.path.insert(0, "/Users/devops.ai/fixops/Fixops/suite-core")
+sys.path.insert(0, "/Users/devops.ai/fixops/Fixops/suite-api")
+
+from fastapi.testclient import TestClient
+
+
+def _make_app():
+    from fastapi import FastAPI
+    from apps.api.threat_intel_router import router
+    app = FastAPI()
+    app.include_router(router)
+    return app
+
+
+def test_threat_intel_index_calls_get_active_threats():
+    from core.threat_intel_correlator import ThreatActor
+    fake_actor = ThreatActor(
+        id="actor-1", name="APT-Test", aliases=["TestGroup"],
+        ttps=["T1059"], motivation="espionage", origin_country="XX",
+        active=True, associated_campaigns=[], iocs=[],
+    )
+    app = _make_app()
+    client = TestClient(app)
+    import apps.api.threat_intel_router as mod
+    original = mod._correlator.get_active_threats
+    mod._correlator.get_active_threats = lambda org_id: [fake_actor]
+    try:
+        resp = client.get("/api/v1/threat-intel/")
+        assert resp.status_code == 200, f"Expected 200, got {resp.status_code}: {resp.text}"
+        data = resp.json()
+        assert data["count"] == 1, f"count={data['count']}"
+        assert len(data["items"]) == 1, f"items len={len(data['items'])}"
+        assert data["items"][0]["name"] == "APT-Test"
+        print("PASS: items returned from real engine, not hardcoded []")
+    finally:
+        mod._correlator.get_active_threats = original
+
+
+def test_threat_intel_index_empty_when_no_actors():
+    app = _make_app()
+    client = TestClient(app)
+    import apps.api.threat_intel_router as mod
+    original = mod._correlator.get_active_threats
+    mod._correlator.get_active_threats = lambda org_id: []
+    try:
+        resp = client.get("/api/v1/threat-intel/")
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["count"] == 0
+        assert data["items"] == []
+        print("PASS: empty items when no actors")
+    finally:
+        mod._correlator.get_active_threats = original
+
+
+if __name__ == "__main__":
+    test_threat_intel_index_calls_get_active_threats()
+    test_threat_intel_index_empty_when_no_actors()
+    print("ALL TESTS PASSED")