fix: filter by criticality and version

Signed-off-by: Umberto Sgueglia <usgueglia@contractor.linuxfoundation.org>

Author: ulemons

backend/src/api/public/v1/packages/getPackageAdvisories.ts

@@ -8,18 +8,33 @@ import { getPackagesQx } from '@/db/packagesDb'
 import { ok } from '@/utils/api'
 import { validateOrThrow } from '@/utils/validation'
 
-import { purlQuerySchema } from './purl'
+import { extractPurlVersion, purlQuerySchema } from './purl'
 
 const DEFAULT_PAGE_SIZE = 20
 const MAX_PAGE_SIZE = 100
 
+const SEVERITY_VALUES = ['critical', 'high', 'moderate', 'low'] as const
+
 const querySchema = purlQuerySchema.extend({
   page: z.coerce.number().int().min(1).default(1),
   pageSize: z.coerce.number().int().min(1).max(MAX_PAGE_SIZE).default(DEFAULT_PAGE_SIZE),
+  severity: z
+    .preprocess(
+      (v) => {
+        if (!v) return undefined
+        const vals = Array.isArray(v) ? v : [v]
+        return vals.flatMap((s: unknown) => String(s).split(','))
+      },
+      z.array(z.enum(SEVERITY_VALUES)).optional(),
+    )
+    .optional(),
 })
 
 export async function getPackageAdvisories(req: Request, res: Response): Promise<void> {
-  const { purl, page, pageSize } = validateOrThrow(querySchema, req.query)
+  const rawPurl = typeof req.query.purl === 'string' ? req.query.purl : ''
+  const version = extractPurlVersion(rawPurl)
+
+  const { purl, page, pageSize, severity } = validateOrThrow(querySchema, req.query)
 
   const qx = await getPackagesQx()
   const pkg = await getPackageDetailByPurl(qx, purl)
@@ -28,7 +43,12 @@ export async function getPackageAdvisories(req: Request, res: Response): Promise
     throw new NotFoundError()
   }
 
-  const { rows, total } = await getAdvisoriesByPackageId(qx, pkg.id, { page, pageSize })
+  const { rows, total } = await getAdvisoriesByPackageId(qx, pkg.id, {
+    page,
+    pageSize,
+    version: version ?? undefined,
+    severities: severity,
+  })
 
   ok(res, {
     page,

backend/src/api/public/v1/packages/purl.ts

@@ -21,6 +21,12 @@ export function normalizePurl(purl: string): string {
   return withoutVersion.replace(/@/g, '%40')
 }
 
+export function extractPurlVersion(purl: string): string | null {
+  const withoutQualifiers = purl.replace(/[?#].*$/, '')
+  const match = withoutQualifiers.match(/@([^/@]+)$/)
+  return match ? match[1] : null
+}
+
 export const purlFieldSchema = z
   .string()
   .trim()

services/libs/data-access-layer/src/osspckgs/api.ts

@@ -775,24 +775,24 @@ export async function listPackagesForScatter(
 export async function getAdvisoriesByPackageId(
   qx: QueryExecutor,
   packageId: string,
-  opts?: { page: number; pageSize: number },
+  opts?: { page: number; pageSize: number; version?: string; severities?: string[] },
 ): Promise<{ rows: AdvisoryRow[]; total: number }> {
   const cte = `
     WITH advisory_data AS (
       SELECT
         a.osv_id AS "osvId",
         LOWER(a.severity) AS severity,
         CASE
-          WHEN p.latest_version IS NULL THEN NULL
+          WHEN COALESCE($(version), p.latest_version) IS NULL THEN NULL
           WHEN COUNT(ar.id) = 0 THEN NULL
           -- TODO: text comparison is lexicographic, not semver — '1.9.0' >= '1.10.0' is TRUE here.
           -- Replace with a proper semver comparison function when one is available in the DB.
           WHEN BOOL_AND(
             CASE
               WHEN ar.fixed_version IS NULL AND ar.last_affected IS NULL THEN FALSE
-              WHEN ar.fixed_version IS NOT NULL AND p.latest_version >= ar.fixed_version THEN TRUE
+              WHEN ar.fixed_version IS NOT NULL AND COALESCE($(version), p.latest_version) >= ar.fixed_version THEN TRUE
               WHEN ar.fixed_version IS NOT NULL THEN FALSE
-              WHEN ar.last_affected IS NOT NULL AND p.latest_version > ar.last_affected THEN TRUE
+              WHEN ar.last_affected IS NOT NULL AND COALESCE($(version), p.latest_version) > ar.last_affected THEN TRUE
               ELSE FALSE
             END
           ) THEN 'patched'
@@ -807,25 +807,37 @@ export async function getAdvisoriesByPackageId(
     )
   `
 
+  const severityClause = opts?.severities?.length
+    ? `WHERE severity = ANY($(severities)::text[])`
+    : ''
   const paginationClause = opts ? `LIMIT $(limit) OFFSET $(offset)` : ''
+  const params = {
+    packageId,
+    version: opts?.version ?? null,
+    severities: opts?.severities ?? null,
+    limit: opts?.pageSize,
+    offset: opts ? (opts.page - 1) * opts.pageSize : 0,
+  }
 
   const rows = (await qx.select(
     `${cte} SELECT * FROM advisory_data
+     ${severityClause}
      ORDER BY
        CASE severity WHEN 'critical' THEN 1 WHEN 'high' THEN 2 WHEN 'moderate' THEN 3 WHEN 'low' THEN 4 ELSE 5 END,
        CASE resolution WHEN 'open' THEN 1 WHEN 'patched' THEN 2 ELSE 3 END,
        "osvId"
      ${paginationClause}`,
-    { packageId, limit: opts?.pageSize, offset: opts ? (opts.page - 1) * opts.pageSize : 0 },
+    params,
   )) as AdvisoryRow[]
 
   if (!opts) {
     return { rows, total: rows.length }
   }
 
-  const countResult = (await qx.selectOne(`${cte} SELECT COUNT(*) AS total FROM advisory_data`, {
-    packageId,
-  })) as { total: string }
+  const countResult = (await qx.selectOne(
+    `${cte} SELECT COUNT(*) AS total FROM advisory_data ${severityClause}`,
+    params,
+  )) as { total: string }
 
   return { rows, total: Number(countResult.total) }
 }