feat: add filters

Signed-off-by: Umberto Sgueglia <usgueglia@contractor.linuxfoundation.org>

Author: ulemons

backend/src/api/public/v1/akrites/openapi.yaml

@@ -399,18 +399,22 @@ components:
 
     Advisory:
       type: object
-      required: [osvId, severity, resolution]
+      required: [osvId, severity, resolution, isCritical]
       properties:
         osvId:
           type: string
           example: GHSA-xxxx-xxxx-xxxx
         severity:
           type: string
-          enum: [critical, high, medium, low]
+          enum: [critical, high, moderate, low]
           nullable: true
         resolution:
           type: string
+          enum: [open, patched]
           nullable: true
+        isCritical:
+          type: boolean
+          description: True when CVSS score >= 7.0.
 
     PackageHistoryEvent:
       type: object
@@ -1000,6 +1004,30 @@ paths:
             minimum: 1
             maximum: 100
             default: 20
+        - name: severity
+          in: query
+          required: false
+          description: Filter by severity. Accepts comma-separated values or multiple params.
+          schema:
+            type: array
+            items:
+              type: string
+              enum: [critical, high, moderate, low]
+        - name: resolution
+          in: query
+          required: false
+          description: Filter by resolution status. Accepts comma-separated values or multiple params.
+          schema:
+            type: array
+            items:
+              type: string
+              enum: [open, patched]
+        - name: critical
+          in: query
+          required: false
+          description: Filter by criticality flag (CVSS >= 7.0).
+          schema:
+            type: boolean
       responses:
         '200':
           description: Paginated advisory list.

backend/src/api/public/v1/packages/getPackage.ts

@@ -74,6 +74,7 @@ export async function getPackage(req: Request, res: Response): Promise<void> {
         osvId: a.osvId,
         severity: a.severity,
         resolution: a.resolution,
+        isCritical: a.isCritical,
       })),
       cvd: {
         isPvrEnabled: null,

backend/src/api/public/v1/packages/getPackageAdvisories.ts

@@ -14,27 +14,39 @@ const DEFAULT_PAGE_SIZE = 20
 const MAX_PAGE_SIZE = 100
 
 const SEVERITY_VALUES = ['critical', 'high', 'moderate', 'low'] as const
+const RESOLUTION_VALUES = ['open', 'patched'] as const
+
+function toStringArray(v: unknown): unknown {
+  if (!v) return undefined
+  const vals = Array.isArray(v) ? v : [v]
+  return vals
+    .flatMap((s: unknown) => String(s).split(','))
+    .map((s) => s.trim())
+    .filter(Boolean)
+}
 
 const querySchema = purlQuerySchema.extend({
   page: z.coerce.number().int().min(1).default(1),
   pageSize: z.coerce.number().int().min(1).max(MAX_PAGE_SIZE).default(DEFAULT_PAGE_SIZE),
-  severity: z
-    .preprocess(
-      (v) => {
-        if (!v) return undefined
-        const vals = Array.isArray(v) ? v : [v]
-        return vals.flatMap((s: unknown) => String(s).split(','))
-      },
-      z.array(z.enum(SEVERITY_VALUES)).optional(),
-    )
+  severity: z.preprocess(toStringArray, z.array(z.enum(SEVERITY_VALUES)).optional()).optional(),
+  resolution: z.preprocess(toStringArray, z.array(z.enum(RESOLUTION_VALUES)).optional()).optional(),
+  critical: z
+    .preprocess((v) => {
+      if (v === 'true') return true
+      if (v === 'false') return false
+      return v
+    }, z.boolean().optional())
     .optional(),
 })
 
 export async function getPackageAdvisories(req: Request, res: Response): Promise<void> {
   const rawPurl = typeof req.query.purl === 'string' ? req.query.purl : ''
   const version = extractPurlVersion(rawPurl)
 
-  const { purl, page, pageSize, severity } = validateOrThrow(querySchema, req.query)
+  const { purl, page, pageSize, severity, resolution, critical } = validateOrThrow(
+    querySchema,
+    req.query,
+  )
 
   const qx = await getPackagesQx()
   const pkg = await getPackageDetailByPurl(qx, purl)
@@ -48,6 +60,8 @@ export async function getPackageAdvisories(req: Request, res: Response): Promise
     pageSize,
     version: version ?? undefined,
     severities: severity,
+    resolutions: resolution,
+    critical,
   })
 
   ok(res, {
@@ -58,6 +72,7 @@ export async function getPackageAdvisories(req: Request, res: Response): Promise
       osvId: a.osvId,
       severity: a.severity,
       resolution: a.resolution,
+      isCritical: a.isCritical,
     })),
   })
 }

services/libs/data-access-layer/src/osspckgs/api.ts

@@ -616,6 +616,7 @@ export interface AdvisoryRow {
   osvId: string
   severity: string
   resolution: 'open' | 'patched' | null
+  isCritical: boolean
 }
 
 export async function getPackageDetailByPurl(
@@ -775,13 +776,21 @@ export async function listPackagesForScatter(
 export async function getAdvisoriesByPackageId(
   qx: QueryExecutor,
   packageId: string,
-  opts?: { page: number; pageSize: number; version?: string; severities?: string[] },
+  opts?: {
+    page: number
+    pageSize: number
+    version?: string
+    severities?: string[]
+    resolutions?: ('open' | 'patched')[]
+    critical?: boolean
+  },
 ): Promise<{ rows: AdvisoryRow[]; total: number }> {
   const cte = `
     WITH advisory_data AS (
       SELECT
         a.osv_id AS "osvId",
         LOWER(a.severity) AS severity,
+        a.is_critical AS "isCritical",
         CASE
           WHEN COALESCE($(version), p.latest_version) IS NULL THEN NULL
           WHEN COUNT(ar.id) = 0 THEN NULL
@@ -803,25 +812,36 @@ export async function getAdvisoriesByPackageId(
       LEFT JOIN advisory_affected_ranges ar ON ar.advisory_package_id = ap.id
       JOIN packages p ON p.id = ap.package_id
       WHERE ap.package_id = $(packageId)::bigint
-      GROUP BY a.osv_id, a.severity, p.latest_version
+      GROUP BY a.osv_id, a.severity, a.is_critical, p.latest_version
     )
   `
 
-  const severityClause = opts?.severities?.length
-    ? `WHERE severity = ANY($(severities)::text[])`
-    : ''
+  const conditions: string[] = []
+  if (opts?.severities?.length) {
+    conditions.push('severity = ANY($(severities)::text[])')
+  }
+  if (opts?.resolutions?.length) {
+    conditions.push('resolution = ANY($(resolutions)::text[])')
+  }
+  if (opts?.critical !== undefined) {
+    conditions.push('"isCritical" = $(critical)')
+  }
+
+  const whereClause = conditions.length ? `WHERE ${conditions.join(' AND ')}` : ''
   const paginationClause = opts ? `LIMIT $(limit) OFFSET $(offset)` : ''
   const params = {
     packageId,
     version: opts?.version ?? null,
     severities: opts?.severities ?? null,
+    resolutions: opts?.resolutions ?? null,
+    critical: opts?.critical ?? null,
     limit: opts?.pageSize,
     offset: opts ? (opts.page - 1) * opts.pageSize : 0,
   }
 
   const rows = (await qx.select(
     `${cte} SELECT * FROM advisory_data
-     ${severityClause}
+     ${whereClause}
      ORDER BY
        CASE severity WHEN 'critical' THEN 1 WHEN 'high' THEN 2 WHEN 'moderate' THEN 3 WHEN 'low' THEN 4 ELSE 5 END,
        CASE resolution WHEN 'open' THEN 1 WHEN 'patched' THEN 2 ELSE 3 END,
@@ -835,7 +855,7 @@ export async function getAdvisoriesByPackageId(
   }
 
   const countResult = (await qx.selectOne(
-    `${cte} SELECT COUNT(*) AS total FROM advisory_data ${severityClause}`,
+    `${cte} SELECT COUNT(*) AS total FROM advisory_data ${whereClause}`,
     params,
   )) as { total: string }