feat: provide scores in sbom details response

[dejanb]

Fixes #952

[carlosthe19916]

@dejanb thanks for putting this PR in place.

Generally speaking this is exactly what I need so I would be happy to have this PR merged but here are some things I've just notice that we might need to address before:

• I've uploaded the files from D3 https://github.com/trustification/trustify/tree/main/etc/datasets/ds3
• Then try to hit the endpoint http://localhost:8080/api/v1/sbom/{id}/advisory and the response is huge. The one I got has 40Mb of size which I think is too much.
  • I guess the size of the response could be explained because the response includes status.vulnerability.advisories where advisories is the field that weights the most. From the top of my mind I would suggest removing status.vulnerability.advisories so the response is not that huge but I am not sure if that is fine with you.

[dejanb]

Yeah, as mentioned in the issue, I think we should actually return VulnerabilitySummary here, but that needs a bit more changes to fetch for a single vulnerability. It should be faster as well as it will not reach database to fetch unnecessary data.

[jcrossley3]

I took a swipe at it, using VulnerabilityHead instead of VulnerabilityDetails and adding a severity field.

Can you give it a shot @carlosthe19916 and see if we're any closer to what you need? Hoping to add some unit tests tomorrow.

[carlosthe19916]

@jcrossley3 Thank you very much!!!!!
This reduced the number of call drastically and I was able to generate the Dashboard using my WIP draft PR trustification/trustify-ui#232

• From the pure point of view "It Works". I think YESSS it works your changes gives me back what I need. We can call it DONE. Thanks.
• From the point of long term API:
  • If I hit /api/v1/sbom/{id}/advisory then the response is similar to:

[
    {        
        "status": [
            {
                "vulnerability": {
                    "normative": true,
                    "identifier": "CVE-2023-20860",
                    "title": null,
                    "description": null,
                    "reserved": null,
                    "published": null,
                    "modified": null,
                    "withdrawn": null,
                    "discovered": null,
                    "released": null,
                    "cwes": []
                },
                "severity": "high",
                "status": "not_affected",                
            },

You can see that the field severity is outside of the vulnerability object. However, if I hit /api/v1/vulnerability/{id} then the severity is in a field named average_severity and it is inside the object itself (a vulnerability).

{
  "title": "string", 
  "average_severity": null,
// other fields
}

I assume average and average_severity are the same in this case.

In the long term, the APIs always grow, and having a strategy for having consistency and avoiding fields to be spread in different places and with different names would be necessary for the future.

For the time being, I am happy to accept this PR as it is because it will allow me to have the Dashboard being implemented! Thank you!

[jcrossley3]

@jcrossley3 Thank you very much!!!!! This reduced the number of call drastically and I was able to generate the Dashboard using my WIP draft PR trustification/trustify-ui#232

Good to hear! 😄

You can see that the field severity is outside of the vulnerability object. However, if I hit /api/v1/vulnerability/{id} then the severity is in a field named average_severity and it is inside the object itself (a vulnerability).

I can fix that. I'll flatten all the fields and rename severity to average_severity.

For the time being, I am happy to accept this PR as it is because it will allow me to have the Dashboard being implemented! Thank you!

Part of the reason it took me so long to grok this part of the code is its lack of unit tests, so I'd like to fill some in there and clean up the code a bit. Hoping to have that in today, if that's not too long for you to wait for the merge.

[carlosthe19916]

I can wait surely. Thanks @jcrossley3 !

[jcrossley3]

@carlosthe19916 I refactored things a bit and flattened the structure per your request -- lemme know if it needs further tweaking

@dejanb I would've requested a review from you but since you originated the PR, I can't 🤷

[ctron]

Love all the improvements!

[ctron]

❤️

[dejanb]

It looks good to me. The UI is currently broken as sbom/vulnerability page still expects the old response. Maybe we should wait with merging until UI catches up? @carlosthe19916

[carlosthe19916]

@jcrossley3 Thanks, I've tested it and it works as expected. Whenever you feel it is the time let's merge this PR.