feat(findings): group findings and add deepen workflows

2026-08-24 19:29:24 +08:00
1 parent 31dc9e7446
commit 27dc6d8bad
@@ -3,13 +3,15 @@ package db
 import (
 	"database/sql"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"strconv"
 	"strings"
 	"time"
 )

-// DBFinding is a row in the standalone findings table (persists across task deletion).
+// DBFinding is a row in the standalone findings table. It persists across task
+// deletion unless the caller explicitly requests related finding cleanup.
 type DBFinding struct {
 	ID              int64
 	TaskID          *int64
@@ -146,6 +148,11 @@ type FindingFilter struct {
 	Sort      string // "severity" | "time"
 }

+// FindingUnassignedTask is the task filter sentinel for findings whose task is
+// absent. That includes rows created without a task and rows retained after their
+// originating task was deleted (the findings FK is ON DELETE SET NULL).
+const FindingUnassignedTask = "__unassigned__"
+
 // where builds the WHERE clause (shared by the page and count queries) plus its
 // positional args. Only equality filters, all parameterized.
 func (f FindingFilter) where() (string, []any) {
@@ -162,7 +169,9 @@ func (f FindingFilter) where() (string, []any) {
 	add("status", f.Status)
 	add("vulnclass", f.VulnClass)
 	// task_id 是 bigint 列,按整数比较(不能走上面的文本 add);空/非法值忽略。
-	if tid, err := strconv.ParseInt(f.TaskID, 10, 64); err == nil && tid > 0 {
+	if f.TaskID == FindingUnassignedTask {
+		conds = append(conds, "(f.task_id IS NULL OR t.id IS NULL)")
+	} else if tid, err := strconv.ParseInt(f.TaskID, 10, 64); err == nil && tid > 0 {
 		args = append(args, tid)
 		conds = append(conds, fmt.Sprintf("f.task_id = $%d", len(args)))
 	}
@@ -184,14 +193,19 @@ func (d *DB) ListFindingsPage(f FindingFilter, page, pageSize int) ([]*DBFinding
 	where, args := f.where()

 	var total int
-	if err := d.QueryRow(`SELECT COUNT(*) FROM findings f`+where, args...).Scan(&total); err != nil {
+	if err := d.QueryRow(`SELECT COUNT(*) FROM findings f LEFT JOIN tasks t ON f.task_id=t.id`+where, args...).Scan(&total); err != nil {
 		return nil, 0, err
 	}
+	// Avoid overflowing (page-1)*pageSize for an arbitrarily large page number.
+	// Once the requested page is beyond the exact count, no data query is needed.
+	if total == 0 || page > (total-1)/pageSize+1 {
+		return []*DBFinding{}, total, nil
+	}

-	order := "f.created_at DESC"
+	order := "f.created_at DESC, f.id DESC"
 	if f.Sort == "severity" {
 		// critical > high > medium > low > 其它, then newest first.
-		order = `CASE f.severity WHEN 'critical' THEN 4 WHEN 'high' THEN 3 WHEN 'medium' THEN 2 WHEN 'low' THEN 1 ELSE 0 END DESC, f.created_at DESC`
+		order = `CASE f.severity WHEN 'critical' THEN 4 WHEN 'high' THEN 3 WHEN 'medium' THEN 2 WHEN 'low' THEN 1 ELSE 0 END DESC, f.created_at DESC, f.id DESC`
 	}
 	pageArgs := append(append([]any{}, args...), pageSize, (page-1)*pageSize)
 	q := fmt.Sprintf(`
@@ -209,8 +223,6 @@ func (d *DB) ListFindingsPage(f FindingFilter, page, pageSize int) ([]*DBFinding
 	return out, total, err
 }

-<<<<<<< Updated upstream
-=======
 // FindingGroup is one task-level bucket in the global findings view. TaskID is
 // nil for both findings that never had a task and findings retained after task
 // deletion; those records intentionally share one "unassigned/deleted" bucket.
@@ -446,7 +458,6 @@ func (d *DB) ListFindingsForExport(f FindingFilter, ids []int64) ([]*DBFinding,
 	return out, rows.Err()
 }

->>>>>>> Stashed changes
 // FindingStats is the whole-table aggregate powering the 发现 page's stat cards
 // and vuln-class filter — computed server-side so it stays exact regardless of
 // pagination.
@@ -547,6 +558,38 @@ func (d *DB) GetFinding(id int64) (*DBFinding, error) {
 	return f, nil
 }

+// DeleteFinding removes a finding entirely: the standalone findings row and its
+// originating exploration node (kind='finding'), so it disappears from the findings
+// list, the per-task 发现 Tab, and the exploration graph alike. Deleting the node
+// cascades its edges + node_assets and nulls any activity referencing it. Returns
+// rows affected (0 = no finding with that id).
+func (d *DB) DeleteFinding(id int64) (int64, error) {
+	var nodeID *int64
+	err := d.QueryRow(`DELETE FROM findings WHERE id=$1 RETURNING node_id`, id).Scan(&nodeID)
+	if err == sql.ErrNoRows {
+		return 0, nil
+	}
+	if err != nil {
+		return 0, err
+	}
+	if nodeID != nil {
+		// best-effort: the finding is already gone; a stray node must not fail the op.
+		_, _ = d.Exec(`DELETE FROM exploration_nodes WHERE id=$1 AND kind='finding'`, *nodeID)
+	}
+	return 1, nil
+}
+
+// DeleteFindingsByTask removes all findings rows of a task. The originating
+// exploration finding nodes are cascade-deleted separately when the task's
+// exploration subgraph is dropped. Returns rows deleted.
+func (d *DB) DeleteFindingsByTask(taskID int64) (int64, error) {
+	res, err := d.Exec(`DELETE FROM findings WHERE task_id=$1`, taskID)
+	if err != nil {
+		return 0, err
+	}
+	return res.RowsAffected()
+}
+
 // SetFindingStatus updates one finding's triage state. Returns rows affected.
 func (d *DB) SetFindingStatus(id int64, status string) (int64, error) {
 	res, err := d.Exec(`UPDATE findings SET status=$1 WHERE id=$2`, status, id)
@@ -1,10 +1,62 @@
 package db

 import (
+	"encoding/json"
+	"errors"
+	"fmt"
 	"slices"
 	"testing"
+	"time"
 )

+// TestDeleteFinding verifies删除漏洞 removes both the findings row and its
+// originating exploration node (kind='finding').
+func TestDeleteFinding(t *testing.T) {
+	d, err := Open(testDSN(t))
+	if err != nil {
+		t.Skipf("postgres unavailable (%v) — skipping", err)
+	}
+	defer d.Close()
+
+	tk, err := d.CreateTask("删除漏洞测试", "目标", nil, 0, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer d.DeleteTask(tk.ID)
+
+	// seed a finding node in the task's exploration graph, then a findings row on it
+	es := d.Exploration(tk.ExplorationID)
+	nodeID, err := es.AddNode(KindFinding, map[string]any{"summary": "x", "severity": "high"}, 5, "confirmed", "worker", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	fid, err := d.AddFinding(tk.ID, nodeID, "XSS", "反射型 XSS", "high", "summary", "poc", "worker", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	n, err := d.DeleteFinding(fid)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n != 1 {
+		t.Fatalf("DeleteFinding rows: want 1, got %d", n)
+	}
+	if f, _ := d.GetFinding(fid); f != nil {
+		t.Fatalf("finding row should be gone, got %+v", f)
+	}
+	var cnt int
+	d.QueryRow(`SELECT count(*) FROM exploration_nodes WHERE id=$1`, nodeID).Scan(&cnt)
+	if cnt != 0 {
+		t.Fatalf("originating finding node should be deleted, still %d", cnt)
+	}
+
+	// deleting a non-existent finding is a no-op (0 rows), not an error
+	if n, err := d.DeleteFinding(fid); err != nil || n != 0 {
+		t.Fatalf("re-delete: want (0,nil), got (%d,%v)", n, err)
+	}
+}
+
 // TestFindingsPageAndStats exercises ListFindingsPage (filter/sort/paging) and
 // FindingStats against the live dev PG. It tags its rows with a unique vulnclass
 // so assertions are isolated from any pre-existing data, and cleans up after.
@@ -135,3 +187,297 @@ func TestFindingsPageAndStats(t *testing.T) {
 		t.Fatalf("SetFindingSeverity(-1): want 0,nil got %d,%v", n, err)
 	}
 }
+
+func TestListFindingsPageUsesStableIDTieBreaker(t *testing.T) {
+	d, err := Open(testDSN(t))
+	if err != nil {
+		t.Skipf("postgres unavailable (%v) — skipping", err)
+	}
+	defer d.Close()
+
+	vc := fmt.Sprintf("__test_finding_stable_page_%d__", time.Now().UnixNano())
+	defer d.Exec(`DELETE FROM findings WHERE vulnclass=$1`, vc)
+	ids := make([]int64, 0, 7)
+	for i := 0; i < 7; i++ {
+		id, addErr := d.AddFinding(0, 0, vc, "", SeverityHigh, fmt.Sprintf("finding %d", i), "", "test", nil)
+		if addErr != nil {
+			t.Fatalf("AddFinding[%d]: %v", i, addErr)
+		}
+		ids = append(ids, id)
+	}
+	sharedCreatedAt := time.Date(2026, time.August, 21, 8, 30, 0, 0, time.UTC)
+	if _, err := d.Exec(`UPDATE findings SET created_at=$1 WHERE vulnclass=$2`, sharedCreatedAt, vc); err != nil {
+		t.Fatal(err)
+	}
+
+	want := make([]int64, len(ids))
+	for i := range ids {
+		want[i] = ids[len(ids)-1-i]
+	}
+	for _, sort := range []string{"time", "severity"} {
+		t.Run(sort, func(t *testing.T) {
+			var got []int64
+			for page := 1; page <= 3; page++ {
+				items, total, pageErr := d.ListFindingsPage(FindingFilter{VulnClass: vc, Sort: sort}, page, 3)
+				if pageErr != nil {
+					t.Fatal(pageErr)
+				}
+				if total != len(ids) {
+					t.Fatalf("page %d total=%d, want %d", page, total, len(ids))
+				}
+				for _, item := range items {
+					got = append(got, item.ID)
+				}
+			}
+			if !slices.Equal(got, want) {
+				t.Fatalf("same-timestamp pagination was unstable: got=%v want=%v", got, want)
+			}
+		})
+	}
+}
+
+func TestFindingGroupsAndUnassignedPaging(t *testing.T) {
+	d, err := Open(testDSN(t))
+	if err != nil {
+		t.Skipf("postgres unavailable (%v) — skipping", err)
+	}
+	defer d.Close()
+
+	vc := fmt.Sprintf("__test_finding_groups_%d__", time.Now().UnixNano())
+	cleanupFindings := func() { _, _ = d.Exec(`DELETE FROM findings WHERE vulnclass=$1`, vc) }
+	defer cleanupFindings()
+
+	taskA, err := d.CreateTask("group A", "goal", nil, 0, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer d.DeleteTask(taskA.ID)
+	taskB, err := d.CreateTask("group B", "goal", nil, 0, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer d.DeleteTask(taskB.ID)
+
+	seed := []struct {
+		taskID   int64
+		severity string
+		status   string
+	}{
+		{taskA.ID, SeverityCritical, FindingPending},
+		{taskA.ID, SeverityHigh, FindingResolved},
+		{taskB.ID, SeverityLow, FindingPending},
+		{0, SeverityMedium, FindingPending},
+	}
+	for i, item := range seed {
+		id, addErr := d.AddFinding(item.taskID, 0, vc, "", item.severity, fmt.Sprintf("summary %d", i), "", "test", nil)
+		if addErr != nil {
+			t.Fatalf("AddFinding[%d]: %v", i, addErr)
+		}
+		if _, setErr := d.SetFindingStatus(id, item.status); setErr != nil {
+			t.Fatalf("SetFindingStatus[%d]: %v", i, setErr)
+		}
+	}
+	// Retained findings from deleted tasks join the same bucket as findings that
+	// were created without any task.
+	if err := d.DeleteTask(taskB.ID); err != nil {
+		t.Fatal(err)
+	}
+
+	page, groupTotal, findingTotal, err := d.ListFindingGroups(FindingFilter{VulnClass: vc, Sort: "severity"}, 1, 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(page) != 1 || groupTotal != 2 || findingTotal != 4 {
+		t.Fatalf("page totals: items=%d groups=%d findings=%d", len(page), groupTotal, findingTotal)
+	}
+	groups, _, _, err := d.ListFindingGroups(FindingFilter{VulnClass: vc}, 1, 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var live, unassigned *FindingGroup
+	for i := range groups {
+		if groups[i].TaskID == nil {
+			unassigned = &groups[i]
+		} else if *groups[i].TaskID == taskA.ID {
+			live = &groups[i]
+		}
+	}
+	if live == nil || live.Count != 2 || live.Critical != 1 || live.High != 1 || live.TaskDescription != "group A" {
+		t.Fatalf("live group mismatch: %+v", live)
+	}
+	if unassigned == nil || unassigned.Count != 2 || unassigned.Medium != 1 || unassigned.Low != 1 {
+		t.Fatalf("unassigned group mismatch: %+v", unassigned)
+	}
+	groupForTask := func(items []FindingGroup, taskID int64) *FindingGroup {
+		for i := range items {
+			if items[i].TaskID != nil && *items[i].TaskID == taskID {
+				return &items[i]
+			}
+		}
+		return nil
+	}
+	if err := d.SetPaused(taskA.ID, true); err != nil {
+		t.Fatal(err)
+	}
+	groups, _, _, err = d.ListFindingGroups(FindingFilter{VulnClass: vc}, 1, 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if group := groupForTask(groups, taskA.ID); group == nil || group.TaskStatus != "paused" {
+		t.Fatalf("paused task group status mismatch: %+v", groups)
+	}
+	if err := d.SetPaused(taskA.ID, false); err != nil {
+		t.Fatal(err)
+	}
+	if err := d.Enqueue(taskA.ID, "resume"); err != nil {
+		t.Fatal(err)
+	}
+	groups, _, _, err = d.ListFindingGroups(FindingFilter{VulnClass: vc}, 1, 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if group := groupForTask(groups, taskA.ID); group == nil || group.TaskStatus != "queued" {
+		t.Fatalf("queued task group status mismatch: %+v", groups)
+	}
+	if err := d.SetStatus(taskA.ID, "done"); err != nil {
+		t.Fatal(err)
+	}
+	groups, _, _, err = d.ListFindingGroups(FindingFilter{VulnClass: vc}, 1, 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if group := groupForTask(groups, taskA.ID); group == nil || group.TaskStatus != "done" {
+		t.Fatalf("terminal task status must win over queued flag: %+v", groups)
+	}
+
+	orphans, total, err := d.ListFindingsPage(FindingFilter{VulnClass: vc, TaskID: FindingUnassignedTask}, 1, 10)
+	if err != nil || total != 2 || len(orphans) != 2 {
+		t.Fatalf("unassigned page: len=%d total=%d err=%v", len(orphans), total, err)
+	}
+	maxPage := int(^uint(0) >> 1)
+	farFindings, farTotal, err := d.ListFindingsPage(FindingFilter{VulnClass: vc}, maxPage, 200)
+	if err != nil || farTotal != len(seed) || len(farFindings) != 0 {
+		t.Fatalf("far finding page: len=%d total=%d err=%v", len(farFindings), farTotal, err)
+	}
+	farGroups, farGroupTotal, farFindingTotal, err := d.ListFindingGroups(FindingFilter{VulnClass: vc}, maxPage, 100)
+	if err != nil || farGroupTotal != 2 || farFindingTotal != len(seed) || len(farGroups) != 0 {
+		t.Fatalf("far group page: len=%d groups=%d findings=%d err=%v",
+			len(farGroups), farGroupTotal, farFindingTotal, err)
+	}
+	filtered, filteredGroups, filteredFindings, err := d.ListFindingGroups(
+		FindingFilter{VulnClass: vc, Status: FindingResolved}, 1, 10,
+	)
+	if err != nil || filteredGroups != 1 || filteredFindings != 1 || len(filtered) != 1 || filtered[0].High != 1 {
+		t.Fatalf("filtered groups: %+v groups=%d findings=%d err=%v", filtered, filteredGroups, filteredFindings, err)
+	}
+}
+
+func TestAddFindingFollowUpIntent(t *testing.T) {
+	d, err := Open(testDSN(t))
+	if err != nil {
+		t.Skipf("postgres unavailable (%v) — skipping", err)
+	}
+	defer d.Close()
+
+	task, err := d.CreateTask("finding follow-up", "goal", nil, 0, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer d.DeleteTask(task.ID)
+	assetID, err := d.Assets().UpsertRootDomain(UpsertRootDomainReq{
+		Domain: fmt.Sprintf("follow-up-%d.example.test", time.Now().UnixNano()),
+		TaskID: task.ID,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer d.Exec(`DELETE FROM assets WHERE id=$1`, assetID)
+
+	store := d.Exploration(task.ExplorationID)
+	findingNodeID, err := store.AddNode(KindFinding, map[string]any{"summary": "source"}, 5, "confirmed", "worker", []int64{assetID})
+	if err != nil {
+		t.Fatal(err)
+	}
+	findingID, err := d.AddFinding(task.ID, findingNodeID, "test", "source", SeverityHigh, "source", "", "worker", []int64{assetID})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	auditInput := Activity{Worker: "system", Kind: "text", Summary: "人工提交漏洞深入利用意图", Detail: "验证可利用性并形成证据链"}
+	intentID, audit, err := store.AddFindingFollowUpIntent(findingID, findingNodeID, "验证可利用性并形成证据链", auditInput)
+	if err != nil {
+		t.Fatal(err)
+	}
+	secondID, _, err := store.AddFindingFollowUpIntent(findingID, findingNodeID, "从另一条路径深入", Activity{
+		Worker: "system", Kind: "text", Summary: "人工提交漏洞深入利用意图", Detail: "从另一条路径深入",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if secondID == intentID {
+		t.Fatal("repeated follow-up submissions must create distinct intents")
+	}
+	expectedAuditSummary := fmt.Sprintf("%s #%d", auditInput.Summary, intentID)
+	if audit.ID <= 0 || audit.NodeID == nil || *audit.NodeID != intentID || audit.CreatedAt.IsZero() || audit.Summary != expectedAuditSummary {
+		t.Fatalf("persisted audit mismatch: %+v", audit)
+	}
+	node, err := store.GetNode(intentID)
+	if err != nil || node == nil {
+		t.Fatalf("GetNode: node=%+v err=%v", node, err)
+	}
+	if node.Kind != KindIntent || node.Priority != 10 || node.State != "open" || node.Origin != "human" {
+		t.Fatalf("follow-up intent metadata: %+v", node)
+	}
+	var anchorCount, edgeCount int
+	if err := d.QueryRow(`SELECT COUNT(*) FROM exploration_anchors WHERE node_id=$1 AND asset_id=$2`, intentID, assetID).Scan(&anchorCount); err != nil {
+		t.Fatal(err)
+	}
+	if err := d.QueryRow(`SELECT COUNT(*) FROM exploration_edges
+		WHERE exploration_id=$1 AND src_id=$2 AND rel=$3 AND dst_id=$4`,
+		task.ExplorationID, findingNodeID, RelDerivedFrom, intentID).Scan(&edgeCount); err != nil {
+		t.Fatal(err)
+	}
+	if anchorCount != 1 || edgeCount != 1 {
+		t.Fatalf("follow-up lineage: anchors=%d edges=%d", anchorCount, edgeCount)
+	}
+	var persistedAuditCount int
+	if err := d.QueryRow(`SELECT COUNT(*) FROM activity
+		WHERE id=$1 AND exploration_id=$2 AND node_id=$3 AND worker='system' AND summary=$4`,
+		audit.ID, task.ExplorationID, intentID, expectedAuditSummary).Scan(&persistedAuditCount); err != nil {
+		t.Fatal(err)
+	}
+	if persistedAuditCount != 1 {
+		t.Fatalf("atomic audit count=%d, want 1", persistedAuditCount)
+	}
+
+	var nodesBefore, activitiesBefore int
+	if err := d.QueryRow(`SELECT COUNT(*) FROM exploration_nodes WHERE exploration_id=$1`, task.ExplorationID).Scan(&nodesBefore); err != nil {
+		t.Fatal(err)
+	}
+	if err := d.QueryRow(`SELECT COUNT(*) FROM activity WHERE exploration_id=$1`, task.ExplorationID).Scan(&activitiesBefore); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := store.AddFindingFollowUpIntent(findingID, findingNodeID, "must roll back", Activity{
+		Worker: "system", Kind: "text", Summary: "invalid audit", Metadata: json.RawMessage(`{`),
+	}); err == nil {
+		t.Fatal("invalid activity metadata should fail the transaction")
+	}
+	var nodesAfter, activitiesAfter int
+	if err := d.QueryRow(`SELECT COUNT(*) FROM exploration_nodes WHERE exploration_id=$1`, task.ExplorationID).Scan(&nodesAfter); err != nil {
+		t.Fatal(err)
+	}
+	if err := d.QueryRow(`SELECT COUNT(*) FROM activity WHERE exploration_id=$1`, task.ExplorationID).Scan(&activitiesAfter); err != nil {
+		t.Fatal(err)
+	}
+	if nodesAfter != nodesBefore || activitiesAfter != activitiesBefore {
+		t.Fatalf("activity failure did not roll back graph: nodes %d->%d activities %d->%d",
+			nodesBefore, nodesAfter, activitiesBefore, activitiesAfter)
+	}
+
+	if _, err := d.Exec(`DELETE FROM exploration_nodes WHERE id=$1`, findingNodeID); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := store.AddFindingFollowUpIntent(findingID, findingNodeID, "should fail", auditInput); !errors.Is(err, ErrFindingOriginUnavailable) {
+		t.Fatalf("missing source node: want ErrFindingOriginUnavailable, got %v", err)
+	}
+}