Add Severity Overrides to Vulnerability Report Graphql Calls

Overview

This issue aims to enhance the Vulnerability Report GraphQL by adding Severity overrides to the response. This improvement will ensure that any manually overridden severity levels are accurately reflected in various parts of the vulnerability management interface.

Current Implementation

The Vulnerability Report currently uses different data sources and GraphQL queries for various components:

1. Vulnerability Count
2. Vulnerabilities List
3. Vulnerability Details Page

Implementation Plan

1. Vulnerability Count

• Update vulnerabilitySeveritiesCount GraphQL query
  • Currently uses vulnerability_reads
  • Uses VulnerabilityReadsFinder in its resolver
• Modify VulnerabilityReadsFinder to include severity override metadata

2. Vulnerabilities List

• Update projectVulnerabilities GraphQL query
  • Currently uses VulnerabilityFragment
• Modify VulnerabilityFragment to include severity override data
• Update VulnerabilityReadsFinder to handle severity overrides for sorting
• Ensure the as_vulnerabilities method properly incorporates override data
  • This method fetches from the vulnerabilities table and overrides fields from vulnerability_reads
• Verify that rendered severity comes from the vulnerabilities table with override applied

3. Vulnerability Details Page

• Update the vulnerabilities controller to include severity override metadata
  • Currently uses vulnerable.vulnerabilities which uses the vulnerabilities table
• Modify the vulnerabilities_details Vue component to display overridden severity

Technical Considerations

• Ensure consistency between vulnerability_reads and vulnerabilities tables when dealing with severity overrides
• Update sorting logic in VulnerabilityReadsFinder to consider overridden severity values
• Implement proper error handling for cases where override data might be missing or inconsistent

Expected Outcome

After implementation, the Vulnerability Report should:

• Accurately display overridden severity levels in all relevant views (count, list, and details)
• Maintain consistency between different parts of the interface
• Provide a more accurate representation of the actual severity of vulnerabilities as determined by security teams

Testing Requirements

• Add unit tests for updated GraphQL queries and resolvers
• Implement integration tests to ensure proper data flow from backend to frontend
• Create end-to-end tests to verify the correct display of overridden severities in the UI

Documentation

• Update relevant API documentation to reflect the new severity override metadata
• Provide clear guidelines for frontend developers on how to handle and display overridden severities