Vulnerability returns none without license

• Please check this box if this contribution uses AI-generated content (including content generated by GitLab Duo features) as outlined in the GitLab DCO & CLA. As a benefit of being a GitLab Community Contributor, you receive complimentary access to GitLab Duo.

What does this MR do and why?

Reopening the MR: !140290 (closed)

As described by @mallocke in the above MR,

This change modifies Resolvers::VulnerabilitiesResolver to short circuit with an empty result if the :security_dashboard feature is unavailable.

This fixes an edge case where GQL endpoint returns hasNextPage: true in the pagination data, but returns an empty result set.

This can occur on a project that previously had this licensed feature available, and has vulnerabilities, but the licensed feature is now turned off. This happens because the resolver loads the vulnerabilities, but they are all subsequently redacted. The check for hasNextPage happens independently of the redaction.

This MR resolves the bug #433513 (closed)

How to set up and validate locally

1. Create several vulnerabilities in a project. Validate these vulnerabilities exist using the following query:

{
  project(fullPath: "gitlab-org/gitlab-test") {
    name
    vulnerabilities(first: 3) {
      nodes {
        id
        title
      }
      pageInfo {
        endCursor
        hasNextPage
      }
    }
  }
}

This should return:

{
  "data": {
    "project": {
      "name": "Gitlab Test",
      "vulnerabilities": {
        "nodes": [
          {
            "id": "gid://gitlab/Vulnerability/547",
            "title": "testtest"
          },
          {
            "id": "gid://gitlab/Vulnerability/541",
            "title": "test"
          },
          {
            "id": "gid://gitlab/Vulnerability/546",
            "title": "ECB mode is insecure"
          }
        ],
        "pageInfo": {
          "endCursor": "eyJzZXZlcml0eSI6Im1lZGl1bSIsInZ1bG5lcmFiaWxpdHlfaWQiOiI1NDYifQ",
          "hasNextPage": true
        }
      }
    }
  },
  "extensions": {
    "disabled_filters": []
  },
  "correlationId": "01JR8ZBE4H6516GYV6RSMWBPZC"
}

2. Simulate missing license by adding the following line in ee/app/models/license.rb:

    def feature_available?(feature)
      # Include features available per plan + usage ping features if Usage Pings is enabled
      # as instance setting.
+      return false if feature == :security_dashboard
+ 
      !!current&.feature_available?(feature) ||
        GitlabSubscriptions::Features.usage_ping_feature?(feature)
    end

3. On the master branch, run the above query once again. This will return the following — notice "hasNextPage" is set to true.

{
  "data": {
    "project": {
      "name": "Gitlab Test",
      "vulnerabilities": {
        "nodes": [],
        "pageInfo": {
          "endCursor": null,
          "hasNextPage": true
        }
      }
    }
  },
  "extensions": {
    "disabled_filters": []
  },
  "correlationId": "01JR8ZR2YRKDY08DW1RZ28VMEN"
}

4. Switch to this branch, and run the above query once again. This fixes the issue, returning "hasNextPage" set to false.

{
  "data": {
    "project": {
      "name": "Gitlab Test",
      "vulnerabilities": {
        "nodes": [],
        "pageInfo": {
          "endCursor": null,
          "hasNextPage": false
        }
      }
    }
  },
  "correlationId": "01JR8ZYEQXN2MCMN32TJE6CK7N"
}

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #433513 (closed)