feat(monitor/collectors/cve): cve_events repository with EPSS-only patch
This commit is contained in:
CarterPerez-dev
parent
ee358e38f1
commit
2a61953cb9
|
|
@ -0,0 +1,84 @@
|
|||
// ©AngelaMos | 2026
|
||||
// repo.go
|
||||
|
||||
package cve
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"time"
|
||||
|
||||
"github.com/jmoiron/sqlx"
|
||||
)
|
||||
|
||||
type Row struct {
|
||||
CveID string `db:"cve_id"`
|
||||
Published time.Time `db:"published"`
|
||||
LastModified time.Time `db:"last_modified"`
|
||||
Severity string `db:"severity"`
|
||||
CVSS float64 `db:"cvss_score"`
|
||||
EPSSScore *float64 `db:"epss_score"`
|
||||
EPSSPercentile *float64 `db:"epss_percentile"`
|
||||
InKEV bool `db:"in_kev"`
|
||||
Payload json.RawMessage `db:"payload"`
|
||||
}
|
||||
|
||||
type Repo struct {
|
||||
db *sqlx.DB
|
||||
}
|
||||
|
||||
func NewRepo(db *sqlx.DB) *Repo { return &Repo{db: db} }
|
||||
|
||||
func (r *Repo) Upsert(ctx context.Context, row Row) error {
|
||||
_, err := r.db.ExecContext(ctx, `
|
||||
INSERT INTO cve_events (cve_id, published, last_modified, severity, cvss_score, payload)
|
||||
VALUES ($1, $2, $3, $4, $5, $6)
|
||||
ON CONFLICT (cve_id) DO UPDATE SET
|
||||
last_modified = EXCLUDED.last_modified,
|
||||
severity = EXCLUDED.severity,
|
||||
cvss_score = EXCLUDED.cvss_score,
|
||||
payload = EXCLUDED.payload`,
|
||||
row.CveID, row.Published, row.LastModified, row.Severity, row.CVSS, []byte(row.Payload),
|
||||
)
|
||||
if err != nil {
|
||||
return fmt.Errorf("upsert cve %s: %w", row.CveID, err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (r *Repo) UpdateEPSS(ctx context.Context, cveID string, score, percentile float64) error {
|
||||
_, err := r.db.ExecContext(ctx,
|
||||
`UPDATE cve_events SET epss_score = $2, epss_percentile = $3 WHERE cve_id = $1`,
|
||||
cveID, score, percentile,
|
||||
)
|
||||
if err != nil {
|
||||
return fmt.Errorf("update epss %s: %w", cveID, err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (r *Repo) Get(ctx context.Context, cveID string) (Row, error) {
|
||||
var row Row
|
||||
err := r.db.GetContext(ctx, &row, `
|
||||
SELECT cve_id, published, last_modified, severity, cvss_score,
|
||||
epss_score, epss_percentile, in_kev, payload
|
||||
FROM cve_events WHERE cve_id = $1`, cveID)
|
||||
if err != nil {
|
||||
return Row{}, fmt.Errorf("get cve %s: %w", cveID, err)
|
||||
}
|
||||
return row, nil
|
||||
}
|
||||
|
||||
func (r *Repo) RecentByLastModified(ctx context.Context, limit int) ([]Row, error) {
|
||||
var rows []Row
|
||||
err := r.db.SelectContext(ctx, &rows, `
|
||||
SELECT cve_id, published, last_modified, severity, cvss_score,
|
||||
epss_score, epss_percentile, in_kev, payload
|
||||
FROM cve_events
|
||||
ORDER BY last_modified DESC LIMIT $1`, limit)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("recent cves: %w", err)
|
||||
}
|
||||
return rows, nil
|
||||
}
|
||||
|
|
@ -0,0 +1,135 @@
|
|||
// ©AngelaMos | 2026
|
||||
// repo_test.go
|
||||
|
||||
package cve_test
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
_ "github.com/jackc/pgx/v5/stdlib"
|
||||
"github.com/jmoiron/sqlx"
|
||||
"github.com/stretchr/testify/require"
|
||||
"github.com/testcontainers/testcontainers-go/modules/postgres"
|
||||
|
||||
"github.com/carterperez-dev/monitor-the-situation/backend/internal/collectors/cve"
|
||||
)
|
||||
|
||||
func setupDB(t *testing.T) *sqlx.DB {
|
||||
t.Helper()
|
||||
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 90*time.Second)
|
||||
defer cancel()
|
||||
|
||||
pg, err := postgres.Run(ctx, "postgres:17-alpine",
|
||||
postgres.WithDatabase("monitor"),
|
||||
postgres.WithUsername("monitor"),
|
||||
postgres.WithPassword("monitor"),
|
||||
postgres.BasicWaitStrategies(),
|
||||
)
|
||||
require.NoError(t, err)
|
||||
t.Cleanup(func() { _ = pg.Terminate(context.Background()) })
|
||||
|
||||
dsn, err := pg.ConnectionString(ctx, "sslmode=disable")
|
||||
require.NoError(t, err)
|
||||
|
||||
db, err := sqlx.ConnectContext(ctx, "pgx", dsn)
|
||||
require.NoError(t, err)
|
||||
t.Cleanup(func() { _ = db.Close() })
|
||||
|
||||
_, err = db.ExecContext(ctx, `
|
||||
CREATE TABLE cve_events (
|
||||
cve_id text PRIMARY KEY,
|
||||
published timestamptz,
|
||||
last_modified timestamptz NOT NULL,
|
||||
severity text NOT NULL DEFAULT '',
|
||||
cvss_score numeric(3,1) NOT NULL DEFAULT 0,
|
||||
epss_score numeric(5,4),
|
||||
epss_percentile numeric(5,4),
|
||||
in_kev boolean NOT NULL DEFAULT false,
|
||||
payload jsonb NOT NULL
|
||||
)`)
|
||||
require.NoError(t, err)
|
||||
return db
|
||||
}
|
||||
|
||||
func TestRepo_UpsertThenEPSSUpdate(t *testing.T) {
|
||||
db := setupDB(t)
|
||||
repo := cve.NewRepo(db)
|
||||
ctx := context.Background()
|
||||
|
||||
row := cve.Row{
|
||||
CveID: "CVE-2026-0001",
|
||||
Published: time.Now().UTC().Add(-time.Hour),
|
||||
LastModified: time.Now().UTC(),
|
||||
Severity: "CRITICAL",
|
||||
CVSS: 9.8,
|
||||
Payload: json.RawMessage(`{"id":"CVE-2026-0001"}`),
|
||||
}
|
||||
require.NoError(t, repo.Upsert(ctx, row))
|
||||
|
||||
require.NoError(t, repo.UpdateEPSS(ctx, "CVE-2026-0001", 0.9512, 0.9988))
|
||||
|
||||
got, err := repo.Get(ctx, "CVE-2026-0001")
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, got.EPSSScore)
|
||||
require.InDelta(t, 0.9512, *got.EPSSScore, 0.0001)
|
||||
require.NotNil(t, got.EPSSPercentile)
|
||||
require.InDelta(t, 0.9988, *got.EPSSPercentile, 0.0001)
|
||||
require.Equal(t, "CRITICAL", got.Severity)
|
||||
require.InDelta(t, 9.8, got.CVSS, 0.0001)
|
||||
}
|
||||
|
||||
func TestRepo_UpsertOnConflictUpdatesLastModified(t *testing.T) {
|
||||
db := setupDB(t)
|
||||
repo := cve.NewRepo(db)
|
||||
ctx := context.Background()
|
||||
|
||||
first := cve.Row{
|
||||
CveID: "CVE-2026-0002",
|
||||
Published: time.Now().UTC().Add(-2 * time.Hour),
|
||||
LastModified: time.Now().UTC().Add(-time.Hour),
|
||||
Severity: "MEDIUM",
|
||||
CVSS: 5.0,
|
||||
Payload: json.RawMessage(`{"v":1}`),
|
||||
}
|
||||
require.NoError(t, repo.Upsert(ctx, first))
|
||||
|
||||
updated := first
|
||||
updated.LastModified = time.Now().UTC()
|
||||
updated.Severity = "HIGH"
|
||||
updated.CVSS = 7.5
|
||||
updated.Payload = json.RawMessage(`{"v":2}`)
|
||||
require.NoError(t, repo.Upsert(ctx, updated))
|
||||
|
||||
got, err := repo.Get(ctx, "CVE-2026-0002")
|
||||
require.NoError(t, err)
|
||||
require.Equal(t, "HIGH", got.Severity)
|
||||
require.InDelta(t, 7.5, got.CVSS, 0.0001)
|
||||
}
|
||||
|
||||
func TestRepo_RecentByLastModifiedOrdered(t *testing.T) {
|
||||
db := setupDB(t)
|
||||
repo := cve.NewRepo(db)
|
||||
ctx := context.Background()
|
||||
|
||||
now := time.Now().UTC()
|
||||
for i, name := range []string{"CVE-A", "CVE-B", "CVE-C"} {
|
||||
require.NoError(t, repo.Upsert(ctx, cve.Row{
|
||||
CveID: name,
|
||||
Published: now.Add(-time.Duration(10-i) * time.Hour),
|
||||
LastModified: now.Add(-time.Duration(10-i) * time.Hour),
|
||||
Severity: "LOW",
|
||||
Payload: json.RawMessage(`{}`),
|
||||
}))
|
||||
}
|
||||
|
||||
rows, err := repo.RecentByLastModified(ctx, 3)
|
||||
require.NoError(t, err)
|
||||
require.Len(t, rows, 3)
|
||||
require.Equal(t, "CVE-C", rows[0].CveID)
|
||||
require.Equal(t, "CVE-B", rows[1].CveID)
|
||||
require.Equal(t, "CVE-A", rows[2].CveID)
|
||||
}
|
||||
Loading…
Reference in New Issue