fix(vulnerability): address priority API review feedback

Author: ybelMekk

internal/graph/gengql/root_.generated.go

@@ -263,13 +263,20 @@ type ExternalIngressCriticalVulnerabilityIssue implements Issue & Node {
 
 "Raised when a workload with external ingresses has one or more urgent vulnerability-priority findings."
 type ExternalIngressUrgentVulnerabilityIssue implements Issue & Node {
+	"The globally unique identifier for this issue."
 	id: ID!
+	"The team environment where the affected workload is deployed."
 	teamEnvironment: TeamEnvironment!
+	"The severity assigned to this issue."
 	severity: Severity!
+	"A human-readable description of the issue."
 	message: String!
 
+	"The workload with urgent vulnerabilities and external ingresses."
 	workload: Workload!
+	"Number of urgent vulnerabilities on the workload."
 	priorityUrgent: Int!
+	"External ingress URLs that expose the workload."
 	ingresses: [String!]!
 }
 

internal/graph/schema/issues.graphqls

@@ -492,6 +492,25 @@ func normalizeFromDate(from time.Time) time.Time {
 	return time.Date(from.Year(), from.Month(), from.Day(), 2, 0, 0, 0, time.UTC)
 }
 
+func environmentNameFromFilter(filter *TeamVulnerabilitySummaryFilter) (*string, error) {
+	if filter == nil {
+		return nil, nil
+	}
+	if filter.EnvironmentName != nil && len(filter.Environments) > 0 {
+		return nil, apierror.Errorf("environmentName and environments cannot be used together")
+	}
+	if filter.EnvironmentName != nil {
+		return filter.EnvironmentName, nil
+	}
+	if len(filter.Environments) > 1 {
+		return nil, apierror.Errorf("environments supports exactly one value")
+	}
+	if len(filter.Environments) == 1 {
+		return &filter.Environments[0], nil
+	}
+	return nil, nil
+}
+
 func getVulnerabilityHistory(ctx context.Context, opts []vulnerabilities.Option) (*ImageVulnerabilityHistory, error) {
 	resp, err := fromContext(ctx).manager.Client.GetVulnerabilitySummaryTimeSeries(ctx, opts...)
 	if err != nil {

internal/vulnerability/queries.go

@@ -2,6 +2,40 @@ package vulnerability
 
 import "testing"
 
+func TestEnvironmentNameFromFilter(t *testing.T) {
+	dev := "dev"
+	tests := []struct {
+		name    string
+		filter  *TeamVulnerabilitySummaryFilter
+		want    *string
+		wantErr bool
+	}{
+		{name: "nil filter"},
+		{name: "environment name", filter: &TeamVulnerabilitySummaryFilter{EnvironmentName: &dev}, want: &dev},
+		{name: "deprecated single environment", filter: &TeamVulnerabilitySummaryFilter{Environments: []string{"dev"}}, want: &dev},
+		{name: "multiple deprecated environments", filter: &TeamVulnerabilitySummaryFilter{Environments: []string{"dev", "prod"}}, wantErr: true},
+		{name: "both environment filters", filter: &TeamVulnerabilitySummaryFilter{EnvironmentName: &dev, Environments: []string{"prod"}}, wantErr: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := environmentNameFromFilter(tt.filter)
+			if (err != nil) != tt.wantErr {
+				t.Fatalf("environmentNameFromFilter() error = %v, wantErr %v", err, tt.wantErr)
+			}
+			if got == nil || tt.want == nil {
+				if got != tt.want {
+					t.Fatalf("environmentNameFromFilter() = %v, want %v", got, tt.want)
+				}
+				return
+			}
+			if *got != *tt.want {
+				t.Fatalf("environmentNameFromFilter() = %q, want %q", *got, *tt.want)
+			}
+		})
+	}
+}
+
 func TestSplitImage(t *testing.T) {
 	tests := []struct {
 		name     string

internal/vulnerability/queries_test.go

@@ -67,49 +67,52 @@ func toWorkloadVulnerabilitySummary(w *vulnerabilities.WorkloadSummary) *Workloa
 	}
 
 	v13sSummary := w.GetVulnerabilitySummary()
-	if v13sSummary == nil {
-		v13sSummary = &vulnerabilities.Summary{}
+
+	return &WorkloadVulnerabilitySummary{
+		Summary:         toImageVulnerabilitySummary(v13sSummary),
+		HasSbom:         v13sSummary.GetHasSbom(),
+		TeamSlug:        slug.Slug(w.GetWorkload().GetNamespace()),
+		EnvironmentName: environmentmapper.EnvironmentName(w.GetWorkload().GetCluster()),
+		WorkloadReference: &workload.Reference{
+			Name: w.GetWorkload().GetName(),
+			Type: wType,
+		},
+	}
+}
+
+func toImageVulnerabilitySummary(summary *vulnerabilities.Summary) *ImageVulnerabilitySummary {
+	if summary == nil {
+		summary = &vulnerabilities.Summary{}
 	}
 
 	var lastUpdated *time.Time
-	if ts := v13sSummary.GetLastUpdated(); ts != nil {
+	if ts := summary.GetLastUpdated(); ts != nil {
 		t := ts.AsTime()
 		lastUpdated = &t
 	}
 
-	summary := &ImageVulnerabilitySummary{
-		Critical:      int(v13sSummary.Critical),
-		High:          int(v13sSummary.High),
-		Medium:        int(v13sSummary.Medium),
-		Low:           int(v13sSummary.Low),
-		Unassigned:    int(v13sSummary.Unassigned),
-		Total:         int(v13sSummary.Total),
-		RiskScore:     int(v13sSummary.RiskScore),
+	return &ImageVulnerabilitySummary{
+		Critical:      int(summary.GetCritical()),
+		High:          int(summary.GetHigh()),
+		Medium:        int(summary.GetMedium()),
+		Low:           int(summary.GetLow()),
+		Unassigned:    int(summary.GetUnassigned()),
+		Total:         int(summary.GetTotal()),
+		RiskScore:     int(summary.GetRiskScore()),
 		LastUpdated:   lastUpdated,
-		StaleImageTag: v13sSummary.StaleImageTag,
+		StaleImageTag: summary.StaleImageTag,
 		CountsBySeverity: ImageVulnerabilitySummaryCountsBySeverity{
-			Critical:   int(v13sSummary.Critical),
-			High:       int(v13sSummary.High),
-			Medium:     int(v13sSummary.Medium),
-			Low:        int(v13sSummary.Low),
-			Unassigned: int(v13sSummary.Unassigned),
+			Critical:   int(summary.GetCritical()),
+			High:       int(summary.GetHigh()),
+			Medium:     int(summary.GetMedium()),
+			Low:        int(summary.GetLow()),
+			Unassigned: int(summary.GetUnassigned()),
 		},
 		CountsByPriority: ImageVulnerabilitySummaryCountsByPriority{
-			Urgent:       int(v13sSummary.ActNow),
-			HighRisk:     int(v13sSummary.HighRisk),
-			ElevatedRisk: int(v13sSummary.ElevatedRisk),
-			Monitor:      int(v13sSummary.Monitor),
-		},
-	}
-
-	return &WorkloadVulnerabilitySummary{
-		Summary:         summary,
-		HasSbom:         v13sSummary.GetHasSbom(),
-		TeamSlug:        slug.Slug(w.GetWorkload().GetNamespace()),
-		EnvironmentName: environmentmapper.EnvironmentName(w.GetWorkload().GetCluster()),
-		WorkloadReference: &workload.Reference{
-			Name: w.GetWorkload().GetName(),
-			Type: wType,
+			Urgent:       int(summary.GetActNow()),
+			HighRisk:     int(summary.GetHighRisk()),
+			ElevatedRisk: int(summary.GetElevatedRisk()),
+			Monitor:      int(summary.GetMonitor()),
 		},
 	}
 }

internal/vulnerability/transform.go

@@ -0,0 +1,43 @@
+package vulnerability
+
+import (
+	"testing"
+	"time"
+
+	"github.com/nais/v13s/pkg/api/vulnerabilities"
+	"google.golang.org/protobuf/types/known/timestamppb"
+)
+
+func TestToImageVulnerabilitySummary(t *testing.T) {
+	lastUpdated := time.Date(2026, time.June, 30, 12, 0, 0, 0, time.UTC)
+	staleImageTag := "previous"
+
+	got := toImageVulnerabilitySummary(&vulnerabilities.Summary{
+		Critical:      1,
+		High:          2,
+		Medium:        3,
+		Low:           4,
+		Unassigned:    5,
+		Total:         15,
+		RiskScore:     42,
+		ActNow:        6,
+		HighRisk:      7,
+		ElevatedRisk:  8,
+		Monitor:       9,
+		LastUpdated:   timestamppb.New(lastUpdated),
+		StaleImageTag: &staleImageTag,
+	})
+
+	if got.CountsBySeverity != (ImageVulnerabilitySummaryCountsBySeverity{Critical: 1, High: 2, Medium: 3, Low: 4, Unassigned: 5}) {
+		t.Fatalf("CountsBySeverity = %#v", got.CountsBySeverity)
+	}
+	if got.CountsByPriority != (ImageVulnerabilitySummaryCountsByPriority{Urgent: 6, HighRisk: 7, ElevatedRisk: 8, Monitor: 9}) {
+		t.Fatalf("CountsByPriority = %#v", got.CountsByPriority)
+	}
+	if got.Total != 15 || got.RiskScore != 42 || got.StaleImageTag == nil || *got.StaleImageTag != "previous" {
+		t.Fatalf("summary metadata = %#v", got)
+	}
+	if got.LastUpdated == nil || !got.LastUpdated.Equal(lastUpdated) {
+		t.Fatalf("LastUpdated = %v, want %v", got.LastUpdated, lastUpdated)
+	}
+}