Fix: broken event links

controllers/vuln_event_controller_test.go

@@ -74,7 +74,7 @@ func TestReadEventsByAssetIDAndAssetVersionName(t *testing.T) {
 			UserID: "system",
 		}
 		detail.ComponentPurl = "pkg:npm/express@4.18.2"
-		detail.CVEID = "CVE-2024-1234"
+		detail.ResourceIdentifier = "CVE-2024-1234"
 
 		paged := shared.NewPaged(shared.PageInfo{Page: 1, PageSize: 10}, 1, []models.VulnEventDetail{detail})
 		mockRepo.On("ReadEventsByAssetIDAndAssetVersionName", mock.Anything, mock.Anything, assetID, "main", mock.Anything, mock.Anything).

database/models/vulnevent_model.go

@@ -97,11 +97,11 @@ func SetVulnIDOnEvent(event *VulnEvent, vulnID uuid.UUID, vulnType dtos.VulnType
 type VulnEventDetail struct {
 	VulnEvent
 
-	AssetVersionName string `json:"assetVersionName" gorm:"column:asset_version_name"`
-	Slug             string `json:"assetVersionSlug" gorm:"column:slug"`
-	CVEID            string `json:"cveID" gorm:"column:cve_id"`
-	ComponentPurl    string `json:"packageName"`
-	URI              string `json:"uri"`
+	AssetVersionName   string `json:"assetVersionName" gorm:"column:asset_version_name"`
+	Slug               string `json:"assetVersionSlug" gorm:"column:slug"`
+	ResourceIdentifier string `json:"resourceIdentifier" gorm:"column:resource_identifier"`
+	ComponentPurl      string `json:"packageName"`
+	URI                string `json:"uri"`
 }
 
 func (event VulnEvent) TableName() string {

database/repositories/vulnevent_repository.go

@@ -130,6 +130,7 @@ func (r *eventRepository) ReadEventsByAssetIDAndAssetVersionName(ctx context.Con
 			Joins("LEFT JOIN dependency_vulns dv ON e.dependency_vuln_id = dv.id").
 			Joins("LEFT JOIN first_party_vulnerabilities fv ON e.first_party_vuln_id = fv.id").
 			Joins("LEFT JOIN license_risks lr ON e.license_risk_id = lr.id").
+			Joins("LEFT JOIN compliance_postures cp ON e.compliance_posture_id = cp.id").
 			// id breaks ties - batched events share a created_at, and without it
 			// the same row lands on two pages while another lands on none
 			Order("e.created_at DESC, e.id DESC")
@@ -159,7 +160,7 @@ func (r *eventRepository) ReadEventsByAssetIDAndAssetVersionName(ctx context.Con
 	}
 
 	// a license risk names its component in the same field a dependency vuln does
-	if err := page.Select("e.*, dv.cve_id, COALESCE(dv.component_purl, lr.component_purl) AS component_purl, fv.uri").
+	if err := page.Select("e.*, COALESCE(dv.cve_id, cp.framework_control_id) AS resource_identifier, COALESCE(dv.component_purl, lr.component_purl) AS component_purl, fv.uri").
 		Scan(&events).Error; err != nil {
 		return shared.Paged[models.VulnEventDetail]{}, err
 	}

tests/vuln_event_feed_integration_test.go

@@ -157,11 +157,10 @@ func TestVulnEventFeedScopesToItsAssetVersion(t *testing.T) {
 		assert.Equal(t, mainEvent, result.Data[0].ID)
 		assert.NotEqual(t, otherEvent, result.Data[0].ID,
 			"an event belonging to another asset version must not leak into this feed")
-		assert.Equal(t, cve.CVE, result.Data[0].CVEID, "the dependency_vulns detail join must still populate cve_id")
+		assert.Equal(t, cve.CVE, result.Data[0].ResourceIdentifier, "the dependency_vulns detail join must still populate resource_identifier")
 	})
 }
 
-
 func TestVulnEventFeedIncludesEveryKindOfVuln(t *testing.T) {
 	t.Parallel()
 	WithTestApp(t, "../initdb.sql", func(f *TestFixture) {
@@ -228,7 +227,7 @@ func TestVulnEventFeedIncludesEveryKindOfVuln(t *testing.T) {
 		}
 
 		require.Contains(t, byType, dtos.VulnTypeDependencyVuln)
-		assert.Equal(t, cve.CVE, byType[dtos.VulnTypeDependencyVuln].CVEID)
+		assert.Equal(t, cve.CVE, byType[dtos.VulnTypeDependencyVuln].ResourceIdentifier)
 		assert.Equal(t, "pkg:npm/kinds-dependency@1.0.0", byType[dtos.VulnTypeDependencyVuln].ComponentPurl)
 
 		require.Contains(t, byType, dtos.VulnTypeLicenseRisk, "license risk events were missing from the feed entirely")

transformer/vulnevent_transformer.go

@@ -31,7 +31,7 @@ func ConvertVulnEventDetailToDto(e models.VulnEventDetail) dtos.VulnEventDTO {
 		MechanicalJustification:  e.MechanicalJustification,
 		CreatedAt:                e.CreatedAt,
 		OriginalAssetVersionName: e.OriginalAssetVersionName,
-		VulnerabilityName:        e.CVEID,
+		VulnerabilityName:        e.ResourceIdentifier,
 		PackageName:              e.ComponentPurl,
 		URI:                      e.URI,
 		CreatedByVexRule:         e.CreatedByVexRule,