fix(reports): correct the Security & Compliance Posture report

apps/api/eslint.config.js

@@ -15,4 +15,21 @@ export default [
     linterOptions: { reportUnusedDisableDirectives: 'off' },
     rules: {},
   },
+  {
+    files: ['src/**/*.ts'],
+    ignores: ['src/**/*.test.ts', 'src/lib/validation.ts'],
+    rules: {
+      'no-restricted-imports': [
+        'error',
+        {
+          paths: [
+            {
+              name: '@hono/zod-validator',
+              message: 'Import zValidator from src/lib/validation instead.',
+            },
+          ],
+        },
+      ],
+    },
+  },
 ];

apps/api/src/__tests__/integration/securityComplianceReport.integration.test.ts

@@ -0,0 +1,133 @@
+import './setup';
+
+import { describe, expect, it } from 'vitest';
+
+import { db, withDbAccessContext, withSystemDbAccessContext } from '../../db';
+import { devices, deviceVulnerabilities, vulnerabilities } from '../../db/schema';
+import { generateSecurityCompliancePostureReport } from '../../services/securityComplianceReport';
+import { loadOpenVulnerabilityCounts } from '../../services/securityComplianceReportVulnerabilities';
+import { setupTestEnvironment } from './db-utils';
+
+const runDb = it.runIf(!!process.env.DATABASE_URL);
+
+describe('security compliance report vulnerability isolation', () => {
+  runDb('counts its own open catalog findings and excludes another organization', async () => {
+    const envA = await setupTestEnvironment({ scope: 'organization' });
+    const envB = await setupTestEnvironment({ scope: 'organization' });
+
+    const seeded = await withSystemDbAccessContext(async () => {
+      const [deviceA, deviceB] = await db
+        .insert(devices)
+        .values([
+          {
+            orgId: envA.organization.id,
+            siteId: envA.site.id,
+            agentId: `posture-a-${Date.now()}`,
+            hostname: 'posture-a',
+            osType: 'windows',
+            osVersion: '11',
+            architecture: 'x86_64',
+            agentVersion: 'test',
+            status: 'offline',
+          },
+          {
+            orgId: envB.organization.id,
+            siteId: envB.site.id,
+            agentId: `posture-b-${Date.now()}`,
+            hostname: 'posture-b',
+            osType: 'windows',
+            osVersion: '11',
+            architecture: 'x86_64',
+            agentVersion: 'test',
+            status: 'offline',
+          },
+        ])
+        .returning({ id: devices.id, orgId: devices.orgId });
+
+      const [catalogA, catalogB, patchedCatalog, mitigatedCatalog, acceptedCatalog] = await db
+        .insert(vulnerabilities)
+        .values([
+          { cveId: 'CVE-2026-71001', source: 'nvd', description: 'org A open finding', severity: 'HIGH', rawPayload: {} },
+          { cveId: 'CVE-2026-71002', source: 'msrc', description: 'org B open finding', severity: 'Critical', rawPayload: {} },
+          { cveId: 'CVE-2026-71003', source: 'nvd', description: 'org A patched finding', severity: 'CRITICAL', rawPayload: {} },
+          { cveId: 'CVE-2026-71004', source: 'nvd', description: 'org A mitigated finding', severity: 'CRITICAL', rawPayload: {} },
+          { cveId: 'CVE-2026-71005', source: 'nvd', description: 'org A accepted finding', severity: 'CRITICAL', rawPayload: {} },
+        ])
+        .returning({ id: vulnerabilities.id });
+
+      await db.insert(deviceVulnerabilities).values([
+        {
+          orgId: envA.organization.id,
+          deviceId: deviceA!.id,
+          vulnerabilityId: catalogA!.id,
+          status: 'open',
+          detectedAt: new Date(),
+        },
+        {
+          orgId: envB.organization.id,
+          deviceId: deviceB!.id,
+          vulnerabilityId: catalogB!.id,
+          status: 'open',
+          detectedAt: new Date(),
+        },
+        {
+          orgId: envA.organization.id,
+          deviceId: deviceA!.id,
+          vulnerabilityId: patchedCatalog!.id,
+          status: 'patched',
+          detectedAt: new Date(),
+        },
+        {
+          orgId: envA.organization.id,
+          deviceId: deviceA!.id,
+          vulnerabilityId: mitigatedCatalog!.id,
+          status: 'mitigated',
+          detectedAt: new Date(),
+        },
+        {
+          orgId: envA.organization.id,
+          deviceId: deviceA!.id,
+          vulnerabilityId: acceptedCatalog!.id,
+          status: 'accepted',
+          detectedAt: new Date(),
+        },
+      ]);
+
+      return { deviceA: deviceA!.id, deviceB: deviceB!.id };
+    });
+
+    const { result, vulnerabilityCounts } = await withDbAccessContext(
+      {
+        scope: 'organization',
+        orgId: envA.organization.id,
+        accessibleOrgIds: [envA.organization.id],
+        userId: envA.user.id,
+      },
+      async () => {
+        const result = await generateSecurityCompliancePostureReport(envA.organization.id, {
+          includeCis: false,
+        });
+        const vulnerabilityCounts = await loadOpenVulnerabilityCounts([
+          seeded.deviceA,
+          seeded.deviceB,
+        ]);
+        return { result, vulnerabilityCounts };
+      },
+    );
+
+    expect(result.rows).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          hostname: 'posture-a',
+          openVulnHigh: 1,
+          openVulnCritical: 0,
+        }),
+      ]),
+    );
+    expect(result.rows).not.toEqual(
+      expect.arrayContaining([expect.objectContaining({ hostname: 'posture-b' })]),
+    );
+    expect(vulnerabilityCounts.get(seeded.deviceA)).toEqual({ high: 1, critical: 0 });
+    expect(vulnerabilityCounts.has(seeded.deviceB)).toBe(false);
+  });
+});

apps/api/src/db/autoMigrate.test.ts

@@ -9,7 +9,7 @@ import {
   partitionLedgerRows,
 } from './autoMigrate';
 import { createHash } from 'node:crypto';
-import { mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 
@@ -114,91 +114,6 @@ describe('autoMigrate', () => {
     });
   });
 
-  // Regression test for issue #506. A `localeCompare` sort places
-  // `2026-04-19-installer-bootstrap-tokens-constraints.sql` before
-  // `...-tokens.sql` (because '-' < '.'), so the constraints migration ran
-  // before the table that owns those constraints existed. This scans every
-  // migration in the same order autoMigrate uses and asserts that each
-  // referenced table was created in this file or an earlier one.
-  describe('migration ordering', () => {
-    const MIGRATION_FILE_PATTERN = /^\d{4}-.*\.sql$/;
-    const migrationsDir = path.resolve(__dirname, '../../migrations');
-
-    const SYSTEM_TABLES = new Set([
-      'pg_policies',
-      'pg_indexes',
-      'pg_class',
-      'pg_namespace',
-      'pg_trigger',
-      'pg_proc',
-      'pg_constraint',
-      'pg_attribute',
-      'pg_type',
-      'pg_tables',
-      'information_schema',
-    ]);
-
-    function collectMatches(sql: string, pattern: RegExp): string[] {
-      const out: string[] = [];
-      for (const match of sql.matchAll(pattern)) {
-        if (match[1]) out.push(match[1].toLowerCase());
-      }
-      return out;
-    }
-
-    function extractCreatedTables(sql: string): string[] {
-      return collectMatches(
-        sql,
-        /CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(?:"?public"?\.)?"?([a-zA-Z_][a-zA-Z0-9_]*)"?/gi,
-      );
-    }
-
-    function extractReferencedTables(sql: string): string[] {
-      const stripped = sql
-        .replace(/--[^\n]*/g, '')
-        .replace(/\/\*[\s\S]*?\*\//g, '');
-      // Only patterns that hard-fail when the table is missing. Tolerant
-      // forms like `DROP TABLE IF EXISTS` or `ALTER TABLE IF EXISTS` are
-      // intentionally excluded — they're a no-op against an absent table.
-      const patterns = [
-        /\bREFERENCES\s+(?:"?public"?\.)?"?([a-zA-Z_][a-zA-Z0-9_]*)"?/gi,
-        /\bALTER\s+TABLE\s+(?!IF\s+EXISTS\b)(?:ONLY\s+)?(?:"?public"?\.)?"?([a-zA-Z_][a-zA-Z0-9_]*)"?/gi,
-        /\bCREATE\s+POLICY\s+[^;]*?\bON\s+(?:"?public"?\.)?"?([a-zA-Z_][a-zA-Z0-9_]*)"?/gi,
-        /\bCREATE\s+(?:UNIQUE\s+)?INDEX\s+(?:CONCURRENTLY\s+)?(?:IF\s+NOT\s+EXISTS\s+)?[^;]*?\bON\s+(?:"?public"?\.)?"?([a-zA-Z_][a-zA-Z0-9_]*)"?/gi,
-        /\bCREATE\s+TRIGGER\s+[^;]*?\bON\s+(?:"?public"?\.)?"?([a-zA-Z_][a-zA-Z0-9_]*)"?/gi,
-      ];
-      const refs: string[] = [];
-      for (const pattern of patterns) refs.push(...collectMatches(stripped, pattern));
-      return refs;
-    }
-
-    it('every referenced table is created in the same file or an earlier one', () => {
-      const files = readdirSync(migrationsDir)
-        .filter((name) => MIGRATION_FILE_PATTERN.test(name))
-        .sort((a, b) => a.localeCompare(b));
-
-      expect(files.length).toBeGreaterThan(0);
-
-      const created = new Set<string>();
-      const violations: string[] = [];
-
-      for (const file of files) {
-        const sql = readFileSync(path.join(migrationsDir, file), 'utf8');
-        // Add tables created in this file BEFORE checking references so a
-        // file that creates a table and immediately alters or self-references
-        // it passes.
-        for (const t of extractCreatedTables(sql)) created.add(t);
-        for (const ref of extractReferencedTables(sql)) {
-          if (SYSTEM_TABLES.has(ref)) continue;
-          if (created.has(ref)) continue;
-          violations.push(`${file} references "${ref}" before it is created`);
-        }
-      }
-
-      expect(violations).toEqual([]);
-    });
-  });
-
   describe('hasNoTransactionDirective', () => {
     it('returns true when "-- @no-transaction" is the first line', () => {
       expect(hasNoTransactionDirective('-- @no-transaction\nCREATE INDEX foo ON bar (x);')).toBe(

apps/api/src/db/migrationOrdering.test.ts

@@ -0,0 +1,92 @@
+import { describe, it, expect } from 'vitest';
+import { readdir, readFile } from 'node:fs/promises';
+import path from 'node:path';
+
+// Regression test for issue #506. A `localeCompare` sort places
+// `2026-04-19-installer-bootstrap-tokens-constraints.sql` before
+// `...-tokens.sql` (because '-' < '.'), so the constraints migration ran
+// before the table that owns those constraints existed. This scans every
+// migration in the same order autoMigrate uses and asserts that each
+// referenced table was created in this file or an earlier one.
+describe('migration ordering', () => {
+  const MIGRATION_FILE_PATTERN = /^\d{4}-.*\.sql$/;
+  const migrationsDir = path.resolve(__dirname, '../../migrations');
+
+  const SYSTEM_TABLES = new Set([
+    'pg_policies',
+    'pg_indexes',
+    'pg_class',
+    'pg_namespace',
+    'pg_trigger',
+    'pg_proc',
+    'pg_constraint',
+    'pg_attribute',
+    'pg_type',
+    'pg_tables',
+    'information_schema',
+  ]);
+
+  function collectMatches(sql: string, pattern: RegExp): string[] {
+    const out: string[] = [];
+    for (const match of sql.matchAll(pattern)) {
+      if (match[1]) out.push(match[1].toLowerCase());
+    }
+    return out;
+  }
+
+  function extractCreatedTables(sql: string): string[] {
+    return collectMatches(
+      sql,
+      /CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(?:"?public"?\.)?"?([a-zA-Z_][a-zA-Z0-9_]*)"?/gi,
+    );
+  }
+
+  function extractReferencedTables(sql: string): string[] {
+    const stripped = sql
+      .replace(/--[^\n]*/g, '')
+      .replace(/\/\*[\s\S]*?\*\//g, '');
+    // Only patterns that hard-fail when the table is missing. Tolerant
+    // forms like `DROP TABLE IF EXISTS` or `ALTER TABLE IF EXISTS` are
+    // intentionally excluded — they're a no-op against an absent table.
+    const patterns = [
+      /\bREFERENCES\s+(?:"?public"?\.)?"?([a-zA-Z_][a-zA-Z0-9_]*)"?/gi,
+      /\bALTER\s+TABLE\s+(?!IF\s+EXISTS\b)(?:ONLY\s+)?(?:"?public"?\.)?"?([a-zA-Z_][a-zA-Z0-9_]*)"?/gi,
+      /\bCREATE\s+POLICY\s+[^;]*?\bON\s+(?:"?public"?\.)?"?([a-zA-Z_][a-zA-Z0-9_]*)"?/gi,
+      /\bCREATE\s+(?:UNIQUE\s+)?INDEX\s+(?:CONCURRENTLY\s+)?(?:IF\s+NOT\s+EXISTS\s+)?[^;]*?\bON\s+(?:"?public"?\.)?"?([a-zA-Z_][a-zA-Z0-9_]*)"?/gi,
+      /\bCREATE\s+TRIGGER\s+[^;]*?\bON\s+(?:"?public"?\.)?"?([a-zA-Z_][a-zA-Z0-9_]*)"?/gi,
+    ];
+    const refs: string[] = [];
+    for (const pattern of patterns) refs.push(...collectMatches(stripped, pattern));
+    return refs;
+  }
+
+  it('every referenced table is created in the same file or an earlier one', async () => {
+    const files = (await readdir(migrationsDir))
+      .filter((name) => MIGRATION_FILE_PATTERN.test(name))
+      .sort((a, b) => a.localeCompare(b));
+
+    expect(files.length).toBeGreaterThan(0);
+
+    const migrations = await Promise.all(files.map(async (file) => ({
+      file,
+      sql: await readFile(path.join(migrationsDir, file), 'utf8'),
+    })));
+
+    const created = new Set<string>();
+    const violations: string[] = [];
+
+    for (const { file, sql } of migrations) {
+      // Add tables created in this file BEFORE checking references so a
+      // file that creates a table and immediately alters or self-references
+      // it passes.
+      for (const t of extractCreatedTables(sql)) created.add(t);
+      for (const ref of extractReferencedTables(sql)) {
+        if (SYSTEM_TABLES.has(ref)) continue;
+        if (created.has(ref)) continue;
+        violations.push(`${file} references "${ref}" before it is created`);
+      }
+    }
+
+    expect(violations).toEqual([]);
+  });
+});