fix(api): reaggregate resource inventory and attack surface after muting findings (#10843)

api/src/backend/tasks/tests/test_backfill.py

@@ -7,8 +7,8 @@ from tasks.jobs.backfill import (
     backfill_compliance_summaries,
     backfill_provider_compliance_scores,
     backfill_resource_scan_summaries,
-    backfill_scan_category_summaries,
-    backfill_scan_resource_group_summaries,
+    aggregate_scan_category_summaries,
+    aggregate_scan_resource_group_summaries,
 )
 
 from api.models import (
@@ -183,6 +183,10 @@ class TestBackfillComplianceSummaries:
     def test_backfill_creates_compliance_summaries(
         self, tenants_fixture, scans_fixture, compliance_requirements_overviews_fixture
     ):
+        # Fixture seeds compliance rows the backfill aggregates over; pytest
+        # injects it by parameter name, so we reference it explicitly here
+        # to keep static analysers from flagging it as unused.
+        del compliance_requirements_overviews_fixture
         tenant = tenants_fixture[0]
         scan = scans_fixture[0]
 
@@ -227,22 +231,86 @@ class TestBackfillComplianceSummaries:
 
 @pytest.mark.django_db
 class TestBackfillScanCategorySummaries:
-    def test_already_backfilled(self, scan_category_summary_fixture):
+    def test_rerun_with_no_findings_is_noop(self, scan_category_summary_fixture):
+        """When the scan has no findings, the backfill is a no-op: it
+        reports `no categories to backfill` and leaves the table
+        untouched. The upsert path cannot drop rows it does not produce,
+        so any pre-existing row survives (matching the scan-completion
+        writer that used `ignore_conflicts=True`)."""
         tenant_id = scan_category_summary_fixture.tenant_id
         scan_id = scan_category_summary_fixture.scan_id
 
-        result = backfill_scan_category_summaries(str(tenant_id), str(scan_id))
+        result = aggregate_scan_category_summaries(str(tenant_id), str(scan_id))
 
-        assert result == {"status": "already backfilled"}
+        assert result == {"status": "no categories to backfill"}
+        assert ScanCategorySummary.objects.filter(
+            tenant_id=tenant_id, scan_id=scan_id, category="existing-category"
+        ).exists()
+
+    def test_rerun_upserts_without_duplicating(self, findings_with_categories_fixture):
+        """Calling the backfill twice upserts rather than raising on
+        `unique_category_severity_per_scan`; rows are updated in place
+        (same primary keys)."""
+        finding = findings_with_categories_fixture
+        tenant_id = str(finding.tenant_id)
+        scan_id = str(finding.scan_id)
+
+        aggregate_scan_category_summaries(tenant_id, scan_id)
+        first_ids = set(
+            ScanCategorySummary.objects.filter(
+                tenant_id=tenant_id, scan_id=scan_id
+            ).values_list("id", flat=True)
+        )
+
+        aggregate_scan_category_summaries(tenant_id, scan_id)
+        second_ids = set(
+            ScanCategorySummary.objects.filter(
+                tenant_id=tenant_id, scan_id=scan_id
+            ).values_list("id", flat=True)
+        )
+
+        assert first_ids == second_ids
+        assert len(first_ids) == 2  # 2 categories x 1 severity
+
+    def test_rerun_reflects_mute_between_runs(self, findings_with_categories_fixture):
+        """Muting a finding between two backfill runs must move counters:
+        `failed_findings` and `new_failed_findings` drop to zero (muted
+        findings are excluded from those totals). Guards against a
+        regression where the upsert keeps stale counts from the first run."""
+        finding = findings_with_categories_fixture
+        tenant_id = str(finding.tenant_id)
+        scan_id = str(finding.scan_id)
+
+        aggregate_scan_category_summaries(tenant_id, scan_id)
+        before = list(
+            ScanCategorySummary.objects.filter(tenant_id=tenant_id, scan_id=scan_id)
+        )
+        assert all(s.failed_findings == 1 for s in before)
+        assert all(s.new_failed_findings == 1 for s in before)
+        assert all(s.total_findings == 1 for s in before)
+
+        Finding.all_objects.filter(pk=finding.pk).update(muted=True)
+
+        aggregate_scan_category_summaries(tenant_id, scan_id)
+        after = list(
+            ScanCategorySummary.objects.filter(tenant_id=tenant_id, scan_id=scan_id)
+        )
+
+        assert {s.id for s in after} == {s.id for s in before}
+        assert all(s.failed_findings == 0 for s in after)
+        assert all(s.new_failed_findings == 0 for s in after)
+        assert all(s.total_findings == 0 for s in after)
 
     def test_not_completed_scan(self, get_not_completed_scans):
         for scan in get_not_completed_scans:
-            result = backfill_scan_category_summaries(str(scan.tenant_id), str(scan.id))
+            result = aggregate_scan_category_summaries(
+                str(scan.tenant_id), str(scan.id)
+            )
             assert result == {"status": "scan is not completed"}
 
     def test_no_categories_to_backfill(self, scans_fixture):
         scan = scans_fixture[1]  # Failed scan with no findings
-        result = backfill_scan_category_summaries(str(scan.tenant_id), str(scan.id))
+        result = aggregate_scan_category_summaries(str(scan.tenant_id), str(scan.id))
         assert result == {"status": "no categories to backfill"}
 
     def test_successful_backfill(self, findings_with_categories_fixture):
@@ -250,7 +318,7 @@ class TestBackfillScanCategorySummaries:
         tenant_id = str(finding.tenant_id)
         scan_id = str(finding.scan_id)
 
-        result = backfill_scan_category_summaries(tenant_id, scan_id)
+        result = aggregate_scan_category_summaries(tenant_id, scan_id)
 
         # 2 categories × 1 severity = 2 rows
         assert result == {"status": "backfilled", "categories_count": 2}
@@ -311,24 +379,87 @@ def scan_resource_group_summary_fixture(scans_fixture):
 
 @pytest.mark.django_db
 class TestBackfillScanGroupSummaries:
-    def test_already_backfilled(self, scan_resource_group_summary_fixture):
+    def test_rerun_with_no_findings_is_noop(self, scan_resource_group_summary_fixture):
+        """When the scan has no findings, the backfill is a no-op: it
+        reports `no resource groups to backfill` and leaves the table
+        untouched. The upsert path cannot drop rows it does not produce,
+        so any pre-existing row survives (matching the scan-completion
+        writer that used `ignore_conflicts=True`)."""
         tenant_id = scan_resource_group_summary_fixture.tenant_id
         scan_id = scan_resource_group_summary_fixture.scan_id
 
-        result = backfill_scan_resource_group_summaries(str(tenant_id), str(scan_id))
+        result = aggregate_scan_resource_group_summaries(str(tenant_id), str(scan_id))
 
-        assert result == {"status": "already backfilled"}
+        assert result == {"status": "no resource groups to backfill"}
+        assert ScanGroupSummary.objects.filter(
+            tenant_id=tenant_id, scan_id=scan_id, resource_group="existing-group"
+        ).exists()
+
+    def test_rerun_upserts_without_duplicating(self, findings_with_group_fixture):
+        """Calling the backfill twice upserts rather than raising on
+        `unique_resource_group_severity_per_scan`; rows are updated in
+        place (same primary keys)."""
+        finding = findings_with_group_fixture
+        tenant_id = str(finding.tenant_id)
+        scan_id = str(finding.scan_id)
+
+        aggregate_scan_resource_group_summaries(tenant_id, scan_id)
+        first_ids = set(
+            ScanGroupSummary.objects.filter(
+                tenant_id=tenant_id, scan_id=scan_id
+            ).values_list("id", flat=True)
+        )
+
+        aggregate_scan_resource_group_summaries(tenant_id, scan_id)
+        second_ids = set(
+            ScanGroupSummary.objects.filter(
+                tenant_id=tenant_id, scan_id=scan_id
+            ).values_list("id", flat=True)
+        )
+
+        assert first_ids == second_ids
+        assert len(first_ids) == 1  # 1 resource group x 1 severity
+
+    def test_rerun_reflects_mute_between_runs(self, findings_with_group_fixture):
+        """Muting a finding between two backfill runs must move counters:
+        `failed_findings` and `new_failed_findings` drop to zero (muted
+        findings are excluded from those totals). Guards against a
+        regression where the upsert keeps stale counts from the first run."""
+        finding = findings_with_group_fixture
+        tenant_id = str(finding.tenant_id)
+        scan_id = str(finding.scan_id)
+
+        aggregate_scan_resource_group_summaries(tenant_id, scan_id)
+        before = list(
+            ScanGroupSummary.objects.filter(tenant_id=tenant_id, scan_id=scan_id)
+        )
+        assert len(before) == 1
+        assert before[0].failed_findings == 1
+        assert before[0].new_failed_findings == 1
+        assert before[0].total_findings == 1
+
+        Finding.all_objects.filter(pk=finding.pk).update(muted=True)
+
+        aggregate_scan_resource_group_summaries(tenant_id, scan_id)
+        after = list(
+            ScanGroupSummary.objects.filter(tenant_id=tenant_id, scan_id=scan_id)
+        )
+
+        assert {s.id for s in after} == {s.id for s in before}
+        assert after[0].failed_findings == 0
+        assert after[0].new_failed_findings == 0
+        assert after[0].total_findings == 0
 
     def test_not_completed_scan(self, get_not_completed_scans):
         for scan in get_not_completed_scans:
-            result = backfill_scan_resource_group_summaries(
+            result = aggregate_scan_resource_group_summaries(
                 str(scan.tenant_id), str(scan.id)
             )
             assert result == {"status": "scan is not completed"}
 
     def test_no_resource_groups_to_backfill(self, scans_fixture):
         scan = scans_fixture[1]  # Failed scan with no findings
-        result = backfill_scan_resource_group_summaries(
+        result = aggregate_scan_resource_group_summaries(
             str(scan.tenant_id), str(scan.id)
         )
         assert result == {"status": "no resource groups to backfill"}
@@ -338,7 +469,7 @@ class TestBackfillScanGroupSummaries:
         tenant_id = str(finding.tenant_id)
         scan_id = str(finding.scan_id)
 
-        result = backfill_scan_resource_group_summaries(tenant_id, scan_id)
+        result = aggregate_scan_resource_group_summaries(tenant_id, scan_id)
 
         # 1 resource group × 1 severity = 1 row
         assert result == {"status": "backfilled", "resource_groups_count": 1}

api/src/backend/tasks/tests/test_scan.py

@@ -3366,14 +3366,24 @@ class TestAggregateFindings:
         findings_fixture,
     ):
         """Re-running `aggregate_findings` for the same scan must not violate
-        the `unique_scan_summary` constraint, and the resulting row set for
-        the scan must match the single-run output. This is exercised by the
-        post-mute reaggregation pipeline, which re-dispatches
-        `perform_scan_summary_task` against scans whose summaries already
-        exist."""
+        the `unique_scan_summary` constraint. The post-mute reaggregation
+        pipeline re-dispatches `perform_scan_summary_task` against scans
+        whose summaries already exist; upsert must update existing rows in
+        place (same primary keys) rather than inserting duplicates."""
         tenant = tenants_fixture[0]
         scan = scans_fixture[0]
 
+        value_columns = (
+            "check_id",
+            "service",
+            "severity",
+            "region",
+            "fail",
+            "_pass",
+            "muted",
+            "total",
+        )
+
         aggregate_findings(str(tenant.id), str(scan.id))
         first_run_ids = set(
             ScanSummary.all_objects.filter(
@@ -3382,19 +3392,11 @@ class TestAggregateFindings:
         )
         first_run_rows = list(
             ScanSummary.all_objects.filter(tenant_id=tenant.id, scan_id=scan.id).values(
-                "check_id",
-                "service",
-                "severity",
-                "region",
-                "fail",
-                "_pass",
-                "muted",
-                "total",
+                *value_columns
             )
         )
 
-        # Second invocation must not raise and must replace the rows without
-        # leaving duplicates behind.
+        # Second invocation must not raise and must not duplicate rows.
         aggregate_findings(str(tenant.id), str(scan.id))
         second_run_ids = set(
             ScanSummary.all_objects.filter(
@@ -3403,19 +3405,49 @@ class TestAggregateFindings:
         )
         second_run_rows = list(
             ScanSummary.all_objects.filter(tenant_id=tenant.id, scan_id=scan.id).values(
-                "check_id",
-                "service",
-                "severity",
-                "region",
-                "fail",
-                "_pass",
-                "muted",
-                "total",
+                *value_columns
             )
         )
 
+        # Upsert preserves the original row identities; values stay stable
+        # because the underlying Finding set is unchanged between runs.
         assert second_run_rows == first_run_rows
-        assert first_run_ids.isdisjoint(second_run_ids)
+        assert first_run_ids == second_run_ids
+
+    def test_aggregate_findings_reflects_mute_between_runs(
+        self,
+        tenants_fixture,
+        scans_fixture,
+        findings_fixture,
+    ):
+        """Re-running `aggregate_findings` after a finding is muted between
+        runs must move counters: the matching ScanSummary row's `fail`
+        decrements and `muted` increments. Guards against a regression where
+        upsert silently keeps stale values from the first run."""
+        tenant = tenants_fixture[0]
+        scan = scans_fixture[0]
+        finding1, _ = findings_fixture  # finding1 is FAIL and not muted.
+
+        aggregate_findings(str(tenant.id), str(scan.id))
+        before = ScanSummary.all_objects.get(
+            tenant_id=tenant.id,
+            scan_id=scan.id,
+            check_id=finding1.check_id,
+            service="ec2",
+            severity=finding1.severity,
+            region="us-east-1",
+        )
+        assert before.fail == 1
+        assert before.muted == 0
+
+        Finding.all_objects.filter(pk=finding1.pk).update(muted=True)
+
+        aggregate_findings(str(tenant.id), str(scan.id))
+        after = ScanSummary.all_objects.get(pk=before.pk)
+
+        assert after.fail == 0
+        assert after.muted == 1
+        assert after.total == before.total
 
 
 @pytest.mark.django_db

api/src/backend/tasks/tests/test_tasks.py

@@ -2361,6 +2361,9 @@ class TestReaggregateAllFindingGroupSummaries:
 
     @patch("tasks.tasks.chain")
     @patch("tasks.tasks.group")
+    @patch("tasks.tasks.aggregate_attack_surface_task")
+    @patch("tasks.tasks.aggregate_scan_category_summaries_task")
+    @patch("tasks.tasks.aggregate_scan_resource_group_summaries_task")
     @patch("tasks.tasks.aggregate_finding_group_summaries_task")
     @patch("tasks.tasks.aggregate_daily_severity_task")
     @patch("tasks.tasks.perform_scan_summary_task")
@@ -2371,6 +2374,9 @@ class TestReaggregateAllFindingGroupSummaries:
         mock_scan_summary_task,
         mock_daily_severity_task,
         mock_finding_group_task,
+        mock_resource_group_task,
+        mock_category_task,
+        mock_attack_surface_task,
         mock_group,
         mock_chain,
     ):
@@ -2383,8 +2389,8 @@ class TestReaggregateAllFindingGroupSummaries:
         yesterday = today - timedelta(days=1)
 
         mock_outer_group_result = MagicMock()
-        # The first `group()` call wraps the inner (severity, finding-group)
-        # parallel step; subsequent calls wrap the outer per-scan generator.
+        # The first `group()` call wraps the inner parallel step; subsequent
+        # calls wrap the outer per-scan generator.
         mock_group.side_effect = lambda *args, **kwargs: (
             list(args[0]) if args and hasattr(args[0], "__iter__") else None,
             mock_outer_group_result,
@@ -2420,6 +2426,9 @@ class TestReaggregateAllFindingGroupSummaries:
             mock_scan_summary_task,
             mock_daily_severity_task,
             mock_finding_group_task,
+            mock_resource_group_task,
+            mock_category_task,
+            mock_attack_surface_task,
         ):
             assert task_mock.si.call_count == 3
             dispatched = {
@@ -2433,6 +2442,9 @@ class TestReaggregateAllFindingGroupSummaries:
 
     @patch("tasks.tasks.chain")
     @patch("tasks.tasks.group")
+    @patch("tasks.tasks.aggregate_attack_surface_task")
+    @patch("tasks.tasks.aggregate_scan_category_summaries_task")
+    @patch("tasks.tasks.aggregate_scan_resource_group_summaries_task")
     @patch("tasks.tasks.aggregate_finding_group_summaries_task")
     @patch("tasks.tasks.aggregate_daily_severity_task")
     @patch("tasks.tasks.perform_scan_summary_task")
@@ -2443,6 +2455,9 @@ class TestReaggregateAllFindingGroupSummaries:
         mock_scan_summary_task,
         mock_daily_severity_task,
         mock_finding_group_task,
+        mock_resource_group_task,
+        mock_category_task,
+        mock_attack_surface_task,
         mock_group,
         mock_chain,
     ):
@@ -2481,6 +2496,9 @@ class TestReaggregateAllFindingGroupSummaries:
             mock_scan_summary_task,
             mock_daily_severity_task,
             mock_finding_group_task,
+            mock_resource_group_task,
+            mock_category_task,
+            mock_attack_surface_task,
         ):
             task_mock.si.assert_called_once_with(
                 tenant_id=self.tenant_id, scan_id=str(latest_scan_today)