feat(compliance): add resource metadata tab inside req find (#11187)

api/CHANGELOG.md

@@ -7,6 +7,7 @@ All notable changes to the **Prowler API** are documented in this file.
 ### 🚀 Added
 
 - `okta` provider support [(#11184)](https://github.com/prowler-cloud/prowler/pull/11184)
+- `metadata` field on resources included in finding responses (`?include=resources`), so finding consumers can read the affected resource's metadata without an extra request [(#11187)](https://github.com/prowler-cloud/prowler/pull/11187)
 
 ---
 

api/src/backend/api/tests/test_views.py

@@ -7158,6 +7158,32 @@ class TestFindingViewSet:
             "id"
         ] == str(finding_1.resources.first().id)
 
+    def test_findings_retrieve_include_resource_metadata(
+        self, authenticated_client, findings_fixture
+    ):
+        finding_1, *_ = findings_fixture
+        resource = finding_1.resources.first()
+        resource.metadata = '{"VulnerabilityID": "CVE-2026-0001"}'
+        resource.details = "Python 3.12 base image"
+        resource.save()
+
+        response = authenticated_client.get(
+            reverse("finding-detail", kwargs={"pk": finding_1.id}),
+            {"include": "resources"},
+        )
+        assert response.status_code == status.HTTP_200_OK
+
+        included_resource = next(
+            item
+            for item in response.json()["included"]
+            if item["type"] == "resources" and item["id"] == str(resource.id)
+        )
+        assert (
+            included_resource["attributes"]["metadata"]
+            == '{"VulnerabilityID": "CVE-2026-0001"}'
+        )
+        assert included_resource["attributes"]["details"] == "Python 3.12 base image"
+
     def test_findings_invalid_retrieve(self, authenticated_client):
         response = authenticated_client.get(
             reverse("finding-detail", kwargs={"pk": "random_id"}),

api/src/backend/api/v1/serializers.py

@@ -1397,6 +1397,7 @@ class ResourceIncludeSerializer(RLSSerializer):
             "service",
             "type_",
             "tags",
+            "metadata",
             "details",
             "partition",
         ]
@@ -1404,6 +1405,7 @@ class ResourceIncludeSerializer(RLSSerializer):
             "id": {"read_only": True},
             "inserted_at": {"read_only": True},
             "updated_at": {"read_only": True},
+            "metadata": {"read_only": True},
             "details": {"read_only": True},
             "partition": {"read_only": True},
         }