Update state sorting to generic keyset pagination

This change alters the Vulnerabilities state sort scopes in order to
use the generic keyset pagination library.

ee/app/models/ee/vulnerability.rb

@@ -115,8 +115,14 @@ module EE
       scope :order_created_at_desc, -> { reorder(created_at: :desc, id: :desc) }
       scope :order_report_type_asc, -> { select(*arel.projections, report_type_order.as('case_order_value')).reorder(report_type_order.asc, id: :desc) }
       scope :order_report_type_desc, -> { select(*arel.projections, report_type_order.as('case_order_value')).reorder(report_type_order.desc, id: :desc) }
-      scope :order_state_asc, -> { select(*arel.projections, state_order.as('array_position')).reorder(state_order.asc, id: :desc) }
-      scope :order_state_desc, -> { select(*arel.projections, state_order.as('array_position')).reorder(state_order.desc, id: :desc) }
+      scope :order_state_asc, -> do
+        order = with_state_order(:asc)
+        order.apply_cursor_conditions(self).reorder(order)
+      end
+      scope :order_state_desc, -> do
+        order = with_state_order(:desc)
+        order.apply_cursor_conditions(self).reorder(order)
+      end
       scope :order_id_desc, -> { reorder(id: :desc) }
 
       scope :with_limit, -> (maximum) { limit(maximum) }
@@ -278,6 +284,27 @@ module EE
           order_severity_desc
         end
       end
+
+      def with_state_order(direction)
+        raise "unknown sort direction given: #{direction}" unless %i[asc desc].include?(direction)
+
+        ::Gitlab::Pagination::Keyset::Order.build([
+          ::Gitlab::Pagination::Keyset::ColumnOrderDefinition.new(
+            attribute_name: 'array_position',
+            order_expression: state_order.public_send(direction), # rubocop: disable GitlabSecurity/PublicSend
+            nullable: :not_nullable,
+            order_direction: direction,
+            distinct: false,
+            add_to_projections: true
+          ),
+          ::Gitlab::Pagination::Keyset::ColumnOrderDefinition.new(
+            attribute_name: 'id',
+            order_expression: arel_table[:id].public_send(direction), # rubocop: disable GitlabSecurity/PublicSend
+            nullable: :not_nullable,
+            distinct: true
+          )
+        ])
+      end
     end
   end
 end

ee/spec/requests/api/graphql/vulnerabilities/sort_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Query.vulnerabilities.sort' do
+  include GraphqlHelpers
+
+  let_it_be(:project) { create(:project) }
+  let_it_be(:current_user) { create(:user, security_dashboard_projects: [project]) }
+  let_it_be(:data_path) { %w[vulnerabilities] }
+
+  let_it_be(:vulnerability_confirmed1) { create(:vulnerability, :confirmed, project: project) }
+  let_it_be(:vulnerability_confirmed2) { create(:vulnerability, :confirmed, project: project) }
+  let_it_be(:vulnerability_detected1) { create(:vulnerability, :detected, project: project) }
+  let_it_be(:vulnerability_dismissed1) { create(:vulnerability, :dismissed, project: project) }
+  let_it_be(:vulnerability_resolved1) { create(:vulnerability, :resolved, project: project) }
+  let_it_be(:vulnerability_detected2) { create(:vulnerability, :detected, project: project) }
+
+  before do
+    project.add_developer(current_user)
+    stub_licensed_features(security_dashboard: true)
+  end
+
+  def pagination_query(params)
+    graphql_query_for(
+      :vulnerabilities,
+      params.merge({ projectId: project.id }),
+      "#{page_info} nodes { id }"
+    )
+  end
+
+  [true, false].each do |flag_enabled|
+    context "when the new_graphql_keyset_pagination FF state #{flag_enabled}" do
+      before do
+        stub_feature_flags(new_graphql_keyset_pagination: flag_enabled)
+      end
+
+      context 'sort by STATE_ASC' do
+        it_behaves_like 'sorted paginated query' do
+          let(:sort_param) { :state_asc }
+          let(:first_param) { 2 }
+          let(:all_records) do
+            [
+              vulnerability_detected1,
+              vulnerability_detected2,
+              vulnerability_confirmed1,
+              vulnerability_confirmed2,
+              vulnerability_resolved1,
+              vulnerability_dismissed1
+            ].map(&:to_gid).map(&:to_s)
+          end
+        end
+      end
+
+      context 'sort by STATE_ASC' do
+        it_behaves_like 'sorted paginated query' do
+          let(:sort_param) { :state_desc }
+          let(:first_param) { 2 }
+          let(:all_records) do
+            [
+              vulnerability_dismissed1,
+              vulnerability_resolved1,
+              vulnerability_confirmed2,
+              vulnerability_confirmed1,
+              vulnerability_detected2,
+              vulnerability_detected1
+            ].map(&:to_gid).map(&:to_s)
+          end
+        end
+      end
+    end
+  end
+end