Merge branch 'utilize_vulnerability_statistics_table_on_graphql_api' into 'master'

Utilize Vulnerabilities::Statistic model for stats on GraphQL API

See merge request gitlab-org/gitlab!38316

ee/app/graphql/ee/types/project_type.rb

@@ -26,11 +26,7 @@ module EE
 
         field :vulnerability_severities_count, ::Types::VulnerabilitySeveritiesCountType, null: true,
                description: 'Counts for each severity of vulnerability of the project',
-               resolve: -> (obj, _args, ctx) do
-                 Hash.new(0).merge(
-                   obj.vulnerabilities.with_states([:detected, :confirmed]).counts_by_severity
-                 )
-               end
+               resolve: -> (obj, *) { obj.vulnerability_statistic || Hash.new(0) }
 
         field :requirement, ::Types::RequirementsManagement::RequirementType, null: true,
               description: 'Find a single requirement. Available only when feature flag `requirements_management` is enabled.',

ee/app/models/vulnerability.rb

@@ -68,7 +68,6 @@ class Vulnerability < ApplicationRecord
   scope :with_severities, -> (severities) { where(severity: severities) }
   scope :with_states, -> (states) { where(state: states) }
   scope :with_scanners, -> (scanners) { joins(findings: :scanner).merge(Vulnerabilities::Scanner.with_external_id(scanners)) }
-  scope :counts_by_severity, -> { group(:severity).count }
 
   class << self
     def parent_class

ee/spec/factories/vulnerabilities/statistics.rb

@@ -4,24 +4,24 @@ FactoryBot.define do
   factory :vulnerability_statistic, class: 'Vulnerabilities::Statistic' do
     project
 
-    trait :a do
+    trait :grade_a do
       info { 1 }
     end
 
-    trait :b do
+    trait :grade_b do
       low { 1 }
     end
 
-    trait :c do
+    trait :grade_c do
       medium { 1 }
     end
 
-    trait :d do
+    trait :grade_d do
       high { 1 }
       unknown { 1 }
     end
 
-    trait :f do
+    trait :grade_f do
       critical { 1 }
     end
   end

ee/spec/models/vulnerabilities/projects_grade_spec.rb

@@ -10,11 +10,11 @@ RSpec.describe Vulnerabilities::ProjectsGrade do
   let_it_be(:project_4) { create(:project, group: group) }
   let_it_be(:project_5) { create(:project, group: group) }
 
-  let_it_be(:vulnerability_statistic_1) { create(:vulnerability_statistic, :a, project: project_1) }
-  let_it_be(:vulnerability_statistic_2) { create(:vulnerability_statistic, :b, project: project_2) }
-  let_it_be(:vulnerability_statistic_3) { create(:vulnerability_statistic, :b, project: project_3) }
-  let_it_be(:vulnerability_statistic_4) { create(:vulnerability_statistic, :c, project: project_4) }
-  let_it_be(:vulnerability_statistic_5) { create(:vulnerability_statistic, :f, project: project_5) }
+  let_it_be(:vulnerability_statistic_1) { create(:vulnerability_statistic, :grade_a, project: project_1) }
+  let_it_be(:vulnerability_statistic_2) { create(:vulnerability_statistic, :grade_b, project: project_2) }
+  let_it_be(:vulnerability_statistic_3) { create(:vulnerability_statistic, :grade_b, project: project_3) }
+  let_it_be(:vulnerability_statistic_4) { create(:vulnerability_statistic, :grade_c, project: project_4) }
+  let_it_be(:vulnerability_statistic_5) { create(:vulnerability_statistic, :grade_f, project: project_5) }
 
   describe '.grades_for' do
     let(:compare_key) { ->(projects_grade) { [projects_grade.grade, projects_grade.project_ids.sort] } }

ee/spec/models/vulnerability_spec.rb

@@ -166,24 +166,6 @@ RSpec.describe Vulnerability do
     end
   end
 
-  describe '.counts_by_severity' do
-    before do
-      create_list(:vulnerability, 2, severity: :critical)
-      create_list(:vulnerability, 3, severity: :high)
-      create(:vulnerability, severity: :low)
-    end
-
-    subject { described_class.counts_by_severity }
-
-    it 'returns the count for each severity' do
-      is_expected.to eq({
-        'critical' => 2,
-        'high' => 3,
-        'low' => 1
-      })
-    end
-  end
-
   describe '.counts_by_day_and_severity' do
     context 'when the vulnerability_history feature flag is disabled' do
       before do

ee/spec/requests/api/graphql/project/vulnerability_severities_count_spec.rb

@@ -5,10 +5,7 @@ require 'spec_helper'
 RSpec.describe 'Query.project(fullPath).vulnerabilitySeveritiesCount' do
   let_it_be(:project) { create(:project) }
   let_it_be(:user) { create(:user) }
-  let_it_be(:confirmed_vulnerability) { create(:vulnerability, :confirmed, :high, project: project) }
-  let_it_be(:detected_vulnerability) { create(:vulnerability, :detected, :high, project: project) }
-  let_it_be(:resolved_vulnerability) { create(:vulnerability, :resolved, :high, project: project) }
-  let_it_be(:dismissed_vulnerabilities) { create(:vulnerability, :dismissed, :high, project: project) }
+  let_it_be(:statistic) { create(:vulnerability_statistic, :grade_d, project: project) }
 
   let_it_be(:query) do
     %(
@@ -33,6 +30,6 @@ RSpec.describe 'Query.project(fullPath).vulnerabilitySeveritiesCount' do
   it "returns counts for each severity of the project's detected or confirmed vulnerabilities" do
     high_count = subject.dig('data', 'project', 'vulnerabilitySeveritiesCount', 'high')
 
-    expect(high_count).to be(2)
+    expect(high_count).to be(statistic.high)
   end
 end