LWLP-5: Lightwell Network API by etsien · Pull Request #1666 · content-services/content-sources-backend

etsien · 2026-08-24T18:20:20Z

Summary

Implements the Phase 1 v2 API spec for Lightwell endpoints: flat cross-repo and nested repo-scoped aliases for packages, package_versions, and advisories. Adds CVE-based version filtering (resolves/vulnerable), sqlc-generated advisory store, severity-ordered advisory listing, and a CI job to detect sqlc drift.

Testing Steps

make compose-up to start postgres, pulp, and kafka containers.
make db-migrate-up to apply all migrations (including the new advisory severity_order migration).
Run handler unit tests:
go test ./pkg/handler/ -run "LightwellAdvisory|LightwellPackages" -v
Expect 20 PASS (6 advisory, 14 packages).
Run store integration tests (requires live DB from step 1):
go test ./pkg/lightwell/db/store/ -v -count=1
Expect PASS for advisory queries (ListAdvisories, filter by package/severity/repo, CountByRepo, ByCveID, ByPackage) and vulnerability queries.
Optionally seed advisory data and curl the endpoints:

curl localhost:8000/api/content-sources/v1.0/lightwell/advisories
curl localhost:8000/api/content-sources/v1.0/lightwell/repositories/java-remediated/advisories
curl localhost:8000/api/content-sources/v1.0/lightwell/package_versions?resolves_cve_id=CVE-2024-1234

Verify response envelopes contain data, meta, and links fields.

…ns and counts

This reverts commit a71bf04.

dominikvagner

could you rebase this please? (it has a duplicate commit for 2187002 which is in main)

also if possible, could the commits be cleaned up a bit for easier reviewing 🧹
not sure if the work should be split into more commits, or squashed together, don't know your workflow 😅

Add severity_order column to advisories table and duplicate_of to vulnerabilities. Rename the duplicate migration to avoid timestamp collision. Add sqlc queries for listing/counting advisories with filtering and pagination. Extend store_test.go with advisory query coverage.

Add REST handlers for /lightwell/advisories, /lightwell/packages, and /lightwell/package_versions with filtering, pagination, and aggregate counts. Include cross-repo package listing with CVE-based filtering. Add packages_count, versions_count, and remediations_count to the repository response. Full handler test coverage for both endpoints.

…ien/content-sources-backend into LWLP-5-Lightwell-Network-API

etsien · 2026-08-25T16:01:29Z

could you rebase this please? (it has a duplicate commit for 2187002 which is in main)

also if possible, could the commits be cleaned up a bit for easier reviewing 🧹 not sure if the work should be split into more commits, or squashed together, don't know your workflow 😅

yeah just did, sorry, the rebasing was a bit of a mess at first

etsien · 2026-08-25T16:01:49Z

/ok-to-test

xbhouse · 2026-08-25T17:26:51Z

/ok-to-test

Add severity_order column to advisories table and duplicate_of to vulnerabilities. Rename the duplicate migration to avoid timestamp collision. Add sqlc queries for listing/counting advisories with filtering and pagination. Extend store_test.go with advisory query coverage.

Add REST handlers for /lightwell/advisories, /lightwell/packages, and /lightwell/package_versions with filtering, pagination, and aggregate counts. Include cross-repo package listing with CVE-based filtering. Add packages_count, versions_count, and remediations_count to the repository response. Full handler test coverage for both endpoints.

rverdile

A couple small comments. Also this unfortunately needs another rebase. I'm not sure how much of this I can test locally, but I'll test next as well

The 20260827110000 timestamp collided with the upstream 20260827120000_add_lightwell_vulnerability_key migration. CI checks that migrations.latest matches new migration files added by the PR; move to 20260828110000 so it sorts last.

etsien · 2026-09-02T11:27:23Z

fixes implemented

…handle cased text

…twork-API # Conflicts: # db/migrations.latest

etsien · 2026-09-04T09:42:46Z

merged in main and Beacon SPUR changes

The severity_order migration had timestamp 20260828, which predates upstream's 20260902 migration. CI requires migrations.latest to match the PR-added migration timestamp.

rverdile

Overall there is a lot working, two more functional comments!

I can help you set up to test locally if you want help verifying, or I can test it again on my end

…ith severity_score

rverdile

Thanks for the changes, looks good!

TenSt and others added 8 commits August 14, 2026 22:19

LWLP-35: create db schema for clearinghouse ui

ee17fa2

Merge branch 'pr/1635' into LWLP-5-Lightwell-Network-API

e8e00c8

build out phase 1: advisories, packages, repositories, package-versio…

f0048ec

…ns and counts

Merge branch 'main' into LWLP-5-Lightwell-Network-API

212ca7b

Update .gitignore

e990645

v2 of API buildout Phase 1

3373e92

add tests

d18fec3

Create advisories.sql.go

bcdc0d2

etsien requested a review from a team as a code owner August 24, 2026 18:20

etsien changed the title ~~Lwlp 5 lightwell network api~~ LWLP-5: Lightwell Network API Aug 24, 2026

etsien added 9 commits August 24, 2026 14:35

Merge branch 'main' into LWLP-5-Lightwell-Network-API

ec38125

revert docs changes

a71bf04

Revert "revert docs changes"

0d66a2f

This reverts commit a71bf04.

update docs and api

e79f887

re-add tests

8827f3f

update migrations

cc7b447

bugfix

949fedd

Update migrations.latest

9501f5d

Update store_test.go

7e92db7

dominikvagner reviewed Aug 25, 2026

View reviewed changes

etsien added 4 commits August 25, 2026 11:28

LWLP-5: regenerate OpenAPI spec for Lightwell endpoints

d6351b9

Merge branch 'LWLP-5-Lightwell-Network-API' of https://github.com/ets…

5d2ed76

…ien/content-sources-backend into LWLP-5-Lightwell-Network-API

etsien added 3 commits August 25, 2026 14:56

LWLP-5: regenerate OpenAPI spec for Lightwell endpoints

32508fa

Merge branch 'main' into LWLP-5-Lightwell-Network-API

96fb90f

rverdile reviewed Sep 1, 2026

View reviewed changes

Comment thread pkg/dao/repository_configs.go

Comment thread pkg/dao/repository_configs_test.go

Comment thread pkg/handler/repositories.go Outdated

Comment thread .mockery_v3.yml

etsien added 5 commits September 2, 2026 05:06

bring back accidentally removed rebased stuff

7214c79

reuse existing counts, remove redundant fields

2215df8

regenerate docs

2d1bfb4

Merge upstream/main into LWLP-5-Lightwell-Network-API

3c375a4

Create handler-test-patterns.mdc

cfab2a2

rverdile reviewed Sep 2, 2026

View reviewed changes

Comment thread db/migrations/20260828110000_add_lightwell_advisory_severity_order.up.sql Outdated

rverdile reviewed Sep 2, 2026

View reviewed changes

Comment thread pkg/handler/lightwell_advisories.go Outdated

rverdile reviewed Sep 2, 2026

View reviewed changes

Comment thread pkg/handler/lightwell_advisories.go Outdated

etsien mentioned this pull request Sep 2, 2026

LWLP-977: Add purl and coordinates to package versions endpoint #1703

Open

Merge branch 'main' into LWLP-5-Lightwell-Network-API

db7fdff

etsien mentioned this pull request Sep 3, 2026

LWLP-916,LWLP-919,LWLP-920: Beacon SPUR updates #1702

Merged

TenSt reviewed Sep 3, 2026

View reviewed changes

Comment thread pkg/api/lightwell_packages.go

TenSt reviewed Sep 3, 2026

View reviewed changes

Comment thread pkg/api/lightwell_packages.go Outdated

rverdile reviewed Sep 3, 2026

View reviewed changes

Comment thread pkg/handler/lightwell_advisories.go

etsien added 6 commits September 3, 2026 16:44

remove aliased nested path for package search

58421cb

add SeverityOrder to GORM model, update matching of severityOrder to …

00c6cbb

…handle cased text

add entitlement check for advisories endpoint

4333344

rename contentType to ecosystem for user clarity

383930a

Update AGENTS.md

18d7a7c

Merge remote-tracking branch 'upstream/main' into LWLP-5-Lightwell-Ne…

a587c05

…twork-API # Conflicts: # db/migrations.latest

fix: rename migration timestamp to follow upstream ordering

b9c2115

The severity_order migration had timestamp 20260828, which predates upstream's 20260902 migration. CI requires migrations.latest to match the PR-added migration timestamp.

rverdile reviewed Sep 8, 2026

View reviewed changes

Comment thread pkg/handler/lightwell_advisories.go Outdated

Comment thread db/migrations/20260904120000_add_lightwell_advisory_severity_order.up.sql Outdated

address entitlement issue at db query level, replace severity_order w…

09ead23

…ith severity_score

rverdile approved these changes Sep 9, 2026

View reviewed changes

etsien merged commit fcd3106 into content-services:main Sep 9, 2026
20 checks passed

Uh oh!

Conversation

etsien commented Aug 24, 2026

Summary

Testing Steps

Uh oh!

dominikvagner left a comment

Choose a reason for hiding this comment

Uh oh!

etsien commented Aug 25, 2026

Uh oh!

etsien commented Aug 25, 2026

Uh oh!

xbhouse commented Aug 25, 2026

Uh oh!

rverdile left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

etsien commented Sep 2, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

etsien commented Sep 4, 2026

Uh oh!

rverdile left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

rverdile left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants