Merge pull request #75 from Emmanuel-Ugochukwu1/feat/audit-detail-page

feat: implement audit detail page with findings view (#32)

Author: Kami-no-san

apps/api/src/modules/audits/audits.controller.ts

@@ -1,4 +1,4 @@
-import { Body, Controller, Get, Param, Post, Query, UseGuards } from '@nestjs/common';
+import { Body, Controller, Get, Param, Patch, Post, Query, UseGuards } from '@nestjs/common';
 import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
 
 import { CurrentUser } from '../../common/decorators/current-user.decorator';
@@ -30,4 +30,14 @@ export class AuditsController {
   findOne(@Param('id') id: string, @CurrentUser('id') userId: string) {
     return this.auditsService.findOne(id, userId);
   }
+
+  @Patch('findings/:id')
+  @ApiOperation({ summary: 'Update finding status' })
+  updateFindingStatus(
+    @Param('id') id: string,
+    @Body() body: { status: string },
+    @CurrentUser('id') userId: string,
+  ) {
+    return this.auditsService.updateFindingStatus(id, body.status, userId);
+  }
 }

apps/api/src/modules/audits/audits.service.ts

@@ -1,4 +1,9 @@
-import { ForbiddenException, Injectable, NotFoundException } from '@nestjs/common';
+import {
+  BadRequestException,
+  ForbiddenException,
+  Injectable,
+  NotFoundException,
+} from '@nestjs/common';
 import { logger } from '@veridion/logger';
 
 import { CacheService } from '../../common/cache/cache.service';
@@ -106,4 +111,30 @@ export class AuditsService {
   private auditCachePrefix(userId: string): string {
     return `audits:${userId}:`;
   }
+
+  async updateFindingStatus(findingId: string, status: string, userId: string) {
+    const validStatuses = ['OPEN', 'ACKNOWLEDGED', 'FALSE_POSITIVE', 'RESOLVED'];
+    if (!validStatuses.includes(status)) {
+      throw new BadRequestException(`Invalid status. Must be one of: ${validStatuses.join(', ')}`);
+    }
+
+    const finding = await this.prisma.db.auditFinding.findUnique({
+      where: { id: findingId },
+      include: { audit: { include: { project: { select: { userId: true } } } } },
+    });
+
+    if (!finding) throw new NotFoundException('Finding not found');
+    if (finding.audit.project.userId !== userId) {
+      throw new ForbiddenException('Access denied');
+    }
+
+    const updated = await this.prisma.db.auditFinding.update({
+      where: { id: findingId },
+      data: { status },
+    });
+
+    logger.info({ findingId, status, userId }, 'Finding status updated');
+
+    return updated;
+  }
 }