jramos/cve-dashboard
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix owner-lookup hostId fast path — use asset-search owner data directly

Browse Source 
The asset-search response wraps in { assets: [...] } and includes the full
owner record. Previously we tried to extract just an _id from the top level
(which didn't exist) and then made a separate getOwner() call that returned
empty data for IPv6 assets.

Now when hostId resolves via asset-search, we return the owner data directly
from the search response — no second API call needed. This fixes the tooltip
showing empty confirmed/unconfirmed for IPv6-only findings.
This commit is contained in:
Jordan Ramos
2026-06-09 14:03:31 -06:00
parent 10239be83c
commit 32ed65eb79
1 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
backend/routes/cardApi.js
View File

@@ -595,14 +595,28 @@ function createCardApiRouter() {
const hostId = req.query.hostId;
// Fast path: if Ivanti hostId is provided, try asset-search first
// The asset-search returns the full record including owner data, so we can
// return directly without a separate getOwner() call.
let assetId = null;
if (hostId && /^\d+$/.test(hostId)) {
try {
const searchResult = await searchByIvantiHostId(hostId);
if (searchResult.ok) {
const searchData = JSON.parse(searchResult.body);
// Extract asset_id from the search response (_id field or asset_id)
assetId = searchData._id || searchData.asset_id || searchData.id || null;
const assets = searchData.assets || [];
if (assets.length > 0) {
const asset = assets[0];
const owner = asset.owner || {};
return res.json({
asset_id: asset._id || null,
ip: ip.trim(),
confirmed: owner.confirmed || null,
unconfirmed: owner.unconfirmed || null,
declined: owner.declined || [],
candidate: owner.candidate || [],
update_token: owner.update_token || null,
});
}
}
} catch (_) {
// Fall through to suffix resolution