feat: Improve dashboard

Author: dadav

CLAUDE.md

@@ -139,7 +139,10 @@ Access control rules:
 - Prioritized CVEs must always sort to the top in `/cves`, regardless of selected sort column.
 - Dashboard chart datasets must apply the same visibility logic as `stat_total_cves`.
 - Severity distribution must classify each visible CVE exactly once so the bucket sum matches `stat_total_cves`.
-- Dashboard payload includes both `priority_cves` and `high_epss_cves`.
+- Dashboard payload includes both `priority_cves` and `high_epss_cves`, plus `fix_first_cves` (ranked actionable list) and `cve_history` (real per-day totals).
+- `stat_open_risk_acceptances` is scoped: sec team sees the global `requested` count; regular users only count RAs they can access (`user_can_access_ra`), so the stat matches the `/risk-acceptances?status=requested` list.
+- The `cve_history` trend is sourced from the `cve_snapshots` table, filled by the daily `cve_snapshot` scheduler job (runs in the single `worker` process only). The `'*'`/`'*'` rows are org-wide counts deduplicated across namespaces; per-namespace rows may count a CVE once per namespace. `count_visible` applies CVSS/EPSS thresholds (always-show CVEs bypass), `count_total` does not.
+- `mttr_by_severity` is a sec-team-only audit metric; the endpoint returns an empty list for non-sec-team users.
 
 ### CVE detail and workflow rules
 

backend/alembic/versions/019_add_cve_snapshots.py

@@ -0,0 +1,35 @@
+"""Add cve_snapshots table for dashboard history chart
+
+Revision ID: 019
+Revises: 018
+Create Date: 2026-07-04 00:00:00.000000
+"""
+
+import sqlalchemy as sa
+
+from alembic import op
+
+revision = "019"
+down_revision = "018"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "cve_snapshots",
+        sa.Column("id", sa.Integer(), primary_key=True, autoincrement=True),
+        sa.Column("snapshot_date", sa.Date(), nullable=False),
+        sa.Column("cluster_name", sa.String(255), nullable=False),
+        sa.Column("namespace", sa.String(255), nullable=False),
+        sa.Column("severity", sa.Integer(), nullable=False),
+        sa.Column("count_total", sa.Integer(), nullable=False, server_default="0"),
+        sa.Column("count_visible", sa.Integer(), nullable=False, server_default="0"),
+        sa.UniqueConstraint("snapshot_date", "cluster_name", "namespace", "severity", name="uq_cve_snapshot"),
+    )
+    op.create_index("ix_cve_snapshots_snapshot_date", "cve_snapshots", ["snapshot_date"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_cve_snapshots_snapshot_date", table_name="cve_snapshots")
+    op.drop_table("cve_snapshots")

backend/app/models/__init__.py

@@ -2,6 +2,7 @@
 from .badge import BadgeToken
 from .cve_comment import CveComment
 from .cve_priority import CvePriority, PriorityLevel
+from .cve_snapshot import CveSnapshot
 from .escalation import Escalation
 from .global_settings import GlobalSettings
 from .namespace_contact import NamespaceContact
@@ -20,6 +21,7 @@
     "CveComment",
     "CvePriority",
     "PriorityLevel",
+    "CveSnapshot",
     "GlobalSettings",
     "Escalation",
     "BadgeToken",

backend/app/models/cve_snapshot.py

@@ -0,0 +1,29 @@
+from datetime import date
+
+from sqlalchemy import Date, Integer, String, UniqueConstraint
+from sqlalchemy.orm import Mapped, mapped_column
+
+from ..database import Base
+
+
+class CveSnapshot(Base):
+    """Daily CVE counts per (cluster, namespace, severity) for the dashboard history chart.
+
+    The special row cluster_name='*' / namespace='*' holds org-wide counts
+    deduplicated across namespaces (a CVE in 3 namespaces counts once there).
+    count_total: all unsuppressed CVEs. count_visible: additionally filtered by the
+    global CVSS/EPSS thresholds at snapshot time (always-show CVEs bypass them).
+    """
+
+    __tablename__ = "cve_snapshots"
+    __table_args__ = (
+        UniqueConstraint("snapshot_date", "cluster_name", "namespace", "severity", name="uq_cve_snapshot"),
+    )
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
+    snapshot_date: Mapped[date] = mapped_column(Date, nullable=False, index=True)
+    cluster_name: Mapped[str] = mapped_column(String(255), nullable=False)
+    namespace: Mapped[str] = mapped_column(String(255), nullable=False)
+    severity: Mapped[int] = mapped_column(Integer, nullable=False)
+    count_total: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+    count_visible: Mapped[int] = mapped_column(Integer, nullable=False, default=0)

backend/app/routers/dashboard.py

@@ -19,11 +19,11 @@
     AgingBucket,
     ClusterHeatmapRow,
     ComponentCveCount,
+    CveHistoryPoint,
     CveTrendPoint,
     DashboardData,
     EpssMatrixPoint,
     FixabilityCount,
-    FixableTrendPoint,
     MttrSeverity,
     NamespaceCveCount,
     RiskAcceptancePipeline,
@@ -34,6 +34,7 @@
     compute_suppression_sets,
 )
 from ..services.escalation_preview import compute_upcoming_escalations
+from ..services.risk_acceptance_service import user_can_access_ra
 from ..stackrox import queries as sx
 from ._scope import narrow_namespaces
 
@@ -238,22 +239,47 @@ async def _sx_fixability_breakdown(
         )
 
 
-async def _sx_fixable_trend(
-    ns: list[tuple[str, str]] | None,
-    min_cvss: float,
-    min_epss: float,
-    always_show: set[str],
-    exclude: set[str],
-) -> list[dict]:
-    async with _stackrox_semaphore, StackRoxSessionLocal() as db:
-        return await sx.get_fixable_trend(
-            db,
-            ns,
-            min_cvss=min_cvss,
-            min_epss=min_epss,
-            always_show_cve_ids=always_show,
-            exclude_cve_ids=exclude,
-        )
+async def _cve_history(
+    ns_list: list[tuple[str, str]] | None,
+    use_visible_counts: bool,
+    days: int = 90,
+) -> list[CveHistoryPoint]:
+    """Aggregate stored snapshots into a per-day severity series.
+
+    ns_list None => use the org-wide '*' rows (exact, deduped across namespaces).
+    Otherwise sum the user's namespace rows (a CVE present in several visible
+    namespaces counts once per namespace, same semantics as NamespaceBreakdown).
+    """
+    from collections import defaultdict
+
+    from ..models.cve_snapshot import CveSnapshot
+
+    since = datetime.now(UTC).date() - timedelta(days=days)
+    async with AppSessionLocal() as db:
+        q = select(
+            CveSnapshot.snapshot_date,
+            CveSnapshot.severity,
+            func.sum(CveSnapshot.count_visible if use_visible_counts else CveSnapshot.count_total),
+        ).where(CveSnapshot.snapshot_date >= since)
+        if ns_list is None:
+            q = q.where(CveSnapshot.namespace == "*")
+        else:
+            q = q.where(
+                CveSnapshot.namespace != "*",
+                tuple_(CveSnapshot.namespace, CveSnapshot.cluster_name).in_(ns_list),
+            )
+        q = q.group_by(CveSnapshot.snapshot_date, CveSnapshot.severity)
+        rows = (await db.execute(q)).all()
+
+    by_date: dict = defaultdict(lambda: {"critical": 0, "important": 0, "moderate": 0, "low": 0, "unknown": 0})
+    sev_key = {4: "critical", 3: "important", 2: "moderate", 1: "low", 0: "unknown"}
+    for snapshot_date, severity, count in rows:
+        by_date[snapshot_date][sev_key.get(severity, "unknown")] += int(count or 0)
+    return [CveHistoryPoint(date=str(d), **v) for d, v in sorted(by_date.items())]
+
+
+async def _empty_mttr() -> list[MttrSeverity]:
+    return []
 
 
 async def _upcoming_escalations(
@@ -403,8 +429,9 @@ async def dashboard(
                 top_vulnerable_components=[],
                 risk_acceptance_pipeline=RiskAcceptancePipeline(requested=0, approved=0, rejected=0, expired=0),
                 fixability_breakdown=FixabilityCount(fixable=0, unfixable=0),
-                fixable_trend=[],
+                cve_history=[],
                 mttr_by_severity=[],
+                fix_first_cves=[],
             )
         namespaces = narrow_namespaces(current_user.namespaces, cluster, namespace)
 
@@ -474,12 +501,16 @@ async def dashboard(
             escalations_result = await app_db.execute(select(func.count(Escalation.id)))
     escalations = escalations_result.scalar() or 0
 
-    open_ra_result = await app_db.execute(
-        select(func.count(RiskAcceptance.id)).where(
-            RiskAcceptance.status == RiskStatus.requested,
+    # Open risk acceptances: sec team sees the global count; regular users only
+    # count RAs they can actually see in the /risk-acceptances list.
+    if current_user.is_sec_team:
+        open_ra_result = await app_db.execute(
+            select(func.count(RiskAcceptance.id)).where(RiskAcceptance.status == RiskStatus.requested)
         )
-    )
-    open_ra = open_ra_result.scalar() or 0
+        open_ra = open_ra_result.scalar() or 0
+    else:
+        open_ra_rows = await app_db.execute(select(RiskAcceptance).where(RiskAcceptance.status == RiskStatus.requested))
+        open_ra = sum(1 for ra in open_ra_rows.scalars().all() if user_can_access_ra(current_user, ra))
 
     # Run all chart queries + upcoming escalations + RA pipeline concurrently
     upcoming_ns = namespaces if (has_scope or not current_user.can_see_all_namespaces) else []
@@ -492,7 +523,7 @@ async def dashboard(
         aging_rows,
         top_components_rows,
         fixability_data,
-        fixable_trend_rows,
+        cve_history_data,
         upcoming_escalations,
         risk_acceptance_pipeline,
         mttr_data,
@@ -505,10 +536,10 @@ async def dashboard(
         _sx_cve_aging(ns_list_for_queries, min_cvss, min_epss, always_show, suppressed_cve_ids),
         _sx_top_vulnerable_components(ns_list_for_queries, min_cvss, min_epss, always_show, suppressed_cve_ids),
         _sx_fixability_breakdown(ns_list_for_queries, min_cvss, min_epss, always_show, suppressed_cve_ids),
-        _sx_fixable_trend(ns_list_for_queries, min_cvss, min_epss, always_show, suppressed_cve_ids),
+        _cve_history(ns_list_for_queries, use_visible_counts=not current_user.is_sec_team),
         _upcoming_escalations(upcoming_ns, settings),
         _ra_pipeline(),
-        _mttr_by_severity(ns_list_for_queries),
+        _mttr_by_severity(ns_list_for_queries) if current_user.is_sec_team else _empty_mttr(),
     )
 
     epss_matrix = [
@@ -550,6 +581,19 @@ async def dashboard(
         ),
     )[:8]
 
+    # "Fix first" ranking for ops teams: actionable CVEs ordered by
+    # sec-team priority, then fixability, then exploitation probability, then
+    # severity. Fixable CVEs rank above unfixable ones; risk-accepted CVEs are excluded.
+    fix_first = sorted(
+        (item for item in unique_items if not item.has_risk_acceptance),
+        key=lambda x: (
+            not x.has_priority,
+            not x.fixable,
+            -x.epss_probability,
+            -x.severity.value,
+        ),
+    )[:10]
+
     return DashboardData(
         stat_total_cves=total,
         stat_escalations=escalations,
@@ -594,9 +638,7 @@ async def dashboard(
         top_vulnerable_components=top_vulnerable_components,
         risk_acceptance_pipeline=risk_acceptance_pipeline,
         fixability_breakdown=FixabilityCount(**fixability_data),
-        fixable_trend=[
-            FixableTrendPoint(date=r["date"], fixable=r["fixable"], unfixable=r["unfixable"])
-            for r in fixable_trend_rows
-        ],
+        cve_history=cve_history_data,
         mttr_by_severity=mttr_data,
+        fix_first_cves=fix_first,
     )

backend/app/routers/risk_acceptances.py

@@ -22,15 +22,23 @@
     RiskAcceptanceResponse,
     RiskAcceptanceReview,
     RiskAcceptanceUpdate,
-    RiskScope,
 )
 from ..services.audit_service import log_action
+from ..services.risk_acceptance_service import (
+    get_scope_namespaces as _get_scope_namespaces,
+)
 from ..services.risk_acceptance_service import (
     is_single_team_scope as _is_single_team_scope,
 )
+from ..services.risk_acceptance_service import (
+    normalize_scope as _normalize_scope,
+)
 from ..services.risk_acceptance_service import (
     scope_key as _scope_key,
 )
+from ..services.risk_acceptance_service import (
+    user_can_access_ra as _user_can_access_ra,
+)
 from ..services.risk_acceptance_service import (
     validate_and_resolve_scope as _validate_and_resolve_scope,
 )
@@ -53,35 +61,6 @@ async def _effective_namespaces(user: CurrentUser, sx_db: AsyncSession) -> list[
     return user.namespaces
 
 
-def _normalize_scope(scope: dict) -> RiskScope:
-    if isinstance(scope, dict) and "mode" in scope and "targets" in scope:
-        return RiskScope.model_validate(scope)
-    # Legacy records used {} or {images, namespaces}. Treat missing mode as global.
-    return RiskScope(mode="all", targets=[])
-
-
-def _get_scope_namespaces(scope: dict) -> set[tuple[str, str]]:
-    """Extract (namespace, cluster_name) pairs from a risk acceptance scope."""
-    ns_scope = _normalize_scope(scope)
-    if ns_scope.mode == "all":
-        return set()
-    return {(t.namespace, t.cluster_name) for t in ns_scope.targets}
-
-
-def _user_can_access_ra(user: CurrentUser, ra: RiskAcceptance) -> bool:
-    """Check if user can access a risk acceptance based on namespace overlap."""
-    if user.can_see_all_namespaces:
-        return True
-    if ra.created_by == user.id:
-        return True
-    scope_ns = _get_scope_namespaces(ra.scope)
-    if not scope_ns:
-        # 'all' scope — accessible to anyone with any namespace
-        return user.has_namespaces
-    user_ns = set(user.namespaces)
-    return bool(scope_ns & user_ns)
-
-
 def _build_response(ra: RiskAcceptance, comment_count: int) -> RiskAcceptanceResponse:
     return RiskAcceptanceResponse(
         id=ra.id,

backend/app/schemas/dashboard.py

@@ -74,10 +74,13 @@ class FixabilityCount(BaseModel):
     unfixable: int
 
 
-class FixableTrendPoint(BaseModel):
+class CveHistoryPoint(BaseModel):
     date: str  # YYYY-MM-DD
-    fixable: int
-    unfixable: int
+    critical: int = 0
+    important: int = 0
+    moderate: int = 0
+    low: int = 0
+    unknown: int = 0
 
 
 class ThresholdPreview(BaseModel):
@@ -107,5 +110,6 @@ class DashboardData(BaseModel):
     top_vulnerable_components: list[ComponentCveCount]
     risk_acceptance_pipeline: RiskAcceptancePipeline
     fixability_breakdown: FixabilityCount
-    fixable_trend: list[FixableTrendPoint]
+    cve_history: list[CveHistoryPoint]
     mttr_by_severity: list[MttrSeverity]
+    fix_first_cves: list[CveListItem]