Feature 7559: Include 3rd party severity scores in the vulnerability web-hook payload (#7581)

Premium users should receive vulnerability scores as part of the web-hook payload.

ee/server/webhooks/mapper.go

@@ -0,0 +1,33 @@
+package webhooks
+
+import (
+	"net/url"
+
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	fleetwebhooks "github.com/fleetdm/fleet/v4/server/webhooks"
+)
+
+type Mapper struct {
+	fleetwebhooks.Mapper
+}
+
+func NewMapper() fleetwebhooks.VulnMapper {
+	return &Mapper{}
+}
+
+func (m *Mapper) GetPayload(
+	hostBaseURL *url.URL,
+	hosts []*fleet.HostShort,
+	vuln fleet.SoftwareVulnerability,
+	meta fleet.CVEMeta,
+) fleetwebhooks.WebhookPayload {
+	r := m.Mapper.GetPayload(hostBaseURL,
+		hosts,
+		vuln,
+		meta,
+	)
+	r.EPSSProbability = meta.EPSSProbability
+	r.CVSSScore = meta.CVSSScore
+	r.CISAKnownExploit = meta.CISAKnownExploit
+	return r
+}

ee/server/webhooks/mapper_test.go

@@ -0,0 +1,33 @@
+package webhooks
+
+import (
+	"net/url"
+	"testing"
+
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/ptr"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetPayload(t *testing.T) {
+	serverURL, err := url.Parse("http://mywebsite.com")
+	require.NoError(t, err)
+
+	vuln := fleet.SoftwareVulnerability{
+		CVE:        "cve-1",
+		SoftwareID: 1,
+	}
+	meta := fleet.CVEMeta{
+		CVE:              "cve-1",
+		CVSSScore:        ptr.Float64(1),
+		EPSSProbability:  ptr.Float64(0.5),
+		CISAKnownExploit: ptr.Bool(true),
+	}
+
+	sut := Mapper{}
+
+	result := sut.GetPayload(serverURL, nil, vuln, meta)
+	require.Equal(t, *meta.CISAKnownExploit, *result.CISAKnownExploit)
+	require.Equal(t, *meta.EPSSProbability, *result.EPSSProbability)
+	require.Equal(t, *meta.CVSSScore, *result.CVSSScore)
+}