From ceea328fae554a8724d61bd2a47f4b9bbde4d414 Mon Sep 17 00:00:00 2001
From: Oliver Kieselbach <oliver.kieselbach@outlook.com>
Date: Sun, 29 Mar 2026 13:09:12 +0200
Subject: [PATCH] vul report rescan bugfix

---
 .../AutopilotMonitor.Agent/buildcounter.txt   |  2 +-
 .../GetVulnerabilityReportFunction.cs         | 25 ++++++++++++++++---
 .../[sessionId]/hooks/useSessionAnalysis.ts   | 17 +++++--------
 3 files changed, 29 insertions(+), 15 deletions(-)

diff --git a/src/Agent/AutopilotMonitor.Agent/buildcounter.txt b/src/Agent/AutopilotMonitor.Agent/buildcounter.txt
index 0dba26ea..72295df7 100644
--- a/src/Agent/AutopilotMonitor.Agent/buildcounter.txt
+++ b/src/Agent/AutopilotMonitor.Agent/buildcounter.txt
@@ -1 +1 @@
-680
+681
diff --git a/src/Backend/AutopilotMonitor.Functions/Functions/Vulnerability/GetVulnerabilityReportFunction.cs b/src/Backend/AutopilotMonitor.Functions/Functions/Vulnerability/GetVulnerabilityReportFunction.cs
index 6cfbe8bb..9aa1ea01 100644
--- a/src/Backend/AutopilotMonitor.Functions/Functions/Vulnerability/GetVulnerabilityReportFunction.cs
+++ b/src/Backend/AutopilotMonitor.Functions/Functions/Vulnerability/GetVulnerabilityReportFunction.cs
@@ -80,7 +80,7 @@ namespace AutopilotMonitor.Functions.Functions.Vulnerability
                     if (inventoryItems.Count == 0)
                     {
                         var noInventory = req.CreateResponse(HttpStatusCode.OK);
-                        await noInventory.WriteAsJsonAsync(new { success = true, sessionId, report = (object?)null, message = "No software inventory events found for this session" });
+                        await noInventory.WriteAsJsonAsync(new { success = true, sessionId, report = (object?)null, rescanned = true, message = "No software inventory events found for this session" });
                         return noInventory;
                     }
 
@@ -163,8 +163,27 @@ namespace AutopilotMonitor.Functions.Functions.Vulnerability
                     var triggeredAt = evt.Data.ContainsKey("triggered_at") ? evt.Data["triggered_at"]?.ToString() : null;
                     if (triggeredAt != "shutdown") continue;
 
-                    // Extract inventory array
-                    if (evt.Data.ContainsKey("inventory") && evt.Data["inventory"] is Newtonsoft.Json.Linq.JArray inventoryArray)
+                    if (!evt.Data.ContainsKey("inventory")) continue;
+
+                    var inventoryData = evt.Data["inventory"];
+
+                    // DeserializeEventData converts JArrays to List<object> via ConvertJTokenToNative,
+                    // so handle both the native List<object> case and the raw JArray case.
+                    if (inventoryData is IList<object> nativeList)
+                    {
+                        foreach (var entry in nativeList)
+                        {
+                            if (entry is Dictionary<string, object> dict)
+                            {
+                                items.Add(dict);
+                            }
+                            else if (entry is IDictionary<string, object> idict)
+                            {
+                                items.Add(new Dictionary<string, object>(idict));
+                            }
+                        }
+                    }
+                    else if (inventoryData is Newtonsoft.Json.Linq.JArray inventoryArray)
                     {
                         foreach (var item in inventoryArray)
                         {
diff --git a/src/Web/autopilot-monitor-web/app/sessions/[sessionId]/hooks/useSessionAnalysis.ts b/src/Web/autopilot-monitor-web/app/sessions/[sessionId]/hooks/useSessionAnalysis.ts
index e3c7722a..839592d5 100644
--- a/src/Web/autopilot-monitor-web/app/sessions/[sessionId]/hooks/useSessionAnalysis.ts
+++ b/src/Web/autopilot-monitor-web/app/sessions/[sessionId]/hooks/useSessionAnalysis.ts
@@ -38,23 +38,18 @@ export function useSessionAnalysis(
   }, [sessionId, sessionTenantId, getAccessToken]);
 
   const fetchVulnerabilityReport = useCallback(async (rescan = false) => {
-    if (!sessionTenantId || !GUID_REGEX.test(sessionTenantId)) {
-      console.warn("[VulnReport] Skipped fetch: sessionTenantId missing or invalid", { sessionTenantId, rescan });
-      return;
-    }
-    const url = api.sessions.vulnerabilityReport(sessionId, sessionTenantId, rescan || undefined);
-    console.info(`[VulnReport] Fetching: rescan=${rescan}, url=${url}`);
+    if (!sessionTenantId || !GUID_REGEX.test(sessionTenantId)) return;
     try {
-      const response = await authenticatedFetch(url, getAccessToken);
+      const response = await authenticatedFetch(
+        api.sessions.vulnerabilityReport(sessionId, sessionTenantId, rescan || undefined),
+        getAccessToken
+      );
       if (response.ok) {
         const data = await response.json();
-        console.info(`[VulnReport] Response OK: rescan=${rescan}, hasReport=${data.report != null}, rescanned=${data.rescanned ?? false}`);
         setVulnerabilityReport(data.report ?? null);
-      } else {
-        console.warn(`[VulnReport] Response not OK: status=${response.status}, rescan=${rescan}`);
       }
     } catch (error) {
-      console.error("[VulnReport] Failed to fetch vulnerability report:", error);
+      console.error("Failed to fetch vulnerability report:", error);
     }
   }, [sessionId, sessionTenantId, getAccessToken]);