[osmontero]

fixbackend+frontend: applying a note no longer removes a source from its group (#2967)

Problem

In Data Sources → Sources, clicking the pencil (Note) icon and "Apply note"
silently removed the source from its group:

• the source no longer appeared under its group, and the group's member count
  dropped;
• new alerts from that source lost assetGroupId/assetGroupName, so they
  dropped out of the Datasource Group filter in Threat Management.

The note itself was saved — the group membership was collateral damage.

Root cause

assets-apply-note.component.ts (and asset-edit-alias.component.ts) called
utmNetScanService.update(asset) — the whole-entity PUT /api/utm-network-scans.
The asset was the row from search-by-filters, a NetworkScanDTO. That DTO
carries the group/type only as read-only objects (group, assetType), not
the persisted groupId / assetTypeId columns (the entity maps them with
insertable = false, updatable = false). The endpoint deserializes the body
straight into the UtmNetworkScan entity and save()s it, so the missing ids
were persisted as NULL → the group was wiped.

Any row action that sends the list row to that endpoint would clobber the same
columns — this is why the fix introduces dedicated single-field endpoints rather
than patching the DTO.

Fix

Backend — new field-scoped endpoints (mirroring the existing, safe
updateGroup / updateType), so only the intended column changes:

• PUT /api/utm-network-scans/updateNotes → UPDATE ... SET asset_notes = :v WHERE id IN :ids
• PUT /api/utm-network-scans/updateAlias → UPDATE ... SET asset_alias = :v WHERE id IN :ids
• Both mirror the existing updateGroup/updateType: a missing id is a
  no-op (the @Modifying query matches nothing), no extra existence check.
• New repository @Modifying queries + service methods (updateNotes,
  updateAlias).

Frontend — assets-apply-note now calls updateNotes({value, assetsIds:[id]})
and asset-edit-alias now calls updateAlias({value, assetsIds:[id]}). Both
previously sent the full row to the entity PUT.

Tests

Backend compiles clean (Maven, Java 17). No new JUnit test: the change is two
@Modifying JPQL statements + a thin controller, verified by compile and by the
frontend pointing at the new endpoints. (A repository-integration test would need
a live DB, which this module's harness does not spin up.)

Files

• backend/.../repository/network_scan/UtmNetworkScanRepository.java
• backend/.../service/network_scan/UtmNetworkScanService.java
• backend/.../web/rest/network_scan/UtmNetworkScanResource.java
• frontend/.../assets-discover/shared/services/utm-net-scan.service.ts
• frontend/.../assets-discover/shared/components/assets-apply-note/assets-apply-note.component.ts
• frontend/.../assets-discover/shared/components/asset-edit-alias/asset-edit-alias.component.ts

Fixes #2967

[github-actions]

❌ Go dependencies check failed

There are outdated Go dependencies, or modules that could not be inspected.
Run bash .github/scripts/go-deps.sh --update --discover locally and
commit the updated go.mod / go.sum files.

Script output

🔍 Discovered 25 Go projects

📦 Dependencies with updates available:

  📁 ./plugins/gcp:
     - google.golang.org/api: v0.299.0 → v0.308.0

  📁 ./plugins/aws:
     - github.com/aws/aws-sdk-go-v2: v1.47.0 → v1.47.4
     - github.com/aws/aws-sdk-go-v2/config: v1.33.5 → v1.33.10
     - github.com/aws/aws-sdk-go-v2/credentials: v1.20.5 → v1.20.10
     - github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs: v1.88.0 → v1.90.2

  📁 ./plugins/alerts:
     - github.com/tidwall/gjson: v1.19.0 → v1.20.0

  📁 ./plugins/events:
     - github.com/tidwall/gjson: v1.19.0 → v1.20.0

  📁 ./plugins/modules-config:
     - github.com/Azure/azure-sdk-for-go/sdk/storage/azblob: v1.8.1 → v1.8.2
     - github.com/aws/aws-sdk-go-v2/config: v1.33.5 → v1.33.10
     - github.com/aws/aws-sdk-go-v2/credentials: v1.20.5 → v1.20.10
     - github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs: v1.88.0 → v1.90.2
     - github.com/aws/aws-sdk-go-v2/service/sts: v1.51.0 → v1.51.5
     - github.com/crowdstrike/gofalcon: v0.22.0 → v0.23.0
     - golang.org/x/sync: v0.23.0 → v0.24.0
     - google.golang.org/api: v0.299.0 → v0.308.0

  📁 ./plugins/azure:
     - github.com/Azure/azure-sdk-for-go/sdk/azcore: v1.23.1 → v1.23.3
     - github.com/Azure/azure-sdk-for-go/sdk/storage/azblob: v1.8.1 → v1.8.2

  📁 ./plugins/crowdstrike:
     - github.com/crowdstrike/gofalcon: v0.22.0 → v0.23.0

  📁 ./plugins/geolocation:
     - github.com/tidwall/gjson: v1.19.0 → v1.20.0

  📁 ./installer:
     - github.com/cloudfoundry/gosigar: v1.3.127 → v1.3.128

  📁 ./agent:
     - github.com/netsampler/goflow2: v1.3.7 → v1.3.8
     - golang.org/x/sys: v0.48.0 → v0.49.0

�[0;31m❌ Please update dependencies before merging.�[0m

[github-actions]

✅ AI review — Approved with warnings

Only minor (medium/low) issues were found. They won't block the merge, but consider addressing them.

⚠️ architecture (silas-1.7-pro) — non-blocking warnings

Summary: Adds field-specific endpoints to avoid whole-entity NULL overwrites; no agent/migration/proto impact, but introduces duplicated contract and update logic.

• medium backend/src/main/java/com/park/utmstack/web/rest/network_scan/UtmNetworkScanResource.java:131 — New updateNotes/updateAlias endpoints duplicate the updateGroup pattern; consider one generic field-update or partial-update contract to avoid endpoint proliferation and keep client behavior consistent.
• low backend/src/main/java/com/park/utmstack/service/network_scan/UtmNetworkScanService.java:132 — updateNotes/updateAlias repeat the same validation and exception wrapping; extract a shared single-field update service method or helper.
• low backend/src/main/java/com/park/utmstack/repository/network_scan/UtmNetworkScanRepository.java:106 — Bulk @Modifying JPQL updates may require an active transaction; ensure the calling service is @transactional or that repository methods are annotated to avoid inconsistent writes.

⚠️ bugs (silas-1.7-pro) — non-blocking warnings

Summary: No blocking defects found; warnings for nullable value clearing target field, assetsIds key typo, and exception cause loss.

• medium backend/src/main/java/com/park/utmstack/web/rest/network_scan/UtmNetworkScanResource.java:379 — The value field in UpdateFieldRequestBody is not validated as non-null/non-blank. A request such as PUT /utm-network-scans/updateNotes with body {"assetsIds":[1]} will set assetNotes to NULL and return 200, which may silently erase notes/alias. Add @NotNull/@notblank or explicitly handle null if clearing is intended.
• low backend/src/main/java/com/park/utmstack/web/rest/network_scan/UtmNetworkScanResource.java:377 — The JSON key assetsIds appears to be a typo/copy-paste residue for assetIds, matching the service/repository parameter names. Rename it consistently to avoid future client lookup mismatches.
• low backend/src/main/java/com/park/utmstack/service/network_scan/UtmNetworkScanService.java:144 — Exceptions are rethrown as new Exception(ctx + ": " + e.getMessage()) without preserving the original cause or stack trace. If e.getMessage() is null, diagnostic details are lost. Use new Exception(ctx, e) or otherwise attach the cause. Same pattern at line 157.

⚠️ security (silas-1.7-pro) — non-blocking warnings

Summary: New note/alias update endpoints are parameterized but return raw exception details and accept unbounded value input.

• low backend/src/main/java/com/park/utmstack/web/rest/network_scan/UtmNetworkScanResource.java:150 — Error handlers for updateNotes/updateAlias include e.getMessage() in the response header and ERROR event, potentially leaking internal exception or SQL details. Return a generic failure message and log the full exception server-side only.
• low backend/src/main/java/com/park/utmstack/web/rest/network_scan/UtmNetworkScanResource.java:380 — UpdateFieldRequestBody.value is unvalidated, allowing arbitrarily large alias/note values to be submitted. Add @SiZe validation and enforce database column limits.

[utmstackprapprover]

Changes requested — Go dependencies check failed (see above).