From 6c4823d94179535a5c17b8979fa09574f5122362 Mon Sep 17 00:00:00 2001
From: StellaOps Bot <stellaops-bot@example.com>
Date: Sun, 4 Jan 2026 15:11:38 +0200
Subject: [PATCH] refactor(vulnexplorer): inject TimeProvider and IGuidProvider
 for determinism - DET-016

VexDecisionStore: Added TimeProvider and IGuidProvider injection for deterministic
ID generation and timestamps in Create/Update methods.

Added StellaOps.Determinism.Abstractions project reference.
---
 .../Data/VexDecisionStore.cs                      | 15 ++++++++++++---
 .../StellaOps.VulnExplorer.Api.csproj             |  3 +++
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/src/VulnExplorer/StellaOps.VulnExplorer.Api/Data/VexDecisionStore.cs b/src/VulnExplorer/StellaOps.VulnExplorer.Api/Data/VexDecisionStore.cs
index 6121194b3..c0ac5b09f 100644
--- a/src/VulnExplorer/StellaOps.VulnExplorer.Api/Data/VexDecisionStore.cs
+++ b/src/VulnExplorer/StellaOps.VulnExplorer.Api/Data/VexDecisionStore.cs
@@ -1,4 +1,5 @@
 using System.Collections.Concurrent;
+using StellaOps.Determinism;
 using StellaOps.VulnExplorer.Api.Models;
 
 namespace StellaOps.VulnExplorer.Api.Data;
@@ -10,11 +11,19 @@ namespace StellaOps.VulnExplorer.Api.Data;
 public sealed class VexDecisionStore
 {
     private readonly ConcurrentDictionary<Guid, VexDecisionDto> _decisions = new();
+    private readonly TimeProvider _timeProvider;
+    private readonly IGuidProvider _guidProvider;
+
+    public VexDecisionStore(TimeProvider? timeProvider = null, IGuidProvider? guidProvider = null)
+    {
+        _timeProvider = timeProvider ?? TimeProvider.System;
+        _guidProvider = guidProvider ?? SystemGuidProvider.Instance;
+    }
 
     public VexDecisionDto Create(CreateVexDecisionRequest request, string userId, string userDisplayName)
     {
-        var id = Guid.NewGuid();
-        var now = DateTimeOffset.UtcNow;
+        var id = _guidProvider.NewGuid();
+        var now = _timeProvider.GetUtcNow();
 
         var decision = new VexDecisionDto(
             Id: id,
@@ -52,7 +61,7 @@ public sealed class VexDecisionStore
             Scope = request.Scope ?? existing.Scope,
             ValidFor = request.ValidFor ?? existing.ValidFor,
             SupersedesDecisionId = request.SupersedesDecisionId ?? existing.SupersedesDecisionId,
-            UpdatedAt = DateTimeOffset.UtcNow
+            UpdatedAt = _timeProvider.GetUtcNow()
         };
 
         _decisions[id] = updated;
diff --git a/src/VulnExplorer/StellaOps.VulnExplorer.Api/StellaOps.VulnExplorer.Api.csproj b/src/VulnExplorer/StellaOps.VulnExplorer.Api/StellaOps.VulnExplorer.Api.csproj
index ba83ee03a..541f26c07 100644
--- a/src/VulnExplorer/StellaOps.VulnExplorer.Api/StellaOps.VulnExplorer.Api.csproj
+++ b/src/VulnExplorer/StellaOps.VulnExplorer.Api/StellaOps.VulnExplorer.Api.csproj
@@ -12,4 +12,7 @@
     <PackageReference Include="Microsoft.AspNetCore.OpenApi" />
     <PackageReference Include="Swashbuckle.AspNetCore" />
   </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="../../__Libraries/StellaOps.Determinism.Abstractions/StellaOps.Determinism.Abstractions.csproj" />
+  </ItemGroup>
 </Project>