up

tests/StellaOps.VulnExplorer.Api.Tests/StellaOps.VulnExplorer.Api.Tests.csproj

@@ -9,7 +9,8 @@
     <IsPackable>false</IsPackable>
   </PropertyGroup>
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="8.0.8"/>
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.10.0" />
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.0-rc.2.25502.107"/>
     <PackageReference Include="xunit" Version="2.9.2"/>
     <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2"/>
   </ItemGroup>

tests/StellaOps.VulnExplorer.Api.Tests/VulnApiTests.cs

@@ -2,6 +2,7 @@ using System.Net;
 using System.Net.Http.Json;
 using Microsoft.AspNetCore.Mvc.Testing;
 using StellaOps.VulnExplorer.Api.Models;
+using Xunit;
 
 namespace StellaOps.VulnExplorer.Api.Tests;
 
@@ -51,4 +52,20 @@ public class VulnApiTests : IClassFixture<WebApplicationFactory<Program>>
         var response = await client.GetAsync("/v1/vulns/missing");
         Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
     }
+
+    [Fact]
+    public async Task Detail_ReturnsRationaleAndPaths()
+    {
+        var client = factory.CreateClient();
+        client.DefaultRequestHeaders.Add("x-stella-tenant", "tenant-a");
+
+        var response = await client.GetAsync("/v1/vulns/vuln-0001");
+        response.EnsureSuccessStatusCode();
+
+        var detail = await response.Content.ReadFromJsonAsync<VulnDetail>();
+        Assert.NotNull(detail);
+        Assert.Equal("rat-0001", detail!.Rationale.Id);
+        Assert.Contains("/src/app/Program.cs", detail.Paths);
+        Assert.NotEmpty(detail.Evidence);
+    }
 }