fix: SBOM multi-ecosystem support with correct package managers and licenses (#8)

compliance-agent/src/api/handlers/mod.rs

@@ -554,6 +554,37 @@ pub async fn update_finding_feedback(
     Ok(Json(serde_json::json!({ "status": "updated" })))
 }
 
+pub async fn sbom_filters(
+    Extension(agent): AgentExt,
+) -> Result<Json<serde_json::Value>, StatusCode> {
+    let db = &agent.db;
+
+    let managers: Vec<String> = db
+        .sbom_entries()
+        .distinct("package_manager", doc! {})
+        .await
+        .unwrap_or_default()
+        .into_iter()
+        .filter_map(|v| v.as_str().map(|s| s.to_string()))
+        .filter(|s| !s.is_empty() && s != "unknown" && s != "file")
+        .collect();
+
+    let licenses: Vec<String> = db
+        .sbom_entries()
+        .distinct("license", doc! {})
+        .await
+        .unwrap_or_default()
+        .into_iter()
+        .filter_map(|v| v.as_str().map(|s| s.to_string()))
+        .filter(|s| !s.is_empty())
+        .collect();
+
+    Ok(Json(serde_json::json!({
+        "package_managers": managers,
+        "licenses": licenses,
+    })))
+}
+
 pub async fn list_sbom(
     Extension(agent): AgentExt,
     Query(filter): Query<SbomFilter>,

compliance-agent/src/api/routes.rs

@@ -36,6 +36,7 @@ pub fn build_router() -> Router {
             patch(handlers::update_finding_feedback),
         )
         .route("/api/v1/sbom", get(handlers::list_sbom))
+        .route("/api/v1/sbom/filters", get(handlers::sbom_filters))
         .route("/api/v1/sbom/export", get(handlers::export_sbom))
         .route("/api/v1/sbom/licenses", get(handlers::license_summary))
         .route("/api/v1/sbom/diff", get(handlers::sbom_diff))