E2E Tests:
- 17 integration tests covering: health, repos CRUD, findings lifecycle,
  cascade delete (SAST + DAST + pentest), DAST targets, stats overview
- TestServer harness: spins up agent API on random port with isolated
  MongoDB database per test, auto-cleanup
- Added lib.rs to expose agent internals for integration tests
- Nightly CI workflow with MongoDB service container (3 AM UTC)

Tests verify:
- Repository add/list/delete + duplicate rejection + invalid ID handling
- Finding creation, filtering by severity/repo, status updates, bulk updates
- Cascade delete: repo deletion removes all DAST targets, pentest sessions,
  attack chain nodes, DAST findings, SAST findings, and SBOM entries
- DAST target CRUD and empty finding list
- Stats overview accuracy with zero and populated data

Also:
- Fix Dockerfile.dashboard: bump dioxus-cli 0.7.3 → 0.7.4 (compile fix)
- Fix clippy: allow new_without_default for pattern scanners

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

@@ -0,0 +14,4 @@
+
+concurrency:
+  group: nightly-e2e
+  cancel-in-progress: true

@@ -0,0 +21,4 @@
+    name: E2E Tests
+    runs-on: docker
+    container:
+      image: rust:1.94-bookworm

@@ -0,0 +42,4 @@
+            | tar xz --strip-components=1 -C /usr/local/bin/ sccache-v0.9.1-x86_64-unknown-linux-musl/sccache
+          chmod +x /usr/local/bin/sccache
+        env:
+          RUSTC_WRAPPER: ""

@@ -0,0 +45,4 @@
+          RUSTC_WRAPPER: ""
+
+      - name: Run E2E tests
+        run: cargo test -p compliance-agent --test e2e -- --test-threads=4

@@ -0,0 +49,4 @@
+
+      - name: Show sccache stats
+        run: sccache --show-stats
+        if: always()

@@ -1,6 +1,6 @@
 FROM rust:1.94-bookworm AS builder
 
-RUN cargo install dioxus-cli --version 0.7.3
+RUN cargo install dioxus-cli --version 0.7.4

@@ -43,2 +43,4 @@
 dashmap = { workspace = true }
 tokio-stream = { workspace = true }
+
+[dev-dependencies]

@@ -0,0 +12,4 @@
+pub mod scheduler;
+pub mod ssh;
+#[allow(dead_code)]
+pub mod trackers;

@@ -12,3 +1,1 @@
-#[allow(dead_code)]
-mod trackers;
-mod webhooks;
+use compliance_agent::{agent, api, config, database, scheduler, ssh, webhooks};

@@ -4,0 +13,4 @@
+
+/// A running test server with a unique database.
+pub struct TestServer {
+    pub base_url: String,

@@ -4,0 +18,4 @@
+    db_name: String,
+    mongodb_uri: String,
+}
+

@@ -4,0 +32,4 @@
+            .await
+            .expect("Failed to connect to MongoDB — is it running?");
+        db.ensure_indexes().await.expect("Failed to create indexes");
+

@@ -4,0 +74,4 @@
+        // Build the router with the agent extension
+        let app = api::routes::build_router()
+            .layer(axum::extract::Extension(Arc::new(agent)))
+            .layer(tower_http::cors::CorsLayer::permissive());

@@ -4,0 +128,4 @@
+            .post(format!("{}{path}", self.base_url))
+            .json(body)
+            .send()
+            .await

@@ -4,0 +154,4 @@
+    /// Get the unique database name for direct MongoDB access in tests.
+    pub fn db_name(&self) -> &str {
+        &self.db_name
+    }

@@ -0,0 +7,4 @@
+        .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
+    let client = mongodb::Client::with_uri_str(&mongodb_uri).await.unwrap();
+    let db = client.database(&server.db_name());
+

@@ -0,0 +9,4 @@
+    let db = client.database(&server.db_name());
+
+    let result = db
+        .collection::<mongodb::bson::Document>("dast_targets")

@@ -0,0 +11,4 @@
+    let result = db
+        .collection::<mongodb::bson::Document>("dast_targets")
+        .insert_one(mongodb::bson::doc! {
+            "name": name,

@@ -0,0 +12,4 @@
+        .collection::<mongodb::bson::Document>("dast_targets")
+        .insert_one(mongodb::bson::doc! {
+            "name": name,
+            "base_url": format!("https://{name}.example.com"),

@@ -0,0 +147,4 @@
+
+    // All downstream data should be gone
+    assert_eq!(count_docs(&server, "dast_targets").await, 0);
+    assert_eq!(count_docs(&server, "pentest_sessions").await, 0);

@@ -0,0 +12,4 @@
+    assert_eq!(body["data"].as_array().unwrap().len(), 0);
+
+    // Add a target
+    let resp = server

@@ -0,0 +14,4 @@
+
+    // Get the DB name from the test server by parsing the health response
+    // For now, we use a direct insert approach
+    let db = client.database(&server.db_name());

@@ -0,0 +19,4 @@
+    let now = mongodb::bson::DateTime::now();
+    db.collection::<mongodb::bson::Document>("findings")
+        .insert_one(mongodb::bson::doc! {
+            "repo_id": repo_id,

@@ -0,0 +32,4 @@
+        })
+        .await
+        .unwrap();
+}

@@ -0,0 +67,4 @@
+    assert_eq!(body["total"], 1);
+    assert_eq!(body["data"][0]["title"], "SQL Injection");
+
+    // Filter by repo

@@ -0,0 +82,4 @@
+    insert_finding(&server, "repo1", "Test Bug", "medium").await;
+
+    // Get the finding ID
+    let resp = server.get("/api/v1/findings").await;

@@ -0,0 +7,4 @@
+    let resp = server.get("/api/v1/health").await;
+    assert_eq!(resp.status(), 200);
+
+    let body: serde_json::Value = resp.json().await.unwrap();

@@ -0,0 +7,4 @@
+
+    // Initially empty
+    let resp = server.get("/api/v1/repositories").await;
+    assert_eq!(resp.status(), 200);

@@ -0,0 +14,4 @@
+    // Add a repository
+    let resp = server
+        .post(
+            "/api/v1/repositories",

@@ -0,0 +42,4 @@
+
+    let payload = json!({
+        "name": "dup-repo",
+        "git_url": "https://github.com/example/dup-repo.git",

@@ -0,0 +12,4 @@
+            &json!({
+                "name": "stats-repo",
+                "git_url": "https://github.com/example/stats-repo.git",
+            }),

@@ -0,0 +19,4 @@
+    // Insert findings directly
+    let mongodb_uri = std::env::var("TEST_MONGODB_URI")
+        .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
+    let client = mongodb::Client::with_uri_str(&mongodb_uri).await.unwrap();

@@ -0,0 +22,4 @@
+    let client = mongodb::Client::with_uri_str(&mongodb_uri).await.unwrap();
+    let db = client.database(&server.db_name());
+    let now = mongodb::bson::DateTime::now();
+

@@ -0,0 +32,4 @@
+        db.collection::<mongodb::bson::Document>("findings")
+            .insert_one(mongodb::bson::doc! {
+                "repo_id": "test-repo-id",
+                "fingerprint": format!("fp-{title}"),

@@ -1,4 +1,9 @@
-// Integration tests for the compliance-agent crate.
+// E2E / Integration tests for the compliance-agent API.

@@ -0,0 +14,4 @@
+
+concurrency:
+  group: nightly-e2e
+  cancel-in-progress: true

@@ -0,0 +20,4 @@
+  e2e:
+    name: E2E Tests
+    runs-on: docker
+    container:

@@ -0,0 +42,4 @@
+            | tar xz --strip-components=1 -C /usr/local/bin/ sccache-v0.9.1-x86_64-unknown-linux-musl/sccache
+          chmod +x /usr/local/bin/sccache
+        env:
+          RUSTC_WRAPPER: ""

@@ -0,0 +45,4 @@
+          RUSTC_WRAPPER: ""
+
+      - name: Run E2E tests
+        run: cargo test -p compliance-agent --test e2e -- --test-threads=4

@@ -0,0 +49,4 @@
+
+      - name: Show sccache stats
+        run: sccache --show-stats
+        if: always()

@@ -1,6 +1,6 @@
 FROM rust:1.94-bookworm AS builder
 
-RUN cargo install dioxus-cli --version 0.7.3
+RUN cargo install dioxus-cli --version 0.7.4

@@ -43,2 +43,4 @@
 dashmap = { workspace = true }
 tokio-stream = { workspace = true }
+
+[dev-dependencies]

@@ -0,0 +12,4 @@
+pub mod scheduler;
+pub mod ssh;
+#[allow(dead_code)]
+pub mod trackers;

@@ -12,3 +1,1 @@
-#[allow(dead_code)]
-mod trackers;
-mod webhooks;
+use compliance_agent::{agent, api, config, database, scheduler, ssh, webhooks};

@@ -4,0 +10,4 @@
+use compliance_agent::database::Database;
+use compliance_core::AgentConfig;
+use secrecy::SecretString;
+

@@ -4,0 +13,4 @@
+
+/// A running test server with a unique database.
+pub struct TestServer {
+    pub base_url: String,

@@ -4,0 +15,4 @@
+pub struct TestServer {
+    pub base_url: String,
+    pub client: reqwest::Client,
+    db_name: String,

@@ -4,0 +31,4 @@
+        let db = Database::connect(&mongodb_uri, &db_name)
+            .await
+            .expect("Failed to connect to MongoDB — is it running?");
+        db.ensure_indexes().await.expect("Failed to create indexes");

@@ -4,0 +75,4 @@
+        let app = api::routes::build_router()
+            .layer(axum::extract::Extension(Arc::new(agent)))
+            .layer(tower_http::cors::CorsLayer::permissive());
+

@@ -4,0 +151,4 @@
+            .expect("DELETE request failed")
+    }
+
+    /// Get the unique database name for direct MongoDB access in tests.

@@ -0,0 +7,4 @@
+        .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
+    let client = mongodb::Client::with_uri_str(&mongodb_uri).await.unwrap();
+    let db = client.database(&server.db_name());
+

@@ -0,0 +9,4 @@
+    let db = client.database(&server.db_name());
+
+    let result = db
+        .collection::<mongodb::bson::Document>("dast_targets")

@@ -0,0 +11,4 @@
+    let result = db
+        .collection::<mongodb::bson::Document>("dast_targets")
+        .insert_one(mongodb::bson::doc! {
+            "name": name,

@@ -0,0 +12,4 @@
+        .collection::<mongodb::bson::Document>("dast_targets")
+        .insert_one(mongodb::bson::doc! {
+            "name": name,
+            "base_url": format!("https://{name}.example.com"),

@@ -0,0 +147,4 @@
+
+    // All downstream data should be gone
+    assert_eq!(count_docs(&server, "dast_targets").await, 0);
+    assert_eq!(count_docs(&server, "pentest_sessions").await, 0);

@@ -0,0 +12,4 @@
+    // We'll use the agent's internal DB through the stats endpoint to verify
+    let client = mongodb::Client::with_uri_str(&mongodb_uri).await.unwrap();
+
+    // Get the DB name from the test server by parsing the health response

@@ -0,0 +14,4 @@
+
+    // Get the DB name from the test server by parsing the health response
+    // For now, we use a direct insert approach
+    let db = client.database(&server.db_name());

@@ -0,0 +20,4 @@
+    db.collection::<mongodb::bson::Document>("findings")
+        .insert_one(mongodb::bson::doc! {
+            "repo_id": repo_id,
+            "fingerprint": format!("fp-{title}-{severity}"),

@@ -0,0 +22,4 @@
+            "repo_id": repo_id,
+            "fingerprint": format!("fp-{title}-{severity}"),
+            "scanner": "test-scanner",
+            "scan_type": "sast",

@@ -0,0 +27,4 @@
+            "description": format!("Test finding: {title}"),
+            "severity": severity,
+            "status": "open",
+            "created_at": now,

@@ -0,0 +32,4 @@
+        })
+        .await
+        .unwrap();
+}

@@ -0,0 +102,4 @@
+    assert_eq!(body["data"]["status"], "resolved");
+
+    server.cleanup().await;
+}

@@ -0,0 +7,4 @@
+
+    // Initially empty
+    let resp = server.get("/api/v1/repositories").await;
+    assert_eq!(resp.status(), 200);

@@ -0,0 +41,4 @@
+    let server = TestServer::start().await;
+
+    let payload = json!({
+        "name": "dup-repo",

@@ -0,0 +12,4 @@
+            &json!({
+                "name": "stats-repo",
+                "git_url": "https://github.com/example/stats-repo.git",
+            }),

@@ -0,0 +17,4 @@
+        .await;
+
+    // Insert findings directly
+    let mongodb_uri = std::env::var("TEST_MONGODB_URI")

@@ -0,0 +22,4 @@
+    let client = mongodb::Client::with_uri_str(&mongodb_uri).await.unwrap();
+    let db = client.database(&server.db_name());
+    let now = mongodb::bson::DateTime::now();
+

@@ -0,0 +32,4 @@
+        db.collection::<mongodb::bson::Document>("findings")
+            .insert_one(mongodb::bson::doc! {
+                "repo_id": "test-repo-id",
+                "fingerprint": format!("fp-{title}"),

@@ -1,4 +1,9 @@
-// Integration tests for the compliance-agent crate.
+// E2E / Integration tests for the compliance-agent API.

@@ -18,0 +24,4 @@
+///
+/// Returns the first match found, or `None` if the node is a root.
+fn find_parent_qname(qname: &str, node_map: &HashMap<String, NodeIndex>) -> Option<String> {
+    let mut current = qname.to_string();

@@ -121,7 +148,48 @@ impl GraphEngine {
                 graph.add_edge(src, tgt, edge.kind.clone());

@@ -125,0 +163,4 @@
+            .first()
+            .map(|n| n.graph_build_id.as_str())
+            .unwrap_or("");
+

@@ -125,0 +173,4 @@
+        for qname in &qualified_names {
+            if let Some(parent_qname) = find_parent_qname(qname, &node_map) {
+                let child_idx = node_map[qname];
+                let parent_idx = node_map[&parent_qname];

@@ -125,0 +174,4 @@
+            if let Some(parent_qname) = find_parent_qname(qname, &node_map) {
+                let child_idx = node_map[qname];
+                let parent_idx = node_map[&parent_qname];
+

@@ -132,33 +200,62 @@ impl GraphEngine {
         })

@@ -150,3 +224,2 @@
-                || qualified.ends_with(&format!(".{target}"))
-            {
+            if qualified.ends_with(&suffix_pattern) || qualified.ends_with(&dot_pattern) {
                 return Some(*idx);

@@ -71,3 +71,3 @@
       # Tests (reuses compilation artifacts from clippy)
       - name: Tests (core + agent)
-        run: cargo test -p compliance-core -p compliance-agent
+        run: cargo test -p compliance-core -p compliance-agent --lib

@@ -0,0 +22,4 @@
+    runs-on: docker
+    container:
+      image: rust:1.94-bookworm
+    services:

@@ -43,2 +43,4 @@
 dashmap = { workspace = true }
 tokio-stream = { workspace = true }
+
+[dev-dependencies]

@@ -0,0 +12,4 @@
+pub mod scheduler;
+pub mod ssh;
+#[allow(dead_code)]
+pub mod trackers;

@@ -12,3 +1,1 @@
-#[allow(dead_code)]
-mod trackers;
-mod webhooks;
+use compliance_agent::{agent, api, config, database, scheduler, ssh, webhooks};

@@ -4,0 +13,4 @@
+
+/// A running test server with a unique database.
+pub struct TestServer {
+    pub base_url: String,

@@ -4,0 +16,4 @@
+    pub base_url: String,
+    pub client: reqwest::Client,
+    db_name: String,
+    mongodb_uri: String,

@@ -4,0 +18,4 @@
+    db_name: String,
+    mongodb_uri: String,
+}
+

@@ -4,0 +32,4 @@
+            .await
+            .expect("Failed to connect to MongoDB — is it running?");
+        db.ensure_indexes().await.expect("Failed to create indexes");
+

@@ -4,0 +81,4 @@
+            .await
+            .expect("Failed to bind test server");
+        let port = listener.local_addr().expect("no local addr").port();
+

@@ -4,0 +151,4 @@
+            .expect("DELETE request failed")
+    }
+
+    /// Get the unique database name for direct MongoDB access in tests.

@@ -0,0 +7,4 @@
+        .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
+    let client = mongodb::Client::with_uri_str(&mongodb_uri).await.unwrap();
+    let db = client.database(&server.db_name());
+

@@ -0,0 +9,4 @@
+    let db = client.database(&server.db_name());
+
+    let result = db
+        .collection::<mongodb::bson::Document>("dast_targets")

@@ -0,0 +11,4 @@
+    let result = db
+        .collection::<mongodb::bson::Document>("dast_targets")
+        .insert_one(mongodb::bson::doc! {
+            "name": name,

@@ -0,0 +12,4 @@
+        .collection::<mongodb::bson::Document>("dast_targets")
+        .insert_one(mongodb::bson::doc! {
+            "name": name,
+            "base_url": format!("https://{name}.example.com"),

@@ -0,0 +147,4 @@
+
+    // All downstream data should be gone
+    assert_eq!(count_docs(&server, "dast_targets").await, 0);
+    assert_eq!(count_docs(&server, "pentest_sessions").await, 0);

@@ -0,0 +12,4 @@
+    assert_eq!(body["data"].as_array().unwrap().len(), 0);
+
+    // Add a target
+    let resp = server

@@ -0,0 +21,4 @@
+                "target_type": "webapp",
+            }),
+        )
+        .await;

@@ -0,0 +16,4 @@
+    // For now, we use a direct insert approach
+    let db = client.database(&server.db_name());
+
+    let now = mongodb::bson::DateTime::now();

@@ -0,0 +19,4 @@
+    let now = mongodb::bson::DateTime::now();
+    db.collection::<mongodb::bson::Document>("findings")
+        .insert_one(mongodb::bson::doc! {
+            "repo_id": repo_id,

@@ -0,0 +22,4 @@
+            "repo_id": repo_id,
+            "fingerprint": format!("fp-{title}-{severity}"),
+            "scanner": "test-scanner",
+            "scan_type": "sast",

@@ -0,0 +91,4 @@
+        .patch(
+            &format!("/api/v1/findings/{finding_id}/status"),
+            &json!({ "status": "resolved" }),
+        )

@@ -0,0 +115,4 @@
+    let resp = server.get("/api/v1/findings").await;
+    let body: serde_json::Value = resp.json().await.unwrap();
+    let ids: Vec<String> = body["data"]
+        .as_array()

@@ -0,0 +7,4 @@
+    let resp = server.get("/api/v1/health").await;
+    assert_eq!(resp.status(), 200);
+
+    let body: serde_json::Value = resp.json().await.unwrap();

@@ -0,0 +7,4 @@
+
+    // Initially empty
+    let resp = server.get("/api/v1/repositories").await;
+    assert_eq!(resp.status(), 200);

@@ -0,0 +14,4 @@
+    // Add a repository
+    let resp = server
+        .post(
+            "/api/v1/repositories",

@@ -0,0 +29,4 @@
+    // List should now return 1
+    let resp = server.get("/api/v1/repositories").await;
+    let body: serde_json::Value = resp.json().await.unwrap();
+    let repos = body["data"].as_array().unwrap();

@@ -0,0 +17,4 @@
+        .await;
+
+    // Insert findings directly
+    let mongodb_uri = std::env::var("TEST_MONGODB_URI")

@@ -0,0 +32,4 @@
+        db.collection::<mongodb::bson::Document>("findings")
+            .insert_one(mongodb::bson::doc! {
+                "repo_id": "test-repo-id",
+                "fingerprint": format!("fp-{title}"),

@@ -0,0 +47,4 @@
+    }
+
+    let resp = server.get("/api/v1/stats/overview").await;
+    assert_eq!(resp.status(), 200);

@@ -1,4 +1,9 @@
-// Integration tests for the compliance-agent crate.
+// E2E / Integration tests for the compliance-agent API.

@@ -18,0 +22,4 @@
+///   1. `"src/main.rs::config"`  (trim last `::` segment)
+///   2. `"src/main.rs"`          (trim again)
+///
+/// Returns the first match found, or `None` if the node is a root.

@@ -121,7 +148,48 @@ impl GraphEngine {
                 graph.add_edge(src, tgt, edge.kind.clone());

@@ -122,3 +149,3 @@
                 resolved_edges.push(edge);
             }
-            // Skip unresolved edges (cross-file, external deps) — conservative approach
+        }

@@ -132,33 +200,62 @@ impl GraphEngine {
         })

@@ -144,3 +218,3 @@
         }
 
-        // Try matching just the function/type name (intra-file resolution)
+        // 2. Suffix match: "foo" → "path/file.rs::foo"

@@ -356,0 +461,4 @@
+        output.nodes.push(make_node("src/main.rs::config::load"));
+
+        let code_graph = engine.build_petgraph(output).unwrap();
+