From 739382f7f567afb622c393067122edf62086c56e Mon Sep 17 00:00:00 2001
From: Gabriel Jesus <342175451+secgabriel@users.noreply.github.com>
Date: Fri, 16 Oct 2026 20:36:02 -0300
Subject: [PATCH] tracker: expose package versions in group JSON

Include current package version, architecture, and repository in the group JSON endpoint. Add a regression test.

Fixes #237
---
 test/test_group.py   | 9 +++++++++
 tracker/view/show.py | 9 +++++++++
 2 files changed, 18 insertions(+)

diff --git a/test/test_group.py b/test/test_group.py
index 7d62aa1a..4f3d6b8a 100644
--- a/test/test_group.py
+++ b/test/test_group.py
@@ -338,6 +338,7 @@ def test_show_group(db, client):
     assert 'text/html; charset=utf-8' == resp.content_type
     assert DEFAULT_GROUP_NAME in resp.data.decode()
 
+@create_package(name='foo', version='1.2.3-4')
 @create_group(id=DEFAULT_GROUP_ID, packages=['foo'], affected='1.2.3-3', fixed='1.2.3-4')
 @create_advisory(id=DEFAULT_ADVISORY_ID, group_package_id=DEFAULT_GROUP_ID, advisory_type=issue_types[1])
 def test_show_group_json(db, client):
@@ -348,6 +349,14 @@ def test_show_group_json(db, client):
     assert data['name'] == DEFAULT_GROUP_NAME
     assert data['issues'] == [DEFAULT_ISSUE_ID]
     assert data['packages'] == ['foo']
+    assert data['versions'] == [
+        {
+            'name': 'foo',
+            'version': '1.2.3-4',
+            'arch': 'any',
+            'repository': 'core',
+        }
+    ]
     assert data['affected'] == '1.2.3-3'
     assert data['fixed'] == '1.2.3-4'
 
diff --git a/tracker/view/show.py b/tracker/view/show.py
index 0e89a4b0..341067fa 100644
--- a/tracker/view/show.py
+++ b/tracker/view/show.py
@@ -283,6 +283,15 @@ def show_group_json(avg):
     json_data = OrderedDict()
     json_data['name'] = group.name
     json_data['packages'] = [package.pkgname for package in packages]
+    json_data['versions'] = [
+        {
+            'name': package.name,
+            'version': package.version,
+            'arch': package.arch,
+            'repository': package.database,
+        }
+        for package in data['versions']
+    ]
     json_data['status'] = group.status.label
     json_data['severity'] = group.severity.label
     json_data['type'] = 'multiple issues' if len(issue_types) > 1 else issue_types[0]