# frozen_string_literal: true

module Security
  class VulnerabilityFindingsController < ::Security::ApplicationController
    include ProjectCollectionVulnerabilityFindingsActions

    before_action :remove_invalid_project_ids

    private

    def remove_invalid_project_ids
      render_empty_response if valid_project_ids.empty?

      params[:project_id] = valid_project_ids
    end

    def render_empty_response
      respond_to do |format|
        format.json do
          render json: {}
        end
      end
    end

    def vulnerable
      @vulnerable ||= ApplicationInstance.new
    end

    def valid_project_ids
      return security_dashboard_project_ids if request_project_ids.empty?

      security_dashboard_project_ids & request_project_ids
    end

    def request_project_ids
      params.fetch(:project_id, []).map(&:to_i)
    end

    def security_dashboard_project_ids
      current_user.security_dashboard_project_ids
    end
  end
end
