Model the Issue fields the API sends and we currently drop

CLAUDE.md

@@ -73,6 +73,10 @@ erDiagram
         IssueStatuses statuses "active, ignored counts"
         String severity "critical, high, medium, low"
         String cve "CVE identifier (vulns only)"
+        String url "deep link into the FOSSA UI (all categories)"
+        Vec_String affected_version_ranges "e.g. <5.0.52 (vulns only)"
+        Vec_String references "upstream advisory/commit URLs (vulns only)"
+        Vec_IssueMetric metrics "CVSS vector decomposed: Attack Vector = Network"
         DateTime created_at
     }
 
@@ -137,7 +141,7 @@ Project (top-level container)
 - **Project** - Top-level container, implements Get/List/Update
 - **Revision** - Snapshot at point in time, implements Get/List
 - **Dependency** - Package dependency, implements List only (via revision)
-- **Issue** - Vulnerability/licensing/quality issue, implements Get/List
+- **Issue** - Vulnerability/licensing/quality issue, implements Get/List. `Issue` has no `deny_unknown_fields`, so any API key not declared on the struct is silently dropped — when the API grows a field, add it here or callers never see it. `cpes` is deliberately unmodeled (empty on all 80 sampled issues); `patchedVersionRanges` is modeled but rarely populated (1/80) — prefer `remediation` for upgrade targets. `IssueProject` entries carry the revision the issue was found in (`revision_id`, `latest`, `first_found_at`), not just the project.
 - **Snippet** - Third-party (OSS) code matched into first-party files, implements List only (via revision). Read-only; reached through the `get_snippet_*` convenience functions. Quirks: `id` is a string, `matchDetails.matchPercentage` is 0-100 (other percentages are 0-1), and whole-file matches highlight a trailing blank EOF line that is excluded from the reported range.
 - **LicenseInfo** - Can be simple string ("MIT") or full object
 
@@ -147,9 +151,11 @@ Issues come in three categories with different fields:
 
 | Category | Key Fields | Description |
 |----------|------------|-------------|
-| `vulnerability` | cve, cvss, severity, remediation, epss | Security vulnerabilities |
+| `vulnerability` | cve, cvss, severity, remediation, epss, affectedVersionRanges, references, metrics, cveStatus | Security vulnerabilities |
 | `licensing` | license | License compliance issues |
-| `quality` | qualityRule | Code quality concerns |
+| `quality` | qualityRule, latestVersion | Code quality concerns |
+
+All three categories also carry `url` (deep link into the FOSSA UI).
 
 ## Future Work
 

src/lib.rs

@@ -100,6 +100,7 @@ pub use models::{
     IssueDepths,
     IssueEpss,
     IssueListQuery,
+    IssueMetric,
     IssueProject,
     IssueRemediation,
     IssueSource,

src/mock_server/fixtures.rs

@@ -3,8 +3,8 @@
 //! Provides factory functions for creating realistic test data.
 
 use crate::{
-    Dependency, Issue, IssueDepths, IssueSource, IssueStatuses, LatestRevision, Project,
-    ProjectIssues, Revision,
+    Dependency, Issue, IssueDepths, IssueMetric, IssueSource, IssueStatuses, LatestRevision,
+    Project, ProjectIssues, Revision,
 };
 
 /// Collection of fixture factories for test data.
@@ -165,6 +165,7 @@ impl Fixtures {
             },
             projects: vec![],
             created_at: None,
+            url: Some(format!("https://app.fossa.com/issues/vulnerability/{id}")),
             cve: Some(cve.to_string()),
             cvss: Some(7.5),
             cvss_vector: None,
@@ -175,10 +176,25 @@ impl Fixtures {
             published: None,
             exploitability: None,
             epss: None,
+            affected_version_ranges: vec!["<1.0.0".to_string()],
+            patched_version_ranges: vec![],
+            references: vec![format!("https://nvd.nist.gov/vuln/detail/{}", cve)],
+            metrics: vec![
+                IssueMetric {
+                    name: "Attack Vector".to_string(),
+                    value: Some("Network".to_string()),
+                },
+                IssueMetric {
+                    name: "Attack Complexity".to_string(),
+                    value: Some("Low".to_string()),
+                },
+            ],
+            cve_status: Some("COMPLETED".to_string()),
             vuln_id: Some(format!("{}_{}", cve, package_locator)),
             title: Some(format!("{} Vulnerability", cve)),
             license: None,
             quality_rule: None,
+            latest_version: None,
         }
     }
 
@@ -201,6 +217,7 @@ impl Fixtures {
             },
             projects: vec![],
             created_at: None,
+            url: Some(format!("https://app.fossa.com/issues/licensing/{id}")),
             cve: None,
             cvss: None,
             cvss_vector: None,
@@ -211,10 +228,16 @@ impl Fixtures {
             published: None,
             exploitability: None,
             epss: None,
+            affected_version_ranges: vec![],
+            patched_version_ranges: vec![],
+            references: vec![],
+            metrics: vec![],
+            cve_status: None,
             vuln_id: None,
             title: None,
             license: Some(license.to_string()),
             quality_rule: None,
+            latest_version: None,
         }
     }