working base dash

internal/crowdsec/cli.go

@@ -28,18 +28,24 @@ func NewCLIClient(cscliPath string) *CLIClient {
 // -----------------------------------------------------------------------
 
 // ListDecisions returns decisions via cscli, applying filter options.
-// cscli does not support offset, so pagination is handled in Go by fetching
-// enough rows and slicing. Maximum fetch = page * limit + 1.
+// cscli decisions list -o json returns alert objects with nested decisions —
+// not a flat decision list. We extract and flatten the nested decisions.
+// cscli does not support offset, so pagination is Go-side.
 func (c *CLIClient) ListDecisions(ctx context.Context, f DecisionFilter) ([]Decision, error) {
+	// Fetch enough alerts to cover offset+limit decisions.
+	// Since --limit is per-alert and each alert typically has one decision,
+	// multiply by a small factor; minimum fetch covers the full page range.
 	fetchLimit := f.Limit
 	if f.Offset > 0 {
 		fetchLimit = f.Offset + f.Limit
 	}
+	// Always fetch at least 500 so small offsets don't under-fetch.
+	if fetchLimit < 500 {
+		fetchLimit = 500
+	}
 
 	args := []string{"decisions", "list", "-o", "json"}
-	if fetchLimit > 0 {
-		args = append(args, "--limit", fmt.Sprintf("%d", fetchLimit))
-	}
+	args = append(args, "--limit", fmt.Sprintf("%d", fetchLimit))
 	if f.Type != "" && safeArg.MatchString(f.Type) {
 		args = append(args, "--type", f.Type)
 	}
@@ -63,12 +69,19 @@ func (c *CLIClient) ListDecisions(ctx context.Context, f DecisionFilter) ([]Deci
 		return []Decision{}, nil
 	}
 
-	var decisions []Decision
-	if err := json.Unmarshal(out, &decisions); err != nil {
+	// cscli decisions list -o json returns alert objects, each containing
+	// a "decisions" array. Extract and flatten those nested decisions.
+	var alerts []Alert
+	if err := json.Unmarshal(out, &alerts); err != nil {
 		return nil, fmt.Errorf("parse decisions: %w\noutput: %s", err, string(out))
 	}
 
-	// apply Go-side offset slice
+	var decisions []Decision
+	for _, a := range alerts {
+		decisions = append(decisions, a.Decisions...)
+	}
+
+	// Apply Go-side offset slice.
 	if f.Offset > 0 {
 		if f.Offset >= len(decisions) {
 			return []Decision{}, nil