perf(cve): index cwe_id so CWE lookup stops scanning the catalog

cwe_lookup reports how many CVEs map to a weakness via
SELECT COUNT(*) FROM cves WHERE cwe_id = ?. That column had no index, so
every uncached lookup scanned the entire CVE table: several seconds per
request on a cold page cache, sub-second only once warm. Response bodies
are identical — this is latency only.

The guard does not copy the SQL. It traces the statement
count_cves_for_cwe actually issues and plans that, so it follows the
query if it is ever rewritten. Verified by mutation: dropping the index
and switching the predicate to LIKE each turn it red.

Author: UPinar

app/db.py

@@ -211,6 +211,7 @@ def init_cve_db():
         con.execute("CREATE INDEX IF NOT EXISTS idx_cves_published ON cves(published)")
         con.execute("CREATE INDEX IF NOT EXISTS idx_cves_epss ON cves(epss_score)")
         con.execute("CREATE INDEX IF NOT EXISTS idx_cves_kev ON cves(in_kev)")
+        con.execute("CREATE INDEX IF NOT EXISTS idx_cves_cwe ON cves(cwe_id)")
         # Migration: add cwes JSON-array column if missing (existing installs); backfill from cwe_id.
         cve_cols = {row[1] for row in con.execute("PRAGMA table_info(cves)")}
         if "cwes" not in cve_cols:

app/tests/test_db.py

@@ -871,3 +871,39 @@ def test_ip_cache_with_age_versioned(self):
         payload, age = result
         assert payload == {"x": 1}
         assert age >= 0
+
+
+def test_cwe_count_query_uses_index(monkeypatch):
+    """cwe_lookup counts CVEs per weakness; unindexed this is a full catalog scan.
+
+    Plans the SQL count_cves_for_cwe actually issues (captured via trace), not a
+    copy of it, so the guard follows the query if it is ever rewritten.
+    """
+    import contextlib
+
+    import db
+
+    captured: list[str] = []
+    real_get_cve_db = db.get_cve_db
+
+    @contextlib.contextmanager
+    def traced_get_cve_db():
+        with real_get_cve_db() as con:
+            con.set_trace_callback(captured.append)
+            try:
+                yield con
+            finally:
+                con.set_trace_callback(None)
+
+    monkeypatch.setattr(db, "get_cve_db", traced_get_cve_db)
+    db.count_cves_for_cwe("CWE-79")
+
+    selects = [sql for sql in captured if sql.lstrip().upper().startswith("SELECT")]
+    assert selects, f"count_cves_for_cwe issued no SELECT; captured: {captured}"
+    sql = selects[-1]
+
+    with real_get_cve_db() as con:
+        plan = con.execute("EXPLAIN QUERY PLAN " + sql, ("CWE-79",) * sql.count("?")).fetchall()
+    detail = " ".join(str(row[-1]) for row in plan)
+    assert "SCAN cves" not in detail, f"cwe_id count fell back to a full scan: {detail}"
+    assert "idx_cves_cwe" in detail, f"expected idx_cves_cwe in plan, got: {detail}"