feat: Added vuln filter

server/internal/api/vulnerabilities.go

@@ -32,6 +32,7 @@ func listVulnerabilities(c *gin.Context) {
 		State:    c.DefaultQuery("state", models.FindingOpen),
 		ServerID: c.Query("server"),
 		Tags:     tagsFromQuery(c),
+		HasFix:   hasFixFromQuery(c),
 	})
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
@@ -82,6 +83,22 @@ func groupByCVE(findings []models.VulnFinding) []vulnGroup {
 	return out
 }
 
+// hasFixFromQuery reads ?has_fix=true|false. Anything else, including an empty
+// or malformed value, is no filter — a filter nobody asked for must never hide
+// findings, and the wrong direction here hides the unfixable ones.
+func hasFixFromQuery(c *gin.Context) *bool {
+	switch c.Query("has_fix") {
+	case "true":
+		v := true
+		return &v
+	case "false":
+		v := false
+		return &v
+	default:
+		return nil
+	}
+}
+
 // tagsFromQuery reads repeated tag=key:value parameters.
 func tagsFromQuery(c *gin.Context) map[string]string {
 	out := map[string]string{}