fix: preserve legacy SBOM source values

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834

api/routers/sbom.py

@@ -343,7 +343,15 @@ async def _translate_snapshots(
 
 
 def _translate_snapshot(item: dict, repo_id: uuid.UUID) -> dict:
-    return {**item, "repo_id": repo_id}
+    translated = {**item, "repo_id": repo_id}
+    source = translated.get("source")
+    if (
+        translated.get("legacy_id")
+        and isinstance(source, str)
+        and source.startswith("state-hub:")
+    ):
+        translated["source"] = source.removeprefix("state-hub:")
+    return translated
 
 
 def _translate_entry(item: dict, repo_id: uuid.UUID) -> dict:

tests/test_sbom_nexus_compat.py

@@ -53,7 +53,8 @@ async def test_nexus_read_mode_preserves_state_hub_response_contract(client, mon
         "repo_id": nexus_repo_id,
         "repo_slug": "testrepo",
         "snapshot_at": "2026-08-22T12:00:00+00:00",
-        "source": "state-hub-import",
+        "source": "state-hub:manual",
+        "legacy_id": snapshot_id,
         "entry_count": 1,
         "created_at": "2026-08-22T12:00:01+00:00",
         "status": "imported",
@@ -113,6 +114,8 @@ async def test_nexus_read_mode_preserves_state_hub_response_contract(client, mon
     assert repo_view.status_code == 200
     assert snapshots.json()[0]["id"] == snapshot_id
     assert snapshots.json()[0]["repo_id"] == repo["id"]
+    assert snapshots.json()[0]["source"] == "manual"
+    assert detail.json()["source"] == "manual"
     assert detail.json()["entries"][0]["repo_id"] == repo["id"]
     assert entries.json()[0]["repo_id"] == repo["id"]
     assert "source_path" not in entries.json()[0]