Prevent posture checks field update from nmui

[VishalDalwadi]

Describe your changes

Provide Issue ticket number if applicable/not in title

Provide testing steps

Checklist before requesting a review

• My changes affect only 10 files or less.
• I have performed a self-review of my code and tested it.
• If it is a new feature, I have added thorough tests, my code is <= 1450 lines.
• If it is a bugfix, my code is <= 200 lines.
• My functions are <= 80 lines.
• I have had my code reviewed by a peer.
• My unit tests pass locally.
• Netmaker is awesome.

[tenki-reviewer]

Review Complete

Files Reviewed: 1
Findings: 2

By Severity:

• 🟡 Medium: 2

---

The PR adds new PostureCheck fields (violations, severity level, evaluation timestamp/ID) to the Node model's Fill method with two data-model issues: the zero-value integer enum SeverityUnknown is conflated with 'unset', and the violations slice is aliased rather than deep-copied.

Files Reviewed (1 files)

models/node.go

[tenki-reviewer]

Risk: 🟡 Medium (42/100) — 2 medium findings · 12 LOC across 1 file

---

PR #4070 Review Summary

This single-file PR (models/node.go) extends the Fill method on the Node struct to merge three new PostureCheck-related fields when in-network node updates are received.

Key Findings

• finding-001: The guard newNode.PostureCheckViolationSeverityLevel == 0 at line 266 treats the iota enum member SeverityUnknown (value 0) as 'unset', conflating a legitimate domain value with the absent/initialized state. Future callers that intentionally set SeverityUnknown would have their value silently overwritten.
• finding-002: At line 270, the slice assignment shares the backing array between currentNode and newNode — any subsequent append, re-slice, or sort on either node's PostureChecksViolations will mutate the other's data, creating an alias bug.

Assessment

Both issues are medium severity with moderate fix complexity. Neither is a crash or security vulnerability, but they create latent data-integrity bugs that could manifest as stale or incorrect posture-check state propagation in multi-node deployments.