Merge pull request #856 from DependencyTrack/issue-1417-replace-uuid-…

…columns-with-native-type

Use native `UUID` type for UUID colums

src/main/java/org/dependencytrack/event/kafka/processor/ProcessedVulnerabilityScanResultProcessor.java

@@ -130,7 +130,7 @@ public void process(final List<ConsumerRecord<String, ScanResult>> records) thro
                         Unexpected vulnerability scan status %s""".formatted(completedVulnScan.getStatus()));
             }
 
-            final UUID workflowToken = UUID.fromString(completedVulnScan.getToken());
+            final UUID workflowToken = completedVulnScan.getToken();
             metricsUpdateEvent.setChainIdentifier(workflowToken);
             policyEvalEvent.setChainIdentifier(workflowToken);
             policyEvalEvent.onFailure(metricsUpdateEvent);
@@ -154,13 +154,13 @@ private static List<VulnerabilityScan> recordScanResults(final Handle jdbiHandle
         LOGGER.debug("Aggregated %d records down to %d unique scans".formatted(records.size(), aggregatesByToken.size()));
 
         final int numAggregates = aggregatesByToken.size();
-        final var tokens = new ArrayList<String>(numAggregates);
+        final var tokens = new ArrayList<UUID>(numAggregates);
         final var resultsTotal = new ArrayList<Integer>(numAggregates);
         final var scannerResultsTotal = new ArrayList<Integer>(numAggregates);
         final var scannerResultsFailed = new ArrayList<Integer>(numAggregates);
 
         for (final Map.Entry<String, Aggregate> entry : aggregatesByToken.entrySet()) {
-            tokens.add(entry.getKey());
+            tokens.add(UUID.fromString(entry.getKey()));
             resultsTotal.add(entry.getValue().resultsTotal);
             scannerResultsTotal.add(entry.getValue().scannerResultsTotal);
             scannerResultsFailed.add(entry.getValue().scannerResultsFailed);
@@ -184,7 +184,7 @@ private static List<VulnerabilityScan> recordScanResults(final Handle jdbiHandle
 
     private static List<WorkflowState> updateWorkflowStates(final Handle jdbiHandle, final List<VulnerabilityScan> completedVulnScans) {
         final int numScans = completedVulnScans.size();
-        final var tokens = new ArrayList<String>(numScans);
+        final var tokens = new ArrayList<UUID>(numScans);
         final var statuses = new ArrayList<WorkflowStatus>(numScans);
         final var failureReasons = new ArrayList<String>(numScans);
 
@@ -203,10 +203,9 @@ private static List<WorkflowState> updateWorkflowStates(final Handle jdbiHandle,
         final List<WorkflowState> updatedWorkflowStates =
                 workflowDao.updateAllStates(WorkflowStep.VULN_ANALYSIS, tokens, statuses, failureReasons);
 
-        final List<String> failedStepTokens = updatedWorkflowStates.stream()
+        final List<UUID> failedStepTokens = updatedWorkflowStates.stream()
                 .filter(step -> step.getStatus() == WorkflowStatus.FAILED)
                 .map(WorkflowState::getToken)
-                .map(UUID::toString)
                 .toList();
         if (!failedStepTokens.isEmpty()) {
             LOGGER.debug("Cancelling children of %d failed workflow steps".formatted(failedStepTokens.size()));
@@ -247,7 +246,7 @@ private static List<WorkflowState> updateWorkflowStates(final Handle jdbiHandle,
         // Collect the workflow tokens for all completed scans, as long as they target a project.
         // Dispatching BOM_PROCESSED notifications does not make sense when individual components,
         // or even the entire portfolio was scanned.
-        final Set<String> workflowTokens = completedVulnScans.stream()
+        final Set<UUID> workflowTokens = completedVulnScans.stream()
                 .filter(vulnScan -> vulnScan.getTargetType() == VulnerabilityScan.TargetType.PROJECT)
                 .map(VulnerabilityScan::getToken)
                 .collect(Collectors.toSet());
@@ -260,7 +259,7 @@ private static List<WorkflowState> updateWorkflowStates(final Handle jdbiHandle,
         // For example, a scan triggered via "Reanalyze" button in the UI won't have such as step,
         // hence it doesn't make sense to dispatch a BOM_PROCESSED notification for it.
         final var workflowDao = jdbiHandle.attach(WorkflowDao.class);
-        final Set<String> workflowTokensWithBomProcessed =
+        final Set<UUID> workflowTokensWithBomProcessed =
                 workflowDao.getTokensByStepAndStateAndTokenAnyOf(WorkflowStep.BOM_PROCESSING, WorkflowStatus.COMPLETED, workflowTokens);
         if (workflowTokensWithBomProcessed.isEmpty()) {
             LOGGER.debug("None of the possible %d workflows have %s steps with status %s"

src/main/java/org/dependencytrack/event/kafka/processor/VulnerabilityScanResultProcessor.java

@@ -801,7 +801,7 @@ public interface Dao {
                 INNER JOIN
                   "PROJECT" AS "P" ON "P"."ID" = "C"."PROJECT_ID"
                 WHERE
-                  "C"."UUID" = (:uuid)::TEXT
+                  "C"."UUID" = :uuid
                 """)
         @RegisterConstructorMapper(Component.class)
         Component getComponentByUuid(final UUID uuid);
@@ -821,7 +821,7 @@ public interface Dao {
                 INSERT INTO "FINDINGATTRIBUTION"
                   ("VULNERABILITY_ID", "COMPONENT_ID", "PROJECT_ID", "ANALYZERIDENTITY", "ATTRIBUTED_ON", "UUID")
                 VALUES
-                  (:vulnId, :componentId, :projectId, :analyzer, NOW(), (:uuid)::TEXT)
+                  (:vulnId, :componentId, :projectId, :analyzer, NOW(), :uuid)
                 ON CONFLICT ("VULNERABILITY_ID", "COMPONENT_ID") DO NOTHING
                 """)
         void createFindingAttributions(@BindMethods final Iterable<FindingAttribution> attribution);
@@ -854,7 +854,7 @@ ON CONFLICT ("VULNERABILITY_ID", "COMPONENT_ID") DO NOTHING
                   "VULNERABILITY_POLICY" AS "VP" ON "VP"."ID" = "A"."VULNERABILITY_POLICY_ID"
                 WHERE
                   "A"."COMPONENT_ID" = :component.id
-                  AND "V"."UUID" = ANY((:vulnUuids)::TEXT[])
+                  AND "V"."UUID" = ANY(:vulnUuids)
                 """)
         @RegisterBeanMapper(Analysis.class)
         List<Analysis> getAnalyses(@BindMethods("component") final Component component, final Iterable<UUID> vulnUuids);

src/main/java/org/dependencytrack/metrics/Metrics.java

@@ -69,7 +69,7 @@ public static void updatePortfolioMetrics() {
      */
     public static void updateProjectMetrics(final UUID projectUuid) {
         useJdbiHandle(handle -> handle
-                .createCall("CALL \"UPDATE_PROJECT_METRICS\"((:uuid)::VARCHAR)")
+                .createCall("CALL \"UPDATE_PROJECT_METRICS\"(:uuid)")
                 .bind("uuid", projectUuid)
                 .invoke());
     }
@@ -82,7 +82,7 @@ public static void updateProjectMetrics(final UUID projectUuid) {
      */
     public static void updateComponentMetrics(final UUID componentUuid) {
         useJdbiHandle(handle -> handle
-                .createCall("CALL \"UPDATE_COMPONENT_METRICS\"((:uuid)::VARCHAR)")
+                .createCall("CALL \"UPDATE_COMPONENT_METRICS\"(:uuid)")
                 .bind("uuid", componentUuid)
                 .invoke());
     }

src/main/java/org/dependencytrack/model/AffectedVersionAttribution.java

@@ -89,7 +89,7 @@ public class AffectedVersionAttribution implements Serializable {
 
     @Persistent(customValueStrategy = "uuid")
     @Unique(name = "AFFECTEDVERSIONATTRIBUTION_UUID_IDX")
-    @Column(name = "UUID", jdbcType = "VARCHAR", length = 36, allowsNull = "false")
+    @Column(name = "UUID", sqlType = "UUID", allowsNull = "false")
     private UUID uuid;
 
     public AffectedVersionAttribution() {

src/main/java/org/dependencytrack/model/Bom.java

@@ -100,7 +100,7 @@ public String getFormatLongName() {
 
     @Persistent(customValueStrategy = "uuid")
     @Unique(name = "BOM_UUID_IDX")
-    @Column(name = "UUID", jdbcType = "VARCHAR", length = 36, allowsNull = "false")
+    @Column(name = "UUID", sqlType = "UUID", allowsNull = "false")
     @NotNull
     private UUID uuid;
 

src/main/java/org/dependencytrack/model/Component.java

@@ -380,7 +380,7 @@ public enum FetchGroup {
 
     @Persistent(customValueStrategy = "uuid")
     @Unique(name = "COMPONENT_UUID_IDX")
-    @Column(name = "UUID", jdbcType = "VARCHAR", length = 36, allowsNull = "false")
+    @Column(name = "UUID", sqlType = "UUID", allowsNull = "false")
     @NotNull
     private UUID uuid;
 

src/main/java/org/dependencytrack/model/ComponentProperty.java

@@ -110,7 +110,7 @@ public Identity(final ComponentProperty property) {
 
     @Persistent(customValueStrategy = "uuid")
     @Unique(name = "COMPONENT_PROPERTY_UUID_IDX")
-    @Column(name = "UUID", allowsNull = "false")
+    @Column(name = "UUID", sqlType = "UUID", allowsNull = "false")
     @NotNull
     private UUID uuid;
 

src/main/java/org/dependencytrack/model/FindingAttribution.java

@@ -87,7 +87,7 @@ public class FindingAttribution implements Serializable {
 
     @Persistent(customValueStrategy = "uuid")
     @Unique(name = "FINDINGATTRIBUTION_UUID_IDX")
-    @Column(name = "UUID", jdbcType = "VARCHAR", length = 36, allowsNull = "false")
+    @Column(name = "UUID", sqlType = "UUID", allowsNull = "false")
     @NotNull
     private UUID uuid;
 

src/main/java/org/dependencytrack/model/License.java

@@ -216,7 +216,7 @@ public enum FetchGroup {
      */
     @Persistent(defaultFetchGroup = "true", customValueStrategy = "uuid")
     @Unique(name = "LICENSE_UUID_IDX")
-    @Column(name = "UUID", jdbcType = "VARCHAR", length = 36, allowsNull = "false")
+    @Column(name = "UUID", sqlType = "UUID", allowsNull = "false")
     @NotNull
     private UUID uuid;
 

src/main/java/org/dependencytrack/model/LicenseGroup.java

@@ -90,7 +90,7 @@ public class LicenseGroup implements Serializable {
      */
     @Persistent(customValueStrategy = "uuid")
     @Unique(name = "LICENSEGROUP_UUID_IDX")
-    @Column(name = "UUID", jdbcType = "VARCHAR", length = 36, allowsNull = "false")
+    @Column(name = "UUID", sqlType = "UUID", allowsNull = "false")
     @NotNull
     private UUID uuid;
 

src/main/java/org/dependencytrack/model/NotificationPublisher.java

@@ -110,7 +110,7 @@ public enum FetchGroup {
 
     @Persistent(defaultFetchGroup = "true", customValueStrategy = "uuid")
     @Unique(name = "NOTIFICATIONPUBLISHER_UUID_IDX")
-    @Column(name = "UUID", jdbcType = "VARCHAR", length = 36, allowsNull = "false")
+    @Column(name = "UUID", sqlType = "UUID", allowsNull = "false")
     @NotNull
     private UUID uuid;
 

src/main/java/org/dependencytrack/model/NotificationRule.java

@@ -144,7 +144,7 @@ public class NotificationRule implements Serializable {
 
     @Persistent(defaultFetchGroup = "true", customValueStrategy = "uuid")
     @Unique(name = "NOTIFICATIONRULE_UUID_IDX")
-    @Column(name = "UUID", jdbcType = "VARCHAR", length = 36, allowsNull = "false")
+    @Column(name = "UUID", sqlType = "UUID", allowsNull = "false")
     @NotNull
     private UUID uuid;
 

src/main/java/org/dependencytrack/model/Policy.java

@@ -131,7 +131,7 @@ public enum ViolationState {
      */
     @Persistent(customValueStrategy = "uuid")
     @Unique(name = "POLICY_UUID_IDX")
-    @Column(name = "UUID", jdbcType = "VARCHAR", length = 36, allowsNull = "false")
+    @Column(name = "UUID", sqlType = "UUID", allowsNull = "false")
     @NotNull
     private UUID uuid;
 

src/main/java/org/dependencytrack/model/PolicyCondition.java

@@ -130,7 +130,7 @@ public enum Subject {
      */
     @Persistent(customValueStrategy = "uuid")
     @Unique(name = "POLICYCONDITION_UUID_IDX")
-    @Column(name = "UUID", jdbcType = "VARCHAR", length = 36, allowsNull = "false")
+    @Column(name = "UUID", sqlType = "UUID", allowsNull = "false")
     @NotNull
     private UUID uuid;
 

src/main/java/org/dependencytrack/model/PolicyViolation.java

@@ -100,7 +100,7 @@ public enum Type {
      */
     @Persistent(customValueStrategy = "uuid")
     @Unique(name = "POLICYVIOLATION_UUID_IDX")
-    @Column(name = "UUID", jdbcType = "VARCHAR", length = 36, allowsNull = "false")
+    @Column(name = "UUID", sqlType = "UUID", allowsNull = "false")
     @NotNull
     private UUID uuid;
 

src/main/java/org/dependencytrack/model/Project.java

@@ -234,7 +234,7 @@ public enum FetchGroup {
 
     @Persistent(customValueStrategy = "uuid")
     @Unique(name = "PROJECT_UUID_IDX")
-    @Column(name = "UUID", jdbcType = "VARCHAR", length = 36, allowsNull = "false")
+    @Column(name = "UUID", sqlType = "UUID", allowsNull = "false")
     @NotNull
     private UUID uuid;
 

src/main/java/org/dependencytrack/model/Repository.java

@@ -103,8 +103,7 @@ public class Repository implements Serializable {
 
     @Persistent(customValueStrategy = "uuid")
     @Index(name = "REPOSITORY_UUID_IDX") // Cannot be @Unique. Microsoft SQL Server throws an exception
-    @Column(name = "UUID", jdbcType = "VARCHAR", length = 36, allowsNull = "true")
-    // New column, must allow nulls on existing databases
+    @Column(name = "UUID", sqlType = "UUID", allowsNull = "true")
     @NotNull
     private UUID uuid;
 

src/main/java/org/dependencytrack/model/ServiceComponent.java

@@ -190,7 +190,7 @@ public enum FetchGroup {
 
     @Persistent(customValueStrategy = "uuid")
     @Unique(name = "SERVICECOMPONENT_UUID_IDX")
-    @Column(name = "UUID", jdbcType = "VARCHAR", length = 36, allowsNull = "false")
+    @Column(name = "UUID", sqlType = "UUID", allowsNull = "false")
     @NotNull
     private UUID uuid;
 

src/main/java/org/dependencytrack/model/Vex.java

@@ -99,7 +99,7 @@ public String getFormatLongName() {
 
     @Persistent(customValueStrategy = "uuid")
     @Unique(name = "VEX_UUID_IDX")
-    @Column(name = "UUID", jdbcType = "VARCHAR", length = 36, allowsNull = "false")
+    @Column(name = "UUID", sqlType = "UUID", allowsNull = "false")
     @NotNull
     private UUID uuid;
 

src/main/java/org/dependencytrack/model/Vulnerability.java

@@ -316,7 +316,7 @@ public static boolean isKnownSource(String source) {
 
     @Persistent(customValueStrategy = "uuid")
     @Unique(name = "VULNERABILITY_UUID_IDX")
-    @Column(name = "UUID", jdbcType = "VARCHAR", length = 36, allowsNull = "false")
+    @Column(name = "UUID", sqlType = "UUID", allowsNull = "false")
     @NotNull
     private UUID uuid;
 

src/main/java/org/dependencytrack/model/VulnerabilityAlias.java

@@ -112,7 +112,7 @@ public class VulnerabilityAlias implements Serializable {
 
     @Persistent(customValueStrategy = "uuid")
     @Unique(name = "VULNERABILITYALIAS_UUID_IDX")
-    @Column(name = "UUID", jdbcType = "VARCHAR", length = 36, allowsNull = "false")
+    @Column(name = "UUID", sqlType = "UUID", allowsNull = "false")
     @NotNull
     private UUID uuid;
 

src/main/java/org/dependencytrack/model/VulnerabilityScan.java

@@ -54,8 +54,8 @@ public enum TargetType {
      */
     @Persistent
     @Unique(name = "VULNERABILITY_SCAN_TOKEN_IDX")
-    @Column(name = "TOKEN", allowsNull = "false")
-    private String token;
+    @Column(name = "TOKEN", sqlType = "UUID", allowsNull = "false")
+    private UUID token;
 
     /**
      * The type of the entity targeted by this scan.
@@ -68,7 +68,7 @@ public enum TargetType {
      * Unique identifier of the entity targeted by this scan.
      */
     @Persistent
-    @Column(name = "TARGET_IDENTIFIER", allowsNull = "false")
+    @Column(name = "TARGET_IDENTIFIER", sqlType = "UUID", allowsNull = "false")
     private UUID targetIdentifier;
 
     /**
@@ -135,11 +135,11 @@ public void setId(final long id) {
         this.id = id;
     }
 
-    public String getToken() {
+    public UUID getToken() {
         return token;
     }
 
-    public void setToken(final String token) {
+    public void setToken(final UUID token) {
         this.token = token;
     }
 

src/main/java/org/dependencytrack/model/VulnerableSoftware.java

@@ -170,7 +170,7 @@ public class VulnerableSoftware implements ICpe, Serializable {
 
     @Persistent(defaultFetchGroup = "true", customValueStrategy = "uuid")
     @Unique(name = "VULNERABLESOFTWARE_UUID_IDX")
-    @Column(name = "UUID", jdbcType = "VARCHAR", length = 36, allowsNull = "false")
+    @Column(name = "UUID", sqlType = "UUID", allowsNull = "false")
     private UUID uuid;
 
     private transient List<AffectedVersionAttribution> affectedVersionAttributions;

src/main/java/org/dependencytrack/model/WorkflowState.java

@@ -49,7 +49,7 @@ public class WorkflowState implements Serializable {
     private WorkflowState parent;
 
     @Persistent
-    @Column(name = "TOKEN", jdbcType = "VARCHAR", length = 36, allowsNull = "false")
+    @Column(name = "TOKEN", sqlType = "UUID", allowsNull = "false")
     @NotNull
     private UUID token;
 

src/main/java/org/dependencytrack/parser/cyclonedx/util/ModelConverter.java

@@ -846,9 +846,9 @@ public static org.cyclonedx.model.Service convert(final QueryManager qm, final S
 
     public static org.cyclonedx.model.vulnerability.Vulnerability convert(final QueryManager qm, final CycloneDXExporter.Variant variant,
                                                                           final Finding finding) {
-        final Component component = qm.getObjectByUuid(Component.class, (String) finding.getComponent().get("uuid"));
+        final Component component = qm.getObjectByUuid(Component.class, finding.getComponent().get("uuid").toString());
         final Project project = component.getProject();
-        final Vulnerability vulnerability = qm.getObjectByUuid(Vulnerability.class, (String) finding.getVulnerability().get("uuid"));
+        final Vulnerability vulnerability = qm.getObjectByUuid(Vulnerability.class, finding.getVulnerability().get("uuid").toString());
 
         final org.cyclonedx.model.vulnerability.Vulnerability cdxVulnerability = new org.cyclonedx.model.vulnerability.Vulnerability();
         cdxVulnerability.setBomRef(vulnerability.getUuid().toString());

src/main/java/org/dependencytrack/persistence/FindingsSearchQueryManager.java

@@ -124,9 +124,9 @@ public PaginatedResult getAllFindings(final Map<String, String> filters, final b
         final List<Object[]> list = totalList.subList(this.pagination.getOffset(), Math.min(this.pagination.getOffset() + this.pagination.getLimit(), totalList.size()));
         final List<Finding> findings = new ArrayList<>();
         for (final Object[] o : list) {
-            final Finding finding = new Finding(UUID.fromString((String) o[29]), o);
-            final Component component = getObjectByUuid(Component.class, (String) finding.getComponent().get("uuid"));
-            final Vulnerability vulnerability = getObjectByUuid(Vulnerability.class, (String) finding.getVulnerability().get("uuid"));
+            final Finding finding = new Finding((UUID) o[29], o);
+            final Component component = getObjectByUuid(Component.class, finding.getComponent().get("uuid").toString());
+            final Vulnerability vulnerability = getObjectByUuid(Vulnerability.class, finding.getVulnerability().get("uuid").toString());
             final Analysis analysis = getAnalysis(component, vulnerability);
             final List<VulnerabilityAlias> aliases = detach(getVulnerabilityAliases(vulnerability));
             aliases.forEach(alias -> alias.setUuid(null));

src/main/java/org/dependencytrack/persistence/QueryManager.java

@@ -1679,7 +1679,7 @@ public List<RepositoryMetaComponent> getRepositoryMetaComponents(final List<Repo
      * @return The created {@link VulnerabilityScan}
      */
     public VulnerabilityScan createVulnerabilityScan(final VulnerabilityScan.TargetType targetType,
-                                                     final UUID targetIdentifier, final String scanToken,
+                                                     final UUID targetIdentifier, final UUID scanToken,
                                                      final int expectedResults) {
         final Transaction trx = pm.currentTransaction();
         trx.setOptimistic(true);
@@ -1711,7 +1711,7 @@ public VulnerabilityScan createVulnerabilityScan(final VulnerabilityScan.TargetT
      * @param token The token that uniquely identifies the scan for clients
      * @return A {@link VulnerabilityScan}, or {@code null} when no {@link VulnerabilityScan} was found
      */
-    public VulnerabilityScan getVulnerabilityScan(final String token) {
+    public VulnerabilityScan getVulnerabilityScan(final UUID token) {
         final Transaction trx = pm.currentTransaction();
         trx.setOptimistic(true);
         trx.setRollbackOnly(); // We won't commit anything
@@ -1783,7 +1783,7 @@ -- record is not in the desired final state yet.
             final ResultSet rs = ps.executeQuery();
             if (rs.next()) {
                 final var vs = new VulnerabilityScan();
-                vs.setToken(scanToken);
+                vs.setToken(UUID.fromString(scanToken));
                 vs.setTargetType(VulnerabilityScan.TargetType.valueOf(rs.getString("TARGET_TYPE")));
                 vs.setTargetIdentifier(UUID.fromString(rs.getString("TARGET_IDENTIFIER")));
                 vs.setScanFailed(rs.getInt("SCAN_FAILED"));
@@ -1951,7 +1951,7 @@ public ComponentMetaInformation getMetaInformation(UUID uuid) {
             connection = (Connection) pm.getDataStoreConnection();
 
             preparedStatement = connection.prepareStatement(queryString);
-            preparedStatement.setString(1, uuid.toString());
+            preparedStatement.setObject(1, uuid);
             ResultSet resultSet = preparedStatement.executeQuery();
             if (resultSet.next()) {
                 Date publishedDate = null;