add REST API action for product policy violations

Signed-off-by: tdruez <tdruez@aboutcode.org>

Author: tdruez

product_portfolio/api.py

@@ -48,6 +48,7 @@
 from product_portfolio.models import ProductComponent
 from product_portfolio.models import ProductDependency
 from product_portfolio.models import ProductPackage
+from product_portfolio.models import ProductPolicyViolation
 from product_portfolio.models import ScanCodeProject
 from vulnerabilities.api import VulnerabilityAnalysisSerializer
 
@@ -343,6 +344,25 @@ class Meta:
         )
 
 
+class ProductPolicyViolationSerializer(serializers.ModelSerializer):
+    rule_label = serializers.ReadOnlyField()
+    rule_description = serializers.ReadOnlyField()
+    rule_severity = serializers.ReadOnlyField()
+
+    class Meta:
+        model = ProductPolicyViolation
+        fields = (
+            "rule_type",
+            "rule_label",
+            "rule_description",
+            "rule_severity",
+            "violation_count",
+            "detected_date",
+            "resolved",
+            "resolved_date",
+        )
+
+
 class ProductViewSet(
     ObjectPermissionsMixin,
     SendAboutFilesMixin,
@@ -413,6 +433,14 @@ def imports(self, request, uuid):
         projects_data = ScanCodeProjectSerializer(scancode_projects, many=True).data
         return Response(projects_data)
 
+    @action(detail=True, url_path="policy_violations")
+    def policy_violations(self, request, uuid):
+        """List active policy violations for this product, with rule details and counts."""
+        product = self.get_object()
+        violations = product.policy_violations.filter(resolved=False)
+        serializer = ProductPolicyViolationSerializer(violations, many=True)
+        return Response(serializer.data)
+
     @action(detail=True, methods=["post"], serializer_class=LoadSBOMsFormSerializer)
     def load_sboms(self, request, *args, **kwargs):
         """

product_portfolio/tests/test_api.py

@@ -43,6 +43,7 @@
 from product_portfolio.models import ProductComponent
 from product_portfolio.models import ProductItemPurpose
 from product_portfolio.models import ProductPackage
+from product_portfolio.models import ProductPolicyViolation
 from product_portfolio.models import ProductRelationStatus
 from product_portfolio.models import ProductStatus
 from product_portfolio.models import ScanCodeProject
@@ -717,6 +718,48 @@ def test_api_product_endpoint_manage_permissions_action(self):
         self.assertIn("errors", response.data)
 
 
+    def test_api_product_endpoint_policy_violations_action(self):
+        url = reverse("api_v2:product-policy-violations", args=[self.product1.uuid])
+
+        self.client.login(username=self.base_user.username, password="secret")
+        response = self.client.get(url)
+        self.assertEqual(status.HTTP_404_NOT_FOUND, response.status_code)
+
+        add_perm(self.base_user, "add_product")
+        assign_perm("view_product", self.base_user, self.product1)
+
+        response = self.client.get(url)
+        self.assertEqual(status.HTTP_200_OK, response.status_code)
+        self.assertEqual([], response.data)
+
+        violation = ProductPolicyViolation.objects.create(
+            product=self.product1,
+            dataspace=self.dataspace,
+            rule_type="usage_policy_error",
+            violation_count=5,
+        )
+
+        response = self.client.get(url)
+        self.assertEqual(status.HTTP_200_OK, response.status_code)
+        self.assertEqual(1, len(response.data))
+        entry = response.data[0]
+        self.assertEqual("usage_policy_error", entry["rule_type"])
+        self.assertEqual(5, entry["violation_count"])
+        self.assertFalse(entry["resolved"])
+        self.assertIsNone(entry["resolved_date"])
+        self.assertIn("rule_label", entry)
+        self.assertIn("rule_description", entry)
+        self.assertIn("rule_severity", entry)
+        self.assertIn("detected_date", entry)
+
+        violation.resolved = True
+        violation.save()
+
+        response = self.client.get(url)
+        self.assertEqual(status.HTTP_200_OK, response.status_code)
+        self.assertEqual([], response.data)
+
+
 class ProductRelatedAPITestCase(TestCase):
     def setUp(self):
         self.dataspace = Dataspace.objects.create(name="nexB")