add analisys preset system

Signed-off-by: tdruez <tdruez@aboutcode.org>

Author: tdruez

vulnerabilities/forms.py

@@ -97,6 +97,7 @@ def helper(self):
         return helper
 
     def save(self, *args, **kwargs):
+        self.instance.applied_by_preset = None
         instance = super().save(*args, **kwargs)
 
         if products := self.cleaned_data.get("propagate_to_products"):

vulnerabilities/migrations/0011_vulnerabilityanalysis_applied_by_preset.py

@@ -0,0 +1,20 @@
+# Generated by Django 6.0.6 on 2026-08-12 06:37
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('vulnerabilities', '0010_api_v3_remove_old_fields'),
+        ('vulnerabilities_triage', '0002_analysispreset_triageruleset_analysis_preset'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='vulnerabilityanalysis',
+            name='applied_by_preset',
+            field=models.ForeignKey(blank=True, help_text='The analysis preset that automatically created this analysis. Cleared when a user edits the analysis manually.', null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='applied_analyses', to='vulnerabilities_triage.analysispreset'),
+        ),
+    ]

vulnerabilities/models.py

@@ -274,8 +274,8 @@ def as_cyclonedx(self, affected_instances, analysis=None):
         )
 
 
-class VulnerabilityAnalysisMixin(models.Model):
-    """Aligned with the cyclonedx.model.vulnerability.VulnerabilityAnalysis"""
+class VulnerabilityAnalysisContentMixin(models.Model):
+    """Core analysis content fields, shared with AnalysisPreset. CycloneDX-aligned."""
 
     # cyclonedx.model.impact_analysis.ImpactAnalysisState
     class State(models.TextChoices):
@@ -344,6 +344,14 @@ class Response(models.TextChoices):
             "details on why the component or service is not impacted by this vulnerability."
         ),
     )
+
+    class Meta:
+        abstract = True
+
+
+class VulnerabilityAnalysisMixin(VulnerabilityAnalysisContentMixin):
+    """Aligned with the cyclonedx.model.vulnerability.VulnerabilityAnalysis"""
+
     first_issued = models.DateTimeField(
         auto_now_add=True,
         help_text=_("The date and time (timestamp) when the analysis was first issued."),
@@ -546,6 +554,17 @@ class VulnerabilityAnalysis(
             "product package."
         ),
     )
+    applied_by_preset = models.ForeignKey(
+        to="vulnerabilities_triage.AnalysisPreset",
+        on_delete=models.SET_NULL,
+        null=True,
+        blank=True,
+        related_name="applied_analyses",
+        help_text=_(
+            "The analysis preset that automatically created this analysis."
+            " Cleared when a user edits the analysis manually."
+        ),
+    )
 
     objects = DataspacedManager.from_queryset(ProductSecuredQuerySet)()
 

vulnerabilities/triage/admin.py

@@ -12,12 +12,61 @@
 
 from dje.admin import DataspacedAdmin
 from dje.admin import dejacode_site
+from vulnerabilities.triage.forms import AnalysisPresetForm
 from vulnerabilities.triage.forms import TriageRulesetForm
+from vulnerabilities.triage.models import AnalysisPreset
 from vulnerabilities.triage.models import TriageAction
 from vulnerabilities.triage.models import TriageRuleset
 from vulnerabilities.triage.rules import RULE_REGISTRY
 
 
+@admin.register(AnalysisPreset, site=dejacode_site)
+class AnalysisPresetAdmin(DataspacedAdmin):
+    form = AnalysisPresetForm
+    short_description = (
+        "An Analysis Preset defines default vulnerability analysis values that the triage"
+        " engine applies automatically when an assigned ruleset fires."
+    )
+    long_description = (
+        "Only non-blank preset fields are applied. Analyses already modified by a human"
+        " are never overwritten. When a user edits an auto-applied analysis, the preset"
+        " link is cleared and the analysis becomes human-owned."
+    )
+    list_display = [
+        "name",
+        "state",
+        "justification",
+        "get_responses",
+        "is_reachable",
+        "description",
+        "get_dataspace",
+    ]
+    search_fields = ["name"]
+    fieldsets = [
+        (
+            None,
+            {"fields": ["name", "description"]},
+        ),
+        (
+            "Analysis defaults",
+            {
+                "fields": ["state", "justification", "responses", "detail", "is_reachable"],
+                "description": (
+                    "Leave a field blank to leave it unchanged on the analysis."
+                    " At least one field should be set."
+                ),
+            },
+        ),
+    ]
+
+    @admin.display(description="Responses")
+    def get_responses(self, obj):
+        if not obj.responses:
+            return ""
+        labels = dict(AnalysisPreset.Response.choices)
+        return ", ".join(labels.get(response, response) for response in obj.responses)
+
+
 @admin.register(TriageRuleset, site=dejacode_site)
 class TriageRulesetAdmin(DataspacedAdmin):
     short_description = (
@@ -39,6 +88,7 @@ class TriageRulesetAdmin(DataspacedAdmin):
         "get_action_label",
         "precedence",
         "get_enabled_rules",
+        "analysis_preset",
         "description",
         "enabled",
         "get_dataspace",
@@ -74,14 +124,30 @@ def get_changes_details(self, form):
         return super().get_changes_details(form)
 
     def get_form(self, request, obj=None, change=False, **kwargs):
-        kwargs["fields"] = ["name", "description", "action", "precedence", "enabled"]
+        kwargs["fields"] = [
+            "name",
+            "description",
+            "action",
+            "precedence",
+            "enabled",
+            "analysis_preset",
+        ]
         return super().get_form(request, obj, change=change, **kwargs)
 
     def get_fieldsets(self, request, obj=None):
         base_fieldsets = [
             (
                 None,
-                {"fields": ["name", "description", "action", "precedence", "enabled"]},
+                {
+                    "fields": [
+                        "name",
+                        "description",
+                        "action",
+                        "precedence",
+                        "enabled",
+                        "analysis_preset",
+                    ]
+                },
             ),
         ]
         rule_fieldsets = []

vulnerabilities/triage/engine.py

@@ -6,6 +6,8 @@
 # See https://aboutcode.org for more information about AboutCode FOSS projects.
 #
 
+from django.apps import apps
+
 from vulnerabilities.triage.models import TriageRecord
 from vulnerabilities.triage.rules import RULE_REGISTRY
 
@@ -37,10 +39,75 @@ def collect_matches(ruleset, product):
     return matched_rules_per_vulnerability_id
 
 
+def apply_preset_for_vulnerabilities(preset, product, vulnerability_ids):
+    """
+    For each (product_package, vulnerability) pair in the product, create or update
+    a VulnerabilityAnalysis using preset values.
+
+    Skips any analysis already modified by a human (applied_by_preset is null on an
+    existing record). Only analyses that were auto-created (applied_by_preset is set)
+    or brand-new are touched.
+    """
+    VulnerabilityAnalysis = apps.get_model("vulnerabilities", "VulnerabilityAnalysis")
+    ProductPackage = apps.get_model("product_portfolio", "ProductPackage")
+
+    vulnerability_ids = list(vulnerability_ids)
+
+    # One query: exact (product_package_id, vulnerability_id) pairs to process.
+    # Filtering by __id__in on the M2M restricts the JOIN rows to the matching
+    # vulnerabilities, so values_list returns only the pairs we want.
+    pp_vuln_pairs = set(
+        ProductPackage.objects.filter(
+            product=product,
+            package__affected_by_vulnerabilities__id__in=vulnerability_ids,
+        )
+        .values_list("id", "package__affected_by_vulnerabilities__id")
+        .distinct()
+    )
+
+    if not pp_vuln_pairs:
+        return
+
+    pp_ids = {pp_id for pp_id, _ in pp_vuln_pairs}
+
+    # One query: all existing analyses for this product_package / vulnerability set
+    existing_analyses = {
+        (analysis.product_package_id, analysis.vulnerability_id): analysis
+        for analysis in VulnerabilityAnalysis.objects.filter(
+            product_package_id__in=pp_ids,
+            vulnerability_id__in=vulnerability_ids,
+        )
+    }
+
+    # One query: product_package instances needed to construct new analyses
+    product_packages_by_id = {pp.pk: pp for pp in ProductPackage.objects.filter(pk__in=pp_ids)}
+
+    for product_package_id, vulnerability_id in pp_vuln_pairs:
+        existing = existing_analyses.get((product_package_id, vulnerability_id))
+
+        if existing is not None and existing.applied_by_preset_id is None:
+            continue  # Human-owned analysis -- never overwrite
+
+        if existing is None:
+            product_package = product_packages_by_id[product_package_id]
+            analysis = VulnerabilityAnalysis(
+                product_package=product_package,
+                vulnerability_id=vulnerability_id,
+                dataspace_id=product.dataspace_id,
+            )
+        else:
+            analysis = existing
+
+        preset.apply_to_analysis(analysis)
+        analysis.applied_by_preset = preset
+        analysis.save()
+
+
 def sync_triage_records(ruleset, product, matched_rules_per_vulnerability_id):
     """
     Create or update one TriageRecord per matching vulnerability, then
     delete records for vulnerabilities that no longer match any rule in the ruleset.
+    Applies the ruleset's analysis_preset when configured.
     """
     for vulnerability_id, matched_rules in matched_rules_per_vulnerability_id.items():
         TriageRecord.objects.update_or_create(
@@ -59,6 +126,13 @@ def sync_triage_records(ruleset, product, matched_rules_per_vulnerability_id):
         product=product,
     ).exclude(vulnerability_id__in=matched_rules_per_vulnerability_id.keys()).delete()
 
+    if ruleset.analysis_preset_id and matched_rules_per_vulnerability_id:
+        apply_preset_for_vulnerabilities(
+            preset=ruleset.analysis_preset,
+            product=product,
+            vulnerability_ids=list(matched_rules_per_vulnerability_id.keys()),
+        )
+
 
 def evaluate_ruleset(ruleset, product):
     """Evaluate a TriageRuleset against a product and persist the results."""

vulnerabilities/triage/forms.py

@@ -9,11 +9,33 @@
 from django import forms
 
 from dje.forms import DataspacedAdminForm
+from vulnerabilities.models import VulnerabilityAnalysisContentMixin
+from vulnerabilities.triage.models import AnalysisPreset
 from vulnerabilities.triage.models import TriageAction
 from vulnerabilities.triage.models import TriageRuleset
 from vulnerabilities.triage.rules import RULE_REGISTRY
 
 
+class AnalysisPresetForm(DataspacedAdminForm):
+    responses = forms.MultipleChoiceField(
+        choices=VulnerabilityAnalysisContentMixin.Response.choices,
+        widget=forms.CheckboxSelectMultiple,
+        required=False,
+    )
+
+    class Meta:
+        model = AnalysisPreset
+        fields = [
+            "name",
+            "description",
+            "state",
+            "justification",
+            "responses",
+            "detail",
+            "is_reachable",
+        ]
+
+
 class TriageRulesetForm(DataspacedAdminForm):
     action = forms.ChoiceField(
         choices=[("", "---------")] + list(TriageAction.choices),
@@ -22,7 +44,7 @@ class TriageRulesetForm(DataspacedAdminForm):
 
     class Meta:
         model = TriageRuleset
-        fields = ["name", "description", "action", "precedence", "enabled"]
+        fields = ["name", "description", "action", "precedence", "enabled", "analysis_preset"]
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)