add missing unit test for full coverage

Signed-off-by: tdruez <tdruez@aboutcode.org>

Author: tdruez

product_portfolio/admin.py

@@ -72,6 +72,7 @@
 from product_portfolio.models import ProductRelationStatus
 from product_portfolio.models import ProductStatus
 from reporting.filters import ReportingQueryListFilter
+from vulnerabilities.triage.models import ProductTriageRuleset
 
 
 @admin.register(ProductStatus, site=dejacode_site)
@@ -240,7 +241,7 @@ def save_model(self, request, obj, form, change):
         if "_saveasnew" in request.POST:
             old_product_id = request.resolver_match.kwargs.get("object_id")
             old_product = self.get_object(request, old_product_id)
-            for model_class in [ProductComponent, ProductPackage]:
+            for model_class in [ProductComponent, ProductPackage, ProductTriageRuleset]:
                 for relationship in model_class.objects.filter(product=old_product):
                     relationship.id = None
                     relationship.uuid = uuid.uuid4()

product_portfolio/tests/test_admin.py

@@ -25,6 +25,8 @@
 from product_portfolio.models import ProductComponent
 from product_portfolio.models import ProductPackage
 from product_portfolio.tests import make_product_dependency
+from vulnerabilities.triage.models import ProductTriageRuleset
+from vulnerabilities.triage.models import TriageRuleset
 
 
 class ProductPortfolioAdminsTestCase(TestCase):
@@ -430,6 +432,12 @@ def test_product_admin_changeform_save_as_includes_relationships(self):
         ProductPackage.objects.create(
             product=self.product1, package=self.package1, dataspace=self.dataspace
         )
+        ruleset = TriageRuleset.objects.create(
+            name="Upgrade Ruleset", precedence=100, dataspace=self.dataspace
+        )
+        ProductTriageRuleset.objects.create(
+            product=self.product1, ruleset=ruleset, dataspace=self.dataspace
+        )
 
         url = self.product1.get_admin_url()
         data = {
@@ -447,6 +455,7 @@ def test_product_admin_changeform_save_as_includes_relationships(self):
         new_product = Product.unsecured_objects.get(name=self.product1.name, version="new version")
         self.assertEqual(1, new_product.productcomponents.count())
         self.assertEqual(1, new_product.productpackages.count())
+        self.assertEqual(1, new_product.product_triage_rulesets.count())
 
     def test_codebaseresource_admin_changeform_product_prefill_on_save_addanother(self):
         self.client.login(username=self.user.username, password="secret")

product_portfolio/tests/test_filters.py

@@ -26,6 +26,10 @@
 from product_portfolio.tests import make_product_component
 from product_portfolio.tests import make_product_package
 from vulnerabilities.tests import make_vulnerability
+from vulnerabilities.triage.engine import evaluate_ruleset
+from vulnerabilities.triage.models import ProductTriageRuleset
+from vulnerabilities.triage.models import TriageAction
+from vulnerabilities.triage.models import TriageRuleset
 
 
 class ProductPackageFilterSetTestCase(TestCase):
@@ -187,6 +191,47 @@ def test_filter_by_vulnerability_rule_returns_distinct_results(self):
         self.assertEqual(1, filterset.qs.count())
 
 
+class ProductPackageFilterByTriageActionTestCase(TestCase):
+    def setUp(self):
+        self.dataspace = Dataspace.objects.create(name="nexB")
+        self.product = make_product(self.dataspace)
+        self.pp_with_recommendation = make_product_package(
+            self.product, make_package(self.dataspace)
+        )
+        self.pp_without_recommendation = make_product_package(
+            self.product, make_package(self.dataspace)
+        )
+        make_vulnerability(
+            self.dataspace, affecting=self.pp_with_recommendation.package, risk_score=9.0
+        )
+        ruleset = TriageRuleset.objects.create(
+            name="Upgrade Ruleset",
+            action=TriageAction.UPGRADE,
+            precedence=100,
+            dataspace=self.dataspace,
+            rules_config={"risk_score": {"is_active": True, "min_risk_score": 8.0}},
+        )
+        ProductTriageRuleset.objects.create(
+            product=self.product, ruleset=ruleset, dataspace=self.dataspace
+        )
+        evaluate_ruleset(ruleset, self.product)
+
+    def test_filter_by_triage_action_filters_matching_packages(self):
+        filterset = ProductPackageFilterSet(
+            dataspace=self.dataspace,
+            data={"triage_action": "upgrade"},
+        )
+        self.assertIn(self.pp_with_recommendation, filterset.qs)
+        self.assertNotIn(self.pp_without_recommendation, filterset.qs)
+
+    def test_filter_by_triage_action_excludes_non_matching_action(self):
+        filterset = ProductPackageFilterSet(
+            dataspace=self.dataspace,
+            data={"triage_action": "notify"},
+        )
+        self.assertNotIn(self.pp_with_recommendation, filterset.qs)
+
+
 class ProductComponentFilterByRuleTestCase(TestCase):
     def setUp(self):
         self.dataspace = Dataspace.objects.create(name="nexB")

product_portfolio/tests/test_views.py

@@ -64,6 +64,7 @@
 from vulnerabilities.models import VulnerabilityAnalysis
 from vulnerabilities.tests import make_vulnerability
 from vulnerabilities.tests import make_vulnerability_analysis
+from vulnerabilities.triage.models import AnalysisPreset
 from vulnerabilities.triage.models import ProductTriageRuleset
 from vulnerabilities.triage.models import TriageAction
 from vulnerabilities.triage.models import TriageRuleset
@@ -1994,6 +1995,12 @@ def test_product_portfolio_product_update_save_as_new(self):
         CodebaseResource.objects.create(
             path="/path1/", product=self.product1, dataspace=self.dataspace
         )
+        ruleset = TriageRuleset.objects.create(
+            name="Upgrade Ruleset", precedence=100, dataspace=self.dataspace
+        )
+        ProductTriageRuleset.objects.create(
+            product=self.product1, ruleset=ruleset, dataspace=self.dataspace
+        )
         initial_product_count = Product.objects.get_queryset(self.super_user).count()
 
         data = {
@@ -2015,6 +2022,7 @@ def test_product_portfolio_product_update_save_as_new(self):
         self.assertEqual(1, cloned_product.productcomponents.count())
         self.assertEqual(1, cloned_product.productpackages.count())
         self.assertEqual(1, cloned_product.codebaseresources.count())
+        self.assertEqual(1, cloned_product.product_triage_rulesets.count())
 
     def test_product_portfolio_product_delete_view(self):
         delete_url = self.product1.get_delete_url()
@@ -3423,6 +3431,54 @@ def test_product_portfolio_vulnerability_analysis_form_view(self):
         self.assertEqual(vulnerability1, analysis.vulnerability)
         self.assertEqual("resolved", analysis.state)
 
+    def test_product_portfolio_apply_analysis_preset_view(self):
+        self.client.login(username=self.super_user.username, password="secret")
+
+        package1 = make_package(self.dataspace)
+        vulnerability1 = make_vulnerability(self.dataspace, affecting=[package1])
+        product1 = make_product(self.dataspace, inventory=[package1])
+        product_package = ProductPackage.objects.get(product=product1, package=package1)
+        preset = AnalysisPreset.objects.create(
+            name="Preset1",
+            state="not_affected",
+            detail="Not deployed",
+            dataspace=self.dataspace,
+        )
+
+        url = reverse(
+            "product_portfolio:apply_analysis_preset",
+            args=[product_package.uuid, preset.pk, vulnerability1.advisory_uid],
+        )
+        response = self.client.post(url)
+        self.assertEqual(200, response.status_code)
+        self.assertEqual(b'{"success": "applied"}', response.content)
+        analysis = VulnerabilityAnalysis.objects.get()
+        self.assertEqual(product_package, analysis.product_package)
+        self.assertEqual(vulnerability1, analysis.vulnerability)
+        self.assertEqual("not_affected", analysis.state)
+        self.assertEqual(preset, analysis.applied_by_preset)
+
+    def test_product_portfolio_apply_analysis_preset_view_existing_analysis(self):
+        self.client.login(username=self.super_user.username, password="secret")
+
+        package1 = make_package(self.dataspace)
+        vulnerability1 = make_vulnerability(self.dataspace, affecting=[package1])
+        product1 = make_product(self.dataspace, inventory=[package1])
+        product_package = ProductPackage.objects.get(product=product1, package=package1)
+        make_vulnerability_analysis(product_package, vulnerability1, state="exploitable")
+        preset = AnalysisPreset.objects.create(
+            name="Preset1", state="not_affected", dataspace=self.dataspace
+        )
+
+        url = reverse(
+            "product_portfolio:apply_analysis_preset",
+            args=[product_package.uuid, preset.pk, vulnerability1.advisory_uid],
+        )
+        response = self.client.post(url)
+        self.assertEqual(400, response.status_code)
+        self.assertEqual(1, VulnerabilityAnalysis.objects.count())
+        self.assertEqual("exploitable", VulnerabilityAnalysis.objects.get().state)
+
     def test_product_portfolio_tab_compliance_view_empty(self):
         self.client.login(username="nexb_user", password="secret")
         url = self.product1.get_url("tab_compliance")
@@ -4295,6 +4351,85 @@ def test_post_with_change_perm_evaluates_and_returns_hx_refresh(self, mock_evalu
         mock_evaluate.assert_called_once_with(self.product1)
 
 
+class ManageTriageRulesetsViewTestCase(TestCase):
+    def setUp(self):
+        self.dataspace = Dataspace.objects.create(name="nexB")
+        self.super_user = create_superuser("nexb_user", self.dataspace)
+        self.basic_user = create_user("basic_user", self.dataspace)
+        self.product1 = Product.objects.create(
+            name="Product1", version="1.0", dataspace=self.dataspace
+        )
+        self.ruleset = TriageRuleset.objects.create(
+            name="Upgrade Ruleset",
+            action=TriageAction.UPGRADE,
+            precedence=100,
+            dataspace=self.dataspace,
+        )
+
+    def test_get_without_login_redirects(self):
+        url = self.product1.get_manage_triage_rulesets_url()
+        response = self.client.get(url)
+        self.assertEqual(302, response.status_code)
+
+    def test_get_without_change_perm_returns_404(self):
+        self.client.login(username="basic_user", password="secret")
+        url = self.product1.get_manage_triage_rulesets_url()
+        response = self.client.get(url)
+        self.assertEqual(404, response.status_code)
+
+    def test_get_with_change_perm_renders_available_rulesets(self):
+        self.client.login(username="nexb_user", password="secret")
+        url = self.product1.get_manage_triage_rulesets_url()
+        response = self.client.get(url)
+        self.assertEqual(200, response.status_code)
+        self.assertContains(response, self.ruleset.name)
+        self.assertNotContains(response, "checked")
+
+    def test_get_marks_the_assigned_rulesets_as_checked(self):
+        ProductTriageRuleset.objects.create(
+            product=self.product1, ruleset=self.ruleset, dataspace=self.dataspace
+        )
+        self.client.login(username="nexb_user", password="secret")
+        url = self.product1.get_manage_triage_rulesets_url()
+        response = self.client.get(url)
+        self.assertContains(response, "checked")
+
+    def test_post_without_change_perm_returns_404(self):
+        self.client.login(username="basic_user", password="secret")
+        url = self.product1.get_manage_triage_rulesets_url()
+        response = self.client.post(url)
+        self.assertEqual(404, response.status_code)
+
+    @patch("product_portfolio.views.evaluate_ruleset")
+    def test_post_assigns_the_submitted_rulesets(self, mock_evaluate):
+        self.client.login(username="nexb_user", password="secret")
+        url = self.product1.get_manage_triage_rulesets_url()
+        response = self.client.post(url, {"ruleset_uuids": [str(self.ruleset.uuid)]})
+        self.assertEqual(b'{"success": true}', response.content)
+        self.assertTrue(
+            ProductTriageRuleset.objects.filter(
+                product=self.product1, ruleset=self.ruleset
+            ).exists()
+        )
+        mock_evaluate.assert_called_once_with(ruleset=self.ruleset, product=self.product1)
+
+    @patch("product_portfolio.views.evaluate_ruleset")
+    def test_post_unassigns_the_deselected_rulesets(self, mock_evaluate):
+        ProductTriageRuleset.objects.create(
+            product=self.product1, ruleset=self.ruleset, dataspace=self.dataspace
+        )
+        self.client.login(username="nexb_user", password="secret")
+        url = self.product1.get_manage_triage_rulesets_url()
+        response = self.client.post(url, {"ruleset_uuids": []})
+        self.assertEqual(b'{"success": true}', response.content)
+        self.assertFalse(
+            ProductTriageRuleset.objects.filter(
+                product=self.product1, ruleset=self.ruleset
+            ).exists()
+        )
+        mock_evaluate.assert_not_called()
+
+
 class TabCompliancePolicyContextTestCase(TestCase):
     def setUp(self):
         self.dataspace = Dataspace.objects.create(name="nexB")

vulnerabilities/tests/test_forms.py

@@ -16,6 +16,7 @@
 from product_portfolio.tests import make_product_package
 from vulnerabilities.forms import VulnerabilityAnalysisForm
 from vulnerabilities.tests import make_vulnerability
+from vulnerabilities.triage.models import AnalysisPreset
 
 
 class VulnerabilitiesFormsTestCase(TestCase):
@@ -49,6 +50,31 @@ def test_vulnerability_forms_vulnerability_analysis_save(self):
         self.assertEqual(product_package1.package, analysis.package)
         self.assertEqual(data["detail"], analysis.detail)
 
+    def test_vulnerability_forms_vulnerability_analysis_save_clears_applied_by_preset(self):
+        product_package1 = make_product_package(make_product(self.dataspace))
+        vulnerability1 = make_vulnerability(
+            dataspace=self.dataspace, affecting=[product_package1.package]
+        )
+        preset = AnalysisPreset.objects.create(
+            name="Preset1", state="not_affected", dataspace=self.dataspace
+        )
+        analysis = product_package1.vulnerability_analyses.create(
+            vulnerability=vulnerability1,
+            dataspace=self.dataspace,
+            state="not_affected",
+            applied_by_preset=preset,
+        )
+
+        data = {
+            "product_package": product_package1,
+            "vulnerability": vulnerability1,
+            "detail": "Human edit",
+        }
+        form = VulnerabilityAnalysisForm(user=self.super_user, data=data, instance=analysis)
+        self.assertTrue(form.is_valid())
+        saved_analysis = form.save()
+        self.assertIsNone(saved_analysis.applied_by_preset)
+
     def test_vulnerability_forms_vulnerability_analysis_propagate_to_products(self):
         product_package1 = make_product_package(make_product(self.dataspace))
         vulnerability1 = make_vulnerability(

vulnerabilities/triage/tests/test_forms.py

@@ -0,0 +1,63 @@
+#
+# Copyright (c) nexB Inc. and others. All rights reserved.
+# DejaCode is a trademark of nexB Inc.
+# SPDX-License-Identifier: AGPL-3.0-only
+# See https://github.com/aboutcode-org/dejacode for support or download.
+# See https://aboutcode.org for more information about AboutCode FOSS projects.
+#
+
+from django.test import TestCase
+
+from dje.models import Dataspace
+from vulnerabilities.triage.forms import TriageRulesetForm
+from vulnerabilities.triage.models import TriageRuleset
+
+
+class TriageRulesetFormTestCase(TestCase):
+    def setUp(self):
+        self.dataspace = Dataspace.objects.create(name="nexB")
+
+    def test_adds_a_dynamic_field_pair_for_every_registered_rule(self):
+        form = TriageRulesetForm(instance=TriageRuleset(dataspace=self.dataspace))
+        self.assertIn("rule_risk_score_enabled", form.fields)
+        self.assertIn("rule_risk_score_min_risk_score", form.fields)
+        self.assertIn("rule_exploited_vulnerability_enabled", form.fields)
+        self.assertNotIn("rule_exploited_vulnerability_min_risk_score", form.fields)
+
+    def test_save_builds_rules_config_from_the_submitted_rule_fields(self):
+        data = {
+            "name": "My Ruleset",
+            "precedence": 100,
+            "rule_risk_score_enabled": "on",
+            "rule_risk_score_min_risk_score": "7.5",
+            "rule_exploited_vulnerability_enabled": "on",
+        }
+        form = TriageRulesetForm(data=data, instance=TriageRuleset(dataspace=self.dataspace))
+        self.assertTrue(form.is_valid(), form.errors)
+
+        ruleset = form.save()
+
+        self.assertEqual(
+            {"is_active": True, "min_risk_score": 7.5}, ruleset.rules_config["risk_score"]
+        )
+        self.assertEqual({"is_active": True}, ruleset.rules_config["exploited_vulnerability"])
+
+    def test_save_drops_an_inactive_rule_that_has_no_parameters(self):
+        data = {"name": "My Ruleset", "precedence": 100}
+        form = TriageRulesetForm(data=data, instance=TriageRuleset(dataspace=self.dataspace))
+        self.assertTrue(form.is_valid(), form.errors)
+
+        ruleset = form.save()
+
+        self.assertNotIn("exploited_vulnerability", ruleset.rules_config)
+
+    def test_save_keeps_an_inactive_rule_that_has_parameters_with_their_defaults(self):
+        data = {"name": "My Ruleset", "precedence": 100}
+        form = TriageRulesetForm(data=data, instance=TriageRuleset(dataspace=self.dataspace))
+        self.assertTrue(form.is_valid(), form.errors)
+
+        ruleset = form.save()
+
+        self.assertEqual(
+            {"is_active": False, "min_risk_score": 8.0}, ruleset.rules_config["risk_score"]
+        )