enable rulsets per products

Signed-off-by: tdruez <tdruez@aboutcode.org>

Author: tdruez

product_portfolio/forms.py

@@ -58,6 +58,7 @@
 from product_portfolio.models import ScanCodeProject
 from product_portfolio.tasks import pull_project_data_from_scancodeio_task
 from product_portfolio.tasks import scancodeio_submit_project_task
+from vulnerabilities.triage.models import ProductTriageRuleset
 
 
 class NameVersionValidationFormMixin:
@@ -106,6 +107,7 @@ class ProductForm(
         ProductComponent,
         ProductPackage,
         CodebaseResource,
+        ProductTriageRuleset,
     ]
 
     keywords = KeywordsField()

product_portfolio/models.py

@@ -495,6 +495,9 @@ def get_export_security_compliance_url(self):
     def get_evaluate_policy_rules_url(self):
         return self.get_url("evaluate_policy_rules")
 
+    def get_manage_triage_rulesets_url(self):
+        return self.get_url("manage_triage_rulesets")
+
     @property
     def cyclonedx_bom_ref(self):
         return str(self.uuid)

product_portfolio/templates/product_portfolio/modals/manage_triage_rulesets_form.html

@@ -0,0 +1,35 @@
+{% load i18n %}
+<form id="manage-triage-rulesets-form">
+  {% if available_rulesets %}
+    <p class="text-body-secondary small px-3 pt-3 mb-0">
+      {% trans "Select the rules to activate for this product. Saving triggers an evaluation of all active packages." %}
+    </p>
+    <div class="list-group list-group-flush mt-2">
+      {% for ruleset in available_rulesets %}
+        <label class="list-group-item d-flex gap-3 py-3" for="ruleset_{{ ruleset.uuid }}">
+          <input class="form-check-input flex-shrink-0 mt-1"
+                 type="checkbox"
+                 name="ruleset_uuids"
+                 value="{{ ruleset.uuid }}"
+                 id="ruleset_{{ ruleset.uuid }}"
+                 {% if ruleset.id in assigned_ruleset_ids %}checked{% endif %}>
+          <span class="flex-grow-1">
+            <span class="d-flex justify-content-between align-items-baseline">
+              <strong>{{ ruleset.name }}</strong>
+              <span class="badge bg-secondary-subtle text-secondary-emphasis ms-2 flex-shrink-0">
+                {% trans "Precedence:" %} {{ ruleset.precedence }}
+              </span>
+            </span>
+            <span class="d-block small text-body-secondary">
+              {{ ruleset.action_label }}{% if ruleset.description %}, {{ ruleset.description }}{% endif %}
+            </span>
+          </span>
+        </label>
+      {% endfor %}
+    </div>
+  {% else %}
+    <p class="text-body-secondary px-3 py-3 mb-0">
+      {% trans "No triage rules are available in this dataspace." %}
+    </p>
+  {% endif %}
+</form>

product_portfolio/templates/product_portfolio/modals/manage_triage_rulesets_modal.html

@@ -0,0 +1,17 @@
+{% load i18n %}
+<div id="manage-triage-rulesets-modal" class="modal" tabindex="-1" role="dialog">
+  <div class="modal-dialog modal-lg" role="document">
+    <div class="modal-content">
+      <div class="modal-header">
+        <h5 class="modal-title">{% trans "Triage Rules" %}</h5>
+        <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+      </div>
+      <div id="manage-triage-rulesets-body" class="modal-body p-0">
+      </div>
+      <div class="modal-footer">
+        <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">{% trans "Close" %}</button>
+        <button type="button" id="submit-triage-rulesets" class="btn btn-primary">{% trans "Save" %}</button>
+      </div>
+    </div>
+  </div>
+</div>

product_portfolio/templates/product_portfolio/product_details.html

@@ -10,7 +10,7 @@
           <i class="fas fa-tasks"></i> Manage
         </button>
       </span>
-    {% elif has_edit_productcomponent or has_edit_productpackage or has_change_codebaseresource_permission or has_add_productcomponent %}
+    {% elif has_edit_productcomponent or has_edit_productpackage or has_change_codebaseresource_permission or has_add_productcomponent or has_change_permission %}
       <div class="dropdown btn-group">
         <a class="btn btn-outline-dark dropdown-toggle" data-bs-toggle="dropdown" role="button" href="#"><i class="fas fa-tasks"></i> {% trans 'Manage' %}</a>
         <div class="dropdown-menu dropdown-menu-end">
@@ -32,6 +32,16 @@
           {% if purldb_enabled %}
             <a class="dropdown-item" href="#" id="check-package-versions"><i class="fas fa-arrow-alt-circle-up"></i> {% trans 'Check for new Package versions' %}</a>
           {% endif %}
+          {% if has_change_permission and request.user.dataspace.enable_vulnerablecodedb_access %}
+            <hr class="dropdown-divider">
+            <div class="dropdown-header">{% trans "Vulnerabilities" %}</div>
+            <button class="dropdown-item" type="button"
+                    data-bs-toggle="modal"
+                    data-bs-target="#manage-triage-rulesets-modal"
+                    data-manage-url="{{ product.get_manage_triage_rulesets_url }}">
+              <i class="fas fa-filter me-1"></i> {% trans "Triage Rules" %}
+            </button>
+          {% endif %}
         </div>
       </div>
     {% endif %}
@@ -148,6 +158,9 @@
   {% if request.user.dataspace.enable_vulnerablecodedb_access and product.vulnerability_count %}
     {% include 'product_portfolio/modals/vulnerability_analysis_modal.html' %}
   {% endif %}
+  {% if has_change_permission and request.user.dataspace.enable_vulnerablecodedb_access %}
+    {% include 'product_portfolio/modals/manage_triage_rulesets_modal.html' %}
+  {% endif %}
 {% endblock %}
 
 {% block messages-alert %}
@@ -281,6 +294,39 @@
     </script>
   {% endif %}
 
+  {% if has_change_permission and request.user.dataspace.enable_vulnerablecodedb_access %}
+    <script>
+      document.addEventListener("DOMContentLoaded", function () {
+        const triageModal = document.getElementById("manage-triage-rulesets-modal");
+        if (!triageModal) return;
+
+        triageModal.addEventListener("show.bs.modal", function (event) {
+          const body = document.getElementById("manage-triage-rulesets-body");
+          body.innerHTML = "";
+          const manageUrl = event.relatedTarget.dataset.manageUrl;
+          document.getElementById("submit-triage-rulesets").dataset.manageUrl = manageUrl;
+          fetch(manageUrl)
+            .then(r => r.text())
+            .then(html => { body.innerHTML = html; })
+            .catch(() => { body.innerHTML = "Error loading content."; });
+        });
+
+        document.getElementById("submit-triage-rulesets").addEventListener("click", function () {
+          const manageUrl = this.dataset.manageUrl;
+          const form = document.getElementById("manage-triage-rulesets-form");
+          fetch(manageUrl, {
+            method: "POST",
+            headers: { "X-CSRFToken": csrftoken },
+            body: new FormData(form),
+          })
+            .then(r => r.json())
+            .then(data => { if (data.success) location.reload(); })
+            .catch(() => {});
+        });
+      });
+    </script>
+  {% endif %}
+
   {% if request.user.dataspace.enable_vulnerablecodedb_access and product.vulnerability_count %}
     <script>
       $(document).ready(function () {

product_portfolio/tests/test_views.py

@@ -278,7 +278,7 @@ def test_product_portfolio_detail_view_tab_vulnerability_queryset(self):
         self.client.login(username="nexb_user", password="secret")
         url = self.product1.get_url("tab_vulnerabilities")
 
-        with self.assertMaxQueries(9):
+        with self.assertMaxQueries(12):
             response = self.client.get(url)
         self.assertContains(response, "0 results")
 
@@ -292,20 +292,19 @@ def test_product_portfolio_detail_view_tab_vulnerability_queryset(self):
         self.assertEqual(4, product1.packages.vulnerable().count())
 
         url = product1.get_url("tab_vulnerabilities")
-        with self.assertMaxQueries(12):
+        with self.assertMaxQueries(15):
             response = self.client.get(url)
         self.assertContains(response, "4 results")
 
     def test_product_portfolio_tab_vulnerability_view_filters(self):
         self.client.login(username="nexb_user", password="secret")
         url = self.product1.get_url("tab_vulnerabilities")
         response = self.client.get(url)
-        self.assertContains(response, "?vulnerabilities-weighted_risk_score=#vulnerabilities")
-        self.assertContains(response, "?vulnerabilities-sort=weighted_risk_score#vulnerabilities")
-        response = self.client.get(
-            url + "?vulnerabilities-sort=weighted_risk_score#vulnerabilities"
+        self.assertContains(response, "?vulnerabilities-triage_action=#vulnerabilities")
+        self.assertContains(response, "?vulnerabilities-triage_action=upgrade#vulnerabilities")
+        self.assertContains(
+            response, "?vulnerabilities-vulnerability_analyses__state=#vulnerabilities"
         )
-        self.assertContains(response, "?vulnerabilities-sort=-weighted_risk_score#vulnerabilities")
 
     def test_product_portfolio_tab_vulnerability_view_packages_row_rendering(self):
         self.client.login(username="nexb_user", password="secret")
@@ -320,11 +319,9 @@ def test_product_portfolio_tab_vulnerability_view_packages_row_rendering(self):
         url = product1.get_url("tab_vulnerabilities")
         response = self.client.get(url)
         expected = f"""
-        <td rowspan="2">
-          <strong>
-            <a href="{p1.get_absolute_url()}#vulnerabilities" target="_blank">{p1}</a>
-          </strong>
-        </td>
+        <strong>
+          <a href="{p1.get_absolute_url()}#vulnerabilities" target="_blank">{p1}</a>
+        </strong>
         """
         self.assertContains(response, expected, html=True)
 
@@ -360,7 +357,7 @@ def test_product_portfolio_tab_vulnerability_view_queries(self):
         make_vulnerability_analysis(product_package2, vulnerability2)
 
         url = product1.get_url("tab_vulnerabilities")
-        with self.assertMaxQueries(12):
+        with self.assertMaxQueries(15):
             self.client.get(url)
 
     def test_product_portfolio_tab_vulnerability_risk_threshold(self):

product_portfolio/urls.py

@@ -46,6 +46,7 @@
 from product_portfolio.views import import_from_scan_view
 from product_portfolio.views import import_packages_from_scancodeio_view
 from product_portfolio.views import improve_packages_from_purldb_view
+from product_portfolio.views import manage_triage_rulesets_view
 from product_portfolio.views import scan_all_packages_view
 from product_portfolio.views import scancodeio_project_download_input_view
 from product_portfolio.views import scancodeio_project_status_view
@@ -131,6 +132,7 @@ def product_path(path_segment, view):
     *product_path("vulnerability_analysis_form", vulnerability_analysis_form_view),
     *product_path("scan_all_packages", scan_all_packages_view),
     *product_path("evaluate_policy_rules", evaluate_policy_rules_view),
+    *product_path("manage_triage_rulesets", manage_triage_rulesets_view),
     *product_path("improve_packages_from_purldb", improve_packages_from_purldb_view),
     *product_path("about_files", ProductSendAboutFilesView.as_view()),
     *product_path("export_spdx", ProductExportSPDXDocumentView.as_view()),

product_portfolio/views.py

@@ -150,8 +150,11 @@
 from vulnerabilities.models import Vulnerability
 from vulnerabilities.models import VulnerabilityAnalysis
 from vulnerabilities.models import get_risk_level
+from vulnerabilities.triage.engine import evaluate_ruleset
+from vulnerabilities.triage.models import ProductTriageRuleset
 from vulnerabilities.triage.models import TriageAction
 from vulnerabilities.triage.models import TriageRecord
+from vulnerabilities.triage.models import TriageRuleset
 
 TRIAGE_ACTION_STYLES = {
     "upgrade": ("bg-danger-subtle text-danger-emphasis", "fa-arrow-circle-up"),
@@ -2129,6 +2132,58 @@ def evaluate_policy_rules_view(request, dataspace, name, version=""):
     return HttpResponse(headers={"HX-Refresh": "true"})
 
 
+@login_required
+def manage_triage_rulesets_view(request, dataspace, name, version=""):
+    guarded_qs = Product.objects.get_queryset(request.user, perms="change_product")
+    product = get_object_or_404(
+        guarded_qs,
+        name=unquote_plus(name),
+        version=unquote_plus(version),
+        dataspace__name=dataspace,
+    )
+    available_rulesets = list(
+        TriageRuleset.objects.filter(dataspace=product.dataspace, enabled=True).order_by(
+            "-precedence", "name"
+        )
+    )
+
+    if request.method == "POST":
+        submitted_uuids = set(request.POST.getlist("ruleset_uuids"))
+        current_assignments = {
+            str(ptr.ruleset.uuid): ptr
+            for ptr in ProductTriageRuleset.objects.filter(product=product).select_related(
+                "ruleset"
+            )
+        }
+        for ruleset in available_rulesets:
+            ruleset_uuid = str(ruleset.uuid)
+            if ruleset_uuid in submitted_uuids and ruleset_uuid not in current_assignments:
+                ProductTriageRuleset.objects.create(
+                    product=product,
+                    ruleset=ruleset,
+                    dataspace=product.dataspace,
+                )
+                evaluate_ruleset(ruleset=ruleset, product=product)
+        for ruleset_uuid, assignment in current_assignments.items():
+            if ruleset_uuid not in submitted_uuids:
+                assignment.delete()
+        return JsonResponse({"success": True})
+
+    assigned_ruleset_ids = set(product.product_triage_rulesets.values_list("ruleset_id", flat=True))
+    action_labels = dict(TriageAction.choices)
+    for ruleset in available_rulesets:
+        ruleset.action_label = action_labels.get(ruleset.action, ruleset.action)
+
+    return render(
+        request,
+        "product_portfolio/modals/manage_triage_rulesets_form.html",
+        {
+            "available_rulesets": available_rulesets,
+            "assigned_ruleset_ids": assigned_ruleset_ids,
+        },
+    )
+
+
 @login_required
 def import_from_scan_view(request, dataspace, name, version=""):
     """

vulnerabilities/triage/admin.py

@@ -100,5 +100,3 @@ def get_fieldsets(self, request, obj=None):
                 )
             )
         return base_fieldsets + rule_fieldsets
-
-

vulnerabilities/triage/models.py

@@ -93,9 +93,7 @@ def primary_actions(self):
             self.model.objects.filter(
                 product_package=OuterRef("product_package"),
                 ruleset__enabled=True,
-                ruleset__product_triage_rulesets__product=OuterRef(
-                    "product_package__product"
-                ),
+                ruleset__product_triage_rulesets__product=OuterRef("product_package__product"),
             )
             .order_by("-ruleset__precedence", "ruleset__name")
             .values("ruleset_id")[:1]