fix unit tests

Signed-off-by: tdruez <tdruez@aboutcode.org>

Author: tdruez

dejacode/static/css/dejacode_bootstrap.css

@@ -417,8 +417,8 @@ table.vulnerabilities-table .column-summary {
   width: 240px;
 }
 #tab_vulnerabilities .column-affected_packages {
-  min-width: 300px;
-  width: 300px;
+  min-width: 310px;
+  width: 310px;
 }
 #tab_vulnerabilities .column-triage_action {
   min-width: 165px;

vulnerabilities/tests/test_fetch.py

@@ -85,25 +85,28 @@ def test_vulnerabilities_fetch_for_packages(self, mock_bulk_search_by_purl):
         response_json = json.loads(response_file.read_text())
         mock_bulk_search_by_purl.return_value = response_json
 
-        with self.assertNumQueries(12):
+        with self.assertNumQueries(13):
             results = fetch_for_packages(
                 queryset, self.dataspace, batch_size=1, update=True, log_func=buffer.write
             )
-        self.assertEqual(results, {"created": 2, "updated": 0})
+        self.assertEqual(results, {"created": 3, "updated": 0})
 
         self.assertEqual("Progress: 1/1", buffer.getvalue())
-        self.assertEqual(2, package1.affected_by_vulnerabilities.count())
+        self.assertEqual(3, package1.affected_by_vulnerabilities.count())
         vulnerability = package1.affected_by_vulnerabilities.filter(
             advisory_uid="pypa/idna/PYSEC-2024-60"
         ).get()
         self.assertEqual("PYSEC-2024-60", vulnerability.advisory_id)
         self.assertEqual(Decimal("0.5"), vulnerability.exploitability)
         self.assertEqual(Decimal("6.8"), vulnerability.weighted_severity)
         self.assertEqual(Decimal("3.4"), vulnerability.risk_score)
+        self.assertEqual(["pkg:pypi/idna@3.7"], vulnerability.fixed_by_packages)
         package1.refresh_from_db()
         pp1.refresh_from_db()
         self.assertEqual(Decimal("3.4"), package1.risk_score)
         self.assertEqual(Decimal("3.4"), pp1.weighted_risk_score)
+        self.assertEqual("3.15", package1.next_non_vulnerable_version)
+        self.assertEqual("3.15", package1.latest_non_vulnerable_version)
 
         purpose1 = make_product_item_purpose(self.dataspace, exposure_factor=0.5)
         pp1.raw_update(purpose=purpose1)
@@ -151,9 +154,9 @@ def test_vulnerabilities_fetch_for_packages_cross_batch_no_spurious_update(
         mock_bulk_search_by_purl.side_effect = [response_36, response_37]
 
         results = fetch_for_packages(queryset, self.dataspace, batch_size=1, update=True)
-        # 2 vulnerabilities created from response_36; the shared one is NOT re-updated
+        # 3 vulnerabilities created from response_36; the shared one is NOT re-updated
         # when encountered in response_37's batch, because created_advisory_uids guards it.
-        self.assertEqual(results, {"created": 2, "updated": 0})
+        self.assertEqual(results, {"created": 3, "updated": 0})
 
     @mock.patch("vulnerabilities.fetch.fire_webhooks")
     def test_vulnerabilities_fetch_notify_vulnerability_data_update(self, mock_fire_hook):

vulnerabilities/tests/test_models.py

@@ -49,8 +49,9 @@ def test_vulnerability_mixin_get_entry_for_package(self, mock_bulk_search):
         mock_bulk_search.return_value = json.loads(response_file.read_text())
 
         affected_by_vulnerabilities = package1.get_entry_for_package(vulnerablecode)
-        self.assertEqual(2, len(affected_by_vulnerabilities))
+        self.assertEqual(3, len(affected_by_vulnerabilities))
         self.assertEqual("pypa/idna/PYSEC-2024-60", affected_by_vulnerabilities[0]["advisory_uid"])
+        self.assertEqual(["pkg:pypi/idna@3.7"], affected_by_vulnerabilities[0]["fixed_by_packages"])
 
     @mock.patch("vulnerabilities.models.AffectedByVulnerabilityMixin.get_entry_for_package")
     @mock.patch("dejacode_toolkit.vulnerablecode.VulnerableCode.is_configured")
@@ -79,12 +80,19 @@ def test_vulnerability_mixin_fetch_vulnerabilities(self, mock_is_configured, moc
         package1 = make_package(self.dataspace, package_url="pkg:pypi/idna@3.6")
         package1.fetch_vulnerabilities()
 
-        self.assertEqual(2, Vulnerability.objects.scope(self.dataspace).count())
-        self.assertEqual(2, package1.affected_by_vulnerabilities.count())
+        self.assertEqual(3, Vulnerability.objects.scope(self.dataspace).count())
+        self.assertEqual(3, package1.affected_by_vulnerabilities.count())
         vulnerability = package1.affected_by_vulnerabilities.filter(
             advisory_uid="pypa/idna/PYSEC-2024-60"
         ).get()
         self.assertEqual("PYSEC-2024-60", vulnerability.advisory_id)
+        self.assertEqual(["pkg:pypi/idna@3.7"], vulnerability.fixed_by_packages)
+
+        # This code path (single-package fetch) does not go through
+        # vulnerabilities.fetch.process_vc_entry, so the purl-level fields are not set.
+        package1.refresh_from_db()
+        self.assertEqual("", package1.next_non_vulnerable_version)
+        self.assertEqual("", package1.latest_non_vulnerable_version)
 
     def test_vulnerability_mixin_create_vulnerabilities(self):
         response_file = self.data / "vulnerabilities" / "idna_3.6_response.json"
@@ -96,7 +104,7 @@ def test_vulnerability_mixin_create_vulnerabilities(self):
         product1 = make_product(self.dataspace, inventory=[package1])
         package1.create_vulnerabilities(vulnerabilities_data)
 
-        self.assertEqual(3, Vulnerability.objects.scope(self.dataspace).count())
+        self.assertEqual(4, Vulnerability.objects.scope(self.dataspace).count())
         self.assertEqual("5.0", str(package1.risk_score))
         self.assertEqual("5.0", str(product1.productpackages.get().weighted_risk_score))
 
@@ -199,17 +207,17 @@ def test_vulnerability_model_add_affected(self):
         self.assertQuerySetEqual(vulnerability2.affected_packages.all(), [package1])
         self.assertQuerySetEqual(vulnerability2.affected_components.all(), [component1])
 
-    def test_vulnerability_model_fixed_packages_count_generated_field(self):
+    def test_vulnerability_model_fixed_by_packages_count_generated_field(self):
         vulnerability1 = make_vulnerability(dataspace=self.dataspace)
-        self.assertEqual(0, vulnerability1.fixed_packages_count)
+        self.assertEqual(0, vulnerability1.fixed_by_packages_count)
 
-        vulnerability1.fixed_packages = [
-            {"purl": "pkg:pypi/gitpython@3.1.41", "is_vulnerable": True},
-            {"purl": "pkg:pypi/gitpython@3.2", "is_vulnerable": False},
+        vulnerability1.fixed_by_packages = [
+            "pkg:pypi/gitpython@3.1.41",
+            "pkg:pypi/gitpython@3.2",
         ]
         vulnerability1.save()
         vulnerability1.refresh_from_db()
-        self.assertEqual(2, vulnerability1.fixed_packages_count)
+        self.assertEqual(2, vulnerability1.fixed_by_packages_count)
 
     def test_vulnerability_model_create_from_data(self):
         package1 = make_package(self.dataspace)