Move fixed_packages to vulnerabilities in packages endpoint #809

Reference: #809
Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>

Author: TG1999

vulnerabilities/api.py

@@ -56,11 +56,15 @@ class VulnSerializerRefsAndSummary(serializers.HyperlinkedModelSerializer):
     Used for nesting inside package focused APIs.
     """
 
+    fixed_packages = MinimalPackageSerializer(
+        many=True, source="filtered_fixed_packages", read_only=True
+    )
+
     references = VulnerabilityReferenceSerializer(many=True, source="vulnerabilityreference_set")
 
     class Meta:
         model = Vulnerability
-        fields = ["url", "vulnerability_id", "summary", "references"]
+        fields = ["url", "vulnerability_id", "summary", "references", "fixed_packages"]
 
 
 class MinimalVulnerabilitySerializer(serializers.HyperlinkedModelSerializer):
@@ -73,21 +77,6 @@ class Meta:
         fields = ["url", "vulnerability_id"]
 
 
-class PackageSerializerFixedVulns(serializers.HyperlinkedModelSerializer):
-    """
-    Used for nesting inside vulnerability focused APIs.
-    """
-
-    purl = serializers.CharField(source="package_url")
-    fixing_vulnerabilities = MinimalVulnerabilitySerializer(
-        many=True, source="resolved_to", read_only=True
-    )
-
-    class Meta:
-        model = Package
-        fields = ["url", "purl", "fixing_vulnerabilities"]
-
-
 class AliasSerializer(serializers.HyperlinkedModelSerializer):
     """
     Used for nesting inside package focused APIs.
@@ -128,13 +117,52 @@ def to_representation(self, instance):
         return data
 
     purl = serializers.CharField(source="package_url")
-    affected_by_vulnerabilities = VulnSerializerRefsAndSummary(
-        many=True, source="vulnerable_to", read_only=True
-    )
-    fixing_vulnerabilities = VulnSerializerRefsAndSummary(
-        many=True, source="resolved_to", read_only=True
-    )
-    fixed_packages = PackageSerializerFixedVulns(many=True, read_only=True)
+
+    affected_by_vulnerabilities = serializers.SerializerMethodField("get_affected_vulnerabilities")
+
+    fixing_vulnerabilities = serializers.SerializerMethodField("get_fixed_vulnerabilities")
+
+    def get_fixed_packages(self, package):
+        return Package.objects.filter(
+            name=package.name,
+            namespace=package.namespace,
+            type=package.type,
+            qualifiers=package.qualifiers,
+            subpath=package.subpath,
+            packagerelatedvulnerability__fix=True,
+        ).distinct()
+
+    def get_affected_vulnerabilities(self, package):
+        fixed_packages = self.get_fixed_packages(package=package)
+        qs = package.vulnerabilities.filter(packagerelatedvulnerability__fix=False)
+        qs = qs.prefetch_related(
+            Prefetch(
+                "packages",
+                queryset=fixed_packages,
+                to_attr="filtered_fixed_packages",
+            )
+        )
+        return VulnSerializerRefsAndSummary(
+            instance=qs,
+            many=True,
+            context={"request": self.context["request"]},
+        ).data
+
+    def get_fixed_vulnerabilities(self, package):
+        fixed_packages = self.get_fixed_packages(package=package)
+        qs = package.vulnerabilities.filter(packagerelatedvulnerability__fix=True)
+        qs = qs.prefetch_related(
+            Prefetch(
+                "packages",
+                queryset=fixed_packages,
+                to_attr="filtered_fixed_packages",
+            )
+        )
+        return VulnSerializerRefsAndSummary(
+            instance=qs,
+            many=True,
+            context={"request": self.context["request"]},
+        ).data
 
     class Meta:
         model = Package
@@ -148,7 +176,6 @@ class Meta:
             "qualifiers",
             "subpath",
             "affected_by_vulnerabilities",
-            "fixed_packages",
             "fixing_vulnerabilities",
         ]
 

vulnerabilities/models.py

@@ -83,7 +83,7 @@ def alias(self):
         Returns packages that first received patch against this vulnerability
         in their particular version history.
         """
-        return self.aliases.all()
+        return self.aliases.all().order_by("-alias")
 
     def __str__(self):
         return self.vulnerability_id

vulnerabilities/tests/test_fix_api.py

@@ -7,6 +7,8 @@
 # See https://aboutcode.org for more information about nexB OSS projects.
 #
 
+from collections import OrderedDict
+
 from django.test import TestCase
 from django.utils.http import int_to_base36
 from rest_framework import status
@@ -138,30 +140,24 @@ def test_api_with_single_vulnerability_and_fixed_package(self):
             "namespace": "nginx",
             "name": "test",
             "version": "11",
-            "unresolved_vulnerabilities": [],
             "qualifiers": {},
             "subpath": "",
-            "fixed_packages": [
-                {
-                    "url": f"http://testserver/api/packages/{self.package.id}",
-                    "purl": "pkg:generic/nginx/test@11",
-                    "fixing_vulnerabilities": [
-                        {
-                            "url": f"http://testserver/api/vulnerabilities/{self.vuln.id}",
-                            "vulnerability_id": f"VULCOID-{int_to_base36(self.vuln.id).upper()}",
-                        }
-                    ],
-                }
-            ],
             "affected_by_vulnerabilities": [],
             "fixing_vulnerabilities": [
                 {
                     "url": f"http://testserver/api/vulnerabilities/{self.vuln.id}",
                     "vulnerability_id": f"VULCOID-{int_to_base36(self.vuln.id).upper()}",
                     "summary": "test-vuln",
                     "references": [],
-                }
+                    "fixed_packages": [
+                        {
+                            "url": f"http://testserver/api/packages/{self.package.id}",
+                            "purl": "pkg:generic/nginx/test@11",
+                        }
+                    ],
+                },
             ],
+            "unresolved_vulnerabilities": [],
         }
 
     def test_api_with_single_vulnerability_and_vulnerable_package(self):
@@ -173,37 +169,37 @@ def test_api_with_single_vulnerability_and_vulnerable_package(self):
             "namespace": "nginx",
             "name": "test",
             "version": "9",
-            "unresolved_vulnerabilities": [
+            "qualifiers": {},
+            "subpath": "",
+            "affected_by_vulnerabilities": [
                 {
                     "url": f"http://testserver/api/vulnerabilities/{self.vuln.id}",
                     "vulnerability_id": f"VULCOID-{int_to_base36(self.vuln.id).upper()}",
                     "summary": "test-vuln",
                     "references": [],
-                }
-            ],
-            "qualifiers": {},
-            "subpath": "",
-            "fixed_packages": [
-                {
-                    "url": f"http://testserver/api/packages/{self.package.id}",
-                    "purl": "pkg:generic/nginx/test@11",
-                    "fixing_vulnerabilities": [
+                    "fixed_packages": [
                         {
-                            "url": f"http://testserver/api/vulnerabilities/{self.vuln.id}",
-                            "vulnerability_id": f"VULCOID-{int_to_base36(self.vuln.id).upper()}",
+                            "url": f"http://testserver/api/packages/{self.package.id}",
+                            "purl": "pkg:generic/nginx/test@11",
                         }
                     ],
                 }
             ],
-            "affected_by_vulnerabilities": [
+            "fixing_vulnerabilities": [],
+            "unresolved_vulnerabilities": [
                 {
                     "url": f"http://testserver/api/vulnerabilities/{self.vuln.id}",
                     "vulnerability_id": f"VULCOID-{int_to_base36(self.vuln.id).upper()}",
                     "summary": "test-vuln",
                     "references": [],
+                    "fixed_packages": [
+                        {
+                            "url": f"http://testserver/api/packages/{self.package.id}",
+                            "purl": "pkg:generic/nginx/test@11",
+                        }
+                    ],
                 }
             ],
-            "fixing_vulnerabilities": [],
         }