Use queries for SSVC

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>

Author: TG1999

vulnerabilities/api_v3.py

@@ -10,11 +10,14 @@
 from collections import defaultdict
 from urllib.parse import urlencode
 
+from django.contrib.postgres.aggregates import JSONBAgg
 from django.db.models import Exists
+from django.db.models import F
 from django.db.models import Max
 from django.db.models import OuterRef
 from django.db.models import Prefetch
 from django.db.models import Q
+from django.db.models.functions import JSONObject
 from django_filters import rest_framework as filters
 from drf_spectacular.utils import extend_schema
 from packageurl import PackageURL
@@ -659,6 +662,16 @@ def get_affected_advisories_bulk(packages):
             max_exploitability=Max(
                 "members__advisory__exploitability",
             ),
+            ssvc_trees=JSONBAgg(
+                JSONObject(
+                    vector=F("members__advisory__related_ssvcs__vector"),
+                    decision=F("members__advisory__related_ssvcs__decision"),
+                    options=F("members__advisory__related_ssvcs__options"),
+                    source_url=F("members__advisory__related_ssvcs__source_advisory__url"),
+                ),
+                filter=Q(members__advisory__related_ssvcs__decision__isnull=False),
+                distinct=True,
+            ),
         )
         .only(
             "id",
@@ -695,22 +708,6 @@ def get_affected_advisories_bulk(packages):
             identifier = primary.advisory_id.split("/")[-1]
 
             aliases = [a for a in adv._aliases_cache if a != identifier]
-            all_ssvc = []
-
-            for member in adv.members.all():
-                all_ssvc.extend(member.advisory.prefetched_ssvc_trees)
-
-            ssvcs = []
-
-            for ssvc in all_ssvc:
-                ssvcs.append(
-                    {
-                        "vector": ssvc.vector,
-                        "decision": ssvc.decision,
-                        "options": ssvc.options,
-                        "source_url": ssvc.source_advisory.url,
-                    }
-                )
 
             grouped.append(
                 {
@@ -722,7 +719,7 @@ def get_affected_advisories_bulk(packages):
                     "risk_score": risk_score,
                     "summary": primary.summary,
                     "resource_url": primary.get_absolute_url(),
-                    "ssvc_trees": ssvcs,
+                    "ssvc_trees": adv.ssvc_trees,
                 }
             )