Add test for person inbox and outbox

check activitypub content-type
Fix create activity response
test webfinger
Fix review, note voting
Add test for person inbox and outbox
check activitypub content-type
Add importer ( automate creation of Purls and Vulnerabilities by reading the git repo )
Add a small test for the importer
Add activitypub tests ( test_person_create_note, test_person_follow_purl , test_person_delete_note , ... )
Add a django post-save signal to clone the git repo when it's created
Fix ap_collection error
Add auth view , Fix model test
Add test for Activity and activity handler
Add activitypub basic inbox and outbox
Create a way to handel activities
Create UserFollowing, PurlFollowers view
Remove fixed  notes from purl_profile.html
Add basic activitypub activity
Create notes view , refactor webfinger templates
Draft for the new implementation of purl-sync
Add a delete follow view ( unsubscribe )
Add basic design activitypub activities
Add follow page , FollowView view
Fix models test
Add review form
Create review page
Rename notes to comments
Fix review-vote, comment-vote
Add Create button to repo_list page
Remove function from severity_systems.py
Add jquery
Add basic implementation for vote view
Add create comment form , review status form
Add review list page , review-list view
Add login , logout functionality
Add a basic ui for review , review list , create review pages
Edit model.py ( use a many-to-many relationship instead of json field )
Add test
Add support for webfinger
Add pytest run doctests
Edit Actor model , Edit create_git_repo and view function
Try to make Reputation model more general
Add bulma static folders
Add create git function
Add basic UI, security_team_profile, database_admin_profile
Remove the extra relations ( many-to-many ,..) and use JSONField instead
Add test for following and follower actors
Edit basic django model
Add support for pytest, black, isort
Add django model test
Add missing fields in GitRepo
Add basic Implementation for ER diagram
Initial config for purl-sync project

Signed-off-by: ziadhany <ziadhany2016@gmail.com>

Author: ziadhany

.github/workflows/main.yml

@@ -3,9 +3,9 @@ name: run tests
 on: [push, pull_request]
 
 env:
-  DB_NAME: vulnerablecode
-  DB_USER: vulnerablecode
-  DB_PASSWORD: vulnerablecode
+  DB_NAME: purl-sync
+  DB_USER: purl-sync
+  DB_PASSWORD: purl-sync
 
 jobs:
   build:

.gitignore

@@ -103,3 +103,4 @@ Pipfile
 *.bak
 /.cache/
 /tmp/
+/purl_sync/venv_purl/

purl_sync/Makefile

@@ -0,0 +1,97 @@
+# SPDX-License-Identifier: Apache-2.0
+#
+# http://nexb.com and https://github.com/nexB/scancode.io
+# The ScanCode.io software is licensed under the Apache License version 2.0.
+# Data generated with ScanCode.io is provided as-is without warranties.
+# ScanCode is a trademark of nexB Inc.
+#
+# You may not use this software except in compliance with the License.
+# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing, software distributed
+# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+# CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+#
+# Data Generated with ScanCode.io is provided on an "AS IS" BASIS, WITHOUT WARRANTIES
+# OR CONDITIONS OF ANY KIND, either express or implied. No content created from
+# ScanCode.io should be considered or used as legal advice. Consult an Attorney
+# for any legal advice.
+#
+# ScanCode.io is a free software code scanning tool from nexB Inc. and others.
+# Visit https://github.com/nexB/scancode.io for support and download.
+# Modified for VulnerableCode use
+
+# Python version can be specified with `$ PYTHON_EXE=python3.x make conf`
+PYTHON_EXE?=python3
+VENV=venv
+MANAGE=${VENV}/bin/python manage.py
+ACTIVATE?=. ${VENV}/bin/activate;
+VIRTUALENV_PYZ=etc/thirdparty/virtualenv.pyz
+# Do not depend on Python to generate the SECRET_KEY
+GET_SECRET_KEY=`base64 /dev/urandom | head -c50`
+# Customize with `$ make envfile ENV_FILE=/etc/vulnerablecode/.env`
+ENV_FILE=.env
+# Customize with `$ make postgres VULNERABLECODE_DB_PASSWORD=YOUR_PASSWORD`
+VULNERABLECODE_DB_PASSWORD=vulnerablecode
+
+virtualenv:
+	@echo "-> Bootstrap the virtualenv with PYTHON_EXE=${PYTHON_EXE}"
+	@${PYTHON_EXE} ${VIRTUALENV_PYZ} --never-download --no-periodic-update ${VENV}
+
+conf: virtualenv
+	@echo "-> Install dependencies"
+	@${ACTIVATE} pip install -e . -c requirements.txt
+
+dev: virtualenv
+	@echo "-> Configure and install development dependencies"
+	@${ACTIVATE} pip install -e .[dev] -c requirements.txt
+
+envfile:
+	@echo "-> Create the .env file and generate a secret key"
+	@if test -f ${ENV_FILE}; then echo ".env file exists already"; exit 1; fi
+	@mkdir -p $(shell dirname ${ENV_FILE}) && touch ${ENV_FILE}
+	@echo SECRET_KEY=\"${GET_SECRET_KEY}\" > ${ENV_FILE}
+
+isort:
+	@echo "-> Apply isort changes to ensure proper imports ordering"
+	${VENV}/bin/isort .
+
+black:
+	@echo "-> Apply black code formatter"
+	${VENV}/bin/black .
+
+valid: isort black
+
+check:
+	@echo "-> Run pycodestyle (PEP8) validation"
+	@${ACTIVATE} pycodestyle --max-line-length=100 --exclude=venv,lib,thirdparty,docs,migrations,settings.py .
+	@echo "-> Run isort imports ordering validation"
+	@${ACTIVATE} isort --check-only .
+	@echo "-> Run black validation"
+	@${ACTIVATE} black --check ${BLACK_ARGS}
+
+clean:
+	@echo "-> Clean the Python env"
+	rm -rf ${VENV} build/ dist/ vulnerablecode.egg-info/ docs/_build/ pip-selfcheck.json
+	find . -type f -name '*.py[co]' -delete -o -type d -name __pycache__ -delete
+
+migrate:
+	@echo "-> Apply database migrations"
+	${MANAGE} migrate
+
+sqlite:
+	@echo "-> Configure SQLite database"
+	@echo VULNERABLECODE_DB_ENGINE=\"django.db.backends.sqlite3\" >> ${ENV_FILE}
+	@echo VULNERABLECODE_DB_NAME=\"sqlite3.db\" >> ${ENV_FILE}
+	@$(MAKE) migrate
+
+run:
+	${MANAGE} runserver 8000 --insecure
+
+test:
+	@echo "-> Run the test suite"
+	${ACTIVATE} ${PYTHON_EXE} -m pytest -vvs -m "not webtest"
+
+webtest:
+	@echo "-> Run web tests"
+	${ACTIVATE} ${PYTHON_EXE} -m pytest -vvs -m "webtest"

purl_sync/manage.py

@@ -0,0 +1,22 @@
+#!/usr/bin/env python
+"""Django's command-line utility for administrative tasks."""
+import os
+import sys
+
+
+def main():
+    """Run administrative tasks."""
+    os.environ.setdefault("DJANGO_SETTINGS_MODULE", "purl_sync.settings")
+    try:
+        from django.core.management import execute_from_command_line
+    except ImportError as exc:
+        raise ImportError(
+            "Couldn't import Django. Are you sure it's installed and "
+            "available on your PYTHONPATH environment variable? Did you "
+            "forget to activate a virtual environment?"
+        ) from exc
+    execute_from_command_line(sys.argv)
+
+
+if __name__ == "__main__":
+    main()

purl_sync/media/uploads/favicon-16x16.png

@@ -0,0 +1,16 @@
+"""
+ASGI config for purl_sync project.
+
+It exposes the ASGI callable as a module-level variable named ``application``.
+
+For more information on this file, see
+https://docs.djangoproject.com/en/4.1/howto/deployment/asgi/
+"""
+
+import os
+
+from django.core.asgi import get_asgi_application
+
+os.environ.setdefault("DJANGO_SETTINGS_MODULE", "purl_sync.settings")
+
+application = get_asgi_application()

purl_sync/purl_sync/__init__.py

@@ -0,0 +1,158 @@
+import os
+from pathlib import Path
+
+import environ
+
+PROJECT_DIR = Path(__file__).resolve().parent
+ROOT_DIR = PROJECT_DIR.parent
+# Environment
+
+ENV_FILE = "purl_sync/.env"
+if not Path(ENV_FILE).exists():
+    ENV_FILE = ROOT_DIR / ".env"
+
+env = environ.Env()
+environ.Env.read_env(str(ENV_FILE))
+
+DOMAIN = env.str("DOMAIN", "127.0.0.1")
+
+# Build paths inside the project like this: BASE_DIR / 'subdir'.
+BASE_DIR = Path(__file__).resolve().parent.parent
+
+# Quick-start development settings - unsuitable for production
+# See https://docs.djangoproject.com/en/4.1/howto/deployment/checklist/
+
+# SECURITY WARNING: keep the secret key used in production secret!
+SECRET_KEY = "django-insecure-uoc-dv7+6%dy7c6(hc$6*z_m-#4y*jp1%-^*5)y&+i9-@j7zup"
+
+# SECURITY WARNING: don't run with debug turned on in production!
+DEBUG = True
+
+ALLOWED_HOSTS = []
+
+# Application definition
+
+INSTALLED_APPS = [
+    "django.contrib.admin",
+    "django.contrib.auth",
+    "django.contrib.contenttypes",
+    "django.contrib.sessions",
+    "django.contrib.messages",
+    "django.contrib.staticfiles",
+    "review",
+    "oauth2_provider",
+]
+
+MIDDLEWARE = [
+    "django.middleware.security.SecurityMiddleware",
+    "django.contrib.sessions.middleware.SessionMiddleware",
+    "django.middleware.common.CommonMiddleware",
+    "django.middleware.csrf.CsrfViewMiddleware",
+    "django.contrib.auth.middleware.AuthenticationMiddleware",
+    "django.contrib.messages.middleware.MessageMiddleware",
+    "django.middleware.clickjacking.XFrameOptionsMiddleware",
+    "oauth2_provider.middleware.OAuth2TokenMiddleware",
+]
+
+ROOT_URLCONF = "purl_sync.urls"
+
+TEMPLATES = [
+    {
+        "BACKEND": "django.template.backends.django.DjangoTemplates",
+        "DIRS": [],
+        "APP_DIRS": True,
+        "OPTIONS": {
+            "context_processors": [
+                "django.template.context_processors.debug",
+                "django.template.context_processors.request",
+                "django.contrib.auth.context_processors.auth",
+                "django.contrib.messages.context_processors.messages",
+            ],
+        },
+    },
+]
+
+WSGI_APPLICATION = "purl_sync.wsgi.application"
+
+# https://docs.djangoproject.com/en/4.1/ref/settings/#databases
+# postgresql database
+# DATABASES = {
+#     "default": {
+#         "ENGINE": env.str("PURL_SYNC_DB_ENGINE", "django.db.backends.postgresql"),
+#         "HOST": env.str("PURL_SYNC_DB_HOST", "localhost"),
+#         "NAME": env.str("PURL_SYNC_DB_NAME", "purl-sync"),
+#         "USER": env.str("PURL_SYNC_DB_USER", "vulnerablecode"),
+#         "PASSWORD": env.str("PURL_SYNC_DB_PASSWORD", "vulnerablecode"),
+#         "PORT": env.str("PURL_SYNC_DB_PORT", "5432"),
+#     }
+# }
+
+# sqlite3 database :
+DATABASES = {
+    "default": {
+        "ENGINE": "django.db.backends.sqlite3",
+        "NAME": "mydatabase.db",
+    }
+}
+
+# Password validation
+# https://docs.djangoproject.com/en/4.1/ref/settings/#auth-password-validators
+
+AUTH_PASSWORD_VALIDATORS = [
+    {
+        "NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator",
+    },
+    {
+        "NAME": "django.contrib.auth.password_validation.MinimumLengthValidator",
+    },
+    {
+        "NAME": "django.contrib.auth.password_validation.CommonPasswordValidator",
+    },
+    {
+        "NAME": "django.contrib.auth.password_validation.NumericPasswordValidator",
+    },
+]
+
+REST_FRAMEWORK = {
+    "DEFAULT_AUTHENTICATION_CLASSES": (
+        "oauth2_provider.contrib.rest_framework.OAuth2Authentication",
+        "rest_framework.authentication.SessionAuthentication",
+    ),
+    "DEFAULT_PERMISSION_CLASSES": ("rest_framework.permissions.IsAuthenticated",),
+}
+
+OAUTH2_PROVIDER = {
+    "ACCESS_TOKEN_EXPIRE_SECONDS": 3600,
+    "REFRESH_TOKEN_EXPIRE_SECONDS": 3600 * 24 * 365,
+    "SCOPES": {"read": "Read scope", "write": "Write scope"},
+}
+
+AUTHENTICATION_BACKENDS = (
+    "django.contrib.auth.backends.ModelBackend",
+    "oauth2_provider.backends.OAuth2Backend",
+)
+# Internationalization
+# https://docs.djangoproject.com/en/4.1/topics/i18n/
+
+LANGUAGE_CODE = "en-us"
+
+TIME_ZONE = "UTC"
+
+USE_I18N = True
+
+USE_TZ = True
+
+# Static files (CSS, JavaScript, Images)
+# https://docs.djangoproject.com/en/4.1/howto/static-files/
+
+STATIC_URL = "static/"
+
+# Default primary key field type
+# https://docs.djangoproject.com/en/4.1/ref/settings/#default-auto-field
+
+DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
+
+MEDIA_URL = "/media/"
+MEDIA_ROOT = os.path.join(BASE_DIR, "media")
+GIT_PATH = os.path.join(MEDIA_ROOT, "git")
+AP_CONTENT_TYPE = "application/activity+json"