Resolve merge conflict

Signed-off-by: ziad hany <ziadhany2016@gmail.com>

Author: ziadhany

vulnerabilities/api_v3.py

@@ -11,11 +11,13 @@
 from urllib.parse import urlencode
 
 from django.contrib.postgres.aggregates import ArrayAgg
+from django.contrib.postgres.aggregates import JSONBAgg
 from django.db.models import Exists
 from django.db.models import Max
 from django.db.models import OuterRef
 from django.db.models import Prefetch
 from django.db.models import Q
+from django.db.models.functions import JSONObject
 from django_filters import rest_framework as filters
 from drf_spectacular.utils import extend_schema
 from packageurl import PackageURL
@@ -479,7 +481,23 @@ def get_affected_advisories_bulk(packages, max_advisories, base_url):
                 "impacted_package__fixed_by_packages__package_url",
                 distinct=True,
                 filter=Q(impacted_package__fixed_by_packages__package_url__isnull=False),
-            )
+            ),
+            introduced_patches=JSONBAgg(
+                JSONObject(
+                    commit_hash="impacted_package__introduced_by_package_commit_patches__commit_hash",
+                    vcs_url="impacted_package__introduced_by_package_commit_patches__vcs_url",
+                ),
+                distinct=True,
+                filter=Q(impacted_package__introduced_by_package_commit_patches__isnull=False),
+            ),
+            fixed_patches=JSONBAgg(
+                JSONObject(
+                    commit_hash="impacted_package__fixed_by_package_commit_patches__commit_hash",
+                    vcs_url="impacted_package__fixed_by_package_commit_patches__vcs_url",
+                ),
+                distinct=True,
+                filter=Q(impacted_package__fixed_by_package_commit_patches__isnull=False),
+            ),
         )
     )
 
@@ -492,6 +510,20 @@ def get_affected_advisories_bulk(packages, max_advisories, base_url):
         for row in impacts
     }
 
+    introduced_patches_map = {
+        (row["package_id"], row["impacted_package__advisory_id"]): [
+            p for p in (row["introduced_patches"] or []) if p and p.get("commit_hash")
+        ]
+        for row in impacts
+    }
+
+    fixed_patches_map = {
+        (row["package_id"], row["impacted_package__advisory_id"]): [
+            p for p in (row["fixed_patches"] or []) if p and p.get("commit_hash")
+        ]
+        for row in impacts
+    }
+
     # Package types with multiple importers
 
     advisory_sets = list(
@@ -647,6 +679,8 @@ def get_affected_advisories_bulk(packages, max_advisories, base_url):
                     "exploitability": exploitability,
                     "risk_score": risk_score,
                     "fixed_by_packages": fixed_by_packages,
+                    "introduced_in_patch": introduced_patches_map.get((package.id, primary.id), []),
+                    "fixed_in_patch": fixed_patches_map.get((package.id, primary.id), []),
                     "ssvc_trees": adv.ssvc_trees,
                     "resource_url": resource_url,
                 }
@@ -742,6 +776,10 @@ def get_affected_advisories_bulk(packages, max_advisories, base_url):
                     "exploitability": advisory.exploitability,
                     "risk_score": advisory.risk_score,
                     "fixed_by_packages": fixed_by_packages,
+                    "introduced_in_patch": introduced_patches_map.get(
+                        (package.id, advisory_id), []
+                    ),
+                    "fixed_in_patch": fixed_patches_map.get((package.id, advisory_id), []),
                     "ssvc_trees": [
                         {
                             "vector": ssvc.vector,

vulnerabilities/templates/advisory_package_commit_details.html

@@ -12,7 +12,7 @@
 {% block content %}
 
 {% if advisoryv2 %}
-    <section class="section pt-0">
+    <section class="section pt-4">
         <div class="details-container">
             <article class="panel is-info panel-header-only">
                 <div class="panel-heading py-2 is-size-6">

vulnerabilities/tests/test_api_v3.py

@@ -16,6 +16,12 @@
 from univers.version_range import PypiVersionRange
 
 from vulnerabilities.importer import AdvisoryDataV2
+from vulnerabilities.importer import AffectedPackageV2
+from vulnerabilities.importer import PackageCommitPatchData
+from vulnerabilities.models import AdvisorySet
+from vulnerabilities.models import AdvisorySetMember
+from vulnerabilities.models import ImpactedPackage
+from vulnerabilities.models import ImpactedPackageAffecting
 from vulnerabilities.models import PackageV2
 from vulnerabilities.pipes.advisory import insert_advisory_v2
 from vulnerabilities.tests.pipelines import TestLogger
@@ -254,3 +260,84 @@ def test_get_all_vulnerable_purls(self):
         results = response.data["results"]
         self.assertEqual(len(results), 100)
         self.assertIn("next", response.data)
+
+
+class PackageCommitPatchTests(APITestCase):
+    def setUp(self):
+        self.advisory = AdvisoryDataV2(
+            advisory_id="AVID-123",
+            aliases=[],
+            affected_packages=[
+                AffectedPackageV2(
+                    package=PackageURL(type="pypi", name="sample"),
+                    affected_version_range=PypiVersionRange.from_string("vers:pypi/=1.0.0"),
+                    introduced_by_commit_patches=[
+                        PackageCommitPatchData(
+                            vcs_url="https://github.com/aboutcode-org/sample",
+                            commit_hash="06580c7f99c6fde7bcf18e30bdcc61f081430957",
+                        )
+                    ],
+                    fixed_by_commit_patches=[
+                        PackageCommitPatchData(
+                            vcs_url="https://github.com/aboutcode-org/sample",
+                            commit_hash="98e516011d6e096e25247b82fc5f196bbeecff10",
+                        )
+                    ],
+                )
+            ],
+            url="https://github.com/aboutcode-org/sample",
+        )
+
+        self.advisory = insert_advisory_v2(self.advisory, "importer_1", print, 100)
+        self.advisory.is_latest = True
+        self.advisory._all_impacts_unfurled_at = timezone.now()
+        self.advisory.save()
+        self.package, _ = PackageV2.objects.get_or_create(
+            package_url="pkg:pypi/sample@1.0.0",
+            defaults={"name": "sample", "type": "pypi", "version": "1.0.0"},
+        )
+
+        impacted_package = ImpactedPackage.objects.get(advisory=self.advisory)
+        ImpactedPackageAffecting.objects.get_or_create(
+            package=self.package,
+            impacted_package=impacted_package,
+        )
+        adv_set = AdvisorySet.objects.create(
+            package=self.package, primary_advisory=self.advisory, relation_type="affecting"
+        )
+        AdvisorySetMember.objects.create(advisory_set=adv_set, advisory=self.advisory)
+
+        self.client = APIClient(enforce_csrf_checks=True)
+
+    def test_packages_commit_patch(self):
+        url = reverse("package-v3-list")
+        response = self.client.post(
+            url,
+            data={"purls": ["pkg:pypi/sample@1.0.0"], "details": True},
+            format="json",
+        )
+
+        assert response.status_code == 200
+        results = response.data["results"]
+        assert len(results) == 1
+        pkg = results[0]
+        assert pkg["purl"] == "pkg:pypi/sample@1.0.0"
+
+        vulns = pkg.get("affected_by_vulnerabilities", [])
+        assert len(vulns) == 1
+        advisory_data = vulns[0]
+
+        assert advisory_data["advisory_id"] == "AVID-123"
+        assert advisory_data["introduced_in_patch"] == [
+            {
+                "commit_hash": "06580c7f99c6fde7bcf18e30bdcc61f081430957",
+                "vcs_url": "https://github.com/aboutcode-org/sample",
+            }
+        ]
+
+        assert advisory_data["fixed_in_patch"] == [
+            {
+                "commit_hash": "98e516011d6e096e25247b82fc5f196bbeecff10",
+                "vcs_url": "https://github.com/aboutcode-org/sample",
+            }
+        ]

vulnerabilities/views.py

@@ -944,7 +944,7 @@ def get_queryset(self):
 class AdvisoryPackageCommitPatchDetails(DetailView):
     """
     View to display all packages introduce by or fixing a specific vulnerability.
-    URL: /advisories/{id}/commits
+    URL: /advisories/commits/{id}
     """
 
     model = models.AdvisoryV2

vulnerablecode/urls.py

@@ -31,6 +31,7 @@
 from vulnerabilities.api_v3 import PackageV3ViewSet
 from vulnerabilities.views import AdminLoginView
 from vulnerabilities.views import AdvisoryDetails
+from vulnerabilities.views import AdvisoryPackageCommitPatchDetails
 from vulnerabilities.views import AdvisoryPackageCurationView
 from vulnerabilities.views import AdvisoryPackagesDetails
 from vulnerabilities.views import AdvisoryToDoListView
@@ -131,6 +132,11 @@ def __init__(self, *args, **kwargs):
         AdvisoryPackagesDetails.as_view(),
         name="advisory_package_details",
     ),
+    path(
+        "advisories/commits/<path:avid>",
+        AdvisoryPackageCommitPatchDetails.as_view(),
+        name="advisory_package_commit_details",
+    ),
     path(
         "advisories/<path:avid>",
         AdvisoryDetails.as_view(),