Add test for person inbox and outbox

check activitypub content-type
Add importer ( automate creation of Purls and Vulnerabilities by reading the git repo )
Add a small test for the importer

Signed-off-by: ziadhany <ziadhany2016@gmail.com>

Author: ziadhany

purl_sync/purl_sync/urls.py

@@ -42,7 +42,7 @@
 urlpatterns = [
     path("admin/", admin.site.urls),
     path(".well-known/webfinger", WebfingerView.as_view(), name="web-finger"),
-    path("home", HomeView.as_view(), name="home-page"),
+    path("", HomeView.as_view(), name="home-page"),
     path("users/@<str:slug>", PersonView.as_view(), name="user-profile"),
     path("purls/@<path:slug>/", PurlView.as_view(), name="purl-profile"),
     path("purls/@<path:purl_string>/follow", FollowView.as_view(), name="purl-follow"),
@@ -66,15 +66,13 @@
         "vulnerability/<uuid:vulnerability_id>/", redirect_vulnerability, name="vulnerability-page"
     ),
     path("notes/<uuid:uuid>", NoteView.as_view(), name="note-page"),
-    path("/api/v0/users/@<str:username>/outbox/", PersonOutbox.as_view(), name="user-outbox"),
-    path("/api/v0/users/@<str:username>/outbox/", PersonInbox.as_view(), name="user-inbox"),
-    path("/api/v0/purls/@<path:purl_string>/inbox/", PurlInbox.as_view(), name="purl-inbox"),
-    path("/api/v0/purls/@<path:purl_string>/outbox/", PurlOutbox.as_view(), name="purl-outbox"),
+    path("api/v0/users/@<str:username>/inbox", PersonInbox.as_view(), name="user-inbox"),
+    path("api/v0/users/@<str:username>/outbox", PersonOutbox.as_view(), name="user-outbox"),
+    path("api/v0/purls/@<path:purl_string>/inbox", PurlInbox.as_view(), name="purl-inbox"),
+    path("api/v0/purls/@<path:purl_string>/outbox", PurlOutbox.as_view(), name="purl-outbox"),
+    path("api/v0/users/@<str:username>/following/", UserFollowing.as_view(), name="user-following"),
     path(
-        "/api/v0/users/@<str:username>/following/", UserFollowing.as_view(), name="user-following"
-    ),
-    path(
-        "/api/v0/purls/@<path:purl_string>/followers/",
+        "api/v0/purls/@<path:purl_string>/followers/",
         PurlFollowers.as_view(),
         name="purl-followers",
     ),

purl_sync/requirements.txt

@@ -11,3 +11,8 @@ pytest-django==4.5.2
 sqlparse==0.4.4
 tomli==2.0.1
 typing_extensions==4.6.3
+
+djangorestframework~=3.14.0
+requests~=2.31.0
+saneyaml~=0.6.0
+django-oauth-toolkit~=2.3.0

purl_sync/review/activitypub.py

@@ -15,6 +15,7 @@
 
 from django.contrib.auth.models import User
 from django.http import HttpResponseBadRequest
+from django.http import HttpResponseForbidden
 from django.http import JsonResponse
 from git import Repo
 
@@ -56,45 +57,45 @@
 AP_TARGET = {"cc": "https://www.w3.org/ns/activitystreams#Public"}
 
 
-def check_ap_context(response):
+def check_ap_context(request):
     """
-    check activitypub context response
+    check activitypub context request and return request without @context
     """
-    if not response:
-        return HttpResponseBadRequest("Invalid context response")
-
-    if not response.get("@context"):
-        response.append(**AP_CONTEXT)
-
-    return response
+    if request.get("@context") == AP_CONTEXT["@context"]:
+        request.pop("@context")
+        return request
+    else:
+        return None
 
 
 def add_ap_target(response):
     """
     Add target activitypub response
     """
-    if not response:
-        raise Exception("Invalid context response")
+    if response is not dict:
+        raise Exception("Invalid response")
 
     if not response.get("cc"):
         response.append(**AP_TARGET)
 
     return response
 
 
-def is_valid_header(method):
-    @functools.wraps(method)
+def has_valid_header(view):
+    """
+    check if the request header in the VALID_HEADERS if yes return view else return HttpResponseForbidden
+    """
+
     def wrapper(request, *args, **kwargs):
-        if not request.headers.get("Content-Type") in VALID_HEADERS:
-            return HttpResponseBadRequest("Invalid content-type")
+        content_type = request.headers.get("Content-Type")
+        if content_type in VALID_HEADERS:
+            return view(request, *args, **kwargs)
+        else:
+            return HttpResponseForbidden()
 
     return wrapper
 
 
-def is_valid_context(response):
-    return True if response in AP_CONTEXT else False
-
-
 @dataclass
 class Activity:
     type: Literal["Follow", "Create", "Update", "Delete"]
@@ -361,7 +362,8 @@ def failed_ap_rs(self):
 def create_activity_obj(data):
     """Convert json object to activity object"""
     payload = json.loads(data)
-    return Activity(**payload)
+    payload_without_context = check_ap_context(payload)
+    return Activity(**payload_without_context)
 
 
 @dataclass

purl_sync/review/importer.py

@@ -0,0 +1,40 @@
+import json
+from dataclasses import dataclass
+from pathlib import Path
+
+import saneyaml
+
+from review.models import Note
+from review.models import Purl
+from review.models import Repository
+from review.models import Service
+from review.models import Vulnerability
+from review.utils import generate_webfinger
+
+
+@dataclass
+class Importer:
+    repo_obj: Repository
+    default_service: Service
+
+    def run(self):
+        git_repo = self.repo_obj.git_repo_obj
+        for commit in git_repo.commit().tree.traverse():
+            file = Path(commit.abspath)
+            if file.is_file():
+                with open(commit.abspath) as f:
+                    yaml_data = saneyaml.load(f.read())
+                    if str(file.name).startswith("VCID"):
+                        self.register_vul(yaml_data)
+                    else:
+                        self.register_pkg(yaml_data)
+
+    def register_pkg(self, data):
+        pacakge = data["pacakge"]
+        Purl.objects.get_or_create(string=pacakge, service=self.default_service)
+        for version in data["versions"]:
+            acct = generate_webfinger(pacakge)
+            Note.objects.get_or_create(acct=acct, content=json.dumps(version))
+
+    def register_vul(self, data):
+        Vulnerability.objects.get_or_create(repo=self.repo_obj, filename=data["vulnerability_id"])

purl_sync/review/models.py

@@ -204,6 +204,8 @@ class Person(Actor):
         RemotePerson, on_delete=models.CASCADE, null=True, blank=True
     )
 
+    # TODO raise error if the user doesn't have a user or remote actor
+
     @property
     def acct(self):
         return generate_webfinger(self.user.username)
@@ -251,7 +253,7 @@ def review_count(self):
         return Review.objects.filter(vulnerability__repo=self).count()
 
     @property
-    def git_repo(self):
+    def git_repo_obj(self):
         return Repo(self.path)
 
     class Meta:
@@ -274,7 +276,6 @@ class Vulnerability(models.Model):
         help_text="The object's unique global identifier",
     )
     repo = models.ForeignKey(Repository, on_delete=models.CASCADE)
-    branch_name = models.CharField(max_length=28, help_text="")
     filename = models.CharField(max_length=255, help_text="")
     commit_id = models.CharField(max_length=50, help_text="")
 
@@ -284,7 +285,7 @@ def load_file(self):
         fetch the url
         copied from https://stackoverflow.com/a/54900961/9871531
         """
-        commit = self.repo.git_repo.commit(self.commit_id)
+        commit = self.repo.git_repo_obj.commit(self.commit_id)
         target_file = commit.tree / self.filename
 
         with io.BytesIO(target_file.data_stream.read()) as f:
@@ -296,7 +297,6 @@ def to_ap(self):
             "id": "https://example.com/vulnerability/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",
             "type": "Vulnerability",
             "repository": full_reverse("repository-page", self.id),
-            "branch": self.branch_name,
             "filename": self.filename,
             "commit": self.commit_id,
         }

purl_sync/review/templates/navbar.html

@@ -38,12 +38,12 @@
           More
         </a>
 
-        <div class="navbar-dropdown">
+        <div class="navbar-dropdown" href="https://github.com/nexB/vulnerablecode/">
           <a class="navbar-item">
             About
           </a>
           <hr class="navbar-divider">
-          <a class="navbar-item">
+          <a class="navbar-item" href="https://github.com/nexB/vulnerablecode/issues/new">
             Report an issue
           </a>
         </div>

purl_sync/review/tests/test_activitypub.py

@@ -11,6 +11,7 @@
 import pytest
 
 from purl_sync.settings import DOMAIN
+from review.activitypub import AP_CONTEXT
 from review.activitypub import Activity
 from review.activitypub import create_activity_obj
 from review.models import Follow
@@ -34,6 +35,7 @@
 def test_person_create_note(person):
     payload = json.dumps(
         {
+            **AP_CONTEXT,
             "type": "Create",
             "actor": f"https://127.0.0.1:8000/users/@{person.user.username}",
             "object": {
@@ -53,6 +55,7 @@ def test_person_create_note(person):
 def test_person_create_review(person, vulnerability, repo):
     payload = json.dumps(
         {
+            **AP_CONTEXT,
             "type": "Create",
             "actor": f"https://127.0.0.1:8000/users/@ziad",
             "object": {
@@ -81,6 +84,7 @@ def test_person_create_review(person, vulnerability, repo):
 def test_purl_create_note(purl, service):
     payload = json.dumps(
         {
+            **AP_CONTEXT,
             "type": "Create",
             "actor": f"https://127.0.0.1:8000/purls/@{purl.string}/",
             "object": {
@@ -98,6 +102,7 @@ def test_purl_create_note(purl, service):
 def test_service_create_repo(service):
     payload = json.dumps(
         {
+            **AP_CONTEXT,
             "type": "Create",
             "actor": f"https://127.0.0.1:8000/users/@{service.user.username}",
             "object": {
@@ -119,6 +124,7 @@ def test_service_create_repo(service):
 def test_person_follow_purl(person, purl):
     payload = json.dumps(
         {
+            **AP_CONTEXT,
             "type": "Follow",
             "actor": f"https://127.0.0.1:8000/users/@{person.user.username}",
             "object": {
@@ -138,6 +144,7 @@ def test_person_follow_purl(person, purl):
 def test_person_delete_note(person, note):
     payload = json.dumps(
         {
+            **AP_CONTEXT,
             "type": "Delete",
             "actor": f"https://127.0.0.1:8000/users/@{person.user.username}",
             "object": {
@@ -156,6 +163,7 @@ def test_person_delete_note(person, note):
 def test_person_delete_note(person, note):
     payload = json.dumps(
         {
+            **AP_CONTEXT,
             "type": "Delete",
             "actor": f"https://127.0.0.1:8000/users/@{person.user.username}",
             "object": {
@@ -174,6 +182,7 @@ def test_person_delete_note(person, note):
 def test_person_update_note(person, note):
     payload = json.dumps(
         {
+            **AP_CONTEXT,
             "type": "Update",
             "actor": f"https://127.0.0.1:8000/users/@{person.user.username}",
             "object": {
@@ -194,6 +203,7 @@ def test_person_update_note(person, note):
 def test_person_unfollow_purl(person, purl, follow):
     payload = json.dumps(
         {
+            **AP_CONTEXT,
             "type": "UnFollow",
             "actor": f"https://127.0.0.1:8000/users/@{person.user.username}",
             "object": {