refactor the signal related to preset analysis

Signed-off-by: tdruez <tdruez@aboutcode.org>

Author: tdruez

product_portfolio/views.py

@@ -150,6 +150,7 @@
 from vulnerabilities.models import Vulnerability
 from vulnerabilities.models import VulnerabilityAnalysis
 from vulnerabilities.models import get_risk_level
+from vulnerabilities.triage.engine import delete_triage_records_for_assignment
 from vulnerabilities.triage.engine import reevaluate_product_rulesets
 from vulnerabilities.triage.models import AnalysisPreset
 from vulnerabilities.triage.models import ProductTriageRuleset
@@ -2262,6 +2263,9 @@ def manage_triage_rulesets_view(request, dataspace, name, version=""):
             for ruleset_uuid, assignment in current_assignments.items():
                 if ruleset_uuid not in submitted_uuids:
                     assignment.delete()
+                    delete_triage_records_for_assignment(
+                        ruleset=assignment.ruleset, product=product
+                    )
             reevaluate_product_rulesets(product)
         return JsonResponse({"success": True})
 

vulnerabilities/triage/admin.py

@@ -13,6 +13,7 @@
 from dje.admin import DataspacedAdmin
 from dje.admin import dejacode_site
 from dje.list_display import AsLink
+from vulnerabilities.triage.engine import delete_preset_analyses_before_ruleset_delete
 from vulnerabilities.triage.engine import evaluate_ruleset
 from vulnerabilities.triage.forms import AnalysisPresetForm
 from vulnerabilities.triage.forms import TriageRulesetForm
@@ -146,6 +147,15 @@ def save_model(self, request, obj, form, change):
         for assignment in obj.product_triage_rulesets.select_related("product"):
             evaluate_ruleset(ruleset=obj, product=assignment.product)
 
+    def delete_model(self, request, obj):
+        delete_preset_analyses_before_ruleset_delete(obj)
+        super().delete_model(request, obj)
+
+    def delete_queryset(self, request, queryset):
+        for obj in queryset:
+            delete_preset_analyses_before_ruleset_delete(obj)
+        super().delete_queryset(request, queryset)
+
     def get_form(self, request, obj=None, change=False, **kwargs):
         kwargs["fields"] = [
             "name",

vulnerabilities/triage/engine.py

@@ -130,6 +130,24 @@ def delete_preset_analyses_for_product(preset_id, product, vulnerability_ids):
     ).delete()
 
 
+def delete_triage_records_for_assignment(ruleset, product):
+    """
+    Delete triage records and associated preset analyses for a ruleset being
+    unassigned from a product.
+    """
+    matching_records = TriageRecord.objects.filter(ruleset=ruleset, product=product)
+    stale_vulnerability_ids = list(matching_records.values_list("vulnerability_id", flat=True))
+    # Records with an open Request are kept so reassigning the ruleset reconnects to it
+    # instead of opening a duplicate Request.
+    matching_records.filter(request__isnull=True).delete()
+    if ruleset.analysis_preset_id and stale_vulnerability_ids:
+        delete_preset_analyses_for_product(
+            preset_id=ruleset.analysis_preset_id,
+            product=product,
+            vulnerability_ids=stale_vulnerability_ids,
+        )
+
+
 def sync_triage_records(ruleset, product, matched_rules_per_vulnerability_id, apply_preset=True):
     """
     Create or update one TriageRecord per matching vulnerability, then
@@ -228,6 +246,33 @@ def evaluate_ruleset(ruleset, product, apply_preset=True):
     )
 
 
+def delete_preset_analyses_before_ruleset_delete(ruleset):
+    """
+    Delete VulnerabilityAnalysis records applied by the ruleset's preset, for every
+    product currently assigned to it.
+
+    Must run before the ruleset itself is deleted: its TriageRecords have no signal of
+    their own, so Django cascade-deletes them via a fast bulk query before a post_delete
+    signal on the ruleset or its assignments would even get a chance to see them.
+    """
+    if not ruleset.analysis_preset_id:
+        return
+
+    assignments = ProductTriageRuleset.objects.filter(ruleset=ruleset).select_related("product")
+    for assignment in assignments:
+        vulnerability_ids = list(
+            TriageRecord.objects.filter(
+                ruleset=ruleset, product=assignment.product
+            ).values_list("vulnerability_id", flat=True)
+        )
+        if vulnerability_ids:
+            delete_preset_analyses_for_product(
+                preset_id=ruleset.analysis_preset_id,
+                product=assignment.product,
+                vulnerability_ids=vulnerability_ids,
+            )
+
+
 def reevaluate_product_rulesets(product, apply_preset=True):
     """Re-evaluate all enabled triage rulesets currently assigned to the product."""
     assignments = ProductTriageRuleset.objects.filter(

vulnerabilities/triage/management/commands/create_triage_rulesets.py

@@ -10,6 +10,7 @@
 from django.core.management.base import CommandError
 
 from dje.models import Dataspace
+from vulnerabilities.triage.engine import delete_preset_analyses_before_ruleset_delete
 from vulnerabilities.triage.models import AnalysisPreset
 from vulnerabilities.triage.models import TriageAction
 from vulnerabilities.triage.models import TriageRuleset
@@ -179,6 +180,8 @@ def handle(self, *args, **options):
                 self.stdout.write("Reset cancelled.")
                 return
 
+            for ruleset in TriageRuleset.objects.filter(dataspace=dataspace):
+                delete_preset_analyses_before_ruleset_delete(ruleset)
             deleted_rulesets, _ = TriageRuleset.objects.filter(dataspace=dataspace).delete()
             deleted_presets, _ = AnalysisPreset.objects.filter(dataspace=dataspace).delete()
             self.stdout.write(

vulnerabilities/triage/signals.py

@@ -10,28 +10,7 @@
 from django.db.models.signals import post_save
 from django.dispatch import receiver
 
-from vulnerabilities.triage.engine import delete_preset_analyses_for_product
 from vulnerabilities.triage.engine import reevaluate_product_rulesets
-from vulnerabilities.triage.models import TriageRecord
-
-
-@receiver(post_delete, sender="vulnerabilities_triage.ProductTriageRuleset")
-def delete_triage_records_on_unassign(sender, instance, **kwargs):
-    """Delete triage records and associated preset analyses when a ruleset is de-assigned."""
-    matching_records = TriageRecord.objects.filter(
-        ruleset=instance.ruleset,
-        product=instance.product,
-    )
-    stale_vulnerability_ids = list(matching_records.values_list("vulnerability_id", flat=True))
-    # Records with an open Request are kept so reassigning the ruleset reconnects to it
-    # instead of opening a duplicate Request.
-    matching_records.filter(request__isnull=True).delete()
-    if instance.ruleset.analysis_preset_id and stale_vulnerability_ids:
-        delete_preset_analyses_for_product(
-            preset_id=instance.ruleset.analysis_preset_id,
-            product=instance.product,
-            vulnerability_ids=stale_vulnerability_ids,
-        )
 
 
 @receiver([post_save, post_delete], sender="vulnerabilities.VulnerabilityAnalysis")