add ability to set a analysis preset

Signed-off-by: tdruez <tdruez@aboutcode.org>

Author: tdruez

product_portfolio/templates/product_portfolio/product_details.html

@@ -384,6 +384,21 @@
           });
         });
 
+        document.addEventListener('click', function(event) {
+          const btn = event.target.closest('.quick-preset-btn');
+          if (!btn) return;
+          fetch(btn.dataset.applyUrl, {
+            method: 'POST',
+            headers: {'X-CSRFToken': csrftoken},
+          })
+          .then(response => response.json())
+          .then(data => {
+            if (data.success) location.reload();
+            else alert(data.error || 'Error applying preset.');
+          })
+          .catch(() => alert('Error applying preset.'));
+        });
+
       });
     </script>
   {% endif %}

product_portfolio/templates/product_portfolio/tabs/tab_packages_vulnerabilities.html

@@ -134,7 +134,7 @@
                 <i class="fa-solid fa-bug-slash" data-bs-toggle="tooltip" title="Vulnerability is NOT reachable"></i>
               {% endif %}
             </td>
-            <td class="p-1">
+            <td class="p-1 text-nowrap">
               <span data-bs-toggle="modal"
                     data-bs-target="#vulnerability-analysis-modal"
                     data-advisory-uid="{{ vulnerability.advisory_uid }}"
@@ -145,6 +145,24 @@
                   <i class="far fa-edit fa-sm"></i>
                 </button>
               </span>
+              {% if analysis_presets and not vulnerability.vulnerability_analysis %}
+                <div class="dropdown d-inline">
+                  <button type="button" class="btn btn-link p-0" data-bs-toggle="dropdown" aria-label="Quick action" title="Apply preset">
+                    <i class="fas fa-bolt fa-sm text-warning"></i>
+                  </button>
+                  <ul class="dropdown-menu dropdown-menu-end">
+                    <li><h6 class="dropdown-header small">Apply preset</h6></li>
+                    {% for preset in analysis_presets %}
+                    <li>
+                      <button type="button" class="dropdown-item small quick-preset-btn"
+                              data-apply-url="{% url 'product_portfolio:apply_analysis_preset' product_package.uuid preset.pk vulnerability.advisory_uid %}">
+                        {{ preset.name }}
+                      </button>
+                    </li>
+                    {% endfor %}
+                  </ul>
+                </div>
+              {% endif %}
             </td>
             {% if not forloop.first %}</tr>{% endif %}
           {% endfor %}

product_portfolio/urls.py

@@ -39,6 +39,7 @@
 from product_portfolio.views import ProductUpdateView
 from product_portfolio.views import PullProjectDataFromScanCodeIOView
 from product_portfolio.views import add_customcomponent_ajax_view
+from product_portfolio.views import apply_analysis_preset_view
 from product_portfolio.views import check_package_version_ajax_view
 from product_portfolio.views import delete_scan_htmx_view
 from product_portfolio.views import edit_productrelation_ajax_view
@@ -118,6 +119,11 @@ def product_path(path_segment, view):
         edit_productrelation_ajax_view,
         name="edit_productrelation_ajax",
     ),
+    path(
+        "vulnerability_analysis/<uuid:productpackage_uuid>/preset/<int:preset_id>/<path:advisory_uid>/",
+        apply_analysis_preset_view,
+        name="apply_analysis_preset",
+    ),
     path(
         "vulnerability_analysis/<uuid:productpackage_uuid>/<path:advisory_uid>/",
         vulnerability_analysis_form_view,

product_portfolio/views.py

@@ -151,6 +151,7 @@
 from vulnerabilities.models import VulnerabilityAnalysis
 from vulnerabilities.models import get_risk_level
 from vulnerabilities.triage.engine import evaluate_ruleset
+from vulnerabilities.triage.models import AnalysisPreset
 from vulnerabilities.triage.models import ProductTriageRuleset
 from vulnerabilities.triage.models import TriageAction
 from vulnerabilities.triage.models import TriageRecord
@@ -1426,6 +1427,7 @@ def get_context_data(self, **kwargs):
         self.attach_vulnerability_analyses(page_obj)
         self.attach_triage_data(product, page_obj)
 
+        analysis_presets = list(AnalysisPreset.objects.scope(product.dataspace))
         context_data.update(
             {
                 "filterset": self.filterset,
@@ -1434,6 +1436,7 @@ def get_context_data(self, **kwargs):
                 "search_query": self.request.GET.get("vulnerabilities-q", ""),
                 "risk_threshold": risk_threshold,
                 "has_triage_rulesets": self.has_triage_rulesets,
+                "analysis_presets": analysis_presets,
             }
         )
 
@@ -2934,6 +2937,45 @@ def vulnerability_analysis_form_view(request, productpackage_uuid, advisory_uid)
     return HttpResponse(rendered_form)
 
 
+@login_required
+@require_POST
+def apply_analysis_preset_view(request, productpackage_uuid, advisory_uid, preset_id):
+    user = request.user
+    dataspace = user.dataspace
+
+    product_package_qs = ProductPackage.objects.product_secured(user, perms="change_product")
+    product_package = get_object_or_404(product_package_qs, uuid=productpackage_uuid)
+    vulnerability = get_object_or_404(
+        Vulnerability.objects.scope(dataspace), advisory_uid=advisory_uid
+    )
+    preset = get_object_or_404(AnalysisPreset.objects.scope(dataspace), pk=preset_id)
+
+    existing = VulnerabilityAnalysis.objects.scope(dataspace).get_or_none(
+        product_package=product_package,
+        vulnerability=vulnerability,
+    )
+    if existing:
+        return JsonResponse(
+            {"error": "An analysis already exists for this vulnerability."}, status=400
+        )
+
+    analysis = VulnerabilityAnalysis(
+        product_package=product_package,
+        vulnerability=vulnerability,
+        dataspace=dataspace,
+    )
+    preset.apply_to_analysis(analysis)
+
+    content_fields = [analysis.state, analysis.justification, analysis.responses, analysis.detail]
+    if not any(content_fields):
+        return JsonResponse({"error": "This preset has no content fields to apply."}, status=400)
+
+    analysis.applied_by_preset = preset
+    analysis.save()
+
+    return JsonResponse({"success": "applied"}, status=200)
+
+
 @login_required
 @csrf_exempt
 @require_http_methods(["DELETE"])