simplify the sync

Signed-off-by: tdruez <tdruez@aboutcode.org>

Author: tdruez

vulnerabilities/triage/admin.py

@@ -13,7 +13,6 @@
 from dje.admin import DataspacedAdmin
 from dje.admin import dejacode_site
 from dje.list_display import AsLink
-from vulnerabilities.triage.engine import delete_preset_analyses_before_ruleset_delete
 from vulnerabilities.triage.engine import evaluate_ruleset
 from vulnerabilities.triage.forms import AnalysisPresetForm
 from vulnerabilities.triage.forms import TriageRulesetForm
@@ -147,15 +146,6 @@ def save_model(self, request, obj, form, change):
         for assignment in obj.product_triage_rulesets.select_related("product"):
             evaluate_ruleset(ruleset=obj, product=assignment.product)
 
-    def delete_model(self, request, obj):
-        delete_preset_analyses_before_ruleset_delete(obj)
-        super().delete_model(request, obj)
-
-    def delete_queryset(self, request, queryset):
-        for obj in queryset:
-            delete_preset_analyses_before_ruleset_delete(obj)
-        super().delete_queryset(request, queryset)
-
     def get_form(self, request, obj=None, change=False, **kwargs):
         kwargs["fields"] = [
             "name",

vulnerabilities/triage/engine.py

@@ -132,20 +132,17 @@ def delete_preset_analyses_for_product(preset_id, product, vulnerability_ids):
 
 def delete_triage_records_for_assignment(ruleset, product):
     """
-    Delete triage records and associated preset analyses for a ruleset being
-    unassigned from a product.
+    Delete triage records for a ruleset being unassigned from a product.
+
+    VulnerabilityAnalysis records already applied by the ruleset's preset are left
+    untouched: the facts that justified them have not changed, only the decision to keep
+    monitoring with this ruleset. This matches disabling a ruleset, which also leaves
+    previously-applied analyses in place.
     """
     matching_records = TriageRecord.objects.filter(ruleset=ruleset, product=product)
-    stale_vulnerability_ids = list(matching_records.values_list("vulnerability_id", flat=True))
     # Records with an open Request are kept so reassigning the ruleset reconnects to it
     # instead of opening a duplicate Request.
     matching_records.filter(request__isnull=True).delete()
-    if ruleset.analysis_preset_id and stale_vulnerability_ids:
-        delete_preset_analyses_for_product(
-            preset_id=ruleset.analysis_preset_id,
-            product=product,
-            vulnerability_ids=stale_vulnerability_ids,
-        )
 
 
 def sync_triage_records(ruleset, product, matched_rules_per_vulnerability_id, apply_preset=True):
@@ -246,33 +243,6 @@ def evaluate_ruleset(ruleset, product, apply_preset=True):
     )
 
 
-def delete_preset_analyses_before_ruleset_delete(ruleset):
-    """
-    Delete VulnerabilityAnalysis records applied by the ruleset's preset, for every
-    product currently assigned to it.
-
-    Must run before the ruleset itself is deleted: its TriageRecords have no signal of
-    their own, so Django cascade-deletes them via a fast bulk query before a post_delete
-    signal on the ruleset or its assignments would even get a chance to see them.
-    """
-    if not ruleset.analysis_preset_id:
-        return
-
-    assignments = ProductTriageRuleset.objects.filter(ruleset=ruleset).select_related("product")
-    for assignment in assignments:
-        vulnerability_ids = list(
-            TriageRecord.objects.filter(
-                ruleset=ruleset, product=assignment.product
-            ).values_list("vulnerability_id", flat=True)
-        )
-        if vulnerability_ids:
-            delete_preset_analyses_for_product(
-                preset_id=ruleset.analysis_preset_id,
-                product=assignment.product,
-                vulnerability_ids=vulnerability_ids,
-            )
-
-
 def reevaluate_product_rulesets(product, apply_preset=True):
     """Re-evaluate all enabled triage rulesets currently assigned to the product."""
     assignments = ProductTriageRuleset.objects.filter(

vulnerabilities/triage/management/commands/create_triage_rulesets.py

@@ -10,7 +10,6 @@
 from django.core.management.base import CommandError
 
 from dje.models import Dataspace
-from vulnerabilities.triage.engine import delete_preset_analyses_before_ruleset_delete
 from vulnerabilities.triage.models import AnalysisPreset
 from vulnerabilities.triage.models import TriageAction
 from vulnerabilities.triage.models import TriageRuleset
@@ -180,8 +179,6 @@ def handle(self, *args, **options):
                 self.stdout.write("Reset cancelled.")
                 return
 
-            for ruleset in TriageRuleset.objects.filter(dataspace=dataspace):
-                delete_preset_analyses_before_ruleset_delete(ruleset)
             deleted_rulesets, _ = TriageRuleset.objects.filter(dataspace=dataspace).delete()
             deleted_presets, _ = AnalysisPreset.objects.filter(dataspace=dataspace).delete()
             self.stdout.write(