refine implementation

Signed-off-by: tdruez <tdruez@aboutcode.org>

Author: tdruez

product_portfolio/api.py

@@ -396,6 +396,11 @@ class TriageRulesetAssignmentSerializer(serializers.Serializer):
     assigned = serializers.BooleanField(read_only=True)
 
 
+class AssignTriageRulesetSerializer(serializers.Serializer):
+    ruleset = serializers.UUIDField()
+    assigned = serializers.BooleanField()
+
+
 class ProductViewSet(
     ObjectPermissionsMixin,
     SendAboutFilesMixin,
@@ -484,7 +489,12 @@ def triage_records(self, request, uuid):
         serializer = TriageRecordSerializer(records, many=True)
         return Response(serializer.data)
 
-    @action(detail=True, methods=["get", "post"], url_path="manage_triage_rulesets")
+    @action(
+        detail=True,
+        methods=["get", "post"],
+        url_path="manage_triage_rulesets",
+        serializer_class=AssignTriageRulesetSerializer,
+    )
     def manage_triage_rulesets(self, request, uuid):
         """
         GET: list every enabled triage ruleset in this product's dataspace, each flagged
@@ -496,22 +506,16 @@ def manage_triage_rulesets(self, request, uuid):
         product = self.get_object()
 
         if request.method == "POST":
-            if not isinstance(request.data, dict):
-                return Response(
-                    {"error": "Expected a JSON object with 'ruleset' and 'assigned'."},
-                    status=status.HTTP_400_BAD_REQUEST,
-                )
-            ruleset_uuid = request.data.get("ruleset")
-            assigned = request.data.get("assigned")
-            if ruleset_uuid is None or assigned is None:
-                return Response(
-                    {"error": "Both 'ruleset' and 'assigned' are required."},
-                    status=status.HTTP_400_BAD_REQUEST,
-                )
+            serializer = AssignTriageRulesetSerializer(data=request.data)
+            if not serializer.is_valid():
+                return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
+
             ruleset = get_object_or_404(
                 TriageRuleset.objects.scope(product.dataspace).filter(enabled=True),
-                uuid=ruleset_uuid,
+                uuid=serializer.validated_data["ruleset"],
             )
+            assigned = serializer.validated_data["assigned"]
+
             with transaction.atomic():
                 assignment = ProductTriageRuleset.objects.filter(
                     product=product, ruleset=ruleset
@@ -520,10 +524,11 @@ def manage_triage_rulesets(self, request, uuid):
                     ProductTriageRuleset.objects.create(
                         product=product, ruleset=ruleset, dataspace=product.dataspace
                     )
+                    reevaluate_product_rulesets(product)
                 elif not assigned and assignment:
                     assignment.delete()
                     delete_triage_records_for_assignment(ruleset=ruleset, product=product)
-                reevaluate_product_rulesets(product)
+                    reevaluate_product_rulesets(product)
             return Response(status=status.HTTP_200_OK)
 
         assigned_ruleset_ids = set(

product_portfolio/tests/test_api.py

@@ -868,6 +868,25 @@ def test_api_product_endpoint_manage_triage_rulesets_post_unassigns(self):
             ProductTriageRuleset.objects.filter(product=self.product1, ruleset=ruleset).exists()
         )
 
+    def test_api_product_endpoint_manage_triage_rulesets_post_unassigns_form_encoded(self):
+        # Regression: a form-encoded "false" string must not be treated as truthy.
+        url = reverse("api_v2:product-manage-triage-rulesets", args=[self.product1.uuid])
+        self.client.login(username=self.base_user.username, password="secret")
+        add_perm(self.base_user, "add_product")
+        assign_perm("view_product", self.base_user, self.product1)
+        assign_perm("change_product", self.base_user, self.product1)
+
+        ruleset = make_triage_ruleset(self.dataspace)
+        make_product_triage_ruleset(self.product1, ruleset=ruleset)
+
+        data = {"ruleset": str(ruleset.uuid), "assigned": "false"}
+        response = self.client.post(url, data=data)
+
+        self.assertEqual(status.HTTP_200_OK, response.status_code)
+        self.assertFalse(
+            ProductTriageRuleset.objects.filter(product=self.product1, ruleset=ruleset).exists()
+        )
+
     def test_api_product_endpoint_manage_triage_rulesets_post_requires_both_fields(self):
         url = reverse("api_v2:product-manage-triage-rulesets", args=[self.product1.uuid])
         self.client.login(username=self.base_user.username, password="secret")

vulnerabilities/triage/api.py

@@ -10,6 +10,7 @@
 from rest_framework import serializers
 
 from dje.api import CreateRetrieveUpdateListViewSet
+from dje.api import DataspacedHyperlinkedRelatedField
 from dje.api import DataspacedSerializer
 from dje.api import ExtraPermissionsViewSetMixin
 from dje.api_custom import TabPermission
@@ -73,6 +74,19 @@ class AnalysisPresetViewSet(
 
 
 class TriageRulesetSerializer(DataspacedSerializer):
+    analysis_preset = DataspacedHyperlinkedRelatedField(
+        view_name="api_v2:analysispreset-detail",
+        lookup_field="uuid",
+        required=False,
+        allow_null=True,
+    )
+    request_template = DataspacedHyperlinkedRelatedField(
+        view_name="api_v2:requesttemplate-detail",
+        lookup_field="uuid",
+        required=False,
+        allow_null=True,
+    )
+
     class Meta:
         model = TriageRuleset
         fields = (
@@ -92,18 +106,6 @@ class Meta:
                 "view_name": "api_v2:triageruleset-detail",
                 "lookup_field": "uuid",
             },
-            "analysis_preset": {
-                "view_name": "api_v2:analysispreset-detail",
-                "lookup_field": "uuid",
-                "required": False,
-                "allow_null": True,
-            },
-            "request_template": {
-                "view_name": "api_v2:requesttemplate-detail",
-                "lookup_field": "uuid",
-                "required": False,
-                "allow_null": True,
-            },
         }
 
     def validate_request_template(self, value):

vulnerabilities/triage/tests/test_api.py

@@ -144,6 +144,19 @@ def test_api_triageruleset_endpoint_create_rejects_request_template_with_no_crea
         msg = "This request template has no creator and cannot be used to open requests."
         self.assertIn(msg, response.data["request_template"])
 
+    def test_api_triageruleset_endpoint_create_rejects_cross_dataspace_analysis_preset(self):
+        self.client.login(username="super_user", password="secret")
+        other_preset = make_analysis_preset(self.alternate, name="OtherPreset")
+        other_preset_url = reverse("api_v2:analysispreset-detail", args=[other_preset.uuid])
+        data = {
+            "name": "New Ruleset",
+            "precedence": 200,
+            "analysis_preset": other_preset_url,
+        }
+        response = self.client.post(self.list_url, data=data, content_type="application/json")
+        self.assertEqual(status.HTTP_400_BAD_REQUEST, response.status_code)
+        self.assertIn("analysis_preset", response.data)
+
     def test_api_triageruleset_endpoint_update(self):
         self.client.login(username="super_user", password="secret")
         data = {"enabled": False}