Add fixed packages in packages endpoint

[TG1999]

Signed-off-by: Tushar Goel [email protected]

[tdruez]

@TG1999 The new code looks fine.
You should add a simple unit test for the fixed_packages property.
Model properties should be easy to test and you should always add a unit test when you add new properties.

[tdruez]

@TG1999 Your code is not tested. How can we know it works?

[tdruez]

Why not using proper filters instead of this duplicated logic?

[tdruez]

The class name is too long thus not readable.

[tdruez]

This is still duplicated code and much harder to read and understand than the previous code.
This is not what I meant by "proper filters" but I was rather referring to https://www.django-rest-framework.org/api-guide/filtering/#djangofilterbackend.
Any reason to not use a FilterSet here?

[TG1999]

The filters applied by me are for Package model and the viewset is on Vulnerabilities model

[tdruez]

I understand, but relational fields are not available on FilterSet?

[TG1999]

I can do something like this https://github.com/philipn/django-rest-framework-filters#filtering-across-relationships, but the query will then look like api?package__name=name not api?name=name

[tdruez]

api?package__name=name

Is it a problem?

[tdruez]

@TG1999 you already defined a PackageFilterSet, you should use it, for example:

class VulnerabilityViewSet(viewsets.ReadOnlyModelViewSet):
    def get_fixed_packages_qs(self):
        package_filter_data = {"packagerelatedvulnerability__fix": True}

        query_params = self.request.query_params
        for field_name in ["name", "namespace", "type"]:
            value = query_params.get(field_name)
            if value:
                package_filter_data[field_name] = value

        return PackageFilterSet(package_filter_data).qs

    def get_queryset(self):
        queryset = Vulnerability.objects.prefetch_related(
            Prefetch(
                "packages",
                queryset=self.get_fixed_packages_qs(),
                to_attr="filtered_fixed_packages",
            )
        )
        return queryset

Also, make sure to add packagerelatedvulnerability__fix to the PackageFilterSet.fields.

Lastly, you should always document such methods using the docstring, it is not obvious to the reader what is happening here and why we are prefetching filtered package data.