Add filter for fixed packages in vulnerabilities endpoint

Signed-off-by: Tushar Goel <[email protected]>

Author: TG1999

vulnerabilities/api.py

@@ -50,7 +50,34 @@ class Meta:
         fields = ["url", "purl"]
 
 
-class MinimalVulnerabilitySerializer(serializers.HyperlinkedModelSerializer):
+class FilteredPackageListSerializer(serializers.ListSerializer):
+    def to_representation(self, data):
+        params = self.context["request"].query_params
+        name = params.get("name")
+        if name:
+            data = data.filter(name=name)
+        namespace = params.get("namespace")
+        if namespace:
+            data = data.filter(namespace=namespace)
+        type = params.get("type")
+        if type:
+            data = data.filter(type=type)
+        return super(FilteredPackageListSerializer, self).to_representation(data)
+
+
+class FixedPackageSerializer(serializers.ModelSerializer):
+
+    purl = serializers.CharField(source="package_url")
+
+    class Meta:
+        list_serializer_class = FilteredPackageListSerializer
+        model = Package
+        fields = ["url", "purl"]
+
+
+class MinimalVulnerabilitySerializerWithReferencesAndSummary(
+    serializers.HyperlinkedModelSerializer
+):
     """
     Used for nesting inside package focused APIs.
     """
@@ -62,6 +89,31 @@ class Meta:
         fields = ["url", "vulnerability_id", "summary", "references"]
 
 
+class MinimalVulnerabilitySerializer(serializers.HyperlinkedModelSerializer):
+    """
+    Used for nesting inside package focused APIs.
+    """
+
+    class Meta:
+        model = Vulnerability
+        fields = ["url", "vulnerability_id"]
+
+
+class MinimalPackageSerializerWithFixedVulnerabilities(serializers.HyperlinkedModelSerializer):
+    """
+    Used for nesting inside vulnerability focused APIs.
+    """
+
+    purl = serializers.CharField(source="package_url")
+    fixing_vulnerabilities = MinimalVulnerabilitySerializer(
+        many=True, source="resolved_to", read_only=True
+    )
+
+    class Meta:
+        model = Package
+        fields = ["url", "purl", "fixing_vulnerabilities"]
+
+
 class AliasSerializer(serializers.HyperlinkedModelSerializer):
     """
     Used for nesting inside package focused APIs.
@@ -74,7 +126,7 @@ class Meta:
 
 class VulnerabilitySerializer(serializers.HyperlinkedModelSerializer):
 
-    fixed_packages = MinimalPackageSerializer(many=True, source="resolved_to", read_only=True)
+    fixed_packages = FixedPackageSerializer(many=True, source="resolved_to", read_only=True)
     affected_packages = MinimalPackageSerializer(many=True, source="vulnerable_to", read_only=True)
 
     references = VulnerabilityReferenceSerializer(many=True, source="vulnerabilityreference_set")
@@ -100,13 +152,13 @@ def to_representation(self, instance):
         return data
 
     purl = serializers.CharField(source="package_url")
-    affected_by_vulnerabilities = MinimalVulnerabilitySerializer(
+    affected_by_vulnerabilities = MinimalVulnerabilitySerializerWithReferencesAndSummary(
         many=True, source="vulnerable_to", read_only=True
     )
-    fixing_vulnerabilities = MinimalVulnerabilitySerializer(
+    fixing_vulnerabilities = MinimalVulnerabilitySerializerWithReferencesAndSummary(
         many=True, source="resolved_to", read_only=True
     )
-    fixed_packages = MinimalPackageSerializer(many=True, read_only=True)
+    fixed_packages = MinimalPackageSerializerWithFixedVulnerabilities(many=True, read_only=True)
 
     class Meta:
         model = Package

vulnerabilities/models.py

@@ -198,17 +198,14 @@ def fixed_packages(self):
         """
         Returns vulnerabilities which are affecting this package.
         """
-        return (
-            Package.objects.filter(
-                name=self.name,
-                namespace=self.namespace,
-                type=self.type,
-                qualifiers=self.qualifiers,
-                subpath=self.subpath,
-            )
-            .filter(packagerelatedvulnerability__fix=True)
-            .distinct()
-        )
+        return Package.objects.filter(
+            name=self.name,
+            namespace=self.namespace,
+            type=self.type,
+            qualifiers=self.qualifiers,
+            subpath=self.subpath,
+            packagerelatedvulnerability__fix=True,
+        ).distinct()
 
     def set_package_url(self, package_url):
         """