fix: change VEX responses to return VEX document inside the metadata key

Author: GermanMT

app/domain/vex_generation/processors/sbom_processor.py

@@ -147,7 +147,6 @@ async def save_vex_tix(
             sbom_path=sbom_path,
             sbom_name=sbom_path.split("/")[-1] if "/" in sbom_path else sbom_path,
             moment=now,
-            statements=vex.get("statements", []),
             metadata=vex
         )
         vex_id = await self.vex_service.create_vex(vex_create)
@@ -158,7 +157,6 @@ async def save_vex_tix(
             sbom_path=sbom_path,
             sbom_name=sbom_path.split("/")[-1] if "/" in sbom_path else sbom_path,
             moment=now,
-            statements=tix.get("statements", []),
             metadata=tix
         )
         tix_id = await self.tix_service.create_tix(tix_create)

app/schemas/tix/tix.py

@@ -15,13 +15,12 @@ class TIXBase(BaseModel):
 
 
 class TIXCreate(TIXBase):
-    statements: list[dict[str, Any]] = Field(default_factory=list)
     metadata: dict[str, Any] | None = None
 
 
 class TIXResponse(TIXBase):
     id: str = Field(..., alias="_id")
-    statements: list[dict[str, Any]] = Field(default_factory=list)
+    metadata: dict[str, Any] | None = None
 
     model_config = ConfigDict(
         populate_by_name=True,

app/schemas/vex/vex.py

@@ -15,13 +15,12 @@ class VEXBase(BaseModel):
 
 
 class VEXCreate(VEXBase):
-    statements: list[dict[str, Any]] = Field(default_factory=list)
     metadata: dict[str, Any] | None = None
 
 
 class VEXResponse(VEXBase):
     id: str = Field(..., alias="_id")
-    statements: list[dict[str, Any]] = Field(default_factory=list)
+    metadata: dict[str, Any] | None = None
 
     model_config = ConfigDict(
         populate_by_name=True,

app/services/tix_service.py

@@ -45,7 +45,7 @@ async def read_user_tixs(self, user_id: str) -> list[TIXResponse]:
             },
             {
                 "$lookup": {
-                    "from": "tixs",
+                    "from": "tix",
                     "localField": "tixs",
                     "foreignField": "_id",
                     "as": 'lookup'
@@ -60,7 +60,7 @@ async def read_user_tixs(self, user_id: str) -> list[TIXResponse]:
                     "sbom_path": "$lookup.sbom_path",
                     "sbom_name": "$lookup.sbom_name",
                     "moment": "$lookup.moment",
-                    "statements": "$lookup.statements"
+                    "metadata": "$lookup.metadata"
                 }
             }
         ]

app/services/vex_service.py

@@ -45,7 +45,7 @@ async def read_user_vexs(self, user_id: str) -> list[VEXResponse]:
             },
             {
                 "$lookup": {
-                    "from": "vexs",
+                    "from": "vex",
                     "localField": "vexs",
                     "foreignField": "_id",
                     "as": 'lookup'
@@ -60,7 +60,7 @@ async def read_user_vexs(self, user_id: str) -> list[VEXResponse]:
                     "sbom_path": "$lookup.sbom_path",
                     "sbom_name": "$lookup.sbom_name",
                     "moment": "$lookup.moment",
-                    "statements": "$lookup.statements"
+                    "metadata": "$lookup.metadata"
                 }
             }
         ]

tests/unit/processors/test_sbom_processor.py

@@ -209,15 +209,13 @@ async def test_save_vex_tix(self, processor, mock_vex_service, mock_tix_service)
         assert vex_call.name == "test-repo"
         assert vex_call.sbom_path == sbom_path
         assert vex_call.sbom_name == "sbom.json"
-        assert vex_call.statements == [{"id": "stmt1"}]
 
         mock_tix_service.create_tix.assert_called_once()
         tix_call = mock_tix_service.create_tix.call_args[0][0]
         assert tix_call.owner == "test-owner"
         assert tix_call.name == "test-repo"
         assert tix_call.sbom_path == sbom_path
         assert tix_call.sbom_name == "sbom.json"
-        assert tix_call.statements == [{"id": "stmt2"}]
 
         mock_vex_service.update_user_vexs.assert_called_once_with("vex_id_123", "507f1f77bcf86cd799439011")
         mock_tix_service.update_user_tixs.assert_called_once_with("tix_id_123", "507f1f77bcf86cd799439011")

tests/unit/schemas/test_tix.py

@@ -86,20 +86,8 @@ def test_valid_tix_create(self):
         }
         tix = TIXCreate(**data)
         assert tix.owner == "test-owner"
-        assert tix.statements == []
         assert tix.metadata is None
 
-    def test_tix_create_with_statements(self):
-        data = {
-            "owner": "test-owner",
-            "name": "test-repo",
-            "sbom_path": "/path/to/sbom.json",
-            "statements": [{"id": "stmt-1", "status": "exploitable"}]
-        }
-        tix = TIXCreate(**data)
-        assert len(tix.statements) == 1
-        assert tix.statements[0]["id"] == "stmt-1"
-
     def test_tix_create_with_metadata(self):
         data = {
             "owner": "test-owner",

tests/unit/schemas/test_vex.py

@@ -86,20 +86,8 @@ def test_valid_vex_create(self):
         }
         vex = VEXCreate(**data)
         assert vex.owner == "test-owner"
-        assert vex.statements == []
         assert vex.metadata is None
 
-    def test_vex_create_with_statements(self):
-        data = {
-            "owner": "test-owner",
-            "name": "test-repo",
-            "sbom_path": "/path/to/sbom.json",
-            "statements": [{"id": "stmt-1", "status": "not_affected"}]
-        }
-        vex = VEXCreate(**data)
-        assert len(vex.statements) == 1
-        assert vex.statements[0]["id"] == "stmt-1"
-
     def test_vex_create_with_metadata(self):
         data = {
             "owner": "test-owner",