feat: keep rule priority when rule no longer matches

Author: dervoeti

backend/application/rules/services/rule_engine.py

@@ -73,8 +73,9 @@ def apply_rules_for_observation(self, observation: Observation) -> None:
         observation.rule_rego_severity = ""
         observation.rule_status = ""
         observation.rule_rego_status = ""
-        observation.rule_priority = None
-        observation.rule_rego_priority = None
+        # rule_priority and rule_rego_priority are intentionally not reset: the priority is kept
+        # even if the rule no longer matches, so it stays visible why an assessment was made.
+        # A rule that matches again overwrites it with the new value.
         observation.rule_vex_justification = ""
         observation.rule_rego_vex_justification = ""
         observation.rule_vex_remediations = None

backend/application/rules/services/simulator.py

@@ -55,8 +55,7 @@ def simulate_rule(rule: Rule) -> Tuple[int, list[Observation]]:
         observation_before.rule_rego_status = ""
         observation_before.rule_severity = ""
         observation_before.rule_rego_status = ""
-        observation_before.rule_priority = None
-        observation_before.rule_rego_priority = None
+        # rule_priority and rule_rego_priority are intentionally not reset, see Rule_Engine
         observation_before.rule_vex_justification = ""
         observation_before.rule_rego_vex_justification = ""
         observation_before.general_rule = None

backend/unittests/rules/services/test_rule_engine.py

@@ -85,6 +85,27 @@ def test_check_rule_rego_lazy_loads_interpreter(self, mock_rule, mock_rego_inter
 
     # --- apply_rules ---
 
+    @patch("application.rules.models.Rule.objects.filter")
+    def test_apply_rules_keeps_priority_when_no_rule_matches(self, mock_rule):
+        mock_rule.return_value = []
+        self.product_1.apply_general_rules = False
+        rule_engine = Rule_Engine(self.product_1)
+        observation = Observation(
+            title="observation",
+            product=self.product_1,
+            rule_priority=3,
+            rule_rego_priority=2,
+            current_priority=2,
+            rule_severity="High",
+        )
+
+        rule_engine.apply_rules_for_observation(observation)
+
+        self.assertEqual(observation.rule_priority, 3)
+        self.assertEqual(observation.rule_rego_priority, 2)
+        self.assertEqual(observation.current_priority, 2)
+        self.assertEqual(observation.rule_severity, "")
+
     # --- _check_regex ---
 
     def test_check_regex_no_pattern(self):

backend/unittests/rules/services/test_simulator.py

@@ -284,6 +284,8 @@ def test_observation_before_fields_are_reset(
         self, mock_obs_manager, mock_rule_engine_cls, mock_copy, mock_normalize
     ):
         obs_before = MagicMock(spec=Observation)
+        obs_before.rule_priority = 3
+        obs_before.rule_rego_priority = 3
         mock_copy.return_value = obs_before
 
         self._setup_queryset_mock(mock_obs_manager, [self.mock_observation])
@@ -295,8 +297,9 @@ def test_observation_before_fields_are_reset(
         self.assertEqual(obs_before.rule_status, "")
         self.assertEqual(obs_before.rule_rego_status, "")
         self.assertEqual(obs_before.rule_severity, "")
-        self.assertIsNone(obs_before.rule_priority)
-        self.assertIsNone(obs_before.rule_rego_priority)
+        # priorities are intentionally kept, see Rule_Engine
+        self.assertEqual(obs_before.rule_priority, 3)
+        self.assertEqual(obs_before.rule_rego_priority, 3)
         self.assertEqual(obs_before.rule_vex_justification, "")
         self.assertEqual(obs_before.rule_rego_vex_justification, "")
         self.assertIsNone(obs_before.general_rule)