V3/locations Endpoint object init guards (#15142)

* guard endpoints usage

* render jira templates locations instead of guarding

* tests

* render locations in reports when v3, tests

* render locations on report api when necessary

* cleanup

* test fixes

---------

Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com>

Author: dogboat

dojo/api_v2/serializers.py

@@ -254,12 +254,6 @@ class MetaMainSerializer(serializers.Serializer):
         default=None,
         allow_null=True,
     )
-    endpoint = serializers.PrimaryKeyRelatedField(
-        queryset=Endpoint.objects.all(),
-        required=False,
-        default=None,
-        allow_null=True,
-    )
     finding = serializers.PrimaryKeyRelatedField(
         queryset=Finding.objects.all(),
         required=False,
@@ -268,6 +262,17 @@ class MetaMainSerializer(serializers.Serializer):
     )
     metadata = MetadataSerializer(many=True)
 
+    # TODO: Delete this after the move to Locations
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        if not settings.V3_FEATURE_LOCATIONS:
+            self.fields["endpoint"] = serializers.PrimaryKeyRelatedField(
+                queryset=Endpoint.objects.all(),
+                required=False,
+                default=None,
+                allow_null=True,
+            )
+
     def validate(self, data):
         product_id = data.get("product", None)
         endpoint_id = data.get("endpoint", None)
@@ -1052,7 +1057,6 @@ class ReportGenerateSerializer(serializers.Serializer):
     report_info = serializers.CharField(max_length=200)
     test = TestSerializer(many=False, read_only=True)
     endpoint = EndpointSerializer(many=False, read_only=True)
-    endpoints = EndpointSerializer(many=True, read_only=True)
     findings = FindingSerializer(many=True, read_only=True)
     user = UserStubSerializer(many=False, read_only=True)
     team_name = serializers.CharField(max_length=200)
@@ -1063,6 +1067,22 @@ class ReportGenerateSerializer(serializers.Serializer):
         many=True, allow_null=True, required=False,
     )
 
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        # Locations are the default under V3; V3EndpointCompatibleSerializer presents them with the
+        # same endpoint-compatible shape the V3 /endpoints route uses. Legacy Endpoints are the
+        # V2-only exception. The lazy import avoids a circular import: endpoint_compat imports this
+        # module (and its viewset references ReportGenerateSerializer in @extend_schema at
+        # class-definition time).
+        if settings.V3_FEATURE_LOCATIONS:
+            from dojo.location.api.endpoint_compat import (  # noqa: PLC0415
+                V3EndpointCompatibleSerializer,
+            )
+            self.fields["endpoints"] = V3EndpointCompatibleSerializer(many=True, read_only=True)
+        else:
+            # TODO: Delete this after the move to Locations
+            self.fields["endpoints"] = EndpointSerializer(many=True, read_only=True)
+
 
 from dojo.jira.api.serializers import (  # noqa: E402, F401 backward compat
     EngagementUpdateJiraEpicSerializer,

dojo/api_v2/views.py

@@ -7,6 +7,8 @@
 from django.contrib.auth.models import Permission
 from django.core.exceptions import ValidationError
 from django.db import IntegrityError
+from django.db.models import OuterRef, Value
+from django.db.models.functions import Coalesce
 from django.db.models.query import QuerySet as DjangoQuerySet
 from django.utils import timezone
 from django_filters.rest_framework import DjangoFilterBackend
@@ -45,6 +47,8 @@
 from dojo.importers.auto_create_context import AutoCreateContextManager
 from dojo.jira import services as jira_services
 from dojo.labels import get_labels
+from dojo.location.models import LocationFindingReference, LocationProductReference
+from dojo.location.status import FindingLocationStatus
 from dojo.models import (
     App_Analysis,
     Dojo_User,
@@ -67,11 +71,13 @@
     get_authorized_languages,
     get_authorized_products,
 )
+from dojo.query_utils import build_count_subquery
 from dojo.reports.ui.views import (
     prefetch_related_findings_for_report,
     report_url_resolver,
 )
 from dojo.test.queries import get_authorized_tests
+from dojo.url.models import URL
 from dojo.user.utils import get_configuration_permissions_codenames
 from dojo.utils import (
     get_celery_queue_details,
@@ -261,11 +267,13 @@ def _fetch_and_authorize_parents(self, request, permission_map):
         """Fetch parent objects and verify the user has the required permissions."""
         data = request.data
         parents = {}
-        for field, (model, permission) in permission_map.items():
-            obj = model.objects.filter(id=data.get(field)).first()
-            if obj:
-                user_has_permission_or_403(request.user, obj, permission)
-            parents[field] = obj
+        # TODO: Delete this after the move to Locations
+        with Endpoint.allow_endpoint_init():
+            for field, (model, permission) in permission_map.items():
+                obj = model.objects.filter(id=data.get(field)).first()
+                if obj:
+                    user_has_permission_or_403(request.user, obj, permission)
+                parents[field] = obj
         return parents
 
     def process_post(self, request):
@@ -519,6 +527,29 @@ def perform_create(self, serializer):
 from dojo.notes.api.views import NotesViewSet  # noqa: E402, F401 -- re-export; urls.py imports by name
 
 
+def _report_url_location_refs(product):
+    """
+    URL LocationProductReferences for a product, shaped for V3EndpointCompatibleSerializer.
+
+    Mirrors V3EndpointCompatibleViewSet.get_queryset so the report's ``endpoints`` field matches
+    the V3 ``/endpoints`` route. Non-URL locations (e.g. dependencies) are excluded because the
+    compat serializer only understands URL-backed locations.
+    """
+    active_finding_subquery = build_count_subquery(
+        LocationFindingReference.objects.filter(
+            location=OuterRef("location"),
+            status=FindingLocationStatus.Active,
+        ),
+        group_field="location",
+    )
+    return LocationProductReference.objects.filter(
+        product=product,
+        location__location_type=URL.LOCATION_TYPE,
+    ).annotate(
+        active_finding_count=Coalesce(active_finding_subquery, Value(0)),
+    ).distinct()
+
+
 def report_generate(request, obj, options):
     user = Dojo_User.objects.get(id=request.user.id)
     product_type = None
@@ -589,10 +620,14 @@ def report_generate(request, obj, options):
                 Finding.objects.filter(test__engagement__product=product),
             ),
         )
-        ids = get_endpoint_ids(
-            Endpoint.objects.filter(product=product).distinct(),
-        )
-        endpoints = Endpoint.objects.filter(id__in=ids)
+        if settings.V3_FEATURE_LOCATIONS:
+            endpoints = _report_url_location_refs(product)
+        else:
+            # TODO: Delete this after the move to Locations
+            ids = get_endpoint_ids(
+                Endpoint.objects.filter(product=product).distinct(),
+            )
+            endpoints = Endpoint.objects.filter(id__in=ids)
 
     elif type(obj).__name__ == "Engagement":
         engagement = obj
@@ -605,11 +640,14 @@ def report_generate(request, obj, options):
         )
         report_name = "Engagement Report: " + str(engagement)
 
-        ids = set(finding.id for finding in findings.qs)  # noqa: C401
-        ids = get_endpoint_ids(
-            Endpoint.objects.filter(product=engagement.product).distinct(),
-        )
-        endpoints = Endpoint.objects.filter(id__in=ids)
+        if settings.V3_FEATURE_LOCATIONS:
+            endpoints = _report_url_location_refs(engagement.product)
+        else:
+            # TODO: Delete this after the move to Locations
+            ids = get_endpoint_ids(
+                Endpoint.objects.filter(product=engagement.product).distinct(),
+            )
+            endpoints = Endpoint.objects.filter(id__in=ids)
 
     elif type(obj).__name__ == "Test":
         test = obj

dojo/auditlog/ui/views.py

@@ -73,7 +73,8 @@ def action_history(request, cid, oid):
     # TODO: Delete this after the move to Locations
     elif ct.model == "endpoint":
         user_has_permission_or_403(request.user, obj, "view")
-        object_value = Endpoint.objects.get(id=obj.id)
+        with Endpoint.allow_endpoint_init():
+            object_value = Endpoint.objects.get(id=obj.id)
         product_id = object_value.product.id
         active_tab = "endpoints"
     elif ct.model == "risk_acceptance":

dojo/github/services.py

@@ -1,6 +1,7 @@
 import logging
 import sys
 
+from django.conf import settings
 from django.template.loader import render_to_string
 from github import Auth, Github
 
@@ -160,4 +161,5 @@ def github_body(find):
     template = "issue-trackers/jira_full/jira-description.tpl"
     kwargs = {}
     kwargs["finding"] = find
+    kwargs["V3_FEATURE_LOCATIONS"] = settings.V3_FEATURE_LOCATIONS
     return render_to_string(template, kwargs)

dojo/jira/helper.py

@@ -705,6 +705,7 @@ def jira_description(obj, **kwargs):
     elif isinstance(obj, Finding_Group):
         kwargs["finding_group"] = obj
 
+    kwargs["V3_FEATURE_LOCATIONS"] = settings.V3_FEATURE_LOCATIONS
     description = render_to_string(template, kwargs)
     defect_dojo_obj_url = get_full_url(obj.get_absolute_url())
     max_length = getattr(settings, "JIRA_DESCRIPTION_MAX_LENGTH", 32767)

dojo/reports/ui/views.py

@@ -917,8 +917,12 @@ def get(self, request):
                 fields.append(finding.test.engagement.product.name)
 
                 endpoint_value = ""
-                for endpoint in finding.endpoints.all():
-                    endpoint_value += f"{endpoint}; "
+                if settings.V3_FEATURE_LOCATIONS:
+                    for location_ref in finding.locations.all():
+                        endpoint_value += f"{location_ref.location}; "
+                else:
+                    for endpoint in finding.endpoints.all():
+                        endpoint_value += f"{endpoint}; "
                 endpoint_value = endpoint_value.removesuffix("; ")
                 if len(endpoint_value) > EXCEL_CHAR_LIMIT:
                     endpoint_value = endpoint_value[:EXCEL_CHAR_LIMIT - 3] + "..."
@@ -1082,8 +1086,12 @@ def get(self, request):
                 col_num += 1
 
                 endpoint_value = ""
-                for endpoint in finding.endpoints.all():
-                    endpoint_value += f"{endpoint}; \n"
+                if settings.V3_FEATURE_LOCATIONS:
+                    for location_ref in finding.locations.all():
+                        endpoint_value += f"{location_ref.location}; \n"
+                else:
+                    for endpoint in finding.endpoints.all():
+                        endpoint_value += f"{endpoint}; \n"
                 endpoint_value = endpoint_value.removesuffix("; \n")
                 if len(endpoint_value) > EXCEL_CHAR_LIMIT:
                     endpoint_value = endpoint_value[:EXCEL_CHAR_LIMIT - 3] + "..."

dojo/templates/issue-trackers/jira_full/jira-description.tpl

@@ -43,13 +43,23 @@
 *Commit hash:* {{ finding.test.engagement.commit_hash }}
 {% endif %}
 
+{% if V3_FEATURE_LOCATIONS %}
+{% if finding.locations.all %}
+*Systems/Locations*:
+||Location||Status||
+{% for location_ref in finding.locations.all %}|{{ location_ref.location }}|{{ location_ref.get_status_display }}|
+{% endfor %}
+{% endif %}
+{% else %}
+{% comment %} TODO: Delete this after the move to Locations {% endcomment %}
 {% if finding.endpoints.all %}
 *Systems/Endpoints*:
 ||System/Endpoint||Status||
 {% for endpoint in finding|get_vulnerable_endpoints %}|{{ endpoint }}|{{ endpoint|endpoint_display_status:finding }}|
 {% endfor %}{% for endpoint in finding|get_mitigated_endpoints %}|{{ endpoint }}|{{ endpoint|endpoint_display_status:finding }}|
 {% endfor %}
-{%endif%}
+{% endif %}
+{% endif %}
 
 
 {% if finding.component_name %}

dojo/templates/issue-trackers/jira_full/jira-finding-group-description.tpl

@@ -47,13 +47,23 @@ h3. [{{ finding.title|jiraencode}}|{{ finding_url|full_url }}]
 {% if finding.cve %}*CVE:* [{{ finding.cve }}|{{ finding.cve|vulnerability_url }}]{% else %}*CVE:* Unknown{% endif %}
 {% if finding.cvssv3_score %} *CVSSv3 Score:* {{ finding.cvssv3_score }} {% endif %}
 
+{% if V3_FEATURE_LOCATIONS %}
+{% if finding.locations.all %}
+*Systems/Locations*:
+||Location||Status||
+{% for location_ref in finding.locations.all %}|{{ location_ref.location }}|{{ location_ref.get_status_display }}|
+{% endfor %}
+{% endif %}
+{% else %}
+{% comment %} TODO: Delete this after the move to Locations {% endcomment %}
 {% if finding.endpoints.all %}
 *Systems/Endpoints*:
 ||System/Endpoint||Status||
 {% for endpoint in finding|get_vulnerable_endpoints %}|{{ endpoint }}|{{ endpoint|endpoint_display_status:finding }}|
 {% endfor %}{% for endpoint in finding|get_mitigated_endpoints %}|{{ endpoint }}|{{ endpoint|endpoint_display_status:finding }}|
 {% endfor %}
-{%endif%}
+{% endif %}
+{% endif %}
 
 {% if finding.sast_source_object %}
 *Source Object*: {{ finding.sast_source_object }}