feat(vuln-id): rename to Vulnerability, fix cve-only + reimporter bugs, add cutover-safety tests

Review response (#15331) plus prep for the one-way legacy retirement.

Rename (per review): VulnerabilityId -> Vulnerability; module dojo/vulnerability_id/ -> dojo/vulnerability/;
table dojo_vulnerabilityid -> dojo_vulnerability (migration 0285 amended in place). String column stays
vulnerability_id; reference FK stays `vulnerability`. Added vocabulary + porting-trap docstrings.

Must-fixes:
- MF4: UniqueConstraint(finding, order) on FindingVulnerabilityReference (model + migration 0285).
- MF2: verify_vulnerability_ids downgrades order-0 != cve to a non-fatal warning when cve is not among
  the finding's ids (unreachable without breaking hash parity); stays a hard gate for genuine ordering drift.

Bug fixes surfaced by the new tests:
- cve-only hash-parity break: backfill step 4 fabricated a cve-only reference the live dual-write never
  creates, so entity reads diverged from legacy (dedup churn on deploy). Removed; the reference set now
  mirrors the legacy row set exactly. cve stays an orphan registry entity.
- reimporter N+1: reconcile read the non-prefetched legacy relation under flag-on. Now reads through the
  seam (matches the prefetch). Perf re-baselined: -5 queries per reimport across 24 assertions.

Reader ports toward the cutover (route through the flag seam, reversible): Finding.copy, reimporter reconcile.

Tests (fixture-free, both flag states): legacy-independence (poison), dedup differential, real-scanner
corpus (8 parsers), enumerable shapes (cve-only/null-cve/unicode/quotes/copy), MF2 warning, MF4 constraint.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Maffooch

dojo/api_v2/prefetch/registrations.py

@@ -110,11 +110,11 @@
 from dojo.test.queries import get_authorized_test_imports, get_authorized_tests
 from dojo.tool_product.queries import get_authorized_tool_product_settings
 from dojo.url.models import URL
-from dojo.vulnerability_id.models import (
+from dojo.vulnerability.models import (
     FindingVulnerabilityReference,
-    VulnerabilityId,
+    Vulnerability,
 )
-from dojo.vulnerability_id.queries import (
+from dojo.vulnerability.queries import (
     get_authorized_finding_vulnerability_references,
     get_authorized_vulnerability_id_entities,
 )
@@ -224,7 +224,7 @@
 for model, helper in (
     (Finding_Group, get_authorized_finding_groups),
     (Vulnerability_Id, get_authorized_vulnerability_ids),
-    (VulnerabilityId, get_authorized_vulnerability_id_entities),
+    (Vulnerability, get_authorized_vulnerability_id_entities),
     (FindingVulnerabilityReference, get_authorized_finding_vulnerability_references),
 ):
     register(model, discard_user(helper), "view")

dojo/authorization/query_registrations.py

@@ -41,7 +41,7 @@
     Vulnerability_Id,
 )
 from dojo.request_cache import cache_for_request_or_task
-from dojo.vulnerability_id.models import FindingVulnerabilityReference, VulnerabilityId
+from dojo.vulnerability.models import FindingVulnerabilityReference, Vulnerability
 
 
 def _resolve_user(user):
@@ -421,7 +421,7 @@ def _get_authorized_vulnerability_ids(permission, queryset=None, user=None):
 
 def _get_authorized_vulnerability_id_entities(permission, queryset=None, user=None):
     user = _resolve_user(user)
-    qs = queryset if queryset is not None else VulnerabilityId.objects.all()
+    qs = queryset if queryset is not None else Vulnerability.objects.all()
     if user is None or getattr(user, "is_anonymous", False):
         return qs.none()
     if _is_unrestricted(user, permission_to_action(permission)):

dojo/db_migrations/0285_vulnerability_id_entity_tables.py

@@ -1,11 +1,11 @@
-# Vulnerability ID entity tables: the normalized VulnerabilityId registry and the ordered
-# Finding -> VulnerabilityId reference table. Both tables are CREATED EMPTY here, so every index
+# Vulnerability ID entity tables: the normalized Vulnerability registry and the ordered
+# Finding -> Vulnerability reference table. Both tables are CREATED EMPTY here, so every index
 # (including the two GIN indexes) is built on zero rows — the DDL is effectively instant and needs
 # no AddIndexConcurrently. The data backfill runs separately in 0286 (atomic=False, resumable).
 #
 # >50M-row fallback (documented, NOT the default path): on installs where the subsequent 0286
 # backfill would insert tens of millions of reference rows, GIN maintenance during the backfill
-# dominates. Such installs can strip the two GinIndex entries from the VulnerabilityId Meta here,
+# dominates. Such installs can strip the two GinIndex entries from the Vulnerability Meta here,
 # let 0286 populate the tables, then add both GIN indexes with CREATE INDEX CONCURRENTLY in a
 # follow-up migration. Not needed for typical installs.
 
@@ -20,41 +20,41 @@
 class Migration(migrations.Migration):
 
     dependencies = [
-        ('dojo', '0284_backfill_finding_cwe'),
+        ("dojo", "0284_backfill_finding_cwe"),
     ]
 
     operations = [
         migrations.CreateModel(
-            name='VulnerabilityId',
+            name="Vulnerability",
             fields=[
-                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
-                ('vulnerability_id', models.TextField(unique=True, verbose_name='Vulnerability Id')),
-                ('vulnerability_id_type', models.CharField(blank=True, db_index=True, editable=False, max_length=20, null=True)),
-                ('epss_score', models.FloatField(blank=True, default=None, null=True, validators=[django.core.validators.MinValueValidator(0.0), django.core.validators.MaxValueValidator(1.0)])),
-                ('epss_percentile', models.FloatField(blank=True, default=None, null=True, validators=[django.core.validators.MinValueValidator(0.0), django.core.validators.MaxValueValidator(1.0)])),
-                ('known_exploited', models.BooleanField(blank=True, default=None, null=True)),
-                ('ransomware_used', models.BooleanField(blank=True, default=None, null=True)),
-                ('kev_date', models.DateField(blank=True, default=None, null=True)),
-                ('created', models.DateTimeField(auto_now_add=True)),
-                ('updated', models.DateTimeField(auto_now=True)),
+                ("id", models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name="ID")),
+                ("vulnerability_id", models.TextField(unique=True, verbose_name="Vulnerability Id")),
+                ("vulnerability_id_type", models.CharField(blank=True, db_index=True, editable=False, max_length=20, null=True)),
+                ("epss_score", models.FloatField(blank=True, default=None, null=True, validators=[django.core.validators.MinValueValidator(0.0), django.core.validators.MaxValueValidator(1.0)])),
+                ("epss_percentile", models.FloatField(blank=True, default=None, null=True, validators=[django.core.validators.MinValueValidator(0.0), django.core.validators.MaxValueValidator(1.0)])),
+                ("known_exploited", models.BooleanField(blank=True, default=None, null=True)),
+                ("ransomware_used", models.BooleanField(blank=True, default=None, null=True)),
+                ("kev_date", models.DateField(blank=True, default=None, null=True)),
+                ("created", models.DateTimeField(auto_now_add=True)),
+                ("updated", models.DateTimeField(auto_now=True)),
             ],
             options={
-                'indexes': [django.contrib.postgres.indexes.GinIndex(django.contrib.postgres.search.SearchVector('vulnerability_id', config='english', weight='A'), name='dojo_vulnid_entity_fts_gin'), django.contrib.postgres.indexes.GinIndex(fields=['vulnerability_id'], name='dojo_vulnid_entity_trgm', opclasses=['gin_trgm_ops']), models.Index(django.db.models.functions.text.Upper('vulnerability_id'), name='dojo_vulnid_entity_upper')],
+                "indexes": [django.contrib.postgres.indexes.GinIndex(django.contrib.postgres.search.SearchVector("vulnerability_id", config="english", weight="A"), name="dojo_vulnid_entity_fts_gin"), django.contrib.postgres.indexes.GinIndex(fields=["vulnerability_id"], name="dojo_vulnid_entity_trgm", opclasses=["gin_trgm_ops"]), models.Index(django.db.models.functions.text.Upper("vulnerability_id"), name="dojo_vulnid_entity_upper")],
             },
         ),
         migrations.CreateModel(
-            name='FindingVulnerabilityReference',
+            name="FindingVulnerabilityReference",
             fields=[
-                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
-                ('order', models.PositiveSmallIntegerField(default=0, help_text="Position in the finding's id list; 0 is the primary identifier.")),
-                ('created', models.DateTimeField(auto_now_add=True)),
-                ('finding', models.ForeignKey(editable=False, on_delete=django.db.models.deletion.CASCADE, related_name='vulnerability_references', to='dojo.finding')),
-                ('vulnerability', models.ForeignKey(editable=False, on_delete=django.db.models.deletion.CASCADE, related_name='finding_references', to='dojo.vulnerabilityid')),
+                ("id", models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name="ID")),
+                ("order", models.PositiveSmallIntegerField(default=0, help_text="Position in the finding's id list; 0 is the primary identifier.")),
+                ("created", models.DateTimeField(auto_now_add=True)),
+                ("finding", models.ForeignKey(editable=False, on_delete=django.db.models.deletion.CASCADE, related_name="vulnerability_references", to="dojo.finding")),
+                ("vulnerability", models.ForeignKey(editable=False, on_delete=django.db.models.deletion.CASCADE, related_name="finding_references", to="dojo.vulnerability")),
             ],
             options={
-                'ordering': ['order'],
-                'indexes': [models.Index(fields=['finding', 'order'], name='dojo_findin_finding_d1a7a8_idx'), models.Index(fields=['vulnerability'], name='dojo_findin_vulnera_13169c_idx')],
-                'constraints': [models.UniqueConstraint(fields=('finding', 'vulnerability'), name='unique_finding_vulnerability')],
+                "ordering": ["order"],
+                "indexes": [models.Index(fields=["finding", "order"], name="dojo_findin_finding_d1a7a8_idx"), models.Index(fields=["vulnerability"], name="dojo_findin_vulnera_13169c_idx")],
+                "constraints": [models.UniqueConstraint(fields=("finding", "vulnerability"), name="unique_finding_vulnerability"), models.UniqueConstraint(fields=("finding", "order"), name="unique_finding_order")],
             },
         ),
     ]

dojo/db_migrations/0286_backfill_vulnerability_id_entities.py

@@ -1,11 +1,11 @@
-# Data-only backfill of the VulnerabilityId entity + FindingVulnerabilityReference tables created
+# Data-only backfill of the Vulnerability entity + FindingVulnerabilityReference tables created
 # in 0285. atomic=False so each set-based statement (and each finding_id window in the reference
 # build) commits on its own — a crash mid-backfill resumes where it left off, and ON CONFLICT DO
 # NOTHING everywhere makes any re-run a no-op on completed work. Insert-only into the two NEW
 # tables: dojo_vulnerability_id and dojo_finding are never rewritten, locked, or deleted, so
 # concurrent readers/writers are not blocked.
 #
-# The actual work lives in dojo.vulnerability_id.backfill.run_backfill, shared with the
+# The actual work lives in dojo.vulnerability.backfill.run_backfill, shared with the
 # `migrate_vulnerability_ids` management command (big installs pre-run the command on the previous
 # release; this migration is then an idempotent catch-up during the deploy).
 import logging
@@ -23,7 +23,8 @@ def backfill_vulnerability_id_entities(apps, schema_editor):
             connection.vendor,
         )
         return
-    from dojo.vulnerability_id.backfill import run_backfill  # noqa: PLC0415 -- keep entity import lazy/out of migration graph build
+    from dojo.vulnerability.backfill import run_backfill  # noqa: PLC0415 -- keep entity import lazy/out of migration graph build
+
     run_backfill(logger=logger)
 
 

dojo/filters.py

@@ -55,7 +55,7 @@
 )
 from dojo.product_type.queries import get_authorized_product_types
 from dojo.utils import get_system_setting, is_finding_groups_enabled, truncate_timezone_aware
-from dojo.vulnerability_id.queries import finding_ids_with_vulnerability_ids
+from dojo.vulnerability.queries import finding_ids_with_vulnerability_ids
 
 logger = logging.getLogger(__name__)
 

dojo/finding/api/serializer.py

@@ -323,7 +323,7 @@ def get_attribute(self, instance):
         return instance
 
     def to_representation(self, finding):
-        from dojo.vulnerability_id.queries import finding_vulnerability_id_strings  # noqa: PLC0415 -- flag seam
+        from dojo.vulnerability.queries import finding_vulnerability_id_strings  # noqa: PLC0415 -- flag seam
         return [{"vulnerability_id": value} for value in finding_vulnerability_id_strings(finding)]
 
     def to_internal_value(self, data):

dojo/finding/deduplication.py

@@ -9,7 +9,7 @@
 
 from dojo.celery import app
 from dojo.models import Endpoint_Status, Finding, System_Settings
-from dojo.vulnerability_id.queries import vulnerability_id_prefetch
+from dojo.vulnerability.queries import vulnerability_id_prefetch
 
 logger = logging.getLogger(__name__)
 deduplicationLogger = logging.getLogger("dojo.specific-loggers.deduplication")

dojo/finding/helper.py

@@ -55,7 +55,7 @@
     get_object_or_none,
     to_str_typed,
 )
-from dojo.vulnerability_id.manager import persist_for_finding
+from dojo.vulnerability.manager import persist_for_finding
 
 logger = logging.getLogger(__name__)
 deduplicationLogger = logging.getLogger("dojo.specific-loggers.deduplication")

dojo/finding/models.py

@@ -707,9 +707,13 @@ def copy(self, test=None):
         copy.tags.set(old_tags)
         # Copy the vulnerability ids and CWEs (relation rows aren't copied by copy_model_util).
         # Route vulnerability ids through the dual-write seam so the copy gets legacy rows AND
-        # entity references (copy.cve was already carried over by copy_model_util).
-        from dojo.vulnerability_id.manager import persist_for_finding  # noqa: PLC0415 -- avoid import cycle
-        vulnerability_id_strings = [row.vulnerability_id for row in self.vulnerability_id_set.all()]
+        # entity references (copy.cve was already carried over by copy_model_util). Read the SOURCE
+        # ids through the flag seam too (not the legacy relation directly), so copy() keeps working
+        # after the legacy Vulnerability_Id store is retired.
+        from dojo.vulnerability.manager import persist_for_finding  # noqa: PLC0415 -- avoid import cycle
+        from dojo.vulnerability.queries import finding_vulnerability_id_strings  # noqa: PLC0415
+
+        vulnerability_id_strings = finding_vulnerability_id_strings(self)
         if vulnerability_id_strings:
             persist_for_finding(copy, vulnerability_id_strings, delete_existing=False)
         for finding_cwe in self.finding_cwe_set.all():
@@ -842,7 +846,7 @@ def _get_unsaved_vulnerability_ids(finding) -> str:
 
         def _get_saved_vulnerability_ids(finding) -> str:
             if finding.id is not None:
-                from dojo.vulnerability_id.queries import use_entity_reads  # noqa: PLC0415
+                from dojo.vulnerability.queries import use_entity_reads  # noqa: PLC0415
                 if use_entity_reads():
                     # Entity store: the prefetch-honoring reverse relation (vulnerability_references
                     # + select_related("vulnerability")) so Prefetch is honored — no N+1 in dedupe.
@@ -1393,7 +1397,7 @@ def get_references_with_links(self):
 
     @cached_property
     def vulnerability_ids(self):
-        from dojo.vulnerability_id.queries import use_entity_reads  # noqa: PLC0415
+        from dojo.vulnerability.queries import use_entity_reads  # noqa: PLC0415
         # Get vulnerability ids from database and convert to list of strings
         if use_entity_reads():
             # Entity store: reverse relation is ordered by FindingVulnerabilityReference.Meta.ordering.

dojo/finding/queries.py

@@ -20,7 +20,7 @@ def get_auth_filter(key): return None
     Vulnerability_Id,
 )
 from dojo.request_cache import cache_for_request_or_task
-from dojo.vulnerability_id.queries import vulnerability_id_prefetch
+from dojo.vulnerability.queries import vulnerability_id_prefetch
 
 logger = logging.getLogger(__name__)