Webhook Notifications: Support the owner field (#12940)

* Webhook Notifications: Support the owner field

* Forgot the `engagement_added` event in docs

* Support the case where the owner is not supplied

* Adding tests

* Adding a new user to the test data had surprising consequences...

Author: Maffooch

docs/content/en/open_source/notification_webhooks/engagement_added.md

@@ -34,6 +34,14 @@ X-DefectDojo-Event: engagement_added
     },
     "url_api": "http://localhost:8080/api/v2/engagements/7/",
     "url_ui": "http://localhost:8080/engagement/7",
-    "user": null
+    "user": {
+        "id": 1,
+        "email": "admin@defectdojo.local",
+        "first_name": "Admin",
+        "last_name": "User",
+        "username": "admin",
+        "url_api": "http://localhost:8080/api/v2/users/1/",
+        "url_ui": "http://localhost:8080/user/1"
+    }
 }
 ```

docs/content/en/open_source/notification_webhooks/ping.md

@@ -17,6 +17,14 @@ X-DefectDojo-Event: ping
 {
     "description": "Test webhook notification",
     "title": "",
-    "user": null,
+    "user": {
+        "id": 1,
+        "email": "admin@defectdojo.local",
+        "first_name": "Admin",
+        "last_name": "User",
+        "username": "admin",
+        "url_api": "http://localhost:8080/api/v2/users/1/",
+        "url_ui": "http://localhost:8080/user/1"
+    },
 }
 ```

docs/content/en/open_source/notification_webhooks/product_added.md

@@ -29,6 +29,14 @@ X-DefectDojo-Event: product_added
     },
     "url_api": "http://localhost:8080/api/v2/products/4/",
     "url_ui": "http://localhost:8080/product/4",
-    "user": null
+    "user": {
+        "id": 1,
+        "email": "admin@defectdojo.local",
+        "first_name": "Admin",
+        "last_name": "User",
+        "username": "admin",
+        "url_api": "http://localhost:8080/api/v2/users/1/",
+        "url_ui": "http://localhost:8080/user/1"
+    }
 }
 ```

docs/content/en/open_source/notification_webhooks/product_type_added.md

@@ -23,6 +23,14 @@ X-DefectDojo-Event: product_type_added
     },
     "url_api": "http://localhost:8080/api/v2/product_types/4/",
     "url_ui": "http://localhost:8080/product/type/4",
-    "user": null
+    "user": {
+        "id": 1,
+        "email": "admin@defectdojo.local",
+        "first_name": "Admin",
+        "last_name": "User",
+        "username": "admin",
+        "url_api": "http://localhost:8080/api/v2/users/1/",
+        "url_ui": "http://localhost:8080/user/1"
+    }
 }
 ```

docs/content/en/open_source/notification_webhooks/scan_added.md

@@ -87,6 +87,14 @@ X-DefectDojo-Event: scan_added_empty
     },
     "url_api": "http://localhost:8080/api/v2/tests/90/",
     "url_ui": "http://localhost:8080/test/90",
-    "user": null
+    "user": {
+        "id": 1,
+        "email": "admin@defectdojo.local",
+        "first_name": "Admin",
+        "last_name": "User",
+        "username": "admin",
+        "url_api": "http://localhost:8080/api/v2/users/1/",
+        "url_ui": "http://localhost:8080/user/1"
+    }
 }
 ```

docs/content/en/open_source/notification_webhooks/test_added.md

@@ -41,6 +41,14 @@ X-DefectDojo-Event: test_added
     },
     "url_api": "http://localhost:8080/api/v2/tests/90/",
     "url_ui": "http://localhost:8080/test/90",
-    "user": null
+    "user": {
+        "id": 1,
+        "email": "admin@defectdojo.local",
+        "first_name": "Admin",
+        "last_name": "User",
+        "username": "admin",
+        "url_api": "http://localhost:8080/api/v2/users/1/",
+        "url_ui": "http://localhost:8080/user/1"
+    }
 }
 ```

dojo/fixtures/dojo_testdata.json

@@ -94,8 +94,8 @@
     "model": "auth.user",
     "fields": {
       "username": "user5",
-      "first_name": "",
-      "last_name": "",
+      "first_name": "User",
+      "last_name": "Five",
       "is_active": true,
       "is_superuser": false,
       "is_staff": false,
@@ -108,7 +108,7 @@
         28
       ],
       "password": "pbkdf2_sha256$36000$pe8Ff8HrBPac$Lb3ee6/R9z/aL9nM+D2AXWTpIt9Pa9kcLueXxYNy1ZY=",
-      "email": "",
+      "email": "user5@email.com",
       "date_joined": "2018-04-13T07:59:51.527Z"
     }
   },
@@ -3070,7 +3070,7 @@
       "first_error": null,
       "last_error": null,
       "note": null,
-      "owner": 2
+      "owner": 6
     }
   }
 ]

dojo/templates/notifications/webhooks/subtemplates/base.tpl

@@ -3,7 +3,7 @@
 ---
 description: {{ description | as_json_no_html_esc }}
 title: {{ title | as_json_no_html_esc }}
-user: {{ user | as_json_no_html_esc }}
+{% include 'notifications/webhooks/subtemplates/user.tpl' %}
 {% if url %}
 url_ui:  {{ url | full_url | as_json_no_html_esc }}
 {% endif %}

dojo/templates/notifications/webhooks/subtemplates/user.tpl

@@ -0,0 +1,16 @@
+{% load display_tags %}
+{% load as_json %}
+{% if user %}
+{% url 'view_user' user.id as user_url_ui %}
+{% url 'user-detail' user.id as user_url_api %}
+user:
+    id: {{ user.pk }}
+    email: {{ user.email | as_json_no_html_esc }}
+    username: {{ user.username | as_json_no_html_esc }}
+    first_name: {{ user.first_name | as_json_no_html_esc }}
+    last_name: {{ user.last_name | as_json_no_html_esc }}
+    url_ui: {{ user_url_ui | full_url | as_json_no_html_esc }}
+    url_api: {{ user_url_api | full_url | as_json_no_html_esc }}
+{% else %}
+user: {{ user | as_json_no_html_esc }}
+{% endif %}

unittests/test_notifications.py

@@ -976,3 +976,30 @@ def test_events_messages(self, mock):
                     "url_ui": "http://localhost:8080/finding/239",
                 }],
             })
+
+    @patch("requests.request", **{"return_value.status_code": 200})
+    def test_ping_with_owner_assigned(self, mock):
+        """
+        We only need to test one event because the user is serialized in the base sub template. This allows to]
+        assert that if the test passes for one event, it will pass for all events.
+        """
+        manager = WebhookNotificationManger()
+        manager._test_webhooks_notification(Notification_Webhooks.objects.filter(owner__isnull=False).first())
+        self.assertEqual(mock.call_args.kwargs["headers"]["X-DefectDojo-Event"], "ping")
+        self.maxDiff = None
+        self.assertEqual(
+            mock.call_args.kwargs["json"],
+            {
+                "description": "Test webhook notification",
+                "title": "",
+                "user": {
+                    "id": 6,
+                    "username": "user5",
+                    "first_name": "User",
+                    "last_name": "Five",
+                    "email": "user5@email.com",
+                    "url_api": "http://localhost:8080/api/v2/users/6/",
+                    "url_ui": "http://localhost:8080/user/6",
+                },
+            },
+        )