Vulnerability id entity-only cutover: drop legacy Vulnerability_Id

Read vulnerability ids exclusively from the Vulnerability entity +
FindingVulnerabilityReference through-table. Remove the read flag and all
flag-off branches, delete the legacy Vulnerability_Id model, and add migration
0287 dropping dojo_vulnerability_id (0286 backfills the entities first).

- MF2: backfill no longer inserts cve-only references (preserves hash parity)
- MF4: UniqueConstraint(finding, order) on the reference table
- Reimporter reads finding_vulnerability_id_strings (fixes a latent N+1)
- Repoint tests to the entity store; remove legacy-model coverage; delete the
  migrate_cve / verify_vulnerability_ids commands

NOTE: test_tag_inheritance_perf EXPECTED_* query counts need recalibration
under watson-enabled CI after the dual-write removal.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Maffooch

dojo/api_v2/prefetch/registrations.py

@@ -37,7 +37,6 @@
 from dojo.engagement.queries import get_authorized_engagements
 from dojo.finding.queries import (
     get_authorized_findings,
-    get_authorized_vulnerability_ids,
 )
 from dojo.finding_group.queries import get_authorized_finding_groups
 from dojo.github.models import GITHUB_Issue, GITHUB_PKey
@@ -94,7 +93,6 @@
     Tool_Product_Settings,
     Tool_Type,
     UserContactInfo,
-    Vulnerability_Id,
 )
 from dojo.notifications.models import Notification_Webhooks, Notifications
 from dojo.product.queries import (
@@ -223,7 +221,6 @@
 # Models where we can simply fall back to a `get_authorized_*` method to check auth
 for model, helper in (
     (Finding_Group, get_authorized_finding_groups),
-    (Vulnerability_Id, get_authorized_vulnerability_ids),
     (Vulnerability, get_authorized_vulnerability_id_entities),
     (FindingVulnerabilityReference, get_authorized_finding_vulnerability_references),
 ):

dojo/apps.py

@@ -113,11 +113,8 @@ def register_watson_models(app_config):
     watson.register(app_config.get_model("Location"))
     watson.register(app_config.get_model("Engagement"), fields=get_model_fields_with_extra(app_config.get_model("Engagement"), ("id", "product__name")), store=("product__name", ))
     watson.register(app_config.get_model("App_Analysis"))
-    # Watson stays on the legacy Vulnerability_Id table (unconditionally dual-written), so global
-    # search keeps working identically in both flag states with no buildwatson reindex. Moving the
-    # watson index (and the classic search view) to FindingVulnerabilityReference is a legacy-drop
-    # phase concern, not this reads-only flag flip.
-    watson.register(app_config.get_model("Vulnerability_Id"), store=("finding__test__engagement__product__name", ))
+    # The legacy Vulnerability_Id table was retired (entity-only cutover); the classic watson-backed
+    # vuln-id search is gone. The Vue global search covers vulnerability ids via the entity store.
 
     # YourModel = app_config.get_model("YourModel")
     # watson.register(YourModel)

dojo/authorization/query_registrations.py

@@ -38,7 +38,6 @@
     Test,
     Test_Import,
     Tool_Product_Settings,
-    Vulnerability_Id,
 )
 from dojo.request_cache import cache_for_request_or_task
 from dojo.vulnerability.models import FindingVulnerabilityReference, Vulnerability
@@ -405,20 +404,6 @@ def _get_authorized_findings(permission, queryset=None, user=None):
 register_auth_filter("finding.get_authorized_findings_for_queryset", _get_authorized_findings)
 
 
-def _get_authorized_vulnerability_ids(permission, queryset=None, user=None):
-    user = _resolve_user(user)
-    qs = queryset if queryset is not None else Vulnerability_Id.objects.all()
-    if user is None or getattr(user, "is_anonymous", False):
-        return qs.none()
-    if _is_unrestricted(user, permission_to_action(permission)):
-        return qs
-    return qs.filter(finding__test__engagement__product__id__in=_authorized_product_ids(user))
-
-
-register_auth_filter("finding.get_authorized_vulnerability_ids", _get_authorized_vulnerability_ids)
-register_auth_filter("finding.get_authorized_vulnerability_ids_for_queryset", _get_authorized_vulnerability_ids)
-
-
 def _get_authorized_vulnerability_id_entities(permission, queryset=None, user=None):
     user = _resolve_user(user)
     qs = queryset if queryset is not None else Vulnerability.objects.all()

dojo/db_migrations/0287_delete_vulnerability_id.py

@@ -0,0 +1,20 @@
+# Entity-only cutover: drop the legacy Vulnerability_Id store. Vulnerability ids now live entirely in
+# the Vulnerability entity + FindingVulnerabilityReference through-table (created in 0285, backfilled
+# from dojo_vulnerability_id in 0286 — which runs BEFORE this drop). ⚠️ DESTRUCTIVE: drops
+# dojo_vulnerability_id and its data. On upgrading installs, ensure 0286's backfill (or
+# `manage.py migrate_vulnerability_ids` pre-run) has completed before this migration removes the source.
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("dojo", "0286_backfill_vulnerability_id_entities"),
+    ]
+
+    operations = [
+        migrations.DeleteModel(
+            name="Vulnerability_Id",
+        ),
+    ]

dojo/finding/admin.py

@@ -6,7 +6,6 @@
     Finding,
     Finding_Group,
     Finding_Template,
-    Vulnerability_Id,
 )
 
 
@@ -26,12 +25,6 @@ class FindingTemplateAdmin(admin.ModelAdmin):
     """Admin support for the Finding_Template model."""
 
 
-@admin.register(Vulnerability_Id)
-class VulnerabilityIdAdmin(admin.ModelAdmin):
-
-    """Admin support for the Vulnerability_Id model."""
-
-
 @admin.register(Finding_Group)
 class FindingGroupAdmin(admin.ModelAdmin):
 

dojo/finding/api/serializer.py

@@ -43,7 +43,7 @@
     Test,
     Test_Type,
     User,
-    Vulnerability_Id,
+    Vulnerability,
 )
 from dojo.notifications.helper import async_create_notification
 from dojo.user.queries import get_authorized_users
@@ -297,7 +297,9 @@ def get_jira(self, obj):
 
 class VulnerabilityIdSerializer(serializers.ModelSerializer):
     class Meta:
-        model = Vulnerability_Id
+        # Schema-only (OpenAPI) shape for VulnerabilityIdsField; points at the Vulnerability entity,
+        # which carries the same ``vulnerability_id`` string column.
+        model = Vulnerability
         fields = ["vulnerability_id"]
 
 

dojo/finding/models.py

@@ -25,7 +25,6 @@
 
 from dojo.base_models.base import BaseModel
 from dojo.finding.cwe import cwe_label, finding_cwe_labels
-from dojo.finding.vulnerability_id import resolve_vulnerability_id_type
 
 # get_current_date/tomorrow/copy_model_util are defined early in dojo.models, before the
 # re-export that loads this module — so this resolves despite the partial circular load, and
@@ -846,18 +845,11 @@ def _get_unsaved_vulnerability_ids(finding) -> str:
 
         def _get_saved_vulnerability_ids(finding) -> str:
             if finding.id is not None:
-                from dojo.vulnerability.queries import use_entity_reads  # noqa: PLC0415
-                if use_entity_reads():
-                    # Entity store: the prefetch-honoring reverse relation (vulnerability_references
-                    # + select_related("vulnerability")) so Prefetch is honored — no N+1 in dedupe.
-                    vulnerability_id_str_list = [ref.vulnerability.vulnerability_id for ref in finding.vulnerability_references.all()]
-                else:
-                    # Use the reverse relation (vulnerability_id_set) rather than a fresh
-                    # Vulnerability_Id.objects.filter(...) so prefetch_related("vulnerability_id_set")
-                    # is honored — avoids an N+1 (COUNT + SELECT per finding) during dedupe/hashcode.
-                    vulnerability_id_str_list = [str(vulnerability_id) for vulnerability_id in finding.vulnerability_id_set.all()]
+                # Entity store: the prefetch-honoring reverse relation (vulnerability_references
+                # + select_related("vulnerability")) so Prefetch is honored — no N+1 in dedupe.
+                vulnerability_id_str_list = [ref.vulnerability.vulnerability_id for ref in finding.vulnerability_references.all()]
                 deduplicationLogger.debug("get_vulnerability_ids after the finding was saved. Vulnerability references count: " + str(len(vulnerability_id_str_list)))
-                # sort vulnerability_ids strings (no dedupe — byte parity with the legacy store)
+                # sort vulnerability_ids strings (no dedupe — ordering is irrelevant to the hash)
                 return "".join(sorted(vulnerability_id_str_list))
             return ""
 
@@ -1397,14 +1389,9 @@ def get_references_with_links(self):
 
     @cached_property
     def vulnerability_ids(self):
-        from dojo.vulnerability.queries import use_entity_reads  # noqa: PLC0415
-        # Get vulnerability ids from database and convert to list of strings
-        if use_entity_reads():
-            # Entity store: reverse relation is ordered by FindingVulnerabilityReference.Meta.ordering.
-            vulnerability_ids = [ref.vulnerability.vulnerability_id for ref in self.vulnerability_references.all()]
-        else:
-            vulnerability_ids_model = self.vulnerability_id_set.all()
-            vulnerability_ids = [vulnerability_id.vulnerability_id for vulnerability_id in vulnerability_ids_model]
+        # Get vulnerability ids from database and convert to list of strings.
+        # Entity store: reverse relation is ordered by FindingVulnerabilityReference.Meta.ordering.
+        vulnerability_ids = [ref.vulnerability.vulnerability_id for ref in self.vulnerability_references.all()]
 
         # Synchronize the cve field with the unsaved_vulnerability_ids
         # We do this to be as flexible as possible to handle the fields until
@@ -1452,39 +1439,9 @@ def set_hash_code(self, dedupe_option):
                 deduplicationLogger.debug("Hash_code computed for finding: %s: %s", finding_id, self.hash_code)
 
 
-class Vulnerability_Id(models.Model):
-    finding = models.ForeignKey("dojo.Finding", editable=False, on_delete=models.CASCADE)
-    vulnerability_id = models.TextField(max_length=50, blank=False, null=False)
-    # Autodetected from the id prefix (CVE, GHSA, ...); NULL when there is no non-numeric
-    # prefix. Denormalized/indexed so type-scoped queries (e.g. GROUP BY type) stay cheap.
-    vulnerability_id_type = models.CharField(max_length=20, null=True, blank=True, editable=False, db_index=True)
-
-    class Meta:
-        constraints = [
-            models.UniqueConstraint(fields=["finding", "vulnerability_id"], name="unique_finding_vulnerability_id"),
-        ]
-        indexes = [
-            # Leading on vulnerability_id (the unique constraint's index leads on finding), for the
-            # vulnerability-id Explorer's GROUP BY vulnerability_id / lookups by exact id.
-            models.Index(fields=["vulnerability_id"], name="dojo_vuln_id_lookup_idx"),
-            # Global search (pro/search/): weighted tsvector FTS + trigram fuzzy match.
-            GinIndex(
-                SearchVector("vulnerability_id", weight="A", config="english"),
-                name="dojo_vulnerability_id_fts_gin",
-            ),
-            GinIndex(fields=["vulnerability_id"], opclasses=["gin_trgm_ops"], name="dojo_vuln_id_trgm"),
-        ]
-
-    def __str__(self):
-        return self.vulnerability_id
-
-    def save(self, *args, **kwargs):
-        # bulk_create paths set the type at construction; this covers save()/get_or_create.
-        self.vulnerability_id_type = resolve_vulnerability_id_type(self.vulnerability_id)
-        super().save(*args, **kwargs)
-
-    def get_absolute_url(self):
-        return reverse("view_finding", args=[str(self.finding.id)])
+# The legacy Vulnerability_Id model was removed in the entity-only cutover; vulnerability ids now
+# live in the Vulnerability entity + FindingVulnerabilityReference through-table (dojo/vulnerability/).
+# The dojo_vulnerability_id table is dropped by migration 0287.
 
 
 class Finding_CWE(models.Model):

dojo/finding/queries.py

@@ -17,7 +17,6 @@ def get_auth_filter(key): return None
     Endpoint_Status,
     Finding,
     Test_Import_Finding_Action,
-    Vulnerability_Id,
 )
 from dojo.request_cache import cache_for_request_or_task
 from dojo.vulnerability.queries import vulnerability_id_prefetch
@@ -41,22 +40,6 @@ def get_authorized_findings_for_queryset(permission, queryset, user=None):
     return Finding.objects.all().order_by("id") if queryset is None else queryset
 
 
-# Cached: all parameters are hashable, no dynamic queryset filtering
-@cache_for_request_or_task
-def get_authorized_vulnerability_ids(permission, user=None):
-    impl = get_auth_filter("finding.get_authorized_vulnerability_ids")
-    if impl:
-        return impl(permission, user=user)
-    return Vulnerability_Id.objects.all()
-
-
-def get_authorized_vulnerability_ids_for_queryset(permission, queryset, user=None):
-    impl = get_auth_filter("finding.get_authorized_vulnerability_ids_for_queryset")
-    if impl:
-        return impl(permission, queryset, user=user)
-    return queryset
-
-
 def prefetch_for_findings(findings, prefetch_type="all", *, exclude_untouched=True):
     """
     Unified prefetch function for findings across the application.

dojo/importers/base_importer.py

@@ -82,8 +82,8 @@ def __init__(
         and will raise a `NotImplemented` exception
         """
         ImporterOptions.__init__(self, *args, **kwargs)
-        # Unconditional dual-write seam: buffers legacy Vulnerability_Id rows AND the new
-        # entity/reference rows, flushed together at the batch boundary.
+        # Write seam: buffers the Vulnerability entity + FindingVulnerabilityReference rows,
+        # flushed at the batch boundary.
         self.vulnerability_id_manager = VulnerabilityIdManager()
         self.pending_cwes: list[Finding_CWE] = []
         self.pending_cwe_deletes: list[int] = []
@@ -891,7 +891,7 @@ def store_vulnerability_ids(
         finding: Finding,
     ) -> Finding:
         """
-        Accumulate Vulnerability_Id objects for bulk insert at the batch boundary.
+        Accumulate a finding's vulnerability-id references for bulk insert at the batch boundary.
         Call flush_vulnerability_ids() to persist.
         """
         self.sanitize_vulnerability_ids(finding)
@@ -926,8 +926,8 @@ def reconcile_cwes(self, finding: Finding) -> None:
         self.pending_cwes.extend([Finding_CWE(finding=finding, cwe=cwe) for cwe in new_cwes])
 
     def flush_vulnerability_ids(self) -> None:
-        """Flush the dual-write vulnerability-id buffers, then the Finding_CWE buffers, and clear."""
-        # Legacy Vulnerability_Id rows + entity/reference rows, in one transaction.
+        """Flush the vulnerability-id buffers, then the Finding_CWE buffers, and clear."""
+        # Vulnerability entity + FindingVulnerabilityReference rows, in one transaction.
         self.vulnerability_id_manager.flush()
         # CWE buffers ride the same flush boundary as before (not owned by the manager).
         if self.pending_cwe_deletes: