Split CI/CD-related infrastructure into its own model (#15002)

* wip cicd split

* migration updates

* old ui

* display under ci/cd eng details

* cicdinfra type field is read only on form to prevent changes in usage on engagements

* migration update after merge

* add cicd link to navbar

* css for disabled controls (new old ui)

* eng view updates

* classic copies of templates

* make (name, infra type) unique

* linter fix

* cicd tests

* linter fixes

* test fixes

* refactor model into module in line with how it should be done

* refactor cicd api to correct layout

* refactor (old) ui into proper package

* add cicd_infrastructure to modules state table

* remove config authorized decorator usage

* rework api perms to allow read by authed user, edit by superuser

* rework edit-related view perms

* comment

* disallow editing of infra type on instances in api, check in model save as well

* reorder listings to scm/build/orch for logical usage

* fix migration

* comments

* migration updates after merge

* Renumber cicd_infrastructure migration to 0285 after dev merge

* fix: make CICDInfrastructure a grantable configuration permission

CICDInfrastructure was never added to get_configuration_permissions_fields(),
so its view/add/change/delete codenames never reached a user's configuration
permissions. Non-superusers could not be granted access and the new CI/CD
Infrastructure UI/menu was effectively superuser-only, unlike the
Tool_Configuration it replaces. Register it (with a "CI/CD Infrastructure"
display name) so it is grantable like every other configuration model.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Valentijn Scholten <valentijnscholten@gmail.com>
Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: 4 people

AGENTS.md

@@ -54,6 +54,7 @@ Modules in various stages of reorganization:
 |--------|-----------|-------------|-----|------|--------|
 | **url** | In module | N/A | Done | Done | **Complete** |
 | **location** | In module | N/A | N/A | Done | **Complete** |
+| **cicd_infrastructure** | In module | N/A | Done | Done | **Complete** |
 | **product_type** | In module | N/A | Done | Done | **Complete** (#14970) |
 | **test** | In module | N/A | Done | Done | **Complete** (#14971) |
 | **engagement** | In module | In module | Done | Done | **Complete** (#14972) |

dojo/authorization/api_permissions.py

@@ -20,6 +20,7 @@
 from dojo.importers.auto_create_context import AutoCreateContextManager
 from dojo.location.models import Location
 from dojo.models import (
+    CICDInfrastructure,
     Development_Environment,
     Endpoint,
     Engagement,
@@ -1114,6 +1115,18 @@ class UserHasRegulationPermission(BaseDjangoModelPermission):
     }
 
 
+class UserHasCICDInfrastructurePermission(BaseDjangoModelPermission):
+    django_model = CICDInfrastructure
+    # Reads are open to any authenticated user (engagement views surface CICD
+    # references and need to render them). Writes require elevated privileges.
+    request_method_permission_map = {
+        "POST": "add",
+        "PUT": "change",
+        "PATCH": "change",
+        "DELETE": "delete",
+    }
+
+
 def raise_no_auto_create_import_validation_error(
     test_title,
     scan_type,

dojo/cicd_infrastructure/__init__.py

@@ -0,0 +1 @@
+import dojo.cicd_infrastructure.admin  # noqa: F401

dojo/cicd_infrastructure/admin.py

@@ -0,0 +1,9 @@
+from django.contrib import admin
+
+from dojo.cicd_infrastructure.models import CICDInfrastructure
+
+
+@admin.register(CICDInfrastructure)
+class CICDInfrastructureAdmin(admin.ModelAdmin):
+
+    """Admin support for the CICDInfrastructure model."""

dojo/cicd_infrastructure/api/__init__.py

@@ -0,0 +1,16 @@
+from rest_framework import serializers
+
+from dojo.models import CICDInfrastructure
+
+
+class CICDInfrastructureSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = CICDInfrastructure
+        fields = "__all__"
+
+    def get_fields(self):
+        fields = super().get_fields()
+        if self.instance is not None:
+            # Disallow editing of infra type on an instance; see the matching comment on CICDInfrastructure#save()
+            fields["infrastructure_type"].read_only = True
+        return fields

dojo/cicd_infrastructure/api/serializers.py

@@ -0,0 +1,6 @@
+from dojo.cicd_infrastructure.api.views import CICDInfrastructureViewSet
+
+
+def add_cicd_infrastructure_urls(router):
+    router.register(r"cicd_infrastructure", CICDInfrastructureViewSet, basename="cicd_infrastructure")
+    return router

dojo/cicd_infrastructure/api/urls.py

@@ -0,0 +1,21 @@
+from django_filters.rest_framework import DjangoFilterBackend
+from rest_framework.permissions import IsAuthenticated
+
+from dojo.api_v2.views import DojoModelViewSet
+from dojo.authorization import api_permissions as permissions
+from dojo.cicd_infrastructure.api.serializers import CICDInfrastructureSerializer
+from dojo.models import CICDInfrastructure
+
+
+# Authorization: read open to authenticated users; write requires configuration permission.
+class CICDInfrastructureViewSet(
+    DojoModelViewSet,
+):
+    serializer_class = CICDInfrastructureSerializer
+    queryset = CICDInfrastructure.objects.none()
+    filter_backends = (DjangoFilterBackend,)
+    filterset_fields = ["id", "name", "infrastructure_type"]
+    permission_classes = (IsAuthenticated, permissions.UserHasCICDInfrastructurePermission)
+
+    def get_queryset(self):
+        return CICDInfrastructure.objects.all().order_by("id")

dojo/cicd_infrastructure/api/views.py

@@ -0,0 +1,35 @@
+from django.core.exceptions import ValidationError
+from django.db import models
+from django.utils.translation import gettext as _
+
+
+class CICDInfrastructure(models.Model):
+    INFRASTRUCTURE_TYPE_CHOICES = (
+        ("scm_server", "SCM Server"),
+        ("build_server", "Build Server"),
+        ("orchestration", "Orchestration Engine"),
+    )
+
+    name = models.CharField(max_length=200)
+    description = models.CharField(max_length=2000, blank=True, default="")
+    url = models.URLField(max_length=2000, blank=True, default="", help_text=_("Public URL of the tool (e.g., https://jenkins.company.com)"))
+    infrastructure_type = models.CharField(max_length=30, choices=INFRASTRUCTURE_TYPE_CHOICES)
+
+    class Meta:
+        ordering = ["name"]
+        unique_together = [("name", "infrastructure_type")]
+
+    def __str__(self):
+        return self.name
+
+    def save(self, *args, **kwargs):
+        if self.pk:
+            # Disallow editing of the infra type on an instance; engagement CICD FKs are scoped by infrastructure_type
+            # via limit_choices_to (build_server/scm_server/orchestration), so changing the type would create a
+            # semantic conflict between an engagement and this object.
+            current_type = type(self).objects.filter(pk=self.pk).values_list("infrastructure_type", flat=True).first()
+            if current_type is not None and current_type != self.infrastructure_type:
+                raise ValidationError(
+                    {"infrastructure_type": _("infrastructure_type cannot be changed once set.")},
+                )
+        super().save(*args, **kwargs)