test(vuln-id): fix fixture/perf tests for default-on entity reads

Three test-only fixes surfaced by V3_FEATURE_VULNERABILITY_IDS defaulting True in OSS
(reads hit the entity store):

- test_bulk_risk_acceptance_api + test_pdf_report_rendering seeded vuln ids via the
  legacy Vulnerability_Id table directly, so entity reads returned empty flag-on. Seed
  via save_vulnerability_ids (unconditional dual-write) instead — production code is
  unchanged and correct. bulk_risk verified locally (3 tests green flag-on); the pdf
  report test loads dojo_testdata (can't run in the Pro container) and relies on OSS CI.
- test_tag_inheritance_perf: re-baseline the 6 EXPECTED_ZAP_* assertNumQueries constants
  for the dual-write delta (+2 import / +12 reimport-no-change / +6 reimport-with-new),
  from a pure-OSS CI run.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Maffooch

unittests/test_bulk_risk_acceptance_api.py

@@ -9,6 +9,7 @@
     Role,
 )
 from dojo.authorization.roles_permissions import Roles
+from dojo.finding.helper import save_vulnerability_ids
 from dojo.models import (
     Dojo_User,
     Engagement,
@@ -19,7 +20,6 @@
     Test,
     Test_Type,
     User,
-    Vulnerability_Id,
 )
 
 
@@ -61,24 +61,24 @@ def create_finding(test: Test, reporter: User, cve: str) -> Finding:
         Finding.objects.bulk_create(
             create_finding(cls.test_a, cls.user, f"CVE-1999-{i}") for i in range(50, 150, 3))
         for finding in Finding.objects.filter(test=cls.test_a):
-            Vulnerability_Id.objects.get_or_create(finding=finding, vulnerability_id=finding.cve)
+            save_vulnerability_ids(finding, [finding.cve])
         Finding.objects.bulk_create(
             create_finding(cls.test_b, cls.user, f"CVE-1999-{i}") for i in range(51, 150, 3))
         for finding in Finding.objects.filter(test=cls.test_b):
-            Vulnerability_Id.objects.get_or_create(finding=finding, vulnerability_id=finding.cve)
+            save_vulnerability_ids(finding, [finding.cve])
         Finding.objects.bulk_create(
             create_finding(cls.test_c, cls.user, f"CVE-1999-{i}") for i in range(52, 150, 3))
         for finding in Finding.objects.filter(test=cls.test_c):
-            Vulnerability_Id.objects.get_or_create(finding=finding, vulnerability_id=finding.cve)
+            save_vulnerability_ids(finding, [finding.cve])
 
         Finding.objects.bulk_create(
             create_finding(cls.test_d, cls.user, f"CVE-2000-{i}") for i in range(50, 150, 3))
         for finding in Finding.objects.filter(test=cls.test_d):
-            Vulnerability_Id.objects.get_or_create(finding=finding, vulnerability_id=finding.cve)
+            save_vulnerability_ids(finding, [finding.cve])
         Finding.objects.bulk_create(
             create_finding(cls.test_e, cls.user, f"CVE-1999-{i}") for i in range(50, 150, 3))
         for finding in Finding.objects.filter(test=cls.test_e):
-            Vulnerability_Id.objects.get_or_create(finding=finding, vulnerability_id=finding.cve)
+            save_vulnerability_ids(finding, [finding.cve])
 
     def setUp(self) -> None:
         self.client = APIClient()
@@ -204,13 +204,13 @@ def create_finding(test, reporter, cve):
         Finding.objects.bulk_create(
             create_finding(cls.test_enabled, cls.writer, f"CVE-2024-{i}") for i in range(10))
         for f in Finding.objects.filter(test=cls.test_enabled):
-            Vulnerability_Id.objects.get_or_create(finding=f, vulnerability_id=f.cve)
+            save_vulnerability_ids(f, [f.cve])
 
         # Findings on the disabled product
         Finding.objects.bulk_create(
             create_finding(cls.test_disabled, cls.writer, f"CVE-2024-{i + 100}") for i in range(5))
         for f in Finding.objects.filter(test=cls.test_disabled):
-            Vulnerability_Id.objects.get_or_create(finding=f, vulnerability_id=f.cve)
+            save_vulnerability_ids(f, [f.cve])
 
     def _client_for(self, token):
         client = APIClient()

unittests/test_pdf_report_rendering.py

@@ -1,6 +1,7 @@
 from django.template import engines
 from django.utils.timezone import now
 
+from dojo.finding.helper import save_vulnerability_ids
 from dojo.models import (
     Engagement,
     Finding,
@@ -9,7 +10,6 @@
     Test,
     Test_Type,
     User,
-    Vulnerability_Id,
 )
 from unittests.dojo_test_case import DojoTestCase, versioned_fixtures
 
@@ -176,7 +176,9 @@ def test_report_field_contains_rendered_content(self):
     def test_report_finding_table_includes_vulnerability_ids(self):
         """Finding PDF reports should show vulnerability IDs in the finding table."""
         finding = self._create_finding()
-        Vulnerability_Id.objects.create(finding=finding, vulnerability_id="CVE-2026-12345")
+        # Dual-write (legacy row + entity reference) so the report's flag-appropriate
+        # read resolves whether V3_FEATURE_VULNERABILITY_IDS is on (default) or off.
+        save_vulnerability_ids(finding, ["CVE-2026-12345"])
 
         html = self._render_finding_report(Finding.objects.filter(pk=finding.pk))
 

unittests/test_tag_inheritance_perf.py

@@ -597,9 +597,13 @@ def test_baseline_zap_scan_reimport_with_new_findings_v3(self):
     # Multiple-CWEs feature: +2 import / +2 reimport-no-change (Finding_CWE
     # store + bulk flush) and +10 reimport-with-new (per-finding reconcile reads
     # existing Finding_CWE rows for each changed finding).
-    EXPECTED_ZAP_IMPORT_V2 = 294
-    EXPECTED_ZAP_IMPORT_V3 = 318
-    EXPECTED_ZAP_REIMPORT_NO_CHANGE_V2 = 79
-    EXPECTED_ZAP_REIMPORT_NO_CHANGE_V3 = 91
-    EXPECTED_ZAP_REIMPORT_WITH_NEW_V2 = 161
-    EXPECTED_ZAP_REIMPORT_WITH_NEW_V3 = 190
+    # Vulnerability_Id entity dual-write (unconditional): +2 import / +12
+    # reimport-no-change / +6 reimport-with-new queries (VulnerabilityId entity +
+    # FindingVulnerabilityReference bulk writes alongside the legacy rows; batched,
+    # not per-finding).
+    EXPECTED_ZAP_IMPORT_V2 = 296
+    EXPECTED_ZAP_IMPORT_V3 = 320
+    EXPECTED_ZAP_REIMPORT_NO_CHANGE_V2 = 91
+    EXPECTED_ZAP_REIMPORT_NO_CHANGE_V3 = 103
+    EXPECTED_ZAP_REIMPORT_WITH_NEW_V2 = 167
+    EXPECTED_ZAP_REIMPORT_WITH_NEW_V3 = 196