feat(vuln-id): retain legacy Vulnerability_Id model+table for a transition

Defer the destructive drop. Instead of the entity-only cutover dropping
dojo_vulnerability_id in the same release, keep the legacy Vulnerability_Id
model and table for a transition period and remove them together in a future
release, once the entity store has proven itself in production.

- Restore the Vulnerability_Id model (unused: no code path reads or writes it;
  entity references are the source of truth) + its dojo.models re-export.
- Delete migration 0288 (no drop, no SeparateDatabaseAndState state/DB split,
  which complicated other tooling). The model stays in Django state, matching
  code — makemigrations --check + manage.py check are clean.
- The physical DROP TABLE moves to a future release; guard it there with the
  invariant (abort if legacy has rows while the reference table is empty).

Validated: fresh migrate from zero through 0287 keeps both table sets; merge,
search, and vulnerability-id suites green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Maffooch

dojo/db_migrations/0288_delete_vulnerability_id.py

@@ -25,6 +25,7 @@
 
 from dojo.base_models.base import BaseModel
 from dojo.finding.cwe import cwe_label, finding_cwe_labels
+from dojo.finding.vulnerability_id import resolve_vulnerability_id_type
 
 # get_current_date/tomorrow/copy_model_util are defined early in dojo.models, before the
 # re-export that loads this module — so this resolves despite the partial circular load, and
@@ -1438,9 +1439,44 @@ def set_hash_code(self, dedupe_option):
                 deduplicationLogger.debug("Hash_code computed for finding: %s: %s", finding_id, self.hash_code)
 
 
-# The legacy Vulnerability_Id model was removed in the entity-only cutover; vulnerability ids now
-# live in the Vulnerability entity + FindingVulnerabilityReference through-table (dojo/vulnerability/).
-# The dojo_vulnerability_id table is dropped by migration 0287.
+# Legacy vulnerability-id store. As of the entity-only cutover, vulnerability ids live in the
+# Vulnerability entity + FindingVulnerabilityReference through-table (dojo/vulnerability/), and this
+# model is NO LONGER READ OR WRITTEN by any code path. It (and its dojo_vulnerability_id table) are
+# intentionally RETAINED for a transition period as a frozen pre-cutover snapshot, and removed
+# together in a future release. Do not add new usages.
+class Vulnerability_Id(models.Model):
+    finding = models.ForeignKey("dojo.Finding", editable=False, on_delete=models.CASCADE)
+    vulnerability_id = models.TextField(max_length=50, blank=False, null=False)
+    # Autodetected from the id prefix (CVE, GHSA, ...); NULL when there is no non-numeric
+    # prefix. Denormalized/indexed so type-scoped queries (e.g. GROUP BY type) stay cheap.
+    vulnerability_id_type = models.CharField(max_length=20, null=True, blank=True, editable=False, db_index=True)
+
+    class Meta:
+        constraints = [
+            models.UniqueConstraint(fields=["finding", "vulnerability_id"], name="unique_finding_vulnerability_id"),
+        ]
+        indexes = [
+            # Leading on vulnerability_id (the unique constraint's index leads on finding), for the
+            # vulnerability-id Explorer's GROUP BY vulnerability_id / lookups by exact id.
+            models.Index(fields=["vulnerability_id"], name="dojo_vuln_id_lookup_idx"),
+            # Global search (pro/search/): weighted tsvector FTS + trigram fuzzy match.
+            GinIndex(
+                SearchVector("vulnerability_id", weight="A", config="english"),
+                name="dojo_vulnerability_id_fts_gin",
+            ),
+            GinIndex(fields=["vulnerability_id"], opclasses=["gin_trgm_ops"], name="dojo_vuln_id_trgm"),
+        ]
+
+    def __str__(self):
+        return self.vulnerability_id
+
+    def save(self, *args, **kwargs):
+        # bulk_create paths set the type at construction; this covers save()/get_or_create.
+        self.vulnerability_id_type = resolve_vulnerability_id_type(self.vulnerability_id)
+        super().save(*args, **kwargs)
+
+    def get_absolute_url(self):
+        return reverse("view_finding", args=[str(self.finding.id)])
 
 
 class Finding_CWE(models.Model):

dojo/finding/models.py

@@ -405,6 +405,7 @@ class Meta:
     Finding_CWE,  # noqa: F401 -- re-export
     Finding_Group,  # noqa: F401 -- re-export
     Finding_Template,
+    Vulnerability_Id,  # noqa: F401 -- re-export (legacy; retained for a transition period, see model)
 )
 from dojo.vulnerability.models import (  # noqa: E402 -- re-export; FKs reference dojo.Finding / dojo.Vulnerability by string
     FindingVulnerabilityReference,  # noqa: F401 -- re-export

dojo/models.py

@@ -2,8 +2,9 @@
 Write seam for vulnerability ids: the ``Vulnerability`` entity + ``FindingVulnerabilityReference``
 rows are the single source of truth. Every writer persists them through this one module.
 
-The legacy ``Vulnerability_Id`` store is gone: this entity-only cutover stops writing it and drops
-its table in the same change (migration 0288, after the 0287 backfill).
+The legacy ``Vulnerability_Id`` store is no longer written or read after this entity-only cutover.
+Its model and ``dojo_vulnerability_id`` table are retained (unused) for a transition period as a
+frozen pre-cutover snapshot, and removed together in a future release.
 CWE buffering (store_cwes/pending_cwes/reconcile_cwes) is deliberately NOT owned here — it keeps
 riding the importer flush boundary exactly as before.
 """

dojo/vulnerability/manager.py

@@ -18,8 +18,9 @@ def get_auth_filter(key):
 # ---------------------------------------------------------------------------
 # Read helpers over the entity/reference store — the single source of truth.
 # (The legacy Vulnerability_Id read path + V3_FEATURE_VULNERABILITY_IDS flag were
-# removed in the entity-only cutover; the legacy table is dropped by migration 0288
-# in the same change, after the 0287 backfill.)
+# removed in the entity-only cutover; the legacy Vulnerability_Id model + table are
+# retained unused for a transition period after the 0287 backfill and removed
+# together in a future release.)
 # ---------------------------------------------------------------------------