test(vulnerability_id): add upgrade read-parity tests (legacy rows -> backfill -> flag parity)

TestReadSeamFlagParity seeds via the dual-write seam, so both stores are trivially in
sync. These new tests cover the actual UPGRADE scenario a deployment hits: legacy
Vulnerability_Id rows written the old way (no entity refs), then backfilled by
migrate_vulnerability_ids, then read flag-off (legacy) vs flag-on (entity).

- test_backfilled_normal_data_reads_identically: for seam-shaped data (cve == first/
  lowest-PK row) get_vulnerability_ids, the vulnerability_ids property, and the raw v2
  wire shape are byte-identical across the flag.
- test_backfilled_cve_not_first_row_preserves_hash_and_property: anomalous data where cve
  is not the first-created legacy row keeps hash + property byte-identical (both are
  order-insensitive by construction); only the RAW v2 wire ORDER differs (legacy PK-asc
  vs entity cve-first, same set) — asserted so the bounded divergence is deliberate.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Maffooch

unittests/test_vulnerability_id.py

@@ -233,3 +233,88 @@ def test_verify_command_fails_on_discrepancy(self):
         Vulnerability_Id.objects.create(finding=finding, vulnerability_id="CVE-BAD-1")
         with self.assertRaises(SystemExit):
             call_command("verify_vulnerability_ids")
+
+
+class TestUpgradeReadParity(VulnerabilityIdDualWriteTestCase):
+
+    """
+    Upgrade path: legacy Vulnerability_Id rows written the OLD way (before the entity existed) and
+    then backfilled by migrate_vulnerability_ids must read back IDENTICALLY in both flag states.
+
+    Distinct from TestReadSeamFlagParity, which seeds through the dual-write seam (so both stores
+    are trivially in sync). Here only the LEGACY rows are written — the true pre-upgrade state —
+    then backfilled, then flag-off (legacy read) is compared against flag-on (entity read). This is
+    the scenario a real deployment actually hits when the flag is first turned on after a migration.
+    """
+
+    def _seed_legacy_only(self, finding, cve, ordered_ids):
+        """
+        Write legacy rows directly (creation order == PK order), set the primary cve, and assert
+        the pre-migration state (no entity references yet) — i.e. exactly what pre-upgrade data looks
+        like.
+        """
+        finding.cve = cve
+        finding.save()
+        for vid in ordered_ids:
+            Vulnerability_Id.objects.create(finding=finding, vulnerability_id=vid)
+        self.assertEqual(FindingVulnerabilityReference.objects.filter(finding=finding).count(), 0)
+
+    def _fresh(self, pk):
+        # Fresh instance per read: vulnerability_ids is a cached_property.
+        return Finding.objects.get(pk=pk)
+
+    def _reads(self, pk):
+        return (
+            self._fresh(pk).get_vulnerability_ids(),
+            self._fresh(pk).vulnerability_ids,
+            [r["vulnerability_id"] for r in VulnerabilityIdsField().to_representation(self._fresh(pk))],
+        )
+
+    def test_backfilled_normal_data_reads_identically(self):
+        # Seam/historical invariant: the primary cve IS the first-created (lowest-PK) legacy row.
+        finding = self._make_finding("upgrade-normal")
+        self._seed_legacy_only(finding, cve="CVE-U-1", ordered_ids=["CVE-U-1", "CVE-U-2", "CVE-U-3"])
+
+        call_command("migrate_vulnerability_ids")
+        self.assertEqual(self._refs(finding)[0], "CVE-U-1")  # cve at order 0
+
+        with override_settings(V3_FEATURE_VULNERABILITY_IDS=False):
+            off_hash, off_prop, off_wire = self._reads(finding.pk)
+        with override_settings(V3_FEATURE_VULNERABILITY_IDS=True):
+            on_hash, on_prop, on_wire = self._reads(finding.pk)
+
+        # Full parity: hash input, the merged property, AND the raw v2 wire order.
+        self.assertEqual(off_hash, on_hash)
+        self.assertEqual(off_prop, on_prop)
+        self.assertEqual(off_wire, on_wire)
+        self.assertEqual(off_prop, ["CVE-U-1", "CVE-U-2", "CVE-U-3"])
+        self.assertEqual(off_wire, ["CVE-U-1", "CVE-U-2", "CVE-U-3"])
+
+    def test_backfilled_cve_not_first_row_preserves_hash_and_property(self):
+        # Anomalous pre-upgrade data: the primary cve is NOT the first-created legacy row (e.g. the
+        # cve field was edited independently of the id rows historically). The hash (sorted) and the
+        # vulnerability_ids property (cve-merged + deduped) are order-insensitive by construction and
+        # stay byte-identical across flag states. Only the RAW v2 wire ORDER differs — legacy reads
+        # PK-ascending, the entity reads cve-first — carrying the SAME set in a different order. This
+        # divergence is bounded to this anomalous shape (never produced by save_vulnerability_ids,
+        # which always makes cve == ids[0] == the lowest-PK row) and is asserted here so any future
+        # change to it is deliberate, not silent.
+        finding = self._make_finding("upgrade-cve-mid")
+        self._seed_legacy_only(finding, cve="CVE-M-3", ordered_ids=["CVE-M-1", "CVE-M-2", "CVE-M-3"])
+
+        call_command("migrate_vulnerability_ids")
+        self.assertEqual(self._refs(finding)[0], "CVE-M-3")  # cve at order 0 despite being last-created
+
+        with override_settings(V3_FEATURE_VULNERABILITY_IDS=False):
+            off_hash, off_prop, off_wire = self._reads(finding.pk)
+        with override_settings(V3_FEATURE_VULNERABILITY_IDS=True):
+            on_hash, on_prop, on_wire = self._reads(finding.pk)
+
+        # Hash + property: byte-identical across the flag.
+        self.assertEqual(off_hash, on_hash)
+        self.assertEqual(off_prop, on_prop)
+        self.assertEqual(off_prop, ["CVE-M-3", "CVE-M-1", "CVE-M-2"])  # cve first, then PK-asc rest
+        # Raw v2 wire: same set, different order (the documented, bounded divergence).
+        self.assertEqual(off_wire, ["CVE-M-1", "CVE-M-2", "CVE-M-3"])  # legacy PK order
+        self.assertEqual(on_wire, ["CVE-M-3", "CVE-M-1", "CVE-M-2"])   # entity cve-first order
+        self.assertEqual(set(off_wire), set(on_wire))