ref: canoical rule cache, moving inner closure

Return rule cache from get rule cache (no dict copy), inner closure to class fnc, test updated

Author: pindo696

evaluator/logic.py

@@ -128,15 +128,34 @@ async def _load_rule_cache_for_name(self, conn: AsyncConnection, name: str) -> O
             return RuleCache(rule["id"], rule["playbook_count"])
 
     async def _get_rule_cache(self, conn: Optional[AsyncConnection] = None) -> Dict[str, RuleCache]:
-        """Return a snapshot of the rule cache, refreshing from DB when cache TTL expired. You can also load full cache from DB (see _load_rule_cache)"""
+        """Return the canoical rule cache dict, refreshing from DB when TTL expired (see _load_rule_cache)"""
         if self._rule_cache_expired():
             if conn is None:
                 async with self.db_pool.connection() as conn:
                     self.rule_cache = await self._load_rule_cache(conn)
             else:
                 self.rule_cache = await self._load_rule_cache(conn)
             self._set_rule_cache_expiry()
-        return dict(self.rule_cache)
+        return self.rule_cache
+
+    async def _get_rule_from_cache(
+        self,
+        conn: AsyncConnection,
+        rule_name: str,
+        missing_rules_not_found: Set[str],
+    ) -> Optional[RuleCache]:
+        """Resolve rule metadata from self.rule_cache, lazy-loading by name on miss"""
+        cached = self.rule_cache.get(rule_name)
+        if cached:
+            return cached
+        if rule_name in missing_rules_not_found:
+            return None
+        fetched = await self._load_rule_cache_for_name(conn, rule_name)
+        if fetched:
+            self.rule_cache[rule_name] = fetched
+            return fetched
+        missing_rules_not_found.add(rule_name)
+        return None
 
     async def _load_package_name_cache(self) -> Dict[str, PackageNameCache]:
         """Load package name cache from DB"""
@@ -619,28 +638,14 @@ async def _evaluate_advisor_res(
         self,
         rule_results: dict,
         sys_vuln_rows: Dict[str, SystemVulnerabilitiesRow],
-        rule_cache: Dict[str, RuleCache],
         system_platform: SystemPlatform,
         unpatched_cves: Set[str],
         conn: AsyncConnection,
     ) -> Dict[str, SystemVulnerabilitiesRow]:
         """Merge results from vmaas package evaluation with advisor rule evaluation"""
 
-        missing_rules_not_found = set()
-
-        async def resolve_rule_cache(rule_name: str) -> Optional[RuleCache]:
-            cached = rule_cache.get(rule_name)
-            if cached:
-                return cached
-            if rule_name in missing_rules_not_found:
-                return None
-            fetched = await self._load_rule_cache_for_name(conn, rule_name)
-            if fetched:
-                self.rule_cache[rule_name] = fetched
-                rule_cache[rule_name] = fetched
-                return fetched
-            missing_rules_not_found.add(rule_name)
-            return None
+        await self._get_rule_cache(conn)
+        missing_rules_not_found: Set[str] = set()
 
         for cve, hit_details in rule_results["rule_hits"].items():
             if cve in unpatched_cves:
@@ -658,7 +663,7 @@ async def resolve_rule_cache(rule_name: str) -> Optional[RuleCache]:
             if not isinstance(hit_details["details"], dict):
                 hit_details["details"] = json.loads(hit_details["details"])
 
-            rule_db = await resolve_rule_cache(rule)
+            rule_db = await self._get_rule_from_cache(conn, rule, missing_rules_not_found)
             if not rule_db:
                 continue
 
@@ -707,7 +712,7 @@ async def resolve_rule_cache(rule_name: str) -> Optional[RuleCache]:
                 continue
 
             # system was marked vulnerable from vmaas but not from by rules -> abnv
-            rule_db = await resolve_rule_cache(rule)
+            rule_db = await self._get_rule_from_cache(conn, rule, missing_rules_not_found)
             if not rule_db:
                 continue
 
@@ -740,8 +745,7 @@ async def evaluate_vulnerabilities(self, system_platform: SystemPlatform, conn:
             unpatched_cves_set = set(x.cve for x in unpatched_cves)
             # Rule metadata is cached in memory (warm in init), TTL controls refresh while evaluator runs
             with RULES_EVAL_TIME.time():
-                rule_cache = await self._get_rule_cache(conn)
                 sys_vuln_rows = await self._evaluate_advisor_res(
-                    system_platform.rule_results, sys_vuln_rows, rule_cache, system_platform, unpatched_cves_set, conn
+                    system_platform.rule_results, sys_vuln_rows, system_platform, unpatched_cves_set, conn
                 )
         return sys_vuln_rows

tests/common_tests/test_evaluator_rule_cache.py

@@ -44,7 +44,8 @@ async def fake_load_rule_cache(_self, _conn):
     # How many times the fake full-load ran
     # For live warm cache two loads result into a single db fetch
     assert len(loads) == 1
-    assert snap1 == snap2 == {"RULE_A": RuleCache(42, 1)}
+    assert snap1 is snap2 is logic.rule_cache
+    assert snap1 == {"RULE_A": RuleCache(42, 1)}
 
 
 async def test_get_rule_cache_always_reloads_when_ttl_disabled(monkeypatch):
@@ -171,7 +172,7 @@ async def fake_load_rule_for_name(_self, _conn, name: str):
     logic._load_rule_cache_for_name = MethodType(fake_load_rule_for_name, logic)
 
     # Empty sys_vuln_rows: rule-only hit branch (no prior VMAAS row for this CVE)
-    out = await logic._evaluate_advisor_res(rule_results, {}, {}, platform, set(), conn)
+    out = await logic._evaluate_advisor_res(rule_results, {}, platform, set(), conn)
 
     assert len(full_load_calls) == 1  # warm TTL: advisor merge must not trigger another full refresh
     assert lazy_names == [rule_id]  # one lazy fetch for the missing name
@@ -218,7 +219,7 @@ async def empty_full_load(_self, _conn):
     logic._load_rule_cache = MethodType(empty_full_load, logic)
     await logic._get_rule_cache()
 
-    out_lazy = await logic._evaluate_advisor_res(rule_results, {}, {}, platform, set(), conn)
+    out_lazy = await logic._evaluate_advisor_res(rule_results, {}, platform, set(), conn)
 
     assert lazy_names == [rule_id]
     row_lazy = out_lazy[cve]
@@ -228,13 +229,11 @@ async def empty_full_load(_self, _conn):
     assert row_lazy.cve_id == 500
     assert json.loads(row_lazy.rule_hit_details) == rule_results["rule_hits"][cve]["details"]
 
-    # Second run: pretend the rule row was already in the dict returned by _get_rule_cache (should mimic old behavior before cache change)
+    # Second run: canoical cache holds rule_id from lazy path, canoical name as instance
     lazy_names.clear()
-    logic.rule_cache.clear()  # drop instance cache so we only measure the explicit snapshot dict
-    snapshot = {rule_id: expected_rule}  # same data as lazy path returned, but supplied up front
-    out_pre = await logic._evaluate_advisor_res(rule_results, {}, dict(snapshot), platform, set(), conn)
+    out_pre = await logic._evaluate_advisor_res(rule_results, {}, platform, set(), conn)
 
-    assert lazy_names == []  # no per-name fetch: rule_id was already in the merge snapshot
+    assert lazy_names == []  # cache hit on self.rule_cache
     row_pre = out_pre[cve]
     # Row must match exactly: lazy vs preloaded must not change vulnerability semantics
     assert row_pre.state == row_lazy.state