implement fire_policy_webhooks

Signed-off-by: tdruez <tdruez@aboutcode.org>

Author: tdruez

notification/admin.py

@@ -66,6 +66,7 @@ class WebhookSubscriptionAdmin(ProhibitDataspaceLookupMixin, DataspacedAdmin):
     inlines = [WebhookDeliveryInline]
 
     def get_inlines(self, request, obj=None):
+        """Exclude delivery history on the add form as no deliveries exist yet."""
         if obj is None:
             return []
         return super().get_inlines(request, obj)

notification/models.py

@@ -28,6 +28,8 @@
     "user.added_or_updated",
     "user.locked_out",
     "vulnerability.data_update",
+    "policy.violation_detected",
+    "policy.violation_resolved",
 ]
 
 

policy/engine.py

@@ -33,7 +33,11 @@ def get_effective_config(rule_type, dataspace):
 
 
 def evaluate_rule(rule_type, product, threshold, parameters):
-    """Evaluate a single rule against a product and record the violation if triggered."""
+    """
+    Evaluate a single rule against a product and record the violation if triggered.
+
+    Returns a 3-tuple: (violation_or_none, created, resolved_count).
+    """
     handler = RULE_REGISTRY[rule_type]
     violation_count = handler.count_violations(product, threshold, parameters)
 
@@ -47,37 +51,44 @@ def evaluate_rule(rule_type, product, threshold, parameters):
         if not created:
             violation.violation_count = violation_count
             violation.save()
-        return violation
+        return violation, created, 0
 
-    else:
-        ProductPolicyViolation.objects.filter(**lookup).update(
-            resolved=True,
-            resolved_date=timezone.now(),
-        )
-        return
+    resolved_count = ProductPolicyViolation.objects.filter(**lookup).update(
+        resolved=True,
+        resolved_date=timezone.now(),
+    )
+    return None, False, resolved_count
 
 
 def evaluate_rules(product):
     """
     Evaluate all rules in RULE_REGISTRY for the given product.
 
-    Returns the list of active ProductPolicyViolation instances.
+    Returns a 2-tuple: (new_violations, resolved_count).
+    new_violations is a list of newly created ProductPolicyViolation instances.
+    resolved_count is the total number of violations resolved during this run.
     """
-    violations = []
+    new_violations = []
+    resolved_count = 0
+
     for rule_type in RULE_REGISTRY:
         config = get_effective_config(rule_type, product.dataspace)
         if not config["is_active"]:
             # Explicitly resolve open violations so disabling a rule clears its history
             # rather than leaving stale unresolved records.
-            ProductPolicyViolation.objects.filter(
+            rows = ProductPolicyViolation.objects.filter(
                 rule_type=rule_type,
                 product=product,
                 resolved=False,
             ).update(resolved=True, resolved_date=timezone.now())
+            resolved_count += rows
             continue
 
-        violation = evaluate_rule(rule_type, product, config["threshold"], config["parameters"])
-        if violation:
-            violations.append(violation)
+        violation, created, resolved = evaluate_rule(
+            rule_type, product, config["threshold"], config["parameters"]
+        )
+        if created:
+            new_violations.append(violation)
+        resolved_count += resolved
 
-    return violations
+    return new_violations, resolved_count

policy/tasks.py

@@ -13,37 +13,70 @@
 from django_rq import job
 
 from dje.models import get_unsecured_manager
+from notification.models import fire_webhooks
 from policy.engine import evaluate_rules
 
 logger = logging.getLogger(__name__)
 
 
+def fire_policy_webhooks(product, new_violations, resolved_count):
+    """Fire policy webhooks for newly detected or resolved violations."""
+    if new_violations:
+        lines = [
+            f"- {violation.rule_label}: {violation.violation_count} violation(s)"
+            for violation in new_violations
+        ]
+        payload = {
+            "text": (f"[DejaCode] Policy violations detected for {product}\n" + "\n".join(lines))
+        }
+        fire_webhooks("policy.violation_detected", instance=product, payload_override=payload)
+
+    if resolved_count:
+        payload = {
+            "text": (f"[DejaCode] {resolved_count} policy violation(s) resolved for {product}")
+        }
+        fire_webhooks("policy.violation_resolved", instance=product, payload_override=payload)
+
+
 @job
 def evaluate_product_rules_task(product_uuid):
-    """Evaluate all active PolicyRules for the given product."""
+    """Evaluate all active policy rules for the given product and fire webhooks on changes."""
     Product = apps.get_model("product_portfolio", "product")
 
     try:
-        product = Product.unsecured_objects.select_related("dataspace").get(uuid=product_uuid)
+        product = get_unsecured_manager(Product).get(uuid=product_uuid)
     except Product.DoesNotExist:
         logger.error(f"evaluate_product_rules_task: product {product_uuid} not found, skipping.")
         return
 
     logger.info(f"Evaluating policy rules for product {product}")
-    violations = evaluate_rules(product)
-    logger.info(f"Policy rules evaluated for {product}: {len(violations)} active violation(s).")
+    new_violations, resolved_count = evaluate_rules(product)
+    logger.info(
+        f"Policy rules evaluated for {product}: "
+        f"{len(new_violations)} new violation(s), {resolved_count} resolved."
+    )
+    fire_policy_webhooks(product, new_violations, resolved_count)
 
 
 @job
 def evaluate_all_products_rules_task(include_locked=False):
-    """Enqueue evaluate_product_rules_task for every product, skipping locked ones by default."""
+    """Evaluate policy rules for every product directly, skipping locked ones by default."""
     Product = apps.get_model("product_portfolio", "product")
 
-    products = Product.unsecured_objects.select_related("dataspace")
+    products = get_unsecured_manager(Product).select_related("dataspace")
     if not include_locked:
         products = products.exclude_locked()
 
     count = products.count()
-    logger.info(f"Queuing policy rule evaluation for {count} product(s).")
+    logger.info(f"Starting policy rule evaluation for {count} product(s).")
+
     for product in products:
-        evaluate_product_rules_task.delay(product_uuid=product.uuid)
+        logger.info(f"Evaluating policy rules for product {product}")
+        new_violations, resolved_count = evaluate_rules(product)
+        logger.info(
+            f"Policy rules evaluated for {product}: "
+            f"{len(new_violations)} new violation(s), {resolved_count} resolved."
+        )
+        fire_policy_webhooks(product, new_violations, resolved_count)
+
+    logger.info(f"Policy rule evaluation complete for {count} product(s).")