fix: address review feedback on OS message opt-out

- Renumber migration 0270 -> 0275 (depends on 0274_finding_sla_expiration_index)
  to resolve the leaf-node collision with the finding perf-index migrations
  that landed on dev.
- Make the dismiss_os_message write concurrency-safe: read-modify-write
  user_state_details under an atomic() + select_for_update() row lock so a
  concurrent write to a different key can't clobber it (lost update).
- Exclude the internal user_state_details JSON blob from
  UserContactInfoSerializer so it stays out of the public API.
- Add a regression test asserting dismissal preserves other keys in
  user_state_details.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Maffooch

dojo/announcement/ui/views.py

@@ -2,6 +2,7 @@
 import re
 
 from django.contrib import messages
+from django.db import transaction
 from django.http import HttpResponse, HttpResponseForbidden, HttpResponseRedirect
 from django.shortcuts import render
 from django.urls import reverse
@@ -98,12 +99,17 @@ def dismiss_os_message(request):
         return HttpResponseForbidden()
     token = request.POST.get("token", "").strip()
     if token and re.fullmatch(r"[0-9a-f]{1,64}", token):
-        contact = UserContactInfo.objects.get_or_create(user=request.user)[0]
-        state = contact.user_state_details or {}
-        if state.get(OS_MESSAGE_DISMISSED_KEY) != token:
-            state[OS_MESSAGE_DISMISSED_KEY] = token
-            contact.user_state_details = state
-            contact.save(update_fields=["user_state_details"])
+        # user_state_details is a shared JSON blob for many per-user flags, so
+        # read-modify-write it under a row lock to avoid clobbering a concurrent
+        # write to a different key (lost update).
+        with transaction.atomic():
+            contact, _ = UserContactInfo.objects.get_or_create(user=request.user)
+            contact = UserContactInfo.objects.select_for_update().get(pk=contact.pk)
+            state = contact.user_state_details or {}
+            if state.get(OS_MESSAGE_DISMISSED_KEY) != token:
+                state[OS_MESSAGE_DISMISSED_KEY] = token
+                contact.user_state_details = state
+                contact.save(update_fields=["user_state_details"])
     if request.headers.get("x-requested-with") == "XMLHttpRequest":
         return HttpResponse(status=204)
     referer = request.META.get("HTTP_REFERER")

…70_usercontactinfo_user_state_details.py …75_usercontactinfo_user_state_details.pydojo/db_migrations/0270_usercontactinfo_user_state_details.py renamed to dojo/db_migrations/0275_usercontactinfo_user_state_details.py dojo/db_migrations/0270_usercontactinfo_user_state_details.py renamed to dojo/db_migrations/0275_usercontactinfo_user_state_details.py

@@ -6,7 +6,7 @@
 class Migration(migrations.Migration):
 
     dependencies = [
-        ("dojo", "0269_normalize_blank_finding_components"),
+        ("dojo", "0274_finding_sla_expiration_index"),
     ]
 
     operations = [

dojo/user/api/serializer.py

@@ -169,7 +169,9 @@ class UserContactInfoSerializer(serializers.ModelSerializer):
 
     class Meta:
         model = UserContactInfo
-        fields = "__all__"
+        # user_state_details is an internal JSON blob for UI state (dismissed
+        # banners, "don't show again" flags); keep it out of the public API.
+        exclude = ("user_state_details",)
 
     def validate(self, data):
         user = data.get("user", None) or self.instance.user

unittests/test_os_message.py

@@ -333,6 +333,17 @@ def test_post_persists_hash_on_usercontactinfo(self):
         contact = UserContactInfo.objects.get(user=self.user)
         self.assertEqual(contact.user_state_details.get(os_message.OS_MESSAGE_DISMISSED_KEY), "abc123def456")
 
+    def test_dismiss_preserves_other_state_keys(self):
+        """Dismissing must not clobber unrelated keys in the shared user_state_details blob."""
+        contact = UserContactInfo.objects.get_or_create(user=self.user)[0]
+        contact.user_state_details = {"other_flag": 1}
+        contact.save(update_fields=["user_state_details"])
+        response = self.client.post(self.url, {"token": "abc123def456"}, HTTP_X_REQUESTED_WITH="XMLHttpRequest")
+        self.assertEqual(response.status_code, 204)
+        contact.refresh_from_db()
+        self.assertEqual(contact.user_state_details.get("other_flag"), 1)
+        self.assertEqual(contact.user_state_details.get(os_message.OS_MESSAGE_DISMISSED_KEY), "abc123def456")
+
     def test_get_not_allowed(self):
         self.assertEqual(self.client.get(self.url).status_code, 405)