feat(risk-acceptance): add option to restore Verified when a Risk Acceptance expires - #15878
Merged
Conversation
When a Risk Acceptance expires and reactivates its findings, DefectDojo returns them to Active and clears risk_accepted, but never touches Verified -- so scanner-imported findings come back Active only, not "Active, Verified". There was no way to change that. Add a per-Risk_Acceptance BooleanField `restore_verified_expired` (default False). When enabled, expire_now() also sets verified=True on each reactivated finding, so it returns as Active, Verified. Mirrors the existing restart_sla_expired toggle, and lives inside the reactivate_expired block so it only affects findings that actually reactivate. Because Pro Risk Acceptances 2.0 delegates expiry to the same OSS expire_now(), this works for both the classic flow and the 2.0 workflow. Surfaced on the edit form and API (fields="__all__"), the API filter, and the view template; migration adds the field to the pghistory event mirror and regenerates its triggers. Adds two behavioral tests (default leaves Verified untouched; enabled restores it). Requested via a customer support ticket. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
github-actions
Bot
added
New Migration
Maffooch
enabled auto-merge (squash)
September 4, 2026 22:27
blakeaowens
approved these changes
Sep 4, 2026
devGregA
approved these changes
Sep 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
[sc-15175]
What
When a Risk Acceptance expires and reactivates its findings, DefectDojo returns them to Active and clears
risk_accepted, but it never touchesverified. So scanner-imported findings, which are usually unverified while accepted, come back Active only, not "Active, Verified." There was no option to change that, and some teams treat "Active, Verified" as their true-vulnerability signal for metrics.Change
Add a per-Risk_Acceptance boolean
restore_verified_expired(defaultFalse). When enabled,expire_now()also setsverified=Trueon each reactivated finding, so it returns as Active, Verified. It mirrors the existingrestart_sla_expiredtoggle and lives inside thereactivate_expiredblock, so it only affects findings that actually reactivate on expiry; default-off preserves today's behavior exactly.The field is exposed on the edit form and API (
fields="__all__"), added to the API filter, and shown on the view template. The migration adds the field to the model and its pghistory event mirror and regenerates the audit triggers.Because the Pro "Risk Acceptances 2.0" workflow delegates expiry to this same
expire_now(), the option works for both the classic flow and the 2.0 workflow with no additional wiring.Tests
Two behavioral tests in
unittests/test_risk_acceptance.py: with the toggle off, Verified is left untouched on expiry; with it on, reactivated findings come back Verified. Both pass (the test database builds through the new migration and triggers).Notes
Requested via a customer support ticket. Base is
dev(new setting, ships in the next minor).