Security Info API fixes (#2772)

Add new tests checking creation of scans by `external_vulnerabilities`.

src/ralph/security/api.py

@@ -38,7 +38,7 @@ def to_internal_value(self, data):
 
         # external_id to local_id
         if 'external_vulnerabilities' in data:
-            external_ids = data.getlist('external_vulnerabilities')
+            external_ids = data.get('external_vulnerabilities', [])
             converted = Vulnerability.objects.filter(
                 external_vulnerability_id__in=external_ids)
             if len(converted) != len(external_ids):
@@ -49,9 +49,9 @@ def to_internal_value(self, data):
                     ', '.join(unknown)
                 )
                 errors['external_vulnerability'] = msg
-            merged_vulnerabilities = data.getlist('vulnerabilities') or []
+            merged_vulnerabilities = data.get('vulnerabilities', [])
             merged_vulnerabilities.extend([c.id for c in converted])
-            data.setlist('vulnerabilities', merged_vulnerabilities)
+            data['vulnerabilities'] = merged_vulnerabilities
 
         host_ip = data.get('host_ip', None)
         if host_ip:

src/ralph/security/tests/test_api.py

@@ -92,9 +92,13 @@ def test_patch_security_scan(self):
         url = reverse('securityscan-detail', args=(self.security_scan.id,))
         vulnerability = VulnerabilityFactory()
         data = {
-            'last_scan_date': (datetime.now() + timedelta(days=10)).isoformat(),
+            'last_scan_date': (
+                datetime.now() + timedelta(days=10)
+            ).isoformat(),
             'scan_status': ScanStatus.error.name,
-            'next_scan_date': (datetime.now() + timedelta(days=15)).isoformat(),
+            'next_scan_date': (
+                datetime.now() + timedelta(days=15)
+            ).isoformat(),
             'details_url': self.security_scan.details_url + '-new',
             'rescan_url': self.security_scan.rescan_url + '-new',
             'host_ip': ip.address,
@@ -156,7 +160,9 @@ def test_create_vulnerability(self):
         url = reverse('vulnerability-list')
         data = {
             'name': "vulnerability name",
-            'patch_deadline': (datetime.now() + timedelta(days=10)).isoformat(),
+            'patch_deadline': (
+                datetime.now() + timedelta(days=10)
+            ).isoformat(),
             'risk': Risk.low.name,
             'external_vulnerability_id': 100,
         }
@@ -196,3 +202,38 @@ def test_patch_vulnerability(self):
         self.assertEqual(
             self.vulnerability.external_vulnerability_id,
             data['external_vulnerability_id'])
+
+
+class TestExternalVulnerability(RalphAPITestCase):
+    def setUp(self):
+        super().setUp()
+        ip = IPAddressFactory(address="192.168.128.10")
+        self.vulnerability = VulnerabilityFactory()
+        self.data = {
+            'last_scan_date': '2015-01-01T00:00:00',
+            'scan_status': ScanStatus.ok.name,
+            'next_scan_date': '2016-01-01T00:00:00',
+            'host_ip': ip.address,
+            'external_vulnerabilities': [
+                self.vulnerability.external_vulnerability_id
+            ],
+        }
+
+    def test_create_scan_by_external_id_works(self):
+        response = self.client.post(
+            reverse('securityscan-list'), self.data, format='json'
+        )
+        security_scan = SecurityScan.objects.get(pk=response.data['id'])
+        self.assertEqual(
+            self.vulnerability.id, security_scan.vulnerabilities.get().id
+        )
+
+    def test_create_scan_raise_error_when_both_vulnerabilities_empty(self):
+        self.data['external_vulnerabilities'] = []
+        response = self.client.post(
+            reverse('securityscan-list'), self.data, format='json'
+        )
+        self.assertEqual(
+            response.data,
+            {'vulnerabilities': ['This list may not be empty.']},
+        )

src/ralph/security/tests/test_serializers.py

@@ -17,25 +17,22 @@ def setUp(self):
         super().setUp()
         self.security_scan = SecurityScanFactory()
 
-    def _dict2QueryDict(self, data_dict):
-        qdict = QueryDict('', mutable=True)
-        qdict.update(data_dict)
-        return qdict
-
     def test_external_id_is_converted_to_local(self):
         ip = IPAddressFactory(address="192.168.128.10")
         vulnerability_1 = VulnerabilityFactory()
         vulnerability_2 = VulnerabilityFactory()
-        data = self._dict2QueryDict({
+        data = {
             'last_scan_date': '2015-01-01T00:00:00',
             'scan_status': 'ok',
             'next_scan_date': '2016-01-01T00:00:00',
             'details_url': 'https://example.com/scan-deatils',
             'rescan_url': 'https://example.com/rescan-url',
             'host_ip': ip.address,
-            'vulnerabilities': vulnerability_1.id,
-            'external_vulnerabilities': vulnerability_2.external_vulnerability_id,  # noqa
-        })
+            'vulnerabilities': [vulnerability_1.id],
+            'external_vulnerabilities': [
+                vulnerability_2.external_vulnerability_id
+            ],
+        }
         scan_serializer = SaveSecurityScanSerializer(
             context={'request': None})
         deserialized = scan_serializer.to_internal_value(data)
@@ -48,16 +45,16 @@ def test_external_id_is_converted_to_local(self):
     def test_error_raised_when_unknown_external_id(self):
         ip = IPAddressFactory(address="192.168.128.10")
         vulnerability = VulnerabilityFactory()
-        data = self._dict2QueryDict({
+        data = {
             'last_scan_date': '2015-01-01T00:00:00',
             'scan_status': 'ok',
             'next_scan_date': '2016-01-01T00:00:00',
             'details_url': 'https://example.com/scan-deatils',
             'rescan_url': 'https://example.com/rescan-url',
             'host_ip': ip.address,
-            'vulnerabilities': vulnerability.id,
-            'external_vulnerabilities': '12345678',
-        })
+            'vulnerabilities': [vulnerability.id],
+            'external_vulnerabilities': ['12345678'],
+        }
         scan_serializer = SaveSecurityScanSerializer(
             context={'request': None})
         with self.assertRaises(serializers.ValidationError):