fix: /api/v2/purl/{purl} now honors qualifiers, or lack thereof

Fixes #1158 Signed-off-by: Jim Crossley <[email protected]>
trustification · Jan 20, 2025 · a4b12cd · a4b12cd
1 parent e3783b2
commit a4b12cd
Show file tree

Hide file tree

Showing 4 changed files with 33 additions and 37 deletions.
diff --git a/modules/fundamental/src/ai/service/tools/package_info.rs b/modules/fundamental/src/ai/service/tools/package_info.rs
@@ -234,7 +234,7 @@ mod tests {
             "pkg:rpm/redhat/[email protected]?arch=s390x",
             r#"
 {
-  "identifier": "pkg:rpm/redhat/[email protected]?arch=ppc64le",
+  "identifier": "pkg:rpm/redhat/[email protected]?arch=s390x",
   "uuid": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
   "name": "libsepol",
   "version": "3.5-1.el9",

diff --git a/modules/fundamental/src/purl/service/mod.rs b/modules/fundamental/src/purl/service/mod.rs
@@ -21,7 +21,11 @@ use trustify_common::{
     model::{Paginated, PaginatedResults},
     purl::{Purl, PurlErr},
 };
-use trustify_entity::{base_purl, qualified_purl, versioned_purl};
+use trustify_entity::{
+    base_purl,
+    qualified_purl::{self, CanonicalPurl},
+    versioned_purl,
+};
 use trustify_module_ingestor::common::Deprecation;
 
 #[derive(Default)]
@@ -232,33 +236,17 @@ impl PurlService {
         deprecation: Deprecation,
         connection: &C,
     ) -> Result<Option<PurlDetails>, Error> {
-        if let Some(version) = &purl.version {
-            let mut query = qualified_purl::Entity::find()
-                .left_join(versioned_purl::Entity)
-                .left_join(base_purl::Entity)
-                .filter(base_purl::Column::Type.eq(&purl.ty))
-                .filter(base_purl::Column::Name.eq(&purl.name))
-                .filter(versioned_purl::Column::Version.eq(version));
-
-            if let Some(ns) = &purl.namespace {
-                query = query.filter(base_purl::Column::Namespace.eq(ns));
-            } else {
-                query = query.filter(base_purl::Column::Namespace.is_null());
-            }
-
-            let purl = query.one(connection).await?;
-
-            if let Some(purl) = purl {
-                Ok(Some(
-                    PurlDetails::from_entity(None, None, &purl, deprecation, connection).await?,
-                ))
-            } else {
-                Ok(None)
-            }
+        let canonical = CanonicalPurl::from(purl.clone());
+        let purl = qualified_purl::Entity::find()
+            .filter(qualified_purl::Column::Purl.eq(canonical))
+            .one(connection)
+            .await?;
+        if let Some(purl) = purl {
+            Ok(Some(
+                PurlDetails::from_entity(None, None, &purl, deprecation, connection).await?,
+            ))
         } else {
-            Err(Error::Purl(PurlErr::MissingVersion(
-                "A fully-qualified pURL requires a version".to_string(),
-            )))
+            Ok(None)
         }
     }
 

diff --git a/modules/fundamental/src/purl/service/test.rs b/modules/fundamental/src/purl/service/test.rs
@@ -816,25 +816,33 @@ async fn ingest_some_log4j_data(ctx: &TrustifyContext) -> Result<(), anyhow::Err
             &ctx.db,
         )
         .await?;
+
+    log4j_123
+        .ingest_qualified_package(
+            &Purl::from_str("pkg:maven/org.apache/[email protected]")?,
+            &ctx.db,
+        )
+        .await?;
     Ok(())
 }
 
 #[test_context(TrustifyContext)]
 #[test(actix_web::test)]
-async fn purl_by_purl(ctx: &TrustifyContext) -> Result<(), anyhow::Error> {
+async fn unqualified_purl_by_purl(ctx: &TrustifyContext) -> Result<(), anyhow::Error> {
     let service = PurlService::new();
 
     ingest_some_log4j_data(ctx).await?;
 
+    let purl = "pkg:maven/org.apache/[email protected]";
+
     let results = service
-        .purl_by_purl(
-            &Purl::from_str("pkg:maven/org.apache/[email protected]")?,
-            Default::default(),
-            &ctx.db,
-        )
-        .await?;
+        .purl_by_purl(&Purl::from_str(purl)?, Default::default(), &ctx.db)
+        .await?
+        .unwrap();
 
-    assert_eq!(results.unwrap().version.version, "1.2.3");
+    log::debug!("{results:#?}");
+    assert_eq!(results.head.purl.to_string(), purl);
+    assert_eq!(results.version.version, "1.2.3");
 
     Ok(())
 }

diff --git a/modules/fundamental/src/vulnerability/service/test.rs b/modules/fundamental/src/vulnerability/service/test.rs
@@ -299,7 +299,7 @@ async fn product_statuses(ctx: &TrustifyContext) -> Result<(), anyhow::Error> {
     // Ensure that purl->vuln mapping is good
     let purl = purl_service
         .purl_by_purl(
-            &Purl::try_from("pkg:maven/io.quarkus/[email protected]")?,
+            &Purl::try_from("pkg:maven/io.quarkus/[email protected]?repository_url=https://maven.repository.redhat.com/ga/&type=jar")?,
             Default::default(),
             &ctx.db,
         )