canonical / ubuntu-com-security-api

The API for CVEs and USNs data.
17 stars 9 forks source link

Switch the whole app to using flask-sqlalchemy #84

Closed nottrobin closed 2 years ago

nottrobin commented 2 years ago

Here I'm switching the whole app to using flask-sqlalchemy rather than pure SQLAlchemy, because I actually think it's more common, as well as being more straightforward to use with some important defaults already set.

I've given a long explanation in this commit.

Warning: Tests will fail

Tests will completely fail, because alchemy-mock is completely unable to effectively mock the db.Model-based classes for flask-sqlalchemy.

I'm going switch the test-python check to be not required for now. I will be filing a PR very soon to completely rewrite the tests, and once I've done that I'll make test-python mandatory again.

QA

As we are flying blind without any Python tests to check things for us, we need to check this quite thoroughly.

Check migrations work fine on an empty database

Clear out any existing database and run the site - which will set a new one up from scratch:

dotrun delete-db
dotrun

Now check these URLs:

Check migrations work on an existing database

Start and populate the database from another branch first:

git checkout main
dotrun

Once it's created the database and the migrations, kill the server and switch back to this branch:

git checkout flask-sqlalchemy
dotrun

Watch it just output a couple of lines saying nothing needs migrating:

$ ./entrypoint 0.0.0.0:${PORT}
INFO  [alembic.runtime.migration] Context impl PostgresqlImpl.
INFO  [alembic.runtime.migration] Will assume transactional DDL.

Now check these URLs:

Test creating and deleting data

With the site still running, run the scripts (it'll probably ask you to authenticate through the browser):

dotrun exec scripts/create-cves.py scripts/payloads/cves.json  # Create a new CVE through the API
dotrun exec scripts/create-notice.py scripts/payloads/usn-4414-2.json  # Create a Notice through the API
dotrun exec scripts/create-release.py scripts/payloads/testy.json  # Create a Release through the API

Go to:

To check they were created properly.

Now try deleting them:

dotrun exec scripts/delete-cves.py CVE-2019-20504  # Delete the CVE
dotrun exec scripts/delete-notices.py USN-4414-2  # Delete the notice
dotrun exec scripts/delete-releases.py testy  # Delete the release

Now go back to:

And check they've been deleted (you might need to refresh because of the caching).