feat(api): add bulk finding update endpoint - #15240
Closed
npeham wants to merge 3 commits into
Closed
Conversation
Add PATCH /api/v2/findings/bulk/ to update an allowlisted set of fields (epss_score, epss_percentile, known_exploited, ransomware_used, kev_date) on many findings in a single atomic request. This closes the performance and atomicity gap for programmatic EPSS/KEV enrichment described in issue DefectDojo#13900, where updating many findings previously required one API call per finding. Behaviour: - Body: {"findings": [{"id": 123, "epss_score": 0.42, ...}, ...]}, max 200 findings per request. - Unknown fields, unknown/duplicate ids, invalid values and over-limit batches are rejected with a 400. - Edit permission is checked per finding; if the user cannot edit any one of them the whole batch is rejected with a 403 and rolled back (the work runs in a single transaction). - Findings are never pushed to JIRA from this endpoint. - Updates are plain row writes, so the pghistory audit trail is recorded exactly as for a normal PATCH; the irrelevant dedupe/JIRA/grading post-processing is skipped for performance. Add unit/API tests covering the happy path, validation, the per-request limit, atomic rollback on a permission failure, and audit history. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015aePDGyHBoxvfpz2iHGmtH
|
This pull request introduces critical security concerns as the author 'npeham' modified over 40 sensitive codepath files across multiple core modules (APIs, models, migrations, templates, and authorization logic) without being an allowed author, potentially compromising system integrity and access controls. Although the findings are non-blocking, the widespread impact across critical components demands immediate review and remediation.
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in
|
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/api_v2/serializers.py' matches configured sensitive codepath pattern 'dojo/api_v2/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/api_v2/views.py (drs_e72da343)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/api_v2/views.py' matches configured sensitive codepath pattern 'dojo/api_v2/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/authorization/api_permissions.py (drs_f6fb772c)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/authorization/api_permissions.py' matches configured sensitive codepath pattern 'dojo/authorization/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/authorization/query_registrations.py (drs_283b4ef1)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/authorization/query_registrations.py' matches configured sensitive codepath pattern 'dojo/authorization/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/authorization/template_filters.py (drs_990e2282)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/authorization/template_filters.py' matches configured sensitive codepath pattern 'dojo/authorization/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/celery.py (drs_41ac1ffe)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/celery.py' matches configured sensitive codepath pattern 'dojo/celery.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/db_migrations/0280_vulnerability_id_type.py (drs_9ee98c0e)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/db_migrations/0280_vulnerability_id_type.py' matches configured sensitive codepath pattern 'dojo/db_migrations/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/db_migrations/0281_backfill_vulnerability_id_type.py (drs_3c2a6341)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/db_migrations/0281_backfill_vulnerability_id_type.py' matches configured sensitive codepath pattern 'dojo/db_migrations/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/db_migrations/0282_unique_finding_vulnerability_id.py (drs_b154a12f)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/db_migrations/0282_unique_finding_vulnerability_id.py' matches configured sensitive codepath pattern 'dojo/db_migrations/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/db_migrations/0283_finding_cwe.py (drs_b1cb7155)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/db_migrations/0283_finding_cwe.py' matches configured sensitive codepath pattern 'dojo/db_migrations/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/db_migrations/0284_backfill_finding_cwe.py (drs_ff2caebb)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/db_migrations/0284_backfill_finding_cwe.py' matches configured sensitive codepath pattern 'dojo/db_migrations/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/endpoint/queries.py (drs_581e607e)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/endpoint/queries.py' matches configured sensitive codepath pattern 'dojo/endpoint/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/engagement/queries.py (drs_6bd385bd)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/engagement/queries.py' matches configured sensitive codepath pattern 'dojo/engagement/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/finding/cwe.py (drs_da6aceb6)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/finding/cwe.py' matches configured sensitive codepath pattern 'dojo/finding/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/finding/deduplication.py (drs_e211473f)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/finding/deduplication.py' matches configured sensitive codepath pattern 'dojo/finding/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/finding/helper.py (drs_9c80aceb)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/finding/helper.py' matches configured sensitive codepath pattern 'dojo/finding/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/finding/models.py (drs_2014c850)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/finding/models.py' matches configured sensitive codepath pattern 'dojo/finding/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/finding/queries.py (drs_07497d3e)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/finding/queries.py' matches configured sensitive codepath pattern 'dojo/finding/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/finding/vulnerability_id.py (drs_b9a10216)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/finding/vulnerability_id.py' matches configured sensitive codepath pattern 'dojo/finding/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/finding_group/queries.py (drs_05b197c3)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/finding_group/queries.py' matches configured sensitive codepath pattern 'dojo/finding_group/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/forms.py (drs_47c9849a)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/forms.py' matches configured sensitive codepath pattern 'dojo/forms.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/importers/base_importer.py (drs_21e38377)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/importers/base_importer.py' matches configured sensitive codepath pattern 'dojo/importers/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/importers/default_reimporter.py (drs_08241e07)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/importers/default_reimporter.py' matches configured sensitive codepath pattern 'dojo/importers/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/jira/helper.py (drs_bd6740d2)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/jira/helper.py' matches configured sensitive codepath pattern 'dojo/jira/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/jira/queries.py (drs_71bc1465)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/jira/queries.py' matches configured sensitive codepath pattern 'dojo/jira/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/jira/services.py (drs_d47af9da)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/jira/services.py' matches configured sensitive codepath pattern 'dojo/jira/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/middleware.py (drs_97a3ea49)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/middleware.py' matches configured sensitive codepath pattern 'dojo/middleware.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/models.py (drs_cedab850)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/models.py' matches configured sensitive codepath pattern 'dojo/models.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/product/queries.py (drs_da3a9418)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/product/queries.py' matches configured sensitive codepath pattern 'dojo/product/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/product_type/queries.py (drs_90641379)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/product_type/queries.py' matches configured sensitive codepath pattern 'dojo/product_type/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/risk_acceptance/queries.py (drs_e28b5450)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/risk_acceptance/queries.py' matches configured sensitive codepath pattern 'dojo/risk_acceptance/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/tasks.py (drs_f615bcdc)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/tasks.py' matches configured sensitive codepath pattern 'dojo/tasks.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/templates/dojo/ad_hoc_findings.html (drs_0d5e2c4f)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/templates/dojo/ad_hoc_findings.html' matches configured sensitive codepath pattern 'dojo/templates/**/*.html' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/templates/dojo/add_findings.html (drs_f793b015)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/templates/dojo/add_findings.html' matches configured sensitive codepath pattern 'dojo/templates/**/*.html' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/templates/dojo/edit_finding.html (drs_a60ef02f)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/templates/dojo/edit_finding.html' matches configured sensitive codepath pattern 'dojo/templates/**/*.html' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/templates/dojo/findings_list_snippet.html (drs_e551a87a)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/templates/dojo/findings_list_snippet.html' matches configured sensitive codepath pattern 'dojo/templates/**/*.html' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/templates/dojo/view_finding.html (drs_b6be85d5)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/templates/dojo/view_finding.html' matches configured sensitive codepath pattern 'dojo/templates/**/*.html' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/templates/dojo/view_test.html (drs_6721f8f7)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/templates/dojo/view_test.html' matches configured sensitive codepath pattern 'dojo/templates/**/*.html' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/test/queries.py (drs_f2617902)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/test/queries.py' matches configured sensitive codepath pattern 'dojo/test/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/tool_product/queries.py (drs_d1ef72d2)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/tool_product/queries.py' matches configured sensitive codepath pattern 'dojo/tool_product/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/user/queries.py (drs_fa28d80b)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/user/queries.py' matches configured sensitive codepath pattern 'dojo/user/*.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/views.py (drs_17783d32)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/views.py' matches configured sensitive codepath pattern 'dojo/views.py' and was modified by 'npeham' (commit e5d0fc4) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/apps.py (drs_8f888b30)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/apps.py' matches configured sensitive codepath pattern 'dojo/apps.py' and was modified by 'npeham' (commit ac16776) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/search/views.py (drs_3c4d1f40)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/search/views.py' matches configured sensitive codepath pattern 'dojo/search/*.py' and was modified by 'npeham' (commit ac16776) who is not in the allowed authors list. |
We've notified @mtesauro.
Comment to provide feedback on these findings.
Report false positive: @dryrunsecurity fp [FINDING ID] [FEEDBACK]
Report low-impact: @dryrunsecurity nit [FINDING ID] [FEEDBACK]
Example: @dryrunsecurity fp drs_90eda195 This code is not user-facing
All finding details can be found in the DryRun Security Dashboard.
Contributor
|
Thank you for the work here, and for the thorough tests and schema coverage. Real effort clearly went into it. Unfortunately this is a PR we can't accept, so we're going to close it. Our priority for the open-source project is keeping the core maintainable and focused on its core purpose, similar to how the Linux kernel stays lean and selective about what gets merged into mainline. For transparency, we do support this kind of enrichment in DefectDojo Pro, but the decision here comes down to keeping the core focused and maintainable. This is not a reflection on the code quality. So that contributors don't spend time on work we can't merge, we ask that larger features be pre-approved before implementation. The best place for that is our community Slack https://join.slack.com/t/defectdojocommunity/shared_invite/zt-3l9028wlf-ezDB29D_MIh9ShXdesCHZA, where you can run the idea by the maintainers and get a quick read on fit before writing any code. Thank you again for being a member of the DefectDojo community. |
Author
@devGregA Thanks for the response, I completely understand and the comparison to how the Linux kernel stays lean makes a lot of sense. I appreciate the transparency. Thank you for the Slack invite, I've just joined, and I'm happy to be part of the DefectDojo community! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements the bulk finding-update capability requested in DefectDojo issue #13900 (bulk create/update/delete API for Findings). This PR delivers the update slice, scoped to a narrow, allowlisted set of threat-intelligence fields.
Description
Adds a new endpoint
PATCH /api/v2/findings/bulk/that updates many findings in a single atomic request, closing the performance and atomicity gap that today forces one API call per finding when enriching EPSS/KEV metadata programmatically.Design (as discussed in the issue):
{"findings": [{"id": 123, "epss_score": 0.42, ...}, ...]}, at most 200 findings per request.epss_score,epss_percentile,known_exploited,ransomware_used,kev_datemay be set. Any other field is rejected — the endpoint can never be used to mass-edit severity, status or ownership.[0, 1]), empty list, and over-limit batches all return400with a clear message.UserHasFindingPermissionobject permission. If the user cannot edit any referenced finding, the entire batch is rejected with403and rolled back — the whole operation runs in onetransaction.atomic()block.push_to_jira=False).Implementation:
dojo/finding/api/serializer.py:FindingBulkUpdateSerializer+FindingBulkUpdateFieldsSerializer, plus theBULK_UPDATE_ALLOWED_FIELDS/BULK_UPDATE_MAX_FINDINGSconstants.dojo/finding/api/views.py: abulk_updateaction onFindingViewSet(detail=False,url_path="bulk") with a fully documented@extend_schema.Test results
Added
unittests/test_finding_bulk_update_api.py(13 tests) covering the happy path, response shape, per-field validation, the per-request limit, atomic rollback on a permission failure, unauthenticated access, and that a bulk update produces a pghistory audit event just like a normal PATCH.All 13 new tests pass, and the existing
unittests.test_rest_framework.FindingsTest(27 tests) andunittests.test_apiv2_methods_and_endpointssuites still pass. The generated OpenAPI schema includes the new endpoint and validates cleanly (no drf-spectacular warnings). Ruff-compliant.Documentation
The endpoint is self-documenting via its
@extend_schemarequest/response and docstring, so it appears in the auto-generated OpenAPI/Swagger API docs. No separate docs-folder page is required for a new API action.Checklist
ruff.toml).Finding).Extra information
Suggested labels:
enhancement,performance,feature.