Skip to content

remove: Credential Manager (2.57 deprecation, 2.59 EOL)#14836

Merged
Maffooch merged 7 commits into
devfrom
remove-credential-manager
May 8, 2026
Merged

remove: Credential Manager (2.57 deprecation, 2.59 EOL)#14836
Maffooch merged 7 commits into
devfrom
remove-credential-manager

Conversation

@Maffooch
Copy link
Copy Markdown
Contributor

@Maffooch Maffooch commented May 7, 2026

Per the 2.59 upgrade notes, this PR retires the Credential Manager feature (announced for removal in 2.57.0). Full removal: UI, API, models, DB tables, and the toggle that gated it.

Endpoints removed (now 404)

  • /api/v2/credentials/
  • /api/v2/credential_mappings/

UI removed (now 404)

  • All /cred/*, /product/<id>/cred/*, /engagement/<id>/cred/*, /test/<id>/cred/*, /finding/<id>/cred/* routes
  • "Credential Manager" sidebar entry and per-product Add/View Credentials shortcuts in the navbar
  • Credential sections from view_test, view_eng, and view_finding

What changed

Area What was removed
Module Entire dojo/cred/ package (views.py, urls.py, signals.py, queries.py, __init__.py)
Templates All 10 dojo/templates/dojo/*cred*.html templates
Forms CredMappingForm, CredMappingFormProd, CredUserForm (dojo/forms.py)
Filters ApiCredentialsFilter (dojo/filters.py)
API CredentialsViewSet, CredentialsMappingViewSet, CredentialSerializer, CredentialMappingSerializer, UserHasCredentialPermission
Authorization Permissions.Credential_View/Add/Edit/Delete, get_credential_permissions(), plus the credential-perm entries in Reader/API_Importer/Writer/Maintainer/Owner roles, and the Cred_Mapping-routing branch in user_has_object_permission
Cross-cutting views Cred_Mapping reverse-lookup blocks in dojo/test/views.py, dojo/finding/views.py, and dojo/engagement/views.py (incl. the cred_form plumbing in import-scan and add_tests); Cred_User from dojo/notes/views.py
Audit / pghistory Cred_User from dojo/auditlog/{services,backfill}.py and the three dojo/management/commands/pghistory_*.py commands
Tests unittests/test_rest_framework.py (CredentialMappingTest, CredentialTest); Selenium tests/credential_test.py and tests/product_credential_test.py
App registration dojo.cred.signals import in dojo/apps.py

Schema changes

dojo/db_migrations/0265_remove_credential_manager.py:

  1. Drops the three pghistory triggers on cred_user (insert_insert, update_update, delete_delete)
  2. DeleteModel('Cred_UserEvent')
  3. DeleteModel('Cred_Mapping') (drops first because it has FKs to Cred_User)
  4. DeleteModel('Cred_User')
  5. RemoveField('system_settings', 'enable_credentials')

Verification

  • python manage.py check
  • python manage.py makemigrations --check → must report "No changes detected"
  • python manage.py migrate dojo → applies 0265
  • python -m pytest unittests/ -x --timeout=120
  • API surface: curl -i /api/v2/credentials/ and /api/v2/credential_mappings/ → 404
  • UI surface: navigate to /cred or any /product/<id>/cred/all → 404
  • No leftover refs: grep -rn "Cred_User\\|Cred_Mapping\\|enable_credentials" dojo/ unittests/ tests/ --include="*.py" --include="*.html" (excluding db_migrations/) → empty
  • Schema regenerates cleanly: python manage.py spectacular --file /tmp/schema.yml && grep -cE "/credentials|/credential_mappings" /tmp/schema.yml → 0

The 2.59 upgrade doc already documents this removal; no doc update required.

Diff: 44 files changed, 59 insertions(+), 2879 deletions(-).

🤖 Generated with Claude Code

@Maffooch @claude
remove: Credential Manager (announced 2.57, EOL in 2.59)
b0f866b 
Per the 2.59 release notes, retires the Credential Manager feature in
its entirety: UI, API, models, DB tables, and the system-settings
toggle that gated it.

Endpoints removed (now `404`):
- /api/v2/credentials/
- /api/v2/credential_mappings/

UI removed:
- All `/cred/*`, `/product/<id>/cred/*`, `/engagement/<id>/cred/*`,
  `/test/<id>/cred/*`, `/finding/<id>/cred/*` routes
- "Credential Manager" sidebar entry and per-product Add/View
  Credentials shortcuts in the navbar
- Credential sections from view_test, view_eng, and view_finding

Code deleted:
- The entire `dojo/cred/` module (views, urls, signals, queries)
- All `*cred*.html` templates
- `CredMappingForm`, `CredMappingFormProd`, `CredUserForm` in forms.py
- `ApiCredentialsFilter` in filters.py
- `CredentialsViewSet`, `CredentialsMappingViewSet`,
  `CredentialSerializer`, `CredentialMappingSerializer`,
  `UserHasCredentialPermission`
- Selenium tests `tests/credential_test.py` and
  `tests/product_credential_test.py`
- The four `Credential_*` permissions and
  `Permissions.get_credential_permissions()`, plus their entries in
  every role's permission set
- The `Cred_Mapping` reverse-lookup blocks in test/finding/engagement
  views (and the `cred_form` plumbing in the import-scan flow)
- `Cred_User` from audit-log and pghistory tracking lists, including
  the `Cred_UserEvent` history table

Schema dropped via 0265_remove_credential_manager:
- `system_settings.enable_credentials` (no longer gates anything)
- `Cred_Mapping`, `Cred_User`, `Cred_UserEvent` models, with their
  pghistory triggers cleared first

The 2.59 upgrade doc already documents the removal; nothing to update
in `docs/`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@Maffooch Maffooch requested a review from mtesauro as a code owner May 7, 2026 22:22
@github-actions github-actions Bot added New Migration Adding a new migration file. Take care when merging. apiv2 unittests integration_tests ui labels May 7, 2026
@Maffooch Maffooch mentioned this pull request May 7, 2026
Merged
Maffooch and others added 2 commits May 7, 2026 16:43
@Maffooch @claude
fix: ruff E302 + drop cred refs from fixtures
12d749f 
- dojo/authorization/roles_permissions.py: add the second blank line
  before get_roles_with_permissions() that ruff's E302 demands.
- Remove the now-orphan dojo.cred_user / dojo.cred_mapping entries from
  the three test fixtures, drop watson.searchentry rows pointing at
  those content types, and strip the gone enable_credentials field
  from System_Settings entries (the loaddata test was failing on it).

The fixture normalization picks up small indentation diffs in
unrelated sections (Python's json.dump uses one consistent indent)
but the data is unchanged otherwise.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@Maffooch @claude
fix: drop credential_manager refs from sample_data_locations fixture …
1c25b90 
…+ matrix

- dojo/fixtures/defect_dojo_sample_data_locations.json: missed in the
  previous fixture sweep — strip enable_credentials, cred_user /
  cred_mapping rows, and the matching watson.searchentry rows so
  loaddata stops failing.
- .github/workflows/integration-tests.yml: drop the credential_test.py
  and product_credential_test.py entries from the UI test matrix; both
  files were deleted in this PR and CI was failing trying to run them.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@Maffooch Maffooch force-pushed the remove-credential-manager branch from 1294079 to 1c25b90 Compare May 7, 2026 23:12
@Maffooch @claude
fix: drop cred_user from configuration permissions list
e70b19d 
dojo/user/utils.py left a Permission_Helper(name="cred user", ...) in
the configuration-permissions form that drives /user/<id>/edit_permissions
and /group/<id>/edit_permissions. With Cred_User gone, the underlying
view_cred_user / add_cred_user / change_cred_user / delete_cred_user
django auth permissions no longer exist and the form 500s on save —
which is what was breaking the group_test and user_test UI integration
tests.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@Maffooch Maffooch added this to the 2.59.0 milestone May 8, 2026
mtesauro
mtesauro approved these changes May 8, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@mtesauro mtesauro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

Maffooch and others added 2 commits May 8, 2026 14:13
@Maffooch
Merge branch 'dev' into remove-credential-manager
2f8f682
@Maffooch @claude
fix: drop malformed watson.searchentry rows left by bad merge
723e1ca 
The merge of dev into this branch (2f8f682) collided on the watson
search-entry rows: dev removed stub_finding entries while this branch
removed cred_user entries, and the three-way merge dropped only the
model name from each conflicting row, leaving six entries per fixture
with content_type set to ['dojo'] (a one-element natural key).

loaddata then failed with:

    ContentTypeManager.get_by_natural_key() missing 1 required
    positional argument: 'model' ... (watson.searchentry:pk=4)
    field_value was '['dojo']'

These rows pointed at the now-removed cred_user content type and were
already supposed to be deleted (see 12d749f). Remove them from both
fixture files.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@Maffooch Maffooch merged commit b681610 into dev May 8, 2026
156 of 157 checks passed
Maffooch added a commit to devGregA/django-DefectDojo that referenced this pull request May 8, 2026
@Maffooch @claude
devGregA Merge branch 'dev' into tailwind
03124a3 
Resolve conflicts from dev's removal of Credential Manager (DefectDojo#14836),
Stub Findings (DefectDojo#14837), deprecated questionnaire API (DefectDojo#14835), plus
Xygeni parser (DefectDojo#14769) and import-time tag batching (DefectDojo#14839).

Accepted dev's deletions: cred module, stub findings, deprecated
viewsets, and their UI sections in view_eng/view_finding/view_test.
Kept tailwind's refactored auth (api_permissions shim, action-string
roles, _user_authorized_for) over dev's legacy Permissions-enum code.
Trimmed cred/Stub_Finding refs from authorization/{api_permissions,
query_registrations,url_permissions}.py and the legacy auth tests.

Note: dojo/templates_classic/ still references removed URL names
(new_cred_*, promote_to_finding, delete_stub_finding) — follow-up.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Maffooch pushed a commit to devGregA/django-DefectDojo that referenced this pull request May 8, 2026
@devGregA @claude
Merge branch 'dev' into tailwind
ae1210d 
Resolve conflicts from dev's removal of Credential Manager (DefectDojo#14836),
Stub Findings (DefectDojo#14837), deprecated questionnaire API (DefectDojo#14835), plus
Xygeni parser (DefectDojo#14769) and import-time tag batching (DefectDojo#14839).

Accepted dev's deletions: cred module, stub findings, deprecated
viewsets, and their UI sections in view_eng/view_finding/view_test.
Kept tailwind's refactored auth (api_permissions shim, action-string
roles, _user_authorized_for) over dev's legacy Permissions-enum code.
Trimmed cred/Stub_Finding refs from authorization/{api_permissions,
query_registrations,url_permissions}.py and the legacy auth tests.

Note: dojo/templates_classic/ still references removed URL names
(new_cred_*, promote_to_finding, delete_stub_finding) — follow-up.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Maffooch pushed a commit to devGregA/django-DefectDojo that referenced this pull request May 8, 2026
@devGregA @claude
Merge branch 'dev' into tailwind
9917ad8 
Resolve conflicts from dev's removal of Credential Manager (DefectDojo#14836),
Stub Findings (DefectDojo#14837), deprecated questionnaire API (DefectDojo#14835), plus
Xygeni parser (DefectDojo#14769) and import-time tag batching (DefectDojo#14839).

Accepted dev's deletions: cred module, stub findings, deprecated
viewsets, and their UI sections in view_eng/view_finding/view_test.
Kept tailwind's refactored auth (api_permissions shim, action-string
roles, _user_authorized_for) over dev's legacy Permissions-enum code.
Trimmed cred/Stub_Finding refs from authorization/{api_permissions,
query_registrations,url_permissions}.py and the legacy auth tests.

Note: dojo/templates_classic/ still references removed URL names
(new_cred_*, promote_to_finding, delete_stub_finding) — follow-up.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mtesauro mtesauro mtesauro approved these changes

@valentijnscholten valentijnscholten valentijnscholten approved these changes

@paulOsinski paulOsinski paulOsinski approved these changes

@Jino-T Jino-T Jino-T approved these changes

@blakeaowens blakeaowens Awaiting requested review from blakeaowens

Assignees

No one assigned

Labels

apiv2 integration_tests New Migration Adding a new migration file. Take care when merging. ui unittests

Projects

None yet

Milestone

2.59.0

Development

Successfully merging this pull request may close these issues.

5 participants

@Maffooch @mtesauro @valentijnscholten @paulOsinski @Jino-T