fix: source CSAF justification and comment from the status-setting assessment

Author: dervoeti

backend/application/vex/services/csaf_generator_vulnerability.py

@@ -1,7 +1,6 @@
 from typing import Optional
 
-from application.core.models import Observation
-from application.core.queries.observation import get_current_observation_log
+from application.core.models import Observation, Observation_Log
 from application.vex.services.csaf_generator_helpers import (
     get_product_or_relationship_id,
     get_vulnerability_ecosystem,
@@ -124,16 +123,21 @@ def set_flag_or_threat(vulnerability: CSAFVulnerability, observation: Observatio
     vex_status = map_status(observation.current_status)
     if vex_status == CSAF_Status.CSAF_STATUS_NOT_AFFECTED:
         product_or_relationship_id = get_product_or_relationship_id(observation)
-        # get_current_observation_log (unlike get_current_modifying_observation_log) excludes empty log
-        # entries, e.g. the ones created when a rego rule is removed. Those have an empty
-        # vex_justification and comment and would otherwise shadow the real assessment, leaving the
-        # product in known_not_affected without any impact statement (CSAF mandatory test 6.1.27.9).
-        observation_log = get_current_observation_log(observation)
+        # Use the observation log that set the current status, i.e. the assessment. The generic
+        # "current"/"modifying" observation log helpers are unreliable here: automated log entries
+        # (for example "Removed product rego rule ...") carry no status but still pass those filters
+        # (empty vex_remediations is stored inconsistently as "" or NULL) and would then provide a
+        # misleading justification and comment. Filtering on the current status skips those entries.
+        assessment_log = (
+            Observation_Log.objects.filter(observation=observation, status=observation.current_status)
+            .order_by("-created")
+            .first()
+        )
 
-        # Prefer the observation's authoritative current justification, fall back to the log.
+        # Prefer the observation's authoritative current justification, fall back to the assessment.
         justification = observation.current_vex_justification
-        if not justification and observation_log:
-            justification = observation_log.vex_justification
+        if not justification and assessment_log:
+            justification = assessment_log.vex_justification
         csaf_label = map_vex_justification_to_csaf_openvex_justification(justification)
         if csaf_label:
             found = False
@@ -153,9 +157,9 @@ def set_flag_or_threat(vulnerability: CSAFVulnerability, observation: Observatio
         # Surface the assessment comment as a free-text impact threat whenever it exists, so the human
         # explanation is kept alongside the machine-readable flag. With neither a flag nor a comment
         # the product has no impact statement and validation fails, which is intended.
-        if observation_log and observation_log.comment:
+        if assessment_log and assessment_log.comment:
             category = "impact"
-            details = observation_log.comment
+            details = assessment_log.comment
             found = False
             for threat in vulnerability.threats:
                 if threat.category == category and threat.details == details: