Feature/updateinfo v2

[rockythorn]

Summary

Implements v2 updateinfo.xml API endpoint with FK-based filtering and major version aggregation. Fixes critical module package bug causing 230+ missing advisories through ORM-level property pattern.

Problems Solved

Module Package Source RPM Mapping Bug

• ~8,908 packages had "module." prefix in package_name field (e.g., "module.postgresql")
• NEVRA parsing extracts "postgresql" but database has "module.postgresql" → mismatch
• Impact: 230+ module advisories missing from Rocky 8 AppStream updateinfo.xml

V1 Endpoint Limitations

• Uses denormalized product_name strings instead of FK relationships
• No major version aggregation (separate XML per minor version)
• Requires URL encoding for product names with spaces

Changes

1. ORM-Level Module Prefix Fix (Trinity Quirk)

Adds Python property pattern to AdvisoryPackage model to transparently strip "module." prefix:

class AdvisoryPackage(Model):
    _package_name = fields.TextField(source_field='package_name')

    @property
    def package_name(self):
        return self._clean_package_name(self._package_name)

• No database migration required
• Works for existing data (reads) and new data (writes)
• Transparent to all business logic

2. Simplify Business Logic

Removed manual .removeprefix("module.") calls since ORM handles it automatically.

3. V2 Updateinfo API Endpoint

URL: /api/v3/updateinfo/{product_slug}/{major_version}/{repo}/updateinfo.xml?arch={arch}

Example: /api/v3/updateinfo/rocky-linux/8/BaseOS/updateinfo.xml?arch=x86_64

Key improvements:

• FK-based filtering using supported_product_id instead of string matching
• Major version aggregation (8 → all 8.x minor versions)
• Required architecture parameter (validated against Architecture enum)
• Product slug mapping (rocky-linux → Rocky Linux)
• Data integrity validation via FK relationships

4. Architecture Validation

Uses centralized Architecture enum from validation module instead of hardcoded lists.

5. Helper Functions

Extracted reusable functions:

• resolve_product_slug() - Convert URL slug to product name
• get_source_package_name() - Extract source package identifier
• build_source_rpm_mapping() - Map binary packages to source RPMs

Also fixed bug where binaries were mapped to source RPMs from different minor versions.

API Comparison

Feature	V1	V2
URL	/Rocky%20Linux%208%20x86_64/BaseOS/updateinfo.xml	/rocky-linux/8/BaseOS/updateinfo.xml?arch=x86_64
Filtering	String-based product_name	FK-based supported_product_id
Version aggregation	None (one product = one minor version)	Major version aggregation
Architecture	Optional query param	Required query param
URL encoding	Required (spaces in names)	Not needed (slugs)

Testing

• Created 14 unit tests for new helper functions
• Integration testing shows 230 module advisories now appear
• V1 endpoint produces identical output (backward compatible)
• All tests pass

Deployment

• Backward compatible: V1 endpoint unchanged
• No schema changes: ORM uses property pattern
• No migration required: Works with existing data
• Module advisories appear automatically after deployment

Files Changed

apollo/db/__init__.py                     |  30 +++
apollo/server/routes/api_updateinfo.py    | 251 +++
apollo/tests/BUILD.bazel                  |   8 +
apollo/tests/test_api_updateinfo.py       | 182 +++
.github/workflows/test.yaml               |   1 +