feat: API endpoint for matching training data by DarshanCode2005 · Pull Request #1204 · NixOS/nix-security-tracker

DarshanCode2005 · 2026-07-20T06:41:26Z

Summary

Add GET /api/v1/matching/training-data for maintainer export of curated matching proposals (Endpoint for training data on matching #1038)
Auth: Knox/session + admin (isadmin: staff or security team)
Paginated (50 default, max 100), payload uses the shared feat: matching training data schema and roundtrip #1203 export schema

Related files to this PR

src/api/matching/*
src/api/tests/test_matching_training_data.py

fricklerhandwerk · 2026-07-20T12:02:58Z

    path("v1/server-info", ServerInfoView.as_view(), name="server-info"),
    path("v1/tokens/me", TokenManagementView.as_view(), name="token-management"),
+    path(
+        "v1/matching/training-data",


@florentc opinions on where to put this, since you've been touching a lot of this recently?

Not really.

Seems to me this is not an API endpoint a regular sec tracker user would use. If it's an admin restricted thing I guess it should live under a v1/admin prefix.

I don't see what else we would put under matching beside training-data. Do we have future endpoints in mind? If not maybe let's flatten the route.

fricklerhandwerk · 2026-07-20T12:08:55Z

+    """Staff or security-team members (see shared.auth.isadmin)."""
+
+    def has_permission(self, request: Request, view: APIView) -> bool:  # pyright: ignore[reportIncompatibleMethodOverride]
+        return bool(request.user and isadmin(request.user))


Should probably be a separate role so contributors can obtain the samples

DarshanCode2005 · 2026-07-21T20:53:00Z

So should I change the route to v1/matching-training-data?

fricklerhandwerk · 2026-07-21T21:41:10Z

Yeah let's do that

DarshanCode2005 · 2026-07-21T22:33:04Z

Clarifying against the plan for #1038 : this endpoint is read-only export of curated proposals. Auth was intentionally locked to isadmin , because in the next follow-up PR fetch_matching_training_data will use a Knox/session token against staging/prod. You suggested a separate role so contributors can obtain samples. What I need to know:

Who is "contributor" here? : Matching-algorithm contributors outside security/committers, or should we reuse an existing bar (iscommitter/user_can_edit_suggestion)?
Should we widen access in this PR , or keep isadmin for this current PR and add a dedicated role when the Github team/ group exists?
Is the sensitivity of the payload ( labels, comments, overlays, rejection, reasons) a reason to keep this elevated, or is "any authenticated user who can mint a token" fine for public-ish training corpus?

fricklerhandwerk · 2026-07-21T23:02:09Z

Let's just make a new Django group and assign people manually via database for now

I suggest to hard-code that into a migration so we can't forget to deploy it.
As above
The concern is not sensitive data but server load. We don't have a concept for implementing rate limiting yet, so authentication to a limited group is the stopgap.

introduce schema_version=1 dataclasses and dict roundtrip helpers the offline matching corpus

Assert schema dict roundtrip, curated filter, export -> import -> re-export equality, auto-reject labels, and idempotent import by cve id

Replace hand-rolled dataclasses with round-tripping DRF serializers so export/import share the same validated wire format.

Move SCHEMA_VERSION into constants.py so serializers no longer import schema, and allow blank proposal comments during round-trip.

NixChannel.release_branch is now a foreign key and the repository field is gone, so the synthetic benchmark channel needs its own branch row.

Add untouched() for pending proposals and user_curated() for non-pending proposals, providing complementary helpers with shared vocabulary. This allows NixOS#1211 to use CVEDerivationClusterProposal.objects.untouched() instead of inlining status=PENDING, while training export can use user_curated(). Update docstrings to cross-reference both methods and add tests covering the complementary behavior.

Remove the hand-built _sample_record() helper from the schema tests. Build proposal objects using the existing fixtures and serialize them through CVEDerivationClusterProposal(...).data, matching the same code path used by the API. Keep the schema version test by mutating the serialized payload after export. This makes the tests exercise the production serializer instead of a manually constructed payload.

Inline the Organization.objects.get_or_create() call into create() and remove the _ensure_organization() helper. Keep the _TRAINING_ORG_UUID constant while avoiding an unnecessary single-use helper, as suggested during review.

Extract a shared derivation_as_key() helper in evaluation.py and have EvaluatedAttribute.as_key() delegate to it. Reuse the same helper during training import deduplication by constructing a deterministic synthetic drv_path from the derivation attribute, name, and system. This keeps the training data format portable while sharing the same keying logic as evaluation ingestion.

Drop duplicated nested OpenAPI field definitions; the API adapter subclasses the shared round-tripping schema.

Renumber the matching_training_data group migration after NixpkgsBranch landed as 0101, and drop the ruff-format blank line in the API view.

Reuse shared CVEDerivationClusterProposal serialization and user_curated queryset after the NixOS#1203 wrapper removed

fricklerhandwerk

Good! Just a few style nits in DarshanCode2005#3 (reviewed together)

- remove the redundant MatchingTrainingRecordSerializer adapter and use CVEDerivationClusterProposal directly - add make_client helper for API test clients - update the default client fixture to use make_client - simplify assertions for curated training-data responses - parameterize pagination tests across count and page size - use explicit formulas for expected pagination results - clean up unused imports and references to the removed serializer

github-project-automation Bot added this to Nixpkgs Vulnerability Tracker Jul 20, 2026

DarshanCode2005 requested a review from fricklerhandwerk July 20, 2026 06:42

DarshanCode2005 mentioned this pull request Jul 20, 2026

feat: matching training data schema and roundtrip #1203

Open

fricklerhandwerk reviewed Jul 20, 2026

View reviewed changes

DarshanCode2005 force-pushed the matching-training-api branch from b077e92 to cc729f5 Compare July 30, 2026 09:29

github-advanced-security AI found potential problems Jul 30, 2026

View reviewed changes

Comment thread src/shared/matching_training_data/schema.py Fixed

Comment thread src/shared/matching_training_data/schema.py Fixed

Comment thread src/shared/matching_training_data/serializers.py Fixed

DarshanCode2005 force-pushed the matching-training-api branch from cc729f5 to bb0c813 Compare July 30, 2026 10:32

DarshanCode2005 added 8 commits July 30, 2026 16:16

feat: add matching training-data schema

16b7ac9

introduce schema_version=1 dataclasses and dict roundtrip helpers the offline matching corpus

feat: export user-curated proposals to training schema

8f4bd5a

feat: import training records onto synthetic benchmark channel

4a428e3

test: cover matching training-data export/import roundtrip

d834544

Assert schema dict roundtrip, curated filter, export -> import -> re-export equality, auto-reject labels, and idempotent import by cve id

chore: formatting

4902ee2

refactor: use DRF serializers for matching training-data schema

473568f

Replace hand-rolled dataclasses with round-tripping DRF serializers so export/import share the same validated wire format.

fix: break matching training-data import cycle

bff6c83

Move SCHEMA_VERSION into constants.py so serializers no longer import schema, and allow blank proposal comments during round-trip.

fix: create benchmark channel via NixpkgsBranch

f02290b

NixChannel.release_branch is now a foreign key and the repository field is gone, so the synthetic benchmark channel needs its own branch row.

DarshanCode2005 force-pushed the matching-training-api branch from bb0c813 to 5cd87e9 Compare July 30, 2026 11:03

DarshanCode2005 mentioned this pull request Aug 3, 2026

feat: fetch and import matching training data commands #1233

Open

DarshanCode2005 added 3 commits August 5, 2026 04:31

feat: add user_curated queryset on proposals

2deb77c

refactor: replace matching training-data wrappers with modelserializers

731a2a0

test: cover ModelSerializer export and import roundtrip

e82ec34

DarshanCode2005 force-pushed the matching-training-api branch from 25b84a5 to 92f3fb1 Compare August 4, 2026 23:20

DarshanCode2005 added 4 commits August 6, 2026 04:38

refactor: use shared.models namespace in serializers

4b6444d

refactor: use fixed dummy hash instead of random token_hex

cbb20f9

DarshanCode2005 added 17 commits August 6, 2026 05:01

refactor: inline organization get_or_create logic

257910d

Inline the Organization.objects.get_or_create() call into create() and remove the _ensure_organization() helper. Keep the _TRAINING_ORG_UUID constant while avoiding an unnecessary single-use helper, as suggested during review.

chore: formatting

6e3c9a3

chore: update the doc-string

edbac1e

chore: update the docstring

fd8a1e4

fix: silence pyright on training-data serializers

6b1b352

chore: format PackageOverlay.to_representation for ruff

6336deb

feat: add admin-only matching training-data API

2f2894c

test: cover matching training-data API auth and pagination

7accee5

fix: CI errors

f9a049f

refactor: flatten matching training-data API path

4e5bb2a

feat: add matching_training_data Django group

1cac85b

feat: restrict training-data API to matching_training_data group

55add17

test: cover matching training-data group permission

dd187aa

refactor: reuse shared TrainingRecordSerializer in matching API

571160a

Drop duplicated nested OpenAPI field definitions; the API adapter subclasses the shared round-tripping schema.

fix: resolve training-data CI formatting and migration clash

ca6d6ec

Renumber the matching_training_data group migration after NixpkgsBranch landed as 0101, and drop the ruff-format blank line in the API view.

refactor: adapt matching training-data API to modelserializers

def739a

Reuse shared CVEDerivationClusterProposal serialization and user_curated queryset after the NixOS#1203 wrapper removed

DarshanCode2005 force-pushed the matching-training-api branch from 92f3fb1 to def739a Compare August 6, 2026 06:44

fricklerhandwerk approved these changes Aug 7, 2026

View reviewed changes

DarshanCode2005 mentioned this pull request Aug 10, 2026

feat: offline matching benchmark against training labels #1244

Open

Navigation Menu

Uh oh!

feat: API endpoint for matching training data - #1204

feat: API endpoint for matching training data#1204
DarshanCode2005 wants to merge 33 commits into
NixOS:mainfrom
DarshanCode2005:matching-training-api

DarshanCode2005 commented Jul 20, 2026

Uh oh!

fricklerhandwerk Jul 20, 2026

Uh oh!

florentc Jul 20, 2026 •

edited

Loading

Uh oh!

fricklerhandwerk Jul 20, 2026

Uh oh!

DarshanCode2005 commented Jul 21, 2026

Uh oh!

fricklerhandwerk commented Jul 21, 2026

Uh oh!

DarshanCode2005 commented Jul 21, 2026

Uh oh!

fricklerhandwerk commented Jul 21, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

fricklerhandwerk left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

DarshanCode2005 commented Jul 20, 2026

Summary

Related files to this PR

Uh oh!

fricklerhandwerk Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

florentc Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fricklerhandwerk Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

DarshanCode2005 commented Jul 21, 2026

Uh oh!

fricklerhandwerk commented Jul 21, 2026

Uh oh!

DarshanCode2005 commented Jul 21, 2026

Uh oh!

fricklerhandwerk commented Jul 21, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

fricklerhandwerk left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

florentc Jul 20, 2026 •

edited

Loading