OWASP / OWASP/Nest

Enable real project health score in production

Open
#3,992 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
451
Forks
702
Avg merge
22h 59m
Merged PRs (30d)
91

Description

**Describe the issue**

`idx_health_score` in `backend/apps/owasp/models/mixins/project.py` (line 43) returns `DEFAULT_HEALTH_SCORE` in production instead of the real computed `self.health_score`. There is an in-code TODO to enable the real score when ready. Production search ranking therefore uses a constant (100) for every project instead of actual health data.

**Current behavior**

- In production, `idx_health_score` returns `DEFAULT_HEALTH_SCORE` (100) for all projects.
- In development, it correctly returns `self.health_score`.

Relevant code (lines 40–43):

```python
return DEFAULT_HEALTH_SCORE if settings.IS_PRODUCTION_ENVIRONMENT else self.health_score
```

**Expected behavior**

- `idx_health_score` should return `self.health_score` in all environments so that indexing and search ranking use the real project health score everywhere. Projects without metrics should get `None` (Algolia handles null in ranking).

**Are you going to work on this?**

- [x] Yes
- [ ] No

**Proposed solution**

**Context:** `health_score` is already a computed property on `Project`. Algolia uses `idx_health_score` for ranking; real scores give accurate search. The current production behavior flattens ranking.

1. **Code change** — In `backend/apps/owasp/models/mixins/project.py`, replace `idx_health_score` (lines 40–43) with:

```python
@property
def idx_health_score(self) -> float | None:
"""Return health score for indexing."""
return self.health_score
```

Remove the TODO and the environment branch. Remove unused `settings` and `DEFAULT_HEALTH_SCORE` from this file if no longer referenced.

2. **Tests** — In `backend/tests/apps/owasp/models/project_test.py`: (a) With real score, assert `project.idx_health_score == project.health_score` and same when `IS_PRODUCTION_ENVIRONMENT` is patched to `True`; (b) With no metrics, assert `project.idx_health_score is None`. Run `make check-test`.

3. **After deployment** — Re-run indexing in production so the Algolia index gets updated `idx_health_score` values.

**Additional context**

- **Acceptance criteria:** `idx_health_score` returns `self.health_score` in all environments; TODO removed; tests added; re-indexing run after deployment.
- **Labels:** `enhancement`, `backend`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.