[Search DV] Display deprecation and vulnerabilities on search page.

src/Bootstrap/less/theme/common-list-packages.less

@@ -58,3 +58,30 @@
   margin-top: 75px;
   margin-bottom: 0px;
 }
+
+@severe-warning-background-color: rgb(254, 217, 204);
+@severe-warning-icon-color: rgb(216, 59, 1);
+@warning-background-color: rgb(255, 244, 206);
+@package-warning-color: rgb(50, 49, 48);
+@badge-border-radius: 2px;
+
+.package-warning {
+  padding-right: 8px;
+  padding-left: 8px;
+  border-radius: @badge-border-radius;
+  margin-right: 5px;
+  color: @package-warning-color
+}
+
+.package-warning--vulnerable {
+  .package-warning;
+  background-color: @severe-warning-background-color;
+  i {
+    color: @severe-warning-icon-color;
+  }
+}
+
+.package-warning--deprecated {
+  .package-warning;
+  background-color: @warning-background-color;
+}

src/NuGet.Services.Entities/AlternatePackage.cs

@@ -0,0 +1,12 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+namespace NuGet.Services.Entities
+{
+    public class AlternatePackage
+    {
+        public string Id { get; set; }
+
+        public string Range { get; set; }
+    }
+}

src/NuGet.Services.Entities/Deprecation.cs

@@ -0,0 +1,14 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+namespace NuGet.Services.Entities
+{
+    public class Deprecation
+    {
+        public AlternatePackage AlternatePackage { get; set; }
+
+        public string Message { get; set; }
+
+        public string[] Reasons { get; set; }
+    }
+}

src/NuGet.Services.Entities/Package.cs

@@ -310,5 +310,17 @@ public string Id
         public bool HasEmbeddedIcon { get; set; }
 
         public EmbeddedReadmeFileType EmbeddedReadmeType { get; set; }
+
+        /// <summary>
+        /// Deprecation data retrieved from search service.
+        /// </summary>
+        [NotMapped]
+        public Deprecation Deprecation { get; set; }
+
+        /// <summary>
+        /// Vulnerability data retrieved from search service.
+        /// </summary>
+        [NotMapped]
+        public IReadOnlyList<Vulnerability> Vulnerabilities { get; set; }
     }
 }

src/NuGet.Services.Entities/Vulnerability.cs

@@ -0,0 +1,12 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+namespace NuGet.Services.Entities
+{
+    public class Vulnerability
+    {
+        public string AdvisoryURL { get; set; }
+
+        public int Severity { get; set; }
+    }
+}

src/NuGetGallery/Helpers/ViewModelExtensions/ListPackageItemViewModelFactory.cs

@@ -39,6 +39,8 @@ private ListPackageItemViewModel SetupInternal(ListPackageItemViewModel viewMode
             viewModel.MinClientVersion = package.MinClientVersion;
             viewModel.Owners = package.PackageRegistration?.Owners?.Select(GetBasicUserViewModel).ToList();
             viewModel.IsVerified = package.PackageRegistration?.IsVerified;
+            viewModel.IsDeprecated = package.Deprecation?.Reasons?.Length > 0;
+            viewModel.IsVulnerable = package.Vulnerabilities?.Count > 0;
 
             viewModel.CanDisplayPrivateMetadata = CanPerformAction(currentUser, package, ActionsRequiringPermissions.DisplayPrivatePackageMetadata);
             viewModel.CanEdit = CanPerformAction(currentUser, package, ActionsRequiringPermissions.EditPackage);

src/NuGetGallery/Infrastructure/Lucene/ExternalSearchService.cs

@@ -205,6 +205,49 @@ internal static Package ReadPackage(JObject doc, string semVerLevel)
             var isLatestStable = doc.Value<bool>("IsLatestStable");
             var semVer2 = SemVerLevelKey.ForSemVerLevel(semVerLevel) == SemVerLevelKey.SemVer2;
 
+            var docDeprecation = doc["Deprecation"];
+            Deprecation deprecation = null;
+            if (docDeprecation != null)
+            {
+                var docReasons = docDeprecation.Value<JArray>("Reasons");
+                if (docReasons != null && docReasons.HasValues)
+                {
+                    var reasons = docReasons
+                        .Select(v => v.Value<string>())
+                        .ToArray();
+
+                    var docAlternatePackage = docDeprecation["AlternatePackage"];
+                    AlternatePackage alternatePackage = null;
+                    if (docAlternatePackage != null)
+                    {
+                        alternatePackage = new AlternatePackage()
+                        {
+                            Id = docAlternatePackage.Value<string>("Id"),
+                            Range = docAlternatePackage.Value<string>("Range")
+                        };
+                    }
+
+                    deprecation = new Deprecation()
+                    {
+                        Message = docDeprecation.Value<string>("Message"),
+                        Reasons = reasons,
+                        AlternatePackage = alternatePackage
+                    };
+                }
+            }
+
+            var docVulnerabilities = doc.Value<JArray>("Vulnerabilities");
+            var vulnerabilities = new List<Vulnerability>();
+            if (docVulnerabilities != null)
+            {
+                vulnerabilities = docVulnerabilities.Select(obj => new Vulnerability()
+                {
+                    AdvisoryURL = obj.Value<string>("AdvisoryURL"),
+                    Severity = obj.Value<int>("Severity")
+                })
+                .ToList();
+            }
+
             return new Package
             {
                 Copyright = doc.Value<string>("Copyright"),
@@ -243,7 +286,9 @@ internal static Package ReadPackage(JObject doc, string semVerLevel)
                 LicenseNames = doc.Value<string>("LicenseNames"),
                 LicenseReportUrl = doc.Value<string>("LicenseReportUrl"),
                 HideLicenseReport = doc.Value<bool>("HideLicenseReport"),
-                Listed = doc.Value<bool>("Listed")
+                Listed = doc.Value<bool>("Listed"),
+                Deprecation = deprecation,
+                Vulnerabilities = vulnerabilities
             };
         }
 

src/NuGetGallery/NuGetGallery.csproj

@@ -1444,7 +1444,6 @@
     <Compile Include="Services\NullReportService.cs" />
     <Compile Include="Services\NullStatisticsService.cs" />
     <Compile Include="Services\PackageFileService.cs" />
-    <Compile Include="Services\PackageSearchResults.cs" />
     <Compile Include="Services\JsonAggregateStatsService.cs" />
     <Compile Include="Services\SearchResults.cs" />
     <Compile Include="Services\SqlAggregateStatsService.cs" />

src/NuGetGallery/ViewModels/PackageViewModel.cs

@@ -30,6 +30,7 @@ public class PackageViewModel : IPackageVersionModel
         public string FullVersion { get; set; }
         public PackageStatusSummary PackageStatusSummary { get; set; }
         public bool IsVulnerable { get; set; }
+        public bool IsDeprecated { get; set; }
 
         public bool IsCurrent(IPackageVersionModel current)
         {

src/NuGetGallery/Views/Shared/_ListPackage.cshtml

@@ -38,19 +38,16 @@
             <div class="package-header">
                 <a class="package-title"
                    href="@Url.Package(Model.Id, Model.UseVersion ? Model.Version : null).TrimEnd('/')"
-                   @if (itemIndex.HasValue)
-                   {
-                        @:data-track="@eventName" data-track-value="@itemIndex"
-                        @:data-package-id="@Model.Id" data-package-version="@Model.Version" data-use-version="@Model.UseVersion"
-                   }
-                   >@Html.BreakWord(Model.Id)</a>
+                   @if (itemIndex.HasValue) { @: data-track="@eventName" data-track-value="@itemIndex"
+                    @: data-package-id="@Model.Id" data-package-version="@Model.Version" data-use-version="@Model.UseVersion"
+                   }>@Html.BreakWord(Model.Id)</a>
 
                 @if (Model.IsVerified.HasValue && Model.IsVerified.Value)
                 {
                     <img class="reserved-indicator"
                          src="~/Content/gallery/img/reserved-indicator.svg"
                          @ViewHelpers.ImageFallback(Url.Absolute("~/Content/gallery/img/reserved-indicator-20x20.png"))
-                         data-content="@Strings.ReservedNamespace_ReservedIndicatorTooltip" tabindex="0" alt="@Strings.ReservedNamespace_ReservedIndicatorTooltip"/>
+                         data-content="@Strings.ReservedNamespace_ReservedIndicatorTooltip" tabindex="0" alt="@Strings.ReservedNamespace_ReservedIndicatorTooltip" />
                 }
 
                 @if (showEditButton && (Model.CanEdit || Model.CanManageOwners || Model.CanUnlistOrRelist))
@@ -72,6 +69,29 @@
                 }
             </div>
 
+
+            @if(Model.IsVulnerable || Model.IsDeprecated)
+            {
+                <ul class="package-list">
+                    <li>
+                        @if(Model.IsVulnerable)
+                        {
+                            <span class="icon-text package-warning--vulnerable">
+                                <i class="ms-Icon ms-Icon--BlockedSiteSolid12" aria-hidden="true"></i>
+                                Vulnerable
+                            </span>
+                        }
+                        @if(Model.IsDeprecated)
+                        {
+                            <span class="icon-text package-warning--deprecated">
+                                <i class="ms-Icon ms-Icon--ShieldAlert" aria-hidden="true"></i>
+                                Deprecated
+                            </span>
+                        }
+                    </li>
+                </ul>
+            }
+
             <ul class="package-list">
                 <li>
                     <span class="icon-text">

tests/NuGetGallery.Facts/Helpers/DeprecationItemsHelper.cs

@@ -0,0 +1,71 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using NuGet.Services.Entities;
+using System.Collections.Generic;
+
+namespace NuGetGallery.Helpers
+{
+    public static class DeprecationItemsHelper
+    {
+        public static IEnumerable<object[]> ValidObjects
+        {
+            get
+            {
+                yield return new object[] {
+                        new Deprecation()
+                        {
+                            Message = "message",
+                            Reasons = new [] { "Other", "Legacy", "CriticalBugs" },
+                            AlternatePackage = new AlternatePackage() {
+                                Id = "AnotherId",
+                                Range = "[13.0.2-beta1, )"
+                            }
+                        }
+                    };
+                yield return new object[] {
+                        new Deprecation()
+                        {
+                            Reasons = new [] { "Other", "Legacy", "CriticalBugs" },
+                            AlternatePackage = new AlternatePackage() {
+                                Id = "AnotherId",
+                                Range = "[13.0.2-beta1, )"
+                            }
+                        }
+                    };
+                yield return new object[] {
+                        new Deprecation()
+                        {
+                            Message = "message",
+                            Reasons = new [] { "Other", "Legacy", "CriticalBugs" },
+                        }
+                    };
+                yield return new object[] {
+                        new Deprecation()
+                        {
+                            Reasons = new [] { "Legacy" },
+                        }
+                    };
+            }
+        }
+
+        public static IEnumerable<object[]> InvalidObjects
+        {
+            get
+            {
+                yield return new object[] {
+                        new Deprecation()
+                        {
+                            Message = "message",
+                            AlternatePackage = new AlternatePackage() {
+                                Id = "AnotherId",
+                                Range = "[13.0.2-beta1, )"
+                            }
+                        }
+                    };
+                yield return new object[] { new Deprecation() };
+                yield return new object[] { null };
+            }
+        }
+    }
+}

tests/NuGetGallery.Facts/Helpers/VulnerabilityItemsHelper.cs

@@ -0,0 +1,50 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using NuGet.Services.Entities;
+using System.Collections.Generic;
+
+namespace NuGetGallery.Helpers
+{
+    public static class VulnerabilityItemsHelper
+    {
+        public static IEnumerable<object[]> ValidObjects
+        {
+            get
+            {
+                yield return new object[] {
+                        new List<Vulnerability>() {
+                            new Vulnerability()
+                            {
+                                AdvisoryURL = "url",
+                                Severity = 1
+                            }
+                        }
+                    };
+                yield return new object[] {
+                        new List<Vulnerability>() {
+                            new Vulnerability()
+                            {
+                                AdvisoryURL = "url",
+                                Severity = 1
+                            },
+                            new Vulnerability()
+                            {
+                                AdvisoryURL = "url",
+                                Severity = 2
+                            }
+                        }
+                    };
+            }
+        }
+
+        public static IEnumerable<object[]> InvalidObjects
+        {
+            get
+            {
+                yield return new object[] { new List<Vulnerability>() };
+                yield return new object[] { null };
+            }
+        }
+    }
+}