refactor(product): Extract Product module into dojo/product/ [4/10]

[valentijnscholten]

Stacked PRs

This is one of a stacked series that reorganizes dojo/ into self-contained dojo/{module}/ packages (matching the dojo/url/ reference). They are stacked — each PR is based on the previous one — so review and merge bottom-up in this order:

1. refactor(product_type): Extra ProductType models into dojo/product_type/ module [1/10] #14970 — product_type
2. refactor(test): Extract Test models into dojo/test/ module [2/10] #14971 — test
3. refactor(engagement): Extract Test models into dojo/test/ module [3/10] #14972 — engagement
4. refactor(product): Extract Product module into dojo/product/ [4/10] #14973 — product ◀ this PR
5. refactor(finding): Reorganize finding into self-contained dojo/finding/ package [5/10] #14974 — finding (+ CWE & BurpRawRequestResponse fold-in)
6. refactor(reorg): extract user + system_settings modules [6/10] #14981 — peripheral: user + system_settings
7. refactor(reorg): extract endpoint + tool_type/tool_config/tool_product modules [7/10] #14982 — peripheral: endpoint + tool_type/tool_config/tool_product
8. refactor(reorg): extract survey + benchmark modules [8/10] #14983 — peripheral: survey + benchmark
9. refactor(reorg): extract notes/note_type/file_uploads/reports/risk_acceptance [9/10] #14986 — peripheral: notes/note_type + file_uploads + reports + risk_acceptance
10. refactor(reorg): extract regulations/banner/announcement/development_environment/object [10/10] #14987 — peripheral: regulations + banner + announcement + development_environment + object

Merge #14970 first; each following branch is rebased onto the updated base and merged in turn. PRs 6–10 (draft, head branches on the DefectDojo upstream repo) continue the stack on top of #14974 — full implementation brief is the Phase 10 section in AGENTS.md.

Summary

Reorganizes the Product domain into a self-contained dojo/product/ package (models + ui/ + api/), matching the dojo/url/ reference and the completed dojo/test/ and dojo/engagement/ modules.

Models

• Move Product, Product_Line, Product_API_Scan_Configuration + admin into dojo/product/{models,admin}.py. Product_Member/Product_Group stay in dojo/authorization/.
• Cross-module FKs use string references; Product methods querying Finding/Engagement use lazy imports. Identical migrations.

Forms + UI filters → dojo/product/ui/

• Move the product forms (ProductForm, DeleteProductForm, Add_Product_AuthorizedUsersForm, Authorize_User_For_ProductsForm, ProductCountsFormBase, ProductTagCountsForm, Product_API_Scan_ConfigurationForm, DeleteProduct_API_Scan_ConfigurationForm) into ui/forms.py.
• Move the product UI filters (ProductComponentFilter, ComponentFilter(+WithoutObjectLookups), ProductFilterHelper, ProductFilter(+WithoutObjectLookups)) into ui/filters.py. ProductSLAFilter stays in dojo/filters.py as a shared base (also used by the asset API and ApiProductFilter).
• dojo/forms.py keeps re-exports only for symbols still consumed outside the module (ProductCountsFormBase, ProductTagCountsForm, Authorize_User_For_ProductsForm); filter consumers (dojo/components/, dojo/product_type/) are repointed to the new path to avoid a dojo.filters import cycle.

Views → dojo/product/ui/views.py

• Move dojo/product/views.py into ui/views.py; update dojo/asset/urls.py and dojo/organization/urls.py imports.
• No services.py: product views are CRUD + metrics-display queries with no extractable workflow (matches the product_type reference).

API layer → dojo/product/api/

• Move ProductSerializer, ProductAPIScanConfigurationSerializer, ProductMetaSerializer into api/serializer.py (tags via a lazy get_fields() to avoid the api_v2.serializers cycle), ApiProductFilter into api/filters.py, and ProductViewSet + ProductAPIScanConfigurationViewSet into api/views.py.
• api/urls.py registers both viewsets; dojo/urls.py calls add_product_urls(v2_api). Routes and basenames (products/product, product_api_scan_configurations/product_api_scan_configuration) are unchanged.
• api_v2/serializers.py keeps re-exports for ProductSerializer (used by ReportGenerateSerializer) and ProductMetaSerializer (used by the asset API); the viewset is not re-exported (would cycle), so dojo/urls.py and unittests/test_rest_framework.py are repointed.

Backward-compat re-exports keep existing consumers unchanged. No migration change.