refactor(reorg): extract every type of class into modules [10/10]

[valentijnscholten]

Stacked PRs

This is one of a stacked series that reorganizes dojo/ into self-contained dojo/{module}/ packages (matching the dojo/url/ reference). They are stacked — each PR is based on the previous one — so review and merge bottom-up in this order:

1. refactor(product_type): Extra ProductType models into dojo/product_type/ module [1/10] #14970 — product_type
2. refactor(test): Extract Test models into dojo/test/ module [2/10] #14971 — test
3. refactor(engagement): Extract Test models into dojo/test/ module [3/10] #14972 — engagement
4. refactor(product): Extract Product module into dojo/product/ [4/10] #14973 — product
5. refactor(finding): Reorganize finding into self-contained dojo/finding/ package [5/10] #14974 — finding (+ CWE & BurpRawRequestResponse fold-in)
6. refactor(reorg): extract user + system_settings modules [6/10] #14981 — peripheral: user + system_settings
7. refactor(reorg): extract endpoint + tool_type/tool_config/tool_product modules [7/10] #14982 — peripheral: endpoint + tool_type/tool_config/tool_product
8. refactor(reorg): extract survey + benchmark modules [8/10] #14983 — peripheral: survey + benchmark
9. refactor(reorg): extract notes/note_type/file_uploads/reports/risk_acceptance [9/10] #14986 — peripheral: notes/note_type + file_uploads + reports + risk_acceptance
10. refactor(reorg): extract every type of class into modules [10/10] #14987 — peripheral: regulations + banner + announcement + development_environment + object ◀ this PR

Merge #14970 first; each following branch is rebased onto the updated base and merged in turn. This PR is the top of the stack (on top of #14986) — full implementation brief is the Phase 10 section in AGENTS.md.

Summary

Reorganizes the regulations, banner, announcement, development_environment, and object domains into self-contained dojo/{module}/ packages with ui/ (and, where an API exists, api/) sub-packages, matching the dojo/url/ reference layout. Pure code-movement: no behaviour or migration changes; backward-compat re-exports keep external consumers working.

regulations / development_environment / announcement (have API layers)

• Move Regulation, Development_Environment, Announcement, UserAnnouncement into their {models,admin}.py (string-ref FKs). The ANNOUNCEMENT_STYLE_CHOICES constant moves into dojo/announcement/models.py (re-exported from dojo.models).
• Move RegulationSerializer/DevelopmentEnvironmentSerializer/AnnouncementSerializer into each module's api/serializer.py (re-exported from api_v2/serializers.py for prefetcher discovery), and RegulationsViewSet/DevelopmentEnvironmentViewSet/AnnouncementViewSet into api/views.py with add_*_urls, preserving routes/basenames.
• Move the forms into each module's ui/forms.py and views.py/urls.py into ui/; announcement/os_message.py and signals.py stay.

banner / object (no API layer)

• Move BannerConf and Objects_Review/Objects_Product into their {models,admin}.py (string-ref FKs; the tagulous.admin.register(Objects_Product.tags) registration moves to dojo/object/admin.py). Move LoginBanner and the object settings forms into each module's ui/forms.py, and views.py/urls.py into ui/.

[valentijnscholten]

As all the classes/methods are still re-exported from their old locations, the dojo-pro codebase still builds and runs fine.

[dryrunsecurity]

This pull request introduces a high-severity security vulnerability by missing authorization checks in the configure_announcement view, allowing any authenticated user to access, modify, or delete site-wide announcements that should be restricted to administrative staff.

🟠 Missing Authorization Checks in dojo/announcement/ui/views.py (drs_cc8fc769)

Vulnerability	Missing Authorization Checks
Description	The announcement management view 'configure_announcement' lacks any authorization decorators or explicit permission checks. This allows any authenticated user to access, modify, or delete site-wide announcements, which should be restricted to administrative or staff users.

django-DefectDojo/dojo/announcement/ui/views.py

Lines 7 to 14 in e0a0fef

	from django.utils.translation import gettext
	from django.utils.translation import gettext_lazy as _
	from dojo.announcement.models import Announcement, UserAnnouncement
	from dojo.announcement.ui.forms import AnnouncementCreateForm, AnnouncementRemoveForm
	from dojo.utils import add_breadcrumb
	logger = logging.getLogger(__name__)

---

Comment to provide feedback on these findings.

Report false positive: @dryrunsecurity fp [FINDING ID] [FEEDBACK]
Report low-impact: @dryrunsecurity nit [FINDING ID] [FEEDBACK]

Example: @dryrunsecurity fp drs_90eda195 This code is not user-facing

All finding details can be found in the DryRun Security Dashboard.

[mtesauro]

Approved