1use allow_core::json_escape;
2
3use crate::DiffReport;
4use crate::json::{json_string_array, option_json};
5use crate::{REPORT_COMMAND_DIFF, REPORT_SCHEMA_ID};
6
7pub fn render_diff_json_with_posture(report_json: &str, report: DiffReport<'_>) -> Option<String> {
8 if !is_diff_report_artifact(report_json) {
9 return None;
10 }
11 let diff_json = render_diff_posture_json(report);
12 let trimmed = report_json.trim_end();
13 trimmed
14 .strip_suffix('}')
15 .map(|prefix| format!("{prefix},\n \"diff\": {diff_json}\n}}\n"))
16}
17
18fn is_diff_report_artifact(report_json: &str) -> bool {
19 contains_json_string_field(report_json, "schema_id", REPORT_SCHEMA_ID)
20 && contains_json_string_field(report_json, "command", REPORT_COMMAND_DIFF)
21}
22
23fn contains_json_string_field(json: &str, field: &str, value: &str) -> bool {
24 let spaced = format!("\"{field}\": \"{value}\"");
25 let compact = format!("\"{field}\":\"{value}\"");
26 json.contains(&spaced) || json.contains(&compact)
27}
28
29pub(crate) fn render_diff_posture_json(report: DiffReport<'_>) -> String {
30 let mut out = String::new();
31 out.push_str("{\n");
32 out.push_str(&format!(
33 " \"net_posture\": \"{}\",\n",
34 json_escape(report.net_posture)
35 ));
36 out.push_str(&format!(
37 " \"reviewer_action\": \"{}\",\n",
38 json_escape(report.reviewer_action)
39 ));
40 out.push_str(" \"summary\": {\n");
41 out.push_str(&format!(
42 " \"current_failures\": {},\n",
43 report.summary.current_failures
44 ));
45 out.push_str(&format!(
46 " \"new_findings\": {},\n",
47 report.summary.new_findings
48 ));
49 out.push_str(&format!(
50 " \"removed_findings\": {},\n",
51 report.summary.removed_findings
52 ));
53 out.push_str(&format!(
54 " \"policy_failures\": {},\n",
55 report.summary.policy_failures
56 ));
57 out.push_str(&format!(
58 " \"policy_review_items\": {},\n",
59 report.summary.policy_review_items
60 ));
61 out.push_str(&format!(
62 " \"policy_improvements\": {}\n",
63 report.summary.policy_improvements
64 ));
65 out.push_str(" },\n");
66 out.push_str(" \"finding_changes\": [\n");
67 for (index, change) in report.finding_changes.iter().enumerate() {
68 if index > 0 {
69 out.push_str(",\n");
70 }
71 out.push_str(" {");
72 out.push_str(&format!("\"change\": \"{}\", ", json_escape(change.change)));
73 out.push_str(&format!("\"key\": \"{}\", ", json_escape(change.key)));
74 out.push_str(&format!("\"kind\": \"{}\", ", json_escape(change.kind)));
75 out.push_str(&format!("\"family\": {}, ", option_json(change.family)));
76 out.push_str(&format!("\"path\": \"{}\"", json_escape(change.path)));
77 out.push('}');
78 }
79 out.push_str("\n ],\n");
80 out.push_str(" \"policy_changes\": [\n");
81 for (index, change) in report.policy_changes.iter().enumerate() {
82 if index > 0 {
83 out.push_str(",\n");
84 }
85 out.push_str(" {");
86 out.push_str(&format!(
87 "\"severity\": \"{}\", ",
88 json_escape(change.severity)
89 ));
90 out.push_str(&format!(
91 "\"allow_id\": \"{}\", ",
92 json_escape(change.allow_id)
93 ));
94 out.push_str(&format!("\"kind\": \"{}\", ", json_escape(change.kind)));
95 out.push_str(&format!("\"message\": \"{}\"", json_escape(change.message)));
96 if let Some(exception_identity) = change.exception_identity {
97 out.push_str(", ");
98 out.push_str(&format!(
99 "\"exception_identity\": {{\"field\": \"{}\", \"before\": {}, \"after\": {}}}",
100 json_escape(exception_identity.field),
101 option_json(exception_identity.before),
102 option_json(exception_identity.after)
103 ));
104 }
105 if let Some(selector_identity) = change.selector_identity {
106 out.push_str(", ");
107 out.push_str(&format!(
108 "\"selector_identity\": {{\"changed_fields\": {}}}",
109 json_string_array(selector_identity.changed_fields)
110 ));
111 }
112 if let Some(selector_precision) = change.selector_precision {
113 out.push_str(", ");
114 out.push_str(&format!(
115 "\"selector_precision\": {{\"before\": {}, \"after\": {}, \"removed_fields\": {}, \"added_fields\": {}}}",
116 selector_precision.before,
117 selector_precision.after,
118 json_string_array(selector_precision.removed_fields),
119 json_string_array(selector_precision.added_fields)
120 ));
121 }
122 if let Some(scope) = change.scope {
123 out.push_str(", ");
124 out.push_str(&format!(
125 "\"scope\": {{\"field\": \"{}\", \"before\": {}, \"after\": {}}}",
126 json_escape(scope.field),
127 option_json(scope.before),
128 option_json(scope.after)
129 ));
130 }
131 if let Some(limit) = change.occurrence_limit {
132 out.push_str(", ");
133 out.push_str(&format!(
134 "\"occurrence_limit\": {{\"before\": {}, \"after\": {}}}",
135 option_u32_json(limit.before),
136 option_u32_json(limit.after)
137 ));
138 }
139 if let Some(lifecycle) = change.lifecycle {
140 out.push_str(", ");
141 out.push_str(&format!(
142 "\"lifecycle\": {{\"field\": \"{}\", \"before\": {}, \"after\": {}}}",
143 json_escape(lifecycle.field),
144 option_json(lifecycle.before),
145 option_json(lifecycle.after)
146 ));
147 }
148 if let Some(evidence) = change.evidence {
149 out.push_str(", ");
150 out.push_str(&format!(
151 "\"evidence\": {{\"field\": \"{}\", \"removed\": {}, \"added\": {}}}",
152 json_escape(evidence.field),
153 json_string_array(evidence.removed),
154 json_string_array(evidence.added)
155 ));
156 }
157 if let Some(metadata) = change.metadata {
158 out.push_str(", ");
159 out.push_str(&format!(
160 "\"metadata\": {{\"field\": \"{}\", \"before\": {}, \"after\": {}}}",
161 json_escape(metadata.field),
162 option_json(metadata.before),
163 option_json(metadata.after)
164 ));
165 }
166 if let Some(requirement) = change.requirement {
167 out.push_str(", ");
168 out.push_str(&format!(
169 "\"requirement\": {{\"field\": \"{}\", \"before\": {}, \"after\": {}}}",
170 json_escape(requirement.field),
171 requirement.before,
172 requirement.after
173 ));
174 }
175 if let Some(policy_status) = change.policy_status {
176 out.push_str(", ");
177 out.push_str(&format!(
178 "\"policy_status\": {{\"before\": {}, \"after\": {}}}",
179 option_json(policy_status.before),
180 option_json(policy_status.after)
181 ));
182 }
183 out.push('}');
184 }
185 out.push_str("\n ]\n");
186 out.push_str(" }");
187 out
188}
189
190fn option_u32_json(value: Option<u32>) -> String {
191 value.map_or_else(|| "null".to_string(), |value| value.to_string())
192}