allow-policy-legacy 0.1.9

Legacy policy adapters for cargo-allow migrations.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137

use allow_core::{CargoAllowError, CargoAllowResult};
use toml::Value;

use crate::fields::{legacy_evidence, string_field};
use crate::parser_support::normalize_legacy_expires;
use crate::types::LegacyExecutableRule;

pub(crate) fn parse_executable_rules(
    table: &toml::Table,
) -> CargoAllowResult<Vec<LegacyExecutableRule>> {
    let entries = table
        .get("allow")
        .and_then(Value::as_array)
        .ok_or_else(|| CargoAllowError::new("executable-allowlist missing allow entries"))?;
    entries
        .iter()
        .enumerate()
        .map(|(index, entry)| parse_executable_rule(index, entry))
        .collect()
}

fn parse_executable_rule(index: usize, entry: &Value) -> CargoAllowResult<LegacyExecutableRule> {
    let table = entry.as_table().ok_or_else(|| {
        CargoAllowError::new(format!("executable allow entry {index} is not a table"))
    })?;
    let id = string_field(table, "id").unwrap_or_else(|| format!("legacy-executable-{index:04}"));
    let path = string_field(table, "path")
        .ok_or_else(|| CargoAllowError::new(format!("{id} missing path")))?;
    Ok(LegacyExecutableRule {
        id,
        path,
        owner: string_field(table, "owner").unwrap_or_default(),
        reason: string_field(table, "reason").unwrap_or_default(),
        interpreter: string_field(table, "interpreter"),
        evidence: legacy_evidence(table),
        created: string_field(table, "created"),
        review_after: string_field(table, "review_after"),
        expires: normalize_legacy_expires(string_field(table, "expires")),
    })
}

#[cfg(test)]
mod tests {
    use super::*;

    fn parse_table(input: &str) -> toml::Table {
        toml::from_str::<toml::Table>(input)
            .unwrap_or_else(|err| std::panic::panic_any(format!("test TOML parses: {err}")))
    }

    #[test]
    fn parse_executable_rules_preserves_metadata_lifecycle_and_evidence() {
        let table = parse_table(
            r#"
[[allow]]
id = "exec-release-script"
path = "scripts/release.ps1"
owner = "release"
reason = "Release script keeps executable mode."
interpreter = "powershell"
evidence = ["doc:docs/release.md", "test:package-proof"]
created = "2026-05-09"
review_after = "2026-09-09"
expires = "permanent"

[[allow]]
path = "scripts/tool"
covered_by = "test:script-mode"
"#,
        );

        let mut rules = parse_executable_rules(&table)
            .unwrap_or_else(|err| std::panic::panic_any(format!("executable rules parse: {err}")));

        assert_eq!(rules.len(), 2);
        let full_rule = rules.remove(0);
        assert_eq!(full_rule.id, "exec-release-script");
        assert_eq!(full_rule.path, "scripts/release.ps1");
        assert_eq!(full_rule.owner, "release");
        assert_eq!(full_rule.reason, "Release script keeps executable mode.");
        assert_eq!(full_rule.interpreter.as_deref(), Some("powershell"));
        assert_eq!(
            full_rule.evidence,
            vec![
                "doc:docs/release.md".to_string(),
                "test:package-proof".to_string(),
            ]
        );
        assert_eq!(full_rule.created.as_deref(), Some("2026-05-09"));
        assert_eq!(full_rule.review_after.as_deref(), Some("2026-09-09"));
        assert_eq!(full_rule.expires.as_deref(), Some("never"));

        let minimal_rule = rules.remove(0);
        assert_eq!(minimal_rule.id, "legacy-executable-0001");
        assert_eq!(minimal_rule.path, "scripts/tool");
        assert!(minimal_rule.owner.is_empty());
        assert!(minimal_rule.reason.is_empty());
        assert!(minimal_rule.interpreter.is_none());
        assert_eq!(minimal_rule.evidence, vec!["test:script-mode".to_string()]);
        assert!(minimal_rule.created.is_none());
        assert!(minimal_rule.review_after.is_none());
        assert!(minimal_rule.expires.is_none());
    }

    #[test]
    fn parse_executable_rules_reports_expected_errors() {
        let missing_entries = parse_table("policy = \"executable-allowlist\"");
        let err = parse_executable_rules(&missing_entries)
            .err()
            .unwrap_or_else(|| std::panic::panic_any("entries are required"));
        assert!(
            err.to_string()
                .contains("executable-allowlist missing allow entries")
        );

        let non_table = parse_table("allow = [\"not a table\"]");
        let err = parse_executable_rules(&non_table)
            .err()
            .unwrap_or_else(|| std::panic::panic_any("entry must be a table"));
        assert!(
            err.to_string()
                .contains("executable allow entry 0 is not a table")
        );

        let missing_path = parse_table(
            r#"
[[allow]]
id = "exec-missing"
owner = "release"
"#,
        );
        let err = parse_executable_rules(&missing_path)
            .err()
            .unwrap_or_else(|| std::panic::panic_any("path is required"));
        assert!(err.to_string().contains("exec-missing missing path"));
    }
}