allow-policy-legacy 0.1.9

pub(super) fn policy_fixture_text() -> String {
    let mut text = String::from(
        r#"schema_version = 1
policy = "non-rust-allowlist"
owner = "EffortlessMetrics"
status = "advisory"

"#,
    );
    push_allow(
        &mut text,
        r#"id = "non-rust-docs"
glob = "docs/**"
category = "documentation"
owner = "docs"
reason = "Repository policy prose."
broad_glob_reason = "Docs are intentionally tree-shaped."
created = "2026-05-09"
expires = "permanent"

"#,
    );
    push_allow(
        &mut text,
        r#"id = "non-rust-github-meta"
glob = ".github/**"
category = "ci_meta"
owner = "release/meta"
reason = "GitHub metadata."
broad_glob_reason = "Covers ancillary GitHub configuration."
created = "2026-05-09"
expires = "permanent"

"#,
    );
    push_allow(
        &mut text,
        r#"id = "non-rust-github-workflows"
glob = ".github/workflows/*.yml"
category = "ci_declarative"
owner = "release/ci"
reason = "GitHub Actions workflows."
broad_glob_reason = "Workflow detail lives in a companion ledger."
created = "2026-05-09"
expires = "permanent"

"#,
    );
    push_allow(
        &mut text,
        r#"id = "non-rust-ripr-config"
path = "ripr.toml"
category = "policy_config"
owner = "policy"
reason = "ripr configuration."
created = "2026-05-09"
expires = "permanent"
"#,
    );
    text
}

pub(super) fn generated_policy_fixture_text() -> String {
    let mut text = String::from(
        r#"schema_version = 1
policy = "generated-allowlist"
owner = "EffortlessMetrics"
status = "advisory"

"#,
    );
    push_allow(
        &mut text,
        r#"id = "generated-no-panic-baseline"
path = "policy/no-panic-baseline.toml"
generator = "cargo xtask no-panic baseline --reset"
regenerate_command = "cargo xtask no-panic baseline --reset"
owner = "policy"
reason = "Generated by the no-panic classifier."
created = "2026-05-10"
expires = "permanent"
"#,
    );
    text
}

pub(super) fn no_panic_baseline_fixture_text() -> String {
    let unwrap_snippet = ["let value = maybe.", "unwrap();"].concat();
    let panic_snippet = ["panic!", "(\"bad\");"].concat();
    format!(
        r#"schema_version = 1
policy = "no-panic-baseline"
owner = "EffortlessMetrics"
status = "advisory"

[policy_config]
mode = "no-new-debt"

[[entry]]
path = "src/lib.rs"
family = "unwrap"
selector_kind = "method-call"
selector_callee = "Option/Result::unwrap"
snippet = "{unwrap_snippet}"
count = 2

[[entry]]
path = "src/lib.rs"
family = "panic"
selector_kind = "macro-call"
selector_callee = "panic"
snippet = '{panic_snippet}'
count = 1
"#,
    )
}

pub(super) fn no_panic_allowlist_fixture_text() -> String {
    r#"schema_version = 1
policy = "no-panic-allowlist"
owner = "EffortlessMetrics"
status = "advisory"

[[allow]]
id = "no-panic-unwrap"
path = "src/lib.rs"
family = "unwrap"
owner = "parser"
classification = "reviewed_panic_exception"
explanation = "Parser validates the optional value."
created = "2026-05-09"
review_after = "2026-09-09"

[allow.selector]
kind = "method-call"
callee = "Option/Result::unwrap"
container = "load"
line_hint = 7

[allow.last_seen]
line = 7
column = 12

[[allow]]
path = "src/lib.rs"
family = "panic"

[allow.selector]
kind = "macro-call"
callee = "panic"
"#
    .to_string()
}

pub(super) fn clippy_policy_fixture_text() -> String {
    let mut text = String::from(
        r#"schema_version = 1
policy = "clippy-exceptions"
owner = "EffortlessMetrics"
status = "advisory"

"#,
    );
    push_allow(
        &mut text,
        r#"id = "clippy-unwrap-policy"
path = "src/lib.rs"
lint = "clippy::unwrap_used"
family = "expect"
owner = "lint"
classification = "reviewed_lint_exception"
reason = "Fixture keeps an explicit lint suppression linked to policy."
policy_id = "clippy-unwrap-policy"
created = "2026-05-09"
review_after = "2026-09-09"
"#,
    );
    text
}

pub(super) fn unsafe_policy_fixture_text() -> String {
    r#"schema_version = 1
policy = "unsafe-allowlist"
owner = "EffortlessMetrics"
status = "advisory"

[[allow]]
id = "unsafe-read"
path = "src/lib.rs"
family = "unsafe_block"
owner = "runtime"
classification = "reviewed_unsafe_boundary"
reason = "Caller validates pointer before read."
evidence = ["unsafe-review:docs/evidence/unsafe/read.json"]
created = "2026-05-09"
review_after = "2026-09-09"

[allow.selector]
kind = "unsafe-block"
container = "read"
line_hint = 7

[allow.last_seen]
line = 7
column = 12

[[allow]]
path = "src/lib.rs"
family = "unsafe_fn"

[allow.selector]
kind = "unsafe-fn"
"#
    .to_string()
}

pub(super) fn executable_policy_fixture_text() -> String {
    let mut text = String::from(
        r#"schema_version = 1
policy = "executable-allowlist"
owner = "EffortlessMetrics"
status = "advisory"

"#,
    );
    push_allow(
        &mut text,
        r#"id = "exec-package-proof"
path = "scripts/package-proof.sh"
interpreter = "bash"
owner = "release"
reason = "Release preflight aggregator."
created = "2026-05-09"
expires = "permanent"
"#,
    );
    text
}

pub(super) fn workflow_policy_fixture_text() -> String {
    let mut text = String::from(
        r#"schema_version = 1
policy = "workflow-allowlist"
owner = "EffortlessMetrics"
status = "advisory"

"#,
    );
    text.push_str("[[entry]]\n");
    text.push_str(
        r#"path = ".github/workflows/ci.yml"
owner = "release/ci"
reason = "Primary PR correctness gate."
permissions = ["contents:read"]
secrets_used = []
external_actions = [
  "actions/checkout@v6.0.2",
  "Swatinem/rust-cache@v2",
]
created = "2026-05-09"
expires = "permanent"
"#,
    );
    text
}

pub(super) fn dependency_policy_fixture_text() -> String {
    let mut text = String::from(
        r#"schema_version = 1
policy = "dependency-surface-allowlist"
owner = "EffortlessMetrics"
status = "advisory"

"#,
    );
    push_allow(
        &mut text,
        r#"id = "dep-workspace-cargo-toml"
path = "Cargo.toml"
surface = "workspace_manifest"
owner = "release"
reason = "Workspace dependency block."
dep_count_at_baseline = 22
created = "2026-05-09"
expires = "permanent"

"#,
    );
    push_allow(
        &mut text,
        r#"id = "dep-crate-cargo-toml"
path = "crates/*/Cargo.toml"
surface = "crate_manifest"
owner = "release"
reason = "Per-crate manifests."
broad_glob_reason = "Per-crate enumeration would duplicate the workspace member list."
created = "2026-05-09"
expires = "permanent"
"#,
    );
    text
}

pub(super) fn process_policy_fixture_text() -> String {
    let mut text = String::from(
        r#"schema_version = 1
policy = "process-allowlist"
owner = "EffortlessMetrics"
status = "advisory"

"#,
    );
    push_allow(
        &mut text,
        r#"id = "proc-cargo-install-cargo-deny"
binary = "cargo"
argv_shape = ["install", "cargo-deny", "--locked"]
network_reach = true
called_by = [".github/workflows/ci.yml"]
owner = "release/ci"
reason = "Installs cargo-deny in the deny job."
created = "2026-05-09"
review_after = "2026-09-09"

"#,
    );
    push_allow(
        &mut text,
        r#"id = "proc-bash-package-proof"
binary = "bash"
argv_shape = ["scripts/package-proof.sh"]
network_reach = false
called_by = [".github/workflows/release.yml"]
owner = "release"
reason = "Release preflight package proof; pure local checks."
created = "2026-05-09"
expires = "permanent"
"#,
    );
    text
}

pub(super) fn network_policy_fixture_text() -> String {
    let mut text = String::from(
        r#"schema_version = 1
policy = "network-allowlist"
owner = "EffortlessMetrics"
status = "advisory"

"#,
    );
    push_allow(
        &mut text,
        r#"id = "net-crates-io-fetch"
destination = "crates.io"
auth_required = false
lane = "build"
owner = "release"
reason = "cargo fetch resolves and downloads crate dependencies."
created = "2026-05-09"
expires = "permanent"

"#,
    );
    push_allow(
        &mut text,
        r#"id = "net-github-api"
destination = "api.github.com"
auth_required = true
auth_secret = "GITHUB_TOKEN"
lane = "release"
owner = "release/ci"
reason = "Release uploads through the GitHub API."
created = "2026-05-09"
expires = "permanent"
"#,
    );
    text
}

fn push_allow(text: &mut String, body: &str) {
    text.push_str("[[");
    text.push_str("allow]]\n");
    text.push_str(body);
}