cargo-allow 0.1.3

Source-tree exception ledger and policy scanner for Rust repositories.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155

use super::{
    ExplainContext,
    explain_steps::{ExplainReferenceAttention, explain_next_steps},
};
use crate::evidence_inventory::{
    DEFAULT_SOURCE_TREE_INVENTORY_EVIDENCE_MESSAGE, evidence_reference_diagnostics_for_source_tree,
    policy_reference_diagnostics_for_source_tree,
};
use crate::evidence_render::evidence_reference_target_text;
use allow_core::{AllowEntry, Finding, MatchOutcome, allow_entry_broad_scope};
use allow_diff::selector_precision_score;
use std::collections::BTreeSet;
use std::path::Path;

pub(super) fn render_explain_entry(
    root: &Path,
    entry: &AllowEntry,
    findings: &[Finding],
    outcomes: &[MatchOutcome],
    evidence_source_tree_files: Option<&BTreeSet<String>>,
) -> String {
    render_explain_report(
        root,
        entry,
        findings,
        outcomes,
        evidence_source_tree_files,
        ExplainContext::default(),
        allow_report::render_explain_human,
    )
}

pub(super) fn render_explain_entry_json(
    root: &Path,
    entry: &AllowEntry,
    findings: &[Finding],
    outcomes: &[MatchOutcome],
    evidence_source_tree_files: Option<&BTreeSet<String>>,
    context: ExplainContext<'_>,
) -> String {
    render_explain_report(
        root,
        entry,
        findings,
        outcomes,
        evidence_source_tree_files,
        context,
        allow_report::render_explain_json,
    )
}

fn render_explain_report<R>(
    root: &Path,
    entry: &AllowEntry,
    findings: &[Finding],
    outcomes: &[MatchOutcome],
    evidence_source_tree_files: Option<&BTreeSet<String>>,
    context: ExplainContext<'_>,
    render: impl FnOnce(allow_report::ExplainReport<'_>) -> R,
) -> R {
    let evidence_diagnostics =
        evidence_reference_diagnostics_for_source_tree(root, entry, evidence_source_tree_files);
    let link_diagnostics =
        link_reference_diagnostics_for_source_tree(root, entry, evidence_source_tree_files);
    let references = ExplainReferenceAttention {
        has_broken_evidence: evidence_diagnostics
            .iter()
            .any(|diagnostic| diagnostic.status.is_broken_local_link()),
        has_weak_evidence: evidence_diagnostics
            .iter()
            .any(|diagnostic| diagnostic.status.is_weak_reference()),
        has_evidence_outside_default_inventory: evidence_diagnostics
            .iter()
            .any(|diagnostic| diagnostic.message == DEFAULT_SOURCE_TREE_INVENTORY_EVIDENCE_MESSAGE),
        has_broken_link: link_diagnostics
            .iter()
            .any(|diagnostic| diagnostic.status.is_broken_local_link()),
        has_weak_link: link_diagnostics
            .iter()
            .any(|diagnostic| diagnostic.status.is_weak_reference()),
        has_link_outside_default_inventory: link_diagnostics
            .iter()
            .any(|diagnostic| diagnostic.message == DEFAULT_SOURCE_TREE_INVENTORY_EVIDENCE_MESSAGE),
    };
    let (suggested_actions, proof_commands) =
        explain_next_steps(entry, findings, outcomes, references);
    let normalized_targets = evidence_diagnostics
        .iter()
        .map(evidence_reference_target_text)
        .collect::<Vec<_>>();
    let evidence_references = evidence_diagnostics
        .iter()
        .zip(normalized_targets.iter())
        .map(|(diagnostic, target)| allow_report::EvidenceReference {
            raw: &diagnostic.raw,
            prefix: diagnostic.prefix.as_deref(),
            target: target.as_deref(),
            status: diagnostic.status.as_str(),
            category: diagnostic.category.as_str(),
            message: &diagnostic.message,
        })
        .collect::<Vec<_>>();
    let link_normalized_targets = link_diagnostics
        .iter()
        .map(evidence_reference_target_text)
        .collect::<Vec<_>>();
    let link_messages = link_diagnostics
        .iter()
        .map(|diagnostic| link_reference_message(&diagnostic.message))
        .collect::<Vec<_>>();
    let link_references = link_diagnostics
        .iter()
        .zip(link_normalized_targets.iter())
        .zip(link_messages.iter())
        .map(
            |((diagnostic, target), message)| allow_report::EvidenceReference {
                raw: &diagnostic.raw,
                prefix: diagnostic.prefix.as_deref(),
                target: target.as_deref(),
                status: diagnostic.status.as_str(),
                category: diagnostic.category.as_str(),
                message,
            },
        )
        .collect::<Vec<_>>();

    render(allow_report::ExplainReport {
        inventory: context.inventory,
        entry,
        selector_precision: selector_precision_score(entry),
        broad_scope: allow_entry_broad_scope(entry).is_some(),
        current_findings: findings,
        match_outcomes: outcomes,
        evidence_references: &evidence_references,
        link_references: &link_references,
        suggested_actions: &suggested_actions,
        proof_commands: &proof_commands,
    })
}

fn link_reference_diagnostics_for_source_tree(
    root: &Path,
    entry: &AllowEntry,
    evidence_source_tree_files: Option<&BTreeSet<String>>,
) -> Vec<allow_policy::EvidenceReferenceDiagnostic> {
    policy_reference_diagnostics_for_source_tree(root, entry, evidence_source_tree_files)
        .into_iter()
        .filter(|reference| reference.source == crate::evidence_inventory::ReferenceSource::Link)
        .map(|reference| reference.diagnostic)
        .collect()
}

fn link_reference_message(message: &str) -> String {
    message.replace("evidence", "link")
}