use std::collections::{BTreeSet, VecDeque};
use std::process::Command;
const ALWAYS_FORBIDDEN_CRATES: &[&str] = &[
"reqwest",
"hyper",
"hyper-util",
"h2",
"isahc",
"surf",
"attohttpc",
"curl",
"curl-sys",
"tiny_http",
"actix-web",
"axum",
"warp",
"rouille",
"minreq",
"tungstenite",
"tokio-tungstenite",
"websocket",
"ssh2",
"libssh2-sys",
"russh",
"tokio",
"async-std",
"smol",
"async-io",
"openssl",
"openssl-sys",
"native-tls",
"trust-dns-resolver",
"hickory-resolver",
"sentry",
"sentry-core",
"opentelemetry",
"tracing-opentelemetry",
"posthog",
"posthog-rs",
"segment",
"amplitude",
"mixpanel",
"datadog-apm",
"metrics-exporter-prometheus",
];
const CONNECT_GATED_CRATES: &[&str] = &["ureq", "rustls", "keyring"];
const CONNECT_CRATE: &str = "costroid-connect";
const CLI_CRATE: &str = "costroid";
const BAR_CRATE: &str = "costroid-bar";
const CONNECT_ALLOWED: &[&str] = &[
"aes",
"async-broadcast",
"async-trait",
"base64",
"block-buffer",
"block-padding",
"byteorder",
"cbc",
"cc",
"cipher",
"concurrent-queue",
"core-foundation",
"cpufeatures",
"crossbeam-utils",
"crypto-common",
"dbus",
"dbus-secret-service",
"digest",
"endi",
"enumflags2",
"enumflags2_derive",
"event-listener",
"event-listener-strategy",
"find-msvc-tools",
"futures-core",
"futures-macro",
"futures-sink",
"futures-task",
"futures-util",
"generic-array",
"hkdf",
"hmac",
"http",
"httparse",
"inout",
"jobserver",
"keyring",
"libdbus-sys",
"nix",
"num",
"num-bigint",
"num-complex",
"num-integer",
"num-iter",
"num-rational",
"openssl-probe",
"ordered-stream",
"parking",
"percent-encoding",
"pin-project-lite",
"pkg-config",
"ring",
"rpassword",
"rtoolbox",
"rustls",
"rustls-native-certs",
"rustls-pki-types",
"rustls-webpki",
"schannel",
"secrecy",
"secret-service",
"security-framework",
"security-framework-sys",
"serde_repr",
"sha1",
"sha2",
"shlex",
"slab",
"subtle",
"tracing",
"tracing-attributes",
"tracing-core",
"typenum",
"untrusted",
"ureq",
"ureq-proto",
"utf8-zero",
"windows-targets",
"windows_x86_64_msvc",
"xdg-home",
"zbus",
"zbus_macros",
"zbus_names",
"zeroize",
"zeroize_derive",
"zvariant",
"zvariant_derive",
"zvariant_utils",
];
const BAR_ACCESSKIT_ALLOWED: &[&str] = &[
"accesskit_atspi_common",
"accesskit_consumer",
"accesskit_macos",
"accesskit_unix",
"accesskit_windows",
"accesskit_winit",
"async-broadcast",
"async-channel",
"async-executor",
"async-io",
"async-lock",
"async-process",
"async-recursion",
"async-signal",
"async-task",
"async-trait",
"atomic-waker",
"atspi",
"atspi-common",
"atspi-proxies",
"blocking",
"concurrent-queue",
"endi",
"enumflags2",
"enumflags2_derive",
"event-listener",
"event-listener-strategy",
"fastrand",
"futures-lite",
"hex",
"ordered-stream",
"parking",
"phf",
"phf_generator",
"phf_macros",
"phf_shared",
"piper",
"serde_repr",
"signal-hook-registry",
"siphasher",
"windows",
"windows-collections",
"windows-core",
"windows-future",
"windows-implement",
"windows-interface",
"windows-numerics",
"windows-result",
"windows-strings",
"windows-threading",
"zbus",
"zbus-lockstep",
"zbus-lockstep-macros",
"zbus_macros",
"zbus_names",
"zbus_xml",
"zvariant",
"zvariant_derive",
"zvariant_utils",
];
const SHIPPED_TARGETS: &[&str] = &[
"x86_64-unknown-linux-gnu",
"aarch64-unknown-linux-gnu",
"x86_64-unknown-linux-musl",
"x86_64-apple-darwin",
"aarch64-apple-darwin",
"x86_64-pc-windows-msvc",
];
fn reachable_crate_names(roots: &[&str], extra_args: &[&str]) -> BTreeSet<String> {
let mut names = BTreeSet::new();
for target in SHIPPED_TARGETS {
names.extend(reachable_for_target(target, roots, extra_args));
}
names
}
fn reachable_for_target(target: &str, roots: &[&str], extra_args: &[&str]) -> BTreeSet<String> {
let mut args = vec![
"metadata",
"--format-version",
"1",
"--locked",
"--filter-platform",
target,
];
args.extend_from_slice(extra_args);
let output = match Command::new(env!("CARGO")).args(&args).output() {
Ok(output) => output,
Err(err) => panic!(
"failed to run `cargo metadata --filter-platform {target} {extra_args:?}`: {err}"
),
};
assert!(
output.status.success(),
"`cargo metadata --filter-platform {target} {extra_args:?}` failed:\n{}",
String::from_utf8_lossy(&output.stderr)
);
let meta: serde_json::Value = match serde_json::from_slice(&output.stdout) {
Ok(value) => value,
Err(err) => panic!("`cargo metadata` emitted invalid JSON: {err}"),
};
let packages = match meta["packages"].as_array() {
Some(packages) => packages,
None => panic!("`cargo metadata` output had no `packages` array"),
};
let id_to_name: std::collections::HashMap<&str, &str> = packages
.iter()
.filter_map(|pkg| Some((pkg["id"].as_str()?, pkg["name"].as_str()?)))
.collect();
let resolve = &meta["resolve"];
let nodes = match resolve["nodes"].as_array() {
Some(nodes) => nodes,
None => panic!("`cargo metadata` output had no `resolve.nodes` array"),
};
let mut edges: std::collections::HashMap<&str, Vec<&str>> = std::collections::HashMap::new();
for node in nodes {
let Some(id) = node["id"].as_str() else {
continue;
};
let deps: Vec<&str> = node["deps"]
.as_array()
.map(|deps| deps.iter().filter_map(|d| d["pkg"].as_str()).collect())
.unwrap_or_default();
edges.insert(id, deps);
}
let members = match meta["workspace_members"].as_array() {
Some(members) => members,
None => panic!("`cargo metadata` output had no `workspace_members` array"),
};
let mut queue: VecDeque<&str> = VecDeque::new();
let mut visited: BTreeSet<&str> = BTreeSet::new();
for member in members {
let Some(id) = member.as_str() else {
continue;
};
let is_root = id_to_name
.get(id)
.copied()
.is_some_and(|name| roots.contains(&name));
if is_root && visited.insert(id) {
queue.push_back(id);
}
}
while let Some(id) = queue.pop_front() {
if let Some(deps) = edges.get(id) {
for &dep in deps {
if visited.insert(dep) {
queue.push_back(dep);
}
}
}
}
visited
.iter()
.filter_map(|id| id_to_name.get(id).map(|name| name.to_string()))
.collect()
}
fn forbidden_hits<'a>(
names: &BTreeSet<String>,
forbidden: impl IntoIterator<Item = &'a str>,
allow: &[&str],
) -> Vec<&'a str> {
let allowed: BTreeSet<&str> = allow.iter().copied().collect();
forbidden
.into_iter()
.filter(|crate_name| names.contains(*crate_name) && !allowed.contains(crate_name))
.collect()
}
#[test]
fn cli_default_build_links_no_network_tls_or_telemetry_crate() {
let names = reachable_crate_names(&[CLI_CRATE], &[]);
assert!(
!names.contains(CONNECT_CRATE),
"the default CLI build must not link `{CONNECT_CRATE}` — the `connect` feature \
must be off by default so the local-only build links no network/keychain code."
);
let hits = forbidden_hits(
&names,
ALWAYS_FORBIDDEN_CRATES
.iter()
.chain(CONNECT_GATED_CRATES.iter())
.copied(),
&[],
);
assert!(
hits.is_empty(),
"the default/local-only CLI build forbids networking/TLS/async-runtime/telemetry \
dependencies, but the resolved graph contains: {hits:?}.\n\
Costroid's CLI must read local logs only and make no network call. Network code \
belongs solely in `costroid-connect`, behind the off-by-default `connect` \
feature — if a crate must move there, update CONNECT_GATED_CRATES, deny.toml, \
and the `connect`-build test together."
);
}
#[test]
fn cli_connect_feature_admits_only_the_sanctioned_trio() {
let names = reachable_crate_names(&[CLI_CRATE], &["--features", "connect"]);
assert!(
names.contains(CONNECT_CRATE),
"`--features connect` must link `{CONNECT_CRATE}` — otherwise the gate is not \
actually wired to the connections subsystem."
);
let hits = forbidden_hits(&names, ALWAYS_FORBIDDEN_CRATES.iter().copied(), &[]);
assert!(
hits.is_empty(),
"even with `connect` on, the CLI forbids async runtimes, non-rustls TLS (OpenSSL), \
other HTTP clients, and all telemetry, but the resolved graph contains: {hits:?}.\n\
The connections subsystem uses only `ureq` + `rustls` + `keyring`."
);
for gated in CONNECT_GATED_CRATES {
assert!(
names.contains(*gated),
"`--features connect` must link `{gated}` — the connections subsystem \
(T8 credential store, T9a authorized-host HTTP client) depends on the \
full `ureq`/`rustls`/`keyring` trio, so the gate has to pull it in."
);
}
let default = reachable_crate_names(&[CLI_CRATE], &[]);
let allowed: BTreeSet<&str> = CONNECT_ALLOWED.iter().copied().collect();
let unexpected: Vec<&str> = names
.difference(&default)
.map(String::as_str)
.filter(|name| *name != CONNECT_CRATE && !allowed.contains(name))
.collect();
assert!(
unexpected.is_empty(),
"`--features connect` introduced crate(s) not in the reviewed allowlist: \
{unexpected:?}.\n\
Every crate the connect-on graph adds must be reviewed (is it a network / TLS / \
telemetry path?) and, if legitimate, added to CONNECT_ALLOWED. Regenerate the \
expected delta with: \
`cargo test -p costroid --test offline print_connect_delta -- --ignored --nocapture`."
);
}
#[test]
fn bar_default_build_admits_only_the_reviewed_accesskit_subtree() {
let names = reachable_crate_names(&[BAR_CRATE], &[]);
assert!(
!names.contains(CONNECT_CRATE),
"the default `{BAR_CRATE}` build must not link `{CONNECT_CRATE}` — the bar's `connect` \
feature is off by default, so the GUI links no network/keychain code."
);
let hits = forbidden_hits(
&names,
ALWAYS_FORBIDDEN_CRATES
.iter()
.chain(CONNECT_GATED_CRATES.iter())
.copied(),
BAR_ACCESSKIT_ALLOWED,
);
assert!(
hits.is_empty(),
"the default `{BAR_CRATE}` build forbids every network/TLS/telemetry crate (only the \
reviewed AccessKit local-IPC subtree is excused), but the resolved graph contains: \
{hits:?}.\n\
If a crate is a legitimate part of the local-IPC AccessKit subtree, review it and add \
it to BAR_ACCESSKIT_ALLOWED; otherwise it is a real egress path and must be removed."
);
assert!(
names.contains("async-io"),
"AccessKit must be ON in the default `{BAR_CRATE}` build (its `accesskit` default \
feature), so its local-IPC `async-io` reactor is linked — accessibility is required."
);
let no_accesskit = reachable_crate_names(&[BAR_CRATE], &["--no-default-features"]);
let allowed: BTreeSet<&str> = BAR_ACCESSKIT_ALLOWED.iter().copied().collect();
let unexpected: Vec<&str> = names
.difference(&no_accesskit)
.map(String::as_str)
.filter(|name| !allowed.contains(name))
.collect();
assert!(
unexpected.is_empty(),
"the bar's `accesskit` feature introduced crate(s) not in the reviewed allowlist: \
{unexpected:?}.\n\
Every crate the accesskit-on graph adds must be reviewed (is it a network / TLS / \
telemetry path, or local AT-SPI/UI-Automation IPC?) and, if legitimate, added to \
BAR_ACCESSKIT_ALLOWED. Regenerate the expected delta with: \
`cargo test -p costroid --test offline print_bar_accesskit_delta -- --ignored --nocapture`."
);
}
#[test]
fn bar_connect_build_forbids_network_except_the_reviewed_subtrees() {
let names = reachable_crate_names(&[BAR_CRATE], &["--features", "connect"]);
assert!(
names.contains(CONNECT_CRATE),
"`--features connect` must link `{CONNECT_CRATE}` in the bar too — otherwise the gate \
is not wired to the display-only connection lane."
);
let hits = forbidden_hits(
&names,
ALWAYS_FORBIDDEN_CRATES.iter().copied(),
BAR_ACCESSKIT_ALLOWED,
);
assert!(
hits.is_empty(),
"even with `connect` on, the bar forbids async runtimes, non-rustls TLS, other HTTP \
clients, and all telemetry (only the reviewed AccessKit subtree is excused), but the \
resolved graph contains: {hits:?}."
);
for gated in CONNECT_GATED_CRATES {
assert!(
names.contains(*gated),
"`--features connect` must link `{gated}` in the bar — the connection lane shares \
the CLI's credential store, which depends on the `ureq`/`rustls`/`keyring` trio."
);
}
let bar_default = reachable_crate_names(&[BAR_CRATE], &[]);
let allowed: BTreeSet<&str> = CONNECT_ALLOWED.iter().copied().collect();
let unexpected: Vec<&str> = names
.difference(&bar_default)
.map(String::as_str)
.filter(|name| *name != CONNECT_CRATE && !allowed.contains(name))
.collect();
assert!(
unexpected.is_empty(),
"`--features connect` introduced crate(s) into the bar not in the reviewed allowlist: \
{unexpected:?}.\n\
Review each (network / TLS / telemetry?) and, if legitimate, add it to CONNECT_ALLOWED."
);
}
#[test]
#[ignore]
fn print_connect_delta() {
let default = reachable_crate_names(&[CLI_CRATE], &[]);
let connect = reachable_crate_names(&[CLI_CRATE], &["--features", "connect"]);
let delta: Vec<&String> = connect.difference(&default).collect();
println!("CONNECT_DELTA ({} crates):", delta.len());
for name in &delta {
println!(" {name}");
}
}
#[test]
#[ignore]
fn print_bar_accesskit_delta() {
let with = reachable_crate_names(&[BAR_CRATE], &[]);
let without = reachable_crate_names(&[BAR_CRATE], &["--no-default-features"]);
let delta: Vec<&String> = with.difference(&without).collect();
println!("BAR_ACCESSKIT_DELTA ({} crates):", delta.len());
for name in &delta {
println!(" {name}");
}
}