1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
//! Tier-B test-fixture suppression list. Loaded from the bundled
//! `crates/cli/data/suppressions/test-fixtures.toml` via `include_str!`
//! at build time; previously hardcoded in `orchestrator.rs` as a chain
//! of `cred == concat!("sk_", "live_", …)` branches. Moving the data
//! out of code lets a user contribute a new suppression without
//! re-compiling, lets the differential bench harness honour the same
//! list, and lets users opt out entirely via
//! `--no-suppress-test-fixtures`.
use std::collections::HashSet;
use serde::Deserialize;
/// Bundled suppression payload, parsed once at startup and queried
/// per finding. `exact` is an O(1) hash lookup; `substring` is a
/// short linear scan (the list is intentionally tiny - EXAMPLE
/// and PLACEHOLDER today; if it grows, swap the impl for an
/// aho-corasick scan without changing the public API).
#[derive(Debug)]
pub(crate) struct TestFixtureSuppressions {
exact: HashSet<String>,
substrings: Vec<&'static str>,
}
#[derive(Debug, Deserialize)]
struct SuppressionFile {
schema_version: u32,
#[serde(default)]
exact: Vec<ExactEntry>,
#[serde(default)]
substring: Vec<SubstringEntry>,
}
#[derive(Debug, Deserialize)]
struct ExactEntry {
credential: String,
service: Option<String>,
source: Option<String>,
}
#[derive(Debug, Deserialize)]
struct SubstringEntry {
needle: String,
}
const BUNDLED_TOML: &str = include_str!("../data/suppressions/test-fixtures.toml");
impl TestFixtureSuppressions {
/// Load the bundled suppression list. A malformed bundled TOML is a broken
/// build; do not continue with test-fixture suppression weakened.
#[must_use]
pub(crate) fn bundled() -> Self {
match Self::from_toml(BUNDLED_TOML) {
Ok(suppressions) => suppressions,
Err(error) => {
panic!(
"crates/cli/data/suppressions/test-fixtures.toml is invalid: {error}. \
Fix the bundled Tier-B test-fixture suppressions; refusing to run without \
suppression truth."
)
}
}
}
pub(crate) fn from_toml(raw: &str) -> Result<Self, String> {
let parsed: SuppressionFile =
toml::from_str(raw).map_err(|error| format!("invalid test-fixtures.toml: {error}"))?;
if parsed.schema_version != 1 {
return Err(format!(
"unsupported test-fixture suppression schema_version {}",
parsed.schema_version
));
}
let mut exact = HashSet::with_capacity(parsed.exact.len());
for entry in parsed.exact {
let ExactEntry {
credential,
service,
source,
} = entry;
if credential.trim().is_empty() {
return Err("exact suppression credentials must not be empty".to_string());
}
for (field, value) in [
("service", service.as_deref()),
("source", source.as_deref()),
] {
if let Some(value) = value {
if value.trim().is_empty() {
return Err(format!(
"exact suppression metadata field {field} must not be empty"
));
}
}
}
if !exact.insert(credential.clone()) {
return Err(format!(
"duplicate exact suppression credential {credential:?}"
));
}
}
let mut substring_seen = HashSet::new();
// Substrings are tiny and constant - leak the strings to
// `&'static str` so we don't pay an alloc on every check.
let mut substrings = Vec::with_capacity(parsed.substring.len());
for entry in parsed.substring {
let needle = entry.needle.trim();
if needle.is_empty() {
return Err("substring suppression needles must not be empty".to_string());
}
if !substring_seen.insert(needle.to_string()) {
return Err(format!("duplicate substring suppression needle {needle:?}"));
}
substrings.push(Box::leak(needle.to_string().into_boxed_str()) as &'static str);
}
if exact.is_empty() && substrings.is_empty() {
return Err("test-fixture suppressions must contain at least one entry".to_string());
}
Ok(Self { exact, substrings })
}
/// A do-nothing suppression list - every credential passes
/// through. Returned when the user passes
/// `--no-suppress-test-fixtures`.
#[must_use]
pub(crate) fn empty() -> Self {
Self {
exact: HashSet::new(),
substrings: Vec::new(),
}
}
/// True when `cred` should be suppressed. O(1) for exact hits,
/// O(n_substrings) for substring filtering (n=2 today).
#[must_use]
pub(crate) fn suppresses(&self, cred: &str) -> bool {
if self.exact.contains(cred) {
return true;
}
for needle in &self.substrings {
if cred.contains(needle) {
return true;
}
}
false
}
/// Count of exact entries - used by tests + introspection
/// (`--list-suppressions` if we ship one).
#[must_use]
pub(crate) fn exact_count(&self) -> usize {
self.exact.len()
}
}