pmat 3.26.0

#![cfg_attr(coverage_nightly, coverage(off))]
//! GH #629: make the supply-chain claim satisfiable by refreshing its own cache.
//!
//! The gate reads `.pmat-metrics/deny-status.json` (falling back to
//! `deny-cache.txt`) and blocks once that file is older than
//! [`CACHE_BLOCK_HOURS`](super::types::CACHE_BLOCK_HOURS). Nothing in pmat, and
//! nothing pmat installs into a consumer repo, ever wrote either file — so the
//! advice it printed ("Run 'cargo deny check' first") could not clear it.
//! `cargo deny` writes to stdout, not to the cache. Every `pmat work complete`
//! therefore needed `--override-claims supply-chain`, which trains operators to
//! wave through a *security* gate.
//!
//! The fix is for pmat to populate the cache itself, from cargo-deny's exit
//! code. The O(1) contract is kept where it matters: a fresh cache is still a
//! single `stat` + parse, and the subprocess runs at most once per block window.

use super::types::CachedMetric;
use std::io::Read;
use std::path::Path;
use std::process::{Command, Output, Stdio};
use std::time::{Duration, Instant};

/// Run a command, killing it if it outruns `limit`.
///
/// Returns `Ok(None)` on timeout. stdout and stderr are drained on their own
/// threads: polling `try_wait` while the child writes into a full pipe buffer
/// would deadlock, which is the classic way a hand-rolled timeout makes hangs
/// *more* likely rather than less.
pub(crate) fn run_with_timeout(
    cmd: &mut Command,
    limit: Duration,
) -> std::io::Result<Option<Output>> {
    let mut child = cmd.stdout(Stdio::piped()).stderr(Stdio::piped()).spawn()?;

    let mut stdout = child.stdout.take();
    let mut stderr = child.stderr.take();
    let drain = |pipe: Option<&mut dyn Read>| -> Vec<u8> {
        let mut buf = Vec::new();
        if let Some(p) = pipe {
            let _ = p.read_to_end(&mut buf);
        }
        buf
    };
    let out_handle = std::thread::spawn(move || drain(stdout.as_mut().map(|p| p as &mut dyn Read)));
    let err_handle = std::thread::spawn(move || drain(stderr.as_mut().map(|p| p as &mut dyn Read)));

    let deadline = Instant::now() + limit;
    let status = loop {
        match child.try_wait()? {
            Some(status) => break status,
            None if Instant::now() >= deadline => {
                let _ = child.kill();
                let _ = child.wait();
                return Ok(None);
            }
            None => std::thread::sleep(Duration::from_millis(50)),
        }
    };

    Ok(Some(Output {
        status,
        stdout: out_handle.join().unwrap_or_default(),
        stderr: err_handle.join().unwrap_or_default(),
    }))
}

/// Result of trying to bring the deny cache up to date.
pub(crate) enum DenyRefresh {
    /// cargo-deny ran to completion; the cache now reflects its verdict.
    Recorded(Box<CachedMetric>),
    /// cargo-deny is not available, so the claim cannot be evaluated here.
    ToolMissing,
    /// cargo-deny could not be run, or its verdict could not be persisted.
    Failed(String),
}

/// Where the refreshed verdict is written, relative to the project root.
pub(crate) const DENY_STATUS_PATH: &str = ".pmat-metrics/deny-status.json";

/// Install hint shown when cargo-deny is absent.
pub(crate) const CARGO_DENY_INSTALL_HINT: &str = "cargo install cargo-deny --locked";

/// True if cargo reported that the `deny` subcommand does not exist.
///
/// `Command::new("cargo")` succeeds whenever cargo itself is installed, so a
/// missing cargo-deny surfaces as a normal non-zero exit with this message
/// rather than as an `io::ErrorKind::NotFound`.
fn is_missing_subcommand(stderr: &str) -> bool {
    stderr.contains("no such command") || stderr.contains("no such subcommand")
}

/// Count vulnerability diagnostics in cargo-deny output.
///
/// cargo-deny emits one `error[vulnerability]` block per advisory. Bans,
/// licence and source violations use their own codes and are deliberately not
/// counted here — they still fail the gate via the exit code, but the numeric
/// evidence attached to the claim is specifically a vulnerability count.
fn count_vulnerabilities(output: &str) -> u64 {
    output.matches("error[vulnerability]").count() as u64
}

/// A one-line reason a cargo-deny run failed.
///
/// cargo-deny fails for bans, licences and sources as well as advisories, and
/// those carry no `error[vulnerability]`. Without this, such a run was reported
/// as "0 vulnerabilities" — a failure verdict phrased as a success, which is
/// worse than no message. Prefers cargo-deny's own per-check summary
/// (`advisories ok, bans ok, licenses FAILED, sources ok`), then the first
/// error diagnostic.
fn failure_summary(stdout: &str, stderr: &str) -> String {
    let lines = stdout.lines().chain(stderr.lines()).map(str::trim);
    let mut first_error = None;

    for line in lines {
        if line.contains("FAILED") && line.contains(" ok") {
            return line.to_string();
        }
        if first_error.is_none() && line.starts_with("error") {
            first_error = Some(line.to_string());
        }
    }
    first_error.unwrap_or_else(|| "cargo deny check failed".to_string())
}

/// How long cargo-deny may run before the gate gives up on it.
///
/// `cargo deny check` git-fetches the RustSec advisory database, so a stalled
/// connection would otherwise block `pmat work complete` forever behind a
/// half-printed "Reading deny cache... " line, with no output and no way to
/// tell a hang from slow work.
const DENY_TIMEOUT: Duration = Duration::from_secs(120);

/// Run `cargo deny check` in `project_path` and persist its verdict.
pub(crate) fn refresh_deny_cache(project_path: &Path) -> DenyRefresh {
    let output = match run_with_timeout(
        Command::new("cargo")
            .args(["deny", "check"])
            .current_dir(project_path),
        DENY_TIMEOUT,
    ) {
        Ok(Some(output)) => output,
        Ok(None) => {
            return DenyRefresh::Failed(format!(
                "'cargo deny check' did not finish within {}s (advisory-DB fetch may be stalled; \
                 check connectivity or run it manually)",
                DENY_TIMEOUT.as_secs()
            ))
        }
        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return DenyRefresh::ToolMissing,
        Err(e) => return DenyRefresh::Failed(format!("could not run 'cargo deny check': {e}")),
    };

    // cargo-deny writes its diagnostics to stderr and its per-check summary to
    // stdout; scan both so the count is independent of that split.
    let stderr = String::from_utf8_lossy(&output.stderr);
    if is_missing_subcommand(&stderr) {
        return DenyRefresh::ToolMissing;
    }
    let stdout = String::from_utf8_lossy(&output.stdout);

    let passed = output.status.success();
    let count = count_vulnerabilities(&stderr) + count_vulnerabilities(&stdout);
    let value = serde_json::json!({
        "passed": passed,
        "vulnerability_count": count,
        "summary": if passed { String::new() } else { failure_summary(&stdout, &stderr) },
        "timestamp": chrono::Utc::now().to_rfc3339(),
        "source": "pmat work complete (cargo deny check)",
    });

    if let Err(e) = write_status(project_path, &value) {
        return DenyRefresh::Failed(format!("could not write {DENY_STATUS_PATH}: {e}"));
    }

    DenyRefresh::Recorded(Box::new(CachedMetric {
        value,
        age_minutes: 0,
        is_stale_warn: false,
        is_stale_block: false,
    }))
}

/// Persist the verdict to `.pmat-metrics/deny-status.json`, creating the
/// directory if the consumer repo has never recorded a metric before.
fn write_status(project_path: &Path, value: &serde_json::Value) -> std::io::Result<()> {
    write_json_status(project_path, DENY_STATUS_PATH, value)
}

/// Write a metric verdict under the project, creating `.pmat-metrics/` if the
/// consumer repo has never recorded one before.
pub(crate) fn write_json_status(
    project_path: &Path,
    relative: &str,
    value: &serde_json::Value,
) -> std::io::Result<()> {
    let path = project_path.join(relative);
    if let Some(parent) = path.parent() {
        std::fs::create_dir_all(parent)?;
    }
    std::fs::write(path, serde_json::to_string_pretty(value)?)
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn missing_subcommand_detected_from_cargo_message() {
        // The exact wording cargo uses when cargo-deny is not installed.
        assert!(is_missing_subcommand("error: no such command: `deny`"));
        assert!(is_missing_subcommand("error: no such subcommand: `deny`"));
    }

    #[test]
    fn missing_subcommand_not_confused_with_a_real_failure() {
        assert!(!is_missing_subcommand(
            "error[vulnerability]: RUSTSEC-2024-0001"
        ));
        assert!(!is_missing_subcommand("advisories FAILED"));
        assert!(!is_missing_subcommand(""));
    }

    #[test]
    fn vulnerabilities_counted_per_diagnostic() {
        let out = "error[vulnerability]: RUSTSEC-2024-0001\n\
                   error[vulnerability]: RUSTSEC-2024-0002\n\
                   warning[unmaintained]: RUSTSEC-2024-0003\n";
        assert_eq!(count_vulnerabilities(out), 2);
    }

    #[test]
    fn failure_summary_prefers_the_per_check_line() {
        // The real shape of a licence failure, which carries no
        // error[vulnerability] and so would otherwise report "0 vulnerabilities".
        let stdout = "advisories ok, bans ok, licenses FAILED, sources ok\n";
        let stderr = "error[unlicensed]: dogfood = 0.1.0 is unlicensed\n";
        assert_eq!(
            failure_summary(stdout, stderr),
            "advisories ok, bans ok, licenses FAILED, sources ok"
        );
    }

    #[test]
    fn failure_summary_falls_back_to_the_first_error() {
        let stderr =
            "error[vulnerability]: RUSTSEC-2024-0001\nerror[vulnerability]: RUSTSEC-2024-0002\n";
        assert_eq!(
            failure_summary("", stderr),
            "error[vulnerability]: RUSTSEC-2024-0001"
        );
    }

    #[test]
    fn failure_summary_always_says_something() {
        assert_eq!(failure_summary("", ""), "cargo deny check failed");
    }

    #[test]
    fn clean_output_counts_zero() {
        assert_eq!(count_vulnerabilities("advisories ok\nbans ok\n"), 0);
        assert_eq!(count_vulnerabilities(""), 0);
    }

    #[test]
    fn write_status_creates_missing_metrics_dir() {
        // A consumer repo that has never recorded a metric has no
        // .pmat-metrics/ at all; the refresh must not fail on that.
        let dir = tempfile::tempdir().unwrap();
        let value = serde_json::json!({ "passed": true, "vulnerability_count": 0 });

        write_status(dir.path(), &value).unwrap();

        let written = std::fs::read_to_string(dir.path().join(DENY_STATUS_PATH)).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&written).unwrap();
        assert_eq!(parsed["passed"], serde_json::json!(true));
        assert_eq!(parsed["vulnerability_count"], serde_json::json!(0));
    }

    #[test]
    fn write_status_overwrites_a_stale_verdict() {
        let dir = tempfile::tempdir().unwrap();
        std::fs::create_dir_all(dir.path().join(".pmat-metrics")).unwrap();
        std::fs::write(
            dir.path().join(DENY_STATUS_PATH),
            r#"{"passed": true, "timestamp": "2026-07-01T21:02:57Z"}"#,
        )
        .unwrap();

        write_status(
            dir.path(),
            &serde_json::json!({ "passed": false, "vulnerability_count": 3 }),
        )
        .unwrap();

        let written = std::fs::read_to_string(dir.path().join(DENY_STATUS_PATH)).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&written).unwrap();
        assert_eq!(parsed["passed"], serde_json::json!(false));
        assert_eq!(parsed["vulnerability_count"], serde_json::json!(3));
    }
}