repotoire 0.5.3

Graph-powered code analysis CLI. 106 detectors for security, architecture, and code quality.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131

use std::collections::HashMap;

use tower_lsp::lsp_types::{
    CodeAction, CodeActionKind, Position, Range, TextEdit, Url, WorkspaceEdit,
};

use crate::models::Finding;

/// Comment prefix for a given file extension.
fn comment_prefix(uri: &Url) -> &'static str {
    let path = uri.path();
    if path.ends_with(".py") || path.ends_with(".rb") {
        "#"
    } else {
        "//"
    }
}

/// Generate code actions for a finding at a given URI.
pub fn actions_for_finding(finding: &Finding, uri: &Url) -> Vec<CodeAction> {
    let mut actions = Vec::new();
    let line = finding.line_start.unwrap_or(1).saturating_sub(1); // 0-indexed

    // 1. Ignore suppression
    let prefix = comment_prefix(uri);
    let ignore_text = format!(
        "{} repotoire:ignore[{}]\n",
        prefix,
        finding.detector.to_lowercase()
    );

    let ignore_edit = TextEdit {
        range: Range {
            start: Position::new(line, 0),
            end: Position::new(line, 0),
        },
        new_text: ignore_text,
    };

    actions.push(CodeAction {
        title: format!("Ignore: {} (repotoire)", finding.detector),
        kind: Some(CodeActionKind::QUICKFIX),
        edit: Some(WorkspaceEdit {
            changes: Some(HashMap::from([(uri.clone(), vec![ignore_edit])])),
            ..Default::default()
        }),
        ..Default::default()
    });

    // 2. Suggested fix (if available)
    if let Some(fix) = &finding.suggested_fix {
        actions.push(CodeAction {
            title: format!("Fix: {}", finding.title),
            kind: Some(CodeActionKind::QUICKFIX),
            // Show fix description as a comment above the line
            edit: Some(WorkspaceEdit {
                changes: Some(HashMap::from([(
                    uri.clone(),
                    vec![TextEdit {
                        range: Range {
                            start: Position::new(line, 0),
                            end: Position::new(line, 0),
                        },
                        new_text: format!("{} FIX: {}\n", comment_prefix(uri), fix),
                    }],
                )])),
                ..Default::default()
            }),
            ..Default::default()
        });
    }

    actions
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::models::Severity;
    use std::path::PathBuf;

    #[test]
    fn ignore_action_python() {
        let f = Finding {
            detector: "SQLInjection".to_string(),
            line_start: Some(10),
            affected_files: vec![PathBuf::from("/tmp/app.py")],
            title: "SQL Injection".to_string(),
            severity: Severity::Critical,
            ..Default::default()
        };
        let uri = Url::from_file_path("/tmp/app.py").unwrap();
        let actions = actions_for_finding(&f, &uri);
        assert_eq!(actions.len(), 1); // no suggested_fix
        let edit = &actions[0].edit.as_ref().unwrap().changes.as_ref().unwrap()[&uri][0];
        assert!(edit.new_text.starts_with("# repotoire:ignore"));
    }

    #[test]
    fn ignore_action_rust() {
        let f = Finding {
            detector: "UnwrapDetector".to_string(),
            line_start: Some(5),
            affected_files: vec![PathBuf::from("/tmp/main.rs")],
            title: "Unwrap".to_string(),
            severity: Severity::Medium,
            ..Default::default()
        };
        let uri = Url::from_file_path("/tmp/main.rs").unwrap();
        let actions = actions_for_finding(&f, &uri);
        let edit = &actions[0].edit.as_ref().unwrap().changes.as_ref().unwrap()[&uri][0];
        assert!(edit.new_text.starts_with("// repotoire:ignore"));
    }

    #[test]
    fn suggested_fix_action() {
        let f = Finding {
            detector: "SQLi".to_string(),
            line_start: Some(10),
            affected_files: vec![PathBuf::from("/tmp/app.py")],
            title: "SQL Injection".to_string(),
            suggested_fix: Some("Use parameterized queries".to_string()),
            severity: Severity::Critical,
            ..Default::default()
        };
        let uri = Url::from_file_path("/tmp/app.py").unwrap();
        let actions = actions_for_finding(&f, &uri);
        assert_eq!(actions.len(), 2); // ignore + fix
        assert!(actions[1].title.contains("Fix:"));
    }
}