sbom_tools/diff/
engine.rs

1//! Semantic diff engine implementation.
2
3use super::changes::{
4    ComponentChangeComputer, DependencyChangeComputer, LicenseChangeComputer,
5    VulnerabilityChangeComputer,
6};
7pub use super::engine_config::LargeSbomConfig;
8use super::engine_matching::{match_components, ComponentMatchResult};
9use super::engine_rules::{apply_rules, remap_match_result};
10use super::traits::ChangeComputer;
11use super::{diff_dependency_graph, CostModel, DiffResult, GraphDiffConfig, MatchInfo};
12use crate::error::SbomDiffError;
13use crate::matching::{
14    ComponentMatcher, FuzzyMatchConfig, FuzzyMatcher, MatchingRulesConfig, RuleEngine,
15};
16use crate::model::NormalizedSbom;
17use std::borrow::Cow;
18
19/// Semantic diff engine for comparing SBOMs.
20#[must_use]
21pub struct DiffEngine {
22    cost_model: CostModel,
23    fuzzy_config: FuzzyMatchConfig,
24    include_unchanged: bool,
25    graph_diff_config: Option<GraphDiffConfig>,
26    rule_engine: Option<RuleEngine>,
27    custom_matcher: Option<Box<dyn ComponentMatcher>>,
28    large_sbom_config: LargeSbomConfig,
29}
30
31impl DiffEngine {
32    /// Create a new diff engine with default settings
33    pub fn new() -> Self {
34        Self {
35            cost_model: CostModel::default(),
36            fuzzy_config: FuzzyMatchConfig::balanced(),
37            include_unchanged: false,
38            graph_diff_config: None,
39            rule_engine: None,
40            custom_matcher: None,
41            large_sbom_config: LargeSbomConfig::default(),
42        }
43    }
44
45    /// Create a diff engine with a custom cost model
46    pub const fn with_cost_model(mut self, cost_model: CostModel) -> Self {
47        self.cost_model = cost_model;
48        self
49    }
50
51    /// Set fuzzy matching configuration
52    pub const fn with_fuzzy_config(mut self, config: FuzzyMatchConfig) -> Self {
53        self.fuzzy_config = config;
54        self
55    }
56
57    /// Include unchanged components in the result
58    pub const fn include_unchanged(mut self, include: bool) -> Self {
59        self.include_unchanged = include;
60        self
61    }
62
63    /// Enable graph-aware diffing with the given configuration
64    pub const fn with_graph_diff(mut self, config: GraphDiffConfig) -> Self {
65        self.graph_diff_config = Some(config);
66        self
67    }
68
69    /// Set custom matching rules from a configuration
70    pub fn with_matching_rules(mut self, config: MatchingRulesConfig) -> Result<Self, String> {
71        self.rule_engine = Some(RuleEngine::new(config)?);
72        Ok(self)
73    }
74
75    /// Set custom matching rules engine directly
76    pub fn with_rule_engine(mut self, engine: RuleEngine) -> Self {
77        self.rule_engine = Some(engine);
78        self
79    }
80
81    /// Set a custom component matcher.
82    pub fn with_matcher(mut self, matcher: Box<dyn ComponentMatcher>) -> Self {
83        self.custom_matcher = Some(matcher);
84        self
85    }
86
87    /// Configure large SBOM optimization settings.
88    pub const fn with_large_sbom_config(mut self, config: LargeSbomConfig) -> Self {
89        self.large_sbom_config = config;
90        self
91    }
92
93    /// Get the large SBOM configuration.
94    #[must_use] 
95    pub const fn large_sbom_config(&self) -> &LargeSbomConfig {
96        &self.large_sbom_config
97    }
98
99    /// Check if a custom matcher is configured
100    #[must_use] 
101    pub fn has_custom_matcher(&self) -> bool {
102        self.custom_matcher.is_some()
103    }
104
105    /// Check if graph diffing is enabled
106    #[must_use] 
107    pub const fn graph_diff_enabled(&self) -> bool {
108        self.graph_diff_config.is_some()
109    }
110
111    /// Check if custom matching rules are configured
112    #[must_use] 
113    pub const fn has_matching_rules(&self) -> bool {
114        self.rule_engine.is_some()
115    }
116
117    /// Compare two SBOMs and return the diff result
118    #[must_use = "diff result contains all changes and should not be discarded"]
119    pub fn diff(&self, old: &NormalizedSbom, new: &NormalizedSbom) -> Result<DiffResult, SbomDiffError> {
120        let mut result = DiffResult::new();
121
122        // Quick check: if content hashes match, SBOMs are identical
123        if old.content_hash == new.content_hash && old.content_hash != 0 {
124            return Ok(result);
125        }
126
127        // Apply custom matching rules if configured
128        // Use Cow to avoid cloning SBOMs when no rules are applied
129        let (old_filtered, new_filtered, canonical_maps) =
130            if let Some(rule_result) = apply_rules(self.rule_engine.as_ref(), old, new) {
131                result.rules_applied = rule_result.rules_count;
132                (
133                    Cow::Owned(rule_result.old_filtered),
134                    Cow::Owned(rule_result.new_filtered),
135                    Some((rule_result.old_canonical, rule_result.new_canonical)),
136                )
137            } else {
138                (Cow::Borrowed(old), Cow::Borrowed(new), None)
139            };
140
141        // Build component mappings using the configured matcher
142        let default_matcher = FuzzyMatcher::new(self.fuzzy_config.clone());
143        let matcher: &dyn ComponentMatcher = self
144            .custom_matcher
145            .as_ref()
146            .map_or(&default_matcher as &dyn ComponentMatcher, |m| m.as_ref());
147
148        let mut component_matches = match_components(
149            &old_filtered,
150            &new_filtered,
151            matcher,
152            &self.fuzzy_config,
153            &self.large_sbom_config,
154        );
155
156        // Apply canonical mappings from rule engine
157        if let Some((old_canonical, new_canonical)) = &canonical_maps {
158            component_matches = remap_match_result(&component_matches, old_canonical, new_canonical);
159        }
160
161        // Compute changes using the modular change computers
162        self.compute_all_changes(&old_filtered, &new_filtered, &component_matches, matcher, &mut result);
163
164        // Perform graph-aware diffing if enabled
165        if let Some(ref graph_config) = self.graph_diff_config {
166            let (graph_changes, graph_summary) =
167                diff_dependency_graph(&old_filtered, &new_filtered, &component_matches.matches, graph_config);
168            result.graph_changes = graph_changes;
169            result.graph_summary = Some(graph_summary);
170        }
171
172        // Calculate semantic score
173        result.semantic_score = self.cost_model.calculate_semantic_score(
174            result.components.added.len(),
175            result.components.removed.len(),
176            result.components.modified.len(),
177            result.licenses.component_changes.len(),
178            result.vulnerabilities.introduced.len(),
179            result.vulnerabilities.resolved.len(),
180            result.dependencies.added.len(),
181            result.dependencies.removed.len(),
182        );
183
184        result.calculate_summary();
185        Ok(result)
186    }
187
188    /// Compute all changes using the modular change computers.
189    fn compute_all_changes(
190        &self,
191        old: &NormalizedSbom,
192        new: &NormalizedSbom,
193        match_result: &ComponentMatchResult,
194        matcher: &dyn ComponentMatcher,
195        result: &mut DiffResult,
196    ) {
197        // Component changes
198        let comp_computer = ComponentChangeComputer::new(self.cost_model.clone());
199        let comp_changes = comp_computer.compute(old, new, &match_result.matches);
200        result.components.added = comp_changes.added;
201        result.components.removed = comp_changes.removed;
202        result.components.modified = comp_changes
203            .modified
204            .into_iter()
205            .map(|mut change| {
206                // Add match explanation for modified components
207                // Use stored canonical IDs directly instead of reconstructing from name+version
208                if let (Some(old_id), Some(new_id)) =
209                    (&change.old_canonical_id, &change.canonical_id)
210                    && let (Some(old_comp), Some(new_comp)) =
211                        (old.components.get(old_id), new.components.get(new_id))
212                    {
213                        let explanation = matcher.explain_match(old_comp, new_comp);
214                        let mut match_info = MatchInfo::from_explanation(&explanation);
215
216                        // Use the actual score from the matching phase if available
217                        if let Some(&score) =
218                            match_result.pairs.get(&(old_id.clone(), new_id.clone()))
219                        {
220                            match_info.score = score;
221                        }
222
223                        change = change.with_match_info(match_info);
224                    }
225                change
226            })
227            .collect();
228
229        // Dependency changes
230        let dep_computer = DependencyChangeComputer::new();
231        let dep_changes = dep_computer.compute(old, new, &match_result.matches);
232        result.dependencies.added = dep_changes.added;
233        result.dependencies.removed = dep_changes.removed;
234
235        // License changes
236        let lic_computer = LicenseChangeComputer::new();
237        let lic_changes = lic_computer.compute(old, new, &match_result.matches);
238        result.licenses.new_licenses = lic_changes.new_licenses;
239        result.licenses.removed_licenses = lic_changes.removed_licenses;
240
241        // Vulnerability changes
242        let vuln_computer = VulnerabilityChangeComputer::new();
243        let vuln_changes = vuln_computer.compute(old, new, &match_result.matches);
244        result.vulnerabilities.introduced = vuln_changes.introduced;
245        result.vulnerabilities.resolved = vuln_changes.resolved;
246        result.vulnerabilities.persistent = vuln_changes.persistent;
247    }
248}
249
250impl Default for DiffEngine {
251    fn default() -> Self {
252        Self::new()
253    }
254}
255
256#[cfg(test)]
257mod tests {
258    use super::*;
259
260    #[test]
261    fn test_empty_diff() {
262        let engine = DiffEngine::new();
263        let sbom = NormalizedSbom::default();
264        let result = engine.diff(&sbom, &sbom).expect("diff should succeed");
265        assert!(!result.has_changes());
266    }
267}
sbom_tools/diff/engine.rs

sbom_tools/diff/
engine.rs
