fallow_security/
rules.rs

1//! Rule-severity policy for security-aware surfaces.
2
3use fallow_config::{ResolvedConfig, Severity};
4
5/// Enable the advisory security rules for a dedicated security-aware surface.
6///
7/// Explicit user severities are preserved. Only the default `off` state is
8/// promoted to `warn`, so `fallow security` and the viz Security lens surface
9/// candidates without overriding a deliberate configuration.
10pub fn enable_security_rules(config: &mut ResolvedConfig) {
11    if config.rules.security_client_server_leak == Severity::Off {
12        config.rules.security_client_server_leak = Severity::Warn;
13    }
14    if config.rules.security_sink == Severity::Off {
15        config.rules.security_sink = Severity::Warn;
16    }
17}
18
19#[cfg(test)]
20#[allow(
21    clippy::expect_used,
22    reason = "fixture setup asserts its own invariants directly"
23)]
24mod tests {
25    use super::enable_security_rules;
26
27    #[test]
28    fn enables_only_default_off_security_rules() {
29        let project = tempfile::tempdir().expect("temp dir");
30        let mut config = fallow_config::FallowConfig::default().resolve(
31            project.path().to_path_buf(),
32            fallow_config::OutputFormat::Human,
33            1,
34            true,
35            true,
36            None,
37        );
38        config.rules.security_client_server_leak = fallow_config::Severity::Off;
39        config.rules.security_sink = fallow_config::Severity::Error;
40
41        enable_security_rules(&mut config);
42
43        assert_eq!(
44            config.rules.security_client_server_leak,
45            fallow_config::Severity::Warn
46        );
47        assert_eq!(config.rules.security_sink, fallow_config::Severity::Error);
48    }
49}
fallow_security/rules.rs

fallow_security/
rules.rs
