zoi_resolver/

mini_resolve.rs

//! Optimized dependency resolution for Zoi Mini.
//!
//! This module provides a fast, lightweight resolution path that uses a
//! pre-compiled JSON index instead of full registry checkouts.

use std::collections::HashMap;

use anyhow::{Result, anyhow};
use colored::Colorize;
use serde::{Deserialize, Serialize};
pub use zoi_core::types::MiniVulnerability;

/// Returns the default package revision ("1").
fn default_revision() -> String {
    "1".to_string()
}

/// A simplified version of package metadata used in Zoi Mini's remote index.
///
/// This index allows Zoi Mini to perform fast lookups and vulnerability checks
/// without downloading individual `.pkg.lua` files or cloning entire
/// registries.
#[derive(Debug, Serialize, Deserialize, Clone)]
pub struct MiniPackageIndex {
    /// The repository where the package is located.
    pub repo: String,
    /// The type of repository (e.g. official, unofficial).
    pub repo_type: String,
    /// The current version of the package.
    pub version: String,
    /// The revision of the package version.
    #[serde(default = "default_revision")]
    pub revision: String,
    /// A short description of the package.
    pub description: String,
    /// A list of sub-packages provided by this package.
    #[serde(default, deserialize_with = "deserialize_sub_packages")]
    pub sub_packages: Option<Vec<String>>,
    /// Known vulnerabilities for this package.
    pub vuln: Option<Vec<MiniVulnerability>>
}

/// Custom deserializer for sub-packages to handle potential null or non-array
/// values gracefully.
fn deserialize_sub_packages<'de, D>(
    deserializer: D
) -> Result<Option<Vec<String>>, D::Error>
where
    D: serde::Deserializer<'de>
{
    let v: serde_json::Value = serde::Deserialize::deserialize(deserializer)?;
    if v.is_array() {
        Ok(serde_json::from_value(v).ok())
    } else {
        Ok(None)
    }
}

/// A mapping of package names to their metadata in the Mini index.
#[derive(Debug, Serialize, Deserialize, Clone)]
pub struct MiniRegistryIndex {
    /// The collection of packages in the index.
    pub packages: HashMap<String, MiniPackageIndex>
}

/// Returns the set (default) built-in registry to use for Mini resolution.
///
/// # Errors
///
/// Returns an error if no built-in registry is marked as the set registry or
/// if the built-in definitions are invalid.
fn set_registry_info() -> Result<(String, String)> {
    let reg = zoi_core::builtin::registry::get_set()?.ok_or_else(|| {
        anyhow!(
            "No set registry is defined in the built-in registries. Please \
             reinstall Zoi."
        )
    })?;
    Ok((reg.git, reg.branch))
}

/// Fetches the optimized JSON index from the set built-in registry.
///
/// This index is the backbone of Zoi Mini, providing a pre-resolved mapping
/// of package names to their current versions and metadata.
///
/// # Errors
///
/// Returns an error if the index cannot be fetched or parsed.
pub fn fetch_registry_index() -> Result<MiniRegistryIndex> {
    let (git, branch) = set_registry_info()?;
    let url = zoi_purl::construct_raw_url(&git, &branch, "packages.json")?;
    let client = zoi_core::utils::get_http_client()?;
    let response = client.get(url).send()?;
    if !response.status().is_success() {
        return Err(anyhow!(
            "Failed to fetch packages.json from registry: {}",
            response.status()
        ));
    }
    let index: MiniRegistryIndex = response.json()?;
    Ok(index)
}

/// Fetches the repository configuration from the set built-in registry.
///
/// # Errors
///
/// Returns an error if the configuration cannot be fetched or parsed.
pub fn fetch_registry_config() -> Result<zoi_core::types::RepoConfig> {
    let (git, branch) = set_registry_info()?;
    let url = zoi_purl::construct_raw_url(&git, &branch, "repo.yaml")?;
    let client = zoi_core::utils::get_http_client()?;
    let response = client.get(url).send()?;
    if !response.status().is_success() {
        return Err(anyhow!(
            "Failed to fetch repo.yaml from registry: {}",
            response.status()
        ));
    }
    let content = response.text()?;
    let config: zoi_core::types::RepoConfig = serde_yaml::from_str(&content)?;
    Ok(config)
}

/// Returns the URL to download a package's `.pkg.lua` file from the set
/// built-in registry.
pub fn get_package_lua_url(repo: &str, name: &str) -> String {
    let file_path = if repo.is_empty() {
        format!("{name}/{name}.pkg.lua")
    } else {
        format!("{repo}/{name}/{name}.pkg.lua")
    };
    let (git, branch) = set_registry_info().unwrap_or_else(|_| {
        (
            "https://gitlab.com/zillowe/zillwen/zusty/zoidberg".to_string(),
            "main".to_string()
        )
    });
    zoi_purl::construct_raw_url(&git, &branch, &file_path).unwrap_or(file_path)
}

/// Scans the package metadata for known security advisories.
///
/// Returns `true` if the package is safe to install, or if the user
/// explicitly chooses to bypass a security warning.
///
/// # Errors
///
/// Returns an error if the version cannot be parsed or if the user confirmation
/// fails.
pub fn check_vulnerabilities(
    pkg_name: &str,
    pkg_index: &MiniPackageIndex,
    version: &str
) -> Result<bool> {
    let Some(vulns) = &pkg_index.vuln else {
        return Ok(true);
    };

    let target_version =
        semver::Version::parse(version.trim_start_matches('v'))
            .map_err(|e| anyhow!("Failed to parse version {version}: {e}"))?;

    let mut affected = Vec::new();

    for vuln in vulns {
        if let Ok(req) = semver::VersionReq::parse(&vuln.affected_range)
            && req.matches(&target_version)
        {
            affected.push(vuln);
        }
    }

    if affected.is_empty() {
        return Ok(true);
    }

    println!("\n{}", "SECURITY WARNING".red().bold());
    for vuln in affected {
        println!(
            "Package {} v{} is known to be vulnerable:",
            pkg_name.cyan().bold(),
            version.red()
        );
        println!(
            "[{}] {} (Severity: {})",
            vuln.id.dimmed(),
            vuln.summary,
            vuln.severity.to_uppercase()
        );
        if let Some(fixed) = &vuln.fixed_in {
            println!("Fixed in version: {}", fixed.green());
        }
        println!();
    }

    Ok(zoi_core::utils::ask_for_confirmation(
        "Do you want to continue with the installation anyway?",
        false
    ))
}