ephemeris_forge_github/plan/

security.rs

use ephemeris_forge::{FieldDiff, Limitation, Report};

use crate::api::model;
use crate::api::request::{AnalysisPatch, CodeScanningPatch, ReviewersBody, StatusBody};
use crate::live::SecurityView;
use crate::operation::security::Operation;
use crate::{CodeScanning, Language, Reviewer, Security, SetupState};

macro_rules! status {
    ($diff:ident, $patch:ident, $report:ident, $desired:ident, $live:ident, $($field:ident),+ $(,)?) => {$(
        if let Some(wanted) = $desired.$field {
            match $live.$field {
                Some(actual) => {
                    if $diff.check(stringify!($field), actual == wanted, &actual, &wanted) {
                        $patch.$field = Some(StatusBody { status: wanted });
                    }
                }
                None => unreadable(stringify!($field), $report),
            }
        }
    )+};
}

pub(super) fn plan(
    desired: &Security,
    live: &SecurityView<'_>,
    report: &mut Report,
) -> Vec<Operation> {
    let mut diff = FieldDiff::default();
    let mut operations = Vec::new();
    let analysis = analysis(desired, live.analysis, &mut diff, report);
    operations.extend((!analysis.is_empty()).then_some(Operation::PatchAnalysis(analysis)));
    operations.extend(switch(
        "vulnerability_alerts",
        desired.vulnerability_alerts,
        live.endpoints.vulnerability_alerts,
        Operation::SetVulnerabilityAlerts,
        &mut diff,
        report,
    ));
    operations.extend(switch(
        "automated_security_fixes",
        desired.automated_security_fixes,
        live.endpoints.automated_security_fixes,
        Operation::SetAutomatedSecurityFixes,
        &mut diff,
        report,
    ));
    operations.extend(switch(
        "private_vulnerability_reporting",
        desired.private_vulnerability_reporting,
        live.endpoints.private_vulnerability_reporting,
        Operation::SetPrivateVulnerabilityReporting,
        &mut diff,
        report,
    ));
    if let Some(wanted) = &desired.code_scanning_default_setup {
        match &live.endpoints.code_scanning_default_setup {
            Some(actual) => {
                operations.extend(code_scanning(wanted, actual, &mut diff));
            }
            None => unreadable("code_scanning_default_setup", report),
        }
    }
    diff.record("security", report);
    operations
}

fn unreadable(field: &'static str, report: &mut Report) {
    report
        .limitations
        .push(Limitation::SecurityUnreadable { field });
}

fn analysis(
    desired: &Security,
    live: &model::Analysis,
    diff: &mut FieldDiff,
    report: &mut Report,
) -> AnalysisPatch {
    let mut patch = AnalysisPatch::default();
    status!(
        diff,
        patch,
        report,
        desired,
        live,
        advanced_security,
        code_security,
        secret_scanning,
        secret_scanning_push_protection,
        secret_scanning_ai_detection,
        secret_scanning_non_provider_patterns,
        secret_scanning_delegated_alert_dismissal,
        secret_scanning_delegated_bypass,
    );
    if let Some(wanted) = &desired.secret_scanning_delegated_bypass_options.reviewers {
        if live.secret_scanning_delegated_bypass.is_none() {
            unreadable("secret_scanning_delegated_bypass_options", report);
        } else {
            let wanted = sorted(wanted);
            let actual = sorted(&live.secret_scanning_delegated_bypass_reviewers);
            if diff.check(
                "secret_scanning_delegated_bypass_options",
                wanted == actual,
                &actual,
                &wanted,
            ) {
                patch.secret_scanning_delegated_bypass_options =
                    Some(ReviewersBody { reviewers: wanted });
            }
        }
    }
    patch
}

fn sorted(reviewers: &[Reviewer]) -> Vec<Reviewer> {
    let mut reviewers = reviewers.to_vec();
    reviewers.sort_unstable();
    reviewers.dedup();
    reviewers
}

fn switch(
    field: &'static str,
    desired: Option<bool>,
    live: Option<bool>,
    operation: fn(bool) -> Operation,
    diff: &mut FieldDiff,
    report: &mut Report,
) -> Option<Operation> {
    let wanted = desired?;
    let Some(actual) = live else {
        unreadable(field, report);
        return None;
    };
    diff.check(field, actual == wanted, &actual, &wanted)
        .then(|| operation(wanted))
}

fn code_scanning(
    desired: &CodeScanning,
    live: &model::CodeScanning,
    diff: &mut FieldDiff,
) -> Option<Operation> {
    let mut changed = desired.state.is_some_and(|state| {
        diff.check(
            "code_scanning_default_setup.state",
            live.state == state,
            &live.state,
            &state,
        )
    });
    if desired.state != Some(SetupState::NotConfigured) {
        if let Some(wanted) = &desired.languages {
            let (actual, wanted) = (languages(&live.languages), languages(wanted));
            changed |= diff.check(
                "code_scanning_default_setup.languages",
                actual == wanted,
                &actual,
                &wanted,
            );
        }
        if let Some(runner_type) = desired.runner_type {
            changed |= diff.check(
                "code_scanning_default_setup.runner_type",
                live.runner_type == Some(runner_type),
                &live.runner_type,
                &Some(runner_type),
            );
        }
        if let Some(label) = &desired.runner_label {
            changed |= diff.check(
                "code_scanning_default_setup.runner_label",
                live.runner_label.as_ref() == Some(label),
                &live.runner_label,
                &Some(label),
            );
        }
        if let Some(query_suite) = desired.query_suite {
            changed |= diff.check(
                "code_scanning_default_setup.query_suite",
                live.query_suite == Some(query_suite),
                &live.query_suite,
                &Some(query_suite),
            );
        }
        if let Some(threat_model) = desired.threat_model {
            changed |= diff.check(
                "code_scanning_default_setup.threat_model",
                live.threat_model == Some(threat_model),
                &live.threat_model,
                &Some(threat_model),
            );
        }
    }
    changed.then(|| Operation::PatchCodeScanning(code_scanning_patch(desired)))
}

fn code_scanning_patch(desired: &CodeScanning) -> CodeScanningPatch {
    if desired.state == Some(SetupState::NotConfigured) {
        return CodeScanningPatch {
            state: desired.state,
            ..CodeScanningPatch::default()
        };
    }
    CodeScanningPatch {
        state: desired.state,
        languages: desired.languages.as_deref().map(languages),
        runner_type: desired.runner_type,
        runner_label: desired.runner_label.clone(),
        query_suite: desired.query_suite,
        threat_model: desired.threat_model,
    }
}

fn languages(languages: &[Language]) -> Vec<Language> {
    let mut languages = languages.to_vec();
    languages.sort_unstable();
    languages.dedup();
    languages
}