rubik 0.1.0

data/lib/rubik/security/classifier/matcher/options.rb

@@ -0,0 +1,245 @@
+# frozen_string_literal: true
+
+require_relative "../models"
+
+module Rubik
+  module Security
+    module Classifier
+      module Matcher
+        module Options
+          def self.classify_options(argv, command_def)
+            known = []
+            unknown = []
+            overrides = []
+            risk_overrides = []
+            directories = []
+            delegations = []
+            positional = []
+            present_flags = []
+            options = command_def.options
+
+            stop_at_first_pos = command_def.delegates_to && [
+              DelegationMode::REST_ARE_ARGV,
+              DelegationMode::ARGS_ARE_EXPRESSION
+            ].include?(command_def.delegates_to.mode)
+
+            i = 0
+            end_of_options = false
+
+            while i < argv.size
+              token = argv[i]
+
+              if token == "--"
+                end_of_options = true
+                positional << token
+                i += 1
+                while i < argv.size
+                  positional << argv[i]
+                  i += 1
+                end
+                break
+              end
+
+              if end_of_options || !token.start_with?("-")
+                if stop_at_first_pos
+                  i += command_def.delegates_to.skip_leading_positionals
+                  positional.concat(argv[i..])
+                  break
+                end
+                positional << token
+                i += 1
+                next
+              end
+
+              # --key=value
+              if token.start_with?("--") && token.include?("=")
+                key, value = token.split("=", 2)
+                opt_def = options[key]
+                if opt_def
+                  known << token
+                  present_flags << key
+                  overrides << [key, opt_def.overrides] if opt_def.overrides
+                  risk_overrides << [key, opt_def.risk] if opt_def.risk
+                  directories << value if opt_def.captures_directory
+                else
+                  unknown << token
+                  present_flags << key
+                end
+                i += 1
+                next
+              end
+
+              # Long option --flag
+              if token.start_with?("--")
+                opt_def = options[token]
+                if opt_def
+                  known << token
+                  present_flags << token
+                  overrides << [token, opt_def.overrides] if opt_def.overrides
+                  risk_overrides << [token, opt_def.risk] if opt_def.risk
+                  if opt_def.delegates_to
+                    del_tokens = extract_delegation_tokens(argv, i, opt_def.delegates_to)
+                    delegations << [token, opt_def.delegates_to, del_tokens]
+                    i = skip_delegation_tokens(argv, i, opt_def.delegates_to)
+                    next
+                  end
+                  if opt_def.takes_value && i + 1 < argv.size
+                    i += 1
+                    value = argv[i]
+                    known << value
+                    directories << value if opt_def.captures_directory
+                  end
+                else
+                  unknown << token
+                  present_flags << token
+                end
+                i += 1
+                next
+              end
+
+              # Exact short option (e.g. -it, -exec)
+              opt_def = options[token]
+              if opt_def
+                known << token
+                present_flags << token
+                overrides << [token, opt_def.overrides] if opt_def.overrides
+                risk_overrides << [token, opt_def.risk] if opt_def.risk
+                if opt_def.delegates_to
+                  del_tokens = extract_delegation_tokens(argv, i, opt_def.delegates_to)
+                  delegations << [token, opt_def.delegates_to, del_tokens]
+                  i = skip_delegation_tokens(argv, i, opt_def.delegates_to)
+                  next
+                end
+                if opt_def.takes_value && i + 1 < argv.size
+                  i += 1
+                  value = argv[i]
+                  known << value
+                  directories << value if opt_def.captures_directory
+                end
+                i += 1
+                next
+              end
+
+              # Single char short option with joined value: -fvalue
+              if token.length >= 2 && token[0] == "-" && token[1] != "-"
+                short_flag = "-#{token[1]}"
+                opt_def = options[short_flag]
+
+                if opt_def&.takes_value && token.length > 2
+                  known << token
+                  present_flags << short_flag
+                  val = token[2..]
+                  overrides << [short_flag, opt_def.overrides] if opt_def.overrides
+                  risk_overrides << [short_flag, opt_def.risk] if opt_def.risk
+                  directories << val if opt_def.captures_directory
+                  i += 1
+                  next
+                end
+
+                # Combined short flags: -rf -> -r, -f
+                if opt_def && !opt_def.takes_value && token.length > 2
+                  all_known, p_flags, p_overrides, p_risk_overrides, next_i = parse_combined(
+                    token, options, argv, i, directories
+                  )
+                  if all_known
+                    known << token
+                    present_flags.concat(p_flags)
+                    overrides.concat(p_overrides)
+                    risk_overrides.concat(p_risk_overrides)
+                    i = next_i
+                    next
+                  end
+                end
+
+                if opt_def
+                  known << token
+                  present_flags << short_flag
+                  overrides << [short_flag, opt_def.overrides] if opt_def.overrides
+                  risk_overrides << [short_flag, opt_def.risk] if opt_def.risk
+                  if opt_def.takes_value && i + 1 < argv.size
+                    i += 1
+                    val = argv[i]
+                    known << val
+                    directories << val if opt_def.captures_directory
+                  end
+                  i += 1
+                  next
+                end
+              end
+
+              unknown << token
+              present_flags << token
+              i += 1
+            end
+
+            [known, unknown, overrides, risk_overrides, directories, delegations, positional, present_flags]
+          end
+
+          def self.parse_combined(token, options, argv, idx, directories)
+            p_flags = []
+            p_overrides = []
+            p_risk_overrides = []
+            curr_idx = idx + 1
+
+            (1...token.length).each do |j|
+              char_flag = "-#{token[j]}"
+              char_def = options[char_flag]
+              return [false, [], [], [], idx + 1] unless char_def
+
+              p_flags << char_flag
+              p_overrides << [char_flag, char_def.overrides] if char_def.overrides
+              p_risk_overrides << [char_flag, char_def.risk] if char_def.risk
+
+              next unless char_def.takes_value
+
+              rem = token[(j + 1)..]
+              if rem && !rem.empty?
+                directories << rem if char_def.captures_directory
+              elsif curr_idx < argv.size
+                val = argv[curr_idx]
+                curr_idx += 1
+                directories << val if char_def.captures_directory
+              end
+              break
+            end
+
+            [true, p_flags, p_overrides, p_risk_overrides, curr_idx]
+          end
+
+          def self.terminator?(token, terminator)
+            return false if terminator.nil?
+            return true if token == terminator
+
+            token == "\\#{terminator}"
+          end
+
+          def self.extract_delegation_tokens(argv, option_index, delegation)
+            return [] unless delegation.mode == DelegationMode::TERMINATED_ARGV
+
+            tokens = []
+            i = option_index + 1
+            while i < argv.size
+              break if terminator?(argv[i], delegation.terminator)
+
+              tokens << argv[i]
+              i += 1
+            end
+            tokens
+          end
+
+          def self.skip_delegation_tokens(argv, option_index, delegation)
+            return option_index + 1 unless delegation.mode == DelegationMode::TERMINATED_ARGV
+
+            i = option_index + 1
+            while i < argv.size
+              return i + 1 if terminator?(argv[i], delegation.terminator)
+
+              i += 1
+            end
+            argv.size
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubik/security/classifier/matcher/subcommands.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+require_relative "../models"
+
+module Rubik
+  module Security
+    module Classifier
+      module Matcher
+        module Subcommands
+          def self.strip_global_options(argv, command_def)
+            return [argv.dup, [], [], [], []] if command_def.global_options.empty?
+
+            remaining = []
+            ignored = []
+            directories = []
+            overrides = []
+            risk_overrides = []
+            i = 0
+
+            while i < argv.size
+              token = argv[i]
+              unless token.start_with?("-")
+                remaining.concat(argv[i..])
+                break
+              end
+
+              if token.include?("=")
+                key, val = token.split("=", 2)
+                opt_def = command_def.global_options[key]
+                if opt_def
+                  ignored << token
+                  directories << val if opt_def.captures_directory
+                  overrides << [key, opt_def.overrides] if opt_def.overrides
+                  risk_overrides << [key, opt_def.risk] if opt_def.risk
+                  i += 1
+                  next
+                end
+              end
+
+              opt_def = command_def.global_options[token]
+              if opt_def
+                ignored << token
+                overrides << [token, opt_def.overrides] if opt_def.overrides
+                risk_overrides << [token, opt_def.risk] if opt_def.risk
+                if opt_def.takes_value && i + 1 < argv.size
+                  i += 1
+                  val = argv[i]
+                  ignored << val
+                  directories << val if opt_def.captures_directory
+                end
+                i += 1
+                next
+              end
+
+              remaining << token
+              i += 1
+            end
+
+            [remaining, ignored, directories, overrides, risk_overrides]
+          end
+
+          def self.match_subcommand(argv, command_def)
+            matched_def = command_def
+            command_chain = []
+            remaining = argv.dup
+
+            until remaining.empty?
+              token = remaining.first
+              break if token.start_with?("-")
+
+              break unless matched_def.subcommands.key?(token)
+
+              matched_def = matched_def.subcommands[token]
+              command_chain << matched_def.command
+              remaining = remaining[1..]
+
+            end
+
+            [matched_def, command_chain, remaining]
+          end
+
+          def self.match_all_subcommands(argv, command_def)
+            matched_names = []
+            matched_defs = []
+            remaining = []
+
+            argv.each do |token|
+              if !token.start_with?("-") && command_def.subcommands.key?(token)
+                matched = command_def.subcommands[token]
+                matched_names << matched.command
+                matched_defs << matched
+              else
+                remaining << token
+              end
+            end
+
+            [matched_names, matched_defs, remaining]
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubik/security/classifier/matcher.rb

@@ -0,0 +1,249 @@
+# frozen_string_literal: true
+
+require_relative "models"
+require_relative "matcher/subcommands"
+require_relative "matcher/options"
+require_relative "matcher/delegation"
+
+module Rubik
+  module Security
+    module Classifier
+      module Matcher
+        BUILTIN_DIR_CMDS = ["cd", "pushd", "popd"].freeze
+        BUILTIN_READONLY_CMDS = ["[", "[[", "test"].freeze
+        BUILTIN_DANGEROUS_CMDS = ["source", "."].freeze
+
+        def self.match_command(invocation, database, parse_warnings = nil, shell: nil)
+          argv = invocation.argv
+          if argv.nil? || argv.empty?
+            return CommandResult.new(
+              command: [], argv: [], classification: Classification::UNKNOWN,
+              risk: Risk::HIGH, matched_rule: nil, inner_commands: []
+            )
+          end
+
+          binary = argv[0]
+
+          # Step 0: Builtins
+          return handle_builtin(invocation, Classification::READONLY, Risk::LOW) if BUILTIN_DIR_CMDS.include?(binary)
+          return handle_builtin(invocation, Classification::READONLY, Risk::LOW) if BUILTIN_READONLY_CMDS.include?(binary)
+          return handle_builtin(invocation, Classification::DANGEROUS, Risk::HIGH) if BUILTIN_DANGEROUS_CMDS.include?(binary)
+
+          # Step 1: Database lookup
+          command_def = database.get(binary, shell: shell)
+          if command_def.nil? && (binary.include?("/") || binary.include?("\\"))
+            basename = File.basename(binary)
+            command_def = database.get(basename, shell: shell)
+            binary = basename if command_def
+          end
+
+          unless command_def
+            return CommandResult.new(
+              command: [binary], argv: argv.dup, classification: Classification::UNKNOWN,
+              risk: Risk::HIGH, matched_rule: nil, inner_commands: [],
+              classification_reason: "command not in database"
+            )
+          end
+
+          # Step 1b: Alias resolution
+          command_def = database.resolve_alias(command_def)
+
+          # Step 2: Strip global options
+          remaining, ignored, g_dirs, g_overrides, g_risk_overrides = Subcommands.strip_global_options(
+            argv[1..], command_def
+          )
+
+          # Step 3: Subcommands
+          if command_def.subcommand_mode == :match_all
+            matched_names, matched_defs, remaining = Subcommands.match_all_subcommands(remaining, command_def)
+            matched_def = command_def
+            command_chain = matched_names
+          else
+            matched_def, command_chain, remaining = Subcommands.match_subcommand(remaining, command_def)
+            matched_defs = []
+          end
+
+          # Step 4: Options
+          _, u_opts, overrides, r_overrides, o_dirs, o_dels, rem_pos, present_flags = Options.classify_options(
+            remaining, matched_def
+          )
+
+          all_overrides = g_overrides + overrides
+          all_risk_overrides = g_risk_overrides + r_overrides
+          all_directories = g_dirs + o_dirs
+          full_command = [binary, *command_chain]
+          matched_rule = command_chain.any? ? full_command.join(".") : binary
+
+          # Step 5: Base classification & risk
+          res = compute_classification_and_risk(
+            matched_def, command_def, all_overrides, all_risk_overrides,
+            u_opts, matched_defs, rem_pos, matched_rule
+          )
+
+          # Step 6: Delegation
+          inner_commands, del_count = handle_delegations(
+            matched_def, rem_pos, o_dels, database, argv, parse_warnings, shell: shell
+          )
+
+          final_class, final_risk, final_reason = apply_inner_results(
+            res, del_count, all_overrides, u_opts, matched_def, inner_commands, matched_rule
+          )
+
+          CommandResult.new(
+            command: full_command, argv: argv.dup, classification: final_class,
+            risk: final_risk, matched_rule: matched_rule, inner_commands: inner_commands,
+            ignored_options: ignored.empty? ? nil : ignored,
+            remaining_options: u_opts.empty? ? nil : u_opts,
+            classification_reason: final_reason,
+            overriding_option: res[:overriding_option],
+            directories: all_directories.empty? ? nil : all_directories,
+            options: present_flags, positionals: rem_pos
+          )
+        end
+
+        def self.handle_builtin(inv, classification, risk)
+          CommandResult.new(
+            command: [inv.argv[0]], argv: inv.argv.dup, classification: classification,
+            risk: risk, matched_rule: nil, inner_commands: [],
+            classification_reason: "shell builtin (always #{classification})"
+          )
+        end
+
+        def self.compute_classification_and_risk(
+          matched_def, command_def, all_overrides, all_risk_overrides,
+          unknown_opts, matched_defs, rem_pos, matched_rule
+        )
+          base_class = matched_def.classification || Classification::READONLY
+          base_risk = matched_def.risk || Delegation.default_risk(base_class)
+          risk_set = !matched_def.risk.nil?
+
+          overriding_opt = nil
+          if all_overrides.any?
+            final_class = all_overrides[0][1]
+            overriding_opt = all_overrides[0][0]
+            all_overrides[1..].each do |opt_name, ov_class|
+              if Classification.severity(ov_class) > Classification.severity(final_class)
+                final_class = ov_class
+                overriding_opt = opt_name
+              end
+            end
+            reason = "overridden by option #{overriding_opt} to #{final_class}"
+          else
+            final_class = base_class
+            desc = matched_def.respond_to?(:description) ? matched_def.description : nil
+            desc = command_def.respond_to?(:description) ? command_def.description : nil if (desc.nil? || desc.to_s.empty?) && command_def
+            desc_str = desc && !desc.to_s.strip.empty? ? " (#{desc})" : ""
+            prefix = final_class == Classification::DANGEROUS ? "blocked by default rule" : "base rule"
+            reason = "#{prefix}: #{matched_rule}#{desc_str}"
+          end
+
+          final_risk = resolve_risk(all_risk_overrides, all_overrides, risk_set, final_class, base_risk)
+
+          # Check trailing global options
+          if command_def.global_options.any?
+            unknown_opts.dup.each do |opt|
+              k = opt.split("=", 2)[0]
+              g_opt = command_def.global_options[k]
+              next unless g_opt
+
+              unknown_opts.delete(opt)
+              if g_opt.overrides && Classification.severity(g_opt.overrides) > Classification.severity(final_class)
+                final_class = g_opt.overrides
+                overriding_opt = k
+                reason = "overridden by option #{k} to #{final_class}"
+              end
+              final_risk = Risk.max_severity(final_risk, g_opt.risk) if g_opt.risk
+            end
+          end
+
+          # Match-all subcommand aggregation
+          if command_def.subcommand_mode == :match_all && matched_defs.any?
+            agg_c, agg_r = aggregate_match_all(matched_defs, rem_pos, base_risk)
+            if all_overrides.any?
+              final_risk = Risk.max_severity(final_risk, agg_r)
+            else
+              final_class = Classification.max_severity(final_class, agg_c)
+              final_risk = agg_r
+            end
+          end
+
+          if matched_def.strict && unknown_opts.any?
+            final_class = Classification.max_severity(final_class, Classification::UNKNOWN)
+            reason = "unrecognized option #{unknown_opts[0]} in strict mode" if final_class == Classification::UNKNOWN
+            final_risk = Risk::HIGH
+          end
+
+          { classification: final_class, risk: final_risk, reason: reason, overriding_option: overriding_opt }
+        end
+
+        def self.resolve_risk(risk_overrides, overrides, risk_set, final_class, base_risk)
+          if risk_overrides.any?
+            risk_overrides.map(&:last).max_by { |r| Risk.severity(r) }
+          elsif overrides.any? && !risk_set
+            Delegation.default_risk(final_class)
+          else
+            base_risk
+          end
+        end
+
+        def self.aggregate_match_all(matched_defs, rem_pos, base_risk)
+          agg_c = Classification::READONLY
+          agg_r = Risk::LOW
+          matched_defs.each do |sub_def|
+            sc = sub_def.classification || Classification::READONLY
+            sr = sub_def.risk || Delegation.default_risk(sc)
+            agg_c = Classification.max_severity(agg_c, sc)
+            agg_r = Risk.max_severity(agg_r, sr)
+          end
+          agg_r = Risk.max_severity(agg_r, base_risk) if rem_pos.any? { |t| !t.start_with?("-") }
+          [agg_c, agg_r]
+        end
+
+        def self.handle_delegations(matched_def, rem_pos, o_dels, database, argv, parse_warnings, shell: nil)
+          inners = []
+          cmd_inners = 0
+
+          if matched_def.delegates_to
+            res = Delegation.handle_delegation(
+              rem_pos, matched_def.delegates_to, database, argv,
+              matched_def, parse_warnings
+            ) { |inv, db, w| match_command(inv, db, w, shell: shell) }
+            cmd_inners = res.size
+            inners.concat(res)
+          end
+
+          o_dels.each do |opt_name, del_config, del_tokens|
+            inners.concat(Delegation.handle_option_delegation(
+              opt_name, del_config, del_tokens, database, parse_warnings
+            ) { |inv, db, w| match_command(inv, db, w, shell: shell) })
+          end
+
+          [inners, cmd_inners]
+        end
+
+        def self.apply_inner_results(res, del_count, all_overrides, unknown_opts, matched_def, inners, matched_rule)
+          final_class = res[:classification]
+          final_risk = res[:risk]
+          reason = res[:reason]
+
+          if del_count.positive? && all_overrides.empty? && !(matched_def.strict && unknown_opts.any?)
+            final_class = Classification::READONLY
+            final_risk = Risk::LOW
+            reason = "delegated to inner via #{matched_rule}"
+          end
+
+          inners.each do |inner|
+            if Classification.severity(inner.classification) > Classification.severity(final_class)
+              final_class = Classification.max_severity(final_class, inner.classification)
+              reason = "elevated by inner command"
+            end
+            final_risk = Risk.max_severity(final_risk, inner.risk)
+          end
+
+          final_risk = Delegation.clamp_risk(final_class, final_risk)
+          [final_class, final_risk, reason]
+        end
+      end
+    end
+  end
+end