infraweaver 0.1.0

package/src/mcp/terraform/suppressions.ts

@@ -0,0 +1,551 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { parse as parseYaml } from "yaml";
+import { CONFIG_FILE, CONFIG_FILE_JSON } from "#app/brand";
+import { isPathAllowed } from "#app/mcp/guardrails";
+import { NATIVE_SOURCE } from "#app/mcp/terraform/nativeRules";
+import type { Concern, ConcernSuppression } from "#app/mcp/terraform/types";
+import { neutralizeMarkup } from "#app/mcp/untrustedContent";
+import { readConfigAtBaseRef } from "#app/utils/baseRefConfig";
+import { log } from "#app/utils/cli";
+import { INFRAWEAVER_CONFIG_FILENAMES } from "#app/utils/infraweaverConfig";
+
+export type SuppressionSource = ConcernSuppression["source"];
+
+export interface Suppression {
+  source: SuppressionSource;
+  rule: string;
+  reason: string;
+  expires: string | null;
+  paths: string[];
+  file: string | null;
+  /** Set when this came from a NATIVE scanner skip directive (checkov/tfsec/trivy)
+   *  rather than a `#infraweaver:ignore`. The owning scanner already honours it; we
+   *  carry the provenance so the unified audit trail shows where it came from. */
+  tool?: string;
+}
+
+export interface ParsedSuppressions {
+  suppressions: Suppression[];
+  warnings: string[];
+}
+
+const NAMESPACES: ReadonlySet<string> = new Set([
+  "trivy",
+  "checkov",
+  "tflint",
+  "tfsec",
+  "terraform-fmt",
+  "terraform-validate",
+  // the native rule pack — `#infraweaver:ignore:infraweaver:<rule>: reason`. The bare
+  // form (`#infraweaver:ignore:<rule>: reason`) also works via `ruleMatches`.
+  NATIVE_SOURCE,
+]);
+
+const ISO_DATE = /^\d{4}-\d{2}-\d{2}$/;
+const INLINE_DIRECTIVE = /#\s*infraweaver:ignore:(.+)$/i;
+const EXPIRES_TOKEN = /\b(?:expires|until)=(\d{4}-\d{2}-\d{2})\b/i;
+
+function splitRuleAndReason(
+  rest: string,
+): { rule: string; reason: string } | null {
+  const parts = rest.split(":");
+  if (parts.length < 2) return null;
+  const first = (parts[0] ?? "").trim();
+  let rule: string;
+  let reasonParts: string[];
+  if (NAMESPACES.has(first.toLowerCase()) && parts.length >= 3) {
+    rule = `${first}:${(parts[1] ?? "").trim()}`;
+    reasonParts = parts.slice(2);
+  } else {
+    rule = first;
+    reasonParts = parts.slice(1);
+  }
+  const reason = reasonParts.join(":").trim();
+  if (!rule || !reason) return null;
+  return { rule, reason };
+}
+
+function extractExpiry(reason: string): {
+  reason: string;
+  expires: string | null;
+} {
+  const match = reason.match(EXPIRES_TOKEN);
+  if (!match) return { reason, expires: null };
+  const cleaned = reason
+    .replace(EXPIRES_TOKEN, "")
+    .replace(/\s{2,}/g, " ")
+    .trim();
+  return { reason: cleaned, expires: match[1] ?? null };
+}
+
+export function parseInlineSuppressions(
+  content: string,
+  file: string,
+): ParsedSuppressions {
+  const suppressions: Suppression[] = [];
+  const warnings: string[] = [];
+  const lines = content.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i] ?? "";
+    const directive = line.match(INLINE_DIRECTIVE);
+    if (!directive) continue;
+    const split = splitRuleAndReason((directive[1] ?? "").trim());
+    if (!split) {
+      warnings.push(
+        `${file}:${i + 1}: #infraweaver:ignore needs <rule>:<reason> — "${line.trim()}" ignored`,
+      );
+      continue;
+    }
+    const { reason: rawReason, expires } = extractExpiry(split.reason);
+    // LLM01. The reason is free text written by whoever authored the file under
+    // examination, and it travels a long way: into the agent's context via
+    // `terraform_scan`'s `suppressed[].suppression`, and outward into the SARIF
+    // suppression justification and the PR body. Neutralise the markup here, at
+    // the single parse point, rather than at each of those surfaces. The
+    // directive is matched per line, so the newline collapse is a no-op and the
+    // reason stays readable. A reason that neutralises to nothing was never a
+    // reason — it falls into the existing "needs a reason" warning below.
+    const reason = neutralizeMarkup(rawReason);
+    if (!reason) {
+      warnings.push(
+        `${file}:${i + 1}: #infraweaver:ignore needs a reason — ignored`,
+      );
+      continue;
+    }
+    suppressions.push({
+      source: "inline",
+      rule: split.rule,
+      reason,
+      expires,
+      paths: [],
+      file,
+    });
+  }
+  return { suppressions, warnings };
+}
+
+interface NativePattern {
+  tool: string;
+  re: RegExp;
+}
+
+// Native scanner skip directives. The owning scanner already honours these (so the
+// finding never reaches Infraweaver), but we parse them too so a native skip is
+// VISIBLE in Infraweaver's unified audit trail — carrying the scanner provenance —
+// instead of silently vanishing. `#infraweaver:ignore` (above) remains the portable,
+// reason-mandatory form; these stay honoured by their own scanners (pass-through).
+const NATIVE_PATTERNS: readonly NativePattern[] = [
+  // checkov:skip=CKV_AWS_20[:optional reason]
+  {
+    tool: "checkov",
+    re: /#\s*checkov:skip=([A-Za-z0-9_]+)(?::\s*(.*\S))?\s*$/i,
+  },
+  // tfsec:ignore:rule[:exp:YYYY-MM-DD]
+  {
+    tool: "tfsec",
+    re: /#\s*tfsec:ignore:([A-Za-z0-9._-]+)(?::exp:(\d{4}-\d{2}-\d{2}))?\s*$/i,
+  },
+  // trivy:ignore:rule [exp:YYYY-MM-DD]
+  {
+    tool: "trivy",
+    re: /#\s*trivy:ignore:([A-Za-z0-9._\-*]+)(?:\s+exp:(\d{4}-\d{2}-\d{2}))?\s*$/i,
+  },
+];
+
+/** A native scanner-skip directive with its source location — the line-aware shape
+ *  behind both the suppression pipeline and the orphan-skip audit. */
+export interface NativeSkip {
+  tool: string;
+  /** namespaced rule, e.g. "checkov:CKV_AWS_20" — matches a concern's `rule_id`. */
+  rule: string;
+  reason: string;
+  expires: string | null;
+  file: string;
+  /** 1-based line of the directive. */
+  line: number;
+}
+
+/** Collect every native scanner-skip directive in a file, WITH line numbers. The
+ *  single source of truth for native-skip parsing (used by the suppression pipeline
+ *  and the orphan-skip audit). At most one directive per line. */
+export function collectNativeSkips(
+  content: string,
+  file: string,
+): NativeSkip[] {
+  const out: NativeSkip[] = [];
+  const lines = content.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i] ?? "";
+    for (const { tool, re } of NATIVE_PATTERNS) {
+      const m = line.match(re);
+      if (!m) continue;
+      const ruleId = (m[1] ?? "").trim();
+      if (!ruleId) break;
+      // checkov captures a reason in group 2; tfsec/trivy capture an expiry there.
+      // The reason is repo-authored free text — neutralised for the same reason
+      // as `parseInlineSuppressions` below, and it reaches one channel that form
+      // doesn't: `orphan_native_skips[].reason`, which is surfaced precisely
+      // because nothing else audits it.
+      const reason = tool === "checkov" ? neutralizeMarkup(m[2] ?? "") : "";
+      const expires = tool === "checkov" ? null : (m[2] ?? null);
+      out.push({
+        tool,
+        rule: `${tool}:${ruleId}`,
+        reason: reason || `Native ${tool} skip directive`,
+        expires,
+        file,
+        line: i + 1,
+      });
+      break; // at most one directive per line
+    }
+  }
+  return out;
+}
+
+/**
+ * Parse native scanner skip directives (`#checkov:skip=…`, `#tfsec:ignore:…`,
+ * `#trivy:ignore:…`) into the unified `Suppression` shape so they can be honoured
+ * and audited alongside `#infraweaver:ignore`. Native skips don't mandate a reason
+ * (their tools don't), so a synthetic one records the provenance. The rule is
+ * namespaced (`checkov:CKV_AWS_20`) so it matches a surviving concern's `rule_id`.
+ */
+export function parseNativeSuppressions(
+  content: string,
+  file: string,
+): ParsedSuppressions {
+  const suppressions: Suppression[] = collectNativeSkips(content, file).map(
+    (s) => ({
+      source: "inline",
+      tool: s.tool,
+      rule: s.rule,
+      reason: s.reason,
+      expires: s.expires,
+      paths: [],
+      file: s.file,
+    }),
+  );
+  return { suppressions, warnings: [] };
+}
+
+/**
+ * Native skips that NO concern corresponds to — the owning scanner already dropped
+ * the finding (or the rule never fired), so the skip is invisible to Infraweaver's
+ * gate and posture. Surfacing these keeps scanner-native suppressions auditable
+ * (a `#checkov:skip` can silently hide a real issue forever). A skip "matches" a
+ * concern when its rule matches (exact / bare / `:suffix`) AND the file is the same.
+ * Canonical cross-rule matching (a trivy skip vs a checkov concern for the *same*
+ * issue) is a future taxonomy refinement — see `taxonomy.ts`.
+ */
+export function findOrphanNativeSkips(
+  skips: NativeSkip[],
+  concerns: Concern[],
+): NativeSkip[] {
+  return skips.filter(
+    (s) =>
+      !concerns.some(
+        (c) => c.location.file === s.file && ruleMatches(s.rule, c),
+      ),
+  );
+}
+
+export interface NativeSkipAudit {
+  /** every native skip found in the scanned tree. */
+  skips: NativeSkip[];
+  /** the subset with no corresponding concern (the audit signal). */
+  orphans: NativeSkip[];
+}
+
+/**
+ * Walk a file list, collect native skips, and partition them against the scan's
+ * concern set. `read` returns a file's content or null (missing). Pure given its
+ * inputs, so it's unit-testable without a real tree.
+ */
+export function auditNativeSkips(
+  files: string[],
+  concerns: Concern[],
+  read: (relPath: string) => string | null,
+): NativeSkipAudit {
+  const skips: NativeSkip[] = [];
+  for (const f of files) {
+    const content = read(f);
+    if (content === null) continue;
+    skips.push(...collectNativeSkips(content, f));
+  }
+  return { skips, orphans: findOrphanNativeSkips(skips, concerns) };
+}
+
+interface RawPolicyEntry {
+  rule?: unknown;
+  reason?: unknown;
+  expires?: unknown;
+  paths?: unknown;
+}
+
+function normalizePaths(value: unknown): string[] {
+  if (typeof value === "string") {
+    return value
+      .split(/[\n,]/)
+      .map((s) => s.trim())
+      .filter(Boolean);
+  }
+  if (Array.isArray(value)) {
+    return value
+      .filter((v): v is string => typeof v === "string")
+      .map((v) => v.trim())
+      .filter(Boolean);
+  }
+  return [];
+}
+
+export function parseSuppressionPolicy(
+  raw: string,
+  format: "yaml" | "json",
+): ParsedSuppressions {
+  const label = format === "json" ? CONFIG_FILE_JSON : CONFIG_FILE;
+  const suppressions: Suppression[] = [];
+  const warnings: string[] = [];
+  let doc: unknown;
+  try {
+    if (format === "json") {
+      if (raw.trim() === "") return { suppressions, warnings };
+      doc = JSON.parse(raw);
+    } else {
+      doc = parseYaml(raw);
+    }
+  } catch {
+    return { suppressions, warnings };
+  }
+  if (!doc || typeof doc !== "object" || Array.isArray(doc))
+    return { suppressions, warnings };
+  const block = (doc as Record<string, unknown>).suppressions;
+  if (block === undefined) return { suppressions, warnings };
+  if (!Array.isArray(block)) {
+    warnings.push(
+      `${label}: "suppressions" must be a list of { rule, reason } entries — ignored`,
+    );
+    return { suppressions, warnings };
+  }
+  block.forEach((entry, idx) => {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+      warnings.push(
+        `${label}: suppressions[${idx}] must be a mapping — ignored`,
+      );
+      return;
+    }
+    const e = entry as RawPolicyEntry;
+    const rule = typeof e.rule === "string" ? e.rule.trim() : "";
+    // Neutralised like the two inline forms above, so all three suppression
+    // sources are treated identically at their parse point. This one is
+    // base-ref-read (a fork PR cannot introduce it), but it is the only form
+    // that can carry a multi-line YAML scalar — exactly the shape that renders
+    // as its own section in a PR body.
+    const reason =
+      typeof e.reason === "string" ? neutralizeMarkup(e.reason) : "";
+    if (!rule || !reason) {
+      warnings.push(
+        `${label}: suppressions[${idx}] needs a non-empty "rule" and "reason" — ignored`,
+      );
+      return;
+    }
+    let expires: string | null = null;
+    if (e.expires !== undefined && e.expires !== null) {
+      const exp = String(e.expires).trim();
+      if (!ISO_DATE.test(exp)) {
+        warnings.push(
+          `${label}: suppressions[${idx}] "expires" must be YYYY-MM-DD — entry ignored`,
+        );
+        return;
+      }
+      expires = exp;
+    }
+    suppressions.push({
+      source: "policy",
+      rule,
+      reason,
+      expires,
+      paths: normalizePaths(e.paths),
+      file: null,
+    });
+  });
+  return { suppressions, warnings };
+}
+
+export function loadSuppressionPolicy(
+  cwd: string | undefined,
+): ParsedSuppressions {
+  const root = cwd ?? process.cwd();
+  for (const name of INFRAWEAVER_CONFIG_FILENAMES) {
+    let raw: string;
+    try {
+      raw = readFileSync(join(root, name), "utf-8");
+    } catch {
+      continue;
+    }
+    return parseSuppressionPolicy(
+      raw,
+      name.endsWith(".json") ? "json" : "yaml",
+    );
+  }
+  return { suppressions: [], warnings: [] };
+}
+
+/**
+ * The suppression policy that APPLIES to this run.
+ *
+ * On a pull-request run the `suppressions:` block is read from the **base ref**,
+ * not the PR's head: a waiver is an accepted risk, and accepting it is exactly
+ * what the review is for. Letting a PR silence the finding that would otherwise
+ * block it is the self-approval hole the two-person SoD on waivers (§5.3) exists
+ * to close — this closes the file-shaped version of it. A PR that adds a waiver
+ * still sees the finding; the waiver applies from the next run on the merged base.
+ *
+ * Everything degrades to the head value with a warning when the base ref can't
+ * be read (shallow clone) or the run isn't a PR — stated, never silent.
+ */
+export function loadSuppressionPolicyForRun(
+  cwd: string | undefined,
+): ParsedSuppressions {
+  const root = cwd ?? process.cwd();
+  const baseRef = process.env.GITHUB_BASE_REF?.trim() || undefined;
+  if (!baseRef) return loadSuppressionPolicy(root);
+
+  const source = readConfigAtBaseRef(root, baseRef);
+  if (source.kind === "unavailable") {
+    const head = loadSuppressionPolicy(root);
+    if (head.suppressions.length > 0) {
+      head.warnings.push(
+        `could not read the base ref (${baseRef}) to resolve the suppression policy — applying ` +
+          `this ref's ${head.suppressions.length} suppression(s). A shallow clone causes this; ` +
+          "`fetch-depth: 0` (or fetching the base branch) restores the check.",
+      );
+    }
+    return head;
+  }
+
+  const base =
+    source.kind === "file"
+      ? parseSuppressionPolicy(source.raw, source.format)
+      : { suppressions: [], warnings: [] };
+  const headCount = loadSuppressionPolicy(root).suppressions.length;
+  if (headCount !== base.suppressions.length) {
+    base.warnings.push(
+      `the suppression policy differs from the base ref (${source.ref}) — applying the BASE ` +
+        `policy (${base.suppressions.length} entry/entries, not ${headCount}) so this change ` +
+        "cannot waive the findings reviewing it. It takes effect once merged.",
+    );
+  }
+  return base;
+}
+
+function toIsoDate(d: Date): string {
+  return d.toISOString().slice(0, 10);
+}
+
+function isActive(s: Suppression, now: Date): boolean {
+  if (!s.expires) return true;
+  return s.expires >= toIsoDate(now);
+}
+
+function ruleMatches(rule: string, concern: Concern): boolean {
+  const wanted = rule.toLowerCase();
+  const ruleId = concern.rule_id.toLowerCase();
+  if (ruleId === wanted) return true;
+  const prefix = `${concern.source.toLowerCase()}:`;
+  const bare = ruleId.startsWith(prefix) ? ruleId.slice(prefix.length) : ruleId;
+  if (bare === wanted) return true;
+  return ruleId.endsWith(`:${wanted}`);
+}
+
+function scopeMatches(s: Suppression, file: string): boolean {
+  if (s.source === "inline") return s.file === file;
+  if (s.paths.length === 0) return true;
+  return isPathAllowed(file, s.paths);
+}
+
+function matches(s: Suppression, concern: Concern, now: Date): boolean {
+  return (
+    isActive(s, now) &&
+    ruleMatches(s.rule, concern) &&
+    scopeMatches(s, concern.location.file)
+  );
+}
+
+export interface ApplySuppressionsOptions {
+  policy: Suppression[];
+  cwd: string;
+  now?: Date;
+  readFile?: (relPath: string) => string | null;
+  onWarn?: (warning: string) => void;
+}
+
+export function applySuppressions(
+  concerns: Concern[],
+  opts: ApplySuppressionsOptions,
+): Concern[] {
+  const now = opts.now ?? new Date();
+  const read = opts.readFile ?? ((rel) => defaultRead(opts.cwd, rel));
+  const inlineByFile = new Map<string, Suppression[]>();
+
+  const inlineFor = (file: string): Suppression[] => {
+    const cached = inlineByFile.get(file);
+    if (cached) return cached;
+    const content = read(file);
+    const parsed =
+      content === null ? [] : collectInline(content, file, opts.onWarn);
+    inlineByFile.set(file, parsed);
+    return parsed;
+  };
+
+  return concerns.map((concern) => {
+    const candidates = [...inlineFor(concern.location.file), ...opts.policy];
+    const hit = candidates.find((s) => matches(s, concern, now));
+    if (!hit) return concern;
+    return {
+      ...concern,
+      // A native skip keeps source "inline" (it IS an inline directive) but tags its
+      // scanner provenance into the reason so the audit trail shows where it came from.
+      suppression: {
+        source: hit.source,
+        reason: hit.tool ? `${hit.reason} [via ${hit.tool} skip]` : hit.reason,
+        expires: hit.expires,
+      },
+    };
+  });
+}
+
+function collectInline(
+  content: string,
+  file: string,
+  onWarn: ((warning: string) => void) | undefined,
+): Suppression[] {
+  const inline = parseInlineSuppressions(content, file);
+  // Also fold in native scanner skips so they're honoured + audited in one pipeline.
+  const native = parseNativeSuppressions(content, file);
+  if (onWarn)
+    for (const w of [...inline.warnings, ...native.warnings]) onWarn(w);
+  return [...inline.suppressions, ...native.suppressions];
+}
+
+function defaultRead(cwd: string, rel: string): string | null {
+  try {
+    return readFileSync(join(cwd, rel), "utf-8");
+  } catch {
+    return null;
+  }
+}
+
+export function suppressConcerns(
+  concerns: Concern[],
+  cwd: string,
+  now?: Date,
+): Concern[] {
+  const { suppressions, warnings } = loadSuppressionPolicyForRun(cwd);
+  for (const w of warnings) log.warning(`» ${w}`);
+  return applySuppressions(concerns, {
+    policy: suppressions,
+    cwd,
+    ...(now ? { now } : {}),
+    onWarn: (w) => log.warning(`» ${w}`),
+  });
+}