apparmor-language-server 0.5.1__py3-none-any.whl

apparmor_language_server/__init__.py

@@ -0,0 +1,23 @@
+# apparmor-language-server - LSP server for AppArmor profiles
+#
+# Copyright (C) 2026 Alex Murray <murray.alex@gmail.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+#
+
+"""AppArmor Language Server Protocol server."""
+
+from importlib.metadata import version
+
+__version__ = version("apparmor-language-server")

apparmor_language_server/__main__.py

@@ -0,0 +1,24 @@
+# apparmor-language-server - LSP server for AppArmor profiles
+#
+# Copyright (C) 2026 Alex Murray <murray.alex@gmail.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+#
+
+"""Entry point: python -m apparmor_language_server [--tcp] [--host HOST] [--port PORT]"""
+
+from .server import main
+
+if __name__ == "__main__":
+    main()

apparmor_language_server/_text.py

@@ -0,0 +1,70 @@
+# apparmor-language-server - LSP server for AppArmor profiles
+#
+# Copyright (C) 2026 Alex Murray <murray.alex@gmail.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+#
+
+"""
+AppArmor LSP – shared line/text helpers.
+
+Tiny module so that the server, parser and diagnostics layers share one
+implementation of "where does a comment start on this line?" rather than
+each carrying its own copy.
+"""
+
+from __future__ import annotations
+
+import re
+
+# Lines starting with a directive (#include, #abi) use '#' as a directive
+# marker, not a comment introducer.
+_RE_DIRECTIVE_LINE = re.compile(r"^\s*#(include|abi)\b")
+
+# Matches either a quoted string (to skip over its contents) or a '#' that
+# starts a comment — i.e. one at the start of the line or immediately preceded
+# by whitespace or a comma.  The comment '#' is captured in group 1; a quoted-
+# string match leaves group 1 empty so the caller can distinguish the two.
+_RE_COMMENT_OR_QUOTED = re.compile(r'"[^"]*"|\'[^\']*\'|((?:^|(?<=[ \t,]))#)')
+
+
+def raw_to_pos(raw: str, start_line: int, offset: int) -> tuple[int, int]:
+    """Convert a byte offset within *raw* to an absolute ``(line, character)`` pair.
+
+    *raw* may span multiple source lines joined with ``\\n``; each ``\\n``
+    advances the line counter.  The character is the column of *offset*
+    within its source line (0-based, absolute from the left margin).
+    """
+    prefix = raw[:offset]
+    nl_count = prefix.count("\n")
+    if nl_count:
+        char = offset - prefix.rfind("\n") - 1
+    else:
+        char = offset
+    return start_line + nl_count, char
+
+
+def code_end(line: str) -> int:
+    """Return the column at which a trailing comment begins on *line*.
+
+    Returns ``len(line)`` if the line has no trailing comment, or if the
+    line is itself a directive (``#include``/``#abi``) where '#' is the
+    directive marker rather than a comment introducer.
+    """
+    if _RE_DIRECTIVE_LINE.match(line):
+        return len(line)
+    for m in _RE_COMMENT_OR_QUOTED.finditer(line):
+        if m.group(1) is not None:
+            return m.start(1)
+    return len(line)

apparmor_language_server/call_hierarchy.py

@@ -0,0 +1,300 @@
+# apparmor-language-server - LSP server for AppArmor profiles
+#
+# Copyright (C) 2026 Alex Murray <murray.alex@gmail.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+#
+
+"""
+AppArmor LSP – call hierarchy provider.
+
+Implements ``textDocument/prepareCallHierarchy``,
+``callHierarchy/incomingCalls``, and ``callHierarchy/outgoingCalls``.
+
+Incoming calls: which profiles exec-transition (``px``, ``cx``, ``Px``, …),
+``change_profile``, or ``change_hat`` into a given profile?
+
+Outgoing calls: which profiles does a given profile exec-transition,
+``change_profile``, or ``change_hat`` to?
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Iterable, Iterator, Optional, Union
+
+from lsprotocol.types import (
+    CallHierarchyIncomingCall,
+    CallHierarchyItem,
+    CallHierarchyOutgoingCall,
+    Position,
+    Range,
+    SymbolKind,
+)
+
+from .constants import translate_uri
+from .nodes import (
+    BlockNode,
+    ChangeHatRuleNode,
+    ChangeProfileRuleNode,
+    DocumentNode,
+    FileRuleNode,
+    IfBlockNode,
+    Node,
+    ProfileNode,
+    Token,
+    iter_children,
+    walk,
+)
+
+logger = logging.getLogger(__name__)
+
+# Type alias for the cache snapshot taken under the lock.
+_CacheSnapshot = list[tuple[str, tuple[DocumentNode, list]]]
+
+
+# ── Helpers ───────────────────────────────────────────────────────────────────
+
+
+def _unquote(tok: Token) -> str:
+    """Strip surrounding double-quotes from a token value.
+
+    The parser preserves quotes on ``change_hat`` hat names and
+    ``change_profile`` targets (e.g. ``change_hat "inner"`` →
+    ``Token('"inner"', …)``).  Profile names are stored without quotes, so
+    the quotes must be stripped before doing a name lookup.
+    """
+    s = str(tok)
+    return s[1:-1] if len(s) >= 2 and s[0] == '"' and s[-1] == '"' else s
+
+
+def _profile_name(profile: ProfileNode) -> str:
+    tok = profile.name or profile.attachment
+    return str(tok) if tok is not None else "(anonymous)"
+
+
+def _make_item(profile: ProfileNode, uri: str) -> CallHierarchyItem:
+    name = _profile_name(profile)
+    tok = profile.name or profile.attachment
+    sel_range = tok.range if tok is not None else profile.range
+    return CallHierarchyItem(
+        name=name,
+        kind=SymbolKind.Class,
+        uri=translate_uri(uri),
+        range=profile.range,
+        selection_range=sel_range,
+        data=name,
+    )
+
+
+def _direct_transitions(
+    nodes: Iterable[Node],
+) -> Iterator[tuple[Node, str, Token]]:
+    """Yield ``(rule, target_str, target_token)`` for every exec-transition rule
+    in *nodes*.
+
+    Recurses into ``IfBlockNode`` / ``QualifierBlockNode`` (same security
+    domain) but does *not* descend into nested ``ProfileNode`` hat children
+    (they are separate security domains and appear as separate call hierarchy
+    items).
+    """
+    for node in nodes:
+        if isinstance(node, ProfileNode):
+            continue  # hat — treat as a separate profile, not a recursive descent
+        if isinstance(node, FileRuleNode):
+            tgt = node.profile_transition_target
+            if tgt is not None:
+                yield node, str(tgt), tgt
+        elif (
+            isinstance(node, ChangeProfileRuleNode) and node.target_profile is not None
+        ):
+            yield node, _unquote(node.target_profile), node.target_profile
+        elif isinstance(node, ChangeHatRuleNode):
+            for hat in node.hats:
+                yield node, _unquote(hat), hat
+        elif isinstance(node, BlockNode):
+            yield from _direct_transitions(node.children)
+            if isinstance(node, IfBlockNode) and node.else_branch is not None:
+                yield from _direct_transitions([node.else_branch])
+
+
+def _all_transitions(
+    node: Union[Node, DocumentNode],
+    enclosing: Optional[ProfileNode] = None,
+) -> Iterator[tuple[ProfileNode, Node, str, Token]]:
+    """Yield ``(enclosing_profile, rule, target_str, target_token)`` for every
+    exec-transition rule in the subtree of *node*.
+
+    The *enclosing_profile* is the most specific ``ProfileNode`` ancestor
+    (outer profile or hat) so that incoming-call items are attributed to the
+    correct caller.
+    """
+    if isinstance(node, DocumentNode):
+        for child in node.children:
+            yield from _all_transitions(child, None)
+        return
+    if isinstance(node, ProfileNode):
+        enclosing = node
+    elif enclosing is not None:
+        if isinstance(node, FileRuleNode):
+            tgt = node.profile_transition_target
+            if tgt is not None:
+                yield enclosing, node, str(tgt), tgt
+        elif (
+            isinstance(node, ChangeProfileRuleNode) and node.target_profile is not None
+        ):
+            yield enclosing, node, _unquote(node.target_profile), node.target_profile
+        elif isinstance(node, ChangeHatRuleNode):
+            for hat in node.hats:
+                yield enclosing, node, _unquote(hat), hat
+    for child in iter_children(node):
+        yield from _all_transitions(child, enclosing)
+
+
+def _find_profile(
+    cache_snapshot: _CacheSnapshot,
+    name: str,
+) -> Optional[tuple[ProfileNode, str]]:
+    """Find a ``ProfileNode`` by name or attachment across all cached documents."""
+    for doc_uri, (doc, _) in cache_snapshot:
+        for node in walk(doc):
+            if isinstance(node, ProfileNode):
+                if node.name == name or node.attachment == name:
+                    return node, doc_uri
+    return None
+
+
+# ── Public API ────────────────────────────────────────────────────────────────
+
+
+def prepare_call_hierarchy(
+    doc: DocumentNode,
+    uri: str,
+    line: int,
+    ch: int,
+    cache_snapshot: _CacheSnapshot,
+) -> Optional[list[CallHierarchyItem]]:
+    """Return a ``CallHierarchyItem`` for the profile under the cursor, or ``None``.
+
+    Two positions resolve to a call hierarchy item:
+    - A profile name or attachment token — the item is that profile itself.
+    - An exec-transition target token — the item is the target profile (looked
+      up across the full workspace cache).
+    """
+    # Cursor on a profile name or attachment token
+    for node in walk(doc):
+        if not isinstance(node, ProfileNode):
+            continue
+        for tok in (node.name, node.attachment):
+            if (
+                tok is not None
+                and tok.range.start.line == line
+                and tok.range.start.character <= ch <= tok.range.end.character
+            ):
+                return [_make_item(node, uri)]
+
+    # Cursor on an exec-transition target token
+    for node in walk(doc):
+        if node.range.start.line != line:
+            continue
+        target_str: Optional[str] = None
+        if isinstance(node, FileRuleNode):
+            t = node.profile_transition_target
+            if t is not None and t.range.start.character <= ch <= t.range.end.character:
+                target_str = str(t)
+        elif (
+            isinstance(node, ChangeProfileRuleNode) and node.target_profile is not None
+        ):
+            t = node.target_profile
+            if t.range.start.character <= ch <= t.range.end.character:
+                target_str = _unquote(t)
+        elif isinstance(node, ChangeHatRuleNode):
+            for hat in node.hats:
+                if hat.range.start.character <= ch <= hat.range.end.character:
+                    target_str = _unquote(hat)
+                    break
+        if target_str is not None:
+            found = _find_profile(cache_snapshot, target_str)
+            if found is not None:
+                return [_make_item(found[0], found[1])]
+
+    return None
+
+
+def get_incoming_calls(
+    cache_snapshot: _CacheSnapshot,
+    item: CallHierarchyItem,
+) -> list[CallHierarchyIncomingCall]:
+    """Return all profiles that exec-transition into the profile named by *item*.
+
+    Multiple rules from the same caller profile are merged into a single
+    ``CallHierarchyIncomingCall`` with all rule locations listed in
+    ``from_ranges``.
+    """
+    target_name: str = item.data if isinstance(item.data, str) else item.name
+    # key: "<uri>::<profile_name>" → (caller_item, [from_ranges])
+    callers: dict[str, tuple[CallHierarchyItem, list[Range]]] = {}
+    for doc_uri, (doc, _) in cache_snapshot:
+        for profile, _rule, tgt_str, tgt_tok in _all_transitions(doc):
+            if tgt_str != target_name:
+                continue
+            key = f"{doc_uri}::{_profile_name(profile)}"
+            if key not in callers:
+                callers[key] = (_make_item(profile, doc_uri), [])
+            callers[key][1].append(tgt_tok.range)
+    return [
+        CallHierarchyIncomingCall(from_=caller_item, from_ranges=ranges)
+        for caller_item, ranges in callers.values()
+    ]
+
+
+def get_outgoing_calls(
+    cache_snapshot: _CacheSnapshot,
+    item: CallHierarchyItem,
+) -> list[CallHierarchyOutgoingCall]:
+    """Return all profiles that the profile named by *item* exec-transitions to.
+
+    Multiple rules pointing to the same target profile are merged into a
+    single ``CallHierarchyOutgoingCall`` with all rule locations in
+    ``from_ranges``.
+    """
+    source_name: str = item.data if isinstance(item.data, str) else item.name
+    found = _find_profile(cache_snapshot, source_name)
+    if found is None:
+        return []
+    source_profile, source_uri = found
+
+    # key: target profile name → (target_item, [from_ranges])
+    targets: dict[str, tuple[CallHierarchyItem, list[Range]]] = {}
+    for _rule, tgt_str, tgt_tok in _direct_transitions(source_profile.children):
+        tgt_found = _find_profile(cache_snapshot, tgt_str)
+        if tgt_found is not None:
+            tgt_item = _make_item(tgt_found[0], tgt_found[1])
+        else:
+            # Target not in cache — synthesise a placeholder item.
+            tgt_item = CallHierarchyItem(
+                name=tgt_str,
+                kind=SymbolKind.Class,
+                uri=translate_uri(source_uri),
+                range=Range(Position(0, 0), Position(0, 0)),
+                selection_range=Range(Position(0, 0), Position(0, 0)),
+                data=tgt_str,
+            )
+        if tgt_str not in targets:
+            targets[tgt_str] = (tgt_item, [])
+        targets[tgt_str][1].append(tgt_tok.range)
+    return [
+        CallHierarchyOutgoingCall(to=tgt_item, from_ranges=ranges)
+        for tgt_item, ranges in targets.values()
+    ]