fensu-cli 0.26.0__tar.gz → 0.28.0__tar.gz

{fensu_cli-0.26.0 → fensu_cli-0.28.0}/Cargo.lock

@@ -388,7 +388,7 @@ checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
 
 [[package]]
 name = "fensu-cli"
-version = "0.26.0"
+version = "0.28.0"
 dependencies = [
  "cap-fs-ext",
  "cap-std",
@@ -458,7 +458,7 @@ dependencies = [
 
 [[package]]
 name = "fensu-policy"
-version = "0.26.0"
+version = "0.28.0"
 dependencies = [
  "command-group",
  "globset",

{fensu_cli-0.26.0 → fensu_cli-0.28.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fensu-cli
-Version: 0.26.0
+Version: 0.28.0
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: Apache Software License

{fensu_cli-0.26.0 → fensu_cli-0.28.0}/crates/fensu-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "fensu-cli"
-version = "0.26.0" # x-release-please-version
+version = "0.28.0" # x-release-please-version
 edition.workspace = true
 license.workspace = true
 publish = false

{fensu_cli-0.26.0 → fensu_cli-0.28.0}/crates/fensu-cli/src/check/_helpers/exceptions.rs

@@ -1,7 +1,12 @@
+use std::cmp::Reverse;
 use std::collections::{HashMap, HashSet};
 use std::path::Path;
 
-use crate::models::{Config, Fault, RuleException, ScopedSource};
+use crate::analyzer::AnalyzerId;
+use crate::configuration::main::rust_exception_symbols::rust_exception_symbols;
+use crate::models::{Config, Fault, RuleException, RustExceptionSymbol, ScopedSource};
+
+const RUST_PATH_SEPARATOR: &str = "::";
 
 type ExceptionKey = (String, String, Option<String>);
 
@@ -35,6 +40,7 @@ pub(crate) fn apply_exceptions(
         .map(|source| (source.target_path.as_str(), source))
         .collect::<HashMap<_, _>>();
     let mut applied: HashSet<ExceptionKey> = HashSet::new();
+    let rust_symbols_by_path = rust_symbols_by_path(config, &source_by_path)?;
     let mut retained: Vec<Fault> = Vec::new();
     for fault in faults {
         let directory = if fault.code == fensu_native::rules::constants::STALE_DEAD_CODE_ROOT_CODE {
@@ -58,9 +64,15 @@ pub(crate) fn apply_exceptions(
                 break;
             }
             if owner.is_none() {
-                owner = source_by_path
-                    .get(reported.as_str())
-                    .and_then(|source| fault_owner(&fault, source));
+                owner = if config.analyzer == AnalyzerId::Rust {
+                    rust_symbols_by_path
+                        .get(reported.as_str())
+                        .and_then(|symbols| rust_fault_owner(&fault, symbols))
+                } else {
+                    source_by_path
+                        .get(reported.as_str())
+                        .and_then(|source| fault_owner(&fault, source))
+                };
             }
             matched_symbol = owner.as_ref().and_then(|owner| {
                 entry
@@ -151,6 +163,55 @@ fn fault_owner(fault: &Fault, source: &ScopedSource) -> Option<FaultOwner> {
     )
 }
 
+fn rust_symbols_by_path(
+    config: &Config,
+    source_by_path: &HashMap<&str, &ScopedSource>,
+) -> Result<HashMap<String, Vec<RustExceptionSymbol>>, String> {
+    let mut symbols_by_path: HashMap<String, Vec<RustExceptionSymbol>> = HashMap::new();
+    if config.analyzer != AnalyzerId::Rust {
+        return Ok(symbols_by_path);
+    }
+    for entry in config
+        .exceptions
+        .iter()
+        .filter(|entry| !entry.symbols.is_empty())
+    {
+        if symbols_by_path.contains_key(&entry.path) {
+            continue;
+        }
+        let Some(source) = source_by_path.get(entry.path.as_str()) else {
+            continue;
+        };
+        let symbols = rust_exception_symbols(&String::from_utf8_lossy(&source.content)).map_err(
+            |message| {
+                format!(
+                    "Could not inspect rule exception path {}: {message}",
+                    entry.path
+                )
+            },
+        )?;
+        symbols_by_path.insert(entry.path.clone(), symbols);
+    }
+    Ok(symbols_by_path)
+}
+
+fn rust_fault_owner(fault: &Fault, symbols: &[RustExceptionSymbol]) -> Option<FaultOwner> {
+    let line = fault.line? as usize;
+    symbols
+        .iter()
+        .filter(|symbol| symbol.first_line <= line && line <= symbol.last_line)
+        .min_by_key(|symbol| {
+            (
+                symbol.last_line - symbol.first_line,
+                Reverse(symbol.name.matches(RUST_PATH_SEPARATOR).count()),
+                symbol.name.as_str(),
+            )
+        })
+        .map(|symbol| FaultOwner {
+            identities: vec![symbol.name.clone()],
+        })
+}
+
 fn web_fault_owner(source: &ScopedSource, line: usize, column: usize) -> Option<FaultOwner> {
     let offset = source_offset(&source.content, line, column)?;
     let mut candidates: Vec<(usize, Vec<String>)> = Vec::new();

{fensu_cli-0.26.0 → fensu_cli-0.28.0}/crates/fensu-cli/src/configuration/_helpers/exception_targets.rs

@@ -5,10 +5,15 @@ use std::path::Path;
 use fensu_facts::parsing::main::parse_strict::parse_strict;
 use ruff_python_ast::visitor::{walk_stmt, Visitor};
 use ruff_python_ast::Stmt;
+use syn::ext::IdentExt;
+use syn::spanned::Spanned;
 
 use crate::analyzer::AnalyzerId;
 use crate::check::main::python_version::python_version;
-use crate::models::Config;
+use crate::models::{Config, RustExceptionSymbol};
+
+const RUST_PATH_SEPARATOR: &str = "::";
+const UNNAMED_RUST_ITEM: &str = "_";
 
 pub(crate) fn validate_targets(config: &Config, project_root: &Path) -> Result<(), String> {
     for exception in &config.exceptions {
@@ -31,10 +36,10 @@ pub(crate) fn validate_targets(config: &Config, project_root: &Path) -> Result<(
         if exception.symbols.is_empty() {
             continue;
         }
-        let symbols = if config.analyzer == AnalyzerId::Python {
-            defined_symbols(&path)?
-        } else {
-            defined_web_symbols(&path, config.analyzer)?
+        let symbols = match config.analyzer {
+            AnalyzerId::Python => defined_symbols(&path)?,
+            AnalyzerId::Rust => defined_rust_symbols(&path)?,
+            analyzer => defined_web_symbols(&path, analyzer)?,
         };
         for symbol in &exception.symbols {
             match symbols.get(symbol).copied().unwrap_or_default() {
@@ -57,6 +62,26 @@ pub(crate) fn validate_targets(config: &Config, project_root: &Path) -> Result<(
     Ok(())
 }
 
+fn defined_rust_symbols(path: &Path) -> Result<HashMap<String, usize>, String> {
+    let bytes = fs::read(path).map_err(|error| {
+        format!(
+            "Could not inspect rule exception path {}: {error}",
+            path.display()
+        )
+    })?;
+    let source = String::from_utf8_lossy(&bytes);
+    let mut symbols: HashMap<String, usize> = HashMap::new();
+    for symbol in rust_symbols(&source).map_err(|message| {
+        format!(
+            "Could not inspect rule exception path {}: {message}",
+            path.display()
+        )
+    })? {
+        *symbols.entry(symbol.name).or_default() += 1;
+    }
+    Ok(symbols)
+}
+
 fn defined_web_symbols(
     path: &Path,
     analyzer: AnalyzerId,
@@ -180,3 +205,107 @@ impl<'ast> Visitor<'ast> for SymbolCollector {
         }
     }
 }
+
+pub(crate) fn rust_symbols(source: &str) -> Result<Vec<RustExceptionSymbol>, String> {
+    let syntax = syn::parse_file(source).map_err(|error| error.to_string())?;
+    Ok(item_symbols(&syntax.items, ""))
+}
+
+fn item_symbols(items: &[syn::Item], prefix: &str) -> Vec<RustExceptionSymbol> {
+    let mut symbols: Vec<RustExceptionSymbol> = Vec::new();
+    for item in items {
+        match item {
+            syn::Item::Fn(inner) => symbols.extend(symbol(prefix, &inner.sig.ident, item)),
+            syn::Item::Struct(inner) => symbols.extend(symbol(prefix, &inner.ident, item)),
+            syn::Item::Enum(inner) => symbols.extend(symbol(prefix, &inner.ident, item)),
+            syn::Item::Union(inner) => symbols.extend(symbol(prefix, &inner.ident, item)),
+            syn::Item::Type(inner) => symbols.extend(symbol(prefix, &inner.ident, item)),
+            syn::Item::Const(inner) => symbols.extend(symbol(prefix, &inner.ident, item)),
+            syn::Item::Static(inner) => symbols.extend(symbol(prefix, &inner.ident, item)),
+            syn::Item::Trait(inner) => {
+                symbols.extend(symbol(prefix, &inner.ident, item));
+                symbols.extend(trait_symbols(inner, &qualified(prefix, &inner.ident)));
+            }
+            syn::Item::Impl(inner) => {
+                if let Some(self_type) = self_type_path(&inner.self_ty) {
+                    symbols.extend(impl_symbols(inner, &join(prefix, &self_type)));
+                }
+            }
+            syn::Item::Mod(inner) => {
+                if let Some((_, content)) = &inner.content {
+                    symbols.extend(item_symbols(content, &qualified(prefix, &inner.ident)));
+                }
+            }
+            _ => {}
+        }
+    }
+    symbols
+}
+
+fn trait_symbols(item: &syn::ItemTrait, owner: &str) -> Vec<RustExceptionSymbol> {
+    let mut symbols: Vec<RustExceptionSymbol> = Vec::new();
+    for member in &item.items {
+        let ident = match member {
+            syn::TraitItem::Fn(inner) => &inner.sig.ident,
+            syn::TraitItem::Const(inner) => &inner.ident,
+            syn::TraitItem::Type(inner) => &inner.ident,
+            _ => continue,
+        };
+        symbols.extend(symbol(owner, ident, member));
+    }
+    symbols
+}
+
+fn impl_symbols(item: &syn::ItemImpl, owner: &str) -> Vec<RustExceptionSymbol> {
+    let mut symbols: Vec<RustExceptionSymbol> = Vec::new();
+    for member in &item.items {
+        let ident = match member {
+            syn::ImplItem::Fn(inner) => &inner.sig.ident,
+            syn::ImplItem::Const(inner) => &inner.ident,
+            syn::ImplItem::Type(inner) => &inner.ident,
+            _ => continue,
+        };
+        symbols.extend(symbol(owner, ident, member));
+    }
+    symbols
+}
+
+fn self_type_path(self_type: &syn::Type) -> Option<String> {
+    let syn::Type::Path(path) = self_type else {
+        return None;
+    };
+    if path.qself.is_some() {
+        return None;
+    }
+    let segments: Vec<String> = path
+        .path
+        .segments
+        .iter()
+        .map(|segment| segment.ident.unraw().to_string())
+        .collect();
+    Some(segments.join(RUST_PATH_SEPARATOR))
+}
+
+fn symbol(prefix: &str, ident: &syn::Ident, node: &impl Spanned) -> Option<RustExceptionSymbol> {
+    if ident == UNNAMED_RUST_ITEM {
+        return None;
+    }
+    let span = node.span();
+    Some(RustExceptionSymbol {
+        name: qualified(prefix, ident),
+        first_line: span.start().line,
+        last_line: span.end().line,
+    })
+}
+
+fn qualified(prefix: &str, ident: &syn::Ident) -> String {
+    join(prefix, &ident.unraw().to_string())
+}
+
+fn join(prefix: &str, name: &str) -> String {
+    if prefix.is_empty() {
+        name.to_owned()
+    } else {
+        format!("{prefix}{RUST_PATH_SEPARATOR}{name}")
+    }
+}

{fensu_cli-0.26.0 → fensu_cli-0.28.0}/crates/fensu-cli/src/configuration/_helpers/exceptions.rs

@@ -5,6 +5,8 @@ use crate::configuration::_helpers::selectors::valid_code;
 use crate::constants::CUSTOM_RULE_TEST_COVERAGE_CODE;
 
 const RULE_EXCEPTION_SYMBOLS: &str = "symbols";
+const CARGO_MANIFEST_SUFFIX: &str = "Cargo.toml";
+const RUST_PATH_SEPARATOR: &str = "::";
 
 pub(crate) fn validate(value: Option<&toml::Value>, analyzer: AnalyzerId) -> Result<(), String> {
     validate_for(value, Some(analyzer))
@@ -46,21 +48,26 @@ fn validate_for(value: Option<&toml::Value>, analyzer: Option<AnalyzerId>) -> Re
             ));
         }
         validate_path(&path, analyzer, &rule)?;
-        if (matches!(analyzer, Some(AnalyzerId::Rust) | None)
-            || rule == CUSTOM_RULE_TEST_COVERAGE_CODE)
+        if (analyzer.is_none() || rule == CUSTOM_RULE_TEST_COVERAGE_CODE)
             && table.contains_key(RULE_EXCEPTION_SYMBOLS)
         {
             let owner = if rule == CUSTOM_RULE_TEST_COVERAGE_CODE {
                 "Custom-rule coverage"
-            } else if analyzer.is_none() {
-                "Repository"
             } else {
-                "Rust"
+                "Repository"
             };
             return Err(format!(
                 "{owner} rule exceptions support file-level exceptions only."
             ));
         }
+        if analyzer == Some(AnalyzerId::Rust)
+            && path.ends_with(CARGO_MANIFEST_SUFFIX)
+            && table.contains_key(RULE_EXCEPTION_SYMBOLS)
+        {
+            return Err(format!(
+                "Rust Cargo.toml rule exceptions support file-level exceptions only: {path}."
+            ));
+        }
         let symbols = match table.get(RULE_EXCEPTION_SYMBOLS) {
             Some(value) => {
                 super::validation::required_strings(Some(value), "rule_exceptions.symbols")?
@@ -76,7 +83,12 @@ fn validate_for(value: Option<&toml::Value>, analyzer: Option<AnalyzerId>) -> Re
             ));
         }
         for symbol in symbols {
-            if !valid_qualified_symbol(&symbol) {
+            let valid = if analyzer == Some(AnalyzerId::Rust) {
+                valid_rust_symbol(&symbol)
+            } else {
+                valid_qualified_symbol(&symbol)
+            };
+            if !valid {
                 return Err(format!(
                     "Malformed qualified rule exception symbol: {symbol}."
                 ));
@@ -105,16 +117,21 @@ fn exception_text(
 
 fn valid_qualified_symbol(value: &str) -> bool {
     let mut parts = value.split('.');
-    let valid = |part: &str| {
-        let mut characters = part.chars();
-        characters
-            .next()
-            .is_some_and(|item| item.is_ascii_alphabetic() || item == '_')
-            && characters.all(|item| item.is_ascii_alphanumeric() || item == '_')
-    };
-    let first = parts.next().is_some_and(valid);
+    let first = parts.next().is_some_and(valid_identifier);
     let second = parts.next();
-    first && second.is_none_or(valid) && parts.next().is_none()
+    first && second.is_none_or(valid_identifier) && parts.next().is_none()
+}
+
+fn valid_rust_symbol(value: &str) -> bool {
+    value.split(RUST_PATH_SEPARATOR).all(valid_identifier)
+}
+
+fn valid_identifier(part: &str) -> bool {
+    let mut characters = part.chars();
+    characters
+        .next()
+        .is_some_and(|item| item.is_ascii_alphabetic() || item == '_')
+        && characters.all(|item| item.is_ascii_alphanumeric() || item == '_')
 }
 
 fn validate_path(path: &str, analyzer: Option<AnalyzerId>, rule: &str) -> Result<(), String> {
@@ -125,13 +142,15 @@ fn validate_path(path: &str, analyzer: Option<AnalyzerId>, rule: &str) -> Result
     } else {
         match analyzer {
             Some(AnalyzerId::Python) => path.ends_with(".py"),
-            Some(AnalyzerId::Rust) => path.ends_with(".rs") || path.ends_with("Cargo.toml"),
+            Some(AnalyzerId::Rust) => {
+                path.ends_with(".rs") || path.ends_with(CARGO_MANIFEST_SUFFIX)
+            }
             Some(AnalyzerId::TypeScript) => web_source_path(path),
             Some(AnalyzerId::Svelte) => path.ends_with(".svelte") || web_source_path(path),
             None => {
                 path.ends_with(".py")
                     || path.ends_with(".rs")
-                    || path.ends_with("Cargo.toml")
+                    || path.ends_with(CARGO_MANIFEST_SUFFIX)
                     || path.ends_with(".svelte")
                     || web_source_path(path)
             }

{fensu_cli-0.26.0 → fensu_cli-0.28.0}/crates/fensu-cli/src/configuration/main/mod.rs

@@ -10,5 +10,6 @@ pub(crate) mod load_target;
 pub(crate) mod load_targets;
 pub(crate) mod render_target_config;
 pub(crate) mod resolve_target_root;
+pub(crate) mod rust_exception_symbols;
 pub(crate) mod validate_document;
 pub(crate) mod validate_exception_targets;

fensu_cli-0.28.0/crates/fensu-cli/src/configuration/main/rust_exception_symbols.rs

@@ -0,0 +1,6 @@
+use crate::configuration::_helpers::exception_targets;
+use crate::models::RustExceptionSymbol;
+
+pub(crate) fn rust_exception_symbols(source: &str) -> Result<Vec<RustExceptionSymbol>, String> {
+    exception_targets::rust_symbols(source)
+}

{fensu_cli-0.26.0 → fensu_cli-0.28.0}/crates/fensu-cli/src/models.rs

@@ -167,6 +167,13 @@ pub(crate) struct RuleException {
     pub(crate) symbols: Vec<String>,
 }
 
+#[derive(Clone, Debug)]
+pub(crate) struct RustExceptionSymbol {
+    pub(crate) name: String,
+    pub(crate) first_line: usize,
+    pub(crate) last_line: usize,
+}
+
 #[derive(Clone, Debug, Default)]
 pub(crate) struct RuleIgnore {
     pub(crate) rules: Vec<String>,

{fensu_cli-0.26.0 → fensu_cli-0.28.0}/crates/fensu-cli/tests/command/test_check_rust.rs

@@ -183,12 +183,6 @@ fn given_invalid_rust_configuration_when_checking_then_configuration_fails_close
             expected_exit_code: 2,
             expected_error: "repository-relative POSIX paths",
         },
-        InvalidCheckConfigTestCase {
-            description: "Rust exceptions reject symbol scope during configuration validation",
-            config: "[[targets.rust.rule_exceptions]]\nrule = \"FPRSS010\"\npath = \"src/lib.rs\"\nsymbols = [\"value\"]\nreason = \"Unsupported symbol scope.\"\n",
-            expected_exit_code: 2,
-            expected_error: "Rust rule exceptions support file-level exceptions only",
-        },
     ];
     for test_case in test_cases {
         let repository = tempfile::tempdir().expect("temporary repository");
@@ -928,6 +922,15 @@ fn given_custom_rust_policy_when_checking_then_warning_ignore_and_exception_sema
             expected_present: "Applied 1 rule exception",
             expected_absent: "XRS004 ",
         },
+        RustCustomPolicyTestCase {
+            description: "symbol exception cannot suppress a line-less custom Rust finding",
+            selection: "select = [\"XRS004\"]\n",
+            policy: "[[targets.rust.rule_exceptions]]\nrule = \"XRS004\"\npath = \"src/lib.rs\"\nsymbols = [\"value\"]\nreason = \"Accepted adapter.\"\n",
+            arguments: &["--no-cache"],
+            expected_exit_code: 2,
+            expected_present: "Rule exception no longer matches a fault: XRS004 src/lib.rs::value.",
+            expected_absent: "Rust rule exceptions support file-level exceptions only",
+        },
     ];
     for test_case in test_cases {
         let repository = tempfile::tempdir().expect("temporary repository");