fensu-cli 0.4.1__tar.gz → 0.5.0__tar.gz

{fensu_cli-0.4.1 → fensu_cli-0.5.0}/Cargo.lock

@@ -392,7 +392,7 @@ checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
 
 [[package]]
 name = "fensu-cli"
-version = "0.4.1"
+version = "0.5.0"
 dependencies = [
  "cap-fs-ext",
  "cap-std",

{fensu_cli-0.4.1 → fensu_cli-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fensu-cli
-Version: 0.4.1
+Version: 0.5.0
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: Apache Software License

{fensu_cli-0.4.1 → fensu_cli-0.5.0}/crates/fensu-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "fensu-cli"
-version = "0.4.1" # x-release-please-version
+version = "0.5.0" # x-release-please-version
 edition.workspace = true
 license.workspace = true
 publish = false

{fensu_cli-0.4.1 → fensu_cli-0.5.0}/crates/fensu-cli/src/configuration/helpers/loading.rs

@@ -38,5 +38,7 @@ pub(crate) fn load_optional(start: &Path) -> Result<Option<(PathBuf, Config)>, S
 
 pub(crate) fn custom_rules_are_configured(start: &Path) -> Result<bool, String> {
     let (_, config) = load(start)?;
-    Ok(!config.rule_paths.is_empty() || !config.rule_modules.is_empty())
+    Ok(!config.rule_paths.is_empty()
+        || !config.rule_modules.is_empty()
+        || !config.rule_options.is_empty())
 }

{fensu_cli-0.4.1 → fensu_cli-0.5.0}/crates/fensu-cli/src/configuration/helpers/parsing.rs

@@ -30,6 +30,11 @@ pub(crate) fn build(
         ignore: strings(table.get("ignore")),
         rule_paths: strings(table.get("rule_paths")),
         rule_modules: strings(table.get("rule_modules")),
+        rule_options: table
+            .get("rule_options")
+            .and_then(toml::Value::as_table)
+            .cloned()
+            .unwrap_or_default(),
         cache_enabled: cache
             .and_then(|values| values.get("enabled"))
             .and_then(toml::Value::as_bool)

{fensu_cli-0.4.1 → fensu_cli-0.5.0}/crates/fensu-cli/src/configuration/helpers/validation.rs

@@ -19,6 +19,7 @@ pub(crate) fn validate(table: &toml::map::Map<String, toml::Value>) -> Result<()
             "ignore",
             "rule_paths",
             "rule_modules",
+            "rule_options",
             "thresholds",
             "roles",
             "contracts",
@@ -37,6 +38,7 @@ pub(crate) fn validate(table: &toml::map::Map<String, toml::Value>) -> Result<()
     validate_optional_table(table, "cache", &["enabled", "require_cacheable"])?;
     validate_optional_table(table, "evaluation", &["include", "exclude"])?;
     validate_optional_table(table, "skills", &["name"])?;
+    validate_rule_options(table.get("rule_options"))?;
     for name in [
         "tests",
         "tooling",
@@ -63,6 +65,19 @@ pub(crate) fn validate(table: &toml::map::Map<String, toml::Value>) -> Result<()
     Ok(())
 }
 
+fn validate_rule_options(value: Option<&toml::Value>) -> Result<(), String> {
+    let Some(value) = value else {
+        return Ok(());
+    };
+    let rules = value
+        .as_table()
+        .ok_or_else(|| "Config key rule_options must be a table.".to_owned())?;
+    if rules.values().any(|options| !options.is_table()) {
+        return Err("Config key rule_options must contain rule-code tables.".to_owned());
+    }
+    Ok(())
+}
+
 fn validate_nested_roots(roots: Vec<String>) -> Result<(), String> {
     for (index, first) in roots.iter().enumerate() {
         let first = first.split('/').collect::<Vec<_>>();

{fensu_cli-0.4.1 → fensu_cli-0.5.0}/crates/fensu-cli/src/helpers/check_evaluation.rs

@@ -78,6 +78,7 @@ pub(crate) fn evaluate_and_render(
                 observations: HashMap::new(),
                 custom_registrations: Vec::new(),
                 repo_root: root.to_string_lossy().into_owned(),
+                rule_options: native_rule_options(codes)?,
             };
             let plans = plan_core_rule_queries(program(source), codes, &context);
             context.observations = observe(root, &plans, &program_by_path, &program_by_module);
@@ -156,6 +157,26 @@ pub(crate) fn evaluate_and_render(
     Ok((output, i32::from(!blocking_faults.is_empty())))
 }
 
+fn native_rule_options(
+    codes: &[String],
+) -> Result<HashMap<String, HashMap<String, String>>, String> {
+    let mut by_code = HashMap::new();
+    for code in codes {
+        let rule = rule::rule(code).ok_or_else(|| format!("Unknown native rule code: {code}"))?;
+        let mut values = HashMap::new();
+        for option in &rule.options {
+            values.insert(
+                option.name.clone(),
+                serde_json::to_string(&option.current_value).map_err(|error| error.to_string())?,
+            );
+        }
+        if !values.is_empty() {
+            by_code.insert(rule.code.clone(), values);
+        }
+    }
+    Ok(by_code)
+}
+
 pub(crate) fn selected_rules(select: &[String], ignore: &[String]) -> Vec<&'static RuleMetadata> {
     rule::catalogue()
         .iter()

{fensu_cli-0.4.1 → fensu_cli-0.5.0}/crates/fensu-cli/src/helpers/check_policy.rs

@@ -270,7 +270,7 @@ pub(crate) fn check_identity(
     warnings: bool,
 ) -> String {
     let mut digest = Sha256::new();
-    digest.update(b"fensu-native-check-v2\0");
+    digest.update(b"fensu-native-check-v3\0");
     digest.update(env!("CARGO_PKG_VERSION").as_bytes());
     digest.update(&config.raw);
     digest.update([u8::from(warnings)]);

{fensu_cli-0.4.1 → fensu_cli-0.5.0}/crates/fensu-cli/src/helpers/rule.rs

@@ -5,7 +5,7 @@ use std::sync::OnceLock;
 
 use crate::configuration::main::load;
 use crate::constants::{COLOR_ALWAYS, COLOR_AUTO, COLOR_NEVER, OPTION_COLOR};
-use crate::models::{Config, RuleMetadata};
+use crate::models::{Config, RuleMetadata, RuleOptionMetadata, RuleOptionValue};
 use crate::skills::main::catalogue::load_rule_catalogue;
 
 static CATALOGUE: OnceLock<Vec<RuleMetadata>> = OnceLock::new();
@@ -24,7 +24,10 @@ pub(crate) fn rule_output(arguments: &[String]) -> Result<String, String> {
     let project_root = config_path
         .parent()
         .ok_or_else(|| "Configuration has no parent directory.".to_owned())?;
-    let catalogue = if loaded.rule_paths.is_empty() && loaded.rule_modules.is_empty() {
+    let catalogue = if loaded.rule_paths.is_empty()
+        && loaded.rule_modules.is_empty()
+        && loaded.rule_options.is_empty()
+    {
         catalogue().to_vec()
     } else {
         load_rule_catalogue(&loaded, project_root)?
@@ -91,11 +94,81 @@ fn render(metadata: &RuleMetadata, config: &Config, color: bool) -> String {
     };
     let mut output = format!("{header}\n");
     render_metadata(&mut output, metadata, color);
+    render_options(&mut output, metadata);
     render_exceptions(&mut output, metadata, config);
     render_rule_ignores(&mut output, metadata, config);
     output
 }
 
+fn render_options(output: &mut String, metadata: &RuleMetadata) {
+    if metadata.options.is_empty() {
+        return;
+    }
+    let mut options = metadata.options.iter().collect::<Vec<_>>();
+    options.sort_by(|left, right| left.name.cmp(&right.name));
+    output.push_str("\nOptions:\n");
+    for option in options {
+        output.push_str(&format!("  {}\n", option.name));
+        for (label, value) in option_lines(option) {
+            output.push_str(&format!("    {label}: {value}\n"));
+        }
+    }
+}
+
+fn option_lines(option: &RuleOptionMetadata) -> [(&'static str, String); 9] {
+    [
+        ("Type", option_type(&option.kind).to_owned()),
+        ("Required", option.required.to_string()),
+        (
+            "Default",
+            if option.required {
+                "required".to_owned()
+            } else {
+                option_value(option.default.as_ref())
+            },
+        ),
+        ("Current value", option_value(Some(&option.current_value))),
+        (
+            "Description",
+            option
+                .description
+                .clone()
+                .unwrap_or_else(|| "None".to_owned()),
+        ),
+        (
+            "Choices",
+            serde_json::to_string(&option.choices).unwrap_or_else(|_| "null".to_owned()),
+        ),
+        ("Minimum", optional_number(option.minimum)),
+        ("Maximum", optional_number(option.maximum)),
+        (
+            "Minimum items",
+            option
+                .minimum_items
+                .map_or_else(|| "None".to_owned(), |value| value.to_string()),
+        ),
+    ]
+}
+
+fn option_type(kind: &str) -> &str {
+    match kind {
+        "string_list" => "list[string]",
+        "integer_list" => "list[integer]",
+        other => other,
+    }
+}
+
+fn option_value(value: Option<&RuleOptionValue>) -> String {
+    value.map_or_else(
+        || "None".to_owned(),
+        |value| serde_json::to_string(value).unwrap_or_else(|_| "null".to_owned()),
+    )
+}
+
+fn optional_number(value: Option<i64>) -> String {
+    value.map_or_else(|| "None".to_owned(), |value| value.to_string())
+}
+
 fn render_metadata(output: &mut String, metadata: &RuleMetadata, color: bool) {
     let enabled = if metadata.enabled_by_default {
         "yes"

{fensu_cli-0.4.1 → fensu_cli-0.5.0}/crates/fensu-cli/src/models.rs

@@ -57,6 +57,39 @@ pub(crate) struct RuleMetadata {
     pub(crate) source: Option<String>,
     #[serde(default = "crate::helpers::rule::cacheable_default")]
     pub(crate) cacheable: bool,
+    #[serde(default)]
+    pub(crate) options: Vec<RuleOptionMetadata>,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub(crate) struct RuleOptionMetadata {
+    pub(crate) name: String,
+    pub(crate) kind: String,
+    pub(crate) required: bool,
+    pub(crate) default: Option<RuleOptionValue>,
+    pub(crate) current_value: RuleOptionValue,
+    pub(crate) description: Option<String>,
+    pub(crate) choices: Option<Vec<String>>,
+    pub(crate) minimum: Option<i64>,
+    pub(crate) maximum: Option<i64>,
+    pub(crate) minimum_items: Option<usize>,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(untagged)]
+pub(crate) enum RuleOptionValue {
+    Boolean(bool),
+    Integer(i64),
+    String(String),
+    List(Vec<RuleOptionListValue>),
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(untagged)]
+pub(crate) enum RuleOptionListValue {
+    Integer(i64),
+    String(String),
 }
 
 #[derive(Clone, Debug, Default)]
@@ -69,6 +102,7 @@ pub(crate) struct Config {
     pub(crate) ignore: Vec<String>,
     pub(crate) rule_paths: Vec<String>,
     pub(crate) rule_modules: Vec<String>,
+    pub(crate) rule_options: toml::map::Map<String, toml::Value>,
     pub(crate) cache_enabled: bool,
     pub(crate) cache_require_cacheable: bool,
     pub(crate) evaluation_include: Vec<String>,

{fensu_cli-0.4.1 → fensu_cli-0.5.0}/crates/fensu-cli/src/skills/helpers/content/fingerprint.rs

@@ -274,6 +274,8 @@ fn rules_value(rules: &[RuleMetadata]) -> Value {
         sorted
             .into_iter()
             .map(|rule| {
+                let mut options = rule.options.iter().collect::<Vec<_>>();
+                options.sort_by(|left, right| left.name.cmp(&right.name));
                 json!({
                     "code": rule.code,
                     "family": rule.family,
@@ -286,6 +288,7 @@ fn rules_value(rules: &[RuleMetadata]) -> Value {
                     "enabled_by_default": rule.enabled_by_default,
                     "cacheable": rule.cacheable,
                     "execution_owner": rule.execution_owner,
+                    "options": options,
                 })
             })
             .collect(),

{fensu_cli-0.4.1 → fensu_cli-0.5.0}/crates/fensu-cli/src/skills/helpers/content/mod.rs

@@ -1,4 +1,5 @@
 pub(crate) mod discovery;
 pub(crate) mod fingerprint;
+pub(crate) mod option_rendering;
 pub(crate) mod rendering;
 pub(crate) mod sections;

fensu_cli-0.5.0/crates/fensu-cli/src/skills/helpers/content/option_rendering.rs

@@ -0,0 +1,83 @@
+use serde_json::json;
+
+use crate::models::{RuleMetadata, RuleOptionMetadata, RuleOptionValue};
+use crate::skills::helpers::content::sections::py_json;
+
+pub(crate) fn rule_option_lines(rule: &RuleMetadata) -> Vec<String> {
+    if rule.options.is_empty() {
+        return Vec::new();
+    }
+    let mut options = rule.options.iter().collect::<Vec<_>>();
+    options.sort_by(|left, right| left.name.cmp(&right.name));
+    let mut lines = vec!["Options:".to_owned(), String::new()];
+    for option in options {
+        lines.push(format!("#### `{}`", option.name));
+        lines.push(String::new());
+        lines.extend(skill_option_fields(option));
+        lines.push(String::new());
+    }
+    lines
+}
+
+fn skill_option_fields(option: &RuleOptionMetadata) -> Vec<String> {
+    vec![
+        format!("- Type: `{}`", skill_option_type(&option.kind)),
+        format!("- Required: `{}`", option.required),
+        format!(
+            "- Default: {}",
+            if option.required {
+                "required".to_owned()
+            } else {
+                skill_option_value(option.default.as_ref())
+            }
+        ),
+        format!(
+            "- Current value: {}",
+            skill_option_value(Some(&option.current_value))
+        ),
+        format!(
+            "- Description: {}",
+            option.description.as_deref().unwrap_or("None")
+        ),
+        format!(
+            "- Choices: {}",
+            option.choices.as_ref().map_or_else(
+                || "None".to_owned(),
+                |value| py_json(&json!(value)).unwrap_or_else(|_| "None".to_owned())
+            )
+        ),
+        format!(
+            "- Minimum: {}",
+            option
+                .minimum
+                .map_or_else(|| "None".to_owned(), |value| value.to_string())
+        ),
+        format!(
+            "- Maximum: {}",
+            option
+                .maximum
+                .map_or_else(|| "None".to_owned(), |value| value.to_string())
+        ),
+        format!(
+            "- Minimum items: {}",
+            option
+                .minimum_items
+                .map_or_else(|| "None".to_owned(), |value| value.to_string())
+        ),
+    ]
+}
+
+fn skill_option_type(kind: &str) -> &str {
+    match kind {
+        "string_list" => "list[string]",
+        "integer_list" => "list[integer]",
+        other => other,
+    }
+}
+
+fn skill_option_value(value: Option<&RuleOptionValue>) -> String {
+    value.map_or_else(
+        || "None".to_owned(),
+        |value| py_json(&json!(value)).unwrap_or_else(|_| "None".to_owned()),
+    )
+}

{fensu_cli-0.4.1 → fensu_cli-0.5.0}/crates/fensu-cli/src/skills/helpers/content/rendering.rs

@@ -5,6 +5,7 @@ use std::sync::OnceLock;
 use serde_json::{json, Value};
 
 use crate::models::RuleMetadata;
+use crate::skills::helpers::content::option_rendering::rule_option_lines;
 use crate::skills::helpers::content::sections::{
     display_project_path, effective_config_lines, expand_repository_profile, governed_path, py_json,
 };
@@ -327,6 +328,7 @@ fn tier_lines(heading: &str, rules: &[RuleMetadata]) -> Vec<String> {
             ),
             String::new(),
         ]);
+        lines.extend(rule_option_lines(rule));
     }
     lines
 }

{fensu_cli-0.4.1 → fensu_cli-0.5.0}/crates/fensu-cli/src/skills/helpers/context/mod.rs

@@ -1,5 +1,6 @@
 pub(crate) mod build;
 pub(crate) mod exceptions;
 pub(crate) mod identity;
+pub(crate) mod option_validation;
 pub(crate) mod options;
 pub(crate) mod selection;

fensu_cli-0.5.0/crates/fensu-cli/src/skills/helpers/context/option_validation.rs

@@ -0,0 +1,123 @@
+use std::collections::HashSet;
+
+use crate::models::{RuleMetadata, RuleOptionListValue, RuleOptionMetadata, RuleOptionValue};
+
+const INTEGER_KIND: &str = "integer";
+const INTEGER_LIST_KIND: &str = "integer_list";
+const STRING_KIND: &str = "string";
+const STRING_LIST_KIND: &str = "string_list";
+
+pub(crate) fn validate_rule_options(rule: &RuleMetadata) -> Result<(), String> {
+    let mut names = HashSet::new();
+    for option in &rule.options {
+        if !valid_option_name(&option.name)
+            || !names.insert(option.name.as_str())
+            || option.required == option.default.is_some()
+            || !option_value_matches_kind(&option.current_value, &option.kind)
+            || option
+                .default
+                .as_ref()
+                .is_some_and(|value| !option_value_matches_kind(value, &option.kind))
+            || option
+                .description
+                .as_deref()
+                .is_some_and(|description| description.trim().is_empty())
+            || !valid_option_constraints(option)
+        {
+            return Err(format!(
+                "Catalogue rule {} option {} contains incompatible metadata.",
+                rule.code, option.name
+            ));
+        }
+    }
+    Ok(())
+}
+
+fn valid_option_name(name: &str) -> bool {
+    !name.is_empty()
+        && name.split('_').all(|part| {
+            !part.is_empty()
+                && part.as_bytes()[0].is_ascii_lowercase()
+                && part
+                    .as_bytes()
+                    .iter()
+                    .all(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit())
+        })
+}
+
+fn option_value_matches_kind(value: &RuleOptionValue, kind: &str) -> bool {
+    match (kind, value) {
+        ("boolean", RuleOptionValue::Boolean(_))
+        | (INTEGER_KIND, RuleOptionValue::Integer(_))
+        | (STRING_KIND, RuleOptionValue::String(_)) => true,
+        (STRING_LIST_KIND, RuleOptionValue::List(values)) => values
+            .iter()
+            .all(|value| matches!(value, RuleOptionListValue::String(_))),
+        (INTEGER_LIST_KIND, RuleOptionValue::List(values)) => values
+            .iter()
+            .all(|value| matches!(value, RuleOptionListValue::Integer(_))),
+        _ => false,
+    }
+}
+
+fn valid_option_constraints(option: &RuleOptionMetadata) -> bool {
+    let choices_valid = match (&option.kind[..], &option.choices) {
+        (STRING_KIND, Some(choices)) => {
+            !choices.is_empty()
+                && choices.iter().collect::<HashSet<_>>().len() == choices.len()
+                && option_values_in_choices(option, choices)
+        }
+        (STRING_KIND, None) => true,
+        (_, None) => true,
+        (_, Some(_)) => false,
+    };
+    let integer_bounds_valid = if option.kind == INTEGER_KIND {
+        option
+            .minimum
+            .zip(option.maximum)
+            .is_none_or(|(min, max)| min <= max)
+            && option_values_in_bounds(option)
+    } else {
+        option.minimum.is_none() && option.maximum.is_none()
+    };
+    let minimum_items_valid =
+        if matches!(option.kind.as_str(), STRING_LIST_KIND | INTEGER_LIST_KIND) {
+            option
+                .minimum_items
+                .is_none_or(|minimum| option_values_have_minimum_items(option, minimum))
+        } else {
+            option.minimum_items.is_none()
+        };
+    choices_valid && integer_bounds_valid && minimum_items_valid
+}
+
+fn option_values_in_choices(option: &RuleOptionMetadata, choices: &[String]) -> bool {
+    [
+        &option.current_value,
+        option.default.as_ref().unwrap_or(&option.current_value),
+    ]
+    .into_iter()
+    .all(|value| matches!(value, RuleOptionValue::String(value) if choices.contains(value)))
+}
+
+fn option_values_in_bounds(option: &RuleOptionMetadata) -> bool {
+    [
+        &option.current_value,
+        option.default.as_ref().unwrap_or(&option.current_value),
+    ]
+    .into_iter()
+    .all(|value| {
+        matches!(value, RuleOptionValue::Integer(value)
+                if option.minimum.is_none_or(|minimum| *value >= minimum)
+                    && option.maximum.is_none_or(|maximum| *value <= maximum))
+    })
+}
+
+fn option_values_have_minimum_items(option: &RuleOptionMetadata, minimum: usize) -> bool {
+    [
+        &option.current_value,
+        option.default.as_ref().unwrap_or(&option.current_value),
+    ]
+    .into_iter()
+    .all(|value| matches!(value, RuleOptionValue::List(values) if values.len() >= minimum))
+}

{fensu_cli-0.4.1 → fensu_cli-0.5.0}/crates/fensu-cli/src/skills/helpers/context/selection.rs

@@ -5,6 +5,7 @@ use serde_json::json;
 
 use crate::helpers::{process, rule};
 use crate::models::{Config, RuleMetadata};
+use crate::skills::helpers::context::option_validation::validate_rule_options;
 use crate::skills::models::{HostResponse, RuleSelection};
 
 const CORE_KIND: &str = "core";
@@ -13,6 +14,7 @@ const CORE_RULE_CODE_LENGTH: usize = 6;
 const CUSTOM_KIND: &str = "custom";
 const CUSTOM_PREFIX: char = 'X';
 const MAX_CORE_SELECTOR_SUFFIX: usize = 4;
+const METADATA_PROTOCOL: u32 = 2;
 
 pub(crate) fn validate_config_policy(config: &Config) -> Result<(), String> {
     for (name, selectors) in [
@@ -32,7 +34,10 @@ pub(crate) fn validate_config_policy(config: &Config) -> Result<(), String> {
 }
 
 pub(crate) fn selection(config: &Config, project_root: &Path) -> Result<RuleSelection, String> {
-    if !config.rule_paths.is_empty() || !config.rule_modules.is_empty() {
+    if !config.rule_paths.is_empty()
+        || !config.rule_modules.is_empty()
+        || !config.rule_options.is_empty()
+    {
         return hosted_selection(project_root);
     }
     let catalogue = rule::catalogue().to_vec();
@@ -57,7 +62,7 @@ pub(crate) fn selection(config: &Config, project_root: &Path) -> Result<RuleSele
 
 fn hosted_selection(project_root: &Path) -> Result<RuleSelection, String> {
     let request = serde_json::to_vec(&json!({
-        "protocol": 1,
+        "protocol": METADATA_PROTOCOL,
         "project_root": project_root.to_string_lossy(),
     }))
     .map_err(|error| error.to_string())?;
@@ -65,10 +70,10 @@ fn hosted_selection(project_root: &Path) -> Result<RuleSelection, String> {
     validate_host_shape(&raw)?;
     let response: HostResponse = serde_json::from_slice(&raw)
         .map_err(|error| format!("Invalid custom-rule metadata host response: {error}"))?;
-    if response.protocol != 1 {
+    if response.protocol != METADATA_PROTOCOL {
         return Err(format!(
-            "Incompatible custom-rule metadata protocol {}; expected 1.",
-            response.protocol
+            "Incompatible custom-rule metadata protocol {}; expected {}.",
+            response.protocol, METADATA_PROTOCOL
         ));
     }
     if response.package_version != env!("CARGO_PKG_VERSION") {
@@ -115,6 +120,7 @@ fn validate_host_shape(raw: &[u8]) -> Result<(), String> {
         "kind",
         "source",
         "cacheable",
+        "options",
     ]);
     for rule in catalogue {
         let fields = rule
@@ -174,6 +180,7 @@ fn validate_host_catalogue(catalogue: &[RuleMetadata]) -> Result<(), String> {
                 item.code
             ));
         }
+        validate_rule_options(item)?;
     }
     Ok(())
 }