sqlguard-ninja 0.1.0__py3-none-any.whl

sqlguard_ninja/policy/model.py

@@ -0,0 +1,370 @@
+"""Versioned, validated policy schema.
+
+A policy describes *what exists* (the catalog and its classification labels) and *who may
+see what* (roles). It is loaded from YAML or JSON and validated eagerly so that a typo in a
+role grant fails at start-up instead of silently allowing or denying queries.
+"""
+
+from __future__ import annotations
+
+import json
+from enum import StrEnum
+from pathlib import Path
+from typing import Any, Literal
+
+import yaml
+from pydantic import BaseModel, ConfigDict, Field, field_validator, model_validator
+
+from sqlguard_ninja.core.findings import Action
+
+
+class PolicyError(ValueError):
+    """Raised when a policy file is malformed or internally inconsistent."""
+
+
+class Access(StrEnum):
+    """How a role may use a column or a label."""
+
+    ALLOW = "allow"
+    AGGREGATE_ONLY = "aggregate_only"
+    REVIEW = "review"
+    DENY = "deny"
+
+
+class Sensitivity(StrEnum):
+    LOW = "low"
+    MEDIUM = "medium"
+    HIGH = "high"
+    CRITICAL = "critical"
+
+
+class _Model(BaseModel):
+    model_config = ConfigDict(extra="forbid", frozen=True)
+
+
+def _lower_keys(value: Any) -> Any:
+    if isinstance(value, dict):
+        return {str(k).lower(): v for k, v in value.items()}
+    return value
+
+
+def _lower_list(value: Any) -> Any:
+    if isinstance(value, list):
+        return [str(v).lower() for v in value]
+    return value
+
+
+class LabelDef(_Model):
+    """A classification label such as ``contact`` or ``financial``."""
+
+    description: str = ""
+    sensitivity: Sensitivity = Sensitivity.MEDIUM
+    masking: str | None = Field(
+        default=None, description="Recommended masking or minimisation technique."
+    )
+    special_category: bool = Field(
+        default=False, description="GDPR Art. 9 special-category data, when so configured."
+    )
+
+
+class ColumnDef(_Model):
+    """Metadata for one column. Labels are configuration, never inferred from the name."""
+
+    type: str = "text"
+    labels: tuple[str, ...] = ()
+    identifying: bool = Field(
+        default=False,
+        description="Uniquely identifies a person/entity. Used for small-cohort checks.",
+    )
+    alternatives: tuple[str, ...] = Field(
+        default=(), description="Less sensitive columns of the same table that may suffice."
+    )
+    json_fields: dict[str, tuple[str, ...]] = Field(
+        default_factory=dict,
+        description="Labels for paths inside a JSON column, keyed by dotted path.",
+    )
+
+    _norm_labels = field_validator("labels", "alternatives", mode="before")(_lower_list)
+
+    @field_validator("json_fields", mode="before")
+    @classmethod
+    def _norm_json(cls, value: Any) -> Any:
+        if isinstance(value, dict):
+            return {str(k).lower(): _lower_list(list(v)) for k, v in value.items()}
+        return value
+
+    def effective_labels(self, json_path: tuple[str, ...] | None = None) -> set[str]:
+        """Labels revealed by reading this column, or one JSON path inside it.
+
+        Reading the whole column reveals every nested field, so its labels are the union of
+        the column's own labels and all JSON field labels. Reading a path reveals the
+        column's labels plus labels of that path, its ancestors and its descendants.
+        """
+        labels = set(self.labels)
+        if json_path is None:
+            for field_labels in self.json_fields.values():
+                labels.update(field_labels)
+            return labels
+        requested = ".".join(p.lower() for p in json_path)
+        for path, field_labels in self.json_fields.items():
+            if (
+                path == requested
+                or path.startswith(requested + ".")
+                or requested.startswith(path + ".")
+            ):
+                labels.update(field_labels)
+        return labels
+
+
+class TableDef(_Model):
+    description: str = ""
+    columns: dict[str, ColumnDef]
+    tenant_column: str | None = None
+    estimated_rows: int | None = Field(default=None, ge=0)
+
+    @field_validator("columns", mode="before")
+    @classmethod
+    def _norm_columns(cls, value: Any) -> Any:
+        if not isinstance(value, dict):
+            return value
+        out: dict[str, Any] = {}
+        for name, spec in value.items():
+            if spec is None:
+                spec = {}
+            elif isinstance(spec, str):
+                spec = {"type": spec}
+            elif isinstance(spec, list):
+                spec = {"labels": spec}
+            out[str(name).lower()] = spec
+        return out
+
+    @field_validator("tenant_column", mode="before")
+    @classmethod
+    def _norm_tenant(cls, value: Any) -> Any:
+        return value.lower() if isinstance(value, str) else value
+
+    @model_validator(mode="after")
+    def _check(self) -> TableDef:
+        if self.tenant_column and self.tenant_column not in self.columns:
+            raise ValueError(f"tenant_column '{self.tenant_column}' is not a declared column")
+        for name, col in self.columns.items():
+            for alt in col.alternatives:
+                if alt not in self.columns:
+                    raise ValueError(f"column '{name}' lists unknown alternative '{alt}'")
+        return self
+
+
+class Catalog(_Model):
+    default_schema: str | None = Field(
+        default=None,
+        description="Schema that unqualified names resolve to (e.g. 'public' or 'main').",
+    )
+    tables: dict[str, TableDef]
+
+    _norm = field_validator("tables", mode="before")(_lower_keys)
+
+    @field_validator("default_schema", mode="before")
+    @classmethod
+    def _norm_schema(cls, value: Any) -> Any:
+        return value.lower() if isinstance(value, str) else value
+
+    def sqlglot_schema(self) -> dict[str, dict[str, str]]:
+        return {
+            name: {col: spec.type for col, spec in table.columns.items()}
+            for name, table in self.tables.items()
+        }
+
+
+class TableGrant(_Model):
+    """Which columns of a table a role may reference."""
+
+    columns: Literal["*"] | tuple[str, ...] = "*"
+    deny_columns: tuple[str, ...] = ()
+    column_access: dict[str, Access] = Field(
+        default_factory=dict, description="Per-column overrides; most specific rule wins."
+    )
+
+    @field_validator("columns", mode="before")
+    @classmethod
+    def _norm_cols(cls, value: Any) -> Any:
+        return _lower_list(value) if isinstance(value, list) else value
+
+    _norm_deny = field_validator("deny_columns", mode="before")(_lower_list)
+    _norm_access = field_validator("column_access", mode="before")(_lower_keys)
+
+
+class Limits(_Model):
+    max_sql_length: int = Field(default=20_000, gt=0)
+    max_ast_nodes: int = Field(default=5_000, gt=0)
+    max_joins: int | None = Field(default=8, ge=0)
+    max_subquery_depth: int | None = Field(default=5, ge=0)
+    max_limit: int | None = Field(default=None, gt=0)
+    require_limit: bool = False
+
+
+class Role(_Model):
+    description: str = ""
+    tables: dict[str, TableGrant] = Field(default_factory=dict)
+    labels: dict[str, Access] = Field(
+        default_factory=dict, description="Access per classification label."
+    )
+    unlisted_label_access: Access = Field(
+        default=Access.DENY,
+        description="Access for labelled columns whose label the role does not mention.",
+    )
+    tenant_scoped: bool = True
+    limits: Limits | None = None
+
+    _norm_labels = field_validator("labels", mode="before")(_lower_keys)
+
+    @field_validator("tables", mode="before")
+    @classmethod
+    def _grant_shorthand(cls, value: Any) -> Any:
+        # Allow `tables: {orders: "*"}` and `tables: {orders: [id, status]}`.
+        if isinstance(value, dict):
+            out: dict[str, Any] = {}
+            for name, grant in value.items():
+                if grant is None or grant == "*":
+                    grant = {"columns": "*"}
+                elif isinstance(grant, list):
+                    grant = {"columns": grant}
+                out[str(name).lower()] = grant
+            return out
+        return value
+
+
+class FunctionPolicy(_Model):
+    mode: Literal["denylist", "allowlist"] = "denylist"
+    deny: tuple[str, ...] = ()
+    allow: tuple[str, ...] = Field(
+        default=(),
+        description="In allowlist mode: the permitted functions. In denylist mode: "
+        "exceptions removed from the built-in deny list.",
+    )
+    review: tuple[str, ...] = ()
+    unknown_function_action: Action = Field(
+        default=Action.WARN,
+        description="Action for functions sqlglot does not recognise (possible UDFs).",
+    )
+
+    _norm = field_validator("deny", "allow", "review", mode="before")(_lower_list)
+
+
+class TenantConfig(_Model):
+    context_key: str = "tenant_id"
+    parameter_names: tuple[str, ...] = Field(
+        default=("tenant_id",),
+        description="Bind-parameter names that the application fills with the trusted tenant.",
+    )
+
+
+class Defaults(_Model):
+    unknown_table_action: Action = Action.DENY
+    unresolved_column_action: Action = Action.DENY
+    unexpandable_star_action: Action = Action.DENY
+    catalog_access_action: Action = Action.DENY
+    minimization_action: Action = Action.WARN
+    small_cohort_action: Action = Action.REVIEW
+
+
+class CostThresholds(_Model):
+    """Static and planner thresholds; see :mod:`sqlguard_ninja.query_cost`."""
+
+    enabled: bool = True
+    review_score: int = Field(default=50, ge=0, le=100)
+    deny_score: int = Field(default=80, ge=0, le=100)
+    large_table_rows: int = Field(default=1_000_000, ge=0)
+    max_plan_total_cost: float | None = None
+    max_plan_rows: float | None = None
+
+
+class Disclosure(StrEnum):
+    """How much schema detail agent-facing messages may contain."""
+
+    NAMES = "names"
+    GENERIC = "generic"
+
+
+class Policy(_Model):
+    """Top-level policy document (``version: 1``)."""
+
+    version: Literal[1] = 1
+    name: str
+    description: str = ""
+    dialect: str = "postgres"
+    catalog: Catalog
+    labels: dict[str, LabelDef] = Field(default_factory=dict)
+    roles: dict[str, Role] = Field(default_factory=dict)
+    default_role: str | None = None
+    tenant: TenantConfig = Field(default_factory=TenantConfig)
+    functions: FunctionPolicy = Field(default_factory=FunctionPolicy)
+    limits: Limits = Field(default_factory=Limits)
+    defaults: Defaults = Field(default_factory=Defaults)
+    cost: CostThresholds = Field(default_factory=CostThresholds)
+    disclosure: Disclosure = Disclosure.NAMES
+
+    _norm_labels = field_validator("labels", mode="before")(_lower_keys)
+
+    @model_validator(mode="after")
+    def _check_references(self) -> Policy:
+        errors: list[str] = []
+        for tname, table in self.catalog.tables.items():
+            for cname, col in table.columns.items():
+                for label in col.effective_labels():
+                    if label not in self.labels:
+                        errors.append(f"{tname}.{cname}: unknown label '{label}'")
+        for rname, role in self.roles.items():
+            for label in role.labels:
+                if label not in self.labels:
+                    errors.append(f"role '{rname}': unknown label '{label}'")
+            for tname, grant in role.tables.items():
+                tdef = self.catalog.tables.get(tname)
+                if tdef is None:
+                    errors.append(f"role '{rname}': grant on unknown table '{tname}'")
+                    continue
+                named = [
+                    *(grant.columns if grant.columns != "*" else ()),
+                    *grant.deny_columns,
+                    *grant.column_access,
+                ]
+                for cname in named:
+                    if cname not in tdef.columns:
+                        errors.append(f"role '{rname}': unknown column '{tname}.{cname}'")
+        if self.default_role and self.default_role not in self.roles:
+            errors.append(f"default_role '{self.default_role}' is not defined")
+        if self.cost.review_score > self.cost.deny_score:
+            errors.append("cost.review_score must not exceed cost.deny_score")
+        if errors:
+            raise ValueError("; ".join(errors))
+        return self
+
+    # ------------------------------------------------------------------ loading
+    @classmethod
+    def from_dict(cls, data: dict[str, Any]) -> Policy:
+        try:
+            return cls.model_validate(data)
+        except ValueError as exc:  # pydantic.ValidationError subclasses ValueError
+            raise PolicyError(f"invalid policy: {exc}") from exc
+
+    @classmethod
+    def from_file(cls, path: str | Path) -> Policy:
+        """Load a policy from ``.yaml``/``.yml`` or ``.json``."""
+        p = Path(path)
+        try:
+            text = p.read_text(encoding="utf-8")
+        except OSError as exc:
+            raise PolicyError(f"cannot read policy file {p}: {exc}") from exc
+        data = json.loads(text) if p.suffix.lower() == ".json" else yaml.safe_load(text)
+        if not isinstance(data, dict):
+            raise PolicyError(f"policy file {p} must contain a mapping at the top level")
+        return cls.from_dict(data)
+
+    def role(self, name: str | None) -> tuple[str | None, Role | None]:
+        """Resolve a role name (falling back to ``default_role``)."""
+        key = name or self.default_role
+        if key is None:
+            return None, None
+        return key, self.roles.get(key)
+
+    def effective_limits(self, role: Role | None) -> Limits:
+        return role.limits if role is not None and role.limits is not None else self.limits

sqlguard_ninja/privacy/__init__.py

@@ -0,0 +1,9 @@
+"""Privacy policy pack (classification labels, aggregate-only access, minimisation)."""
+
+from sqlguard_ninja.privacy.rules import (
+    ColumnAccessDecision,
+    PrivacyPolicyRule,
+    resolve_column_access,
+)
+
+__all__ = ["ColumnAccessDecision", "PrivacyPolicyRule", "resolve_column_access"]

sqlguard_ninja/privacy/rules.py

@@ -0,0 +1,286 @@
+"""Privacy policy pack: label-based column restrictions, aggregate-only access, data
+minimisation and small-cohort re-identification warnings.
+
+This is a technical control library. It helps implement data-minimisation and
+need-to-know principles; it does not certify GDPR compliance.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterator
+from dataclasses import dataclass
+
+from sqlguard_ninja.core.analysis import AggregateKind, Clause, ColumnRef
+from sqlguard_ninja.core.findings import Action, Category, Finding, Severity
+from sqlguard_ninja.core.rules.base import RuleContext
+from sqlguard_ninja.policy.model import Access, ColumnDef, Disclosure, Policy, Role, Sensitivity
+
+_SEVERITY = {
+    Sensitivity.LOW: Severity.LOW,
+    Sensitivity.MEDIUM: Severity.MEDIUM,
+    Sensitivity.HIGH: Severity.HIGH,
+    Sensitivity.CRITICAL: Severity.CRITICAL,
+}
+
+
+@dataclass(frozen=True)
+class ColumnAccessDecision:
+    """How a role may use one column, and why."""
+
+    restrictions: tuple[tuple[Access, str], ...]
+    """(access, source) pairs; source is ``column:<name>`` or ``label:<label>``."""
+    labels: frozenset[str]
+
+    @property
+    def strongest(self) -> Access:
+        order = [Access.DENY, Access.AGGREGATE_ONLY, Access.REVIEW, Access.ALLOW]
+        present = {a for a, _ in self.restrictions}
+        return next((a for a in order if a in present), Access.ALLOW)
+
+
+def resolve_column_access(
+    policy: Policy,
+    role: Role | None,
+    table: str,
+    column: str,
+    json_path: tuple[str, ...] | None = None,
+) -> ColumnAccessDecision:
+    """Resolve effective access: explicit column rule → label rules → role default."""
+    tdef = policy.catalog.tables.get(table)
+    cdef: ColumnDef | None = tdef.columns.get(column) if tdef else None
+    labels = frozenset(cdef.effective_labels(json_path)) if cdef else frozenset()
+    if role is not None:
+        grant = role.tables.get(table)
+        if grant is not None and column in grant.column_access:
+            return ColumnAccessDecision(
+                ((grant.column_access[column], f"column:{table}.{column}"),), labels
+            )
+    restrictions: list[tuple[Access, str]] = []
+    for label in sorted(labels):
+        access = Access.DENY if role is None else role.labels.get(label, role.unlisted_label_access)
+        if access is not Access.ALLOW:
+            restrictions.append((access, f"label:{label}"))
+    return ColumnAccessDecision(tuple(restrictions), labels)
+
+
+class PrivacyPolicyRule:
+    rule_ids = (
+        "privacy.label_denied",
+        "privacy.aggregate_only",
+        "privacy.label_review",
+        "privacy.small_cohort",
+        "privacy.minimization",
+    )
+
+    def check(self, ctx: RuleContext) -> Iterator[Finding]:
+        policy = ctx.policy
+        role = ctx.role
+        emitted: set[tuple[str, str, str]] = set()
+        aggregate_only_used = False
+        star_labelled: dict[str, set[str]] = {}
+
+        for ref in ctx.analysis.columns:
+            tdef = policy.catalog.tables.get(ref.table)
+            if tdef is None or ref.column not in tdef.columns:
+                continue
+            if role is not None and ref.table not in role.tables:
+                continue
+            decision = resolve_column_access(policy, role, ref.table, ref.column, ref.json_path)
+            if ref.whole_row and decision.labels:
+                star_labelled.setdefault(ref.table, set()).update(decision.labels)
+            for access, source in decision.restrictions:
+                finding = self._finding_for(ctx, ref, access, source, decision.labels)
+                if finding is None:
+                    if access is Access.AGGREGATE_ONLY:
+                        aggregate_only_used = True
+                    continue
+                key = (finding.rule_id, f"{ref.table}.{ref.column}", "")
+                if key in emitted:
+                    continue
+                emitted.add(key)
+                yield finding
+
+        if aggregate_only_used:
+            yield from self._small_cohort(ctx)
+
+        for table, labels in sorted(star_labelled.items()):
+            yield Finding(
+                rule_id="privacy.minimization",
+                category=Category.PRIVACY,
+                severity=Severity.LOW,
+                action=policy.defaults.minimization_action,
+                message=f"Selecting every column of {ctx.name('table', table)} returns "
+                "classified data; select only the columns the task needs.",
+                labels=tuple(sorted(labels)),
+                table=table,
+            )
+        yield from self._alternatives(ctx)
+
+    # -------------------------------------------------------------- helpers
+    def _finding_for(
+        self,
+        ctx: RuleContext,
+        ref: ColumnRef,
+        access: Access,
+        source: str,
+        labels: frozenset[str],
+    ) -> Finding | None:
+        policy = ctx.policy
+        col_txt = ctx.name("column", f"{ref.table}.{ref.column}")
+        label_names = tuple(sorted(labels))
+        label_defs = [policy.labels[x] for x in label_names if x in policy.labels]
+        severity = max(
+            (_SEVERITY[d.sensitivity] for d in label_defs),
+            default=Severity.MEDIUM,
+            key=list(Severity).index,
+        )
+        special = any(d.special_category for d in label_defs)
+        masking = next((d.masking for d in label_defs if d.masking), None)
+        alt = self._allowed_alternative(ctx, ref)
+        remediation_parts = []
+        if alt:
+            remediation_parts.append(f"Use {ctx.name('column', alt)} instead.")
+        if masking:
+            remediation_parts.append(f"Recommended treatment: {masking}.")
+        remediation = " ".join(remediation_parts) or None
+        path_txt = f" (JSON path {'.'.join(ref.json_path)})" if ref.json_path else ""
+        cls_txt = (
+            "special-category personal data"
+            if special
+            else ("classified data (" + ", ".join(label_names) + ")" if label_names else "data")
+        )
+        if policy.disclosure == Disclosure.GENERIC:
+            cls_txt = "classified data"
+        meta = {"source": source, "clause": ref.clause.value, "aggregate": ref.aggregate.value}
+
+        if access is Access.DENY:
+            return Finding(
+                rule_id="privacy.label_denied",
+                category=Category.PRIVACY,
+                severity=Severity.CRITICAL if special else severity,
+                action=Action.DENY,
+                message=f"The {col_txt}{path_txt} contains {cls_txt} that this role may not "
+                "access.",
+                detail=f"restricted by {source}",
+                table=ref.table,
+                column=ref.column,
+                labels=label_names,
+                remediation=remediation,
+                metadata=meta,
+            )
+        if access is Access.AGGREGATE_ONLY:
+            if ref.aggregate is AggregateKind.STATISTICAL:
+                return None
+            where = (
+                "in a filter, grouping or ordering"
+                if ref.clause in (Clause.WHERE, Clause.JOIN, Clause.GROUP, Clause.ORDER)
+                else "as individual values"
+            )
+            return Finding(
+                rule_id="privacy.aggregate_only",
+                category=Category.PRIVACY,
+                severity=severity,
+                action=Action.DENY,
+                message=f"The {col_txt} may only be used inside statistical aggregates "
+                f"(COUNT, SUM, AVG, ...), not {where}.",
+                detail=f"restricted by {source}; aggregate={ref.aggregate.value}",
+                table=ref.table,
+                column=ref.column,
+                labels=label_names,
+                remediation=remediation
+                or "Aggregate the column (e.g. AVG) and group by non-identifying attributes.",
+                metadata=meta,
+            )
+        if access is Access.REVIEW:
+            return Finding(
+                rule_id="privacy.label_review",
+                category=Category.PRIVACY,
+                severity=severity,
+                action=Action.REVIEW,
+                message=f"Access to the {col_txt} ({cls_txt}) requires human approval.",
+                detail=f"restricted by {source}",
+                table=ref.table,
+                column=ref.column,
+                labels=label_names,
+                remediation=remediation,
+                metadata=meta,
+            )
+        return None
+
+    def _allowed_alternative(self, ctx: RuleContext, ref: ColumnRef) -> str | None:
+        tdef = ctx.policy.catalog.tables[ref.table]
+        cdef = tdef.columns[ref.column]
+        for alt in cdef.alternatives:
+            decision = resolve_column_access(ctx.policy, ctx.role, ref.table, alt)
+            if decision.strongest is Access.ALLOW and self._granted(ctx, ref.table, alt):
+                return f"{ref.table}.{alt}"
+        return None
+
+    @staticmethod
+    def _granted(ctx: RuleContext, table: str, column: str) -> bool:
+        if ctx.role is None:
+            return True
+        grant = ctx.role.tables.get(table)
+        if grant is None or column in grant.deny_columns:
+            return False
+        return grant.columns == "*" or column in grant.columns
+
+    def _small_cohort(self, ctx: RuleContext) -> Iterator[Finding]:
+        """Aggregates over a group filtered or grouped by an identifier reveal single values."""
+        catalog = ctx.policy.catalog
+        for ref in ctx.analysis.columns:
+            if ref.clause not in (Clause.WHERE, Clause.GROUP, Clause.JOIN, Clause.HAVING):
+                continue
+            if ref.clause is Clause.JOIN:
+                continue  # join keys are expected to be identifiers
+            tdef = catalog.tables.get(ref.table)
+            if tdef is None or ref.column not in tdef.columns:
+                continue
+            if tdef.columns[ref.column].identifying and ref.aggregate is AggregateKind.NONE:
+                yield Finding(
+                    rule_id="privacy.small_cohort",
+                    category=Category.PRIVACY,
+                    severity=Severity.MEDIUM,
+                    action=ctx.policy.defaults.small_cohort_action,
+                    message="An aggregate of restricted data is filtered or grouped by an "
+                    "identifying column, which can reveal individual values.",
+                    detail=f"identifying column {ref.table}.{ref.column} in {ref.clause.value}",
+                    table=ref.table,
+                    column=ref.column,
+                    remediation="Group by non-identifying attributes and ensure groups are "
+                    "large enough (k-anonymity is not checked statically).",
+                )
+                return
+
+    def _alternatives(self, ctx: RuleContext) -> Iterator[Finding]:
+        """Suggest less sensitive alternatives for permitted-but-labelled columns."""
+        seen: set[tuple[str, str]] = set()
+        for ref in ctx.analysis.columns:
+            if ref.whole_row or ref.clause is not Clause.SELECT:
+                continue
+            key = (ref.table, ref.column)
+            if key in seen:
+                continue
+            seen.add(key)
+            tdef = ctx.policy.catalog.tables.get(ref.table)
+            if tdef is None or ref.column not in tdef.columns:
+                continue
+            if not tdef.columns[ref.column].alternatives:
+                continue
+            decision = resolve_column_access(ctx.policy, ctx.role, ref.table, ref.column)
+            if decision.strongest is not Access.ALLOW or not decision.labels:
+                continue
+            alt = self._allowed_alternative(ctx, ref)
+            if alt:
+                yield Finding(
+                    rule_id="privacy.minimization",
+                    category=Category.PRIVACY,
+                    severity=Severity.INFO,
+                    action=Action.WARN,
+                    message=f"The {ctx.name('column', f'{ref.table}.{ref.column}')} is "
+                    f"classified; {ctx.name('column', alt)} may be sufficient.",
+                    table=ref.table,
+                    column=ref.column,
+                    labels=tuple(sorted(decision.labels)),
+                    remediation=f"Prefer {alt}.",
+                )