|
| 1 | +import { parseSync } from 'oxc-parser'; |
| 2 | +import { propertyName, visitAst } from './cutover-policy-ast.ts'; |
| 3 | +import { countNamedCalls, lineOf, namedFunction } from './runtime-command-cutover-ast.ts'; |
| 4 | +import type { UnruledViolation } from './runtime-command-cutover-model.ts'; |
| 5 | + |
| 6 | +type AstNode = Record<string, unknown>; |
| 7 | + |
| 8 | +const SNAPSHOT_RUNTIME_BINDING_FILE = 'src/daemon/snapshot-runtime-binding.ts'; |
| 9 | +const SNAPSHOT_ADMISSION_FUNCTION = 'inspectSnapshotCaptureAdmission'; |
| 10 | + |
| 11 | +/** Snapshot admission consumes the selected plan and operation facts, never device-owner identity. */ |
| 12 | +export function snapshotPlatformPolicyBranchViolations( |
| 13 | + sources: ReadonlyMap<string, string>, |
| 14 | +): UnruledViolation[] { |
| 15 | + const source = sources.get(SNAPSHOT_RUNTIME_BINDING_FILE); |
| 16 | + if (source === undefined) { |
| 17 | + return [ |
| 18 | + { |
| 19 | + file: SNAPSHOT_RUNTIME_BINDING_FILE, |
| 20 | + line: 1, |
| 21 | + message: 'snapshot facts-first admission module is missing', |
| 22 | + }, |
| 23 | + ]; |
| 24 | + } |
| 25 | + const program = parseSync(SNAPSHOT_RUNTIME_BINDING_FILE, source).program as AstNode; |
| 26 | + const admission = namedFunction(program, SNAPSHOT_ADMISSION_FUNCTION); |
| 27 | + if (admission === undefined) { |
| 28 | + return [ |
| 29 | + { |
| 30 | + file: SNAPSHOT_RUNTIME_BINDING_FILE, |
| 31 | + line: 1, |
| 32 | + message: `snapshot admission must be owned by ${SNAPSHOT_ADMISSION_FUNCTION}`, |
| 33 | + }, |
| 34 | + ]; |
| 35 | + } |
| 36 | + |
| 37 | + const violations: UnruledViolation[] = []; |
| 38 | + const seenLines = new Set<number>(); |
| 39 | + let readsRequiredOperations = false; |
| 40 | + let readsOperationFacts = false; |
| 41 | + let admitsAvailableFacts = false; |
| 42 | + visitAst(admission, (node) => { |
| 43 | + const path = memberPath(node); |
| 44 | + if (path === undefined) return; |
| 45 | + if (samePath(path, ['plan', 'use', 'required'])) readsRequiredOperations = true; |
| 46 | + if (samePath(path, ['facts', 'operations'])) readsOperationFacts = true; |
| 47 | + if (samePath(path, ['fact', 'available'])) admitsAvailableFacts = true; |
| 48 | + |
| 49 | + const readsDeviceLeaf = |
| 50 | + (path[0] === 'device' && path.length > 1) || |
| 51 | + (path[0] === 'params' && path[1] === 'device' && path.length > 2); |
| 52 | + const readsOwnerIdentity = path[0] === 'facts' && path[1] === 'device' && path.length > 2; |
| 53 | + if (!readsDeviceLeaf && !readsOwnerIdentity) return; |
| 54 | + const line = lineOf(source, node); |
| 55 | + if (seenLines.has(line)) return; |
| 56 | + seenLines.add(line); |
| 57 | + violations.push({ |
| 58 | + file: SNAPSHOT_RUNTIME_BINDING_FILE, |
| 59 | + line, |
| 60 | + message: 'snapshot admission reads device-owner identity instead of selected operation facts', |
| 61 | + }); |
| 62 | + }); |
| 63 | + |
| 64 | + if (countNamedCalls(admission, 'resolveSnapshotRuntimePlan') !== 1) { |
| 65 | + violations.push({ |
| 66 | + file: SNAPSHOT_RUNTIME_BINDING_FILE, |
| 67 | + line: lineOf(source, admission), |
| 68 | + message: 'snapshot admission must select exactly one normalized runtime plan', |
| 69 | + }); |
| 70 | + } |
| 71 | + if (!readsRequiredOperations || !readsOperationFacts || !admitsAvailableFacts) { |
| 72 | + violations.push({ |
| 73 | + file: SNAPSHOT_RUNTIME_BINDING_FILE, |
| 74 | + line: lineOf(source, admission), |
| 75 | + message: 'snapshot admission must admit every selected operation through owner facts', |
| 76 | + }); |
| 77 | + } |
| 78 | + return violations; |
| 79 | +} |
| 80 | + |
| 81 | +function memberPath(node: unknown): string[] | undefined { |
| 82 | + if (node === null || typeof node !== 'object') return undefined; |
| 83 | + const record = node as AstNode; |
| 84 | + if (record['type'] === 'Identifier') { |
| 85 | + const name = record['name']; |
| 86 | + return typeof name === 'string' ? [name] : undefined; |
| 87 | + } |
| 88 | + if (record['type'] === 'ChainExpression') return memberPath(record['expression']); |
| 89 | + if (record['type'] !== 'MemberExpression' || record['computed'] === true) return undefined; |
| 90 | + const object = memberPath(record['object']); |
| 91 | + const name = propertyName(record['property']); |
| 92 | + return object && name ? [...object, name] : undefined; |
| 93 | +} |
| 94 | + |
| 95 | +function samePath(actual: readonly string[], expected: readonly string[]): boolean { |
| 96 | + return ( |
| 97 | + actual.length === expected.length && actual.every((part, index) => part === expected[index]) |
| 98 | + ); |
| 99 | +} |
0 commit comments