aboutsummaryrefslogtreecommitdiffhomepage
path: root/crates/shirabe/src/advisory/auditor.rs
AgeCommit message (Collapse)Author
2026-06-28refactor: add linternsfisis
2026-06-27test: port Composer tests unblocked by mockall, add seamsnsfisis
Port 11 categories of previously-ignored Composer tests now reachable with the mockall crate: DownloadManager, VCS/Perforce/File downloaders, VersionSelector, PlatformRepository, Auditor, installer/FilesystemRepository, RootPackageLoader, util auth/http, commands, and Cache. Extract test seams additively on concrete structs as *Interface traits (Runtime, HhvmDetector, VersionGuesser, RepositorySet, Perforce, BinaryInstaller) plus mock-field seams (Cache, Filesystem); consumers take trait objects. Mocks are defined locally in the test crates via mockall::mock!, since automock-generated mocks are cfg(test)-gated and invisible across the integration-test boundary. dataProviders are ported in full; tests blocked by unported shims stay #[ignore] with documented reasons rather than reduced or weakened. Fix product bugs surfaced by the ports: - util/github: use the exception code, not the HTTP status, for 401/403 - advisory: serialize empty audit maps as [] to match PHP json_encode - repository/filesystem and downloader/file: fix RefCell double-borrow panics Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-27refactor: fix compiler warnings and clippy warningsnsfisis
2026-06-26fix(check-platform-reqs-command): add PlatformRepository to existing compositensfisis
execute nested the already-built InstalledRepository inside a second InstalledRepository, tripping the assertion that an InstalledRepository may not contain another. PHP adds a PlatformRepository to the existing composite via addRepository; do the same. Un-ignores CheckPlatformReqsCommandTest::test_failed_platform_requirement. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-26refactor(symfony-table): model rows/cells with enums instead of PhpMixednsfisis
The Table helper modeled a row's cells as PhpMixed and recovered the concrete TableCell/TableSeparator types via runtime instance_of, leaving the entire mixed/array bridge (to_row_vec, cell_colspan, row_get, ...) as todo!(). Replace that with proper Row/Cell enums: Row = HeaderDivider | Separator(TableSeparator) | Cells(Vec<Cell>) Cell = Null | Value(String) | Cell(TableCell) | Separator(TableSeparator) The internal header/body boundary that PHP detects by object identity ($divider === $row) becomes the dedicated Row::HeaderDivider variant. Style arguments (PHP string|TableStyle) become a StyleName enum, so Table::new no longer panics in resolve_style's instance_of stub; TableStyle derives Clone so named styles resolve from the registry. PhpMixed-based callers (SymfonyStyle::table, render_table, auditor's sanitize) bridge via From<PhpMixed> for Cell/Row at the boundary. Un-ignores LicensesCommandTest text-format cases (4) and BaseDependencyCommandTest::why; output matches PHP exactly. Removes ~15 impl todo!()s in the Table helper. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-24chore: unwrap meaningless PhpMixed::String()nsfisis
2026-06-20refactor(php-shim): drop Box wrapping from PhpMixed List/Arraynsfisis
The List and Array variants of PhpMixed boxed their elements unnecessarily. Store PhpMixed values directly and update all callers accordingly. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-20refactor: auto-fix clippy warningsnsfisis
2026-06-14refactor(pcre): drop Result from Preg method return typesnsfisis
The Preg methods panic on PCRE failure (per the file header rationale), so their anyhow::Result wrappers never carried an Err. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-12refactor(php-shim): replace literal sprintf calls with format!nsfisis
Convert every sprintf() call with a compile-time literal format string to format!, implementing Display for PhpMixed (delegating to php_to_string) so PhpMixed values render with PHP string semantics through {}. Also merge the format!-wrapped and conditional-literal dynamic sites into single format! calls. Genuinely runtime format strings (table styles, configurable error messages, command synopsis, progress-bar modifiers, regex-built messages) still go through sprintf. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-12feat(symfony-console): port Symfony Console and make the workspace compilensfisis
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09feat(datetime): resolve datetime TODOsnsfisis
Introduce shim functions and constants, replacing the ad-hoc chrono format strings and parse helpers used as phase-b placeholders. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-08feat(phase-c): resolve PhpMixed-conversion phase-b TODOsnsfisis
Implement the foundational PhpMixed conversion infrastructure (From<bool|i64|f64|String>, order-sensitive PartialEq matching PHP ===) and resolve the category-G phase-b TODOs that depend on it: - Fix VCS driver cache paths that discarded parsed JSON or diverged on null caches (svn/forgejo/gitlab/git-bitbucket/github). - Wire up real conversions previously stubbed or dropped: suggests platform config, audit ignore-severities, composer_repository search and ProviderInfo, class_loader prefix/classmap merges, locker lock diff comparison, advisory JSON serialization, SPDX license fields. - Make GenericRule take a typed ReasonData; populate RULE_ROOT_REQUIRE with the constraint and convert PhpMixed at the call sites.
2026-06-08feat(phase-c): resolve reflection/downcast phase-b TODOsnsfisis
Resolve category F phase-b TODOs (class-string, instanceof, get_class, method_exists, __FILE__, Reflection API, downcast). - VcsRepository: dispatch drivers through a VcsDriverKind enum (instantiate/supports/php_class_name) and add constructors to the concrete VCS drivers - repository downcasts via RepositoryInterfaceHandle::downcast_rc and as_any (init/show commands, vcs ValidatingArrayLoader) - BaseCommand::is_self_update_command override replaces an instanceof - Factory::create narrows PartialComposer to ComposerHandle via as_full - InstalledVersions gains set_self_dir/set_installed_is_local_dir, replacing Reflection-based static property mutation - ClassLoader::as_array_iter ports the PHP (array) cast - drop the unnecessary __FILE__ phar branch in self-update application get_class(command) reclassified TODO(plugin); buffer_io StreamableInputInterface downcast and the ValidatingArrayLoader trait redesign left as tracked TODOs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-07refactor(phase-c): resolve shared-ownership TODOs via handle/Rc clonesnsfisis
Resolve the resolvable subset of category A (shared ownership / non-cloneable PHP class) TODOs by leaning on values that are already shared behind Rc/handle wrappers, where cloning preserves PHP reference semantics: - solver: call IgnoreListPlatformRequirementFilter::filter_constraint with a cloned AnyConstraint (a Clone enum) and propagate the Result - update_command: filter PlatformRepository out of the repository manager's handles into a CompositeRepository (array_filter equivalent) - package_discovery_trait: pass the real platform_requirement_filter (Rc clone) instead of substituting ignore_nothing() - installation_manager: pass the original full operation list (Vec<Rc<_>> clone) as all_operations - file_downloader: swap self.io to NullIO and restore via std::mem::replace - auditor: reuse the PackageInterfaceHandle list across the advisory and abandoned-package queries - process_executor: drop the unused, lossy Clone impl - config / array_repository: demote settled RefCell-design markers to comments Remaining category A items (factory installer wiring, purge_packages handle bridge, installer cache identity, reinstall flow, plugin command discovery) stay as TODOs since correct resolution needs structural refactors. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-07feat(shirabe): resolve advisory instanceof TODOs via AnySecurityAdvisorynsfisis
Add an Ignored variant to the advisory enum (renamed to AnySecurityAdvisory) so the PHP three-class hierarchy PartialSecurityAdvisory -> SecurityAdvisory -> IgnoredSecurityAdvisory maps one-to-one onto enum variants. Replace the hard-coded auditor downcasts with as_security_advisory() (PHP `instanceof SecurityAdvisory`, true for both full and ignored) and as_ignored(), implementing severity/cve/source ignore filtering, the toIgnoredAdvisory conversion, and the table/plain row output faithfully. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-05refactor(json): model JsonFile encode/write options as a typed structnsfisis
Replace the i64 bitmask + encode_with_indent split with a JsonEncodeOptions struct (Default = JSON_UNESCAPED_SLASHES|JSON_PRETTY_PRINT|JSON_UNESCAPED_UNICODE, default indent). encode/write each get a default form plus an explicit encode_with_options/write_with_options variant, mirroring PHP's optional $options argument. write_with_options always encodes with self.indent, matching PHP write(). Also reconcile call sites with the PHP sources: most ported sites passed 0 where Composer omits the argument (= default flags), so JsonManipulator/ShowCommand and JsonConfigSource now use the default options; only ComposerRepository and Locker genuinely pass 0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-03feat(io): add as_any downcast shims for IOInterface and OutputInterfacensfisis
Introduce the cross-cutting downcast base for PHP `instanceof` checks on io/output trait objects: `IOInterface::as_any` (ConsoleIO/NullIO/BufferIO) and `OutputInterface::as_console_output_interface` (promoting ConsoleOutput to a proper ConsoleOutputInterface). Wire the resolved downcasts in ConsoleIO error output, Auditor table format, and the event dispatcher. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-02feat(resolver): port SecurityAdvisoryPoolFilter::filternsfisis
Implement the security advisory pool filter end to end, plus the remaining actionable wirings it unblocked. - Unify the PartialSecurityAdvisory|SecurityAdvisory union as the PartialOrFullSecurityAdvisory enum and make the advisory types Clone, so advisories can be collected and stored; Pool.security_removed_versions now carries the union. This also unblocks PoolOptimizer's clone of the security-removed versions. - Thread the filter result through run_security_advisory_filter/build_pool as anyhow::Result. - Introduce typed PlatformRepositoryHandle and pass platform repos as handles through determine_requirements instead of &PlatformRepository. - Wire RuleSetGenerator's is_unacceptable_fixed_or_locked_package check and UpdateCommand's non-locked installed-packages branch. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-05-27refactor(package): pass package handles by value throughoutnsfisis
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-25refactor(package): introduce Rc<RefCell<_>> handles for packagesnsfisis
PHP packages have reference semantics, so introduce shared-ownership handles over an AnyPackage enum (PackageInterfaceHandle and friends) and replace Box<dyn PackageInterface> throughout. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-20refactor: re-export module items to shorten import pathsnsfisis
2026-05-20fix(compile): fix all remaining compile errorsnsfisis
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-19fix(compile): fix various compile errorsnsfisis
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-18fix(compile): extract static methods from BasePackage traitnsfisis
2026-05-17fix(compile): extract constants from traits to make them dyn-compatiblensfisis
2026-05-17chore(style): cargo fmtnsfisis
2026-05-16feat(port): port Auditor.phpnsfisis
2026-05-12feat(init): add scaffold filesnsfisis