From 54af47e286d0fb601e2e60aeb19002f6b7937574 Mon Sep 17 00:00:00 2001
From: nsfisis <nsfisis@gmail.com>
Date: Sun, 7 Jun 2026 11:20:23 +0900
Subject: feat(shirabe): resolve advisory instanceof TODOs via
 AnySecurityAdvisory

Add an Ignored variant to the advisory enum (renamed to AnySecurityAdvisory)
so the PHP three-class hierarchy PartialSecurityAdvisory -> SecurityAdvisory
-> IgnoredSecurityAdvisory maps one-to-one onto enum variants.

Replace the hard-coded auditor downcasts with as_security_advisory()
(PHP `instanceof SecurityAdvisory`, true for both full and ignored) and
as_ignored(), implementing severity/cve/source ignore filtering, the
toIgnoredAdvisory conversion, and the table/plain row output faithfully.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 crates/shirabe/src/dependency_resolver/pool.rs               | 12 ++++--------
 .../src/dependency_resolver/security_advisory_pool_filter.rs | 10 +++++-----
 2 files changed, 9 insertions(+), 13 deletions(-)

(limited to 'crates/shirabe/src/dependency_resolver')

diff --git a/crates/shirabe/src/dependency_resolver/pool.rs b/crates/shirabe/src/dependency_resolver/pool.rs
index 91c3e31..06878e1 100644
--- a/crates/shirabe/src/dependency_resolver/pool.rs
+++ b/crates/shirabe/src/dependency_resolver/pool.rs
@@ -8,7 +8,7 @@ use shirabe_semver::compiling_matcher::CompilingMatcher;
 use shirabe_semver::constraint::AnyConstraint;
 use shirabe_semver::constraint::SimpleConstraint;
 
-use crate::advisory::PartialOrFullSecurityAdvisory;
+use crate::advisory::AnySecurityAdvisory;
 use crate::package::BasePackage;
 use crate::package::BasePackageHandle;
 use crate::package::version::VersionParser;
@@ -31,8 +31,7 @@ pub struct Pool {
     /// @var array<string, array<string, string>> Map of package object hash => removed normalized versions => removed pretty version
     pub(crate) removed_versions_by_package: IndexMap<String, IndexMap<String, String>>,
     /// @var array<string, array<string, array<SecurityAdvisory|PartialSecurityAdvisory>>> Map of package name => normalized version => security advisories
-    security_removed_versions:
-        IndexMap<String, IndexMap<String, Vec<PartialOrFullSecurityAdvisory>>>,
+    security_removed_versions: IndexMap<String, IndexMap<String, Vec<AnySecurityAdvisory>>>,
     /// @var array<string, array<string, string>> Map of package name => normalized version => pretty version
     abandoned_removed_versions: IndexMap<String, IndexMap<String, String>>,
 }
@@ -49,10 +48,7 @@ impl Pool {
         unacceptable_fixed_or_locked_packages: Vec<BasePackageHandle>,
         removed_versions: IndexMap<String, IndexMap<String, String>>,
         removed_versions_by_package: IndexMap<String, IndexMap<String, String>>,
-        security_removed_versions: IndexMap<
-            String,
-            IndexMap<String, Vec<PartialOrFullSecurityAdvisory>>,
-        >,
+        security_removed_versions: IndexMap<String, IndexMap<String, Vec<AnySecurityAdvisory>>>,
         abandoned_removed_versions: IndexMap<String, IndexMap<String, String>>,
     ) -> Self {
         let mut this = Self {
@@ -189,7 +185,7 @@ impl Pool {
     /// @return array<string, array<string, array<SecurityAdvisory|PartialSecurityAdvisory>>>
     pub fn get_all_security_removed_package_versions(
         &self,
-    ) -> &IndexMap<String, IndexMap<String, Vec<PartialOrFullSecurityAdvisory>>> {
+    ) -> &IndexMap<String, IndexMap<String, Vec<AnySecurityAdvisory>>> {
         &self.security_removed_versions
     }
 
diff --git a/crates/shirabe/src/dependency_resolver/security_advisory_pool_filter.rs b/crates/shirabe/src/dependency_resolver/security_advisory_pool_filter.rs
index 3136ce5..80769bb 100644
--- a/crates/shirabe/src/dependency_resolver/security_advisory_pool_filter.rs
+++ b/crates/shirabe/src/dependency_resolver/security_advisory_pool_filter.rs
@@ -1,8 +1,8 @@
 //! ref: composer/src/Composer/DependencyResolver/SecurityAdvisoryPoolFilter.php
 
+use crate::advisory::AnySecurityAdvisory;
 use crate::advisory::AuditConfig;
 use crate::advisory::Auditor;
-use crate::advisory::PartialOrFullSecurityAdvisory;
 use crate::dependency_resolver::Pool;
 use crate::dependency_resolver::Request;
 use crate::package::BasePackageHandle;
@@ -86,7 +86,7 @@ impl SecurityAdvisoryPoolFilter {
         let mut packages: Vec<BasePackageHandle> = vec![];
         let mut security_removed_versions: IndexMap<
             String,
-            IndexMap<String, Vec<PartialOrFullSecurityAdvisory>>,
+            IndexMap<String, Vec<AnySecurityAdvisory>>,
         > = IndexMap::new();
         let mut abandoned_removed_versions: IndexMap<String, IndexMap<String, String>> =
             IndexMap::new();
@@ -144,13 +144,13 @@ impl SecurityAdvisoryPoolFilter {
     fn get_matching_advisories(
         &self,
         package: BasePackageHandle,
-        advisory_map: &IndexMap<String, Vec<PartialOrFullSecurityAdvisory>>,
-    ) -> Vec<PartialOrFullSecurityAdvisory> {
+        advisory_map: &IndexMap<String, Vec<AnySecurityAdvisory>>,
+    ) -> Vec<AnySecurityAdvisory> {
         if package.is_dev() {
             return vec![];
         }
 
-        let mut matching_advisories: Vec<PartialOrFullSecurityAdvisory> = vec![];
+        let mut matching_advisories: Vec<AnySecurityAdvisory> = vec![];
         for package_name in package.get_names(false) {
             if !advisory_map.contains_key(&package_name) {
                 continue;
-- 
cgit v1.3.1