datasecurity: simplify code and tests

Author: aimenebelfodil

pkg/collector/sharedlibrary/rustchecks/checks/datasecurity/src/config.rs

@@ -26,9 +26,6 @@ impl CheckConfig {
 
 
 /// Instance configuration for the datasecurity check.
-///
-/// Kept in its own module so the deserialization surface of the check instance
-/// config stays readable and easy to grow as the check gains real RC tasks.
 #[derive(Debug, Default, Deserialize)]
 pub struct CheckConfig {
     #[serde(default)]

pkg/collector/sharedlibrary/rustchecks/checks/datasecurity/src/scanning/mod.rs

@@ -1,13 +1,11 @@
-//! Self-contained SDS scanning: rule config parsing (`rule`) plus building and
-//! running the dd-sds scanner over column-oriented query results. Everything
-//! scanning-related lives in this module so the rest of the check stays lean.
+//! SDS scanning: parse rules and run the dd-sds scanner over query results.
 
 use std::collections::{HashMap, HashSet};
 use std::sync::Arc;
 
 use anyhow::{Context, Result};
 use dd_sds::{RootRuleConfig, RuleConfig, RuleMatch, Scanner as SdsScanner, ScannerBuilder};
-use serde_json::{Map, Value};
+use serde_json::Value;
 
 use crate::payload::Match;
 
@@ -17,64 +15,44 @@ pub use rule::ScanningRule;
 #[cfg(test)]
 mod tests;
 
-/// A built dd-sds scanner plus the rule ids in builder order. dd-sds reports
-/// matches by rule index, so we keep the ids to map matches back to our rules.
+/// A dd-sds scanner plus the rule ids, used to map matches back to rules.
 pub struct Scanner {
     scanner: SdsScanner,
     rule_ids: Vec<String>,
 }
 
 impl Scanner {
-    /// Builds a scanner from the check's scanning rules. The full dd-sds rule
-    /// surface (pattern, proximity keywords, suppressions, precedence, secondary
-    /// validators such as Luhn/JWT, ...) is supported because each rule carries
-    /// the flattened `RootRuleConfig` verbatim.
+    /// Builds a scanner from the check's scanning rules.
     pub fn new(rules: &[ScanningRule]) -> Result<Self> {
         let mut rule_ids = Vec::with_capacity(rules.len());
-        let compiled: Vec<RootRuleConfig<Arc<dyn RuleConfig>>> = rules
+        let scanner_rules: Vec<RootRuleConfig<Arc<dyn RuleConfig>>> = rules
             .iter()
             .map(|rule| {
                 rule_ids.push(rule.id.clone());
                 rule.config.clone().into_dyn()
             })
             .collect();
 
-        let scanner = ScannerBuilder::new(&compiled)
+        let scanner = ScannerBuilder::new(&scanner_rules)
             .build()
             .context("building sds scanner")?;
         Ok(Self { scanner, rule_ids })
     }
 
-    /// Scans a column-oriented result (`{ column: [values...] }`) and returns
-    /// one `Match` per (column, rule) pair with the count of matched rows.
+    /// Scans `{ column: [values] }` and returns one `Match` per (column, rule).
     pub fn scan(&self, data: &Value) -> Result<Vec<Match>> {
-        let mut event = Map::new();
-        if let Some(columns) = data.as_object() {
-            for (name, values) in columns {
-                let str_values: Vec<Value> = values
-                    .as_array()
-                    .map(|vs| {
-                        vs.iter()
-                            .filter_map(|v| v.as_str().map(|s| Value::String(s.to_string())))
-                            .collect()
-                    })
-                    .unwrap_or_default();
-                event.insert(name.clone(), Value::Array(str_values));
-            }
-        }
-
-        let mut event_value = Value::Object(event);
+        let mut event = data.clone();
         let hits = self
             .scanner
-            .scan(&mut event_value)
+            .scan(&mut event)
             .context("scanning query result")?;
 
         Ok(aggregate_matches(&self.rule_ids, &hits))
     }
 }
 
-/// Groups raw dd-sds hits into `(column, rule)` pairs, counting distinct matched
-/// rows (paths) per pair. Output is sorted so emitted events are deterministic.
+/// Groups hits into `(column, rule)` pairs and counts matched rows. Sorted for
+/// deterministic output.
 fn aggregate_matches(rule_ids: &[String], hits: &[RuleMatch]) -> Vec<Match> {
     let mut rows: HashMap<(String, String), HashSet<String>> = HashMap::new();
     for hit in hits {
@@ -101,9 +79,9 @@ fn aggregate_matches(rule_ids: &[String], hits: &[RuleMatch]) -> Vec<Match> {
     matches
 }
 
-/// `foo[0]` / `foo.bar` -> `foo`.
+/// `foo[0]` -> `foo`.
 fn column_name_from_path(path: &str) -> String {
-    match path.find(['[', '.']) {
+    match path.find('[') {
         Some(i) => path[..i].to_string(),
         None => path.to_string(),
     }

pkg/collector/sharedlibrary/rustchecks/checks/datasecurity/src/scanning/rule.rs

@@ -1,11 +1,6 @@
 use dd_sds::{RegexRuleConfig, RootRuleConfig};
 use serde::Deserialize;
 
-/// A scanning rule, shared by every sub task. `id` (used to map matches back to
-/// the rule) and `name` are ours; everything else is the flattened dd-sds
-/// `RootRuleConfig<RegexRuleConfig>`, so the full rule schema — pattern,
-/// proximity keywords, suppressions, precedence and secondary validators (Luhn,
-/// JWT, ...) — comes straight from dd-sds with no duplication.
 #[derive(Debug, Deserialize)]
 pub struct ScanningRule {
     pub id: String,

pkg/collector/sharedlibrary/rustchecks/checks/datasecurity/src/scanning/tests.rs

@@ -1,13 +1,5 @@
-//! Scanning tests, split in two parts:
-//!   * config parsing — a `ScanningRule` deserializes straight into the
-//!     flattened dd-sds `RootRuleConfig<RegexRuleConfig>`, so the whole dd-sds
-//!     rule surface (proximity keywords, suppressions, precedence, secondary
-//!     validators) is accepted verbatim and a scanner builds from it;
-//!   * scanning behaviour — running the built scanner over column-oriented data
-//!     yields the expected per-(column, rule) matched-row counts.
-
 use dd_sds::{MatchAction, SecondaryValidator};
-use serde_json::json;
+use serde_json::{json, Value};
 
 use super::{Scanner, ScanningRule};
 
@@ -19,6 +11,13 @@ fn scanner(yaml: &str) -> Scanner {
     Scanner::new(&parse(yaml)).expect("build scanner")
 }
 
+/// Scans `data` and returns the matches as JSON, so tests can assert against a
+/// single `json!` literal.
+fn scan_json(scanner: &Scanner, data: &Value) -> Value {
+    let matches = scanner.scan(data).expect("scan");
+    serde_json::to_value(matches).expect("serialize matches")
+}
+
 // --- config parsing -------------------------------------------------------
 
 #[test]
@@ -163,12 +162,13 @@ fn suppression_drops_matching_rows() {
         ]
     });
 
-    let matches = scanner.scan(&data).expect("scan");
-    assert_eq!(matches.len(), 1, "one (column, rule) pair");
-    assert_eq!(matches[0].rule_id, "email");
-    assert_eq!(matches[0].column_name, "email");
     // `alice@example.com` is suppressed; the other two rows match.
-    assert_eq!(matches[0].count_matched_rows, 2);
+    assert_eq!(
+        scan_json(&scanner, &data),
+        json!([
+            { "rule_id": "email", "column_name": "email", "count_matched_rows": 2 }
+        ])
+    );
 }
 
 #[test]
@@ -191,11 +191,13 @@ fn included_keyword_required_for_match() {
         ]
     });
 
-    let matches = scanner.scan(&data).expect("scan");
-    assert_eq!(matches.len(), 1);
-    assert_eq!(matches[0].rule_id, "token");
     // Only the row with the `token` keyword nearby matches.
-    assert_eq!(matches[0].count_matched_rows, 1);
+    assert_eq!(
+        scan_json(&scanner, &data),
+        json!([
+            { "rule_id": "token", "column_name": "note", "count_matched_rows": 1 }
+        ])
+    );
 }
 
 #[test]
@@ -218,10 +220,13 @@ fn excluded_keyword_suppresses_match() {
         ]
     });
 
-    let matches = scanner.scan(&data).expect("scan");
-    assert_eq!(matches.len(), 1);
     // The row preceded by the `test` keyword is excluded.
-    assert_eq!(matches[0].count_matched_rows, 1);
+    assert_eq!(
+        scan_json(&scanner, &data),
+        json!([
+            { "rule_id": "code", "column_name": "code", "count_matched_rows": 1 }
+        ])
+    );
 }
 
 #[test]
@@ -243,11 +248,13 @@ fn luhn_checksum_filters_invalid_numbers() {
         ]
     });
 
-    let matches = scanner.scan(&data).expect("scan");
-    assert_eq!(matches.len(), 1);
-    assert_eq!(matches[0].rule_id, "credit-card");
     // Only the Luhn-valid number is kept.
-    assert_eq!(matches[0].count_matched_rows, 1);
+    assert_eq!(
+        scan_json(&scanner, &data),
+        json!([
+            { "rule_id": "credit-card", "column_name": "card", "count_matched_rows": 1 }
+        ])
+    );
 }
 
 #[test]
@@ -261,6 +268,5 @@ fn no_matches_produce_empty() {
     );
 
     let data = json!({ "name": ["alice", "bob"] });
-    let matches = scanner.scan(&data).expect("scan");
-    assert!(matches.is_empty());
+    assert_eq!(scan_json(&scanner, &data), json!([]));
 }