Merge remote-tracking branch 'origin/main' into fix/advisory-packages-bq-ceiling-CM-1362

Author: themarolt

backend/src/api/public/v1/akrites-external/openapi.yaml

@@ -11,8 +11,8 @@ info:
 
     Packages, Advisories and Contacts endpoints are implemented. Blast Radius
     submit (2a) and poll (2b) are both implemented, backed by a 4-stage
-    Temporal pipeline (intel, dependents, reachability, report) for npm, go, and
-    maven packages; other ecosystems fail fast with ECOSYSTEM_NOT_SUPPORTED. The
+    Temporal pipeline (intel, dependents, reachability, report) for npm, go, maven, and
+    cargo packages; other ecosystems fail fast with ECOSYSTEM_NOT_SUPPORTED. The
     7-day result cache is specced separately and not yet built.
 
 
@@ -61,7 +61,7 @@ tags:
     description: >
       Advisory reachability analysis — submit (2a) and poll (2b) are both
       implemented, each with a bulk counterpart. Submitting kicks off a
-      Temporal workflow that runs the npm, go, or maven reachability pipeline (other
+      Temporal workflow that runs the npm, go, maven, or cargo reachability pipeline (other
       ecosystems fail fast with ECOSYSTEM_NOT_SUPPORTED); poll returns job
       status and, once done, results. Bulk submit (jobs:batch) is capped at
       20 jobs per request (10 recommended as the default batch size) — each
@@ -411,9 +411,9 @@ components:
           example: GHSA-jf85-cpcp-j695
         ecosystem:
           type: string
-          enum: [npm, go, maven]
+          enum: [npm, go, maven, cargo]
           description: >
-            Required. The reachability pipeline supports npm, go, and maven today —
+            Required. The reachability pipeline supports npm, go, maven, and cargo today —
             any other value, or a missing ecosystem, is rejected with a 400.
           example: npm
         package:
@@ -450,7 +450,7 @@ components:
           description: Echoes the request's package. Null when the request omitted it.
         ecosystem:
           type: string
-          enum: [npm, go, maven]
+          enum: [npm, go, maven, cargo]
           description: Echoes the request's ecosystem. Always present — the request requires it.
         status:
           type: string
@@ -611,7 +611,7 @@ components:
           nullable: true
         ecosystem:
           type: string
-          enum: [npm, go, maven]
+          enum: [npm, go, maven, cargo]
         submittedAt:
           type: string
           nullable: true
@@ -1244,7 +1244,7 @@ paths:
         advisories); provide it to narrow to one package, which is required
         for advisories affecting more than one. Starts a Temporal workflow
         running the 4-stage reachability pipeline
-        (intel, dependents, reachability, report) for npm, go, or maven; other
+        (intel, dependents, reachability, report) for npm, go, maven, or cargo; other
         ecosystems fail fast with ECOSYSTEM_NOT_SUPPORTED. Poll status/results
         via GET /jobs/{analysisId}.
 
@@ -1272,7 +1272,7 @@ paths:
         '400':
           description: >
             Validation error (missing/empty advisoryId), or an unsupported
-            ecosystem — only npm, go, and maven are supported today, so any other
+            ecosystem — only npm, go, maven, and cargo are supported today, so any other
             value (including a missing ecosystem) is rejected before a
             workflow is started.
           content:

backend/src/api/public/v1/packages/blastRadius.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod'
 
-export const SUPPORTED_BLAST_RADIUS_ECOSYSTEMS = ['npm', 'go', 'maven'] as const
+export const SUPPORTED_BLAST_RADIUS_ECOSYSTEMS = ['npm', 'go', 'maven', 'cargo', 'nuget'] as const
 
 // Always exactly one job per request — advisory-wide (package omitted) or narrowed
 // to a single package. package accepts either a full purl or a bare package name,

backend/src/api/public/v1/packages/blastRadiusAnalysis.ts

@@ -63,6 +63,8 @@ function toPurl(ecosystem: BlastRadiusJobEcosystem, name: string): string {
     }
     case 'go':
       return `pkg:golang/${name}`
+    case 'cargo':
+      return `pkg:cargo/${name}`
     case 'npm':
     default:
       return `pkg:npm/${name.replace(/^@/, '%40')}`

services/apps/packages_worker/src/blast-radius/__tests__/ecosystemSupport.test.ts

@@ -1,7 +1,13 @@
 import { ApplicationFailure } from '@temporalio/workflow'
 import { describe, expect, it } from 'vitest'
 
-import { buildEcosystemNotSupportedFailure } from '../ecosystemSupport'
+import { SUPPORTED_ECOSYSTEMS, buildEcosystemNotSupportedFailure } from '../ecosystemSupport'
+
+describe('SUPPORTED_ECOSYSTEMS', () => {
+  it('includes cargo and nuget alongside npm, go, and maven', () => {
+    expect(SUPPORTED_ECOSYSTEMS).toEqual(['npm', 'go', 'maven', 'cargo', 'nuget'])
+  })
+})
 
 describe('buildEcosystemNotSupportedFailure', () => {
   it('builds a non-retryable ApplicationFailure tagged ECOSYSTEM_NOT_SUPPORTED', () => {

services/apps/packages_worker/src/blast-radius/__tests__/packageIdentifier.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest'
 
-import { toBareNpmName } from '../packageIdentifier'
+import { toBareNpmName, toBareNuGetId, toDbCargoName } from '../packageIdentifier'
 
 describe('toBareNpmName', () => {
   it('returns a bare name unchanged', () => {
@@ -31,3 +31,41 @@ describe('toBareNpmName', () => {
     expect(toBareNpmName('pkg:npm/lodash@4.17.21?foo=bar#sub')).toBe('lodash')
   })
 })
+
+describe('toDbCargoName', () => {
+  it('leaves an already-underscored name unchanged', () => {
+    expect(toDbCargoName('serde_json')).toBe('serde_json')
+  })
+
+  it('converts hyphens to underscores, matching packages.name for hyphenated crates', () => {
+    expect(toDbCargoName('serde-json')).toBe('serde_json')
+  })
+
+  it('lowercases mixed-case names', () => {
+    expect(toDbCargoName('Actix-Web')).toBe('actix_web')
+  })
+})
+
+describe('toBareNuGetId', () => {
+  it('returns a bare id unchanged, preserving casing', () => {
+    expect(toBareNuGetId('Newtonsoft.Json')).toBe('Newtonsoft.Json')
+  })
+
+  it('strips the pkg:nuget/ prefix', () => {
+    expect(toBareNuGetId('pkg:nuget/Newtonsoft.Json')).toBe('Newtonsoft.Json')
+  })
+
+  it('strips a trailing version', () => {
+    expect(toBareNuGetId('pkg:nuget/Newtonsoft.Json@13.0.1')).toBe('Newtonsoft.Json')
+  })
+
+  it('strips qualifiers and subpath', () => {
+    expect(toBareNuGetId('pkg:nuget/Newtonsoft.Json@13.0.1?foo=bar#sub')).toBe('Newtonsoft.Json')
+  })
+
+  it('does not lowercase the id — DB lookups are case-sensitive', () => {
+    expect(toBareNuGetId('pkg:nuget/Microsoft.AspNetCore.Mvc@2.2.0')).toBe(
+      'Microsoft.AspNetCore.Mvc',
+    )
+  })
+})

services/apps/packages_worker/src/blast-radius/agent/__tests__/cargoPrompts.test.ts

@@ -0,0 +1,18 @@
+import { describe, expect, it } from 'vitest'
+
+import { CARGO_INTEL_SCHEMA } from '../cargoPrompts'
+
+describe('CARGO_INTEL_SCHEMA', () => {
+  it('keeps import_signatures.properties keys in sync with its required list', () => {
+    const importSignatures = CARGO_INTEL_SCHEMA.properties.import_signatures
+    const propertyKeys = Object.keys(importSignatures.properties).sort()
+    const requiredKeys = [...importSignatures.required].sort()
+    expect(propertyKeys).toEqual(requiredKeys)
+  })
+
+  it('keeps the top-level schema properties in sync with its required list', () => {
+    const propertyKeys = Object.keys(CARGO_INTEL_SCHEMA.properties).sort()
+    const requiredKeys = [...CARGO_INTEL_SCHEMA.required].sort()
+    expect(propertyKeys).toEqual(requiredKeys)
+  })
+})

services/apps/packages_worker/src/blast-radius/agent/cargoPrompts.ts

@@ -0,0 +1,127 @@
+// Parallels goPrompts.ts — schema shape and the intel prompt builder are shared via
+// promptKit.ts; only the Rust-specific keys/enum and system-prompt prose live here.
+import {
+  buildIntelPrompt,
+  buildIntelSchema,
+  buildReachabilitySymbolsBlock,
+  buildVerdictSchema,
+} from './promptKit'
+import { SymbolSpec } from './prompts'
+
+// ---------- STAGE 1: INTEL ----------
+
+const IMPORT_SIGNATURE_KEYS = [
+  'use_path',
+  'extern_crate',
+  'macro_invocation',
+  'fully_qualified_path',
+]
+
+export const CARGO_INTEL_SCHEMA = buildIntelSchema(IMPORT_SIGNATURE_KEYS)
+
+export const CARGO_INTEL_SYSTEM_PROMPT = `You are a vulnerability analyst. Your working directory contains the FULL SOURCE of the
+vulnerable version of a Rust crate. You are given the security advisory and the patch
+(diff) that fixed the vulnerability.
+
+Your job is to determine, precisely, WHAT is vulnerable — so that downstream analysts can
+check whether other crates actually reach the vulnerable code.
+
+Rules:
+- Identify the exact vulnerable function(s)/method(s)/type(s)/macro(s) from the patch and
+  the source. Be minimal and precise: do NOT include similar-but-unaffected symbols. If the
+  patch only touches a private (non-\`pub\`) helper, trace which \`pub\` symbols route through
+  it and list those as the reachable surface (note the helper in \`notes\`).
+- Read the crate source to verify how each vulnerable symbol is exported — only items
+  marked \`pub\` (or \`pub(crate)\`/\`pub(super)\`, which are NOT reachable from other crates)
+  are visible outside the crate; note the exact module path each symbol lives in (e.g.
+  \`crate::foo::bar\`), and whether it's re-exported elsewhere via \`pub use\`.
+- Build \`import_signatures\`: concrete code patterns a dependent crate would contain if it
+  uses the vulnerable symbol. Cover: a plain \`use crate_name::path::Symbol\` followed by bare
+  \`Symbol\` usage, an \`extern crate crate_name;\` (2018-edition-and-earlier style) followed by
+  fully-qualified use, invocation of a vulnerable macro (\`crate_name::macro_name!(...)\` or
+  \`use\`d then bare \`macro_name!(...)\`), and a fully-qualified path call
+  (\`crate_name::path::Symbol::method(...)\`) without any \`use\`. These are the patterns
+  analysts will grep for — make them literal and greppable, not prose.
+- \`reachability_notes\` must state what does NOT count (e.g. sibling functions that look
+  similar but are not affected, usage confined to \`tests/\`, \`examples/\`, or code behind
+  \`#[cfg(test)]\`) and any conditions required for exploitability (e.g. a specific Cargo
+  feature flag must be enabled).
+- Set \`confidence\` for your identification: 0.9+ only if the patch unambiguously
+  identifies the symbol(s); lower if you had to infer from indirect evidence.`
+
+export const buildCargoIntelPrompt = buildIntelPrompt
+
+// ---------- STAGE 3: REACHABILITY ----------
+
+const IMPORT_STYLE_ENUM = [
+  'use-path',
+  'extern-crate',
+  'macro-invocation',
+  'fully-qualified-path',
+  'reexport',
+  'none',
+]
+
+export const CARGO_VERDICT_SCHEMA = buildVerdictSchema(IMPORT_STYLE_ENUM)
+
+export function buildCargoReachabilitySystemPrompt(spec: SymbolSpec): string {
+  const { symbolsText, signatures } = buildReachabilitySymbolsBlock(spec)
+
+  return `You are a security reachability analyst. Your working directory contains the published
+source of ONE Rust crate (the "dependent") that declares a dependency on
+\`${spec.package}\`, which has a known vulnerability (${spec.vuln_id}).
+
+## The vulnerability
+${spec.summary}
+
+Vulnerable symbol(s) in \`${spec.package}\`:
+${symbolsText}
+
+Exploit preconditions: ${spec.exploit_preconditions}
+
+Analyst notes: ${spec.reachability_notes}
+
+## Import signatures to look for
+${signatures}
+
+## Your task
+Decide whether THIS dependent's own code actually reaches the vulnerable symbol(s).
+
+Scope rules — follow strictly:
+1. Only the dependent's OWN shipped code counts (\`src/\`). Usage of the vulnerable symbol
+   inside the dependent's OTHER dependencies (its own \`Cargo.toml\` deps) is OUT OF SCOPE
+   (that is second-level analysis, done separately).
+2. Merely declaring a dependency on \`${spec.package}\` (present in \`Cargo.toml\`) is NOT
+   enough — the vulnerable symbol itself must be reached. Uses of other items from the
+   crate are irrelevant.
+3. Usage only in \`tests/\`, \`examples/\`, \`benches/\`, or code gated behind \`#[cfg(test)]\`
+   that is not part of the shipped runtime code → \`not_affected\` (explain in reasoning).
+4. If the dependent RE-EXPORTS the vulnerable symbol to its own consumers (\`pub use\`, or a
+   thin wrapper function/type that passes arguments through), that DOES count as \`affected\`
+   with \`import_style: "reexport"\` — it propagates the vulnerable surface.
+5. Watch for indirect reachability inside the dependent's own code: fully-qualified paths
+   (\`crate_name::module::Symbol\`), trait method calls through a re-exported trait, macro
+   invocations, and generic/dyn dispatch through the vulnerable type.
+6. \`import_style\` describes how the VULNERABLE SYMBOL is reached, not how the crate is
+   declared: report \`none\` whenever the vulnerable symbol itself is not reached, even if
+   the crate is a dependency for other functionality.
+
+Method: grep for the import signatures (and the bare symbol/macro names) across the source,
+open every hit, and trace whether the symbol is actually invoked. Check \`Cargo.toml\` to
+confirm the declared dependency, its version requirement, and whether any feature flags
+gate the vulnerable code path. Exclude \`tests/\`, \`examples/\`, \`benches/\`, and
+\`#[cfg(test)]\`-gated code from consideration.
+
+## Confidence calibration
+- 0.8–1.0: direct evidence — you found (or ruled out) the import AND the call site
+  explicitly; source was readable.
+- 0.4–0.8: symbol is imported but the call path is ambiguous (trait dispatch, conditional
+  compilation, generated/macro-expanded code).
+- <0.4 and/or \`unclear\`: source is generated/absent, or indirection you could not resolve.
+
+Report evidence as exact file paths, line numbers, and short verbatim snippets.`
+}
+
+export const CARGO_REACHABILITY_PROMPT =
+  'Analyze this crate per your instructions and produce the structured verdict. ' +
+  'Start by listing the crate structure and grepping for the import signatures.'