Merge pull request #1171 from jhrozek/rem_params

engine: Pass params to the remediate interface, too
mindersec · Oct 11, 2023 · 696eef6 · 696eef6
2 parents 8d08d8b + bf74d84
commit 696eef6
Show file tree

Hide file tree

Showing 5 changed files with 58 additions and 5 deletions.
diff --git a/internal/engine/interfaces/interface.go b/internal/engine/interfaces/interface.go
@@ -83,5 +83,10 @@ func ActionOptFromString(s *string) ActionOpt {
 
 // Remediator is the interface for a rule type remediator
 type Remediator interface {
-	Remediate(ctx context.Context, remAction ActionOpt, ent protoreflect.ProtoMessage, pol map[string]any) error
+	Remediate(
+		ctx context.Context,
+		remAction ActionOpt,
+		ent protoreflect.ProtoMessage,
+		pol map[string]any,
+		params map[string]any) error
 }
diff --git a/internal/engine/remediate/noop/noop.go b/internal/engine/remediate/noop/noop.go
@@ -39,6 +39,7 @@ func (_ *Remediator) Remediate(
 	_ interfaces.ActionOpt,
 	_ protoreflect.ProtoMessage,
 	_ map[string]any,
+	_ map[string]any,
 ) error {
 	return enginerr.ErrRemediationNotAvailable
 }
diff --git a/internal/engine/remediate/rest/rest.go b/internal/engine/remediate/rest/rest.go
@@ -100,6 +100,8 @@ type EndpointTemplateParams struct {
 	Entity any
 	// Profile are the parameters to be used in the template
 	Profile map[string]any
+	// Params are the rule instance parameters
+	Params map[string]any
 }
 
 // Remediate actually performs the remediation
@@ -108,10 +110,12 @@ func (r *Remediator) Remediate(
 	remAction interfaces.ActionOpt,
 	ent protoreflect.ProtoMessage,
 	pol map[string]any,
+	params map[string]any,
 ) error {
 	retp := &EndpointTemplateParams{
 		Entity:  ent,
 		Profile: pol,
+		Params:  params,
 	}
 
 	endpoint := new(bytes.Buffer)

diff --git a/internal/engine/remediate/rest/rest_test.go b/internal/engine/remediate/rest/rest_test.go
@@ -203,6 +203,7 @@ func TestRestRemediate(t *testing.T) {
 		remAction interfaces.ActionOpt
 		ent       protoreflect.ProtoMessage
 		pol       map[string]any
+		params    map[string]any
 	}
 
 	type newRestRemediateArgs struct {
@@ -255,6 +256,48 @@ func TestRestRemediate(t *testing.T) {
 			},
 			wantErr: false,
 		},
+		{
+			name: "valid remediate expanding a branch from parameters",
+			newRemArgs: newRestRemediateArgs{
+				restCfg: &pb.RestType{
+					Endpoint: `/repos/{{.Entity.Owner}}/{{.Entity.Name}}/branches/{{ index .Params "branch" }}/protection`,
+					Body:     &bodyTemplateWithVars,
+					Method:   http.MethodPut,
+				},
+			},
+			remArgs: remediateArgs{
+				remAction: interfaces.ActionOptOn,
+				ent: &pb.Repository{
+					Owner:  "OwnerVar",
+					Name:   "NameVar",
+					RepoId: 456,
+				},
+				pol: map[string]any{
+					"allowed_actions": "selected",
+				},
+				params: map[string]any{
+					"branch": "main",
+				},
+			},
+			testHandler: func(writer http.ResponseWriter, request *http.Request) {
+				assert.Equal(t, "/repos/OwnerVar/NameVar/branches/main/protection", request.URL.Path, "unexpected path")
+				assert.Equal(t, http.MethodPut, request.Method, "unexpected method")
+
+				var requestBody struct {
+					Enabled        bool   `json:"enabled"`
+					AllowedActions string `json:"allowed_actions"`
+				}
+
+				err := json.NewDecoder(request.Body).Decode(&requestBody)
+				assert.NoError(t, err, "unexpected error decoding body")
+				assert.Equal(t, true, requestBody.Enabled, "unexpected enabled")
+				assert.Equal(t, "selected", requestBody.AllowedActions, "unexpected allowed actions")
+
+				defer request.Body.Close()
+				writer.WriteHeader(http.StatusOK)
+			},
+			wantErr: false,
+		},
 		{
 			name: "valid dry run",
 			newRemArgs: newRestRemediateArgs{
@@ -341,7 +384,7 @@ func TestRestRemediate(t *testing.T) {
 			require.NoError(t, err, "unexpected error creating remediate engine")
 			require.NotNil(t, engine, "expected non-nil remediate engine")
 
-			err = engine.Remediate(context.Background(), tt.remArgs.remAction, tt.remArgs.ent, tt.remArgs.pol)
+			err = engine.Remediate(context.Background(), tt.remArgs.remAction, tt.remArgs.ent, tt.remArgs.pol, tt.remArgs.params)
 			if tt.wantErr {
 				require.Error(t, err, "expected error")
 				return

diff --git a/internal/engine/rule_types.go b/internal/engine/rule_types.go
@@ -252,15 +252,15 @@ func (r *RuleTypeEngine) Eval(
 
 	evalErr = r.reval.Eval(ctx, pol, result)
 
-	remediateErr = r.tryRemediate(ctx, ent, pol, remAction, evalErr)
+	remediateErr = r.tryRemediate(ctx, ent, pol, params, remAction, evalErr)
 
 	return evalErr, remediateErr
 }
 
 func (r *RuleTypeEngine) tryRemediate(
 	ctx context.Context,
 	ent protoreflect.ProtoMessage,
-	pol map[string]any,
+	pol, params map[string]any,
 	remAction engif.ActionOpt,
 	evalErr error,
 ) error {
@@ -271,7 +271,7 @@ func (r *RuleTypeEngine) tryRemediate(
 		return evalerrors.ErrRemediationSkipped
 	}
 
-	return r.rrem.Remediate(ctx, remAction, ent, pol)
+	return r.rrem.Remediate(ctx, remAction, ent, pol, params)
 }
 
 func (r *RuleTypeEngine) shouldRemediate(remAction engif.ActionOpt, evalErr error) (bool, error) {