up

src/Scanner/StellaOps.Scanner.WebService/Services/RuntimePolicyService.cs

@@ -7,13 +7,14 @@ using System.Linq;
 using System.Globalization;
 using System.Text.Json;
 using System.Text.Json.Serialization;
-using Microsoft.Extensions.Logging;
-using Microsoft.Extensions.Options;
-using StellaOps.Policy;
-using StellaOps.Scanner.Storage.Catalog;
-using StellaOps.Scanner.Storage.Repositories;
-using StellaOps.Scanner.WebService.Options;
-using StellaOps.Zastava.Core.Contracts;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using StellaOps.Policy;
+using StellaOps.Scanner.Storage.Catalog;
+using StellaOps.Scanner.Storage.Repositories;
+using StellaOps.Scanner.WebService.Contracts;
+using StellaOps.Scanner.WebService.Options;
+using StellaOps.Zastava.Core.Contracts;
 using RuntimePolicyVerdict = StellaOps.Zastava.Core.Contracts.PolicyVerdict;
 using CanonicalPolicyVerdict = StellaOps.Policy.PolicyVerdict;
 using CanonicalPolicyVerdictStatus = StellaOps.Policy.PolicyVerdictStatus;
@@ -35,35 +36,38 @@ internal sealed class RuntimePolicyService : IRuntimePolicyService
 
     private readonly LinkRepository _linkRepository;
     private readonly ArtifactRepository _artifactRepository;
-    private readonly RuntimeEventRepository _runtimeEventRepository;
-    private readonly PolicySnapshotStore _policySnapshotStore;
-    private readonly PolicyPreviewService _policyPreviewService;
-    private readonly IOptionsMonitor<ScannerWebServiceOptions> _optionsMonitor;
-    private readonly TimeProvider _timeProvider;
-    private readonly IRuntimeAttestationVerifier _attestationVerifier;
-    private readonly ILogger<RuntimePolicyService> _logger;
+    private readonly RuntimeEventRepository _runtimeEventRepository;
+    private readonly PolicySnapshotStore _policySnapshotStore;
+    private readonly PolicyPreviewService _policyPreviewService;
+    private readonly ILinksetResolver _linksetResolver;
+    private readonly IOptionsMonitor<ScannerWebServiceOptions> _optionsMonitor;
+    private readonly TimeProvider _timeProvider;
+    private readonly IRuntimeAttestationVerifier _attestationVerifier;
+    private readonly ILogger<RuntimePolicyService> _logger;
 
     public RuntimePolicyService(
-        LinkRepository linkRepository,
-        ArtifactRepository artifactRepository,
-        RuntimeEventRepository runtimeEventRepository,
-        PolicySnapshotStore policySnapshotStore,
-        PolicyPreviewService policyPreviewService,
-        IOptionsMonitor<ScannerWebServiceOptions> optionsMonitor,
-        TimeProvider timeProvider,
-        IRuntimeAttestationVerifier attestationVerifier,
-        ILogger<RuntimePolicyService> logger)
-    {
-        _linkRepository = linkRepository ?? throw new ArgumentNullException(nameof(linkRepository));
-        _artifactRepository = artifactRepository ?? throw new ArgumentNullException(nameof(artifactRepository));
-        _runtimeEventRepository = runtimeEventRepository ?? throw new ArgumentNullException(nameof(runtimeEventRepository));
-        _policySnapshotStore = policySnapshotStore ?? throw new ArgumentNullException(nameof(policySnapshotStore));
-        _policyPreviewService = policyPreviewService ?? throw new ArgumentNullException(nameof(policyPreviewService));
-        _optionsMonitor = optionsMonitor ?? throw new ArgumentNullException(nameof(optionsMonitor));
-        _timeProvider = timeProvider ?? throw new ArgumentNullException(nameof(timeProvider));
-        _attestationVerifier = attestationVerifier ?? throw new ArgumentNullException(nameof(attestationVerifier));
-        _logger = logger ?? throw new ArgumentNullException(nameof(logger));
-    }
+        LinkRepository linkRepository,
+        ArtifactRepository artifactRepository,
+        RuntimeEventRepository runtimeEventRepository,
+        PolicySnapshotStore policySnapshotStore,
+        PolicyPreviewService policyPreviewService,
+        ILinksetResolver linksetResolver,
+        IOptionsMonitor<ScannerWebServiceOptions> optionsMonitor,
+        TimeProvider timeProvider,
+        IRuntimeAttestationVerifier attestationVerifier,
+        ILogger<RuntimePolicyService> logger)
+    {
+        _linkRepository = linkRepository ?? throw new ArgumentNullException(nameof(linkRepository));
+        _artifactRepository = artifactRepository ?? throw new ArgumentNullException(nameof(artifactRepository));
+        _runtimeEventRepository = runtimeEventRepository ?? throw new ArgumentNullException(nameof(runtimeEventRepository));
+        _policySnapshotStore = policySnapshotStore ?? throw new ArgumentNullException(nameof(policySnapshotStore));
+        _policyPreviewService = policyPreviewService ?? throw new ArgumentNullException(nameof(policyPreviewService));
+        _linksetResolver = linksetResolver ?? throw new ArgumentNullException(nameof(linksetResolver));
+        _optionsMonitor = optionsMonitor ?? throw new ArgumentNullException(nameof(optionsMonitor));
+        _timeProvider = timeProvider ?? throw new ArgumentNullException(nameof(timeProvider));
+        _attestationVerifier = attestationVerifier ?? throw new ArgumentNullException(nameof(attestationVerifier));
+        _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+    }
 
     public async Task<RuntimePolicyEvaluationResult> EvaluateAsync(RuntimePolicyEvaluationRequest request, CancellationToken cancellationToken)
     {
@@ -118,13 +122,14 @@ internal sealed class RuntimePolicyService : IRuntimePolicyService
                     heuristicReasons.Add("policy.snapshot.missing");
                 }
 
-                ImmutableArray<CanonicalPolicyVerdict> projectedVerdicts = ImmutableArray<CanonicalPolicyVerdict>.Empty;
-                ImmutableArray<PolicyIssue> issues = ImmutableArray<PolicyIssue>.Empty;
-
-                try
-                {
-                    if (!findings.IsDefaultOrEmpty && findings.Length > 0)
-                    {
+                ImmutableArray<CanonicalPolicyVerdict> projectedVerdicts = ImmutableArray<CanonicalPolicyVerdict>.Empty;
+                ImmutableArray<PolicyIssue> issues = ImmutableArray<PolicyIssue>.Empty;
+                IReadOnlyList<LinksetSummaryDto> linksets = Array.Empty<LinksetSummaryDto>();
+
+                try
+                {
+                    if (!findings.IsDefaultOrEmpty && findings.Length > 0)
+                    {
                         var previewRequest = new PolicyPreviewRequest(
                             image,
                             findings,
@@ -133,14 +138,15 @@ internal sealed class RuntimePolicyService : IRuntimePolicyService
                             ProposedPolicy: null);
 
                         var preview = await _policyPreviewService.PreviewAsync(previewRequest, cancellationToken).ConfigureAwait(false);
-                        issues = preview.Issues;
-                        if (!preview.Diffs.IsDefaultOrEmpty)
-                        {
-                            projectedVerdicts = preview.Diffs.Select(diff => diff.Projected).ToImmutableArray();
-                        }
-                    }
-                }
-                catch (Exception ex) when (!cancellationToken.IsCancellationRequested)
+                        issues = preview.Issues;
+                        if (!preview.Diffs.IsDefaultOrEmpty)
+                        {
+                            projectedVerdicts = preview.Diffs.Select(diff => diff.Projected).ToImmutableArray();
+                            linksets = await _linksetResolver.ResolveAsync(projectedVerdicts, cancellationToken).ConfigureAwait(false);
+                        }
+                    }
+                }
+                catch (Exception ex) when (!cancellationToken.IsCancellationRequested)
                 {
                     _logger.LogWarning(ex, "Runtime policy preview failed for image {ImageDigest}; falling back to heuristic evaluation.", image);
                 }
@@ -151,12 +157,13 @@ internal sealed class RuntimePolicyService : IRuntimePolicyService
                 var decision = await BuildDecisionAsync(
                     image,
                     metadata,
-                    heuristicReasons,
-                    projectedVerdicts,
-                    issues,
-                    policyDigest,
-                    buildIdObservation?.BuildIds,
-                    cancellationToken).ConfigureAwait(false);
+                    heuristicReasons,
+                    projectedVerdicts,
+                    issues,
+                    policyDigest,
+                    linksets,
+                    buildIdObservation?.BuildIds,
+                    cancellationToken).ConfigureAwait(false);
 
                 results[image] = decision;
 
@@ -279,12 +286,13 @@ internal sealed class RuntimePolicyService : IRuntimePolicyService
     private async Task<RuntimePolicyImageDecision> BuildDecisionAsync(
         string imageDigest,
         RuntimeImageMetadata metadata,
-        List<string> heuristicReasons,
-        ImmutableArray<CanonicalPolicyVerdict> projectedVerdicts,
-        ImmutableArray<PolicyIssue> issues,
-        string? policyDigest,
-        IReadOnlyList<string>? buildIds,
-        CancellationToken cancellationToken)
+        List<string> heuristicReasons,
+        ImmutableArray<CanonicalPolicyVerdict> projectedVerdicts,
+        ImmutableArray<PolicyIssue> issues,
+        string? policyDigest,
+        IReadOnlyList<LinksetSummaryDto> linksets,
+        IReadOnlyList<string>? buildIds,
+        CancellationToken cancellationToken)
     {
         var reasons = new List<string>(heuristicReasons);
 
@@ -330,18 +338,19 @@ internal sealed class RuntimePolicyService : IRuntimePolicyService
             .Distinct(StringComparer.Ordinal)
             .ToArray();
 
-        return new RuntimePolicyImageDecision(
-            overallVerdict,
-            metadata.Signed,
-            metadata.HasSbomReferrers,
-            normalizedReasons,
-            rekor,
-            metadataPayload,
-            confidence,
-            quieted,
-            quietedBy,
-            buildIds);
-    }
+        return new RuntimePolicyImageDecision(
+            overallVerdict,
+            metadata.Signed,
+            metadata.HasSbomReferrers,
+            normalizedReasons,
+            rekor,
+            metadataPayload,
+            confidence,
+            quieted,
+            quietedBy,
+            buildIds,
+            linksets);
+    }
 
     private RuntimePolicyVerdict MapVerdict(ImmutableArray<CanonicalPolicyVerdict> projectedVerdicts, IReadOnlyList<string> heuristicReasons)
     {
@@ -501,17 +510,18 @@ internal sealed record RuntimePolicyEvaluationResult(
     string? PolicyRevision,
     IReadOnlyDictionary<string, RuntimePolicyImageDecision> Results);
 
-internal sealed record RuntimePolicyImageDecision(
-    RuntimePolicyVerdict PolicyVerdict,
-    bool Signed,
-    bool HasSbomReferrers,
-    IReadOnlyList<string> Reasons,
-    RuntimePolicyRekorReference? Rekor,
-    IDictionary<string, object?>? Metadata,
-    double Confidence,
-    bool Quieted,
-    string? QuietedBy,
-    IReadOnlyList<string>? BuildIds);
+internal sealed record RuntimePolicyImageDecision(
+    RuntimePolicyVerdict PolicyVerdict,
+    bool Signed,
+    bool HasSbomReferrers,
+    IReadOnlyList<string> Reasons,
+    RuntimePolicyRekorReference? Rekor,
+    IDictionary<string, object?>? Metadata,
+    double Confidence,
+    bool Quieted,
+    string? QuietedBy,
+    IReadOnlyList<string>? BuildIds,
+    IReadOnlyList<LinksetSummaryDto> Linksets);
 
 internal sealed record RuntimePolicyRekorReference(string? Uuid, string? Url, bool? Verified);