configstatus

package
v0.510.4 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 6, 2026 License: Apache-2.0 Imports: 12 Imported by: 0

README

Application Config Status Module

Derives the effective status of one shipped rule under the built-in default policy and an optional YAML config file. This is the core data layer for the future deltascope config status <rule-id> CLI command.

Files

File Responsibility
status.go Inspect derives ON/OFF, Loaded, effective level, default vs current snapshots, config effect, and FK-forbid suppression for one rule
status_test.go Verifies default-only, override, replacement-danger, validation, cloning, JSON, default-disabled catalog-only rules, and FK-forbid suppression

Exports

  • Request — { RuleID, ConfigPath }
  • Result — { RuleID, Status, Default, Current, ConfigEffect, Suppression, RuleDetailsCommand }
  • RuleStatus — { Enabled, Level, State, Loaded }
  • RulePolicySnapshot — { Enabled, Level, Params }
  • ConfigEffect — { HasConfig, HasOverride, ChangedFields, Messages }
  • Suppression — { Reason, By } for enabled Default Policy rules that are not Loaded
  • Inspect(ctx, Request) (Result, error)

What it does

  • Reads the built-in default policy (policy.Default) and the rule catalog (catalog.Lookup). Catalog-only opt-in rules are inspectable as default-disabled even when Default Policy does not include them.
  • Loads the effective policy via the existing viperconfig.LoadPolicy when a config path is supplied, and uses its output verbatim as the "current" snapshot.
  • Compares default versus current enabled, level, and params, producing deterministic ChangedFields (enabled, level, then params.<key> alphabetically) and messages.
  • Validates the config with the same semantics as deltascope config lint (unknown rule, invalid level, unknown param, param type mismatch) so malformed configs error instead of producing partial status.
  • Clones all params maps before returning; it never mutates the default or effective policy.
  • Reports status.loaded separately from status.enabled. Under the shipped baseline the three ddl.constraint.foreign_key.name.* rules stay enabled and are not Loaded; suppression.reason is fk_forbid. Catalog-only dml.impact.* rules are inspectable as default-disabled without a suppression.

What it does not do

  • It does not run an audit.
  • It does not parse SQL.
  • It does not connect to a database.
  • It does not add a severity field; the public priority field is level.
  • It does not modify viperconfig.LoadPolicy or audit behavior.

Config semantics: rule-level replacement (audit-faithful)

The "current" snapshot matches what the audit path actually applies. Mentioning a rule in YAML replaces its entire RulePolicy; fields the file omits become zero values (enabled -> false, level -> "", params -> empty). Therefore a partial override such as level: warning alone leaves the rule OFF, because enabled is omitted and replaced with false. Inspect surfaces this with explicit omitted-field warnings rather than hiding it. Whether LoadPolicy should adopt merge semantics is a separate decision and is intentionally out of scope here. See docs/decisions/2026-06-14-v0.310.0-rule-config-status.md.

Dependencies

  • Upstream: (none yet; the CLI config status command in Task 3 will call Inspect)
  • Downstream: internal/domain/policy, internal/domain/rule, internal/domain/rule/catalog, internal/infrastructure/config/viper

Update Rule

  • If members, interfaces, or dependencies change, update this file in the same change.
  • The semantic-validation helpers mirror internal/interfaces/cli lint behavior on purpose; if those rules diverge, update both together.

Documentation

Overview

Package configstatus derives the effective status of one shipped rule under the default policy and an optional YAML config file. input: a rule ID, an optional config path, built-in default policy, the rule catalog, 

and the existing Viper-backed policy loader

output: a stable Result describing whether the rule is ON or OFF, whether it is Loaded, 

its effective level, default versus current policy snapshot, FK-forbid suppression,
and what the user's config changed

pos: application use case for single-rule config status, below the CLI surface note: if this file changes, update this header and module README.md.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type ConfigEffect 

type ConfigEffect struct {
	HasConfig     bool     `json:"has_config"`
	HasOverride   bool     `json:"has_override"`
	ChangedFields []string `json:"changed_fields"`
	Messages      []string `json:"messages"`
}

ConfigEffect summarizes how the supplied config affected this rule.

type Request 

type Request struct {
	RuleID     string
	ConfigPath string
}

Request selects one shipped rule and an optional config file.

type Result 

type Result struct {
	RuleID             string             `json:"rule_id"`
	Status             RuleStatus         `json:"status"`
	Default            RulePolicySnapshot `json:"default"`
	Current            RulePolicySnapshot `json:"current"`
	ConfigEffect       ConfigEffect       `json:"config_effect"`
	Suppression        *Suppression       `json:"suppression,omitempty"`
	RuleDetailsCommand string             `json:"rule_details_command"`
}

Result is the derived status of one rule. It never includes a "severity" field.

func Inspect 

func Inspect(ctx context.Context, req Request) (Result, error)

Inspect derives the effective status of one shipped rule under the default policy and an optional YAML config file. It does not run an audit, parse SQL, or touch a database. ctx is reserved for future cancellation and is currently unused.

type RulePolicySnapshot 

type RulePolicySnapshot struct {
	Enabled bool           `json:"enabled"`
	Level   rule.Level     `json:"level"`
	Params  map[string]any `json:"params"`
}

RulePolicySnapshot captures the enabled flag, level, and params for one policy source. Params is always a non-nil cloned map.

type RuleStatus 

type RuleStatus struct {
	Enabled bool       `json:"enabled"`
	Level   rule.Level `json:"level"`
	State   string     `json:"state"`
	Loaded  bool       `json:"loaded"`
}

RuleStatus reports the effective runtime state of the rule. Enabled/State follow Default Policy (or the caller's config). Loaded is the distinct registration fact: a rule can be enabled and still not Loaded.

type Suppression added in v0.510.4 

type Suppression struct {
	Reason string `json:"reason"`
	By     string `json:"by"`
}

Suppression names why an enabled Default Policy rule is not Loaded.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.