@@ -112,9 +184,7 @@
{{ rule.name }}
-
- Priority {{ rule.priority }} · revision {{ rule.revision_id }}
-
+
Last applied in revision {{ rule.revision }}
@@ -133,7 +203,7 @@
{{ rule.expression }}
+ >
{{ rule.rule }}
@@ -141,7 +211,14 @@
diff --git a/apps/labrinth/src/routes/internal/mod.rs b/apps/labrinth/src/routes/internal/mod.rs
index 46cd42c713..d54c86c742 100644
--- a/apps/labrinth/src/routes/internal/mod.rs
+++ b/apps/labrinth/src/routes/internal/mod.rs
@@ -120,6 +120,7 @@ pub fn config(cfg: &mut web::ServiceConfig) {
moderation::tech_review::rules::create_rule,
moderation::tech_review::rules::update_rule,
moderation::tech_review::rules::delete_rule,
+ moderation::tech_review::rules_scan::scan_rules,
moderation::tech_review::get_project_report,
moderation::tech_review::submit_report,
moderation::tech_review::update_issue_details,
diff --git a/apps/labrinth/src/routes/internal/moderation/tech_review.rs b/apps/labrinth/src/routes/internal/moderation/tech_review.rs
index fedf2288f2..92b230cd79 100644
--- a/apps/labrinth/src/routes/internal/moderation/tech_review.rs
+++ b/apps/labrinth/src/routes/internal/moderation/tech_review.rs
@@ -45,11 +45,13 @@ use eyre::eyre;
pub mod global;
pub mod rules;
+pub mod rules_scan;
pub fn config(cfg: &mut actix_web::web::ServiceConfig) {
cfg.service(search_projects)
.configure(global::config)
.configure(rules::config)
+ .configure(rules_scan::config)
.service(get_project_report)
.service(get_report)
.service(get_issue)
diff --git a/apps/labrinth/src/routes/internal/moderation/tech_review/rules.rs b/apps/labrinth/src/routes/internal/moderation/tech_review/rules.rs
index 415956caa2..9a0a55d23c 100644
--- a/apps/labrinth/src/routes/internal/moderation/tech_review/rules.rs
+++ b/apps/labrinth/src/routes/internal/moderation/tech_review/rules.rs
@@ -191,32 +191,12 @@ pub async fn test_rule(
for (index, trace) in request.traces.iter().enumerate() {
let input = test_rule_input(trace);
- let mut context = cel::Context::default();
- context.add_variable("input", input).map_err(|error| {
- ApiError::Request(eyre!(
- "failed to build input for test trace {index}: {error}"
- ))
- })?;
-
- let value = program.execute(&context).map_err(|error| {
- ApiError::Request(eyre!(
- "failed to evaluate test trace {index}: {error}"
- ))
- })?;
- let value = value.json().map_err(|error| {
- ApiError::Request(eyre!(
- "failed to decode result for test trace {index}: {error}"
- ))
- })?;
-
- let effect = match value {
- serde_json::Value::Null => None,
- value => Some(serde_json::from_value(value).map_err(|error| {
+ let effect = super::rules_scan::evaluate_rule(&program, input)
+ .map_err(|error| {
ApiError::Request(eyre!(
- "invalid effect for test trace {index}: {error}"
+ "failed to evaluate test trace {index}: {error}"
))
- })?),
- };
+ })?;
effects.push(effect);
}
@@ -280,7 +260,7 @@ pub async fn get_rules(
updated_by
FROM delphi_rules
WHERE NOT delete_on_next_revision
- ORDER BY name, id
+ ORDER BY id
"#,
)
.fetch_all(&***ro_pool)
@@ -336,10 +316,17 @@ pub async fn create_rule(
INSERT INTO delphi_rules (
name,
rule,
+ revision,
created_by,
updated_by
)
- VALUES ($1, $2, $3, $3)
+ VALUES (
+ $1,
+ $2,
+ (SELECT revision + 1 FROM delphi_rule_revisions LIMIT 1),
+ $3,
+ $3
+ )
RETURNING
id,
name,
@@ -405,6 +392,9 @@ pub async fn update_rule(
SET
name = $2,
rule = $3,
+ revision = (
+ SELECT revision + 1 FROM delphi_rule_revisions LIMIT 1
+ ),
updated_at = CURRENT_TIMESTAMP,
updated_by = $4
WHERE id = $1 AND NOT delete_on_next_revision
@@ -470,6 +460,9 @@ pub async fn delete_rule(
UPDATE delphi_rules
SET
delete_on_next_revision = TRUE,
+ revision = (
+ SELECT revision + 1 FROM delphi_rule_revisions LIMIT 1
+ ),
updated_at = CURRENT_TIMESTAMP,
updated_by = $2
WHERE id = $1 AND NOT delete_on_next_revision
diff --git a/apps/labrinth/src/routes/internal/moderation/tech_review/rules_scan.rs b/apps/labrinth/src/routes/internal/moderation/tech_review/rules_scan.rs
new file mode 100644
index 0000000000..4ee7f4c595
--- /dev/null
+++ b/apps/labrinth/src/routes/internal/moderation/tech_review/rules_scan.rs
@@ -0,0 +1,493 @@
+use std::collections::{BTreeMap, HashMap};
+
+use actix_web::{HttpRequest, HttpResponse, post, web};
+use ariadne::ids::base62_impl::to_base62;
+use bytes::Bytes;
+use eyre::{Context as _, Result, eyre};
+use futures_util::{StreamExt, TryStreamExt};
+use serde::Serialize;
+use sqlx::types::Json;
+use tokio::sync::mpsc;
+use tokio_stream::wrappers::UnboundedReceiverStream;
+
+use super::rules::DelphiRuleEffect;
+use crate::{
+ auth::check_is_moderator_from_headers,
+ database::{
+ PgPool, PgTransaction, models::delphi_report_item::DelphiSeverity,
+ redis::RedisPool,
+ },
+ models::pats::Scopes,
+ queue::session::AuthQueue,
+ routes::ApiError,
+};
+
+const RULE_SCAN_LOCK_ID: i64 = 0x6465_6c70_6869_7275;
+const PROGRESS_INTERVAL: usize = 50;
+
+pub fn config(cfg: &mut actix_web::web::ServiceConfig) {
+ cfg.service(scan_rules);
+}
+
+#[derive(Serialize)]
+struct RuleScanEvent<'a> {
+ phase: &'a str,
+ revision: i64,
+ scanned: usize,
+ total: usize,
+ effects: usize,
+}
+
+#[derive(Serialize)]
+struct RuleScanErrorEvent<'a> {
+ message: &'a str,
+}
+
+#[derive(Serialize)]
+struct RuleInput {
+ schema_version: u32,
+ trace: RuleTrace,
+ scan: RuleScan,
+ artifact: RuleArtifact,
+ scope: RuleScope,
+}
+
+#[derive(Serialize)]
+struct RuleTrace {
+ key: String,
+ issue_type: String,
+ severity: DelphiSeverity,
+ jar: Option
,
+ file_path: String,
+ data: HashMap,
+}
+
+#[derive(Serialize)]
+struct RuleScan {
+ delphi_version: i32,
+}
+
+#[derive(Serialize)]
+struct RuleArtifact {
+ size: Option,
+ hashes: BTreeMap,
+}
+
+#[derive(Serialize)]
+struct RuleScope {
+ project_id: Option,
+ version_id: Option,
+ file_id: Option,
+}
+
+struct CompiledRule {
+ id: i64,
+ program: cel::Program,
+}
+
+struct MaterializedEffect {
+ detail_id: i64,
+ rule_id: i64,
+ effect: DelphiRuleEffect,
+}
+
+struct ScanSummary {
+ revision: i64,
+ scanned: usize,
+ total: usize,
+ effects: usize,
+}
+
+/// Re-evaluate every Delphi issue detail and atomically publish a new rule revision.
+#[utoipa::path(
+ context_path = "/moderation/tech-review",
+ tag = "moderation",
+ security(("bearer_auth" = [])),
+ responses((status = OK), (status = CONFLICT))
+)]
+#[post("/rules/scan")]
+pub async fn scan_rules(
+ req: HttpRequest,
+ pool: web::Data,
+ redis: web::Data,
+ session_queue: web::Data,
+) -> Result {
+ check_is_moderator_from_headers(
+ &req,
+ &**pool,
+ &redis,
+ &session_queue,
+ Scopes::PROJECT_WRITE,
+ )
+ .await?;
+
+ let mut transaction = crate::util::error::Context::wrap_internal_err(
+ pool.begin().await,
+ "failed to begin delphi rule scan",
+ )?;
+
+ sqlx::query!("SET TRANSACTION ISOLATION LEVEL REPEATABLE READ")
+ .execute(&mut transaction)
+ .await
+ .map_err(|error| {
+ ApiError::Internal(
+ eyre!(error)
+ .wrap_err("failed to set delphi rule scan isolation"),
+ )
+ })?;
+
+ let acquired = sqlx::query_scalar!(
+ "SELECT pg_try_advisory_xact_lock($1)",
+ RULE_SCAN_LOCK_ID,
+ )
+ .fetch_one(&mut transaction)
+ .await
+ .map_err(|error| {
+ ApiError::Internal(
+ eyre!(error).wrap_err("failed to acquire delphi rule scan lock"),
+ )
+ })?
+ .unwrap_or(false);
+
+ if !acquired {
+ return Err(ApiError::Conflict(
+ "a delphi rule scan is already running".to_string(),
+ ));
+ }
+
+ let (sender, receiver) = mpsc::unbounded_channel();
+ actix_web::rt::spawn(async move {
+ match run_scan(transaction, &sender).await {
+ Ok(summary) => {
+ send_event(
+ &sender,
+ "complete",
+ &RuleScanEvent {
+ phase: "complete",
+ revision: summary.revision,
+ scanned: summary.scanned,
+ total: summary.total,
+ effects: summary.effects,
+ },
+ );
+ }
+ Err(error) => {
+ tracing::error!(error = ?error, "delphi rule scan failed");
+ send_event(
+ &sender,
+ "failed",
+ &RuleScanErrorEvent {
+ message: &error.to_string(),
+ },
+ );
+ }
+ }
+ });
+
+ let stream =
+ UnboundedReceiverStream::new(receiver).map(Ok::<_, std::io::Error>);
+
+ Ok(HttpResponse::Ok()
+ .insert_header(("Content-Type", "text/event-stream"))
+ .insert_header(("Cache-Control", "no-cache"))
+ .insert_header(("X-Accel-Buffering", "no"))
+ .streaming(stream))
+}
+
+async fn run_scan(
+ mut transaction: PgTransaction<'static>,
+ sender: &mpsc::UnboundedSender,
+) -> Result {
+ sqlx::query!("LOCK TABLE delphi_rules IN SHARE MODE")
+ .execute(&mut transaction)
+ .await
+ .wrap_err("failed to lock delphi rules")?;
+ sqlx::query!("LOCK TABLE delphi_report_issue_details IN SHARE MODE")
+ .execute(&mut transaction)
+ .await
+ .wrap_err("failed to lock delphi issue details")?;
+
+ let current_revision = sqlx::query_scalar!(
+ "SELECT revision FROM delphi_rule_revisions LIMIT 1 FOR UPDATE",
+ )
+ .fetch_one(&mut transaction)
+ .await
+ .wrap_err("failed to fetch the current delphi rule revision")?;
+ let revision = current_revision
+ .checked_add(1)
+ .ok_or_else(|| eyre!("delphi rule revision overflowed"))?;
+
+ let rules = sqlx::query!(
+ r#"
+ SELECT id, rule
+ FROM delphi_rules
+ WHERE NOT delete_on_next_revision
+ ORDER BY id
+ "#,
+ )
+ .fetch_all(&mut transaction)
+ .await
+ .wrap_err("failed to fetch delphi rules")?
+ .into_iter()
+ .map(|rule| {
+ let program = cel::Program::compile(&rule.rule).map_err(|error| {
+ eyre!("failed to compile delphi rule {}: {error}", rule.id)
+ })?;
+ Ok(CompiledRule {
+ id: rule.id,
+ program,
+ })
+ })
+ .collect::>>()?;
+
+ let total = sqlx::query_scalar!(
+ "SELECT COUNT(*) AS \"count!\" FROM delphi_report_issue_details",
+ )
+ .fetch_one(&mut transaction)
+ .await
+ .wrap_err("failed to count delphi issue details")? as usize;
+
+ let mut details = sqlx::query!(
+ r#"
+ SELECT
+ detail.id,
+ detail.key,
+ issue.issue_type,
+ detail.severity AS "severity: DelphiSeverity",
+ detail.jar,
+ detail.file_path,
+ detail.data AS "data: Json>",
+ report.delphi_version,
+ file.size AS "size?",
+ file.id AS "file_id?",
+ version.id AS "version_id?",
+ version.mod_id AS "project_id?",
+ COALESCE(file_hashes.hashes, '{}'::jsonb)
+ AS "hashes!: Json>"
+ FROM delphi_report_issue_details detail
+ INNER JOIN delphi_report_issues issue ON issue.id = detail.issue_id
+ INNER JOIN delphi_reports report ON report.id = issue.report_id
+ LEFT JOIN files file ON file.id = report.file_id
+ LEFT JOIN versions version ON version.id = file.version_id
+ LEFT JOIN (
+ SELECT
+ file_id,
+ jsonb_object_agg(algorithm, encode(hash, 'hex')) AS hashes
+ FROM hashes
+ GROUP BY file_id
+ ) file_hashes ON file_hashes.file_id = file.id
+ ORDER BY detail.id
+ "#,
+ )
+ .fetch(&mut transaction);
+
+ let mut effects = Vec::new();
+ let mut scanned = 0;
+ send_progress(sender, "scanning", revision, 0, total, 0);
+
+ while let Some(detail) = details
+ .try_next()
+ .await
+ .wrap_err("failed to fetch a delphi issue detail")?
+ {
+ let detail_id = detail.id;
+ let input = RuleInput {
+ schema_version: 1,
+ trace: RuleTrace {
+ key: detail.key,
+ issue_type: detail.issue_type,
+ severity: detail.severity,
+ jar: detail.jar,
+ file_path: detail.file_path,
+ data: detail.data.0,
+ },
+ scan: RuleScan {
+ delphi_version: detail.delphi_version,
+ },
+ artifact: RuleArtifact {
+ size: detail.size,
+ hashes: detail.hashes.0,
+ },
+ scope: RuleScope {
+ project_id: detail.project_id.map(to_public_id),
+ version_id: detail.version_id.map(to_public_id),
+ file_id: detail.file_id.map(to_public_id),
+ },
+ };
+
+ for rule in &rules {
+ let effect = evaluate_rule(&rule.program, &input).wrap_err_with(|| {
+ format!(
+ "failed to evaluate delphi rule {} for detail {detail_id}",
+ rule.id
+ )
+ })?;
+ if let Some(effect) = effect {
+ effects.push(MaterializedEffect {
+ detail_id,
+ rule_id: rule.id,
+ effect,
+ });
+ break;
+ }
+ }
+
+ scanned += 1;
+ if scanned % PROGRESS_INTERVAL == 0 || scanned == total {
+ send_progress(
+ sender,
+ "scanning",
+ revision,
+ scanned,
+ total,
+ effects.len(),
+ );
+ tokio::task::yield_now().await;
+ }
+ }
+ drop(details);
+
+ send_progress(sender, "publishing", revision, total, total, effects.len());
+
+ let detail_ids = effects
+ .iter()
+ .map(|effect| effect.detail_id)
+ .collect::>();
+ let rule_ids = effects
+ .iter()
+ .map(|effect| effect.rule_id)
+ .collect::>();
+ let severities = effects
+ .iter()
+ .map(|effect| effect.effect.severity)
+ .collect::>();
+ let hidden = effects
+ .iter()
+ .map(|effect| effect.effect.hidden)
+ .collect::>();
+
+ if !effects.is_empty() {
+ sqlx::query!(
+ r#"
+ INSERT INTO delphi_rule_effects (
+ revision,
+ detail_id,
+ rule_id,
+ severity,
+ hidden
+ )
+ SELECT $1, effect.*
+ FROM UNNEST(
+ $2::BIGINT[],
+ $3::BIGINT[],
+ $4::delphi_severity[],
+ $5::BOOLEAN[]
+ ) AS effect(detail_id, rule_id, severity, hidden)
+ "#,
+ revision,
+ &detail_ids,
+ &rule_ids,
+ &severities as &[Option],
+ &hidden,
+ )
+ .execute(&mut transaction)
+ .await
+ .wrap_err("failed to insert delphi rule effects")?;
+ }
+
+ sqlx::query!(
+ "DELETE FROM delphi_rule_effects WHERE revision <> $1",
+ revision,
+ )
+ .execute(&mut transaction)
+ .await
+ .wrap_err("failed to delete old delphi rule effects")?;
+ sqlx::query!("DELETE FROM delphi_rules WHERE delete_on_next_revision")
+ .execute(&mut transaction)
+ .await
+ .wrap_err("failed to delete retired delphi rules")?;
+ sqlx::query!(
+ "UPDATE delphi_rules SET revision = $1 WHERE NOT delete_on_next_revision",
+ revision,
+ )
+ .execute(&mut transaction)
+ .await
+ .wrap_err("failed to update delphi rule revisions")?;
+ sqlx::query!("UPDATE delphi_rule_revisions SET revision = $1", revision)
+ .execute(&mut transaction)
+ .await
+ .wrap_err("failed to publish the delphi rule revision")?;
+
+ transaction
+ .commit()
+ .await
+ .wrap_err("failed to commit the delphi rule scan")?;
+
+ Ok(ScanSummary {
+ revision,
+ scanned: total,
+ total,
+ effects: effects.len(),
+ })
+}
+
+pub(super) fn evaluate_rule(
+ program: &cel::Program,
+ input: impl Serialize,
+) -> Result> {
+ let mut context = cel::Context::default();
+ context
+ .add_variable("input", input)
+ .wrap_err("failed to build cel input")?;
+
+ let value = program
+ .execute(&context)
+ .wrap_err("failed to execute cel expression")?;
+ let value = value.json().map_err(|error| {
+ eyre!("failed to convert cel result to json: {error}")
+ })?;
+
+ match value {
+ serde_json::Value::Null => Ok(None),
+ value => serde_json::from_value(value)
+ .map(Some)
+ .wrap_err("cel expression returned an invalid rule effect"),
+ }
+}
+
+fn to_public_id(id: i64) -> String {
+ to_base62(id as u64)
+}
+
+fn send_progress(
+ sender: &mpsc::UnboundedSender,
+ phase: &'static str,
+ revision: i64,
+ scanned: usize,
+ total: usize,
+ effects: usize,
+) {
+ send_event(
+ sender,
+ "progress",
+ &RuleScanEvent {
+ phase,
+ revision,
+ scanned,
+ total,
+ effects,
+ },
+ );
+}
+
+fn send_event(
+ sender: &mpsc::UnboundedSender,
+ event: &str,
+ data: &impl Serialize,
+) {
+ let Ok(data) = serde_json::to_string(data) else {
+ return;
+ };
+ let _ =
+ sender.send(Bytes::from(format!("event: {event}\ndata: {data}\n\n")));
+}
diff --git a/packages/api-client/src/modules/labrinth/tech-review/internal.ts b/packages/api-client/src/modules/labrinth/tech-review/internal.ts
index c5d86fc713..c66520baa8 100644
--- a/packages/api-client/src/modules/labrinth/tech-review/internal.ts
+++ b/packages/api-client/src/modules/labrinth/tech-review/internal.ts
@@ -68,6 +68,15 @@ export class LabrinthTechReviewInternalModule extends AbstractModule {
})
}
+ public async scanRules(signal?: AbortSignal): Promise> {
+ return this.client.stream('/moderation/tech-review/rules/scan', {
+ api: 'labrinth',
+ version: 'internal',
+ method: 'POST',
+ signal,
+ })
+ }
+
/**
* Search for projects awaiting technical review.
*
diff --git a/packages/api-client/src/modules/labrinth/types.ts b/packages/api-client/src/modules/labrinth/types.ts
index 51f664faa3..9d97f1ec5a 100644
--- a/packages/api-client/src/modules/labrinth/types.ts
+++ b/packages/api-client/src/modules/labrinth/types.ts
@@ -2265,6 +2265,20 @@ export namespace Labrinth {
effects: Array
}
+ export type DelphiRuleScanPhase = 'scanning' | 'publishing' | 'complete'
+
+ export type DelphiRuleScanEvent = {
+ phase: DelphiRuleScanPhase
+ revision: number
+ scanned: number
+ total: number
+ effects: number
+ }
+
+ export type DelphiRuleScanErrorEvent = {
+ message: string
+ }
+
export type SearchProjectsRequest = {
limit?: number
page?: number
From ea42c644f35d2cec2479403526e13ea04aa14fa9 Mon Sep 17 00:00:00 2001
From: aecsocket <43144841+aecsocket@users.noreply.github.com>
Date: Wed, 22 Jul 2026 20:14:57 +0100
Subject: [PATCH 5/7] show in/out schema
---
.../moderation/technical-review/rules.vue | 306 ++++++++++++++++-
apps/labrinth/src/routes/internal/mod.rs | 2 +
.../internal/moderation/tech_review/rules.rs | 309 +++++++++++++++---
.../moderation/tech_review/rules_scan.rs | 128 ++++++--
.../modules/labrinth/tech-review/internal.ts | 24 ++
.../api-client/src/modules/labrinth/types.ts | 28 ++
6 files changed, 707 insertions(+), 90 deletions(-)
diff --git a/apps/frontend/src/pages/moderation/technical-review/rules.vue b/apps/frontend/src/pages/moderation/technical-review/rules.vue
index d0447852c7..6cf23d476a 100644
--- a/apps/frontend/src/pages/moderation/technical-review/rules.vue
+++ b/apps/frontend/src/pages/moderation/technical-review/rules.vue
@@ -37,6 +37,37 @@
severity and/or hidden when it does.
+
+
+ Input and output schema
+
+
+
+ Loading schema…
+
+
+ {{ ruleSchemaError }}
+
+
+
+
+ Input (input)
+
+
{{ ruleInputSchemaText }}
+
+
+
+ Output
+
+
{{ ruleOutputSchemaText }}
+
+
+
@@ -233,7 +264,11 @@
description="Create a rule to transform matching issue traces."
/>
-
+
{{ rule.name }}
@@ -257,6 +292,112 @@
{{ rule.rule }}
+
+
+
+ Affected details ({{ rule.affected_details_count.toLocaleString() }})
+
+
+ No details are affected in the current revision.
+
+
+
+
+
+
+
+ {{ detail.project_name ?? detail.project_id }}
+
+
Unattached trace
+
+ ·
+
+ {{ detail.version_name ?? detail.version_number ?? detail.version_id }}
+
+
+
+
+
+ {{ detail.severity ?? detail.original_severity }}
+
+
+
+ Hidden
+
+ {{ detail.issue_type }}
+
+
+
+ {{ detail.jar }}
+
+
+ {{ detail.file_path }}
+
+
+
+
+
+ View
+
+
+
+
+
+
+
+
+
+
+
+
@@ -266,8 +407,10 @@
import { type Labrinth, SseParser } from '@modrinth/api-client'
import {
ArrowLeftIcon,
+ ChevronRightIcon,
EditIcon,
EyeOffIcon,
+ ExternalIcon,
LoaderCircleIcon,
PlayIcon,
PlusIcon,
@@ -275,6 +418,7 @@ import {
} from '@modrinth/assets'
import {
ButtonStyled,
+ Avatar,
ConfirmModal,
EmptyState,
injectModrinthClient,
@@ -335,13 +479,20 @@ const isLoading = ref(true)
const isSaving = ref(false)
const isScanning = ref(false)
const isTestingRule = ref(false)
+const isLoadingRuleSchema = ref(false)
const isRuleModalOpen = ref(false)
const loadFailed = ref(false)
+const ruleSchemaError = ref(null)
+const ruleSchema = ref(null)
const editingRuleId = ref(null)
const ruleToDelete = ref(null)
const ruleTestEffects = ref>([])
const ruleTestError = ref(null)
const scanProgress = ref(null)
+const expandedAffectedDetails = reactive(
+ new Map(),
+)
+const loadingAffectedRuleIds = reactive(new Set())
const form = reactive({
name: '',
rule: DEFAULT_RULE,
@@ -358,6 +509,12 @@ onMounted(async () => {
})
const modalTitle = computed(() => (editingRuleId.value === null ? 'Create rule' : 'Edit rule'))
+const ruleInputSchemaText = computed(() =>
+ ruleSchema.value ? formatRuleSchema(ruleSchema.value.input, ruleSchema.value.components) : '',
+)
+const ruleOutputSchemaText = computed(() =>
+ ruleSchema.value ? formatRuleSchema(ruleSchema.value.output, ruleSchema.value.components) : '',
+)
const previewExamples = computed(() =>
TEST_TRACES.map((original, index) => {
const effect = ruleTestEffects.value[index] ?? null
@@ -399,6 +556,92 @@ function getSeverityBadgeColor(severity: Labrinth.TechReview.Internal.DelphiSeve
}
}
+function isSchema(value: unknown): value is Labrinth.TechReview.Internal.DelphiRuleSchema {
+ return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function formatRuleSchema(
+ schema: Labrinth.TechReview.Internal.DelphiRuleSchema,
+ components: Record,
+ depth = 0,
+ visitedReferences = new Set(),
+): string {
+ if (typeof schema.$ref === 'string') {
+ const name = decodeURIComponent(schema.$ref.split('/').at(-1) ?? '')
+ if (visitedReferences.has(name)) return name || 'unknown'
+
+ const referencedSchema = components[name]
+ if (!referencedSchema) return name || 'unknown'
+
+ const visited = new Set(visitedReferences)
+ visited.add(name)
+ return formatRuleSchema(referencedSchema, components, depth, visited)
+ }
+
+ const resolved = schema
+ const alternatives = [resolved.oneOf, resolved.anyOf].find(Array.isArray)
+ if (alternatives) {
+ return alternatives
+ .filter(isSchema)
+ .map((alternative) => formatRuleSchema(alternative, components, depth, visitedReferences))
+ .join(' | ')
+ }
+
+ if (Array.isArray(resolved.enum)) {
+ return resolved.enum.map((value) => JSON.stringify(value)).join(' | ')
+ }
+
+ const declaredTypes = Array.isArray(resolved.type)
+ ? resolved.type.filter((type): type is string => typeof type === 'string')
+ : typeof resolved.type === 'string'
+ ? [resolved.type]
+ : []
+ const nullable = resolved.nullable === true || declaredTypes.includes('null')
+ const type = declaredTypes.find((value) => value !== 'null')
+ let formatted: string
+
+ if (type === 'object' || isSchema(resolved.properties) || resolved.additionalProperties) {
+ const properties = isSchema(resolved.properties) ? resolved.properties : {}
+ const required = new Set(
+ Array.isArray(resolved.required)
+ ? resolved.required.filter((name): name is string => typeof name === 'string')
+ : [],
+ )
+ const indentation = ' '.repeat(depth)
+ const childIndentation = ' '.repeat(depth + 1)
+ const lines = Object.entries(properties)
+ .filter((entry): entry is [string, Labrinth.TechReview.Internal.DelphiRuleSchema] =>
+ isSchema(entry[1]),
+ )
+ .map(
+ ([name, property]) =>
+ `${childIndentation}${JSON.stringify(name)}${required.has(name) ? '' : '?'}: ${formatRuleSchema(property, components, depth + 1, visitedReferences)}`,
+ )
+
+ if (isSchema(resolved.additionalProperties)) {
+ lines.push(
+ `${childIndentation}[key: string]: ${formatRuleSchema(resolved.additionalProperties, components, depth + 1, visitedReferences)}`,
+ )
+ } else if (resolved.additionalProperties === true) {
+ lines.push(`${childIndentation}[key: string]: unknown`)
+ }
+
+ formatted = lines.length === 0 ? '{}' : `{\n${lines.join(',\n')}\n${indentation}}`
+ } else if (type === 'array') {
+ formatted = isSchema(resolved.items)
+ ? `Array<${formatRuleSchema(resolved.items, components, depth, visitedReferences)}>`
+ : 'unknown[]'
+ } else if (type === 'integer' || type === 'number') {
+ formatted = 'number'
+ } else if (type === 'boolean' || type === 'string' || type === 'null') {
+ formatted = type
+ } else {
+ formatted = 'unknown'
+ }
+
+ return nullable && formatted !== 'null' ? `${formatted} | null` : formatted
+}
+
function onRuleEditorInit(editor: Ace.Editor) {
ruleEditorInstance.value = editor
editor.session.setUseWrapMode(true)
@@ -460,6 +703,7 @@ async function loadRules() {
loadFailed.value = false
try {
rules.value = await client.labrinth.tech_review_internal.getRules()
+ expandedAffectedDetails.clear()
} catch (error) {
console.error('Failed to load Delphi rules', error)
loadFailed.value = true
@@ -468,6 +712,64 @@ async function loadRules() {
}
}
+async function loadRuleSchema() {
+ if (ruleSchema.value || isLoadingRuleSchema.value) return
+
+ isLoadingRuleSchema.value = true
+ ruleSchemaError.value = null
+ try {
+ ruleSchema.value = await client.labrinth.tech_review_internal.getRuleSchema()
+ } catch (error) {
+ console.error('Failed to load Delphi rule schema', error)
+ ruleSchemaError.value = 'The rule input and output schema could not be loaded.'
+ } finally {
+ isLoadingRuleSchema.value = false
+ }
+}
+
+function getVisibleRuleDetails(
+ rule: Labrinth.TechReview.Internal.DelphiRule,
+): Labrinth.TechReview.Internal.DelphiRuleAffectedDetail[] {
+ return expandedAffectedDetails.get(rule.id) ?? rule.affected_details
+}
+
+function getAffectedDetailLink(
+ detail: Labrinth.TechReview.Internal.DelphiRuleAffectedDetail,
+): string {
+ return `/moderation/technical-review/${detail.project_id}?detail=${encodeURIComponent(detail.detail_id)}`
+}
+
+function getProjectLink(detail: Labrinth.TechReview.Internal.DelphiRuleAffectedDetail): string {
+ return `/project/${detail.project_id}`
+}
+
+function getVersionLink(detail: Labrinth.TechReview.Internal.DelphiRuleAffectedDetail): string {
+ return `/project/${detail.project_id}/version/${detail.version_id}`
+}
+
+async function toggleAffectedDetails(rule: Labrinth.TechReview.Internal.DelphiRule) {
+ if (expandedAffectedDetails.has(rule.id)) {
+ expandedAffectedDetails.delete(rule.id)
+ return
+ }
+ if (loadingAffectedRuleIds.has(rule.id)) return
+
+ loadingAffectedRuleIds.add(rule.id)
+ try {
+ const details = await client.labrinth.tech_review_internal.getRuleAffectedDetails(rule.id)
+ expandedAffectedDetails.set(rule.id, details)
+ } catch (error) {
+ console.error('Failed to load details affected by Delphi rule', error)
+ addNotification({
+ type: 'error',
+ title: 'Failed to load affected details',
+ text: 'The complete list of affected details could not be loaded.',
+ })
+ } finally {
+ loadingAffectedRuleIds.delete(rule.id)
+ }
+}
+
function openCreateModal() {
if (isScanning.value) return
editingRuleId.value = null
@@ -476,6 +778,7 @@ function openCreateModal() {
isRuleModalOpen.value = true
ruleModal.value?.show()
nextTick(() => ruleEditorInstance.value?.resize(true))
+ void loadRuleSchema()
void testRule()
}
@@ -487,6 +790,7 @@ function openEditModal(rule: Labrinth.TechReview.Internal.DelphiRule) {
isRuleModalOpen.value = true
ruleModal.value?.show()
nextTick(() => ruleEditorInstance.value?.resize(true))
+ void loadRuleSchema()
void testRule()
}
diff --git a/apps/labrinth/src/routes/internal/mod.rs b/apps/labrinth/src/routes/internal/mod.rs
index d54c86c742..6dc3734377 100644
--- a/apps/labrinth/src/routes/internal/mod.rs
+++ b/apps/labrinth/src/routes/internal/mod.rs
@@ -117,9 +117,11 @@ pub fn config(cfg: &mut web::ServiceConfig) {
moderation::tech_review::global::get_global_issue_detail,
moderation::tech_review::rules::get_rules,
moderation::tech_review::rules::test_rule,
+ moderation::tech_review::rules::get_rule_affected_details,
moderation::tech_review::rules::create_rule,
moderation::tech_review::rules::update_rule,
moderation::tech_review::rules::delete_rule,
+ moderation::tech_review::rules_scan::get_rule_schema,
moderation::tech_review::rules_scan::scan_rules,
moderation::tech_review::get_project_report,
moderation::tech_review::submit_report,
diff --git a/apps/labrinth/src/routes/internal/moderation/tech_review/rules.rs b/apps/labrinth/src/routes/internal/moderation/tech_review/rules.rs
index 9a0a55d23c..00c2f4a91a 100644
--- a/apps/labrinth/src/routes/internal/moderation/tech_review/rules.rs
+++ b/apps/labrinth/src/routes/internal/moderation/tech_review/rules.rs
@@ -5,13 +5,23 @@ use chrono::{DateTime, Utc};
use eyre::eyre;
use serde::{Deserialize, Serialize};
+use super::rules_scan::{
+ RuleArtifact, RuleInput, RuleScan, RuleScope, RuleTrace,
+};
use crate::{
auth::check_is_moderator_from_headers,
database::{
- PgPool, ReadOnlyPgPool, models::delphi_report_item::DelphiSeverity,
+ PgPool, ReadOnlyPgPool,
+ models::{
+ DBProjectId, DBVersionId, DelphiReportIssueDetailsId,
+ DelphiReportIssueId, delphi_report_item::DelphiSeverity,
+ },
redis::RedisPool,
},
- models::pats::Scopes,
+ models::{
+ ids::{ProjectId, VersionId},
+ pats::Scopes,
+ },
queue::session::AuthQueue,
routes::ApiError,
util::error::Context,
@@ -24,6 +34,7 @@ const MAX_RULE_TEST_TRACES: usize = 10;
pub fn config(cfg: &mut actix_web::web::ServiceConfig) {
cfg.service(get_rules)
.service(test_rule)
+ .service(get_rule_affected_details)
.service(create_rule)
.service(update_rule)
.service(delete_rule);
@@ -39,6 +50,27 @@ pub struct DelphiRule {
pub updated_at: DateTime,
pub created_by: Option,
pub updated_by: Option,
+ pub affected_details_count: i64,
+ pub affected_details: Vec,
+}
+
+#[derive(Debug, Serialize, utoipa::ToSchema)]
+pub struct DelphiRuleAffectedDetail {
+ pub detail_id: DelphiReportIssueDetailsId,
+ pub issue_id: DelphiReportIssueId,
+ pub project_id: Option,
+ pub project_name: Option,
+ pub project_icon_url: Option,
+ pub version_id: Option,
+ pub version_name: Option,
+ pub version_number: Option,
+ pub issue_type: String,
+ pub key: String,
+ pub jar: Option,
+ pub file_path: String,
+ pub original_severity: DelphiSeverity,
+ pub severity: Option,
+ pub hidden: bool,
}
#[derive(Debug, Deserialize, utoipa::ToSchema)]
@@ -77,33 +109,6 @@ pub struct DelphiRuleEffect {
pub hidden: bool,
}
-#[derive(Serialize)]
-struct TestRuleInput<'a> {
- schema_version: u32,
- trace: &'a TestDelphiRuleTrace,
- scan: TestRuleScan,
- artifact: TestRuleArtifact,
- scope: TestRuleScope,
-}
-
-#[derive(Serialize)]
-struct TestRuleScan {
- delphi_version: i32,
-}
-
-#[derive(Serialize)]
-struct TestRuleArtifact {
- size: u32,
- hashes: BTreeMap,
-}
-
-#[derive(Serialize)]
-struct TestRuleScope {
- project_id: String,
- version_id: String,
- file_id: String,
-}
-
struct ValidatedRule {
name: String,
rule: String,
@@ -203,22 +208,29 @@ pub async fn test_rule(
Ok(web::Json(TestDelphiRuleResponse { effects }))
}
-fn test_rule_input(trace: &TestDelphiRuleTrace) -> TestRuleInput<'_> {
- TestRuleInput {
+fn test_rule_input(trace: &TestDelphiRuleTrace) -> RuleInput {
+ RuleInput {
schema_version: 1,
- trace,
- scan: TestRuleScan { delphi_version: 17 },
- artifact: TestRuleArtifact {
- size: 412_892,
+ trace: RuleTrace {
+ key: trace.key.clone(),
+ issue_type: trace.issue_type.clone(),
+ severity: trace.severity,
+ jar: trace.jar.clone(),
+ file_path: trace.file_path.clone(),
+ data: trace.data.clone(),
+ },
+ scan: RuleScan { delphi_version: 17 },
+ artifact: RuleArtifact {
+ size: Some(412_892),
hashes: BTreeMap::from([
("sha1".to_string(), "0123456789abcdef".to_string()),
("sha512".to_string(), "fedcba9876543210".to_string()),
]),
},
- scope: TestRuleScope {
- project_id: "example-project".to_string(),
- version_id: "example-version".to_string(),
- file_id: "example-file".to_string(),
+ scope: RuleScope {
+ project_id: Some("example-project".to_string()),
+ version_id: Some("example-version".to_string()),
+ file_id: Some("example-file".to_string()),
},
}
}
@@ -250,27 +262,81 @@ pub async fn get_rules(
let rules = sqlx::query!(
r#"
SELECT
- id,
- name,
- rule,
- revision,
- created_at,
- updated_at,
- created_by,
- updated_by
- FROM delphi_rules
- WHERE NOT delete_on_next_revision
- ORDER BY id
+ delphi_rule.id,
+ delphi_rule.name,
+ delphi_rule.rule,
+ delphi_rule.revision,
+ delphi_rule.created_at,
+ delphi_rule.updated_at,
+ delphi_rule.created_by,
+ delphi_rule.updated_by,
+ COALESCE(preview.affected_details_count, 0)
+ AS "affected_details_count!",
+ preview.detail_id AS "detail_id?: DelphiReportIssueDetailsId",
+ preview.issue_id AS "issue_id?: DelphiReportIssueId",
+ preview.project_id AS "project_id?: DBProjectId",
+ preview.project_name AS "project_name?",
+ preview.project_icon_url AS "project_icon_url?",
+ preview.version_id AS "version_id?: DBVersionId",
+ preview.version_name AS "version_name?",
+ preview.version_number AS "version_number?",
+ preview.issue_type AS "issue_type?",
+ preview.key AS "key?",
+ preview.jar AS "jar?",
+ preview.file_path AS "file_path?",
+ preview.original_severity AS "original_severity?: DelphiSeverity",
+ preview.severity AS "effect_severity?: DelphiSeverity",
+ preview.hidden AS "hidden?"
+ FROM delphi_rules delphi_rule
+ LEFT JOIN LATERAL (
+ SELECT
+ effect.detail_id,
+ detail.issue_id,
+ version.mod_id AS project_id,
+ project.name AS project_name,
+ project.icon_url AS project_icon_url,
+ version.id AS version_id,
+ version.name AS version_name,
+ version.version_number,
+ issue.issue_type,
+ detail.key,
+ detail.jar,
+ detail.file_path,
+ detail.severity AS original_severity,
+ effect.severity,
+ effect.hidden,
+ COUNT(*) OVER () AS affected_details_count
+ FROM delphi_rule_effects effect
+ INNER JOIN delphi_rule_revisions published
+ ON published.revision = effect.revision
+ INNER JOIN delphi_report_issue_details detail
+ ON detail.id = effect.detail_id
+ INNER JOIN delphi_report_issues issue
+ ON issue.id = detail.issue_id
+ INNER JOIN delphi_reports report
+ ON report.id = issue.report_id
+ LEFT JOIN files file ON file.id = report.file_id
+ LEFT JOIN versions version ON version.id = file.version_id
+ LEFT JOIN mods project ON project.id = version.mod_id
+ WHERE effect.rule_id = delphi_rule.id
+ ORDER BY effect.detail_id DESC
+ LIMIT 3
+ ) preview ON TRUE
+ WHERE NOT delphi_rule.delete_on_next_revision
+ ORDER BY delphi_rule.id, preview.detail_id DESC
"#,
)
.fetch_all(&***ro_pool)
.await
.wrap_internal_err("failed to fetch delphi rules")?;
- Ok(web::Json(
- rules
- .into_iter()
- .map(|rule| DelphiRule {
+ let mut response = Vec::::new();
+ for rule in rules {
+ if response
+ .last()
+ .is_none_or(|existing| existing.id != rule.id)
+ {
+ response.push(DelphiRule {
id: rule.id,
name: rule.name,
rule: rule.rule,
@@ -279,6 +345,137 @@ pub async fn get_rules(
updated_at: rule.updated_at,
created_by: rule.created_by,
updated_by: rule.updated_by,
+ affected_details_count: rule.affected_details_count,
+ affected_details: Vec::new(),
+ });
+ }
+
+ if let (
+ Some(detail_id),
+ Some(issue_id),
+ Some(issue_type),
+ Some(key),
+ Some(file_path),
+ Some(original_severity),
+ Some(hidden),
+ ) = (
+ rule.detail_id,
+ rule.issue_id,
+ rule.issue_type,
+ rule.key,
+ rule.file_path,
+ rule.original_severity,
+ rule.hidden,
+ ) {
+ response
+ .last_mut()
+ .expect("a delphi rule was inserted above")
+ .affected_details
+ .push(DelphiRuleAffectedDetail {
+ detail_id,
+ issue_id,
+ project_id: rule.project_id.map(ProjectId::from),
+ project_name: rule.project_name,
+ project_icon_url: rule.project_icon_url,
+ version_id: rule.version_id.map(VersionId::from),
+ version_name: rule.version_name,
+ version_number: rule.version_number,
+ issue_type,
+ key,
+ jar: rule.jar,
+ file_path,
+ original_severity,
+ severity: rule.effect_severity,
+ hidden,
+ });
+ }
+ }
+
+ Ok(web::Json(response))
+}
+
+/// List all details affected by a Delphi rule in the published revision.
+#[utoipa::path(
+ context_path = "/moderation/tech-review",
+ tag = "moderation",
+ security(("bearer_auth" = [])),
+ responses((status = OK, body = Vec))
+)]
+#[get("/rules/{id}/effects")]
+pub async fn get_rule_affected_details(
+ req: HttpRequest,
+ pool: web::Data,
+ ro_pool: web::Data,
+ redis: web::Data,
+ session_queue: web::Data,
+ path: web::Path<(i64,)>,
+) -> Result>, ApiError> {
+ check_is_moderator_from_headers(
+ &req,
+ &**pool,
+ &redis,
+ &session_queue,
+ Scopes::PROJECT_READ,
+ )
+ .await?;
+ let (rule_id,) = path.into_inner();
+
+ let details = sqlx::query!(
+ r#"
+ SELECT
+ effect.detail_id AS "detail_id!: DelphiReportIssueDetailsId",
+ detail.issue_id AS "issue_id!: DelphiReportIssueId",
+ version.mod_id AS "project_id?: DBProjectId",
+ project.name AS "project_name?",
+ project.icon_url AS "project_icon_url?",
+ version.id AS "version_id?: DBVersionId",
+ version.name AS "version_name?",
+ version.version_number AS "version_number?",
+ issue.issue_type,
+ detail.key,
+ detail.jar,
+ detail.file_path,
+ detail.severity AS "original_severity!: DelphiSeverity",
+ effect.severity AS "effect_severity: DelphiSeverity",
+ effect.hidden
+ FROM delphi_rule_effects effect
+ INNER JOIN delphi_rule_revisions published
+ ON published.revision = effect.revision
+ INNER JOIN delphi_report_issue_details detail
+ ON detail.id = effect.detail_id
+ INNER JOIN delphi_report_issues issue ON issue.id = detail.issue_id
+ INNER JOIN delphi_reports report ON report.id = issue.report_id
+ LEFT JOIN files file ON file.id = report.file_id
+ LEFT JOIN versions version ON version.id = file.version_id
+ LEFT JOIN mods project ON project.id = version.mod_id
+ WHERE effect.rule_id = $1
+ ORDER BY effect.detail_id DESC
+ "#,
+ rule_id,
+ )
+ .fetch_all(&***ro_pool)
+ .await
+ .wrap_internal_err("failed to fetch details affected by delphi rule")?;
+
+ Ok(web::Json(
+ details
+ .into_iter()
+ .map(|detail| DelphiRuleAffectedDetail {
+ detail_id: detail.detail_id,
+ issue_id: detail.issue_id,
+ project_id: detail.project_id.map(ProjectId::from),
+ project_name: detail.project_name,
+ project_icon_url: detail.project_icon_url,
+ version_id: detail.version_id.map(VersionId::from),
+ version_name: detail.version_name,
+ version_number: detail.version_number,
+ issue_type: detail.issue_type,
+ key: detail.key,
+ jar: detail.jar,
+ file_path: detail.file_path,
+ original_severity: detail.original_severity,
+ severity: detail.effect_severity,
+ hidden: detail.hidden,
})
.collect(),
))
@@ -354,6 +551,8 @@ pub async fn create_rule(
updated_at: rule.updated_at,
created_by: rule.created_by,
updated_by: rule.updated_by,
+ affected_details_count: 0,
+ affected_details: Vec::new(),
}))
}
@@ -427,6 +626,8 @@ pub async fn update_rule(
updated_at: rule.updated_at,
created_by: rule.created_by,
updated_by: rule.updated_by,
+ affected_details_count: 0,
+ affected_details: Vec::new(),
}))
}
diff --git a/apps/labrinth/src/routes/internal/moderation/tech_review/rules_scan.rs b/apps/labrinth/src/routes/internal/moderation/tech_review/rules_scan.rs
index 4ee7f4c595..e6895558ac 100644
--- a/apps/labrinth/src/routes/internal/moderation/tech_review/rules_scan.rs
+++ b/apps/labrinth/src/routes/internal/moderation/tech_review/rules_scan.rs
@@ -1,6 +1,6 @@
use std::collections::{BTreeMap, HashMap};
-use actix_web::{HttpRequest, HttpResponse, post, web};
+use actix_web::{HttpRequest, HttpResponse, get, post, web};
use ariadne::ids::base62_impl::to_base62;
use bytes::Bytes;
use eyre::{Context as _, Result, eyre};
@@ -9,6 +9,7 @@ use serde::Serialize;
use sqlx::types::Json;
use tokio::sync::mpsc;
use tokio_stream::wrappers::UnboundedReceiverStream;
+use utoipa::{PartialSchema, ToSchema};
use super::rules::DelphiRuleEffect;
use crate::{
@@ -26,7 +27,7 @@ const RULE_SCAN_LOCK_ID: i64 = 0x6465_6c70_6869_7275;
const PROGRESS_INTERVAL: usize = 50;
pub fn config(cfg: &mut actix_web::web::ServiceConfig) {
- cfg.service(scan_rules);
+ cfg.service(get_rule_schema).service(scan_rules);
}
#[derive(Serialize)]
@@ -43,41 +44,41 @@ struct RuleScanErrorEvent<'a> {
message: &'a str,
}
-#[derive(Serialize)]
-struct RuleInput {
- schema_version: u32,
- trace: RuleTrace,
- scan: RuleScan,
- artifact: RuleArtifact,
- scope: RuleScope,
+#[derive(Serialize, utoipa::ToSchema)]
+pub(super) struct RuleInput {
+ pub(super) schema_version: u32,
+ pub(super) trace: RuleTrace,
+ pub(super) scan: RuleScan,
+ pub(super) artifact: RuleArtifact,
+ pub(super) scope: RuleScope,
}
-#[derive(Serialize)]
-struct RuleTrace {
- key: String,
- issue_type: String,
- severity: DelphiSeverity,
- jar: Option,
- file_path: String,
- data: HashMap,
+#[derive(Serialize, utoipa::ToSchema)]
+pub(super) struct RuleTrace {
+ pub(super) key: String,
+ pub(super) issue_type: String,
+ pub(super) severity: DelphiSeverity,
+ pub(super) jar: Option,
+ pub(super) file_path: String,
+ pub(super) data: HashMap,
}
-#[derive(Serialize)]
-struct RuleScan {
- delphi_version: i32,
+#[derive(Serialize, utoipa::ToSchema)]
+pub(super) struct RuleScan {
+ pub(super) delphi_version: i32,
}
-#[derive(Serialize)]
-struct RuleArtifact {
- size: Option,
- hashes: BTreeMap,
+#[derive(Serialize, utoipa::ToSchema)]
+pub(super) struct RuleArtifact {
+ pub(super) size: Option,
+ pub(super) hashes: BTreeMap,
}
-#[derive(Serialize)]
-struct RuleScope {
- project_id: Option,
- version_id: Option,
- file_id: Option,
+#[derive(Serialize, utoipa::ToSchema)]
+pub(super) struct RuleScope {
+ pub(super) project_id: Option,
+ pub(super) version_id: Option,
+ pub(super) file_id: Option,
}
struct CompiledRule {
@@ -98,6 +99,62 @@ struct ScanSummary {
effects: usize,
}
+#[derive(Serialize, utoipa::ToSchema)]
+pub struct DelphiRuleSchemaResponse {
+ pub input: serde_json::Value,
+ pub output: serde_json::Value,
+ pub components: BTreeMap,
+}
+
+/// Get the schemas for the CEL input and output values.
+#[utoipa::path(
+ context_path = "/moderation/tech-review",
+ tag = "moderation",
+ security(("bearer_auth" = [])),
+ responses((status = OK, body = DelphiRuleSchemaResponse))
+)]
+#[get("/rules/schema")]
+pub async fn get_rule_schema(
+ req: HttpRequest,
+ pool: web::Data,
+ redis: web::Data,
+ session_queue: web::Data,
+) -> Result, ApiError> {
+ check_is_moderator_from_headers(
+ &req,
+ &**pool,
+ &redis,
+ &session_queue,
+ Scopes::PROJECT_READ,
+ )
+ .await?;
+
+ let mut schemas = Vec::new();
+ ::schemas(&mut schemas);
+ as ToSchema>::schemas(&mut schemas);
+
+ Ok(web::Json(DelphiRuleSchemaResponse {
+ input: schema_to_value(::schema())?,
+ output: schema_to_value(
+ as PartialSchema>::schema(),
+ )?,
+ components: schemas
+ .into_iter()
+ .map(|(name, schema)| Ok((name, schema_to_value(schema)?)))
+ .collect::>()?,
+ }))
+}
+
+fn schema_to_value(
+ schema: T,
+) -> Result {
+ serde_json::to_value(schema).map_err(|error| {
+ ApiError::Internal(
+ eyre!(error).wrap_err("failed to serialize Delphi rule schema"),
+ )
+ })
+}
+
/// Re-evaluate every Delphi issue detail and atomically publish a new rule revision.
#[utoipa::path(
context_path = "/moderation/tech-review",
@@ -316,12 +373,13 @@ async fn run_scan(
};
for rule in &rules {
- let effect = evaluate_rule(&rule.program, &input).wrap_err_with(|| {
- format!(
- "failed to evaluate delphi rule {} for detail {detail_id}",
- rule.id
- )
- })?;
+ let effect = evaluate_rule(&rule.program, &input)
+ .wrap_err_with(|| {
+ format!(
+ "failed to evaluate delphi rule {} for detail {detail_id}",
+ rule.id
+ )
+ })?;
if let Some(effect) = effect {
effects.push(MaterializedEffect {
detail_id,
diff --git a/packages/api-client/src/modules/labrinth/tech-review/internal.ts b/packages/api-client/src/modules/labrinth/tech-review/internal.ts
index c66520baa8..5cf7e278fb 100644
--- a/packages/api-client/src/modules/labrinth/tech-review/internal.ts
+++ b/packages/api-client/src/modules/labrinth/tech-review/internal.ts
@@ -17,6 +17,30 @@ export class LabrinthTechReviewInternalModule extends AbstractModule {
)
}
+ public async getRuleSchema(): Promise {
+ return this.client.request(
+ '/moderation/tech-review/rules/schema',
+ {
+ api: 'labrinth',
+ version: 'internal',
+ method: 'GET',
+ },
+ )
+ }
+
+ public async getRuleAffectedDetails(
+ id: number,
+ ): Promise {
+ return this.client.request(
+ `/moderation/tech-review/rules/${id}/effects`,
+ {
+ api: 'labrinth',
+ version: 'internal',
+ method: 'GET',
+ },
+ )
+ }
+
public async testRule(
request: Labrinth.TechReview.Internal.TestDelphiRuleRequest,
): Promise {
diff --git a/packages/api-client/src/modules/labrinth/types.ts b/packages/api-client/src/modules/labrinth/types.ts
index 9d97f1ec5a..8f9e55939d 100644
--- a/packages/api-client/src/modules/labrinth/types.ts
+++ b/packages/api-client/src/modules/labrinth/types.ts
@@ -2235,6 +2235,26 @@ export namespace Labrinth {
updated_at: string
created_by: number | null
updated_by: number | null
+ affected_details_count: number
+ affected_details: DelphiRuleAffectedDetail[]
+ }
+
+ export type DelphiRuleAffectedDetail = {
+ detail_id: string
+ issue_id: string
+ project_id: string | null
+ project_name: string | null
+ project_icon_url: string | null
+ version_id: string | null
+ version_name: string | null
+ version_number: string | null
+ issue_type: string
+ key: string
+ jar: string | null
+ file_path: string
+ original_severity: DelphiSeverity
+ severity: DelphiSeverity | null
+ hidden: boolean
}
export type WriteDelphiRule = {
@@ -2261,6 +2281,14 @@ export namespace Labrinth {
hidden: boolean
}
+ export type DelphiRuleSchema = Record
+
+ export type DelphiRuleSchemaResponse = {
+ input: DelphiRuleSchema
+ output: DelphiRuleSchema
+ components: Record
+ }
+
export type TestDelphiRuleResponse = {
effects: Array
}
From 4b07ed720ed92aae253447d75a52546bc97cba34 Mon Sep 17 00:00:00 2001
From: aecsocket <43144841+aecsocket@users.noreply.github.com>
Date: Thu, 23 Jul 2026 09:12:37 +0100
Subject: [PATCH 6/7] remove old ui
---
.../moderation/technical-review/rules.vue | 22 -------------------
1 file changed, 22 deletions(-)
diff --git a/apps/frontend/src/pages/moderation/technical-review/rules.vue b/apps/frontend/src/pages/moderation/technical-review/rules.vue
index 6cf23d476a..254415f84d 100644
--- a/apps/frontend/src/pages/moderation/technical-review/rules.vue
+++ b/apps/frontend/src/pages/moderation/technical-review/rules.vue
@@ -226,28 +226,6 @@
/>
-
- CEL contract and input
-
-
- Effects are maps such as
- { "severity": "low", "hidden": false }. Severity can be low,
- medium, high, or severe.
-
-
- Rules run in the order shown below. The first rule that returns a non-null effect wins.
-
-
- The input object contains schema_version,
- trace (key, issue_type, severity,
- jar, file_path, data),
- scan.delphi_version, artifact (size,
- hashes), and stable IDs under scope (project_id,
- version_id, file_id).
-
-
-
From 8d82c228cf032752a90220b9f6db4a82bcf54fdc Mon Sep 17 00:00:00 2001
From: aecsocket <43144841+aecsocket@users.noreply.github.com>
Date: Fri, 24 Jul 2026 13:49:20 +0100
Subject: [PATCH 7/7] rules affect tech review detail statuses
---
.../moderation/GlobalDetailLocalTraceCard.vue | 22 +-
.../ui/moderation/GlobalDetailTracesList.vue | 11 +-
.../ui/moderation/IssueDetailPath.vue | 74 +++
.../ui/moderation/ModerationTechRevCard.vue | 82 ++-
.../pages/moderation/global-traces/[key].vue | 11 +-
.../moderation/technical-review/rules.vue | 13 +-
...23120000_delphi_effective_rule_details.sql | 37 ++
.../src/routes/internal/delphi/mod.rs | 11 +-
.../src/routes/internal/delphi/rescan.rs | 2 +
.../internal/delphi/tech_review_sync.rs | 111 ++--
apps/labrinth/src/routes/internal/mod.rs | 1 +
.../src/routes/internal/moderation/mod.rs | 4 +
.../routes/internal/moderation/tech_review.rs | 54 +-
.../internal/moderation/tech_review/global.rs | 4 +
.../moderation/tech_review/rules_scan.rs | 484 ++++++++++++++----
.../modules/labrinth/tech-review/internal.ts | 13 +
.../api-client/src/modules/labrinth/types.ts | 24 +
17 files changed, 754 insertions(+), 204 deletions(-)
create mode 100644 apps/frontend/src/components/ui/moderation/IssueDetailPath.vue
create mode 100644 apps/labrinth/migrations/20260723120000_delphi_effective_rule_details.sql
diff --git a/apps/frontend/src/components/ui/moderation/GlobalDetailLocalTraceCard.vue b/apps/frontend/src/components/ui/moderation/GlobalDetailLocalTraceCard.vue
index a6756ce443..8329b64b33 100644
--- a/apps/frontend/src/components/ui/moderation/GlobalDetailLocalTraceCard.vue
+++ b/apps/frontend/src/components/ui/moderation/GlobalDetailLocalTraceCard.vue
@@ -5,14 +5,8 @@
{{ trace.project_name }}
-
- {{ trace.version_number }}
-
- {{ decodeTracePath(trace.file_name) }}
-
-
- {{ decodeTracePath(trace.jar) }}
-
+
+
@@ -33,9 +27,11 @@
diff --git a/apps/frontend/src/components/ui/moderation/GlobalDetailTracesList.vue b/apps/frontend/src/components/ui/moderation/GlobalDetailTracesList.vue
index 8d42abbc1e..1d4fd8cb8a 100644
--- a/apps/frontend/src/components/ui/moderation/GlobalDetailTracesList.vue
+++ b/apps/frontend/src/components/ui/moderation/GlobalDetailTracesList.vue
@@ -65,7 +65,7 @@
Path
- {{ decodeTracePath(getLatestLocalTrace(trace)?.file_path ?? '') }}
+
@@ -133,6 +133,7 @@ import {
} from '@modrinth/ui'
import GlobalDetailLocalTraceCard from '~/components/ui/moderation/GlobalDetailLocalTraceCard.vue'
+import IssueDetailPath from '~/components/ui/moderation/IssueDetailPath.vue'
const client = injectModrinthClient()
const { addNotification } = injectNotificationManager()
@@ -165,14 +166,6 @@ function getLatestLocalTrace(trace: Labrinth.TechReview.Internal.GlobalIssueDeta
return trace.local_traces.at(-1)
}
-function decodeTracePath(path: string): string {
- try {
- return decodeURIComponent(path)
- } catch {
- return path
- }
-}
-
function getSeverityBadgeColor(
severity: Labrinth.TechReview.Internal.DelphiSeverity | undefined,
): string {
diff --git a/apps/frontend/src/components/ui/moderation/IssueDetailPath.vue b/apps/frontend/src/components/ui/moderation/IssueDetailPath.vue
new file mode 100644
index 0000000000..6289a9cd56
--- /dev/null
+++ b/apps/frontend/src/components/ui/moderation/IssueDetailPath.vue
@@ -0,0 +1,74 @@
+
+
+
+
+
+ {{ formatSegment(segment) }}
+
+
+
+
+
+
diff --git a/apps/frontend/src/components/ui/moderation/ModerationTechRevCard.vue b/apps/frontend/src/components/ui/moderation/ModerationTechRevCard.vue
index f91bd67552..3e595510ca 100644
--- a/apps/frontend/src/components/ui/moderation/ModerationTechRevCard.vue
+++ b/apps/frontend/src/components/ui/moderation/ModerationTechRevCard.vue
@@ -6,7 +6,6 @@ import {
CheckCheckIcon,
CheckIcon,
ChevronDownIcon,
- ChevronRightIcon,
ClipboardCopyIcon,
CodeIcon,
CopyIcon,
@@ -49,6 +48,7 @@ import {
import dayjs from 'dayjs'
import { computed, nextTick, reactive, ref, watch } from 'vue'
+import IssueDetailPath from '~/components/ui/moderation/IssueDetailPath.vue'
import type { UnsafeFile } from '~/components/ui/moderation/MaliciousSummaryModal.vue'
import ThreadView from '~/components/ui/thread/ThreadView.vue'
@@ -601,6 +601,29 @@ async function copyToClipboard(code: string, detailId: string) {
}
}
+async function copyDetailCelInput(detailId: string) {
+ if (copyingCelDetails.has(detailId)) return
+
+ copyingCelDetails.add(detailId)
+ try {
+ const input = await client.labrinth.tech_review_internal.getDetailRuleInput(detailId)
+ await navigator.clipboard.writeText(JSON.stringify(input, null, 2))
+ copiedCelDetails.add(detailId)
+ setTimeout(() => {
+ copiedCelDetails.delete(detailId)
+ }, 2000)
+ } catch (error) {
+ console.error('Failed to copy CEL input:', error)
+ addNotification({
+ type: 'error',
+ title: 'Failed to copy CEL input',
+ text: 'An error occurred while loading the trace rule input.',
+ })
+ } finally {
+ copyingCelDetails.delete(detailId)
+ }
+}
+
function getDetailDecision(
detailId: string,
backendStatus: Labrinth.TechReview.Internal.DelphiReportIssueStatus,
@@ -999,6 +1022,8 @@ async function updateGlobalDetailStatus(
const expandedClasses = reactive
>(new Set())
const autoExpandedFileIds = reactive>(new Set())
const showCopyFeedback = reactive>(new Map())
+const copyingCelDetails = reactive>(new Set())
+const copiedCelDetails = reactive>(new Set())
const highlightedSourceCache = reactive>(new Map())
const LAZY_LOAD_CLASS_SOURCE_MINIMUM = 2
@@ -1025,7 +1050,7 @@ interface JarGroup {
function splitJarSegments(jar: string | null, currentFileName: string | null): string[] {
if (!jar) return []
const segments = jar
- .split(/[/#]/)
+ .split('#')
.map((s) => decodeURIComponent(s.trim()))
.filter((s) => s.length > 0)
// Skip the first segment if it matches the current file tab (it's already shown in the file list)
@@ -1770,27 +1795,12 @@ function copyId() {
class="border-b border-solid border-surface-1 px-4 py-3"
>
-
-
-
- {{ segment }}
-
-
-
-
+
-
{{
- truncateMiddle(classItem.filePath)
- }}
+
+
+
+
@@ -103,6 +103,7 @@ import {
} from '@modrinth/ui'
import GlobalDetailLocalTraceCard from '~/components/ui/moderation/GlobalDetailLocalTraceCard.vue'
+import IssueDetailPath from '~/components/ui/moderation/IssueDetailPath.vue'
const client = injectModrinthClient()
const { addNotification } = injectNotificationManager()
@@ -137,14 +138,6 @@ const pageEnd = computed(() =>
)
const latestLocalTrace = computed(() => trace.value?.local_traces.at(-1))
-function decodeTracePath(path: string): string {
- try {
- return decodeURIComponent(path)
- } catch {
- return path
- }
-}
-
function getSeverityBadgeColor(severity: Labrinth.TechReview.Internal.DelphiSeverity): string {
switch (severity) {
case 'severe':
diff --git a/apps/frontend/src/pages/moderation/technical-review/rules.vue b/apps/frontend/src/pages/moderation/technical-review/rules.vue
index 254415f84d..66035cd75e 100644
--- a/apps/frontend/src/pages/moderation/technical-review/rules.vue
+++ b/apps/frontend/src/pages/moderation/technical-review/rules.vue
@@ -327,11 +327,11 @@
-
- {{ detail.jar }}
-
-
- {{ detail.file_path }}
+
@@ -385,7 +385,6 @@
import { type Labrinth, SseParser } from '@modrinth/api-client'
import {
ArrowLeftIcon,
- ChevronRightIcon,
EditIcon,
EyeOffIcon,
ExternalIcon,
@@ -409,6 +408,8 @@ import { useDebounceFn } from '@vueuse/core'
import type { Ace } from 'ace-builds'
import type { Component } from 'vue'
+import IssueDetailPath from '~/components/ui/moderation/IssueDetailPath.vue'
+
const DEFAULT_RULE = `input.trace.issue_type == "OBFUSCATED_NAMES"
? {"severity": "low", "hidden": false}
: null`
diff --git a/apps/labrinth/migrations/20260723120000_delphi_effective_rule_details.sql b/apps/labrinth/migrations/20260723120000_delphi_effective_rule_details.sql
new file mode 100644
index 0000000000..65dc4e2536
--- /dev/null
+++ b/apps/labrinth/migrations/20260723120000_delphi_effective_rule_details.sql
@@ -0,0 +1,37 @@
+DROP VIEW delphi_issue_details_with_statuses;
+
+CREATE VIEW delphi_issue_details_with_statuses AS
+SELECT
+ drid.id,
+ drid.issue_id,
+ drid.key,
+ drid.jar,
+ drid.file_path,
+ drid.decompiled_source,
+ drid.data,
+ drid.severity AS original_severity,
+ COALESCE(dre.severity, drid.severity) AS severity,
+ COALESCE(dre.hidden, FALSE) AS hidden,
+ m.id AS project_id,
+ didv.verdict AS local_status,
+ dgdv.verdict AS global_status,
+ COALESCE(dgdv.verdict, didv.verdict, 'pending') AS status
+FROM delphi_report_issue_details drid
+INNER JOIN delphi_report_issues dri ON dri.id = drid.issue_id
+INNER JOIN delphi_reports dr ON dr.id = dri.report_id
+INNER JOIN files f ON f.id = dr.file_id
+INNER JOIN versions v ON v.id = f.version_id
+INNER JOIN mods m ON m.id = v.mod_id
+LEFT JOIN delphi_global_detail_verdicts dgdv
+ ON drid.key = dgdv.detail_key
+LEFT JOIN delphi_issue_detail_verdicts didv
+ ON m.id = didv.project_id
+ AND drid.key = didv.detail_key
+LEFT JOIN (
+ SELECT revision
+ FROM delphi_rule_revisions
+ LIMIT 1
+) drr ON TRUE
+LEFT JOIN delphi_rule_effects dre
+ ON dre.revision = drr.revision
+ AND dre.detail_id = drid.id;
diff --git a/apps/labrinth/src/routes/internal/delphi/mod.rs b/apps/labrinth/src/routes/internal/delphi/mod.rs
index cf92fc312b..ed275dfb6c 100644
--- a/apps/labrinth/src/routes/internal/delphi/mod.rs
+++ b/apps/labrinth/src/routes/internal/delphi/mod.rs
@@ -210,6 +210,7 @@ async fn ingest_report_deserialized(
"Delphi found issues in file",
);
+ let mut inserted_detail_ids = Vec::new();
for (issue_type, issue_details) in report.issues {
let issue_id = DBDelphiReportIssue {
id: DelphiReportIssueId(0), // This will be set by the database
@@ -229,7 +230,7 @@ async fn ingest_report_deserialized(
let decompiled_source =
report.decompiled_sources.get(&issue_detail.file);
- ReportIssueDetail {
+ let detail_id = ReportIssueDetail {
id: DelphiReportIssueDetailsId(0), // This will be set by the database
issue_id,
key: issue_detail.key.0,
@@ -245,9 +246,17 @@ async fn ingest_report_deserialized(
.insert(&mut transaction)
.await
.wrap_internal_err("failed to insert Delphi issue detail")?;
+ inserted_detail_ids.push(detail_id);
}
}
+ crate::routes::internal::moderation::tech_review::rules_scan::materialize_current_rule_effects(
+ &inserted_detail_ids,
+ &mut transaction,
+ )
+ .await
+ .wrap_internal_err("failed to apply delphi rules to new issue details")?;
+
tech_review_sync::sync_project_tech_review_state(
&[DBProjectId::from(report.project_id)],
tech_review_sync::TechReviewExitReason::Resolved,
diff --git a/apps/labrinth/src/routes/internal/delphi/rescan.rs b/apps/labrinth/src/routes/internal/delphi/rescan.rs
index c7d7fa297b..cbaefd58f7 100644
--- a/apps/labrinth/src/routes/internal/delphi/rescan.rs
+++ b/apps/labrinth/src/routes/internal/delphi/rescan.rs
@@ -105,6 +105,7 @@ async fn fetch_unreviewed_tech_review_project_ids(
WHERE
didws.project_id = m.id
AND didws.status = 'pending'
+ AND NOT didws.hidden
-- see delphi.rs todo comment
AND dri.issue_type != '__dummy'
)
@@ -115,6 +116,7 @@ async fn fetch_unreviewed_tech_review_project_ids(
WHERE
didws.project_id = m.id
AND didws.status IN ('safe', 'unsafe')
+ AND NOT didws.hidden
-- see delphi.rs todo comment
AND dri.issue_type != '__dummy'
)
diff --git a/apps/labrinth/src/routes/internal/delphi/tech_review_sync.rs b/apps/labrinth/src/routes/internal/delphi/tech_review_sync.rs
index 23a45d218a..974db515d0 100644
--- a/apps/labrinth/src/routes/internal/delphi/tech_review_sync.rs
+++ b/apps/labrinth/src/routes/internal/delphi/tech_review_sync.rs
@@ -60,9 +60,11 @@ const DUMMY_ISSUE_TYPE: &str = "__dummy";
pub enum TechReviewExitReason {
Resolved,
FileDeleted,
+ RulesChanged,
}
struct ProjectTechReviewState {
+ project_id: DBProjectId,
has_pending_detail: bool,
has_unsafe_detail: bool,
has_dummy: bool,
@@ -88,36 +90,35 @@ pub async fn sync_project_tech_review_state(
r#"
WITH project_ids AS (
SELECT unnest($1::bigint[]) AS project_id
- )
- SELECT
- p.project_id AS "project_id!: DBProjectId",
- EXISTS(
- SELECT 1
- FROM delphi_issue_details_with_statuses didws
- INNER JOIN delphi_report_issues dri ON dri.id = didws.issue_id
- WHERE
- didws.project_id = p.project_id
- AND didws.status = 'pending'
+ ),
+ project_detail_state AS (
+ SELECT
+ p.project_id,
+ COALESCE(BOOL_OR(
+ didws.status = 'pending'
+ AND NOT didws.hidden
AND dri.issue_type != $3
- ) AS "has_pending_detail!",
- EXISTS(
- SELECT 1
- FROM delphi_issue_details_with_statuses didws
- INNER JOIN delphi_report_issues dri ON dri.id = didws.issue_id
- WHERE
- didws.project_id = p.project_id
- AND didws.status = 'unsafe'
+ ), FALSE) AS has_pending_detail,
+ COALESCE(BOOL_OR(
+ didws.status = 'unsafe'
+ AND NOT didws.hidden
AND dri.issue_type != $3
- ) AS "has_unsafe_detail!",
- EXISTS(
- SELECT 1
- FROM delphi_issue_details_with_statuses didws
- INNER JOIN delphi_report_issues dri ON dri.id = didws.issue_id
- WHERE
- didws.project_id = p.project_id
- AND didws.status = 'pending'
+ ), FALSE) AS has_unsafe_detail,
+ COALESCE(BOOL_OR(
+ didws.status = 'pending'
AND dri.issue_type = $3
- ) AS "has_dummy!",
+ ), FALSE) AS has_dummy
+ FROM project_ids p
+ LEFT JOIN delphi_issue_details_with_statuses didws
+ ON didws.project_id = p.project_id
+ LEFT JOIN delphi_report_issues dri ON dri.id = didws.issue_id
+ GROUP BY p.project_id
+ )
+ SELECT
+ p.project_id AS "project_id!: DBProjectId",
+ p.has_pending_detail AS "has_pending_detail!",
+ p.has_unsafe_detail AS "has_unsafe_detail!",
+ p.has_dummy AS "has_dummy!",
(
SELECT t.id
FROM threads t
@@ -144,7 +145,7 @@ pub async fn sync_project_tech_review_state(
ORDER BY dr.created DESC, dr.id DESC
LIMIT 1
) AS "report_id: DelphiReportId"
- FROM project_ids p
+ FROM project_detail_state p
"#,
&project_ids_raw,
&tech_review_message_types,
@@ -156,6 +157,7 @@ pub async fn sync_project_tech_review_state(
for row in rows {
let state = ProjectTechReviewState {
+ project_id: row.project_id,
has_pending_detail: row.has_pending_detail,
has_unsafe_detail: row.has_unsafe_detail,
has_dummy: row.has_dummy,
@@ -250,8 +252,23 @@ async fn sync_one_project_tech_review_state(
exit_reason: TechReviewExitReason,
txn: &mut PgTransaction<'_>,
) -> Result<(), ApiError> {
- let needs_tech_review =
- state.has_pending_detail || state.has_unsafe_detail || state.has_dummy;
+ let has_review_detail = state.has_pending_detail || state.has_unsafe_detail;
+
+ if matches!(exit_reason, TechReviewExitReason::RulesChanged)
+ && !has_review_detail
+ {
+ remove_dummy_issue_details(state.project_id, txn).await?;
+
+ if let Some(thread_id) = state.thread_id
+ && should_send_exit(state.last_tech_review_message_type.as_deref())
+ {
+ insert_exit_message(thread_id, exit_reason, txn).await?;
+ }
+
+ return Ok(());
+ }
+
+ let needs_tech_review = has_review_detail || state.has_dummy;
if needs_tech_review {
if (state.has_pending_detail || state.has_unsafe_detail)
@@ -325,7 +342,9 @@ async fn insert_exit_message(
txn: &mut PgTransaction<'_>,
) -> Result<(), ApiError> {
let body = match exit_reason {
- TechReviewExitReason::Resolved => MessageBody::TechReviewExited,
+ TechReviewExitReason::Resolved | TechReviewExitReason::RulesChanged => {
+ MessageBody::TechReviewExited
+ }
TechReviewExitReason::FileDeleted => {
MessageBody::TechReviewExitFileDeleted
}
@@ -344,6 +363,36 @@ async fn insert_exit_message(
Ok(())
}
+async fn remove_dummy_issue_details(
+ project_id: DBProjectId,
+ txn: &mut PgTransaction<'_>,
+) -> Result<(), ApiError> {
+ sqlx::query!(
+ r#"
+ DELETE FROM delphi_report_issue_details detail
+ USING
+ delphi_report_issues issue,
+ delphi_reports report,
+ files file,
+ versions version
+ WHERE
+ detail.issue_id = issue.id
+ AND issue.issue_type = $2
+ AND issue.report_id = report.id
+ AND report.file_id = file.id
+ AND file.version_id = version.id
+ AND version.mod_id = $1
+ "#,
+ project_id as DBProjectId,
+ DUMMY_ISSUE_TYPE,
+ )
+ .execute(&mut *txn)
+ .await
+ .wrap_internal_err("failed to remove dummy Delphi issue details")?;
+
+ Ok(())
+}
+
async fn ensure_dummy_issue_detail(
report_id: DelphiReportId,
txn: &mut PgTransaction<'_>,
diff --git a/apps/labrinth/src/routes/internal/mod.rs b/apps/labrinth/src/routes/internal/mod.rs
index 6dc3734377..c01423a488 100644
--- a/apps/labrinth/src/routes/internal/mod.rs
+++ b/apps/labrinth/src/routes/internal/mod.rs
@@ -122,6 +122,7 @@ pub fn config(cfg: &mut web::ServiceConfig) {
moderation::tech_review::rules::update_rule,
moderation::tech_review::rules::delete_rule,
moderation::tech_review::rules_scan::get_rule_schema,
+ moderation::tech_review::rules_scan::get_detail_rule_input,
moderation::tech_review::rules_scan::scan_rules,
moderation::tech_review::get_project_report,
moderation::tech_review::submit_report,
diff --git a/apps/labrinth/src/routes/internal/moderation/mod.rs b/apps/labrinth/src/routes/internal/moderation/mod.rs
index 7b3dac3ca1..e745939f89 100644
--- a/apps/labrinth/src/routes/internal/moderation/mod.rs
+++ b/apps/labrinth/src/routes/internal/moderation/mod.rs
@@ -295,6 +295,7 @@ pub async fn get_projects_internal(
FROM delphi_issue_details_with_statuses didws
WHERE didws.project_id = m.id
AND didws.status = 'pending'
+ AND NOT didws.hidden
)
)
),
@@ -542,6 +543,7 @@ pub async fn get_projects_internal(
FROM delphi_issue_details_with_statuses didws
WHERE didws.project_id = m.id
AND didws.status = 'pending'
+ AND NOT didws.hidden
)
)
),
@@ -770,6 +772,7 @@ pub async fn get_project_ids(
FROM delphi_issue_details_with_statuses didws
WHERE didws.project_id = m.id
AND didws.status = 'pending'
+ AND NOT didws.hidden
)
)
),
@@ -898,6 +901,7 @@ pub async fn get_project_ids(
FROM delphi_issue_details_with_statuses didws
WHERE didws.project_id = mods.id
AND didws.status = 'pending'
+ AND NOT didws.hidden
)
)
ORDER BY
diff --git a/apps/labrinth/src/routes/internal/moderation/tech_review.rs b/apps/labrinth/src/routes/internal/moderation/tech_review.rs
index 92b230cd79..853d0b05fb 100644
--- a/apps/labrinth/src/routes/internal/moderation/tech_review.rs
+++ b/apps/labrinth/src/routes/internal/moderation/tech_review.rs
@@ -254,7 +254,9 @@ pub async fn get_issue(
)
), '[]'::jsonb)
FROM delphi_issue_details_with_statuses didws
- WHERE didws.issue_id = dri.id
+ WHERE
+ didws.issue_id = dri.id
+ AND NOT didws.hidden
)
) AS "data!: sqlx::types::Json"
FROM delphi_report_issues dri
@@ -309,6 +311,16 @@ pub async fn get_report(
'file_size', f.size,
'flag_reason', 'delphi',
'download_url', f.url,
+ 'severity', COALESCE((
+ SELECT MAX(didws.severity)
+ FROM delphi_report_issues severity_issue
+ INNER JOIN delphi_issue_details_with_statuses didws
+ ON didws.issue_id = severity_issue.id
+ WHERE
+ severity_issue.report_id = dr.id
+ AND severity_issue.issue_type != '__dummy'
+ AND NOT didws.hidden
+ ), 'low'::delphi_severity),
-- TODO: replace with `json_array` in Postgres 16
'issues', (
SELECT coalesce(json_agg(
@@ -331,15 +343,24 @@ pub async fn get_report(
)
), '[]'::jsonb)
FROM delphi_issue_details_with_statuses didws
- WHERE didws.issue_id = dri.id
+ WHERE
+ didws.issue_id = dri.id
+ AND NOT didws.hidden
)
)
), '[]'::json)
FROM delphi_report_issues dri
WHERE
- dri.report_id = dr.id
+ dri.report_id = dr.id
-- see delphi.rs todo comment
AND dri.issue_type != '__dummy'
+ AND EXISTS (
+ SELECT 1
+ FROM delphi_issue_details_with_statuses visible_detail
+ WHERE
+ visible_detail.issue_id = dri.id
+ AND NOT visible_detail.hidden
+ )
)
) AS "data!: sqlx::types::Json"
FROM delphi_reports dr
@@ -534,7 +555,9 @@ async fn fetch_project_reports(
didws.global_status AS "global_status?: DelphiStatus",
didws.status AS "status!: DelphiStatus"
FROM delphi_issue_details_with_statuses didws
- WHERE didws.issue_id = ANY($1::bigint[])
+ WHERE
+ didws.issue_id = ANY($1::bigint[])
+ AND NOT didws.hidden
ORDER BY didws.issue_id, didws.id
"#,
&issue_ids.iter().map(|i| i.0).collect::>()
@@ -640,6 +663,10 @@ async fn fetch_project_reports(
.get(&issue_row.id)
.unwrap_or(&empty_details);
+ if issue_details.is_empty() {
+ continue;
+ }
+
file_issues.push(FileIssue {
id: issue_row.id,
report_id: issue_row.report_id,
@@ -648,12 +675,23 @@ async fn fetch_project_reports(
});
}
+ if file_issues.is_empty() {
+ continue;
+ }
+
+ let severity = file_issues
+ .iter()
+ .flat_map(|issue| issue.details.iter())
+ .map(|detail| detail.severity)
+ .max()
+ .unwrap_or(report_row.severity);
+
file_reports.push(FileReport {
report_id: report_row.report_id,
file_id: FileId::from(file_row.file_id),
created: report_row.created,
flag_reason: FlagReason::Delphi,
- severity: report_row.severity,
+ severity,
file_name: file_row.filename.clone(),
file_size: file_row.size,
download_url: file_row.url.clone(),
@@ -784,6 +822,7 @@ pub async fn search_projects(
AND (cardinality($6::text[]) = 0 OR m.status = ANY($6::text[]))
AND (cardinality($7::text[]) = 0 OR dri.issue_type = ANY($7::text[]))
AND didws.status = 'pending'
+ AND NOT didws.hidden
AND (
$5::text IS NULL
OR ($5::text = 'unreplied' AND (tm_last.id IS NULL OR u_last.role IS NULL OR u_last.role NOT IN ('moderator', 'admin')))
@@ -793,8 +832,8 @@ pub async fn search_projects(
ORDER BY
CASE WHEN $3 = 'created_asc' THEN MIN(dr.created) ELSE TO_TIMESTAMP(0) END ASC,
CASE WHEN $3 = 'created_desc' THEN MIN(dr.created) ELSE TO_TIMESTAMP(0) END DESC,
- CASE WHEN $3 = 'severity_asc' THEN MAX(dr.severity) ELSE 'low'::delphi_severity END ASC,
- CASE WHEN $3 = 'severity_desc' THEN MAX(dr.severity) ELSE 'low'::delphi_severity END DESC,
+ CASE WHEN $3 = 'severity_asc' THEN MAX(didws.severity) ELSE 'low'::delphi_severity END ASC,
+ CASE WHEN $3 = 'severity_desc' THEN MAX(didws.severity) ELSE 'low'::delphi_severity END DESC,
-- tie-breaker: oldest reports
MIN(dr.created) ASC
LIMIT $1 OFFSET $2
@@ -1039,6 +1078,7 @@ pub async fn submit_report(
WHERE
m.id = $1
AND didws.status = 'pending'
+ AND NOT didws.hidden
-- see delphi.rs todo comment
AND dri.issue_type != '__dummy'
"#,
diff --git a/apps/labrinth/src/routes/internal/moderation/tech_review/global.rs b/apps/labrinth/src/routes/internal/moderation/tech_review/global.rs
index 82aa8055b1..09f47d3ea3 100644
--- a/apps/labrinth/src/routes/internal/moderation/tech_review/global.rs
+++ b/apps/labrinth/src/routes/internal/moderation/tech_review/global.rs
@@ -188,6 +188,7 @@ pub async fn search_global_issue_details(
FROM delphi_global_detail_verdicts dgdv
LEFT JOIN delphi_issue_details_with_statuses didws
ON didws.key = dgdv.detail_key
+ AND NOT didws.hidden
LEFT JOIN delphi_report_issues dri
ON dri.id = didws.issue_id
AND dri.issue_type != '__dummy'
@@ -248,6 +249,7 @@ pub async fn search_global_issue_details(
AND didv.detail_key = didws.key
WHERE
didws.key = ANY($1::text[])
+ AND NOT didws.hidden
AND dri.issue_type != '__dummy'
)
SELECT
@@ -367,6 +369,7 @@ pub async fn get_global_issue_detail(
FROM delphi_global_detail_verdicts dgdv
LEFT JOIN delphi_issue_details_with_statuses didws
ON didws.key = dgdv.detail_key
+ AND NOT didws.hidden
LEFT JOIN delphi_report_issues dri
ON dri.id = didws.issue_id
AND dri.issue_type != '__dummy'
@@ -412,6 +415,7 @@ pub async fn get_global_issue_detail(
WHERE
didws.key = $1
AND ($2::bigint IS NULL OR didws.id > $2)
+ AND NOT didws.hidden
AND dri.issue_type != '__dummy'
ORDER BY didws.id
LIMIT $3
diff --git a/apps/labrinth/src/routes/internal/moderation/tech_review/rules_scan.rs b/apps/labrinth/src/routes/internal/moderation/tech_review/rules_scan.rs
index e6895558ac..c3f9d79d21 100644
--- a/apps/labrinth/src/routes/internal/moderation/tech_review/rules_scan.rs
+++ b/apps/labrinth/src/routes/internal/moderation/tech_review/rules_scan.rs
@@ -12,10 +12,17 @@ use tokio_stream::wrappers::UnboundedReceiverStream;
use utoipa::{PartialSchema, ToSchema};
use super::rules::DelphiRuleEffect;
+use crate::routes::internal::delphi::tech_review_sync::{
+ self, TechReviewExitReason,
+};
use crate::{
auth::check_is_moderator_from_headers,
database::{
- PgPool, PgTransaction, models::delphi_report_item::DelphiSeverity,
+ PgPool, PgTransaction, ReadOnlyPgPool,
+ models::{
+ DBProjectId, DelphiReportIssueDetailsId,
+ delphi_report_item::DelphiSeverity,
+ },
redis::RedisPool,
},
models::pats::Scopes,
@@ -25,9 +32,12 @@ use crate::{
const RULE_SCAN_LOCK_ID: i64 = 0x6465_6c70_6869_7275;
const PROGRESS_INTERVAL: usize = 50;
+const DUMMY_ISSUE_TYPE: &str = "__dummy";
pub fn config(cfg: &mut actix_web::web::ServiceConfig) {
- cfg.service(get_rule_schema).service(scan_rules);
+ cfg.service(get_rule_schema)
+ .service(get_detail_rule_input)
+ .service(scan_rules);
}
#[derive(Serialize)]
@@ -45,40 +55,40 @@ struct RuleScanErrorEvent<'a> {
}
#[derive(Serialize, utoipa::ToSchema)]
-pub(super) struct RuleInput {
- pub(super) schema_version: u32,
- pub(super) trace: RuleTrace,
- pub(super) scan: RuleScan,
- pub(super) artifact: RuleArtifact,
- pub(super) scope: RuleScope,
+pub struct RuleInput {
+ pub schema_version: u32,
+ pub trace: RuleTrace,
+ pub scan: RuleScan,
+ pub artifact: RuleArtifact,
+ pub scope: RuleScope,
}
#[derive(Serialize, utoipa::ToSchema)]
-pub(super) struct RuleTrace {
- pub(super) key: String,
- pub(super) issue_type: String,
- pub(super) severity: DelphiSeverity,
- pub(super) jar: Option,
- pub(super) file_path: String,
- pub(super) data: HashMap,
+pub struct RuleTrace {
+ pub key: String,
+ pub issue_type: String,
+ pub severity: DelphiSeverity,
+ pub jar: Option,
+ pub file_path: String,
+ pub data: HashMap,
}
#[derive(Serialize, utoipa::ToSchema)]
-pub(super) struct RuleScan {
- pub(super) delphi_version: i32,
+pub struct RuleScan {
+ pub delphi_version: i32,
}
#[derive(Serialize, utoipa::ToSchema)]
-pub(super) struct RuleArtifact {
- pub(super) size: Option,
- pub(super) hashes: BTreeMap,
+pub struct RuleArtifact {
+ pub size: Option,
+ pub hashes: BTreeMap,
}
#[derive(Serialize, utoipa::ToSchema)]
-pub(super) struct RuleScope {
- pub(super) project_id: Option,
- pub(super) version_id: Option,
- pub(super) file_id: Option,
+pub struct RuleScope {
+ pub project_id: Option,
+ pub version_id: Option,
+ pub file_id: Option,
}
struct CompiledRule {
@@ -145,6 +155,101 @@ pub async fn get_rule_schema(
}))
}
+/// Get the exact CEL input for a Delphi issue detail.
+#[utoipa::path(
+ context_path = "/moderation/tech-review",
+ tag = "moderation",
+ security(("bearer_auth" = [])),
+ responses(
+ (status = OK, body = RuleInput),
+ (status = NOT_FOUND, description = "Detail not found")
+ )
+)]
+#[get("/rules/details/{detail_id}/input")]
+pub async fn get_detail_rule_input(
+ req: HttpRequest,
+ pool: web::Data,
+ ro_pool: web::Data,
+ redis: web::Data,
+ session_queue: web::Data,
+ path: web::Path<(DelphiReportIssueDetailsId,)>,
+) -> Result, ApiError> {
+ check_is_moderator_from_headers(
+ &req,
+ &**pool,
+ &redis,
+ &session_queue,
+ Scopes::PROJECT_READ,
+ )
+ .await?;
+
+ let (detail_id,) = path.into_inner();
+ let detail = crate::util::error::Context::wrap_internal_err(
+ sqlx::query!(
+ r#"
+ SELECT
+ detail.key,
+ issue.issue_type,
+ detail.severity AS "severity: DelphiSeverity",
+ detail.jar,
+ detail.file_path,
+ detail.data AS "data: Json>",
+ report.delphi_version,
+ file.size AS "size?",
+ file.id AS "file_id?",
+ version.id AS "version_id?",
+ version.mod_id AS "project_id?",
+ COALESCE(file_hashes.hashes, '{}'::jsonb)
+ AS "hashes!: Json>"
+ FROM delphi_report_issue_details detail
+ INNER JOIN delphi_report_issues issue ON issue.id = detail.issue_id
+ INNER JOIN delphi_reports report ON report.id = issue.report_id
+ LEFT JOIN files file ON file.id = report.file_id
+ LEFT JOIN versions version ON version.id = file.version_id
+ LEFT JOIN LATERAL (
+ SELECT
+ jsonb_object_agg(algorithm, encode(hash, 'hex')) AS hashes
+ FROM hashes
+ WHERE hashes.file_id = file.id
+ ) file_hashes ON TRUE
+ WHERE
+ detail.id = $1
+ AND issue.issue_type != $2
+ "#,
+ detail_id as DelphiReportIssueDetailsId,
+ DUMMY_ISSUE_TYPE,
+ )
+ .fetch_optional(&***ro_pool)
+ .await,
+ "failed to fetch delphi rule input",
+ )?
+ .ok_or(ApiError::NotFound)?;
+
+ Ok(web::Json(RuleInput {
+ schema_version: 1,
+ trace: RuleTrace {
+ key: detail.key,
+ issue_type: detail.issue_type,
+ severity: detail.severity,
+ jar: detail.jar,
+ file_path: detail.file_path,
+ data: detail.data.0,
+ },
+ scan: RuleScan {
+ delphi_version: detail.delphi_version,
+ },
+ artifact: RuleArtifact {
+ size: detail.size,
+ hashes: detail.hashes.0,
+ },
+ scope: RuleScope {
+ project_id: detail.project_id.map(to_public_id),
+ version_id: detail.version_id.map(to_public_id),
+ file_id: detail.file_id.map(to_public_id),
+ },
+ }))
+}
+
fn schema_to_value(
schema: T,
) -> Result {
@@ -274,31 +379,16 @@ async fn run_scan(
.checked_add(1)
.ok_or_else(|| eyre!("delphi rule revision overflowed"))?;
- let rules = sqlx::query!(
- r#"
- SELECT id, rule
- FROM delphi_rules
- WHERE NOT delete_on_next_revision
- ORDER BY id
- "#,
- )
- .fetch_all(&mut transaction)
- .await
- .wrap_err("failed to fetch delphi rules")?
- .into_iter()
- .map(|rule| {
- let program = cel::Program::compile(&rule.rule).map_err(|error| {
- eyre!("failed to compile delphi rule {}: {error}", rule.id)
- })?;
- Ok(CompiledRule {
- id: rule.id,
- program,
- })
- })
- .collect::>>()?;
+ let rules = fetch_compiled_rules(&mut transaction).await?;
let total = sqlx::query_scalar!(
- "SELECT COUNT(*) AS \"count!\" FROM delphi_report_issue_details",
+ r#"
+ SELECT COUNT(*) AS "count!"
+ FROM delphi_report_issue_details detail
+ INNER JOIN delphi_report_issues issue ON issue.id = detail.issue_id
+ WHERE issue.issue_type != $1
+ "#,
+ DUMMY_ISSUE_TYPE,
)
.fetch_one(&mut transaction)
.await
@@ -333,8 +423,10 @@ async fn run_scan(
FROM hashes
GROUP BY file_id
) file_hashes ON file_hashes.file_id = file.id
+ WHERE issue.issue_type != $1
ORDER BY detail.id
"#,
+ DUMMY_ISSUE_TYPE,
)
.fetch(&mut transaction);
@@ -407,74 +499,79 @@ async fn run_scan(
send_progress(sender, "publishing", revision, total, total, effects.len());
- let detail_ids = effects
- .iter()
- .map(|effect| effect.detail_id)
- .collect::>();
- let rule_ids = effects
- .iter()
- .map(|effect| effect.rule_id)
- .collect::>();
- let severities = effects
- .iter()
- .map(|effect| effect.effect.severity)
- .collect::>();
- let hidden = effects
- .iter()
- .map(|effect| effect.effect.hidden)
- .collect::>();
+ insert_materialized_effects(revision, &effects, &mut transaction).await?;
- if !effects.is_empty() {
- sqlx::query!(
- r#"
- INSERT INTO delphi_rule_effects (
- revision,
- detail_id,
- rule_id,
- severity,
- hidden
- )
- SELECT $1, effect.*
- FROM UNNEST(
- $2::BIGINT[],
- $3::BIGINT[],
- $4::delphi_severity[],
- $5::BOOLEAN[]
- ) AS effect(detail_id, rule_id, severity, hidden)
- "#,
- revision,
- &detail_ids,
- &rule_ids,
- &severities as &[Option],
- &hidden,
+ let affected_projects = sqlx::query!(
+ r#"
+ WITH project_membership AS (
+ SELECT
+ detail.project_id,
+ BOOL_OR(
+ detail.status IN ('pending', 'unsafe')
+ AND issue.issue_type != $2
+ AND NOT detail.hidden
+ ) AS old_needs_review,
+ BOOL_OR(
+ detail.status IN ('pending', 'unsafe')
+ AND issue.issue_type != $2
+ AND NOT COALESCE(new_effect.hidden, FALSE)
+ ) AS new_needs_review
+ FROM delphi_issue_details_with_statuses detail
+ INNER JOIN delphi_report_issues issue
+ ON issue.id = detail.issue_id
+ LEFT JOIN delphi_rule_effects new_effect
+ ON new_effect.revision = $1
+ AND new_effect.detail_id = detail.id
+ GROUP BY detail.project_id
)
- .execute(&mut transaction)
- .await
- .wrap_err("failed to insert delphi rule effects")?;
- }
+ SELECT project_id AS "project_id!: DBProjectId"
+ FROM project_membership
+ WHERE old_needs_review IS DISTINCT FROM new_needs_review
+ "#,
+ revision,
+ DUMMY_ISSUE_TYPE,
+ )
+ .fetch_all(&mut transaction)
+ .await
+ .wrap_err("failed to fetch projects affected by delphi rule changes")?;
sqlx::query!(
- "DELETE FROM delphi_rule_effects WHERE revision <> $1",
+ "UPDATE delphi_rules SET revision = $1 WHERE NOT delete_on_next_revision",
revision,
)
.execute(&mut transaction)
.await
- .wrap_err("failed to delete old delphi rule effects")?;
- sqlx::query!("DELETE FROM delphi_rules WHERE delete_on_next_revision")
+ .wrap_err("failed to update delphi rule revisions")?;
+ sqlx::query!("UPDATE delphi_rule_revisions SET revision = $1", revision)
.execute(&mut transaction)
.await
- .wrap_err("failed to delete retired delphi rules")?;
+ .wrap_err("failed to publish the delphi rule revision")?;
+
+ tech_review_sync::sync_project_tech_review_state(
+ &affected_projects
+ .iter()
+ .map(|project| project.project_id)
+ .collect::>(),
+ TechReviewExitReason::RulesChanged,
+ &mut transaction,
+ )
+ .await
+ .map_err(|error| {
+ eyre!(error)
+ .wrap_err("failed to sync projects affected by delphi rule changes")
+ })?;
+
sqlx::query!(
- "UPDATE delphi_rules SET revision = $1 WHERE NOT delete_on_next_revision",
+ "DELETE FROM delphi_rule_effects WHERE revision <> $1",
revision,
)
.execute(&mut transaction)
.await
- .wrap_err("failed to update delphi rule revisions")?;
- sqlx::query!("UPDATE delphi_rule_revisions SET revision = $1", revision)
+ .wrap_err("failed to delete old delphi rule effects")?;
+ sqlx::query!("DELETE FROM delphi_rules WHERE delete_on_next_revision")
.execute(&mut transaction)
.await
- .wrap_err("failed to publish the delphi rule revision")?;
+ .wrap_err("failed to delete retired delphi rules")?;
transaction
.commit()
@@ -489,6 +586,197 @@ async fn run_scan(
})
}
+pub(crate) async fn materialize_current_rule_effects(
+ detail_ids: &[DelphiReportIssueDetailsId],
+ transaction: &mut PgTransaction<'_>,
+) -> Result<()> {
+ if detail_ids.is_empty() {
+ return Ok(());
+ }
+
+ let revision = sqlx::query_scalar!(
+ "SELECT revision FROM delphi_rule_revisions LIMIT 1",
+ )
+ .fetch_one(&mut *transaction)
+ .await
+ .wrap_err("failed to fetch the current delphi rule revision")?;
+ let rules = fetch_compiled_rules(transaction).await?;
+
+ if rules.is_empty() {
+ return Ok(());
+ }
+
+ let details = sqlx::query!(
+ r#"
+ SELECT
+ detail.id,
+ detail.key,
+ issue.issue_type,
+ detail.severity AS "severity: DelphiSeverity",
+ detail.jar,
+ detail.file_path,
+ detail.data AS "data: Json>",
+ report.delphi_version,
+ file.size AS "size?",
+ file.id AS "file_id?",
+ version.id AS "version_id?",
+ version.mod_id AS "project_id?",
+ COALESCE(file_hashes.hashes, '{}'::jsonb)
+ AS "hashes!: Json>"
+ FROM delphi_report_issue_details detail
+ INNER JOIN delphi_report_issues issue ON issue.id = detail.issue_id
+ INNER JOIN delphi_reports report ON report.id = issue.report_id
+ LEFT JOIN files file ON file.id = report.file_id
+ LEFT JOIN versions version ON version.id = file.version_id
+ LEFT JOIN LATERAL (
+ SELECT
+ jsonb_object_agg(algorithm, encode(hash, 'hex')) AS hashes
+ FROM hashes
+ WHERE hashes.file_id = file.id
+ ) file_hashes ON TRUE
+ WHERE
+ detail.id = ANY($1::bigint[])
+ AND issue.issue_type != $2
+ ORDER BY detail.id
+ "#,
+ &detail_ids.iter().map(|id| id.0).collect::>(),
+ DUMMY_ISSUE_TYPE,
+ )
+ .fetch_all(&mut *transaction)
+ .await
+ .wrap_err("failed to fetch new delphi issue details")?;
+
+ let mut effects = Vec::new();
+ for detail in details {
+ let input = RuleInput {
+ schema_version: 1,
+ trace: RuleTrace {
+ key: detail.key,
+ issue_type: detail.issue_type,
+ severity: detail.severity,
+ jar: detail.jar,
+ file_path: detail.file_path,
+ data: detail.data.0,
+ },
+ scan: RuleScan {
+ delphi_version: detail.delphi_version,
+ },
+ artifact: RuleArtifact {
+ size: detail.size,
+ hashes: detail.hashes.0,
+ },
+ scope: RuleScope {
+ project_id: detail.project_id.map(to_public_id),
+ version_id: detail.version_id.map(to_public_id),
+ file_id: detail.file_id.map(to_public_id),
+ },
+ };
+
+ for rule in &rules {
+ let effect =
+ evaluate_rule(&rule.program, &input).wrap_err_with(|| {
+ format!(
+ "failed to evaluate delphi rule {} for detail {}",
+ rule.id, detail.id
+ )
+ })?;
+ if let Some(effect) = effect {
+ effects.push(MaterializedEffect {
+ detail_id: detail.id,
+ rule_id: rule.id,
+ effect,
+ });
+ break;
+ }
+ }
+ }
+
+ insert_materialized_effects(revision, &effects, transaction).await
+}
+
+async fn fetch_compiled_rules(
+ transaction: &mut PgTransaction<'_>,
+) -> Result> {
+ sqlx::query!(
+ r#"
+ SELECT id, rule
+ FROM delphi_rules
+ WHERE NOT delete_on_next_revision
+ ORDER BY id
+ "#,
+ )
+ .fetch_all(&mut *transaction)
+ .await
+ .wrap_err("failed to fetch delphi rules")?
+ .into_iter()
+ .map(|rule| {
+ let program = cel::Program::compile(&rule.rule).map_err(|error| {
+ eyre!("failed to compile delphi rule {}: {error}", rule.id)
+ })?;
+ Ok(CompiledRule {
+ id: rule.id,
+ program,
+ })
+ })
+ .collect()
+}
+
+async fn insert_materialized_effects(
+ revision: i64,
+ effects: &[MaterializedEffect],
+ transaction: &mut PgTransaction<'_>,
+) -> Result<()> {
+ if effects.is_empty() {
+ return Ok(());
+ }
+
+ let detail_ids = effects
+ .iter()
+ .map(|effect| effect.detail_id)
+ .collect::>();
+ let rule_ids = effects
+ .iter()
+ .map(|effect| effect.rule_id)
+ .collect::>();
+ let severities = effects
+ .iter()
+ .map(|effect| effect.effect.severity)
+ .collect::>();
+ let hidden = effects
+ .iter()
+ .map(|effect| effect.effect.hidden)
+ .collect::>();
+
+ sqlx::query!(
+ r#"
+ INSERT INTO delphi_rule_effects (
+ revision,
+ detail_id,
+ rule_id,
+ severity,
+ hidden
+ )
+ SELECT $1, effect.*
+ FROM UNNEST(
+ $2::BIGINT[],
+ $3::BIGINT[],
+ $4::delphi_severity[],
+ $5::BOOLEAN[]
+ ) AS effect(detail_id, rule_id, severity, hidden)
+ "#,
+ revision,
+ &detail_ids,
+ &rule_ids,
+ &severities as &[Option],
+ &hidden,
+ )
+ .execute(&mut *transaction)
+ .await
+ .wrap_err("failed to insert delphi rule effects")?;
+
+ Ok(())
+}
+
pub(super) fn evaluate_rule(
program: &cel::Program,
input: impl Serialize,
diff --git a/packages/api-client/src/modules/labrinth/tech-review/internal.ts b/packages/api-client/src/modules/labrinth/tech-review/internal.ts
index 5cf7e278fb..2ad32b78ff 100644
--- a/packages/api-client/src/modules/labrinth/tech-review/internal.ts
+++ b/packages/api-client/src/modules/labrinth/tech-review/internal.ts
@@ -28,6 +28,19 @@ export class LabrinthTechReviewInternalModule extends AbstractModule {
)
}
+ public async getDetailRuleInput(
+ detailId: string,
+ ): Promise {
+ return this.client.request(
+ `/moderation/tech-review/rules/details/${detailId}/input`,
+ {
+ api: 'labrinth',
+ version: 'internal',
+ method: 'GET',
+ },
+ )
+ }
+
public async getRuleAffectedDetails(
id: number,
): Promise {
diff --git a/packages/api-client/src/modules/labrinth/types.ts b/packages/api-client/src/modules/labrinth/types.ts
index 8f9e55939d..3089099050 100644
--- a/packages/api-client/src/modules/labrinth/types.ts
+++ b/packages/api-client/src/modules/labrinth/types.ts
@@ -2289,6 +2289,30 @@ export namespace Labrinth {
components: Record
}
+ export type RuleInput = {
+ schema_version: number
+ trace: {
+ key: string
+ issue_type: string
+ severity: DelphiSeverity
+ jar: string | null
+ file_path: string
+ data: Record
+ }
+ scan: {
+ delphi_version: number
+ }
+ artifact: {
+ size: number | null
+ hashes: Record
+ }
+ scope: {
+ project_id: string | null
+ version_id: string | null
+ file_id: string | null
+ }
+ }
+
export type TestDelphiRuleResponse = {
effects: Array
}