marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-11-13 17:58:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(access-control-prover): publish fact conformance handoff

Browse Source
This commit is contained in:
Marius Ciepluch
2026-11-01 18:16:07 +01:00
parent ec6c8f7f3e
commit 29030b38fc
37 changed files with 2333 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/fixtures/access_control/conformance/v1/artifacts/sha256/02b8aa4884cb356afa9ba7960fee55f5d9a15f0e4b73fbc3573d85622d0defa9
Vendored
+1
View File
@@ -0,0 +1 @@
{"location":{"column":0,"line":3,"path":"sources/complete.js","symbol":"app.get->adminHandler@sources/complete.js:4:9"},"observed":"app.get","requirement_id":"qualified_target","schema_version":"openultrasast.detection-core.structural-observation.v2"}
tests/fixtures/access_control/conformance/v1/artifacts/sha256/0494c5e2973965bbfc12cee1db3971cfa700a41d9b5e11309d45eb529837d556
Vendored
+1
View File
@@ -0,0 +1 @@
{"location":{"column":0,"line":1,"path":"sources/name-only.js","symbol":"app.get->adminHandler@sources/name-only.js:2:9"},"observed":"app.get","requirement_id":"qualified_target","schema_version":"openultrasast.detection-core.structural-observation.v2"}
tests/fixtures/access_control/conformance/v1/artifacts/sha256/0acf81eaebbf1c67bef9d93fe7aaf061c85494cd124d1338727c230ba91cc4bd
Vendored
+1
View File
@@ -0,0 +1 @@
{"location":{"column":0,"line":3,"path":"sources/partial.js","symbol":"app.get"},"observed":"express_application","requirement_id":"receiver","schema_version":"openultrasast.detection-core.structural-observation.v2"}
tests/fixtures/access_control/conformance/v1/artifacts/sha256/1010797dff4ba19deb6e95640373984d4227f0a657b9d03f841634c17d095262
Vendored
+1
View File
@@ -0,0 +1 @@
{"authority_review":{"attestation_digest":"c07b5c22c2724b13dd34134b112c66ad9e2885e2e6947e23cde6245b3bbc9061","conflict_disclosure":{"artifact_id":"installed-entry-authority-conflicts-v1","byte_length":113,"content_digest":"a8bf581d321560f2730aae3d5a7c9114c2d8f81f7a702fa3681a87e7be4cb9e1","media_type":"application/json","retention_policy_digest":"09a0fe8a253780b3666ef016d575a212bf0570da392dd5bf1a834dce2edf703f","storage_receipt_digest":"ee92fde020e9b4d316ad285f3f904032c52d902fe1c7c0a94cb0d61d9c0136ce"},"producer_identity":"f12a7e897cbaf3059619517e1f8a725b90049a0edf3af08efa12fb1ef7fdee43","reviewer_identity":"f12a7e897cbaf3059619517e1f8a725b90049a0edf3af08efa12fb1ef7fdee43","subject_digest":"0fa8f607297aa5364a0ca6c9b8d47bfcdef28456b7f062ddb251f8f8b9a67da4"},"bundle_digest":"0fa8f607297aa5364a0ca6c9b8d47bfcdef28456b7f062ddb251f8f8b9a67da4","custody_policy":{"policy_digest":"415b1c13adc918c162932a38e79548a7d9867f5331860eb409238c51b1cca1f0","reviewed_custodian_digests":["4fe8ca2923ee759a24fd8e5b91673faa6859a7a0c2df6e7c7ea5e23968708632"]},"lineages":[{"arm_id":"installed-entry-facts:javascript","manifest_digest":"f3b4b192dadd6b7d0d298286008480dadfd8640e9603020b0f24d13dce9bda04","subject_digest":"331e8c2261cb030f4257a8650448560eb94941554df47cb275882e24b8f8923f","uses":[{"influenced_artifact_digest":"331e8c2261cb030f4257a8650448560eb94941554df47cb275882e24b8f8923f","labels_accessed":false,"population_use_receipt_digest":"36ccebd06b60601775ab24a2f7ec9f2b49c2eac6b273816eaf9e867f6c445915","purpose":"semantic_fact","source_population_digest":"0ec4bbe3712a691a76f6525aca59f15d0492adc1e7ec8d7e9bb42e8ee42795ce"}]},{"arm_id":"installed-entry-facts:typescript","manifest_digest":"b7a6a95ddcdd8f6e6dbcd2b90cb707eda9833ec7479cb4d7aae3c91cfe0059ca","subject_digest":"b6d1157e99537bd4928303ec0d887628bc53f0aa9e770427580a32e3948babd9","uses":[{"influenced_artifact_digest":"b6d1157e99537bd4928303ec0d887628bc53f0aa9e770427580a32e3948babd9","labels_accessed":false,"population_use_receipt_digest":"7dc5fe36b1e111ab6cf979137c40bf67b885b2a9deda944aff78e3031cb5a553","purpose":"semantic_fact","source_population_digest":"0ec4bbe3712a691a76f6525aca59f15d0492adc1e7ec8d7e9bb42e8ee42795ce"}]},{"arm_id":"installed-entry-structural-matcher","manifest_digest":"5f7ffd58a773b61d1f8e2ba0ca019e27d778166e13cec770e6f25c16b1f1a994","subject_digest":"0ad18521beeb3708e12f8c9941b3f29b3e1312fe78b9320e5aaf15bc9db8831a","uses":[{"influenced_artifact_digest":"0ad18521beeb3708e12f8c9941b3f29b3e1312fe78b9320e5aaf15bc9db8831a","labels_accessed":false,"population_use_receipt_digest":"a602c8bccc6afc2ff9d857119131a2847509bc693a80192bf8459b9dcba9cbda","purpose":"matching_behavior","source_population_digest":"0ec4bbe3712a691a76f6525aca59f15d0492adc1e7ec8d7e9bb42e8ee42795ce"}]}],"matcher_behavior_digest":"0ad18521beeb3708e12f8c9941b3f29b3e1312fe78b9320e5aaf15bc9db8831a","matcher_lineage_manifest_digest":"5f7ffd58a773b61d1f8e2ba0ca019e27d778166e13cec770e6f25c16b1f1a994","matcher_revision":"entry-structural-matcher-v1","pack_files":["express.javascript.v2.json","express.typescript.v2.json"],"recognition_projection":{"artifact_id":"express-recognition-projection-v1","byte_length":628,"content_digest":"529d18ba2b351a8de985a9cf416261d717ef55a4b7a9d9d65bce53b97d59ab35","media_type":"application/json","retention_policy_digest":"09a0fe8a253780b3666ef016d575a212bf0570da392dd5bf1a834dce2edf703f","storage_receipt_digest":"3a85c0641cddcfc8c926fd01e230360c042606bda78e14a39489de14f88944b4"},"review_policy":{"forbidden_identity_pairs":[],"maximum_evidence_bytes":1048576,"policy_digest":"cb023a4f7e727ec4abfee583256194fe3f11c064a10960f297c1f7bf2e6fecde","reviewed_reviewer_digests":["f12a7e897cbaf3059619517e1f8a725b90049a0edf3af08efa12fb1ef7fdee43"],"trusted_store_identities":["openultrasast-installed-entry-artifacts-v1"]},"schema_version":"openultrasast.access-control.installed-entry-authority.v1"}
tests/fixtures/access_control/conformance/v1/artifacts/sha256/3edf94ff896c1e8fb1ae5b297d67117e4524a29870834190c13c3870f4d30aa6
Vendored
+1
View File
@@ -0,0 +1 @@
{"fact_id":"entry:express:app-route:get","matcher_behavior_digest":"0ad18521beeb3708e12f8c9941b3f29b3e1312fe78b9320e5aaf15bc9db8831a","matcher_lineage_manifest_digest":"5f7ffd58a773b61d1f8e2ba0ca019e27d778166e13cec770e6f25c16b1f1a994","matcher_revision":"entry-structural-matcher-v1","observations":[{"evidence":{"artifact_id":"structural-observation:0494c5e2973965bbfc12cee1db3971cfa700a41d9b5e11309d45eb529837d556","byte_length":253,"content_digest":"0494c5e2973965bbfc12cee1db3971cfa700a41d9b5e11309d45eb529837d556","media_type":"application/json","retention_policy_digest":"445c538acfffe5dde50f57bc699da2732e237207f0953c59dd8559f66c1a6708","storage_receipt_digest":"d364b9ac443e85a5cf7f4de2bea24f0a5d16719ede85486ef93800ac99702267"},"location":{"column":0,"line":1,"path":"sources/name-only.js","symbol":"app.get->adminHandler@sources/name-only.js:2:9"},"observed":"app.get","requirement_id":"qualified_target"},{"evidence":{"artifact_id":"structural-observation:60fe67b0d61dbfcedf97ce1470219bdb7b8cc5590c04d90401fede5bcd6e9064","byte_length":251,"content_digest":"60fe67b0d61dbfcedf97ce1470219bdb7b8cc5590c04d90401fede5bcd6e9064","media_type":"application/json","retention_policy_digest":"445c538acfffe5dde50f57bc699da2732e237207f0953c59dd8559f66c1a6708","storage_receipt_digest":"305af51d6f3af6440f732ddcb13971c2ffe9f3327452915ca126061eb08c896b"},"location":{"column":0,"line":1,"path":"sources/name-only.js","symbol":"app.get->adminHandler@sources/name-only.js:2:9"},"observed":"member_call","requirement_id":"call_shape"},{"evidence":{"artifact_id":"structural-observation:aba7fbac17cbc9095715999b1584daa07cf20552ea17c0b71948890aa88e9ece","byte_length":261,"content_digest":"aba7fbac17cbc9095715999b1584daa07cf20552ea17c0b71948890aa88e9ece","media_type":"application/json","retention_policy_digest":"445c538acfffe5dde50f57bc699da2732e237207f0953c59dd8559f66c1a6708","storage_receipt_digest":"c36686f481771721e444b10f632990f18951f4cdef1e0c0d02e5a3325b19c6d5"},"location":{"column":0,"line":1,"path":"sources/name-only.js","symbol":"app.get->adminHandler@sources/name-only.js:2:9"},"observed":"route_path_and_handler","requirement_id":"arguments"}],"pack_digest":"331e8c2261cb030f4257a8650448560eb94941554df47cb275882e24b8f8923f","product_location":{"column":0,"line":1,"path":"sources/name-only.js","symbol":"app.get->adminHandler@sources/name-only.js:2:9"},"schema_version":"openultrasast.detection-core.fact-match.v2"}
tests/fixtures/access_control/conformance/v1/artifacts/sha256/4a46c6164bc28bf737ed6109d53f18ddc78efcc7a25c2417e38ff4600461bc9b
Vendored
+1
View File
@@ -0,0 +1 @@
{"decision":{"basis":"deterministic","bounded_scope":{"base_revision":"base","change_digest":"531bb28a24082947325ef7b3108f5586a4e8187dbf094409be514d6510bb9f27","head_revision":"head","regions":[{"end_line":4,"path":"sources/complete.js","start_line":1}]},"family_code":"indeterminate","outcome":"indeterminate","packet_digest":"9d2e3db2b44ba56d5f017a5deab969abe8603aa9f3c6908d5412d2939432a235","provenance":{"lineage_manifest_digest":null,"model_declaration_digest":null,"model_identity":null,"model_result_digest":null,"proof_producer_digest":null,"proof_record_digest":null},"reasons":["missing_constraint_relation"]},"packet":{"completeness_reasons":["missing_constraint_relation"],"ecosystem":"express","family_contract_digest":"d3aea166bdad9186843b78ce1e3a6a4c135473f3d918ff580b096dbed61c787a","family_fields":[{"kind":"text","name":"operation","value":"entry-registration"},{"kind":"text","name":"boundary","value":"express"}],"family_id":"access_control","observations":[],"provenance":{"acquisition_record_digest":"f978265cdc2549cc1c5b2c757bb41934a467ddc9a042a10d1af67acd5bc6905a","analyzer_revision":"dc2816e78d1aca97801ab5a22fb316ae6c354a6e65260ade31ebcbbfa83f9fc0","change_input_digest":"531bb28a24082947325ef7b3108f5586a4e8187dbf094409be514d6510bb9f27","configuration_digest":"3f167eebbd83522e30a8258e23a2b7bf3761880276a05965b0865c8f766b6214","fact_set_digest":"7438561f434fb5999d22aaccae44813d3d7c7cbff588a37cc497bb846c93bc75","family_contract_digest":"d3aea166bdad9186843b78ce1e3a6a4c135473f3d918ff580b096dbed61c787a","population_digest":"c03e2c11dd18a4a5ada83492740946ed9e1ff1201ded765e9e2c75d34a445fce"},"schema_version":"openultrasast.detection-core.evidence-packet.v2","scope":{"base_revision":"base","change_digest":"531bb28a24082947325ef7b3108f5586a4e8187dbf094409be514d6510bb9f27","head_revision":"head","regions":[{"end_line":4,"path":"sources/complete.js","start_line":1}]},"security_object_id":"33bf0ef7a2efd0c79d89da501e49fe2f44a57931a0252bd95783bf9237256b6a","transitions":[{"conditions":[],"kind":"registration","location":{"column":0,"line":3,"path":"sources/complete.js","symbol":"app.get->adminHandler@sources/complete.js:4:9"},"provenance":{"fact_match":{"artifact_id":"fact-match:db111c965603bb4cf9d83ba07b0e22a57a537ba6a05448158ef7d7615efb18d3","byte_length":3037,"content_digest":"db111c965603bb4cf9d83ba07b0e22a57a537ba6a05448158ef7d7615efb18d3","media_type":"application/json","retention_policy_digest":"445c538acfffe5dde50f57bc699da2732e237207f0953c59dd8559f66c1a6708","storage_receipt_digest":"cd74cb0a824a618a2ae3f822e9988bb5703fdafc41e41e88bf941b71a31fd602"},"kind":"semantic_fact","semantic_fact_id":"entry:express:app-route:get","semantic_pack_digest":"331e8c2261cb030f4257a8650448560eb94941554df47cb275882e24b8f8923f","source_content_digest":"db111c965603bb4cf9d83ba07b0e22a57a537ba6a05448158ef7d7615efb18d3"},"reasons":[],"relation_id":"89785eb0e81e26cab8dbdb8c029290d46f47cae9454f21cf07f6a8157d279f8c","role":"entry_registration","source":{"location":{"column":0,"line":3,"path":"sources/complete.js","symbol":"app.get->adminHandler@sources/complete.js:4:9"},"node_id":"3dbe3056740381221072862da39a5d10c3502ee776445560efcd27c54091fe29","role":"framework_instance"},"status":"complete","target":{"location":{"column":0,"line":3,"path":"sources/complete.js","symbol":"app.get->adminHandler@sources/complete.js:4:9"},"node_id":"f17ecafe6356afc2325229cc686f3953e3bcbf8d37d9c5a24cc300ff43829547","role":"entry_handler"}},{"conditions":[],"kind":"constraint_effect","location":{"column":0,"line":3,"path":"sources/complete.js","symbol":"app.get->adminHandler@sources/complete.js:4:9"},"provenance":{"fact_match":null,"kind":"product_code","semantic_fact_id":null,"semantic_pack_digest":null,"source_content_digest":"531bb28a24082947325ef7b3108f5586a4e8187dbf094409be514d6510bb9f27"},"reasons":["missing_constraint_relation"],"relation_id":"ac7cedfbee67ec3f24eefa0fe0cc88076367eb70873345f37f1b3f1ceb30712a","role":"constraint","source":{"location":{"column":0,"line":3,"path":"sources/complete.js","symbol":"app.get->adminHandler@sources/complete.js:4:9"},"node_id":"constraint-source","role":"security_object"},"status":"incomplete","target":{"location":{"column":0,"line":3,"path":"sources/complete.js","symbol":"app.get->adminHandler@sources/complete.js:4:9"},"node_id":"constraint-target","role":"operation"}}]},"schema_version":"openultrasast.detection-core.evidence-record.v2"}
tests/fixtures/access_control/conformance/v1/artifacts/sha256/4b657ac957f89e41f34c179e7519cba950f92c09b6410fbf713a16ec06eff43f
Vendored
+1
View File
@@ -0,0 +1 @@
{"location":{"column":0,"line":3,"path":"sources/partial.js","symbol":"app.get"},"observed":"app.get","requirement_id":"qualified_target","schema_version":"openultrasast.detection-core.structural-observation.v2"}
tests/fixtures/access_control/conformance/v1/artifacts/sha256/56d8517c0bb2c8e9296a7fa096ebd1d0babfc0cd2491d966b7c2120a2e01ee22
Vendored
+1
View File
File diff suppressed because one or more lines are too long
tests/fixtures/access_control/conformance/v1/artifacts/sha256/60fe67b0d61dbfcedf97ce1470219bdb7b8cc5590c04d90401fede5bcd6e9064
Vendored
+1
View File
@@ -0,0 +1 @@
{"location":{"column":0,"line":1,"path":"sources/name-only.js","symbol":"app.get->adminHandler@sources/name-only.js:2:9"},"observed":"member_call","requirement_id":"call_shape","schema_version":"openultrasast.detection-core.structural-observation.v2"}
tests/fixtures/access_control/conformance/v1/artifacts/sha256/615552917e474d463b8af6323c7aaa9cbd24b759b42bbf53af3805ec9be0149d
Vendored
+1
View File
@@ -0,0 +1 @@
{"authority_review":{"attestation_digest":"aeeb9120c10d8bf83159a9cbd14ad8a070a0ceb99a53b5a1daa616a315c84b55","conflict_disclosure":{"artifact_id":"installed-entry-authority-conflicts-v1","byte_length":113,"content_digest":"a8bf581d321560f2730aae3d5a7c9114c2d8f81f7a702fa3681a87e7be4cb9e1","media_type":"application/json","retention_policy_digest":"09a0fe8a253780b3666ef016d575a212bf0570da392dd5bf1a834dce2edf703f","storage_receipt_digest":"ee92fde020e9b4d316ad285f3f904032c52d902fe1c7c0a94cb0d61d9c0136ce"},"producer_identity":"9635025424be37e1615e597185a425a5443242fa210d6136c38250101088e7b4","reviewer_identity":"f12a7e897cbaf3059619517e1f8a725b90049a0edf3af08efa12fb1ef7fdee43","subject_digest":"0fa8f607297aa5364a0ca6c9b8d47bfcdef28456b7f062ddb251f8f8b9a67da4"},"bundle_digest":"0000000000000000000000000000000000000000000000000000000000000000","custody_policy":{"policy_digest":"415b1c13adc918c162932a38e79548a7d9867f5331860eb409238c51b1cca1f0","reviewed_custodian_digests":["4fe8ca2923ee759a24fd8e5b91673faa6859a7a0c2df6e7c7ea5e23968708632"]},"lineages":[{"arm_id":"installed-entry-facts:javascript","manifest_digest":"f3b4b192dadd6b7d0d298286008480dadfd8640e9603020b0f24d13dce9bda04","subject_digest":"331e8c2261cb030f4257a8650448560eb94941554df47cb275882e24b8f8923f","uses":[{"influenced_artifact_digest":"331e8c2261cb030f4257a8650448560eb94941554df47cb275882e24b8f8923f","labels_accessed":false,"population_use_receipt_digest":"36ccebd06b60601775ab24a2f7ec9f2b49c2eac6b273816eaf9e867f6c445915","purpose":"semantic_fact","source_population_digest":"0ec4bbe3712a691a76f6525aca59f15d0492adc1e7ec8d7e9bb42e8ee42795ce"}]},{"arm_id":"installed-entry-facts:typescript","manifest_digest":"b7a6a95ddcdd8f6e6dbcd2b90cb707eda9833ec7479cb4d7aae3c91cfe0059ca","subject_digest":"b6d1157e99537bd4928303ec0d887628bc53f0aa9e770427580a32e3948babd9","uses":[{"influenced_artifact_digest":"b6d1157e99537bd4928303ec0d887628bc53f0aa9e770427580a32e3948babd9","labels_accessed":false,"population_use_receipt_digest":"7dc5fe36b1e111ab6cf979137c40bf67b885b2a9deda944aff78e3031cb5a553","purpose":"semantic_fact","source_population_digest":"0ec4bbe3712a691a76f6525aca59f15d0492adc1e7ec8d7e9bb42e8ee42795ce"}]},{"arm_id":"installed-entry-structural-matcher","manifest_digest":"5f7ffd58a773b61d1f8e2ba0ca019e27d778166e13cec770e6f25c16b1f1a994","subject_digest":"0ad18521beeb3708e12f8c9941b3f29b3e1312fe78b9320e5aaf15bc9db8831a","uses":[{"influenced_artifact_digest":"0ad18521beeb3708e12f8c9941b3f29b3e1312fe78b9320e5aaf15bc9db8831a","labels_accessed":false,"population_use_receipt_digest":"a602c8bccc6afc2ff9d857119131a2847509bc693a80192bf8459b9dcba9cbda","purpose":"matching_behavior","source_population_digest":"0ec4bbe3712a691a76f6525aca59f15d0492adc1e7ec8d7e9bb42e8ee42795ce"}]}],"matcher_behavior_digest":"0ad18521beeb3708e12f8c9941b3f29b3e1312fe78b9320e5aaf15bc9db8831a","matcher_lineage_manifest_digest":"5f7ffd58a773b61d1f8e2ba0ca019e27d778166e13cec770e6f25c16b1f1a994","matcher_revision":"entry-structural-matcher-v1","pack_files":["express.javascript.v2.json","express.typescript.v2.json"],"recognition_projection":{"artifact_id":"express-recognition-projection-v1","byte_length":628,"content_digest":"529d18ba2b351a8de985a9cf416261d717ef55a4b7a9d9d65bce53b97d59ab35","media_type":"application/json","retention_policy_digest":"09a0fe8a253780b3666ef016d575a212bf0570da392dd5bf1a834dce2edf703f","storage_receipt_digest":"3a85c0641cddcfc8c926fd01e230360c042606bda78e14a39489de14f88944b4"},"review_policy":{"forbidden_identity_pairs":[],"maximum_evidence_bytes":1048576,"policy_digest":"cb023a4f7e727ec4abfee583256194fe3f11c064a10960f297c1f7bf2e6fecde","reviewed_reviewer_digests":["f12a7e897cbaf3059619517e1f8a725b90049a0edf3af08efa12fb1ef7fdee43"],"trusted_store_identities":["openultrasast-installed-entry-artifacts-v1"]},"schema_version":"openultrasast.access-control.installed-entry-authority.v1"}
tests/fixtures/access_control/conformance/v1/artifacts/sha256/6c750f6128bd698bb27dd6db5e1260995cac678261ce2734cbf048c7b33e9b12
Vendored
+1
View File
@@ -0,0 +1 @@
{"location":{"column":0,"line":3,"path":"sources/complete.js","symbol":"app.get->adminHandler@sources/complete.js:4:9"},"observed":"express_application","requirement_id":"receiver","schema_version":"openultrasast.detection-core.structural-observation.v2"}
tests/fixtures/access_control/conformance/v1/artifacts/sha256/749ff8b59bb778be1d8b2bf745f223c7c3b09cad2714696bbc65cfd332170bbf
Vendored
+1
View File
File diff suppressed because one or more lines are too long
tests/fixtures/access_control/conformance/v1/artifacts/sha256/752f84618a299286bd5a9fdd1513dc40c05b6649a2ff0a81b23175001560d490
Vendored
+1
View File
@@ -0,0 +1 @@
{"location":{"column":0,"line":3,"path":"sources/partial.js","symbol":"app.get"},"observed":"member_call","requirement_id":"call_shape","schema_version":"openultrasast.detection-core.structural-observation.v2"}
tests/fixtures/access_control/conformance/v1/artifacts/sha256/88a8b08604bb7db69ccfc50af54701e4ab41044db5eb61cb812881a60e1b6370
Vendored
+1
View File
@@ -0,0 +1 @@
{"location":{"column":0,"line":3,"path":"sources/complete.js","symbol":"app.get->adminHandler@sources/complete.js:4:9"},"observed":"route_path_and_handler","requirement_id":"arguments","schema_version":"openultrasast.detection-core.structural-observation.v2"}
tests/fixtures/access_control/conformance/v1/artifacts/sha256/a1c31def035a5c45d4c49f77816815570d9874d781ac06c5f33b9c75166fb7b4
Vendored
+1
View File
@@ -0,0 +1 @@
{"fact_id":"entry:express:app-route:get","matcher_behavior_digest":"0ad18521beeb3708e12f8c9941b3f29b3e1312fe78b9320e5aaf15bc9db8831a","matcher_lineage_manifest_digest":"5f7ffd58a773b61d1f8e2ba0ca019e27d778166e13cec770e6f25c16b1f1a994","matcher_revision":"entry-structural-matcher-v1","observations":[{"evidence":{"artifact_id":"structural-observation:4b657ac957f89e41f34c179e7519cba950f92c09b6410fbf713a16ec06eff43f","byte_length":212,"content_digest":"4b657ac957f89e41f34c179e7519cba950f92c09b6410fbf713a16ec06eff43f","media_type":"application/json","retention_policy_digest":"445c538acfffe5dde50f57bc699da2732e237207f0953c59dd8559f66c1a6708","storage_receipt_digest":"e2c2971b375d018688a4aa7e1d86907d732a6eaac6649f397b92ec6896ddd3ea"},"location":{"column":0,"line":3,"path":"sources/partial.js","symbol":"app.get"},"observed":"app.get","requirement_id":"qualified_target"},{"evidence":{"artifact_id":"structural-observation:752f84618a299286bd5a9fdd1513dc40c05b6649a2ff0a81b23175001560d490","byte_length":210,"content_digest":"752f84618a299286bd5a9fdd1513dc40c05b6649a2ff0a81b23175001560d490","media_type":"application/json","retention_policy_digest":"445c538acfffe5dde50f57bc699da2732e237207f0953c59dd8559f66c1a6708","storage_receipt_digest":"3b5f35240b90c610f28d093ad4ce49908e3650335d41ae7ae7e1b02c3eafe415"},"location":{"column":0,"line":3,"path":"sources/partial.js","symbol":"app.get"},"observed":"member_call","requirement_id":"call_shape"},{"evidence":{"artifact_id":"structural-observation:0acf81eaebbf1c67bef9d93fe7aaf061c85494cd124d1338727c230ba91cc4bd","byte_length":216,"content_digest":"0acf81eaebbf1c67bef9d93fe7aaf061c85494cd124d1338727c230ba91cc4bd","media_type":"application/json","retention_policy_digest":"445c538acfffe5dde50f57bc699da2732e237207f0953c59dd8559f66c1a6708","storage_receipt_digest":"c1ab8ae696194ecf29c8af32cbd1f8649eceff8ab5106cae75881994a06e843e"},"location":{"column":0,"line":3,"path":"sources/partial.js","symbol":"app.get"},"observed":"express_application","requirement_id":"receiver"}],"pack_digest":"331e8c2261cb030f4257a8650448560eb94941554df47cb275882e24b8f8923f","product_location":{"column":0,"line":3,"path":"sources/partial.js","symbol":"app.get"},"schema_version":"openultrasast.detection-core.fact-match.v2"}
tests/fixtures/access_control/conformance/v1/artifacts/sha256/a8bf581d321560f2730aae3d5a7c9114c2d8f81f7a702fa3681a87e7be4cb9e1
Vendored
+1
View File
@@ -0,0 +1 @@
{"conflicts":[],"resolved":true,"schema_version":"openultrasast.access-control.authority-conflict-disclosure.v1"}
tests/fixtures/access_control/conformance/v1/artifacts/sha256/aba7fbac17cbc9095715999b1584daa07cf20552ea17c0b71948890aa88e9ece
Vendored
+1
View File
@@ -0,0 +1 @@
{"location":{"column":0,"line":1,"path":"sources/name-only.js","symbol":"app.get->adminHandler@sources/name-only.js:2:9"},"observed":"route_path_and_handler","requirement_id":"arguments","schema_version":"openultrasast.detection-core.structural-observation.v2"}
tests/fixtures/access_control/conformance/v1/artifacts/sha256/db111c965603bb4cf9d83ba07b0e22a57a537ba6a05448158ef7d7615efb18d3
Vendored
+1
View File
@@ -0,0 +1 @@
{"fact_id":"entry:express:app-route:get","matcher_behavior_digest":"0ad18521beeb3708e12f8c9941b3f29b3e1312fe78b9320e5aaf15bc9db8831a","matcher_lineage_manifest_digest":"5f7ffd58a773b61d1f8e2ba0ca019e27d778166e13cec770e6f25c16b1f1a994","matcher_revision":"entry-structural-matcher-v1","observations":[{"evidence":{"artifact_id":"structural-observation:02b8aa4884cb356afa9ba7960fee55f5d9a15f0e4b73fbc3573d85622d0defa9","byte_length":251,"content_digest":"02b8aa4884cb356afa9ba7960fee55f5d9a15f0e4b73fbc3573d85622d0defa9","media_type":"application/json","retention_policy_digest":"445c538acfffe5dde50f57bc699da2732e237207f0953c59dd8559f66c1a6708","storage_receipt_digest":"993681396623b12e3d9b6060c056b60c86e3027554ebe6eb403c6ec9ccb28142"},"location":{"column":0,"line":3,"path":"sources/complete.js","symbol":"app.get->adminHandler@sources/complete.js:4:9"},"observed":"app.get","requirement_id":"qualified_target"},{"evidence":{"artifact_id":"structural-observation:fc13dbdeea6d0909956de97eac4e2229a784e7cd76a51ab4fcc6db5151da6831","byte_length":249,"content_digest":"fc13dbdeea6d0909956de97eac4e2229a784e7cd76a51ab4fcc6db5151da6831","media_type":"application/json","retention_policy_digest":"445c538acfffe5dde50f57bc699da2732e237207f0953c59dd8559f66c1a6708","storage_receipt_digest":"7af07572d53abac371dbc1c5970ad5324ab23f1ef5744eeab7e3621b9f2c3f59"},"location":{"column":0,"line":3,"path":"sources/complete.js","symbol":"app.get->adminHandler@sources/complete.js:4:9"},"observed":"member_call","requirement_id":"call_shape"},{"evidence":{"artifact_id":"structural-observation:6c750f6128bd698bb27dd6db5e1260995cac678261ce2734cbf048c7b33e9b12","byte_length":255,"content_digest":"6c750f6128bd698bb27dd6db5e1260995cac678261ce2734cbf048c7b33e9b12","media_type":"application/json","retention_policy_digest":"445c538acfffe5dde50f57bc699da2732e237207f0953c59dd8559f66c1a6708","storage_receipt_digest":"a7ab3b129c07dedd077d877a3bc189b86f2da852a2b340c3496c1b729465002d"},"location":{"column":0,"line":3,"path":"sources/complete.js","symbol":"app.get->adminHandler@sources/complete.js:4:9"},"observed":"express_application","requirement_id":"receiver"},{"evidence":{"artifact_id":"structural-observation:88a8b08604bb7db69ccfc50af54701e4ab41044db5eb61cb812881a60e1b6370","byte_length":259,"content_digest":"88a8b08604bb7db69ccfc50af54701e4ab41044db5eb61cb812881a60e1b6370","media_type":"application/json","retention_policy_digest":"445c538acfffe5dde50f57bc699da2732e237207f0953c59dd8559f66c1a6708","storage_receipt_digest":"c2eec061e981fccdea378bf097a53b75de44916cd1bc908d899345cc30229bd5"},"location":{"column":0,"line":3,"path":"sources/complete.js","symbol":"app.get->adminHandler@sources/complete.js:4:9"},"observed":"route_path_and_handler","requirement_id":"arguments"}],"pack_digest":"331e8c2261cb030f4257a8650448560eb94941554df47cb275882e24b8f8923f","product_location":{"column":0,"line":3,"path":"sources/complete.js","symbol":"app.get->adminHandler@sources/complete.js:4:9"},"schema_version":"openultrasast.detection-core.fact-match.v2"}
tests/fixtures/access_control/conformance/v1/artifacts/sha256/dfad0338dfda8dc13feeb699ed359553c7b761dbbff151b815cde6a572c6cc88
Vendored
+1
View File
@@ -0,0 +1 @@
!"location":{"column":0,"line":3,"path":"sources/complete.js","symbol":"app.get->adminHandler@sources/complete.js:4:9"},"observed":"app.get","requirement_id":"qualified_target","schema_version":"openultrasast.detection-core.structural-observation.v2"}
tests/fixtures/access_control/conformance/v1/artifacts/sha256/e8e149309abd78f24206c58fde7f73ae2f60364d8b8fee22ecaee8342798d8ce
Vendored
+33
View File
@@ -0,0 +1,33 @@
{
"facts": [
{
"defines_handler": true,
"handler_kind": "route",
"id": "entry:express:app-route",
"pattern": "app.(get|post|put|delete|patch|all|use)\\s*\\("
},
{
"defines_handler": true,
"handler_kind": "route",
"id": "entry:express:router-route",
"pattern": "router.(get|post|put|delete|patch|all|use)\\s*\\("
},
{
"defines_handler": false,
"handler_kind": "app",
"id": "entry:express:express-app",
"pattern": "express\\s*\\(\\s*\\)"
}
],
"family": "access_control",
"framework": "express",
"kind": "entry_facts",
"languages": [
"javascript",
"typescript"
],
"review": {
"digest": "47866e5c15b286d7107b101bd396f78bbbda23788085676c590c3af937085e00",
"note": "Reviewed against Express 4/5 routing docs and the pilot pool's manifest-level framework usage (2026-10-30 recognition table). Entry patterns only; no sinks, no labels."
}
}
tests/fixtures/access_control/conformance/v1/artifacts/sha256/fc13dbdeea6d0909956de97eac4e2229a784e7cd76a51ab4fcc6db5151da6831
Vendored
+1
View File
@@ -0,0 +1 @@
{"location":{"column":0,"line":3,"path":"sources/complete.js","symbol":"app.get->adminHandler@sources/complete.js:4:9"},"observed":"member_call","requirement_id":"call_shape","schema_version":"openultrasast.detection-core.structural-observation.v2"}
tests/fixtures/access_control/conformance/v1/manifest.json
Vendored
+1
View File
File diff suppressed because one or more lines are too long
tests/fixtures/access_control/conformance/v1/sources/complete.js
Vendored
+4
View File
@@ -0,0 +1,4 @@
import express from "express";
const app = express();
app.get("/admin", adminHandler);
function adminHandler(req, res) { res.sendStatus(204); }
tests/fixtures/access_control/conformance/v1/sources/legacy-only.js
Vendored
+2
View File
@@ -0,0 +1,2 @@
// Legacy recognition text only: app.get("/admin", adminHandler)
export const marker = "not a structural registration";
tests/fixtures/access_control/conformance/v1/sources/name-only.js
Vendored
+2
View File
@@ -0,0 +1,2 @@
app.get("/admin", adminHandler);
function adminHandler(req, res) { res.sendStatus(204); }
tests/fixtures/access_control/conformance/v1/sources/partial.js
Vendored
+3
View File
@@ -0,0 +1,3 @@
import express from "express";
const app = express();
app.get("/admin");