Add CI-ready entitlement smart diff

.gitignore

@@ -4,6 +4,7 @@
 # Ignore binstubs but do commit the one specific for this code.
 bin/*
 !bin/deploy-entitlements
+!bin/entitlements-smart-diff
 
 # There's a place for local caching of container gems to make local builds faster.
 # Keep the .keep file but not the gems themselves

Gemfile.lock

@@ -4,6 +4,7 @@ PATH
     entitlements-app (1.2.3)
       concurrent-ruby (~> 1.3, >= 1.3.1)
       dogstatsd-ruby (~> 5.7)
+      extralite-bundle (= 2.10)
       faraday (~> 2.0)
       logger (~> 1.6)
       net-ldap (~> 0.19)
@@ -42,6 +43,7 @@ GEM
     docile (1.4.0)
     dogstatsd-ruby (5.7.1)
     drb (2.2.1)
+    extralite-bundle (2.10)
     faraday (2.14.1)
       faraday-net_http (>= 2.0, < 3.5)
       json

bin/entitlements-smart-diff

@@ -0,0 +1,6 @@
+#!/usr/bin/env ruby
+
+require "entitlements"
+require "entitlements/smart_diff/cli"
+
+exit Entitlements::SmartDiff::Cli.run

entitlements-app.gemspec

@@ -10,9 +10,9 @@ Gem::Specification.new do |s|
   s.authors = ["GitHub, Inc. Security Ops"]
   s.email = "opensource+entitlements-app@github.com"
   s.license = "MIT"
-  s.files = Dir.glob("lib/**/*") + %w[bin/deploy-entitlements]
+  s.files = Dir.glob("lib/**/*") + %w[bin/deploy-entitlements bin/entitlements-smart-diff]
   s.homepage = "https://github.com/github/entitlements-app"
-  s.executables = %w[deploy-entitlements]
+  s.executables = %w[deploy-entitlements entitlements-smart-diff]
 
   s.required_ruby_version = ">= 3.0.0"
 
@@ -24,6 +24,7 @@ Gem::Specification.new do |s|
   s.add_dependency "optimist", "~> 3.1"
   s.add_dependency "ostruct", "~> 0.6.0"
   s.add_dependency "logger", "~> 1.6"
+  s.add_dependency "extralite-bundle", "2.10"
 
   s.add_development_dependency "debug", "<= 1.8.0"
   s.add_development_dependency "rake", "~> 13.2", ">= 13.2.1"

lib/entitlements.rb

@@ -4,6 +4,7 @@
 # Load third party dependencies first.
 require "concurrent"
 require "ruby_version_check"
+require "time"
 
 # contracts.ruby has two specific ruby-version specific libraries, which we have vendored into lib/
 
@@ -90,13 +91,49 @@ def self.reset!
     @config = nil
     @config_file = nil
     @config_path_override = nil
+    @evaluation_time = nil
     @person_extra_methods = {}
     @statsd = nil
 
     reset_extras!
     Entitlements::Data::Groups::Calculated.reset!
   end
 
+  def self.with_evaluation_context(config_file:, evaluated_at:, tree_root: nil, prepare: nil)
+    original_dir = ENV["DIR"]
+    ENV["DIR"] = File.expand_path(tree_root) if tree_root
+    reset!
+    self.config_file = config_file
+    self.evaluation_time = evaluated_at
+    prepare.call(config) if prepare
+    load_extras
+    register_filters
+    yield config
+  ensure
+    reset!
+    if tree_root
+      original_dir ? ENV["DIR"] = original_dir : ENV.delete("DIR")
+    end
+  end
+
+  # Return the fixed time used for the current date-sensitive entitlement evaluation.
+  #
+  # Returns a Time.
+  Contract C::None => Time
+  def self.evaluation_time
+    @evaluation_time ||= Time.now
+  end
+
+  # Set the time used for date-sensitive entitlement evaluation.
+  #
+  # value - A Time.
+  #
+  # Returns the supplied Time.
+  Contract Time => Time
+  def self.evaluation_time=(value)
+    @evaluation_time = value
+  end
+
   def self.reset_extras!
     extras_loaded = @extras_loaded
     if extras_loaded
@@ -674,6 +711,7 @@ def self.cache
 require_relative "entitlements/cli"
 require_relative "entitlements/data/groups"
 require_relative "entitlements/data/people"
+require_relative "entitlements/desired_groups"
 require_relative "entitlements/extras"
 require_relative "entitlements/extras/base"
 require_relative "entitlements/models/action"
@@ -685,6 +723,7 @@ def self.cache
 require_relative "entitlements/plugins/posix_group"
 require_relative "entitlements/rule/base"
 require_relative "entitlements/service/ldap"
+require_relative "entitlements/smart_diff"
 require_relative "entitlements/util/mirror"
 require_relative "entitlements/util/override"
 require_relative "entitlements/util/util"

lib/entitlements/data/groups/calculated.rb

@@ -39,6 +39,7 @@ def self.reset!
           @groups_in_ou_cache = {}
           @groups_cache = {}
           @config_cache = {}
+          Entitlements::Data::Groups::Calculated::Rules::Group.reset!
         end
 
         # Construct a group object.

lib/entitlements/data/groups/calculated/base.rb

@@ -118,7 +118,7 @@ def filtered_members
               filters.reject { |_, filter_val| filter_val == :all }.each do |filter_name, filter_val|
                 filter_cfg = Entitlements::Data::Groups::Calculated.filters_index[filter_name]
                 clazz = filter_cfg.fetch(:class)
-                obj = clazz.new(filter: filter_val, config: filter_cfg.fetch(:config, {}))
+                obj = clazz.new(filter: filter_val, config: filter_cfg.fetch(:config, {}), options: options)
                 # If excluded_paths is set, ignore any of those excluded paths
                 unless filter_cfg[:config]["excluded_paths"].nil?
                   # if the filename is not in any of the excluded paths, filter it
@@ -217,7 +217,7 @@ def expired?(expiration, context)
             return false if expiration.nil? || expiration.strip.empty?
             if expiration =~ /\A(\d{4})-(\d{2})-(\d{2})\z/
               year, month, day = Regexp.last_match(1).to_i, Regexp.last_match(2).to_i, Regexp.last_match(3).to_i
-              return Time.utc(year, month, day, 0, 0, 0) <= Time.now.utc
+              return Time.utc(year, month, day, 0, 0, 0) <= Entitlements.evaluation_time.utc
             end
             message = "Invalid expiration date #{expiration.inspect} in #{context} (expected format: YYYY-MM-DD)"
             raise ArgumentError, message
@@ -340,7 +340,7 @@ def handle_or(rule)
           # Returns C::SetOf[Entitlements::Models::Person] from a recursive call.
           def handle_and(rule)
             ensure_type!("and", rule, Array)
-            return result unless rule.any?
+            return Set.new unless rule.any?
 
             first_rule = rule.shift
             ensure_type!("and", first_rule, Hash)

lib/entitlements/data/groups/calculated/filters/base.rb

@@ -31,16 +31,18 @@ def filtered?(_member)
             # config - Configuration data (Hash, optional)
             Contract C::KeywordArgs[
               filter: C::Or[:none, C::ArrayOf[String]],
-              config: C::Maybe[Hash]
+              config: C::Maybe[Hash],
+              options: C::Optional[C::HashOf[Symbol => C::Any]]
             ] => C::Any
-            def initialize(filter:, config: {})
+            def initialize(filter:, config: {}, options: {})
               @filter = filter
               @config = config
+              @options = options
             end
 
             private
 
-            attr_reader :config, :filter
+            attr_reader :config, :filter, :options
 
             # Helper method: Determine if the person is listed in an array of filter conditions.
             # Filter conditions that have no `/` are interpreted to be usernames, whereas filter
@@ -79,6 +81,7 @@ def member_of_named_group?(member, group_ref)
               Entitlements.cache[:member_of_named_group][group_ref] ||= begin
                 member_set = Entitlements::Data::Groups::Calculated::Rules::Group.matches(
                   value: group_ref,
+                  options: options
                 )
                 member_set.map { |person| person.uid.downcase }
               end

lib/entitlements/data/groups/calculated/modifiers/expiration.rb

@@ -30,7 +30,7 @@ def modify(result)
               end
 
               # If the date is in the future, leave the entitlement unchanged.
-              return false if parse_date > Time.now.utc.to_date
+              return false if parse_date > Entitlements.evaluation_time.utc.to_date
 
               # Empty the group. Set metadata allowing no members. Return true to indicate modification.
               rs.metadata["no_members_ok"] = true

lib/entitlements/data/groups/calculated/rules/group.rb

@@ -14,6 +14,10 @@ class Group < Entitlements::Data::Groups::Calculated::Rules::Base
               "yaml" => "Entitlements::Data::Groups::Calculated::YAML"
             }
 
+            def self.reset!
+              @files_for_cache = {}
+            end
+
             # Interface method: Get a Set[Entitlements::Models::Person] matching this condition.
             #
             # value    - The value to match.
@@ -66,6 +70,7 @@ def self.matches(value:, filename: nil, options: {})
                     clazz = Kernel.const_get(FILE_EXTENSIONS[ext])
                     Entitlements.cache[:file_objects][filebase_with_path] = clazz.new(
                       filename: "#{filebase_with_path}.#{ext}",
+                      options: options
                     )
                     if Entitlements.cache[:file_objects][filebase_with_path].members == :calculating
                       next if matching_files.size > 1

lib/entitlements/data/groups/calculated/text.rb

@@ -21,10 +21,12 @@ class Text < Entitlements::Data::Groups::Calculated::Base
           # Returns a Set[String] with DN's of the people in the group.
           Contract C::None => C::Or[:calculating, C::SetOf[Entitlements::Models::Person]]
           def members
-            @members ||= begin
-              Entitlements.logger.debug "Calculating members from #{filename}"
-              members_from_rules(rules)
-            end
+            return @members if @members
+
+            Entitlements.logger.debug "Calculating members from #{filename}"
+            result = members_from_rules(rules)
+            @members = result unless result == :calculating
+            result
           end
 
           # Standard interface: Get the description of this group.
@@ -182,7 +184,7 @@ def rules
               if parsed_data.key?("modifier_expiration") && affirmative.empty?
                 exp_date = parsed_data.fetch("modifier_expiration").fetch("=").first.fetch(:key)
                 date = Entitlements::Util::Util.parse_date(exp_date)
-                return {"always" => false} if date <= Time.now.utc.to_date
+                return {"always" => false} if date <= Entitlements.evaluation_time.utc.to_date
               end
 
               # There has to be at least one affirmative condition, not just all negative ones.

lib/entitlements/data/groups/calculated/yaml.rb

@@ -18,10 +18,12 @@ class YAML < Entitlements::Data::Groups::Calculated::Base
           # Returns a Set[String] with DN's of the people in the group.
           Contract C::None => C::Or[:calculating, C::SetOf[Entitlements::Models::Person]]
           def members
-            @members ||= begin
-              Entitlements.logger.debug "Calculating members from #{filename}"
-              members_from_rules(rules)
-            end
+            return @members if @members
+
+            Entitlements.logger.debug "Calculating members from #{filename}"
+            result = members_from_rules(rules)
+            @members = result unless result == :calculating
+            result
           end
 
           # Standard interface: Get the description of this group.