Function build_l7_rules

crates/openshell-sandbox/src/mechanistic_mapper.rs:337–371

Build L7 allow-rules from observed (method, path) samples. Groups paths by HTTP method and generalises path patterns where possible: - `/v1/models/abc123` → `/v1/models/**` (ID-like trailing segments) - `/api/v2/users/42` → `/api/v2/users/*` (numeric trailing segment) Falls back to the exact observed path when no pattern applies.

(samples: &HashMap<(String, String), u32>)

///
/// Falls back to the exact observed path when no pattern applies.
fn build_l7_rules(samples: &HashMap<(String, String), u32>) -> Vec<L7Rule> {
    // Deduplicate after generalisation.
    let mut seen: std::collections::HashSet<(String, String)> = std::collections::HashSet::new();
    let mut rules = Vec::new();

    for (method, path) in samples.keys() {
        let generalised = generalise_path(path);
        let key = (method.clone(), generalised.clone());
        if !seen.insert(key) {
            continue;
        }

        rules.push(L7Rule {
            allow: Some(L7Allow {
                method: method.clone(),
                path: generalised,
                command: String::new(),
                query: HashMap::new(),
                operation_type: String::new(),
                operation_name: String::new(),
                fields: Vec::new(),
                params: HashMap::new(),
            }),
        });
    }

    // Sort for deterministic output.
    rules.sort_by(|a, b| {
        let a = a.allow.as_ref().unwrap();
        let b = b.allow.as_ref().unwrap();
        (&a.method, &a.path).cmp(&(&b.method, &b.path))
    });

    rules
}

/// Generalise a URL path for policy rules.
///