Function generate_proposals

crates/openshell-sandbox/src/mechanistic_mapper.rs:59–242

Generate draft `PolicyChunk` proposals from denial summaries. Groups denials by `(host, port, binary)`, then for each group generates a `PolicyChunk` with a `NetworkPolicyRule` allowing that endpoint for that single binary. This produces one proposal per binary so each `(sandbox_id, host, port, binary)` maps to exactly one DB row. Proposals never include `allowed_ips`. If the user applies a prop

(summaries: &[DenialSummary])

///
/// Returns an empty vec if there are no actionable denials.
pub fn generate_proposals(summaries: &[DenialSummary]) -> Vec<PolicyChunk> {
    // Group denials by (host, port, binary).
    let mut groups: HashMap<(String, u32, String), Vec<&DenialSummary>> = HashMap::new();

    for summary in summaries {
        let binary_key = if summary.binary.is_empty() {
            String::new()
        } else {
            summary.binary.clone()
        };
        groups
            .entry((summary.host.clone(), summary.port, binary_key))
            .or_default()
            .push(summary);
    }

    let mut proposals = Vec::new();

    for ((host, port, binary), denials) in &groups {
        let rule_name = generate_rule_name(host, *port);

        let mut total_count: u32 = 0;
        let mut first_seen_ms: i64 = i64::MAX;
        let mut last_seen_ms: i64 = 0;
        let mut is_ssrf = false;

        for denial in denials {
            total_count += denial.count;
            first_seen_ms = first_seen_ms.min(denial.first_seen_ms);
            last_seen_ms = last_seen_ms.max(denial.last_seen_ms);
            if denial.denial_stage == "ssrf" {
                is_ssrf = true;
            }
        }

        // Collect L7 request samples across all denials in this group.
        let mut l7_methods: HashMap<(String, String), u32> = HashMap::new();
        let mut has_l7 = false;
        for denial in denials {
            if denial.l7_inspection_active || !denial.l7_request_samples.is_empty() {
                has_l7 = true;
            }
            for sample in &denial.l7_request_samples {
                *l7_methods
                    .entry((sample.method.clone(), sample.path.clone()))
                    .or_insert(0) += sample.count;
            }
        }

        // Skip proposals for always-blocked destinations (loopback,
        // link-local, unspecified, and known metadata hostnames). These would
        // be denied at runtime regardless of policy, producing an infinite
        // proposal loop in the TUI.
        if is_always_blocked_destination(host) {
            tracing::info!(
                host,
                port,
                "Skipped proposal for always-blocked destination \