Function preprocess_yaml_data

crates/openshell-supervisor-network/src/opa.rs:723–763

Preprocess YAML policy data: parse, normalize, validate, expand access presets, return JSON.

(yaml_str: &str)

/// Preprocess YAML policy data: parse, normalize, validate, expand access presets, return JSON.
fn preprocess_yaml_data(yaml_str: &str) -> Result<String> {
    let mut data: serde_json::Value = serde_yml::from_str(yaml_str)
        .map_err(|e| miette::miette!("failed to parse YAML data: {e}"))?;

    // Normalize port → ports for all endpoints so Rego always sees "ports" array.
    normalize_endpoint_ports(&mut data);
    let config_errors = normalize_l7_config_aliases(&mut data);
    if !config_errors.is_empty() {
        return Err(miette::miette!(
            "L7 policy validation failed:\n{}",
            config_errors.join("\n")
        ));
    }

    // Validate BEFORE expanding presets (catches user errors like rules+access)
    let (errors, warnings) = crate::l7::validate_l7_policies(&data);
    for w in &warnings {
        openshell_ocsf::ocsf_emit!(
            openshell_ocsf::ConfigStateChangeBuilder::new(openshell_ocsf::ctx::ctx())
                .severity(openshell_ocsf::SeverityId::Medium)
                .status(openshell_ocsf::StatusId::Success)
                .state(openshell_ocsf::StateId::Enabled, "validated")
                .unmapped("warning", serde_json::json!(w.clone()))
                .message(format!("L7 policy validation warning: {w}"))
                .build()
        );
    }
    if !errors.is_empty() {
        return Err(miette::miette!(
            "L7 policy validation failed:\n{}",
            errors.join("\n")
        ));
    }

    normalize_l7_policy_rule_aliases(&mut data);

    // Expand access presets to explicit rules after validation
    crate::l7::expand_access_presets(&mut data);

    serde_json::to_string(&data).map_err(|e| miette::miette!("failed to serialize data: {e}"))
}

/// Normalize endpoint port/ports in JSON data.
///