Function computeFirewallDiff

pkg/cli/audit_diff.go:62–207

computeFirewallDiff computes the diff between two FirewallAnalysis results. run1 is the "before" (baseline) and run2 is the "after" (comparison target). Either analysis may be nil, indicating no firewall data for that run.

(run1ID, run2ID int64, run1, run2 *FirewallAnalysis)

// run1 is the "before" (baseline) and run2 is the "after" (comparison target).
// Either analysis may be nil, indicating no firewall data for that run.
func computeFirewallDiff(run1ID, run2ID int64, run1, run2 *FirewallAnalysis) *FirewallDiff {
	auditDiffLog.Printf("Computing firewall diff: run1=%d, run2=%d", run1ID, run2ID)
	diff := &FirewallDiff{
		Run1ID: run1ID,
		Run2ID: run2ID,
	}

	// Handle nil cases
	run1Stats := make(map[string]DomainRequestStats)
	run2Stats := make(map[string]DomainRequestStats)

	if run1 != nil {
		run1Stats = run1.RequestsByDomain
	}
	if run2 != nil {
		run2Stats = run2.RequestsByDomain
	}

	// If both are nil/empty, return empty diff
	if len(run1Stats) == 0 && len(run2Stats) == 0 {
		return diff
	}

	// Collect all domains
	allDomains := make(map[string]struct{})
	for domain := range run1Stats {
		allDomains[domain] = struct{}{}
	}
	for domain := range run2Stats {
		allDomains[domain] = struct{}{}
	}

	// Sorted domain list for deterministic output
	sortedDomains := sliceutil.SortedKeys(allDomains)

	anomalyCount := 0

	for _, domain := range sortedDomains {
		stats1, inRun1 := run1Stats[domain]
		stats2, inRun2 := run2Stats[domain]

		if !inRun1 && inRun2 {
			// New domain in run 2
			entry := DomainDiffEntry{
				Domain:      domain,
				Status:      "new",
				Run2Allowed: stats2.Allowed,
				Run2Blocked: stats2.Blocked,
				Run2Status:  classifyFirewallDomainStatus(stats2),
			}
			// Anomaly: new denied domain
			if stats2.Blocked > 0 {
				entry.IsAnomaly = true
				entry.AnomalyNote = "new denied domain"
				anomalyCount++
			}
			diff.NewDomains = append(diff.NewDomains, entry)
		} else if inRun1 && !inRun2 {