Function analyzeFirewallPolicy

pkg/cli/firewall_policy.go:499–539

analyzeFirewallPolicy loads policy manifest and audit JSONL, then enriches with rule attribution. Returns nil if no policy artifacts are found (graceful fallback to basic analysis).

(runDir string, verbose bool)

// analyzeFirewallPolicy loads policy manifest and audit JSONL, then enriches with rule attribution.
// Returns nil if no policy artifacts are found (graceful fallback to basic analysis).
func analyzeFirewallPolicy(runDir string, verbose bool) (*PolicyAnalysis, error) {
	manifestPath, auditJSONLPath, err := detectFirewallAuditArtifacts(runDir)
	if err != nil {
		return nil, fmt.Errorf("failed to detect firewall audit artifacts: %w", err)
	}

	if manifestPath == "" {
		firewallPolicyLog.Print("No policy manifest found, skipping policy analysis")
		return nil, nil
	}

	manifest, err := loadPolicyManifest(manifestPath)
	if err != nil {
		return nil, fmt.Errorf("failed to load policy manifest: %w", err)
	}

	if auditJSONLPath == "" {
		// We have a manifest but no audit log — return policy summary without request enrichment
		firewallPolicyLog.Print("No audit JSONL found, returning manifest-only analysis")
		sslBump := "disabled"
		if manifest.SSLBumpEnabled {
			sslBump = "enabled"
		}
		dlp := "disabled"
		if manifest.DLPEnabled {
			dlp = "enabled"
		}

		return &PolicyAnalysis{
			PolicySummary: fmt.Sprintf("%d rules, SSL Bump %s, DLP %s", len(manifest.Rules), sslBump, dlp),
			RuleHits:      make([]RuleHitStats, 0),
		}, nil
	}

	entries, err := parseAuditJSONL(auditJSONLPath)
	if err != nil {
		return nil, fmt.Errorf("failed to parse audit JSONL: %w", err)
	}

	return enrichWithPolicyRules(entries, manifest), nil
}