Detect property to exclude Cargo dependencies

detectable/src/main/java/com/blackduck/integration/detectable/detectable/util/EnumListFilter.java

@@ -87,4 +87,7 @@ public boolean shouldExclude(T enumValue) {
         return excludedSet.contains(enumValue);
     }
 
+    public boolean shouldIncludeAll() {
+        return excludedSet.isEmpty();
+    }
 }

detectable/src/main/java/com/blackduck/integration/detectable/detectables/cargo/CargoCliDetectable.java

@@ -36,15 +36,17 @@ public class CargoCliDetectable extends Detectable {
     private final CargoResolver cargoResolver;
     private final CargoCliExtractor cargoCliExtractor;
     private final DetectableExecutableRunner executableRunner;
+    private final CargoDetectableOptions cargoDetectableOptions;
     private ExecutableTarget cargoExe;
     private File cargoToml;
 
-    public CargoCliDetectable(DetectableEnvironment environment, FileFinder fileFinder, CargoResolver cargoResolver, CargoCliExtractor cargoCliExtractor, DetectableExecutableRunner executableRunner) {
+    public CargoCliDetectable(DetectableEnvironment environment, FileFinder fileFinder, CargoResolver cargoResolver, CargoCliExtractor cargoCliExtractor, DetectableExecutableRunner executableRunner, CargoDetectableOptions cargoDetectableOptions) {
         super(environment);
         this.fileFinder = fileFinder;
         this.cargoResolver = cargoResolver;
         this.cargoCliExtractor = cargoCliExtractor;
         this.executableRunner = executableRunner;
+        this.cargoDetectableOptions = cargoDetectableOptions;
     }
 
     @Override
@@ -72,7 +74,7 @@ public DetectableResult extractable() throws DetectableException {
     @Override
     public Extraction extract(ExtractionEnvironment extractionEnvironment) throws IOException, DetectableException, MissingExternalIdException, ExecutableRunnerException {
         try {
-            return cargoCliExtractor.extract(environment.getDirectory(), cargoExe, cargoToml);
+            return cargoCliExtractor.extract(environment.getDirectory(), cargoExe, cargoToml, cargoDetectableOptions);
         } catch (Exception e) {
             logger.error("Failed to extract Cargo dependencies.", e);
             return new Extraction.Builder().failure("Cargo extraction failed due to an exception: " + e.getMessage()).build();

detectable/src/main/java/com/blackduck/integration/detectable/detectables/cargo/CargoCliExtractor.java

@@ -18,7 +18,10 @@
 import java.nio.charset.StandardCharsets;
 import java.util.Arrays;
 import java.util.List;
+import java.util.ArrayList;
 import java.util.Optional;
+import java.util.Map;
+import java.util.EnumMap;
 
 public class CargoCliExtractor {
     private static final List<String> CARGO_TREE_COMMAND = Arrays.asList("tree", "--no-dedupe", "--prefix", "depth");
@@ -32,8 +35,12 @@ public CargoCliExtractor(DetectableExecutableRunner executableRunner, CargoDepen
         this.cargoTomlParser = cargoTomlParser;
     }
 
-    public Extraction extract(File directory, ExecutableTarget cargoExe, File cargoTomlFile) throws ExecutableFailedException, IOException {
-        ExecutableOutput cargoOutput = executableRunner.executeSuccessfully(ExecutableUtils.createFromTarget(directory, cargoExe, CARGO_TREE_COMMAND));
+    public Extraction extract(File directory, ExecutableTarget cargoExe, File cargoTomlFile, CargoDetectableOptions cargoDetectableOptions) throws ExecutableFailedException, IOException {
+        List<String> cargoTreeCommand = new ArrayList<>(CARGO_TREE_COMMAND);
+
+        addEdgeExclusions(cargoTreeCommand, cargoDetectableOptions);
+
+        ExecutableOutput cargoOutput = executableRunner.executeSuccessfully(ExecutableUtils.createFromTarget(directory, cargoExe, cargoTreeCommand));
         List<String> cargoTreeOutput = cargoOutput.getStandardOutputAsList();
 
         DependencyGraph graph = cargoDependencyTransformer.transform(cargoTreeOutput);
@@ -51,4 +58,24 @@ public Extraction extract(File directory, ExecutableTarget cargoExe, File cargoT
             .nameVersionIfPresent(projectNameVersion)
             .build();
     }
+
+    private void addEdgeExclusions(List<String> cargoTreeCommand, CargoDetectableOptions options) {
+        Map<CargoDependencyType, String> exclusionMap = new EnumMap<>(CargoDependencyType.class);
+        exclusionMap.put(CargoDependencyType.NORMAL, "no-normal");
+        exclusionMap.put(CargoDependencyType.BUILD, "no-build");
+        exclusionMap.put(CargoDependencyType.DEV, "no-dev");
+        exclusionMap.put(CargoDependencyType.PROC_MACRO, "no-proc-macro");
+
+        List<String> exclusions = new ArrayList<>();
+        for (Map.Entry<CargoDependencyType, String> entry : exclusionMap.entrySet()) {
+            if (options.getDependencyTypeFilter().shouldExclude(entry.getKey())) {
+                exclusions.add(entry.getValue());
+            }
+        }
+
+        if (!exclusions.isEmpty()) {
+            cargoTreeCommand.add("--edges");
+            cargoTreeCommand.add(String.join(",", exclusions));
+        }
+    }
 }

detectable/src/main/java/com/blackduck/integration/detectable/detectables/cargo/CargoDependencyType.java

@@ -0,0 +1,8 @@
+package com.blackduck.integration.detectable.detectables.cargo;
+
+public enum CargoDependencyType {
+    NORMAL,
+    BUILD,
+    DEV,
+    PROC_MACRO
+}

detectable/src/main/java/com/blackduck/integration/detectable/detectables/cargo/CargoDetectableOptions.java

@@ -0,0 +1,15 @@
+package com.blackduck.integration.detectable.detectables.cargo;
+
+import com.blackduck.integration.detectable.detectable.util.EnumListFilter;
+
+public class CargoDetectableOptions {
+    private final EnumListFilter<CargoDependencyType> dependencyTypeFilter;
+
+    public CargoDetectableOptions(EnumListFilter<CargoDependencyType> dependencyTypeFilter) {
+        this.dependencyTypeFilter = dependencyTypeFilter;
+    }
+
+    public EnumListFilter<CargoDependencyType> getDependencyTypeFilter() {
+        return dependencyTypeFilter;
+    }
+}

detectable/src/main/java/com/blackduck/integration/detectable/detectables/cargo/CargoExtractor.java

@@ -3,11 +3,20 @@
 import java.io.File;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
+import java.util.ArrayDeque;
 import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Deque;
+import java.util.HashSet;
 import java.util.List;
+import java.util.Map;
+import java.util.Objects;
 import java.util.Optional;
+import java.util.Set;
 import java.util.stream.Collectors;
 
+import com.blackduck.integration.detectable.detectable.util.EnumListFilter;
+import com.blackduck.integration.detectable.detectables.cargo.data.CargoLockPackageData;
 import org.apache.commons.io.FileUtils;
 import org.jetbrains.annotations.Nullable;
 
@@ -39,26 +48,152 @@ public CargoExtractor(
         this.cargoLockPackageTransformer = cargoLockPackageTransformer;
     }
 
-    public Extraction extract(File cargoLockFile, @Nullable File cargoTomlFile) throws IOException, DetectableException, MissingExternalIdException {
+    public Extraction extract(File cargoLockFile, @Nullable File cargoTomlFile, CargoDetectableOptions cargoDetectableOptions) throws IOException, DetectableException, MissingExternalIdException {
         CargoLockData cargoLockData = new Toml().read(cargoLockFile).to(CargoLockData.class);
-        List<CargoLockPackage> packages = cargoLockData.getPackages()
-            .orElse(new ArrayList<>()).stream()
+        List<CargoLockPackageData> cargoLockPackageDataList = cargoLockData.getPackages().orElse(new ArrayList<>());
+        List<CargoLockPackageData> filteredPackages = cargoLockPackageDataList;
+        boolean exclusionEnabled = isDependencyExclusionEnabled(cargoDetectableOptions);
+        String cargoTomlContents = null;
+
+        if(cargoTomlFile == null && exclusionEnabled) {
+            return new Extraction.Builder()
+                .failure("Cargo.toml file is required to exclude dependencies, but was not provided.")
+                .build();
+        }
+
+        if (cargoTomlFile != null) {
+            cargoTomlContents = FileUtils.readFileToString(cargoTomlFile, StandardCharsets.UTF_8);
+        }
+
+        if (cargoTomlFile != null && exclusionEnabled) {
+            Set<NameVersion> dependenciesToInclude = cargoTomlParser.parseDependenciesToInclude(
+                    cargoTomlContents, cargoDetectableOptions.getDependencyTypeFilter());
+            filteredPackages = includeDependencies(cargoLockPackageDataList, dependenciesToInclude);
+        }
+
+        List<CargoLockPackage> packages = filteredPackages.stream()
             .map(cargoLockPackageDataTransformer::transform)
             .collect(Collectors.toList());
 
         DependencyGraph graph = cargoLockPackageTransformer.transformToGraph(packages);
 
         Optional<NameVersion> projectNameVersion = Optional.empty();
         if (cargoTomlFile != null) {
-            String cargoTomlContents = FileUtils.readFileToString(cargoTomlFile, StandardCharsets.UTF_8);
             projectNameVersion = cargoTomlParser.parseNameVersionFromCargoToml(cargoTomlContents);
         }
-
         CodeLocation codeLocation = new CodeLocation(graph); //TODO: Consider for producing a ProjectDependencyGraph
 
         return new Extraction.Builder()
             .success(codeLocation)
             .nameVersionIfPresent(projectNameVersion)
             .build();
     }
+
+    private boolean isDependencyExclusionEnabled(CargoDetectableOptions options) {
+        if (options == null) {
+            return false;
+        }
+
+        EnumListFilter<CargoDependencyType> filter = options.getDependencyTypeFilter();
+        return filter != null && !filter.shouldIncludeAll();
+    }
+
+
+    private List<CargoLockPackageData> includeDependencies(
+            List<CargoLockPackageData> packages,
+            Set<NameVersion> dependenciesToInclude
+    ) {
+        processTransitiveDependenciesForInclusion(packages, dependenciesToInclude); // Collect all transitive dependencies to include
+        return filterPackagesByInclusion(packages, dependenciesToInclude); // Only keep direct and transitive dependencies
+    }
+
+    private void processTransitiveDependenciesForInclusion(List<CargoLockPackageData> packages, Set<NameVersion> dependenciesToInclude) {
+        Set<NameVersion> resolvedToInclude = new HashSet<>();
+        for (NameVersion nv : dependenciesToInclude) {
+            CargoLockPackageData pkg = findPackageByNameVersion(nv, packages);
+            if (pkg != null) {
+                String name = pkg.getName().orElse(null);
+                String version = pkg.getVersion().orElse(null);
+                resolvedToInclude.add(new NameVersion(name, version));
+            } else {
+                resolvedToInclude.add(nv);
+            }
+        }
+        dependenciesToInclude.clear();
+        dependenciesToInclude.addAll(resolvedToInclude);
+
+        Deque<NameVersion> queue = new ArrayDeque<>(dependenciesToInclude);
+        while (!queue.isEmpty()) {
+            NameVersion current = queue.pop();
+            CargoLockPackageData currentPkg = findPackageByNameVersion(current, packages);
+            if (currentPkg != null) {
+                currentPkg.getDependencies().ifPresent(dependencies -> {
+                    for (String depStr : dependencies) {
+                        NameVersion nameVersion = extractPackageNameVersion(depStr, packages);
+                        if (nameVersion != null && dependenciesToInclude.add(nameVersion)) {
+                            queue.add(nameVersion);
+                        }
+                    }
+                });
+            }
+        }
+    }
+
+    private List<CargoLockPackageData> filterPackagesByInclusion(
+            List<CargoLockPackageData> packages,
+            Set<NameVersion> dependenciesToInclude
+    ) {
+        List<CargoLockPackageData> result = new ArrayList<>();
+        for (CargoLockPackageData pkg : packages) {
+            String name = pkg.getName().orElse(null);
+            String version = VersionUtils.stripBuildMetadata(pkg.getVersion().orElse(null));
+            for (NameVersion include : dependenciesToInclude) {
+                String includeName = include.getName();
+                String includeVersion = VersionUtils.stripBuildMetadata(include.getVersion());
+                if (Objects.equals(name, includeName) && VersionUtils.versionMatches(includeVersion, version)) {
+                    result.add(pkg);
+                    break;
+                }
+            }
+        }
+        return result;
+    }
+
+    private NameVersion extractPackageNameVersion(String dependencyString, List<CargoLockPackageData> packages) {
+        if (dependencyString == null || dependencyString.isEmpty()) {
+            return null;
+        }
+
+        String[] parts = dependencyString.split(" ");
+        String depName = parts[0].trim();
+        String depVersion = (parts.length > 1) ? parts[1].trim() : null;
+
+        // If depVersion is null or empty, find by name only.
+        // Otherwise, find by name and version.
+        if (depVersion == null || depVersion.isEmpty()) {
+            for (CargoLockPackageData pkg : packages) {
+                String name = pkg.getName().orElse(null);
+                String version = pkg.getVersion().orElse(null);
+                if (depName.equals(name)) {
+                    return new NameVersion(name, version);
+                }
+            }
+        }
+        return new NameVersion(depName, depVersion);
+    }
+
+    private CargoLockPackageData findPackageByNameVersion(NameVersion nv, List<CargoLockPackageData> packages) {
+        for (CargoLockPackageData pkg : packages) {
+            String name = pkg.getName().orElse(null);
+            String version = pkg.getVersion().orElse(null);
+
+            // Matching name and use VersionUtils to check if the versions are compatible
+            if (nv.getName().equals(name)
+                && version != null
+                && VersionUtils.versionMatches(VersionUtils.stripBuildMetadata(nv.getVersion()), VersionUtils.stripBuildMetadata(version))) {
+                return pkg;
+            }
+        }
+        return null;
+    }
 }

detectable/src/main/java/com/blackduck/integration/detectable/detectables/cargo/CargoLockDetectable.java

@@ -25,14 +25,15 @@ public class CargoLockDetectable extends Detectable {
 
     private final FileFinder fileFinder;
     private final CargoExtractor cargoExtractor;
-
+    private final CargoDetectableOptions cargoDetectableOptions;
     private File cargoLock;
     private File cargoToml;
 
-    public CargoLockDetectable(DetectableEnvironment environment, FileFinder fileFinder, CargoExtractor cargoExtractor) {
+    public CargoLockDetectable(DetectableEnvironment environment, FileFinder fileFinder, CargoExtractor cargoExtractor, CargoDetectableOptions cargoDetectableOptions) {
         super(environment);
         this.fileFinder = fileFinder;
         this.cargoExtractor = cargoExtractor;
+        this.cargoDetectableOptions = cargoDetectableOptions;
     }
 
     @Override
@@ -52,6 +53,6 @@ public DetectableResult extractable() {
 
     @Override
     public Extraction extract(ExtractionEnvironment extractionEnvironment) throws IOException, DetectableException, MissingExternalIdException {
-        return cargoExtractor.extract(cargoLock, cargoToml);
+        return cargoExtractor.extract(cargoLock, cargoToml, cargoDetectableOptions);
     }
 }