Added lockdown configuration, wick audit, and wick run --dryrun

.cargo/config

@@ -8,4 +8,7 @@ rustflags = ["-C", "link-arg=-undefined", "-C", "link-arg=dynamic_lookup"]
 linker = "aarch64-linux-gnu-gcc"
 
 [target.x86_64-pc-windows-gnu]
-linker = "x86_64-w64-mingw32-gcc"
+linker = "x86_64-w64-mingw32-gcc"
+
+[registries.crates-io]
+protocol = "sparse"

Cargo.toml

@@ -74,14 +74,14 @@ wasmtime = { version = "11.0", default-features = false, features = [
 wasmtime-wasi = { version = "11.0", features = ["sync"] }
 wasi-common = { version = "11.0" }
 # wasmrs
-wasmrs = { version = "0.14.0" }
-wasmrs-codec = { version = "0.14.0" }
-wasmrs-frames = { version = "0.14.0" }
-wasmrs-guest = { version = "0.14.0" }
-wasmrs-host = { version = "0.14.0" }
-wasmrs-runtime = { version = "0.14.0" }
-wasmrs-rx = { version = "0.14.0" }
-wasmrs-wasmtime = { version = "0.14.0" }
+wasmrs = { version = "0.15.0" }
+wasmrs-codec = { version = "0.15.0" }
+wasmrs-frames = { version = "0.15.0" }
+wasmrs-guest = { version = "0.15.0" }
+wasmrs-host = { version = "0.15.0" }
+wasmrs-runtime = { version = "0.15.0" }
+wasmrs-rx = { version = "0.15.0" }
+wasmrs-wasmtime = { version = "0.15.0" }
 #
 # Other
 #
@@ -209,3 +209,4 @@ walkdir = { version = "2.3", default-features = false }
 xdg = { version = "2.4", default-features = false }
 byteorder = { version = "1.4", default-features = false }
 rstest = { version = "0.18", default-features = false }
+wildmatch = { version = "2.1.1", default-features = false }

crates/bins/wick/src/commands.rs

@@ -15,8 +15,8 @@ pub(crate) mod wasm;
 
 use clap::{Parser, Subcommand};
 
+use crate::options::logging::LoggingOptions;
 use crate::options::GlobalOptions;
-use crate::LoggingOptions;
 
 #[derive(Parser, Debug, Clone)]
 #[clap(
@@ -35,20 +35,23 @@ pub(crate) struct Cli {
 
 #[derive(Debug, Clone, Subcommand)]
 pub(crate) enum CliCommand {
-  // Core commands
   /// Start a persistent host from a manifest.
   #[clap(name = "serve")]
   Serve(serve::Options),
-  /// Load a manifest and execute an entrypoint component (temporarily disabled).
+
+  /// Run a wick application.
   #[clap(name = "run")]
   Run(run::Options),
-  /// Invoke a component from a manifest or wasm module.
+
+  /// Invoke an operation.
   #[clap(name = "invoke")]
   Invoke(invoke::Options),
-  /// Print the components in a manifest or wasm module.
+
+  /// Print the signature of a component.
   #[clap(name = "list")]
   List(list::Options),
-  /// Execute a component with test data and assert its output.
+
+  /// Run test cases against a component.
   #[clap(name = "test")]
   Test(test::Options),
 

crates/bins/wick/src/commands/config.rs

@@ -1,5 +1,6 @@
 use clap::Subcommand;
 
+pub(crate) mod audit;
 pub(crate) mod dot;
 pub(crate) mod expand;
 
@@ -8,6 +9,9 @@ pub(crate) enum SubCommands {
   /// Generate a dot-syntax graph of a composite component.
   #[clap(name = "dot")]
   Dot(dot::Options),
+  /// Generate an audit report for a component or application.
+  #[clap(name = "audit")]
+  Audit(audit::Options),
   /// Validate and output an expanded configuration.
   #[clap(name = "expand")]
   Expand(expand::Options),

crates/bins/wick/src/commands/config/audit.rs

@@ -0,0 +1,73 @@
+use anyhow::Result;
+use clap::Args;
+use serde_json::json;
+use structured_output::StructuredOutput;
+use wick_config::audit::Audit;
+use wick_config::WickConfiguration;
+
+use crate::utils::{fetch_wick_tree, parse_config_string, reconcile_fetch_options};
+
+#[derive(Debug, Clone, Args)]
+#[clap(rename_all = "kebab-case")]
+#[group(skip)]
+pub(crate) struct Options {
+  #[clap(flatten)]
+  pub(crate) oci: crate::options::oci::OciOptions,
+
+  #[clap(flatten)]
+  pub(crate) component: crate::options::component::ComponentOptions,
+
+  /// Turn the audit report into a lockdown configuration.
+  #[clap(long = "lockdown", action)]
+  lockdown: bool,
+}
+
+#[allow(clippy::unused_async)]
+pub(crate) async fn handle(
+  opts: Options,
+  settings: wick_settings::Settings,
+  span: tracing::Span,
+) -> Result<StructuredOutput> {
+  let runtime_config = parse_config_string(opts.component.with.as_deref())?;
+  let options = reconcile_fetch_options(&opts.component.path, &settings, opts.oci, None);
+  let config = fetch_wick_tree(&opts.component.path, options.clone(), runtime_config, span.clone()).await?;
+  let flattened = config.flatten();
+  let report = Audit::new_flattened(&flattened);
+
+  if opts.lockdown {
+    let config = WickConfiguration::Lockdown(report.into());
+    let config_json = serde_json::to_value(&config)?;
+    let config_yaml = config.into_v1_yaml()?;
+
+    Ok(StructuredOutput::new(config_yaml, config_json))
+  } else {
+    let mut buffer = String::new();
+    gen_report(&report, &mut buffer);
+    let filtered = report.iter().filter(|a| !a.resources.is_empty()).collect::<Vec<_>>();
+    let json = json!({"audit":filtered});
+
+    Ok(StructuredOutput::new(buffer, json))
+  }
+}
+
+fn gen_report(audit: &[Audit], buffer: &mut String) {
+  for audit in audit {
+    if audit.resources.is_empty() {
+      continue;
+    }
+    let resource_lines = audit
+      .resources
+      .iter()
+      .map(|r| format!("    {}", r))
+      .collect::<Vec<_>>()
+      .join("\n");
+    let message = format!(
+      "
+name: {}
+  resources:
+{}",
+      audit.name, resource_lines
+    );
+    buffer.push_str(&message);
+  }
+}

crates/bins/wick/src/commands/config/dot.rs

@@ -7,28 +7,21 @@ use structured_output::StructuredOutput;
 use wick_config::WickConfiguration;
 use wick_host::ComponentHostBuilder;
 
-use crate::options::get_auth_for_scope;
-use crate::utils::{merge_config, parse_config_string};
+use crate::utils::{get_auth_for_scope, merge_config, parse_config_string};
 
 #[derive(Debug, Clone, Args)]
 #[clap(rename_all = "kebab-case")]
 #[group(skip)]
 pub(crate) struct Options {
-  /// Path to composite component to load.
-  #[clap(action)]
-  pub(crate) path: String,
+  #[clap(flatten)]
+  pub(crate) oci: crate::options::oci::OciOptions,
 
+  #[clap(flatten)]
+  pub(crate) component: crate::options::component::ComponentOptions,
   /// Operation to render.
   #[clap(action)]
   pub(crate) operation: String,
 
-  #[clap(flatten)]
-  pub(crate) oci: crate::oci::Options,
-
-  /// Pass configuration necessary to instantiate the component (JSON).
-  #[clap(long = "with", short = 'w', action)]
-  with: Option<String>,
-
   /// Pass configuration necessary to invoke the operation (JSON).
   #[clap(long = "op-with", action)]
   op_with: Option<String>,
@@ -41,7 +34,10 @@ pub(crate) async fn handle(
   span: tracing::Span,
 ) -> Result<StructuredOutput> {
   span.in_scope(|| debug!("Generate dotviz graph"));
-  let configured_creds = settings.credentials.iter().find(|c| opts.path.starts_with(&c.scope));
+  let configured_creds = settings
+    .credentials
+    .iter()
+    .find(|c| opts.component.path.starts_with(&c.scope));
 
   let (username, password) = get_auth_for_scope(
     configured_creds,
@@ -53,7 +49,7 @@ pub(crate) async fn handle(
   let mut fetch_opts: wick_oci_utils::OciOptions = opts.oci.clone().into();
   fetch_opts.set_username(username).set_password(password);
 
-  let path = PathBuf::from(&opts.path);
+  let path = PathBuf::from(&opts.component.path);
 
   if !path.exists() {
     fetch_opts.set_cache_dir(env.global().cache().clone());
@@ -63,9 +59,9 @@ pub(crate) async fn handle(
     fetch_opts.set_cache_dir(path_dir.join(env.local().cache()));
   };
 
-  let root_config = parse_config_string(opts.with.as_deref())?;
+  let root_config = parse_config_string(opts.component.with.as_deref())?;
 
-  let mut config = WickConfiguration::fetch(&opts.path, fetch_opts).await?;
+  let mut config = WickConfiguration::fetch(&opts.component.path, fetch_opts).await?;
   config.set_root_config(root_config);
   let manifest = config.finish()?.try_component_config()?;