feat: Add support for sandbox diagnostic log (#245)

* feat: Add support for sandbox diagnostic log

* fix: Normalize and prioritise sandbox violations

* fix: Code review fixes

sandbox/platform/seatbelt_diagnostics_darwin_test.go

@@ -0,0 +1,78 @@
+//go:build darwin
+// +build darwin
+
+package platform
+
+import (
+	"testing"
+
+	"github.com/safedep/pmg/sandbox"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseSeatbeltLogPayload(t *testing.T) {
+	msg := `Sandbox: node(123) deny(1) file-write-data /Users/dev/project/.env ` +
+		seatbeltLogMessage("run-1", "file-write", "/Users/dev/project/.env")
+
+	payload, ok := parseSeatbeltLogPayload(msg)
+	require.True(t, ok)
+	assert.Equal(t, "run-1", payload.RunID)
+	assert.Equal(t, "file-write", payload.Kind)
+	assert.Equal(t, "/Users/dev/project/.env", payload.Target)
+}
+
+func TestParseSeatbeltLogPayloadEmptyTarget(t *testing.T) {
+	msg := `Sandbox: node(123) deny(1) default ` + seatbeltLogMessage("run-1", "default", "")
+
+	payload, ok := parseSeatbeltLogPayload(msg)
+	require.True(t, ok)
+	assert.Equal(t, "run-1", payload.RunID)
+	assert.Equal(t, "default", payload.Kind)
+	assert.Empty(t, payload.Target)
+}
+
+func TestExtractSeatbeltDeniedPath(t *testing.T) {
+	payload := &seatbeltLogPayload{
+		RunID:  "run-1",
+		Kind:   "file-read",
+		Target: "**/.env",
+	}
+
+	raw := `Sandbox: node(123) deny(1) file-read-data ./.env ` + seatbeltLogMessage("run-1", "file-read", "**/.env")
+	assert.Equal(t, "./.env", extractSeatbeltDeniedPath(raw, payload))
+}
+
+func TestDecodeSeatbeltLogEntries(t *testing.T) {
+	data := []byte(`[
+		{"eventMessage":"entry-1","process":"node"},
+		{"eventMessage":"entry-2","process":"npm"}
+	]`)
+
+	entries, err := decodeSeatbeltLogEntries(data)
+	require.NoError(t, err)
+	require.Len(t, entries, 2)
+	assert.Equal(t, "entry-1", entries[0].EventMessage)
+	assert.Equal(t, "npm", entries[1].Process)
+}
+
+func TestExtractSeatbeltViolations(t *testing.T) {
+	entries := []seatbeltLogEntry{
+		{
+			EventMessage: "Sandbox deny " + seatbeltLogMessage("run-1", "file-read", "/tmp/.env"),
+			Process:      "node",
+		},
+		{
+			EventMessage: "Sandbox deny " + seatbeltLogMessage("run-2", "file-write", "/tmp/out"),
+			Process:      "npm",
+		},
+	}
+
+	violations := extractSeatbeltViolations(entries, "run-1")
+	require.Len(t, violations, 1)
+	assert.Equal(t, sandbox.ViolationKindFSRead, violations[0].Kind)
+	assert.Equal(t, "file-read", violations[0].RawKind)
+	assert.Equal(t, "/tmp/.env", violations[0].Target)
+	assert.Equal(t, "/tmp/.env", violations[0].RuleTarget)
+	assert.Equal(t, "node", violations[0].Process)
+}