ggladstone/eas 4431 extend (#91)

* feat(reporter): surface manifest parse failures in FSRT output

Previously, manifest deserialization errors were silently swallowed via unwrap_or_default(), causing FSRT to scan an empty manifest and return zero findings with errors: false.

Change get_manifest() to return Result<ForgeManifest, serde_yaml::Error> and handle parse failures in scan_directory() by returning a structured error report with errors: true and a detailed error_message field, e.g.:

  'Could not process manifest, failed on modules.scheduledTrigger[0].interval: unknown variant `fiveMinute`, expected one of `hour`, `day`, `week` at line 27 column 17'

Add error_message: String field (default empty) to Report. Add Report::error() constructor, has_errors() and error_message() accessors.

* fix(manifest): support endpoint-routed triggers

Allow modules.trigger entries to deserialize with endpoint instead of function, matching Forge manifest behavior where endpoint is required when function is omitted.

This prevents valid endpoint-routed lifecycle triggers from failing manifest processing with missing field function.

* fix(manifest): support boolean macro config

Allow Confluence macro modules to deserialize config: true in addition to config objects with function handlers.

This prevents valid macro manifests from failing manifest processing.

* fix(manifest): default missing permissions to empty scopes

Allow manifests without a permissions block to deserialize by defaulting permissions to Perms::default(), equivalent to permissions.scopes: [].

This prevents apps that omit permissions from failing manifest processing before scanning.

* fix(manifest): support i18n jira admin page titles

Allow jira:adminPage title to deserialize from either a plain string or an i18n object.

This prevents valid manifests using title.i18n from failing manifest processing with invalid type map

* fix(manifest): own rovo agent descriptions

Deserialize rovo:agent description as an owned String instead of a borrowed str so YAML strings requiring escape processing, such as descriptions containing newlines, do not fail manifest processing.

This prevents valid Rovo agent manifests from failing with expected a borrowed string.

* fix(manifest): own rovo agent text fields

Deserialize rovo:agent description and conversationStarters as owned Strings instead of borrowed strs.

YAML strings containing escape sequences such as \n require allocation during deserialization, so borrowed strs can fail manifest processing with expected a borrowed string. Owning these fields allows valid Rovo agent manifests with multiline or escaped text to parse correctly.

* fix(manifest): resources[].path string processing cannot be a borrowed string

* chore: fmt isssues

Author: gladstone-9

crates/forge_analyzer/src/reporter.rs

@@ -47,6 +47,7 @@ pub struct Report {
     ended_at: OffsetDateTime,
     scanned: Vec<String>,
     errors: bool,
+    error_message: String,
 }
 
 pub struct Reporter {
@@ -106,6 +107,7 @@ impl Reporter {
             ended_at: OffsetDateTime::now_utc(),
             scanned: self.apps.into_iter().map(|(key, _)| key).collect(),
             errors: false,
+            error_message: String::new(),
         }
     }
 
@@ -115,10 +117,34 @@ impl Reporter {
 }
 
 impl Report {
+    #[inline]
+    pub fn error(error_message: String, scanned: Vec<String>) -> Self {
+        let now = OffsetDateTime::now_utc();
+        Self {
+            vulns: Vec::new(),
+            scanner: "FSRT",
+            started_at: now,
+            ended_at: now,
+            scanned,
+            errors: true,
+            error_message,
+        }
+    }
+
     #[inline]
     pub fn into_vulns(&self) -> &[Vulnerability] {
         &self.vulns
     }
+
+    #[inline]
+    pub fn has_errors(&self) -> bool {
+        self.errors
+    }
+
+    #[inline]
+    pub fn error_message(&self) -> &str {
+        &self.error_message
+    }
 }
 
 impl Default for Reporter {

crates/forge_loader/src/manifest.rs

@@ -131,8 +131,11 @@ struct RawTrigger<'a> {
 // maps to Trigger under Common Modules
 #[derive(Debug, Clone, PartialEq, Eq, Deserialize)]
 struct EventTrigger<'a> {
-    #[serde(flatten, borrow)]
-    raw: RawTrigger<'a>,
+    key: &'a str,
+    #[serde(default, borrow)]
+    function: Option<&'a str>,
+    #[serde(default, borrow)]
+    endpoint: Option<&'a str>,
     #[serde(borrow)]
     events: Vec<&'a str>,
 }
@@ -184,18 +187,42 @@ struct ContentByLineItem<'a> {
     dynamic_properties: JustFunc<'a>,
 }
 
+#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Copy)]
+#[serde(untagged)]
+#[serde(bound(deserialize = "'de: 'a"))]
+enum MacroConfig<'a> {
+    Enabled(bool),
+    Object(JustFunc<'a>),
+}
+
+impl<'a> HasFunctions<'a> for MacroConfig<'a> {
+    fn append_functions<I: Extend<&'a str>>(&self, funcs: &mut I) {
+        if let Self::Object(config) = self {
+            config.append_functions(funcs);
+        }
+    }
+}
+
 #[derive(Default, Debug, Clone, PartialEq, Eq, Deserialize, Copy)]
 pub struct MacroMod<'a> {
     #[serde(flatten, borrow)]
     common_keys: CommonKey<'a>,
-    config: Option<JustFunc<'a>>,
+    config: Option<MacroConfig<'a>>,
     export: Option<JustFunc<'a>>,
 }
 
 // Jira Modules
+#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Copy)]
+#[serde(untagged)]
+#[serde(bound(deserialize = "'de: 'a"))]
+enum LocalizedText<'a> {
+    Text(&'a str),
+    I18n { i18n: &'a str },
+}
+
 #[derive(Debug, Clone, PartialEq, Eq, Deserialize, Copy)]
 pub struct JiraAdminPage<'a> {
-    title: &'a str,
+    title: LocalizedText<'a>,
     #[serde(flatten, borrow)]
     common_keys: CommonKey<'a>,
 }
@@ -267,15 +294,15 @@ struct AssetsImportType<'a> {
 pub struct RovoAgent<'a> {
     pub key: &'a str,
     pub name: &'a str,
-    pub description: Option<&'a str>,
+    pub description: Option<String>,
     pub icon: Option<&'a str>,
     pub prompt: String, // as may be multiline
-    #[serde(default, rename = "conversationStarters", borrow)]
-    pub conversation_starters: Vec<&'a str>,
+    #[serde(default, rename = "conversationStarters")]
+    pub conversation_starters: Vec<String>,
     #[serde(default, borrow)]
     pub actions: Vec<&'a str>,
     #[serde(rename = "followUpPrompt")]
-    pub follow_up_prompt: Option<&'a str>,
+    pub follow_up_prompt: Option<String>,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, Deserialize)]
@@ -638,10 +665,10 @@ pub struct Module<'a> {
     extra: FxHashMap<String, serde_yaml::Value>,
 }
 
-#[derive(Default, Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
+#[derive(Default, Debug, Clone, PartialEq, Eq, Deserialize)]
 pub struct Resource<'a> {
     pub key: &'a str,
-    pub path: &'a str,
+    pub path: String,
 }
 
 /// The representation of a Forge app's `manifest.yml`
@@ -655,7 +682,7 @@ pub struct ForgeManifest<'a> {
     pub app: AppInfo<'a>,
     #[serde(borrow)]
     pub modules: ForgeModules<'a>,
-    #[serde(borrow)]
+    #[serde(default, borrow)]
     pub permissions: Perms<'a>,
     pub remotes: Option<Vec<Remotes>>,
     #[serde(default, borrow)]
@@ -1169,9 +1196,11 @@ mod tests {
         if let Some(string) = resolver.function {
             assert_eq!(string, "Catch-me-if-you-can1");
         }
-        if let Some(justfunc) = manifest.modules.macros[0].config {
+        if let Some(MacroConfig::Object(justfunc)) = manifest.modules.macros[0].config {
             let func = justfunc.function.unwrap();
             assert_eq!(func, "Catch-me-if-you-can2");
+        } else {
+            panic!("No config function found")
         }
 
         if let Some(justfunc) = manifest.modules.macros[0].export {
@@ -1327,7 +1356,7 @@ mod tests {
         let agent = &manifest.modules.rovo_agent[0];
         assert_eq!(agent.key, "data-discoverability");
         assert_eq!(agent.name, "Data Discoverability");
-        assert_eq!(agent.description, Some("Test description"));
+        assert_eq!(agent.description.as_deref(), Some("Test description"));
         assert_eq!(
             agent.prompt,
             "You are a helpful assistant that helps users manage their project risks. \nYou can retrieve risks from the risk register, create new risks and update existing ones."

crates/fsrt/src/forge_project.rs

@@ -3,6 +3,7 @@ use forge_analyzer::ctx::AppCtx;
 use forge_analyzer::definitions::{Environment, PackageData, run_resolver};
 use forge_loader::manifest::{Entrypoint, ForgeManifest, Resolved};
 use forge_permission_resolver::permissions_resolver::PermMap;
+use serde_yaml::Error as YamlError;
 use std::collections::HashSet;
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
@@ -78,7 +79,7 @@ pub(crate) trait ForgeProjectTrait<'a> {
     #[allow(dead_code)]
     fn get_secret_packages(&self) -> Vec<PackageData>;
 
-    fn get_manifest(&self) -> ForgeManifest<'_>;
+    fn get_manifest(&self) -> Result<ForgeManifest<'_>, YamlError>;
 }
 pub(crate) struct ForgeProject<'a> {
     #[allow(dead_code)]
@@ -135,8 +136,7 @@ impl ForgeProjectTrait<'_> for ForgeProjectFromDir {
         }
     }
 
-    fn get_manifest(&self) -> ForgeManifest<'_> {
-        let out = serde_yaml::from_str(&self.manifest_file_content);
-        out.unwrap_or_default()
+    fn get_manifest(&self) -> Result<ForgeManifest<'_>, YamlError> {
+        serde_yaml::from_str(&self.manifest_file_content)
     }
 }

crates/fsrt/src/main.rs

@@ -372,7 +372,19 @@ pub(crate) fn scan_directory<'a>(
     secret_packages: &[PackageData],
 ) -> Result<Report> {
     let paths = project.get_paths();
-    let manifest = project.get_manifest();
+    let manifest = match project.get_manifest() {
+        Ok(manifest) => manifest,
+        Err(err) => {
+            let error_message = format!(
+                "Could not process manifest, failed on {err}, submit an issue if you believe this is a bug --> https://github.com/atlassian-labs/FSRT/issues"
+            );
+            warn!("{error_message}");
+            return Ok(Report::error(
+                error_message,
+                vec![opts.appkey.clone().unwrap_or_default()],
+            ));
+        }
+    };
     let requested_permissions = manifest.permissions;
     let permissions_declared = requested_permissions
         .scopes

crates/fsrt/src/test.rs

@@ -107,6 +107,7 @@ impl ReportExt for Report {
 pub(crate) struct MockForgeProject<'a> {
     pub files_name_to_source: HashMap<PathBuf, Arc<SourceFile>>,
     pub test_manifest: ForgeManifest<'a>,
+    pub manifest_file_content: Option<String>,
     pub cm: Lrc<SourceMap>,
 }
 
@@ -121,28 +122,28 @@ impl<'a> MockForgeProject<'a> {
     pub fn files_from_string(string: &'a str) -> Self {
         let different_files = string.split("//").filter(|file| !file.is_empty());
 
-        let manifest = if let Some(manifest_string) = different_files.clone().find(|string| {
-            string
-                .replace("//", "")
-                .trim_start()
-                .starts_with("manifest.yaml")
-                || string
-                    .trim_start()
+        let manifest_file_content = different_files
+            .clone()
+            .find(|string| {
+                string
                     .replace("//", "")
-                    .starts_with("manifest.yml")
-        }) {
-            serde_yaml::from_str(manifest_string.split_once('\n').unwrap().1).unwrap_or_default()
-        } else {
-            ForgeManifest::create_manifest_with_func_mod(FunctionMod {
-                key: "main",
-                handler: "index.run",
-                providers: None,
+                    .trim_start()
+                    .starts_with("manifest.yaml")
+                    || string
+                        .trim_start()
+                        .replace("//", "")
+                        .starts_with("manifest.yml")
             })
-        };
+            .map(|manifest_string| manifest_string.split_once('\n').unwrap().1.to_string());
 
         let mut mock_forge_project = MockForgeProject {
             files_name_to_source: HashMap::new(),
-            test_manifest: manifest.to_owned(),
+            test_manifest: ForgeManifest::create_manifest_with_func_mod(FunctionMod {
+                key: "main",
+                handler: "index.run",
+                providers: None,
+            }),
+            manifest_file_content,
             cm: Arc::default(),
         };
 
@@ -186,8 +187,12 @@ impl<'a> ForgeProjectTrait<'a> for MockForgeProject<'a> {
         vec![]
     }
 
-    fn get_manifest(&self) -> ForgeManifest<'_> {
-        self.test_manifest.clone()
+    fn get_manifest(&self) -> Result<ForgeManifest<'_>, serde_yaml::Error> {
+        if let Some(manifest_file_content) = &self.manifest_file_content {
+            serde_yaml::from_str(manifest_file_content)
+        } else {
+            Ok(self.test_manifest.clone())
+        }
     }
 }
 
@@ -224,6 +229,7 @@ fn test_simple() {
     let mut test_forge_project = MockForgeProject {
         test_manifest: forge_manifest,
         files_name_to_source: HashMap::new(),
+        manifest_file_content: None,
         cm: Lrc::new(SourceMap::default()),
     };
     test_forge_project.add_file(
@@ -248,6 +254,7 @@ fn test_secret_vuln() {
     let mut test_forge_project = MockForgeProject {
         test_manifest: forge_manifest,
         files_name_to_source: HashMap::new(),
+        manifest_file_content: None,
         cm: Lrc::new(SourceMap::default()),
     };
     test_forge_project.add_file(