checkPolicyViolations function

List<String> checkPolicyViolations(
  1. Map ctx
)

Engine-safe policy check: ctx = {report, deny(List<String>)}. Returns a list of violation strings, one per denied call site.

Implementation

List<String> checkPolicyViolations(Map ctx) {
  final Map report = ctx['report'];
  final List deny = ctx['deny'];
  final violations = <String>[];
  final List capabilities = report['capabilities'];
  for (final entry in capabilities) {
    if (deny.contains(entry['capability'])) {
      final List callSites = entry['callSites'];
      for (final site in callSites) {
        violations.add(
          '${entry['capability']}: ${site['module']}.${site['function']} calls '
          '${site['calleeModule']}.${site['calleeFunction']}',
        );
      }
    }
  }
  return violations;
}