feat(aa): rewrite rules formatting.

pkg/aa/rules.go

@@ -6,6 +6,9 @@ package aa
 
 import (
 	"slices"
+	"strings"
+
+	"github.com/samber/lo"
 )
 
 type requirement map[string][]string
@@ -145,9 +148,17 @@ func (r Rules) GetIncludes() []*Include {
 func (r Rules) Merge() Rules {
 	for i := 0; i < len(r); i++ {
 		for j := i + 1; j < len(r); j++ {
-			typeOfI := r[i].Kind()
-			typeOfJ := r[j].Kind()
-			if typeOfI != typeOfJ {
+			if r[i] == nil && r[j] == nil {
+				r = r.Delete(j)
+				j--
+				continue
+			}
+			if r[i] == nil || r[j] == nil {
+				continue
+			}
+			kindOfI := r[i].Kind()
+			kindOfJ := r[j].Kind()
+			if kindOfI != kindOfJ {
 				continue
 			}
 
@@ -159,7 +170,7 @@ func (r Rules) Merge() Rules {
 			}
 
 			// File rule
-			if typeOfI == FILE && typeOfJ == FILE {
+			if kindOfI == FILE && kindOfJ == FILE {
 				// Merge access
 				fileI := r[i].(*File)
 				fileJ := r[j].(*File)
@@ -200,27 +211,75 @@ func (r Rules) Sort() Rules {
 // Follow: https://apparmor.pujol.io/development/guidelines/#the-file-block
 func (r Rules) Format() Rules {
 	const prefixOwner = "      "
+	suffixMaxlen := 36
+	transitions := append(requirements[FILE]["transition"], "m")
 
-	hasOwnerRule := false
-	for i := len(r) - 1; i > 0; i-- {
-		j := i - 1
-		typeOfI := r[i].Kind()
-		typeOfJ := r[j].Kind()
+	paddingIndex := []int{}
+	paddingMaxLenght := 0
+	for i, rule := range r {
+		if rule == nil {
+			continue
+		}
 
-		// File rule
-		if typeOfI == FILE && typeOfJ == FILE {
-			letterI := getLetterIn(fileAlphabet, r[i].(*File).Path)
-			letterJ := getLetterIn(fileAlphabet, r[j].(*File).Path)
+		if rule.Kind() == FILE {
+			rule := r[i].(*File)
 
-			// Add prefix before rule path to align with other rule
-			if r[i].(*File).Owner {
-				hasOwnerRule = true
-			} else if hasOwnerRule {
-				r[i].(*File).Prefix = prefixOwner
+			// Add padding to align with other transition rule
+			isTransition := lo.Intersect(transitions, rule.Access)
+			if len(isTransition) > 0 {
+				ruleLen := len(rule.Path) + 1
+				paddingMaxLenght = max(ruleLen, paddingMaxLenght)
+				paddingIndex = append(paddingIndex, i)
 			}
 
-			if letterI != letterJ {
-				// Add a new empty line between Files rule of different type
+			// Add suffix to align comment on udev/data rule
+			if rule.Comment != "" && strings.HasPrefix(rule.Path, "@{run}/udev/data/") {
+				suffixlen := suffixMaxlen - len(rule.Path)
+				if suffixlen < 0 {
+					suffixlen = 0
+				}
+				rule.Suffix = strings.Repeat(" ", suffixlen)
+			}
+		}
+	}
+	if len(paddingIndex) > 1 {
+		r.setPadding(paddingIndex, paddingMaxLenght)
+	}
+
+	hasOwnerRule := false
+	for i := len(r) - 1; i >= 0; i-- {
+		if r[i] == nil {
+			hasOwnerRule = false
+			continue
+		}
+
+		// File rule
+		if r[i].Kind() == FILE {
+			rule := r[i].(*File)
+
+			// Add prefix before rule path to align with other rule
+			if rule.Owner {
+				hasOwnerRule = true
+			} else if hasOwnerRule {
+				rule.Prefix = prefixOwner
+			}
+
+			// Do not add new line on executable rule
+			isTransition := lo.Intersect(transitions, rule.Access)
+			if len(isTransition) > 0 {
+				continue
+			}
+
+			// Add a new line between Files rule of different group type
+			j := i - 1
+			if j < 0 || r[j] == nil || r[j].Kind() != FILE {
+				continue
+			}
+			letterI := getLetterIn(fileAlphabet, rule.Path)
+			letterJ := getLetterIn(fileAlphabet, r[j].(*File).Path)
+			groupI, ok1 := fileAlphabetGroups[letterI]
+			groupJ, ok2 := fileAlphabetGroups[letterJ]
+			if letterI != letterJ && !(ok1 && ok2 && groupI == groupJ) {
 				hasOwnerRule = false
 				r = r.Insert(i, nil)
 			}
@@ -228,3 +287,10 @@ func (r Rules) Format() Rules {
 	}
 	return r
 }
+
+// setPadding adds padding to the rule path to align with other rules.
+func (r *Rules) setPadding(paddingIndex []int, paddingMaxLenght int) {
+	for _, i := range paddingIndex {
+		(*r)[i].(*File).Padding = strings.Repeat(" ", paddingMaxLenght-len((*r)[i].(*File).Path))
+	}
+}