add support for intersection & union in search operations

cmd/rekor-cli/app/pflags.go

@@ -38,6 +38,7 @@ const (
 	uuidFlag      FlagType = "uuid"
 	shaFlag       FlagType = "sha"
 	emailFlag     FlagType = "email"
+	operatorFlag  FlagType = "operator"
 	logIndexFlag  FlagType = "logIndex"
 	pkiFormatFlag FlagType = "pkiFormat"
 	typeFlag      FlagType = "type"
@@ -67,6 +68,10 @@ func initializePFlagMap() {
 			// this validates a valid sha256 checksum which is optionally prefixed with 'sha256:'
 			return valueFactory(shaFlag, validateSHAValue, "")
 		},
+		operatorFlag: func() pflag.Value {
+			// this validates a valid operator name
+			return valueFactory(shaFlag, validateString("oneof=and or"), "")
+		},
 		emailFlag: func() pflag.Value {
 			// this validates an email address
 			return valueFactory(emailFlag, validateString("required,email"), "")

cmd/rekor-cli/app/search.go

@@ -58,6 +58,8 @@ func addSearchPFlags(cmd *cobra.Command) error {
 	cmd.Flags().Var(NewFlagValue(shaFlag, ""), "sha", "the SHA256 or SHA1 sum of the artifact")
 
 	cmd.Flags().Var(NewFlagValue(emailFlag, ""), "email", "email associated with the public key's subject")
+
+	cmd.Flags().Var(NewFlagValue(operatorFlag, ""), "operator", "operator to use for the search")
 	return nil
 }
 
@@ -142,6 +144,8 @@ var searchCmd = &cobra.Command{
 			params.Query.Hash = "sha256:" + hashVal
 		}
 
+		params.Query.Operator = viper.GetString("operator")
+
 		publicKeyStr := viper.GetString("public-key")
 		if publicKeyStr != "" {
 			params.Query.PublicKey = &models.SearchIndexPublicKey{}

openapi.yaml

@@ -510,6 +510,9 @@ definitions:
       hash:
         type: string
         pattern: '^(sha256:)?[0-9a-fA-F]{64}$|^(sha1:)?[0-9a-fA-F]{40}$'
+      operator:
+        type: string
+        enum: ['and','or']
 
   SearchLogQuery:
     type: object

pkg/api/index.go

@@ -34,16 +34,23 @@ import (
 
 func SearchIndexHandler(params index.SearchIndexParams) middleware.Responder {
 	httpReqCtx := params.HTTPRequest.Context()
+	var result Container
+
+	// default behaviour mimics "or"
+	if params.Query.Operator == "and" {
+		result = make(Uniq)
+	} else {
+		result = &Arr{}
+	}
 
-	var result []string
 	if params.Query.Hash != "" {
 		// This must be a valid sha256 hash
 		sha := util.PrefixSHA(params.Query.Hash)
 		var resultUUIDs []string
 		if err := redisClient.Do(httpReqCtx, radix.Cmd(&resultUUIDs, "LRANGE", strings.ToLower(sha), "0", "-1")); err != nil {
 			return handleRekorAPIError(params, http.StatusInternalServerError, err, redisUnexpectedResult)
 		}
-		result = append(result, resultUUIDs...)
+		result.Add(resultUUIDs)
 	}
 	if params.Query.PublicKey != nil {
 		af, err := pki.NewArtifactFactory(pki.Format(swag.StringValue(params.Query.PublicKey.Format)))
@@ -70,17 +77,17 @@ func SearchIndexHandler(params index.SearchIndexParams) middleware.Responder {
 		if err := redisClient.Do(httpReqCtx, radix.Cmd(&resultUUIDs, "LRANGE", strings.ToLower(hex.EncodeToString(keyHash[:])), "0", "-1")); err != nil {
 			return handleRekorAPIError(params, http.StatusInternalServerError, err, redisUnexpectedResult)
 		}
-		result = append(result, resultUUIDs...)
+		result.Add(resultUUIDs)
 	}
 	if params.Query.Email != "" {
 		var resultUUIDs []string
 		if err := redisClient.Do(httpReqCtx, radix.Cmd(&resultUUIDs, "LRANGE", strings.ToLower(params.Query.Email.String()), "0", "-1")); err != nil {
 			return handleRekorAPIError(params, http.StatusInternalServerError, err, redisUnexpectedResult)
 		}
-		result = append(result, resultUUIDs...)
+		result.Add(resultUUIDs)
 	}
 
-	return index.NewSearchIndexOK().WithPayload(result)
+	return index.NewSearchIndexOK().WithPayload(result.Result())
 }
 
 func SearchIndexNotImplementedHandler(params index.SearchIndexParams) middleware.Responder {
@@ -100,3 +107,32 @@ func addToIndex(ctx context.Context, key, value string) error {
 func storeAttestation(ctx context.Context, uuid string, attestation []byte) error {
 	return storageClient.StoreAttestation(ctx, uuid, attestation)
 }
+
+type Container interface {
+	Add([]string)
+	Result() []string
+}
+
+type Uniq map[string]struct{}
+
+func (u Uniq) Add(elements []string) {
+	for _, v := range elements {
+		u[v] = struct{}{}
+	}
+}
+func (u Uniq) Result() []string {
+	var result []string
+	for k := range u {
+		result = append(result, k)
+	}
+	return result
+}
+
+type Arr []string
+
+func (a *Arr) Add(elements []string) {
+	*a = append(*a, elements...)
+}
+func (a Arr) Result() []string {
+	return a
+}

tests/e2e_test.go

@@ -567,6 +567,23 @@ func TestX509(t *testing.T) {
 	out = runCli(t, "search", "--email", "test@rekor.dev")
 	outputContains(t, out, uuid)
 
+	artifactBytes, err := ioutil.ReadFile(artifactPath)
+	if err != nil {
+		t.Error(err)
+	}
+	sha := sha256.Sum256(artifactBytes)
+	dataSHA := hex.EncodeToString(sha[:])
+
+	out = runCli(t, "search", "--email", "test@rekor.dev", "--operator", "and","--sha", dataSHA)
+	if strings.Count(out, uuid) != 1 {
+		t.Errorf("expected to find one match for %v, found %v", uuid, strings.Count(out, uuid))
+	}
+
+	out = runCli(t, "search", "--email", "test@rekor.dev", "--operator", "or","--sha", dataSHA)
+	if strings.Count(out, uuid) != 2 {
+		t.Errorf("expected to find two matches for %v, found %v", uuid, strings.Count(out, uuid))
+	}
+
 }
 
 func TestUploadNoAPIKeyInOutput(t *testing.T) {