chore: Merge Aviator 26.4 changes

fcli-core/fcli-app/src/main/resources/META-INF/native-image/fcli/fcli-app/grpc/reflect-config.json

@@ -600,7 +600,7 @@
     "name":"com.fortify.cli.aviator.config.TagMappingConfig",
     "allDeclaredFields":true,
     "queryAllPublicMethods":true,
-    "methods":[{"name":"<init>","parameterTypes":[] }, {"name":"setMapping","parameterTypes":["com.fortify.cli.aviator.config.TagMappingConfig$Mapping"] }, {"name":"setSuppression_exclusions","parameterTypes":["java.util.List"] }, {"name":"setTag_id","parameterTypes":["java.lang.String"] }]
+    "methods":[{"name":"<init>","parameterTypes":[] }, {"name":"setDast","parameterTypes":["com.fortify.cli.aviator.config.TagMappingConfig$ProductMapping"] }, {"name":"setMapping","parameterTypes":["com.fortify.cli.aviator.config.TagMappingConfig$Mapping"] }, {"name":"setSast","parameterTypes":["com.fortify.cli.aviator.config.TagMappingConfig$ProductMapping"] }, {"name":"setSuppression_exclusions","parameterTypes":["java.util.List"] }, {"name":"setTag_id","parameterTypes":["java.lang.String"] }]
   },
   {
     "name":"com.fortify.cli.aviator.config.TagMappingConfig$Mapping",
@@ -631,6 +631,13 @@
   {
     "name":"com.fortify.cli.aviator.config.TagMappingConfig$MappingCustomizer"
   },
+  {
+    "name":"com.fortify.cli.aviator.config.TagMappingConfig$ProductMapping",
+    "allDeclaredConstructors":true,
+    "allDeclaredFields":true,
+    "queryAllPublicMethods":true,
+    "methods":[{"name":"<init>","parameterTypes":[] }, {"name":"setMapping","parameterTypes":["com.fortify.cli.aviator.config.TagMappingConfig$Mapping"] }, {"name":"setSuppression_exclusions","parameterTypes":["java.util.List"] }, {"name":"setTag_id","parameterTypes":["java.lang.String"] }]
+  },
   {
     "name":"com.fortify.cli.aviator.config.TagMappingConfig$Result",
     "allDeclaredConstructors": true,

fcli-core/fcli-app/src/main/resources/META-INF/native-image/fcli/fcli-app/yaml/reflect-config.json

@@ -43,7 +43,7 @@
     "name":"com.fortify.cli.aviator.config.TagMappingConfig",
     "allDeclaredFields":true,
     "queryAllPublicMethods":true,
-    "methods":[{"name":"<init>","parameterTypes":[] }, {"name":"setMapping","parameterTypes":["com.fortify.cli.aviator.config.TagMappingConfig$Mapping"] }, {"name":"setSuppression_exclusions","parameterTypes":["java.util.List"] }, {"name":"setTag_id","parameterTypes":["java.lang.String"] }]
+    "methods":[{"name":"<init>","parameterTypes":[] }, {"name":"setDast","parameterTypes":["com.fortify.cli.aviator.config.TagMappingConfig$ProductMapping"] }, {"name":"setMapping","parameterTypes":["com.fortify.cli.aviator.config.TagMappingConfig$Mapping"] }, {"name":"setSast","parameterTypes":["com.fortify.cli.aviator.config.TagMappingConfig$ProductMapping"] }, {"name":"setSuppression_exclusions","parameterTypes":["java.util.List"] }, {"name":"setTag_id","parameterTypes":["java.lang.String"] }]
   },
   {
     "name":"com.fortify.cli.aviator.config.TagMappingConfig$Mapping",
@@ -74,6 +74,13 @@
   {
     "name":"com.fortify.cli.aviator.config.TagMappingConfig$MappingCustomizer"
   },
+  {
+    "name":"com.fortify.cli.aviator.config.TagMappingConfig$ProductMapping",
+    "allDeclaredConstructors":true,
+    "allDeclaredFields":true,
+    "queryAllPublicMethods":true,
+    "methods":[{"name":"<init>","parameterTypes":[] }, {"name":"setMapping","parameterTypes":["com.fortify.cli.aviator.config.TagMappingConfig$Mapping"] }, {"name":"setSuppression_exclusions","parameterTypes":["java.util.List"] }, {"name":"setTag_id","parameterTypes":["java.lang.String"] }]
+  },
   {
     "name":"com.fortify.cli.aviator.config.TagMappingConfig$Result",
     "allDeclaredConstructors": true,

fcli-core/fcli-app/src/test/java/com/fortify/cli/NativeReflectConfigTest.java

@@ -38,6 +38,7 @@ class NativeReflectConfigTest {
     private static final List<String> TAG_MAPPING_NESTED_CLASSES = List.of(
             "com.fortify.cli.aviator.config.TagMappingConfig$SuppressionExclusion",
             "com.fortify.cli.aviator.config.TagMappingConfig$Mapping",
+            "com.fortify.cli.aviator.config.TagMappingConfig$ProductMapping",
             "com.fortify.cli.aviator.config.TagMappingConfig$Tier",
             "com.fortify.cli.aviator.config.TagMappingConfig$Result");
 

fcli-core/fcli-aviator-common/build.gradle.kts

@@ -1,6 +1,7 @@
 plugins {
     id("fcli.module-conventions")
     id("java-library")
+    id("java-test-fixtures")
     id("com.google.protobuf")
 }
 
@@ -13,6 +14,7 @@ tasks.withType<JavaCompile>().configureEach { dependsOn("generateProto") }
 
 dependencies {
     implementation(project(":fcli-core:fcli-common-core"))
+    testFixturesImplementation(project(":fcli-core:fcli-common-core"))
     implementation("org.yaml:snakeyaml:2.3")
 
     // JAXB for XML object marshalling (used in FVDLProcessor legacy parser)

fcli-core/fcli-aviator-common/src/main/java/com/fortify/cli/aviator/_common/cli/mixin/AbstractApplyRemediationsOptionsMixin.java

@@ -0,0 +1,93 @@
+/*
+ * Copyright 2021-2026 Open Text.
+ *
+ * The only warranties for products and services of Open Text
+ * and its affiliates and licensors ("Open Text") are as may
+ * be set forth in the express warranty statements accompanying
+ * such products and services. Nothing herein should be construed
+ * as constituting an additional warranty. Open Text shall not be
+ * liable for technical or editorial errors or omissions contained
+ * herein. The information contained herein is subject to change
+ * without notice.
+ */
+package com.fortify.cli.aviator._common.cli.mixin;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+
+import org.apache.commons.lang3.StringUtils;
+
+import com.fortify.cli.aviator._common.remediations_cache.IApplyRemediationsOptions;
+import com.fortify.cli.aviator.fpr.remediation.RemediationExecutionMode;
+import com.fortify.cli.aviator.fpr.utils.ISourceDecoder;
+import com.fortify.cli.common.exception.FcliSimpleException;
+
+import lombok.Getter;
+import picocli.CommandLine.Mixin;
+import picocli.CommandLine.Option;
+
+/**
+ * Abstract base for apply-remediations options. Provides shared CLI options and validation template method.
+ * Product-specific subclasses declare source-selection mixins and implement validation hooks.
+ */
+@Getter
+public abstract class AbstractApplyRemediationsOptionsMixin implements IApplyRemediationsOptions {
+        @Mixin
+        private SourceEncodingsMixin sourceEncodingsMixin = new SourceEncodingsMixin();
+
+    @Option(names = {"--source-dir"})
+    private String sourceCodeDirectory = System.getProperty("user.dir");
+
+    @Option(names = {"--issue-ids"}, split = ",")
+    private List<String> issueIds;
+
+    @Option(names = {"--preview"})
+    private boolean previewMode = false;
+
+    public RemediationExecutionMode executionMode() {
+        return previewMode ? RemediationExecutionMode.PREVIEW : RemediationExecutionMode.APPLY;
+    }
+
+        @Override
+        public ISourceDecoder getSourceDecoder() {
+                return sourceEncodingsMixin.getSourceDecoder();
+        }
+
+    /**
+     * Validates all options by calling validation hooks in order.
+     * Template method: ensures consistent validation sequence across SSC and FoD.
+     */
+    @Override
+    public final void validate() {
+        validateSourceSelection();
+        validateSourceDir();
+        validateIssueIdsConstraints();
+    }
+
+    /** Hook for product-specific source selection validation (--from-cache vs online selection). */
+    protected abstract void validateSourceSelection();
+
+    /** Hook to determine if --from-cache is selected (needed for --issue-ids constraint validation). */
+    protected abstract boolean isCacheMode();
+
+    private void validateSourceDir() {
+        FcliSimpleException.throwIf(
+                StringUtils.isBlank(sourceCodeDirectory),
+                "--source-dir must specify a valid directory path");
+        Path path = Path.of(sourceCodeDirectory);
+        FcliSimpleException.throwIf(
+                !Files.exists(path) || !Files.isDirectory(path),
+                "--source-dir path does not exist or is not a directory: %s", sourceCodeDirectory);
+        FcliSimpleException.throwIf(
+                !Files.isReadable(path),
+                "--source-dir path is not accessible: %s", sourceCodeDirectory);
+    }
+
+    private void validateIssueIdsConstraints() {
+        FcliSimpleException.throwIf(
+                issueIds != null && !issueIds.isEmpty() && !isCacheMode(),
+                "--issue-ids can only be used with --from-cache; "
+                        + "create a cache with download-remediations-cache and rerun with --from-cache");
+    }
+}

fcli-core/fcli-aviator-common/src/main/java/com/fortify/cli/aviator/_common/config/AviatorConfigManager.java

@@ -91,4 +91,8 @@ public TagMappingConfig getDefaultTagMappingConfig() {
         }
         return defaultTagMappingConfig;
     }
+
+    public TagMappingConfig getDefaultDastTagMappingConfig() {
+        return getDefaultTagMappingConfig();
+    }
 }

fcli-core/fcli-aviator-common/src/main/java/com/fortify/cli/aviator/_common/exception/UnsupportedAviatorUrlSchemeException.java

@@ -0,0 +1,42 @@
+/*
+ * Copyright 2021-2026 Open Text.
+ *
+ * The only warranties for products and services of Open Text
+ * and its affiliates and licensors ("Open Text") are as may
+ * be set forth in the express warranty statements accompanying
+ * such products and services. Nothing herein should be construed
+ * as constituting an additional warranty. Open Text shall not be
+ * liable for technical or editorial errors or omissions contained
+ * herein. The information contained herein is subject to change
+ * without notice.
+ */
+package com.fortify.cli.aviator._common.exception;
+
+/**
+ * User-facing rejection of a non-{@code https} Aviator target scheme.
+ * <p>
+ * Typed so diagnose can map endpoint UX without parsing exception message text.
+ */
+public class UnsupportedAviatorUrlSchemeException extends AviatorSimpleException {
+    private static final long serialVersionUID = 1L;
+
+    public static final String STAGE_SUMMARY = "Unsupported URL scheme";
+    public static final String STAGE_GUIDANCE = "Use a supported Aviator URL (https://host[:port])";
+
+    private final String scheme;
+    private final String providedUrl;
+
+    public UnsupportedAviatorUrlSchemeException(String scheme, String providedUrl) {
+        super(STAGE_SUMMARY+" '"+scheme+"'. "+STAGE_GUIDANCE+". Provided URL: "+providedUrl);
+        this.scheme = scheme;
+        this.providedUrl = providedUrl;
+    }
+
+    public String getScheme() {
+        return scheme;
+    }
+
+    public String getProvidedUrl() {
+        return providedUrl;
+    }
+}

fcli-core/fcli-aviator-common/src/main/java/com/fortify/cli/aviator/_common/output/cli/cmd/AbstractAviatorApplyRemediationsCommand.java

@@ -0,0 +1,66 @@
+/*
+ * Copyright 2021-2026 Open Text.
+ *
+ * The only warranties for products and services of Open Text
+ * and its affiliates and licensors ("Open Text") are as may
+ * be set forth in the express warranty statements accompanying
+ * such products and services. Nothing herein should be construed
+ * as constituting an additional warranty. Open Text shall not be
+ * liable for technical or editorial errors or omissions contained
+ * herein. The information contained herein is subject to change
+ * without notice.
+ */
+package com.fortify.cli.aviator._common.output.cli.cmd;
+
+import java.util.Set;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fortify.cli.aviator._common.cli.mixin.AbstractApplyRemediationsOptionsMixin;
+import com.fortify.cli.aviator._common.remediations_cache.IRemediationsFprSource;
+import com.fortify.cli.aviator._common.remediations_cache.RemediationsApplyHelper;
+import com.fortify.cli.aviator._common.remediations_cache.RemediationsApplyHelper.ApplyResult;
+import com.fortify.cli.aviator._common.util.AviatorIssueIdFilterUtils;
+import com.fortify.cli.aviator.config.AviatorLoggerImpl;
+import com.fortify.cli.common.output.cli.cmd.AbstractOutputCommand;
+import com.fortify.cli.common.output.cli.cmd.IJsonNodeSupplier;
+import com.fortify.cli.common.output.cli.mixin.OutputHelperMixins;
+import com.fortify.cli.common.progress.cli.mixin.ProgressWriterFactoryMixin;
+import com.fortify.cli.common.progress.helper.IProgressWriter;
+
+import lombok.Getter;
+import picocli.CommandLine.Mixin;
+
+/**
+ * Abstract base command for applying remediations. Orchestrates validation, FPR source acquisition,
+ * and remediation application. Product-specific subclasses provide options mixin and implement hooks.
+ */
+public abstract class AbstractAviatorApplyRemediationsCommand extends AbstractOutputCommand
+        implements IJsonNodeSupplier {
+
+    @Getter @Mixin private OutputHelperMixins.DetailsNoQuery outputHelper;
+    @Mixin private ProgressWriterFactoryMixin progressWriterFactoryMixin;
+
+    /** Subclasses declare their product-specific options mixin (SSC or FoD). */
+    protected abstract AbstractApplyRemediationsOptionsMixin getApplyOptions();
+
+    @Override
+    public final JsonNode getJsonNode() {
+        AbstractApplyRemediationsOptionsMixin applyOptions = getApplyOptions();
+        applyOptions.validate();
+        Set<String> issueIdFilter = AviatorIssueIdFilterUtils.normalizeIssueIds(applyOptions.getIssueIds());
+        try (IProgressWriter progressWriter = progressWriterFactoryMixin.create()) {
+            AviatorLoggerImpl logger = new AviatorLoggerImpl(progressWriter);
+            try (IRemediationsFprSource fprSource = openFprSource(logger, progressWriter)) {
+                ApplyResult result = RemediationsApplyHelper.apply(fprSource, applyOptions, issueIdFilter, logger);
+                return buildResultNode(fprSource, result, issueIdFilter);
+            }
+        }
+    }
+
+    protected abstract IRemediationsFprSource openFprSource(AviatorLoggerImpl logger, IProgressWriter progressWriter);
+
+    protected abstract JsonNode buildResultNode(IRemediationsFprSource fprSource, ApplyResult result, Set<String> issueIdFilter);
+
+    @Override
+    public final boolean isSingular() { return true; }
+}

fcli-core/fcli-aviator-common/src/main/java/com/fortify/cli/aviator/_common/remediations_cache/CacheRemediationsFprSource.java

@@ -0,0 +1,82 @@
+/*
+ * Copyright 2021-2026 Open Text.
+ *
+ * The only warranties for products and services of Open Text
+ * and its affiliates and licensors ("Open Text") are as may
+ * be set forth in the express warranty statements accompanying
+ * such products and services. Nothing herein should be construed
+ * as constituting an additional warranty. Open Text shall not be
+ * liable for technical or editorial errors or omissions contained
+ * herein. The information contained herein is subject to change
+ * without notice.
+ */
+package com.fortify.cli.aviator._common.remediations_cache;
+
+import java.nio.file.Path;
+import java.util.List;
+
+import com.fortify.cli.aviator._common.remediations_cache.RemediationsCacheReader.ResolvedFpr;
+import com.fortify.cli.common.exception.FcliBugException;
+
+/**
+ * Offline remediations source: ordered FPR paths from a remediations cache zip.
+ * Product identity (and thus artifact vs release id) comes from the validated entry model.
+ */
+public final class CacheRemediationsFprSource implements IRemediationsFprSource {
+    private final RemediationsCacheReader reader;
+
+    private CacheRemediationsFprSource(RemediationsCacheReader reader) {
+        this.reader = reader;
+    }
+
+    public static CacheRemediationsFprSource open(Path cacheZip, String expectedProduct) {
+        RemediationsCacheReader reader = RemediationsCacheReader.open(cacheZip);
+        try {
+            reader.requireProduct(expectedProduct);
+            return new CacheRemediationsFprSource(reader);
+        } catch (RuntimeException e) {
+            reader.close();
+            throw e;
+        }
+    }
+
+    public RemediationsCacheReader reader() {
+        return reader;
+    }
+
+    @Override
+    public void forEachEntry(EntryAction action) {
+        List<ResolvedFpr> units = reader.getOrderedResolvedFprs();
+        int total = units.size();
+        for (int i = 0; i < total; i++) {
+            ResolvedFpr unit = units.get(i);
+            RemediationsCacheEntry entry = unit.entry();
+            String label = entry.getPath() != null
+                    ? entry.getPath()
+                    : unit.fprPath().getFileName().toString();
+            if (!action.accept(unit.fprPath(), label, productId(entry), i + 1, total)) {
+                break;
+            }
+        }
+    }
+
+    /**
+     * Id for progress/result lists: artifactId (SSC) or releaseId (FoD).
+     * Entries are validated before resolve, so exactly one product block is present.
+     */
+    private static String productId(RemediationsCacheEntry entry) {
+        if (entry.getSscData() != null) {
+            return entry.getSscData().getArtifactId();
+        }
+        if (entry.getFodData() != null) {
+            return entry.getFodData().getReleaseId();
+        }
+        throw new FcliBugException(
+                "Remediations cache entry missing product data after validation: " + entry.getPath());
+    }
+
+    @Override
+    public void close() {
+        reader.close();
+    }
+}

fcli-core/fcli-aviator-common/src/main/java/com/fortify/cli/aviator/_common/remediations_cache/IApplyRemediationsOptions.java

@@ -0,0 +1,27 @@
+/*
+ * Copyright 2021-2026 Open Text.
+ *
+ * The only warranties for products and services of Open Text
+ * and its affiliates and licensors ("Open Text") are as may
+ * be set forth in the express warranty statements accompanying
+ * such products and services. Nothing herein should be construed
+ * as constituting an additional warranty. Open Text shall not be
+ * liable for technical or editorial errors or omissions contained
+ * herein. The information contained herein is subject to change
+ * without notice.
+ */
+package com.fortify.cli.aviator._common.remediations_cache;
+
+import java.util.List;
+
+import com.fortify.cli.aviator.fpr.utils.ISourceDecoder;
+
+/** Abstraction over the shared apply-remediations CLI options, allowing RemediationsApplyHelper
+ *  to remain independent of concrete Picocli types. */
+public interface IApplyRemediationsOptions {
+    String getSourceCodeDirectory();
+    List<String> getIssueIds();
+    ISourceDecoder getSourceDecoder();
+    boolean isPreviewMode();
+    void validate();
+}