Slice 1: golden fixture + account sanitizer (#9)

internal/cli/scan.go

@@ -6,6 +6,7 @@ import (
 	"os"
 
 	"github.com/nkcoder/reachr/internal/awsscan"
+	"github.com/nkcoder/reachr/internal/topology"
 	"github.com/spf13/cobra"
 )
 
@@ -16,6 +17,7 @@ var (
 	scanFilter  string
 	scanOutput  string
 	scanRaw     bool
+	scanScrub   bool
 )
 
 var scanCmd = &cobra.Command{
@@ -47,6 +49,9 @@ func runScan(cmd *cobra.Command) error {
 		return fmt.Errorf("scan backbone: %w", err)
 	}
 	snap := raw.ToSnapshot(account, scanFilter)
+	if scanScrub {
+		topology.Sanitize(snap)
+	}
 
 	f, err := os.Create(scanOutput)
 	if err != nil {
@@ -91,5 +96,6 @@ func init() {
 	f.StringVar(&scanFilter, "filter", "", "scope selector, e.g. tag:project=X")
 	f.StringVarP(&scanOutput, "output", "o", "topology.json", "snapshot output path")
 	f.BoolVar(&scanRaw, "raw", false, "exploratory: dump raw AWS backbone JSON to stdout")
+	f.BoolVar(&scanScrub, "scrub", false, "redact the AWS account id (for shareable snapshots / fixtures)")
 	_ = scanCmd.MarkFlagRequired("region")
 }

internal/topology/sanitize.go

@@ -0,0 +1,36 @@
+package topology
+
+import "strings"
+
+// RedactedAccount is the placeholder substituted for the real AWS account id.
+const RedactedAccount = "000000000000"
+
+// Sanitize redacts the AWS account id from a snapshot so it can be committed as a
+// fixture or shared. It replaces the account everywhere it appears — the Account
+// field, ARNs, SG-peer accounts, and ENI instance-owner ids — while keeping resource
+// ids and RFC1918 private IPs (not sensitive, and needed for realistic reasoning).
+func Sanitize(s *Snapshot) {
+	account := s.Account
+	if account == "" || account == RedactedAccount {
+		return
+	}
+	redact := func(v string) string { return strings.ReplaceAll(v, account, RedactedAccount) }
+
+	s.Account = RedactedAccount
+	for i := range s.Subnets {
+		s.Subnets[i].ARN = redact(s.Subnets[i].ARN)
+	}
+	for i := range s.SecurityGroups {
+		s.SecurityGroups[i].ARN = redact(s.SecurityGroups[i].ARN)
+		for j := range s.SecurityGroups[i].Rules {
+			if p := &s.SecurityGroups[i].Rules[j].Peer; p.Account == account {
+				p.Account = RedactedAccount
+			}
+		}
+	}
+	for i := range s.ENIs {
+		if a := s.ENIs[i].Attachment; a != nil && a.InstanceOwnerID == account {
+			a.InstanceOwnerID = RedactedAccount
+		}
+	}
+}

testdata/README.md

@@ -0,0 +1,32 @@
+# testdata
+
+## testenv.golden.json
+
+A sanitized `topology.json` snapshot of the `testenv/` topology (schemaVersion 1).
+This is the golden fixture the reachability engine and renderer are tested against —
+no live AWS needed. It exercises the interesting cases:
+
+| | |
+|---|---|
+| ENIs | 5 — instance (×2), ALB (×2, `amazon-elb`), RDS (`amazon-rds`) |
+| Security groups | 4 — the `alb → app → db` SG-references-SG chain + default self-ref |
+| Route tables | 2 — main + custom, with a gateway-endpoint prefix-list route |
+| VPC endpoints | 1 — S3 gateway endpoint |
+
+**Sanitized:** the AWS account id is redacted to `000000000000` (in `account`, ARNs,
+SG-peer accounts, and instance-owner ids). Resource ids and RFC1918 private IPs are
+kept — they aren't sensitive and are needed for realistic reasoning. Service owners
+(`amazon-elb`, `amazon-rds`) are preserved.
+
+### Regenerating
+
+Stand up `testenv/` (see `testenv/README.md`) and run a scrubbed scan:
+
+```sh
+go run . scan --region ap-southeast-2 --scrub \
+  --vpc "$(terraform -chdir=testenv output -raw vpc_id)" \
+  -o testdata/testenv.golden.json
+```
+
+`--scrub` applies the same redaction (`internal/topology.Sanitize`). `scannedAt` will
+differ per scan; pin it if a stable diff matters.