Move sensitivity classification to shared history

internal/engine/secret.go

@@ -40,58 +40,37 @@ func classifySecretPathsWithEvidence(schema *schemaDescriptor, predicate func(Pa
 			addSecretPath(paths, path.String())
 		})
 	}
-	var dependencies []secretDependency
-	for pointer, history := range metadata.history {
-		addSecretPath(paths, pointer)
-		if path, err := ParsePath(pointer); err == nil {
-			addCandidate(path)
-		}
-		for _, change := range history {
-			paths[change.Path.String()] = change.Path.clone()
-			for _, dependency := range change.Dependencies {
+	secret := make(map[string]bool)
+	var dependencies, inherited []secretDependency
+	if model := metadata.currentHistoryModel(); model != nil {
+		dependencies, inherited = model.sensitivityDependencies()
+		for _, candidate := range model.sensitivityCandidates() {
+			pointer := candidate.path.String()
+			paths[pointer] = candidate.path.clone()
+			if candidate.classify {
+				addCandidate(candidate.path)
+			}
+			if candidate.sensitive {
+				secret[pointer] = true
+			}
+			for _, dependency := range candidate.dependencies {
 				paths[dependency.String()] = dependency.clone()
 				addCandidate(dependency)
-				dependencies = append(dependencies, secretDependency{
-					target: change.Path.clone(), dependency: dependency.clone(),
-				})
 			}
 		}
-	}
-	var inherited []secretDependency
-	for _, operation := range metadata.inheritance {
-		if operation.control != nil {
-			control := operation.control.path
-			paths[control.String()] = control.clone()
-			addCandidate(control)
-			for _, contributor := range operation.controlOrigin.contributors {
-				paths[contributor.source.String()] = contributor.source.clone()
-				addCandidate(contributor.source)
-				inherited = append(inherited, secretDependency{target: control.clone(), dependency: contributor.source.clone()})
-			}
-			continue
+		for _, edge := range dependencies {
+			paths[edge.target.String()] = edge.target.clone()
+			paths[edge.dependency.String()] = edge.dependency.clone()
+			addCandidate(edge.dependency)
 		}
-		if operation.transfer == nil {
-			continue
-		}
-		for pointer := range operation.parentOrigins {
-			source, err := ParsePath(pointer)
-			if err != nil {
-				continue
-			}
-			relative, ok := relativeHistoryPath(operation.transfer.from, source)
-			if !ok {
-				continue
-			}
-			destination := appendInheritancePath(operation.transfer.to, relative)
-			paths[pointer] = source
-			paths[destination.String()] = destination.clone()
-			addCandidate(source)
-			addCandidate(destination)
-			inherited = append(inherited, secretDependency{target: destination, dependency: source})
+		for _, edge := range inherited {
+			paths[edge.target.String()] = edge.target.clone()
+			paths[edge.dependency.String()] = edge.dependency.clone()
+			addCandidate(edge.target)
+			addCandidate(edge.dependency)
 		}
 	}
 
-	secret := make(map[string]bool)
 	classifyProjection := func(tree *document.Node) {
 		walkDocument(tree, Path{}, func(path Path, node *document.Node) {
 			pointer := path.String()