fix: rabbit feedback for disconnected paths

Author: urangel

packages/go/analysis/azure/azure_integration_test.go

@@ -1044,3 +1044,79 @@ func TestFetchEntityDescendentPaths_NoTerminalsReturnsEmpty(t *testing.T) {
 	})
 	require.NoError(t, err)
 }
+
+// TestFetchEntityDescendentPaths_SharedIntermediateNode verifies that two terminal nodes sharing
+// an intermediate container node both produce complete paths reaching root. Each traversal
+// independently reaches root through the shared intermediate without being truncated.
+func TestFetchEntityDescendentPaths_SharedIntermediateNode(t *testing.T) {
+	t.Parallel()
+
+	suite := setupIntegrationTestSuite(t)
+	defer teardownIntegrationTestSuite(t, &suite)
+
+	var (
+		tenantID         = integration.RandomObjectID(t)
+		tenantNode       = NewAzureTenant(t, &suite, tenantID)
+		subscriptionNode = NewNode(t, &suite, graph.AsProperties(graph.PropertyMap{
+			common.Name:         "SharedSubscription",
+			common.ObjectID:     integration.RandomObjectID(t),
+			graphAzure.TenantID: tenantID,
+		}), graphAzure.Entity, graphAzure.Subscription)
+		app1 = NewAzureApplication(t, &suite, "App1", integration.RandomObjectID(t), tenantID)
+		app2 = NewAzureApplication(t, &suite, "App2", integration.RandomObjectID(t), tenantID)
+	)
+
+	// tenant --Contains--> subscription --Contains--> app1
+	//                                   --Contains--> app2
+	NewRelationship(t, &suite, tenantNode, subscriptionNode, graphAzure.Contains)
+	NewRelationship(t, &suite, subscriptionNode, app1, graphAzure.Contains)
+	NewRelationship(t, &suite, subscriptionNode, app2, graphAzure.Contains)
+
+	err := suite.GraphDB.ReadTransaction(suite.Context, func(tx graph.Transaction) error {
+		paths, err := azure.FetchEntityDescendentPaths(tx, tenantNode, graphAzure.App)
+		require.NoError(t, err)
+
+		nodeIDs := paths.AllNodes().IDs()
+		require.Contains(t, nodeIDs, tenantNode.ID)
+		require.Contains(t, nodeIDs, subscriptionNode.ID)
+		require.Contains(t, nodeIDs, app1.ID)
+		require.Contains(t, nodeIDs, app2.ID)
+
+		return nil
+	})
+	require.NoError(t, err)
+}
+
+// TestFetchEntityDescendentPaths_TerminalNotConnectedToRoot verifies that a terminal node
+// which exists in the same tenant but has no azure.Contains path leading back to root
+// is excluded from the returned path set.
+func TestFetchEntityDescendentPaths_TerminalNotConnectedToRoot(t *testing.T) {
+	t.Parallel()
+
+	suite := setupIntegrationTestSuite(t)
+	defer teardownIntegrationTestSuite(t, &suite)
+
+	var (
+		tenantID        = integration.RandomObjectID(t)
+		tenantNode      = NewAzureTenant(t, &suite, tenantID)
+		connectedApp    = NewAzureApplication(t, &suite, "ConnectedApp", integration.RandomObjectID(t), tenantID)
+		disconnectedApp = NewAzureApplication(t, &suite, "DisconnectedApp", integration.RandomObjectID(t), tenantID)
+	)
+
+	// Only connectedApp has a Contains edge to root; disconnectedApp shares the tenantID
+	// but has no path leading back to tenantNode.
+	NewRelationship(t, &suite, tenantNode, connectedApp, graphAzure.Contains)
+
+	err := suite.GraphDB.ReadTransaction(suite.Context, func(tx graph.Transaction) error {
+		paths, err := azure.FetchEntityDescendentPaths(tx, tenantNode, graphAzure.App)
+		require.NoError(t, err)
+
+		nodeIDs := paths.AllNodes().IDs()
+		require.Contains(t, nodeIDs, tenantNode.ID)
+		require.Contains(t, nodeIDs, connectedApp.ID)
+		require.NotContains(t, nodeIDs, disconnectedApp.ID)
+
+		return nil
+	})
+	require.NoError(t, err)
+}

packages/go/analysis/azure/queries.go

@@ -28,7 +28,6 @@ import (
 	"github.com/specterops/bloodhound/packages/go/graphschema/ad"
 	"github.com/specterops/bloodhound/packages/go/graphschema/azure"
 	"github.com/specterops/bloodhound/packages/go/graphschema/common"
-	"github.com/specterops/dawgs/cardinality"
 	"github.com/specterops/dawgs/graph"
 	"github.com/specterops/dawgs/ops"
 	"github.com/specterops/dawgs/query"
@@ -872,46 +871,36 @@ func FetchDescendentKindByTenantID(tx graph.Transaction, root *graph.Node, desce
 
 // FetchEntityDescendentPaths fetches paths from each terminal node of descendentKind (within the
 // same Azure tenant as root) back up to root via azure.Contains relationships. Each traversal
-// halts upon reaching root or encountering a node already claimed by a prior traversal, preventing
-// duplicate path segments across traversals.
+// halts upon reaching root
 func FetchEntityDescendentPaths(tx graph.Transaction, root *graph.Node, descendentKind ...graph.Kind) (graph.PathSet, error) {
-	var (
-		visitedBitmap = cardinality.NewBitmap64()
-		pathSet       = graph.NewPathSet()
-	)
-
-	// Pre-populate the visited bitmap with root so that any traversal halts when it reaches it
-	visitedBitmap.Add(root.ID.Uint64())
+	pathSet := graph.NewPathSet()
 
 	terminalNodes, err := FetchDescendentKindByTenantID(tx, root, descendentKind...)
 	if err != nil {
 		return nil, err
 	}
 
 	for _, terminalNode := range terminalNodes {
-		// Skip this terminal if it was already reached and claimed by a prior traversal
-		if visitedBitmap.Contains(terminalNode.ID.Uint64()) {
-			continue
-		}
-
+		reachedRoot := false
 		if paths, err := ops.TraversePaths(tx, ops.TraversalPlan{
 			Root:      terminalNode,
 			Direction: graph.DirectionInbound,
 			BranchQuery: func() graph.Criteria {
 				return query.Kind(query.Relationship(), azure.Contains)
 			},
 			ExpansionFilter: func(segment *graph.PathSegment) bool {
-				nodeID := segment.Node.ID.Uint64()
-				if visitedBitmap.Contains(nodeID) {
+				if segment.Node.ID == root.ID {
+					reachedRoot = true
 					return false
 				}
-				visitedBitmap.Add(nodeID)
 				return true
 			},
 		}); err != nil {
 			return nil, err
 		} else {
-			pathSet.AddPathSet(paths)
+			if reachedRoot {
+				pathSet.AddPathSet(paths)
+			}
 		}
 	}