[osquerybeat] Implement encoding package in extension (#47169)

* feat: Implement encoding package with MarshalToMap and EncodingFlag support

* fix: Update EncodingFlag constants and enhance tests for zero value handling

* fix: Enhance float handling in convertValueToString to respect zero value flag

* fix: Remove unused EncodingFlagParseUnexported and related test cases

---------

Co-authored-by: Emilio Alvarez Piñeiro <[email protected]>

Author: marc-gr

x-pack/osquerybeat/ext/osquery-extension/pkg/encoding/encoding.go

@@ -0,0 +1,155 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package encoding
+
+import (
+	"fmt"
+	"reflect"
+	"strconv"
+)
+
+type EncodingFlag int
+
+const (
+	// EncodingFlagUseNumbersZeroValues forces numeric zero values to be rendered as "0"
+	// instead of empty strings. By default, zero values for int, uint, and float types
+	// are converted to empty strings, but this flag preserves them as "0".
+	EncodingFlagUseNumbersZeroValues EncodingFlag = 1 << iota
+)
+
+func (f EncodingFlag) has(option EncodingFlag) bool {
+	return f&option != 0
+}
+
+// MarshalToMap converts a struct, a single-level map (like map[string]string
+// or map[string]any), or a pointer to these, into a map[string]string.
+// It prioritizes the "osquery" tag for struct fields.
+func MarshalToMap(in any) (map[string]string, error) {
+	return MarshalToMapWithFlags(in, 0)
+}
+
+func MarshalToMapWithFlags(in any, flags EncodingFlag) (map[string]string, error) {
+	if in == nil {
+		return nil, fmt.Errorf("input cannot be nil")
+	}
+	result := make(map[string]string)
+
+	v := reflect.ValueOf(in)
+	t := reflect.TypeOf(in)
+
+	if v.Kind() == reflect.Ptr {
+		if v.IsNil() {
+			return nil, fmt.Errorf("input pointer is nil")
+		}
+		v = v.Elem()
+		t = t.Elem()
+	}
+
+	if v.Kind() == reflect.Map {
+		if t.Key().Kind() != reflect.String {
+			return nil, fmt.Errorf("map keys must be strings, got %s", t.Key().Kind())
+		}
+
+		for _, k := range v.MapKeys() {
+			key := k.String()
+			fieldValue := v.MapIndex(k)
+
+			value, err := convertValueToString(fieldValue, flags)
+			if err != nil {
+				return nil, fmt.Errorf("failed to convert field %s: %w", key, err)
+			}
+			result[key] = value
+		}
+		return result, nil
+	}
+
+	if v.Kind() != reflect.Struct {
+		return nil, fmt.Errorf("unsupported type: %s, must be a struct, map, or pointer to one of them", v.Kind())
+	}
+
+	for i := 0; i < v.NumField(); i++ {
+		fieldValue := v.Field(i)
+		fieldType := t.Field(i)
+
+		if !fieldType.IsExported() {
+			continue
+		}
+
+		key := fieldType.Tag.Get("osquery")
+		switch key {
+		case "-":
+			continue
+		case "":
+			key = fieldType.Name
+		}
+
+		value, err := convertValueToString(fieldValue, flags)
+		if err != nil {
+			return nil, fmt.Errorf("failed to convert field %s: %w", key, err)
+		}
+
+		result[key] = value
+	}
+
+	return result, nil
+}
+
+func convertValueToString(fieldValue reflect.Value, flag EncodingFlag) (string, error) {
+	// Handle pointers first
+	if fieldValue.Kind() == reflect.Ptr {
+		if fieldValue.IsNil() {
+			return "", nil
+		}
+		return convertValueToString(fieldValue.Elem(), flag)
+	}
+
+	switch fieldValue.Kind() {
+	case reflect.String:
+		return fieldValue.String(), nil
+
+	case reflect.Bool:
+		// osquery often expects boolean values as "0" or "1"
+		if fieldValue.Bool() {
+			return "1", nil
+		}
+		return "0", nil
+
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		// osquery often expects empty string for 0 values unless necessary
+		val := fieldValue.Int()
+		if !flag.has(EncodingFlagUseNumbersZeroValues) && val == 0 {
+			return "", nil
+		}
+		return strconv.FormatInt(val, 10), nil
+
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		val := fieldValue.Uint()
+		if !flag.has(EncodingFlagUseNumbersZeroValues) && val == 0 {
+			return "", nil
+		}
+		return strconv.FormatUint(val, 10), nil
+
+	case reflect.Float32:
+		val := fieldValue.Float()
+		if !flag.has(EncodingFlagUseNumbersZeroValues) && val == 0 {
+			return "", nil
+		}
+		// Use -1 for precision to format the smallest number of digits necessary
+		return strconv.FormatFloat(val, 'f', -1, 32), nil
+	case reflect.Float64:
+		val := fieldValue.Float()
+		if !flag.has(EncodingFlagUseNumbersZeroValues) && val == 0 {
+			return "", nil
+		}
+		return strconv.FormatFloat(val, 'f', -1, 64), nil
+
+	// Default: use Sprintf for unsupported types
+	default:
+		if fieldValue.CanInterface() {
+			return fmt.Sprintf("%v", fieldValue.Interface()), nil
+		}
+		return "", fmt.Errorf("unsupported type (%s)", fieldValue.Kind())
+	}
+}

x-pack/osquerybeat/ext/osquery-extension/pkg/encoding/encoding_test.go

@@ -0,0 +1,213 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package encoding
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestEncodingFlagHas(t *testing.T) {
+	tests := []struct {
+		flag     EncodingFlag
+		option   EncodingFlag
+		expected bool
+	}{
+		{EncodingFlagUseNumbersZeroValues, EncodingFlagUseNumbersZeroValues, true},
+	}
+
+	for _, test := range tests {
+		result := test.flag.has(test.option)
+		if result != test.expected {
+			t.Errorf("has(%v) = %v; expected %v", test.option, result, test.expected)
+		}
+	}
+}
+
+func TestMarshalToMapWithFlags(t *testing.T) {
+	tests := []struct {
+		input    any
+		flags    EncodingFlag
+		expected map[string]string
+		err      bool
+	}{
+		{
+			input:    nil,
+			flags:    0,
+			expected: nil,
+			err:      true,
+		},
+		{
+			input: &struct {
+				Name string `osquery:"name"`
+			}{Name: "test"},
+			flags:    0,
+			expected: map[string]string{"name": "test"},
+			err:      false,
+		},
+		{
+			input:    map[string]any{"key1": "value1", "key2": "value2", "key3": 1},
+			flags:    0,
+			expected: map[string]string{"key1": "value1", "key2": "value2", "key3": "1"},
+			err:      false,
+		},
+		{
+			input: &struct {
+				HiddenField int `osquery:"-"`
+			}{HiddenField: 42},
+			flags:    0,
+			expected: map[string]string{},
+			err:      false,
+		},
+		{
+			input: &struct {
+				InvalidType map[int]string
+			}{InvalidType: map[int]string{1: "value"}},
+			flags:    0,
+			expected: map[string]string{"InvalidType": "map[1:value]"},
+			err:      false,
+		},
+		{
+			input: &struct {
+				ZeroVal int
+			}{ZeroVal: 0},
+			flags:    0,
+			expected: map[string]string{"ZeroVal": ""},
+			err:      false,
+		},
+		{
+			input: &struct {
+				ZeroVal int
+			}{ZeroVal: 0},
+			flags:    EncodingFlagUseNumbersZeroValues,
+			expected: map[string]string{"ZeroVal": "0"},
+			err:      false,
+		},
+		// Test bool type
+		{
+			input: &struct {
+				IsActive bool
+			}{IsActive: true},
+			flags:    0,
+			expected: map[string]string{"IsActive": "1"},
+			err:      false,
+		},
+		{
+			input: &struct {
+				IsActive bool
+			}{IsActive: false},
+			flags:    0,
+			expected: map[string]string{"IsActive": "0"},
+			err:      false,
+		},
+		// Test uint type
+		{
+			input: &struct {
+				Count uint
+			}{Count: 42},
+			flags:    0,
+			expected: map[string]string{"Count": "42"},
+			err:      false,
+		},
+		{
+			input: &struct {
+				Count uint
+			}{Count: 0},
+			flags:    0,
+			expected: map[string]string{"Count": ""},
+			err:      false,
+		},
+		{
+			input: &struct {
+				Count uint
+			}{Count: 0},
+			flags:    EncodingFlagUseNumbersZeroValues,
+			expected: map[string]string{"Count": "0"},
+			err:      false,
+		},
+		// Test float type
+		{
+			input: &struct {
+				Price float64
+			}{Price: 99.99},
+			flags:    0,
+			expected: map[string]string{"Price": "99.99"},
+			err:      false,
+		},
+		{
+			input: &struct {
+				Price float32
+			}{Price: 12.5},
+			flags:    0,
+			expected: map[string]string{"Price": "12.5"},
+			err:      false,
+		},
+		// Test non-pointer struct
+		{
+			input: struct {
+				Name string
+			}{Name: "test"},
+			flags:    0,
+			expected: map[string]string{"Name": "test"},
+			err:      false,
+		},
+		// Test pointer maps
+		{
+			input: &map[string]string{
+				"key1": "value1",
+				"key2": "value2",
+			},
+			flags:    0,
+			expected: map[string]string{"key1": "value1", "key2": "value2"},
+			err:      false,
+		},
+		// Test pointer fields
+		{
+			input: &struct {
+				StrPtr *string
+				IntPtr *int
+			}{
+				StrPtr: stringPtr("hello"),
+				IntPtr: intPtr(123),
+			},
+			flags:    0,
+			expected: map[string]string{"StrPtr": "hello", "IntPtr": "123"},
+			err:      false,
+		},
+		// Test nil pointer fields
+		{
+			input: &struct {
+				StrPtr *string
+				IntPtr *int
+			}{
+				StrPtr: nil,
+				IntPtr: nil,
+			},
+			flags:    0,
+			expected: map[string]string{"StrPtr": "", "IntPtr": ""},
+			err:      false,
+		},
+	}
+
+	for _, test := range tests {
+		result, err := MarshalToMapWithFlags(test.input, test.flags)
+		if (err != nil) != test.err {
+			t.Errorf("MarshalToMapWithFlags(%v, %v) error = %v; expected error = %v", test.input, test.flags, err, test.err)
+			continue
+		}
+		if !reflect.DeepEqual(result, test.expected) {
+			t.Errorf("MarshalToMapWithFlags(%v, %v) = %v; expected %v", test.input, test.flags, result, test.expected)
+		}
+	}
+}
+
+// Helper functions for creating pointers
+func stringPtr(s string) *string {
+	return &s
+}
+
+func intPtr(i int) *int {
+	return &i
+}