dhall freeze: Remove cache import expression before a secure freeze

dhall/src/Dhall/Freeze.hs

@@ -401,9 +401,30 @@ freezeExpressionWithSettings settings directory scope intent expression = do
         cache expression_ =
             return expression_
 
-    case intent of
+    let uncache
+            (ImportAlt
+                (Core.shallowDenote -> Embed
+                    Import{ importHashed = ImportHashed { hash = Just expectedHash, importType = Missing } }
+                )
+                (Core.shallowDenote -> Embed
+                    import_@Import{ importHashed = ImportHashed{ hash = Nothing } }
+                )
+            ) = Embed
+                (import_
+                    { importHashed = (importHashed import_)
+                        { hash = Just expectedHash
+                        }
+                    }
+                )
+        uncache expression_ = expression_
+
+    let simplify (ImportAlt (Core.shallowDenote -> Embed import1) (Core.shallowDenote -> Embed import2))
+            | import1 == import2 = Embed import1
+        simplify expression_ = expression_
+
+    Dhall.Optics.transformOf Core.subExpressions simplify <$> case intent of
         Secure ->
-            traverse freezeFunction expression
+            traverse freezeFunction (Dhall.Optics.transformOf Core.subExpressions uncache expression)
         Cache  ->
             Dhall.Optics.transformMOf Core.subExpressions cache expression
 

dhall/tests/Dhall/Test/Freeze.hs

@@ -21,19 +21,30 @@ import qualified Test.Tasty       as Tasty
 import qualified Test.Tasty.HUnit as Tasty.HUnit
 import qualified Turtle
 
-freezeDirectory :: FilePath
-freezeDirectory = "./tests/freeze"
+freezeDirectoryCached :: FilePath
+freezeDirectoryCached = "./tests/freeze/cached"
+
+freezeDirectorySecure :: FilePath
+freezeDirectorySecure = "./tests/freeze/secure"
 
 getTests :: IO TestTree
 getTests = do
-    freezeTests <- Test.Util.discover (Turtle.chars <* "A.dhall") freezeTest (Turtle.lstree freezeDirectory)
-
-    let testTree = Tasty.testGroup "freeze tests" [ freezeTests ]
+    freezeCachedTests <- Test.Util.discover (Turtle.chars <* "A.dhall")
+        (freezeTest freezeDirectoryCached Cache)
+        (Turtle.lstree freezeDirectoryCached)
+    freezeSecureTests <- Test.Util.discover (Turtle.chars <* "A.dhall")
+        (freezeTest freezeDirectorySecure Secure)
+        (Turtle.lstree freezeDirectorySecure)
+
+    let testTree = Tasty.testGroup "freeze tests"
+            [ Tasty.testGroup "cached" [freezeCachedTests]
+            , Tasty.testGroup "secure" [freezeSecureTests]
+            ]
 
     return testTree
 
-freezeTest :: Text -> TestTree
-freezeTest prefix =
+freezeTest :: FilePath -> Intent -> Text -> TestTree
+freezeTest dir intent prefix =
     Tasty.HUnit.testCase (Text.unpack prefix) $ do
         let inputFile  = Text.unpack (prefix <> "A.dhall")
         let outputFile = Text.unpack (prefix <> "B.dhall")
@@ -42,7 +53,7 @@ freezeTest prefix =
 
         parsedInput <- Core.throws (Parser.exprFromText mempty inputText)
 
-        actualExpression <- Freeze.freezeExpression (Turtle.encodeString freezeDirectory) AllImports Cache parsedInput
+        actualExpression <- Freeze.freezeExpression (Turtle.encodeString dir) AllImports intent parsedInput
 
         let actualText = Core.pretty actualExpression <> "\n"
 

dhall/tests/freeze/secure/True.dhall

@@ -0,0 +1 @@
+True

dhall/tests/freeze/secure/cachedA.dhall

@@ -0,0 +1,2 @@
+  ./True.dhall sha256:27abdeddfe8503496adeb623466caa47da5f63abd2bc6fa19f6cfcb73ecfed70
+? ./True.dhall

dhall/tests/freeze/secure/cachedB.dhall

@@ -0,0 +1,2 @@
+./True.dhall
+  sha256:27abdeddfe8503496adeb623466caa47da5f63abd2bc6fa19f6cfcb73ecfed70

dhall/tests/freeze/secure/incorrectHashA.dhall

@@ -0,0 +1 @@
+./True.dhall sha256:0000000000000000000000000000000000000000000000000000000000000000

dhall/tests/freeze/secure/incorrectHashB.dhall

@@ -0,0 +1,2 @@
+./True.dhall
+  sha256:27abdeddfe8503496adeb623466caa47da5f63abd2bc6fa19f6cfcb73ecfed70

dhall/tests/freeze/secure/protectedA.dhall

@@ -0,0 +1 @@
+./True.dhall sha256:27abdeddfe8503496adeb623466caa47da5f63abd2bc6fa19f6cfcb73ecfed70

dhall/tests/freeze/secure/protectedB.dhall

@@ -0,0 +1,2 @@
+./True.dhall
+  sha256:27abdeddfe8503496adeb623466caa47da5f63abd2bc6fa19f6cfcb73ecfed70

dhall/tests/freeze/secure/unprotectedA.dhall

@@ -0,0 +1 @@
+./True.dhall

dhall/tests/freeze/secure/unprotectedB.dhall

@@ -0,0 +1,2 @@
+./True.dhall
+  sha256:27abdeddfe8503496adeb623466caa47da5f63abd2bc6fa19f6cfcb73ecfed70