@aaa-sentinel/iac-cost 0.3.0 → 0.3.1

package/README.md

@@ -7,6 +7,9 @@ internet is caught in review instead of after the deploy. With `iac-cost fix`, t
 your last scan on resources this Terraform manages come back to you as **pull requests**, not as
 console changes (see [Fixes as pull requests](#fixes-as-pull-requests)).
 
+> **Changed in 0.3.1:** the pull requests of `fix` pass `terraform fmt -check`: an added attribute is
+> aligned with its group (also around heredocs and after removing a block), as `terraform fmt` does.
+
 > **New in 0.3.0:** the `fix` subcommand. Nothing changes for the existing command: same output,
 > same exit codes.
 
@@ -456,8 +459,10 @@ the reason, and the app shows it that way:
 | `rule_not_automated` | No deterministic code fix for that rule |
 
 The rest of the file is kept byte for byte, comments and line endings included (a removed block takes
-the comment lines right above it, up to the first blank line); run `terraform fmt`
-in review if the alignment of `=` matters to you. The pull request says what changed and why;
+the comment lines right above it, up to the first blank line). An added attribute is aligned like
+`terraform fmt` does: if its group of consecutive one-line attributes was already aligned, the whole
+group is realigned to the longest name, so the pull request passes `terraform fmt -check`; if the
+group was not formatted, only the new line is written as `name = value`. The pull request says what changed and why;
 review its `terraform plan` before merging. The finding closes after `terraform apply` and the next scan.
 
 | Option | Meaning |

package/dist/cli.js

@@ -7100,8 +7100,68 @@ function removeListItems(text, attribute, list, remove) {
   const body2 = keep.map((item) => `${itemIndent}${text.slice(item.start, item.end)},${eol}`).join("");
   return { start: attribute.valueStart, end: attribute.valueEnd, text: `[${eol}${body2}${closeIndent}]` };
 }
+function singleLine(text, item) {
+  if (item.kind !== "attribute") return false;
+  return !text.slice(item.start, item.valueEnd).includes("\n") || text.startsWith("<<", item.valueStart);
+}
+function adjacent(text, previous, next) {
+  const gap = text.slice(previous.valueEnd, next.start);
+  const eol = gap.indexOf("\n");
+  if (eol === -1 || gap.indexOf("\n", eol + 1) !== -1) return false;
+  const tail = gap.slice(0, eol).trim();
+  const comment = tail === "" || tail.startsWith("#") || tail.startsWith("//") || tail.startsWith("/*") && tail.endsWith("*/");
+  return comment && gap.slice(eol + 1).trim() === "";
+}
+function alignmentGroups(text, block) {
+  const groups = [];
+  let current = [];
+  for (const item of blockBody(text, block)) {
+    const last = current[current.length - 1];
+    if (singleLine(text, item) && last && adjacent(text, last, item)) {
+      current.push(item);
+      continue;
+    }
+    if (current.length > 0) groups.push(current);
+    current = singleLine(text, item) ? [item] : [];
+  }
+  if (current.length > 0) groups.push(current);
+  return groups;
+}
+function equalsSpan(text, attribute) {
+  return { start: attribute.start + attribute.name.length, end: attribute.valueStart };
+}
+function fmtAligned(text, group) {
+  const width = Math.max(...group.map((attribute) => attribute.name.length));
+  return group.every((attribute) => {
+    const span = equalsSpan(text, attribute);
+    return text.slice(span.start, span.end) === `${" ".repeat(width - attribute.name.length + 1)}= `;
+  });
+}
+function alignAttributes(text, block, names, original) {
+  const edits = [];
+  const before = original ? alignmentGroups(original.text, original.block) : null;
+  for (const group of alignmentGroups(text, block)) {
+    const targets = group.filter((attribute) => names.includes(attribute.name));
+    if (targets.length === 0) continue;
+    let aligned;
+    if (before && original) {
+      const contributing = new Set(group.flatMap((attribute) => before.filter((old) => old.some((a) => a.name === attribute.name))));
+      aligned = [...contributing].every((old) => fmtAligned(original.text, old));
+    } else {
+      const others = group.filter((attribute) => !names.includes(attribute.name));
+      aligned = others.length === 0 || fmtAligned(text, others);
+    }
+    const width = Math.max(...group.map((attribute) => attribute.name.length));
+    for (const attribute of aligned ? group : targets) {
+      const wanted = `${" ".repeat((aligned ? width : attribute.name.length) - attribute.name.length + 1)}= `;
+      const span = equalsSpan(text, attribute);
+      if (text.slice(span.start, span.end) !== wanted) edits.push({ ...span, text: wanted });
+    }
+  }
+  return edits;
+}
 function applyEdits(text, edits) {
-  const sorted = [...edits].sort((a, b) => b.start - a.start || b.end - a.end);
+  const sorted = edits.map((edit2, i) => ({ edit: edit2, i })).sort((a, b) => b.edit.start - a.edit.start || b.edit.end - a.edit.end || b.i - a.i).map(({ edit: edit2 }) => edit2);
   let out = text;
   let limit = Number.POSITIVE_INFINITY;
   for (const edit2 of sorted) {
@@ -8244,6 +8304,19 @@ var ruleTitle = (id) => RULE_TITLES[id] ?? id;
 var comboTitle = (id) => COMBO_TITLES[id] ?? id;
 
 // src/fix/catalog.ts
+function finalizePatch(patch) {
+  const find = (source, target) => parseBody(source, 0, source.length).find(
+    (item) => item.kind === "block" && item.type === "resource" && item.labels[0] === target.type && item.labels[1] === target.name
+  );
+  let text = applyEdits(patch.original, patch.edits);
+  for (const target of patch.align) {
+    const block = find(text, target);
+    if (!block) continue;
+    const before = find(patch.original, target);
+    text = applyEdits(text, alignAttributes(text, block, target.attributes, before ? { text: patch.original, block: before } : void 0));
+  }
+  return text;
+}
 var OPEN_CIDRS = /* @__PURE__ */ new Set(["0.0.0.0/0", "::/0"]);
 var ADMIN_PORTS = [22, 3389];
 var Suggest = class extends Error {
@@ -8295,10 +8368,16 @@ var PatchBuilder = class {
   byFile = /* @__PURE__ */ new Map();
   changes = [];
   first = null;
-  add(where, edit2, attribute, change, lifecycleName = attribute) {
+  add(where, edit2, attribute, change, lifecycleName = attribute, alignName = null) {
     if (lifecycleName !== null && ignoresChanges(where.text, where.block, lifecycleName)) throw new Suggest("ignore_changes", lifecycleName);
-    const patch = this.byFile.get(where.absolutePath) ?? { file: where.file, absolutePath: where.absolutePath, original: where.text, edits: [] };
+    const patch = this.byFile.get(where.absolutePath) ?? { file: where.file, absolutePath: where.absolutePath, original: where.text, edits: [], align: [] };
     patch.edits.push(edit2);
+    const [type, name] = where.block.labels;
+    if (alignName !== null && type && name) {
+      const target = patch.align.find((a) => a.type === type && a.name === name);
+      if (target) target.attributes.push(alignName);
+      else patch.align.push({ type, name, attributes: [alignName] });
+    }
     this.byFile.set(where.absolutePath, patch);
     this.changes.push(change);
     this.first ??= { file: where.file, attribute };
@@ -8327,7 +8406,10 @@ function setLiteral(builder, where, items, name, wanted, ok, insertWhenAbsent =
     where,
     edit(() => setAttribute(where.text, where.block, name, wanted), name),
     name,
-    before === null ? `add \`${name} = ${wanted}\`` : `\`${name}\`: \`${before}\` \u2192 \`${wanted}\``
+    // Solo se alinea lo añadido: cambiar un valor no mueve el `=` de nadie.
+    before === null ? `add \`${name} = ${wanted}\`` : `\`${name}\`: \`${before}\` \u2192 \`${wanted}\``,
+    name,
+    before === null ? name : null
   );
   return "changed";
 }
@@ -8439,21 +8521,25 @@ function awsAdminOpen(ctx, builder) {
   if (blocksOf(items, "dynamic").some((block) => block.labels[0] === "ingress")) throw new Suggest("dynamic_block", "ingress");
   if (attributeOf(items, "ingress")) throw new Suggest("value_from_expression", "ingress");
   let judged = 0;
-  const apply = (target, block, blockItems, shape, label) => {
+  const apply = (target, block, blockItems, shape, label, alignName = null) => {
     const verdict = judgeRule(target.text, block, blockItems, shape, label);
     if (!verdict.open) return false;
     judged += 1;
     const lifecycleName = shape === INLINE_RULE ? "ingress" : verdict.removesBlock ? null : verdict.attribute;
-    verdict.edits.forEach((fn, i) => builder.add(target, edit(fn, verdict.attribute), verdict.attribute, verdict.changes[i] ?? verdict.changes[0] ?? "", lifecycleName));
+    verdict.edits.forEach(
+      (fn, i) => builder.add(target, edit(fn, verdict.attribute), verdict.attribute, verdict.changes[i] ?? verdict.changes[0] ?? "", lifecycleName, verdict.removesBlock ? alignName : null)
+    );
     return verdict.removesBlock;
   };
   const inline = blocksOf(items, "ingress");
   let inlineRemoved = 0;
   for (const ingress of inline) {
-    if (apply(where, ingress, body(where.text, ingress), INLINE_RULE, `the \`ingress\` block of \`${anchor2.address}\``)) inlineRemoved += 1;
+    const before = items[items.indexOf(ingress) - 1];
+    const alignName = before?.kind === "attribute" ? before.name : null;
+    if (apply(where, ingress, body(where.text, ingress), INLINE_RULE, `the \`ingress\` block of \`${anchor2.address}\``, alignName)) inlineRemoved += 1;
   }
   if (inline.length > 0 && inlineRemoved === inline.length) {
-    builder.add(where, edit(() => setAttribute(where.text, where.block, "ingress", "[]"), "ingress"), "ingress", "set `ingress = []` so Terraform removes the rule instead of leaving it unmanaged");
+    builder.add(where, edit(() => setAttribute(where.text, where.block, "ingress", "[]"), "ingress"), "ingress", "set `ingress = []` so Terraform removes the rule instead of leaving it unmanaged", "ingress", "ingress");
   }
   const parents = ["aws_security_group", "aws_default_security_group"];
   const children = [
@@ -8743,7 +8829,7 @@ async function runFix(options, deps) {
     if (outcome.kind === "patch") {
       try {
         for (const patch2 of outcome.patches) {
-          const patched = applyEdits(patch2.original, patch2.edits);
+          const patched = finalizePatch(patch2);
           parseBody(patched, 0, patched.length);
         }
       } catch (error2) {
@@ -8834,7 +8920,7 @@ async function runFix(options, deps) {
         bases.push(atBase);
       }
       const files = patch.patches.map((file, i) => {
-        const patched = applyEdits(file.original, file.edits);
+        const patched = finalizePatch(file);
         const atBase = bases[i] ?? file.original;
         return { path: file.file, content: atBase === file.original ? patched : likeBase(patched, atBase) };
       });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aaa-sentinel/iac-cost",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Estimate the monthly cost delta of a Terraform plan, check it against the AAA Sentinel security rules and open security fixes as pull requests from your CI",
   "license": "MIT",
   "type": "module",