@benzenejs/mesh-discovery-azure 0.0.0-stage → 0.1.0-beta.2

package/dist/AzureAppServiceDiscoveryProvider.d.ts

@@ -0,0 +1,25 @@
+/** Port of Benzene.Mesh.Discovery.Azure.AzureAppServiceDiscoveryProvider. */
+import { IMeshDiscoveryProvider, MeshDiscoveryFilter, MeshServiceRegistryEntry } from '@benzenejs/mesh-contracts';
+import { IAzureResourceLister } from './IAzureResourceLister';
+/**
+ * Discovers Benzene services by enumerating the Azure App Service / Function App resources
+ * (`Microsoft.Web/sites`) in a subscription, keeping those that match the `MeshDiscoveryFilter` (by default,
+ * carry the `benzene` tag), and emitting an HTTP registry entry per site at its default hostname
+ * (`https://{host}/benzene/spec|health`). App Services are HTTP-addressable, so entries use the default HTTP
+ * interrogation source (`MeshServiceSource.http`) - the aggregator's `HttpMeshServiceSource` interrogates each.
+ *
+ * A site's host defaults to `{name}.azurewebsites.net`; override it (custom domain) with the `benzene:host`
+ * tag, and the spec/health paths with `benzene:spec-path`/`benzene:health-path`.
+ */
+export declare class AzureAppServiceDiscoveryProvider implements IMeshDiscoveryProvider {
+    private readonly lister;
+    /** Tag overriding the host (default `{name}.azurewebsites.net`). */
+    static readonly HostTag = "benzene:host";
+    /** Tag overriding the spec path (default `/benzene/spec?type=benzene`). */
+    static readonly SpecPathTag = "benzene:spec-path";
+    /** Tag overriding the health path (default `/benzene/health`). */
+    static readonly HealthPathTag = "benzene:health-path";
+    constructor(lister: IAzureResourceLister);
+    get key(): string;
+    discoverAsync(filter: MeshDiscoveryFilter, cancellationToken?: AbortSignal): Promise<readonly MeshServiceRegistryEntry[]>;
+}

package/dist/AzureAppServiceDiscoveryProvider.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AzureAppServiceDiscoveryProvider = void 0;
+/** Port of Benzene.Mesh.Discovery.Azure.AzureAppServiceDiscoveryProvider. */
+const mesh_contracts_1 = require("@benzenejs/mesh-contracts");
+const DefaultSpecPath = '/benzene/spec?type=benzene';
+const DefaultHealthPath = '/benzene/health';
+/**
+ * Discovers Benzene services by enumerating the Azure App Service / Function App resources
+ * (`Microsoft.Web/sites`) in a subscription, keeping those that match the `MeshDiscoveryFilter` (by default,
+ * carry the `benzene` tag), and emitting an HTTP registry entry per site at its default hostname
+ * (`https://{host}/benzene/spec|health`). App Services are HTTP-addressable, so entries use the default HTTP
+ * interrogation source (`MeshServiceSource.http`) - the aggregator's `HttpMeshServiceSource` interrogates each.
+ *
+ * A site's host defaults to `{name}.azurewebsites.net`; override it (custom domain) with the `benzene:host`
+ * tag, and the spec/health paths with `benzene:spec-path`/`benzene:health-path`.
+ */
+class AzureAppServiceDiscoveryProvider {
+    lister;
+    /** Tag overriding the host (default `{name}.azurewebsites.net`). */
+    static HostTag = 'benzene:host';
+    /** Tag overriding the spec path (default `/benzene/spec?type=benzene`). */
+    static SpecPathTag = 'benzene:spec-path';
+    /** Tag overriding the health path (default `/benzene/health`). */
+    static HealthPathTag = 'benzene:health-path';
+    constructor(lister) {
+        this.lister = lister;
+    }
+    get key() {
+        return 'Azure';
+    }
+    async discoverAsync(filter, cancellationToken) {
+        const resources = await this.lister.listWebAppsAsync(cancellationToken);
+        const entries = [];
+        for (const resource of resources) {
+            if (!filter.matches(resource.tags)) {
+                continue;
+            }
+            if (filter.regions !== undefined &&
+                resource.location !== undefined &&
+                !filter.regions.some((region) => region.toLowerCase() === resource.location.toLowerCase())) {
+                continue;
+            }
+            const defaultHost = resource.defaultHost ?? `${resource.name}.azurewebsites.net`;
+            const host = sanitizeHost(tagOrDefault(resource.tags, AzureAppServiceDiscoveryProvider.HostTag, defaultHost), defaultHost);
+            const specPath = sanitizePath(tagOrDefault(resource.tags, AzureAppServiceDiscoveryProvider.SpecPathTag, DefaultSpecPath), DefaultSpecPath);
+            const healthPath = sanitizePath(tagOrDefault(resource.tags, AzureAppServiceDiscoveryProvider.HealthPathTag, DefaultHealthPath), DefaultHealthPath);
+            entries.push(new mesh_contracts_1.MeshServiceRegistryEntry(resource.name, `https://${host}${specPath}`, `https://${host}${healthPath}`));
+        }
+        return entries;
+    }
+}
+exports.AzureAppServiceDiscoveryProvider = AzureAppServiceDiscoveryProvider;
+function tagOrDefault(tags, key, fallback) {
+    const value = tags[key];
+    return value !== undefined && value.trim().length > 0 ? value : fallback;
+}
+// A host tag carries an attacker-influenceable value (anyone who can tag the resource). Reject anything that
+// isn't a bare host[:port] authority: a value carrying a path, scheme, userinfo, or whitespace/CRLF could
+// otherwise restructure the "https://{host}{path}" URL and point the aggregator's fetch at a different host
+// (SSRF). An invalid override falls back to the safe default host rather than aborting the whole sweep.
+function sanitizeHost(host, fallback) {
+    return isBareAuthority(host) ? host : fallback;
+}
+function isBareAuthority(value) {
+    if (value.trim().length === 0) {
+        return false;
+    }
+    for (const c of value) {
+        if (c === '/' || c === '\\' || c === '@' || c === '?' || c === '#' || /\s/.test(c)) {
+            return false;
+        }
+    }
+    return true;
+}
+// A path override must be a real path (start with '/'); otherwise "{host}{path}" would graft the value onto
+// the host - e.g. ".evil.com/spec" makes "myapp.azurewebsites.net.evil.com/spec" - and redirect the fetch
+// off-host. An invalid override falls back to the safe default path.
+function sanitizePath(path, fallback) {
+    return path.startsWith('/') ? path : fallback;
+}

package/dist/AzureArmResourceLister.d.ts

@@ -0,0 +1,27 @@
+/** Port of Benzene.Mesh.Discovery.Azure.AzureArmResourceLister. */
+import { ResourceManagementClient } from '@azure/arm-resources';
+import { AzureResourceInfo, IAzureResourceLister } from './IAzureResourceLister';
+/**
+ * The real `IAzureResourceLister` over Azure Resource Manager. Kept thin (no discovery logic) so the SDK
+ * coupling lives in one place and `AzureAppServiceDiscoveryProvider` stays unit-testable against the port.
+ * Enumerates the `Microsoft.Web/sites` resources in a subscription, optionally constrained to one resource
+ * group.
+ *
+ * `Azure.ResourceManager` -> `@azure/arm-resources` (the JS-ecosystem equivalent). Divergence: C#'s
+ * `ArmClient` is tenant-scoped and picks the subscription per call (`GetDefaultSubscriptionAsync`), whereas
+ * JS's `ResourceManagementClient` is *subscription-scoped at construction* - so the subscription choice
+ * moves to where the client is built (`addMeshAzureDiscovery`), and this lister only holds the optional
+ * resource-group filter. The resource group isn't a field on the list item, so it's parsed from the ARM id.
+ * Deployment slots (`Microsoft.Web/sites/slots`) are a distinct resource type and never returned; Function
+ * Apps are `Microsoft.Web/sites` and are returned when tagged (the tag filter is the gate).
+ */
+export declare class AzureArmResourceLister implements IAzureResourceLister {
+    private readonly client;
+    private readonly resourceGroup;
+    /**
+     * @param client The subscription-scoped ARM client.
+     * @param resourceGroup If set, only sites in this resource group are returned (matched case-insensitively).
+     */
+    constructor(client: ResourceManagementClient, resourceGroup?: string);
+    listWebAppsAsync(_cancellationToken?: AbortSignal): Promise<AzureResourceInfo[]>;
+}

package/dist/AzureArmResourceLister.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AzureArmResourceLister = void 0;
+/**
+ * The real `IAzureResourceLister` over Azure Resource Manager. Kept thin (no discovery logic) so the SDK
+ * coupling lives in one place and `AzureAppServiceDiscoveryProvider` stays unit-testable against the port.
+ * Enumerates the `Microsoft.Web/sites` resources in a subscription, optionally constrained to one resource
+ * group.
+ *
+ * `Azure.ResourceManager` -> `@azure/arm-resources` (the JS-ecosystem equivalent). Divergence: C#'s
+ * `ArmClient` is tenant-scoped and picks the subscription per call (`GetDefaultSubscriptionAsync`), whereas
+ * JS's `ResourceManagementClient` is *subscription-scoped at construction* - so the subscription choice
+ * moves to where the client is built (`addMeshAzureDiscovery`), and this lister only holds the optional
+ * resource-group filter. The resource group isn't a field on the list item, so it's parsed from the ARM id.
+ * Deployment slots (`Microsoft.Web/sites/slots`) are a distinct resource type and never returned; Function
+ * Apps are `Microsoft.Web/sites` and are returned when tagged (the tag filter is the gate).
+ */
+class AzureArmResourceLister {
+    client;
+    resourceGroup;
+    /**
+     * @param client The subscription-scoped ARM client.
+     * @param resourceGroup If set, only sites in this resource group are returned (matched case-insensitively).
+     */
+    constructor(client, resourceGroup) {
+        this.client = client;
+        this.resourceGroup = resourceGroup !== undefined && resourceGroup.trim().length > 0 ? resourceGroup : undefined;
+    }
+    async listWebAppsAsync(_cancellationToken) {
+        const resources = [];
+        for await (const resource of this.client.resources.list({ filter: "resourceType eq 'Microsoft.Web/sites'" })) {
+            // Scope to one resource group in code (the generic-resources $filter doesn't take a resource group),
+            // so a subscription-scoped Reader identity still only discovers the intended group.
+            if (this.resourceGroup !== undefined && !equalsIgnoreCase(resourceGroupOf(resource.id), this.resourceGroup)) {
+                continue;
+            }
+            resources.push({
+                name: resource.name ?? '',
+                location: resource.location,
+                defaultHost: undefined,
+                tags: resource.tags ?? {},
+            });
+        }
+        return resources;
+    }
+}
+exports.AzureArmResourceLister = AzureArmResourceLister;
+/** Extracts the resource-group segment from an ARM resource id (`/subscriptions/.../resourceGroups/{rg}/...`). */
+function resourceGroupOf(id) {
+    if (id === undefined) {
+        return undefined;
+    }
+    const match = /\/resourceGroups\/([^/]+)/i.exec(id);
+    return match ? match[1] : undefined;
+}
+function equalsIgnoreCase(a, b) {
+    return a !== undefined && a.toLowerCase() === b.toLowerCase();
+}

package/dist/Extensions.d.ts

@@ -0,0 +1,16 @@
+import { IBenzeneServiceContainer } from '@benzenejs/abstractions';
+/**
+ * Registers `AzureAppServiceDiscoveryProvider` (as an additional `IMeshDiscoveryProvider`) over a
+ * `ResourceManagementClient` authenticated with `DefaultAzureCredential` (managed identity in Azure, the dev
+ * credential locally), plus a `MeshDiscoveryRunner` over all registered providers. The identity needs
+ * `Reader` on the resources it enumerates.
+ *
+ * Divergence from C#: JS's `ResourceManagementClient` is subscription-scoped at construction (there's no
+ * `GetDefaultSubscriptionAsync`), so a subscription id is required - passed here or read from the
+ * `AZURE_SUBSCRIPTION_ID` environment variable.
+ *
+ * @param subscriptionId The subscription to enumerate. Falls back to `AZURE_SUBSCRIPTION_ID`; required.
+ * @param resourceGroup If set, discovery is constrained to this resource group (recommended when the
+ * identity holds Reader at subscription scope).
+ */
+export declare function addMeshAzureDiscovery(services: IBenzeneServiceContainer, subscriptionId?: string, resourceGroup?: string): IBenzeneServiceContainer;

package/dist/Extensions.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.addMeshAzureDiscovery = addMeshAzureDiscovery;
+/** Port of Benzene.Mesh.Discovery.Azure.Extensions. */
+const arm_resources_1 = require("@azure/arm-resources");
+const identity_1 = require("@azure/identity");
+const mesh_contracts_1 = require("@benzenejs/mesh-contracts");
+const AzureAppServiceDiscoveryProvider_1 = require("./AzureAppServiceDiscoveryProvider");
+const AzureArmResourceLister_1 = require("./AzureArmResourceLister");
+const IAzureResourceLister_1 = require("./IAzureResourceLister");
+/**
+ * Registers `AzureAppServiceDiscoveryProvider` (as an additional `IMeshDiscoveryProvider`) over a
+ * `ResourceManagementClient` authenticated with `DefaultAzureCredential` (managed identity in Azure, the dev
+ * credential locally), plus a `MeshDiscoveryRunner` over all registered providers. The identity needs
+ * `Reader` on the resources it enumerates.
+ *
+ * Divergence from C#: JS's `ResourceManagementClient` is subscription-scoped at construction (there's no
+ * `GetDefaultSubscriptionAsync`), so a subscription id is required - passed here or read from the
+ * `AZURE_SUBSCRIPTION_ID` environment variable.
+ *
+ * @param subscriptionId The subscription to enumerate. Falls back to `AZURE_SUBSCRIPTION_ID`; required.
+ * @param resourceGroup If set, discovery is constrained to this resource group (recommended when the
+ * identity holds Reader at subscription scope).
+ */
+function addMeshAzureDiscovery(services, subscriptionId, resourceGroup) {
+    const resolvedSubscriptionId = subscriptionId ?? process.env['AZURE_SUBSCRIPTION_ID'];
+    if (resolvedSubscriptionId === undefined || resolvedSubscriptionId.trim().length === 0) {
+        throw new Error('addMeshAzureDiscovery requires a subscription id (pass one explicitly or set AZURE_SUBSCRIPTION_ID) - ' +
+            "the JS ResourceManagementClient is subscription-scoped and has no default-subscription resolution.");
+    }
+    services.addSingletonFactory(IAzureResourceLister_1.IAzureResourceLister, () => new AzureArmResourceLister_1.AzureArmResourceLister(new arm_resources_1.ResourceManagementClient(new identity_1.DefaultAzureCredential(), resolvedSubscriptionId), resourceGroup));
+    services.addSingletonFactory(mesh_contracts_1.IMeshDiscoveryProvider, (resolver) => new AzureAppServiceDiscoveryProvider_1.AzureAppServiceDiscoveryProvider(resolver.getService(IAzureResourceLister_1.IAzureResourceLister)));
+    services.addSingletonFactory(mesh_contracts_1.MeshDiscoveryRunner, (resolver) => new mesh_contracts_1.MeshDiscoveryRunner(resolver.getServices(mesh_contracts_1.IMeshDiscoveryProvider)));
+    return services;
+}

package/dist/IAzureResourceLister.d.ts

@@ -0,0 +1,28 @@
+/** Port of Benzene.Mesh.Discovery.Azure.IAzureResourceLister (+ AzureResourceInfo). */
+import { ServiceToken } from '@benzenejs/abstractions';
+/**
+ * The subset of an Azure App Service / Function App resource that mesh discovery needs. C# `record` ->
+ * a plain interface; `IReadOnlyDictionary` -> `Record`; nullable strings -> `| undefined`.
+ */
+export interface AzureResourceInfo {
+    /** The resource name (used as the mesh service name and, by convention, its default host). */
+    readonly name: string;
+    /** The Azure region the resource is in (for region scoping), or `undefined` if unknown. */
+    readonly location: string | undefined;
+    /** The resource's default hostname if known (e.g. `orders.azurewebsites.net`), else `undefined`. */
+    readonly defaultHost: string | undefined;
+    /** The resource's tags (matched against the discovery filter). */
+    readonly tags: Record<string, string>;
+}
+/**
+ * A minimal port over Azure Resource Manager for listing the App Service / Function App resources
+ * (`Microsoft.Web/sites`) in a subscription, so `AzureAppServiceDiscoveryProvider`'s discovery logic
+ * (tag/region filtering, URL building) is unit-testable without the Azure SDK. The real implementation is
+ * `AzureArmResourceLister`. `CancellationToken` -> optional `AbortSignal`.
+ */
+export interface IAzureResourceLister {
+    /** Lists the `Microsoft.Web/sites` resources in the subscription. */
+    listWebAppsAsync(cancellationToken?: AbortSignal): Promise<AzureResourceInfo[]>;
+}
+/** Container token: the discovery provider resolves its lister by this interface. */
+export declare const IAzureResourceLister: ServiceToken<IAzureResourceLister>;

package/dist/IAzureResourceLister.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IAzureResourceLister = void 0;
+/** Port of Benzene.Mesh.Discovery.Azure.IAzureResourceLister (+ AzureResourceInfo). */
+const abstractions_1 = require("@benzenejs/abstractions");
+/** Container token: the discovery provider resolves its lister by this interface. */
+exports.IAzureResourceLister = (0, abstractions_1.serviceToken)('IAzureResourceLister');

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Port of Benzene.Mesh.Discovery.Azure - self-discovery of Benzene services from Azure App Service /
+ * Function App resources (`Microsoft.Web/sites`). `AzureAppServiceDiscoveryProvider` (pure tag/region
+ * filtering + SSRF-safe URL building) sits over the `IAzureResourceLister` seam, whose real implementation
+ * (`AzureArmResourceLister`) adapts `Azure.ResourceManager` to `@azure/arm-resources`. Wired via
+ * `addMeshAzureDiscovery`.
+ */
+export * from './IAzureResourceLister';
+export * from './AzureAppServiceDiscoveryProvider';
+export * from './AzureArmResourceLister';
+export * from './Extensions';

package/dist/index.js

@@ -0,0 +1,27 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Port of Benzene.Mesh.Discovery.Azure - self-discovery of Benzene services from Azure App Service /
+ * Function App resources (`Microsoft.Web/sites`). `AzureAppServiceDiscoveryProvider` (pure tag/region
+ * filtering + SSRF-safe URL building) sits over the `IAzureResourceLister` seam, whose real implementation
+ * (`AzureArmResourceLister`) adapts `Azure.ResourceManager` to `@azure/arm-resources`. Wired via
+ * `addMeshAzureDiscovery`.
+ */
+__exportStar(require("./IAzureResourceLister"), exports);
+__exportStar(require("./AzureAppServiceDiscoveryProvider"), exports);
+__exportStar(require("./AzureArmResourceLister"), exports);
+__exportStar(require("./Extensions"), exports);

package/package.json

@@ -1,6 +1,18 @@
 {
   "name": "@benzenejs/mesh-discovery-azure",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0-beta.2",
+  "description": "TypeScript port of Benzene.Mesh.Discovery.Azure",
+  "license": "MIT",
+  "type": "commonjs",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "dependencies": {
+    "@benzenejs/abstractions": "0.1.0-beta.2",
+    "@benzenejs/mesh-contracts": "0.1.0-beta.2",
+    "@azure/arm-resources": "^8.0.0",
+    "@azure/identity": "^4.13.1"
+  },
+  "files": [
+    "dist"
+  ]
+}

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.