@flowuent-org/diagramming-core 1.0.5

package/packages/diagrams/src/lib/templates/cloud-arch/utils/genericValidation.ts

@@ -0,0 +1,690 @@
+// Generic validation system using flexible RestrictionEntry approach
+// Eliminates hardcoded canContain, mustBeIn, etc. properties
+
+import { Node } from 'reactflow';
+import {
+  RestrictionEntry,
+  PartialRestriction,
+  ResourceRestrictions,
+  CloudProvider,
+  RestrictionEvaluationContext,
+  RestrictionEvaluationResult
+} from '../types/validation';
+import { restrictionEngine } from './restrictionEngine';
+
+// Define partial restrictions for reusability
+export const COMMON_PARTIALS: PartialRestriction[] = [
+  {
+    id: 'container-hierarchy',
+    name: 'Container Hierarchy Rule',
+    description: 'Standard hierarchy rule for container resources',
+    template: {
+      type: 'mustBeIn',
+      validationMessage: 'Resource must be placed in appropriate container: ${target}',
+      metadata: {
+        severity: 'error',
+        category: 'hierarchy'
+      }
+    },
+    variables: {
+      containerType: {
+        type: 'string',
+        description: 'Type of container required'
+      }
+    }
+  },
+  {
+    id: 'quota-limit',
+    name: 'Quota Limit Rule',
+    description: 'Standard quota limitation for resources',
+    template: {
+      type: 'quota',
+      validationMessage: 'Maximum ${max} ${target} resources allowed per ${context}',
+      metadata: {
+        severity: 'error',
+        category: 'quota'
+      }
+    },
+    variables: {
+      maxCount: {
+        type: 'number',
+        description: 'Maximum allowed instances'
+      },
+      context: {
+        type: 'string',
+        description: 'Context for the quota (e.g., subscription, resource group)'
+      }
+    }
+  },
+  {
+    id: 'network-isolation',
+    name: 'Network Isolation Rule',
+    description: 'Network isolation and security rules',
+    template: {
+      type: 'cannotBeIn',
+      validationMessage: 'For security, ${target} cannot be placed in ${source}',
+      metadata: {
+        severity: 'warning',
+        category: 'security'
+      }
+    }
+  },
+  {
+    id: 'naming-convention',
+    name: 'Naming Convention Rule',
+    description: 'Standard naming pattern validation',
+    template: {
+      type: 'naming',
+      validationMessage: 'Resource name must follow pattern: ${value}',
+      metadata: {
+        severity: 'warning',
+        category: 'naming'
+      }
+    },
+    variables: {
+      pattern: {
+        type: 'string',
+        description: 'Regex pattern for naming'
+      }
+    }
+  }
+];
+
+// AWS Resource Restrictions using generic approach
+export const AWS_RESTRICTIONS: Record<string, ResourceRestrictions> = {
+  'account': {
+    entries: [
+      {
+        id: 'aws-account-root',
+        type: 'canContain',
+        target: 'vpc',
+        max: 5,
+        validationMessage: 'AWS Account can contain maximum ${max} VPCs per region',
+        metadata: {
+          severity: 'error',
+          category: 'quota',
+          references: ['https://docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html']
+        }
+      },
+      {
+        id: 'aws-account-placement',
+        type: 'placement',
+        target: 'root',
+        validationMessage: 'AWS Account must be placed at root level',
+        metadata: {
+          severity: 'error',
+          category: 'hierarchy'
+        }
+      },
+      {
+        id: 'aws-account-cannot-contain-services',
+        type: 'cannotContain',
+        target: 'ec2',
+        validationMessage: 'AWS Account cannot directly contain services. Place services in VPC → Subnet',
+        metadata: {
+          severity: 'error',
+          category: 'hierarchy'
+        }
+      }
+    ],
+    partials: ['container-hierarchy', 'quota-limit']
+  },
+  
+  'vpc': {
+    entries: [
+      {
+        id: 'vpc-must-be-in-account',
+        type: 'mustBeIn',
+        target: 'account',
+        validationMessage: 'VPC must be placed inside AWS Account',
+        metadata: {
+          severity: 'error',
+          category: 'hierarchy'
+        }
+      },
+      {
+        id: 'vpc-can-contain-subnets',
+        type: 'canContain',
+        target: 'subnet',
+        max: 200,
+        validationMessage: 'VPC can contain maximum ${max} subnets',
+        condition: {
+          regions: ['us-east-1', 'us-west-2']
+        },
+        metadata: {
+          severity: 'error',
+          category: 'quota',
+          references: ['https://docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html#vpc-limits-subnets']
+        }
+      },
+      {
+        id: 'vpc-can-contain-security-groups',
+        type: 'canContain',
+        target: 'security-group',
+        max: 2500,
+        validationMessage: 'VPC can contain maximum ${max} security groups',
+        metadata: {
+          severity: 'warning',
+          category: 'quota'
+        }
+      },
+      {
+        id: 'vpc-cannot-contain-other-vpcs',
+        type: 'cannotContain',
+        target: 'vpc',
+        validationMessage: 'VPC cannot contain other VPCs. Use VPC peering for connectivity',
+        metadata: {
+          severity: 'error',
+          category: 'hierarchy',
+          autoFix: {
+            action: 'suggest-vpc-peering',
+            parameters: { connectionType: 'peering' }
+          }
+        }
+      },
+      {
+        id: 'vpc-cidr-validation',
+        type: 'validation',
+        validationMessage: 'VPC CIDR block must be valid and non-overlapping',
+        condition: {
+          expression: 'validateCIDR($sourceResource.properties.cidr)'
+        },
+        metadata: {
+          severity: 'error',
+          category: 'networking'
+        }
+      }
+    ]
+  },
+
+  'subnet': {
+    entries: [
+      {
+        id: 'subnet-must-be-in-vpc',
+        type: 'mustBeIn',
+        target: 'vpc',
+        validationMessage: 'Subnet must be placed inside VPC',
+        metadata: {
+          severity: 'error',
+          category: 'hierarchy'
+        }
+      },
+      {
+        id: 'subnet-can-contain-services',
+        type: 'canContain',
+        target: 'ec2',
+        max: 50,
+        validationMessage: 'Subnet can contain maximum ${max} EC2 instances for optimal performance',
+        metadata: {
+          severity: 'warning',
+          category: 'performance'
+        }
+      },
+      {
+        id: 'subnet-cannot-contain-other-subnets',
+        type: 'cannotContain',
+        target: 'subnet',
+        validationMessage: 'Subnet cannot contain other subnets',
+        metadata: {
+          severity: 'error',
+          category: 'hierarchy'
+        }
+      },
+      {
+        id: 'subnet-az-dependency',
+        type: 'dependency',
+        target: 'availability-zone',
+        validationMessage: 'Subnet requires an Availability Zone',
+        metadata: {
+          severity: 'error',
+          category: 'networking'
+        }
+      }
+    ]
+  },
+
+  'ec2': {
+    entries: [
+      {
+        id: 'ec2-must-be-in-subnet',
+        type: 'mustBeIn',
+        target: 'subnet',
+        validationMessage: 'EC2 instance must be placed in a subnet',
+        metadata: {
+          severity: 'error',
+          category: 'hierarchy'
+        }
+      },
+      {
+        id: 'ec2-cannot-be-in-vpc-directly',
+        type: 'cannotBeIn',
+        target: 'vpc',
+        validationMessage: 'EC2 instance cannot be placed directly in VPC. Use a subnet instead',
+        metadata: {
+          severity: 'error',
+          category: 'hierarchy',
+          autoFix: {
+            action: 'create-subnet',
+            parameters: { autoCreate: true }
+          }
+        }
+      },
+      {
+        id: 'ec2-quota-per-region',
+        type: 'quota',
+        target: 'ec2',
+        max: 20,
+        validationMessage: 'Maximum ${max} EC2 instances allowed per region by default',
+        condition: {
+          regions: ['us-east-1', 'us-west-2']
+        },
+        metadata: {
+          severity: 'warning',
+          category: 'quota',
+          references: ['https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-resource-limits.html']
+        }
+      }
+    ]
+  }
+};
+
+// Azure Resource Restrictions using generic approach
+export const AZURE_RESTRICTIONS: Record<string, ResourceRestrictions> = {
+  'subscription': {
+    entries: [
+      {
+        id: 'azure-subscription-root',
+        type: 'placement',
+        target: 'root',
+        validationMessage: 'Azure Subscription must be at root level',
+        metadata: {
+          severity: 'error',
+          category: 'hierarchy'
+        }
+      },
+      {
+        id: 'azure-subscription-resource-groups',
+        type: 'canContain',
+        target: 'resource-group',
+        max: 980,
+        validationMessage: 'Subscription can contain maximum ${max} resource groups',
+        metadata: {
+          severity: 'error',
+          category: 'quota',
+          references: ['https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits']
+        }
+      }
+    ]
+  },
+
+  'resource-group': {
+    entries: [
+      {
+        id: 'rg-must-be-in-subscription',
+        type: 'mustBeIn',
+        target: 'subscription',
+        validationMessage: 'Resource Group must be in Azure Subscription',
+        metadata: {
+          severity: 'error',
+          category: 'hierarchy'
+        }
+      },
+      {
+        id: 'rg-can-contain-resources',
+        type: 'canContain',
+        target: 'virtual-network',
+        max: 800,
+        validationMessage: 'Resource Group can contain maximum ${max} resources',
+        metadata: {
+          severity: 'warning',
+          category: 'quota'
+        }
+      },
+      {
+        id: 'rg-cannot-contain-other-rgs',
+        type: 'cannotContain',
+        target: 'resource-group',
+        validationMessage: 'Resource Group cannot contain other Resource Groups',
+        metadata: {
+          severity: 'error',
+          category: 'hierarchy'
+        }
+      }
+    ]
+  },
+
+  'virtual-network': {
+    entries: [
+      {
+        id: 'vnet-must-be-in-rg',
+        type: 'mustBeIn',
+        target: 'resource-group',
+        validationMessage: 'Virtual Network must be in Resource Group',
+        metadata: {
+          severity: 'error',
+          category: 'hierarchy'
+        }
+      },
+      {
+        id: 'vnet-can-contain-subnets',
+        type: 'canContain',
+        target: 'subnet',
+        max: 3000,
+        validationMessage: 'Virtual Network can contain maximum ${max} subnets',
+        metadata: {
+          severity: 'error',
+          category: 'quota'
+        }
+      }
+    ]
+  },
+
+  'connections': {
+    entries: [
+      {
+        id: 'connections-must-be-in-rg',
+        type: 'mustBeIn',
+        target: 'resource-group',
+        validationMessage: 'Azure Connection must be placed in Resource Group',
+        metadata: {
+          severity: 'error',
+          category: 'hierarchy'
+        }
+      },
+      {
+        id: 'connections-networking-dependency',
+        type: 'dependency',
+        target: 'virtual-network-gateways',
+        validationMessage: 'Connection requires Virtual Network Gateway',
+        metadata: {
+          severity: 'error',
+          category: 'networking'
+        }
+      }
+    ]
+  }
+};
+
+// GCP Resource Restrictions using generic approach
+export const GCP_RESTRICTIONS: Record<string, ResourceRestrictions> = {
+  'project': {
+    entries: [
+      {
+        id: 'gcp-project-root',
+        type: 'placement',
+        target: 'root',
+        validationMessage: 'GCP Project must be at root level',
+        metadata: {
+          severity: 'error',
+          category: 'hierarchy'
+        }
+      },
+      {
+        id: 'gcp-project-vpc-limit',
+        type: 'canContain',
+        target: 'vpc',
+        max: 15,
+        validationMessage: 'Project can contain maximum ${max} VPC networks',
+        metadata: {
+          severity: 'error',
+          category: 'quota',
+          references: ['https://cloud.google.com/vpc/docs/quota']
+        }
+      }
+    ]
+  },
+
+  'vpc': {
+    entries: [
+      {
+        id: 'gcp-vpc-must-be-in-project',
+        type: 'mustBeIn',
+        target: 'project',
+        validationMessage: 'VPC Network must be in GCP Project',
+        metadata: {
+          severity: 'error',
+          category: 'hierarchy'
+        }
+      },
+      {
+        id: 'gcp-vpc-subnet-limit',
+        type: 'canContain',
+        target: 'subnet',
+        max: 100,
+        validationMessage: 'VPC can contain maximum ${max} subnets per region',
+        metadata: {
+          severity: 'error',
+          category: 'quota'
+        }
+      }
+    ]
+  }
+};
+
+// Main validation function using generic system
+export function validateResourcePlacement(
+  node: Node,
+  parentNode: Node | null,
+  allNodes: Node[],
+  cloudProvider: CloudProvider
+): RestrictionEvaluationResult[] {
+  
+  // Get resource types
+  const childResourceType = node.data?.service;
+  const parentResourceType = parentNode?.data?.service;
+  
+  if (!childResourceType) {
+    return [{
+      isValid: false,
+      restrictionId: 'missing-resource-type',
+      restrictionType: 'validation',
+      severity: 'error',
+      message: 'Resource type is missing',
+      metadata: { category: 'system' }
+    }];
+  }
+
+  // Get appropriate restrictions based on cloud provider
+  let restrictions: Record<string, ResourceRestrictions>;
+  switch (cloudProvider) {
+    case 'aws':
+      restrictions = AWS_RESTRICTIONS;
+      break;
+    case 'azure':
+      restrictions = AZURE_RESTRICTIONS;
+      break;
+    case 'gcp':
+      restrictions = GCP_RESTRICTIONS;
+      break;
+    default:
+      return [{
+        isValid: false,
+        restrictionId: 'unsupported-provider',
+        restrictionType: 'validation',
+        severity: 'error',
+        message: `Unsupported cloud provider: ${cloudProvider}`,
+        metadata: { category: 'system' }
+      }];
+  }
+
+  // Collect all validation results
+  const allResults: RestrictionEvaluationResult[] = [];
+
+  // 1. Check child node's own restrictions (mustBeIn, cannotBeIn, etc.)
+  const childRestrictions = restrictions[childResourceType];
+  if (childRestrictions) {
+    // Process child restrictions...
+    allResults.push(...processNodeRestrictions(childRestrictions, node, parentNode, allNodes, 'child'));
+  }
+
+  // 2. Check parent node's restrictions (canContain, cannotContain, etc.)
+  if (parentNode && parentResourceType) {
+    const parentRestrictions = restrictions[parentResourceType];
+    if (parentRestrictions) {
+      // Process parent restrictions for containment
+      // Note: For containment, parent is source, child is target
+      allResults.push(...processNodeRestrictions(parentRestrictions, parentNode, node, allNodes, 'parent'));
+    }
+  }
+
+  // 3. If no parent (root level), check if child can be at root
+  if (!parentNode) {
+    const rootLevelResults = validateRootLevelPlacement(childResourceType, cloudProvider);
+    allResults.push(...rootLevelResults);
+  }
+
+  // Return all results, or default success if no restrictions
+  return allResults.length > 0 ? allResults : [{
+    isValid: true,
+    restrictionId: 'no-restrictions',
+    restrictionType: 'validation',
+    severity: 'info',
+    message: `No restrictions found for ${childResourceType}`,
+    metadata: { category: 'info' }
+  }];
+
+}
+
+// Helper function to process restrictions for a node
+function processNodeRestrictions(
+  nodeRestrictions: ResourceRestrictions,
+  sourceNode: Node,
+  targetNode: Node | null,
+  allNodes: Node[],
+  perspective: 'child' | 'parent'
+): RestrictionEvaluationResult[] {
+  const results: RestrictionEvaluationResult[] = [];
+
+  // Register partial restrictions
+  COMMON_PARTIALS.forEach(partial => {
+    restrictionEngine.registerPartialRestriction(partial);
+  });
+
+  // Resolve restrictions (including partials)
+  const resolvedRestrictions = restrictionEngine.resolveRestrictions(
+    nodeRestrictions.entries,
+    nodeRestrictions.partials,
+    nodeRestrictions.inheritedFrom
+  );
+
+  // Create evaluation context
+  const context: RestrictionEvaluationContext = {
+    sourceResource: {
+      id: sourceNode.id,
+      type: sourceNode.data?.service || 'unknown',
+      cloudProvider: sourceNode.data?.cloudProvider || 'aws',
+      properties: sourceNode.data || {},
+      region: sourceNode.data?.region
+    },
+    targetResource: targetNode ? {
+      id: targetNode.id,
+      type: targetNode.data?.service || 'unknown',
+      cloudProvider: targetNode.data?.cloudProvider || 'aws',
+      properties: targetNode.data || {},
+      region: targetNode.data?.region
+    } : undefined,
+    allResources: allNodes.map(n => ({
+      id: n.id,
+      type: n.data?.service || 'unknown',
+      cloudProvider: n.data?.cloudProvider || 'aws',
+      parentId: n.parentNode,
+      properties: n.data || {}
+    })),
+    diagramContext: {
+      totalNodes: allNodes.length,
+      totalEdges: 0,
+      cloudProviders: [...new Set(allNodes.map(n => n.data?.cloudProvider).filter(Boolean))] as CloudProvider[]
+    }
+  };
+
+  // Filter restrictions based on perspective
+  const relevantRestrictions = resolvedRestrictions.filter(restriction => {
+    if (perspective === 'parent') {
+      // For parent perspective, check canContain/cannotContain rules
+      return ['canContain', 'cannotContain', 'quota', 'limit'].includes(restriction.type);
+    } else {
+      // For child perspective, check mustBeIn/cannotBeIn rules
+      return ['mustBeIn', 'cannotBeIn', 'placement', 'validation'].includes(restriction.type);
+    }
+  });
+
+  // Debug logging (comment out for production)
+  // console.log(`🔍 Processing ${perspective} restrictions for ${sourceNode.data?.service}:`);
+  // console.log(`- Total restrictions: ${resolvedRestrictions.length}`);
+  // console.log(`- Relevant restrictions: ${relevantRestrictions.length}`);
+
+  // Evaluate relevant restrictions
+  return restrictionEngine.evaluateAllRestrictions(relevantRestrictions, context);
+}
+
+// Helper function to validate root level placement
+function validateRootLevelPlacement(
+  resourceType: string,
+  cloudProvider: CloudProvider
+): RestrictionEvaluationResult[] {
+  const rootAllowedResources: Record<CloudProvider, string[]> = {
+    'aws': ['account'],
+    'azure': ['subscription'],
+    'gcp': ['project', 'folder']
+  };
+
+  const allowed = rootAllowedResources[cloudProvider];
+  if (allowed.includes(resourceType)) {
+    return [{
+      isValid: true,
+      restrictionId: 'root-level-allowed',
+      restrictionType: 'placement',
+      severity: 'info',
+      message: `${resourceType} can be placed at root level`,
+      metadata: { category: 'hierarchy' }
+    }];
+  } else {
+    return [{
+      isValid: false,
+      restrictionId: 'root-level-forbidden',
+      restrictionType: 'placement',
+      severity: 'error',
+      message: `${resourceType} cannot be placed at root level. Only ${allowed.join(', ')} can be at root for ${cloudProvider}.`,
+      metadata: { category: 'hierarchy' }
+         }];
+   }
+ }
+
+// Helper function to get user-friendly validation summary
+export function getValidationSummary(results: RestrictionEvaluationResult[]): {
+  isValid: boolean;
+  message: string;
+  suggestions: string[];
+} {
+  const errors = results.filter(r => !r.isValid && r.severity === 'error');
+  const warnings = results.filter(r => !r.isValid && r.severity === 'warning');
+  
+  if (errors.length > 0) {
+    return {
+      isValid: false,
+      message: errors[0].message,
+      suggestions: errors.filter(e => e.suggestion).map(e => e.suggestion!)
+    };
+  }
+  
+  if (warnings.length > 0) {
+    return {
+      isValid: true,
+      message: warnings[0].message,
+      suggestions: warnings.filter(w => w.suggestion).map(w => w.suggestion!)
+    };
+  }
+  
+  return {
+    isValid: true,
+    message: 'All restrictions passed',
+    suggestions: []
+  };
+}
+
+// Export the restrictions for schema generation
+export const ALL_RESTRICTIONS = {
+  aws: AWS_RESTRICTIONS,
+  azure: AZURE_RESTRICTIONS,
+  gcp: GCP_RESTRICTIONS
+};