@flowuent-org/diagramming-core 1.0.7 → 1.1.0

package/packages/diagrams/src/lib/templates/cloud-arch/utils/genericValidation.ts

@@ -1,690 +0,0 @@
-// Generic validation system using flexible RestrictionEntry approach
-// Eliminates hardcoded canContain, mustBeIn, etc. properties
-
-import { Node } from 'reactflow';
-import {
-  RestrictionEntry,
-  PartialRestriction,
-  ResourceRestrictions,
-  CloudProvider,
-  RestrictionEvaluationContext,
-  RestrictionEvaluationResult
-} from '../types/validation';
-import { restrictionEngine } from './restrictionEngine';
-
-// Define partial restrictions for reusability
-export const COMMON_PARTIALS: PartialRestriction[] = [
-  {
-    id: 'container-hierarchy',
-    name: 'Container Hierarchy Rule',
-    description: 'Standard hierarchy rule for container resources',
-    template: {
-      type: 'mustBeIn',
-      validationMessage: 'Resource must be placed in appropriate container: ${target}',
-      metadata: {
-        severity: 'error',
-        category: 'hierarchy'
-      }
-    },
-    variables: {
-      containerType: {
-        type: 'string',
-        description: 'Type of container required'
-      }
-    }
-  },
-  {
-    id: 'quota-limit',
-    name: 'Quota Limit Rule',
-    description: 'Standard quota limitation for resources',
-    template: {
-      type: 'quota',
-      validationMessage: 'Maximum ${max} ${target} resources allowed per ${context}',
-      metadata: {
-        severity: 'error',
-        category: 'quota'
-      }
-    },
-    variables: {
-      maxCount: {
-        type: 'number',
-        description: 'Maximum allowed instances'
-      },
-      context: {
-        type: 'string',
-        description: 'Context for the quota (e.g., subscription, resource group)'
-      }
-    }
-  },
-  {
-    id: 'network-isolation',
-    name: 'Network Isolation Rule',
-    description: 'Network isolation and security rules',
-    template: {
-      type: 'cannotBeIn',
-      validationMessage: 'For security, ${target} cannot be placed in ${source}',
-      metadata: {
-        severity: 'warning',
-        category: 'security'
-      }
-    }
-  },
-  {
-    id: 'naming-convention',
-    name: 'Naming Convention Rule',
-    description: 'Standard naming pattern validation',
-    template: {
-      type: 'naming',
-      validationMessage: 'Resource name must follow pattern: ${value}',
-      metadata: {
-        severity: 'warning',
-        category: 'naming'
-      }
-    },
-    variables: {
-      pattern: {
-        type: 'string',
-        description: 'Regex pattern for naming'
-      }
-    }
-  }
-];
-
-// AWS Resource Restrictions using generic approach
-export const AWS_RESTRICTIONS: Record<string, ResourceRestrictions> = {
-  'account': {
-    entries: [
-      {
-        id: 'aws-account-root',
-        type: 'canContain',
-        target: 'vpc',
-        max: 5,
-        validationMessage: 'AWS Account can contain maximum ${max} VPCs per region',
-        metadata: {
-          severity: 'error',
-          category: 'quota',
-          references: ['https://docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html']
-        }
-      },
-      {
-        id: 'aws-account-placement',
-        type: 'placement',
-        target: 'root',
-        validationMessage: 'AWS Account must be placed at root level',
-        metadata: {
-          severity: 'error',
-          category: 'hierarchy'
-        }
-      },
-      {
-        id: 'aws-account-cannot-contain-services',
-        type: 'cannotContain',
-        target: 'ec2',
-        validationMessage: 'AWS Account cannot directly contain services. Place services in VPC → Subnet',
-        metadata: {
-          severity: 'error',
-          category: 'hierarchy'
-        }
-      }
-    ],
-    partials: ['container-hierarchy', 'quota-limit']
-  },
-  
-  'vpc': {
-    entries: [
-      {
-        id: 'vpc-must-be-in-account',
-        type: 'mustBeIn',
-        target: 'account',
-        validationMessage: 'VPC must be placed inside AWS Account',
-        metadata: {
-          severity: 'error',
-          category: 'hierarchy'
-        }
-      },
-      {
-        id: 'vpc-can-contain-subnets',
-        type: 'canContain',
-        target: 'subnet',
-        max: 200,
-        validationMessage: 'VPC can contain maximum ${max} subnets',
-        condition: {
-          regions: ['us-east-1', 'us-west-2']
-        },
-        metadata: {
-          severity: 'error',
-          category: 'quota',
-          references: ['https://docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html#vpc-limits-subnets']
-        }
-      },
-      {
-        id: 'vpc-can-contain-security-groups',
-        type: 'canContain',
-        target: 'security-group',
-        max: 2500,
-        validationMessage: 'VPC can contain maximum ${max} security groups',
-        metadata: {
-          severity: 'warning',
-          category: 'quota'
-        }
-      },
-      {
-        id: 'vpc-cannot-contain-other-vpcs',
-        type: 'cannotContain',
-        target: 'vpc',
-        validationMessage: 'VPC cannot contain other VPCs. Use VPC peering for connectivity',
-        metadata: {
-          severity: 'error',
-          category: 'hierarchy',
-          autoFix: {
-            action: 'suggest-vpc-peering',
-            parameters: { connectionType: 'peering' }
-          }
-        }
-      },
-      {
-        id: 'vpc-cidr-validation',
-        type: 'validation',
-        validationMessage: 'VPC CIDR block must be valid and non-overlapping',
-        condition: {
-          expression: 'validateCIDR($sourceResource.properties.cidr)'
-        },
-        metadata: {
-          severity: 'error',
-          category: 'networking'
-        }
-      }
-    ]
-  },
-
-  'subnet': {
-    entries: [
-      {
-        id: 'subnet-must-be-in-vpc',
-        type: 'mustBeIn',
-        target: 'vpc',
-        validationMessage: 'Subnet must be placed inside VPC',
-        metadata: {
-          severity: 'error',
-          category: 'hierarchy'
-        }
-      },
-      {
-        id: 'subnet-can-contain-services',
-        type: 'canContain',
-        target: 'ec2',
-        max: 50,
-        validationMessage: 'Subnet can contain maximum ${max} EC2 instances for optimal performance',
-        metadata: {
-          severity: 'warning',
-          category: 'performance'
-        }
-      },
-      {
-        id: 'subnet-cannot-contain-other-subnets',
-        type: 'cannotContain',
-        target: 'subnet',
-        validationMessage: 'Subnet cannot contain other subnets',
-        metadata: {
-          severity: 'error',
-          category: 'hierarchy'
-        }
-      },
-      {
-        id: 'subnet-az-dependency',
-        type: 'dependency',
-        target: 'availability-zone',
-        validationMessage: 'Subnet requires an Availability Zone',
-        metadata: {
-          severity: 'error',
-          category: 'networking'
-        }
-      }
-    ]
-  },
-
-  'ec2': {
-    entries: [
-      {
-        id: 'ec2-must-be-in-subnet',
-        type: 'mustBeIn',
-        target: 'subnet',
-        validationMessage: 'EC2 instance must be placed in a subnet',
-        metadata: {
-          severity: 'error',
-          category: 'hierarchy'
-        }
-      },
-      {
-        id: 'ec2-cannot-be-in-vpc-directly',
-        type: 'cannotBeIn',
-        target: 'vpc',
-        validationMessage: 'EC2 instance cannot be placed directly in VPC. Use a subnet instead',
-        metadata: {
-          severity: 'error',
-          category: 'hierarchy',
-          autoFix: {
-            action: 'create-subnet',
-            parameters: { autoCreate: true }
-          }
-        }
-      },
-      {
-        id: 'ec2-quota-per-region',
-        type: 'quota',
-        target: 'ec2',
-        max: 20,
-        validationMessage: 'Maximum ${max} EC2 instances allowed per region by default',
-        condition: {
-          regions: ['us-east-1', 'us-west-2']
-        },
-        metadata: {
-          severity: 'warning',
-          category: 'quota',
-          references: ['https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-resource-limits.html']
-        }
-      }
-    ]
-  }
-};
-
-// Azure Resource Restrictions using generic approach
-export const AZURE_RESTRICTIONS: Record<string, ResourceRestrictions> = {
-  'subscription': {
-    entries: [
-      {
-        id: 'azure-subscription-root',
-        type: 'placement',
-        target: 'root',
-        validationMessage: 'Azure Subscription must be at root level',
-        metadata: {
-          severity: 'error',
-          category: 'hierarchy'
-        }
-      },
-      {
-        id: 'azure-subscription-resource-groups',
-        type: 'canContain',
-        target: 'resource-group',
-        max: 980,
-        validationMessage: 'Subscription can contain maximum ${max} resource groups',
-        metadata: {
-          severity: 'error',
-          category: 'quota',
-          references: ['https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits']
-        }
-      }
-    ]
-  },
-
-  'resource-group': {
-    entries: [
-      {
-        id: 'rg-must-be-in-subscription',
-        type: 'mustBeIn',
-        target: 'subscription',
-        validationMessage: 'Resource Group must be in Azure Subscription',
-        metadata: {
-          severity: 'error',
-          category: 'hierarchy'
-        }
-      },
-      {
-        id: 'rg-can-contain-resources',
-        type: 'canContain',
-        target: 'virtual-network',
-        max: 800,
-        validationMessage: 'Resource Group can contain maximum ${max} resources',
-        metadata: {
-          severity: 'warning',
-          category: 'quota'
-        }
-      },
-      {
-        id: 'rg-cannot-contain-other-rgs',
-        type: 'cannotContain',
-        target: 'resource-group',
-        validationMessage: 'Resource Group cannot contain other Resource Groups',
-        metadata: {
-          severity: 'error',
-          category: 'hierarchy'
-        }
-      }
-    ]
-  },
-
-  'virtual-network': {
-    entries: [
-      {
-        id: 'vnet-must-be-in-rg',
-        type: 'mustBeIn',
-        target: 'resource-group',
-        validationMessage: 'Virtual Network must be in Resource Group',
-        metadata: {
-          severity: 'error',
-          category: 'hierarchy'
-        }
-      },
-      {
-        id: 'vnet-can-contain-subnets',
-        type: 'canContain',
-        target: 'subnet',
-        max: 3000,
-        validationMessage: 'Virtual Network can contain maximum ${max} subnets',
-        metadata: {
-          severity: 'error',
-          category: 'quota'
-        }
-      }
-    ]
-  },
-
-  'connections': {
-    entries: [
-      {
-        id: 'connections-must-be-in-rg',
-        type: 'mustBeIn',
-        target: 'resource-group',
-        validationMessage: 'Azure Connection must be placed in Resource Group',
-        metadata: {
-          severity: 'error',
-          category: 'hierarchy'
-        }
-      },
-      {
-        id: 'connections-networking-dependency',
-        type: 'dependency',
-        target: 'virtual-network-gateways',
-        validationMessage: 'Connection requires Virtual Network Gateway',
-        metadata: {
-          severity: 'error',
-          category: 'networking'
-        }
-      }
-    ]
-  }
-};
-
-// GCP Resource Restrictions using generic approach
-export const GCP_RESTRICTIONS: Record<string, ResourceRestrictions> = {
-  'project': {
-    entries: [
-      {
-        id: 'gcp-project-root',
-        type: 'placement',
-        target: 'root',
-        validationMessage: 'GCP Project must be at root level',
-        metadata: {
-          severity: 'error',
-          category: 'hierarchy'
-        }
-      },
-      {
-        id: 'gcp-project-vpc-limit',
-        type: 'canContain',
-        target: 'vpc',
-        max: 15,
-        validationMessage: 'Project can contain maximum ${max} VPC networks',
-        metadata: {
-          severity: 'error',
-          category: 'quota',
-          references: ['https://cloud.google.com/vpc/docs/quota']
-        }
-      }
-    ]
-  },
-
-  'vpc': {
-    entries: [
-      {
-        id: 'gcp-vpc-must-be-in-project',
-        type: 'mustBeIn',
-        target: 'project',
-        validationMessage: 'VPC Network must be in GCP Project',
-        metadata: {
-          severity: 'error',
-          category: 'hierarchy'
-        }
-      },
-      {
-        id: 'gcp-vpc-subnet-limit',
-        type: 'canContain',
-        target: 'subnet',
-        max: 100,
-        validationMessage: 'VPC can contain maximum ${max} subnets per region',
-        metadata: {
-          severity: 'error',
-          category: 'quota'
-        }
-      }
-    ]
-  }
-};
-
-// Main validation function using generic system
-export function validateResourcePlacement(
-  node: Node,
-  parentNode: Node | null,
-  allNodes: Node[],
-  cloudProvider: CloudProvider
-): RestrictionEvaluationResult[] {
-  
-  // Get resource types
-  const childResourceType = node.data?.service;
-  const parentResourceType = parentNode?.data?.service;
-  
-  if (!childResourceType) {
-    return [{
-      isValid: false,
-      restrictionId: 'missing-resource-type',
-      restrictionType: 'validation',
-      severity: 'error',
-      message: 'Resource type is missing',
-      metadata: { category: 'system' }
-    }];
-  }
-
-  // Get appropriate restrictions based on cloud provider
-  let restrictions: Record<string, ResourceRestrictions>;
-  switch (cloudProvider) {
-    case 'aws':
-      restrictions = AWS_RESTRICTIONS;
-      break;
-    case 'azure':
-      restrictions = AZURE_RESTRICTIONS;
-      break;
-    case 'gcp':
-      restrictions = GCP_RESTRICTIONS;
-      break;
-    default:
-      return [{
-        isValid: false,
-        restrictionId: 'unsupported-provider',
-        restrictionType: 'validation',
-        severity: 'error',
-        message: `Unsupported cloud provider: ${cloudProvider}`,
-        metadata: { category: 'system' }
-      }];
-  }
-
-  // Collect all validation results
-  const allResults: RestrictionEvaluationResult[] = [];
-
-  // 1. Check child node's own restrictions (mustBeIn, cannotBeIn, etc.)
-  const childRestrictions = restrictions[childResourceType];
-  if (childRestrictions) {
-    // Process child restrictions...
-    allResults.push(...processNodeRestrictions(childRestrictions, node, parentNode, allNodes, 'child'));
-  }
-
-  // 2. Check parent node's restrictions (canContain, cannotContain, etc.)
-  if (parentNode && parentResourceType) {
-    const parentRestrictions = restrictions[parentResourceType];
-    if (parentRestrictions) {
-      // Process parent restrictions for containment
-      // Note: For containment, parent is source, child is target
-      allResults.push(...processNodeRestrictions(parentRestrictions, parentNode, node, allNodes, 'parent'));
-    }
-  }
-
-  // 3. If no parent (root level), check if child can be at root
-  if (!parentNode) {
-    const rootLevelResults = validateRootLevelPlacement(childResourceType, cloudProvider);
-    allResults.push(...rootLevelResults);
-  }
-
-  // Return all results, or default success if no restrictions
-  return allResults.length > 0 ? allResults : [{
-    isValid: true,
-    restrictionId: 'no-restrictions',
-    restrictionType: 'validation',
-    severity: 'info',
-    message: `No restrictions found for ${childResourceType}`,
-    metadata: { category: 'info' }
-  }];
-
-}
-
-// Helper function to process restrictions for a node
-function processNodeRestrictions(
-  nodeRestrictions: ResourceRestrictions,
-  sourceNode: Node,
-  targetNode: Node | null,
-  allNodes: Node[],
-  perspective: 'child' | 'parent'
-): RestrictionEvaluationResult[] {
-  const results: RestrictionEvaluationResult[] = [];
-
-  // Register partial restrictions
-  COMMON_PARTIALS.forEach(partial => {
-    restrictionEngine.registerPartialRestriction(partial);
-  });
-
-  // Resolve restrictions (including partials)
-  const resolvedRestrictions = restrictionEngine.resolveRestrictions(
-    nodeRestrictions.entries,
-    nodeRestrictions.partials,
-    nodeRestrictions.inheritedFrom
-  );
-
-  // Create evaluation context
-  const context: RestrictionEvaluationContext = {
-    sourceResource: {
-      id: sourceNode.id,
-      type: sourceNode.data?.service || 'unknown',
-      cloudProvider: sourceNode.data?.cloudProvider || 'aws',
-      properties: sourceNode.data || {},
-      region: sourceNode.data?.region
-    },
-    targetResource: targetNode ? {
-      id: targetNode.id,
-      type: targetNode.data?.service || 'unknown',
-      cloudProvider: targetNode.data?.cloudProvider || 'aws',
-      properties: targetNode.data || {},
-      region: targetNode.data?.region
-    } : undefined,
-    allResources: allNodes.map(n => ({
-      id: n.id,
-      type: n.data?.service || 'unknown',
-      cloudProvider: n.data?.cloudProvider || 'aws',
-      parentId: n.parentNode,
-      properties: n.data || {}
-    })),
-    diagramContext: {
-      totalNodes: allNodes.length,
-      totalEdges: 0,
-      cloudProviders: [...new Set(allNodes.map(n => n.data?.cloudProvider).filter(Boolean))] as CloudProvider[]
-    }
-  };
-
-  // Filter restrictions based on perspective
-  const relevantRestrictions = resolvedRestrictions.filter(restriction => {
-    if (perspective === 'parent') {
-      // For parent perspective, check canContain/cannotContain rules
-      return ['canContain', 'cannotContain', 'quota', 'limit'].includes(restriction.type);
-    } else {
-      // For child perspective, check mustBeIn/cannotBeIn rules
-      return ['mustBeIn', 'cannotBeIn', 'placement', 'validation'].includes(restriction.type);
-    }
-  });
-
-  // Debug logging (comment out for production)
-  // console.log(`🔍 Processing ${perspective} restrictions for ${sourceNode.data?.service}:`);
-  // console.log(`- Total restrictions: ${resolvedRestrictions.length}`);
-  // console.log(`- Relevant restrictions: ${relevantRestrictions.length}`);
-
-  // Evaluate relevant restrictions
-  return restrictionEngine.evaluateAllRestrictions(relevantRestrictions, context);
-}
-
-// Helper function to validate root level placement
-function validateRootLevelPlacement(
-  resourceType: string,
-  cloudProvider: CloudProvider
-): RestrictionEvaluationResult[] {
-  const rootAllowedResources: Record<CloudProvider, string[]> = {
-    'aws': ['account'],
-    'azure': ['subscription'],
-    'gcp': ['project', 'folder']
-  };
-
-  const allowed = rootAllowedResources[cloudProvider];
-  if (allowed.includes(resourceType)) {
-    return [{
-      isValid: true,
-      restrictionId: 'root-level-allowed',
-      restrictionType: 'placement',
-      severity: 'info',
-      message: `${resourceType} can be placed at root level`,
-      metadata: { category: 'hierarchy' }
-    }];
-  } else {
-    return [{
-      isValid: false,
-      restrictionId: 'root-level-forbidden',
-      restrictionType: 'placement',
-      severity: 'error',
-      message: `${resourceType} cannot be placed at root level. Only ${allowed.join(', ')} can be at root for ${cloudProvider}.`,
-      metadata: { category: 'hierarchy' }
-         }];
-   }
- }
-
-// Helper function to get user-friendly validation summary
-export function getValidationSummary(results: RestrictionEvaluationResult[]): {
-  isValid: boolean;
-  message: string;
-  suggestions: string[];
-} {
-  const errors = results.filter(r => !r.isValid && r.severity === 'error');
-  const warnings = results.filter(r => !r.isValid && r.severity === 'warning');
-  
-  if (errors.length > 0) {
-    return {
-      isValid: false,
-      message: errors[0].message,
-      suggestions: errors.filter(e => e.suggestion).map(e => e.suggestion!)
-    };
-  }
-  
-  if (warnings.length > 0) {
-    return {
-      isValid: true,
-      message: warnings[0].message,
-      suggestions: warnings.filter(w => w.suggestion).map(w => w.suggestion!)
-    };
-  }
-  
-  return {
-    isValid: true,
-    message: 'All restrictions passed',
-    suggestions: []
-  };
-}
-
-// Export the restrictions for schema generation
-export const ALL_RESTRICTIONS = {
-  aws: AWS_RESTRICTIONS,
-  azure: AZURE_RESTRICTIONS,
-  gcp: GCP_RESTRICTIONS
-};