@flowuent-org/diagramming-core 1.1.0 → 1.1.2

package/packages/diagrams/src/lib/templates/cloud-arch/utils/cloudValidation.ts

@@ -0,0 +1,930 @@
+import { Node } from 'reactflow';
+import { validateResourcePlacement, getValidationSummary } from './genericValidation';
+import { CloudProvider } from '../types/validation';
+
+interface ValidationResult {
+  isValid: boolean;
+  message?: string;
+  suggestions?: string[];
+}
+
+interface ValidationWarning {
+  message: string;
+  severity: 'warning' | 'info' | 'error';
+  suggestions?: string[];
+}
+
+export const validateCloudProviderPlacement = (
+  tempNode: Node,
+  parentNode: Node | null,
+  nodes: Node[],
+  cloudProvider?: CloudProvider
+): ValidationResult => {
+  // Check for cross-provider contamination
+  const crossProviderValidation = validateCrossProviderPlacement(tempNode, nodes, cloudProvider);
+  if (!crossProviderValidation.isValid) {
+    return crossProviderValidation;
+  }
+
+  // Direct validation for AWS (working implementation)
+  if (cloudProvider === 'aws') {
+    const childService = tempNode.data?.service;
+    const parentService = parentNode?.data?.service;
+    
+    // Root level validation
+    if (!parentNode) {
+      if (childService === 'account') {
+        return { isValid: true, message: 'AWS Account can be placed at root level' };
+      } else {
+        return { 
+          isValid: false, 
+          message: `${childService} cannot be at root level. Only AWS Account can be at root.`,
+          suggestions: ['Create an AWS Account first', 'Place this inside an AWS Account']
+        };
+      }
+    }
+    
+    // AWS Account containment rules
+    if (parentService === 'account') {
+      const allowedInAccount = ['vpc', 'availability-zone', 'local-zone'];
+      if (allowedInAccount.includes(childService)) {
+        return { isValid: true, message: `AWS Account can contain ${childService}` };
+      } else {
+        return {
+          isValid: false,
+          message: `${childService} cannot be placed directly in AWS Account. Use VPC → Subnet hierarchy.`,
+          suggestions: ['Create VPC first', 'Place services in Subnet within VPC']
+        };
+      }
+    }
+    
+    // VPC containment rules
+    if (parentService === 'vpc') {
+      const allowedInVpc = ['subnet', 'availability-zone', 'security-group'];
+      if (allowedInVpc.includes(childService)) {
+        return { isValid: true, message: `VPC can contain ${childService}` };
+      } else {
+        return {
+          isValid: false,
+          message: `${childService} cannot be placed directly in VPC. Place in Subnet within VPC.`,
+          suggestions: ['Create Subnet first', 'Place services in Subnet']
+        };
+      }
+    }
+    
+    // Subnet containment rules
+    if (parentService === 'subnet') {
+      const forbiddenInSubnet = ['account', 'vpc', 'subnet'];
+      if (forbiddenInSubnet.includes(childService)) {
+        return {
+          isValid: false,
+          message: `${childService} cannot be placed inside Subnet. Check AWS hierarchy.`,
+          suggestions: ['Place containers at appropriate level']
+        };
+      }
+      return { isValid: true, message: `Subnet can contain ${childService} service` };
+    }
+    
+    // Other AWS containers
+    if (parentService === 'availability-zone') {
+      return { isValid: true, message: `Availability Zone can contain ${childService}` };
+    }
+    
+    if (parentService === 'security-group') {
+      return { isValid: true, message: `Security Group can contain ${childService}` };
+    }
+    
+    // Default fallback - allow but warn
+    console.warn(`AWS validation: Unknown parent-child relationship: ${parentService} → ${childService}`);
+    return { 
+      isValid: true, 
+      message: `${parentService || 'container'} can contain ${childService}` 
+    };
+  }
+
+  // Use generic validation system for other providers
+  if (cloudProvider) {
+    const restrictionResults = validateResourcePlacement(tempNode, parentNode, nodes, cloudProvider);
+    const summary = getValidationSummary(restrictionResults);
+    
+    return {
+      isValid: summary.isValid,
+      message: summary.message,
+      suggestions: summary.suggestions
+    };
+  }
+
+  return { isValid: true };
+};
+
+/**
+ * Validates cross-provider placement to prevent mixing incompatible services
+ */
+const validateCrossProviderPlacement = (
+  tempNode: Node,
+  nodes: Node[],
+  cloudProvider?: CloudProvider
+): ValidationResult => {
+  if (!cloudProvider) return { isValid: true };
+
+  const existingProviders = new Set(
+    nodes
+      .filter(node => node.data?.cloudProvider)
+      .map(node => node.data.cloudProvider)
+  );
+
+  if (existingProviders.size > 0 && !existingProviders.has(cloudProvider)) {
+    const existingProvidersList = Array.from(existingProviders).join(', ');
+    return {
+      isValid: false,
+      message: `Cannot mix cloud providers. This diagram already contains ${existingProvidersList} services. Please use a separate diagram for ${cloudProvider} services.`,
+      suggestions: [
+        'Create a separate diagram for each cloud provider',
+        'Use hybrid/multi-cloud architecture patterns if needed',
+        'Consider using a multi-cloud management service'
+      ]
+    };
+  }
+
+  return { isValid: true };
+};
+
+/**
+ * Automatically finds the best parent node based on position and schema rules
+ * @param nodePosition - Position where the node will be placed
+ * @param service - Service type of the node
+ * @param cloudProvider - Cloud provider (aws, azure, gcp)
+ * @param nodes - All existing nodes
+ * @returns The best parent node or null if no valid parent found
+ */
+export const findAutoParent = (
+  nodePosition: { x: number; y: number },
+  service: string,
+  cloudProvider: 'aws' | 'azure' | 'gcp',
+  nodes: Node[]
+): Node | null => {
+  // Get all potential parent nodes (container nodes)
+  const potentialParents = nodes.filter(node => 
+    node.type === 'subnetNode' && 
+    node.data?.cloudProvider === cloudProvider
+  );
+
+  // First, find all containers that actually contain the drop position
+  const containingParents = potentialParents.filter(parent => 
+    isPositionWithinNode(nodePosition, parent, nodes)
+  );
+
+  // Debug logging for development
+  if (process.env.NODE_ENV === 'development') {
+    console.log(`Finding auto parent for ${service} at position:`, {
+      position: nodePosition,
+      potentialParents: potentialParents.map(p => ({ id: p.id, label: p.data?.label, service: p.data?.service })),
+      containingParents: containingParents.map(p => ({ id: p.id, label: p.data?.label, service: p.data?.service }))
+    });
+  }
+
+  // If we have containers that contain the position, prioritize those
+  if (containingParents.length > 0) {
+    // Sort containing containers by specificity (smallest area first for most specific container)
+    const sortedContainingParents = containingParents.sort((a, b) => {
+      // First sort by z-index (highest first - more specific layers)
+    const aZIndex = a.style?.zIndex || 0;
+    const bZIndex = b.style?.zIndex || 0;
+    
+    if (aZIndex !== bZIndex) {
+      return (bZIndex as number) - (aZIndex as number);
+    }
+
+      // Then sort by area (smallest first - most specific container)
+    const aArea = (Number(a.style?.width) || 0) * (Number(a.style?.height) || 0);
+    const bArea = (Number(b.style?.width) || 0) * (Number(b.style?.height) || 0);
+    return aArea - bArea;
+  });
+
+    // Find the best containing parent based on validation rules
+    for (const potentialParent of sortedContainingParents) {
+      // Create a temporary node to test validation
+      const tempNode: Node = {
+        id: `temp-${Date.now()}`,
+        type: 'serviceNode',
+        position: nodePosition,
+        data: {
+          service,
+          cloudProvider,
+        },
+        parentNode: potentialParent.id,
+      };
+
+      // Validate if this placement is allowed
+      const validation = validateCloudProviderPlacement(
+        tempNode,
+        potentialParent,
+        nodes,
+        cloudProvider
+      );
+
+      if (validation.isValid) {
+        return potentialParent;
+      }
+    }
+  }
+
+  // If no containing containers found or none are valid, fall back to default behavior
+  // Sort all potential parents by z-index and area as fallback
+  const sortedParents = potentialParents.sort((a, b) => {
+    const aZIndex = a.style?.zIndex || 0;
+    const bZIndex = b.style?.zIndex || 0;
+    
+    if (aZIndex !== bZIndex) {
+      return (bZIndex as number) - (aZIndex as number);
+    }
+
+    // If same z-index, prefer smaller containers
+    const aArea = (Number(a.style?.width) || 0) * (Number(a.style?.height) || 0);
+    const bArea = (Number(b.style?.width) || 0) * (Number(b.style?.height) || 0);
+    return aArea - bArea;
+  });
+
+  // Try each potential parent with validation
+  for (const potentialParent of sortedParents) {
+    // Create a temporary node to test validation
+    const tempNode: Node = {
+      id: `temp-${Date.now()}`,
+      type: 'serviceNode',
+      position: nodePosition,
+      data: {
+        service,
+        cloudProvider,
+      },
+      parentNode: potentialParent.id,
+    };
+
+    // Validate if this placement is allowed
+    const validation = validateCloudProviderPlacement(
+      tempNode,
+      potentialParent,
+      nodes,
+      cloudProvider
+    );
+
+    if (validation.isValid) {
+      return potentialParent;
+    }
+  }
+
+  // If no valid parent found in containers, check if it can be placed at root
+  const tempNode: Node = {
+    id: `temp-${Date.now()}`,
+    type: 'serviceNode',
+    position: nodePosition,
+    data: {
+      service,
+      cloudProvider,
+    },
+  };
+
+  const rootValidation = validateCloudProviderPlacement(
+    tempNode,
+    null,
+    nodes,
+    cloudProvider
+  );
+
+  return rootValidation.isValid ? null : getDefaultParent(service, cloudProvider, nodes);
+};
+
+/**
+ * Checks if a position is within the bounds of a node
+ * Handles nested node positioning correctly by calculating absolute coordinates
+ */
+const isPositionWithinNode = (
+  position: { x: number; y: number },
+  node: Node,
+  allNodes?: Node[]
+): boolean => {
+  // Calculate absolute position of the node (considering parent positioning)
+  let nodeX = node.position.x;
+  let nodeY = node.position.y;
+  
+  // If the node has a parent, we need to calculate the absolute position
+  // by traversing up the parent chain
+  if (node.parentNode && allNodes) {
+    const parentNode = allNodes.find(n => n.id === node.parentNode);
+    if (parentNode) {
+      // Recursively calculate parent's absolute position
+      const parentAbsolutePos = getAbsolutePosition(parentNode, allNodes);
+      nodeX = parentAbsolutePos.x + node.position.x;
+      nodeY = parentAbsolutePos.y + node.position.y;
+    }
+  }
+  
+  const nodeWidth = (node.style?.width as number) || (node.data?.width as number) || 200;
+  const nodeHeight = (node.style?.height as number) || (node.data?.height as number) || 150;
+
+  // Add some padding to make it easier to drop items near edges
+  const padding = 10;
+  
+  const isWithin = (
+    position.x >= nodeX - padding &&
+    position.x <= nodeX + nodeWidth + padding &&
+    position.y >= nodeY - padding &&
+    position.y <= nodeY + nodeHeight + padding
+  );
+
+  // Debug logging for development
+  if (process.env.NODE_ENV === 'development') {
+    console.log(`Position check for ${node.data?.service || 'unknown'} (${node.data?.label || 'no label'}):`, {
+      dropPosition: position,
+      originalPosition: node.position,
+      calculatedPosition: { x: nodeX, y: nodeY },
+      nodeSize: { width: nodeWidth, height: nodeHeight },
+      bounds: {
+        left: nodeX - padding,
+        right: nodeX + nodeWidth + padding,
+        top: nodeY - padding,
+        bottom: nodeY + nodeHeight + padding
+      },
+      isWithin,
+      hasParent: !!node.parentNode,
+      parentNode: node.parentNode
+    });
+  }
+
+  return isWithin;
+};
+
+/**
+ * Recursively calculates the absolute position of a node by traversing up the parent chain
+ */
+const getAbsolutePosition = (node: Node, allNodes: Node[]): { x: number; y: number } => {
+  let absoluteX = node.position.x;
+  let absoluteY = node.position.y;
+  
+  if (node.parentNode) {
+    const parentNode = allNodes.find(n => n.id === node.parentNode);
+    if (parentNode) {
+      const parentAbsolutePos = getAbsolutePosition(parentNode, allNodes);
+      absoluteX = parentAbsolutePos.x + node.position.x;
+      absoluteY = parentAbsolutePos.y + node.position.y;
+    }
+  }
+  
+  return { x: absoluteX, y: absoluteY };
+};
+
+/**
+ * Gets the default parent based on service type and cloud provider
+ */
+const getDefaultParent = (
+  service: string,
+  cloudProvider: 'aws' | 'azure' | 'gcp',
+  nodes: Node[]
+): Node | null => {
+  // Define comprehensive default parent hierarchy for each cloud provider
+  const defaultParents = {
+    aws: {
+      // Compute services
+      compute: ['subnet', 'availability-zone', 'vpc', 'account'],
+      ec2: ['subnet', 'availability-zone', 'vpc', 'account'],
+      lambda: ['account'],
+      'elastic-beanstalk': ['account'],
+      fargate: ['subnet', 'vpc', 'account'],
+      batch: ['subnet', 'vpc', 'account'],
+      'app-runner': ['account'],
+      'serverless-application-repository': ['account'],
+      
+      // Database services
+      database: ['subnet', 'vpc', 'account'],
+      rds: ['subnet', 'vpc', 'account'],
+      aurora: ['subnet', 'vpc', 'account'],
+      dynamodb: ['account'],
+      elasticache: ['subnet', 'vpc', 'account'],
+      neptune: ['subnet', 'vpc', 'account'],
+      documentdb: ['subnet', 'vpc', 'account'],
+      keyspaces: ['account'],
+      timestream: ['account'],
+      
+      // Storage services
+      storage: ['account'],
+      s3: ['account'],
+      ebs: ['account'],
+      efs: ['account'],
+      fsx: ['account'],
+      backup: ['account'],
+      'storage-gateway': ['account'],
+      
+      // Networking services
+      networking: ['vpc', 'account'],
+      'elastic-load-balancing': ['subnet', 'vpc', 'account'],
+      'route-53': ['account'],
+      'direct-connect': ['account'],
+      'transit-gateway': ['account'],
+      'global-accelerator': ['account'],
+      'site-to-site-vpn': ['vpc', 'account'],
+      'client-vpn': ['vpc', 'account'],
+      
+      // Security services
+      security: ['account'],
+      iam: ['account'],
+      cognito: ['account'],
+      kms: ['account'],
+      'secrets-manager': ['account'],
+      'certificate-manager': ['account'],
+      waf: ['account'],
+      shield: ['account'],
+      guardduty: ['account'],
+      'security-hub': ['account'],
+      'network-firewall': ['subnet', 'vpc', 'account'],
+      
+      // Container services
+      containers: ['subnet', 'vpc', 'account'],
+      ecs: ['subnet', 'vpc', 'account'],
+      'elastic-container-service': ['subnet', 'vpc', 'account'],
+      eks: ['subnet', 'vpc', 'account'],
+      'elastic-kubernetes-service': ['subnet', 'vpc', 'account'],
+      'elastic-container-registry': ['account'],
+      
+      // Serverless services
+      serverless: ['account'],
+    },
+    azure: {
+      // Compute services
+      virtualMachine: ['subnet', 'virtual-network', 'resource-group', 'subscription'],
+      'virtual-machines': ['subnet', 'virtual-network', 'resource-group', 'subscription'],
+      'app-services': ['resource-group', 'subscription'],
+      'app-service': ['resource-group', 'subscription'],
+      'function-apps': ['resource-group', 'subscription'],
+      'batch-accounts': ['resource-group', 'subscription'],
+      'kubernetes-services': ['resource-group', 'subscription'],
+      'container-instances': ['resource-group', 'subscription'],
+      'virtual-machine-scale-sets': ['resource-group', 'subscription'],
+      
+      // Database services
+      database: ['resource-group', 'subscription'],
+      'sql-database': ['resource-group', 'subscription'],
+      'cosmos-db': ['resource-group', 'subscription'],
+      'mysql-server': ['resource-group', 'subscription'],
+      'postgresql-server': ['resource-group', 'subscription'],
+      'redis-cache': ['resource-group', 'subscription'],
+      
+      // Storage services
+      storageAccount: ['resource-group', 'subscription'],
+      'storage-accounts': ['resource-group', 'subscription'],
+      'managed-disks': ['resource-group', 'subscription'],
+      'blob-storage': ['resource-group', 'subscription'],
+      'file-storage': ['resource-group', 'subscription'],
+      
+      // Networking services
+      networkInterface: ['subnet', 'virtual-network', 'resource-group', 'subscription'],
+      'network-interfaces': ['subnet', 'virtual-network', 'resource-group', 'subscription'],
+      loadBalancer: ['resource-group', 'subscription'],
+      'load-balancers': ['resource-group', 'subscription'],
+      'application-gateway': ['subnet', 'virtual-network', 'resource-group', 'subscription'],
+      'vpn-gateway': ['virtual-network', 'resource-group', 'subscription'],
+      'express-route': ['resource-group', 'subscription'],
+      'cdn-profiles': ['resource-group', 'subscription'],
+      
+      // Security services
+      'key-vaults': ['resource-group', 'subscription'],
+      'security-center': ['subscription'],
+      'azure-firewall': ['subnet', 'virtual-network', 'resource-group', 'subscription'],
+      'network-security-groups': ['resource-group', 'subscription'],
+      'azure-active-directory': ['subscription'],
+    },
+    gcp: {
+      // Compute services
+      compute: ['subnet', 'vpc', 'project'],
+      'compute-engine': ['subnet', 'vpc', 'project'],
+      'app-engine': ['project'],
+      'cloud-functions': ['project'],
+      'kubernetes-engine': ['project'],
+      'cloud-run': ['project'],
+      'cloud-build': ['project'],
+      
+      // Database services
+      database: ['project'],
+      'cloud-sql': ['project'],
+      'cloud-spanner': ['project'],
+      'cloud-bigtable': ['project'],
+      'cloud-firestore': ['project'],
+      'cloud-memorystore': ['project'],
+      
+      // Storage services
+      storage: ['project'],
+      'cloud-storage': ['project'],
+      'persistent-disk': ['project'],
+      'filestore': ['project'],
+      
+      // Networking services
+      networking: ['vpc', 'project'],
+      'cloud-load-balancing': ['project'],
+      'cloud-cdn': ['project'],
+      'cloud-dns': ['project'],
+      'cloud-interconnect': ['project'],
+      'cloud-vpn': ['vpc', 'project'],
+      'cloud-nat': ['vpc', 'project'],
+      'cloud-router': ['vpc', 'project'],
+      
+      // Security services
+      'cloud-iam': ['project'],
+      'cloud-kms': ['project'],
+      'cloud-security-command-center': ['project'],
+      'cloud-armor': ['project'],
+      'binary-authorization': ['project'],
+      'cloud-asset-inventory': ['project'],
+      
+      // Serverless services
+      cloudFunction: ['project'],
+      cloudRun: ['project'],
+    },
+  };
+
+  // Get the service category/type
+  const serviceType = getServiceType(service, cloudProvider);
+  const parentHierarchy = defaultParents[cloudProvider]?.[serviceType as keyof typeof defaultParents[typeof cloudProvider]];
+
+  if (!parentHierarchy) {
+    // If no specific hierarchy found, use the service name directly
+    const directHierarchy = defaultParents[cloudProvider]?.[service as keyof typeof defaultParents[typeof cloudProvider]];
+    if (directHierarchy) {
+      return findParentFromHierarchy(directHierarchy, nodes, cloudProvider);
+    }
+    return null;
+  }
+
+  return findParentFromHierarchy(parentHierarchy, nodes, cloudProvider);
+};
+
+/**
+ * Finds the first available parent from a hierarchy
+ */
+const findParentFromHierarchy = (
+  hierarchy: string[],
+  nodes: Node[],
+  cloudProvider: 'aws' | 'azure' | 'gcp'
+): Node | null => {
+  for (const parentType of hierarchy) {
+    const parent = nodes.find(node => 
+      node.type === 'subnetNode' && 
+      node.data?.service === parentType &&
+      node.data?.cloudProvider === cloudProvider
+    );
+
+    if (parent) {
+      return parent;
+    }
+  }
+  return null;
+};
+
+/**
+ * Maps service to service type/category with comprehensive mapping
+ */
+const getServiceType = (service: string, cloudProvider: 'aws' | 'azure' | 'gcp'): string => {
+  const serviceTypeMap = {
+    aws: {
+      // Compute services
+      ec2: 'compute',
+      lambda: 'serverless',
+      'elastic-beanstalk': 'compute',
+      fargate: 'containers',
+      batch: 'compute',
+      'app-runner': 'compute',
+      'application-auto-scaling': 'compute',
+      'ec2-auto-scaling': 'compute',
+      'serverless-application-repository': 'serverless',
+      
+      // Database services
+      rds: 'database',
+      aurora: 'database',
+      dynamodb: 'database',
+      elasticache: 'database',
+      neptune: 'database',
+      documentdb: 'database',
+      keyspaces: 'database',
+      timestream: 'database',
+      'database-migration-service': 'database',
+      
+      // Storage services
+      s3: 'storage',
+      ebs: 'storage',
+      efs: 'storage',
+      fsx: 'storage',
+      backup: 'storage',
+      'storage-gateway': 'storage',
+      snowball: 'storage',
+      'snowball-edge': 'storage',
+      snowcone: 'storage',
+      snowmobile: 'storage',
+      
+      // Networking services
+      vpc: 'networking',
+      'elastic-load-balancing': 'networking',
+      'route-53': 'networking',
+      'direct-connect': 'networking',
+      'transit-gateway': 'networking',
+      'global-accelerator': 'networking',
+      'site-to-site-vpn': 'networking',
+      'client-vpn': 'networking',
+      'app-mesh': 'networking',
+      'cloud-map': 'networking',
+      'cloud-wan': 'networking',
+      privatelink: 'networking',
+      'vpc-lattice': 'networking',
+      
+      // Security services
+      'security-group': 'security',
+      iam: 'security',
+      cognito: 'security',
+      kms: 'security',
+      'secrets-manager': 'security',
+      'certificate-manager': 'security',
+      waf: 'security',
+      shield: 'security',
+      guardduty: 'security',
+      'security-hub': 'security',
+      'network-firewall': 'security',
+      inspector: 'security',
+      macie: 'security',
+      detective: 'security',
+      
+      // Container services
+      ecs: 'containers',
+      'elastic-container-service': 'containers',
+      eks: 'containers',
+      'elastic-kubernetes-service': 'containers',
+      'elastic-container-registry': 'containers',
+      'ecs-anywhere': 'containers',
+      'eks-anywhere': 'containers',
+      'eks-cloud': 'containers',
+      'eks-distro': 'containers',
+    },
+    azure: {
+      // Compute services
+      'virtual-machine': 'virtualMachine',
+      'virtual-machines': 'virtualMachine',
+      'app-services': 'appService',
+      'app-service': 'appService',
+      'function-apps': 'appService',
+      'batch-accounts': 'compute',
+      'kubernetes-services': 'containers',
+      'container-instances': 'containers',
+      'virtual-machine-scale-sets': 'virtualMachine',
+      
+      // Database services
+      'sql-database': 'database',
+      'cosmos-db': 'database',
+      'mysql-server': 'database',
+      'postgresql-server': 'database',
+      'redis-cache': 'database',
+      'mariadb-server': 'database',
+      'managed-database': 'database',
+      
+      // Storage services
+      'storage-account': 'storageAccount',
+      'storage-accounts': 'storageAccount',
+      'managed-disks': 'storageAccount',
+      'blob-storage': 'storageAccount',
+      'file-storage': 'storageAccount',
+      
+      // Networking services
+      'network-interface': 'networkInterface',
+      'network-interfaces': 'networkInterface',
+      'load-balancer': 'loadBalancer',
+      'load-balancers': 'loadBalancer',
+      'application-gateway': 'loadBalancer',
+      'vpn-gateway': 'networking',
+      'express-route': 'networking',
+      'cdn-profiles': 'networking',
+      
+      // Security services
+      'key-vaults': 'security',
+      'security-center': 'security',
+      'azure-firewall': 'security',
+      'network-security-groups': 'security',
+      'azure-active-directory': 'security',
+    },
+    gcp: {
+      // Compute services
+      'compute-engine': 'compute',
+      'app-engine': 'compute',
+      'cloud-functions': 'cloudFunction',
+      'kubernetes-engine': 'containers',
+      'cloud-run': 'cloudRun',
+      'cloud-build': 'compute',
+      
+      // Database services
+      'cloud-sql': 'database',
+      'cloud-spanner': 'database',
+      'cloud-bigtable': 'database',
+      'cloud-firestore': 'database',
+      'cloud-memorystore': 'database',
+      
+      // Storage services
+      'cloud-storage': 'storage',
+      'persistent-disk': 'storage',
+      'filestore': 'storage',
+      
+      // Networking services
+      'cloud-load-balancing': 'networking',
+      'cloud-cdn': 'networking',
+      'cloud-dns': 'networking',
+      'cloud-interconnect': 'networking',
+      'cloud-vpn': 'networking',
+      'cloud-nat': 'networking',
+      'cloud-router': 'networking',
+      'cloud-firewall-rules': 'networking',
+      'virtual-private-cloud': 'networking',
+      
+      // Security services
+      'cloud-iam': 'security',
+      'cloud-kms': 'security',
+      'cloud-security-command-center': 'security',
+      'cloud-armor': 'security',
+      'binary-authorization': 'security',
+      'cloud-asset-inventory': 'security',
+      iam: 'security',
+      'data-loss-prevention-api': 'security',
+      beyondcorp: 'security',
+    },
+  };
+
+  return serviceTypeMap[cloudProvider]?.[service as keyof typeof serviceTypeMap[typeof cloudProvider]] || service;
+};
+
+/**
+ * Provides smart placement suggestions based on best practices
+ */
+export const getPlacementSuggestions = (
+  service: string,
+  cloudProvider: 'aws' | 'azure' | 'gcp',
+  nodes: Node[]
+): string[] => {
+  const suggestions: string[] = [];
+  
+  // Check if recommended containers exist
+  const serviceType = getServiceType(service, cloudProvider);
+  const recommendedContainers = getRecommendedContainers(service, cloudProvider);
+  
+  for (const container of recommendedContainers) {
+    const exists = nodes.some(node => 
+      node.type === 'subnetNode' && 
+      node.data?.service === container &&
+      node.data?.cloudProvider === cloudProvider
+    );
+    
+    if (!exists) {
+      suggestions.push(`Consider creating a ${container} container first for better organization`);
+    }
+  }
+  
+  // Add cloud-specific best practice suggestions
+  if (cloudProvider === 'aws') {
+    if (serviceType === 'compute' && !nodes.some(n => n.data?.service === 'subnet')) {
+      suggestions.push('AWS compute resources should be placed in subnets for proper network isolation');
+    }
+    if (serviceType === 'database' && !nodes.some(n => n.data?.service === 'subnet')) {
+      suggestions.push('AWS database resources should be placed in private subnets for security');
+    }
+  } else if (cloudProvider === 'azure') {
+    if (serviceType === 'virtualMachine' && !nodes.some(n => n.data?.service === 'subnet')) {
+      suggestions.push('Azure VMs should be placed in subnets within a Virtual Network');
+    }
+    if (!nodes.some(n => n.data?.service === 'resource-group')) {
+      suggestions.push('Azure resources should be organized in Resource Groups');
+    }
+  } else if (cloudProvider === 'gcp') {
+    if (!nodes.some(n => n.data?.service === 'project')) {
+      suggestions.push('GCP resources must be organized within a Project');
+    }
+    if (serviceType === 'compute' && !nodes.some(n => n.data?.service === 'subnet')) {
+      suggestions.push('GCP compute resources should be placed in subnets for network organization');
+    }
+  }
+  
+  return suggestions;
+};
+
+/**
+ * Gets recommended containers for a service
+ */
+const getRecommendedContainers = (service: string, cloudProvider: 'aws' | 'azure' | 'gcp'): string[] => {
+  const containerRecommendations = {
+    aws: {
+      compute: ['account', 'vpc', 'subnet'],
+      database: ['account', 'vpc', 'subnet'],
+      storage: ['account'],
+      networking: ['account', 'vpc'],
+      security: ['account'],
+      containers: ['account', 'vpc', 'subnet'],
+      serverless: ['account'],
+    },
+    azure: {
+      virtualMachine: ['subscription', 'resource-group', 'virtual-network', 'subnet'],
+      database: ['subscription', 'resource-group'],
+      storageAccount: ['subscription', 'resource-group'],
+      appService: ['subscription', 'resource-group'],
+      networking: ['subscription', 'resource-group'],
+      security: ['subscription', 'resource-group'],
+    },
+    gcp: {
+      compute: ['project', 'vpc', 'subnet'],
+      database: ['project'],
+      storage: ['project'],
+      networking: ['project', 'vpc'],
+      security: ['project'],
+      containers: ['project'],
+    },
+  };
+
+  const serviceType = getServiceType(service, cloudProvider);
+  return containerRecommendations[cloudProvider]?.[serviceType as keyof typeof containerRecommendations[typeof cloudProvider]] || [];
+};
+
+/**
+ * Validates placement and provides warnings for sub-optimal configurations
+ */
+export const validatePlacementWithWarnings = (
+  node: Node,
+  parentNode: Node | null,
+  nodes: Node[],
+  cloudProvider: 'aws' | 'azure' | 'gcp'
+): { isValid: boolean; warnings: ValidationWarning[] } => {
+  const warnings: ValidationWarning[] = [];
+  
+  // Check for sub-optimal placements
+  const serviceType = getServiceType(node.data?.service, cloudProvider);
+  
+  if (cloudProvider === 'aws') {
+    // Check for compute resources not in subnets
+    if (serviceType === 'compute' && (!parentNode || parentNode.data?.service !== 'subnet')) {
+      warnings.push({
+        message: 'Compute resources should be placed in subnets for proper network isolation',
+        severity: 'warning',
+        suggestions: ['Create a subnet and place the compute resource within it']
+      });
+    }
+    
+    // Check for database resources not in private subnets
+    if (serviceType === 'database' && (!parentNode || parentNode.data?.service !== 'subnet')) {
+      warnings.push({
+        message: 'Database resources should be placed in private subnets for security',
+        severity: 'warning',
+        suggestions: ['Create a private subnet and place the database within it']
+      });
+    }
+  } else if (cloudProvider === 'azure') {
+    // Check for VMs not in subnets
+    if (serviceType === 'virtualMachine' && (!parentNode || parentNode.data?.service !== 'subnet')) {
+      warnings.push({
+        message: 'Virtual machines should be placed in subnets for network organization',
+        severity: 'warning',
+        suggestions: ['Create a subnet within a virtual network and place the VM there']
+      });
+    }
+  } else if (cloudProvider === 'gcp') {
+    // Check for compute resources not in subnets
+    if (serviceType === 'compute' && (!parentNode || parentNode.data?.service !== 'subnet')) {
+      warnings.push({
+        message: 'Compute resources should be placed in subnets for network organization',
+        severity: 'warning',
+        suggestions: ['Create a subnet within a VPC and place the compute resource there']
+      });
+    }
+  }
+  
+  return { isValid: true, warnings };
+};
+
+/**
+ * Automatically assigns parent during drag and drop based on drop position
+ * @param draggedNode - The node being dragged
+ * @param dropPosition - Position where the node is dropped
+ * @param nodes - All existing nodes
+ * @returns Updated node with automatic parent assignment
+ */
+export const autoAssignParentOnDrop = (
+  draggedNode: Node,
+  dropPosition: { x: number; y: number },
+  nodes: Node[]
+): Node => {
+  const cloudProvider = draggedNode.data?.cloudProvider;
+  const service = draggedNode.data?.service;
+
+  if (!cloudProvider || !service) {
+    return draggedNode;
+  }
+
+  // Find the best parent based on drop position
+  const bestParent = findAutoParent(dropPosition, service, cloudProvider, nodes);
+
+  // Update the node with the new parent
+  const updatedNode: Node = {
+    ...draggedNode,
+    position: dropPosition,
+    parentNode: bestParent?.id,
+    extent: bestParent ? 'parent' : undefined,
+  };
+
+  return updatedNode;
+};