@flowuent-org/diagramming-core 1.3.10 → 1.4.1

package/packages/diagrams/src/lib/templates/cloud-arch/utils/azureValidation.ts

@@ -1,496 +1,496 @@
-import { Node } from 'reactflow';
-import { getTranslatedMessage, getCloudProviderMessageId, formatPlacementRules } from './translations';
-
-// Define types for validation results
-interface ValidationResult {
-  isValid: boolean;
-  message?: string;
-  suggestions?: string[];
-}
-
-// Define Azure resource types - comprehensive list
-type AzureResourceType =
-  // Container Resources
-  | 'subscription'
-  | 'resource-group' | 'resourceGroup'
-  | 'virtual-network' | 'virtualNetwork'
-  | 'subnet'
-  | 'network-security-group' | 'networkSecurityGroup'
-  | 'route-table' | 'routeTable'
-  
-  // Compute Resources
-  | 'virtual-machines' | 'virtualMachine'
-  | 'virtual-machine-scale-sets'
-  | 'app-services' | 'appService'
-  | 'function-apps' | 'functionApps'
-  | 'batch-accounts' | 'batchAccounts'
-  | 'spot-vm' | 'spot-vmss'
-  
-  // Container Services
-  | 'container-instances' | 'containerInstances'
-  | 'kubernetes-services' | 'kubernetesServices'
-  | 'red-hat-openshift'
-  | 'service-fabric-clusters'
-  | 'container-registries'
-  
-  // Storage Resources
-  | 'storage-accounts' | 'storageAccount'
-  | 'storage-accounts-classic'
-  | 'managed-disks' | 'managedDisks'
-  | 'file-storage' | 'fileStorage'
-  | 'blob-storage' | 'blobStorage'
-  | 'azure-fileshares'
-  | 'data-lake-storage-gen1'
-  | 'azure-netapp-files'
-  | 'recovery-services-vaults'
-  | 'data-box' | 'azure-stack-edge'
-  
-  // Database Resources
-  | 'sql-database' | 'database'
-  | 'cosmos-db'
-  | 'mysql-server'
-  | 'postgresql-server'
-  | 'mariadb-server'
-  | 'sql-vm'
-  | 'sql-managed-instance'
-  | 'azure-sql'
-  | 'cache-redis' | 'redisCache'
-  | 'synapse-analytics' | 'synapseAnalytics'
-  | 'purview-accounts' | 'purviewAccounts'
-  | 'data-factories'
-  
-  // Networking Resources
-  | 'load-balancers' | 'loadBalancer'
-  | 'application-gateways' | 'applicationGateway'
-  | 'virtual-network-gateways' | 'vpnGateway'
-  | 'local-network-gateways'
-  | 'expressroute-circuits' | 'expressRoute'
-  | 'network-interfaces' | 'networkInterface'
-  | 'connections'
-  | 'public-ip-addresses'
-  | 'dns-zones'
-  | 'traffic-manager-profiles'
-  | 'network-watcher'
-  | 'front-door-cdn-profiles' | 'cdnProfiles'
-  | 'private-endpoints' | 'privateEndpoint'
-  | 'ddos-protection-plans'
-  
-  // Security Resources
-  | 'key-vaults' | 'keyVaults'
-  | 'application-security-groups'
-  | 'defender-for-cloud'
-  | 'sentinel'
-  | 'information-protection'
-  | 'conditional-access'
-  
-  // Management & Monitoring
-  | 'cognitive-services' | 'cognitiveServices'
-  | 'logic-apps' | 'logicApps'
-  | 'event-hubs' | 'eventHubs'
-  | 'service-bus' | 'serviceBus'
-  | 'api-management' | 'apiManagement'
-  | 'azure-firewall' | 'azureFirewall';
-
-// Define container rules with detailed descriptions
-const containerRules: Record<string, {
-  canContain: string[];
-  cannotContain: string[];
-  description: string;
-  placementRules: string[];
-}> = {
-  subscription: {
-    canContain: ['resourceGroup'],
-    cannotContain: ['subscription', 'tenant'],
-    description: 'Azure Subscription is the root container for all resources',
-    placementRules: [
-      'Must be at the root level',
-      'Can only contain Resource Groups',
-      'Cannot contain other Subscriptions',
-      'Cannot contain tenant-level resources'
-    ]
-  },
-  resourceGroup: {
-    canContain: [
-      'virtualNetwork',
-      'virtualMachine',
-      'storageAccount',
-      'appService',
-      'database',
-      'loadBalancer',
-      'keyVaults',
-      'functionApps',
-      'containerInstances',
-      'kubernetesServices',
-      'batchAccounts',
-      'managedDisks',
-      'fileStorage',
-      'blobStorage',
-      'redisCache',
-      'synapseAnalytics',
-      'purviewAccounts',
-      'cognitiveServices',
-      'logicApps',
-      'eventHubs',
-      'serviceBus',
-      'apiManagement',
-      'cdnProfiles',
-      'expressRoute'
-    ],
-    cannotContain: ['resourceGroup'],
-    description: 'Resource Group is a container for Azure resources in the same lifecycle',
-    placementRules: [
-      'Must be placed within a Subscription',
-      'Cannot contain other Resource Groups',
-      'Should group resources that share the same lifecycle',
-      'Resources within should be in the same region (recommended)'
-    ]
-  },
-  virtualNetwork: {
-    canContain: [
-      'subnet',
-      'networkSecurityGroup',
-      'routeTable',
-      'vpnGateway',
-      'applicationGateway',
-      'azureFirewall',
-      'loadBalancer',
-      'expressRoute'
-    ],
-    cannotContain: ['virtualMachine', 'virtualNetwork'],
-    description: 'Virtual Network is an isolated network in Azure',
-    placementRules: [
-      'Must be placed within a Resource Group',
-      'Cannot contain VMs directly (use Subnets)',
-      'Cannot contain other Virtual Networks (use VNet peering)',
-      'Can contain multiple Subnets'
-    ]
-  },
-  subnet: {
-    canContain: [
-      'virtualMachine',
-      'networkInterface',
-      'privateEndpoint',
-      'applicationGateway',
-      'azureFirewall',
-      'containerInstances',
-      'kubernetesServices'
-    ],
-    cannotContain: ['subnet', 'virtualNetwork'],
-    description: 'Subnet is a range of IP addresses in a Virtual Network',
-    placementRules: [
-      'Must be placed within a Virtual Network',
-      'Cannot contain other Subnets',
-      'Cannot contain VNet-level resources',
-      'Should have non-overlapping IP ranges'
-    ]
-  }
-};
-
-// Helper function to get resource type from node
-function getAzureResourceType(node: Node): AzureResourceType | null {
-  if (!node.data?.service) return null;
-  
-  // Map node service to Azure resource type - comprehensive mapping
-  const serviceToType: Record<string, AzureResourceType> = {
-    // Subscription and Resource Group
-    'subscription': 'subscription',
-    'resource-group': 'resourceGroup',
-    
-    // Networking
-    'virtual-network': 'virtualNetwork',
-    'vnet': 'virtualNetwork',
-    'subnet': 'subnet',
-    'network-security-group': 'networkSecurityGroup',
-    'route-table': 'routeTable',
-    'vpn-gateway': 'vpnGateway',
-    'virtual-network-gateways': 'vpnGateway',
-    'local-network-gateways': 'vpnGateway',
-    'application-gateway': 'applicationGateway',
-    'application-gateways': 'applicationGateway',
-    'network-interface': 'networkInterface',
-    'network-interfaces': 'networkInterface',
-    'private-endpoint': 'privateEndpoint',
-    'private-endpoints': 'privateEndpoint',
-    'azure-firewall': 'azureFirewall',
-    'cdn-profiles': 'cdnProfiles',
-    'front-door-cdn-profiles': 'cdnProfiles',
-    'express-route': 'expressRoute',
-    'expressroute-circuits': 'expressRoute',
-    'load-balancer': 'loadBalancer',
-    'load-balancers': 'loadBalancer',
-    'connections': 'connections',
-    'public-ip-addresses': 'networkInterface',
-    'dns-zones': 'networkInterface',
-    'traffic-manager-profiles': 'loadBalancer',
-    'network-watcher': 'networkInterface',
-    'ddos-protection-plans': 'networkSecurityGroup',
-    
-    // Compute
-    'virtual-machine': 'virtualMachine',
-    'vm': 'virtualMachine',
-    'virtual-machines': 'virtualMachine',
-    'virtual-machine-scale-sets': 'virtualMachine',
-    'spot-vm': 'virtualMachine',
-    'spot-vmss': 'virtualMachine',
-    'batch-accounts': 'batchAccounts',
-    'container-instances': 'containerInstances',
-    'kubernetes-services': 'kubernetesServices',
-    'red-hat-openshift': 'kubernetesServices',
-    'service-fabric-clusters': 'containerInstances',
-    'container-registries': 'containerInstances',
-    'function-apps': 'functionApps',
-    
-    // Storage
-    'storage-accounts': 'storageAccount',
-    'storage-account': 'storageAccount',
-    'storage-accounts-classic': 'storageAccount',
-    'managed-disks': 'managedDisks',
-    'file-storage': 'fileStorage',
-    'blob-storage': 'blobStorage',
-    'azure-fileshares': 'fileStorage',
-    'azure-netapp-files': 'fileStorage',
-    'data-lake-storage-gen1': 'storageAccount',
-    'data-shares': 'storageAccount',
-    'data-share-invitations': 'storageAccount',
-    'import-export-jobs': 'storageAccount',
-    'recovery-services-vaults': 'storageAccount',
-    'azure-stack-edge': 'storageAccount',
-    'data-box': 'storageAccount',
-    'storage-sync-services': 'storageAccount',
-    'storsimple-device-managers': 'storageAccount',
-    'storsimple-data-managers': 'storageAccount',
-    
-    // App Services
-    'app-services': 'appService',
-    'app-service': 'appService',
-    'app-service-environments': 'appService',
-    'app-service-plans': 'appService',
-    'logic-apps': 'logicApps',
-    'api-management': 'apiManagement',
-    
-    // Databases
-    'sql-database': 'database',
-    'cosmos-db': 'database',
-    'mysql-server': 'database',
-    'postgresql-server': 'database',
-    'mariadb-server': 'database',
-    'managed-database': 'database',
-    'sql-data-warehouses': 'database',
-    'synapse-analytics': 'synapseAnalytics',
-    'azure-sql': 'database',
-    'sql-elastic-pools': 'database',
-    'sql-managed-instance': 'database',
-    'cache-redis': 'redisCache',
-    'data-factories': 'database',
-    'purview-accounts': 'purviewAccounts',
-    
-    // Security
-    'key-vaults': 'keyVaults',
-    'application-security-groups': 'networkSecurityGroup',
-    'defender-for-cloud': 'keyVaults',
-    'defender-for-iot': 'keyVaults',
-    'defender-easm': 'keyVaults',
-    'sentinel': 'keyVaults',
-    'information-protection': 'keyVaults',
-    'conditional-access': 'keyVaults',
-    'multifactor-authentication': 'keyVaults',
-    'identity-secure-score': 'keyVaults',
-    'security-center': 'keyVaults',
-    'azure-active-directory': 'keyVaults',
-    
-    // AI/ML
-    'cognitive-services': 'cognitiveServices',
-    'machine-learning': 'cognitiveServices',
-    
-    // Integration
-    'event-hubs': 'eventHubs',
-    'service-bus': 'serviceBus',
-    'event-grid': 'eventHubs',
-    'relay': 'serviceBus'
-  };
-
-  return serviceToType[node.data.service] || null;
-}
-
-// Helper function to suggest similar Azure services
-function getSuggestedAzureServices(serviceName: string): string {
-  const commonServices = [
-    'virtual-machines', 'storage-accounts', 'virtual-network', 'subnet',
-    'app-services', 'sql-database', 'cosmos-db', 'key-vaults',
-    'load-balancers', 'application-gateways', 'container-instances',
-    'kubernetes-services', 'function-apps', 'connections'
-  ];
-  
-  // Find similar services based on partial matches
-  const similar = commonServices.filter(service => 
-    service.includes(serviceName.toLowerCase()) || 
-    serviceName.toLowerCase().includes(service) ||
-    service.replace('-', '').includes(serviceName.toLowerCase().replace('-', ''))
-  );
-  
-  if (similar.length > 0) {
-    return `🔍 Did you mean: ${similar.slice(0, 3).join(', ')}?`;
-  }
-  
-  return `📋 Available services include: ${commonServices.slice(0, 5).join(', ')}, and more.`;
-}
-
-// Validate placement of an Azure resource
-export const validateAzurePlacement =(
-  node: Node,
-  parentNode: Node | null,
-  allNodes: Node[]
-): ValidationResult => {
-  // Only validate Azure resources
-  if (node.data?.cloudProvider !== 'azure') {
-    return { isValid: true };
-  }
-
-  const resourceType = getAzureResourceType(node);
-  const parentType = parentNode ? getAzureResourceType(parentNode) : null;
-
-  if (!resourceType) {
-    const serviceName = node.data?.service || 'unknown';
-    const suggestions = getSuggestedAzureServices(serviceName);
-    
-    return {
-      isValid: false,
-      message: `❌ Azure service "${serviceName}" is not recognized.\n\n${suggestions}\n\n💡 Try dragging from the Azure services panel on the left.`
-    };
-  }
-
-  // If no parent, only subscription is allowed at root
-  if (!parentNode && resourceType !== 'subscription') {
-    return {
-      isValid: false,
-      message: `🚫 Cannot place "${node.data?.service}" at root level.\n\n📋 Azure hierarchy requires:\n• Resources must be inside containers\n• Only Subscriptions can be at root level\n\n💡 Place this inside: Subscription → Resource Group → Virtual Network → Subnet`
-    };
-  }
-
-  // Check if the resource can be placed in the parent container
-  if (parentNode && parentType) {
-    const rules = containerRules[parentType];
-    if (!rules) {
-      return {
-        isValid: false,
-        message: getTranslatedMessage(
-          getCloudProviderMessageId('azure', 'invalid_parent_container'),
-          { parentType }
-        )
-      };
-    }
-
-    if (!rules.canContain.includes(resourceType)) {
-      const parentName = parentNode.data?.label || parentNode.data?.service || parentType;
-      const resourceName = node.data?.label || node.data?.service || resourceType;
-      
-      // Get what this parent CAN contain
-      const canContainList = rules.canContain.map(type => 
-        type.charAt(0).toUpperCase() + type.slice(1).replace(/([A-Z])/g, ' $1')
-      ).join(', ');
-      
-      // Get what this parent CANNOT contain (show only relevant ones)
-      const cannotContainList = ['virtualMachine', 'virtualNetwork', 'subnet', 'storageAccount', 'database']
-        .filter(type => !rules.canContain.includes(type))
-        .map(type => type.charAt(0).toUpperCase() + type.slice(1).replace(/([A-Z])/g, ' $1'))
-        .slice(0, 3)
-        .join(', ');
-      
-      return {
-        isValid: false,
-        message: `🚫 Cannot place "${resourceName}" inside "${parentName}"\n\n✅ ${parentName} CAN contain:\n• ${canContainList}\n\n❌ ${parentName} CANNOT contain:\n• ${cannotContainList}\n\n💡 ${getSuggestedContainer(resourceType)}`
-      };
-    }
-
-    // Check for specific placement rules
-    if (resourceType === 'virtualMachine' && parentType !== 'subnet') {
-      return {
-        isValid: false,
-        message: getTranslatedMessage(
-          getCloudProviderMessageId('azure', 'vm_must_be_in_subnet')
-        )
-      };
-    }
-  }
-
-  return { isValid: true };
-}
-
-// Helper function to suggest the correct container
-const getSuggestedContainer = (resourceType: AzureResourceType): string => {
-  const suggestions: Partial<Record<AzureResourceType, string>> = {
-    virtualMachine: 'Virtual Machines must be placed in a Subnet',
-    subnet: 'Subnets must be placed in a Virtual Network',
-    virtualNetwork: 'Virtual Networks must be placed in a Resource Group',
-    resourceGroup: 'Resource Groups must be placed in a Subscription',
-    storageAccount: 'Storage Accounts must be placed in a Resource Group',
-    appService: 'App Services must be placed in a Resource Group',
-    database: 'Databases must be placed in a Resource Group',
-    loadBalancer: 'Load Balancers must be placed in a Resource Group',
-    networkSecurityGroup: 'Network Security Groups must be placed in a Virtual Network',
-    routeTable: 'Route Tables must be placed in a Virtual Network',
-    vpnGateway: 'VPN Gateways must be placed in a Virtual Network',
-    applicationGateway: 'Application Gateways can be placed in a Virtual Network or Subnet',
-    networkInterface: 'Network Interfaces must be placed in a Subnet',
-    privateEndpoint: 'Private Endpoints must be placed in a Subnet',
-    subscription: 'Subscriptions must be placed at the root level'
-  };
-
-  return `Suggestion: ${suggestions[resourceType] || 'Check Azure documentation for placement requirements'}`;
-}
-
-// Validate the entire Azure diagram
-export const validateAzureDiagram = (nodes: Node[]): ValidationResult & { messages?: string[] } => {
-  const messages: string[] = [];
-
-  // Get all Azure nodes
-  const azureNodes = nodes.filter(node => node.data?.cloudProvider === 'azure');
-
-  // Validate each node
-  for (const node of azureNodes) {
-    const foundParentNode = node.parentNode 
-      ? nodes.find(n => n.id === node.parentNode)
-      : null;
-    const parentNode = foundParentNode || null;
-    
-    const validation = validateAzurePlacement(node, parentNode, nodes);
-    if (!validation.isValid && validation.message) {
-      messages.push(validation.message);
-    }
-  }
-
-  // Additional diagram-wide validations
-  const subscriptions = azureNodes.filter(
-    node => getAzureResourceType(node) === 'subscription'
-  );
-
-  // Check if there are multiple subscriptions
-  if (subscriptions.length > 1) {
-    messages.push(
-      getTranslatedMessage(getCloudProviderMessageId('azure', 'multiple_subscriptions'))
-    );
-  }
-
-  // Check for cross-region dependencies in resource groups
-  const resourceGroups = azureNodes.filter(
-    node => getAzureResourceType(node) === 'resourceGroup'
-  );
-
-  for (const rg of resourceGroups) {
-    const rgResources = azureNodes.filter(node => node.parentNode === rg.id);
-    const regions = new Set(rgResources.map(r => r.data?.region));
-    if (regions.size > 1) {
-      messages.push(
-        getTranslatedMessage(
-          getCloudProviderMessageId('azure', 'cross_region_resources'),
-          { resourceGroupName: rg.data?.label }
-        )
-      );
-    }
-  }
-
-  return {
-    isValid: messages.length === 0,
-    messages
-  };
+import { Node } from 'reactflow';
+import { getTranslatedMessage, getCloudProviderMessageId, formatPlacementRules } from './translations';
+
+// Define types for validation results
+interface ValidationResult {
+  isValid: boolean;
+  message?: string;
+  suggestions?: string[];
+}
+
+// Define Azure resource types - comprehensive list
+type AzureResourceType =
+  // Container Resources
+  | 'subscription'
+  | 'resource-group' | 'resourceGroup'
+  | 'virtual-network' | 'virtualNetwork'
+  | 'subnet'
+  | 'network-security-group' | 'networkSecurityGroup'
+  | 'route-table' | 'routeTable'
+  
+  // Compute Resources
+  | 'virtual-machines' | 'virtualMachine'
+  | 'virtual-machine-scale-sets'
+  | 'app-services' | 'appService'
+  | 'function-apps' | 'functionApps'
+  | 'batch-accounts' | 'batchAccounts'
+  | 'spot-vm' | 'spot-vmss'
+  
+  // Container Services
+  | 'container-instances' | 'containerInstances'
+  | 'kubernetes-services' | 'kubernetesServices'
+  | 'red-hat-openshift'
+  | 'service-fabric-clusters'
+  | 'container-registries'
+  
+  // Storage Resources
+  | 'storage-accounts' | 'storageAccount'
+  | 'storage-accounts-classic'
+  | 'managed-disks' | 'managedDisks'
+  | 'file-storage' | 'fileStorage'
+  | 'blob-storage' | 'blobStorage'
+  | 'azure-fileshares'
+  | 'data-lake-storage-gen1'
+  | 'azure-netapp-files'
+  | 'recovery-services-vaults'
+  | 'data-box' | 'azure-stack-edge'
+  
+  // Database Resources
+  | 'sql-database' | 'database'
+  | 'cosmos-db'
+  | 'mysql-server'
+  | 'postgresql-server'
+  | 'mariadb-server'
+  | 'sql-vm'
+  | 'sql-managed-instance'
+  | 'azure-sql'
+  | 'cache-redis' | 'redisCache'
+  | 'synapse-analytics' | 'synapseAnalytics'
+  | 'purview-accounts' | 'purviewAccounts'
+  | 'data-factories'
+  
+  // Networking Resources
+  | 'load-balancers' | 'loadBalancer'
+  | 'application-gateways' | 'applicationGateway'
+  | 'virtual-network-gateways' | 'vpnGateway'
+  | 'local-network-gateways'
+  | 'expressroute-circuits' | 'expressRoute'
+  | 'network-interfaces' | 'networkInterface'
+  | 'connections'
+  | 'public-ip-addresses'
+  | 'dns-zones'
+  | 'traffic-manager-profiles'
+  | 'network-watcher'
+  | 'front-door-cdn-profiles' | 'cdnProfiles'
+  | 'private-endpoints' | 'privateEndpoint'
+  | 'ddos-protection-plans'
+  
+  // Security Resources
+  | 'key-vaults' | 'keyVaults'
+  | 'application-security-groups'
+  | 'defender-for-cloud'
+  | 'sentinel'
+  | 'information-protection'
+  | 'conditional-access'
+  
+  // Management & Monitoring
+  | 'cognitive-services' | 'cognitiveServices'
+  | 'logic-apps' | 'logicApps'
+  | 'event-hubs' | 'eventHubs'
+  | 'service-bus' | 'serviceBus'
+  | 'api-management' | 'apiManagement'
+  | 'azure-firewall' | 'azureFirewall';
+
+// Define container rules with detailed descriptions
+const containerRules: Record<string, {
+  canContain: string[];
+  cannotContain: string[];
+  description: string;
+  placementRules: string[];
+}> = {
+  subscription: {
+    canContain: ['resourceGroup'],
+    cannotContain: ['subscription', 'tenant'],
+    description: 'Azure Subscription is the root container for all resources',
+    placementRules: [
+      'Must be at the root level',
+      'Can only contain Resource Groups',
+      'Cannot contain other Subscriptions',
+      'Cannot contain tenant-level resources'
+    ]
+  },
+  resourceGroup: {
+    canContain: [
+      'virtualNetwork',
+      'virtualMachine',
+      'storageAccount',
+      'appService',
+      'database',
+      'loadBalancer',
+      'keyVaults',
+      'functionApps',
+      'containerInstances',
+      'kubernetesServices',
+      'batchAccounts',
+      'managedDisks',
+      'fileStorage',
+      'blobStorage',
+      'redisCache',
+      'synapseAnalytics',
+      'purviewAccounts',
+      'cognitiveServices',
+      'logicApps',
+      'eventHubs',
+      'serviceBus',
+      'apiManagement',
+      'cdnProfiles',
+      'expressRoute'
+    ],
+    cannotContain: ['resourceGroup'],
+    description: 'Resource Group is a container for Azure resources in the same lifecycle',
+    placementRules: [
+      'Must be placed within a Subscription',
+      'Cannot contain other Resource Groups',
+      'Should group resources that share the same lifecycle',
+      'Resources within should be in the same region (recommended)'
+    ]
+  },
+  virtualNetwork: {
+    canContain: [
+      'subnet',
+      'networkSecurityGroup',
+      'routeTable',
+      'vpnGateway',
+      'applicationGateway',
+      'azureFirewall',
+      'loadBalancer',
+      'expressRoute'
+    ],
+    cannotContain: ['virtualMachine', 'virtualNetwork'],
+    description: 'Virtual Network is an isolated network in Azure',
+    placementRules: [
+      'Must be placed within a Resource Group',
+      'Cannot contain VMs directly (use Subnets)',
+      'Cannot contain other Virtual Networks (use VNet peering)',
+      'Can contain multiple Subnets'
+    ]
+  },
+  subnet: {
+    canContain: [
+      'virtualMachine',
+      'networkInterface',
+      'privateEndpoint',
+      'applicationGateway',
+      'azureFirewall',
+      'containerInstances',
+      'kubernetesServices'
+    ],
+    cannotContain: ['subnet', 'virtualNetwork'],
+    description: 'Subnet is a range of IP addresses in a Virtual Network',
+    placementRules: [
+      'Must be placed within a Virtual Network',
+      'Cannot contain other Subnets',
+      'Cannot contain VNet-level resources',
+      'Should have non-overlapping IP ranges'
+    ]
+  }
+};
+
+// Helper function to get resource type from node
+function getAzureResourceType(node: Node): AzureResourceType | null {
+  if (!node.data?.service) return null;
+  
+  // Map node service to Azure resource type - comprehensive mapping
+  const serviceToType: Record<string, AzureResourceType> = {
+    // Subscription and Resource Group
+    'subscription': 'subscription',
+    'resource-group': 'resourceGroup',
+    
+    // Networking
+    'virtual-network': 'virtualNetwork',
+    'vnet': 'virtualNetwork',
+    'subnet': 'subnet',
+    'network-security-group': 'networkSecurityGroup',
+    'route-table': 'routeTable',
+    'vpn-gateway': 'vpnGateway',
+    'virtual-network-gateways': 'vpnGateway',
+    'local-network-gateways': 'vpnGateway',
+    'application-gateway': 'applicationGateway',
+    'application-gateways': 'applicationGateway',
+    'network-interface': 'networkInterface',
+    'network-interfaces': 'networkInterface',
+    'private-endpoint': 'privateEndpoint',
+    'private-endpoints': 'privateEndpoint',
+    'azure-firewall': 'azureFirewall',
+    'cdn-profiles': 'cdnProfiles',
+    'front-door-cdn-profiles': 'cdnProfiles',
+    'express-route': 'expressRoute',
+    'expressroute-circuits': 'expressRoute',
+    'load-balancer': 'loadBalancer',
+    'load-balancers': 'loadBalancer',
+    'connections': 'connections',
+    'public-ip-addresses': 'networkInterface',
+    'dns-zones': 'networkInterface',
+    'traffic-manager-profiles': 'loadBalancer',
+    'network-watcher': 'networkInterface',
+    'ddos-protection-plans': 'networkSecurityGroup',
+    
+    // Compute
+    'virtual-machine': 'virtualMachine',
+    'vm': 'virtualMachine',
+    'virtual-machines': 'virtualMachine',
+    'virtual-machine-scale-sets': 'virtualMachine',
+    'spot-vm': 'virtualMachine',
+    'spot-vmss': 'virtualMachine',
+    'batch-accounts': 'batchAccounts',
+    'container-instances': 'containerInstances',
+    'kubernetes-services': 'kubernetesServices',
+    'red-hat-openshift': 'kubernetesServices',
+    'service-fabric-clusters': 'containerInstances',
+    'container-registries': 'containerInstances',
+    'function-apps': 'functionApps',
+    
+    // Storage
+    'storage-accounts': 'storageAccount',
+    'storage-account': 'storageAccount',
+    'storage-accounts-classic': 'storageAccount',
+    'managed-disks': 'managedDisks',
+    'file-storage': 'fileStorage',
+    'blob-storage': 'blobStorage',
+    'azure-fileshares': 'fileStorage',
+    'azure-netapp-files': 'fileStorage',
+    'data-lake-storage-gen1': 'storageAccount',
+    'data-shares': 'storageAccount',
+    'data-share-invitations': 'storageAccount',
+    'import-export-jobs': 'storageAccount',
+    'recovery-services-vaults': 'storageAccount',
+    'azure-stack-edge': 'storageAccount',
+    'data-box': 'storageAccount',
+    'storage-sync-services': 'storageAccount',
+    'storsimple-device-managers': 'storageAccount',
+    'storsimple-data-managers': 'storageAccount',
+    
+    // App Services
+    'app-services': 'appService',
+    'app-service': 'appService',
+    'app-service-environments': 'appService',
+    'app-service-plans': 'appService',
+    'logic-apps': 'logicApps',
+    'api-management': 'apiManagement',
+    
+    // Databases
+    'sql-database': 'database',
+    'cosmos-db': 'database',
+    'mysql-server': 'database',
+    'postgresql-server': 'database',
+    'mariadb-server': 'database',
+    'managed-database': 'database',
+    'sql-data-warehouses': 'database',
+    'synapse-analytics': 'synapseAnalytics',
+    'azure-sql': 'database',
+    'sql-elastic-pools': 'database',
+    'sql-managed-instance': 'database',
+    'cache-redis': 'redisCache',
+    'data-factories': 'database',
+    'purview-accounts': 'purviewAccounts',
+    
+    // Security
+    'key-vaults': 'keyVaults',
+    'application-security-groups': 'networkSecurityGroup',
+    'defender-for-cloud': 'keyVaults',
+    'defender-for-iot': 'keyVaults',
+    'defender-easm': 'keyVaults',
+    'sentinel': 'keyVaults',
+    'information-protection': 'keyVaults',
+    'conditional-access': 'keyVaults',
+    'multifactor-authentication': 'keyVaults',
+    'identity-secure-score': 'keyVaults',
+    'security-center': 'keyVaults',
+    'azure-active-directory': 'keyVaults',
+    
+    // AI/ML
+    'cognitive-services': 'cognitiveServices',
+    'machine-learning': 'cognitiveServices',
+    
+    // Integration
+    'event-hubs': 'eventHubs',
+    'service-bus': 'serviceBus',
+    'event-grid': 'eventHubs',
+    'relay': 'serviceBus'
+  };
+
+  return serviceToType[node.data.service] || null;
+}
+
+// Helper function to suggest similar Azure services
+function getSuggestedAzureServices(serviceName: string): string {
+  const commonServices = [
+    'virtual-machines', 'storage-accounts', 'virtual-network', 'subnet',
+    'app-services', 'sql-database', 'cosmos-db', 'key-vaults',
+    'load-balancers', 'application-gateways', 'container-instances',
+    'kubernetes-services', 'function-apps', 'connections'
+  ];
+  
+  // Find similar services based on partial matches
+  const similar = commonServices.filter(service => 
+    service.includes(serviceName.toLowerCase()) || 
+    serviceName.toLowerCase().includes(service) ||
+    service.replace('-', '').includes(serviceName.toLowerCase().replace('-', ''))
+  );
+  
+  if (similar.length > 0) {
+    return `🔍 Did you mean: ${similar.slice(0, 3).join(', ')}?`;
+  }
+  
+  return `📋 Available services include: ${commonServices.slice(0, 5).join(', ')}, and more.`;
+}
+
+// Validate placement of an Azure resource
+export const validateAzurePlacement =(
+  node: Node,
+  parentNode: Node | null,
+  allNodes: Node[]
+): ValidationResult => {
+  // Only validate Azure resources
+  if (node.data?.cloudProvider !== 'azure') {
+    return { isValid: true };
+  }
+
+  const resourceType = getAzureResourceType(node);
+  const parentType = parentNode ? getAzureResourceType(parentNode) : null;
+
+  if (!resourceType) {
+    const serviceName = node.data?.service || 'unknown';
+    const suggestions = getSuggestedAzureServices(serviceName);
+    
+    return {
+      isValid: false,
+      message: `❌ Azure service "${serviceName}" is not recognized.\n\n${suggestions}\n\n💡 Try dragging from the Azure services panel on the left.`
+    };
+  }
+
+  // If no parent, only subscription is allowed at root
+  if (!parentNode && resourceType !== 'subscription') {
+    return {
+      isValid: false,
+      message: `🚫 Cannot place "${node.data?.service}" at root level.\n\n📋 Azure hierarchy requires:\n• Resources must be inside containers\n• Only Subscriptions can be at root level\n\n💡 Place this inside: Subscription → Resource Group → Virtual Network → Subnet`
+    };
+  }
+
+  // Check if the resource can be placed in the parent container
+  if (parentNode && parentType) {
+    const rules = containerRules[parentType];
+    if (!rules) {
+      return {
+        isValid: false,
+        message: getTranslatedMessage(
+          getCloudProviderMessageId('azure', 'invalid_parent_container'),
+          { parentType }
+        )
+      };
+    }
+
+    if (!rules.canContain.includes(resourceType)) {
+      const parentName = parentNode.data?.label || parentNode.data?.service || parentType;
+      const resourceName = node.data?.label || node.data?.service || resourceType;
+      
+      // Get what this parent CAN contain
+      const canContainList = rules.canContain.map(type => 
+        type.charAt(0).toUpperCase() + type.slice(1).replace(/([A-Z])/g, ' $1')
+      ).join(', ');
+      
+      // Get what this parent CANNOT contain (show only relevant ones)
+      const cannotContainList = ['virtualMachine', 'virtualNetwork', 'subnet', 'storageAccount', 'database']
+        .filter(type => !rules.canContain.includes(type))
+        .map(type => type.charAt(0).toUpperCase() + type.slice(1).replace(/([A-Z])/g, ' $1'))
+        .slice(0, 3)
+        .join(', ');
+      
+      return {
+        isValid: false,
+        message: `🚫 Cannot place "${resourceName}" inside "${parentName}"\n\n✅ ${parentName} CAN contain:\n• ${canContainList}\n\n❌ ${parentName} CANNOT contain:\n• ${cannotContainList}\n\n💡 ${getSuggestedContainer(resourceType)}`
+      };
+    }
+
+    // Check for specific placement rules
+    if (resourceType === 'virtualMachine' && parentType !== 'subnet') {
+      return {
+        isValid: false,
+        message: getTranslatedMessage(
+          getCloudProviderMessageId('azure', 'vm_must_be_in_subnet')
+        )
+      };
+    }
+  }
+
+  return { isValid: true };
+}
+
+// Helper function to suggest the correct container
+const getSuggestedContainer = (resourceType: AzureResourceType): string => {
+  const suggestions: Partial<Record<AzureResourceType, string>> = {
+    virtualMachine: 'Virtual Machines must be placed in a Subnet',
+    subnet: 'Subnets must be placed in a Virtual Network',
+    virtualNetwork: 'Virtual Networks must be placed in a Resource Group',
+    resourceGroup: 'Resource Groups must be placed in a Subscription',
+    storageAccount: 'Storage Accounts must be placed in a Resource Group',
+    appService: 'App Services must be placed in a Resource Group',
+    database: 'Databases must be placed in a Resource Group',
+    loadBalancer: 'Load Balancers must be placed in a Resource Group',
+    networkSecurityGroup: 'Network Security Groups must be placed in a Virtual Network',
+    routeTable: 'Route Tables must be placed in a Virtual Network',
+    vpnGateway: 'VPN Gateways must be placed in a Virtual Network',
+    applicationGateway: 'Application Gateways can be placed in a Virtual Network or Subnet',
+    networkInterface: 'Network Interfaces must be placed in a Subnet',
+    privateEndpoint: 'Private Endpoints must be placed in a Subnet',
+    subscription: 'Subscriptions must be placed at the root level'
+  };
+
+  return `Suggestion: ${suggestions[resourceType] || 'Check Azure documentation for placement requirements'}`;
+}
+
+// Validate the entire Azure diagram
+export const validateAzureDiagram = (nodes: Node[]): ValidationResult & { messages?: string[] } => {
+  const messages: string[] = [];
+
+  // Get all Azure nodes
+  const azureNodes = nodes.filter(node => node.data?.cloudProvider === 'azure');
+
+  // Validate each node
+  for (const node of azureNodes) {
+    const foundParentNode = node.parentNode 
+      ? nodes.find(n => n.id === node.parentNode)
+      : null;
+    const parentNode = foundParentNode || null;
+    
+    const validation = validateAzurePlacement(node, parentNode, nodes);
+    if (!validation.isValid && validation.message) {
+      messages.push(validation.message);
+    }
+  }
+
+  // Additional diagram-wide validations
+  const subscriptions = azureNodes.filter(
+    node => getAzureResourceType(node) === 'subscription'
+  );
+
+  // Check if there are multiple subscriptions
+  if (subscriptions.length > 1) {
+    messages.push(
+      getTranslatedMessage(getCloudProviderMessageId('azure', 'multiple_subscriptions'))
+    );
+  }
+
+  // Check for cross-region dependencies in resource groups
+  const resourceGroups = azureNodes.filter(
+    node => getAzureResourceType(node) === 'resourceGroup'
+  );
+
+  for (const rg of resourceGroups) {
+    const rgResources = azureNodes.filter(node => node.parentNode === rg.id);
+    const regions = new Set(rgResources.map(r => r.data?.region));
+    if (regions.size > 1) {
+      messages.push(
+        getTranslatedMessage(
+          getCloudProviderMessageId('azure', 'cross_region_resources'),
+          { resourceGroupName: rg.data?.label }
+        )
+      );
+    }
+  }
+
+  return {
+    isValid: messages.length === 0,
+    messages
+  };
 }