@intentius/chant-lexicon-aws 0.124.52 → 0.124.54

package/src/components/demo-composed-stacks-floci.e2e.test.ts

@@ -0,0 +1,235 @@
+/**
+ * `examples/demo-composed-stacks` through the pull-request loop against
+ * Floci (#4448): each scenario from a fresh base, through `chant
+ * components pr-plan`, one approval and `chant components pr-apply`, as
+ * #4430 ran them by hand.
+ *
+ * - The edit act: every value known at plan, one approval, pr-apply exits 0,
+ *   and any round after an upstream applied is covered by that approval.
+ * - The create act: app's read of network's new `SubnetBId` is known after
+ *   apply, one approval, pr-apply exits 0, the round that plans app again is
+ *   `covered` with `filledInputs` naming the id, and app's parameter holds
+ *   network's real subnet id, and so does edge's, through app's
+ *   `WorkerSubnetId` output.
+ * - The imports act (#4466): the stacks read each other only through
+ *   `Fn::ImportValue`. pr-plan orders them by the imports and lists both
+ *   as known after apply, one approval covers both rounds, and edge holds
+ *   the id of the interface app created in network's new subnet.
+ *
+ * Each act copies the example with its stack names and SSM names made the
+ * run's own, builds the templates with the example's `npm run build`, and
+ * deletes its stacks after. Set CHANT_FLOCI_ENDPOINT to a running Floci, for
+ * example `docker run -d -p 4611:4566 floci/floci` and
+ * `CHANT_FLOCI_ENDPOINT=http://localhost:4611`; the `aws` CLI must be on
+ * PATH. Skipped otherwise, with the reason named.
+ */
+
+import { execFileSync } from "node:child_process";
+import { join } from "node:path";
+import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import type { PrMember, PrReport } from "@intentius/chant/pr-loop";
+import { openScenarioLoop, type ScenarioLoop } from "@intentius/chant-test-utils/pr-loop-harness";
+import { awsPlugin } from "../plugin";
+
+const REPO = join(import.meta.dirname, "..", "..", "..", "..");
+const EXAMPLE = join(REPO, "examples", "demo-composed-stacks");
+const TIMEOUT = 900_000;
+const STACKS = ["network", "app", "edge"];
+
+const endpoint = process.env.CHANT_FLOCI_ENDPOINT?.replace(/\/+$/, "");
+function hasAwsCli(): boolean {
+  try {
+    execFileSync("aws", ["--version"], { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+const missing = !endpoint
+  ? "CHANT_FLOCI_ENDPOINT is not set (for example `docker run -d -p 4611:4566 floci/floci` and CHANT_FLOCI_ENDPOINT=http://localhost:4611)"
+  : !hasAwsCli()
+    ? "the aws CLI is not on PATH"
+    : undefined;
+
+const aws = (...args: string[]): unknown => JSON.parse(execFileSync("aws", ["--endpoint-url", endpoint!, "--output", "json", ...args], { encoding: "utf8" }) || "{}");
+
+interface Stack {
+  Outputs?: { OutputKey: string; OutputValue: string }[];
+  Parameters?: { ParameterKey: string; ParameterValue: string }[];
+}
+const stack = (name: string): Stack => (aws("cloudformation", "describe-stacks", "--stack-name", name) as { Stacks: Stack[] }).Stacks[0]!;
+const ssm = (name: string): string => (aws("ssm", "get-parameter", "--name", name) as { Parameter: { Value: string } }).Parameter.Value;
+const byComponent = (r: PrReport): Record<string, PrMember> => Object.fromEntries(r.members.map((m) => [m.component, m]));
+// The report lists members by the change set's order, which the report does
+// not define as dependency order; `selection.waves` holds that.
+const statuses = (r: PrReport): string[][] => r.members.map((m) => [m.component, m.status]).sort(([a], [b]) => a!.localeCompare(b!));
+const total = (r: PrReport, action: "create" | "update" | "replace" | "delete"): number => r.members.reduce((n, m) => n + m.counts[action], 0);
+
+/**
+ * The example's names made this run's own: the CloudFormation stack each
+ * component deploys (and `stacks[]`, which names the same stacks), and the
+ * SSM parameter paths and tags. Component names, and so `stackOutput` reads,
+ * stay as they are.
+ */
+function rewrite(id: string) {
+  return (rel: string, text: string): string => {
+    let out = text.replaceAll("chant-compose", id);
+    if (rel === "chant.config.ts") out = out.replace(/name: "(network|app|edge)", src:/g, `name: "${id}-$1", src:`);
+    if (rel.endsWith(".component.ts")) out = out.replace(/(kind: "cfn-deploy",\s*stack: ")(network|app|edge)"/g, `$1${id}-$2"`);
+    return out;
+  };
+}
+
+function actSuite(scenario: string, tests: (ctx: { loop: () => ScenarioLoop; id: string }) => void): void {
+  describe.skipIf(missing !== undefined)(`demo-composed-stacks, ${scenario}, on Floci${missing ? `: skipped, ${missing}` : ""}`, () => {
+    const id = `cs-${scenario.replace("chant-compose-", "")}-${Date.now().toString(36)}`;
+    let loop: ScenarioLoop | undefined;
+
+    beforeAll(async () => {
+      loop = await openScenarioLoop({
+        example: EXAMPLE,
+        repo: REPO,
+        plugins: [awsPlugin],
+        env: "demo",
+        rewrite: rewrite(id),
+        // The templates, as the pipeline's "Build the templates" step builds them.
+        prepare: (dir) => void execFileSync("npm", ["run", "build"], { cwd: dir, encoding: "utf8" }),
+        processEnv: { AWS_ENDPOINT_URL: endpoint!, AWS_ACCESS_KEY_ID: "test", AWS_SECRET_ACCESS_KEY: "test", AWS_REGION: "us-east-1", AWS_DEFAULT_REGION: "us-east-1" },
+      });
+      // The base, as the demo host applies it before a scenario.
+      expect(await loop.applyBase()).toBe(0);
+      // describe-stacks throws on a stack the base did not create.
+      for (const s of STACKS) stack(`${id}-${s}`);
+    }, TIMEOUT);
+
+    afterAll(async () => {
+      await loop?.close();
+      for (const s of [...STACKS].reverse()) {
+        try {
+          aws("cloudformation", "delete-stack", "--stack-name", `${id}-${s}`);
+        } catch {
+          // never created
+        }
+      }
+    });
+
+    tests({ loop: () => loop!, id });
+  });
+}
+
+actSuite("chant-compose-edit", ({ loop, id }) => {
+  test("one pr-plan digest over the three stacks, every value known at plan", async () => {
+    const { code, report: plan } = await loop().open(1, "chant-compose-edit");
+    expect(code).toBe(0);
+    expect(plan.status).toBe("planned");
+    expect([...plan.selection.changed].sort()).toEqual(["app", "edge", "network"]);
+    expect(plan.selection.waves).toEqual([["network"], ["app"], ["edge"]]);
+    expect(statuses(plan)).toEqual([
+      ["app", "planned"],
+      ["edge", "planned"],
+      ["network", "planned"],
+    ]);
+    for (const m of plan.members) expect(m.unknownInputs).toBeUndefined();
+    expect([total(plan, "create"), total(plan, "update"), total(plan, "delete")]).toEqual([3, 3, 0]);
+    expect(plan.changeSet.digest).toBe(plan.digest);
+    expect(plan.approval).toEqual({ status: "pending" });
+  }, TIMEOUT);
+
+  test("one approval, and pr-apply exits 0: no round asks for an approval of its own", async () => {
+    const plan = loop().report("plan");
+    await loop().approve(1, "pr-apply", plan.digest);
+    expect(await loop().merge(1)).toBe(0);
+    const applied = loop().report("apply");
+    expect(applied.digest).toBe(plan.digest);
+    expect(applied.status).toBe("applied");
+    for (const r of applied.rounds ?? []) {
+      expect(r.status).toBe("applied");
+      expect(r.covered?.digest).toBe(plan.digest);
+    }
+    expect(statuses(applied)).toEqual([
+      ["app", "applied"],
+      ["edge", "applied"],
+      ["network", "applied"],
+    ]);
+    expect(ssm(`/${id}/upstream`)).toBe("http://app:8090");
+    expect(ssm(`/${id}/admin-upstream`)).toBe("http://app:9000");
+  }, TIMEOUT);
+});
+
+actSuite("chant-compose-create", ({ loop, id }) => {
+  test("one pr-plan digest, app's and edge's reads of the new subnet id known after apply", async () => {
+    const { code, report: plan } = await loop().open(1, "chant-compose-create");
+    expect(code).toBe(0);
+    expect(plan.status).toBe("planned");
+    const m = byComponent(plan);
+    expect(m.app!.unknownInputs).toEqual(["network.SubnetBId"]);
+    expect(m.app!.reads?.find((r) => r.upstream === "network")?.unknown).toEqual(["SubnetBId"]);
+    // edge reads app's ListenerPort, which the preview knows, and app's WorkerSubnetId, which it does not.
+    expect(m.edge!.unknownInputs).toEqual(["app.WorkerSubnetId"]);
+    expect(m.edge!.reads?.find((r) => r.upstream === "app")?.unknown).toEqual(["WorkerSubnetId"]);
+    expect([total(plan, "create"), total(plan, "update"), total(plan, "delete")]).toEqual([3, 1, 0]);
+    expect(plan.approval).toEqual({ status: "pending" });
+  }, TIMEOUT);
+
+  test("one approval, and pr-apply exits 0: the round is covered with filledInputs, and app and edge hold the real id", async () => {
+    const plan = loop().report("plan");
+    await loop().approve(1, "pr-apply", plan.digest);
+    expect(await loop().merge(1)).toBe(0);
+    const applied = loop().report("apply");
+    expect(applied.digest).toBe(plan.digest);
+    expect(applied.status).toBe("applied");
+    const rounds = applied.rounds ?? [];
+    for (const r of rounds) expect(r.status).toBe("applied");
+    const filled = rounds.find((r) => r.components.includes("app"));
+    expect(filled?.covered?.digest).toBe(plan.digest);
+    expect(filled?.covered?.filledInputs).toContain("network.SubnetBId");
+    expect(filled?.notCovered).toBeUndefined();
+    const edgeRound = rounds.find((r) => r.components.includes("edge"));
+    expect(edgeRound?.covered?.digest).toBe(plan.digest);
+    expect(edgeRound?.covered?.filledInputs).toContain("app.WorkerSubnetId");
+
+    const subnetB = stack(`${id}-network`).Outputs?.find((o) => o.OutputKey === "SubnetBId")?.OutputValue;
+    expect(subnetB).toMatch(/^subnet-/);
+    expect(stack(`${id}-app`).Parameters?.find((p) => p.ParameterKey === "appSubnetBId")?.ParameterValue).toBe(subnetB);
+    expect(stack(`${id}-edge`).Parameters?.find((p) => p.ParameterKey === "edgeWorkerSubnetId")?.ParameterValue).toBe(subnetB);
+    expect(ssm(`/${id}/worker-subnet`)).toBe(subnetB);
+    expect(ssm(`/${id}/allowlist`)).toBe("10.0.1.0/24,10.0.2.0/24");
+  }, TIMEOUT);
+});
+
+actSuite("chant-compose-imports", ({ loop, id }) => {
+  test("one pr-plan digest: the imports in the templates order the stacks, and both are known after apply (#4466)", async () => {
+    const { code, report: plan } = await loop().open(1, "chant-compose-imports");
+    expect(code).toBe(0);
+    expect(plan.status).toBe("planned");
+    expect(plan.selection.waves).toEqual([["network"], ["app"], ["edge"]]);
+    const m = byComponent(plan);
+    expect(m.app!.unknownInputs).toEqual(["network.SubnetCId"]);
+    expect(m.app!.reads?.find((r) => r.upstream === "network")?.unknown).toEqual(["SubnetCId"]);
+    expect(m.edge!.unknownInputs).toEqual(["app.ImportsInterfaceId"]);
+    expect(m.edge!.reads?.find((r) => r.upstream === "app")?.unknown).toEqual(["ImportsInterfaceId"]);
+    expect([total(plan, "create"), total(plan, "update"), total(plan, "delete")]).toEqual([3, 0, 0]);
+    expect(plan.approval).toEqual({ status: "pending" });
+  }, TIMEOUT);
+
+  test("one approval, and pr-apply exits 0: both rounds are covered, and edge records the interface app put in subnet c", async () => {
+    const plan = loop().report("plan");
+    await loop().approve(1, "pr-apply", plan.digest);
+    expect(await loop().merge(1)).toBe(0);
+    const applied = loop().report("apply");
+    expect(applied.digest).toBe(plan.digest);
+    expect(applied.status).toBe("applied");
+    const rounds = applied.rounds ?? [];
+    for (const r of rounds) expect(r.status).toBe("applied");
+    const appRound = rounds.find((r) => r.components.includes("app"));
+    expect(appRound?.covered?.digest).toBe(plan.digest);
+    expect(appRound?.covered?.filledInputs).toContain("network.SubnetCId");
+    const edgeRound = [...rounds].reverse().find((r) => r.components.includes("edge"));
+    expect(edgeRound?.covered?.digest).toBe(plan.digest);
+    expect(edgeRound?.covered?.filledInputs).toContain("app.ImportsInterfaceId");
+
+    const iface = stack(`${id}-app`).Outputs?.find((o) => o.OutputKey === "ImportsInterfaceId")?.OutputValue;
+    expect(iface).toMatch(/^eni-/);
+    expect(ssm(`/${id}/imports-interface`)).toBe(iface);
+  }, TIMEOUT);
+});

package/src/derived-edges.test.ts

@@ -0,0 +1,142 @@
+/**
+ * #4522 on the aws lexicon: the reference catalog over an indexed fixture
+ * with a known topology (instance, security group, subnet, route table,
+ * internet gateway), in Cloud Control's CloudFormation property shape.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+import type { GraphIR, IREdge } from "@intentius/chant/graph-ir";
+import { typeListing, type ListingLexicon, type ListingResult } from "@intentius/chant/lifecycle/type-listing";
+import { deriveEdges } from "@intentius/chant/lifecycle/derive-edges";
+import { CapabilityEngine } from "@intentius/chant/capabilities/matcher";
+import { buildView, displayName } from "@intentius/chant/capabilities/view";
+import { resolvePacks, shippedRules } from "@intentius/chant/capabilities/catalog";
+import { awsCapabilityPack } from "./capabilities/pack";
+import { awsKindForListedType } from "./listed-types";
+import { awsReferenceCatalog } from "./reference-catalog";
+import { awsPlugin } from "./plugin";
+
+const here = import.meta.dirname;
+const surface = JSON.parse(readFileSync(join(here, "..", "surface.snapshot.json"), "utf-8")) as {
+  entries: Record<string, { kind: string; resourceType: string }>;
+};
+const KINDS: ReadonlySet<string> = new Set(
+  Object.values(surface.entries).filter((e) => e.kind === "resource").map((e) => e.resourceType),
+);
+const listing = JSON.parse(readFileSync(join(here, "testdata", "indexed", "topology.listing.json"), "utf-8")) as ListingResult;
+
+const aws: ListingLexicon = {
+  name: awsPlugin.name,
+  deepNormalizationHooks: awsPlugin.deepNormalizationHooks,
+  listedTypes: { ...awsPlugin.listedTypes!, kindFor: (t) => awsKindForListedType(t, KINDS) },
+};
+const doc = deriveEdges(typeListing(listing, [aws]), [{ name: "aws", referenceCatalog: awsPlugin.referenceCatalog }]);
+const short = (e: IREdge) => `${displayName(e.from)} -> ${displayName(e.to)} [${e.viaAttr}] ${e.relation}`;
+
+// Hand-checked against the fixture. displayName keeps the native id's last
+// path segment, so the route `rtb-0pub|0.0.0.0/0` reads as `0`.
+const EXPECTED = [
+  "IGW|vpc-0a1 -> igw-0a1 [InternetGatewayId] reference",
+  "IGW|vpc-0a1 -> vpc-0a1 [VpcId] reference",
+  "i-0batch -> sg-0web [SecurityGroupIds] reference",
+  "i-0batch -> subnet-0priv [SubnetId] containment",
+  "i-0web -> sg-0web [SecurityGroupIds] reference",
+  "i-0web -> subnet-0pub [SubnetId] containment",
+  "0 -> igw-0a1 [GatewayId] reference",
+  "0 -> rtb-0pub [RouteTableId] reference",
+  "rtb-0pub -> vpc-0a1 [VpcId] containment",
+  "rtbassoc-0pub -> rtb-0pub [RouteTableId] reference",
+  "rtbassoc-0pub -> subnet-0pub [SubnetId] reference",
+  "sg-0db -> sg-0web [SecurityGroupIngress] reference",
+  "sg-0db -> vpc-0a1 [VpcId] containment",
+  "sg-0web -> vpc-0a1 [VpcId] containment",
+  "subnet-0priv -> vpc-0a1 [VpcId] containment",
+  "subnet-0pub -> shop [Tags] reference",
+  "subnet-0pub -> vpc-0a1 [VpcId] containment",
+].sort();
+
+describe("derived edges over the aws topology fixture", () => {
+  it("produces the topology's edges, each labelled derived with its rule", () => {
+    expect(doc.graph.edges.map(short).sort()).toEqual(EXPECTED);
+    for (const e of doc.graph.edges) {
+      expect(e.origin).toBe("derived");
+      expect(e.grain).toBe("property");
+      expect(e.rule).toMatch(/^aws:AWS::[A-Za-z0-9]+::[A-Za-z0-9]+:/);
+    }
+    expect(doc.graph.dangling).toBeUndefined();
+    expect((doc.notes ?? []).filter((n) => n.kind === "ambiguous-reference" || n.kind === "no-catalog")).toEqual([]);
+  });
+
+  it("names the rule that drew each edge", () => {
+    const rules = new Set(doc.graph.edges.map((e) => e.rule));
+    expect(rules).toContain("aws:AWS::EC2::Instance:SubnetId");
+    expect(rules).toContain("aws:AWS::EC2::Route:GatewayId");
+    expect(rules).toContain("aws:AWS::EC2::VPCGatewayAttachment:InternetGatewayId");
+    expect(rules).toContain("aws:AWS::EC2::SecurityGroup:SecurityGroupIngress[].SourceSecurityGroupId");
+    expect(rules).toContain("aws:AWS::EC2::Subnet:tag:kubernetes.io/cluster/");
+  });
+
+  it("boxes subnets, route tables and security groups in their VPC", () => {
+    const vpc = doc.graph.nodes.find((n) => n.nativeId === "vpc-0a1")!.id;
+    expect(doc.graph.groups.byContainer?.[vpc]?.map(displayName).sort()).toEqual(["rtb-0pub", "sg-0db", "sg-0web", "subnet-0priv", "subnet-0pub"]);
+  });
+
+  it("internet-reachable answers the same over the index as over the declared graph", () => {
+    const n = (id: string, kind: string, attrs: Record<string, unknown>) => ({ id, kind, lexicon: "aws", attrs });
+    const ref = (from: string, to: string, viaAttr: string): IREdge => ({ from, to, kind: "ref", viaAttr });
+    // The same estate as CloudFormation source declares it: references are AttrRefs, named by property.
+    const declared: GraphIR = {
+      nodes: [
+        n("vpc-0a1", "AWS::EC2::VPC", { CidrBlock: "10.0.0.0/16" }),
+        n("subnet-0pub", "AWS::EC2::Subnet", { CidrBlock: "10.0.1.0/24" }),
+        n("subnet-0priv", "AWS::EC2::Subnet", { CidrBlock: "10.0.2.0/24" }),
+        n("igw-0a1", "AWS::EC2::InternetGateway", {}),
+        n("rtb-0pub", "AWS::EC2::RouteTable", {}),
+        n("route", "AWS::EC2::Route", { DestinationCidrBlock: "0.0.0.0/0" }),
+        n("rtbassoc-0pub", "AWS::EC2::SubnetRouteTableAssociation", {}),
+        n("sg-0web", "AWS::EC2::SecurityGroup", { GroupDescription: "web", SecurityGroupIngress: [{ IpProtocol: "tcp", FromPort: 22, ToPort: 22, CidrIp: "0.0.0.0/0" }] }),
+        n("i-0web", "AWS::EC2::Instance", { ImageId: "ami-0abc", InstanceType: "t3.micro" }),
+        n("i-0batch", "AWS::EC2::Instance", { ImageId: "ami-0abc", InstanceType: "t3.micro" }),
+      ],
+      edges: [
+        ref("subnet-0pub", "vpc-0a1", "VpcId"),
+        ref("subnet-0priv", "vpc-0a1", "VpcId"),
+        ref("rtb-0pub", "vpc-0a1", "VpcId"),
+        ref("route", "rtb-0pub", "RouteTableId"),
+        ref("route", "igw-0a1", "GatewayId"),
+        ref("rtbassoc-0pub", "subnet-0pub", "SubnetId"),
+        ref("rtbassoc-0pub", "rtb-0pub", "RouteTableId"),
+        ref("sg-0web", "vpc-0a1", "VpcId"),
+        ref("i-0web", "subnet-0pub", "SubnetId"),
+        ref("i-0web", "sg-0web", "SecurityGroupIds"),
+        ref("i-0batch", "subnet-0priv", "SubnetId"),
+        ref("i-0batch", "sg-0web", "SecurityGroupIds"),
+      ],
+      groups: {},
+    };
+    const answer = (g: GraphIR) => {
+      const e = new CapabilityEngine(buildView(g, resolvePacks([awsCapabilityPack])), shippedRules().rules);
+      return [...e.set("internet-reachable", e.bind("internet-reachable", [] as never)).keys()].map(displayName).sort();
+    };
+    expect(answer(declared)).toEqual(["i-0web"]);
+    expect(answer(doc.graph)).toEqual(answer(declared));
+  });
+});
+
+describe("the aws catalog over indexed nodes", () => {
+  it("gives every untargeted rule a target kind for indexed nodes, and keeps it untargeted for enrichLiveAttrs", () => {
+    const untargeted = awsReferenceCatalog.refs.filter((r) => r.targetKind === undefined);
+    expect(untargeted).toHaveLength(19);
+    expect(untargeted.filter((r) => r.indexedTargetKind === undefined)).toEqual([]);
+  });
+
+  it("keys every identity and target to a kind the lexicon has", () => {
+    const kinds = [
+      ...awsReferenceCatalog.identities.map((i) => i.kind),
+      ...awsReferenceCatalog.refs.flatMap((r) => [r.from, r.targetKind ?? r.indexedTargetKind!]),
+      ...(awsReferenceCatalog.tagRefs ?? []).map((r) => r.targetKind),
+    ];
+    expect([...new Set(kinds)].filter((k) => !KINDS.has(k))).toEqual([]);
+  });
+});