@intentius/chant-lexicon-aws 0.55.0 → 0.57.0

package/src/intrinsics.ts

@@ -2,6 +2,25 @@ import { INTRINSIC_MARKER, resolveIntrinsicValue, isIntrinsic, type Intrinsic }
 import { buildInterpolatedString, defaultInterpolationSerializer } from "@intentius/chant/intrinsic-interpolation";
 import { type Declarable } from "@intentius/chant/declarable";
 import { getLogicalName } from "@intentius/chant/utils";
+import { isCondition, type Condition } from "./condition";
+
+/**
+ * An operand allowed where CloudFormation expects a condition (#2068): a
+ * nested condition intrinsic (`Equals`/`And`/`Or`/`Not`), the `Condition`
+ * declarable itself, or a condition name string. The latter two both emit
+ * the `{ "Condition": "<name>" }` reference form.
+ */
+export type ConditionOperand = Intrinsic | Condition | string;
+
+function resolveConditionOperand(operand: ConditionOperand): unknown {
+  if (typeof operand === "string") {
+    return { Condition: operand };
+  }
+  if (isCondition(operand)) {
+    return { Condition: getLogicalName(operand) };
+  }
+  return resolveIntrinsicValue(operand);
+}
 
 /**
  * Fn::Sub intrinsic function implementation
@@ -99,29 +118,135 @@ export function GetAtt(logicalName: string, attribute: string): GetAttIntrinsic
  */
 export class IfIntrinsic implements Intrinsic {
   readonly [INTRINSIC_MARKER] = true as const;
-  private conditionName: string;
+  private conditionName: string | Condition;
   private valueIfTrue: unknown;
   private valueIfFalse: unknown;
 
-  constructor(conditionName: string, valueIfTrue: unknown, valueIfFalse: unknown) {
+  constructor(conditionName: string | Condition, valueIfTrue: unknown, valueIfFalse: unknown) {
     this.conditionName = conditionName;
     this.valueIfTrue = valueIfTrue;
     this.valueIfFalse = valueIfFalse;
   }
 
   toJSON(): { "Fn::If": [string, unknown, unknown] } {
-    return { "Fn::If": [this.conditionName, resolveIntrinsicValue(this.valueIfTrue), resolveIntrinsicValue(this.valueIfFalse)] };
+    const name = typeof this.conditionName === "string" ? this.conditionName : getLogicalName(this.conditionName);
+    return { "Fn::If": [name, resolveIntrinsicValue(this.valueIfTrue), resolveIntrinsicValue(this.valueIfFalse)] };
   }
 }
 
 
 /**
- * Create an If intrinsic
+ * Create an If intrinsic. The condition is a name string, or the `Condition`
+ * declarable itself (resolved to its logical name at serialization, #2068).
  */
-export function If(conditionName: string, valueIfTrue: unknown, valueIfFalse: unknown): IfIntrinsic {
+export function If(conditionName: string | Condition, valueIfTrue: unknown, valueIfFalse: unknown): IfIntrinsic {
   return new IfIntrinsic(conditionName, valueIfTrue, valueIfFalse);
 }
 
+/**
+ * Fn::Equals condition intrinsic (#2068).
+ * Compares two values; each may be a literal or a value intrinsic (Ref etc.).
+ */
+export class EqualsIntrinsic implements Intrinsic {
+  readonly [INTRINSIC_MARKER] = true as const;
+  private left: unknown;
+  private right: unknown;
+
+  constructor(left: unknown, right: unknown) {
+    this.left = left;
+    this.right = right;
+  }
+
+  toJSON(): { "Fn::Equals": [unknown, unknown] } {
+    return { "Fn::Equals": [resolveIntrinsicValue(this.left), resolveIntrinsicValue(this.right)] };
+  }
+}
+
+/**
+ * Create an Equals condition intrinsic: `Equals(Ref(cutover), "true")`.
+ */
+export function Equals(left: unknown, right: unknown): EqualsIntrinsic {
+  return new EqualsIntrinsic(left, right);
+}
+
+/**
+ * Fn::And condition intrinsic (#2068).
+ */
+export class AndIntrinsic implements Intrinsic {
+  readonly [INTRINSIC_MARKER] = true as const;
+  private conditions: ConditionOperand[];
+
+  constructor(conditions: ConditionOperand[]) {
+    this.conditions = conditions;
+  }
+
+  toJSON(): { "Fn::And": unknown[] } {
+    return { "Fn::And": this.conditions.map(resolveConditionOperand) };
+  }
+}
+
+/**
+ * Create an And condition intrinsic over 2–10 operands, each a nested
+ * condition intrinsic, a `Condition` declarable, or a condition name.
+ */
+export function And(...conditions: ConditionOperand[]): AndIntrinsic {
+  if (conditions.length < 2 || conditions.length > 10) {
+    throw new Error("And(...conditions): Fn::And takes between 2 and 10 conditions");
+  }
+  return new AndIntrinsic(conditions);
+}
+
+/**
+ * Fn::Or condition intrinsic (#2068).
+ */
+export class OrIntrinsic implements Intrinsic {
+  readonly [INTRINSIC_MARKER] = true as const;
+  private conditions: ConditionOperand[];
+
+  constructor(conditions: ConditionOperand[]) {
+    this.conditions = conditions;
+  }
+
+  toJSON(): { "Fn::Or": unknown[] } {
+    return { "Fn::Or": this.conditions.map(resolveConditionOperand) };
+  }
+}
+
+/**
+ * Create an Or condition intrinsic over 2–10 operands, each a nested
+ * condition intrinsic, a `Condition` declarable, or a condition name.
+ */
+export function Or(...conditions: ConditionOperand[]): OrIntrinsic {
+  if (conditions.length < 2 || conditions.length > 10) {
+    throw new Error("Or(...conditions): Fn::Or takes between 2 and 10 conditions");
+  }
+  return new OrIntrinsic(conditions);
+}
+
+/**
+ * Fn::Not condition intrinsic (#2068).
+ */
+export class NotIntrinsic implements Intrinsic {
+  readonly [INTRINSIC_MARKER] = true as const;
+  private condition: ConditionOperand;
+
+  constructor(condition: ConditionOperand) {
+    this.condition = condition;
+  }
+
+  toJSON(): { "Fn::Not": [unknown] } {
+    return { "Fn::Not": [resolveConditionOperand(this.condition)] };
+  }
+}
+
+/**
+ * Create a Not condition intrinsic over a nested condition intrinsic, a
+ * `Condition` declarable, or a condition name.
+ */
+export function Not(condition: ConditionOperand): NotIntrinsic {
+  return new NotIntrinsic(condition);
+}
+
 /**
  * Fn::Join intrinsic function
  * Joins values with a delimiter

package/src/lint/audit-catalog.ts

@@ -88,4 +88,5 @@ export const awsAuditCatalog: Record<string, RuleMeta> = {
   WAW066: auditRule("WAW066", "merge-worthy", "guidance", "Private subnet's route table has no working default route", "Add a 0.0.0.0/0 route to a NAT gateway/Transit Gateway that exists in the template.", { category: "correctness" }),
   WAW067: auditRule("WAW067", "report-only", "guidance", "Single-AZ NAT gateway serves multi-AZ private subnets", "Add one NAT gateway per Availability Zone and point each AZ's subnets at its own.", { category: "best-practice" }),
   WAW068: auditRule("WAW068", "report-only", "guidance", "VPN Gateway or Transit Gateway has only one attached VPN Connection", "Attach a second VPNConnection (ideally to a separate Customer Gateway) for redundancy.", { category: "best-practice" }),
+  WAW069: auditRule("WAW069", "merge-worthy", "guidance", "Template references a condition it never declares", "Declare the condition in the Conditions section (new Condition(...)), or fix the referenced name.", { category: "correctness" }),
 };

package/src/lint/post-synth/index.ts

@@ -60,6 +60,7 @@ import { waw065 } from "./waw065";
 import { waw066 } from "./waw066";
 import { waw067 } from "./waw067";
 import { waw068 } from "./waw068";
+import { waw069 } from "./waw069";
 
 export const postSynthChecks: PostSynthCheck[] = [
   cor020,
@@ -122,4 +123,5 @@ export const postSynthChecks: PostSynthCheck[] = [
   waw066,
   waw067,
   waw068,
+  waw069,
 ];

package/src/lint/post-synth/waw069.test.ts

@@ -0,0 +1,94 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw069, checkUndeclaredConditions } from "./waw069";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW069: Template references an undeclared condition", () => {
+  test("check metadata", () => {
+    expect(waw069.id).toBe("WAW069");
+    expect(waw069.description).toContain("condition");
+  });
+
+  test("resource Condition key referencing an undeclared condition → error", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Rule: { Type: "AWS::Logs::LogGroup", Condition: "DoCutover", Properties: { RetentionInDays: 7 } },
+      },
+    });
+    const diags = checkUndeclaredConditions(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW069");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].message).toContain("DoCutover");
+    expect(diags[0].entity).toBe("Rule");
+  });
+
+  test("Fn::If nested in properties referencing an undeclared condition → error", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Rule: {
+          Type: "AWS::Logs::LogGroup",
+          Properties: { LogGroupName: { "Fn::If": ["DoCutover", "/on", "/off"] } },
+        },
+      },
+    });
+    const diags = checkUndeclaredConditions(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("Fn::If");
+  });
+
+  test("output Condition key and Condition reference inside Conditions → error", () => {
+    const ctx = makeCtx({
+      Conditions: { NoCutover: { "Fn::Not": [{ Condition: "DoCutover" }] } },
+      Resources: { Rule: { Type: "AWS::Logs::LogGroup", Properties: {} } },
+      Outputs: { RuleName: { Condition: "AlsoMissing", Value: { Ref: "Rule" } } },
+    });
+    const diags = checkUndeclaredConditions(ctx);
+    expect(diags).toHaveLength(2);
+    const names = diags.map((d) => d.message);
+    expect(names.some((m) => m.includes('"DoCutover"'))).toBe(true);
+    expect(names.some((m) => m.includes('"AlsoMissing"'))).toBe(true);
+  });
+
+  test("declared conditions are quiet", () => {
+    const ctx = makeCtx({
+      Conditions: {
+        DoCutover: { "Fn::Equals": [{ Ref: "Cutover" }, "true"] },
+        NoCutover: { "Fn::Not": [{ Condition: "DoCutover" }] },
+      },
+      Resources: {
+        Rule: {
+          Type: "AWS::Logs::LogGroup",
+          Condition: "DoCutover",
+          Properties: { LogGroupName: { "Fn::If": ["DoCutover", "/on", "/off"] } },
+        },
+      },
+      Outputs: { RuleName: { Condition: "DoCutover", Value: { Ref: "Rule" } } },
+    });
+    expect(checkUndeclaredConditions(ctx)).toHaveLength(0);
+  });
+
+  test("an IAM policy Condition block is not a condition reference", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Role: {
+          Type: "AWS::IAM::Role",
+          Properties: {
+            AssumeRolePolicyDocument: {
+              Statement: [
+                {
+                  Effect: "Allow",
+                  Condition: { StringEquals: { "aws:SourceAccount": "123456789012" } },
+                },
+              ],
+            },
+          },
+        },
+      },
+    });
+    expect(checkUndeclaredConditions(ctx)).toHaveLength(0);
+  });
+});

package/src/plugin.test.ts

@@ -48,11 +48,15 @@ describe("awsPlugin", () => {
 
   test("returns intrinsics", () => {
     const intrinsics = awsPlugin.intrinsics!();
-    expect(intrinsics.length).toBe(9);
+    expect(intrinsics.length).toBe(13);
     const names = intrinsics.map((i) => i.name);
     expect(names).toContain("Sub");
     expect(names).toContain("Ref");
     expect(names).toContain("GetAtt");
+    expect(names).toContain("Equals");
+    expect(names).toContain("And");
+    expect(names).toContain("Or");
+    expect(names).toContain("Not");
   });
 
   test("returns pseudo-parameters", () => {

package/src/plugin.ts

@@ -111,6 +111,10 @@ export const awsPlugin: LexiconPlugin = {
       { name: "Split", description: "Fn::Split — split string by delimiter", isTag: false, foldsAsCall: true },
       { name: "Base64", description: "Fn::Base64 — encode to Base64", isTag: false, foldsAsCall: true },
       { name: "GetAZs", description: "Fn::GetAZs — list Availability Zones", isTag: false, foldsAsCall: true },
+      { name: "Equals", description: "Fn::Equals — condition comparing two values", isTag: false, foldsAsCall: true },
+      { name: "And", description: "Fn::And — condition conjunction", isTag: false, foldsAsCall: true },
+      { name: "Or", description: "Fn::Or — condition disjunction", isTag: false, foldsAsCall: true },
+      { name: "Not", description: "Fn::Not — condition negation", isTag: false, foldsAsCall: true },
     ];
   },
 

package/src/serializer.ts

@@ -19,8 +19,9 @@ import type { LexiconOutput } from "@intentius/chant/lexicon-output";
 import { walkValue, type SerializerVisitor } from "@intentius/chant/serializer-walker";
 import { isChildProject, type ChildProjectInstance } from "@intentius/chant/child-project";
 import { isStackOutput, type StackOutput } from "@intentius/chant/stack-output";
-import { isAttrRefLike } from "@intentius/chant/utils";
+import { isAttrRefLike, getLogicalName } from "@intentius/chant/utils";
 import { resolveDependsOn } from "@intentius/chant/resource-attributes";
+import { isCondition } from "./condition";
 import { isDefaultTags, type TagEntry } from "./default-tags";
 import { isTemplateTransform } from "./template-transform";
 import { loadTaggableResources } from "./taggable";
@@ -41,6 +42,7 @@ interface CFTemplate {
   Metadata?: Record<string, unknown>;
   Transform?: string | string[];
   Parameters?: Record<string, CFParameter>;
+  Conditions?: Record<string, unknown>;
   Resources: Record<string, CFResource>;
   Outputs?: Record<string, CFOutput>;
 }
@@ -347,6 +349,13 @@ function serializeToTemplate(
       }
 
       template.Parameters[name] = param;
+    } else if (isCondition(entity)) {
+      // Condition declarable → Conditions section (#2068), lifted the way
+      // Parameter is lifted into Parameters above.
+      if (!template.Conditions) {
+        template.Conditions = {};
+      }
+      template.Conditions[name] = toCFValue(entity.expression, entityNames);
     } else if (isChildProject(entity)) {
       // ChildProjectInstance → AWS::CloudFormation::Stack resource
       const childProject = entity as ChildProjectInstance;
@@ -396,8 +405,13 @@ function serializeToTemplate(
             resource.DependsOn = resolved.length === 1 ? resolved[0] : resolved;
           }
         }
-        // Pass-through attributes
-        if (attrs.Condition) resource.Condition = attrs.Condition as string;
+        // Pass-through attributes. Condition accepts the Condition declarable
+        // as well as a name string (#2068).
+        if (attrs.Condition) {
+          resource.Condition = isCondition(attrs.Condition)
+            ? entityNames.get(attrs.Condition) ?? getLogicalName(attrs.Condition)
+            : attrs.Condition as string;
+        }
         if (attrs.DeletionPolicy) resource.DeletionPolicy = attrs.DeletionPolicy as string;
         if (attrs.UpdateReplacePolicy) resource.UpdateReplacePolicy = attrs.UpdateReplacePolicy as string;
         if (attrs.UpdatePolicy) resource.UpdatePolicy = attrs.UpdatePolicy;
@@ -471,6 +485,13 @@ function serializeToTemplate(
       if (exportName) {
         output.Export = { Name: exportName };
       }
+      // Same defensive read: condition (#2068/#2069) postdates older cores.
+      const condition = (stackOutput as { condition?: unknown }).condition;
+      if (condition) {
+        output.Condition = isCondition(condition)
+          ? entityNames.get(condition) ?? getLogicalName(condition)
+          : condition as string;
+      }
       template.Outputs[name] = output;
     }
   }

package/src/testdata/roundtrip/with-conditions.json

@@ -0,0 +1,16 @@
+{
+  "AWSTemplateFormatVersion": "2010-09-09",
+  "Parameters": { "Cutover": { "Type": "String", "Default": "false", "AllowedValues": ["true", "false"] } },
+  "Conditions": {
+    "DoCutover": { "Fn::Equals": [ { "Ref": "Cutover" }, "true" ] },
+    "NoCutover": { "Fn::Not": [ { "Condition": "DoCutover" } ] }
+  },
+  "Resources": {
+    "Rule": {
+      "Type": "AWS::Logs::LogGroup",
+      "Condition": "DoCutover",
+      "Properties": { "LogGroupName": { "Fn::If": [ "DoCutover", "/cut/on", "/cut/off" ] }, "RetentionInDays": 7 }
+    }
+  },
+  "Outputs": { "RuleName": { "Condition": "DoCutover", "Value": { "Ref": "Rule" } } }
+}