@intentius/chant-lexicon-azure 0.124.30 → 0.124.32

package/dist/lint/post-synth/azr031.js

@@ -0,0 +1,36 @@
+/**
+ * AZR031: Policy Assignment Not Enforced
+ *
+ * Flags Microsoft.Authorization/policyAssignments with enforcementMode
+ * DoNotEnforce. The assignment stays visible in the tree while denying
+ * nothing — the Azure shape of a disabled guardrail.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+export const azr031 = {
+    id: "AZR031",
+    description: "Policy assignment has enforcementMode DoNotEnforce — the guardrail is disabled",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== "Microsoft.Authorization/policyAssignments")
+                    continue;
+                const mode = resource.properties?.enforcementMode;
+                if (mode !== "DoNotEnforce")
+                    continue;
+                const name = typeof resource.name === "string" ? resource.name : String(resource.name);
+                diagnostics.push({
+                    checkId: "AZR031",
+                    severity: "error",
+                    message: `Policy assignment "${name}" has enforcementMode DoNotEnforce — the guardrail is assigned but enforces nothing`,
+                    entity: name,
+                    lexicon: "azure",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr032.js

@@ -0,0 +1,53 @@
+/**
+ * AZR032: Policy Definition Assigned Nowhere
+ *
+ * Flags custom Microsoft.Authorization/policyDefinitions with no
+ * policyAssignments referencing them in the same template. The
+ * GovernanceBaseline composite always pairs definition and assignment; a
+ * definition alone is the leftover of a dropped guardrail assignment.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+/**
+ * True when a policyDefinitionId expression targets the definition name —
+ * either a quoted literal inside resourceId()/managementGroupResourceId()
+ * or the trailing segment of a literal resource id.
+ */
+function references(definitionName, policyDefinitionId) {
+    if (typeof policyDefinitionId !== "string")
+        return false;
+    return (policyDefinitionId.includes(`'${definitionName}'`) ||
+        policyDefinitionId.endsWith(`/${definitionName}`) ||
+        policyDefinitionId === definitionName);
+}
+export const azr032 = {
+    id: "AZR032",
+    description: "Custom policy definition assigned nowhere — a defined but unassigned guardrail enforces nothing",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            const assignmentIds = template.resources
+                .filter((r) => r.type === "Microsoft.Authorization/policyAssignments")
+                .map((r) => r.properties?.policyDefinitionId);
+            for (const resource of template.resources) {
+                if (resource.type !== "Microsoft.Authorization/policyDefinitions")
+                    continue;
+                if (typeof resource.name !== "string")
+                    continue;
+                const name = resource.name;
+                if (assignmentIds.some((id) => references(name, id)))
+                    continue;
+                diagnostics.push({
+                    checkId: "AZR032",
+                    severity: "error",
+                    message: `Policy definition "${name}" is assigned nowhere in this template — pair it with a policy assignment or the guardrail enforces nothing`,
+                    entity: name,
+                    lexicon: "azure",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr033.js

@@ -0,0 +1,35 @@
+/**
+ * AZR033: Subscriptions May Leave the Tenant
+ *
+ * Flags a Microsoft.Subscription/policies resource that sets
+ * blockSubscriptionsLeavingTenant to false — the tenant-level leave-block
+ * the landing-zone foundation declares, explicitly weakened.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+export const azr033 = {
+    id: "AZR033",
+    description: "Tenant subscription policy does not block subscriptions from leaving",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== "Microsoft.Subscription/policies")
+                    continue;
+                if (resource.properties?.blockSubscriptionsLeavingTenant !== false)
+                    continue;
+                const name = typeof resource.name === "string" ? resource.name : String(resource.name);
+                diagnostics.push({
+                    checkId: "AZR033",
+                    severity: "error",
+                    message: `Subscription tenant policy "${name}" sets blockSubscriptionsLeavingTenant: false — subscriptions can be moved out of the tenant`,
+                    entity: name,
+                    lexicon: "azure",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/index.js

@@ -0,0 +1,50 @@
+import { azr010 } from "./azr010.js";
+import { azr011 } from "./azr011.js";
+import { azr012 } from "./azr012.js";
+import { azr013 } from "./azr013.js";
+import { azr014 } from "./azr014.js";
+import { azr015 } from "./azr015.js";
+import { azr016 } from "./azr016.js";
+import { azr017 } from "./azr017.js";
+import { azr018 } from "./azr018.js";
+import { azr019 } from "./azr019.js";
+import { azr020 } from "./azr020.js";
+import { azr021 } from "./azr021.js";
+import { azr022 } from "./azr022.js";
+import { azr023 } from "./azr023.js";
+import { azr024 } from "./azr024.js";
+import { azr025 } from "./azr025.js";
+import { azr026 } from "./azr026.js";
+import { azr027 } from "./azr027.js";
+import { azr028 } from "./azr028.js";
+import { azr029 } from "./azr029.js";
+import { azr030 } from "./azr030.js";
+import { azr031 } from "./azr031.js";
+import { azr032 } from "./azr032.js";
+import { azr033 } from "./azr033.js";
+export const postSynthChecks = [
+    azr010,
+    azr011,
+    azr012,
+    azr013,
+    azr014,
+    azr015,
+    azr016,
+    azr017,
+    azr018,
+    azr019,
+    azr020,
+    azr021,
+    azr022,
+    azr023,
+    azr024,
+    azr025,
+    azr026,
+    azr027,
+    azr028,
+    azr029,
+    azr030,
+    azr031,
+    azr032,
+    azr033,
+];

package/dist/lint/rules/hardcoded-location.js

@@ -0,0 +1,82 @@
+import { ts } from "@intentius/chant/lint/typescript";
+/**
+ * AZR001: Hardcoded Azure Location
+ *
+ * Detects hardcoded Azure location strings in code.
+ * Locations should use Azure.ResourceGroupLocation pseudo-parameter instead.
+ */
+export const hardcodedLocationRule = {
+    id: "AZR001",
+    severity: "warning",
+    category: "correctness",
+    description: "Detects hardcoded Azure location strings — use Azure.ResourceGroupLocation instead",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        // Common Azure location strings (case-insensitive match)
+        const azureLocations = new Set([
+            "eastus",
+            "eastus2",
+            "westus",
+            "westus2",
+            "westus3",
+            "centralus",
+            "northcentralus",
+            "southcentralus",
+            "westcentralus",
+            "canadacentral",
+            "canadaeast",
+            "brazilsouth",
+            "northeurope",
+            "westeurope",
+            "uksouth",
+            "ukwest",
+            "francecentral",
+            "francesouth",
+            "switzerlandnorth",
+            "switzerlandwest",
+            "germanywestcentral",
+            "norwayeast",
+            "norwaywest",
+            "swedencentral",
+            "eastasia",
+            "southeastasia",
+            "japaneast",
+            "japanwest",
+            "australiaeast",
+            "australiasoutheast",
+            "australiacentral",
+            "koreacentral",
+            "koreasouth",
+            "southafricanorth",
+            "southafricawest",
+            "uaenorth",
+            "uaecentral",
+            "centralindia",
+            "southindia",
+            "westindia",
+            "qatarcentral",
+            "polandcentral",
+            "italynorth",
+        ]);
+        function visit(node) {
+            if (ts.isStringLiteral(node)) {
+                const value = node.text.toLowerCase();
+                if (azureLocations.has(value)) {
+                    const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                    diagnostics.push({
+                        file: sourceFile.fileName,
+                        line: line + 1,
+                        column: character + 1,
+                        ruleId: "AZR001",
+                        severity: "warning",
+                        message: `Hardcoded location "${node.text}" detected. Use Azure.ResourceGroupLocation instead.`,
+                    });
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/index.js

@@ -0,0 +1,6 @@
+/**
+ * Azure-specific lint rules for chant projects
+ */
+export { hardcodedLocationRule } from "./hardcoded-location.js";
+export { storageHttpsRule } from "./storage-https.js";
+export { nsgWildcardRule } from "./nsg-wildcard.js";

package/dist/lint/rules/nsg-wildcard.js

@@ -0,0 +1,44 @@
+import { ts } from "@intentius/chant/lint/typescript";
+/**
+ * AZR003: NSG Wildcard Source Address
+ *
+ * Detects Network Security Group rules with sourceAddressPrefix: "*".
+ * Wildcard source addresses allow traffic from any source and should be
+ * restricted to specific IP ranges or service tags.
+ */
+export const nsgWildcardRule = {
+    id: "AZR003",
+    severity: "warning",
+    category: "security",
+    description: "Detects NSG rules with wildcard (*) source address — restrict to specific IP ranges or service tags",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function visit(node) {
+            // Look for sourceAddressPrefix: "*" in object literals
+            if (ts.isPropertyAssignment(node)) {
+                const name = node.name;
+                if (ts.isIdentifier(name) || ts.isStringLiteral(name)) {
+                    const propName = ts.isIdentifier(name) ? name.text : name.text;
+                    if (propName === "sourceAddressPrefix") {
+                        // Check if value is "*"
+                        if (ts.isStringLiteral(node.initializer) && node.initializer.text === "*") {
+                            const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                            diagnostics.push({
+                                file: sourceFile.fileName,
+                                line: line + 1,
+                                column: character + 1,
+                                ruleId: "AZR003",
+                                severity: "warning",
+                                message: "NSG rule uses wildcard (*) sourceAddressPrefix. Restrict to specific IP ranges or service tags.",
+                            });
+                        }
+                    }
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/storage-https.js

@@ -0,0 +1,62 @@
+import { ts } from "@intentius/chant/lint/typescript";
+/**
+ * AZR002: Storage Account HTTPS Only
+ *
+ * Detects Storage Account creation without supportsHttpsTrafficOnly: true.
+ * All storage accounts should enforce HTTPS-only traffic.
+ */
+export const storageHttpsRule = {
+    id: "AZR002",
+    severity: "warning",
+    category: "security",
+    description: "Detects Storage Accounts without supportsHttpsTrafficOnly enabled — all storage accounts should enforce HTTPS",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function visit(node) {
+            // Look for `new StorageAccount(...)` or `new storage.StorageAccount(...)`
+            if (ts.isNewExpression(node)) {
+                const expression = node.expression;
+                let isStorageAccount = false;
+                // Check for `new StorageAccount(...)`
+                if (ts.isIdentifier(expression) && expression.text === "StorageAccount") {
+                    isStorageAccount = true;
+                }
+                // Check for `new storage.StorageAccount(...)` or `new azure.storage.StorageAccount(...)`
+                else if (ts.isPropertyAccessExpression(expression)) {
+                    if (expression.name.text === "StorageAccount") {
+                        isStorageAccount = true;
+                    }
+                }
+                if (isStorageAccount && node.arguments && node.arguments.length > 0) {
+                    const props = node.arguments[0];
+                    if (ts.isObjectLiteralExpression(props)) {
+                        const hasHttpsOnly = props.properties.some((prop) => {
+                            if (ts.isPropertyAssignment(prop) && ts.isIdentifier(prop.name)) {
+                                if (prop.name.text === "supportsHttpsTrafficOnly") {
+                                    // Check that it's set to true
+                                    return prop.initializer.kind === ts.SyntaxKind.TrueKeyword;
+                                }
+                            }
+                            return false;
+                        });
+                        if (!hasHttpsOnly) {
+                            const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                            diagnostics.push({
+                                file: sourceFile.fileName,
+                                line: line + 1,
+                                column: character + 1,
+                                ruleId: "AZR002",
+                                severity: "warning",
+                                message: "Storage Account created without supportsHttpsTrafficOnly: true. Enable HTTPS-only traffic.",
+                            });
+                        }
+                    }
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lsp/completions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"completions.d.ts","sourceRoot":"","sources":["../../src/lsp/completions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAapF;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,EAAE,CAEzE"}
+{"version":3,"file":"completions.d.ts","sourceRoot":"","sources":["../../src/lsp/completions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAapF;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,EAAE,CAEzE"}

package/dist/lsp/completions.js

@@ -0,0 +1,18 @@
+import { createRequire } from "module";
+import { moduleSourceUrl } from "@intentius/chant/module-source";
+import { LexiconIndex, lexiconCompletions } from "@intentius/chant/lsp/lexicon-providers";
+const require = createRequire(moduleSourceUrl(import.meta.url));
+let cachedIndex = null;
+function getIndex() {
+    if (cachedIndex)
+        return cachedIndex;
+    const data = require("../generated/lexicon-azure.json");
+    cachedIndex = new LexiconIndex(data);
+    return cachedIndex;
+}
+/**
+ * Provide Azure completions based on context.
+ */
+export function azureCompletions(ctx) {
+    return lexiconCompletions(ctx, getIndex(), "Azure ARM resource");
+}

package/dist/lsp/hover.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hover.d.ts","sourceRoot":"","sources":["../../src/lsp/hover.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAa1E;;GAEG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAEnE"}
+{"version":3,"file":"hover.d.ts","sourceRoot":"","sources":["../../src/lsp/hover.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAa1E;;GAEG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAEnE"}

package/dist/lsp/hover.js

@@ -0,0 +1,44 @@
+import { createRequire } from "module";
+import { moduleSourceUrl } from "@intentius/chant/module-source";
+import { LexiconIndex, lexiconHover } from "@intentius/chant/lsp/lexicon-providers";
+const require = createRequire(moduleSourceUrl(import.meta.url));
+let cachedIndex = null;
+function getIndex() {
+    if (cachedIndex)
+        return cachedIndex;
+    const data = require("../generated/lexicon-azure.json");
+    cachedIndex = new LexiconIndex(data);
+    return cachedIndex;
+}
+/**
+ * Provide hover information for Azure resource types and properties.
+ */
+export function azureHover(ctx) {
+    return lexiconHover(ctx, getIndex(), resourceHover);
+}
+function resourceHover(className, entry) {
+    if (entry.kind !== "resource")
+        return undefined;
+    const lines = [];
+    lines.push(`**${className}**`);
+    lines.push("");
+    lines.push(`ARM resource type: \`${entry.resourceType}\``);
+    const apiVersion = entry.apiVersion;
+    if (apiVersion) {
+        lines.push(`API version: \`${apiVersion}\``);
+    }
+    if (entry.attrs && Object.keys(entry.attrs).length > 0) {
+        lines.push("");
+        lines.push("**Attributes:**");
+        for (const [key, value] of Object.entries(entry.attrs)) {
+            lines.push(`- \`${key}\` → \`${value}\``);
+        }
+    }
+    const provider = entry.resourceType.split("/")[0]?.replace("Microsoft.", "").toLowerCase();
+    const resource = entry.resourceType.split("/").pop()?.toLowerCase();
+    if (provider && resource) {
+        lines.push("");
+        lines.push(`[Azure docs](https://learn.microsoft.com/en-us/azure/templates/${provider}/${resource})`);
+    }
+    return { contents: lines.join("\n") };
+}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "azure",
-  "version": "0.124.30",
+  "version": "0.124.32",
   "chantVersion": ">=0.1.0",
   "namespace": "Azure",
   "intrinsics": [