@intentius/chant-lexicon-azure 0.124.34 → 0.124.36

package/src/op/activities/az-apply.ts

@@ -1,4 +1,5 @@
 import { readFileSync } from "node:fs";
+import { armResourcePath } from "../../arm-type";
 import { createHash } from "node:crypto";
 import { hasOwnershipMarker, OWNERSHIP_MANAGED_BY_VALUE } from "@intentius/chant/ownership";
 import { AZURE_TAG_OWNERSHIP_KEYS } from "../../ownership";
@@ -25,6 +26,11 @@ export interface ArmResource {
   sku?: unknown;
   kind?: unknown;
   tags?: Record<string, string>;
+  identity?: unknown;
+  zones?: unknown;
+  plan?: unknown;
+  extendedLocation?: unknown;
+  managedBy?: unknown;
   dependsOn?: unknown;
 }
 
@@ -64,6 +70,29 @@ export interface ArmEvalCtx {
   signal?: AbortSignal;
 }
 
+/** The ARM resource id of a resource in the context's group. */
+export function armResourceIdOf(ctx: Pick<ArmEvalCtx, "subscriptionId" | "resourceGroup">, type: string, name: string): string {
+  return `/subscriptions/${ctx.subscriptionId}/resourceGroups/${ctx.resourceGroup}/providers/${armResourcePath(type, name)}`;
+}
+
+/**
+ * Record an applied resource's response so `reference()` resolves it by name
+ * and by resource id (#4243). Ids are case-insensitive in ARM, so they are
+ * stored lowercased, under both the id chant derives and the one the
+ * response reports.
+ */
+export function rememberDeployed(ctx: ArmEvalCtx, type: string, name: string, body: unknown): void {
+  ctx.deployed.set(name, body);
+  ctx.deployed.set(armResourceIdOf(ctx, type, name).toLowerCase(), body);
+  const id = (body as { id?: unknown } | null)?.id;
+  if (typeof id === "string") ctx.deployed.set(id.toLowerCase(), body);
+}
+
+/** An applied resource by the name or the resource id a `reference()` names. */
+export function lookupDeployed(ctx: ArmEvalCtx, ref: string): unknown {
+  return ctx.deployed.get(ref) ?? (ref.startsWith("/") ? ctx.deployed.get(ref.toLowerCase()) : undefined);
+}
+
 /** Evaluate an ARM expression string (`"[...]"`); a plain string is returned as-is. */
 export async function evalArmString(s: string, ctx: ArmEvalCtx): Promise<unknown> {
   if (!(s.startsWith("[") && s.endsWith("]"))) return s;
@@ -71,13 +100,17 @@ export async function evalArmString(s: string, ctx: ArmEvalCtx): Promise<unknown
   return new ArmExpr(s.slice(1, -1), ctx).parse();
 }
 
-/** Recursively evaluate every string in a value against the ARM context. */
+/**
+ * Recursively evaluate every string in a value against the ARM context,
+ * object keys included: ARM evaluates a property name too, and
+ * `identity.userAssignedIdentities` is keyed by `[resourceId(...)]` (#4231).
+ */
 export async function evalArm(value: unknown, ctx: ArmEvalCtx): Promise<unknown> {
   if (typeof value === "string") return evalArmString(value, ctx);
   if (Array.isArray(value)) return Promise.all(value.map((v) => evalArm(v, ctx)));
   if (value && typeof value === "object") {
     const out: Record<string, unknown> = {};
-    for (const [k, v] of Object.entries(value)) out[k] = await evalArm(v, ctx);
+    for (const [k, v] of Object.entries(value)) out[String(await evalArmString(k, ctx))] = await evalArm(v, ctx);
     return out;
   }
   return value;
@@ -151,10 +184,13 @@ class ArmExpr {
         return { subscriptionId: this.ctx.subscriptionId, id: `/subscriptions/${this.ctx.subscriptionId}` };
       case "resourceId":
         // resourceId('Microsoft.X/y', 'name'[, 'child']) → the resource-id path.
-        return `/subscriptions/${this.ctx.subscriptionId}/resourceGroups/${this.ctx.resourceGroup}/providers/${args.map(String).join("/")}`;
+        return armResourceIdOf(this.ctx, String(args[0]), args.slice(1).map(String).join("/"));
       case "reference": {
-        // reference('name') → the runtime `properties` of an already-applied resource.
-        const dep = this.ctx.deployed.get(String(args[0]));
+        // reference('name' | resourceId(...)[, apiVersion[, 'Full']]) → the
+        // runtime `properties` of an already-applied resource, or its whole
+        // body with 'Full' (#4243).
+        const dep = lookupDeployed(this.ctx, String(args[0]));
+        if (String(args[2] ?? "").toLowerCase() === "full") return dep;
         return (dep as { properties?: unknown } | undefined)?.properties ?? dep;
       }
       case "listKeys": {
@@ -260,17 +296,23 @@ export function orderArmResources(resources: ArmResource[]): ArmResource[] {
 /** The ARM resource-ID PUT URL for a resource (name expression evaluated). */
 export async function armResourceUrl(resource: ArmResource, ctx: ArmEvalCtx): Promise<string> {
   const name = await evalArmString(resource.name, ctx);
-  return `${ctx.base}/subscriptions/${ctx.subscriptionId}/resourceGroups/${ctx.resourceGroup}/providers/${resource.type}/${name}?api-version=${resource.apiVersion}`;
+  return `${ctx.base}/subscriptions/${ctx.subscriptionId}/resourceGroups/${ctx.resourceGroup}/providers/${armResourcePath(resource.type, String(name))}?api-version=${resource.apiVersion}`;
 }
 
-/** The ARM resource PUT body (location/properties/sku/kind/tags), expressions evaluated. */
+/**
+ * The top-level ARM resource fields a PUT takes beside `location` (#4231). A
+ * field missing here is dropped from the body, which is how a declared
+ * `identity` came back absent.
+ */
+const ARM_BODY_FIELDS = ["properties", "sku", "kind", "tags", "identity", "zones", "plan", "extendedLocation", "managedBy"] as const;
+
+/** The ARM resource PUT body: `location` and {@link ARM_BODY_FIELDS}, expressions evaluated. */
 export async function armResourceBody(resource: ArmResource, ctx: ArmEvalCtx): Promise<Record<string, unknown>> {
   const body: Record<string, unknown> = {};
   if (resource.location) body.location = await evalArmString(resource.location, ctx);
-  if (resource.properties !== undefined) body.properties = await evalArm(resource.properties, ctx);
-  if (resource.sku !== undefined) body.sku = await evalArm(resource.sku, ctx);
-  if (resource.kind !== undefined) body.kind = await evalArm(resource.kind, ctx);
-  if (resource.tags !== undefined) body.tags = await evalArm(resource.tags, ctx);
+  for (const field of ARM_BODY_FIELDS) {
+    if (resource[field] !== undefined) body[field] = await evalArm(resource[field], ctx);
+  }
   return body;
 }
 
@@ -346,7 +388,7 @@ export async function azApply(
     }
     // Capture the applied resource so later reference()/dependents resolve.
     try {
-      ctx.deployed.set(name, JSON.parse(res.text));
+      rememberDeployed(ctx, resource.type, name, JSON.parse(res.text));
     } catch {
       // non-JSON response — reference() to this resource resolves to undefined
     }
@@ -454,7 +496,7 @@ export async function deleteArmResource(
   http: AzHttp = defaultHttp,
   signal?: AbortSignal,
 ): Promise<{ type: string; name: string; deleted: boolean }> {
-  const url = `${ctx.base}/subscriptions/${ctx.subscriptionId}/resourceGroups/${ctx.resourceGroup}/providers/${type}/${name}?api-version=${apiVersion}`;
+  const url = `${ctx.base}/subscriptions/${ctx.subscriptionId}/resourceGroups/${ctx.resourceGroup}/providers/${armResourcePath(type, name)}?api-version=${apiVersion}`;
   const res = await http("DELETE", url, undefined, signal);
   if (res.status === 404) return { type, name, deleted: false };
   if (res.status >= 300) throw new Error(`${type} ${name} delete failed (${res.status}): ${res.text}`);

package/src/plugin.ts

@@ -15,6 +15,7 @@ import { join, dirname } from "path";
 import { fileURLToPath } from "url";
 import { moduleSourceDir } from "@intentius/chant/module-source";
 import { azureSerializer } from "./serializer";
+import { azureGraphEdges } from "./graph-edges";
 import { hardcodedLocationRule } from "./lint/rules/hardcoded-location";
 import { storageHttpsRule } from "./lint/rules/storage-https";
 import { nsgWildcardRule } from "./lint/rules/nsg-wildcard";
@@ -37,6 +38,8 @@ export const azurePlugin: LexiconPlugin = {
   emulator: FLOCI_AZ_EMULATOR,
   auditCatalog: () => azureAuditCatalog,
   serializer: azureSerializer,
+  // References written as ARM expressions (resourceId, reference, listKeys) as graph edges (#4232).
+  graphEdges: (entities) => azureGraphEdges(entities),
 
   lintRules(): LintRule[] {
     return [hardcodedLocationRule, storageHttpsRule, nsgWildcardRule];

package/src/serializer.ts

@@ -10,6 +10,7 @@
  * - parameters, outputs sections
  */
 
+import { armType } from "./arm-type";
 import type { Declarable, CoreParameter } from "@intentius/chant/declarable";
 import { isPropertyDeclarable, isResourceDeclarable } from "@intentius/chant/declarable";
 import type { Serializer, SerializerResult, SerializeContext } from "@intentius/chant/serializer";
@@ -194,7 +195,7 @@ function entityNamed(entityNames: Map<Declarable, string>, name: string): Declar
 function armResourceId(entityNames: Map<Declarable, string>, name: string): string {
   const entity = entityNamed(entityNames, name);
   const { args } = armNameArgs(entity, name);
-  return entity ? `resourceId('${entity.entityType}', ${args})` : `resourceId(${args})`;
+  return entity ? `resourceId('${armType(entity.entityType)}', ${args})` : `resourceId(${args})`;
 }
 
 /**
@@ -259,10 +260,24 @@ function isPlainObject(value: unknown): value is Record<string, unknown> {
   return proto === Object.prototype || proto === null;
 }
 
-function toArmValue(value: unknown, entityNames: Map<Declarable, string>): unknown {
+/** A prop value as the template writes it: references become bracket expressions. */
+export function toArmValue(value: unknown, entityNames: Map<Declarable, string>): unknown {
   return walkValue(value, entityNames, armVisitor(entityNames));
 }
 
+/**
+ * The name a resource takes in the template: its `name` prop, or the entity
+ * key when it sets none. `findArmResourceRefs` reports references by this
+ * name, so the dependsOn inference below and the graph edges
+ * (./graph-edges.ts) both resolve a reference through it.
+ */
+export function armResourceName(entity: Declarable, key: string, entityNames: Map<Declarable, string>): unknown {
+  const props = isResourceDeclarable(entity) && typeof entity.props === "object" && entity.props !== null
+    ? entity.props as Record<string, unknown>
+    : undefined;
+  return props?.name !== undefined ? toArmValue(props.name, entityNames) : key;
+}
+
 /**
  * Serialize entities into an ARM template object.
  */
@@ -291,7 +306,7 @@ function serializeToTemplate(
     } else if (isChildProject(entity)) {
       emittedTypes.push("Microsoft.Resources/deployments");
     } else if (!isPropertyDeclarable(entity)) {
-      emittedTypes.push(entity.entityType);
+      emittedTypes.push(armType(entity.entityType));
     }
   }
   const templateScope = pinnedScope ?? resolveTemplateScope(emittedTypes);
@@ -369,9 +384,9 @@ function serializeToTemplate(
       const apiVersion = (typeof attrs0?.apiVersion === "string") ? attrs0.apiVersion : getApiVersion(resourceType);
 
       const resource: ArmResource = {
-        type: resourceType,
+        type: armType(resourceType),
         apiVersion,
-        name: name,
+        name: armResourceName(entity, name, entityNames) as string,
       };
 
       // Extract all props
@@ -386,7 +401,7 @@ function serializeToTemplate(
             // Hoist to resource level
             (resource as unknown as Record<string, unknown>)[key] = toArmValue(value, entityNames);
           } else if (key === "name") {
-            resource.name = toArmValue(value, entityNames) as string;
+            // Set above by armResourceName.
           } else if (key === "properties" && isPlainObject(value)) {
             // The generated types take ARM's own `properties` object, so
             // merge it, not nest it (#4183).