@intentius/chant-lexicon-gcp 0.124.31 → 0.124.33

package/dist/lint/post-synth/wgc113.js

@@ -0,0 +1,35 @@
+/**
+ * WGC113: Alpha API version warning
+ *
+ * Warns when a Config Connector resource uses an alpha API version
+ * (e.g. v1alpha1). Alpha APIs are unstable — prefer v1beta1 or v1.
+ */
+import { parseGcpManifests, isConfigConnectorResource, getResourceName } from "./gcp-helpers.js";
+export const wgc113 = {
+    id: "WGC113",
+    description: "Config Connector resource uses an alpha API version",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            const manifests = parseGcpManifests(output);
+            for (const manifest of manifests) {
+                if (!isConfigConnectorResource(manifest))
+                    continue;
+                const apiVersion = manifest.apiVersion;
+                if (/alpha\d+/.test(apiVersion)) {
+                    const resourceName = getResourceName(manifest);
+                    diagnostics.push({
+                        checkId: "WGC113",
+                        severity: "warning",
+                        message: `Resource "${resourceName}" uses alpha API version "${apiVersion}" — alpha APIs are unstable, prefer v1beta1 or v1`,
+                        entity: resourceName,
+                        lexicon: "gcp",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc201.js

@@ -0,0 +1,30 @@
+/**
+ * WGC201: Missing managed-by label
+ */
+import { parseGcpManifests, isConfigConnectorResource, getResourceName } from "./gcp-helpers.js";
+export const wgc201 = {
+    id: "WGC201",
+    description: "Config Connector resource without app.kubernetes.io/managed-by label",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            for (const manifest of parseGcpManifests(output)) {
+                if (!isConfigConnectorResource(manifest))
+                    continue;
+                const labels = manifest.metadata?.labels;
+                if (!labels?.["app.kubernetes.io/managed-by"]) {
+                    diagnostics.push({
+                        checkId: "WGC201",
+                        severity: "info",
+                        message: `Resource "${getResourceName(manifest)}" has no app.kubernetes.io/managed-by label — consider using defaultLabels() for consistent labeling`,
+                        entity: getResourceName(manifest),
+                        lexicon: "gcp",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc202.js

@@ -0,0 +1,33 @@
+/**
+ * WGC202: GKE cluster without workload identity
+ */
+import { parseGcpManifests, getSpec, getResourceName } from "./gcp-helpers.js";
+export const wgc202 = {
+    id: "WGC202",
+    description: "ContainerCluster without workload identity configuration",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            for (const manifest of parseGcpManifests(output)) {
+                if (manifest.kind !== "ContainerCluster")
+                    continue;
+                const spec = getSpec(manifest);
+                if (!spec)
+                    continue;
+                const workloadIdentity = spec.workloadIdentityConfig;
+                if (!workloadIdentity?.workloadPool) {
+                    diagnostics.push({
+                        checkId: "WGC202",
+                        severity: "warning",
+                        message: `ContainerCluster "${getResourceName(manifest)}" does not have workload identity configured — recommended for secure pod-to-GCP authentication`,
+                        entity: getResourceName(manifest),
+                        lexicon: "gcp",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc203.js

@@ -0,0 +1,35 @@
+/**
+ * WGC203: GKE node pool with cloud-platform OAuth scope
+ */
+import { parseGcpManifests, getSpec, getResourceName } from "./gcp-helpers.js";
+export const wgc203 = {
+    id: "WGC203",
+    description: "ContainerNodePool using overly broad cloud-platform OAuth scope",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            for (const manifest of parseGcpManifests(output)) {
+                if (manifest.kind !== "ContainerNodePool")
+                    continue;
+                const spec = getSpec(manifest);
+                if (!spec)
+                    continue;
+                const nodeConfig = spec.nodeConfig;
+                const oauthScopes = nodeConfig?.oauthScopes;
+                if (Array.isArray(oauthScopes) && oauthScopes.some(s => (typeof s === "string" && s.includes("cloud-platform")) ||
+                    (typeof s === "object" && s !== null && JSON.stringify(s).includes("cloud-platform")))) {
+                    diagnostics.push({
+                        checkId: "WGC203",
+                        severity: "warning",
+                        message: `ContainerNodePool "${getResourceName(manifest)}" uses cloud-platform OAuth scope — this grants overly broad access; prefer workload identity with fine-grained IAM`,
+                        entity: getResourceName(manifest),
+                        lexicon: "gcp",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc204.js

@@ -0,0 +1,33 @@
+/**
+ * WGC204: ComputeInstance without shielded VM config
+ */
+import { parseGcpManifests, getSpec, getResourceName } from "./gcp-helpers.js";
+export const wgc204 = {
+    id: "WGC204",
+    description: "ComputeInstance without shielded VM configuration",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            for (const manifest of parseGcpManifests(output)) {
+                if (manifest.kind !== "ComputeInstance")
+                    continue;
+                const spec = getSpec(manifest);
+                if (!spec)
+                    continue;
+                const shieldedConfig = spec.shieldedInstanceConfig;
+                if (!shieldedConfig) {
+                    diagnostics.push({
+                        checkId: "WGC204",
+                        severity: "info",
+                        message: `ComputeInstance "${getResourceName(manifest)}" has no shielded VM configuration — consider enabling secureboot, vtpm, and integrity monitoring`,
+                        entity: getResourceName(manifest),
+                        lexicon: "gcp",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc301.js

@@ -0,0 +1,28 @@
+/**
+ * WGC301: No audit logging config (IAMAuditConfig) in output
+ */
+import { parseGcpManifests } from "./gcp-helpers.js";
+export const wgc301 = {
+    id: "WGC301",
+    description: "No IAMAuditConfig resource found in output — audit logging may not be configured",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            const manifests = parseGcpManifests(output);
+            if (manifests.length === 0)
+                continue;
+            const hasAuditConfig = manifests.some(m => m.kind === "IAMAuditConfig");
+            if (!hasAuditConfig) {
+                diagnostics.push({
+                    checkId: "WGC301",
+                    severity: "info",
+                    message: "No IAMAuditConfig resource found — consider adding audit logging for compliance",
+                    lexicon: "gcp",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc302.js

@@ -0,0 +1,28 @@
+/**
+ * WGC302: Service API not explicitly enabled
+ */
+import { parseGcpManifests } from "./gcp-helpers.js";
+export const wgc302 = {
+    id: "WGC302",
+    description: "No Service resource found — GCP APIs may not be explicitly enabled",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            const manifests = parseGcpManifests(output);
+            if (manifests.length === 0)
+                continue;
+            const hasService = manifests.some(m => m.kind === "Service" && m.apiVersion?.includes("serviceusage.cnrm"));
+            if (!hasService) {
+                diagnostics.push({
+                    checkId: "WGC302",
+                    severity: "info",
+                    message: "No Service (serviceusage) resource found — consider explicitly enabling required GCP APIs",
+                    lexicon: "gcp",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc303.js

@@ -0,0 +1,29 @@
+/**
+ * WGC303: Missing VPC Service Controls perimeter
+ */
+import { parseGcpManifests } from "./gcp-helpers.js";
+export const wgc303 = {
+    id: "WGC303",
+    description: "No AccessContextManager ServicePerimeter found — VPC Service Controls not configured",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            const manifests = parseGcpManifests(output);
+            if (manifests.length === 0)
+                continue;
+            const hasPerimeter = manifests.some(m => m.kind === "AccessContextManagerServicePerimeter" ||
+                (m.apiVersion?.includes("accesscontextmanager") && m.kind?.includes("ServicePerimeter")));
+            if (!hasPerimeter) {
+                diagnostics.push({
+                    checkId: "WGC303",
+                    severity: "info",
+                    message: "No VPC Service Controls perimeter found — consider adding for data exfiltration protection",
+                    lexicon: "gcp",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc401.js

@@ -0,0 +1,50 @@
+/**
+ * WGC401: Unknown spec field
+ *
+ * Flags fields in a Config Connector resource spec that are not defined
+ * in the CRD schema. Includes "did you mean?" suggestion via Levenshtein.
+ */
+import { parseGcpManifests, isConfigConnectorResource, getResourceName, getSpec } from "./gcp-helpers.js";
+import { getSchemaRegistry, suggestField } from "./schema-registry.js";
+export const wgc401 = {
+    id: "WGC401",
+    description: "Config Connector resource spec contains unknown field",
+    check(ctx) {
+        const diagnostics = [];
+        const registry = getSchemaRegistry();
+        for (const [_lexicon, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            const manifests = parseGcpManifests(output);
+            for (const manifest of manifests) {
+                if (!isConfigConnectorResource(manifest))
+                    continue;
+                const kind = manifest.kind;
+                if (!kind)
+                    continue;
+                const schema = registry.get(kind);
+                if (!schema)
+                    continue; // No schema available for this kind
+                const spec = getSpec(manifest);
+                if (!spec)
+                    continue;
+                const knownFields = Object.keys(schema.fields);
+                const resourceName = getResourceName(manifest);
+                for (const field of Object.keys(spec)) {
+                    if (field in schema.fields)
+                        continue;
+                    const suggestion = suggestField(field, knownFields);
+                    const hint = suggestion ? ` — did you mean "${suggestion}"?` : "";
+                    diagnostics.push({
+                        checkId: "WGC401",
+                        severity: "error",
+                        message: `Resource "${resourceName}" (${kind}): unknown spec field "${field}"${hint}`,
+                        entity: resourceName,
+                        lexicon: "gcp",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc402.js

@@ -0,0 +1,46 @@
+/**
+ * WGC402: Missing required spec field
+ *
+ * Flags Config Connector resources that are missing required fields
+ * according to their CRD schema.
+ */
+import { parseGcpManifests, isConfigConnectorResource, getResourceName, getSpec } from "./gcp-helpers.js";
+import { getSchemaRegistry } from "./schema-registry.js";
+export const wgc402 = {
+    id: "WGC402",
+    description: "Config Connector resource is missing a required spec field",
+    check(ctx) {
+        const diagnostics = [];
+        const registry = getSchemaRegistry();
+        for (const [_lexicon, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            const manifests = parseGcpManifests(output);
+            for (const manifest of manifests) {
+                if (!isConfigConnectorResource(manifest))
+                    continue;
+                const kind = manifest.kind;
+                if (!kind)
+                    continue;
+                const schema = registry.get(kind);
+                if (!schema)
+                    continue;
+                const spec = getSpec(manifest);
+                const specKeys = new Set(spec ? Object.keys(spec) : []);
+                const resourceName = getResourceName(manifest);
+                for (const requiredField of schema.required) {
+                    if (!specKeys.has(requiredField)) {
+                        diagnostics.push({
+                            checkId: "WGC402",
+                            severity: "error",
+                            message: `Resource "${resourceName}" (${kind}): missing required field "${requiredField}"`,
+                            entity: resourceName,
+                            lexicon: "gcp",
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc403.js

@@ -0,0 +1,74 @@
+/**
+ * WGC403: Type/structure mismatch in spec field
+ *
+ * Flags spec fields where the value type doesn't match the CRD schema:
+ * - String where number expected (e.g. availableMemoryMb: "512")
+ * - Scalar string where resourceRef object expected (e.g. topicRef: "name")
+ */
+import { parseGcpManifests, isConfigConnectorResource, getResourceName, getSpec } from "./gcp-helpers.js";
+import { getSchemaRegistry } from "./schema-registry.js";
+export const wgc403 = {
+    id: "WGC403",
+    description: "Config Connector resource spec field has wrong type or structure",
+    check(ctx) {
+        const diagnostics = [];
+        const registry = getSchemaRegistry();
+        for (const [_lexicon, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            const manifests = parseGcpManifests(output);
+            for (const manifest of manifests) {
+                if (!isConfigConnectorResource(manifest))
+                    continue;
+                const kind = manifest.kind;
+                if (!kind)
+                    continue;
+                const schema = registry.get(kind);
+                if (!schema)
+                    continue;
+                const spec = getSpec(manifest);
+                if (!spec)
+                    continue;
+                const resourceName = getResourceName(manifest);
+                for (const [field, value] of Object.entries(spec)) {
+                    const fieldSchema = schema.fields[field];
+                    if (!fieldSchema)
+                        continue; // Unknown fields handled by WGC401
+                    // Check: resourceRef field expects an object, got a scalar
+                    if (fieldSchema.ref && typeof value === "string") {
+                        diagnostics.push({
+                            checkId: "WGC403",
+                            severity: "error",
+                            message: `Resource "${resourceName}" (${kind}): field "${field}" expects a resourceRef object (e.g. { name, kind }), got string "${value}"`,
+                            entity: resourceName,
+                            lexicon: "gcp",
+                        });
+                        continue;
+                    }
+                    // Check: number field got a string that looks numeric
+                    if (fieldSchema.type === "number" && typeof value === "string") {
+                        diagnostics.push({
+                            checkId: "WGC403",
+                            severity: "error",
+                            message: `Resource "${resourceName}" (${kind}): field "${field}" expects a number, got string "${value}"`,
+                            entity: resourceName,
+                            lexicon: "gcp",
+                        });
+                        continue;
+                    }
+                    // Check: boolean field got a string
+                    if (fieldSchema.type === "boolean" && typeof value === "string") {
+                        diagnostics.push({
+                            checkId: "WGC403",
+                            severity: "error",
+                            message: `Resource "${resourceName}" (${kind}): field "${field}" expects a boolean, got string "${value}"`,
+                            entity: resourceName,
+                            lexicon: "gcp",
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc501.js

@@ -0,0 +1,63 @@
+/**
+ * WGC501: Org Policy Guardrail Not Enforced
+ *
+ * Flags OrgPolicyPolicy resources whose rules switch enforcement off or that
+ * reset the constraint to its default. A disabled org policy is the GCP
+ * shape of a weakened guardrail: the constraint stays visible in the tree
+ * while constraining nothing.
+ */
+import { parseGcpManifests, getResourceName } from "./gcp-helpers.js";
+/**
+ * OrgPolicyPolicy mirrors the API's own `spec` inside the CRD spec, so rules
+ * live at `spec.spec.rules`; accept `spec.rules` too for hand-written manifests.
+ */
+export function orgPolicySpec(manifest) {
+    const outer = manifest.spec ?? {};
+    const inner = outer.spec;
+    return typeof inner === "object" && inner !== null ? inner : outer;
+}
+export function orgPolicyRules(manifest) {
+    const rules = orgPolicySpec(manifest).rules;
+    return Array.isArray(rules) ? rules : [];
+}
+function isDisabled(rule) {
+    return rule.enforce === false || rule.enforce === "FALSE";
+}
+export const wgc501 = {
+    id: "WGC501",
+    description: "Org Policy guardrail not enforced — a disabled policy constrains nothing",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            for (const manifest of parseGcpManifests(output)) {
+                if (manifest.kind !== "OrgPolicyPolicy")
+                    continue;
+                const name = getResourceName(manifest);
+                if (orgPolicySpec(manifest).reset === true) {
+                    diagnostics.push({
+                        checkId: "WGC501",
+                        severity: "error",
+                        message: `OrgPolicyPolicy "${name}" resets the constraint to its default — the guardrail is switched off`,
+                        entity: name,
+                        lexicon: "gcp",
+                    });
+                    continue;
+                }
+                for (const rule of orgPolicyRules(manifest)) {
+                    if (isDisabled(rule)) {
+                        diagnostics.push({
+                            checkId: "WGC501",
+                            severity: "error",
+                            message: `OrgPolicyPolicy "${name}" has a rule with enforce disabled — the guardrail is declared but not enforced`,
+                            entity: name,
+                            lexicon: "gcp",
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc502.js

@@ -0,0 +1,37 @@
+/**
+ * WGC502: Org Policy Guardrail Defines No Rules
+ *
+ * Flags OrgPolicyPolicy resources with no rules (and no reset). A rule-less
+ * org policy binds a constraint to nothing — the usual leftover of a
+ * guardrail whose rules were removed while the policy object was kept.
+ */
+import { parseGcpManifests, getResourceName } from "./gcp-helpers.js";
+import { orgPolicyRules, orgPolicySpec } from "./wgc501.js";
+export const wgc502 = {
+    id: "WGC502",
+    description: "Org Policy guardrail defines no rules — it binds its constraint to nothing",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            for (const manifest of parseGcpManifests(output)) {
+                if (manifest.kind !== "OrgPolicyPolicy")
+                    continue;
+                if (orgPolicySpec(manifest).reset === true)
+                    continue; // WGC501's finding
+                if (orgPolicyRules(manifest).length > 0)
+                    continue;
+                const name = getResourceName(manifest);
+                diagnostics.push({
+                    checkId: "WGC502",
+                    severity: "error",
+                    message: `OrgPolicyPolicy "${name}" defines no rules — the guardrail constrains nothing`,
+                    entity: name,
+                    lexicon: "gcp",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc503.js

@@ -0,0 +1,49 @@
+/**
+ * WGC503: Audit Logging Dropped or Scoped Down
+ *
+ * Flags IAMAuditConfig resources that capture nothing (no auditLogConfigs)
+ * or that carve identities out of the audit trail via exemptedMembers.
+ * WGC301 reports the absence of any IAMAuditConfig as hygiene; this check
+ * covers the declared-but-weakened sink, which is merge-worthy.
+ */
+import { parseGcpManifests, getResourceName, getSpec } from "./gcp-helpers.js";
+export const wgc503 = {
+    id: "WGC503",
+    description: "IAMAuditConfig captures nothing or exempts members — the audit sink is scoped down",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            for (const manifest of parseGcpManifests(output)) {
+                if (manifest.kind !== "IAMAuditConfig")
+                    continue;
+                const name = getResourceName(manifest);
+                const configs = getSpec(manifest)?.auditLogConfigs;
+                if (!Array.isArray(configs) || configs.length === 0) {
+                    diagnostics.push({
+                        checkId: "WGC503",
+                        severity: "error",
+                        message: `IAMAuditConfig "${name}" has no auditLogConfigs — the audit sink is declared but captures nothing`,
+                        entity: name,
+                        lexicon: "gcp",
+                    });
+                    continue;
+                }
+                for (const config of configs) {
+                    const exempted = config.exemptedMembers;
+                    if (Array.isArray(exempted) && exempted.length > 0) {
+                        diagnostics.push({
+                            checkId: "WGC503",
+                            severity: "error",
+                            message: `IAMAuditConfig "${name}" exempts members from ${String(config.logType ?? "audit")} logging — audit evidence is scoped down`,
+                            entity: name,
+                            lexicon: "gcp",
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/rules/hardcoded-project.js

@@ -0,0 +1,51 @@
+import { ts } from "@intentius/chant/lint/typescript";
+/**
+ * WGC001: Hardcoded GCP Project ID
+ *
+ * Detects hardcoded GCP project IDs in code.
+ * Project IDs should use GCP.ProjectId pseudo-parameter instead.
+ */
+export const hardcodedProjectRule = {
+    id: "WGC001",
+    severity: "warning",
+    category: "security",
+    description: "Detects hardcoded GCP project IDs — use GCP.ProjectId pseudo-parameter instead",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        // GCP project ID pattern: lowercase letters, digits, hyphens, 6-30 chars
+        // We look for strings in annotation contexts like "cnrm.cloud.google.com/project-id"
+        const projectIdPattern = /^[a-z][a-z0-9-]{4,28}[a-z0-9]$/;
+        // Common false positives
+        const falsePositives = new Set([
+            "chant", "default", "kube-system", "kube-public", "kube-node-lease",
+            "config-connector", "cnrm-system", "my-project",
+        ]);
+        function visit(node) {
+            if (ts.isPropertyAssignment(node) || ts.isPropertyDeclaration(node)) {
+                const propName = node.name?.getText(sourceFile) ?? "";
+                // Only flag project-id annotation values
+                if (propName.includes("project-id") || propName.includes("projectId") || propName === '"cnrm.cloud.google.com/project-id"') {
+                    const initializer = ts.isPropertyAssignment(node) ? node.initializer : undefined;
+                    if (initializer && ts.isStringLiteral(initializer)) {
+                        const value = initializer.text;
+                        if (projectIdPattern.test(value) && !falsePositives.has(value)) {
+                            const { line, character } = sourceFile.getLineAndCharacterOfPosition(initializer.getStart());
+                            diagnostics.push({
+                                file: sourceFile.fileName,
+                                line: line + 1,
+                                column: character + 1,
+                                ruleId: "WGC001",
+                                severity: "warning",
+                                message: `Hardcoded project ID "${value}" detected. Use GCP.ProjectId pseudo-parameter instead.`,
+                            });
+                        }
+                    }
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};