@intentius/chant-lexicon-gcp 0.124.36 → 0.124.38

package/src/read-refs.test.ts

@@ -0,0 +1,195 @@
+import { describe, test, expect, vi, beforeEach, afterEach } from "vitest";
+import { describeResources } from "./describe-resources";
+import { CloudRunServiceComposite } from "./composites/cloud-run-service";
+import {
+  BackendService,
+  CloudRunService,
+  ComputeAddress,
+  ForwardingRule,
+  IAMPolicyMember,
+  RegionNetworkEndpointGroup,
+  Subnetwork,
+  TargetHTTPProxy,
+  URLMap,
+  VPCNetwork,
+} from "./generated";
+
+/**
+ * #4251: behold's three-cloud gcp member, read back. Every resource here names
+ * another by `.name`, an attribute reference the serializer resolves to the
+ * target's metadata.name (#4245). The read path has to resolve it the same way
+ * before a mapper builds a URL from the declared props.
+ */
+const fetchMock = vi.fn();
+
+function reply(status: number, body: unknown) {
+  return { status, text: async () => JSON.stringify(body) };
+}
+
+function estate() {
+  const web = new CloudRunService({ metadata: { name: "three-cloud-site" }, location: "us-central1", template: {} } as never);
+  const vpc = new VPCNetwork({ metadata: { name: "three-cloud-vpc" }, autoCreateSubnetworks: false } as never);
+  const subnet = new Subnetwork({
+    metadata: { name: "three-cloud-subnet" },
+    region: "us-central1",
+    ipCidrRange: "10.8.0.0/24",
+    networkRef: { name: vpc.name },
+  } as never);
+  (web as unknown as { props: Record<string, unknown> }).props.template = {
+    containers: [{ image: "gcr.io/p/site:1" }],
+    vpcAccess: { egress: "ALL_TRAFFIC", networkInterfaces: [{ networkRef: { name: vpc.name }, subnetworkRef: { name: subnet.name } }] },
+  };
+  const neg = new RegionNetworkEndpointGroup({
+    metadata: { name: "three-cloud-neg" },
+    region: "us-central1",
+    networkEndpointType: "SERVERLESS",
+    cloudRun: { serviceRef: { name: web.name } },
+  } as never);
+  const backend = new BackendService({
+    metadata: { name: "three-cloud-backend" },
+    location: "global",
+    loadBalancingScheme: "EXTERNAL_MANAGED",
+    backend: [{ group: { networkEndpointGroupRef: { name: neg.name } } }],
+  } as never);
+  const urlMap = new URLMap({
+    metadata: { name: "three-cloud-urlmap" },
+    location: "global",
+    defaultService: { backendServiceRef: { name: backend.name } },
+  } as never);
+  const proxy = new TargetHTTPProxy({ metadata: { name: "three-cloud-proxy" }, location: "global", urlMapRef: { name: urlMap.name } } as never);
+  const address = new ComputeAddress({ metadata: { name: "three-cloud-ip" }, location: "global" } as never);
+  const rule = new ForwardingRule({
+    metadata: { name: "three-cloud-rule" },
+    location: "global",
+    loadBalancingScheme: "EXTERNAL_MANAGED",
+    portRange: "80",
+    target: { targetHTTPProxyRef: { name: proxy.name } },
+    ipAddress: { addressRef: { name: address.name } },
+  } as never);
+  const publicIam = new IAMPolicyMember({
+    metadata: { name: "three-cloud-site-public" },
+    member: "allUsers",
+    role: "roles/run.invoker",
+    resourceRef: { apiVersion: "run.cnrm.cloud.google.com/v1beta1", kind: "RunService", name: "three-cloud-site" },
+  } as never);
+  const all = { web, vpc, subnet, neg, backend, urlMap, proxy, address, rule, publicIam };
+  return new Map(
+    Object.entries(all).map(([logical, e]) => {
+      const entity = e as unknown as { entityType: string; props: Record<string, unknown> };
+      return [logical, { entityType: entity.entityType, props: entity.props }];
+    }),
+  );
+}
+
+describe("gcp live read resolves .name references as the build does (#4251)", () => {
+  beforeEach(() => {
+    fetchMock.mockReset();
+    vi.stubGlobal("fetch", fetchMock);
+    process.env.GCP_ENDPOINT_URL = "http://localhost:4588";
+    process.env.GOOGLE_CLOUD_PROJECT = "three-cloud";
+    fetchMock.mockImplementation(async (url: string) => {
+      if (url.includes(":getIamPolicy")) {
+        return reply(200, { etag: "e1", bindings: [{ role: "roles/run.invoker", members: ["allUsers"] }] });
+      }
+      return reply(200, { id: url, name: url.split("/").pop() });
+    });
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    delete process.env.GCP_ENDPOINT_URL;
+    delete process.env.GOOGLE_CLOUD_PROJECT;
+  });
+
+  test("every resource reads, by the names the build writes, and none fails on a reference", async () => {
+    const entities = estate();
+    const out = await describeResources({ environment: "local", buildOutput: "", entityNames: [...entities.keys()], entities });
+
+    expect(out.unobserved ?? {}).toEqual({});
+    for (const logical of entities.keys()) {
+      expect(out.resources[logical]?.physicalId, logical).toBeTruthy();
+    }
+    const urls = fetchMock.mock.calls.map((c) => String(c[0]));
+    for (const name of ["three-cloud-neg", "three-cloud-backend", "three-cloud-urlmap", "three-cloud-proxy", "three-cloud-rule", "three-cloud-subnet", "three-cloud-site"]) {
+      expect(urls.some((u) => u.includes(name)), name).toBe(true);
+    }
+    expect(urls.every((u) => !u.includes("[object"))).toBe(true);
+  });
+
+  test("the public IAMPolicyMember reads as the binding in the service's policy, with a physical id", async () => {
+    const entities = estate();
+    const out = await describeResources({ environment: "local", buildOutput: "", entityNames: [...entities.keys()], entities });
+    expect(out.resources.publicIam?.physicalId).toBe(
+      "projects/three-cloud/locations/us-central1/services/three-cloud-site#roles/run.invoker#allUsers",
+    );
+  });
+
+  test("a binding missing from the policy reads as absent, not observed", async () => {
+    fetchMock.mockImplementation(async (url: string) =>
+      url.includes(":getIamPolicy") ? reply(200, { etag: "e1", bindings: [] }) : reply(200, { id: url }),
+    );
+    const entities = estate();
+    const out = await describeResources({ environment: "local", buildOutput: "", entityNames: [...entities.keys()], entities });
+    expect(out.resources.publicIam).toBeUndefined();
+    expect(out.unobserved?.publicIam).toBeUndefined();
+  });
+});
+
+/**
+ * #4251, the IAM binding behold saw as pending: the public IAMPolicyMember of a
+ * CloudRunServiceComposite whose service runs outside us-central1. The binding
+ * names its service by `name`, so the read has to take the service's region from
+ * the declared service, as apply does, or it asks a region where the service
+ * isn't, gets a 404 and reports the binding absent.
+ */
+describe("the public binding of a service outside us-central1 reads as observed (#4251)", () => {
+  const policyUrl = "/v2/projects/three-cloud/locations/asia-northeast1/services/three-cloud-site:getIamPolicy";
+
+  function composite() {
+    const { service, publicIam } = CloudRunServiceComposite({
+      name: "three-cloud-site",
+      image: "gcr.io/p/site:1",
+      projectId: "three-cloud",
+      location: "asia-northeast1",
+      publicAccess: true,
+    }) as unknown as Record<string, { entityType: string; props: Record<string, unknown> }>;
+    return [
+      ["webService", { entityType: service.entityType, props: service.props }],
+      ["webPublicIam", { entityType: publicIam.entityType, props: publicIam.props }],
+    ] as Array<[string, { entityType: string; props: Record<string, unknown> }]>;
+  }
+
+  beforeEach(() => {
+    fetchMock.mockReset();
+    vi.stubGlobal("fetch", fetchMock);
+    process.env.GCP_ENDPOINT_URL = "http://localhost:4588";
+    process.env.GCP_PROJECT_ID = "three-cloud";
+    delete process.env.GCP_REGION;
+    fetchMock.mockImplementation(async (url: string) => {
+      if (url.includes(":getIamPolicy")) {
+        return url.includes(policyUrl)
+          ? reply(200, { bindings: [{ role: "roles/run.invoker", members: ["allUsers"] }] })
+          : reply(404, { error: { code: 404 } });
+      }
+      return reply(200, { name: url.split("?")[0].split("/").slice(-6).join("/") });
+    });
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    delete process.env.GCP_ENDPOINT_URL;
+    delete process.env.GCP_PROJECT_ID;
+  });
+
+  for (const order of ["service first", "binding first"]) {
+    test(`webPublicIam is observed with a physical id, ${order}`, async () => {
+      const pairs = composite();
+      const entities = new Map(order === "service first" ? pairs : [...pairs].reverse());
+      const out = await describeResources({ environment: "local", buildOutput: "", entityNames: [...entities.keys()], entities });
+      expect(out.unobserved?.webPublicIam).toBeUndefined();
+      expect(out.resources.webPublicIam?.physicalId).toBe(
+        "projects/three-cloud/locations/asia-northeast1/services/three-cloud-site#roles/run.invoker#allUsers",
+      );
+    });
+  }
+});

package/src/serializer.ts

@@ -8,7 +8,8 @@
 import { createRequire } from "module";
 import { moduleSourceUrl } from "@intentius/chant/module-source";
 import type { Declarable } from "@intentius/chant/declarable";
-import { isPropertyDeclarable, isResourceDeclarable } from "@intentius/chant/declarable";
+import { isDeclarable, isPropertyDeclarable, isResourceDeclarable } from "@intentius/chant/declarable";
+import { AttrRef } from "@intentius/chant/attrref";
 import type { Serializer, SerializerResult, SerializeContext } from "@intentius/chant/serializer";
 import { ownershipEntries, LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
 import type { LexiconOutput } from "@intentius/chant/lexicon-output";
@@ -113,11 +114,42 @@ function gcpVisitor(entityNames: Map<Declarable, string>): SerializerVisitor {
  * props, else its logical id in kebab case.
  */
 export function cnrmName(logical: string, entity: Declarable): string {
-  const props = isResourceDeclarable(entity) ? (entity.props as { metadata?: { name?: unknown } } | undefined) : undefined;
-  const declared = props?.metadata?.name;
+  return cnrmNameOf(logical, isResourceDeclarable(entity) ? entity.props : undefined);
+}
+
+/** {@link cnrmName} from a resource's props, for callers holding props rather than the declarable. */
+export function cnrmNameOf(logical: string, props: unknown): string {
+  const declared = (props as { metadata?: { name?: unknown } } | undefined)?.metadata?.name;
   return typeof declared === "string" && declared.length > 0 ? declared : kebabName(logical);
 }
 
+/**
+ * Declared props with each reference to another resource replaced as the
+ * serializer writes it (#4251): an attribute reference (`neg.name`) becomes the
+ * target's metadata.name, and a resource placed whole becomes `{ name }`.
+ * `logicalOf` maps a target's props object to its logical id, for a reference
+ * that does not carry one. Other values, pseudo-parameters included, are kept.
+ */
+export function resolveCnrmRefs(value: unknown, logicalOf: (props: unknown) => string | undefined): unknown {
+  if (value instanceof AttrRef) {
+    const parent = value.parent.deref() as Declarable | undefined;
+    const props = parent && isResourceDeclarable(parent) ? parent.props : undefined;
+    const logical = value.getLogicalName() ?? logicalOf(props);
+    return logical === undefined ? value : cnrmNameOf(logical, props);
+  }
+  if (Array.isArray(value)) return value.map((v) => resolveCnrmRefs(v, logicalOf));
+  if (value === null || typeof value !== "object") return value;
+  if (isDeclarable(value)) {
+    const props = isResourceDeclarable(value) ? value.props : undefined;
+    const logical = logicalOf(props);
+    return logical === undefined ? value : { name: cnrmNameOf(logical, props) };
+  }
+  if (INTRINSIC_MARKER in (value as object)) return value;
+  const out: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(value as Record<string, unknown>)) out[k] = resolveCnrmRefs(v, logicalOf);
+  return out;
+}
+
 function kebabName(logical: string): string {
   return logical.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
 }
@@ -163,7 +195,11 @@ export const gcpSerializer: Serializer = {
     let defaultLabelEntries: Record<string, unknown> = context?.ownership
       ? { ...ownershipEntries(LABEL_OWNERSHIP_KEYS, context.ownership) }
       : {};
-    let defaultAnnotationEntries: Record<string, unknown> = {};
+    // #4252: a member's project, once, in chant.config's `gcp.project`. It
+    // resolves GCP.ProjectId and is written as each resource's project-id
+    // annotation, which apply and the readers take ahead of the env vars.
+    const configProject = gcpConfigProject(context?.config);
+    let defaultAnnotationEntries: Record<string, unknown> = configProject ? { [PROJECT_ID_ANNOTATION]: configProject } : {};
 
     for (const [, entity] of entities) {
       if (isDefaultLabels(entity)) {
@@ -189,6 +225,7 @@ export const gcpSerializer: Serializer = {
         toYAMLValue(isResourceDeclarable(entity) ? entity.props : undefined, entityNames),
         name,
         unresolved,
+        configProject,
       ) as Record<string, unknown> | undefined;
 
       if (!props) continue;
@@ -246,6 +283,14 @@ export const gcpSerializer: Serializer = {
   },
 };
 
+const PROJECT_ID_ANNOTATION = "cnrm.cloud.google.com/project-id";
+
+/** The `gcp.project` a chant.config declares, if any (#4252). */
+export function gcpConfigProject(config: Record<string, unknown> | undefined): string | undefined {
+  const project = (config?.gcp as { project?: unknown } | undefined)?.project;
+  return typeof project === "string" && project.length > 0 ? project : undefined;
+}
+
 /**
  * Pseudo-parameter → environment variable mapping.
  * Config Connector annotations must be plain strings, so PseudoParameters
@@ -270,20 +315,20 @@ interface UnresolvedPseudo {
  * the API as an object. A variable that isn't set is recorded, and the
  * build refuses with every one named.
  */
-function resolvePseudoParameters(value: unknown, entity: string, unresolved: UnresolvedPseudo[]): unknown {
-  if (Array.isArray(value)) return value.map((v) => resolvePseudoParameters(v, entity, unresolved));
+function resolvePseudoParameters(value: unknown, entity: string, unresolved: UnresolvedPseudo[], project?: string): unknown {
+  if (Array.isArray(value)) return value.map((v) => resolvePseudoParameters(v, entity, unresolved, project));
   if (value === null || typeof value !== "object") return value;
   const obj = value as Record<string, unknown>;
   const keys = Object.keys(obj);
   if (keys.length === 1 && keys[0] === "Ref" && typeof obj.Ref === "string" && obj.Ref in PSEUDO_ENV_MAP) {
     const { envVar } = PSEUDO_ENV_MAP[obj.Ref];
-    const resolved = process.env[envVar];
+    const resolved = (obj.Ref === "GCP::ProjectId" ? project : undefined) ?? process.env[envVar];
     if (resolved) return resolved;
     unresolved.push({ entity, ref: obj.Ref, envVar });
     return value;
   }
   const out: Record<string, unknown> = {};
-  for (const [k, v] of Object.entries(obj)) out[k] = resolvePseudoParameters(v, entity, unresolved);
+  for (const [k, v] of Object.entries(obj)) out[k] = resolvePseudoParameters(v, entity, unresolved, project);
   return out;
 }