@intentius/chant-lexicon-gcp 0.41.20 → 0.44.1

package/src/governance.ts

@@ -0,0 +1,179 @@
+/**
+ * GCP governance authoring (#791, epic #787 C1): the desired-state config
+ * shape the GCP cloud warden reconciles, and `landingZoneConfig()` — the
+ * typed authoring layer that emits it.
+ *
+ * This is deliberately NOT a composite. The evaluability rules (EVL002/004,
+ * #916/#952) require composites to declare a fixed set of resources, so a
+ * data-driven folder tree walker cannot be one. The split mirrors the AWS
+ * slice (lexicons/aws/src/governance.ts): authoring emits config (this
+ * module, arbitrary cardinality); resources for greenfield bootstrap are the
+ * fixed-shape composites in `composites/landing-zone.ts`; the warden
+ * consumes only the config.
+ *
+ * GCP has no OrganizationRoot analog — organizations are created through
+ * Cloud Identity / Workspace, never through the resource API.
+ */
+
+// ---------------------------------------------------------------------------
+// The desired-state config shape the GCP cloud warden consumes
+// ---------------------------------------------------------------------------
+
+/** An org-policy definition, keyed by name in `GcpGovernanceConfig.orgPolicies`. */
+export interface OrgPolicyConfig {
+  description?: string;
+  /** The constraint the policy binds, e.g. "iam.disableServiceAccountKeyCreation". */
+  constraint: string;
+  /** OrgPolicyPolicy `spec.rules` entries (enforce / values.allowedValues / …). */
+  rules: Array<Record<string, unknown>>;
+}
+
+/** A project declared inside a folder. */
+export interface ProjectConfig {
+  name: string;
+  /** Defaults to `name`. */
+  projectId?: string;
+}
+
+/** One folder: its guardrails, projects, and child folders, keyed by display name. */
+export interface FolderConfig {
+  /** Names of org policies (from `orgPolicies`) attached to this folder. */
+  orgPolicies?: string[];
+  projects?: ProjectConfig[];
+  children?: Record<string, FolderConfig>;
+}
+
+/**
+ * The desired-state governance tree for one GCP organization. This is the
+ * shape the GCP cloud warden loads as config — the GCP counterpart of
+ * `AwsGovernanceConfig`. Cycles map onto the governance verbs (#790): the
+ * folder/project tree is `org-unit`, org policies are `policy-guardrail`,
+ * audit configuration is `audit-sink`.
+ */
+export interface GcpGovernanceConfig {
+  organization: {
+    /** Org-policy names enforced at the organization root. */
+    orgPolicies?: string[];
+  };
+  /** Top-level folders under the organization, keyed by display name. */
+  folders: Record<string, FolderConfig>;
+  /** Org-policy definitions, keyed by the names the tree attaches. */
+  orgPolicies: Record<string, OrgPolicyConfig>;
+  /** Where audit evidence flows. */
+  auditSinks?: {
+    auditConfig?: { service: string; logTypes: string[] };
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Baseline guardrails (shared with the bootstrap composites)
+// ---------------------------------------------------------------------------
+
+export const DISABLE_SA_KEY_CREATION: OrgPolicyConfig = {
+  description: "User-managed service account keys cannot be created.",
+  constraint: "iam.disableServiceAccountKeyCreation",
+  rules: [{ enforce: "TRUE" }],
+};
+
+export const SKIP_DEFAULT_NETWORK: OrgPolicyConfig = {
+  description: "New projects do not get the auto-mode default VPC.",
+  constraint: "compute.skipDefaultNetworkCreation",
+  rules: [{ enforce: "TRUE" }],
+};
+
+/** Allow resource creation only in `locations` (value-group syntax like "in:us-locations" works too). */
+export function resourceLocationRestriction(locations: readonly string[]): OrgPolicyConfig {
+  return {
+    description: `Resources may only be created in [${locations.join(", ")}].`,
+    constraint: "gcp.resourceLocations",
+    rules: [{ values: { allowedValues: [...locations] } }],
+  };
+}
+
+/** The audit-log coverage `auditAllServices` declares. */
+export const AUDIT_ALL_SERVICES = {
+  service: "allServices",
+  logTypes: ["ADMIN_READ", "DATA_READ", "DATA_WRITE"],
+} as const;
+
+/**
+ * The recommended foundation folder structure. Exported so callers can
+ * extend it rather than restate it.
+ */
+export const FOUNDATION_FOLDERS: Record<string, FolderConfig> = {
+  Security: {},
+  Infrastructure: {},
+  Sandbox: {},
+  Workloads: {},
+};
+
+// ---------------------------------------------------------------------------
+// Authoring
+// ---------------------------------------------------------------------------
+
+export interface LandingZoneConfigProps {
+  /**
+   * Start from the recommended foundation: Security / Infrastructure /
+   * Sandbox / Workloads folders with `disable-sa-key-creation` and
+   * `skip-default-network` enforced at the organization root. Default true;
+   * your `folders`/`orgPolicies` merge over it (same-name keys win).
+   */
+  foundation?: boolean;
+  /** Adds a root resource-location org policy allowing only these locations. */
+  allowedLocations?: string[];
+  /** Folder tree, merged over the foundation's. Greenfield (full tree) and brownfield (partial subtree) are both just this map. */
+  folders?: Record<string, FolderConfig>;
+  /** Org-policy definitions, merged over the foundation's. */
+  orgPolicies?: Record<string, OrgPolicyConfig>;
+  /** Extra org-policy names to enforce at the organization root. */
+  rootOrgPolicies?: string[];
+  /** Declare organization-wide audit logging (allServices, all three log types). */
+  auditAllServices?: boolean;
+}
+
+/**
+ * Author the desired-state tree the GCP cloud warden reconciles. Pure.
+ * Throws when the tree attaches an org-policy name with no definition; only
+ * policies the tree actually attaches are included in the output.
+ */
+export function landingZoneConfig(props: LandingZoneConfigProps = {}): GcpGovernanceConfig {
+  const foundation = props.foundation ?? true;
+  const orgPolicies: Record<string, OrgPolicyConfig> = {
+    ...(foundation
+      ? { "disable-sa-key-creation": DISABLE_SA_KEY_CREATION, "skip-default-network": SKIP_DEFAULT_NETWORK }
+      : {}),
+    ...(props.allowedLocations?.length
+      ? { "resource-location-restriction": resourceLocationRestriction(props.allowedLocations) }
+      : {}),
+    ...props.orgPolicies,
+  };
+  const folders = { ...(foundation ? FOUNDATION_FOLDERS : {}), ...props.folders };
+  const rootOrgPolicies = [
+    ...(foundation ? ["disable-sa-key-creation", "skip-default-network"] : []),
+    ...(props.allowedLocations?.length ? ["resource-location-restriction"] : []),
+    ...(props.rootOrgPolicies ?? []),
+  ];
+
+  const attached = new Set(rootOrgPolicies);
+  const collect = (tree: Record<string, FolderConfig>): void => {
+    for (const node of Object.values(tree)) {
+      for (const p of node.orgPolicies ?? []) attached.add(p);
+      if (node.children) collect(node.children);
+    }
+  };
+  collect(folders);
+  for (const name of attached) {
+    if (!orgPolicies[name]) {
+      throw new Error(`landingZoneConfig: org policy "${name}" is attached but not defined in orgPolicies`);
+    }
+  }
+
+  return {
+    organization: rootOrgPolicies.length ? { orgPolicies: rootOrgPolicies } : {},
+    folders,
+    orgPolicies: Object.fromEntries(Object.entries(orgPolicies).filter(([n]) => attached.has(n))),
+    ...(props.auditAllServices
+      ? { auditSinks: { auditConfig: { service: AUDIT_ALL_SERVICES.service, logTypes: [...AUDIT_ALL_SERVICES.logTypes] } } }
+      : {}),
+  };
+}

package/src/index.ts

@@ -23,6 +23,7 @@ export {
   GkeCluster, CloudRunServiceComposite, CloudSqlInstance, GcsBucket, VpcNetwork,
   PubSubPipeline, CloudFunctionWithTrigger, PrivateService, ManagedCertificate, SecureProject,
   MemorystoreRedis, MultiRegionVpc, GkeCrdbRegion,
+  GovernanceFoundation, LocationRestriction, OrganizationAuditConfig,
 } from "./composites/index";
 export type {
   GkeClusterProps,
@@ -38,8 +39,17 @@ export type {
   MemorystoreRedisProps,
   MultiRegionVpcConfig, MultiRegionVpcRegion,
   GkeCrdbRegionConfig, GkeCrdbRegionNodeConfig,
+  GovernanceFoundationProps, LocationRestrictionProps, OrganizationAuditConfigProps,
 } from "./composites/index";
 
+// GCP governance authoring (#791): the desired-state config the GCP cloud
+// warden reconciles, and the typed landing-zone authoring layer.
+export {
+  landingZoneConfig, resourceLocationRestriction,
+  DISABLE_SA_KEY_CREATION, SKIP_DEFAULT_NETWORK, AUDIT_ALL_SERVICES, FOUNDATION_FOLDERS,
+} from "./governance";
+export type { GcpGovernanceConfig, LandingZoneConfigProps, FolderConfig, OrgPolicyConfig, ProjectConfig } from "./governance";
+
 // IAM role constants
 export { StorageRoles, ComputeRoles, ContainerRoles, IAMRoles, SQLRoles, RunRoles, PubSubRoles } from "./actions/index";
 

package/src/lifecycle-integration.test.ts

@@ -2,9 +2,9 @@
  * Cross-lexicon lifecycle integration (#163) — GCP row.
  *
  * Drives the REAL gcpPlugin through core's live-import driver and the changeset
- * path. Two edges are mocked, because since #1209 the plugin has two
- * transports: `describeResources` reads GCP REST (stubbed `fetch`), while
- * `exportResources` and the deep reader still go through Config Connector
+ * path. Two edges are mocked, because the plugin has two transports:
+ * `describeResources` and the deep reader read GCP REST (stubbed `fetch`,
+ * #1209), while `exportResources` still goes through Config Connector
  * (stubbed `exec`).
  */
 import { describe, test, expect, vi, beforeEach } from "vitest";

package/src/lint/audit-catalog.ts

@@ -30,4 +30,9 @@ export const gcpAuditCatalog: Record<string, RuleMeta> = {
   WGC401: auditRule("WGC401", "merge-worthy", "guidance", "Unknown field in resource spec", "Remove the unknown spec field.", { category: "correctness" }),
   WGC402: auditRule("WGC402", "merge-worthy", "guidance", "Missing required spec field", "Add the required spec field.", { category: "correctness" }),
   WGC403: auditRule("WGC403", "merge-worthy", "guidance", "Spec field has wrong type/structure", "Fix the field's type/structure.", { category: "correctness" }),
+
+  // #793 — governance posture regressions (epic #787 C3).
+  WGC501: auditRule("WGC501", "merge-worthy", "guidance", "Org Policy guardrail not enforced", "Enable enforce on the rule (or remove the policy deliberately) — a disabled org policy constrains nothing.", { authority: [GCP_SEC] }),
+  WGC502: auditRule("WGC502", "merge-worthy", "guidance", "Org Policy guardrail defines no rules", "Add rules to the OrgPolicyPolicy — without them the constraint binds nothing.", { authority: [GCP_SEC] }),
+  WGC503: auditRule("WGC503", "merge-worthy", "guidance", "Audit logging dropped or scoped down", "Keep auditLogConfigs populated and remove exemptedMembers from the IAMAuditConfig.", { authority: [GCP_SEC] }),
 };

package/src/lint/post-synth/index.ts

@@ -23,6 +23,9 @@ import { wgc303 } from "./wgc303";
 import { wgc401 } from "./wgc401";
 import { wgc402 } from "./wgc402";
 import { wgc403 } from "./wgc403";
+import { wgc501 } from "./wgc501";
+import { wgc502 } from "./wgc502";
+import { wgc503 } from "./wgc503";
 
 export const postSynthChecks: PostSynthCheck[] = [
   wgc101,
@@ -48,4 +51,7 @@ export const postSynthChecks: PostSynthCheck[] = [
   wgc401,
   wgc402,
   wgc403,
+  wgc501,
+  wgc502,
+  wgc503,
 ];

package/src/lint/post-synth/wgc501.test.ts

@@ -0,0 +1,87 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgc501 } from "./wgc501";
+
+function makeCtx(yaml: string): PostSynthContext {
+  const outputs = new Map<string, string>([["gcp", yaml]]);
+  return {
+    outputs,
+    entities: new Map(),
+    buildResult: { outputs, entities: new Map(), warnings: [], errors: [], sourceFileCount: 0 },
+  };
+}
+
+describe("WGC501: org policy guardrail not enforced", () => {
+  test("flags a rule with enforce disabled (serializer's nested spec.spec)", () => {
+    const yaml = `apiVersion: orgpolicy.cnrm.cloud.google.com/v1beta1
+kind: OrgPolicyPolicy
+metadata:
+  name: disable-sa-key-creation
+spec:
+  resourceID: iam.disableServiceAccountKeyCreation
+  organizationRef:
+    external: "123456789012"
+  spec:
+    rules:
+      - enforce: "FALSE"
+`;
+    const diags = wgc501.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGC501");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].entity).toBe("disable-sa-key-creation");
+  });
+
+  test("flags boolean false and flat spec.rules", () => {
+    const yaml = `apiVersion: orgpolicy.cnrm.cloud.google.com/v1beta1
+kind: OrgPolicyPolicy
+metadata:
+  name: skip-default-network
+spec:
+  rules:
+    - enforce: false
+`;
+    expect(wgc501.check(makeCtx(yaml))).toHaveLength(1);
+  });
+
+  test("flags a policy that resets the constraint to default", () => {
+    const yaml = `apiVersion: orgpolicy.cnrm.cloud.google.com/v1beta1
+kind: OrgPolicyPolicy
+metadata:
+  name: reset-policy
+spec:
+  spec:
+    reset: true
+`;
+    const diags = wgc501.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("reset");
+  });
+
+  test("no diagnostic for an enforced policy", () => {
+    const yaml = `apiVersion: orgpolicy.cnrm.cloud.google.com/v1beta1
+kind: OrgPolicyPolicy
+metadata:
+  name: disable-sa-key-creation
+spec:
+  spec:
+    rules:
+      - enforce: "TRUE"
+      - values:
+          allowedValues:
+            - in:eu-locations
+`;
+    expect(wgc501.check(makeCtx(yaml))).toHaveLength(0);
+  });
+
+  test("ignores other kinds", () => {
+    const yaml = `apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
+kind: ResourcemanagerFolder
+metadata:
+  name: security
+spec:
+  displayName: Security
+`;
+    expect(wgc501.check(makeCtx(yaml))).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgc501.ts

@@ -0,0 +1,73 @@
+/**
+ * WGC501: Org Policy Guardrail Not Enforced (#793, epic #787 C3)
+ *
+ * Flags OrgPolicyPolicy resources whose rules switch enforcement off or that
+ * reset the constraint to its default. A disabled org policy is the GCP
+ * shape of a weakened guardrail: the constraint stays visible in the tree
+ * while constraining nothing.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseGcpManifests, getResourceName, type GcpManifest } from "./gcp-helpers";
+
+/**
+ * OrgPolicyPolicy mirrors the API's own `spec` inside the CRD spec, so rules
+ * live at `spec.spec.rules`; accept `spec.rules` too for hand-written manifests.
+ */
+export function orgPolicySpec(manifest: GcpManifest): Record<string, unknown> {
+  const outer = manifest.spec ?? {};
+  const inner = outer.spec;
+  return typeof inner === "object" && inner !== null ? (inner as Record<string, unknown>) : outer;
+}
+
+export function orgPolicyRules(manifest: GcpManifest): Array<Record<string, unknown>> {
+  const rules = orgPolicySpec(manifest).rules;
+  return Array.isArray(rules) ? (rules as Array<Record<string, unknown>>) : [];
+}
+
+function isDisabled(rule: Record<string, unknown>): boolean {
+  return rule.enforce === false || rule.enforce === "FALSE";
+}
+
+export const wgc501: PostSynthCheck = {
+  id: "WGC501",
+  description: "Org Policy guardrail not enforced — a disabled policy constrains nothing",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      if (typeof output !== "string") continue;
+
+      for (const manifest of parseGcpManifests(output)) {
+        if (manifest.kind !== "OrgPolicyPolicy") continue;
+        const name = getResourceName(manifest);
+
+        if (orgPolicySpec(manifest).reset === true) {
+          diagnostics.push({
+            checkId: "WGC501",
+            severity: "error",
+            message: `OrgPolicyPolicy "${name}" resets the constraint to its default — the guardrail is switched off`,
+            entity: name,
+            lexicon: "gcp",
+          });
+          continue;
+        }
+
+        for (const rule of orgPolicyRules(manifest)) {
+          if (isDisabled(rule)) {
+            diagnostics.push({
+              checkId: "WGC501",
+              severity: "error",
+              message: `OrgPolicyPolicy "${name}" has a rule with enforce disabled — the guardrail is declared but not enforced`,
+              entity: name,
+              lexicon: "gcp",
+            });
+          }
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/wgc502.test.ts

@@ -0,0 +1,64 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgc502 } from "./wgc502";
+
+function makeCtx(yaml: string): PostSynthContext {
+  const outputs = new Map<string, string>([["gcp", yaml]]);
+  return {
+    outputs,
+    entities: new Map(),
+    buildResult: { outputs, entities: new Map(), warnings: [], errors: [], sourceFileCount: 0 },
+  };
+}
+
+describe("WGC502: org policy guardrail defines no rules", () => {
+  test("flags a policy with no rules", () => {
+    const yaml = `apiVersion: orgpolicy.cnrm.cloud.google.com/v1beta1
+kind: OrgPolicyPolicy
+metadata:
+  name: hollow-guardrail
+spec:
+  resourceID: iam.disableServiceAccountKeyCreation
+  organizationRef:
+    external: "123456789012"
+`;
+    const diags = wgc502.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGC502");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].entity).toBe("hollow-guardrail");
+  });
+
+  test("flags an empty rules array", () => {
+    const yaml = `apiVersion: orgpolicy.cnrm.cloud.google.com/v1beta1
+kind: OrgPolicyPolicy
+metadata:
+  name: empty-rules
+spec:
+  spec:
+    rules: []
+`;
+    expect(wgc502.check(makeCtx(yaml))).toHaveLength(1);
+  });
+
+  test("no diagnostic when rules exist or the policy resets to default", () => {
+    const yaml = `apiVersion: orgpolicy.cnrm.cloud.google.com/v1beta1
+kind: OrgPolicyPolicy
+metadata:
+  name: enforced
+spec:
+  spec:
+    rules:
+      - enforce: "TRUE"
+---
+apiVersion: orgpolicy.cnrm.cloud.google.com/v1beta1
+kind: OrgPolicyPolicy
+metadata:
+  name: reset-policy
+spec:
+  spec:
+    reset: true
+`;
+    expect(wgc502.check(makeCtx(yaml))).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgc502.ts

@@ -0,0 +1,41 @@
+/**
+ * WGC502: Org Policy Guardrail Defines No Rules (#793, epic #787 C3)
+ *
+ * Flags OrgPolicyPolicy resources with no rules (and no reset). A rule-less
+ * org policy binds a constraint to nothing — the usual leftover of a
+ * guardrail whose rules were removed while the policy object was kept.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseGcpManifests, getResourceName } from "./gcp-helpers";
+import { orgPolicyRules, orgPolicySpec } from "./wgc501";
+
+export const wgc502: PostSynthCheck = {
+  id: "WGC502",
+  description: "Org Policy guardrail defines no rules — it binds its constraint to nothing",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      if (typeof output !== "string") continue;
+
+      for (const manifest of parseGcpManifests(output)) {
+        if (manifest.kind !== "OrgPolicyPolicy") continue;
+        if (orgPolicySpec(manifest).reset === true) continue; // WGC501's finding
+        if (orgPolicyRules(manifest).length > 0) continue;
+
+        const name = getResourceName(manifest);
+        diagnostics.push({
+          checkId: "WGC502",
+          severity: "error",
+          message: `OrgPolicyPolicy "${name}" defines no rules — the guardrail constrains nothing`,
+          entity: name,
+          lexicon: "gcp",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/wgc503.test.ts

@@ -0,0 +1,77 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgc503 } from "./wgc503";
+
+function makeCtx(yaml: string): PostSynthContext {
+  const outputs = new Map<string, string>([["gcp", yaml]]);
+  return {
+    outputs,
+    entities: new Map(),
+    buildResult: { outputs, entities: new Map(), warnings: [], errors: [], sourceFileCount: 0 },
+  };
+}
+
+describe("WGC503: audit logging dropped or scoped down", () => {
+  test("flags an IAMAuditConfig with no auditLogConfigs", () => {
+    const yaml = `apiVersion: iam.cnrm.cloud.google.com/v1beta1
+kind: IAMAuditConfig
+metadata:
+  name: audit-config
+spec:
+  resourceRef:
+    kind: Organization
+    external: organizations/123456789012
+  service: allServices
+`;
+    const diags = wgc503.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGC503");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].message).toContain("captures nothing");
+  });
+
+  test("flags exempted members", () => {
+    const yaml = `apiVersion: iam.cnrm.cloud.google.com/v1beta1
+kind: IAMAuditConfig
+metadata:
+  name: audit-config
+spec:
+  service: allServices
+  auditLogConfigs:
+    - logType: ADMIN_READ
+    - logType: DATA_WRITE
+      exemptedMembers:
+        - user:cto@acme.dev
+`;
+    const diags = wgc503.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("DATA_WRITE");
+    expect(diags[0].message).toContain("exempts");
+  });
+
+  test("no diagnostic for full coverage without exemptions", () => {
+    const yaml = `apiVersion: iam.cnrm.cloud.google.com/v1beta1
+kind: IAMAuditConfig
+metadata:
+  name: audit-config
+spec:
+  service: allServices
+  auditLogConfigs:
+    - logType: ADMIN_READ
+    - logType: DATA_READ
+    - logType: DATA_WRITE
+`;
+    expect(wgc503.check(makeCtx(yaml))).toHaveLength(0);
+  });
+
+  test("ignores other kinds", () => {
+    const yaml = `apiVersion: storage.cnrm.cloud.google.com/v1beta1
+kind: StorageBucket
+metadata:
+  name: my-bucket
+spec:
+  location: US
+`;
+    expect(wgc503.check(makeCtx(yaml))).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgc503.ts

@@ -0,0 +1,56 @@
+/**
+ * WGC503: Audit Logging Dropped or Scoped Down (#793, epic #787 C3)
+ *
+ * Flags IAMAuditConfig resources that capture nothing (no auditLogConfigs)
+ * or that carve identities out of the audit trail via exemptedMembers.
+ * WGC301 reports the absence of any IAMAuditConfig as hygiene; this check
+ * covers the declared-but-weakened sink, which is merge-worthy.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseGcpManifests, getResourceName, getSpec } from "./gcp-helpers";
+
+export const wgc503: PostSynthCheck = {
+  id: "WGC503",
+  description: "IAMAuditConfig captures nothing or exempts members — the audit sink is scoped down",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      if (typeof output !== "string") continue;
+
+      for (const manifest of parseGcpManifests(output)) {
+        if (manifest.kind !== "IAMAuditConfig") continue;
+        const name = getResourceName(manifest);
+        const configs = getSpec(manifest)?.auditLogConfigs;
+
+        if (!Array.isArray(configs) || configs.length === 0) {
+          diagnostics.push({
+            checkId: "WGC503",
+            severity: "error",
+            message: `IAMAuditConfig "${name}" has no auditLogConfigs — the audit sink is declared but captures nothing`,
+            entity: name,
+            lexicon: "gcp",
+          });
+          continue;
+        }
+
+        for (const config of configs as Array<Record<string, unknown>>) {
+          const exempted = config.exemptedMembers;
+          if (Array.isArray(exempted) && exempted.length > 0) {
+            diagnostics.push({
+              checkId: "WGC503",
+              severity: "error",
+              message: `IAMAuditConfig "${name}" exempts members from ${String(config.logType ?? "audit")} logging — audit evidence is scoped down`,
+              entity: name,
+              lexicon: "gcp",
+            });
+          }
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/plugin.test.ts

@@ -30,7 +30,7 @@ describe("gcpPlugin", () => {
 
   test("returns post-synth checks", () => {
     const checks = gcpPlugin.postSynthChecks!();
-    expect(checks).toHaveLength(23);
+    expect(checks).toHaveLength(26);
     const ids = checks.map((c) => c.id);
     expect(ids).toContain("WGC101");
     expect(ids).toContain("WGC102");
@@ -55,6 +55,9 @@ describe("gcpPlugin", () => {
     expect(ids).toContain("WGC401");
     expect(ids).toContain("WGC402");
     expect(ids).toContain("WGC403");
+    expect(ids).toContain("WGC501");
+    expect(ids).toContain("WGC502");
+    expect(ids).toContain("WGC503");
   });
 
   // ── Intrinsics / pseudo-parameters ─────────────────────────────────

package/src/serializer.ts

@@ -43,8 +43,13 @@ function getGVKMap(): Record<string, GVKEntry> {
 
 /**
  * Resolve entityType to apiVersion and kind.
+ *
+ * Exported for the read paths (./describe-resources.ts): the CNRM kind is the
+ * key into the applier's mapper table, and the packaged map is the only place
+ * that knows `GCP::Pubsub::Topic` is `PubSubTopic` rather than the naive
+ * `PubsubTopic` the fallback derivation would produce.
  */
-function resolveGVK(entityType: string): { apiVersion: string; kind: string } | null {
+export function resolveGVK(entityType: string): { apiVersion: string; kind: string } | null {
   const gvkMap = getGVKMap();
 
   for (const entry of Object.values(gvkMap)) {