@intentius/chant-lexicon-prometheus 0.97.0 → 0.98.0

package/src/lint/rules/literal-credential.ts

@@ -1,6 +1,6 @@
 import * as ts from "typescript";
 import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
-import { calleeName, CREDENTIAL_CLASS, literalText, position, propertyName } from "./prom-ast";
+import { calleeName, constInitializers, CREDENTIAL_CLASS, literalText, position, propertyName, resolveConst } from "./prom-ast";
 
 /**
  * Alertmanager fields that hold a secret, each with a `*_file` sibling that
@@ -41,13 +41,18 @@ export const literalCredentialRule: LintRule = {
     const diagnostics: LintDiagnostic[] = [];
     const source = context.sourceFile;
 
-    const scanValue = (key: string | undefined, init: ts.Expression) => {
-      if (ts.isObjectLiteralExpression(init)) {
-        scan(init);
-        return;
-      }
-      if (ts.isArrayLiteralExpression(init)) {
-        for (const el of init.elements) if (ts.isObjectLiteralExpression(el)) scan(el);
+    const consts = constInitializers(source);
+    const scanned = new Set<ts.Node>();
+
+    // A value is followed to the const it names, so a list lifted out of the
+    // constructor (`email_configs: heartbeatEmail`) is scanned where it is used.
+    const scanValue = (key: string | undefined, value: ts.Expression) => {
+      const init = resolveConst(value, consts);
+      if (ts.isObjectLiteralExpression(init) || ts.isArrayLiteralExpression(init)) {
+        if (scanned.has(init)) return;
+        scanned.add(init);
+        if (ts.isObjectLiteralExpression(init)) scan(init);
+        else for (const el of init.elements) scanValue(undefined, el);
         return;
       }
       if (!key || !SECRET_FIELDS.has(key)) return;
@@ -64,8 +69,9 @@ export const literalCredentialRule: LintRule = {
 
     const scan = (obj: ts.ObjectLiteralExpression) => {
       for (const prop of obj.properties) {
-        if (!ts.isPropertyAssignment(prop)) continue;
-        scanValue(propertyName(prop), prop.initializer);
+        if (ts.isPropertyAssignment(prop)) scanValue(propertyName(prop), prop.initializer);
+        else if (ts.isShorthandPropertyAssignment(prop)) scanValue(prop.name.text, prop.name);
+        else if (ts.isSpreadAssignment(prop)) scanValue(undefined, prop.expression);
       }
     };
 
@@ -73,7 +79,7 @@ export const literalCredentialRule: LintRule = {
       if (ts.isNewExpression(node) || ts.isCallExpression(node)) {
         const name = calleeName(node);
         const arg = node.arguments?.[0];
-        if (name && CREDENTIAL_CLASS.test(name) && arg && ts.isObjectLiteralExpression(arg)) scan(arg);
+        if (name && CREDENTIAL_CLASS.test(name) && arg) scanValue(undefined, arg);
       }
       ts.forEachChild(node, visit);
     };

package/src/lint/rules/prom-ast.ts

@@ -28,3 +28,39 @@ export function position(source: ts.SourceFile, node: ts.Node): { line: number;
   const { line, character } = source.getLineAndCharacterOfPosition(node.getStart(source));
   return { line: line + 1, column: character + 1 };
 }
+
+/**
+ * Every `const name = <initializer>` in the file, so a rule can follow a
+ * value lifted out of a constructor into a named const (the way COR001 asks
+ * for it, and the way `chant import` writes it) back to its literal.
+ */
+export function constInitializers(source: ts.SourceFile): Map<string, ts.Expression> {
+  const consts = new Map<string, ts.Expression>();
+  const collect = (node: ts.Node) => {
+    if (ts.isVariableDeclarationList(node) && node.flags & ts.NodeFlags.Const) {
+      for (const d of node.declarations) {
+        if (ts.isIdentifier(d.name) && d.initializer) consts.set(d.name.text, d.initializer);
+      }
+    }
+    ts.forEachChild(node, collect);
+  };
+  collect(source);
+  return consts;
+}
+
+/** `expr` itself, or the initializer of the const it names (followed through `as` and `satisfies`). */
+export function resolveConst(expr: ts.Expression, consts: Map<string, ts.Expression>): ts.Expression {
+  let cur = expr;
+  for (let hops = 0; hops < 8; hops++) {
+    if (ts.isAsExpression(cur) || ts.isSatisfiesExpression(cur) || ts.isParenthesizedExpression(cur)) {
+      cur = cur.expression;
+      continue;
+    }
+    if (ts.isIdentifier(cur) && consts.has(cur.text)) {
+      cur = consts.get(cur.text)!;
+      continue;
+    }
+    break;
+  }
+  return cur;
+}

package/src/lint/rules/promql-literal.ts

@@ -1,6 +1,6 @@
 import * as ts from "typescript";
 import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
-import { calleeName, literalText, position, propertyName } from "./prom-ast";
+import { calleeName, constInitializers, literalText, position, propertyName, resolveConst } from "./prom-ast";
 import { checkPromql } from "../../promql";
 
 /**
@@ -21,7 +21,21 @@ export const promqlLiteralRule: LintRule = {
     const diagnostics: LintDiagnostic[] = [];
     const source = context.sourceFile;
 
+    const consts = constInitializers(source);
+    const scanned = new Set<ts.Node>();
+
+    // Rules lifted into a const (`rules: apiRules`) are followed to it and
+    // checked where the group uses them.
+    const follow = (value: ts.Expression) => {
+      const init = resolveConst(value, consts);
+      if (init !== value && !scanned.has(init)) {
+        scanned.add(init);
+        scan(init);
+      }
+    };
     const scan = (node: ts.Node) => {
+      if (ts.isShorthandPropertyAssignment(node)) follow(node.name);
+      if (ts.isPropertyAssignment(node) && ts.isIdentifier(node.initializer)) follow(node.initializer);
       if (ts.isPropertyAssignment(node) && propertyName(node) === "expr") {
         const text = literalText(node.initializer);
         if (text !== undefined) {

package/src/lint/rules/rules.test.ts

@@ -44,6 +44,22 @@ describe("PROM001 literal credential", () => {
     );
     expect(diags).toEqual([]);
   });
+
+  test("follows values lifted into named consts, shorthand props and spreads", () => {
+    const diags = literalCredentialRule.check(
+      ctx(`
+        const heartbeatEmail: EmailConfig[] = [{ to: "a@example.com", auth_password: "hunter2" }];
+        const heartbeat = new Receiver({ name: "heartbeat", email_configs: heartbeatEmail });
+        const oncallUntyped = { opsgenie_configs: [{ api_key: "x" }], pagerduty_configs: [{ service_key: "k" }] };
+        const oncall = new Receiver({ name: "oncall", ...oncallUntyped });
+        const global: AlertmanagerGlobalConfig = { smtp_auth_password: "p" };
+        const settings = new AlertmanagerSettings({ global });
+        const safe: PagerDutyConfig[] = [{ routing_key_file: "/etc/pd" }];
+        const pager = new Receiver({ name: "pager", pagerduty_configs: safe });
+      `),
+    );
+    expect(diags.map((d) => d.message.split("`")[1])).toEqual(["auth_password", "service_key", "smtp_auth_password"]);
+  });
 });
 
 describe("PROM002 PromQL literal", () => {
@@ -61,6 +77,18 @@ describe("PROM002 PromQL literal", () => {
     expect(diags[0].line).toBe(3);
   });
 
+  test("follows rules lifted into a named const", () => {
+    const diags = promqlLiteralRule.check(
+      ctx(`
+        const apiRules: Rule[] = [{ record: "a:b", expr: "sum(" }, { alert: "A", expr: "up == 0" }];
+        const api = new RuleGroup({ name: "api", rules: apiRules });
+        const rules: Rule[] = [{ record: "c:d", expr: "rate(x[5m]" }];
+        const other = new RuleGroup({ name: "other", rules });
+      `),
+    );
+    expect(diags.map((d) => d.line)).toEqual([2, 4]);
+  });
+
   test("ignores built expressions and exprs outside a RuleGroup", () => {
     const diags = promqlLiteralRule.check(
       ctx(`

package/src/model.ts

@@ -180,6 +180,8 @@ export interface PagerDutyConfig extends NotifierBase {
 /** One entry under `receivers:`. */
 export interface ReceiverConfig {
   name: string;
+  /** Labels on the receiver, exposed to notification templates. */
+  labels?: LabelSet;
   webhook_configs?: WebhookConfig[];
   email_configs?: EmailConfig[];
   slack_configs?: SlackConfig[];
@@ -198,11 +200,18 @@ export interface RouteConfig {
   repeat_interval?: string;
   mute_time_intervals?: string[];
   active_time_intervals?: string[];
+  /**
+   * Labels on the route, inherited by child routes and exposed to
+   * notification templates as `routeLabels`. Values may be Go templates.
+   */
+  labels?: LabelSet;
   routes?: RouteConfig[];
 }
 
 /** One entry under `inhibit_rules:`. */
 export interface InhibitRuleConfig {
+  /** A name for the rule, shown in Alertmanager's logs and metrics. */
+  name?: string;
   source_matchers?: string[];
   target_matchers?: string[];
   /** Labels that must be equal on source and target for the inhibition to apply. */
@@ -254,6 +263,18 @@ export interface AlertmanagerGlobalConfig {
   http_config?: HttpClientConfig;
 }
 
+/** `tracing:` settings: where Alertmanager sends its own traces. */
+export interface AlertmanagerTracingConfig {
+  client_type?: "grpc" | "http";
+  endpoint?: string;
+  sampling_fraction?: number;
+  insecure?: boolean;
+  headers?: Record<string, string>;
+  compression?: string;
+  timeout?: string;
+  tls_config?: HttpClientConfig["tls_config"];
+}
+
 /** A whole `alertmanager.yml`, the file `amtool check-config` reads. */
 export interface AlertmanagerConfig {
   global?: AlertmanagerGlobalConfig;
@@ -262,6 +283,7 @@ export interface AlertmanagerConfig {
   inhibit_rules?: InhibitRuleConfig[];
   receivers?: ReceiverConfig[];
   time_intervals?: TimeIntervalConfig[];
+  tracing?: AlertmanagerTracingConfig;
 }
 
 /** The four receiver integrations this lexicon types. */

package/src/plugin.ts

@@ -9,6 +9,8 @@ import { prometheusAuditCatalog } from "./lint/audit-catalog";
 import { completions } from "./lsp/completions";
 import { hover } from "./lsp/hover";
 import { detectTemplate } from "./detect";
+import { PrometheusParser } from "./import/parser";
+import { PrometheusGenerator } from "./import/generator";
 import { initTemplates } from "./init-templates";
 import { prometheusSkills } from "./skill-defs";
 import { CATALOG } from "./catalog";
@@ -110,6 +112,14 @@ export const prometheusPlugin: LexiconPlugin = {
     return detectTemplate(data);
   },
 
+  templateParser() {
+    return new PrometheusParser();
+  },
+
+  templateGenerator() {
+    return new PrometheusGenerator();
+  },
+
   initTemplates(template?: string) {
     return initTemplates(template);
   },

package/src/skills/chant-prometheus-alertmanager.md

@@ -47,6 +47,10 @@ export const pageMutesTicket = new InhibitRule({
 });
 ```
 
+## Starting from an existing alertmanager.yml
+
+Import it rather than retyping it: `chant import alertmanager.yml --output src` (with `--lexicon prometheus` outside a chant project). The importer writes `receivers.ts`, `time-intervals.ts`, `routes.ts` (the root `Route`, children as `RouteProps` that reference receivers and time intervals by variable), `inhibit-rules.ts` and `settings.ts`. `*_file` paths and Go templates are kept as written; a literal credential is imported as found and PROM001 reports it, so offer to move it to the `*_file` field. Integrations the lexicon doesn't type (`opsgenie_configs`, `msteams_configs`, ...) are spread in from an untyped const. `match`/`match_re` and the top-level `mute_time_intervals` come back in their current spelling (`matchers`, `time_intervals`), and `chant import` prints a warning for each.
+
 ## What the checks hold you to
 
 - One root route (the `Route` no other route nests), with a receiver and no matchers (PROM205).

package/src/skills/chant-prometheus.md

@@ -15,6 +15,17 @@ The prometheus lexicon (`@intentius/chant-lexicon-prometheus`) types Prometheus
 export default { lexicons: ["prometheus"] };
 ```
 
+## Starting from an existing rule file
+
+When the user already has a rule file, import it rather than retyping it:
+
+```bash
+chant import rules.yml --output src          # add --lexicon prometheus outside a chant project
+chant build src --lexicon prometheus -o rules.yml   # the same groups back
+```
+
+The importer writes `rules.ts` (per group, a `Rule[]` const of plain objects and a `RuleGroup`) and `slos.ts` for any group an `Slo()` built, as the `Slo` call. Multi-line expressions become template literals and Go templates in annotations stay as written. Read the warnings `chant import` prints: they name any field Prometheus doesn't define, which is not carried.
+
 ## Declaring a group
 
 A group takes the rule file's own keys (`name`, `interval`, `query_offset`, `limit`, `labels`, `rules`). Rules are plain objects: `record` + `expr` for a recording rule, `alert` + `expr` (+ `for`, `keep_firing_for`, `labels`, `annotations`) for an alerting rule.