@intentius/chant-lexicon-prometheus 0.98.0 → 0.99.0

package/src/lint/rules/literal-credential.ts

@@ -7,20 +7,47 @@ import { calleeName, constInitializers, CREDENTIAL_CLASS, literalText, position,
  * reads it from a mounted file instead.
  */
 export const SECRET_FIELDS = new Set([
-  "api_url", // slack_configs: the incoming-webhook URL is the credential
-  "slack_api_url",
-  "routing_key",
+  "api_url", // slack_configs only: the incoming-webhook URL is the credential (see SECRET_ONLY_IN)
+  "webhook_url", // discord, msteams, msteamsv2 and mattermost
+  "app_token",
+  "routing_key", // pagerduty (victorops' routing_key names a route, see SECRET_ONLY_IN)
   "service_key",
+  "api_key",
+  "api_secret",
+  "bot_token",
+  "token",
+  "token_id",
+  "user_key",
+  "alert_source_token",
   "auth_password",
   "auth_secret",
   "smtp_auth_password",
   "smtp_auth_secret",
+  "slack_api_url",
+  "slack_app_token",
+  "opsgenie_api_key",
+  "wechat_api_secret",
+  "victorops_api_key",
+  "telegram_bot_token",
+  "rocketchat_token",
+  "rocketchat_token_id",
+  "mattermost_webhook_url",
   "password",
   "credentials",
   "bearer_token",
   "client_secret",
 ]);
 
+/**
+ * Fields that are a secret in one integration and plain elsewhere: `api_url`
+ * is Slack's webhook credential but only an endpoint for the others, and a
+ * VictorOps `routing_key` names a route.
+ */
+const SECRET_ONLY_IN: Record<string, string> = {
+  api_url: "slack_configs",
+  routing_key: "pagerduty_configs",
+};
+
 /**
  * PROM001: a credential written as a literal in a `Receiver` or
  * `AlertmanagerSettings`.
@@ -46,16 +73,20 @@ export const literalCredentialRule: LintRule = {
 
     // A value is followed to the const it names, so a list lifted out of the
     // constructor (`email_configs: heartbeatEmail`) is scanned where it is used.
-    const scanValue = (key: string | undefined, value: ts.Expression) => {
+    // `integration` is the `*_configs` list a value sits in, when that is known.
+    const scanValue = (key: string | undefined, value: ts.Expression, integration?: string) => {
       const init = resolveConst(value, consts);
+      const within = key?.endsWith("_configs") ? key : integration;
       if (ts.isObjectLiteralExpression(init) || ts.isArrayLiteralExpression(init)) {
         if (scanned.has(init)) return;
         scanned.add(init);
-        if (ts.isObjectLiteralExpression(init)) scan(init);
-        else for (const el of init.elements) scanValue(undefined, el);
+        if (ts.isObjectLiteralExpression(init)) scan(init, within);
+        else for (const el of init.elements) scanValue(undefined, el, within);
         return;
       }
       if (!key || !SECRET_FIELDS.has(key)) return;
+      const only = SECRET_ONLY_IN[key];
+      if (only && integration !== undefined && integration !== only) return;
       const text = literalText(init);
       if (text === undefined || text === "") return;
       diagnostics.push({
@@ -67,11 +98,11 @@ export const literalCredentialRule: LintRule = {
       });
     };
 
-    const scan = (obj: ts.ObjectLiteralExpression) => {
+    const scan = (obj: ts.ObjectLiteralExpression, integration?: string) => {
       for (const prop of obj.properties) {
-        if (ts.isPropertyAssignment(prop)) scanValue(propertyName(prop), prop.initializer);
-        else if (ts.isShorthandPropertyAssignment(prop)) scanValue(prop.name.text, prop.name);
-        else if (ts.isSpreadAssignment(prop)) scanValue(undefined, prop.expression);
+        if (ts.isPropertyAssignment(prop)) scanValue(propertyName(prop), prop.initializer, integration);
+        else if (ts.isShorthandPropertyAssignment(prop)) scanValue(prop.name.text, prop.name, integration);
+        else if (ts.isSpreadAssignment(prop)) scanValue(undefined, prop.expression, integration);
       }
     };
 

package/src/lint/rules/rules.test.ts

@@ -58,7 +58,37 @@ describe("PROM001 literal credential", () => {
         const pager = new Receiver({ name: "pager", pagerduty_configs: safe });
       `),
     );
-    expect(diags.map((d) => d.message.split("`")[1])).toEqual(["auth_password", "service_key", "smtp_auth_password"]);
+    expect(diags.map((d) => d.message.split("`")[1])).toEqual(["auth_password", "api_key", "service_key", "smtp_auth_password"]);
+  });
+
+  test("covers every integration's credential, and api_url and routing_key only where they are one", () => {
+    const diags = literalCredentialRule.check(
+      ctx(`
+        const chatSlack: SlackConfig[] = [{ api_url: "https://hooks.slack.com/services/T/B/X", app_token: "xoxb-1" }];
+        new Receiver({
+          name: "chat",
+          slack_configs: chatSlack,
+          discord_configs: [{ webhook_url: "https://discord.com/api/webhooks/1/x" }],
+          telegram_configs: [{ bot_token: "123:abc", chat_id: 1 }],
+          webex_configs: [{ api_url: "https://webexapis.com/v1/messages", room_id: "r" }],
+          victorops_configs: [{ api_key: "k", routing_key: "ops" }],
+          pushover_configs: [{ user_key: "u", token: "t" }],
+          rocketchat_configs: [{ token_id: "i", token_file: "/etc/rc" }],
+        });
+        new AlertmanagerSettings({ global: { telegram_bot_token: "123:abc", webex_api_url: "https://webexapis.com/v1/messages" } });
+      `),
+    );
+    expect(diags.map((d) => d.message.split("`")[1])).toEqual([
+      "api_url",
+      "app_token",
+      "webhook_url",
+      "bot_token",
+      "api_key",
+      "user_key",
+      "token",
+      "token_id",
+      "telegram_bot_token",
+    ]);
   });
 });
 

package/src/model.ts

@@ -13,6 +13,31 @@
  * docs apply word for word.
  */
 
+import {
+  RECEIVER_INTEGRATION_TYPES,
+  type DiscordConfig,
+  type EmailConfig,
+  type HttpClientConfig,
+  type IncidentioConfig,
+  type JiraConfig,
+  type MattermostConfig,
+  type MSTeamsConfig,
+  type MSTeamsV2Config,
+  type OpsGenieConfig,
+  type PagerDutyConfig,
+  type PushoverConfig,
+  type ReceiverIntegration,
+  type RocketchatConfig,
+  type SlackConfig,
+  type SNSConfig,
+  type TelegramConfig,
+  type TlsConfig,
+  type VictorOpsConfig,
+  type WebexConfig,
+  type WebhookConfig,
+  type WechatConfig,
+} from "./integrations";
+
 /** Labels or annotations: string keys to string values. */
 export type LabelSet = Record<string, string>;
 
@@ -78,114 +103,31 @@ export function ruleName(rule: RuleConfig): string {
 
 // ── Alertmanager ────────────────────────────────────────────────────
 
-/** HTTP client settings shared by the receivers that make HTTP calls. */
-export interface HttpClientConfig {
-  basic_auth?: { username?: string; username_file?: string; password?: string; password_file?: string };
-  authorization?: { type?: string; credentials?: string; credentials_file?: string };
-  bearer_token?: string;
-  bearer_token_file?: string;
-  oauth2?: Record<string, unknown>;
-  proxy_url?: string;
-  follow_redirects?: boolean;
-  enable_http2?: boolean;
-  tls_config?: {
-    ca_file?: string;
-    cert_file?: string;
-    key_file?: string;
-    server_name?: string;
-    insecure_skip_verify?: boolean;
-    min_version?: string;
-  };
-}
-
-interface NotifierBase {
-  /** Whether to notify about resolved alerts too. */
-  send_resolved?: boolean;
-}
-
-export interface WebhookConfig extends NotifierBase {
-  /** Where alerts are POSTed. Set this or `url_file`. */
-  url?: string;
-  url_file?: string;
-  http_config?: HttpClientConfig;
-  /** Most alerts per message; 0 sends them all. */
-  max_alerts?: number;
-  timeout?: string;
-}
-
-export interface EmailConfig extends NotifierBase {
-  to: string;
-  from?: string;
-  /** `host:port` of the SMTP server. Falls back to `global.smtp_smarthost`. */
-  smarthost?: string;
-  hello?: string;
-  auth_username?: string;
-  auth_password?: string;
-  auth_password_file?: string;
-  auth_secret?: string;
-  auth_secret_file?: string;
-  auth_identity?: string;
-  require_tls?: boolean;
-  tls_config?: HttpClientConfig["tls_config"];
-  html?: string;
-  text?: string;
-  headers?: Record<string, string>;
-}
-
-export interface SlackConfig extends NotifierBase {
-  /** The incoming-webhook URL. It is a credential: prefer `api_url_file`. */
-  api_url?: string;
-  api_url_file?: string;
-  channel?: string;
-  username?: string;
-  color?: string;
-  title?: string;
-  title_link?: string;
-  pretext?: string;
-  text?: string;
-  footer?: string;
-  fallback?: string;
-  icon_emoji?: string;
-  icon_url?: string;
-  link_names?: boolean;
-  short_fields?: boolean;
-  mrkdwn_in?: string[];
-  fields?: Array<{ title: string; value: string; short?: boolean }>;
-  actions?: Array<Record<string, unknown>>;
-  http_config?: HttpClientConfig;
-}
-
-export interface PagerDutyConfig extends NotifierBase {
-  /** Events API v2 integration key. A credential: prefer `routing_key_file`. */
-  routing_key?: string;
-  routing_key_file?: string;
-  /** Events API v1 integration key. A credential: prefer `service_key_file`. */
-  service_key?: string;
-  service_key_file?: string;
-  url?: string;
-  client?: string;
-  client_url?: string;
-  description?: string;
-  severity?: string;
-  class?: string;
-  component?: string;
-  group?: string;
-  source?: string;
-  details?: Record<string, string>;
-  links?: Array<{ href: string; text?: string }>;
-  images?: Array<{ src: string; alt?: string; href?: string }>;
-  http_config?: HttpClientConfig;
-}
+export * from "./integrations";
 
 /** One entry under `receivers:`. */
 export interface ReceiverConfig {
   name: string;
   /** Labels on the receiver, exposed to notification templates. */
   labels?: LabelSet;
-  webhook_configs?: WebhookConfig[];
+  discord_configs?: DiscordConfig[];
   email_configs?: EmailConfig[];
-  slack_configs?: SlackConfig[];
+  incidentio_configs?: IncidentioConfig[];
   pagerduty_configs?: PagerDutyConfig[];
+  slack_configs?: SlackConfig[];
+  webhook_configs?: WebhookConfig[];
+  opsgenie_configs?: OpsGenieConfig[];
+  wechat_configs?: WechatConfig[];
+  pushover_configs?: PushoverConfig[];
+  victorops_configs?: VictorOpsConfig[];
+  sns_configs?: SNSConfig[];
+  telegram_configs?: TelegramConfig[];
+  webex_configs?: WebexConfig[];
+  msteams_configs?: MSTeamsConfig[];
+  msteamsv2_configs?: MSTeamsV2Config[];
+  jira_configs?: JiraConfig[];
+  rocketchat_configs?: RocketchatConfig[];
+  mattermost_configs?: MattermostConfig[];
 }
 
 /** A route in the routing tree. The top-level `route:` is the root. */
@@ -244,12 +186,18 @@ export interface TimeIntervalConfig {
   time_intervals: TimePeriodConfig[];
 }
 
-/** `global:` settings. */
+/**
+ * `global:` settings: defaults the receivers fall back to. Credentials with
+ * a `*_file` sibling are best set through it; PROM001 flags a literal.
+ */
 export interface AlertmanagerGlobalConfig {
+  /** How long an alert that stops being updated stays firing. */
   resolve_timeout?: string;
+  http_config?: HttpClientConfig;
+  jira_api_url?: string;
   smtp_from?: string;
-  smtp_smarthost?: string;
   smtp_hello?: string;
+  smtp_smarthost?: string;
   smtp_auth_username?: string;
   smtp_auth_password?: string;
   smtp_auth_password_file?: string;
@@ -257,12 +205,83 @@ export interface AlertmanagerGlobalConfig {
   smtp_auth_secret_file?: string;
   smtp_auth_identity?: string;
   smtp_require_tls?: boolean;
+  smtp_tls_config?: TlsConfig;
+  smtp_force_implicit_tls?: boolean;
   slack_api_url?: string;
   slack_api_url_file?: string;
+  slack_app_token?: string;
+  slack_app_token_file?: string;
+  slack_app_url?: string;
   pagerduty_url?: string;
-  http_config?: HttpClientConfig;
+  opsgenie_api_url?: string;
+  opsgenie_api_key?: string;
+  opsgenie_api_key_file?: string;
+  wechat_api_url?: string;
+  wechat_api_secret?: string;
+  wechat_api_secret_file?: string;
+  wechat_api_corp_id?: string;
+  victorops_api_url?: string;
+  victorops_api_key?: string;
+  victorops_api_key_file?: string;
+  telegram_api_url?: string;
+  telegram_bot_token?: string;
+  telegram_bot_token_file?: string;
+  webex_api_url?: string;
+  rocketchat_api_url?: string;
+  rocketchat_token?: string;
+  rocketchat_token_file?: string;
+  rocketchat_token_id?: string;
+  rocketchat_token_id_file?: string;
+  mattermost_webhook_url?: string;
+  mattermost_webhook_url_file?: string;
 }
 
+/** Every `global:` field, as a list, for code that reads a parsed file. */
+export const ALERTMANAGER_GLOBAL_FIELDS = Object.freeze(Object.keys({
+  resolve_timeout: true,
+  http_config: true,
+  jira_api_url: true,
+  smtp_from: true,
+  smtp_hello: true,
+  smtp_smarthost: true,
+  smtp_auth_username: true,
+  smtp_auth_password: true,
+  smtp_auth_password_file: true,
+  smtp_auth_secret: true,
+  smtp_auth_secret_file: true,
+  smtp_auth_identity: true,
+  smtp_require_tls: true,
+  smtp_tls_config: true,
+  smtp_force_implicit_tls: true,
+  slack_api_url: true,
+  slack_api_url_file: true,
+  slack_app_token: true,
+  slack_app_token_file: true,
+  slack_app_url: true,
+  pagerduty_url: true,
+  opsgenie_api_url: true,
+  opsgenie_api_key: true,
+  opsgenie_api_key_file: true,
+  wechat_api_url: true,
+  wechat_api_secret: true,
+  wechat_api_secret_file: true,
+  wechat_api_corp_id: true,
+  victorops_api_url: true,
+  victorops_api_key: true,
+  victorops_api_key_file: true,
+  telegram_api_url: true,
+  telegram_bot_token: true,
+  telegram_bot_token_file: true,
+  webex_api_url: true,
+  rocketchat_api_url: true,
+  rocketchat_token: true,
+  rocketchat_token_file: true,
+  rocketchat_token_id: true,
+  rocketchat_token_id_file: true,
+  mattermost_webhook_url: true,
+  mattermost_webhook_url_file: true,
+} satisfies Record<keyof AlertmanagerGlobalConfig, true>)) as readonly (keyof AlertmanagerGlobalConfig)[];
+
 /** `tracing:` settings: where Alertmanager sends its own traces. */
 export interface AlertmanagerTracingConfig {
   client_type?: "grpc" | "http";
@@ -272,7 +291,7 @@ export interface AlertmanagerTracingConfig {
   headers?: Record<string, string>;
   compression?: string;
   timeout?: string;
-  tls_config?: HttpClientConfig["tls_config"];
+  tls_config?: TlsConfig;
 }
 
 /** A whole `alertmanager.yml`, the file `amtool check-config` reads. */
@@ -286,17 +305,24 @@ export interface AlertmanagerConfig {
   tracing?: AlertmanagerTracingConfig;
 }
 
-/** The four receiver integrations this lexicon types. */
-export const RECEIVER_INTEGRATIONS = ["webhook_configs", "email_configs", "slack_configs", "pagerduty_configs"] as const;
+/** The receiver integrations, every one Alertmanager defines. */
+export const RECEIVER_INTEGRATIONS = Object.keys(RECEIVER_INTEGRATION_TYPES) as readonly ReceiverIntegration[];
 
 /** True when a parsed document has the shape of a Prometheus rule file. */
 export function looksLikeRuleFile(value: unknown): value is RuleFileConfig {
   if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-  const groups = (value as Record<string, unknown>).groups;
+  const v = value as Record<string, unknown>;
+  const groups = v.groups;
   if (!Array.isArray(groups)) return false;
-  return groups.every(
-    (g) => typeof g === "object" && g !== null && typeof (g as Record<string, unknown>).name === "string" && Array.isArray((g as Record<string, unknown>).rules),
-  );
+  // Grafana's alerting provisioning files also hold `groups:` of named rule lists. Prometheus reads rule
+  // files strictly (unknown keys are errors), so `apiVersion`, a group `folder` or a rule's `data` means Grafana.
+  if ("apiVersion" in v) return false;
+  return groups.every((g) => {
+    if (typeof g !== "object" || g === null) return false;
+    const group = g as Record<string, unknown>;
+    if (typeof group.name !== "string" || !Array.isArray(group.rules) || "folder" in group) return false;
+    return !group.rules.some((r) => typeof r === "object" && r !== null && "data" in r);
+  });
 }
 
 /** True when a parsed document has the shape of an `alertmanager.yml`. */

package/src/plugin.ts

@@ -11,6 +11,7 @@ import { hover } from "./lsp/hover";
 import { detectTemplate } from "./detect";
 import { PrometheusParser } from "./import/parser";
 import { PrometheusGenerator } from "./import/generator";
+import { ruleGroupsImporter } from "./import/embedded";
 import { initTemplates } from "./init-templates";
 import { prometheusSkills } from "./skill-defs";
 import { CATALOG } from "./catalog";
@@ -120,6 +121,10 @@ export const prometheusPlugin: LexiconPlugin = {
     return new PrometheusGenerator();
   },
 
+  embeddedImporters() {
+    return [ruleGroupsImporter];
+  },
+
   initTemplates(template?: string) {
     return initTemplates(template);
   },

package/src/skills/chant-prometheus-alertmanager.md

@@ -49,7 +49,7 @@ export const pageMutesTicket = new InhibitRule({
 
 ## Starting from an existing alertmanager.yml
 
-Import it rather than retyping it: `chant import alertmanager.yml --output src` (with `--lexicon prometheus` outside a chant project). The importer writes `receivers.ts`, `time-intervals.ts`, `routes.ts` (the root `Route`, children as `RouteProps` that reference receivers and time intervals by variable), `inhibit-rules.ts` and `settings.ts`. `*_file` paths and Go templates are kept as written; a literal credential is imported as found and PROM001 reports it, so offer to move it to the `*_file` field. Integrations the lexicon doesn't type (`opsgenie_configs`, `msteams_configs`, ...) are spread in from an untyped const. `match`/`match_re` and the top-level `mute_time_intervals` come back in their current spelling (`matchers`, `time_intervals`), and `chant import` prints a warning for each.
+Import it rather than retyping it: `chant import alertmanager.yml --output src` (with `--lexicon prometheus` outside a chant project). The importer writes `receivers.ts`, `time-intervals.ts`, `routes.ts` (the root `Route`, children as `RouteProps` that reference receivers and time intervals by variable), `inhibit-rules.ts` and `settings.ts`. `*_file` paths and Go templates are kept as written; a literal credential is imported as found and PROM001 reports it, so offer to move it to the `*_file` field. Every integration comes back typed (`OpsGenieConfig[]`, `MSTeamsV2Config[]`, ...); a receiver or `global` key Alertmanager doesn't define is spread in from an untyped const, with a warning. `match`/`match_re` and the top-level `mute_time_intervals` come back in their current spelling (`matchers`, `time_intervals`), and `chant import` prints a warning for each.
 
 ## What the checks hold you to