@intentius/chant-lexicon-terraform 0.57.0 → 0.59.0

package/src/lint/post-synth/post-synth.test.ts

@@ -1,12 +1,16 @@
 import { describe, expect, test } from "vitest";
 import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
-import { tf001 } from "./tf001";
+import { backendTypes, hasRemoteBackend, tf001 } from "./tf001";
+import { loadFixture } from "./fixtures/load";
 import { TERRAFORM_TYPE, terraformEntity } from "../../hcl/parse";
 
 /**
- * The local context builder the k3s checks use. `createPostSynthContext` from
- * the test-utils package hands back an empty entity map, and every check here
- * reads `ctx.entities`.
+ * The local context builder for the edge cases below that are about the
+ * *collection* (several roots or several blocks sharing one root), not about
+ * one root's parsed shape, which is what real HCL fixtures represent. The four
+ * headline cases (a backendless root, a `backend "local"` root, a remote
+ * backend, a `cloud` block) go through `fixtures/TF001/` and `loadFixture`
+ * instead; see that module's doc comment for why.
  */
 function makeCtx(entities: Record<string, ReturnType<typeof terraformEntity>>): PostSynthContext {
   return {
@@ -21,23 +25,37 @@ function terraformBlock(root: string, body: Record<string, unknown>): ReturnType
 }
 
 describe("TF001: root module declares no remote backend", () => {
-  test("flags a root whose terraform block has no backend", () => {
-    const diags = tf001.check(
-      makeCtx({ "legacy/terraform": terraformBlock("legacy", { required_version: ">= 1.5.0" }) }),
-    );
+  test("flags a root whose terraform block has no backend", async () => {
+    const diags = tf001.check(await loadFixture("TF001", "positive"));
     expect(diags).toHaveLength(1);
     expect(diags[0].checkId).toBe("TF001");
-    expect(diags[0].entity).toBe("legacy/terraform");
+    expect(diags[0].entity).toBe("TF001/terraform");
     expect(diags[0].lexicon).toBe("terraform");
-    expect(diags[0].message).toContain("legacy");
+    expect(diags[0].message).toContain("TF001");
+    expect(diags[0].message).toContain("there is no backend block at all");
+    expect(diags[0].missing).toEqual({ kind: "backend", scope: "TF001" });
   });
 
-  test("passes a root with a backend block", () => {
-    const diags = tf001.check(
-      makeCtx({
-        "app/terraform": terraformBlock("app", { backend: { local: [{ path: "terraform.tfstate" }] } }),
-      }),
-    );
+  // #2218: the check reads the backend block's type label, so the local
+  // backend is the same finding whether it is fallen back into or asked for
+  // by name, and the message says which one it found.
+  test('flags a root whose backend is `backend "local"`', async () => {
+    const diags = tf001.check(await loadFixture("TF001", "positive-local"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("TF001");
+    expect(diags[0].entity).toBe("TF001/terraform");
+    expect(diags[0].message).toContain('the backend it declares is `backend "local"`');
+    expect(diags[0].message).not.toContain("no backend block");
+    expect(diags[0].missing).toEqual({ kind: "backend", scope: "TF001" });
+  });
+
+  test("passes a root with a remote backend block", async () => {
+    const diags = tf001.check(await loadFixture("TF001", "negative"));
+    expect(diags).toHaveLength(0);
+  });
+
+  test("passes a root whose cloud block is the whole state configuration", async () => {
+    const diags = tf001.check(await loadFixture("TF001", "negative-cloud"));
     expect(diags).toHaveLength(0);
   });
 
@@ -92,4 +110,43 @@ describe("TF001: root module declares no remote backend", () => {
     const diags = tf001.check(makeCtx({ "app/terraform": terraformBlock("app", { backend: {} }) }));
     expect(diags).toHaveLength(1);
   });
+
+  test('flags a hand-built body carrying `backend "local"`', () => {
+    const diags = tf001.check(
+      makeCtx({
+        "app/terraform": terraformBlock("app", { backend: { local: [{ path: "terraform.tfstate" }] } }),
+      }),
+    );
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain('the backend it declares is `backend "local"`');
+  });
+});
+
+/**
+ * The label read itself (#2218). hcl2json nests a labelled block one level
+ * deeper than an unlabelled one, and the type only survives the parse as a
+ * key of that inner object, so the shape is worth pinning down apart from the
+ * check that reads it.
+ */
+describe("backendTypes / hasRemoteBackend", () => {
+  test("reads the type label out of the nested object hcl2json builds", () => {
+    expect(backendTypes({ backend: { local: [{ path: "terraform.tfstate" }] } })).toEqual(["local"]);
+    expect(backendTypes({ backend: { s3: [{ bucket: "tfstate" }] } })).toEqual(["s3"]);
+  });
+
+  test("has no labels to read when there is no backend block, or a malformed one", () => {
+    expect(backendTypes({})).toEqual([]);
+    expect(backendTypes({ backend: [{ bucket: "tfstate" }] })).toEqual([]);
+    expect(backendTypes({ backend: "s3" })).toEqual([]);
+  });
+
+  test("counts every backend but `local` as remote, and counts `cloud`", () => {
+    expect(hasRemoteBackend({ backend: { local: [{}] } })).toBe(false);
+    expect(hasRemoteBackend({})).toBe(false);
+    expect(hasRemoteBackend({ backend: { s3: [{}] } })).toBe(true);
+    expect(hasRemoteBackend({ backend: { gcs: [{}] } })).toBe(true);
+    expect(hasRemoteBackend({ backend: { azurerm: [{}] } })).toBe(true);
+    expect(hasRemoteBackend({ backend: { http: [{}] } })).toBe(true);
+    expect(hasRemoteBackend({ cloud: [{ organization: "acme" }] })).toBe(true);
+  });
 });

package/src/lint/post-synth/scope.ts

@@ -0,0 +1,107 @@
+/**
+ * Root scope or child scope, and the `Callers:` chain that says which call
+ * reached a finding (chant #2112).
+ *
+ * Since the parse descends into local modules, `ctx.entities` holds two kinds
+ * of block: the root module's own, keyed `<root>/<address>`, and a child
+ * module's, keyed `<root>/module.<name>/<address>` with the call chain on
+ * `props.callers`. Every check has to say which it applies to, and the three
+ * shapes that answer live here:
+ *
+ * - {@link isRootScoped} for a check about how a ROOT is assembled (TF001's
+ *   backend, TF002's `required_providers`): a child module has no backend and
+ *   no provider requirements of its own to judge, and reading one as if it
+ *   were the root's is how a root with a perfectly good backend gets flagged
+ *   because a module beneath it has none.
+ * - {@link isChildScoped} for the mirror, the two rules that are ONLY about
+ *   child modules (TF014, TF015).
+ * - {@link callersNote} for the sentence appended to a finding inside a
+ *   child, naming each call site with the file and line it sits on. tflint
+ *   prints the same thing as a `Callers:` block under the diagnostic
+ *   (https://github.com/terraform-linters/tflint/blob/master/docs/user-guide/calling-modules.md);
+ *   a `PostSynthDiagnostic` carries no ranges, so the chain goes in the
+ *   message, where a reader of any output format sees it.
+ *
+ * A check with no opinion (most of them: an unset `type` on a variable is the
+ * same finding wherever the variable lives) needs nothing from this module and
+ * runs over both scopes, which is what tflint does with its own language rules
+ * under `--call-module-type=local`.
+ */
+
+import type { PostSynthCheck, PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable, type Declarable } from "@intentius/chant/declarable";
+import { callersOfKey, type TerraformEntity } from "../../hcl/parse";
+
+/** The `module.<name>` chain on an entity, outermost first. Empty for a root block. */
+export function callersOf(entity: Declarable): readonly string[] {
+  if (!isResourceDeclarable(entity)) return [];
+  const props = (entity as TerraformEntity).props as Partial<TerraformEntity["props"]>;
+  return Array.isArray(props.callers) ? props.callers : [];
+}
+
+/** Was this block declared in the root module itself? */
+export function isRootScoped(entity: Declarable): boolean {
+  return callersOf(entity).length === 0;
+}
+
+/** Was this block declared in a child module the root calls? */
+export function isChildScoped(entity: Declarable): boolean {
+  return callersOf(entity).length > 0;
+}
+
+/**
+ * The `Callers:` sentence for a finding on `key`, or `""` when the finding is
+ * in the root module.
+ *
+ * The call sites are the key's own prefixes: a finding on
+ * `app/module.cdn/module.bucket/aws_s3_bucket.assets` was reached through
+ * `app/module.cdn` and then `app/module.cdn/module.bucket`, both of them
+ * `module` block entities in `ctx.entities`, so the file and line each was
+ * parsed from are already recorded. A prefix with no entity (a hand-built
+ * context in a test) renders as the bare call name.
+ */
+export function callersNote(ctx: PostSynthContext, key: string): string {
+  const callers = callersOfKey(key);
+  if (callers.length === 0) return "";
+
+  const root = key.slice(0, key.indexOf("/"));
+  const hops = callers.map((caller, i) => {
+    const callSite = [root, ...callers.slice(0, i + 1)].join("/");
+    const entity = ctx.entities.get(callSite);
+    if (!entity || !isResourceDeclarable(entity)) return caller;
+    const props = (entity as TerraformEntity).props as Partial<TerraformEntity["props"]>;
+    const file = typeof props.file === "string" ? props.file : "";
+    if (file === "") return caller;
+    return typeof props.line === "number" ? `${caller} (${file}:${props.line})` : `${caller} (${file})`;
+  });
+
+  return ` Callers: ${[root, ...hops].join(" -> ")}.`;
+}
+
+/**
+ * Wrap every check so a finding inside a child module carries its
+ * {@link callersNote}, whichever rule produced it.
+ *
+ * Done once, here, rather than in each rule's message: a reader of a finding
+ * on `module.cdn`'s bucket needs to know which call reached that code no
+ * matter which of the twenty-odd checks reported it, and a rule that forgot
+ * to append the chain would be a silent gap. The wrapper is what
+ * `terraformPlugin.postSynthChecks()` returns; a rule's own `check()` is
+ * unchanged, which is what its unit tests call.
+ *
+ * A message that already names the chain is left alone, so a rule with
+ * something more specific to say about its callers can say it.
+ */
+export function withCallersChain(checks: readonly PostSynthCheck[]): PostSynthCheck[] {
+  return checks.map((check) => ({
+    ...check,
+    check(ctx: PostSynthContext) {
+      return check.check(ctx).map((diagnostic) => {
+        if (typeof diagnostic.entity !== "string") return diagnostic;
+        if (diagnostic.message.includes("Callers:")) return diagnostic;
+        const note = callersNote(ctx, diagnostic.entity);
+        return note === "" ? diagnostic : { ...diagnostic, message: diagnostic.message + note };
+      });
+    },
+  }));
+}

package/src/lint/post-synth/single-block.test.ts

@@ -0,0 +1,263 @@
+import { describe, expect, test } from "vitest";
+import { loadFixture } from "./fixtures/load";
+import { tf006 } from "./tf006";
+import { tf007 } from "./tf007";
+import { tf008 } from "./tf008";
+import { tf009 } from "./tf009";
+import { tf010 } from "./tf010";
+import { tf011 } from "./tf011";
+import { tf012 } from "./tf012";
+import { tf013 } from "./tf013";
+import { tf016 } from "./tf016";
+import { tf017 } from "./tf017";
+import { tf018 } from "./tf018";
+import { tf019 } from "./tf019";
+import { tf022 } from "./tf022";
+
+/**
+ * The single-block rules (#2110): TF006 to TF013, TF016 to TF019 and TF022,
+ * every one of them reading one entity of one type. Each rule's headline pair
+ * runs through `fixtures/<id>/positive.tf` and `negative.tf` and the shared
+ * loader, so the HCL a test asserts on is the HCL the page shows; the extra
+ * cases below each pair are the ones that are about a shape rather than a
+ * file, and are written as small fixtures of their own through the same
+ * loader rather than as hand-built entity maps.
+ *
+ * TF001 keeps its own file (./post-synth.test.ts) and TF023 is not a
+ * post-synth check at all: it reads the audit's file list, so it is tested in
+ * ../audit.test.ts against a real directory.
+ */
+
+describe("TF006: sensitive variable with a default", () => {
+  test("flags a sensitive variable that carries a default", async () => {
+    const diags = tf006.check(await loadFixture("TF006", "positive"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("TF006");
+    expect(diags[0].entity).toBe("TF006/var.deploy_token");
+    expect(diags[0].severity).toBe("error");
+  });
+
+  test("passes a sensitive variable with no default", async () => {
+    expect(tf006.check(await loadFixture("TF006", "negative"))).toHaveLength(0);
+  });
+
+  test("an empty or null default still counts", async () => {
+    const diags = tf006.check(await loadFixture("TF006", "positive-empty-default"));
+    expect(diags.map((d) => d.entity).sort()).toEqual(["TF006/var.blank_token", "TF006/var.null_token"]);
+  });
+});
+
+describe("TF007: secret-shaped literal in a variable default or a locals value", () => {
+  test("flags a credential-named default and a credential-shaped local", async () => {
+    const diags = tf007.check(await loadFixture("TF007", "positive"));
+    expect(diags.map((d) => d.entity).sort()).toEqual(["TF007/locals.ci_token", "TF007/var.db_password"]);
+    expect(diags.every((d) => d.checkId === "TF007")).toBe(true);
+  });
+
+  test("never repeats the value in the message", async () => {
+    const diags = tf007.check(await loadFixture("TF007", "positive"));
+    for (const d of diags) {
+      expect(d.message).not.toContain("hunter2-prod-db");
+      expect(d.message).not.toContain("ghp_");
+    }
+  });
+
+  test("passes a sensitive variable with no default and a local that references one", async () => {
+    expect(tf007.check(await loadFixture("TF007", "negative"))).toHaveLength(0);
+  });
+});
+
+describe("TF008: hardcoded credentials in a provider block", () => {
+  test("flags both literal credentials, whatever the provider is", async () => {
+    const diags = tf008.check(await loadFixture("TF008", "positive"));
+    expect(diags.map((d) => d.entity).sort()).toEqual([
+      "TF008/provider.aws.access_key",
+      "TF008/provider.aws.secret_key",
+    ]);
+  });
+
+  test("passes a provider with no credential and one pointed at a key file", async () => {
+    expect(tf008.check(await loadFixture("TF008", "negative"))).toHaveLength(0);
+  });
+
+  test("reads attribute names, not provider types, so a non-AWS provider is covered", async () => {
+    const diags = tf008.check(await loadFixture("TF008", "positive-other-provider"));
+    expect(diags).toHaveLength(2);
+    expect(diags.map((d) => d.entity).sort()).toEqual([
+      "TF008/provider.postgresql.password",
+      "TF008/provider.vault.token",
+    ]);
+  });
+
+  test("a credential passed as a variable is the fix, not a finding", async () => {
+    expect(tf008.check(await loadFixture("TF008", "negative-variable"))).toHaveLength(0);
+  });
+});
+
+describe("TF009: credential-named variable not marked sensitive", () => {
+  test("flags a password variable with no sensitive flag", async () => {
+    const diags = tf009.check(await loadFixture("TF009", "positive"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("TF009/var.db_password");
+  });
+
+  test("passes a sensitive one, and an ARN that only points at a secret", async () => {
+    expect(tf009.check(await loadFixture("TF009", "negative"))).toHaveLength(0);
+  });
+});
+
+describe("TF010: variable without a type", () => {
+  test("flags an untyped variable", async () => {
+    const diags = tf010.check(await loadFixture("TF010", "positive"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("TF010/var.instance_count");
+    expect(diags[0].severity).toBe("info");
+  });
+
+  test("passes a typed one", async () => {
+    expect(tf010.check(await loadFixture("TF010", "negative"))).toHaveLength(0);
+  });
+});
+
+describe("TF011: variable without a description", () => {
+  test("flags an undocumented variable", async () => {
+    const diags = tf011.check(await loadFixture("TF011", "positive"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("TF011/var.region");
+  });
+
+  test("passes a documented one", async () => {
+    expect(tf011.check(await loadFixture("TF011", "negative"))).toHaveLength(0);
+  });
+
+  test("a blank description is no description", async () => {
+    expect(tf011.check(await loadFixture("TF011", "positive-blank"))).toHaveLength(1);
+  });
+});
+
+describe("TF012: output without a description", () => {
+  test("flags an undocumented output", async () => {
+    const diags = tf012.check(await loadFixture("TF012", "positive"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("TF012/output.bucket_name");
+  });
+
+  test("passes a documented one", async () => {
+    expect(tf012.check(await loadFixture("TF012", "negative"))).toHaveLength(0);
+  });
+});
+
+describe("TF013: ignore_changes = all", () => {
+  test("flags a lifecycle block that ignores everything", async () => {
+    const diags = tf013.check(await loadFixture("TF013", "positive"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("TF013/aws_instance.web");
+    expect(diags[0].severity).toBe("warning");
+  });
+
+  test("passes a named list of attributes", async () => {
+    expect(tf013.check(await loadFixture("TF013", "negative"))).toHaveLength(0);
+  });
+
+  test("a data source's lifecycle block counts too", async () => {
+    const diags = tf013.check(await loadFixture("TF013", "positive-data"));
+    expect(diags.map((d) => d.entity)).toEqual(["TF013/data.aws_ami.base"]);
+  });
+});
+
+describe("TF016: interpolation-only attribute values", () => {
+  test("flags each quoted interpolation, with its file and line", async () => {
+    const diags = tf016.check(await loadFixture("TF016", "positive"));
+    expect(diags).toHaveLength(2);
+    expect(diags.map((d) => d.entity)).toEqual(["TF016/positive.tf:7", "TF016/positive.tf:12"]);
+    expect(diags[0].message).toContain("bucket");
+  });
+
+  test("passes bare references, which the parse cannot tell apart from quoted ones", async () => {
+    // The point of reading the source: `bucket = var.assets_bucket` parses to
+    // exactly the same `"${var.assets_bucket}"` string as the positive fixture.
+    expect(tf016.check(await loadFixture("TF016", "negative"))).toHaveLength(0);
+  });
+
+  test("passes a template that carries literal text as well", async () => {
+    expect(tf016.check(await loadFixture("TF016", "negative-template"))).toHaveLength(0);
+  });
+
+  test("scans a file once however many blocks it holds", async () => {
+    const diags = tf016.check(await loadFixture("TF016", "positive-shared-file"));
+    expect(diags).toHaveLength(1);
+  });
+});
+
+describe("TF017: depends_on on a module block", () => {
+  test("flags the module call", async () => {
+    const diags = tf017.check(await loadFixture("TF017", "positive"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("TF017/module.cdn");
+  });
+
+  test("passes a module wired through its inputs", async () => {
+    expect(tf017.check(await loadFixture("TF017", "negative"))).toHaveLength(0);
+  });
+});
+
+describe("TF018: output of a whole resource", () => {
+  test("flags an output that returns the resource itself", async () => {
+    const diags = tf018.check(await loadFixture("TF018", "positive"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("TF018/output.web_instance");
+    expect(diags[0].message).toContain("aws_instance.web.id");
+  });
+
+  test("passes an attribute, and a whole module (its outputs are already curated)", async () => {
+    expect(tf018.check(await loadFixture("TF018", "negative"))).toHaveLength(0);
+  });
+
+  test("a whole data source counts, a data source attribute does not", async () => {
+    const diags = tf018.check(await loadFixture("TF018", "positive-data"));
+    expect(diags.map((d) => d.entity)).toEqual(["TF018/output.base_ami"]);
+  });
+});
+
+describe("TF019: a meta-argument set to its default false", () => {
+  test("flags the variable flag and both lifecycle flags", async () => {
+    const diags = tf019.check(await loadFixture("TF019", "positive"));
+    expect(diags.map((d) => d.entity).sort()).toEqual([
+      "TF019/aws_instance.web.create_before_destroy",
+      "TF019/aws_instance.web.prevent_destroy",
+      "TF019/var.log_level.sensitive",
+    ]);
+  });
+
+  test("passes a root with no redundant defaults, and an expression is not a literal false", async () => {
+    expect(tf019.check(await loadFixture("TF019", "negative"))).toHaveLength(0);
+  });
+
+  test("an output's ephemeral flag counts too", async () => {
+    const diags = tf019.check(await loadFixture("TF019", "positive-output"));
+    expect(diags.map((d) => d.entity)).toEqual(["TF019/output.endpoint.ephemeral"]);
+  });
+});
+
+describe("TF022: credential-named resource attribute holding a literal", () => {
+  test("flags the plaintext password", async () => {
+    const diags = tf022.check(await loadFixture("TF022", "positive"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("TF022/aws_db_instance.app.password");
+    expect(diags[0].message).not.toContain("Pr0dDbP4ssw0rd");
+    expect(diags[0].message).toContain("reference");
+  });
+
+  test("passes a password read from a data source", async () => {
+    expect(tf022.check(await loadFixture("TF022", "negative"))).toHaveLength(0);
+  });
+
+  test("descends into a nested block", async () => {
+    const diags = tf022.check(await loadFixture("TF022", "positive-nested"));
+    expect(diags.map((d) => d.entity)).toEqual(["TF022/aws_instance.web.connection.password"]);
+  });
+
+  test("a locator attribute is the remediation, not the finding", async () => {
+    expect(tf022.check(await loadFixture("TF022", "negative-locator"))).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/suppression.test.ts

@@ -0,0 +1,110 @@
+/**
+ * End-to-end suppression (chant #2111): real `.tf` text, through
+ * `blocksToEntities` (the exact parse `chant build`'s `buildRoots()` and
+ * `chant audit`'s `auditEntities()` both call), into TF001, then through
+ * `applyInlineSuppressions`. TF001 is the issue's named test subject because
+ * it is the one rule with nothing to anchor a finding to but the entity that
+ * is missing something, and proving both `# chant-ignore` and
+ * `# chant-ignore-block` reach it validates the block-anchored form for
+ * exactly the case it exists for.
+ */
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { applyInlineSuppressions, SUPPRESSION_EXPIRED_ID, SUPPRESSION_MISPLACED_FILE_ID, SUPPRESSION_UNIGNORABLE_ID } from "@intentius/chant/lint/suppressions";
+import type { RuleConfig } from "@intentius/chant/lint/rule";
+import { tf001 } from "./tf001";
+import { blocksToEntities } from "../../hcl/parse";
+
+async function ctxFor(source: string): Promise<PostSynthContext> {
+  const entities = await blocksToEntities([{ name: "main.tf", source }], "app");
+  return { outputs: new Map(), entities } as unknown as PostSynthContext;
+}
+
+/** A `terraform` block with no backend: TF001's positive case, undecorated. */
+const BACKENDLESS = `terraform {\n  required_version = ">= 1.5.0"\n}\n`;
+
+describe("TF001 through inline suppression", () => {
+  test("chant-ignore-block suppresses TF001 on the terraform block", async () => {
+    const ctx = await ctxFor(`# chant-ignore-block: TF001\n${BACKENDLESS}`);
+    const diags = tf001.check(ctx);
+    expect(diags).toHaveLength(1);
+    const { diagnostics, suppressed } = applyInlineSuppressions(diags, ctx.entities);
+    expect(diagnostics).toHaveLength(0);
+    expect(suppressed).toHaveLength(1);
+  });
+
+  test("a plain chant-ignore on the same block also suppresses TF001", async () => {
+    const ctx = await ctxFor(`# chant-ignore: TF001\n${BACKENDLESS}`);
+    const diags = tf001.check(ctx);
+    const { diagnostics, suppressed } = applyInlineSuppressions(diags, ctx.entities);
+    expect(diagnostics).toHaveLength(0);
+    expect(suppressed).toHaveLength(1);
+  });
+
+  test('"all" suppresses TF001 too, not just an explicit id', async () => {
+    const ctx = await ctxFor(`# chant-ignore-block: all\n${BACKENDLESS}`);
+    const diags = tf001.check(ctx);
+    const { diagnostics, suppressed } = applyInlineSuppressions(diags, ctx.entities);
+    expect(diagnostics).toHaveLength(0);
+    expect(suppressed).toHaveLength(1);
+  });
+
+  test("a directive naming a different rule id does not suppress TF001", async () => {
+    const ctx = await ctxFor(`# chant-ignore-block: TF010\n${BACKENDLESS}`);
+    const diags = tf001.check(ctx);
+    const { diagnostics, suppressed } = applyInlineSuppressions(diags, ctx.entities);
+    expect(diagnostics).toHaveLength(1);
+    expect(suppressed).toHaveLength(0);
+  });
+
+  test("chant-ignore-file suppresses TF001 for the whole root when placed at the top", async () => {
+    const ctx = await ctxFor(`# chant-ignore-file: TF001\n${BACKENDLESS}`);
+    const diags = tf001.check(ctx);
+    const { diagnostics, suppressed } = applyInlineSuppressions(diags, ctx.entities);
+    expect(diagnostics).toHaveLength(0);
+    expect(suppressed).toHaveLength(1);
+  });
+
+  test("a chant-ignore-file NOT on the first non-blank line does not suppress, and is reported", async () => {
+    const ctx = await ctxFor(`# a header\n# chant-ignore-file: TF001\n${BACKENDLESS}`);
+    const diags = tf001.check(ctx);
+    const { diagnostics, suppressed, meta } = applyInlineSuppressions(diags, ctx.entities);
+    expect(diagnostics).toHaveLength(1); // TF001 still fires: the misplaced directive has no effect
+    expect(suppressed).toHaveLength(0);
+    expect(meta.map((m) => m.checkId)).toEqual([SUPPRESSION_MISPLACED_FILE_ID]);
+  });
+
+  test("an expired directive no longer suppresses TF001, and is reported once", async () => {
+    const ctx = await ctxFor(`# chant-ignore-block: TF001 exp:2020-01-01\n${BACKENDLESS}`);
+    const diags = tf001.check(ctx);
+    const { diagnostics, suppressed, meta } = applyInlineSuppressions(diags, ctx.entities, undefined, new Date("2026-01-01"));
+    expect(diagnostics).toHaveLength(1);
+    expect(suppressed).toHaveLength(0);
+    expect(meta.map((m) => m.checkId)).toEqual([SUPPRESSION_EXPIRED_ID]);
+  });
+
+  test("a not-yet-expired directive still suppresses TF001", async () => {
+    const ctx = await ctxFor(`# chant-ignore-block: TF001 exp:2099-01-01\n${BACKENDLESS}`);
+    const diags = tf001.check(ctx);
+    const { diagnostics, suppressed, meta } = applyInlineSuppressions(diags, ctx.entities, undefined, new Date("2026-01-01"));
+    expect(diagnostics).toHaveLength(0);
+    expect(suppressed).toHaveLength(1);
+    expect(meta).toHaveLength(0);
+  });
+
+  test("ignorable: false denies an explicit chant-ignore of TF001, and reports the attempt", async () => {
+    const rules: Record<string, RuleConfig> = { TF001: ["warning", { ignorable: false }] };
+    const ctx = await ctxFor(`# chant-ignore-block: TF001\n${BACKENDLESS}`);
+    const diags = tf001.check(ctx);
+    const { diagnostics, suppressed, meta } = applyInlineSuppressions(diags, ctx.entities, rules);
+    expect(diagnostics).toHaveLength(1); // TF001 still fires
+    expect(suppressed).toHaveLength(0);
+    expect(meta.map((m) => m.checkId)).toEqual([SUPPRESSION_UNIGNORABLE_ID]);
+  });
+
+  test("TF001 with a backend block never fires, suppressed or not", async () => {
+    const withBackend = `terraform {\n  backend "s3" {\n    bucket = "tfstate"\n  }\n}\n`;
+    const ctx = await ctxFor(withBackend);
+    expect(tf001.check(ctx)).toHaveLength(0);
+  });
+});