@intentius/chant 0.124.44 → 0.124.46

package/dist/capabilities/view.js

@@ -0,0 +1,484 @@
+import { terraformType } from "../graph-effective.js";
+/**
+ * Merge mappings for the same lexicon: objects merge key by key at every
+ * depth, lists concatenate, and anything else in a later mapping wins.
+ */
+export function mergeMappings(...ms) {
+    const merge = (a, b) => {
+        if (b === undefined)
+            return a;
+        if (Array.isArray(a) && Array.isArray(b))
+            return [...a, ...b.filter((x) => typeof x === "object" || !a.includes(x))];
+        const isObj = (x) => !!x && typeof x === "object" && !Array.isArray(x);
+        if (isObj(a) && isObj(b)) {
+            const out = { ...a };
+            for (const [k, v] of Object.entries(b))
+                out[k] = merge(a[k], v);
+            return out;
+        }
+        return b;
+    };
+    return ms.reduce((acc, m) => merge(acc, m), { lexicon: ms[0]?.lexicon ?? "" });
+}
+const arr = (v) => (v == null ? [] : Array.isArray(v) ? v : [v]);
+/** Every value at `path` (`A.B`, `A[].B`), flattened. */
+function readPath(obj, path) {
+    let cur = [obj];
+    for (const seg of path.split(".")) {
+        const spread = seg.endsWith("[]");
+        const key = spread ? seg.slice(0, -2) : seg;
+        const next = [];
+        for (const c of cur) {
+            if (!c || typeof c !== "object")
+                continue;
+            const v = c[key];
+            if (v === undefined)
+                continue;
+            if (spread)
+                next.push(...arr(v));
+            else
+                next.push(v);
+        }
+        cur = next;
+    }
+    return cur;
+}
+function readSource(obj, src) {
+    if (typeof src === "string")
+        return readPath(obj, src)[0];
+    if (Array.isArray(src)) {
+        for (const p of src) {
+            const v = readPath(obj, p)[0];
+            if (v !== undefined && v !== null)
+                return v;
+        }
+        return undefined;
+    }
+    if ("const" in src)
+        return src.const;
+    return src.all.flatMap((p) => readPath(obj, p).flatMap(arr));
+}
+function matchesWhen(obj, when) {
+    if (!when)
+        return true;
+    return Object.entries(when).every(([k, v]) => readPath(obj, k)[0] === v);
+}
+/** The bare name a row prints: no stack qualification, no root directory. */
+export function displayName(id) {
+    const s = id.includes("::") ? id.slice(id.lastIndexOf("::") + 2) : id;
+    return s.slice(s.lastIndexOf("/") + 1);
+}
+const ARN_NAMES = [
+    { label: "Role", re: /^arn:aws[\w-]*:iam::[^:]*:role\/(?:[^*]*\/)?([^/*]+)$/ },
+    { label: "Bucket", re: /^arn:aws[\w-]*:s3:::([^/*]+)(?:\/.*)?$/ },
+    { label: "Table", re: /^arn:aws[\w-]*:dynamodb:[^:]*:[^:]*:table\/([^/*]+)$/ },
+];
+/**
+ * Normalize what each lexicon spells its own way, for labels whose meaning is
+ * core vocabulary: an ingress rule's protocol and port range.
+ */
+function normalize(label, attrs) {
+    if (label === "IngressRule") {
+        const raw = attrs.proto == null ? "-1" : String(attrs.proto).toLowerCase();
+        const proto = raw === "all" || raw === "-1" ? "-1" : raw;
+        attrs.proto = proto;
+        if (proto === "-1" || attrs.from == null) {
+            attrs.from = 0;
+            attrs.to = 65535;
+        }
+        else {
+            attrs.from = Number(attrs.from);
+            attrs.to = attrs.to == null ? attrs.from : Number(attrs.to);
+        }
+        attrs.cidrs = arr(attrs.cidrs).map(String);
+    }
+}
+/**
+ * Build the view of an IR through the packs given. Nodes of a kind no
+ * mapping labels are left out, as are edges no mapping names.
+ */
+export function buildView(ir, packs) {
+    const byLexicon = new Map();
+    for (const p of packs) {
+        const prev = byLexicon.get(p.mapping.lexicon);
+        byLexicon.set(p.mapping.lexicon, prev ? { mapping: mergeMappings(prev.mapping, p.mapping), adapter: { ...prev.adapter, ...p.adapter } } : p);
+    }
+    const terraformPack = [...byLexicon.values()].find((p) => p.mapping.types === "terraform");
+    const kindPacks = [...byLexicon.values()].filter((p) => p.mapping.types !== "terraform");
+    const nodes = new Map();
+    const edges = [];
+    const lexicons = new Set();
+    const irById = new Map(ir.nodes.map((n) => [n.id, n]));
+    const packOf = new Map();
+    const typeAndPack = (n) => {
+        const tf = terraformType(n);
+        if (tf !== undefined)
+            return terraformPack ? { type: tf, pack: terraformPack } : undefined;
+        const kind = n.kind ?? "";
+        const pack = kindPacks.find((p) => p.mapping.labels?.[kind] !== undefined);
+        return pack ? { type: kind, pack } : undefined;
+    };
+    const bodyOf = (n, pack) => {
+        const attrs = (n.attrs ?? {});
+        if (!pack.mapping.body)
+            return attrs;
+        const b = attrs[pack.mapping.body];
+        return b && typeof b === "object" && !Array.isArray(b) ? b : {};
+    };
+    // Terraform locals, per scope, so `tags = local.restricted` reads as a map.
+    const locals = new Map();
+    const scopeOf = (id) => id.slice(0, id.lastIndexOf("/") + 1);
+    for (const n of ir.nodes) {
+        if (n.kind !== "Terraform::Locals")
+            continue;
+        const body = (n.attrs?.body ?? {});
+        locals.set(scopeOf(n.id), { ...locals.get(scopeOf(n.id)), ...body });
+    }
+    const resolveLocal = (from, v) => {
+        const m = typeof v === "string" ? /^\$\{local\.([\w-]+)\}$/.exec(v) : null;
+        return m ? locals.get(scopeOf(from))?.[m[1]] : v;
+    };
+    // ---- nodes
+    for (const n of ir.nodes) {
+        const tp = typeAndPack(n);
+        if (!tp)
+            continue;
+        const { type, pack } = tp;
+        const m = pack.mapping;
+        const spec = m.labels?.[type];
+        if (spec === undefined)
+            continue;
+        const label = typeof spec === "string" ? spec : spec.label;
+        const body = bodyOf(n, pack);
+        if (typeof spec !== "string" && !matchesWhen(body, spec.when))
+            continue;
+        const attrs = { type };
+        if (typeof spec !== "string" && spec.style)
+            attrs.style = spec.style;
+        if (typeof spec !== "string" && spec.set)
+            Object.assign(attrs, spec.set);
+        for (const [neutral, src] of Object.entries(m.attrs?.[label] ?? {})) {
+            const v = readSource(body, src);
+            if (v !== undefined)
+                attrs[neutral] = resolveLocal(n.id, v);
+        }
+        // Carry the IR's own derived attributes (a live read's `internetFacing`).
+        for (const [k, v] of Object.entries((n.attrs ?? {}))) {
+            if (k === "internetFacing" && attrs[k] === undefined)
+                attrs[k] = v;
+        }
+        if (m.classificationTags?.length) {
+            for (const path of m.tags ?? []) {
+                const tags = resolveLocal(n.id, readPath(body, path)[0]);
+                const map = Array.isArray(tags)
+                    ? Object.fromEntries(tags.map((t) => [t.Key, t.Value]))
+                    : tags && typeof tags === "object"
+                        ? tags
+                        : {};
+                for (const key of m.classificationTags) {
+                    if (map[key] !== undefined && attrs.classification === undefined)
+                        attrs.classification = map[key];
+                }
+            }
+        }
+        normalize(label, attrs);
+        nodes.set(n.id, { id: n.id, label, irId: n.id, lexicon: m.lexicon, attrs, body });
+        packOf.set(n.id, pack);
+        lexicons.add(m.lexicon);
+    }
+    // ---- references inside attribute values
+    const byName = new Map();
+    for (const v of nodes.values()) {
+        const name = v.attrs.name;
+        if (typeof name !== "string" || !name)
+            continue;
+        if (!byName.has(v.label))
+            byName.set(v.label, new Map());
+        byName.get(v.label).set(name, v.id);
+    }
+    const refTarget = (from, value) => {
+        const pack = packOf.get(from);
+        if (value && typeof value === "object") {
+            const ref = value.$ref;
+            if (typeof ref === "string") {
+                if (nodes.has(ref))
+                    return { id: ref };
+                const dot = ref.lastIndexOf(".");
+                if (dot > 0 && nodes.has(ref.slice(0, dot)))
+                    return { id: ref.slice(0, dot), attr: ref.slice(dot + 1) };
+                return undefined;
+            }
+            const sub = value.$sub;
+            if (typeof sub === "string") {
+                const m = /\$\{([^.}]+)(?:\.([^}]+))?\}/.exec(sub);
+                if (m && nodes.has(m[1]))
+                    return { id: m[1], attr: m[2] };
+            }
+            return undefined;
+        }
+        if (typeof value !== "string")
+            return undefined;
+        if (pack?.mapping.refs === "terraform") {
+            const m = /(?:^|[^\w.])((?:data\.)?[a-z][a-z0-9]*_[a-z0-9_]+\.[A-Za-z0-9_-]+)(?:\[[^\]]*\])?\.([A-Za-z_]+)/.exec(value);
+            if (m) {
+                const id = scopeOf(from) + m[1];
+                if (nodes.has(id))
+                    return { id, attr: m[2] };
+            }
+        }
+        for (const { label, re } of ARN_NAMES) {
+            const m = re.exec(value);
+            const id = m ? byName.get(label)?.get(m[1]) : undefined;
+            if (id)
+                return { id };
+        }
+        return undefined;
+    };
+    const unresolved = [];
+    // An ARN that names nothing declared here is kept for a workspace's composer (#4378).
+    const keepArn = (from, fromAttr, edge, value) => {
+        if (typeof value === "string" && ARN_NAMES.some(({ re }) => re.test(value)))
+            unresolved.push({ from, fromAttr, edge, value });
+    };
+    const blockEdges = [];
+    // ---- inline blocks: ingress rules, inline routes
+    for (const v of [...nodes.values()]) {
+        const pack = packOf.get(v.id);
+        const specs = pack.mapping.blocks?.[v.label];
+        if (!specs)
+            continue;
+        const body = bodyOf(irById.get(v.id), pack);
+        for (const spec of specs) {
+            readPath(body, spec.attr)
+                .flatMap(arr)
+                .forEach((raw, i) => {
+                if (!raw || typeof raw !== "object" || !matchesWhen(raw, spec.when))
+                    return;
+                const id = `${v.id}#${spec.attr.replace(/\[\]/g, "")}[${i}]`;
+                const attrs = { block: true };
+                if (spec.style)
+                    attrs.style = spec.style;
+                for (const [neutral, src] of Object.entries(spec.attrs ?? {})) {
+                    const val = readSource(raw, src);
+                    if (val !== undefined)
+                        attrs[neutral] = val;
+                }
+                normalize(spec.label, attrs);
+                nodes.set(id, { id, label: spec.label, irId: v.id, lexicon: v.lexicon, attrs, body: raw });
+                packOf.set(id, pack);
+                const back = spec.edge.startsWith("-");
+                const name = back ? spec.edge.slice(1) : spec.edge;
+                const hop = { from: v.id, fromAttr: spec.attr.replace(/\[\]/g, ""), to: id, edge: name };
+                blockEdges.push(back ? { from: id, to: v.id, name, hops: [hop] } : { from: v.id, to: id, name, hops: [hop] });
+                for (const [attr, edge] of Object.entries(spec.refs ?? {})) {
+                    for (const val of arr(raw[attr])) {
+                        const t = refTarget(v.id, val);
+                        if (!t)
+                            keepArn(id, attr, edge, val);
+                        if (t)
+                            blockEdges.push({ from: id, to: t.id, name: edge, hops: [{ from: id, fromAttr: attr, to: t.id, ...(t.attr ? { toAttr: t.attr } : {}), edge }] });
+                    }
+                }
+            });
+        }
+    }
+    // Blocks first: an inline route is read before a separate route resource,
+    // the order the folds always used.
+    edges.push(...blockEdges);
+    // ---- IR edges, named per label
+    for (const e of ir.edges ?? []) {
+        const from = nodes.get(e.from);
+        const to = nodes.get(e.to);
+        if (!from || !to)
+            continue;
+        const pack = packOf.get(e.from);
+        const via = e.viaAttr ?? e.kind ?? "";
+        const spec = pack.mapping.edges?.[from.label]?.[via];
+        const name = typeof spec === "string" ? spec : spec?.[to.label];
+        if (!name)
+            continue;
+        const back = name.startsWith("-");
+        const n = back ? name.slice(1) : name;
+        const hop = irHop(e, n);
+        edges.push(back ? { from: e.to, to: e.from, name: n, hops: [hop] } : { from: e.from, to: e.to, name: n, hops: [hop] });
+    }
+    // ---- link resources -> one edge
+    for (const v of [...nodes.values()]) {
+        const link = packOf.get(v.id)?.mapping.links?.[v.label];
+        if (!link)
+            continue;
+        const a = edges.find((e) => e.from === v.id && e.name === link.from);
+        const b = edges.find((e) => e.from === v.id && e.name === link.to);
+        if (a && b)
+            edges.push({ from: a.to, to: b.to, name: link.edge, hops: [...a.hops, ...b.hops] });
+    }
+    // ---- policy documents -> statements
+    for (const holder of [...nodes.values()]) {
+        if (holder.attrs.block)
+            continue;
+        const pack = packOf.get(holder.id);
+        const docs = pack.mapping.documents?.[holder.label];
+        if (!docs)
+            continue;
+        const body = bodyOf(irById.get(holder.id), pack);
+        for (const [path, docKind] of Object.entries(docs)) {
+            readPath(body, path).forEach((raw, di) => {
+                const doc = readDocument(raw, pack);
+                if (!doc)
+                    return;
+                const base = path.replace(/\[\]/g, "");
+                arr(doc.Statement).forEach((s0, si) => {
+                    if (!s0 || typeof s0 !== "object")
+                        return;
+                    const s = s0;
+                    const id = `${holder.id}#${base}[${di}].Statement[${si}]`;
+                    const principal = s.Principal;
+                    const principals = principal === "*"
+                        ? ["*"]
+                        : principal && typeof principal === "object"
+                            ? Object.values(principal).flatMap(arr).map((p) => (typeof p === "string" ? p : "ref"))
+                            : [];
+                    const resources = arr(s.Resource);
+                    const attrs = {
+                        doc: docKind,
+                        effect: s.Effect,
+                        actions: arr(s.Action).map(String),
+                        ...(s.NotAction !== undefined ? { notActions: arr(s.NotAction).map(String) } : {}),
+                        ...(s.NotResource !== undefined ? { notResource: true } : {}),
+                        ...(s.Condition !== undefined ? { condition: true } : {}),
+                        ...(resources.some((r) => r === "*") ? { anyResource: true } : {}),
+                        principals,
+                    };
+                    nodes.set(id, { id, label: "Statement", irId: holder.id, lexicon: holder.lexicon, attrs });
+                    packOf.set(id, pack);
+                    edges.push({ from: holder.id, to: id, name: "statement", hops: [{ from: holder.id, fromAttr: base, to: id, edge: "statement" }] });
+                    let unresolved = 0;
+                    resources.forEach((r, ri) => {
+                        const t = refTarget(holder.id, r);
+                        // A reference the graph holds but can't name (an intrinsic with
+                        // no target, a Terraform expression to an undeclared resource) is
+                        // counted, so an answer can say what it skipped. A `Sub` is read
+                        // through its `$sub` template (chant#4373).
+                        if (!t && ((r && typeof r === "object") || (typeof r === "string" && r.includes("${"))))
+                            unresolved++;
+                        if (!t)
+                            keepArn(id, `Resource[${ri}]`, "resource", r);
+                        if (t)
+                            edges.push({ from: id, to: t.id, name: "resource", hops: [{ from: id, fromAttr: `Resource[${ri}]`, to: t.id, ...(t.attr ? { toAttr: t.attr } : {}), edge: "resource" }] });
+                    });
+                    if (unresolved > 0)
+                        attrs.unresolved = unresolved;
+                    if (principal && typeof principal === "object") {
+                        for (const p of arr(principal.AWS)) {
+                            const t = refTarget(holder.id, p);
+                            if (!t)
+                                keepArn(id, "Principal.AWS", "principal", p);
+                            if (t)
+                                edges.push({ from: id, to: t.id, name: "principal", hops: [{ from: id, fromAttr: "Principal.AWS", to: t.id, ...(t.attr ? { toAttr: t.attr } : {}), edge: "principal" }] });
+                        }
+                    }
+                });
+            });
+        }
+    }
+    return { nodes, edges, lexicons, unresolved };
+}
+/** The version of the serialized view a member's `chant graph --capability-view` prints (#4378). */
+export const VIEW_DOCUMENT_VERSION = 1;
+export function serializeView(view) {
+    return {
+        version: VIEW_DOCUMENT_VERSION,
+        lexicons: [...view.lexicons].sort(),
+        nodes: [...view.nodes.values()].map((n) => ({ id: n.id, label: n.label, irId: n.irId, lexicon: n.lexicon, attrs: n.attrs })),
+        edges: view.edges,
+        unresolved: view.unresolved ?? [],
+    };
+}
+/** Whether a member printed a view this chant reads; anything else is treated as no view. */
+export function isViewDocument(v) {
+    if (!v || typeof v !== "object")
+        return false;
+    const d = v;
+    return d.version === VIEW_DOCUMENT_VERSION && Array.isArray(d.nodes) && Array.isArray(d.edges) && Array.isArray(d.lexicons);
+}
+/** A view document with every id it holds given `prefix` (`<member>/`), as `workspace graph` composes ids. */
+export function prefixView(doc, prefix) {
+    const p = (id) => `${prefix}${id}`;
+    const hop = (h) => ({ ...h, from: p(h.from), to: p(h.to) });
+    return {
+        version: doc.version,
+        lexicons: doc.lexicons,
+        nodes: doc.nodes.map((n) => ({ ...n, id: p(n.id), irId: p(n.irId) })),
+        edges: doc.edges.map((e) => ({ ...e, from: p(e.from), to: p(e.to), hops: e.hops.map(hop) })),
+        unresolved: (doc.unresolved ?? []).map((u) => ({ ...u, from: p(u.from) })),
+    };
+}
+/**
+ * Compose member views into one (#4378), the matcher's input over a
+ * workspace. Each member's view was mapped by its own chant; the one thing
+ * left to do here is resolve the ARNs a member couldn't, by name over every
+ * member's nodes. Where several members declare the name, the last one in
+ * member order wins, as within one view.
+ */
+export function composeViews(docs) {
+    const nodes = new Map();
+    const edges = [];
+    const lexicons = new Set();
+    for (const d of docs) {
+        for (const n of d.nodes)
+            nodes.set(n.id, { ...n });
+        edges.push(...d.edges);
+        for (const l of d.lexicons)
+            lexicons.add(l);
+    }
+    const byName = new Map();
+    for (const v of nodes.values()) {
+        const name = v.attrs.name;
+        if (typeof name !== "string" || !name)
+            continue;
+        if (!byName.has(v.label))
+            byName.set(v.label, new Map());
+        byName.get(v.label).set(name, v.id);
+    }
+    const unresolved = [];
+    for (const u of docs.flatMap((d) => d.unresolved ?? [])) {
+        let to;
+        for (const { label, re } of ARN_NAMES) {
+            const m = re.exec(u.value);
+            to = m ? byName.get(label)?.get(m[1]) : undefined;
+            if (to)
+                break;
+        }
+        if (to)
+            edges.push({ from: u.from, to, name: u.edge, hops: [{ from: u.from, fromAttr: u.fromAttr, to, edge: u.edge }] });
+        else
+            unresolved.push(u);
+    }
+    return { nodes, edges, lexicons, unresolved };
+}
+function irHop(e, name) {
+    return {
+        from: e.from,
+        ...(e.viaAttr ? { fromAttr: e.viaAttr } : {}),
+        to: e.to,
+        ...(e.toAttr ? { toAttr: e.toAttr } : {}),
+        edge: name,
+    };
+}
+function readDocument(raw, pack) {
+    if (pack.adapter?.readDocument)
+        return pack.adapter.readDocument(raw);
+    if (raw && typeof raw === "object" && !Array.isArray(raw)) {
+        const inner = raw.PolicyDocument;
+        return inner && typeof inner === "object" ? inner : raw;
+    }
+    if (typeof raw === "string") {
+        try {
+            return JSON.parse(raw);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return undefined;
+}