@microsoft/terraform-cdk-constructs 1.10.0 → 2.5.0

package/scripts/azure-version-updater/discover.ts

@@ -0,0 +1,382 @@
+#!/usr/bin/env ts-node
+/**
+ * Azure API Version Discovery Script
+ *
+ * Scans all AZAPI construct schema files, queries the Azure ARM providers API
+ * for available API versions, and outputs a JSON manifest of new versions.
+ *
+ * Usage:
+ *   npx ts-node scripts/azure-version-updater/discover.ts > version-manifest.json
+ *
+ * Prerequisites:
+ *   - Must be authenticated with Azure (`az login` or OIDC in CI)
+ */
+
+/* eslint-disable @typescript-eslint/no-require-imports */
+const fs = require("fs");
+const path = require("path");
+const https = require("https");
+const { execSync } = require("child_process");
+const specMapping = require("./spec-mapping");
+
+interface SchemaFileInfo {
+  schemaFile: string;
+  constructFile: string;
+  testFile: string;
+  resourceType: string;
+  namespace: string;
+  resourceTypeName: string;
+  prefix: string;
+  knownVersions: string[];
+}
+
+interface UpdateEntry extends SchemaFileInfo {
+  newVersions: string[];
+  specUrls: Record<string, string>;
+}
+
+interface VersionManifest {
+  updates: UpdateEntry[];
+  noUpdates: Array<{ resourceType: string; latestKnown: string }>;
+  errors: Array<{ resourceType: string; error: string }>;
+  summary: {
+    totalConstructs: number;
+    constructsWithUpdates: number;
+    totalNewVersions: number;
+    discoveryDate: string;
+  };
+}
+
+/**
+ * Scan all schema files and extract resource type info.
+ */
+function scanSchemaFiles(): SchemaFileInfo[] {
+  const srcDir = path.resolve(__dirname, "../../src");
+  const results: SchemaFileInfo[] = [];
+
+  const azureDirs = fs
+    .readdirSync(srcDir)
+    .filter((d: string) => d.startsWith("azure-"))
+    .map((d: string) => path.join(srcDir, d));
+
+  for (const dir of azureDirs) {
+    const libDir = path.join(dir, "lib");
+    if (!fs.existsSync(libDir)) continue;
+
+    // Find all *-schemas.ts files recursively
+    const schemaFiles = findSchemaFiles(libDir);
+
+    for (const schemaFile of schemaFiles) {
+      const content = fs.readFileSync(schemaFile, "utf-8");
+      const infos = extractSchemaInfo(schemaFile, content, dir);
+      results.push(...infos);
+    }
+  }
+
+  return results;
+}
+
+function findSchemaFiles(dir: string): string[] {
+  const files: string[] = [];
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...findSchemaFiles(full));
+    } else if (entry.name.endsWith("-schemas.ts")) {
+      files.push(full);
+    }
+  }
+  return files;
+}
+
+function extractSchemaInfo(
+  schemaFile: string,
+  content: string,
+  constructDir: string,
+): SchemaFileInfo[] {
+  const results: SchemaFileInfo[] = [];
+  const rootDir = path.resolve(__dirname, "../..");
+
+  // Extract all TYPE constants
+  const typeRegex = /export\s+const\s+(\w+)_TYPE\s*=\s*"([^"]+)"/g;
+  let match;
+  while ((match = typeRegex.exec(content)) !== null) {
+    const prefix = match[1];
+    const resourceType = match[2];
+    const parts = resourceType.split("/");
+    const namespace = parts[0];
+    const resourceTypeName = parts.slice(1).join("/");
+
+    // Extract known versions from this file for this resource type
+    // Match version strings in VersionConfig blocks
+    const versionRegex = /version:\s*"(\d{4}-\d{2}-\d{2})"/g;
+    const knownVersions = new Set<string>();
+    let vMatch;
+    while ((vMatch = versionRegex.exec(content)) !== null) {
+      knownVersions.add(vMatch[1]);
+    }
+
+    // Find corresponding construct and test files
+    const constructFile = findConstructFile(constructDir, prefix);
+    const testFile = findTestFile(constructDir, prefix);
+
+    results.push({
+      schemaFile: path.relative(rootDir, schemaFile),
+      constructFile: constructFile
+        ? path.relative(rootDir, constructFile)
+        : "",
+      testFile: testFile ? path.relative(rootDir, testFile) : "",
+      resourceType,
+      namespace,
+      resourceTypeName,
+      prefix,
+      knownVersions: Array.from(knownVersions.values()).sort(),
+    });
+  }
+
+  return results;
+}
+
+function findConstructFile(
+  constructDir: string,
+  _prefix: string,
+): string | null {
+  const libDir = path.join(constructDir, "lib");
+  if (!fs.existsSync(libDir)) return null;
+
+  // Look for .ts files (not -schemas.ts) that contain defaultVersion()
+  const tsFiles = fs
+    .readdirSync(libDir)
+    .filter((f: string) => f.endsWith(".ts") && !f.endsWith("-schemas.ts") && f !== "index.ts");
+
+  for (const f of tsFiles) {
+    const content = fs.readFileSync(path.join(libDir, f), "utf-8");
+    if (content.includes("defaultVersion()")) {
+      return path.join(libDir, f);
+    }
+  }
+  return null;
+}
+
+function findTestFile(constructDir: string, _prefix: string): string | null {
+  const testDir = path.join(constructDir, "test");
+  if (!fs.existsSync(testDir)) return null;
+
+  const specFiles = fs
+    .readdirSync(testDir)
+    .filter((f: string) => f.endsWith(".spec.ts"));
+  return specFiles.length > 0 ? path.join(testDir, specFiles[0]) : null;
+}
+
+/**
+ * Get an Azure access token using the CLI.
+ */
+function getAccessToken(): string {
+  const result = execSync(
+    'az account get-access-token --query accessToken -o tsv',
+    { encoding: "utf-8" },
+  );
+  return result.trim();
+}
+
+/**
+ * Fetch available API versions from the ARM providers endpoint.
+ */
+async function fetchProviderVersions(
+  namespace: string,
+  token: string,
+): Promise<Record<string, string[]>> {
+  const url = `https://management.azure.com/providers/${namespace}?api-version=2024-11-01`;
+  const response = await httpGet(url, {
+    Authorization: `Bearer ${token}`,
+  });
+
+  const data = JSON.parse(response);
+  const result: Record<string, string[]> = {};
+
+  if (data.resourceTypes) {
+    for (const rt of data.resourceTypes) {
+      result[rt.resourceType] = rt.apiVersions || [];
+    }
+  }
+  return result;
+}
+
+function httpGet(
+  url: string,
+  headers: Record<string, string>,
+): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const parsedUrl = new URL(url);
+    const options = {
+      hostname: parsedUrl.hostname,
+      path: parsedUrl.pathname + parsedUrl.search,
+      method: "GET",
+      headers: { ...headers, "Content-Type": "application/json" },
+    };
+    const req = https.request(options, (res: any) => {
+      let body = "";
+      res.on("data", (chunk: Buffer) => (body += chunk.toString()));
+      res.on("end", () => {
+        if (res.statusCode && res.statusCode >= 200 && res.statusCode < 300) {
+          resolve(body);
+        } else {
+          reject(
+            new Error(
+              `HTTP ${res.statusCode} from ${url}: ${body.substring(0, 500)}`,
+            ),
+          );
+        }
+      });
+    });
+    req.on("error", reject);
+    req.end();
+  });
+}
+
+/**
+ * Case-insensitive lookup of resource type in provider data.
+ * ARM API may return "dnszones" when we expect "dnsZones", or
+ * child resources may not be listed separately -- fall back to parent.
+ */
+function findVersionsCaseInsensitive(
+  providerData: Record<string, string[]>,
+  resourceTypeName: string,
+): string[] | undefined {
+  // Try exact match first
+  if (providerData[resourceTypeName]) {
+    return providerData[resourceTypeName];
+  }
+  // Case-insensitive match
+  const lowerTarget = resourceTypeName.toLowerCase();
+  for (const [key, value] of Object.entries(providerData)) {
+    if (key.toLowerCase() === lowerTarget) {
+      return value;
+    }
+  }
+  // For child resources like "virtualNetworks/subnets" or
+  // "networkManagers/connectivityConfigurations", try the top-level parent
+  if (resourceTypeName.includes("/")) {
+    const parent = resourceTypeName.split("/")[0];
+    return findVersionsCaseInsensitive(providerData, parent);
+  }
+  return undefined;
+}
+
+async function main(): Promise<void> {
+  const schemaInfos = scanSchemaFiles();
+  console.error(
+    `Found ${schemaInfos.length} resource types across schema files`,
+  );
+
+  // Get Azure access token
+  let token: string;
+  try {
+    token = getAccessToken();
+  } catch (e) {
+    console.error(
+      "Failed to get Azure access token. Ensure you are logged in with `az login`.",
+    );
+    process.exit(1);
+  }
+
+  // Dedupe namespaces and fetch provider info
+  const namespaces = [...new Set(schemaInfos.map((s) => s.namespace))];
+  console.error(`Querying ${namespaces.length} Azure namespaces...`);
+
+  const providerCache: Record<string, Record<string, string[]>> = {};
+  for (const ns of namespaces) {
+    try {
+      providerCache[ns] = await fetchProviderVersions(ns, token);
+      console.error(`  ${ns}: OK (${Object.keys(providerCache[ns]).length} resource types)`);
+    } catch (e) {
+      console.error(`  ${ns}: FAILED - ${(e as Error).message}`);
+      providerCache[ns] = {};
+    }
+  }
+
+  // Compare and find new versions
+  const manifest: VersionManifest = {
+    updates: [],
+    noUpdates: [],
+    errors: [],
+    summary: {
+      totalConstructs: schemaInfos.length,
+      constructsWithUpdates: 0,
+      totalNewVersions: 0,
+      discoveryDate: new Date().toISOString().split("T")[0],
+    },
+  };
+
+  for (const info of schemaInfos) {
+    const providerData = providerCache[info.namespace];
+    if (!providerData || Object.keys(providerData).length === 0) {
+      manifest.errors.push({
+        resourceType: info.resourceType,
+        error: `No provider data for namespace ${info.namespace}`,
+      });
+      continue;
+    }
+
+    // ARM API may return resource type names with different casing (e.g., "dnszones" vs "dnsZones").
+    // Do a case-insensitive lookup.
+    const rtName = info.resourceTypeName;
+    const armVersions = findVersionsCaseInsensitive(providerData, rtName);
+
+    if (!armVersions) {
+      manifest.errors.push({
+        resourceType: info.resourceType,
+        error: `Resource type "${rtName}" not found in provider ${info.namespace}. Available: ${Object.keys(providerData).slice(0, 10).join(", ")}...`,
+      });
+      continue;
+    }
+
+    // Filter to stable only (no -preview) and newer than our latest
+    const latestKnown =
+      info.knownVersions.length > 0
+        ? info.knownVersions[info.knownVersions.length - 1]
+        : "0000-00-00";
+
+    const newVersions = armVersions
+      .filter((v) => !v.includes("-preview") && v > latestKnown)
+      .sort();
+
+    if (newVersions.length === 0) {
+      manifest.noUpdates.push({
+        resourceType: info.resourceType,
+        latestKnown,
+      });
+      continue;
+    }
+
+    // Build spec URLs for each new version
+    const specUrls: Record<string, string> = {};
+    for (const v of newVersions) {
+      specUrls[v] = specMapping.getSpecTreeUrl(info.resourceType, v);
+    }
+
+    manifest.updates.push({
+      ...info,
+      newVersions,
+      specUrls,
+    });
+
+    manifest.summary.constructsWithUpdates++;
+    manifest.summary.totalNewVersions += newVersions.length;
+  }
+
+  // Output manifest to stdout (logs go to stderr)
+  console.log(JSON.stringify(manifest, null, 2));
+
+  console.error(
+    `\nSummary: ${manifest.summary.constructsWithUpdates}/${manifest.summary.totalConstructs} constructs have ${manifest.summary.totalNewVersions} new version(s)`,
+  );
+  if (manifest.errors.length > 0) {
+    console.error(`Errors: ${manifest.errors.length} resource types could not be queried`);
+  }
+}
+
+main().catch((e) => {
+  console.error("Fatal error:", e);
+  process.exit(1);
+});

package/scripts/azure-version-updater/spec-mapping.ts

@@ -0,0 +1,164 @@
+/**
+ * Maps Azure resource types to their REST API spec paths on GitHub.
+ *
+ * The Azure REST API specs live at:
+ *   https://github.com/Azure/azure-rest-api-specs/tree/main/specification/<service>/resource-manager/<Provider>/stable/<version>/
+ *
+ * This module provides the mapping from resource type strings (e.g. "Microsoft.Network/virtualNetworks")
+ * to the spec directory path template with a {version} placeholder.
+ */
+
+/**
+ * Explicit mapping from Azure resource type to the spec directory path.
+ * The path is relative to the azure-rest-api-specs repo root.
+ * Use {version} as placeholder for the API version string.
+ */
+const SPEC_PATH_MAP: Record<string, string> = {
+  // Resources
+  "Microsoft.Resources/resourceGroups":
+    "specification/resources/resource-manager/Microsoft.Resources/stable/{version}",
+
+  // Network
+  "Microsoft.Network/virtualNetworks":
+    "specification/network/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/virtualNetworks/subnets":
+    "specification/network/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/publicIPAddresses":
+    "specification/network/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/networkInterfaces":
+    "specification/network/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/networkSecurityGroups":
+    "specification/network/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/networkManagers":
+    "specification/network/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/networkManagers/ipamPools":
+    "specification/network/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/networkManagers/ipamPools/staticCidrs":
+    "specification/network/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/networkManagers/connectivityConfigurations":
+    "specification/network/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/networkManagers/securityAdminConfigurations":
+    "specification/network/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/networkManagers/networkGroups":
+    "specification/network/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/networkManagers/networkGroups/staticMembers":
+    "specification/network/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/networkWatchers":
+    "specification/network/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/dnsZones":
+    "specification/dns/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/dnsZones/A":
+    "specification/dns/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/dnsZones/AAAA":
+    "specification/dns/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/dnsZones/CAA":
+    "specification/dns/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/dnsZones/CNAME":
+    "specification/dns/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/dnsZones/MX":
+    "specification/dns/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/dnsZones/NS":
+    "specification/dns/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/dnsZones/PTR":
+    "specification/dns/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/dnsZones/SOA":
+    "specification/dns/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/dnsZones/SRV":
+    "specification/dns/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/dnsZones/TXT":
+    "specification/dns/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/privateDnsZones":
+    "specification/privatedns/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/privateDnsZones/A":
+    "specification/privatedns/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/privateDnsZones/AAAA":
+    "specification/privatedns/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/privateDnsZones/CNAME":
+    "specification/privatedns/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/privateDnsZones/MX":
+    "specification/privatedns/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/privateDnsZones/PTR":
+    "specification/privatedns/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/privateDnsZones/SOA":
+    "specification/privatedns/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/privateDnsZones/SRV":
+    "specification/privatedns/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/privateDnsZones/TXT":
+    "specification/privatedns/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/dnsResolvers":
+    "specification/dnsresolver/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/connections":
+    "specification/network/resource-manager/Microsoft.Network/stable/{version}",
+  "Microsoft.Network/virtualNetworkGateways":
+    "specification/network/resource-manager/Microsoft.Network/stable/{version}",
+
+  // Compute
+  "Microsoft.Compute/virtualMachines":
+    "specification/compute/resource-manager/Microsoft.Compute/ComputeRP/stable/{version}",
+  "Microsoft.Compute/virtualMachineScaleSets":
+    "specification/compute/resource-manager/Microsoft.Compute/ComputeRP/stable/{version}",
+
+  // Storage
+  "Microsoft.Storage/storageAccounts":
+    "specification/storage/resource-manager/Microsoft.Storage/stable/{version}",
+
+  // Containers
+  "Microsoft.ContainerService/managedClusters":
+    "specification/containerservice/resource-manager/Microsoft.ContainerService/aks/stable/{version}",
+  "Microsoft.App/containerApps":
+    "specification/app/resource-manager/Microsoft.App/stable/{version}",
+  "Microsoft.App/managedEnvironments":
+    "specification/app/resource-manager/Microsoft.App/stable/{version}",
+
+  // Authorization
+  "Microsoft.Authorization/roleAssignments":
+    "specification/authorization/resource-manager/Microsoft.Authorization/stable/{version}",
+  "Microsoft.Authorization/roleDefinitions":
+    "specification/authorization/resource-manager/Microsoft.Authorization/stable/{version}",
+  "Microsoft.Authorization/policyDefinitions":
+    "specification/resources/resource-manager/Microsoft.Authorization/stable/{version}",
+  "Microsoft.Authorization/policyAssignments":
+    "specification/resources/resource-manager/Microsoft.Authorization/stable/{version}",
+  "Microsoft.Authorization/policySetDefinitions":
+    "specification/resources/resource-manager/Microsoft.Authorization/stable/{version}",
+
+  // Monitoring / Insights
+  "Microsoft.Insights/activityLogAlerts":
+    "specification/monitor/resource-manager/Microsoft.Insights/stable/{version}",
+  "Microsoft.Insights/metricAlerts":
+    "specification/monitor/resource-manager/Microsoft.Insights/stable/{version}",
+  "Microsoft.Insights/actionGroups":
+    "specification/monitor/resource-manager/Microsoft.Insights/stable/{version}",
+  "Microsoft.Insights/diagnosticSettings":
+    "specification/monitor/resource-manager/Microsoft.Insights/stable/{version}",
+
+  // Log Analytics
+  "Microsoft.OperationalInsights/workspaces":
+    "specification/operationalinsights/resource-manager/Microsoft.OperationalInsights/stable/{version}",
+};
+
+/**
+ * Build the GitHub tree URL for a given resource type and version.
+ */
+function getSpecTreeUrl(resourceType: string, version: string): string {
+  const basePath = SPEC_PATH_MAP[resourceType];
+  if (basePath) {
+    const path = basePath.replace("{version}", version);
+    return `https://github.com/Azure/azure-rest-api-specs/tree/main/${path}`;
+  }
+  // Fallback: construct from resource type convention
+  return buildFallbackSpecUrl(resourceType, version);
+}
+
+/**
+ * Convention-based fallback for unmapped resource types.
+ * Microsoft.Foo/bars -> specification/foo/resource-manager/Microsoft.Foo/stable/{version}
+ */
+function buildFallbackSpecUrl(resourceType: string, version: string): string {
+  const namespace = resourceType.split("/")[0]; // Microsoft.Foo
+  const service = namespace.replace("Microsoft.", "").toLowerCase(); // foo
+  const path = `specification/${service}/resource-manager/${namespace}/stable/${version}`;
+  return `https://github.com/Azure/azure-rest-api-specs/tree/main/${path}`;
+}
+
+module.exports = { SPEC_PATH_MAP, getSpecTreeUrl };

package/scripts/azure-version-updater/tsconfig.json

@@ -0,0 +1,11 @@
+{
+  "compilerOptions": {
+    "target": "es2020",
+    "module": "commonjs",
+    "esModuleInterop": true,
+    "strict": false,
+    "resolveJsonModule": true,
+    "moduleResolution": "node"
+  },
+  "include": ["**/*.ts"]
+}

package/setup.js

@@ -1,2 +1,2 @@
-const cdktf = require("cdktf");
-cdktf.Testing.setupJest();
+const cdktn = require("cdktn");
+cdktn.Testing.setupJest();