aws-iam-language-server 0.0.17 → 0.0.19

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aws-iam-language-server",
-  "version": "0.0.17",
+  "version": "0.0.19",
   "type": "module",
   "bin": "./src/server.js",
   "publisher": "MichaelBarney",

package/readme.md

@@ -55,6 +55,10 @@ vim.lsp.enable("aws-iam-language-server")
 
 ## Features
 
+This language server will detect policies within yaml/json documents, including deeply-nested policies.
+This means it will work for polcies defined as CloudFormation resources or plain policy files.
+Detection of a policy does require that you have a `Version` set to a valid version date: `2012-10-17` or `2008-10-17`).
+
 ### DocumentLink
 
 Certain elements within a policy document will have a document link associated with it.

package/src/handlers/diagnostics/action.js

@@ -25,14 +25,12 @@ export class ActionValidator extends ElementValidator {
             }
             if (isRuleEnabled('DEPENDENT_ACTION')) {
                 const allActions = this.#getExpandedActions();
-                for (const action of expanded) {
-                    const actionDef = ServiceReference.getAction(action);
-                    if (!actionDef?.dependentActions)
-                        continue;
-                    const missing = actionDef.dependentActions.filter((dep) => !allActions.has(dep.toLowerCase()));
-                    if (missing.length > 0) {
-                        diagnostics.push(createDiagnostic('DEPENDENT_ACTION', `"${action}" requires dependent action${missing.length > 1 ? 's' : ''}: ${missing.join(', ')}`, value.range, DiagnosticSeverity.Warning));
-                    }
+                const actionDef = ServiceReference.getAction(value.text);
+                if (!actionDef?.dependentActions)
+                    continue;
+                const missing = actionDef.dependentActions.filter((dep) => !allActions.has(dep.toLowerCase()));
+                if (missing.length > 0) {
+                    diagnostics.push(createDiagnostic('DEPENDENT_ACTION', `"${actionDef.name}" requires dependent action(s): ${missing.join(', ')}`, value.range, DiagnosticSeverity.Warning));
                 }
             }
         }

package/src/lib/treesitter/hcl.js

@@ -376,7 +376,69 @@ export class TreeHcl extends TreeBase {
         }
         if (current?.type !== 'object_elem')
             return false;
-        return this.#getObjectElemKey(current) === 'Statement';
+        if (this.#getObjectElemKey(current) !== 'Statement')
+            return false;
+        // The policy object is the parent of this object_elem
+        const policyObject = current.parent;
+        if (!policyObject || policyObject.type !== 'object')
+            return false;
+        return this.#hasValidJsonencodeVersion(policyObject);
+    }
+    #hasValidJsonencodeVersion(policyObject) {
+        const validVersions = new Set(['2012-10-17', '2008-10-17']);
+        for (const child of policyObject.namedChildren) {
+            if (child.type !== 'object_elem')
+                continue;
+            if (this.#getObjectElemKey(child) !== 'Version')
+                continue;
+            const expressions = child.namedChildren.filter((c) => c.type === 'expression');
+            const valueExpression = expressions.length >= 2 ? expressions[1] : null;
+            if (!valueExpression)
+                return false;
+            const values = this.#readExpressionStringValues(valueExpression);
+            return values.length === 1 && validVersions.has(values[0]);
+        }
+        return false;
+    }
+    /**
+     * Check for a valid Version in an ERROR node's children for jsonencode mode.
+     * Looks for an object_elem with key "Version" and a valid version value, or
+     * an expression "Version" followed by an expression with a valid version string.
+     */
+    #errorNodeHasValidJsonencodeVersion(errorNode) {
+        const validVersions = new Set(['2012-10-17', '2008-10-17']);
+        let sawVersionKey = false;
+        for (const child of errorNode.children) {
+            if (child.type === 'object_elem') {
+                const key = this.#getObjectElemKey(child);
+                if (key === 'Version') {
+                    const expressions = child.namedChildren.filter((c) => c.type === 'expression');
+                    const valueExpression = expressions.length >= 2 ? expressions[1] : null;
+                    if (valueExpression) {
+                        const values = this.#readExpressionStringValues(valueExpression);
+                        if (values.length === 1 && validVersions.has(values[0]))
+                            return true;
+                    }
+                }
+                sawVersionKey = false;
+            }
+            else if (child.type === 'expression') {
+                const id = this.#getExpressionIdentifier(child);
+                if (id === 'Version') {
+                    sawVersionKey = true;
+                }
+                else if (sawVersionKey) {
+                    const values = this.#readExpressionStringValues(child);
+                    if (values.length === 1 && validVersions.has(values[0]))
+                        return true;
+                    sawVersionKey = false;
+                }
+            }
+            else {
+                sawVersionKey = false;
+            }
+        }
+        return false;
     }
     #buildJsonencodeCursorPath(cursorNode, statementObject, position) {
         const keys = [];
@@ -803,6 +865,9 @@ export class TreeHcl extends TreeBase {
         }
         if (!foundStatement || !lastKey || !policyFormat)
             return null;
+        // For jsonencode mode, require a valid Version in the ERROR node
+        if (policyFormat === 'standard' && !this.#errorNodeHasValidJsonencodeVersion(errorNode))
+            return null;
         // Extract partial and value: when the key came from an attribute/object_elem
         // that contains the quote (e.g., `effect = "`), they're empty. When the
         // cursor node is inside a string (open quote slurped subsequent lines),

package/src/lib/treesitter/json.js

@@ -275,7 +275,27 @@ export class TreeJson extends TreeBase {
         const pair = object.parent.parent;
         if (pair?.type !== 'pair')
             return false;
-        return this.#getPairKeyText(pair) === 'Statement';
+        if (this.#getPairKeyText(pair) !== 'Statement')
+            return false;
+        const policyObject = pair.parent;
+        if (!policyObject || policyObject.type !== 'object')
+            return false;
+        return this.#hasValidVersion(policyObject);
+    }
+    #hasValidVersion(policyObject) {
+        const validVersions = new Set(['2012-10-17', '2008-10-17']);
+        for (const child of policyObject.namedChildren) {
+            if (child.type !== 'pair')
+                continue;
+            if (this.#getPairKeyText(child) !== 'Version')
+                continue;
+            const valueNode = child.namedChildren[1];
+            if (valueNode?.type !== 'string')
+                return false;
+            const content = valueNode.namedChildren.find((c) => c.type === 'string_content');
+            return content?.text ? validVersions.has(content.text) : false;
+        }
+        return false;
     }
     /**
      * Get the text content of a pair's key (first named child string).

package/src/lib/treesitter/yaml.js

@@ -380,7 +380,9 @@ export class TreeYaml extends TreeBase {
      */
     #isStatementSequence(sequence) {
         const sequenceParent = this.#skipBlockNode(sequence.parent);
-        return sequenceParent?.type === 'block_mapping_pair' && this.#getPairKeyText(sequenceParent) === 'Statement';
+        return (sequenceParent?.type === 'block_mapping_pair' &&
+            this.#getPairKeyText(sequenceParent) === 'Statement' &&
+            this.#hasValidVersion(sequenceParent));
     }
     #resolveCursorContext(node, statementMapping, position) {
         const cursorPath = this.#buildCursorPath(node, statementMapping, position);
@@ -705,7 +707,59 @@ export class TreeYaml extends TreeBase {
         node = this.#skipBlockNode(node.parent);
         if (node?.type !== 'block_mapping_pair')
             return false;
-        return this.#getPairKeyText(node) === 'Statement';
+        return this.#getPairKeyText(node) === 'Statement' && this.#hasValidVersion(node);
+    }
+    /**
+     * Check that a Statement pair's parent block_mapping contains a Version pair
+     * with a valid IAM policy version value.
+     */
+    #hasValidVersion(statementPair) {
+        const validVersions = new Set(['2012-10-17', '2008-10-17']);
+        const policyMapping = statementPair.parent;
+        if (!policyMapping || policyMapping.type !== 'block_mapping')
+            return false;
+        for (const child of policyMapping.namedChildren) {
+            if (child.type !== 'block_mapping_pair')
+                continue;
+            if (this.#getPairKeyText(child) !== 'Version')
+                continue;
+            const values = this.#readPairStringValues(child);
+            return values.length === 1 && validVersions.has(values[0]);
+        }
+        return false;
+    }
+    /**
+     * Check for a valid Version in an ERROR node's children. Looks for a "Version"
+     * flow_node followed by a valid version string, or a block_mapping_pair with
+     * key "Version" and valid value.
+     */
+    #errorNodeHasValidVersion(errorNode) {
+        const validVersions = new Set(['2012-10-17', '2008-10-17']);
+        let sawVersionKey = false;
+        for (const child of errorNode.children) {
+            if (child.type === 'block_mapping_pair') {
+                const key = this.#getPairKeyText(child);
+                if (key === 'Version') {
+                    const values = this.#readPairStringValues(child);
+                    if (values.length === 1 && validVersions.has(values[0]))
+                        return true;
+                }
+                sawVersionKey = false;
+            }
+            else if (child.type === 'flow_node') {
+                const text = this.#getScalarText(child);
+                if (text === 'Version') {
+                    sawVersionKey = true;
+                }
+                else if (sawVersionKey && text !== null && validVersions.has(text)) {
+                    return true;
+                }
+                else if (text !== ':') {
+                    sawVersionKey = false;
+                }
+            }
+        }
+        return false;
     }
     /**
      * Get the unquoted text of a block_mapping_pair's key.
@@ -805,6 +859,9 @@ export class TreeYaml extends TreeBase {
         }
         if (!errorNode)
             return null;
+        // Pre-scan ERROR children for a valid Version pair
+        if (!this.#errorNodeHasValidVersion(errorNode))
+            return null;
         // Scan ERROR children for a Statement-like structure: "Statement" + ":"
         let foundStatement = false;
         let lastKey = null;