aws-iam-language-server 0.0.9 → 0.0.11

package/src/handlers/diagnostics/base.js

@@ -0,0 +1,21 @@
+import { createDiagnostic } from "./utils.js";
+export class ElementValidator {
+    #validated;
+    constructor() {
+        this.#validated = false;
+    }
+    validate(entry) {
+        const diagnostics = [];
+        if (this.#validated) {
+            diagnostics.push(createDiagnostic('duplicate statement key', entry.keyRange));
+        }
+        this.#validated = true;
+        return diagnostics;
+    }
+    isValidated() {
+        return this.#validated;
+    }
+    resetForStatement() {
+        this.#validated = false;
+    }
+}

package/src/handlers/diagnostics/condition.d.ts

@@ -0,0 +1,6 @@
+import type { Diagnostic } from 'vscode-languageclient';
+import type { StatementEntry } from '../../lib/treesitter/base.ts';
+import { ElementValidator } from './base.ts';
+export declare class ConditionValidator extends ElementValidator {
+    validate(entry: StatementEntry): Array<Diagnostic>;
+}

package/src/handlers/diagnostics/condition.js

@@ -0,0 +1,7 @@
+import { ElementValidator } from "./base.js";
+export class ConditionValidator extends ElementValidator {
+    validate(entry) {
+        const diagnostics = super.validate(entry);
+        return diagnostics;
+    }
+}

package/src/handlers/diagnostics/diagnostics.d.ts

@@ -0,0 +1,4 @@
+import type { Connection } from 'vscode-languageserver';
+import type { TextDocument } from 'vscode-languageserver-textdocument';
+import type { TreeManager } from '../../lib/treesitter/manager.ts';
+export declare function diagnosticsHandler(document: TextDocument, treeManager: TreeManager, connection: Connection): Promise<void>;

package/src/handlers/diagnostics/diagnostics.js

@@ -0,0 +1,121 @@
+import { ActionValidator } from "./action.js";
+import { ConditionValidator } from "./condition.js";
+import { EffectValidator } from "./effect.js";
+import { PrincipalValidator } from "./principal.js";
+import { ResourceValidator } from "./resource.js";
+import { SidValidator } from "./sid.js";
+import { createDiagnostic } from "./utils.js";
+export async function diagnosticsHandler(document, treeManager, connection) {
+    const handler = treeManager.getLanguageHandler(document.uri);
+    if (!handler)
+        return;
+    let diagnostics = [];
+    const policyDocuments = handler.getAllPolicyDocuments(document.uri);
+    for (const policyDocument of policyDocuments) {
+        if (policyDocument.policyFormat === 'standard') {
+            diagnostics = diagnostics.concat(await handleStandardDiagnostics(policyDocument));
+        }
+        else if (policyDocument.policyFormat === 'hcl-block') {
+            diagnostics = diagnostics.concat(await handleHclBlockDiagnostics(policyDocument));
+        }
+    }
+    connection.console.log(`Publishing diagnostics for uri: ${document.uri}: ${policyDocuments.length} policy documents, ${diagnostics.length} diagnostics`);
+    await connection.sendDiagnostics({
+        uri: document.uri,
+        diagnostics,
+    });
+}
+async function handleStandardDiagnostics(policyDocument) {
+    let diagnostics = [];
+    const sidValidator = new SidValidator();
+    const effectValidator = new EffectValidator();
+    const principalValidator = new PrincipalValidator();
+    const actionValidator = new ActionValidator();
+    const resourceValidator = new ResourceValidator();
+    const conditionValidator = new ConditionValidator();
+    for (const statement of policyDocument.statements) {
+        for (const entry of statement.entries) {
+            if (entry.key === 'Sid') {
+                diagnostics = diagnostics.concat(sidValidator.validate(entry));
+            }
+            else if (entry.key === 'Effect') {
+                diagnostics = diagnostics.concat(effectValidator.validate(entry));
+            }
+            else if (entry.key === 'Principal' || entry.key === 'NotPrincipal') {
+                diagnostics = diagnostics.concat(principalValidator.validate(entry));
+            }
+            else if (entry.key === 'Action' || entry.key === 'NotAction') {
+                diagnostics = diagnostics.concat(actionValidator.validate(entry));
+            }
+            else if (entry.key === 'Resource' || entry.key === 'NotResource') {
+                diagnostics = diagnostics.concat(resourceValidator.validate(entry));
+            }
+            else if (entry.key === 'Condition') {
+                diagnostics = diagnostics.concat(conditionValidator.validate(entry));
+            }
+            else {
+                diagnostics.push(createDiagnostic(`Unrecognized entry "${entry.key}" in statement`, entry.keyRange));
+            }
+        }
+        if (!effectValidator.isValidated()) {
+            diagnostics.push(createDiagnostic(`Missing required "Effect" entry in statement`, statement.range));
+        }
+        if (!actionValidator.isValidated()) {
+            diagnostics.push(createDiagnostic(`Missing required "Action" or "NotAction" entry in statement`, statement.range));
+        }
+        if (!resourceValidator.isValidated() && !principalValidator.isValidated()) {
+            diagnostics.push(createDiagnostic(`Missing required "Resource"/"NotResource" or "Principal"/"NotPrincipal" entry in statement`, statement.range));
+        }
+        [sidValidator, effectValidator, principalValidator, actionValidator, resourceValidator, conditionValidator].forEach((x) => {
+            x.resetForStatement();
+        });
+    }
+    return diagnostics;
+}
+async function handleHclBlockDiagnostics(policyDocument) {
+    let diagnostics = [];
+    const sidValidator = new SidValidator();
+    const effectValidator = new EffectValidator();
+    const principalValidator = new PrincipalValidator();
+    const actionValidator = new ActionValidator();
+    const resourceValidator = new ResourceValidator();
+    const conditionValidator = new ConditionValidator();
+    for (const statement of policyDocument.statements) {
+        for (const entry of statement.entries) {
+            if (entry.key === 'sid') {
+                diagnostics = diagnostics.concat(sidValidator.validate(entry));
+            }
+            else if (entry.key === 'effect') {
+                diagnostics = diagnostics.concat(effectValidator.validate(entry));
+            }
+            else if (entry.key === 'principals' || entry.key === 'not_principals') {
+                diagnostics = diagnostics.concat(principalValidator.validate(entry));
+            }
+            else if (entry.key === 'actions' || entry.key === 'not_actions') {
+                diagnostics = diagnostics.concat(actionValidator.validate(entry));
+            }
+            else if (entry.key === 'resources' || entry.key === 'not_resources') {
+                diagnostics = diagnostics.concat(resourceValidator.validate(entry));
+            }
+            else if (entry.key === 'condition') {
+                diagnostics = diagnostics.concat(conditionValidator.validate(entry));
+            }
+            else {
+                diagnostics.push(createDiagnostic(`Unrecognized entry "${entry.key}" in statement`, entry.keyRange));
+            }
+        }
+        if (!effectValidator.isValidated()) {
+            diagnostics.push(createDiagnostic(`Missing required "effect" entry in statement`, statement.range));
+        }
+        if (!actionValidator.isValidated()) {
+            diagnostics.push(createDiagnostic(`Missing required "actions" or "not_actions" entry in statement`, statement.range));
+        }
+        if (!resourceValidator.isValidated() && !principalValidator.isValidated()) {
+            diagnostics.push(createDiagnostic(`Missing required "resources"/"not_resources" or "principals"/"not_principals" entry in statement`, statement.range));
+        }
+        [sidValidator, effectValidator, principalValidator, actionValidator, resourceValidator, conditionValidator].forEach((x) => {
+            x.resetForStatement();
+        });
+    }
+    return diagnostics;
+}

package/src/handlers/diagnostics/effect.d.ts

@@ -0,0 +1,6 @@
+import type { Diagnostic } from 'vscode-languageclient';
+import type { StatementEntry } from '../../lib/treesitter/base.ts';
+import { ElementValidator } from './base.ts';
+export declare class EffectValidator extends ElementValidator {
+    validate(entry: StatementEntry): Array<Diagnostic>;
+}

package/src/handlers/diagnostics/effect.js

@@ -0,0 +1,12 @@
+import { ElementValidator } from "./base.js";
+import { createDiagnostic } from "./utils.js";
+export class EffectValidator extends ElementValidator {
+    validate(entry) {
+        const diagnostics = super.validate(entry);
+        const value = entry.values[0]?.text;
+        if (value !== 'Allow' && value !== 'Deny') {
+            diagnostics.push(createDiagnostic(`effect value must be either "Allow" or "Deny"`, entry.valueRange));
+        }
+        return diagnostics;
+    }
+}

package/src/handlers/diagnostics/principal.d.ts

@@ -0,0 +1,6 @@
+import type { Diagnostic } from 'vscode-languageclient';
+import type { StatementEntry } from '../../lib/treesitter/base.ts';
+import { ElementValidator } from './base.ts';
+export declare class PrincipalValidator extends ElementValidator {
+    validate(entry: StatementEntry): Array<Diagnostic>;
+}

package/src/handlers/diagnostics/principal.js

@@ -0,0 +1,7 @@
+import { ElementValidator } from "./base.js";
+export class PrincipalValidator extends ElementValidator {
+    validate(entry) {
+        const diagnostics = super.validate(entry);
+        return diagnostics;
+    }
+}

package/src/handlers/diagnostics/resource.d.ts

@@ -0,0 +1,6 @@
+import type { Diagnostic } from 'vscode-languageclient';
+import type { StatementEntry } from '../../lib/treesitter/base.ts';
+import { ElementValidator } from './base.ts';
+export declare class ResourceValidator extends ElementValidator {
+    validate(entry: StatementEntry): Array<Diagnostic>;
+}

package/src/handlers/diagnostics/resource.js

@@ -0,0 +1,7 @@
+import { ElementValidator } from "./base.js";
+export class ResourceValidator extends ElementValidator {
+    validate(entry) {
+        const diagnostics = super.validate(entry);
+        return diagnostics;
+    }
+}

package/src/handlers/diagnostics/sid.d.ts

@@ -0,0 +1,8 @@
+import type { Diagnostic } from 'vscode-languageclient';
+import type { StatementEntry } from '../../lib/treesitter/base.ts';
+import { ElementValidator } from './base.ts';
+export declare class SidValidator extends ElementValidator {
+    #private;
+    constructor();
+    validate(entry: StatementEntry): Array<Diagnostic>;
+}

package/src/handlers/diagnostics/sid.js

@@ -0,0 +1,21 @@
+import { ElementValidator } from "./base.js";
+import { createDiagnostic } from "./utils.js";
+export class SidValidator extends ElementValidator {
+    #sids = {};
+    constructor() {
+        super();
+        this.#sids = {};
+    }
+    validate(entry) {
+        const diagnostics = super.validate(entry);
+        const sidValue = entry.values[0]?.text;
+        if (!sidValue)
+            return [];
+        if (sidValue in this.#sids) {
+            diagnostics.push(createDiagnostic(`Duplicate statement id value "${sidValue}"`, entry.valueRange));
+            diagnostics.push(createDiagnostic(`Duplicate statement id value "${sidValue}"`, this.#sids[sidValue].valueRange));
+        }
+        this.#sids[sidValue] = entry;
+        return diagnostics;
+    }
+}

package/src/handlers/diagnostics/utils.d.ts

@@ -0,0 +1,3 @@
+import type { Diagnostic } from 'vscode-languageclient';
+import type { Range } from '../../lib/treesitter/base.ts';
+export declare function createDiagnostic(message: string, range: Range): Diagnostic;

package/src/handlers/diagnostics/utils.js

@@ -0,0 +1,19 @@
+export function createDiagnostic(message, range) {
+    return {
+        source: 'aws-iam-language-server',
+        message,
+        range: convertRangeToDiagnosticRange(range),
+    };
+}
+function convertRangeToDiagnosticRange(range) {
+    return {
+        start: {
+            character: range.start.column,
+            line: range.start.line,
+        },
+        end: {
+            character: range.end.column,
+            line: range.end.line,
+        },
+    };
+}

package/src/handlers/document-link/document-link.d.ts

@@ -1,4 +1,4 @@
-import type { DocumentLink, DocumentLinkParams, TextDocuments } from 'vscode-languageserver';
+import type { Connection, DocumentLink, DocumentLinkParams, TextDocuments } from 'vscode-languageserver';
 import type { TextDocument } from 'vscode-languageserver-textdocument';
 import type { TreeManager } from '../../lib/treesitter/manager.ts';
-export declare function documentLinkHandler(params: DocumentLinkParams, documents: TextDocuments<TextDocument>, _treeManager: TreeManager): DocumentLink[];
+export declare function documentLinkHandler(params: DocumentLinkParams, documents: TextDocuments<TextDocument>, treeManager: TreeManager, connection: Connection): DocumentLink[];

package/src/handlers/document-link/document-link.js

@@ -1,36 +1,47 @@
 import { ServiceReference } from "../../lib/iam-policy/reference/services.js";
-export function documentLinkHandler(params, documents, _treeManager) {
+export function documentLinkHandler(params, documents, treeManager, connection) {
     const document = documents.get(params.textDocument.uri);
     if (!document)
         return [];
-    const text = document.getText();
+    const handler = treeManager.getLanguageHandler(params.textDocument.uri);
+    if (!handler)
+        return [];
+    const policyDocuments = handler.getAllPolicyDocuments(params.textDocument.uri);
     const links = [];
-    const actionSet = new Set(ServiceReference.getAllActions().map((a) => a.toLowerCase()));
-    const pattern = /[a-z0-9-]+:[A-Za-z0-9*?]+/g;
-    for (const match of text.matchAll(pattern)) {
-        if (!actionSet.has(match[0].toLowerCase()))
-            continue;
-        const [serviceName, actionName] = match[0].split(':');
-        const action = ServiceReference.getAction(serviceName, actionName);
-        if (!action)
-            continue;
-        const index = match.index ?? 0;
-        const start = document.positionAt(index);
-        const end = document.positionAt(index + match[0].length);
-        if (action.iamUrl) {
-            links.push({
-                range: { start, end },
-                target: action.iamUrl,
-                tooltip: 'IAM Actions, Conditions, and Context Keys',
-            });
-        }
-        if (action.operationUrl) {
-            links.push({
-                range: { start, end },
-                target: action.operationUrl,
-                tooltip: 'API Operation Documentation',
-            });
+    for (const policyDoc of policyDocuments) {
+        const actionKeys = policyDoc.policyFormat === 'hcl-block' ? new Set(['actions', 'not_actions']) : new Set(['Action', 'NotAction']);
+        for (const statement of policyDoc.statements) {
+            for (const entry of statement.entries) {
+                if (!actionKeys.has(entry.key))
+                    continue;
+                for (const value of entry.values) {
+                    const colonIndex = value.text.indexOf(':');
+                    if (colonIndex === -1)
+                        continue;
+                    const action = ServiceReference.getAction(value.text);
+                    if (!action)
+                        continue;
+                    const start = { line: value.range.start.line, character: value.range.start.column };
+                    const end = { line: value.range.end.line, character: value.range.end.column };
+                    const range = { start, end };
+                    if (action.iamUrl) {
+                        links.push({
+                            range,
+                            target: action.iamUrl,
+                            tooltip: 'IAM Actions, Conditions, and Context Keys',
+                        });
+                    }
+                    if (action.operationUrl) {
+                        links.push({
+                            range,
+                            target: action.operationUrl,
+                            tooltip: 'API Operation Documentation',
+                        });
+                    }
+                }
+            }
         }
     }
+    connection.console.debug(`Found ${links.length} document links in ${params.textDocument.uri}`);
     return links;
 }

package/src/lib/iam-policy/reference/services.d.ts

@@ -5,13 +5,13 @@ export declare class ServiceReference {
     static getServicePrincipals(): string[];
     static getAllActions(): Array<string>;
     static getAllServices(): Array<string>;
-    static getActionsForService(service: string): Array<string>;
+    static getActionsForService(service: string): Array<Action>;
     static getConditionKeysForActions(actions: string[]): Array<{
         name: string;
         types: string[];
     }>;
     static getGlobalConditionKeys(): Array<GlobalConditionKey>;
-    static getAction(service: string, actionName: string): Action | undefined;
+    static getAction(action: string): Action | undefined;
     static getConditionKey(service: string, keyName: string): ConditionKey | undefined;
     static getResourcesForActions(actions: string[]): Map<string, {
         service: string;

package/src/lib/iam-policy/reference/services.js

@@ -30,7 +30,11 @@ export class ServiceReference {
         return ServiceReference.#allServices;
     }
     static getActionsForService(service) {
-        return Object.keys(ServiceReference.getServiceData(service).actions);
+        return Object.entries(ServiceReference.getServiceData(service).actions).map(([actionName, action]) => {
+            if (!action.name)
+                action.name = `${service}:${actionName}`;
+            return action;
+        });
     }
     static getConditionKeysForActions(actions) {
         const keys = new Map();
@@ -56,9 +60,11 @@ export class ServiceReference {
         }
         return ServiceReference.#globalConditionKeys;
     }
-    static getAction(service, actionName) {
+    static getAction(action) {
         try {
-            return ServiceReference.getServiceData(service).actions[actionName];
+            const serviceName = action.split(':')[0];
+            const actionName = action.split(':')[1];
+            return ServiceReference.getServiceData(serviceName).actions[actionName];
         }
         catch {
             return undefined;

package/src/lib/iam-policy/reference/types.d.ts

@@ -53,6 +53,8 @@ export type ServiceData = {
     conditionKeys: Record<string, ConditionKey>;
 };
 export type Action = {
+    name: string;
+    service: string;
     conditionKeys: Array<string>;
     resources: Array<{
         name: string;

package/src/lib/treesitter/base.d.ts

@@ -1,8 +1,33 @@
-import type { Language, Tree } from 'web-tree-sitter';
+import type { Language, Node, Tree } from 'web-tree-sitter';
 export type Position = {
     line: number;
     column: number;
 };
+export type Range = {
+    start: Position;
+    end: Position;
+};
+export type StatementValue = {
+    text: string;
+    range: Range;
+};
+export type StatementEntry = {
+    key: string;
+    keyRange: Range;
+    values: StatementValue[];
+    valueRange: Range;
+    children?: StatementEntry[];
+};
+export type StatementNode = {
+    range: Range;
+    entries: StatementEntry[];
+};
+export type PolicyDocumentNode = {
+    range: Range;
+    policyFormat: PolicyFormat;
+    statements: StatementNode[];
+};
+export declare function nodeRange(node: Node): Range;
 export type PolicyFormat = 'standard' | 'hcl-block';
 export type CursorContext = {
     keys: string[];
@@ -29,8 +54,9 @@ export declare class TreeBase {
     openDocument(uri: string, content: string): void;
     updateDocument(uri: string, content: string): void;
     closeDocument(uri: string): void;
-    getNodeAtPosition(uri: string, position: Position): import("web-tree-sitter").Node | null;
+    getNodeAtPosition(uri: string, position: Position): Node | null;
     getCursorContext(_uri: string, _position: Position): CursorContext | null;
     getStatementContext(_uri: string, _position: Position): StatementContext | null;
     getSiblingKeys(_uri: string, _position: Position): string[];
+    getAllPolicyDocuments(_uri: string): PolicyDocumentNode[];
 }

package/src/lib/treesitter/base.js

@@ -1,5 +1,11 @@
 import { Parser } from 'web-tree-sitter';
 await Parser.init();
+export function nodeRange(node) {
+    return {
+        start: { line: node.startPosition.row, column: node.startPosition.column },
+        end: { line: node.endPosition.row, column: node.endPosition.column },
+    };
+}
 export class TreeBase {
     #trees = new Map();
     #parser;
@@ -47,4 +53,7 @@ export class TreeBase {
     getSiblingKeys(_uri, _position) {
         throw new Error('getSiblingKeys must be implemented by a subclass');
     }
+    getAllPolicyDocuments(_uri) {
+        throw new Error('getAllPolicyDocuments must be implemented by a subclass');
+    }
 }

package/src/lib/treesitter/hcl.d.ts

@@ -1,4 +1,4 @@
-import type { CursorContext, Position, StatementContext } from './base.ts';
+import type { CursorContext, PolicyDocumentNode, Position, StatementContext } from './base.ts';
 import { TreeBase } from './base.ts';
 export declare class TreeHcl extends TreeBase {
     #private;
@@ -6,4 +6,5 @@ export declare class TreeHcl extends TreeBase {
     getCursorContext(uri: string, position: Position): CursorContext | null;
     getStatementContext(uri: string, position: Position): StatementContext | null;
     getSiblingKeys(uri: string, position: Position): string[];
+    getAllPolicyDocuments(uri: string): PolicyDocumentNode[];
 }