timonel 2.14.0-beta.1 → 3.0.0

package/dist/lib/resources/cloud/aws/karpenterResources.js

@@ -15,8 +15,16 @@ export function isValidDisruptionBudget(budget) {
     return nodePattern.test(budget.nodes);
 }
 export function isValidKubernetesDuration(duration) {
-    const durationPattern = /^(\d+h)?(\d+m)?(\d+s)?$/;
-    return durationPattern.test(duration) && duration.length > 0;
+    try {
+        if (typeof duration !== 'string') {
+            return false;
+        }
+        const durationPattern = /^(\d+h)?(\d+m)?(\d+s)?$/;
+        return durationPattern.test(duration) && duration.length > 0;
+    }
+    catch {
+        return false;
+    }
 }
 export const DEFAULT_TERMINATION_GRACE_PERIOD = '30s';
 export class KarpenterResources extends BaseResourceProvider {
@@ -121,9 +129,15 @@ export class KarpenterResources extends BaseResourceProvider {
             nodePoolConfig['weight'] = spec.weight;
         }
         if (spec.labels) {
+            if (typeof spec.labels !== 'object' || Array.isArray(spec.labels)) {
+                throw new Error('Labels must be a valid object');
+            }
             nodePoolConfig['labels'] = spec.labels;
         }
         if (spec.annotations) {
+            if (typeof spec.annotations !== 'object' || Array.isArray(spec.annotations)) {
+                throw new Error('Annotations must be a valid object');
+            }
             nodePoolConfig['annotations'] = spec.annotations;
         }
         return this.addKarpenterNodePool(nodePoolConfig);

package/dist/lib/rutter.js

@@ -6,7 +6,7 @@ import { AWSResources } from './resources/cloud/aws/awsResources.js';
 import { createLogger } from './utils/logger.js';
 import { KarpenterResources } from './resources/cloud/aws/karpenterResources.js';
 import { isHelmExpression, isHelmConstruct } from './utils/helmControlStructures.js';
-import { dumpHelmAwareYaml } from './utils/helmYamlSerializer.js';
+import { dumpHelmAwareYaml, preprocessHelmConstructs } from './utils/helmYamlSerializer.js';
 import { generateHelpersTemplate } from './utils/helmHelpers.js';
 export class Rutter {
     constructor(props) {
@@ -77,11 +77,12 @@ export class Rutter {
             throw new Error('addManifest() requires either a YAML string or an object');
         }
         this.validateManifestStructure(manifestObject);
+        const preprocessedManifest = preprocessHelmConstructs(manifestObject);
         const apiObjectProps = {
-            apiVersion: manifestObject.apiVersion,
-            kind: manifestObject.kind,
-            metadata: manifestObject.metadata,
-            ...manifestObject,
+            apiVersion: preprocessedManifest.apiVersion,
+            kind: preprocessedManifest.kind,
+            metadata: preprocessedManifest.metadata,
+            ...preprocessedManifest,
         };
         return new ApiObject(this.chart, id, apiObjectProps);
     }
@@ -217,8 +218,9 @@ ${yamlContent.trim()}
             operation: 'manifest_processing',
         });
         const enriched = manifestObjs.map((obj) => {
-            if (obj && typeof obj === 'object') {
-                const o = obj;
+            const preprocessed = preprocessHelmConstructs(obj);
+            if (preprocessed && typeof preprocessed === 'object') {
+                const o = preprocessed;
                 o.metadata = o.metadata ?? {};
                 o.metadata.labels = o.metadata.labels ?? {};
                 const labels = o.metadata.labels;
@@ -236,7 +238,7 @@ ${yamlContent.trim()}
                     }
                 }
             }
-            return obj;
+            return preprocessed;
         });
         const synthAssets = [];
         if (this.props.singleManifestFile) {

package/dist/lib/security.js

@@ -84,7 +84,7 @@ export class SecurityUtils {
         }
         const sanitized = env.replace(/[^a-zA-Z0-9-_]/g, '');
         if (sanitized !== env) {
-            throw new Error(`Invalid environment name: ${this.sanitizeLogMessage(env)}`);
+            throw new Error(`Invalid environment name: ${SecurityUtils.sanitizeLogMessage(env)}`);
         }
         if (sanitized.length === 0 || sanitized.length > 63) {
             throw new Error('Environment name must be 1-63 characters long');
@@ -150,7 +150,7 @@ export class SecurityUtils {
         }
         const nameRegex = /^[A-Z_][A-Z0-9_]*$/;
         if (!nameRegex.test(sanitizedName)) {
-            throw new Error(`Invalid environment variable name: ${this.sanitizeLogMessage(name)}`);
+            throw new Error(`Invalid environment variable name: ${SecurityUtils.sanitizeLogMessage(name)}`);
         }
         const hasDangerousPattern = (val) => {
             if (val.includes('$(') && val.includes(')'))
@@ -173,7 +173,7 @@ export class SecurityUtils {
         };
         const dangerousPattern = hasDangerousPattern(value);
         if (dangerousPattern) {
-            throw new Error(`Environment variable value contains dangerous pattern (${dangerousPattern}): ${this.sanitizeLogMessage(value)}`);
+            throw new Error(`Environment variable value contains dangerous pattern (${dangerousPattern}): ${SecurityUtils.sanitizeLogMessage(value)}`);
         }
         if (value.length > 32768) {
             throw new Error('Environment variable value exceeds maximum length (32KB)');
@@ -194,7 +194,7 @@ export class SecurityUtils {
         }
         const tagRegex = /^[a-zA-Z0-9._-]+$/;
         if (!tagRegex.test(trimmedTag)) {
-            throw new Error(`Invalid image tag format: ${this.sanitizeLogMessage(trimmedTag)}`);
+            throw new Error(`Invalid image tag format: ${SecurityUtils.sanitizeLogMessage(trimmedTag)}`);
         }
         if (trimmedTag.length > 128) {
             throw new Error('Image tag exceeds maximum length (128 characters)');

package/dist/lib/templates/flexible-subchart.js

@@ -1,6 +1,7 @@
 import { writeFileSync, mkdirSync, existsSync } from 'fs';
 import { join } from 'path';
 import { Chart } from 'cdk8s';
+import { SecurityUtils } from '../security.js';
 import { dumpHelmAwareYaml } from '../utils/helmYamlSerializer.js';
 import { generateHelpersTemplate } from '../utils/helmHelpers.js';
 export class FlexibleSubchart extends Chart {
@@ -51,13 +52,19 @@ export class FlexibleSubchart extends Chart {
             version: this.config.version || '1.0.0',
             appVersion: this.config.version || '1.0.0',
         };
-        writeFileSync(join(outputDir, 'Chart.yaml'), dumpHelmAwareYaml(subchartYaml));
+        const chartYamlPath = SecurityUtils.validatePath(join(outputDir, 'Chart.yaml'), process.cwd(), {
+            allowAbsolute: true,
+        });
+        writeFileSync(chartYamlPath, dumpHelmAwareYaml(subchartYaml));
         const subchartValues = {
             enabled: true,
             ...Object.fromEntries(Object.entries(this.config).filter(([key, value]) => key !== 'chart' && typeof value !== 'function' && value !== null && value !== undefined)),
         };
-        writeFileSync(join(outputDir, 'values.yaml'), dumpHelmAwareYaml(subchartValues));
-        const templatesDir = join(outputDir, 'templates');
+        const valuesYamlPath = SecurityUtils.validatePath(join(outputDir, 'values.yaml'), process.cwd(), { allowAbsolute: true });
+        writeFileSync(valuesYamlPath, dumpHelmAwareYaml(subchartValues));
+        const templatesDir = SecurityUtils.validatePath(join(outputDir, 'templates'), process.cwd(), {
+            allowAbsolute: true,
+        });
         if (!existsSync(templatesDir)) {
             mkdirSync(templatesDir, { recursive: true });
         }
@@ -65,13 +72,15 @@ export class FlexibleSubchart extends Chart {
             includeKubernetes: true,
             includeSprig: true,
         });
-        writeFileSync(join(templatesDir, '_helpers.tpl'), helpersTpl);
+        const helpersTplPath = SecurityUtils.validatePath(join(templatesDir, '_helpers.tpl'), process.cwd(), { allowAbsolute: true });
+        writeFileSync(helpersTplPath, helpersTpl);
         this._manifests.forEach((item) => {
             if (item && typeof item === 'object' && 'manifest' in item && 'id' in item) {
                 const { manifest, id } = item;
                 if (manifest && typeof manifest === 'object') {
                     const templateContent = this._generateManifestTemplate(manifest, id);
-                    writeFileSync(join(templatesDir, `${id}.yaml`), templateContent);
+                    const manifestPath = SecurityUtils.validatePath(join(templatesDir, `${id}.yaml`), process.cwd(), { allowAbsolute: true });
+                    writeFileSync(manifestPath, templateContent);
                 }
             }
         });

package/dist/lib/templates/umbrella-chart.js

@@ -2,6 +2,7 @@ import { writeFileSync, mkdirSync, existsSync, copyFileSync, readdirSync, rmSync
 import { join } from 'path';
 import { parse } from 'yaml';
 import { App, Chart, ApiObject } from 'cdk8s';
+import { SecurityUtils } from '../security.js';
 import { dumpHelmAwareYaml } from '../utils/helmYamlSerializer.js';
 import { generateHelpersTemplate } from '../utils/helmHelpers.js';
 import { createFlexibleSubchart } from './flexible-subchart.js';
@@ -227,10 +228,12 @@ export class UmbrellaChartTemplate extends Chart {
             else if (subchart.chart && typeof subchart.chart === 'object') {
                 this._handleObjectChart(subchart, flexibleSubchart);
             }
-            console.log(`Added flexible subchart: ${subchart.name}`);
+            const sanitizedName = subchart.name.replace(/[\r\n]/g, '');
+            console.log(`Added flexible subchart: ${sanitizedName}`);
         }
         catch (_error) {
-            console.warn(`Failed to add subchart ${subchart.name}:`, _error);
+            const sanitizedName = subchart.name.replace(/[\r\n]/g, '');
+            console.warn(`Failed to add subchart ${sanitizedName}:`, _error);
             this._createFallbackSubchart(subchart, index);
         }
     }
@@ -249,7 +252,8 @@ export class UmbrellaChartTemplate extends Chart {
             version: subchart.version || '1.0.0',
             description: `${subchart.name} subchart (fallback)`,
         });
-        console.log(`Created fallback subchart: ${subchart.name}`);
+        const sanitizedName = subchart.name.replace(/[\r\n]/g, '');
+        console.log(`Created fallback subchart: ${sanitizedName}`);
     }
     _handleFunctionChart(subchart, index, flexibleSubchart) {
         try {
@@ -263,7 +267,8 @@ export class UmbrellaChartTemplate extends Chart {
             }
         }
         catch (error) {
-            console.log(`Failed to process subchart ${subchart.name}:`, error);
+            const sanitizedName = subchart.name.replace(/[\r\n]/g, '');
+            console.log(`Failed to process subchart ${sanitizedName}:`, error);
         }
     }
     _handleObjectChart(subchart, flexibleSubchart) {
@@ -338,7 +343,8 @@ export class UmbrellaChartTemplate extends Chart {
                 }
             }
             catch (error) {
-                console.log(`Failed to parse asset ${asset.id}:`, error);
+                const sanitizedId = asset.id.replace(/[\r\n]/g, '');
+                console.log(`Failed to parse asset ${sanitizedId}:`, error);
             }
         });
     }
@@ -375,7 +381,8 @@ export class UmbrellaChartTemplate extends Chart {
             includeSprig: true,
         });
         writeFileSync(join(templatesDir, '_helpers.tpl'), helpersTpl);
-        console.log(`Created basic Helm chart structure for subchart: ${subchartName}`);
+        const sanitizedName = subchartName.replace(/[\r\n]/g, '');
+        console.log(`Created basic Helm chart structure for subchart: ${sanitizedName}`);
     }
     writeHelmChart(outputDir) {
         if (!existsSync(outputDir)) {
@@ -412,7 +419,7 @@ export class UmbrellaChartTemplate extends Chart {
             mkdirSync(chartsDir, { recursive: true });
         }
         this.config.subcharts?.forEach((subchart) => {
-            const subchartDir = join(chartsDir, subchart.name);
+            const subchartDir = SecurityUtils.validatePath(join(chartsDir, subchart.name), process.cwd(), { allowAbsolute: true });
             if (!existsSync(subchartDir)) {
                 mkdirSync(subchartDir, { recursive: true });
             }
@@ -444,7 +451,8 @@ export class UmbrellaChartTemplate extends Chart {
                         }
                     }
                     catch (fallbackError) {
-                        console.warn(`Failed to create subchart ${subchart.name}:`, fallbackError);
+                        const sanitizedName = subchart.name.replace(/[\r\n]/g, '');
+                        console.warn(`Failed to create subchart ${sanitizedName}:`, fallbackError);
                         flexibleSubchart.writeHelmChart(subchartDir);
                     }
                 }
@@ -462,7 +470,9 @@ export class UmbrellaChartTemplate extends Chart {
                 flexibleSubchart.writeHelmChart(subchartDir);
             }
         });
-        const templatesDir = join(outputDir, 'templates');
+        const templatesDir = SecurityUtils.validatePath(join(outputDir, 'templates'), process.cwd(), {
+            allowAbsolute: true,
+        });
         if (!existsSync(templatesDir)) {
             mkdirSync(templatesDir, { recursive: true });
         }
@@ -479,7 +489,8 @@ export class UmbrellaChartTemplate extends Chart {
                 },
             },
         };
-        writeFileSync(join(templatesDir, 'namespace.yaml'), dumpHelmAwareYaml(namespaceYaml));
+        const namespaceYamlPath = SecurityUtils.validatePath(join(templatesDir, 'namespace.yaml'), process.cwd(), { allowAbsolute: true });
+        writeFileSync(namespaceYamlPath, dumpHelmAwareYaml(namespaceYaml));
         const helpersTpl = generateHelpersTemplate('aws', undefined, {
             includeKubernetes: true,
             includeSprig: true,

package/dist/lib/umbrellaRutter.js

@@ -27,19 +27,24 @@ export class UmbrellaRutter {
             allowAbsolute: true,
         });
         mkdirSync(validatedOutDir, { recursive: true });
-        mkdirSync(join(validatedOutDir, 'charts'), { recursive: true });
+        const chartsDir = SecurityUtils.validatePath(join(validatedOutDir, 'charts'), process.cwd(), {
+            allowAbsolute: true,
+        });
+        mkdirSync(chartsDir, { recursive: true });
         for (const subchart of this.props.subcharts) {
             if (!SecurityUtils.isValidSubchartName(subchart.name)) {
                 throw new Error(`Invalid subchart name: ${SecurityUtils.sanitizeLogMessage(subchart.name)}`);
             }
             const sanitizedName = subchart.name;
-            const subchartDir = join(validatedOutDir, 'charts', sanitizedName);
+            const subchartDir = SecurityUtils.validatePath(join(validatedOutDir, 'charts', sanitizedName), process.cwd(), { allowAbsolute: true });
             subchart.rutter.write(subchartDir);
         }
         this.writeParentChart(validatedOutDir);
         this.writeParentValues(validatedOutDir);
-        mkdirSync(join(validatedOutDir, 'templates'), { recursive: true });
-        writeFileSync(join(validatedOutDir, 'templates', 'NOTES.txt'), this.generateNotesTemplate());
+        const templatesDir = SecurityUtils.validatePath(join(validatedOutDir, 'templates'), process.cwd(), { allowAbsolute: true });
+        mkdirSync(templatesDir, { recursive: true });
+        const notesPath = SecurityUtils.validatePath(join(validatedOutDir, 'templates', 'NOTES.txt'), process.cwd(), { allowAbsolute: true });
+        writeFileSync(notesPath, this.generateNotesTemplate());
     }
     writeParentChart(outDir) {
         const chartYaml = {
@@ -63,7 +68,10 @@ export class UmbrellaRutter {
                 };
             }),
         };
-        writeFileSync(join(outDir, 'Chart.yaml'), dumpHelmAwareYaml(chartYaml));
+        const chartYamlPath = SecurityUtils.validatePath(join(outDir, 'Chart.yaml'), process.cwd(), {
+            allowAbsolute: true,
+        });
+        writeFileSync(chartYamlPath, dumpHelmAwareYaml(chartYaml));
     }
     writeParentValues(outDir) {
         const values = {
@@ -77,12 +85,16 @@ export class UmbrellaRutter {
                 };
             }
         }
-        writeFileSync(join(outDir, 'values.yaml'), dumpHelmAwareYaml(values));
+        const valuesYamlPath = SecurityUtils.validatePath(join(outDir, 'values.yaml'), process.cwd(), {
+            allowAbsolute: true,
+        });
+        writeFileSync(valuesYamlPath, dumpHelmAwareYaml(values));
         if (this.props.envValues) {
             for (const [env, envVals] of Object.entries(this.props.envValues)) {
                 const sanitizedEnv = SecurityUtils.sanitizeEnvironmentName(env);
                 const envValues = this.deepMerge(values, envVals);
-                writeFileSync(join(outDir, `values-${sanitizedEnv}.yaml`), dumpHelmAwareYaml(envValues));
+                const envValuesPath = SecurityUtils.validatePath(join(outDir, `values-${sanitizedEnv}.yaml`), process.cwd(), { allowAbsolute: true });
+                writeFileSync(envValuesPath, dumpHelmAwareYaml(envValues));
             }
         }
     }

package/dist/lib/utils/envVarsLoader.d.ts

@@ -0,0 +1,19 @@
+export interface EnvVarConfig {
+    name: string;
+    type: 'value' | 'secret';
+    scope?: string;
+    defaultValue?: string;
+    secretName?: string;
+}
+export interface LoadEnvVarsOptions {
+    configPath?: string;
+    defaultScope?: string;
+    fallbackConfig?: EnvVarConfig[];
+}
+export declare function loadEnvVarsConfig(options?: LoadEnvVarsOptions): EnvVarConfig[];
+export declare function generateEnvVars(config: EnvVarConfig[], options?: {
+    defaultScope?: string;
+}): Array<Record<string, unknown>>;
+export declare function loadAndGenerateEnvVars(options?: LoadEnvVarsOptions & {
+    defaultScope?: string;
+}): Array<Record<string, unknown>>;

package/dist/lib/utils/envVarsLoader.js

@@ -0,0 +1,63 @@
+import { readFileSync, existsSync } from 'fs';
+import { join } from 'path';
+import { parse as parseYaml } from 'yaml';
+import { SecurityUtils } from '../security.js';
+import { createHelmExpression } from './helmControlStructures.js';
+export function loadEnvVarsConfig(options = {}) {
+    const { configPath, fallbackConfig = [] } = options;
+    try {
+        if (configPath) {
+            const validatedConfigPath = SecurityUtils.validatePath(configPath, process.cwd(), {
+                allowAbsolute: true,
+            });
+            if (existsSync(validatedConfigPath)) {
+                const data = readFileSync(validatedConfigPath, 'utf-8');
+                return validatedConfigPath.endsWith('.yaml') || validatedConfigPath.endsWith('.yml')
+                    ? parseYaml(data)
+                    : JSON.parse(data);
+            }
+        }
+        const yamlPath = SecurityUtils.validatePath(join(process.cwd(), 'env-config.yaml'), process.cwd(), { allowAbsolute: true });
+        if (existsSync(yamlPath)) {
+            const data = readFileSync(yamlPath, 'utf-8');
+            return parseYaml(data);
+        }
+        const jsonPath = SecurityUtils.validatePath(join(process.cwd(), 'env-config.json'), process.cwd(), { allowAbsolute: true });
+        if (existsSync(jsonPath)) {
+            const data = readFileSync(jsonPath, 'utf-8');
+            return JSON.parse(data);
+        }
+    }
+    catch {
+    }
+    return fallbackConfig;
+}
+export function generateEnvVars(config, options = {}) {
+    const { defaultScope = 'global.env' } = options;
+    return config.map((item) => {
+        const scope = item.scope || defaultScope;
+        if (item.type === 'value') {
+            return {
+                name: item.name,
+                value: createHelmExpression(`{{ .Values.${scope}.${item.name} | default "${item.defaultValue || ''}" }}`),
+            };
+        }
+        else {
+            return {
+                name: item.name,
+                valueFrom: {
+                    secretKeyRef: {
+                        name: item.secretName || createHelmExpression('{{ .Values.secretName }}'),
+                        key: item.name,
+                        optional: true,
+                    },
+                },
+            };
+        }
+    });
+}
+export function loadAndGenerateEnvVars(options = {}) {
+    const config = loadEnvVarsConfig(options);
+    const genOptions = options.defaultScope ? { defaultScope: options.defaultScope } : {};
+    return generateEnvVars(config, genOptions);
+}

package/dist/lib/utils/helmControlStructures.d.ts

@@ -1,11 +1,8 @@
 export interface HelmConstruct {
     __helmConstruct: true;
-    type: 'if' | 'range' | 'with' | 'include' | 'define' | 'var' | 'block' | 'comment' | 'fragment';
+    type: 'if' | 'range' | 'with' | 'include' | 'define' | 'var' | 'block' | 'comment' | 'fragment' | 'fieldConditional';
     data: unknown;
-    options?: {
-        trimLeft?: boolean;
-        trimRight?: boolean;
-    };
+    options?: HelmWhitespaceOptions;
 }
 export declare function helmFragment(...contents: HelmContent[]): HelmConstruct;
 export interface HelmExpression {
@@ -29,6 +26,8 @@ export type HelmContent = string | number | boolean | null | undefined | HelmCon
 export interface HelmWhitespaceOptions {
     trimLeft?: boolean;
     trimRight?: boolean;
+    inline?: boolean;
 }
 export declare function helmIf(condition: string, thenContent: HelmContent, elseContent?: HelmContent, options?: HelmWhitespaceOptions): HelmConstruct;
+export declare function helmIfSimple(condition: string, thenContent: HelmContent, options?: HelmWhitespaceOptions): HelmConstruct;
 export declare function isHelmConstruct(value: unknown): value is HelmConstruct;

package/dist/lib/utils/helmControlStructures.js

@@ -104,6 +104,18 @@ export function helmIf(condition, thenContent, elseContent, options) {
         ...(options ? { options } : {}),
     };
 }
+export function helmIfSimple(condition, thenContent, options) {
+    return {
+        __helmConstruct: true,
+        type: 'if',
+        data: {
+            condition,
+            then: thenContent,
+            else: undefined,
+        },
+        ...(options ? { options } : {}),
+    };
+}
 export function isHelmConstruct(value) {
     return (typeof value === 'object' &&
         value !== null &&

package/dist/lib/utils/helmHelpers.js

@@ -261,12 +261,20 @@ export const AWS_HELPERS = [
 ];
 export function formatHelpers(helpers) {
     return helpers
-        .map((helper) => `{{/*
+        .map((helper) => {
+        if (!helper.name || typeof helper.name !== 'string') {
+            throw new Error('Helper must have a valid name property');
+        }
+        if (!helper.template || typeof helper.template !== 'string') {
+            throw new Error(`Helper '${helper.name}' must have a valid template property`);
+        }
+        return `{{/*
 ${helper.name}
 */}}
 {{- define "${helper.name}" -}}
 ${helper.template}
-{{- end }}`)
+{{- end }}`;
+    })
         .join('\n\n');
 }
 export function getDefaultHelpers(cloudProvider, options) {

package/dist/lib/utils/helmYamlSerializer.d.ts

@@ -1,6 +1,8 @@
+export declare function preprocessHelmConstructs(obj: unknown): unknown;
 export declare function dumpHelmAwareYaml(obj: unknown, options?: {
     lineWidth?: number;
 }): string;
+export declare function postProcessFieldConditionals(yaml: string): string;
 export declare function stringify(obj: unknown, options?: {
     lineWidth?: number;
     doubleQuotedAsJSON?: boolean;