timonel 3.0.0-beta.1 → 3.1.0-beta.1

package/dist/lib/policy/resultFormatter.js

@@ -0,0 +1,217 @@
+import { sortViolationsBySeverity } from './resultAggregator.js';
+export class DefaultResultFormatter {
+    format(result) {
+        const lines = [];
+        lines.push('='.repeat(60));
+        lines.push('Policy Validation Results');
+        lines.push('='.repeat(60));
+        const status = result.valid ? '✅ PASSED' : '❌ FAILED';
+        lines.push(`Status: ${status}`);
+        lines.push('');
+        if (result.summary) {
+            lines.push('Summary:');
+            lines.push(`  Errors:   ${result.summary.violationsBySeverity.error}`);
+            lines.push(`  Warnings: ${result.summary.violationsBySeverity.warning}`);
+            lines.push(`  Info:     ${result.summary.violationsBySeverity.info}`);
+            lines.push('');
+        }
+        lines.push('Execution Details:');
+        lines.push(`  Plugins:   ${result.metadata.pluginCount}`);
+        lines.push(`  Manifests: ${result.metadata.manifestCount}`);
+        lines.push(`  Duration:  ${result.metadata.executionTime}ms`);
+        lines.push('');
+        if (result.violations.length > 0) {
+            lines.push('Violations:');
+            lines.push('-'.repeat(40));
+            const sortedViolations = sortViolationsBySeverity(result.violations);
+            for (const violation of sortedViolations) {
+                lines.push(this.formatViolation(violation));
+                lines.push('');
+            }
+        }
+        if (result.warnings.length > 0) {
+            lines.push('Warnings:');
+            lines.push('-'.repeat(40));
+            const sortedWarnings = sortViolationsBySeverity(result.warnings);
+            for (const warning of sortedWarnings) {
+                lines.push(this.formatViolation(warning));
+                lines.push('');
+            }
+        }
+        if (result.violations.length === 0 && result.warnings.length === 0) {
+            lines.push('✨ No policy violations found!');
+            lines.push('');
+        }
+        return lines.join('\n');
+    }
+    formatViolation(violation) {
+        const lines = [];
+        const severityIcon = this.getSeverityIcon(violation.severity);
+        lines.push(`${severityIcon} [${violation.plugin}] ${violation.message}`);
+        if (violation.resourcePath) {
+            lines.push(`   Resource: ${violation.resourcePath}`);
+        }
+        if (violation.field) {
+            lines.push(`   Field: ${violation.field}`);
+        }
+        if (violation.suggestion) {
+            lines.push(`   💡 Suggestion: ${violation.suggestion}`);
+        }
+        return lines.join('\n');
+    }
+    getSeverityIcon(severity) {
+        switch (severity) {
+            case 'error':
+                return '🚨';
+            case 'warning':
+                return '⚠️';
+            case 'info':
+                return 'ℹ️';
+            default:
+                return '•';
+        }
+    }
+}
+export class JsonResultFormatter {
+    constructor(indent = 2) {
+        this.indent = indent;
+    }
+    format(result) {
+        return JSON.stringify(result, null, this.indent);
+    }
+}
+export class CompactResultFormatter {
+    format(result) {
+        const status = result.valid ? 'PASS' : 'FAIL';
+        const errorCount = result.violations.filter((v) => v.severity === 'error').length;
+        const warningCount = [...result.violations, ...result.warnings].filter((v) => v.severity === 'warning' || v.severity === 'info').length;
+        let output = `Policy validation: ${status}`;
+        if (errorCount > 0 || warningCount > 0) {
+            output += ` (${errorCount} errors, ${warningCount} warnings)`;
+        }
+        output += ` - ${result.metadata.executionTime}ms`;
+        if (!result.valid && result.violations.length > 0) {
+            output += '\n';
+            const firstViolations = result.violations.slice(0, 3);
+            for (const violation of firstViolations) {
+                output += `\n  • [${violation.plugin}] ${violation.message}`;
+            }
+            if (result.violations.length > 3) {
+                output += `\n  ... and ${result.violations.length - 3} more`;
+            }
+        }
+        return output;
+    }
+}
+export class GitHubActionsResultFormatter {
+    format(result) {
+        const lines = [];
+        const status = result.valid ? 'success' : 'failure';
+        lines.push(`::notice title=Policy Validation::Status: ${status}`);
+        for (const violation of result.violations) {
+            const level = violation.severity === 'error' ? 'error' : 'warning';
+            const file = violation.resourcePath || 'unknown';
+            const message = `[${violation.plugin}] ${violation.message}`;
+            lines.push(`::${level} file=${file}::${message}`);
+        }
+        for (const warning of result.warnings) {
+            const level = warning.severity === 'info' ? 'notice' : 'warning';
+            const file = warning.resourcePath || 'unknown';
+            const message = `[${warning.plugin}] ${warning.message}`;
+            lines.push(`::${level} file=${file}::${message}`);
+        }
+        return lines.join('\n');
+    }
+}
+export class SarifResultFormatter {
+    format(result) {
+        const runs = [
+            {
+                tool: {
+                    driver: {
+                        name: 'Timonel Policy Engine',
+                        version: '3.0.0',
+                        informationUri: 'https://github.com/your-org/timonel',
+                    },
+                },
+                results: this.convertViolationsToSarifResults([...result.violations, ...result.warnings]),
+            },
+        ];
+        const sarif = {
+            version: '2.1.0',
+            $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
+            runs,
+        };
+        return JSON.stringify(sarif, null, 2);
+    }
+    convertViolationsToSarifResults(violations) {
+        return violations.map((violation) => ({
+            ruleId: `${violation.plugin}/${this.generateRuleId(violation.message)}`,
+            level: this.mapSeverityToSarifLevel(violation.severity),
+            message: {
+                text: violation.message,
+            },
+            locations: violation.resourcePath
+                ? [
+                    {
+                        physicalLocation: {
+                            artifactLocation: {
+                                uri: violation.resourcePath,
+                            },
+                            region: violation.field
+                                ? {
+                                    startLine: 1,
+                                    startColumn: 1,
+                                }
+                                : undefined,
+                        },
+                    },
+                ]
+                : [],
+            properties: {
+                plugin: violation.plugin,
+                suggestion: violation.suggestion,
+                context: violation.context,
+            },
+        }));
+    }
+    generateRuleId(message) {
+        return message
+            .toLowerCase()
+            .replace(/[^a-z0-9\s]/g, '')
+            .replace(/\s+/g, '-')
+            .substring(0, 50);
+    }
+    mapSeverityToSarifLevel(severity) {
+        switch (severity) {
+            case 'error':
+                return 'error';
+            case 'warning':
+                return 'warning';
+            case 'info':
+                return 'note';
+            default:
+                return 'note';
+        }
+    }
+}
+export function createFormatter(name, options) {
+    switch (name.toLowerCase()) {
+        case 'default':
+            return new DefaultResultFormatter();
+        case 'json':
+            return new JsonResultFormatter(options?.indent);
+        case 'compact':
+            return new CompactResultFormatter();
+        case 'github':
+        case 'github-actions':
+            return new GitHubActionsResultFormatter();
+        case 'sarif':
+            return new SarifResultFormatter();
+        default:
+            throw new Error(`Unknown formatter: ${name}`);
+    }
+}
+export function getAvailableFormatters() {
+    return ['default', 'json', 'compact', 'github-actions', 'sarif'];
+}

package/dist/lib/policy/types.d.ts

@@ -0,0 +1,111 @@
+import type { TimonelLogger } from '../utils/logger.js';
+import type { ChartMetadata } from '../rutter.js';
+import type { ValidationOptions } from '../validation/inputValidator.js';
+import type { CacheOptions } from './validationCache.js';
+import type { ParallelExecutionOptions } from './parallelExecutor.js';
+export interface JSONSchema {
+    type?: string;
+    properties?: Record<string, JSONSchema>;
+    required?: string[];
+    additionalProperties?: boolean | JSONSchema;
+    [key: string]: unknown;
+}
+export interface PluginMetadata {
+    author?: string;
+    license?: string;
+    homepage?: string;
+    repository?: string;
+    kubernetesVersions?: string[];
+    tags?: string[];
+    defaultConfig?: Record<string, unknown>;
+}
+export interface ValidationContext {
+    readonly chart: ChartMetadata;
+    readonly kubernetesVersion?: string;
+    readonly environment?: string;
+    readonly config?: Record<string, unknown>;
+    readonly logger: TimonelLogger;
+}
+export interface PolicyViolation {
+    readonly plugin: string;
+    readonly severity: 'error' | 'warning' | 'info';
+    readonly message: string;
+    readonly resourcePath?: string;
+    readonly field?: string;
+    readonly suggestion?: string;
+    readonly context?: Record<string, unknown>;
+}
+export interface PolicyWarning extends Omit<PolicyViolation, 'severity'> {
+    readonly severity: 'warning' | 'info';
+}
+export interface ValidationMetadata {
+    readonly executionTime: number;
+    readonly pluginCount: number;
+    readonly manifestCount: number;
+    readonly startTime?: number;
+    readonly [key: string]: unknown;
+}
+export interface PolicyResult {
+    readonly valid: boolean;
+    readonly violations: PolicyViolation[];
+    readonly warnings: PolicyWarning[];
+    readonly metadata: ValidationMetadata;
+    readonly summary?: ResultSummary;
+}
+export interface ResultSummary {
+    readonly violationsBySeverity: {
+        readonly error: number;
+        readonly warning: number;
+        readonly info: number;
+    };
+    readonly violationsByPlugin: Record<string, number>;
+    readonly topViolationTypes: Array<{
+        readonly type: string;
+        readonly count: number;
+    }>;
+}
+export interface PolicyPlugin {
+    readonly name: string;
+    readonly version: string;
+    readonly description?: string;
+    validate(manifests: unknown[], context: ValidationContext): Promise<PolicyViolation[]>;
+    readonly configSchema?: JSONSchema;
+    readonly metadata?: PluginMetadata;
+}
+export interface ResultFormatter {
+    format(result: PolicyResult): string;
+}
+export interface RetryConfig {
+    maxAttempts: number;
+    baseDelay: number;
+    backoffMultiplier: number;
+    maxDelay: number;
+    retryOnTimeout: boolean;
+    retryOnPluginError: boolean;
+}
+export interface ConfigurationLoaderOptions {
+    defaultEnvironment?: string;
+    validateSchemas?: boolean;
+    allowUnknownProperties?: boolean;
+    configurationFiles?: string[];
+    environmentPrefix?: string;
+}
+export interface PolicyEngineOptions {
+    timeout?: number;
+    parallel?: boolean;
+    failFast?: boolean;
+    formatter?: ResultFormatter;
+    pluginConfig?: Record<string, unknown>;
+    retryConfig?: RetryConfig;
+    gracefulDegradation?: boolean;
+    configurationLoader?: ConfigurationLoaderOptions;
+    environment?: string;
+    cacheOptions?: CacheOptions;
+    parallelOptions?: ParallelExecutionOptions;
+    validationOptions?: ValidationOptions;
+}
+export interface PolicyEngine {
+    use(plugin: PolicyPlugin): Promise<PolicyEngine>;
+    validate(manifests: unknown[], chartMetadata: ChartMetadata): Promise<PolicyResult>;
+    configure(options: PolicyEngineOptions): PolicyEngine;
+}

package/dist/lib/policy/types.js

@@ -0,0 +1 @@
+export {};

package/dist/lib/policy/validationCache.d.ts

@@ -0,0 +1,58 @@
+import type { PolicyResult } from './types.js';
+export interface CacheEntry {
+    readonly result: PolicyResult;
+    readonly timestamp: number;
+    readonly manifestHash: string;
+    readonly pluginHash: string;
+    accessCount: number;
+    lastAccessed: number;
+}
+export interface CacheOptions {
+    maxEntries?: number;
+    maxAge?: number;
+    enableCompression?: boolean;
+    evictionStrategy?: 'lru' | 'lfu' | 'ttl';
+    cacheFailures?: boolean;
+    minExecutionTimeToCache?: number;
+}
+export interface CacheStats {
+    hits: number;
+    misses: number;
+    entries: number;
+    memoryUsage: number;
+    hitRatio: number;
+    averageAccessCount: number;
+}
+export declare class ValidationCache {
+    private readonly cache;
+    private readonly options;
+    private readonly logger;
+    private stats;
+    constructor(options?: CacheOptions);
+    get(manifestHash: string, pluginHash: string): PolicyResult | undefined;
+    set(manifestHash: string, pluginHash: string, result: PolicyResult): void;
+    invalidate(criteria: {
+        manifestHash?: string;
+        pluginHash?: string;
+        olderThan?: number;
+        all?: boolean;
+    }): number;
+    private invalidateAll;
+    private invalidateSelective;
+    private shouldInvalidateEntry;
+    getStats(): CacheStats;
+    clearStats(): void;
+    private generateCacheKey;
+    private isExpired;
+    private shouldCache;
+    private evictEntries;
+    private evictLRU;
+    private evictLFU;
+    private evictTTL;
+    private updateStats;
+    private estimateMemoryUsage;
+    private startPeriodicCleanup;
+    private cleanupExpiredEntries;
+}
+export declare function generateManifestHash(manifests: unknown[]): string;
+export declare function generatePluginHash(plugins: string[], pluginConfigs: Record<string, unknown>): string;

package/dist/lib/policy/validationCache.js

@@ -0,0 +1,289 @@
+import { createLogger } from '../utils/logger.js';
+const DEFAULT_CACHE_OPTIONS = {
+    maxEntries: 1000,
+    maxAge: 30 * 60 * 1000,
+    enableCompression: false,
+    evictionStrategy: 'lru',
+    cacheFailures: true,
+    minExecutionTimeToCache: 10,
+};
+export class ValidationCache {
+    constructor(options = {}) {
+        this.cache = new Map();
+        this.stats = {
+            hits: 0,
+            misses: 0,
+            entries: 0,
+            memoryUsage: 0,
+            hitRatio: 0,
+            averageAccessCount: 0,
+        };
+        this.options = { ...DEFAULT_CACHE_OPTIONS, ...options };
+        this.logger = createLogger('validation-cache');
+        this.logger.debug('ValidationCache initialized', {
+            options: this.options,
+            operation: 'cache_init',
+        });
+        this.startPeriodicCleanup();
+    }
+    get(manifestHash, pluginHash) {
+        const cacheKey = this.generateCacheKey(manifestHash, pluginHash);
+        const entry = this.cache.get(cacheKey);
+        if (!entry) {
+            this.stats.misses++;
+            this.updateStats();
+            this.logger.debug('Cache miss', {
+                manifestHash: manifestHash.substring(0, 8),
+                pluginHash: pluginHash.substring(0, 8),
+                operation: 'cache_miss',
+            });
+            return undefined;
+        }
+        if (this.isExpired(entry)) {
+            this.cache.delete(cacheKey);
+            this.stats.misses++;
+            this.updateStats();
+            this.logger.debug('Cache entry expired', {
+                manifestHash: manifestHash.substring(0, 8),
+                pluginHash: pluginHash.substring(0, 8),
+                age: Date.now() - entry.timestamp,
+                operation: 'cache_expired',
+            });
+            return undefined;
+        }
+        entry.accessCount++;
+        entry.lastAccessed = Date.now();
+        this.stats.hits++;
+        this.updateStats();
+        this.logger.debug('Cache hit', {
+            manifestHash: manifestHash.substring(0, 8),
+            pluginHash: pluginHash.substring(0, 8),
+            accessCount: entry.accessCount,
+            age: Date.now() - entry.timestamp,
+            operation: 'cache_hit',
+        });
+        return entry.result;
+    }
+    set(manifestHash, pluginHash, result) {
+        if (!this.shouldCache(result)) {
+            this.logger.debug('Skipping cache storage', {
+                manifestHash: manifestHash.substring(0, 8),
+                pluginHash: pluginHash.substring(0, 8),
+                executionTime: result.metadata.executionTime,
+                hasViolations: result.violations.length > 0,
+                operation: 'cache_skip',
+            });
+            return;
+        }
+        const cacheKey = this.generateCacheKey(manifestHash, pluginHash);
+        if (this.cache.size >= this.options.maxEntries) {
+            this.evictEntries();
+        }
+        const entry = {
+            result,
+            timestamp: Date.now(),
+            manifestHash,
+            pluginHash,
+            accessCount: 0,
+            lastAccessed: Date.now(),
+        };
+        this.cache.set(cacheKey, entry);
+        this.updateStats();
+        this.logger.debug('Cache entry stored', {
+            manifestHash: manifestHash.substring(0, 8),
+            pluginHash: pluginHash.substring(0, 8),
+            executionTime: result.metadata.executionTime,
+            violationCount: result.violations.length,
+            warningCount: result.warnings.length,
+            operation: 'cache_store',
+        });
+    }
+    invalidate(criteria) {
+        if (criteria.all) {
+            return this.invalidateAll();
+        }
+        return this.invalidateSelective(criteria);
+    }
+    invalidateAll() {
+        const invalidatedCount = this.cache.size;
+        this.cache.clear();
+        this.logger.info('Cache cleared completely', {
+            invalidatedCount,
+            operation: 'cache_clear_all',
+        });
+        this.updateStats();
+        return invalidatedCount;
+    }
+    invalidateSelective(criteria) {
+        const keysToDelete = [];
+        for (const [key, entry] of this.cache.entries()) {
+            if (this.shouldInvalidateEntry(entry, criteria)) {
+                keysToDelete.push(key);
+            }
+        }
+        for (const key of keysToDelete) {
+            this.cache.delete(key);
+        }
+        this.logger.debug('Cache entries invalidated', {
+            invalidatedCount: keysToDelete.length,
+            criteria,
+            operation: 'cache_invalidate',
+        });
+        this.updateStats();
+        return keysToDelete.length;
+    }
+    shouldInvalidateEntry(entry, criteria) {
+        if (criteria.manifestHash && entry.manifestHash === criteria.manifestHash) {
+            return true;
+        }
+        if (criteria.pluginHash && entry.pluginHash === criteria.pluginHash) {
+            return true;
+        }
+        if (criteria.olderThan && entry.timestamp < criteria.olderThan) {
+            return true;
+        }
+        return false;
+    }
+    getStats() {
+        return { ...this.stats };
+    }
+    clearStats() {
+        this.stats = {
+            hits: 0,
+            misses: 0,
+            entries: this.cache.size,
+            memoryUsage: this.estimateMemoryUsage(),
+            hitRatio: 0,
+            averageAccessCount: 0,
+        };
+        this.logger.debug('Cache statistics cleared', {
+            operation: 'cache_stats_clear',
+        });
+    }
+    generateCacheKey(manifestHash, pluginHash) {
+        return `${manifestHash}:${pluginHash}`;
+    }
+    isExpired(entry) {
+        return Date.now() - entry.timestamp > this.options.maxAge;
+    }
+    shouldCache(result) {
+        if (result.metadata.executionTime < this.options.minExecutionTimeToCache) {
+            return false;
+        }
+        if (!this.options.cacheFailures && !result.valid) {
+            return false;
+        }
+        return true;
+    }
+    evictEntries() {
+        const entriesToEvict = Math.max(1, Math.floor(this.options.maxEntries * 0.1));
+        switch (this.options.evictionStrategy) {
+            case 'lru':
+                this.evictLRU(entriesToEvict);
+                break;
+            case 'lfu':
+                this.evictLFU(entriesToEvict);
+                break;
+            case 'ttl':
+                this.evictTTL(entriesToEvict);
+                break;
+        }
+        this.logger.debug('Cache entries evicted', {
+            strategy: this.options.evictionStrategy,
+            evictedCount: entriesToEvict,
+            remainingEntries: this.cache.size,
+            operation: 'cache_evict',
+        });
+    }
+    evictLRU(count) {
+        const entries = Array.from(this.cache.entries())
+            .sort(([, a], [, b]) => a.lastAccessed - b.lastAccessed)
+            .slice(0, count);
+        for (const [key] of entries) {
+            this.cache.delete(key);
+        }
+    }
+    evictLFU(count) {
+        const entries = Array.from(this.cache.entries())
+            .sort(([, a], [, b]) => a.accessCount - b.accessCount)
+            .slice(0, count);
+        for (const [key] of entries) {
+            this.cache.delete(key);
+        }
+    }
+    evictTTL(count) {
+        const entries = Array.from(this.cache.entries())
+            .sort(([, a], [, b]) => a.timestamp - b.timestamp)
+            .slice(0, count);
+        for (const [key] of entries) {
+            this.cache.delete(key);
+        }
+    }
+    updateStats() {
+        const totalRequests = this.stats.hits + this.stats.misses;
+        this.stats.entries = this.cache.size;
+        this.stats.memoryUsage = this.estimateMemoryUsage();
+        this.stats.hitRatio = totalRequests > 0 ? this.stats.hits / totalRequests : 0;
+        if (this.cache.size > 0) {
+            const totalAccessCount = Array.from(this.cache.values()).reduce((sum, entry) => sum + entry.accessCount, 0);
+            this.stats.averageAccessCount = totalAccessCount / this.cache.size;
+        }
+        else {
+            this.stats.averageAccessCount = 0;
+        }
+    }
+    estimateMemoryUsage() {
+        let totalSize = 0;
+        for (const entry of this.cache.values()) {
+            totalSize += JSON.stringify(entry.result).length * 2;
+            totalSize += entry.manifestHash.length * 2;
+            totalSize += entry.pluginHash.length * 2;
+            totalSize += 64;
+        }
+        return totalSize;
+    }
+    startPeriodicCleanup() {
+        const cleanupInterval = Math.min(this.options.maxAge / 4, 5 * 60 * 1000);
+        globalThis.setInterval(() => {
+            this.cleanupExpiredEntries();
+        }, cleanupInterval);
+    }
+    cleanupExpiredEntries() {
+        const keysToDelete = [];
+        const now = Date.now();
+        for (const [key, entry] of this.cache.entries()) {
+            if (now - entry.timestamp > this.options.maxAge) {
+                keysToDelete.push(key);
+            }
+        }
+        if (keysToDelete.length > 0) {
+            for (const key of keysToDelete) {
+                this.cache.delete(key);
+            }
+            this.updateStats();
+            this.logger.debug('Expired cache entries cleaned up', {
+                cleanedCount: keysToDelete.length,
+                remainingEntries: this.cache.size,
+                operation: 'cache_cleanup',
+            });
+        }
+    }
+}
+export function generateManifestHash(manifests) {
+    const manifestString = JSON.stringify(manifests, Object.keys(manifests).sort());
+    return hashString(manifestString);
+}
+export function generatePluginHash(plugins, pluginConfigs) {
+    const configString = JSON.stringify({
+        plugins: plugins.sort(),
+        configs: pluginConfigs,
+    }, Object.keys({ plugins: plugins.sort(), configs: pluginConfigs }).sort());
+    return hashString(configString);
+}
+function hashString(str) {
+    let hash = 5381;
+    for (let i = 0; i < str.length; i++) {
+        hash = (hash << 5) + hash + str.charCodeAt(i);
+    }
+    return Math.abs(hash).toString(36);
+}

package/dist/lib/resources/baseResourceProvider.js

@@ -48,6 +48,11 @@ export class BaseResourceProvider {
     createRootLevelApiObject(name, apiVersion, kind, fields, labels, annotations) {
         this.validateKubernetesName(name, kind);
         this.validateLabels(labels, kind);
+        const reservedKeys = ['apiVersion', 'kind', 'metadata'];
+        const conflictingKeys = Object.keys(fields).filter((key) => reservedKeys.includes(key));
+        if (conflictingKeys.length > 0) {
+            throw new Error(`Fields object contains reserved keys: ${conflictingKeys.join(', ')}. These keys cannot be overridden.`);
+        }
         return new ApiObject(this.chart, name, {
             apiVersion,
             kind,

package/dist/lib/resources/cloud/aws/awsResources.js

@@ -120,7 +120,8 @@ export class AWSResources extends BaseResourceProvider {
             throw new Error(`Ingress path "${path}" must start with /`);
         }
         if (normalizedPath.includes('../') || normalizedPath.includes('./')) {
-            console.warn(`Warning: Ingress path "${path}" contains path traversal-like sequences`);
+            const sanitizedPath = path.replace(/[\r\n]/g, '');
+            console.warn(`Warning: Ingress path "${sanitizedPath}" contains path traversal-like sequences`);
         }
     }
     validatePathType(pathType) {