timonel 3.0.0-beta.1 → 3.1.0-beta.1

package/dist/lib/utils/envVarsLoader.js

@@ -1,22 +1,28 @@
 import { readFileSync, existsSync } from 'fs';
 import { join } from 'path';
 import { parse as parseYaml } from 'yaml';
+import { SecurityUtils } from '../security.js';
 import { createHelmExpression } from './helmControlStructures.js';
 export function loadEnvVarsConfig(options = {}) {
     const { configPath, fallbackConfig = [] } = options;
     try {
-        if (configPath && existsSync(configPath)) {
-            const data = readFileSync(configPath, 'utf-8');
-            return configPath.endsWith('.yaml') || configPath.endsWith('.yml')
-                ? parseYaml(data)
-                : JSON.parse(data);
+        if (configPath) {
+            const validatedConfigPath = SecurityUtils.validatePath(configPath, process.cwd(), {
+                allowAbsolute: true,
+            });
+            if (existsSync(validatedConfigPath)) {
+                const data = readFileSync(validatedConfigPath, 'utf-8');
+                return validatedConfigPath.endsWith('.yaml') || validatedConfigPath.endsWith('.yml')
+                    ? parseYaml(data)
+                    : JSON.parse(data);
+            }
         }
-        const yamlPath = join(process.cwd(), 'env-config.yaml');
+        const yamlPath = SecurityUtils.validatePath(join(process.cwd(), 'env-config.yaml'), process.cwd(), { allowAbsolute: true });
         if (existsSync(yamlPath)) {
             const data = readFileSync(yamlPath, 'utf-8');
             return parseYaml(data);
         }
-        const jsonPath = join(process.cwd(), 'env-config.json');
+        const jsonPath = SecurityUtils.validatePath(join(process.cwd(), 'env-config.json'), process.cwd(), { allowAbsolute: true });
         if (existsSync(jsonPath)) {
             const data = readFileSync(jsonPath, 'utf-8');
             return JSON.parse(data);

package/dist/lib/utils/helmHelpers.js

@@ -261,12 +261,20 @@ export const AWS_HELPERS = [
 ];
 export function formatHelpers(helpers) {
     return helpers
-        .map((helper) => `{{/*
+        .map((helper) => {
+        if (!helper.name || typeof helper.name !== 'string') {
+            throw new Error('Helper must have a valid name property');
+        }
+        if (!helper.template || typeof helper.template !== 'string') {
+            throw new Error(`Helper '${helper.name}' must have a valid template property`);
+        }
+        return `{{/*
 ${helper.name}
 */}}
 {{- define "${helper.name}" -}}
 ${helper.template}
-{{- end }}`)
+{{- end }}`;
+    })
         .join('\n\n');
 }
 export function getDefaultHelpers(cloudProvider, options) {

package/dist/lib/utils/helmYamlSerializer.js

@@ -1,4 +1,5 @@
 import { Document, Scalar, isMap, isScalar, visit, Pair } from 'yaml';
+import { SecurityUtils } from '../security.js';
 import { isHelmConstruct, isHelmExpression, createHelmExpression, } from './helmControlStructures.js';
 import { isHelmValue, isHelmFieldConditional, isHelmRange, isHelmWith, } from './valuesRef.js';
 const FIELD_CONDITIONAL = '__FIELD_CONDITIONAL__:';
@@ -542,7 +543,8 @@ export function dumpHelmAwareYaml(obj, options = {}) {
         const contentLines = content.split('\n');
         const firstContentLine = contentLines[0]?.trim() || '';
         if (firstContentLine.startsWith(`${fieldKey}:`)) {
-            contentLines[0] = contentLines[0].replace(new RegExp(`^\\s*${fieldKey}:\\s*`), '');
+            const escapedFieldKey = fieldKey.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+            contentLines[0] = contentLines[0].replace(new RegExp(`^\\s*${escapedFieldKey}:\\s*`), '');
             content = contentLines.join('\n');
         }
         const contentFormatted = content
@@ -640,7 +642,7 @@ export function postProcessFieldConditionals(yaml) {
             .join('\n');
         result = result.substring(0, secondLastNewline + 1) + processed + result.substring(markerEnd);
     }
-    result = result.replace(/:\s*\|[-+]?\s*\n(\s*\{\{)/g, ':\n$1');
+    result = result.replace(/:\s*\|[-+]?\s*\n([ \t]*\{\{)/g, ':\n$1');
     result = result.replace(/"(\{\{[\s\S]*?\}\})"/g, '$1');
     return result;
 }
@@ -718,13 +720,14 @@ export function parseHelmExpressions(content) {
             let match;
             regex.lastIndex = 0;
             while ((match = regex.exec(line)) !== null) {
+                const sanitizedExpression = SecurityUtils.sanitizeLogMessage(match[0] || '');
                 expressions.push({
                     type,
-                    expression: match[0],
+                    expression: sanitizedExpression,
                     startLine: i + 1,
                     startCol: match.index + 1,
                     endLine: i + 1,
-                    endCol: match.index + match[0].length + 1,
+                    endCol: match.index + (match[0]?.length || 0) + 1,
                 });
                 if (match.index === regex.lastIndex)
                     regex.lastIndex++;
@@ -780,14 +783,19 @@ function validateFunctionCalls(_content) {
 function checkCommonIssues(yaml, warnings) {
     const deprecatedFunctions = ['template'];
     for (const func of deprecatedFunctions) {
-        const pattern = new RegExp(`\\{\\{[^}]*\\b${func}\\b[^}]*\\}\\}`, 'g');
+        if (!/^[a-zA-Z0-9_]+$/.test(func)) {
+            continue;
+        }
+        const escapedFunc = func.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const pattern = new RegExp(`\\{\\{[^}]*\\b${escapedFunc}\\b[^}]*\\}\\}`, 'g');
         let match;
         while ((match = pattern.exec(yaml)) !== null) {
+            const sanitizedFunc = SecurityUtils.sanitizeLogMessage(func);
             warnings.push({
                 type: 'semantic',
-                message: `Function '${func}' is deprecated`,
+                message: `Function '${sanitizedFunc}' is deprecated`,
                 expression: match[0],
-                suggestion: `Consider avoiding deprecated function '${func}'`,
+                suggestion: `Consider avoiding deprecated function '${sanitizedFunc}'`,
             });
         }
     }
@@ -798,11 +806,13 @@ function checkQuotedExpressions(yaml, warnings) {
         let match;
         pattern.lastIndex = 0;
         while ((match = pattern.exec(yaml)) !== null) {
+            const sanitizedMatch = SecurityUtils.sanitizeLogMessage(match[1] || '');
+            const sanitizedExpression = SecurityUtils.sanitizeLogMessage(match[0] || '');
             warnings.push({
                 type: 'semantic',
                 message: 'Helm expression should not be quoted',
-                expression: match[0],
-                suggestion: `Remove quotes around: ${match[1]}`,
+                expression: sanitizedExpression,
+                suggestion: `Remove quotes around: ${sanitizedMatch}`,
             });
         }
     }

package/dist/lib/utils/logger.js

@@ -180,19 +180,24 @@ export class TimonelLogger {
         }
     }
     requestSerializer(req) {
-        if (!req || typeof req !== 'object')
+        try {
+            if (!req || typeof req !== 'object')
+                return {};
+            const request = req;
+            return {
+                method: request.method,
+                url: SecurityUtils.sanitizeLogMessage(request.url || ''),
+                headers: {
+                    'user-agent': request.headers?.['user-agent'],
+                    'content-type': request.headers?.['content-type'],
+                },
+                remoteAddress: request.remoteAddress,
+                remotePort: request.remotePort,
+            };
+        }
+        catch {
             return {};
-        const request = req;
-        return {
-            method: request.method,
-            url: SecurityUtils.sanitizeLogMessage(request.url || ''),
-            headers: {
-                'user-agent': request.headers?.['user-agent'],
-                'content-type': request.headers?.['content-type'],
-            },
-            remoteAddress: request.remoteAddress,
-            remotePort: request.remotePort,
-        };
+        }
     }
     responseSerializer(res) {
         if (!res || typeof res !== 'object')
@@ -256,40 +261,50 @@ export class TimonelLogger {
         }
     }
     sanitizeContext(context) {
-        const sanitized = {};
-        for (const [key, value] of Object.entries(context)) {
-            if (TimonelLogger.SENSITIVE_FIELDS.has(key.toLowerCase())) {
-                sanitized[key] = '[REDACTED]';
-            }
-            else if (typeof value === 'string') {
-                sanitized[key] = SecurityUtils.sanitizeLogMessage(value);
-            }
-            else if (value && typeof value === 'object') {
-                sanitized[key] = this.sanitizeNestedObject(value, 2);
-            }
-            else {
-                sanitized[key] = value;
+        try {
+            const sanitized = {};
+            for (const [key, value] of Object.entries(context)) {
+                if (TimonelLogger.SENSITIVE_FIELDS.has(key.toLowerCase())) {
+                    sanitized[key] = '[REDACTED]';
+                }
+                else if (typeof value === 'string') {
+                    sanitized[key] = SecurityUtils.sanitizeLogMessage(value);
+                }
+                else if (value && typeof value === 'object') {
+                    sanitized[key] = this.sanitizeNestedObject(value, 2);
+                }
+                else {
+                    sanitized[key] = value;
+                }
             }
+            return sanitized;
+        }
+        catch {
+            return {};
         }
-        return sanitized;
     }
     sanitizeNestedObject(obj, depth) {
-        if (depth <= 0 || !obj || typeof obj !== 'object') {
-            return obj;
-        }
-        const sanitized = {};
-        for (const [key, value] of Object.entries(obj)) {
-            if (typeof value === 'string') {
-                sanitized[key] = SecurityUtils.sanitizeLogMessage(value);
+        try {
+            if (depth <= 0 || !obj || typeof obj !== 'object') {
+                return obj;
             }
-            else if (value && typeof value === 'object') {
-                sanitized[key] = this.sanitizeNestedObject(value, depth - 1);
-            }
-            else {
-                sanitized[key] = value;
+            const sanitized = {};
+            for (const [key, value] of Object.entries(obj)) {
+                if (typeof value === 'string') {
+                    sanitized[key] = SecurityUtils.sanitizeLogMessage(value);
+                }
+                else if (value && typeof value === 'object') {
+                    sanitized[key] = this.sanitizeNestedObject(value, depth - 1);
+                }
+                else {
+                    sanitized[key] = value;
+                }
             }
+            return sanitized;
+        }
+        catch {
+            return obj;
         }
-        return sanitized;
     }
     child(context) {
         const sanitizedContext = this.sanitizeContext(context);

package/dist/lib/utils/valuesRef.js

@@ -10,6 +10,9 @@ function serializeValue(value) {
     return String(value);
 }
 function createCondition(condition) {
+    if (!condition || typeof condition !== 'string') {
+        throw new Error('Condition must be a non-empty string');
+    }
     return {
         [HELM_VALUE_SYMBOL]: true,
         __condition: condition,
@@ -17,9 +20,15 @@ function createCondition(condition) {
             return createCondition(`not (${this.__condition})`);
         },
         and(other) {
+            if (!other || typeof other.__condition !== 'string') {
+                throw new Error('Invalid HelmCondition provided to and()');
+            }
             return createCondition(`and (${this.__condition}) (${other.__condition})`);
         },
         or(other) {
+            if (!other || typeof other.__condition !== 'string') {
+                throw new Error('Invalid HelmCondition provided to or()');
+            }
             return createCondition(`or (${this.__condition}) (${other.__condition})`);
         },
         toString() {

package/dist/lib/validation/inputValidator.d.ts

@@ -0,0 +1,26 @@
+import type { PolicyConfig, PolicyContext, PolicyRule, PluginConfig } from '../../types/index.js';
+export interface ValidationOptions {
+    maxStringLength?: number;
+    maxArrayLength?: number;
+    maxObjectDepth?: number;
+    allowedProtocols?: string[];
+    sanitizeStrings?: boolean;
+}
+export declare class InputValidator {
+    private options;
+    constructor(options?: ValidationOptions);
+    validatePolicyConfig(config: unknown): PolicyConfig;
+    validatePolicyRule(rule: unknown): PolicyRule;
+    validatePolicyContext(context: unknown): PolicyContext;
+    validatePluginConfig(config: unknown): PluginConfig;
+    private validateStringLength;
+    private validateArrayLength;
+    private validateObjectDepth;
+    private sanitizeString;
+    private sanitizeObject;
+}
+export declare const defaultValidator: InputValidator;
+export declare const validatePolicyConfig: (config: unknown) => PolicyConfig;
+export declare const validatePolicyRule: (rule: unknown) => PolicyRule;
+export declare const validatePolicyContext: (context: unknown) => PolicyContext;
+export declare const validatePluginConfig: (config: unknown) => PluginConfig;

package/dist/lib/validation/inputValidator.js

@@ -0,0 +1,176 @@
+import { PolicyValidationError } from '../policy/errors.js';
+const DEFAULT_OPTIONS = {
+    maxStringLength: 10000,
+    maxArrayLength: 1000,
+    maxObjectDepth: 10,
+    allowedProtocols: ['http', 'https'],
+    sanitizeStrings: true,
+};
+export class InputValidator {
+    constructor(options = {}) {
+        this.options = { ...DEFAULT_OPTIONS, ...options };
+    }
+    validatePolicyConfig(config) {
+        if (!config || typeof config !== 'object') {
+            throw new PolicyValidationError('PolicyConfig must be a non-null object');
+        }
+        const typedConfig = config;
+        if (!typedConfig.id || typeof typedConfig.id !== 'string') {
+            throw new PolicyValidationError('PolicyConfig.id must be a non-empty string');
+        }
+        if (!typedConfig.name || typeof typedConfig.name !== 'string') {
+            throw new PolicyValidationError('PolicyConfig.name must be a non-empty string');
+        }
+        if (!Array.isArray(typedConfig.rules)) {
+            throw new PolicyValidationError('PolicyConfig.rules must be an array');
+        }
+        this.validateStringLength(typedConfig.id, 'PolicyConfig.id');
+        this.validateStringLength(typedConfig.name, 'PolicyConfig.name');
+        this.validateArrayLength(typedConfig.rules, 'PolicyConfig.rules');
+        const validatedRules = typedConfig.rules.map((rule, index) => {
+            try {
+                return this.validatePolicyRule(rule);
+            }
+            catch (error) {
+                throw new PolicyValidationError(`PolicyConfig.rules[${index}]: ${error.message}`);
+            }
+        });
+        const sanitizedConfig = {
+            id: this.sanitizeString(typedConfig.id),
+            name: this.sanitizeString(typedConfig.name),
+            rules: validatedRules,
+            enabled: typeof typedConfig.enabled === 'boolean' ? typedConfig.enabled : true,
+        };
+        if (typedConfig.description) {
+            sanitizedConfig.description = this.sanitizeString(typedConfig.description);
+        }
+        if (typedConfig.version) {
+            sanitizedConfig.version = this.sanitizeString(typedConfig.version);
+        }
+        return sanitizedConfig;
+    }
+    validatePolicyRule(rule) {
+        if (!rule || typeof rule !== 'object') {
+            throw new PolicyValidationError('PolicyRule must be a non-null object');
+        }
+        const typedRule = rule;
+        if (!typedRule.id || typeof typedRule.id !== 'string') {
+            throw new PolicyValidationError('PolicyRule.id must be a non-empty string');
+        }
+        if (!typedRule.type || typeof typedRule.type !== 'string') {
+            throw new PolicyValidationError('PolicyRule.type must be a non-empty string');
+        }
+        if (!typedRule.condition || typeof typedRule.condition !== 'object') {
+            throw new PolicyValidationError('PolicyRule.condition must be an object');
+        }
+        this.validateStringLength(typedRule.id, 'PolicyRule.id');
+        this.validateStringLength(typedRule.type, 'PolicyRule.type');
+        this.validateObjectDepth(typedRule.condition, 'PolicyRule.condition');
+        const sanitizedRule = {
+            id: this.sanitizeString(typedRule.id),
+            type: this.sanitizeString(typedRule.type),
+            condition: this.sanitizeObject(typedRule.condition),
+            priority: typeof typedRule.priority === 'number' ? typedRule.priority : 0,
+            enabled: typeof typedRule.enabled === 'boolean' ? typedRule.enabled : true,
+        };
+        if (typedRule.action) {
+            sanitizedRule.action = this.sanitizeString(typedRule.action);
+        }
+        return sanitizedRule;
+    }
+    validatePolicyContext(context) {
+        if (!context || typeof context !== 'object') {
+            throw new PolicyValidationError('PolicyContext must be a non-null object');
+        }
+        const typedContext = context;
+        this.validateObjectDepth(typedContext, 'PolicyContext');
+        return this.sanitizeObject(typedContext);
+    }
+    validatePluginConfig(config) {
+        if (!config || typeof config !== 'object') {
+            throw new PolicyValidationError('PluginConfig must be a non-null object');
+        }
+        const typedConfig = config;
+        if (!typedConfig.name || typeof typedConfig.name !== 'string') {
+            throw new PolicyValidationError('PluginConfig.name must be a non-empty string');
+        }
+        this.validateStringLength(typedConfig.name, 'PluginConfig.name');
+        if (typedConfig.config && typeof typedConfig.config === 'object') {
+            this.validateObjectDepth(typedConfig.config, 'PluginConfig.config');
+        }
+        const sanitizedConfig = {
+            name: this.sanitizeString(typedConfig.name),
+            enabled: typeof typedConfig.enabled === 'boolean' ? typedConfig.enabled : true,
+        };
+        if (typedConfig.version) {
+            sanitizedConfig.version = this.sanitizeString(typedConfig.version);
+        }
+        if (typedConfig.config) {
+            sanitizedConfig.config = this.sanitizeObject(typedConfig.config);
+        }
+        return sanitizedConfig;
+    }
+    validateStringLength(value, fieldName) {
+        if (value.length > this.options.maxStringLength) {
+            throw new PolicyValidationError(`${fieldName} exceeds maximum length of ${this.options.maxStringLength} characters`);
+        }
+    }
+    validateArrayLength(value, fieldName) {
+        if (value.length > this.options.maxArrayLength) {
+            throw new PolicyValidationError(`${fieldName} exceeds maximum length of ${this.options.maxArrayLength} items`);
+        }
+    }
+    validateObjectDepth(obj, fieldName, currentDepth = 0) {
+        if (currentDepth > this.options.maxObjectDepth) {
+            throw new PolicyValidationError(`${fieldName} exceeds maximum object depth of ${this.options.maxObjectDepth}`);
+        }
+        for (const [key, value] of Object.entries(obj)) {
+            if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+                this.validateObjectDepth(value, `${fieldName}.${key}`, currentDepth + 1);
+            }
+        }
+    }
+    sanitizeString(value) {
+        if (!this.options.sanitizeStrings) {
+            return value;
+        }
+        let sanitized = value
+            .replace(/\0/g, '')
+            .split('')
+            .filter((char) => {
+            const code = char.charCodeAt(0);
+            return code > 31 && code !== 127;
+        })
+            .join('');
+        sanitized = sanitized.trim();
+        return sanitized;
+    }
+    sanitizeObject(obj) {
+        const sanitized = {};
+        for (const [key, value] of Object.entries(obj)) {
+            const sanitizedKey = this.sanitizeString(key);
+            if (typeof value === 'string') {
+                sanitized[sanitizedKey] = this.sanitizeString(value);
+            }
+            else if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+                sanitized[sanitizedKey] = this.sanitizeObject(value);
+            }
+            else if (Array.isArray(value)) {
+                sanitized[sanitizedKey] = value.map((item) => typeof item === 'string'
+                    ? this.sanitizeString(item)
+                    : typeof item === 'object' && item !== null
+                        ? this.sanitizeObject(item)
+                        : item);
+            }
+            else {
+                sanitized[sanitizedKey] = value;
+            }
+        }
+        return sanitized;
+    }
+}
+export const defaultValidator = new InputValidator();
+export const validatePolicyConfig = (config) => defaultValidator.validatePolicyConfig(config);
+export const validatePolicyRule = (rule) => defaultValidator.validatePolicyRule(rule);
+export const validatePolicyContext = (context) => defaultValidator.validatePolicyContext(context);
+export const validatePluginConfig = (config) => defaultValidator.validatePluginConfig(config);

package/dist/types/index.d.ts

@@ -0,0 +1,27 @@
+export interface PolicyConfig {
+    id: string;
+    name: string;
+    rules: PolicyRule[];
+    description?: string;
+    version?: string;
+    enabled?: boolean;
+}
+export interface PolicyRule {
+    id: string;
+    type: string;
+    condition: Record<string, unknown>;
+    action?: string;
+    priority?: number;
+    enabled?: boolean;
+}
+export interface PolicyContext {
+    environment?: string;
+    metadata?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+export interface PluginConfig {
+    name: string;
+    version?: string;
+    config?: Record<string, unknown>;
+    enabled?: boolean;
+}

package/dist/types/index.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "timonel",
   "type": "module",
-  "version": "3.0.0-beta.1",
+  "version": "3.1.0-beta.1",
   "description": "Timonel: programmatic Helm chart generator using cdk8s (TypeScript)",
   "bin": {
     "timonel": "dist/cli.js",
@@ -59,6 +59,8 @@
     "test:integration": "vitest run --config vitest.integration.config.ts",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
+    "doc:coverage": "tsx scripts/project-doc-coverage.ts",
+    "doc:coverage:validate": "tsx scripts/validate-doc-coverage.ts",
     "ci:check": "pnpm typecheck && pnpm lint && pnpm format:check && pnpm build",
     "release": "semantic-release",
     "release:dry": "semantic-release --dry-run",
@@ -100,28 +102,28 @@
     ]
   },
   "dependencies": {
-    "cdk8s": "^2.70.28",
-    "cdk8s-plus-33": "^2.4.6",
-    "constructs": "^10.4.3",
+    "cdk8s": "^2.70.40",
+    "cdk8s-plus-33": "^2.4.17",
+    "constructs": "^10.4.4",
     "handlebars": "^4.7.8",
     "pino": "^10.1.0",
-    "pino-pretty": "^13.1.2",
+    "pino-pretty": "^13.1.3",
     "ts-node": "^10.9.2",
-    "yaml": "^2.8.1"
+    "yaml": "^2.8.2"
   },
   "devDependencies": {
-    "@commitlint/cli": "^20.1.0",
-    "@commitlint/config-conventional": "^20.0.0",
-    "@eslint/js": "^9.39.1",
+    "@commitlint/cli": "^20.3.0",
+    "@commitlint/config-conventional": "^20.3.0",
+    "@eslint/js": "^9.39.2",
     "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/exec": "^7.1.0",
     "@semantic-release/git": "^10.0.1",
-    "@types/node": "^24.10.1",
-    "@typescript-eslint/eslint-plugin": "^8.47.0",
-    "@typescript-eslint/parser": "^8.47.0",
-    "@vitest/coverage-v8": "^3.2.4",
+    "@types/node": "^25.0.3",
+    "@typescript-eslint/eslint-plugin": "^8.51.0",
+    "@typescript-eslint/parser": "^8.51.0",
+    "@vitest/coverage-v8": "^4.0.16",
     "conventional-changelog-cli": "^5.0.0",
-    "eslint": "^9.39.1",
+    "eslint": "^9.39.2",
     "eslint-config-prettier": "^10.1.8",
     "eslint-import-resolver-typescript": "^4.4.4",
     "eslint-plugin-import": "^2.32.0",
@@ -130,13 +132,13 @@
     "eslint-plugin-unused-imports": "^4.3.0",
     "husky": "^9.1.7",
     "lint-staged": "^16.2.7",
-    "markdownlint": "^0.39.0",
-    "markdownlint-cli": "^0.46.0",
-    "prettier": "^3.6.2",
+    "markdownlint": "^0.40.0",
+    "markdownlint-cli": "^0.47.0",
+    "prettier": "^3.7.4",
     "semantic-release": "^25.0.2",
-    "tsx": "^4.20.6",
+    "tsx": "^4.21.0",
     "typescript": "^5.9.3",
-    "vitest": "^3.2.4"
+    "vitest": "^4.0.16"
   },
   "files": [
     "dist",