timonel 3.0.0 → 3.1.0

package/dist/lib/validation/inputValidator.d.ts

@@ -0,0 +1,26 @@
+import type { PolicyConfig, PolicyContext, PolicyRule, PluginConfig } from '../../types/index.js';
+export interface ValidationOptions {
+    maxStringLength?: number;
+    maxArrayLength?: number;
+    maxObjectDepth?: number;
+    allowedProtocols?: string[];
+    sanitizeStrings?: boolean;
+}
+export declare class InputValidator {
+    private options;
+    constructor(options?: ValidationOptions);
+    validatePolicyConfig(config: unknown): PolicyConfig;
+    validatePolicyRule(rule: unknown): PolicyRule;
+    validatePolicyContext(context: unknown): PolicyContext;
+    validatePluginConfig(config: unknown): PluginConfig;
+    private validateStringLength;
+    private validateArrayLength;
+    private validateObjectDepth;
+    private sanitizeString;
+    private sanitizeObject;
+}
+export declare const defaultValidator: InputValidator;
+export declare const validatePolicyConfig: (config: unknown) => PolicyConfig;
+export declare const validatePolicyRule: (rule: unknown) => PolicyRule;
+export declare const validatePolicyContext: (context: unknown) => PolicyContext;
+export declare const validatePluginConfig: (config: unknown) => PluginConfig;

package/dist/lib/validation/inputValidator.js

@@ -0,0 +1,176 @@
+import { PolicyValidationError } from '../policy/errors.js';
+const DEFAULT_OPTIONS = {
+    maxStringLength: 10000,
+    maxArrayLength: 1000,
+    maxObjectDepth: 10,
+    allowedProtocols: ['http', 'https'],
+    sanitizeStrings: true,
+};
+export class InputValidator {
+    constructor(options = {}) {
+        this.options = { ...DEFAULT_OPTIONS, ...options };
+    }
+    validatePolicyConfig(config) {
+        if (!config || typeof config !== 'object') {
+            throw new PolicyValidationError('PolicyConfig must be a non-null object');
+        }
+        const typedConfig = config;
+        if (!typedConfig.id || typeof typedConfig.id !== 'string') {
+            throw new PolicyValidationError('PolicyConfig.id must be a non-empty string');
+        }
+        if (!typedConfig.name || typeof typedConfig.name !== 'string') {
+            throw new PolicyValidationError('PolicyConfig.name must be a non-empty string');
+        }
+        if (!Array.isArray(typedConfig.rules)) {
+            throw new PolicyValidationError('PolicyConfig.rules must be an array');
+        }
+        this.validateStringLength(typedConfig.id, 'PolicyConfig.id');
+        this.validateStringLength(typedConfig.name, 'PolicyConfig.name');
+        this.validateArrayLength(typedConfig.rules, 'PolicyConfig.rules');
+        const validatedRules = typedConfig.rules.map((rule, index) => {
+            try {
+                return this.validatePolicyRule(rule);
+            }
+            catch (error) {
+                throw new PolicyValidationError(`PolicyConfig.rules[${index}]: ${error.message}`);
+            }
+        });
+        const sanitizedConfig = {
+            id: this.sanitizeString(typedConfig.id),
+            name: this.sanitizeString(typedConfig.name),
+            rules: validatedRules,
+            enabled: typeof typedConfig.enabled === 'boolean' ? typedConfig.enabled : true,
+        };
+        if (typedConfig.description) {
+            sanitizedConfig.description = this.sanitizeString(typedConfig.description);
+        }
+        if (typedConfig.version) {
+            sanitizedConfig.version = this.sanitizeString(typedConfig.version);
+        }
+        return sanitizedConfig;
+    }
+    validatePolicyRule(rule) {
+        if (!rule || typeof rule !== 'object') {
+            throw new PolicyValidationError('PolicyRule must be a non-null object');
+        }
+        const typedRule = rule;
+        if (!typedRule.id || typeof typedRule.id !== 'string') {
+            throw new PolicyValidationError('PolicyRule.id must be a non-empty string');
+        }
+        if (!typedRule.type || typeof typedRule.type !== 'string') {
+            throw new PolicyValidationError('PolicyRule.type must be a non-empty string');
+        }
+        if (!typedRule.condition || typeof typedRule.condition !== 'object') {
+            throw new PolicyValidationError('PolicyRule.condition must be an object');
+        }
+        this.validateStringLength(typedRule.id, 'PolicyRule.id');
+        this.validateStringLength(typedRule.type, 'PolicyRule.type');
+        this.validateObjectDepth(typedRule.condition, 'PolicyRule.condition');
+        const sanitizedRule = {
+            id: this.sanitizeString(typedRule.id),
+            type: this.sanitizeString(typedRule.type),
+            condition: this.sanitizeObject(typedRule.condition),
+            priority: typeof typedRule.priority === 'number' ? typedRule.priority : 0,
+            enabled: typeof typedRule.enabled === 'boolean' ? typedRule.enabled : true,
+        };
+        if (typedRule.action) {
+            sanitizedRule.action = this.sanitizeString(typedRule.action);
+        }
+        return sanitizedRule;
+    }
+    validatePolicyContext(context) {
+        if (!context || typeof context !== 'object') {
+            throw new PolicyValidationError('PolicyContext must be a non-null object');
+        }
+        const typedContext = context;
+        this.validateObjectDepth(typedContext, 'PolicyContext');
+        return this.sanitizeObject(typedContext);
+    }
+    validatePluginConfig(config) {
+        if (!config || typeof config !== 'object') {
+            throw new PolicyValidationError('PluginConfig must be a non-null object');
+        }
+        const typedConfig = config;
+        if (!typedConfig.name || typeof typedConfig.name !== 'string') {
+            throw new PolicyValidationError('PluginConfig.name must be a non-empty string');
+        }
+        this.validateStringLength(typedConfig.name, 'PluginConfig.name');
+        if (typedConfig.config && typeof typedConfig.config === 'object') {
+            this.validateObjectDepth(typedConfig.config, 'PluginConfig.config');
+        }
+        const sanitizedConfig = {
+            name: this.sanitizeString(typedConfig.name),
+            enabled: typeof typedConfig.enabled === 'boolean' ? typedConfig.enabled : true,
+        };
+        if (typedConfig.version) {
+            sanitizedConfig.version = this.sanitizeString(typedConfig.version);
+        }
+        if (typedConfig.config) {
+            sanitizedConfig.config = this.sanitizeObject(typedConfig.config);
+        }
+        return sanitizedConfig;
+    }
+    validateStringLength(value, fieldName) {
+        if (value.length > this.options.maxStringLength) {
+            throw new PolicyValidationError(`${fieldName} exceeds maximum length of ${this.options.maxStringLength} characters`);
+        }
+    }
+    validateArrayLength(value, fieldName) {
+        if (value.length > this.options.maxArrayLength) {
+            throw new PolicyValidationError(`${fieldName} exceeds maximum length of ${this.options.maxArrayLength} items`);
+        }
+    }
+    validateObjectDepth(obj, fieldName, currentDepth = 0) {
+        if (currentDepth > this.options.maxObjectDepth) {
+            throw new PolicyValidationError(`${fieldName} exceeds maximum object depth of ${this.options.maxObjectDepth}`);
+        }
+        for (const [key, value] of Object.entries(obj)) {
+            if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+                this.validateObjectDepth(value, `${fieldName}.${key}`, currentDepth + 1);
+            }
+        }
+    }
+    sanitizeString(value) {
+        if (!this.options.sanitizeStrings) {
+            return value;
+        }
+        let sanitized = value
+            .replace(/\0/g, '')
+            .split('')
+            .filter((char) => {
+            const code = char.charCodeAt(0);
+            return code > 31 && code !== 127;
+        })
+            .join('');
+        sanitized = sanitized.trim();
+        return sanitized;
+    }
+    sanitizeObject(obj) {
+        const sanitized = {};
+        for (const [key, value] of Object.entries(obj)) {
+            const sanitizedKey = this.sanitizeString(key);
+            if (typeof value === 'string') {
+                sanitized[sanitizedKey] = this.sanitizeString(value);
+            }
+            else if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+                sanitized[sanitizedKey] = this.sanitizeObject(value);
+            }
+            else if (Array.isArray(value)) {
+                sanitized[sanitizedKey] = value.map((item) => typeof item === 'string'
+                    ? this.sanitizeString(item)
+                    : typeof item === 'object' && item !== null
+                        ? this.sanitizeObject(item)
+                        : item);
+            }
+            else {
+                sanitized[sanitizedKey] = value;
+            }
+        }
+        return sanitized;
+    }
+}
+export const defaultValidator = new InputValidator();
+export const validatePolicyConfig = (config) => defaultValidator.validatePolicyConfig(config);
+export const validatePolicyRule = (rule) => defaultValidator.validatePolicyRule(rule);
+export const validatePolicyContext = (context) => defaultValidator.validatePolicyContext(context);
+export const validatePluginConfig = (config) => defaultValidator.validatePluginConfig(config);

package/dist/types/index.d.ts

@@ -0,0 +1,27 @@
+export interface PolicyConfig {
+    id: string;
+    name: string;
+    rules: PolicyRule[];
+    description?: string;
+    version?: string;
+    enabled?: boolean;
+}
+export interface PolicyRule {
+    id: string;
+    type: string;
+    condition: Record<string, unknown>;
+    action?: string;
+    priority?: number;
+    enabled?: boolean;
+}
+export interface PolicyContext {
+    environment?: string;
+    metadata?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+export interface PluginConfig {
+    name: string;
+    version?: string;
+    config?: Record<string, unknown>;
+    enabled?: boolean;
+}

package/dist/types/index.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "timonel",
   "type": "module",
-  "version": "3.0.0",
+  "version": "3.1.0",
   "description": "Timonel: programmatic Helm chart generator using cdk8s (TypeScript)",
   "bin": {
     "timonel": "dist/cli.js",
@@ -59,6 +59,8 @@
     "test:integration": "vitest run --config vitest.integration.config.ts",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
+    "doc:coverage": "tsx scripts/project-doc-coverage.ts",
+    "doc:coverage:validate": "tsx scripts/validate-doc-coverage.ts",
     "ci:check": "pnpm typecheck && pnpm lint && pnpm format:check && pnpm build",
     "release": "semantic-release",
     "release:dry": "semantic-release --dry-run",
@@ -100,28 +102,28 @@
     ]
   },
   "dependencies": {
-    "cdk8s": "^2.70.28",
-    "cdk8s-plus-33": "^2.4.6",
-    "constructs": "^10.4.3",
+    "cdk8s": "^2.70.42",
+    "cdk8s-plus-33": "^2.4.19",
+    "constructs": "^10.4.4",
     "handlebars": "^4.7.8",
-    "pino": "^10.1.0",
-    "pino-pretty": "^13.1.2",
+    "pino": "^10.1.1",
+    "pino-pretty": "^13.1.3",
     "ts-node": "^10.9.2",
-    "yaml": "^2.8.1"
+    "yaml": "^2.8.2"
   },
   "devDependencies": {
-    "@commitlint/cli": "^20.1.0",
-    "@commitlint/config-conventional": "^20.0.0",
-    "@eslint/js": "^9.39.1",
+    "@commitlint/cli": "^20.3.1",
+    "@commitlint/config-conventional": "^20.3.1",
+    "@eslint/js": "^9.39.2",
     "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/exec": "^7.1.0",
     "@semantic-release/git": "^10.0.1",
-    "@types/node": "^24.10.1",
-    "@typescript-eslint/eslint-plugin": "^8.47.0",
-    "@typescript-eslint/parser": "^8.47.0",
-    "@vitest/coverage-v8": "^3.2.4",
+    "@types/node": "^25.0.5",
+    "@typescript-eslint/eslint-plugin": "^8.52.0",
+    "@typescript-eslint/parser": "^8.52.0",
+    "@vitest/coverage-v8": "^4.0.16",
     "conventional-changelog-cli": "^5.0.0",
-    "eslint": "^9.39.1",
+    "eslint": "^9.39.2",
     "eslint-config-prettier": "^10.1.8",
     "eslint-import-resolver-typescript": "^4.4.4",
     "eslint-plugin-import": "^2.32.0",
@@ -130,13 +132,13 @@
     "eslint-plugin-unused-imports": "^4.3.0",
     "husky": "^9.1.7",
     "lint-staged": "^16.2.7",
-    "markdownlint": "^0.39.0",
-    "markdownlint-cli": "^0.46.0",
-    "prettier": "^3.6.2",
+    "markdownlint": "^0.40.0",
+    "markdownlint-cli": "^0.47.0",
+    "prettier": "^3.7.4",
     "semantic-release": "^25.0.2",
-    "tsx": "^4.20.6",
+    "tsx": "^4.21.0",
     "typescript": "^5.9.3",
-    "vitest": "^3.2.4"
+    "vitest": "^4.0.16"
   },
   "files": [
     "dist",