cloudmap 1.3.0__tar.gz → 1.3.2__tar.gz

{cloudmap-1.3.0 → cloudmap-1.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cloudmap
-Version: 1.3.0
+Version: 1.3.2
 Summary: Trace the blast radius of an Azure resource: one name in, a verified dependency graph out.
 Project-URL: Homepage, https://github.com/KatsaounisThanasis/cloudmap
 Project-URL: Repository, https://github.com/KatsaounisThanasis/cloudmap
@@ -92,10 +92,10 @@ pip install -e ".[dev]" && pytest
 
 ## 60-second demo
 
-No Azure account needed - the repo ships a synthetic estate:
+No Azure account needed - a synthetic estate ships inside the package:
 
 ```
-cloudmap trace contoso-web --from fixtures/contoso.json -o contoso-web.drawio
+cloudmap trace contoso-web --from demo -o contoso-web.drawio
 ```
 
 ```text
@@ -241,7 +241,7 @@ going outward, and their value is the reverse view (`--direction up`).
 ## Ask a map questions
 
 ```
-$ cloudmap trace contoso-web --from fixtures/contoso.json --level detail --json out.json
+$ cloudmap trace contoso-web --from demo --level detail --json out.json
 $ cloudmap ask out.json "what breaks if I touch contoso-kv"
 Query: impact  ·  subject: contoso-kv
 2 resource(s) depend on contoso-kv - changing it can break them.

{cloudmap-1.3.0 → cloudmap-1.3.2}/README.md

@@ -58,10 +58,10 @@ pip install -e ".[dev]" && pytest
 
 ## 60-second demo
 
-No Azure account needed - the repo ships a synthetic estate:
+No Azure account needed - a synthetic estate ships inside the package:
 
 ```
-cloudmap trace contoso-web --from fixtures/contoso.json -o contoso-web.drawio
+cloudmap trace contoso-web --from demo -o contoso-web.drawio
 ```
 
 ```text
@@ -207,7 +207,7 @@ going outward, and their value is the reverse view (`--direction up`).
 ## Ask a map questions
 
 ```
-$ cloudmap trace contoso-web --from fixtures/contoso.json --level detail --json out.json
+$ cloudmap trace contoso-web --from demo --level detail --json out.json
 $ cloudmap ask out.json "what breaks if I touch contoso-kv"
 Query: impact  ·  subject: contoso-kv
 2 resource(s) depend on contoso-kv - changing it can break them.

{cloudmap-1.3.0 → cloudmap-1.3.2}/cloudmap/__init__.py

@@ -1,3 +1,3 @@
 """cloudmap - trace an Azure resource's full dependency graph and export it."""
 
-__version__ = "1.3.0"
+__version__ = "1.3.2"

{cloudmap-1.3.0 → cloudmap-1.3.2}/cloudmap/ask/__init__.py

@@ -25,7 +25,8 @@ def answer(graph, question, allow_llm_intent=False, max_hops=None, model=None):
     if plan is None and allow_llm_intent:
         plan = llm_parse(question, graph, model=model)
     if plan is None:
-        result = _error("I could not turn that into a query over this map.")
+        result = _error("I could not turn that into a query over this map. "
+                        "(Questions are matched in English.)")
     else:
         result = _run(graph, plan, max_hops=max_hops)
     result["question"] = question
@@ -67,10 +68,10 @@ def _no_subject(graph, default):
         return default
     groups = sorted({n.name for n in graph.nodes.values()
                      if str(n.id).startswith(HIGH_LEVEL_PREFIXES)})
-    return ("This map is the high-level view: resources are grouped into one box per "
-            "type, so instance names do not exist in it. Ask about a group instead "
-            f"({', '.join(groups[:6])}{', ...' if len(groups) > 6 else ''}), or re-run "
-            "the trace with --level detail to keep instance names.")
+    return ("This map is the high-level view: types with several instances are "
+            "grouped into one box, so that name is not on it. Ask about a group "
+            f"instead ({', '.join(groups[:6])}{', ...' if len(groups) > 6 else ''}), "
+            "or re-run the trace with --level detail to keep every instance name.")
 
 
 def _error(message, query=None):

{cloudmap-1.3.0 → cloudmap-1.3.2}/cloudmap/cli.py

@@ -36,7 +36,7 @@ def main(argv=None):
     t = sub.add_parser("trace", help="trace a component's blast radius")
     t.add_argument("name", help="resource name (or substring) to seed from")
     src = t.add_mutually_exclusive_group(required=True)
-    src.add_argument("--from", dest="fixture", help="path to a Resource Graph JSON fixture")
+    src.add_argument("--from", dest="fixture", help="path to a Resource Graph JSON fixture, or \"demo\" for the built-in synthetic estate")
     src.add_argument("--live", action="store_true", help="query live Azure (guarded, opt-in)")
     t.add_argument("--allow-live", action="store_true", help="required together with --live")
     t.add_argument("--single-sub", action="store_true",
@@ -125,7 +125,22 @@ def _cmd_trace(args):
     else:
         from .adapters import load_graph
         resources = []
-        graph = load_graph(args.fixture)   # auto-detects raw export vs neutral cloudmap graph
+        fixture = args.fixture
+        if fixture == "demo":
+            # the packaged synthetic estate, so `pip install cloudmap` can try the
+            # tool in one command without cloning the repo for fixtures/
+            import importlib.resources as ir
+            fixture = str(ir.files("cloudmap").joinpath("data/contoso.json"))
+        try:
+            graph = load_graph(fixture)   # auto-detects raw export vs neutral cloudmap graph
+        except FileNotFoundError:
+            print(f"cloudmap: fixture '{args.fixture}' does not exist. Point --from at a "
+                  f"capture/fixture file, or try the built-in demo estate: --from demo",
+                  file=sys.stderr)
+            return 2
+        except ValueError as e:            # json.JSONDecodeError is a ValueError
+            print(f"cloudmap: '{args.fixture}' is not valid JSON ({e}).", file=sys.stderr)
+            return 2
         # A re-traced capture keeps its own honesty flags: a scan that was
         # truncated at capture time must not become a map that claims
         # completeness just because it was re-read from disk.
@@ -135,12 +150,24 @@ def _cmd_trace(args):
 
     seeds = find_seeds(graph, args.name)
     if not seeds:
-        print(f"No resource matched '{args.name}'.", file=sys.stderr)
+        scope = (("this subscription" if args.single_sub else "every enabled subscription")
+                 if args.live else f"'{args.fixture}'")
+        print(f"No resource matched '{args.name}' among the {len(graph.nodes)} resources "
+              f"scanned in {scope}. Matching is case-insensitive and substrings count. "
+              + ("If it lives in another subscription, drop --single-sub."
+                 if args.live and args.single_sub else ""), file=sys.stderr)
         return 2
     if len(seeds) > 1:
-        print(f"'{args.name}' is ambiguous. Matches:", file=sys.stderr)
-        for s in seeds:
-            print(f"  - {graph.nodes[s].name}  ({graph.nodes[s].type})", file=sys.stderr)
+        # Same name, same type is the common case (one app per environment), so
+        # the name+type line was two identical rows: show what actually differs
+        # and say how to proceed.
+        print(f"'{args.name}' matches {len(seeds)} resources:", file=sys.stderr)
+        for sid in seeds:
+            n = graph.nodes[sid]
+            rg = f"  rg: {n.resource_group}" if n.resource_group else ""
+            print(f"  - {n.name}  ({n.type}){rg}\n      {sid}", file=sys.stderr)
+        print("Re-run with the full id as the seed to pick one, e.g.:\n"
+              f"  cloudmap trace \"{seeds[0]}\" ...", file=sys.stderr)
         return 2
     seed = seeds[0]
 
@@ -206,10 +233,16 @@ def _export_outputs(sub, seed, args, meta):
         args.html_out = args.html_out or os.path.join(target_dir, f"{name}.html")
         args.csv_out = args.csv_out or os.path.join(target_dir, f"{name}.csv")
 
-    out = args.out or f"{name}.blast.drawio"
-    _ensure_parent(out)
-    with open(out, "w", encoding="utf-8") as f:
-        f.write(to_drawio(sub, seed))
+    # draw.io is the default artifact, not a mandatory one: if the user asked
+    # for specific format(s) and not for draw.io, do not surprise them with a
+    # stray .blast.drawio in the working directory.
+    other_asked = any([args.mermaid, args.json_out, args.html_out,
+                       getattr(args, "csv_out", None)])
+    out = args.out or (None if other_asked else f"{name}.blast.drawio")
+    if out:
+        _ensure_parent(out)
+        with open(out, "w", encoding="utf-8") as f:
+            f.write(to_drawio(sub, seed))
     if args.mermaid:
         _ensure_parent(args.mermaid)
         with open(args.mermaid, "w", encoding="utf-8") as f:
@@ -627,7 +660,8 @@ def _print_summary(graph, seed, out, truncated=False, blind_spots=(), single_sub
         if up:
             console.print(Panel(_build_tree(seed, set(), upward=True),
                                 title=f"What depends on it ({len(up)})", border_style="magenta"))
-        console.print(f"🔗 [bold]draw.io:[/bold] {out}\n")
+        if out:
+            console.print(f"🔗 [bold]draw.io:[/bold] {out}\n")
     else:
         print(f"Seed: {n.name} ({n.type})")
         print(f"Blast radius: {len(graph.nodes)} resources "
@@ -636,7 +670,8 @@ def _print_summary(graph, seed, out, truncated=False, blind_spots=(), single_sub
             print("INCOMPLETE: scan hit the pagination cap - some resources/edges are missing.")
         for spot in blind_spots:
             print(f"BLIND SPOT: {spot}")
-        print(f"draw.io: {out}\n")
+        if out:
+            print(f"draw.io: {out}\n")
         for e in graph.edges:
             tgt = graph.nodes[e.target]
             tag = "  [external]" if tgt.external else ""

{cloudmap-1.3.0 → cloudmap-1.3.2}/cloudmap/graph.py

@@ -101,14 +101,25 @@ def collapse_high_level(graph, seed_id):
         if gkey == seed_id:
             new_nodes[gkey] = rep
         else:
-            label = rep.type.split("/", 1)[-1] if rep.external else friendly_type(rep.type)
-            if len(members) > 1:
-                label += f" ×{len(members)}"
+            role = rep.type.split("/", 1)[-1] if rep.external else friendly_type(rep.type)
+            # Grouping exists for readability, not anonymity: when a "group" has
+            # exactly one member, hiding its name buys nothing and costs the one
+            # thing the reader needs - WHICH vault, WHICH workspace this is.
+            if len(members) == 1:
+                label = rep.name or role
+            else:
+                label = f"{role} ×{len(members)}"
             # an external group keeps its members' reasons: "why is this unverified"
             # must not be lost to grouping either
             note = ""
             for m in members:
                 note = _merge_semis(note, graph.nodes[m].note)
+            if len(members) > 1:
+                # the instance names survive collapsing - on hover in the HTML
+                # viewer, in the drawio tooltip and in `ask` answers
+                shown = sorted(graph.nodes[m].name for m in members)[:8]
+                more = "" if len(members) <= 8 else f", +{len(members) - 8} more"
+                note = _merge_semis(note, "instances: " + ", ".join(shown) + more)
             new_nodes[gkey] = Node(id=gkey, name=label, type=rep.type,
                                    external=rep.external, note=note)
         distances[gkey] = dist

{cloudmap-1.3.0 → cloudmap-1.3.2}/cloudmap/ingest/azure.py

@@ -31,8 +31,11 @@ def _az(args):
     # If the user pinned a specific subscription (e.g. cross-tenant QA sub),
     # force the CLI to use that context for every command to avoid "Given: ''" errors.
     pin = os.environ.get("CLOUDMAP_ALLOW_SUBSCRIPTION", "").strip()
-    if pin and "--subscription" not in cmd and not (args[0] == "account" and len(args) > 1 and args[1] == "list"):
-        # az account list does not accept --subscription
+    # `account list` does not accept --subscription, and `account show` must
+    # report the ACTUAL active subscription: injecting the pin there made the
+    # guard compare the pin to itself, and a mismatched pin surfaced as a bogus
+    # "you are not logged in" - the exact wrong diagnosis for a security knob.
+    if pin and "--subscription" not in cmd and args[0] != "account":
         cmd += ["--subscription", pin]
             
     try:

{cloudmap-1.3.0 → cloudmap-1.3.2}/cloudmap/render/html.py

@@ -138,6 +138,9 @@ _TEMPLATE = r"""<!doctype html>
   .sw{width:22px;height:0;border-top:1.6px solid var(--edge)}
   .sw.model{border-top:2px dashed var(--model)}
   .sw.box{width:12px;height:12px;border:2px solid var(--seed);border-radius:3px}
+  .sw.observes{border-top:1.6px dashed #9aa4ae}
+  .sw.sec{border-top:1.6px solid #d18f00}
+  .sw.data{border-top:1.6px solid #1a7f37}
   aside{width:340px;background:var(--card);border-left:1px solid var(--line);background:var(--card);
         padding:18px;overflow:auto}
   aside.empty .detail{display:none}
@@ -236,11 +239,14 @@ _TEMPLATE = r"""<!doctype html>
     <div class="legend">
       <span class="lg"><span class="sw"></span> verified</span>
       <span class="lg"><span class="sw model"></span> model guess</span>
+      <span class="lg"><span class="sw observes"></span> observes</span>
+      <span class="lg"><span class="sw sec"></span> security</span>
+      <span class="lg"><span class="sw data"></span> data</span>
       <span class="lg"><span class="sw box"></span> seed</span>
     </div>
   </div>
   <aside id="panel" class="empty">
-    <div class="hint">Click a resource to focus its blast radius. Scroll to zoom, drag to pan.</div>
+    <div class="hint">Click a resource to focus its blast radius - a grouped box (×N) lists its instances there. Scroll to zoom, drag to pan.</div>
     <div class="detail"></div>
   </aside>
 </div>
@@ -280,13 +286,20 @@ function catInfo(type){
 
 document.getElementById("seedName").textContent="— "+DATA.seedName;
 (function(){const m=DATA.meta,b=document.getElementById("badges");
-  const add=(txt,cls,title)=>{const s=document.createElement("span");s.className="badge "+(cls||"");s.textContent=txt;if(title)s.title=title;b.appendChild(s);};
+  const add=(txt,cls,title,onclick)=>{const s=document.createElement("span");s.className="badge "+(cls||"");s.textContent=txt;if(title)s.title=title;if(onclick){s.style.cursor="pointer";s.onclick=onclick;}b.appendChild(s);return s;};
   add(m.nodes+" resources");add(m.edges+" dependencies");
   if(m.external)add(m.external+" external","warn");
   if(m.model_edges)add(m.model_edges+" model","warn");
-  // why it is incomplete travels with the badge, so the reader never has to guess
+  // Why it is incomplete must be one click away, not hidden behind a hover
+  // nobody knows exists: the badge opens the explanation in the side panel.
   const why=[].concat(m.truncated?["scan hit the pagination cap"]:[],m.read_gaps||[],m.blind_spots||[]);
-  add(m.complete?"complete":"INCOMPLETE",m.complete?"ok":"warn",why.join("\n\n"));
+  if(m.complete){add("complete","ok");}
+  else{add("INCOMPLETE ⓘ","warn",why.join("\n\n"),()=>{
+    document.getElementById("panel").innerHTML =
+      "<h3>Why this map is incomplete</h3>"+
+      why.map(w=>"<p>"+esc(w)+"</p>").join("")+
+      "<p class=\"hint\">Incomplete means known-missing, not wrong: these are the reads the scan could not or did not make.</p>";
+  });}
 })();
 
 // ---- layout: radial blast ----
@@ -395,7 +408,7 @@ DATA.nodes.forEach(n=>{
   if(icon){
     g.appendChild(icon);
     const t1=el("text",{x:NW/2,y:ICON+22,class:"nname","text-anchor":"middle"});
-    t1.textContent=n.name;g.appendChild(t1);
+    t1.textContent=n.name.length>24?n.name.slice(0,23)+"…":n.name;g.appendChild(t1);  // full name in the tooltip
     const t2=el("text",{x:NW/2,y:ICON+37,class:"ntype","text-anchor":"middle"});
     t2.textContent=shortType(n.type);g.appendChild(t2);
   }else{

cloudmap-1.3.2/fixtures/contoso.json

@@ -0,0 +1,216 @@
+{
+  "note": "100% synthetic fixture. Fake subscription/tenant/principal ids. No real cloud data. Mirrors `az graph query -q resources -o json` output shape.",
+  "count": 15,
+  "data": [
+    {
+      "id": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-app/providers/Microsoft.Web/sites/contoso-web",
+      "name": "contoso-web",
+      "type": "microsoft.web/sites",
+      "resourceGroup": "rg-contoso-app",
+      "subscriptionId": "11111111-1111-1111-1111-111111111111",
+      "location": "westeurope",
+      "kind": "app,linux",
+      "identity": {"type": "SystemAssigned", "principalId": "10000000-0000-0000-0000-000000000001"},
+      "tags": {"app": "contoso", "env": "prod"},
+      "properties": {
+        "serverFarmId": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-app/providers/Microsoft.Web/serverfarms/contoso-plan",
+        "virtualNetworkSubnetId": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-network/providers/Microsoft.Network/virtualNetworks/contoso-vnet/subnets/snet-app",
+        "defaultHostName": "contoso-web.azurewebsites.net",
+        "siteConfig": {
+          "appSettings": [
+            {"name": "KeyVaultSecret", "value": "@Microsoft.KeyVault(SecretUri=https://contoso-kv.vault.azure.net/secrets/db-password/)"},
+            {"name": "SqlConnection", "value": "Server=tcp:contoso-sql.database.windows.net,1433;Initial Catalog=appdb;Authentication=Active Directory Managed Identity;"},
+            {"name": "StorageConnection", "value": "BlobEndpoint=https://contosostg.blob.core.windows.net/;AccountName=contosostg;"},
+            {"name": "APPLICATIONINSIGHTS_CONNECTION_STRING", "value": "InstrumentationKey=aaaa1111-bbbb-2222-cccc-333344445555;IngestionEndpoint=https://westeurope-5.in.applicationinsights.azure.com/"}
+          ]
+        }
+      }
+    },
+    {
+      "id": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-app/providers/Microsoft.Web/serverfarms/contoso-plan",
+      "name": "contoso-plan",
+      "type": "microsoft.web/serverfarms",
+      "resourceGroup": "rg-contoso-app",
+      "subscriptionId": "11111111-1111-1111-1111-111111111111",
+      "location": "westeurope",
+      "kind": "linux",
+      "properties": {"sku": {"name": "P1v3", "tier": "PremiumV3"}}
+    },
+    {
+      "id": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-network/providers/Microsoft.Network/virtualNetworks/contoso-vnet",
+      "name": "contoso-vnet",
+      "type": "microsoft.network/virtualNetworks",
+      "resourceGroup": "rg-contoso-network",
+      "subscriptionId": "11111111-1111-1111-1111-111111111111",
+      "location": "westeurope",
+      "properties": {
+        "addressSpace": {"addressPrefixes": ["10.10.0.0/16"]},
+        "subnets": [
+          {"name": "snet-app", "id": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-network/providers/Microsoft.Network/virtualNetworks/contoso-vnet/subnets/snet-app"},
+          {"name": "snet-pe", "id": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-network/providers/Microsoft.Network/virtualNetworks/contoso-vnet/subnets/snet-pe"},
+          {"name": "snet-aks", "id": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-network/providers/Microsoft.Network/virtualNetworks/contoso-vnet/subnets/snet-aks"},
+          {"name": "snet-agw", "id": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-network/providers/Microsoft.Network/virtualNetworks/contoso-vnet/subnets/snet-agw"}
+        ]
+      }
+    },
+    {
+      "id": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-shared/providers/Microsoft.KeyVault/vaults/contoso-kv",
+      "name": "contoso-kv",
+      "type": "microsoft.keyvault/vaults",
+      "resourceGroup": "rg-contoso-shared",
+      "subscriptionId": "11111111-1111-1111-1111-111111111111",
+      "location": "westeurope",
+      "properties": {"vaultUri": "https://contoso-kv.vault.azure.net/", "enableRbacAuthorization": true}
+    },
+    {
+      "id": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-network/providers/Microsoft.Network/privateEndpoints/pe-kv",
+      "name": "pe-kv",
+      "type": "microsoft.network/privateEndpoints",
+      "resourceGroup": "rg-contoso-network",
+      "subscriptionId": "11111111-1111-1111-1111-111111111111",
+      "location": "westeurope",
+      "properties": {
+        "subnet": {"id": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-network/providers/Microsoft.Network/virtualNetworks/contoso-vnet/subnets/snet-pe"},
+        "privateLinkServiceConnections": [
+          {"name": "kvconn", "properties": {"privateLinkServiceId": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-shared/providers/Microsoft.KeyVault/vaults/contoso-kv", "groupIds": ["vault"]}}
+        ]
+      }
+    },
+    {
+      "id": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-data/providers/Microsoft.Sql/servers/contoso-sql",
+      "name": "contoso-sql",
+      "type": "microsoft.sql/servers",
+      "resourceGroup": "rg-contoso-data",
+      "subscriptionId": "11111111-1111-1111-1111-111111111111",
+      "location": "westeurope",
+      "properties": {"fullyQualifiedDomainName": "contoso-sql.database.windows.net", "version": "12.0"}
+    },
+    {
+      "id": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-network/providers/Microsoft.Network/privateEndpoints/pe-sql",
+      "name": "pe-sql",
+      "type": "microsoft.network/privateEndpoints",
+      "resourceGroup": "rg-contoso-network",
+      "subscriptionId": "11111111-1111-1111-1111-111111111111",
+      "location": "westeurope",
+      "properties": {
+        "subnet": {"id": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-network/providers/Microsoft.Network/virtualNetworks/contoso-vnet/subnets/snet-pe"},
+        "privateLinkServiceConnections": [
+          {"name": "sqlconn", "properties": {"privateLinkServiceId": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-data/providers/Microsoft.Sql/servers/contoso-sql", "groupIds": ["sqlServer"]}}
+        ]
+      }
+    },
+    {
+      "id": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-data/providers/Microsoft.Storage/storageAccounts/contosostg",
+      "name": "contosostg",
+      "type": "microsoft.storage/storageAccounts",
+      "resourceGroup": "rg-contoso-data",
+      "subscriptionId": "11111111-1111-1111-1111-111111111111",
+      "location": "westeurope",
+      "kind": "StorageV2",
+      "properties": {"primaryEndpoints": {"blob": "https://contosostg.blob.core.windows.net/"}}
+    },
+    {
+      "id": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-network/providers/Microsoft.Network/privateEndpoints/pe-stg",
+      "name": "pe-stg",
+      "type": "microsoft.network/privateEndpoints",
+      "resourceGroup": "rg-contoso-network",
+      "subscriptionId": "11111111-1111-1111-1111-111111111111",
+      "location": "westeurope",
+      "properties": {
+        "subnet": {"id": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-network/providers/Microsoft.Network/virtualNetworks/contoso-vnet/subnets/snet-pe"},
+        "privateLinkServiceConnections": [
+          {"name": "stgconn", "properties": {"privateLinkServiceId": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-data/providers/Microsoft.Storage/storageAccounts/contosostg", "groupIds": ["blob"]}}
+        ]
+      }
+    },
+    {
+      "id": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-shared/providers/Microsoft.Insights/components/contoso-appi",
+      "name": "contoso-appi",
+      "type": "microsoft.insights/components",
+      "resourceGroup": "rg-contoso-shared",
+      "subscriptionId": "11111111-1111-1111-1111-111111111111",
+      "location": "westeurope",
+      "kind": "web",
+      "properties": {
+        "InstrumentationKey": "aaaa1111-bbbb-2222-cccc-333344445555",
+        "WorkspaceResourceId": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-shared/providers/Microsoft.OperationalInsights/workspaces/contoso-law"
+      }
+    },
+    {
+      "id": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-shared/providers/Microsoft.OperationalInsights/workspaces/contoso-law",
+      "name": "contoso-law",
+      "type": "microsoft.operationalinsights/workspaces",
+      "resourceGroup": "rg-contoso-shared",
+      "subscriptionId": "11111111-1111-1111-1111-111111111111",
+      "location": "westeurope",
+      "properties": {"sku": {"name": "PerGB2018"}}
+    },
+    {
+      "id": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-network/providers/Microsoft.Network/applicationGateways/contoso-agw",
+      "name": "contoso-agw",
+      "type": "microsoft.network/applicationGateways",
+      "resourceGroup": "rg-contoso-network",
+      "subscriptionId": "11111111-1111-1111-1111-111111111111",
+      "location": "westeurope",
+      "properties": {
+        "gatewayIPConfigurations": [
+          {"name": "agwip", "properties": {"subnet": {"id": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-network/providers/Microsoft.Network/virtualNetworks/contoso-vnet/subnets/snet-agw"}}}
+        ],
+        "backendAddressPools": [
+          {"name": "webpool", "properties": {"backendAddresses": [{"fqdn": "contoso-web.azurewebsites.net"}]}}
+        ]
+      }
+    },
+    {
+      "id": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-app/providers/Microsoft.ContainerService/managedClusters/contoso-aks",
+      "name": "contoso-aks",
+      "type": "microsoft.containerservice/managedClusters",
+      "resourceGroup": "rg-contoso-app",
+      "subscriptionId": "11111111-1111-1111-1111-111111111111",
+      "location": "westeurope",
+      "identity": {"type": "SystemAssigned", "principalId": "10000000-0000-0000-0000-000000000002"},
+      "properties": {
+        "nodeResourceGroup": "mc_rg-contoso-app_contoso-aks_westeurope",
+        "agentPoolProfiles": [
+          {"name": "system", "vnetSubnetID": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-network/providers/Microsoft.Network/virtualNetworks/contoso-vnet/subnets/snet-aks"}
+        ],
+        "addonProfiles": {
+          "omsagent": {"enabled": true, "config": {"logAnalyticsWorkspaceResourceID": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-shared/providers/Microsoft.OperationalInsights/workspaces/contoso-law"}}
+        }
+      }
+    },
+    {
+      "id": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-shared/providers/Microsoft.ContainerRegistry/registries/contosoacr",
+      "name": "contosoacr",
+      "type": "microsoft.containerregistry/registries",
+      "resourceGroup": "rg-contoso-shared",
+      "subscriptionId": "11111111-1111-1111-1111-111111111111",
+      "location": "westeurope",
+      "properties": {"loginServer": "contosoacr.azurecr.io"}
+    },
+    {
+      "id": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-shared/providers/Microsoft.Authorization/roleAssignments/ra-web-kv",
+      "name": "ra-web-kv",
+      "type": "microsoft.authorization/roleAssignments",
+      "resourceGroup": "rg-contoso-shared",
+      "subscriptionId": "11111111-1111-1111-1111-111111111111",
+      "properties": {
+        "principalId": "10000000-0000-0000-0000-000000000001",
+        "roleDefinitionId": "/subscriptions/11111111-1111-1111-1111-111111111111/providers/Microsoft.Authorization/roleDefinitions/4633458b-17de-408a-b874-0445c86b69e6",
+        "scope": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-shared/providers/Microsoft.KeyVault/vaults/contoso-kv"
+      }
+    },
+    {
+      "id": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-shared/providers/Microsoft.Authorization/roleAssignments/ra-aks-acr",
+      "name": "ra-aks-acr",
+      "type": "microsoft.authorization/roleAssignments",
+      "resourceGroup": "rg-contoso-shared",
+      "subscriptionId": "11111111-1111-1111-1111-111111111111",
+      "properties": {
+        "principalId": "10000000-0000-0000-0000-000000000002",
+        "roleDefinitionId": "/subscriptions/11111111-1111-1111-1111-111111111111/providers/Microsoft.Authorization/roleDefinitions/7f951dda-4ed3-4680-a7ca-43fe172d538d",
+        "scope": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-contoso-shared/providers/Microsoft.ContainerRegistry/registries/contosoacr"
+      }
+    }
+  ]
+}

{cloudmap-1.3.0 → cloudmap-1.3.2}/tests/test_ask.py

@@ -343,18 +343,45 @@ def test_warnings_stay_quiet_on_a_clean_map():
     assert warnings(graph) == []
 
 
-def test_high_level_map_explains_itself_instead_of_stonewalling():
-    # The default trace writes the collapsed view, so this is the error people
-    # actually hit: the vault IS on their diagram, inside a "Key Vault" box, and
-    # "name a resource from this map" sends them hunting for a typo.
+def test_a_singleton_group_keeps_its_name_so_asking_about_it_just_works():
+    # Grouping is for readability, not anonymity: with one vault in the map,
+    # the box carries its real name and the question answers directly.
     graph, seed = _real()
     collapsed = collapse_high_level(blast_radius(graph, seed), seed)
     res = answer(collapsed, "what breaks if I touch kv-orders-dev")
 
+    assert not res.get("error")
+    assert res["subject_name"] == "kv-orders-dev"
+
+
+def test_high_level_map_explains_itself_instead_of_stonewalling():
+    # With SEVERAL vaults the box really is anonymous ("Key Vault ×2"), so this
+    # is the error people actually hit: the vault IS on their diagram, inside
+    # the group box, and "name a resource" sends them hunting for a typo.
+    S = "/subscriptions/s/resourcegroups/rg/providers"
+    rows = [
+        {"id": f"{S}/microsoft.web/sites/web", "name": "web", "type": "microsoft.web/sites",
+         "properties": {"siteConfig": {"appSettings": [
+             {"name": "A", "value": "https://kv-orders-dev.vault.azure.net/"},
+             {"name": "B", "value": "https://kv-payments-dev.vault.azure.net/"}]}}},
+        {"id": f"{S}/microsoft.keyvault/vaults/kv-orders-dev", "name": "kv-orders-dev",
+         "type": "microsoft.keyvault/vaults",
+         "properties": {"vaultUri": "https://kv-orders-dev.vault.azure.net/"}},
+        {"id": f"{S}/microsoft.keyvault/vaults/kv-payments-dev", "name": "kv-payments-dev",
+         "type": "microsoft.keyvault/vaults",
+         "properties": {"vaultUri": "https://kv-payments-dev.vault.azure.net/"}},
+    ]
+    graph = build_graph(rows)
+    seed = find_seeds(graph, "web")[0]
+    collapsed = collapse_high_level(blast_radius(graph, seed), seed)
+    res = answer(collapsed, "what breaks if I touch kv-orders-dev")
+
     assert res["error"]
     assert "high-level view" in res["error"]
     assert "--level detail" in res["error"]
-    assert "Key Vault" in res["error"]            # names a group they can actually ask about
+    assert "Key Vault ×2" in res["error"]         # names a group they can actually ask about
+    grouped = next(n for n in collapsed.nodes.values() if "×2" in n.name)
+    assert "kv-orders-dev" in grouped.note        # the names survive in the note
 
 
 def test_high_level_map_warns_that_counts_are_per_type():

{cloudmap-1.3.0 → cloudmap-1.3.2}/tests/test_cli_exports.py

@@ -142,7 +142,9 @@ def test_a_live_trace_seeded_by_arm_id_renders_valid_xml(tmp_path, monkeypatch):
     labels = {o.get("label") for o in ET.parse(tmp_path / "map.drawio").getroot().iter("object")}
 
     assert "web (sites)" in labels
-    assert "Key Vault (vaults)" in labels           # default view groups by type
+    # the default view groups by type, but a group of ONE keeps its name -
+    # a box saying just "Key Vault" answers the wrong question (which one?)
+    assert "kv-1 (vaults)" in labels
 
 
 def _capture_stubs(monkeypatch, rows, truncated=False):
@@ -326,3 +328,64 @@ def test_an_observer_is_labelled_as_observing_rather_than_depending(tmp_path, ca
     out = _summary_of(rows, "st", tmp_path, capsys)
 
     assert "observes" in out and "alert" in out
+
+
+# --- first-hour UX: the answers a new user actually hits --------------------------
+
+def test_the_built_in_demo_estate_traces_without_the_repo(tmp_path, capsys):
+    # `pip install cloudmap` ships no fixtures/ directory, so the README's
+    # 60-second demo used to end in a raw FileNotFoundError traceback. The
+    # packaged estate makes the first command work from anywhere.
+    rc = cli.main(["trace", "contoso-web", "--from", "demo",
+                   "-o", str(tmp_path / "demo.drawio")])
+
+    assert rc == 0
+    assert (tmp_path / "demo.drawio").exists()
+
+
+def test_a_missing_fixture_is_a_message_not_a_traceback(capsys):
+    rc = cli.main(["trace", "x", "--from", "/nowhere/at/all.json"])
+    err = capsys.readouterr().err
+
+    assert rc == 2
+    assert "does not exist" in err
+    assert "--from demo" in err          # and it offers the working alternative
+
+
+def test_asking_for_one_format_yields_exactly_that_format(tmp_path, monkeypatch):
+    # --json alone used to also drop a stray <name>.blast.drawio into the cwd.
+    monkeypatch.chdir(tmp_path)
+    rc = cli.main(["trace", "contoso-web", "--from", FIX,
+                   "--json", str(tmp_path / "only.json")])
+
+    assert rc == 0
+    assert [p.name for p in tmp_path.iterdir()] == ["only.json"]
+
+
+def test_an_ambiguous_name_shows_what_differs_and_how_to_proceed(tmp_path, capsys):
+    # Two apps named "app" printed two IDENTICAL "app (microsoft.web/sites)"
+    # lines - nothing to choose between and no way forward.
+    fixture = tmp_path / "amb.json"
+    fixture.write_text(json.dumps({"data": [
+        {"id": "/subscriptions/s/resourcegroups/rg1/providers/microsoft.web/sites/app",
+         "name": "app", "type": "microsoft.web/sites", "resourceGroup": "rg1"},
+        {"id": "/subscriptions/s/resourcegroups/rg2/providers/microsoft.web/sites/app",
+         "name": "app", "type": "microsoft.web/sites", "resourceGroup": "rg2"},
+    ]}), encoding="utf-8")
+
+    rc = cli.main(["trace", "app", "--from", str(fixture)])
+    err = capsys.readouterr().err
+
+    assert rc == 2
+    assert "rg1" in err and "rg2" in err          # the rows are now tellable apart
+    assert "/resourcegroups/rg1/" in err          # the full id is on screen
+    assert "full id" in err                       # and the way forward is stated
+
+
+def test_a_no_match_answer_says_what_was_searched(capsys):
+    rc = cli.main(["trace", "this-does-not-exist", "--from", FIX])
+    err = capsys.readouterr().err
+
+    assert rc == 2
+    assert "resources scanned" in err
+    assert "case-insensitive" in err

{cloudmap-1.3.0 → cloudmap-1.3.2}/tests/test_ingest_paging.py

@@ -146,22 +146,40 @@ def test_a_failing_az_call_raises_with_its_stderr_attached(monkeypatch):
     assert "account show" in str(err.value)
 
 
-def test_the_subscription_pin_is_forced_onto_every_command_except_account_list(monkeypatch):
-    # The pin is what makes a cross-tenant subscription readable: `az account show`
-    # must be evaluated IN the pinned context, while `az account list` rejects the
-    # flag outright, so it is the one command that must not receive it.
+def test_the_subscription_pin_is_forced_onto_every_command_except_account_ones(monkeypatch):
+    # `account list` rejects --subscription outright, and `account show` must
+    # report the ACTUAL active subscription: injecting the pin there made the
+    # guard compare the pin to itself, so a mismatched pin surfaced as a bogus
+    # "you are not logged in" instead of "refusing the mismatch".
     monkeypatch.setenv("CLOUDMAP_ALLOW_SUBSCRIPTION", "PINNED-SUB")
     seen = _record_commands(monkeypatch)
 
     azure._az(["account", "list", "-o", "json"])
     azure._az(["account", "show", "-o", "json"])
-    azure._az(["graph", "query", "-q", "resources", "--subscriptions", "PINNED-SUB"])
+    azure._az(["webapp", "show", "-g", "rg", "-n", "app", "-o", "json"])
 
     assert "--subscription" not in seen[0]
-    assert seen[1][-2:] == ["--subscription", "PINNED-SUB"]
+    assert "--subscription" not in seen[1]
     assert seen[2][-2:] == ["--subscription", "PINNED-SUB"]
 
 
+def test_a_mismatched_pin_reports_the_mismatch_not_a_login_failure(monkeypatch):
+    # The end-to-end version of the above: the user pointed the pin at one
+    # subscription while az is on another. The old injection made this print
+    # "You are not logged in. Run az login" - the exact wrong advice.
+    import json as _json
+
+    monkeypatch.setenv("CLOUDMAP_ALLOW_SUBSCRIPTION", "SUB-PINNED")
+    monkeypatch.setattr(azure, "_az",
+                        lambda args: _json.dumps({"id": "SUB-ACTIVE", "tenantId": "t",
+                                                  "name": "dev"}))
+    with pytest.raises(SystemExit) as e:
+        azure._guard()
+
+    assert "Refusing the mismatch" in str(e.value)
+    assert "logged in" not in str(e.value)
+
+
 def test_an_unpinned_run_adds_no_subscription_flag(monkeypatch):
     seen = _record_commands(monkeypatch)