platformforge 0.1.0__py3-none-any.whl

platformforge/cloud/__init__.py

@@ -0,0 +1,8 @@
+"""Cloud analyzers — provider-neutral facts from dumps (§49–§56)."""
+
+from platformforge.cloud.aws import analyze_aws_dump
+from platformforge.cloud.common import RESOURCE_KIND_MAP, resource_fact
+from platformforge.cloud.multicloud import analyze_azure_dump, analyze_gcp_dump
+
+__all__ = ["RESOURCE_KIND_MAP", "analyze_aws_dump", "analyze_azure_dump",
+           "analyze_gcp_dump", "resource_fact"]

platformforge/cloud/aws.py

@@ -0,0 +1,254 @@
+"""AWS dump analyzers (§50–§55) — offline, reads CLI/Config exports only.
+
+Accepted shapes (any file or dir):
+  organizations list-accounts / describe-organization
+  iam list-roles | list-policies | get-policy | list-users
+  ec2 describe-vpcs | describe-subnets | describe-route-tables |
+      describe-nat-gateways | describe-internet-gateways | describe-instances |
+      describe-security-groups | describe-load-balancers (ELBv2)
+  route53 list-hosted-zones
+  eks/ecs describe-cluster | list-clusters
+  lambda list-functions
+  s3 list-buckets | get-bucket-policy-status dumps
+  rds describe-db-instances | dynamodb list/describe | sqs/sns list
+  config select-resource-config / snapshot exports (generic)
+
+Everything emits EvidenceTier.PROVIDER_OBSERVED facts (§55). Live calls are
+host-side — this module never imports boto3 or hits an endpoint.
+"""
+
+from __future__ import annotations
+
+import json
+from collections.abc import Callable
+from pathlib import Path
+from typing import Any
+
+from platformforge.cloud.common import resource_fact
+
+
+def _org(doc: dict[str, Any], src: str) -> list[dict[str, Any]]:
+    facts: list[dict[str, Any]] = []
+    org = doc.get("Organization", {})
+    org_id = org.get("Id") or doc.get("OrganizationId") or "org"
+    if org:
+        facts.append(resource_fact(
+            "aws", "organization", org_id, source=src,
+            attrs={"arn": org.get("Arn"), "master": org.get("MasterAccountId")}))
+    for a in doc.get("Accounts", []):
+        facts.append(resource_fact(
+            "aws", "account", a["Id"], source=src,
+            attrs={"name": a.get("Name"), "email_hash": bool(a.get("Email")),
+                   "status": a.get("Status")},
+            edges=[{"src_kind": "cloud_account", "src": a["Id"],
+                    "dst_kind": "organization", "dst": org_id,
+                    "kind": "contained_by"}]))
+    for ou in doc.get("OrganizationalUnits", []):
+        facts.append(resource_fact(
+            "aws", "account", ou["Id"], source=src,  # OU modeled as account-scope
+            attrs={"name": ou.get("Name"), "ou": True}))
+    return facts
+
+
+def _iam(doc: dict[str, Any], src: str) -> list[dict[str, Any]]:
+    facts = []
+    for r in doc.get("Roles", []):
+        facts.append(resource_fact(
+            "aws", "role", r["Arn"], source=src,
+            attrs={"name": r.get("RoleName"),
+                   "trust": sorted(
+                       p.get("Service", p.get("AWS", "?"))
+                       for p in (r.get("AssumeRolePolicyDocument") or {})
+                       .get("Statement", [])
+                       for p in [p.get("Principal", {})])}))
+    for p in doc.get("Policies", []):
+        facts.append(resource_fact(
+            "aws", "policy", p["Arn"], source=src,
+            attrs={"name": p.get("PolicyName"),
+                   "attachment_count": p.get("AttachmentCount"),
+                   "is_aws_managed": bool((p.get("Arn") or "")
+                                          .startswith("arn:aws:iam::aws:"))}))
+    for u in doc.get("Users", []):
+        facts.append(resource_fact(
+            "aws", "principal", u["Arn"], source=src,
+            attrs={"name": u.get("UserName"),
+                   "has_mfa": bool(u.get("Mfa")),
+                   "password_last_used": bool(u.get("PasswordLastUsed"))}))
+    # get-policy-version doc → policy graph contribution with statement analysis
+    pv = doc.get("PolicyVersion") or {}
+    if pv.get("Document"):
+        arn = doc.get("Policy", {}).get("Arn", "policy:unknown")
+        stmts = pv["Document"].get("Statement", [])
+        wild = any(
+            ("*" in str(s.get("Action")) or "*" in str(s.get("Resource")))
+            and str(s.get("Effect")) == "Allow" for s in stmts)
+        facts.append(resource_fact(
+            "aws", "policy", arn, source=src,
+            attrs={"wildcard": wild, "statements": len(stmts)}))
+    return facts
+
+
+def _network(doc: dict[str, Any], src: str) -> list[dict[str, Any]]:
+    facts = []
+    for v in doc.get("Vpcs", []):
+        facts.append(resource_fact(
+            "aws", "vpc", v["VpcId"], source=src, account=v.get("OwnerId", ""),
+            attrs={"cidr": v.get("CidrBlock"), "is_default": v.get("IsDefault")}))
+    for s in doc.get("Subnets", []):
+        facts.append(resource_fact(
+            "aws", "subnet", s["SubnetId"], source=src,
+            attrs={"cidr": s.get("CidrBlock"), "az": s.get("AvailabilityZone"),
+                   "public_ip_on_launch": s.get("MapPublicIpOnLaunch")},
+            edges=[{"src_kind": "subnet", "src": s["SubnetId"],
+                    "dst_kind": "vpc_vnet", "dst": s.get("VpcId", "?"),
+                    "kind": "contained_by"}]))
+    for ig in doc.get("InternetGateways", []):
+        for att in ig.get("Attachments", []):
+            facts.append(resource_fact(
+                "aws", "internet_gateway", ig["InternetGatewayId"], source=src,
+                edges=[{"src_kind": "gateway", "src": ig["InternetGatewayId"],
+                        "dst_kind": "vpc_vnet", "dst": att.get("VpcId", "?"),
+                        "kind": "routes_to"}]))
+    for n in doc.get("NatGateways", []):
+        facts.append(resource_fact(
+            "aws", "nat_gateway", n["NatGatewayId"], source=src,
+            attrs={"state": n.get("State")},
+            edges=[{"src_kind": "nat", "src": n["NatGatewayId"],
+                    "dst_kind": "subnet", "dst": n.get("SubnetId", "?"),
+                    "kind": "contained_by"}]))
+    for rt in doc.get("RouteTables", []):
+        routes = rt.get("Routes", [])
+        public = any(r.get("GatewayId", "").startswith("igw-")
+                     for r in routes)
+        for assoc in rt.get("Associations", []):
+            sid = assoc.get("SubnetId")
+            if sid:
+                facts.append(resource_fact(
+                    "aws", "route_table", rt["RouteTableId"], source=src,
+                    attrs={"public_route": public},
+                    edges=[{"src_kind": "route", "src": rt["RouteTableId"],
+                            "dst_kind": "subnet", "dst": sid,
+                            "kind": "routes_to"}]))
+    for sg in doc.get("SecurityGroups", []):
+        open_ingress = [p for p in sg.get("IpPermissions", [])
+                        if any(r.get("CidrIp") == "0.0.0.0/0"
+                               for r in p.get("IpRanges", []))]
+        facts.append(resource_fact(
+            "aws", "policy", sg["GroupId"], source=src,  # sg as policy node
+            attrs={"sg": True, "name": sg.get("GroupName"),
+                   "open_ingress": bool(open_ingress),
+                   "open_ports": sorted({p.get("FromPort", 0)
+                                         for p in open_ingress})}))
+    for lb in doc.get("LoadBalancers", []):
+        facts.append(resource_fact(
+            "aws", "load_balancer", lb["LoadBalancerArn"], source=src,
+            attrs={"scheme": lb.get("Scheme"), "type": lb.get("Type"),
+                   "public": lb.get("Scheme") == "internet-facing"},
+            edges=[{"src_kind": "load_balancer", "src": lb["LoadBalancerArn"],
+                    "dst_kind": "vpc_vnet", "dst": lb.get("VpcId", "?"),
+                    "kind": "routes_to"}]))
+    for z in doc.get("HostedZones", []):
+        facts.append(resource_fact(
+            "aws", "dns_zone", z["Id"], source=src,
+            attrs={"name": z.get("Name"), "private": z.get("Config", {})
+                   .get("PrivateZone")}))
+    return facts
+
+
+def _compute(doc: dict[str, Any], src: str) -> list[dict[str, Any]]:
+    facts = []
+    for res in doc.get("Reservations", []):
+        for i in res.get("Instances", []):
+            public = bool(i.get("PublicIpAddress"))
+            facts.append(resource_fact(
+                "aws", "instance", i["InstanceId"], source=src,
+                attrs={"type": i.get("InstanceType"),
+                       "state": i.get("State", {}).get("Name"),
+                       "public_ip": public,
+                       "subnet": i.get("SubnetId")},
+                edges=[{"src_kind": "node", "src": i["InstanceId"],
+                        "dst_kind": "subnet",
+                        "dst": i.get("SubnetId", "?"),
+                        "kind": "contained_by"}] if i.get("SubnetId") else []))
+    for fn in doc.get("Functions", []):
+        facts.append(resource_fact(
+            "aws", "function", fn["FunctionArn"], source=src,
+            attrs={"runtime": fn.get("Runtime"), "name": fn.get("FunctionName")}))
+    for c in doc.get("Clusters", []):
+        name = c.get("clusterName") or c.get("name") or c.get("clusterArn")
+        eks = "version" in c or c.get("arn", "").startswith("arn:aws:eks")
+        facts.append(resource_fact(
+            "aws", "cluster", c.get("arn") or c.get("clusterArn") or name,
+            source=src,
+            attrs={"name": name, "engine": "eks" if eks else "ecs",
+                   "version": c.get("version"), "status": c.get("status")}))
+    return facts
+
+
+def _storage(doc: dict[str, Any], src: str) -> list[dict[str, Any]]:
+    facts = []
+    for b in doc.get("Buckets", []):
+        facts.append(resource_fact("aws", "bucket", b["Name"], source=src))
+    for db in doc.get("DBInstances", []):
+        facts.append(resource_fact(
+            "aws", "database", db["DBInstanceArn"], source=src,
+            attrs={"engine": db.get("Engine"), "public": db.get("PubliclyAccessible"),
+                   "encrypted": db.get("StorageEncrypted"),
+                   "multi_az": db.get("MultiAZ")}))
+    for q in doc.get("QueueUrls", doc.get("Queues", [])):
+        name = q if isinstance(q, str) else q.get("QueueUrl") or q.get("QueueArn")
+        facts.append(resource_fact("aws", "queue", str(name), source=src))
+    for t in doc.get("Topics", []):
+        facts.append(resource_fact(
+            "aws", "topic", t.get("TopicArn", t), source=src))
+    for tbl in doc.get("Tables", doc.get("TableNames", [])):
+        name = tbl if isinstance(tbl, str) else tbl.get("TableArn") or tbl.get("TableName")
+        facts.append(resource_fact("aws", "database", str(name), source=src,
+                                   attrs={"engine": "dynamodb"}))
+    return facts
+
+
+_SHAPE_MAP: list[tuple[tuple[str, ...], Callable]] = [
+    (("Organization", "Accounts", "OrganizationalUnits"), _org),
+    (("Roles", "Policies", "Users", "PolicyVersion"), _iam),
+    (("Vpcs", "Subnets", "InternetGateways", "NatGateways", "RouteTables",
+      "SecurityGroups", "LoadBalancers", "HostedZones"), _network),
+    (("Reservations", "Functions", "Clusters"), _compute),
+    (("Buckets", "DBInstances", "QueueUrls", "Queues", "Topics", "Tables",
+      "TableNames"), _storage),
+]
+
+
+def detect_shape(doc: dict[str, Any]) -> str | None:
+    keys = set(doc)
+    for shape_keys, _ in _SHAPE_MAP:
+        if keys & set(shape_keys):
+            return shape_keys[0]
+    return None
+
+
+def analyze_aws_dump(path: str | Path) -> dict[str, Any]:
+    """Analyze one AWS CLI/Config dump or a dir of dumps → T1 facts."""
+    p = Path(path)
+    files = sorted(p.rglob("*.json")) if p.is_dir() else [p]
+    facts: list[dict[str, Any]] = []
+    unrecognized: list[str] = []
+    for f in files:
+        try:
+            doc = json.loads(f.read_text())
+        except (OSError, json.JSONDecodeError) as e:
+            unrecognized.append(f"{f.name}: unparseable ({e})")
+            continue
+        if not isinstance(doc, dict):
+            unrecognized.append(f"{f.name}: not a JSON object")
+            continue
+        matched = False
+        for shape_keys, fn in _SHAPE_MAP:
+            if set(doc) & set(shape_keys):
+                facts.extend(fn(doc, str(f)))
+                matched = True
+        if not matched:
+            unrecognized.append(f.name)
+    return {"facts": facts, "unresolved": unrecognized,
+            "counts": {"facts": len(facts), "unrecognized": len(unrecognized)},
+            "provenance": "provider-observed-dump"}

platformforge/cloud/common.py

@@ -0,0 +1,69 @@
+"""Cloud common model (§49) — provider-neutral resource facts.
+
+Facts here are *provider-observed* (EvidenceTier 1) when they come from
+CLI/API dumps, never mixed with declared config. Each fact contributes
+graph nodes/edges in the provider-neutral vocabulary.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from platformforge.core.redaction import redact_obj
+from platformforge.models.base import EvidenceTier, stable_id
+
+# §49 — provider-neutral resource type → (node kind, default edge target)
+RESOURCE_KIND_MAP = {
+    "organization": "organization", "account": "cloud_account",
+    "subscription": "cloud_account", "project": "cloud_account",
+    "region": "region", "zone": "zone",
+    "role": "role", "policy": "policy", "principal": "iam_principal",
+    "workload_identity": "workload_identity",
+    "vpc": "vpc_vnet", "subnet": "subnet", "route_table": "route",
+    "internet_gateway": "gateway", "nat_gateway": "nat",
+    "transit_gateway": "gateway", "endpoint": "route",
+    "load_balancer": "load_balancer", "dns_zone": "dns",
+    "instance": "node", "function": "workload", "cluster": "cluster",
+    "bucket": "bucket", "database": "database", "cache": "cache",
+    "queue": "queue", "topic": "topic", "secret": "secret",
+    "certificate": "certificate", "budget": "budget",
+    "cost_center": "cost_center",
+}
+
+
+def resource_fact(provider: str, rtype: str, rid: str, *,
+                  account: str = "", region: str = "",
+                  attrs: dict[str, Any] | None = None,
+                  edges: list[dict[str, Any]] | None = None,
+                  nodes: list[dict[str, Any]] | None = None,
+                  tier: int = EvidenceTier.PROVIDER_OBSERVED,
+                  source: str = "") -> dict[str, Any]:
+    """One provider-neutral fact carrying graph contributions."""
+    kind = RESOURCE_KIND_MAP.get(rtype, "component")
+    node_attrs = {"provider": provider, "resource_type": rtype,
+                  "account": account, "region": region}
+    node_attrs.update(attrs or {})
+    graph = {"nodes": [{"kind": kind, "label": rid, "attrs": node_attrs}],
+             "edges": []}
+    if account:
+        graph["nodes"].append({"kind": "cloud_account", "label": account})
+        graph["edges"].append({"src_kind": kind, "src": rid,
+                               "dst_kind": "cloud_account", "dst": account,
+                               "kind": "contained_by"})
+    if region:
+        graph["nodes"].append({"kind": "region", "label": region})
+        graph["edges"].append({"src_kind": kind, "src": rid,
+                               "dst_kind": "region", "dst": region,
+                               "kind": "contained_by"})
+    graph["nodes"].extend(nodes or [])
+    graph["edges"].extend(edges or [])
+    return {
+        "fact_id": stable_id("PF-CLD", f"{provider}.{rtype}", rid),
+        "kind": f"cloud.{provider}.{rtype}",
+        "source": source or f"{provider}-dump",
+        "location": f"{provider}:{account}:{region}:{rid}",
+        "tier": int(tier),
+        "attrs": {"provider": provider, "resource_type": rtype,
+                  "id": rid, "account": account, "region": region,
+                  "graph": graph, **redact_obj(attrs or {})},
+    }

platformforge/cloud/multicloud.py

@@ -0,0 +1,143 @@
+"""Azure + GCP dump analyzers (§175–§176) — provider-observed facts via the
+§49 common model. Shape-detected, offline, never calls a provider API.
+
+Accepted:
+  azure:  dumps with `value[]` items carrying `type` like
+          Microsoft.Network/virtualNetworks, Microsoft.Compute/*,
+          Microsoft.Storage/storageAccounts, Microsoft.Web/sites,
+          Microsoft.Sql/servers, Microsoft.KeyVault/vaults, or a bare
+          `subscriptions`/`tenants` list
+  gcp:    dumps with `items[]`/`projects[]` carrying `kind` like
+          compute#network, compute#instance, container#cluster,
+          storage#bucket, sqladmin#instance, or `folders`/`organizations`
+"""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import Any
+
+from platformforge.cloud.common import resource_fact
+
+_AZURE_TYPE_MAP = {
+    "microsoft.network/virtualnetworks": "vpc",
+    "microsoft.network/subnets": "subnet",
+    "microsoft.network/loadbalancers": "load_balancer",
+    "microsoft.network/publicipaddresses": "load_balancer",
+    "microsoft.compute/virtualmachines": "instance",
+    "microsoft.storage/storageaccounts": "bucket",
+    "microsoft.sql/servers": "database",
+    "microsoft.web/sites": "function",
+    "microsoft.keyvault/vaults": "secret",
+    "microsoft.container_service/managedclusters": "cluster",
+    "microsoft.documentdb/databaseaccounts": "database",
+}
+_GCP_KIND_MAP = {
+    "compute#network": "vpc", "compute#subnetwork": "subnet",
+    "compute#instance": "instance", "compute#forwardingrule": "load_balancer",
+    "compute#backend": "load_balancer",
+    "container#cluster": "cluster", "storage#bucket": "bucket",
+    "sqladmin#instance": "database", "iam#serviceAccount": "principal",
+    "cloudresourcemanager#project": "project",
+    "cloudresourcemanager#folder": "organization",
+    "cloudresourcemanager#organization": "organization",
+    "cloudfunctions#function": "function",
+}
+
+
+def _az_type(rtype: str) -> str:
+    return _AZURE_TYPE_MAP.get(str(rtype).lower(), "component")
+
+
+def analyze_azure_dump(path: str | Path) -> dict[str, Any]:
+    p = Path(path)
+    files = sorted(p.rglob("*.json")) if p.is_dir() else [p]
+    facts: list[dict[str, Any]] = []
+    unresolved: list[str] = []
+    for f in files:
+        try:
+            doc = json.loads(f.read_text())
+        except (OSError, json.JSONDecodeError):
+            unresolved.append(f.name)
+            continue
+        items = doc.get("value") or doc.get("items") or (
+            [doc] if isinstance(doc, dict) and "type" in doc else [])
+        matched = False
+        if isinstance(items, list):
+            for it in items:
+                if not isinstance(it, dict):
+                    continue
+                rtype = it.get("type", "")
+                if not str(rtype).lower().startswith("microsoft."):
+                    continue  # not an Azure resource item
+                rid = (it.get("id") or it.get("name") or "").rsplit("/", 1)[-1]
+                if not rid:
+                    continue
+                matched = True
+                sub = it.get("id", "").split("/resourceGroups/")[0].rsplit("/", 1)[-1] \
+                    if "/subscriptions/" in it.get("id", "") else ""
+                facts.append(resource_fact(
+                    "azure", _az_type(rtype), rid, source=str(f),
+                    account=sub, region=it.get("location", ""),
+                    attrs={"azure_type": rtype, "resource_group":
+                           it.get("id", "").split("/resourceGroups/")[-1]
+                           .split("/")[0] if "resourceGroups" in
+                           it.get("id", "") else "",
+                           "sku": (it.get("sku") or {}).get("name")}))
+        for s in doc.get("subscriptions", doc.get("Subscriptions", [])):
+            matched = True
+            facts.append(resource_fact(
+                "azure", "account",
+                s.get("subscriptionId") or s.get("id", "?"), source=str(f),
+                attrs={"name": s.get("displayName") or s.get("name")}))
+        if not matched:
+            unresolved.append(f.name)
+    return {"facts": facts, "unresolved": unresolved,
+            "counts": {"facts": len(facts), "unrecognized": len(unresolved)},
+            "provenance": "provider-observed-dump"}
+
+
+def analyze_gcp_dump(path: str | Path) -> dict[str, Any]:
+    p = Path(path)
+    files = sorted(p.rglob("*.json")) if p.is_dir() else [p]
+    facts: list[dict[str, Any]] = []
+    unresolved: list[str] = []
+    for f in files:
+        try:
+            doc = json.loads(f.read_text())
+        except (OSError, json.JSONDecodeError):
+            unresolved.append(f.name)
+            continue
+        items = doc.get("items") or doc.get("projects") \
+            or ([doc] if "kind" in doc else [])
+        matched = False
+        for it in items if isinstance(items, list) else []:
+            if not isinstance(it, dict):
+                continue
+            kind = it.get("kind", "")
+            rtype = _GCP_KIND_MAP.get(kind)
+            if rtype is None and "/" in str(kind):
+                rtype = "component"
+            rid = it.get("name") or it.get("id") or it.get("selfLink", "?")
+            rid = str(rid).rsplit("/", 1)[-1]
+            if rtype is None:
+                continue
+            matched = True
+            project = it.get("project") or doc.get("projectId", "")
+            facts.append(resource_fact(
+                "gcp", rtype, rid, source=str(f),
+                account=project, region=it.get("region", "").rsplit("/", 1)[-1],
+                attrs={"gcp_kind": kind}))
+        for pr in doc.get("projects", []):
+            if isinstance(pr, dict):
+                matched = True
+                facts.append(resource_fact(
+                    "gcp", "project", pr.get("projectId", "?"), source=str(f),
+                    attrs={"name": pr.get("name"),
+                           "lifecycle": pr.get("lifecycleState")}))
+        if not matched:
+            unresolved.append(f.name)
+    return {"facts": facts, "unresolved": unresolved,
+            "counts": {"facts": len(facts), "unrecognized": len(unresolved)},
+            "provenance": "provider-observed-dump"}

platformforge/collect/__init__.py

@@ -0,0 +1,11 @@
+"""Generic collection — sniff dump/artifact types and route to analyzers.
+
+§7 `platformforge collect`: a bounded, offline ingress for artifacts a host
+already produced (kubectl -o yaml dumps, terraform plan/state JSON, IAM
+policy JSON, billing exports, SBOMs). Detection is by filename + shape;
+undetected files are reported, never silently skipped.
+"""
+
+from platformforge.collect.detect import collect, detect_file
+
+__all__ = ["collect", "detect_file"]