From 30f2e958396898b61dccdebbbc490b495d62604b Mon Sep 17 00:00:00 2001
From: Delnat Wito <wito.delnat@gmail.com>
Date: Thu, 28 Sep 2023 16:27:16 +0200
Subject: [PATCH] feat: add ValidatingAdmissionPolicy references

---
 .changeset/pretty-donkeys-wash.md             |   5 +
 .../src/references/mappers/mappers.ts         |   2 +
 .../validatingAdmissionPolicyBinding.ts       |  13 ++
 packages/validation/src/references/process.ts | 119 +++++++++++++++++-
 .../src/utils/knownResourceKinds.ts           |   2 +
 5 files changed, 140 insertions(+), 1 deletion(-)
 create mode 100644 .changeset/pretty-donkeys-wash.md
 create mode 100644 packages/validation/src/references/mappers/validatingAdmissionPolicyBinding.ts

diff --git a/.changeset/pretty-donkeys-wash.md b/.changeset/pretty-donkeys-wash.md
new file mode 100644
index 000000000..c3875416b
--- /dev/null
+++ b/.changeset/pretty-donkeys-wash.md
@@ -0,0 +1,5 @@
+---
+"@monokle/validation": minor
+---
+
+Add ValidatingAdmissionPolicy references
diff --git a/packages/validation/src/references/mappers/mappers.ts b/packages/validation/src/references/mappers/mappers.ts
index d9ff96f8d..d44e605e0 100644
--- a/packages/validation/src/references/mappers/mappers.ts
+++ b/packages/validation/src/references/mappers/mappers.ts
@@ -12,6 +12,7 @@ import {endpointSliceMappers} from './endpointSlice.js';
 import {Resource} from '../../common/types.js';
 import {isDefined} from '../../utils/isDefined.js';
 import {ownerReferenceMapper} from './ownerReference.js';
+import {validatingAdmissionPolicyBindingMappers} from './validatingAdmissionPolicyBinding';
 
 export type SiblingMatcher = (
   source: Resource,
@@ -82,6 +83,7 @@ export const OUTGOING_MAPPERS_BY_KIND: Partial<Record<KnownResourceKinds, RefMap
   PersistentVolume: persistentVolumeMapper,
   RoleBinding: roleBindingMappers,
   ClusterRoleBinding: clusterRoleBindingMappers,
+  ValidatingAdmissionPolicyBinding: validatingAdmissionPolicyBindingMappers,
   VolumeAttachment: volumeAttachmentMappers,
   Endpoints: endpointsMappers,
   EndpointSlice: endpointSliceMappers,
diff --git a/packages/validation/src/references/mappers/validatingAdmissionPolicyBinding.ts b/packages/validation/src/references/mappers/validatingAdmissionPolicyBinding.ts
new file mode 100644
index 000000000..5350f1df3
--- /dev/null
+++ b/packages/validation/src/references/mappers/validatingAdmissionPolicyBinding.ts
@@ -0,0 +1,13 @@
+import {RefMapper} from './mappers.js';
+
+export const validatingAdmissionPolicyBindingMappers: RefMapper[] = [
+  {
+    type: 'name',
+    source: {
+      pathParts: ['policyName'],
+    },
+    target: {
+      kind: 'ValidatingAdmissionPolicy',
+    },
+  },
+];
diff --git a/packages/validation/src/references/process.ts b/packages/validation/src/references/process.ts
index 30a75be07..ab367890b 100644
--- a/packages/validation/src/references/process.ts
+++ b/packages/validation/src/references/process.ts
@@ -1,7 +1,7 @@
 import groupBy from 'lodash/groupBy.js';
 import keyBy from 'lodash/keyBy.js';
 import uniq from 'lodash/uniq.js';
-import {Incremental, Resource, ResourceRefsProcessingConfig} from '../common/types.js';
+import {Incremental, Resource, ResourceRefsProcessingConfig, ResourceRefType, YamlPath} from '../common/types.js';
 import {handlePairRefMapping} from './handlePairRefMapping.js';
 import {handleRefMappingByKey} from './handleRefMappingByKey.js';
 import {getOutgoingRefMappers} from './mappers/index.js';
@@ -12,6 +12,8 @@ import {getResourceRefNodes} from './utils/getResourceNodes.js';
 import {refMapperMatchesKind} from './utils/refMatcher.js';
 import {processKustomizations} from './utils/kustomizeRefs.js';
 import {ResourceParser} from '../common/resourceParser.js';
+import {isDefined} from '../utils/isDefined';
+import {isNode} from 'yaml';
 
 /**
  * Processes resources and MUTATES them with their references to other resources.
@@ -84,7 +86,122 @@ function doProcessRefs(resources: Resource[], resourcesToProcess: Resource[], co
         handleRefMappingByKey(sourceResource, targetResources, outgoingRefMapper, config);
       }
     }
+
+    if (sourceResource.kind === 'ValidatingAdmissionPolicyBinding') {
+      processValidatingAdmissionPolicyParams(sourceResource, resourceMap, resourcesByKind, config.parser);
+    }
   }
 
   cleanResourceRefs(resources);
 }
+
+/**
+ * Process references to parameters of ValidationAdmissionPolicyBindings.
+ *
+ * These are quite unique as it needs a referenced Policy object to determine the referenced Params object.
+ * To avoid further complicating the reference framework, we handle this as a one-off special case.
+ */
+function processValidatingAdmissionPolicyParams(
+  policyBinding: Resource,
+  resourceMap: Record<string, Resource>,
+  resourcesByKind: Record<string, Resource[]>,
+  parser: ResourceParser
+) {
+  const paramName = policyBinding.content?.spec?.paramRef?.name;
+  const {paramKind} = determineParamKind(policyBinding, resourceMap);
+  const paramNamespace = policyBinding.content?.spec?.paramRef?.namespace;
+
+  if (!policyBinding.refs || !paramName || !paramKind) {
+    return;
+  }
+
+  const relatedParams = resourcesByKind[paramKind].find(o => {
+    const matchingName = paramName === o.name;
+    const matchingNamespace = paramNamespace ? paramNamespace === o.namespace : true;
+    return matchingName && matchingNamespace;
+  });
+
+  if (!relatedParams) {
+    return;
+  }
+
+  // Add reference to Binding object
+  policyBinding.refs.push({
+    type: ResourceRefType.Outgoing,
+    name: paramName,
+    target: {
+      type: 'resource',
+      resourceId: relatedParams.id,
+      resourceKind: relatedParams.kind,
+    },
+    position: getPosition(parser, policyBinding, ['spec', 'paramRef', 'name']),
+  });
+
+  // Add reference to Params object
+  if (!relatedParams.refs) {
+    relatedParams.refs = [];
+  }
+
+  const hasRef = relatedParams.refs.some(
+    ref =>
+      ref.type === ResourceRefType.Incoming &&
+      ref.name === paramName &&
+      ref.target &&
+      ref.target.type === 'resource' &&
+      ref.target.resourceId === policyBinding.id
+  );
+  if (hasRef) {
+    return;
+  }
+
+  relatedParams.refs.push({
+    type: ResourceRefType.Incoming,
+    name: paramName,
+    target: {
+      type: 'resource',
+      resourceId: policyBinding.id,
+      resourceKind: policyBinding.kind,
+    },
+    position: getPosition(parser, relatedParams, ['metadata', 'name']),
+  });
+}
+
+function determineParamKind(
+  policyBinding: Resource,
+  resourceMap: Record<string, Resource>
+): {paramKind: string | undefined; paramApiVersion: string | undefined} {
+  if (!policyBinding.refs) {
+    return {paramKind: undefined, paramApiVersion: undefined};
+  }
+
+  const relatedPolicy = policyBinding.refs
+    .map(ref => (ref.target?.type === 'resource' ? ref.target.resourceId : undefined))
+    .filter(isDefined)
+    .map(relatedId => resourceMap[relatedId])
+    .find(object => object?.kind === 'ValidatingAdmissionPolicy');
+
+  return {
+    paramKind: relatedPolicy?.content?.spec?.paramKind?.kind,
+    paramApiVersion: relatedPolicy?.content?.spec?.paramKind?.apiVersion,
+  };
+}
+
+function getPosition(parser: ResourceParser, object: Resource, path: YamlPath) {
+  const parsedObject = parser.parse(object);
+  const node = parsedObject.parsedDoc.getIn(path, true);
+
+  if (!isNode(node)) {
+    return {line: 0, column: 0, length: 0};
+  }
+
+  if (node && parsedObject.lineCounter && node.range) {
+    const linePos = parsedObject.lineCounter.linePos(node.range[0]);
+    return {
+      line: linePos.line,
+      column: linePos.col,
+      length: node.range[1] - node.range[0],
+    };
+  }
+
+  return {line: 0, column: 0, length: 0};
+}
diff --git a/packages/validation/src/utils/knownResourceKinds.ts b/packages/validation/src/utils/knownResourceKinds.ts
index 5a894895c..cf55e023b 100644
--- a/packages/validation/src/utils/knownResourceKinds.ts
+++ b/packages/validation/src/utils/knownResourceKinds.ts
@@ -33,4 +33,6 @@ export const KNOWN_RESOURCE_KINDS = [
   'StatefulSet',
   'StorageClass',
   'VolumeAttachment',
+  'ValidatingAdmissionPolicy',
+  'ValidatingAdmissionPolicyBinding',
 ] as const;