domain/architecture/system/deployment/azure/ops.bend checks

raw source on the hub · import 0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/ops.bend as Ops

5 imports

import Base
import ./type.bend as Az
import ../../plan/type.bend as P
import ../../../environment/agreement/type.bend as G
import ../../../environment/agreement/ops.bend as GO

Definitions

def keep_if source · line 7 · raw

@c:Bool -> @x:String -> @rest:List<&2, String> -> List<&2, String>

def same source · line 15 · raw

@a:0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Resource -> @b:0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Resource -> Bool

---- resources: what Azure has against what the system declares ----

def listed source · line 20 · raw

@+r:0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Resource -> @rs:List<&2, 0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Resource> -> Bool

def keep_resource source · line 27 · raw

@c:Bool -> @r:0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Resource -> @rest:List<&2, 0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Resource> -> List<&2, 0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Resource>

def absent source · line 35 · raw

@xs:List<&2, 0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Resource> -> @+ys:List<&2, 0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Resource> -> List<&2, 0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Resource>

The resources in xs that are not in ys (same name, type and resource group).

def undeclared source · line 43 · raw

@observed:List<&2, 0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Resource> -> @+declared:List<&2, 0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Resource> -> List<&2, 0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Resource>

What Azure has that the system does not declare.

def missing source · line 47 · raw

@declared:List<&2, 0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Resource> -> @+observed:List<&2, 0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Resource> -> List<&2, 0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Resource>

What the system declares that Azure does not have.

def show source · line 50 · raw

@r:0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Resource -> String

def shown source · line 55 · raw

@rs:List<&2, 0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Resource> -> List<&2, String>

def glob_chars source · line 64 · raw

@+ps:List<&2, Char> -> @+vs:List<&2, Char> -> Bool

---- permissions ---- ARM patterns use '*' for zero or more characters; matching is case insensitive.

def glob source · line 87 · raw

@pattern:String -> @value:String -> Bool

def covers source · line 92 · raw

@+want:String -> @+actual:String -> Bool

A wildcard pattern is covered only by the same pattern or '*'. This conservative rule avoids claiming that overlapping wildcards grant exactly equal permissions.

def covered source · line 97 · raw

@+action:String -> @patterns:List<&2, String> -> Bool

def every_covered source · line 104 · raw

@xs:List<&2, String> -> @+by:List<&2, String> -> Bool

def actions_if source · line 111 · raw

@hit:Bool -> @acts:List<&2, String> -> @rest:List<&2, String> -> List<&2, String>

def scope_actions source · line 118 · raw

@+scope:String -> @xs:List<&2, 0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Permission> -> List<&2, String>

def no_exclusions source · line 125 · raw

@+scope:String -> @xs:List<&2, 0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Permission> -> Bool

def exact source · line 133 · raw

@+scope:String -> @+want:List<&2, String> -> @+actual:List<&2, 0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Permission> -> Bool

Whether the permissions on scope are exactly want, with nothing excluded.

def not_minimal source · line 139 · raw

@groups:List<&2, String> -> @+a:0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/environment/agreement/type.Agreement -> @+person:String -> @+actual:List<&2, 0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Permission> -> List<&2, String>

The resource groups where person has other than exactly what the agreement grants there (nothing granted means no access at all).

def access_minimal source · line 147 · raw

@groups:List<&2, String> -> @+a:0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/environment/agreement/type.Agreement -> @+person:String -> @+actual:List<&2, 0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Permission> -> Bool

Permission minimality: on every resource group, person has exactly what the agreement grants there.

def identity_names source · line 151 · raw

@xs:List<&2, 0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Identity> -> List<&2, String>

---- identities ----

def signed_in source · line 159 · raw

@+profile:String -> @xs:List<&2, 0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Identity> -> String

Who is signed in with this profile, or "" when no one is.

def blocked_if source · line 167 · raw

@+what:String -> @+xs:List<&2, String> -> @why:String -> List<&2, 0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/plan/type.Step>

---- the steps ----

def verdict source · line 170 · raw

@+what:String -> @+bs:List<&2, 0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/plan/type.Step> -> List<&2, 0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/plan/type.Step>

def domain source · line 173 · raw

@a:0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/environment/agreement/type.Agreement -> String

def judged source · line 178 · raw

@+what:String -> @+a:0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/environment/agreement/type.Agreement -> @+declared:List<&2, 0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Resource> -> @o:0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Observed -> List<&2, 0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/plan/type.Step>

def steps source · line 194 · raw

@az:0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Azure -> @+a:0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/environment/agreement/type.Agreement -> @o:0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/deployment/azure/type.Observed -> List<&2, 0x0826261f6dc5a61da47ff8908a941ce1/domain/architecture/system/plan/type.Step>

What Azure as observed means for the system: Current when every resource is declared and every declared resource exists, every identity in use is one of the agreement's people, every person is in its directory domain, and the signed-in user has exactly what the agreement grants; else Blocked.