serverless-tag-resources/src/validation.js

Datamart: Tag all AWS resources with dual legacy + datamart:* tag support

"use strict";

/**
 * Tag validation module.
 *
 * When enabled (custom.datamart.validation: true), validates that
 * required datamart:* tags are present in stackTags and values
 * match the allowed domains.
 */

const REQUIRED_TAGS = [
  "datamart:cost-center",
  "datamart:finops-scope",
  "datamart:environment",
  "datamart:data-classification",
  "datamart:criticality",
  "datamart:team",
];

const ALLOWED_VALUES = {
  "datamart:finops-scope": [
    "runtime", "compliance", "security", "scraping", "ai", "devtools", "infrastructure",
  ],
  "datamart:environment": [
    "prod", "homo", "qa", "dev", "sandbox", "dr",
  ],
  "datamart:data-classification": [
    "public", "internal", "confidential", "restricted",
  ],
  "datamart:criticality": [
    "critical", "high", "medium", "low",
  ],
  "datamart:cost-center": [
    "datamart", "getdata", "connect", "vizdata", "legalbase", "facesign",
    "keyshield", "lendbot", "jscipher", "atlas", "openfinance", "payments", "operations",
  ],
};

/**
 * Validate stackTags against the datamart tag strategy.
 *
 * @param {object} stackTags - from provider.stackTags
 * @param {string} stage - deployment stage (used to auto-set datamart:environment)
 * @returns {{ valid: boolean, errors: string[] }}
 */
function validateTags(stackTags, stage) {
  const errors = [];
  const tags = stackTags || {};

  // Build effective tags (including auto-generated ones)
  const effective = { ...tags };
  if (!effective["datamart:environment"]) {
    effective["datamart:environment"] = stage;
  }

  // Check required tags
  for (const required of REQUIRED_TAGS) {
    if (!effective[required]) {
      errors.push(`Missing required tag: ${required}`);
    }
  }

  // Check allowed values
  for (const [tag, allowed] of Object.entries(ALLOWED_VALUES)) {
    const value = effective[tag];
    if (value && !allowed.includes(value)) {
      errors.push(
        `Invalid value for ${tag}: "${value}". Allowed: ${allowed.join(", ")}`
      );
    }
  }

  return { valid: errors.length === 0, errors };
}

module.exports = { validateTags, REQUIRED_TAGS, ALLOWED_VALUES };