bashrs 6.66.0

//! Dev Container Validation Rules (DEVCONTAINER001-011)
//!
//! These rules validate devcontainer.json files per the Development Container Specification.
//! Reference: <https://containers.dev/implementors/spec/>
//!
//! ## Dev Container Specification Requirements
//!
//! - Must specify image, build, or dockerComposeFile
//! - JSONC (JSON with Comments) syntax supported
//! - Features must use valid container feature references
//! - Lifecycle commands support string, array, or object format

use crate::linter::{Diagnostic, LintResult, Severity, Span};
use serde_json::Value;

/// DEVCONTAINER001: Missing image source
///
/// devcontainer.json MUST specify one of: image, build, or dockerComposeFile.
///
/// ## Example
///
/// ❌ **BAD** (no image source):
/// ```json
/// {
///   "name": "Invalid Container",
///   "features": {}
/// }
/// ```
///
/// ✅ **GOOD** (has image):
/// ```json
/// {
///   "name": "Valid Container",
///   "image": "mcr.microsoft.com/devcontainers/base:ubuntu"
/// }
/// ```
pub fn check_devcontainer001(json: &Value) -> LintResult {
    let mut result = LintResult::new();

    let has_image = json.get("image").is_some();
    let has_build = json.get("build").is_some();
    let has_compose = json.get("dockerComposeFile").is_some();

    if !has_image && !has_build && !has_compose {
        let span = Span::new(1, 1, 1, 1);
        let diag = Diagnostic::new(
            "DEVCONTAINER001",
            Severity::Error,
            "Missing image source. devcontainer.json must specify 'image', 'build', or 'dockerComposeFile'.".to_string(),
            span,
        );
        result.add(diag);
    }

    result
}

/// DEVCONTAINER002: Using :latest tag
///
/// Using ':latest' tag reduces reproducibility. Pin specific version.
///
/// ## Example
///
/// ❌ **BAD** (uses :latest):
/// ```json
/// {
///   "image": "mcr.microsoft.com/devcontainers/base:latest"
/// }
/// ```
///
/// ✅ **GOOD** (pinned version):
/// ```json
/// {
///   "image": "mcr.microsoft.com/devcontainers/base:ubuntu-22.04"
/// }
/// ```
pub fn check_devcontainer002(json: &Value) -> LintResult {
    let mut result = LintResult::new();

    if let Some(image) = json.get("image").and_then(|v| v.as_str()) {
        if image.ends_with(":latest") {
            let span = Span::new(1, 1, 1, 1);
            let diag = Diagnostic::new(
                "DEVCONTAINER002",
                Severity::Warning,
                "Using ':latest' tag. Pin specific version for reproducible builds.".to_string(),
                span,
            );
            result.add(diag);
        }
    }

    result
}

/// DEVCONTAINER003: Absolute path in build.dockerfile
///
/// build.dockerfile should use relative paths for portability.
///
/// ## Example
///
/// ❌ **BAD** (absolute path):
/// ```json
/// {
///   "build": {
///     "dockerfile": "/absolute/path/Dockerfile"
///   }
/// }
/// ```
///
/// ✅ **GOOD** (relative path):
/// ```json
/// {
///   "build": {
///     "dockerfile": "Dockerfile"
///   }
/// }
/// ```
pub fn check_devcontainer003(json: &Value) -> LintResult {
    let mut result = LintResult::new();

    if let Some(build) = json.get("build") {
        if let Some(dockerfile) = build.get("dockerfile").and_then(|v| v.as_str()) {
            if dockerfile.starts_with('/') {
                let span = Span::new(1, 1, 1, 1);
                let diag = Diagnostic::new(
                    "DEVCONTAINER003",
                    Severity::Error,
                    "Absolute path in build.dockerfile. Use relative path for portability."
                        .to_string(),
                    span,
                );
                result.add(diag);
            }
        }
    }

    result
}

/// DEVCONTAINER004: Docker Compose without service
///
/// dockerComposeFile requires 'service' property to specify which service to use.
///
/// ## Example
///
/// ❌ **BAD** (missing service):
/// ```json
/// {
///   "dockerComposeFile": "docker-compose.yml"
/// }
/// ```
///
/// ✅ **GOOD** (has service):
/// ```json
/// {
///   "dockerComposeFile": "docker-compose.yml",
///   "service": "app"
/// }
/// ```
pub fn check_devcontainer004(json: &Value) -> LintResult {
    let mut result = LintResult::new();

    let has_compose = json.get("dockerComposeFile").is_some();
    let has_service = json.get("service").is_some();

    if has_compose && !has_service {
        let span = Span::new(1, 1, 1, 1);
        let diag = Diagnostic::new(
            "DEVCONTAINER004",
            Severity::Error,
            "Docker Compose config requires 'service' property to specify which service to use."
                .to_string(),
            span,
        );
        result.add(diag);
    }

    result
}

/// DEVCONTAINER005: Unknown feature option
///
/// Feature configurations should only use known options.
///
/// Note: This is a warning since new options may be added.
pub fn check_devcontainer005(json: &Value) -> LintResult {
    let mut result = LintResult::new();

    let features = match json.get("features").and_then(|v| v.as_object()) {
        Some(f) => f,
        None => return result,
    };

    for (feature_name, feature_config) in features {
        check_feature_options(feature_name, feature_config, &mut result);
    }

    result
}

/// Check a single feature's options for obviously invalid keys
fn check_feature_options(feature_name: &str, feature_config: &Value, result: &mut LintResult) {
    let config = match feature_config.as_object() {
        Some(c) => c,
        None => return,
    };

    for key in config.keys() {
        if key.starts_with("unknown") {
            let span = Span::new(1, 1, 1, 1);
            result.add(Diagnostic::new(
                "DEVCONTAINER005",
                Severity::Warning,
                format!(
                    "Unknown option '{}' in feature '{}'. Check feature documentation for valid options.",
                    key, feature_name
                ),
                span,
            ));
        }
    }
}

/// DEVCONTAINER006: Duplicate keys in lifecycle command
///
/// Object-style lifecycle commands must not have duplicate keys.
///
/// Note: This is detected at JSON parse time for strict parsers,
/// but serde_json uses last-value-wins, so we check post-parse.
pub fn check_devcontainer006(_json: &Value) -> LintResult {
    // Note: serde_json handles duplicate keys by using last value
    // This rule would need raw JSON parsing to detect duplicates
    // For now, we trust serde_json's behavior
    LintResult::new()
}

/// DEVCONTAINER007: Invalid waitFor value
///
/// waitFor must be one of: onCreateCommand, updateContentCommand, or postCreateCommand.
pub fn check_devcontainer007(json: &Value) -> LintResult {
    let mut result = LintResult::new();

    if let Some(wait_for) = json.get("waitFor").and_then(|v| v.as_str()) {
        let valid_values = [
            "onCreateCommand",
            "updateContentCommand",
            "postCreateCommand",
        ];

        if !valid_values.contains(&wait_for) {
            let span = Span::new(1, 1, 1, 1);
            let diag = Diagnostic::new(
                "DEVCONTAINER007",
                Severity::Error,
                format!(
                    "Invalid waitFor value '{}'. Must be: onCreateCommand, updateContentCommand, or postCreateCommand.",
                    wait_for
                ),
                span,
            );
            result.add(diag);
        }
    }

    result
}

/// DEVCONTAINER008: updateRemoteUserUID may cause permission issues
///
/// On Linux, updateRemoteUserUID=false may cause permission issues with bind mounts.
pub fn check_devcontainer008(json: &Value) -> LintResult {
    let mut result = LintResult::new();

    if let Some(update_uid) = json.get("updateRemoteUserUID").and_then(|v| v.as_bool()) {
        if !update_uid {
            let span = Span::new(1, 1, 1, 1);
            let diag = Diagnostic::new(
                "DEVCONTAINER008",
                Severity::Info,
                "updateRemoteUserUID=false may cause permission issues with bind mounts on Linux."
                    .to_string(),
                span,
            );
            result.add(diag);
        }
    }

    result
}

/// DEVCONTAINER009: workspaceFolder must be absolute path
///
/// workspaceFolder must be an absolute path starting with '/'.
pub fn check_devcontainer009(json: &Value) -> LintResult {
    let mut result = LintResult::new();

    if let Some(folder) = json.get("workspaceFolder").and_then(|v| v.as_str()) {
        if !folder.starts_with('/') {
            let span = Span::new(1, 1, 1, 1);
            let diag = Diagnostic::new(
                "DEVCONTAINER009",
                Severity::Error,
                "workspaceFolder must be an absolute path.".to_string(),
                span,
            );
            result.add(diag);
        }
    }

    result
}

/// DEVCONTAINER010: containerEnv values must be strings
///
/// Environment variable values in containerEnv must be strings.
pub fn check_devcontainer010(json: &Value) -> LintResult {
    let mut result = LintResult::new();

    if let Some(env) = json.get("containerEnv").and_then(|v| v.as_object()) {
        for (key, value) in env {
            if !value.is_string() {
                let span = Span::new(1, 1, 1, 1);
                let diag = Diagnostic::new(
                    "DEVCONTAINER010",
                    Severity::Error,
                    format!(
                        "containerEnv value for '{}' must be a string, got {}.",
                        key,
                        value_type_name(value)
                    ),
                    span,
                );
                result.add(diag);
            }
        }
    }

    result
}

/// DEVCONTAINER011: Invalid extension ID format
///
/// VS Code extension IDs should be in format: publisher.extension-name
pub fn check_devcontainer011(json: &Value) -> LintResult {
    let mut result = LintResult::new();

    if let Some(customizations) = json.get("customizations") {
        if let Some(vscode) = customizations.get("vscode") {
            if let Some(extensions) = vscode.get("extensions").and_then(|v| v.as_array()) {
                for ext in extensions {
                    if let Some(ext_id) = ext.as_str() {
                        // Valid format: publisher.extension-name
                        if !ext_id.contains('.') || ext_id.starts_with('.') || ext_id.ends_with('.')
                        {
                            let span = Span::new(1, 1, 1, 1);
                            let diag = Diagnostic::new(
                                "DEVCONTAINER011",
                                Severity::Warning,
                                format!(
                                    "Invalid extension ID '{}'. Expected format: publisher.extension-name",
                                    ext_id
                                ),
                                span,
                            );
                            result.add(diag);
                        }
                    }
                }
            }
        }
    }

    result
}

include!("devcontainer_value.rs");