ability to allow and deny envs, regions, and stacks

lib/terraspace/app.rb

@@ -12,16 +12,26 @@ def initialize
 
     def defaults
       config = ActiveSupport::OrderedOptions.new
+
       config.all = ActiveSupport::OrderedOptions.new
       config.all.concurrency = 5
       config.all.exit_on_fail = ActiveSupport::OrderedOptions.new
       config.all.exit_on_fail.down = true
       config.all.exit_on_fail.up = true
-      config.all.ignore_stacks = nil
-      config.all.include_stacks = nil
+
       config.allow = ActiveSupport::OrderedOptions.new
       config.allow.envs = nil
       config.allow.regions = nil
+      config.allow.stacks = nil
+      config.deny = ActiveSupport::OrderedOptions.new
+      config.deny.envs = nil
+      config.deny.regions = nil
+      config.deny.stacks = nil
+
+      config.all.exclude_stacks = nil
+      config.all.include_stacks = nil
+      config.all.consider_allow_deny_stacks = true
+
       config.auto_create_backend = true
       config.build = ActiveSupport::OrderedOptions.new
       config.build.cache_dir = ":CACHE_ROOT/:REGION/:ENV/:BUILD_DIR"

lib/terraspace/app/callable_option.rb

@@ -0,0 +1,58 @@
+# Class represents a terraspace option that is possibly callable. Examples:
+#
+#    config.allow.envs
+#    config.allow.regions
+#    config.deny.envs
+#    config.deny.regions
+#    config.all.include_stacks
+#    config.all.exclude_stacks
+#
+# Abstraction is definitely obtuse. Using it to get rid of duplication.
+#
+class Terraspace::App
+  class CallableOption
+    include Terraspace::Util::Logging
+
+    def initialize(options={})
+      @options = options
+      # Example:
+      # config_name:  config.allow.envs
+      # config_value: ["dev"]
+      # args:         [@stack_name] # passed to object.call
+      @config_name = options[:config_name]
+      @config_value = options[:config_value]
+      @passed_args = options[:passed_args]
+    end
+
+    # Returns either an Array or nil
+    def object
+      case @config_value
+      when nil
+        return nil
+      when Array
+        return @config_value
+      when -> (c) { c.respond_to?(:public_instance_methods) && c.public_instance_methods.include?(:call) }
+        object= @config_value.new
+      when -> (c) { c.respond_to?(:call) }
+        object = @config_value
+      else
+        raise "Invalid option for #{@config_name}"
+      end
+
+      if object
+        result = @passed_args.empty? ? object.call : object.call(*@passed_args)
+        unless result.is_a?(Array) || result.is_a?(NilClass)
+          message = "ERROR: The #{@config_name} needs to return an Array or nil"
+          logger.info message.color(:yellow)
+          logger.info <<~EOL
+            The #{@config_name} when assigned a class, object, or proc must implement
+            the call method and return an Array or nil.
+            The current return value is a #{result.class}
+          EOL
+          raise message
+        end
+      end
+      result
+    end
+  end
+end

lib/terraspace/app/callable_option/concern.rb

@@ -0,0 +1,12 @@
+class Terraspace::App::CallableOption
+  module Concern
+    def callable_option(options={})
+      callable_option = Terraspace::App::CallableOption.new(
+        config_name: options[:config_name],
+        config_value: options[:config_value],
+        passed_args: options[:passed_args],
+      )
+      callable_option.object
+    end
+  end
+end

lib/terraspace/builder/allow.rb

@@ -5,39 +5,9 @@ def initialize(mod)
     end
 
     def check!
-      messages = []
-      unless env_allowed?
-        messages << "This env is not allowed to be used: TS_ENV=#{Terraspace.env}"
-        messages << "Allowed envs: #{config.allow.envs.join(', ')}"
-      end
-      unless region_allowed?
-        messages << "This region is not allowed to be used: Detected current region=#{current_region}"
-        messages << "Allowed regions: #{config.allow.regions.join(', ')}"
-      end
-      unless messages.empty?
-        puts "ERROR: The configs do not allow this.".color(:red)
-        puts messages
-        exit 1
-      end
-    end
-
-    def env_allowed?
-      return true unless config.allow.envs
-      config.allow.envs.include?(Terraspace.env)
-    end
-
-    def region_allowed?
-      return true unless config.allow.regions
-      config.allow.regions.include?(current_region)
-    end
-
-    def current_region
-      expander = Terraspace::Compiler::Expander.autodetect(@mod).expander
-      expander.region
-    end
-
-    def config
-      Terraspace.config
+      Env.new(@mod).check!
+      Stack.new(@mod).check!
+      Region.new(@mod).check!
     end
   end
 end

lib/terraspace/builder/allow/base.rb

@@ -0,0 +1,59 @@
+class Terraspace::Builder::Allow
+  class Base
+    include Terraspace::App::CallableOption::Concern
+
+    def initialize(mod)
+      @mod = mod # Only Region subclass uses @mod but keeping interface same for Env for simplicity
+      @stack_name = mod.name
+    end
+
+    def check!
+      messages = []
+      unless allowed?
+        messages << message # message is interface method
+      end
+      unless messages.empty?
+        puts "ERROR: The configs do not allow this.".color(:red)
+        puts messages
+        exit 1
+      end
+    end
+
+    def allowed?
+      if allows.nil? && denys.nil?
+        true
+      elsif denys.nil?
+        allows.include?(check_value)
+      elsif allows.nil?
+        !denys.include?(check_value)
+      else
+        allows.include?(check_value) && !denys.include?(check_value)
+      end
+    end
+
+    def allows
+      callable_option(
+        config_name: "config.allow.#{config_name}",
+        config_value: config.dig(:allow, config_name),
+        passed_args: [@stack_name],
+      )
+    end
+
+    def denys
+      callable_option(
+        config_name: "config.deny.#{config_name}",
+        config_value: config.dig(:deny, config_name),
+        passed_args: [@stack_name],
+      )
+    end
+
+  private
+    def config
+      Terraspace.config
+    end
+
+    def config_name
+      self.class.to_s.split('::').last.underscore.pluralize.to_sym # ActiveSuport::HashWithIndifferentAccess#dig requires symbol
+    end
+  end
+end

lib/terraspace/builder/allow/env.rb

@@ -0,0 +1,17 @@
+class Terraspace::Builder::Allow
+  class Env < Base
+    # interface method
+    def message
+      messages = []
+      messages << "This env is not allowed to be used: TS_ENV=#{Terraspace.env}"
+      messages << "Allow envs: #{allows.join(', ')}" if allows
+      messages << "Deny envs: #{denys.join(', ')}" if denys
+      messages.join("\n")
+    end
+
+    # interface method
+    def check_value
+      Terraspace.env
+    end
+  end
+end

lib/terraspace/builder/allow/region.rb

@@ -0,0 +1,31 @@
+class Terraspace::Builder::Allow
+  class Region < Base
+    # interface method
+    def message
+      messages = []
+      word = config_name.to_s # IE: regions or locations
+      messages << "This #{word.singularize} is not allowed to be used: Detected current #{word.singularize}=#{current_region}"
+      messages << "Allow #{word}: #{allows.join(', ')}" if allows
+      messages << "Deny #{word}: #{denys.join(', ')}" if denys
+      messages.join("\n")
+    end
+
+    # interface method
+    def check_value
+      current_region
+    end
+
+    def current_region
+      expander = Terraspace::Compiler::Expander.autodetect(@mod).expander
+      expander.region
+    end
+
+    def config_name
+      if config.allow.locations || config.deny.locations
+        :locations # ActiveSuport::HashWithIndifferentAccess#dig requires symbol
+      else
+        super # :regions
+      end
+    end
+  end
+end

lib/terraspace/builder/allow/stack.rb

@@ -0,0 +1,17 @@
+class Terraspace::Builder::Allow
+  class Stack < Base
+    # interface method
+    def message
+      messages = []
+      messages << "This stack is not allowed to be used for TS_ENV=#{Terraspace.env}"
+      messages << "Allow stacks: #{allows.join(', ')}" if allows
+      messages << "Deny stacks: #{denys.join(', ')}" if denys
+      messages.join("\n")
+    end
+
+    # interface method
+    def check_value
+      @mod.name
+    end
+  end
+end

lib/terraspace/compiler/select.rb

@@ -1,5 +1,6 @@
 module Terraspace::Compiler
   class Select
+    include Terraspace::App::CallableOption::Concern
     include Terraspace::Util::Logging
 
     def initialize(path)
@@ -22,48 +23,42 @@ def selected?
     end
 
     def include_stacks
-      include_option(:include_stacks)
+      if config.all.include_stacks
+        config_name = "config.all.include_stacks"
+        config_value = config.dig(:all, :include_stacks)
+      elsif config.all.consider_allow_deny_stacks
+        config_name = "config.allow.stacks"
+        config_value = config.dig(:allow, :stacks)
+      else
+        return
+      end
+      callable_option(
+        config_name: config_name,
+        config_value: config_value,
+        passed_args: [@stack_name],
+      )
     end
 
     def exclude_stacks
-      include_option(:exclude_stacks)
-    end
-
-    def include_option(name)
-      option = all[name]  # IE: include_stacks or exclude_stacks
-      option ||= all[:ignore_stacks] if name == :exclude_stacks
-      case option
-      when nil
-        return nil
-      when Array
-        return option
-      when -> (c) { c.respond_to?(:public_instance_methods) && c.public_instance_methods.include?(:call) }
-        object= option.new
-      when -> (c) { c.respond_to?(:call) }
-        object = option
+      if config.all.exclude_stacks
+        config_name = "config.all.exclude_stacks"
+        config_value = config.dig(:all, :exclude_stacks)
+      elsif config.all.consider_allow_deny_stacks
+        config_name = "config.deny.stacks"
+        config_value = config.dig(:deny, :stacks)
       else
-        raise "Invalid option for config.all.#{name}"
-      end
-
-      if object
-        result = object.call(@stack_name)
-        unless result.is_a?(Array) || result.is_a?(NilClass)
-          message = "ERROR: The config.all.#{name} needs to return an Array or nil"
-          logger.info message.color(:yellow)
-          logger.info <<~EOL
-            The config.all.#{name} when assigned a class, object, or proc must implement
-            the call method and return an Array or nil.
-            The current return value is a #{result.class}
-          EOL
-          raise message
-        end
+        return
       end
-      result
+      callable_option(
+        config_name: config_name,
+        config_value: config_value,
+        passed_args: [@stack_name],
+      )
     end
 
   private
-    def all
-      Terraspace.config.all
+    def config
+      Terraspace.config
     end
 
     def extract_stack_name(path)
@@ -72,7 +67,7 @@ def extract_stack_name(path)
 
     @@ignore_stacks_deprecation_warning = nil
     def ignore_stacks_deprecation_warning
-      return unless all.ignore_stacks
+      return unless config.all.ignore_stacks
       return if @@ignore_stacks_deprecation_warning
       puts <<~EOL.color(:yellow)
         DEPRECATED:  config.all.ignore_stacks