make sub expansions only run for the classification that generated th…

…em (#813)

pkg/engine2/operational_eval/vertex_path_expand.go

@@ -158,12 +158,33 @@ func (v *pathExpandVertex) runExpansion(eval *Evaluator, expansion path_selectio
 	if err := eval.AddResources(resources...); err != nil {
 		return err
 	}
-	if err := eval.AddEdges(result.Edges...); err != nil {
+	if err := eval.AddEdges(edges...); err != nil {
 		return err
 	}
-	if err := eval.AddEdges(edges...); err != nil {
+
+	// add sub expansions returned from the result, only for the classification of this expansion
+	changes := newChanges()
+	for _, subExpand := range result.Edges {
+		pathSatisfications, err := eval.Solution.KnowledgeBase().GetPathSatisfactionsFromEdge(subExpand.Source, subExpand.Target)
+		if err != nil {
+			return fmt.Errorf("could not get path satisfications for sub expansion %s -> %s: %w",
+				subExpand.Source, subExpand.Target, err)
+		}
+
+		for _, satisfication := range pathSatisfications {
+			if satisfication.Classification == v.Satisfication.Classification {
+				changes.addNode(&pathExpandVertex{
+					Edge:          construct.SimpleEdge{Source: subExpand.Source, Target: subExpand.Target},
+					TempGraph:     expansion.TempGraph,
+					Satisfication: satisfication,
+				})
+			}
+		}
+	}
+	if err := eval.enqueue(changes); err != nil {
 		return err
 	}
+
 	delays, err := knowledgebase.ConsumeFromResource(expansion.Dep.Source, expansion.Dep.Target, solution_context.DynamicCtx(eval.Solution))
 	if err != nil {
 		return err

pkg/engine2/path_selection/path_expansion.go

@@ -77,6 +77,20 @@ func expandEdge(
 		return nil, errors.Join(errs, fmt.Errorf("could not find shortest path between %s and %s: %w", input.Dep.Source.ID, input.Dep.Target.ID, err))
 	}
 
+	resultResources, err := renameAndReplaceInTempGraph(ctx, input, g, path)
+	errs = errors.Join(errs, err)
+	errs = errors.Join(errs, handleProperties(ctx, resultResources, input.TempGraph, g))
+	edges, err := findSubExpansionsToRun(resultResources, ctx)
+	return edges, errors.Join(errs, err)
+}
+
+func renameAndReplaceInTempGraph(
+	ctx solution_context.SolutionContext,
+	input ExpansionInput,
+	g construct.Graph,
+	path construct.Path,
+) ([]*construct.Resource, error) {
+	var errs error
 	name := fmt.Sprintf("%s-%s", input.Dep.Source.ID.Name, input.Dep.Target.ID.Name)
 	// rename phantom nodes
 	result := make(construct.Path, len(path))
@@ -89,7 +103,8 @@ func expandEdge(
 				if err != nil && errors.Is(err, graph.ErrVertexNotFound) {
 					break
 				} else if err != nil {
-					return nil, err
+					errs = errors.Join(errs, err)
+					continue
 				}
 				id.Name = fmt.Sprintf("%s-%d", name, suffix)
 			}
@@ -100,13 +115,16 @@ func expandEdge(
 		}
 		result[i] = id
 	}
-	resultResources, errs := addPathToGraph(ctx, g, result)
-	if errs != nil {
+	resultResources, err := addPathToGraph(ctx, g, result)
+	if err != nil {
 		return nil, errors.Join(errs, err)
 	}
-	errs = errors.Join(errs, handleProperties(ctx, resultResources, input.TempGraph, g))
-	edges, err := findSubExpansionsToRun(resultResources, ctx)
-	return edges, errors.Join(errs, err)
+
+	// We need to replace the phantom nodes in the temp graph in case we reuse the temp graph for sub expansions
+	for i, res := range resultResources {
+		errs = errors.Join(errs, construct.ReplaceResource(input.TempGraph, path[i], res))
+	}
+	return resultResources, errs
 }
 
 func findSubExpansionsToRun(

pkg/engine2/solution_context/decisions.go

@@ -74,12 +74,12 @@ func (d PropertyValidationDecision) MarshalJSON() ([]byte, error) {
 			"resource": d.Resource,
 			"property": d.Property.Details().Path,
 			"value":    d.Value,
-			"error":    d.Error,
+			"error":    d.Error.Error(),
 		})
 	}
 	return json.Marshal(map[string]any{
 		"resource": d.Resource,
 		"property": d.Property.Details().Path,
-		"error":    d.Error,
+		"error":    d.Error.Error(),
 	})
 }

pkg/infra/iac3/templates/aws/ecs_task_definition/efs_volumes.ts.tmpl

@@ -1,5 +1,5 @@
 [
-    {{- range $i, $volume := . }}
+    {{- range $i, $volume := .M }}
     { 
         name: "{{ $volume.Name }}",
         efsVolumeConfiguration: {

pkg/templates/aws/edges/service_api.yaml

@@ -11,4 +11,4 @@ targets:
   - aws:sqs_queue
   - aws:secret
 
-edge_weight_multiplier: 1.5
+edge_weight_multiplier: 1.08

pkg/templates/aws/resources/iam_policy.yaml

@@ -48,6 +48,7 @@ classification:
   is:
     - policy
     - security
+    - permissions
   gives:
     - permissions