1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167

<#
.SYNOPSIS
    Validates Rego policy formatting, syntax, and catalog.json schema.

.DESCRIPTION
    Runs opa fmt in-place on all Rego files, checks syntax with opa check --strict,
    and validates every policy entry in catalog.json against the required schema.

.PARAMETER PoliciesDir
    Path to the policies directory. Defaults to .\policies.

.PARAMETER CatalogFile
    Path to catalog.json. Defaults to .\policies\catalog.json.

.EXAMPLE
    .\scripts\validate-policy-catalog.ps1

.EXAMPLE
    .\scripts\validate-policy-catalog.ps1 -PoliciesDir .\policies -CatalogFile .\policies\catalog.json
#>

[CmdletBinding()]
param(
    [Parameter(HelpMessage = "Path to the policies directory")]
    [string] $PoliciesDir = ".\policies",

    [Parameter(HelpMessage = "Path to catalog.json")]
    [string] $CatalogFile = ".\policies\catalog.json"
)

# Helpers --------------------------------------------------------------------

function Write-Log {
    param(
        [Parameter(Mandatory = $true)][string] $Message,
        [ValidateSet("INF", "WRN", "ERR")][string] $Level = "INF"
    )

    $colors = @{ INF = "Blue"; WRN = "Yellow"; ERR = "Red" }

    Write-Host "[validate-policy-catalog] " -ForegroundColor DarkGray -NoNewline
    Write-Host $Level -ForegroundColor $colors[$Level] -NoNewline
    Write-Host " $Message"
}

# Validation -----------------------------------------------------------------

function Invoke-FmtCheck([string] $Dir) {
    Write-Log "Formatting Rego files in $Dir"
    opa fmt -w $Dir 2>&1 | Out-Null
    opa fmt --fail $Dir > $null 2>&1
    if ($LASTEXITCODE -ne 0) {
        Write-Log "Formatting issues remain after fmt pass" -Level ERR
        return $false
    }
    Write-Log "Rego files formatted"
    return $true
}

function Invoke-SyntaxCheck([string] $Dir) {
    Write-Log "Checking Rego syntax in $Dir"
    $output = opa check --strict $Dir 2>&1
    if ($LASTEXITCODE -ne 0) {
        foreach ($line in $output) {
            Write-Log $line -Level ERR
        }
        return $false
    }
    Write-Log "Rego syntax is valid"
    return $true
}

function Invoke-CatalogCheck([string] $File) {
    Write-Log "Validating catalog schema in $File"

    if (-not (Test-Path $File)) {
        Write-Log "Catalog file not found: $File" -Level ERR
        return $false
    }

    $catalog = Get-Content $File -Raw | ConvertFrom-Json
    $policies = $catalog.policies

    if ($null -eq $policies) {
        Write-Log "No policies key found in $File" -Level ERR
        return $false
    }

    $requiredFields = @("title", "description", "severity", "category", "provider", "enabled", "remediation", "references")
    $validSeverities = @("critical", "high", "medium", "low")
    $idPattern = '^ICP-TF-[A-Z]+-[A-Z]+-\d{3}$'

    $errors = 0

    foreach ($id in $policies.PSObject.Properties.Name) {
        $policy = $policies.$id

        # Validate rule ID format
        if ($id -notmatch $idPattern) {
            Write-Log "$id — invalid rule ID format (expected ICP-TF-{PROVIDER}-{CATEGORY}-{NNN})" -Level ERR
            $errors++
        }

        # Validate required fields
        foreach ($field in $requiredFields) {
            if ($null -eq $policy.$field) {
                Write-Log "$id — missing required field: $field" -Level ERR
                $errors++
            }
        }

        # Validate severity value
        if ($null -ne $policy.severity -and $policy.severity -notin $validSeverities) {
            Write-Log "$id — invalid severity '$($policy.severity)' (expected: critical, high, medium, low)" -Level ERR
            $errors++
        }

        # Validate provider matches ID segment
        $idProvider = $id.Split("-")[2]
        if ($null -ne $policy.provider -and $policy.provider -ne $idProvider) {
            Write-Log "$id — provider '$($policy.provider)' does not match ID segment '$idProvider'" -Level ERR
            $errors++
        }

        # Validate category segment in ID exists in provider
        if ($null -ne $policy.references -and $policy.references.Count -eq 0) {
            Write-Log "$id — references must not be empty" -Level ERR
            $errors++
        }

        # Validate enabled is boolean
        if ($policy.enabled -isnot [bool]) {
            Write-Log "$id — enabled must be a boolean" -Level ERR
            $errors++
        }
    }

    if ($errors -gt 0) {
        Write-Log "$errors schema $(if ($errors -eq 1) { 'error' } else { 'errors' }) found in catalog" -Level ERR
        return $false
    }

    Write-Log "Catalog schema is valid ($($policies.PSObject.Properties.Name.Count) policies)"
    return $true
}

# Main -----------------------------------------------------------------------

Write-Log "Starting policy validation workflow"

$failed = $false

if (-not (Test-Path $PoliciesDir)) {
    Write-Log "Policies directory not found: $PoliciesDir" -Level ERR
    exit 1
}

if (-not (Invoke-FmtCheck $PoliciesDir)) { $failed = $true }
if (-not (Invoke-SyntaxCheck $PoliciesDir)) { $failed = $true }
if (-not (Invoke-CatalogCheck $CatalogFile)) { $failed = $true }

if ($failed) {
    Write-Log "Validation failed" -Level ERR
    exit 1
}

Write-Log "All checks passed"