Implement WalkModuleCalls

This allows rulesets to add lints that enforce rules on module calls
rather than only on resource declarations. I plan to use it, for
instance, to constrain the different forms of addresses used for
module sources.

Version constraints may be a bit different over the wire: the type exposed
by `go-version` can't necessarily be exactly reconstructed, as they've
been normalized under the hood. The original value is still accessible
through the usual `hcl.Body.PartialContent` or similar functions, if
needed.

In Terraform 0.12, I think the `Count` and `ForEach` struct members
will never actually be set, but the corresponding Terraform types have
them, so I've included them here. Maybe they'll Just Work once 0.13 is
out of beta and support is added to tflint.

Author: pd

go.mod

@@ -6,6 +6,7 @@ require (
 	github.com/google/go-cmp v0.5.0
 	github.com/hashicorp/go-hclog v0.14.1
 	github.com/hashicorp/go-plugin v1.3.0
+	github.com/hashicorp/go-version v1.0.0
 	github.com/hashicorp/hcl/v2 v2.6.0
 	github.com/zclconf/go-cty v1.5.1
 )

go.sum

@@ -39,6 +39,8 @@ github.com/hashicorp/go-hclog v0.14.1 h1:nQcJDQwIAGnmoUWp8ubocEX40cCml/17YkF6csQ
 github.com/hashicorp/go-hclog v0.14.1/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
 github.com/hashicorp/go-plugin v1.3.0 h1:4d/wJojzvHV1I4i/rrjVaeuyxWrLzDE1mDCyDy8fXS8=
 github.com/hashicorp/go-plugin v1.3.0/go.mod h1:F9eH4LrE/ZsRdbwhfjs9k9HoDUwAHnYtXdgmf1AVNs0=
+github.com/hashicorp/go-version v1.0.0 h1:21MVWPKDphxa7ineQQTrCU5brh7OuVVAzGOCnnCPtE8=
+github.com/hashicorp/go-version v1.0.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/hcl/v2 v2.6.0 h1:3krZOfGY6SziUXa6H9PJU6TyohHn7I+ARYnhbeNBz+o=
 github.com/hashicorp/hcl/v2 v2.6.0/go.mod h1:bQTN5mpo+jewjJgh8jr0JUguIi7qPHUF6yIfAEN3jqY=
 github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb h1:b5rjCoWHc7eqmAS4/qyk21ZsHyb6Mxv/jykxvNTkU4M=

helper/runner.go

@@ -135,6 +135,11 @@ func (r *Runner) WalkResources(resourceType string, walker func(*terraform.Resou
 	return nil
 }
 
+// WalkModuleCalls visits all module calls from Files.
+func (r *Runner) WalkModuleCalls(walker func(*terraform.ModuleCall) error) error {
+	return nil
+}
+
 // Backend returns the terraform backend configuration.
 func (r *Runner) Backend() (*terraform.Backend, error) {
 	for _, file := range r.Files {

terraform/configs.go

@@ -1,6 +1,9 @@
 package terraform
 
-import "github.com/hashicorp/hcl/v2"
+import (
+	"github.com/hashicorp/go-version"
+	"github.com/hashicorp/hcl/v2"
+)
 
 // Resource is an alternative representation of configs.Resource.
 // https://github.com/hashicorp/terraform/blob/v0.12.26/configs/resource.go#L13-L33
@@ -39,6 +42,13 @@ type ManagedResource struct {
 	PreventDestroySet      bool
 }
 
+// PassedProviderConfig is an alternative representation of configs.PassedProviderConfig.
+// https://github.com/hashicorp/terraform/blob/v0.12.26/configs/module_call.go#L155-L158
+type PassedProviderConfig struct {
+	InChild  *ProviderConfigRef
+	InParent *ProviderConfigRef
+}
+
 // ProviderConfigRef is an alternative representation of configs.ProviderConfigRef.
 // https://github.com/hashicorp/terraform/blob/v0.12.26/configs/resource.go#L371-L376
 type ProviderConfigRef struct {
@@ -79,6 +89,40 @@ type Backend struct {
 	DeclRange   hcl.Range
 }
 
+// ModuleCall is an alternative representation of configs.ModuleCall.
+// https://github.com/hashicorp/terraform/blob/v0.12.26/configs/module_call.go#L11-L31
+// DependsOn is not supported due to the difficulty of intermediate representation.
+type ModuleCall struct {
+	Name string
+
+	SourceAddr      string
+	SourceAddrRange hcl.Range
+	SourceSet       bool
+
+	Config      hcl.Body
+	ConfigRange hcl.Range
+
+	Version VersionConstraint
+
+	Count        hcl.Expression
+	CountRange   hcl.Range
+	ForEach      hcl.Expression
+	ForEachRange hcl.Range
+
+	Providers []PassedProviderConfig
+
+	// DependsOn []hcl.Traversal
+
+	DeclRange hcl.Range
+}
+
+// VersionConstraint is an alternative representation of configs.VersionConstraint.
+// https://github.com/hashicorp/terraform/blob/v0.12.26/configs/version_constraint.go#L16-L19
+type VersionConstraint struct {
+	Required  version.Constraints
+	DeclRange hcl.Range
+}
+
 // ProvisionerWhen is an alternative representation of configs.ProvisionerWhen.
 // https://github.com/hashicorp/terraform/blob/v0.12.26/configs/provisioner.go#L172-L181
 type ProvisionerWhen int

tflint/client/client.go

@@ -103,6 +103,33 @@ func (c *Client) WalkResources(resource string, walker func(*terraform.Resource)
 	return nil
 }
 
+// WalkModuleCalls calls the server-side ModuleCalls method and passed the decode response
+// to the passed function.
+func (c *Client) WalkModuleCalls(walker func(*terraform.ModuleCall) error) error {
+	log.Printf("[DEBUG] WalkModuleCalls")
+
+	var response ModuleCallsResponse
+	if err := c.rpcClient.Call("Plugin.ModuleCalls", ModuleCallsRequest{}, &response); err != nil {
+		return err
+	}
+	if response.Err != nil {
+		return response.Err
+	}
+
+	for _, c := range response.ModuleCalls {
+		call, diags := decodeModuleCall(c)
+		if diags.HasErrors() {
+			return diags
+		}
+
+		if err := walker(call); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
 // Backend calls the server-side Backend method and returns the backend configuration.
 func (c *Client) Backend() (*terraform.Backend, error) {
 	log.Printf("[DEBUG] Backend")

tflint/client/decode.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/hashicorp/go-version"
 	hcl "github.com/hashicorp/hcl/v2"
 	"github.com/hashicorp/hcl/v2/hclsyntax"
 	"github.com/terraform-linters/tflint-plugin-sdk/terraform"
@@ -165,6 +166,113 @@ func decodeManagedResource(resource *ManagedResource) (*terraform.ManagedResourc
 	}, nil
 }
 
+// ModuleCall is an intermediate representation of terraform.ModuleCall.
+type ModuleCall struct {
+	Name string
+
+	SourceAddr      string
+	SourceAddrRange hcl.Range
+	SourceSet       bool
+
+	Version      string
+	VersionRange hcl.Range
+
+	Config      []byte
+	ConfigRange hcl.Range
+
+	Count        []byte
+	CountRange   hcl.Range
+	ForEach      []byte
+	ForEachRange hcl.Range
+
+	Providers []PassedProviderConfig
+	DeclRange hcl.Range
+
+	// DependsOn []hcl.Traversal
+}
+
+// PassedProviderConfig is an intermediate representation of terraform.PassedProviderConfig.
+type PassedProviderConfig struct {
+	InChild  *terraform.ProviderConfigRef
+	InParent *terraform.ProviderConfigRef
+}
+
+func decodeModuleCall(call *ModuleCall) (*terraform.ModuleCall, hcl.Diagnostics) {
+	file, diags := parseConfig(call.Config, call.ConfigRange.Filename, call.ConfigRange.Start)
+	if diags.HasErrors() {
+		return nil, diags
+	}
+
+	var count hcl.Expression
+	if call.Count != nil {
+		count, diags = parseExpression(call.Count, call.CountRange.Filename, call.CountRange.Start)
+		if diags.HasErrors() {
+			return nil, diags
+		}
+	}
+
+	var forEach hcl.Expression
+	if call.ForEach != nil {
+		forEach, diags = parseExpression(call.ForEach, call.ForEachRange.Filename, call.ForEachRange.Start)
+		if diags.HasErrors() {
+			return nil, diags
+		}
+	}
+
+	providers := []terraform.PassedProviderConfig{}
+	for _, provider := range call.Providers {
+		providers = append(providers, terraform.PassedProviderConfig{
+			InChild:  provider.InChild,
+			InParent: provider.InParent,
+		})
+	}
+
+	versionConstraint := terraform.VersionConstraint{DeclRange: call.VersionRange}
+	if !call.VersionRange.Empty() {
+		required, err := version.NewConstraint(call.Version)
+		if err != nil {
+			detail := fmt.Sprintf(
+				"ModuleCall '%s' version constraint '%s' parse error: %s",
+				call.Name,
+				call.Version,
+				err,
+			)
+
+			return nil, hcl.Diagnostics{
+				&hcl.Diagnostic{
+					Severity: hcl.DiagError,
+					Summary:  "Failed to reparse module version constraint",
+					Detail:   detail,
+					Subject:  &call.VersionRange,
+				},
+			}
+		}
+
+		versionConstraint.Required = required
+	}
+
+	return &terraform.ModuleCall{
+		Name: call.Name,
+
+		SourceAddr:      call.SourceAddr,
+		SourceAddrRange: call.SourceAddrRange,
+		SourceSet:       call.SourceSet,
+
+		Config:      file.Body,
+		ConfigRange: call.ConfigRange,
+
+		Version: versionConstraint,
+
+		Count:        count,
+		CountRange:   call.CountRange,
+		ForEach:      forEach,
+		ForEachRange: call.ForEachRange,
+
+		Providers: providers,
+		DeclRange: call.DeclRange,
+	}, nil
+}
+
 // Backend is an intermediate representation of terraform.Backend.
 type Backend struct {
 	Type        string

tflint/client/rpc.go

@@ -38,6 +38,15 @@ type BlocksResponse struct {
 	Err    error
 }
 
+// ModuleCallsRequest is a request to the server-side ModuleCalls method.
+type ModuleCallsRequest struct{}
+
+// ModuleCallsResponse is a response to the server-side ModuleCalls method.
+type ModuleCallsResponse struct {
+	ModuleCalls []*ModuleCall
+	Err         error
+}
+
 // ResourcesRequest is a request to the server-side Resources method.
 type ResourcesRequest struct {
 	Name string

tflint/interface.go

@@ -20,6 +20,9 @@ type Runner interface {
 	// You must pass a resource type as the first argument.
 	WalkResources(string, func(*terraform.Resource) error) error
 
+	// WalkModuleCalls visits module calls with the passed function.
+	WalkModuleCalls(func(*terraform.ModuleCall) error) error
+
 	// Backend returns the backend configuration, if any.
 	Backend() (*terraform.Backend, error)
 

tflint/server/server.go

@@ -7,6 +7,7 @@ type Server interface {
 	Attributes(*client.AttributesRequest, *client.AttributesResponse) error
 	Blocks(*client.BlocksRequest, *client.BlocksResponse) error
 	Resources(*client.ResourcesRequest, *client.ResourcesResponse) error
+	ModuleCalls(*client.ModuleCallsRequest, *client.ModuleCallsResponse) error
 	Backend(*client.BackendRequest, *client.BackendResponse) error
 	EvalExpr(*client.EvalExprRequest, *client.EvalExprResponse) error
 	EmitIssue(*client.EmitIssueRequest, *interface{}) error