graph

func BuildModeledGraph ¶

func BuildModeledGraph(template map[string]any, includeIcons bool) (*corerpv20250801preview.ApplicationGraphResponse, error)

BuildModeledGraph parses an ARM JSON template (typically the output of `bicep build` on an application's app.bicep) and returns the corresponding modeled application graph. The graph contains application resources, their connections and dependsOn relationships, resource-specific authored properties (with sensitive values nulled), and a stable diff hash for each resource. It does not contain output resources or runtime status — those are only available for planned and deployed graphs.

Sensitive values are redacted using two rules applied to every property in the emitted Properties bag:

1. Values that reference a Bicep `@secure() param` (surfaced in the compiled template as `parameters.<name>.type == "secureString"` for scalar and `"secureObject"` for structured secrets) are nulled.
2. Values whose property key case-insensitively matches a well-known secret name (`password`, `connectionString`, `apiKey`, etc.) are nulled regardless of source.

See eng/design-notes/security/2026-07-static-graph-sensitive-redaction.md for the full contract.

func ComputeDiffHash ¶

func ComputeDiffHash(properties map[string]any, dependsOn ...string) (string, error)

ComputeDiffHash returns a stable "sha256:<hex>" digest computed over the authorable subset of properties and a sorted dependsOn list. The digest lets tooling classify resources as added, removed, modified or unchanged across two graphs of the same application without comparing every property.

func ExtractDependsOnEdges ¶

func ExtractDependsOnEdges(template map[string]any, rootScope string) map[string][]*corerpv20250801preview.ApplicationGraphConnection

ExtractDependsOnEdges walks a compiled ARM JSON template and returns a map from each resource's canonical Radius ID to the list of outbound Kind: Dependency edges implied by that resource's dependsOn. The shape matches GetGraphRequest.dependsOnEdges on Radius.Core/2025-08-01-preview, so callers can attach the result directly to a deployed-graph request to enrich it with the same implicit dependencies the static graph would surface.

rootScope selects the plane / resource-group prefix used when constructing source and target resource IDs. It must match the scope of the deployed graph the extracted edges will be merged against, because MergeDependencyEdges performs exact-string ID matching. Callers targeting the current workspace should pass workspace.Scope (typically "/planes/radius/local/resourceGroups/<rg>"). An empty rootScope falls back to the modeled-graph default plane and resource group, which is only appropriate when the extracted edges are merged into a modeled graph built by BuildModeledGraph.

Resources whose type is in edges.ExcludedResourceTypes are omitted as sources (they are never edge sources anyway). Individual dependsOn entries that resolve to a canonical ID are included regardless of target type; edges.MergeDependencyEdges applies the target-type exclusion server- and CLI-side. Unresolvable entries (dynamic resourceId expressions, non-Radius symbolic references) are dropped.