velkugan/apim-dependency-explorer

Purpose and Extension Entry Points

APIM Dependency Explorer is a Chrome/Edge MV3 side-panel extension for discovering Azure API Management (APIM) API dependencies. Its runtime starts from manifest.json; the service worker in src/background.js configures side-panel behavior and optionally captures ARM bearer tokens. The interactive application is src/sidepanel.html and src/sidepanel.js.

Side-Panel Control Flow

src/sidepanel.js owns user interaction, token entry/session restoration, APIM service selection, API listing, expansion state, and report rendering. Initial API listing is lightweight. Expanding an API triggers dependency resolution; a service-wide catalog is lazily fetched once and retained for subsequent expansions. src/sidepanel.css provides the panel presentation and dependency fingerprint UI.

Azure Resource Manager Boundary

All Azure access is direct browser-side ARM REST traffic to https://management.azure.com, enabled by extension host permissions. src/lib/arm.js is the transport boundary: ARM paging, response caching, concurrency control, and retry/backoff behavior for throttling. src/lib/apim.js maps APIM concepts to ARM endpoints, parses resource IDs, and discovers APIM services/resources. Tokens are either user-provided or observed from portal ARM traffic by src/background.js; session tokens remain in chrome.storage.session.

Catalog and Per-API Resolution

src/lib/resolver.js is the orchestration layer. It builds reusable service-wide lookup tables for named values, backends, policy fragments, certificates, and loggers, then resolves an expanded API’s policy graph and associated APIM resources. Resolution covers API and optional operation policies, applicable product policies, recursively included fragments with cycle detection, and global policy only where <base /> semantics require it. It also joins discovered references to backend credentials, Key Vault metadata, diagnostics, identities, caches, OAuth/OpenID resources, and outbound URLs.

Policy Dependency Analysis

src/lib/policy-analyzer.js parses policy XML and classifies references rather than regexing raw policy text. It distinguishes actual named values from Liquid variables, C# expression content, and APIM policy variables. Its output separates valid dependencies from unresolved links, variable lookalikes, and excluded moustaches. This classification is a critical correctness boundary consumed by src/lib/resolver.js when turning policy text into resolvable ARM resources.

Data Shaping and Comparison

src/lib/compare.js supports dependency comparison/fingerprinting used by the UI to summarize dependency classes and identify broken references. src/lib/util.js supplies shared infrastructure such as JWT decoding and bounded async work pools. The UI receives resolved, categorized dependency data rather than issuing policy/resource calls itself.

Reporting and Non-Extension Execution

src/report.html, src/report.js, and src/report.css provide a separate report-oriented rendering surface for dependency results. The policy classifier can also run outside Chrome: tools/test-analyzer.mjs exercises src/lib/policy-analyzer.js in Node using linkedom, isolating XML/classification behavior from browser extension and ARM runtime concerns.