fix: Resolve existing resource symbolic references to malformed mocks

docs/changelog.md

@@ -41,6 +41,13 @@ What's changed since pre-release v1.48.0-B0228:
   - Container Registry:
     - Deprecated `Azure.ACR.GeoReplica` because ACR zone redundancy is automatic in supported regions.
       [#3846](https://github.com/Azure/PSRule.Rules.Azure/issues/3846)
+- Bug fixes:
+  - Fixed `cidrHost` and `cidrSubnet` failing on unresolved virtual network, subnet, and IPAM pool address prefixes by @oWretch.
+    [#3907](https://github.com/Azure/PSRule.Rules.Azure/issues/3907)
+  - Fixed `tryGet` throwing instead of returning `null` for a property lookup against an array by @oWretch.
+    [#3907](https://github.com/Azure/PSRule.Rules.Azure/issues/3907)
+  - Fixed cross-scope `existing` resource reference via symbolic name resolving to a malformed mock, breaking `concat()`/`map()` during pre-flight expansion.
+    [#3920](https://github.com/Azure/PSRule.Rules.Azure/issues/3920)
 - Engineering:
   - Bump YamlDotNet to 11.2.5.
 

src/PSRule.Rules.Azure/Arm/Deployments/TemplateContext.cs

@@ -219,12 +219,33 @@ public bool TryGetResource(string nameOrResourceId, out IResourceValue? resource
                 return false;
 
             var resourceId = nameOrResourceId;
+            IResourceValue? symbolResource = null;
             if (_Symbols.TryGetValue(nameOrResourceId, out var symbol) && symbol != null)
-                resourceId = symbol.GetId(0);
+            {
+                symbol.TryGetResource(0, out symbolResource);
+
+                // The ID of an existing resource is expanded on demand and may not be resolvable.
+                try
+                {
+                    resourceId = symbol.GetId(0);
+                }
+                catch
+                {
+                    resourceId = null;
+                }
+            }
 
             if (resourceId != null && _ResourceIds.TryGetValue(resourceId, out resource))
                 return true;
 
+            // Fall back to the resource attached to the symbol. Existing resources are tracked as symbols
+            // but are not added as deployable resources, so they are not in the resource ID lookup.
+            if (symbolResource != null)
+            {
+                resource = symbolResource;
+                return true;
+            }
+
             // Recurse search for resource in the parent deployment by original resource ID only.
             if (Parent != null && ResourceHelper.IsResourceId(nameOrResourceId) && Parent.TryGetResource(nameOrResourceId, out resource))
                 return true;
@@ -240,11 +261,27 @@ public bool TryGetResourceCollection(string symbolicName, out IResourceValue[]?
                 return false;
 
             var ids = array.GetIds();
-            resources = new IResourceValue[ids.Length];
+            var byId = new IResourceValue[ids.Length];
+            var resolved = true;
             for (var i = 0; i < ids.Length; i++)
-                resources[i] = _ResourceIds[ids[i]];
+            {
+                if (ids[i] == null || !_ResourceIds.TryGetValue(ids[i], out var item))
+                {
+                    resolved = false;
+                    break;
+                }
+                byId[i] = item;
+            }
 
-            return true;
+            if (resolved)
+            {
+                resources = byId;
+                return true;
+            }
+
+            // Fall back to the resources attached to the symbol for existing resources.
+            resources = array.GetResources();
+            return resources.Length > 0;
         }
 
 #nullable restore

src/PSRule.Rules.Azure/Arm/Expressions/ExpressionHelpers.cs

@@ -236,7 +236,7 @@ internal static bool TryPropertyOrField(object o, string propertyName, out objec
             return true;
         }
 
-        if (o is JToken jToken && o is not JValue)
+        if (o is JToken jToken && o is not JValue && o is not JArray)
         {
             var propertyToken = jToken[propertyName];
             if (propertyToken == null)

src/PSRule.Rules.Azure/Arm/Expressions/Functions.cs

@@ -289,21 +289,19 @@ internal static object Concat(ITemplateContext context, object[] args)
             return result.ToString();
         }
         // Array
-        else if (args[0] is Array || args[0] is JArray)
+        else if (ExpressionHelpers.TryArray(args[0], out var firstArray))
         {
             var result = new List<object>();
-            for (var i = 0; i < args.Length; i++)
+            for (var j = 0; j < firstArray.Length; j++)
+                result.Add(firstArray.GetValue(j));
+
+            for (var i = 1; i < args.Length; i++)
             {
-                if (args[i] is Array array)
+                if (ExpressionHelpers.TryArray(args[i], out var array))
                 {
                     for (var j = 0; j < array.Length; j++)
                         result.Add(array.GetValue(j));
                 }
-                else if (args[i] is JArray jArray)
-                {
-                    for (var j = 0; j < jArray.Count; j++)
-                        result.Add(jArray[j]);
-                }
             }
             return result.ToArray();
         }
@@ -1176,10 +1174,13 @@ private static object GetReferenceResult(IResourceValue resource, bool full)
             return full ? deployment : deployment.Properties;
 
         if (resource.Existing && !resource.Value.TryGetProperty<JObject>(PROPERTY_PROPERTIES, out _))
-            return full ? new Mock.MockResource(resource.Id) : new Mock.MockResource(resource.Id)[PROPERTY_PROPERTIES];
+        {
+            var mockResourceId = GetResourceIdOrSymbolicName(resource);
+            return full ? new Mock.MockResource(mockResourceId, resource.Type) : new Mock.MockResource(mockResourceId, resource.Type)[PROPERTY_PROPERTIES];
+        }
 
         if (!full && resource.Value.TryGetProperty<JObject>(PROPERTY_PROPERTIES, out var properties))
-            return new Mock.MockObject(properties);
+            return new Mock.MockResourceObject(properties, GetResourceIdOrSymbolicName(resource), resource.Type);
 
         return new Mock.MockObject(full ? resource.Value : new JObject());
     }
@@ -2736,11 +2737,28 @@ private static bool TryResourceIdOrSymbolicName(ITemplateContext context, string
             resourceId = resourceIdOrSymbolicName;
 
         if (context.TryGetResource(resourceIdOrSymbolicName, out var resource) && resource != null)
-            resourceId = resource.Id;
+            resourceId = GetResourceIdOrSymbolicName(resource);
 
         return resourceId != null;
     }
 
+    /// <summary>
+    /// Get the resource ID of a resource, falling back to the symbolic name.
+    /// The ID of an existing resource is expanded on demand and may not be resolvable, for example when
+    /// the scope of the resource depends on a value that is not known during expansion.
+    /// </summary>
+    private static string GetResourceIdOrSymbolicName(IResourceValue resource)
+    {
+        try
+        {
+            return resource.Id;
+        }
+        catch
+        {
+            return resource.SymbolicName;
+        }
+    }
+
     private static int Compare(object left, object right)
     {
         if (ExpressionHelpers.TryLong(left, out var longLeft) && ExpressionHelpers.TryLong(right, out var longRight))