feat: implement workspace sub-resource filtering

Workspace sub-filters specified in workspaceSubFilters are now applied
at runtime. Each workspace's sub-filter is converted to a FilterConfig
and passed to the extraction pipeline. Wildcard patterns in workspace
names trigger discovery-then-filter instead of direct fetch.

Removes the "not yet implemented" warning from the filtering guide.

Closes #119

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Peter Hauge

docs/guides/filtering-resources.md

@@ -140,8 +140,6 @@ apis:
 
 ### Workspace sub-resource filters
 
-> **Note:** Workspace sub-resource filtering is parsed but not yet applied at runtime. Currently, including a workspace extracts all resources within it. This matches the Toolkit's configuration format for forward compatibility. See [#119](https://github.com/Azure/apiops-cli/issues/119) for tracking.
-
 The configuration format supports specifying which workspace-scoped resources to extract:
 
 ```yaml

src/services/workspace-extractor.ts

@@ -9,12 +9,13 @@ import { IApimClient } from '../clients/iapim-client.js';
 import { IArtifactStore } from '../clients/iartifact-store.js';
 import { ApimServiceContext } from '../models/types.js';
 import { ResourceType, RESOURCE_TYPE_METADATA } from '../models/resource-types.js';
-import { FilterConfig } from '../models/config.js';
+import { FilterConfig, WorkspaceSubFilter } from '../models/config.js';
 import { extractResourceType, ExtractedResource } from './resource-extractor.js';
 import { extractApiResources, extractWorkspaceApiTags } from './api-extractor.js';
 import { extractProductResources, extractWorkspaceProductTags } from './product-extractor.js';
 import { logger } from '../lib/logger.js';
 import { getNamePart } from '../lib/resource-path.js';
+import { isWildcardPattern, wildcardMatch } from './filter-service.js';
 
 /**
  * Types that can exist at the workspace level, derived from RESOURCE_TYPE_METADATA.
@@ -58,17 +59,24 @@ export async function extractWorkspaces(
       logger.debug('Workspace filter is empty array — excluding all workspaces');
       return results;
     }
-    workspaceNames = filter.workspaces;
+
+    const hasWildcards = filter.workspaces.some(isWildcardPattern);
+    if (hasWildcards) {
+      // Wildcard patterns require discovery so we can match against real names
+      const discovered = await discoverWorkspaceNames(client, context);
+      workspaceNames = discovered.filter((name) =>
+        filter.workspaces!.some((pattern) =>
+          isWildcardPattern(pattern)
+            ? wildcardMatch(pattern, name)
+            : pattern.toLowerCase() === name.toLowerCase()
+        )
+      );
+    } else {
+      workspaceNames = filter.workspaces;
+    }
   } else {
     // No workspace filter defined — discover all workspaces
-    const discovered: string[] = [];
-    for await (const item of client.listResources(context, ResourceType.Workspace)) {
-      const name = item['name'];
-      if (typeof name === 'string') {
-        discovered.push(name);
-      }
-    }
-    workspaceNames = discovered;
+    workspaceNames = await discoverWorkspaceNames(client, context);
   }
 
   if (workspaceNames.length === 0) {
@@ -92,7 +100,8 @@ export async function extractWorkspaces(
     }
 
     const wsResult = await extractWorkspace(
-      client, store, context, wsName, outputDir, filter
+      client, store, context, wsName, outputDir,
+      resolveWorkspaceFilter(wsName, filter)
     );
     results.push(wsResult);
   }
@@ -218,3 +227,68 @@ async function extractWorkspace(
 
   return { workspaceName, resourceCount, errorCount };
 }
+
+/**
+ * Discover all workspace names from APIM.
+ */
+async function discoverWorkspaceNames(
+  client: IApimClient,
+  context: ApimServiceContext
+): Promise<string[]> {
+  const names: string[] = [];
+  for await (const item of client.listResources(context, ResourceType.Workspace)) {
+    const name = item['name'];
+    if (typeof name === 'string') {
+      names.push(name);
+    }
+  }
+  return names;
+}
+
+/**
+ * Resolve the effective FilterConfig for a workspace.
+ * If the workspace has a sub-filter in workspaceSubFilters, convert it to a FilterConfig.
+ * Otherwise return undefined (no filter = extract everything in the workspace).
+ */
+export function resolveWorkspaceFilter(
+  workspaceName: string,
+  filter?: FilterConfig
+): FilterConfig | undefined {
+  if (!filter?.workspaceSubFilters) {
+    return undefined;
+  }
+
+  // Case-insensitive lookup of workspace sub-filter
+  const lowerName = workspaceName.toLowerCase();
+  const matchingKey = Object.keys(filter.workspaceSubFilters).find(
+    (k) => k.toLowerCase() === lowerName
+  );
+
+  if (!matchingKey) {
+    return undefined;
+  }
+
+  const sub = filter.workspaceSubFilters[matchingKey];
+  return workspaceSubFilterToFilterConfig(sub);
+}
+
+/**
+ * Convert a WorkspaceSubFilter to a FilterConfig so the standard
+ * filter-service matching logic can be applied to workspace-scoped resources.
+ */
+function workspaceSubFilterToFilterConfig(sub: WorkspaceSubFilter): FilterConfig {
+  return {
+    apis: sub.apis,
+    apiSubFilters: sub.apiSubFilters,
+    backends: sub.backends,
+    diagnostics: sub.diagnostics,
+    groups: sub.groups,
+    loggers: sub.loggers,
+    namedValues: sub.namedValues,
+    policyFragments: sub.policyFragments,
+    products: sub.products,
+    subscriptions: sub.subscriptions,
+    tags: sub.tags,
+    versionSets: sub.versionSets,
+  };
+}

tests/unit/services/workspace-extractor.test.ts

@@ -9,6 +9,7 @@ import { ResourceType } from '../../../src/models/resource-types.js';
 import { ApimServiceContext } from '../../../src/models/types.js';
 import { FilterConfig } from '../../../src/models/config.js';
 import { extractWorkspaces } from '../../../src/services/workspace-extractor.js';
+import { resolveWorkspaceFilter } from '../../../src/services/workspace-extractor.js';
 
 const testContext: ApimServiceContext = {
   subscriptionId: 'sub-1',
@@ -202,5 +203,188 @@ describe('workspace-extractor', () => {
       expect(results).toHaveLength(1);
       expect(results[0]?.resourceCount).toBeGreaterThan(0);
     });
+
+    it('should apply workspace sub-filter to limit extracted resources', async () => {
+      const client = createMockClient();
+      const listedTypes: ResourceType[] = [];
+      client.listResources = async function* (_ctx: ApimServiceContext, type: ResourceType) {
+        listedTypes.push(type);
+        if (type === ResourceType.NamedValue) {
+          yield { name: 'ws-nv-1', properties: {} };
+          yield { name: 'ws-nv-2', properties: {} };
+        }
+      };
+      const store = createMockStore();
+      const filter: FilterConfig = {
+        workspaces: ['ws-1'],
+        workspaceSubFilters: {
+          'ws-1': {
+            namedValues: ['ws-nv-1'],
+          },
+        },
+      };
+
+      const results = await extractWorkspaces(
+        client, store, testContext, '/output', filter
+      );
+
+      expect(results).toHaveLength(1);
+      // Only ws-nv-1 should be extracted, ws-nv-2 should be filtered out
+      expect(results[0]?.resourceCount).toBe(1);
+    });
+
+    it('should extract everything when workspace has no sub-filter', async () => {
+      const client = createMockClient();
+      client.listResources = async function* (_ctx: ApimServiceContext, type: ResourceType) {
+        if (type === ResourceType.NamedValue) {
+          yield { name: 'ws-nv-1', properties: {} };
+          yield { name: 'ws-nv-2', properties: {} };
+        }
+      };
+      const store = createMockStore();
+      const filter: FilterConfig = {
+        workspaces: ['ws-1'],
+        // No workspaceSubFilters — extract everything in the workspace
+      };
+
+      const results = await extractWorkspaces(
+        client, store, testContext, '/output', filter
+      );
+
+      expect(results).toHaveLength(1);
+      // Both named values should be extracted
+      expect(results[0]?.resourceCount).toBe(2);
+    });
+
+    it('should support wildcard patterns in workspace names', async () => {
+      const client = createMockClient();
+      // Discovery returns three workspaces
+      const originalListResources = client.listResources;
+      let firstCall = true;
+      client.listResources = async function* (ctx: ApimServiceContext, type: ResourceType) {
+        if (type === ResourceType.Workspace && firstCall) {
+          firstCall = false;
+          yield { name: 'team-a-workspace', properties: {} };
+          yield { name: 'team-b-workspace', properties: {} };
+          yield { name: 'other-workspace', properties: {} };
+          return;
+        }
+        yield* originalListResources(ctx, type);
+      };
+      const store = createMockStore();
+      const filter: FilterConfig = { workspaces: ['team-*'] };
+
+      const results = await extractWorkspaces(
+        client, store, testContext, '/output', filter
+      );
+
+      // Only team-a-workspace and team-b-workspace should match
+      expect(results).toHaveLength(2);
+      expect(results.map((r) => r.workspaceName).sort()).toEqual([
+        'team-a-workspace',
+        'team-b-workspace',
+      ]);
+    });
+
+    it('should apply sub-filter with wildcard workspace name patterns', async () => {
+      const client = createMockClient();
+      let firstCall = true;
+      client.listResources = async function* (_ctx: ApimServiceContext, type: ResourceType) {
+        if (type === ResourceType.Workspace && firstCall) {
+          firstCall = false;
+          yield { name: 'team-a', properties: {} };
+          return;
+        }
+        if (type === ResourceType.NamedValue) {
+          yield { name: 'nv-1', properties: {} };
+          yield { name: 'nv-2', properties: {} };
+        }
+      };
+      const store = createMockStore();
+      const filter: FilterConfig = {
+        workspaces: ['team-*'],
+        workspaceSubFilters: {
+          'team-a': {
+            namedValues: ['nv-1'],
+          },
+        },
+      };
+
+      const results = await extractWorkspaces(
+        client, store, testContext, '/output', filter
+      );
+
+      expect(results).toHaveLength(1);
+      expect(results[0]?.workspaceName).toBe('team-a');
+      // Only nv-1 should be extracted due to sub-filter
+      expect(results[0]?.resourceCount).toBe(1);
+    });
+  });
+
+  describe('resolveWorkspaceFilter', () => {
+    it('should return undefined when no filter provided', () => {
+      expect(resolveWorkspaceFilter('ws-1')).toBeUndefined();
+    });
+
+    it('should return undefined when no workspaceSubFilters', () => {
+      const filter: FilterConfig = { workspaces: ['ws-1'] };
+      expect(resolveWorkspaceFilter('ws-1', filter)).toBeUndefined();
+    });
+
+    it('should return undefined when workspace not in sub-filters', () => {
+      const filter: FilterConfig = {
+        workspaces: ['ws-1'],
+        workspaceSubFilters: {
+          'ws-2': { apis: ['api-1'] },
+        },
+      };
+      expect(resolveWorkspaceFilter('ws-1', filter)).toBeUndefined();
+    });
+
+    it('should resolve workspace sub-filter case-insensitively', () => {
+      const filter: FilterConfig = {
+        workspaces: ['WS-1'],
+        workspaceSubFilters: {
+          'ws-1': { apis: ['api-1'], backends: ['backend-1'] },
+        },
+      };
+      const result = resolveWorkspaceFilter('WS-1', filter);
+      expect(result).toBeDefined();
+      expect(result!.apis).toEqual(['api-1']);
+      expect(result!.backends).toEqual(['backend-1']);
+    });
+
+    it('should convert all workspace sub-filter fields to FilterConfig', () => {
+      const filter: FilterConfig = {
+        workspaceSubFilters: {
+          'ws-1': {
+            apis: ['api-1'],
+            backends: ['be-1'],
+            diagnostics: ['diag-1'],
+            groups: ['group-1'],
+            loggers: ['logger-1'],
+            namedValues: ['nv-1'],
+            policyFragments: ['pf-1'],
+            products: ['prod-1'],
+            subscriptions: ['sub-1'],
+            tags: ['tag-1'],
+            versionSets: ['vs-1'],
+          },
+        },
+      };
+      const result = resolveWorkspaceFilter('ws-1', filter);
+      expect(result).toBeDefined();
+      expect(result!.apis).toEqual(['api-1']);
+      expect(result!.backends).toEqual(['be-1']);
+      expect(result!.diagnostics).toEqual(['diag-1']);
+      expect(result!.groups).toEqual(['group-1']);
+      expect(result!.loggers).toEqual(['logger-1']);
+      expect(result!.namedValues).toEqual(['nv-1']);
+      expect(result!.policyFragments).toEqual(['pf-1']);
+      expect(result!.products).toEqual(['prod-1']);
+      expect(result!.subscriptions).toEqual(['sub-1']);
+      expect(result!.tags).toEqual(['tag-1']);
+      expect(result!.versionSets).toEqual(['vs-1']);
+    });
   });
 });