hecks 3.4.2 → 3.6.0

data/lib/hecks/projections/deploy/fargate/assembly.rb

@@ -1,5 +1,6 @@
 require_relative "yaml"
 require_relative "settings"
+require_relative "sections"
 
 module Hecks
   module Projections
@@ -13,164 +14,34 @@ module Hecks
           # Replaces every optional-section marker in a rendered template.
           def apply(template, plan, context)
             text = override_domain_env(template, plan.domain_env)
-            sections(plan, context).each { |marker, block| text = Yaml.splice(text, marker, block) }
+            Sections.build(plan, context).each { |marker, block| text = Yaml.splice(text, marker, block) }
             check_duplicates!(text)
             text
           end
 
-          def sections(plan, context)
-            {
-              "domain_essential"          => domain_essential_yaml(plan.layout.domain),
-              "session_secret_properties" => session_secret_yaml(plan.extras[:session_secret]),
-              "execution_database_grant"  => execution_grant_yaml(plan, context),
-              "extra_execution_policies"  => Extras.policies_yaml(plan.extras[:execution_policies]),
-              "extra_task_policies"       => task_policies_yaml(plan),
-              "domain_env"                => domain_env_yaml(plan.domain_env),
-              "extra_containers"          => lines(Containers.definitions_yaml(plan.layout, plan.ids[:log_group])),
-              "target_group_attributes"   => Containers.target_group_attributes_yaml(plan.deregistration_delay),
-              "extra_target_groups"       => target_groups_yaml(plan, context),
-              "service_tuning"            => service_tuning_yaml(plan),
-              "extra_load_balancers"      => Containers.load_balancers_yaml(plan.layout),
-              "distribution"              => distribution_yaml(plan, context),
-              "extra_resources"           => extra_resources_yaml(plan, context),
-              "extra_outputs"             => outputs_yaml(plan)
-            }
-          end
-          private_class_method :sections
-
           # Removes each default environment entry the world overrides, with the comments above it.
           def override_domain_env(template, domain_env)
-            domain_env.keys.reduce(template) do |text, name|
-              entry = /(?:^[ \t]*#.*\n)*^[ \t]*- Name: #{Regexp.escape(name)}\n[ \t]+Value: .*\n/
-              if text.match?(entry)
-                text.sub(entry, "")
-              elsif domain_env[name].nil?
-                raise ArgumentError,
-                      "domain_env #{name} is nil, which removes a default variable, but the generator sets no #{name}"
-              else
-                text
-              end
-            end
+            domain_env.keys.reduce(template) { |text, name| without_default(text, name, domain_env[name]) }
           end
           private_class_method :override_domain_env
 
-          def execution_grant_yaml(plan, context)
-            return "" unless plan.execution_database_grant
-
-            <<~GRANT
-              - PolicyName: DbSecretRead
-                PolicyDocument:
-                  Version: '2012-10-17'
-                  Statement:
-                    - Effect: Allow
-                      Action: secretsmanager:GetSecretValue
-                      Resource: !Sub "${#{context[:db_secret_ref]}}"
-            GRANT
-          end
-          private_class_method :execution_grant_yaml
-
-          def domain_essential_yaml(domain)
-            domain.essential.nil? ? "" : "Essential: #{domain.essential}\n"
-          end
-          private_class_method :domain_essential_yaml
-
-          def domain_env_yaml(domain_env)
-            domain_env.compact.map do |name, value|
-              "- Name: #{name}\n  Value: #{Yaml.string(value)}\n"
-            end.join
-          end
-          private_class_method :domain_env_yaml
+          def without_default(text, name, value)
+            entry = /(?:^[ \t]*#.*\n)*^[ \t]*- Name: #{Regexp.escape(name)}\n[ \t]+Value: .*\n/
+            return text.sub(entry, "") if text.match?(entry)
+            return text unless value.nil?
 
-          def session_secret_yaml(given)
-            [("Name: #{given[:name]}\n" if given[:name]),
-             ("Description: #{Yaml.string(given[:description])}\n" if given[:description])].compact.join
+            raise ArgumentError, "domain_env #{name} is nil, which removes a default variable, but the generator sets no #{name}"
           end
-          private_class_method :session_secret_yaml
-
-          def task_policies_yaml(plan)
-            Extras.policies_yaml(plan.extras[:task_policies]) + (plan.execute_command ? Extras.execute_command_policy_yaml : "")
-          end
-          private_class_method :task_policies_yaml
-
-          def service_tuning_yaml(plan)
-            lines = []
-            lines << "EnableExecuteCommand: true" if plan.execute_command
-            lines << "HealthCheckGracePeriodSeconds: #{plan.health_check_grace_period}" if plan.health_check_grace_period
-            lines.empty? ? "" : "#{lines.join("\n")}\n"
-          end
-          private_class_method :service_tuning_yaml
-
-          def target_groups_yaml(plan, context)
-            blocks(
-              [
-                Containers.target_groups_yaml(plan.layout, context[:vpc_ref], plan.deregistration_delay),
-                Containers.listener_rules_yaml(plan.layout, context[:listener_id])
-              ].reject(&:empty?).join("\n\n")
-            )
-          end
-          private_class_method :target_groups_yaml
-
-          def distribution_yaml(plan, context)
-            ids = { distribution_id: context[:distribution_id], alb_id: context[:alb_id] }
-            plan.cdn ? Cdn.yaml(plan.cdn, **ids) : Cdn.default_yaml(**ids)
-          end
-          private_class_method :distribution_yaml
-
-          def monitoring_context(plan, context, groups)
-            { ids: plan.ids, stack_name: context[:stack_name], alb_id: context[:alb_id],
-              distribution_id: context[:distribution_id], target_groups: groups }
-          end
-          private_class_method :monitoring_context
-
-          def extra_resources_yaml(plan, context)
-            alerts = plan.alerts
-            groups = plan.layout.balanced.to_h { |container| [container.name, container.target_group_id] }
-            monitoring = alerts ? Monitoring.yaml(alerts, monitoring_context(plan, context, groups)) : ""
-            blocks([Containers.repositories_yaml(plan.layout), Extras.resources_yaml(plan.extras),
-                    monitoring.rstrip].reject(&:empty?).join("\n\n"))
-          end
-          private_class_method :extra_resources_yaml
-
-          # Adds one output per added container's repository, plus the cluster and service names a
-          # deploy script needs to find the running service.
-          def outputs_yaml(plan)
-            listed = plan.layout.multi? ? container_outputs(plan) : ""
-            alerts = plan.alerts ? "AlertsTopicArn:\n  Value: !Ref #{plan.ids[:alerts_topic]}\n" : ""
-            listed + alerts + Extras.outputs_yaml(plan.extras[:outputs])
-          end
-          private_class_method :outputs_yaml
-
-          def container_outputs(plan)
-            repositories = plan.layout.all.map do |container|
-              "#{Yaml.camel(container.name)}RepositoryUri:\n  Value: !GetAtt #{container.repository_id}.RepositoryUri\n"
-            end
-            cluster = "ClusterName:\n  Value: !Ref #{plan.ids[:cluster]}\n"
-            service = "ServiceName:\n  Value: !GetAtt #{plan.ids[:service]}.Name\n"
-            cluster + service + repositories.join
-          end
-          private_class_method :container_outputs
-
-          # Joins resource blocks so the section ends in the blank line the template expects before
-          # the next resource, and is empty when there is nothing to add.
-          def blocks(text)
-            text.empty? ? "" : "#{text}\n\n"
-          end
-          private_class_method :blocks
-
-          # Ends a block in one newline, and leaves an empty block empty.
-          def lines(text)
-            text.empty? ? "" : "#{text}\n"
-          end
-          private_class_method :lines
+          private_class_method :without_default
 
           def check_duplicates!(template)
             resources = template[/^Resources:\n(.*?)^Outputs:/m, 1].to_s
             parameters = template[/^Parameters:\n(.*?)^Resources:/m, 1].to_s
             repeated = Yaml.duplicate_keys(resources) + Yaml.duplicate_keys(parameters)
-            unless repeated.empty?
-              raise ArgumentError, "logical id or parameter #{repeated.uniq.join(', ')} is declared more than once; " \
-                                   "check logical_ids, containers and parameters for clashes"
-            end
+            return if repeated.empty?
+
+            raise ArgumentError, "logical id or parameter #{repeated.uniq.join(", ")} is declared more than once; " \
+                                 "check logical_ids, containers and parameters for clashes"
           end
           private_class_method :check_duplicates!
         end

data/lib/hecks/projections/deploy/fargate/cdn/behaviors.rb

@@ -0,0 +1,76 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Fargate
+        module Cdn
+          # Reads and checks the `default_behavior` and `behaviors` of the `cdn` setting. Extended
+          # onto `Cdn`, which supplies the constants and `Check`.
+          module Behaviors
+            private
+
+            def behaviors(entries, options, origins)
+              Check.hashes!(entries, "cdn behaviors", allowed: BEHAVIOR_KEYS + [:path], required: [:path]).map do |entry|
+                behavior(entry, "cdn behaviors[#{entry[:path]}]", options, origins, path: true)
+              end
+            end
+
+            def behavior(entry, where, options, origins, path:)
+              given = Check.hash!(entry, where, allowed: BEHAVIOR_KEYS + (path ? [:path] : []))
+              origin = given.fetch(:origin, options[:origin_id]).to_s
+              unless origins.include?(origin)
+                raise ArgumentError,
+                      "#{where} origin #{origin.inspect} is not one of #{origins.join(", ")}"
+              end
+
+              result = behavior_fields(given, where, origin, origin == options[:origin_id], path)
+              add_compress!(result, given, where, path)
+              result[:path] = path_pattern(given[:path], where) if path
+              result
+            end
+
+            def behavior_fields(given, where, origin, balanced, path)
+              {
+                origin: origin, methods: allowed_methods(given.fetch(:methods, path ? "read" : "all"), where),
+                viewer_protocol: Check.one_of!(given.fetch(:viewer_protocol, "redirect-to-https"), "#{where} viewer_protocol",
+                                               PROTOCOLS),
+                cache_policy: policy(given.fetch(:cache_policy, "caching_disabled"), "#{where} cache_policy"),
+                origin_request_policy: policy(given.fetch(:origin_request_policy, balanced ? "all_viewer" : "none"),
+                                              "#{where} origin_request_policy", none: true)
+              }
+            end
+
+            def add_compress!(result, given, where, path)
+              result[:compress] = Check.boolean!(given[:compress], "#{where} compress") if given.key?(:compress)
+              result[:compress] = true if !path && !given.key?(:compress)
+            end
+
+            def path_pattern(value, where)
+              text = value.to_s
+              raise ArgumentError, "#{where} path must start with / or *, got #{text.inspect}" unless text.start_with?("/", "*")
+
+              text
+            end
+
+            def allowed_methods(value, where)
+              return Check.strings!(value, "#{where} methods", min: 1) if value.is_a?(Array)
+              return METHODS.fetch(value.to_s) if METHODS.key?(value.to_s)
+
+              raise ArgumentError,
+                    "#{where} methods must be #{METHODS.keys.join(", ")} or a list of HTTP methods, got #{value.inspect}"
+            end
+
+            def policy(value, where, none: false)
+              text = value.to_s
+              return nil if none && text == "none"
+              return MANAGED_POLICIES.fetch(text) if MANAGED_POLICIES.key?(text)
+              return [text, nil] if UUID.match?(text)
+
+              raise ArgumentError, "#{where} must be #{MANAGED_POLICIES.keys.join(", ")}#{", none" if none}, " \
+                                   "or a policy id, got #{value.inspect}"
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/fargate/cdn/lines.rb

@@ -0,0 +1,112 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Fargate
+        module Cdn
+          # The lines of a rendered distribution. Extended onto `Cdn`.
+          module Lines
+            # Renders one cache behaviour: the default one under `key`, or a list item led by its
+            # path.
+            #
+            # @param key [String, nil] `"DefaultCacheBehavior"`, or nil for a `CacheBehaviors` item
+            # @param entry [Hash{Symbol => Object}] the behaviour as `normalize` checks it
+            #   (`:origin`,
+            #   `:path` for an item, `:viewer_protocol`, `:methods`, `:compress`, `:cache_policy`,
+            #   `:origin_request_policy`), and optionally `:response_headers_policy`, each policy as
+            #   `[id_or_intrinsic, comment_or_nil]`
+            # @param base [String] the indentation of `key`, or of the list item's dash
+            # @return [Array<String>] the lines
+            def behavior_lines(key, entry, base)
+              pad = "#{base}  "
+              head = key ? "#{base}#{key}:" : "#{base}- PathPattern: #{Yaml.string(entry[:path])}"
+              [head, "#{pad}TargetOriginId: #{entry[:origin]}", *behavior_property_lines(entry, pad)]
+            end
+
+            private
+
+            def distribution_head(options, distribution_id)
+              lines = ["#{distribution_id}:", "  Type: AWS::CloudFront::Distribution"]
+              lines.push("  DeletionPolicy: Retain", "  UpdateReplacePolicy: Retain") if options[:retain]
+              lines.push("  Properties:", "    DistributionConfig:", "      Enabled: true", "      HttpVersion: http2")
+            end
+
+            def behavior_section(options)
+              lines = behavior_lines("DefaultCacheBehavior", options[:default_behavior], "      ")
+              lines << "      CacheBehaviors:" unless options[:behaviors].empty?
+              options[:behaviors].each { |entry| lines.concat(behavior_lines(nil, entry, "        ")) }
+              lines
+            end
+
+            def alias_lines(options)
+              return [] if options[:aliases].empty?
+
+              ["      Aliases:"] + options[:aliases].map { |name| "        - #{name}" }
+            end
+
+            def certificate_lines(options)
+              return ["      ViewerCertificate:", "        CloudFrontDefaultCertificate: true"] unless options[:certificate_arn]
+
+              ["      ViewerCertificate:", "        AcmCertificateArn: #{options[:certificate_arn]}",
+               "        SslSupportMethod: sni-only", "        MinimumProtocolVersion: #{options[:minimum_protocol]}"]
+            end
+
+            def origin_lines(options, alb_id)
+              ["      Origins:"] + alb_origin_lines(options, alb_id) + options[:extra_origins].flat_map do |origin|
+                s3_origin_lines(origin)
+              end
+            end
+
+            def alb_origin_lines(options, alb_id)
+              lines = ["        - Id: #{options[:origin_id]}", "          DomainName: !GetAtt #{alb_id}.DNSName"]
+              lines.concat(origin_header_lines(options[:origin_secret]))
+              lines << "          CustomOriginConfig:"
+              lines << "            OriginProtocolPolicy: http-only"
+              lines.push("            HTTPPort: 80", "            HTTPSPort: 443") if options[:explicit_origin_ports]
+              unless options[:origin_ssl_protocols].empty?
+                lines << "            OriginSSLProtocols: #{Yaml.flow_list(options[:origin_ssl_protocols])}"
+              end
+              lines
+            end
+
+            def origin_header_lines(secret)
+              return [] unless secret
+
+              ["          OriginCustomHeaders:", "            - HeaderName: #{secret[:header]}",
+               "              HeaderValue: !Ref #{secret[:parameter]}"]
+            end
+
+            def s3_origin_lines(origin)
+              lines = ["        - Id: #{origin[:id]}", "          DomainName: #{Yaml.string(origin[:domain_name])}"]
+              if origin[:origin_access_control_id]
+                lines << "          OriginAccessControlId: #{Yaml.string(origin[:origin_access_control_id])}"
+              end
+              lines << "          S3OriginConfig: { OriginAccessIdentity: \"\" }"
+              lines
+            end
+
+            def behavior_property_lines(entry, pad)
+              lines = ["#{pad}ViewerProtocolPolicy: #{entry[:viewer_protocol]}",
+                       "#{pad}AllowedMethods: #{Yaml.flow_list(entry[:methods])}",
+                       "#{pad}CachedMethods: [GET, HEAD]"]
+              lines << "#{pad}Compress: #{entry[:compress]}" if entry.key?(:compress)
+              lines << policy_line(pad, "CachePolicyId", entry[:cache_policy])
+              lines.concat(optional_policy_lines(entry, pad))
+            end
+
+            def optional_policy_lines(entry, pad)
+              { "OriginRequestPolicyId"   => entry[:origin_request_policy],
+                "ResponseHeadersPolicyId" => entry[:response_headers_policy] }
+                .select { |_key, policy| policy }
+                .map { |key, policy| policy_line(pad, key, policy) }
+            end
+
+            def policy_line(pad, key, policy)
+              id, label = policy
+              label ? "#{pad}#{key}: #{id} # #{label}" : "#{pad}#{key}: #{id}"
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/fargate/cdn/options.rb

@@ -0,0 +1,85 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Fargate
+        module Cdn
+          # Reads and checks the `cdn` setting into the options `Cdn.yaml` renders. Extended onto
+          # `Cdn`, which supplies the constants and `Check`.
+          module Options
+            private
+
+            def base_options(given, default_origin_id)
+              aliases = alias_names(given)
+              certificate = given[:certificate_arn]&.to_s
+              check_alias_certificate!(aliases, certificate)
+              {
+                aliases: aliases, certificate_arn: certificate_arn(certificate),
+                minimum_protocol: given.fetch(:minimum_protocol, "TLSv1.2_2021").to_s,
+                **origin_options(given, default_origin_id),
+                retain: Check.boolean!(given.fetch(:retain, false), "cdn retain")
+              }
+            end
+
+            def alias_names(given)
+              aliases = Check.strings!(given.fetch(:aliases, []), "cdn aliases")
+              bad = aliases.grep_v(HOSTNAME)
+              raise ArgumentError, "cdn aliases must be hostnames, got #{bad.join(", ")}" unless bad.empty?
+
+              aliases
+            end
+
+            def check_alias_certificate!(aliases, certificate)
+              return unless !aliases.empty? && certificate.nil?
+
+              raise ArgumentError,
+                    "cdn aliases need a certificate_arn, since CloudFront serves an alias only over a certificate"
+            end
+
+            def origin_options(given, default_origin_id)
+              {
+                origin_id:             Check.logical_id!(given.fetch(:origin_id, default_origin_id), "cdn origin_id"),
+                origin_ssl_protocols:  Check.strings!(given.fetch(:origin_ssl_protocols, []), "cdn origin_ssl_protocols"),
+                explicit_origin_ports: Check.boolean!(given.fetch(:explicit_origin_ports, true), "cdn explicit_origin_ports"),
+                origin_secret:         origin_secret(given[:origin_secret])
+              }
+            end
+
+            def certificate_arn(value)
+              return nil if value.nil?
+              return value if value.start_with?("!") || ACM_ARN.match?(value)
+
+              raise ArgumentError,
+                    "cdn certificate_arn must be an ACM certificate ARN in us-east-1 (CloudFront reads no other region) " \
+                    "or an intrinsic, got #{value.inspect}"
+            end
+
+            def origin_secret(value)
+              return nil if value.nil?
+
+              secret = Check.hash!(value, "cdn origin_secret", allowed: [:header, :parameter], required: [:header, :parameter])
+              unless secret[:header].to_s.match?(/\A[A-Za-z0-9-]+\z/)
+                raise ArgumentError,
+                      "cdn origin_secret header must be an HTTP header name, got #{secret[:header].inspect}"
+              end
+
+              { header: secret[:header].to_s, parameter: Check.logical_id!(secret[:parameter], "cdn origin_secret parameter") }
+            end
+
+            def extra_origins(entries)
+              Check.hashes!(entries, "cdn extra_origins", allowed:  [:id, :domain_name, :origin_access_control_id],
+                                                          required: [:id, :domain_name]).map do |entry|
+                { id: Check.logical_id!(entry[:id], "cdn extra_origins id"), domain_name: entry[:domain_name].to_s,
+                  origin_access_control_id: entry[:origin_access_control_id]&.to_s }
+              end
+            end
+
+            def check_unique!(values, what)
+              repeated = values.tally.select { |_value, count| count > 1 }.keys
+              raise ArgumentError, "#{what} must be unique; repeated: #{repeated.join(", ")}" unless repeated.empty?
+            end
+          end
+        end
+      end
+    end
+  end
+end