hecks 3.4.2 → 3.6.0

data/lib/hecks/projections/deploy/lambda/stack/recipes.rb

@@ -0,0 +1,112 @@
+require_relative "../../bastion_lines"
+
+module Hecks
+  module Projections
+    module Deploy
+      module Lambda
+        class Stack
+          # The Makefile recipes that reach the database through the temporary bastion: `mint-era`,
+          # the translation targets and `rename-schema`. Included into `Stack`; each method is also
+          # the value of the template marker of the same name.
+          module Recipes
+            include BastionLines
+
+            # What a translation target runs over the bastion tunnel, and how.
+            #
+            # @!attribute [r] verb [String] the make target's name, as the messages print it
+            # @!attribute [r] script [String] the command that runs against the tunnelled database
+            # @!attribute [r] extra_args [String] arguments after the domain argument
+            # @!attribute [r] cwd [String] the directory the script runs in
+            # @!attribute [r] run_prefix [String] what launches the script
+            # @!attribute [r] db_env_blind [Boolean] whether the script ignores DATABASE_URL, so the
+            #   recipe refuses unless `ALLOW_LOCAL_DB=1`
+            # @!attribute [r] domain_arg [String] the domain argument, passed when run from the root
+            Translation = Struct.new(:verb, :script, :extra_args, :cwd, :run_prefix, :db_env_blind, :domain_arg,
+                                     keyword_init: true)
+
+            # `hecks ask` answers the scaffold as text, and refuses (exit 1) where the script
+            # aborted.
+            SCAFFOLD = Translation.new(verb: "scaffold-translation", script: "exe/hecks query era.scaffold_translation",
+                                       extra_args: "", cwd: "$(ROOT)", run_prefix: "HECKS_ENVIRONMENT=memory ruby",
+                                       db_env_blind: true, domain_arg: "domain=$(DOMAIN) ")
+            # A refused audit is a refused query: `hecks ask` exits 1, so the target fails too.
+            AUDIT = Translation.new(verb: "translation-audit", script: "exe/hecks query era.audit_translation",
+                                    extra_args: "", cwd: "$(ROOT)", run_prefix: "HECKS_ENVIRONMENT=memory ruby",
+                                    db_env_blind: true, domain_arg: "domain=$(DOMAIN) ")
+            # An app-owned one-time migration script instead of a hecks tool:
+            # `bin/migrate_console_settings` belongs to the domain's own application, not to hecks.
+            # Harmless when the domain has none: `bundle exec ruby` on a missing file just fails
+            # loudly.
+            MIGRATE = Translation.new(verb: "migrate-console-settings", script: "bin/migrate_console_settings",
+                                      extra_args: "", cwd: "$(DOMAIN)", run_prefix: "bundle exec ruby",
+                                      db_env_blind: false, domain_arg: "$(DOMAIN) ")
+
+            def mint_era_recipe
+              render_recipe(shared ? "mint_era_shared" : "mint_era_own")
+            end
+
+            def scaffold_translation_recipe = translation_recipe(SCAFFOLD)
+            def translation_audit_recipe = translation_recipe(AUDIT)
+            def migrate_console_settings_recipe = translation_recipe(MIGRATE)
+
+            # `OLD`/`NEW` are Make command-line variables, reusable across whichever domain owns
+            # this stack's RDS instance. Idempotent by inspection (checks which schema exists
+            # first), not by catching a Postgres error.
+            def rename_schema_recipe
+              render_recipe(shared ? "rename_schema_shared" : "rename_schema_own")
+            end
+
+            def pg_native_section
+              pg_version ? TextTemplate.render_from("lambda/pg_native.tmpl", self) : ""
+            end
+
+            def sync_oauth_section
+              google_oauth_present ? TextTemplate.render_from("lambda/sync_oauth.tmpl", self) : ""
+            end
+
+            def oauth_note
+              google_oauth_present ? TextTemplate.render_from("lambda/oauth_note.tmpl", self) : ""
+            end
+
+            def shared_note
+              shared ? TextTemplate.render_from("lambda/shared_note.tmpl", self) : ""
+            end
+
+            private
+
+            def render_recipe(name)
+              TextTemplate.render_from("lambda/#{name}.tmpl", self).rstrip
+            end
+
+            # Shares mint_era_recipe's bastion/tunnel/retry/teardown chain but runs `job.script`
+            # over it.
+            def translation_recipe(job)
+              return TextTemplate.render("lambda/translation_own.tmpl", **translation_values(job)).rstrip unless shared
+
+              owner = owner_domain_name
+              TextTemplate.render("lambda/translation_shared.tmpl", verb: job.verb, owner_domain_name: owner).rstrip
+            end
+
+            def translation_values(job)
+              {
+                verb: job.verb, script: job.script, extra_args: job.extra_args, cwd: job.cwd,
+                run_prefix: job.run_prefix, domain_arg_part: job.cwd == "$(ROOT)" ? job.domain_arg : "",
+                db_env_guard: job.db_env_blind ? env_blind_guard(job) : "", db_name: db_name,
+                hecks_schema: hecks_schema, eval_lines: eval_lines, parameter_overrides: parameter_overrides
+              }
+            end
+
+            # Neither script actually reads DATABASE_URL/HECKS_SCHEMA (both call
+            # `registry.binding_settings`, a lookup against the literal `database "..."` in the
+            # domain's `.world`): without a guard, the recipe would open a real tunnel to production
+            # and silently scaffold/audit the local dev database instead, reporting success.
+            def env_blind_guard(job)
+              TextTemplate.render("lambda/env_blind_guard.tmpl", verb: job.verb, script: job.script, domain: domain,
+                                                                 stack_name: stack_name).rstrip
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/lambda/stack/web.rb

@@ -0,0 +1,57 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Lambda
+        class Stack
+          # The web app's own Lambda: opt-in by a `lambda_handler.rb` beside the world, with its
+          # secrets, OAuth wiring and Function URL. Included into `Stack`; each method is also the
+          # value of the template marker of the same name.
+          module Web
+            # Every line of the function indented two spaces under `Resources:`.
+            def web_function
+              return "" unless web_handler_present
+
+              TextTemplate.render_from("lambda/web_function.tmpl", self).each_line.map { |line| "  #{line}" }.join
+            end
+
+            def web_schema_env
+              hecks_schema ? "\n        HECKS_SCHEMA: #{hecks_schema}" : ""
+            end
+
+            def web_webhook_env
+              return "" unless webhook_secret_env
+
+              "\n        #{webhook_secret_env}_ARN: !Sub \"${#{web_logical_id}WebhookSecret}\""
+            end
+
+            def web_webhook_policy
+              return "" unless webhook_secret_env
+
+              ["", "      - Statement:", "          - Effect: Allow", "            Action: secretsmanager:GetSecretValue",
+               "            Resource: !Sub \"${#{web_logical_id}WebhookSecret}\""].join("\n")
+            end
+
+            def webhook_secret_resource
+              return "" unless webhook_secret_env
+
+              TextTemplate.render_from("lambda/webhook_secret_resource.tmpl", self).rstrip
+            end
+
+            def web_oauth_policy
+              return "" unless google_oauth_present
+
+              tail_indent(TextTemplate.render_from("lambda/web_oauth_policy.tmpl", self), "      ")
+            end
+
+            # Built outside the template so re-indenting it cannot shift this YAML out of sync with
+            # the Environment it joins.
+            def web_google_oauth_env_yaml
+              file = google_oauth_present ? "lambda/web_google_oauth_env.tmpl" : "lambda/web_no_oauth_env.tmpl"
+              tail_indent(TextTemplate.render_from(file, self), "        ")
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/lambda/stack.rb

@@ -0,0 +1,54 @@
+require_relative "../text_template"
+require_relative "../shared"
+require_relative "stack/reading"
+require_relative "stack/reading_web"
+require_relative "stack/checks"
+require_relative "stack/readers"
+require_relative "stack/blocks"
+require_relative "stack/web"
+require_relative "stack/recipes"
+require_relative "stack/deploy_chain"
+
+module Hecks
+  module Projections
+    module Deploy
+      module Lambda
+        # Everything the Lambda generator knows about one stack, read and checked once from the
+        # world: the target's declared sizes, whether a field is marked pii, the owner a Shared
+        # database borrows, the web function. The templates under `templates/lambda/` read each
+        # marker's value from the method of the same name.
+        class Stack
+          include Reading
+          include ReadingWeb
+          include Checks
+          include Readers
+          include Blocks
+          include Web
+          include Recipes
+          include DeployChain
+
+          attr_reader :domain, :root, :world_file, :domain_name, :declared_domain_name, :deploy_settings, :infra_name,
+                      :db_name, :region, :memory, :timeout, :aurora, :shared, :rust_web, :dispatch_none,
+                      :webhook_secret_env, :webhook_handler_module, :cross_domain_targets, :pii_detected,
+                      :geo_restriction_type, :geo_restriction_countries, :owner_domain_name, :owner_stack_name,
+                      :owner_db_name, :hecks_schema, :logical_id, :stack_prefix, :stack_name, :web_handler_present,
+                      :pg_version, :web_logical_id, :web_code_uri, :web_handler_relpath, :google_oauth_present
+
+          # @param options [Hash] the generation options `Lambda.call` receives
+          # @raise [ArgumentError] if the domain's deploy settings are invalid or conflict
+          def initialize(options)
+            read_options(options)
+            detect_pii
+            read_names
+            declare_target
+            check_pii_region
+            read_owner
+            derive_ids
+            read_web
+            check_web
+          end
+        end
+      end
+    end
+  end
+end