jets 5.0.14 → 6.0.0.beta1

data/lib/jets/cli/waf/deploy.rb

@@ -0,0 +1,17 @@
+class Jets::CLI::Waf
+  class Deploy < Base
+    def run
+      are_you_sure?
+      Jets::Cfn::Bootstrap.new(@options).run
+      Jets::Remote::Runner.new(@options.merge(command: "waf:deploy")).run
+    end
+
+    def are_you_sure?
+      sure? <<~EOL
+        Will deploy stack #{stack_name.color(:green)} to us-east-1
+
+        Uses #{Jets.project.namespace} remote runner to deploy a separate stack for WAF resources.
+      EOL
+    end
+  end
+end

data/lib/jets/cli/waf/info.rb

@@ -0,0 +1,128 @@
+class Jets::CLI::Waf
+  class Info < Base
+    include Jets::AwsServices
+
+    def web_acl_name
+      @options[:name] || Jets::CLI::Waf.waf_name
+    end
+
+    def run
+      ENV["AWS_REGION"] = "us-east-1" # wafv2 only works in us-east-1
+
+      web_acl_summary = web_acl_summaries.find do |i|
+        web_acl_name == i.name
+      end
+
+      unless web_acl_summary
+        puts "Web ACL not found: #{web_acl_name}"
+        return
+      end
+
+      resp = wafv2.get_web_acl(
+        id: web_acl_summary.id,
+        name: web_acl_summary.name,
+        scope: "CLOUDFRONT"
+      )
+      web_acl = resp.web_acl
+      present(web_acl)
+    end
+
+    def web_acl_summaries
+      Enumerator.new do |y|
+        next_token = :start
+        while next_token
+          params = {}
+          params[:next_token] = next_token if next_token && next_token != :start
+          params[:scope] = "CLOUDFRONT"
+          resp = wafv2.list_web_acls(params)
+          y.yield resp.web_acls # acl summaries
+          # Looks like if there's only 1 page next_token is not even availablel
+          break unless resp.respond_to?(:next_token)
+          next_token = resp.next_token
+        end
+      end.lazy.flat_map { |i| i }
+    end
+
+    private
+
+    def present(web_acl)
+      presenter = CliFormat::Presenter.new(@options)
+      presenter.empty_message = "Web ACL not found: #{web_acl_name}"
+
+      data = [
+        ["Name", web_acl.name],
+        ["Description", web_acl.description],
+        ["Id", web_acl.id],
+        ["Capacity", web_acl.capacity]
+      ]
+      rules = web_acl.rules.sort_by!(&:priority)
+
+      rules.each_with_index do |rule, i|
+        name = rule_name(rule)
+        data << ["Rule #{i + 1}", name]
+      end
+
+      metric = metric_name(web_acl)
+      data << ["Metric", metric] if metric
+
+      # Additional info
+      data << ["Logging", logging(web_acl)]
+      rules.each do |rule|
+        rate_limited_ips(web_acl, rule)
+      end
+
+      data.each do |row|
+        presenter.rows << row
+      end
+      presenter.show
+    end
+
+    def rule_name(rule)
+      override_action = rule.override_action.to_h.keys.first
+      action = rule.action.to_h.keys.first
+
+      label = (override_action == :none || override_action.nil?) ? action : override_action
+      label ||= :block
+      label = :monitoring if label == :count
+      "#{rule.name} (#{label})"
+    end
+
+    def metric_name(web_acl)
+      web_acl&.visibility_config&.metric_name
+    end
+
+    def logging(web_acl)
+      resp = wafv2.get_logging_configuration(resource_arn: web_acl.arn)
+      # log_destination_configs=
+      #  ["arn:aws:logs:us-east-1:112233445555:log-group:aws-waf-logs-dev:*"],
+      configs = resp.logging_configuration.log_destination_configs
+      configs.map! do |config|
+        # arn:aws:logs:us-east-1:112233445555:log-group:aws-waf-logs-dev:*
+        # only keep everything after the AWS account id which is exactly 12 digits
+        c = config.sub(/arn:aws:logs:.*:\d{12}:/, "")
+        c.sub(/:\*$/, "") # remove trailing colon
+      end
+      configs.join(", ")
+    rescue Aws::WAFV2::Errors::WAFNonexistentItemException
+      "disabled"
+    end
+
+    def rate_limited_ips(web_acl, rule)
+      return unless rule.statement.rate_based_statement
+
+      resp = wafv2.get_rate_based_statement_managed_keys(
+        scope: "CLOUDFRONT",
+        web_acl_name: web_acl.name,
+        web_acl_id: web_acl.id,
+        rule_name: rule.name
+      )
+      addresses = resp.managed_keys_ipv4.addresses + resp.managed_keys_ipv6.addresses
+      return if addresses.empty?
+
+      puts "Rule #{rule.name} rate limited IPs:"
+      addresses.each do |address|
+        puts "  #{address}"
+      end
+    end
+  end
+end

data/lib/jets/cli/waf/init.rb

@@ -0,0 +1,40 @@
+class Jets::CLI::Waf
+  class Init < Jets::CLI::Group::Base
+    include Jets::Util::Sure
+
+    def self.cli_options
+      [
+        [:force, aliases: :f, type: :boolean, desc: "Bypass overwrite are you sure prompt for existing files"],
+        [:yes, aliases: :y, type: :boolean, desc: "Skip are you sure prompt"]
+      ]
+    end
+    cli_options.each { |args| class_option(*args) }
+
+    source_root "#{__dir__}/templates"
+
+    private
+
+    def sure_message
+      <<~EOL
+        This will create a config/jets/waf.rb file with initial waf settings.
+
+        The waf is designed to be a shared resource used by multiple projects.
+        Having a separate project that manages the waf stack may make sense.
+
+        Please make sure you have backed up and committed your changes first.
+      EOL
+    end
+
+    public
+
+    def are_you_sure?
+      return if options[:yes]
+      sure?(sure_message)
+    end
+
+    # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-codebuild-project-source.html#cfn-codebuild-project-source-type
+    def config_jets_ci
+      template "waf.rb.tt", "config/jets/waf.rb"
+    end
+  end
+end

data/lib/jets/cli/waf/templates/waf.rb.tt

@@ -0,0 +1,26 @@
+Jets.deploy.configure do
+  # Logging and Monitoring mode
+  # config.waf.logging.enable = true  # default: false
+  # config.waf.monitoring = true      # default: false
+
+  # Add custom rules
+  # https://docs.rubyonjets.com/docs/routing/lambda/cloudfront/waf/custom-rules/
+  # https://docs.rubyonjets.com/docs/routing/lambda/cloudfront/waf/default-rules/
+  # config.waf.rules = []
+
+  # Jets WAF Managed Rules
+  # config.waf.managed_rules.blanket_rate_limiter.enable = true # default: true
+  # config.waf.managed_rules.blanket_rate_limiter.limit = 1000
+  # config.waf.managed_rules.blanket_rate_limiter.evaluation_window_sec = 300
+  # config.waf.managed_rules.blanket_rate_limiter.aggregate_key_type = "IP"
+
+  # config.waf.managed_rules.uri_rate_limiter.enable = true # default: false
+  # config.waf.managed_rules.uri_rate_limiter.limit = 100
+  # config.waf.managed_rules.uri_rate_limiter.logical_statement = "Or"
+  # config.waf.managed_rules.uri_rate_limiter.paths = ["/login", "/signup"] # default: ["/"]
+  # config.waf.managed_rules.uri_rate_limiter.evaluation_window_sec = 300
+  # config.waf.managed_rules.uri_rate_limiter.aggregate_key_type = "IP"
+  # config.waf.managed_rules.uri_rate_limiter.string_match_condition = "STARTS_WITH"
+
+  # Docs: https://docs.rubyonjets.com/docs/routing/lambda/cloudfront/waf/
+end

data/lib/jets/cli/waf.rb

@@ -0,0 +1,38 @@
+class Jets::CLI
+  class Waf < Jets::Thor::Base
+    class << self
+      # interface method
+      def waf_name
+        [Jets.env, Jets.extra].compact.join("-")
+      end
+    end
+
+    Init.cli_options.each { |args| option(*args) }
+    register(Init, "init", "init", "WAF init creates config/jets/waf.rb")
+
+    desc "build", "WAF build"
+    yes_option
+    def build
+      Build.new(options).run
+    end
+
+    desc "deploy", "WAF deploy"
+    yes_option
+    def deploy
+      Deploy.new(options).run
+    end
+
+    desc "delete", "WAF delete"
+    yes_option
+    def delete
+      Delete.new(options).run
+    end
+
+    desc "info", "WAF info"
+    format_option(default: "info")
+    option :name, aliases: :n, default: waf_name, desc: "Web ACL name"
+    def info
+      Info.new(options).run
+    end
+  end
+end

data/lib/jets/cli.rb

@@ -1,33 +1,185 @@
-# frozen_string_literal: true
-
-require "jets/app_loader"
-
-# If we are inside a Jets application this method performs an exec and thus
-# the rest of this script is not run.
-# exec_app either runs bin/jets or an inline version of it.
-Jets::AppLoader.exec_app
-
-# Allow running jets with local source code when bin/jets does not exist
-# Useful for development: jets build
-# Also allows jets to work without a bin/jets file in the project.
-if File.exist?("config/application.rb")
-  APP_PATH = File.expand_path("config/application", Dir.pwd)
-  require "jets"
-  require "jets/commands"
-  return
-end
+module Jets
+  class CLI < Jets::Thor::Base
+    desc "ci SUBCOMMAND", "ci subcommands"
+    subcommand "ci", Ci
+
+    desc "concurrency SUBCOMMAND", "concurrency subcommands"
+    subcommand "concurrency", Concurrency
+
+    desc "dotenv SUBCOMMAND", "dotenv subcommands"
+    subcommand "dotenv", Dotenv
+
+    desc "env SUBCOMMAND", "env subcommands"
+    subcommand "env", Env
+
+    desc "generate SUBCOMMAND", "generate subcommands"
+    subcommand "generate", Generate
+
+    desc "maintenance SUBCOMMAND", "maintenance subcommands"
+    subcommand "maintenance", Maintenance
+
+    desc "package SUBCOMMAND", "package subcommands"
+    subcommand "package", Package
+
+    desc "release SUBCOMMAND", "release subcommands"
+    subcommand "release", Release
+
+    desc "schedule SUBCOMMAND", "schedule subcommands"
+    subcommand "schedule", Schedule
+
+    desc "waf SUBCOMMAND", "waf subcommands"
+    subcommand "waf", Waf
+
+    desc "build", "Build deployment"
+    option :templates, type: :boolean, desc: "Build only cfn templates. Skip docker build"
+    def build
+      Build.new(options).run
+    end
+
+    desc "bootstrap", "Bootstrap deployment", hide: true
+    yes_option
+    def bootstrap
+      Bootstrap.new(options).run
+    end
+
+    desc "clean", "Clean local build folder"
+    def clean
+      Clean.new(options).run
+    end
+
+    desc "deploy", "Deploy stack"
+    yes_option
+    option :templates, type: :boolean, hide: true, desc: "Deploy only cfn templates. Skip docker build. Experimental option. May be removed."
+    def deploy
+      Deploy.new(options).run
+    end
+
+    desc "delete", "Delete stack"
+    yes_option
+    def delete
+      Delete.new(options).run
+    end
+
+    desc "functions", "List functions"
+    option :full, default: false, type: :boolean, desc: "Show full function names with the project namespace"
+    def functions
+      Functions.new(options).run
+    end
+    map "funs" => :functions
+    # use string "funs", otherwise `jets fun` results in Thor sort error
+
+    Init.cli_options.each { |args| option(*args) }
+    register(Init, "init", "init", "Initialize project for Jets")
+
+    desc "ping", "Ping", hide: true
+    def ping
+      Ping.new(options).run
+    end
+
+    desc "projects", "List projects"
+    paging_options
+    format_option(default: "space")
+    def projects
+      Projects.new(options).run
+    end
+
+    desc "login [TOKEN]", "login"
+    def login(token = nil)
+      Login.new(options.merge(token: token)).run
+    end
+
+    desc "logout", "logout"
+    def logout
+      Logout.new(options).run
+    end
+
+    desc "logs", "Tail the logs"
+    option :since, desc: "From what time to begin displaying logs.  By default, logs will be displayed starting from 10m in the past. The value provided can be an ISO 8601 timestamp or a relative time. Examples: 10m 2d 2w"
+    option :follow, aliases: :f, default: false, type: :boolean, desc: " Whether to continuously poll for new logs. To exit from this mode, use Control-C."
+    option :format, default: "plain", desc: "The format to display the logs. IE: detailed, short, plain.  For plain, no timestamp are shown."
+    option :filter_pattern, desc: "The filter pattern to use. If not provided, all the events are matched"
+    # option :log_group_name, aliases: :n, desc: "The log group name.  Default: /aws/lambda/#{Jets.project.namespace}-controller"
+    option :log_group_name, aliases: :n, desc: "The log group name.  Default: /aws/lambda/NAMESPACE-controller"
+    option :refresh_rate, default: 1, type: :numeric, desc: "How often to refresh the logs in seconds."
+    option :wait_exists, default: true, type: :boolean, desc: "Whether to wait until the log group exists.  By default, it will wait."
+    def logs
+      Logs.new(options).run
+    end
+
+    desc "call", "Call Lambda function"
+    function_name_option
+    verbose_option
+    option :event, aliases: :e, default: "{}", desc: "JSON event to provide to Lambda function as input"
+    option :invocation_type, aliases: :t, default: "RequestResponse", desc: "Invocation type.  IE: RequestResponse, Event, DryRun"
+    def call
+      $stdout.sync = $stderr.sync = true
+      $stdout = $stderr
+      Call.new(options).run
+    rescue Jets::CLI::Call::Error => e
+      puts "ERROR: #{e.message}".color(:red)
+      abort "Unable to find the function.  Please check the function name and try again."
+    end
+
+    desc "curl PATH", "Curl Lambda function"
+    function_name_option
+    verbose_option
+    option :request, aliases: :X, default: "GET", desc: "HTTP request method. IE: GET, POST, PUT, DELETE, etc. Default: GET"
+    option :data, aliases: :d, desc: "HTTP request data. The @ character is used to read data from a file. IE: @data.json"
+    option :headers, aliases: :H, default: {}, type: :hash, desc: "HTTP request header. IE: -H 'Content-Type: application/json'"
+    option :cookie, aliases: :b, desc: "HTTP request cookie. IE: -b 'yummy_cookie=choco; tasty_cookie=strawberry'. If no '=' is used, it is treated as a file with the name of the cookie"
+    option :cookie_jar, aliases: :c, desc: "HTTP request cookie jar. IE: -c cookie.jar"
+    option :trim, aliases: :t, default: nil, type: :boolean, desc: "Trim large values in the response"
+    def curl(path)
+      Curl.new(options.merge(path: path)).run
+    end
+
+    desc "exec", "REPL or execute commands on AWS Lambda"
+    function_name_option
+    verbose_option
+    def exec(*command)
+      Exec.new(options.merge(command: command)).run
+    end
+
+    # Shorthand command for jets release:rollback which works too but is hidden
+    desc "rollback VERSION", "Rollback to a previous release"
+    option :yes, aliases: :y, type: :boolean, desc: "Skip are you sure prompt"
+    def rollback(version)
+      Jets::CLI::Release::Rollback.new(options.merge(version: version)).run
+    end
+
+    desc "stacks", "List deployed stacks"
+    paging_options
+    option :all_projects, desc: "Show all stacks across all projects", type: :boolean, default: false
+    format_option(default: "space")
+    def stacks
+      Stacks.new(options).run
+    end
 
-# The rest of the script runs if outside of Jets application. IE:
-# jets new demo
+    desc "stop", "Stops the deploy"
+    yes_option
+    def stop
+      Stop.new(options).run
+    end
 
-require "jets/ruby_version_check"
-Signal.trap("INT") { puts; exit(1) }
+    # Normally should not have to use this. This is why it's hidden.
+    # Only useful if some reason the remote delete leaves remaining resources behind.
+    desc "teardown", "Teardown stack", hide: true
+    yes_option
+    def teardown
+      warn "WARN: You should use `jets delete` instead of `jets teardown`".color(:yellow)
+      warn "This is for debugging and will not delete the Jets API deployment record"
+      Teardown.new(options).run
+    end
 
-require "jets/command"
+    desc "url", "App url"
+    format_option(default: "space")
+    def url
+      Url.new(options).run
+    end
 
-if ARGV.first == "plugin"
-  ARGV.shift
-  Jets::Command.invoke :plugin, ARGV
-else
-  Jets::Command.invoke :application, ARGV
+    desc "version", "Prints version"
+    def version
+      puts "Jets #{VERSION}"
+    end
+  end
 end

data/lib/jets/code/copy/base.rb

@@ -0,0 +1,84 @@
+module Jets::Code::Copy
+  class Base
+    extend Memoist
+    include Jets::Util::Git
+    include Jets::Util::Logging
+    include Jets::Util::Sh
+
+    delegate :build_root, to: Jets
+    delegate :config, to: "Jets.bootstrap.config"
+
+    def self.run
+      new.run
+    end
+
+    def run
+      create_temp_zip # interface method
+      extract_code # Now have a working area: stage/code
+      remove_temp_files
+      always_keep
+      always_remove
+      save_gitinfo
+      "#{build_root}/stage/code"
+    end
+
+    # Extract code-temp.zip immediately
+    def extract_code
+      quiet_sh "unzip -q #{build_root}/stage/code-temp.zip -d #{build_root}/stage/code"
+    end
+
+    # Remove code-temp files. Not needed anymore.
+    def remove_temp_files
+      FileUtils.rm_f "#{build_root}/stage/code-temp.zip"
+      FileUtils.rm_rf "#{build_root}/stage/code-temp"
+    end
+
+    def save_gitinfo
+      dest = "#{build_root}/stage/code/.jets/gitinfo.yml"
+      FileUtils.mkdir_p(File.dirname(dest))
+      if File.exist?(".jets/gitinfo.yml")
+        # already copied over
+        FileUtils.cp(".jets/gitinfo.yml", dest)
+      else
+        IO.write(dest, git_info.params.deep_stringify_keys.to_yaml)
+      end
+    end
+
+    def git_info
+      Jets::Git::Info.new
+    end
+    memoize :git_info
+
+    # Ensure gitconfig to avoid the Author identity unknown git warning.
+    def gitconfig
+      home = ENV["HOME"] || "/root"
+      git_user = capture "git config user.name || true"
+      return unless git_user.blank?
+
+      IO.write("#{home}/.gitconfig", <<~EOL)
+        [user]
+          name = Nobody
+          email = "nobody@email.com"
+      EOL
+    end
+
+    # Copy always_keep files and folders like .deploy for remote runner
+    # regardless of .gitignore. Allows user to use .deploy/.env files for remote runner
+    # And have a .gitignore for .env at the project root level.
+    def always_keep
+      config.code.copy.always_keep.each do |path|
+        next unless File.exist?(path)
+        # Remove in case not gitignore. IE: avoid creating .deploy/.deploy
+        FileUtils.rm_rf("#{build_root}/stage/code/#{path}")
+        FileUtils.mkdir_p("#{build_root}/stage/code")
+        FileUtils.cp_r(path, "#{build_root}/stage/code/#{path}")
+      end
+    end
+
+    def always_remove
+      config.code.copy.always_remove.each do |path|
+        FileUtils.rm_rf("#{build_root}/stage/code/#{path}")
+      end
+    end
+  end
+end

data/lib/jets/code/copy/full.rb

@@ -0,0 +1,9 @@
+module Jets::Code::Copy
+  # Inherits from Base for build_root and class run method
+  class Full < Base
+    # Completely override run since Full has complete different behavior
+    def run
+      FileUtils.cp_r(Jets.root, "#{build_root}/stage/code")
+    end
+  end
+end

data/lib/jets/code/copy/git_copy.rb

@@ -0,0 +1,26 @@
+module Jets::Code::Copy
+  class GitCopy < Base
+    # interface method
+    def create_temp_zip
+      copy_to_code_temp # interface method
+
+      # We leverage git archive for gitignore settings.
+      Dir.chdir("#{build_root}/stage/code-temp") do
+        if git_info.params[:git_dirty]
+          quiet_sh "git add ."
+          gitconfig
+          quiet_sh "git commit -m 'add working tree files' > /dev/null || true"
+        end
+        quiet_sh "git archive -o #{build_root}/stage/code-temp.zip HEAD"
+      end
+    end
+
+    # Copy project to stage/code-temp to use git add and archive
+    # without affecting up the current git repo.
+    # interface method. overriden by GitRsync
+    def copy_to_code_temp
+      FileUtils.mkdir_p("#{build_root}/stage")
+      FileUtils.cp_r(Jets.root, "#{build_root}/stage/code-temp")
+    end
+  end
+end

data/lib/jets/code/copy/git_inline.rb

@@ -0,0 +1,13 @@
+module Jets::Code::Copy
+  class GitInline < Base
+    def create_temp_zip
+      # Git add and commit to current repo. Affects the working dir but faster.
+      if git_info.params[:git_dirty]
+        quiet_sh "git add ."
+        gitconfig
+        quiet_sh "git commit -m 'commit for deploy' > /dev/null || true"
+      end
+      quiet_sh "git archive -o #{build_root}/stage/code-temp.zip HEAD"
+    end
+  end
+end

data/lib/jets/code/copy/rsync.rb

@@ -0,0 +1,19 @@
+module Jets::Code::Copy
+  class Rsync < Base
+    # interface method
+    def create_temp_zip
+      FileUtils.mkdir_p("#{build_root}/stage/code-temp")
+      excludes = " --exclude .git"
+      excludes << " --exclude-from=#{Jets.root}/.gitignore" if File.exist?("#{Jets.root}/.gitignore")
+      quiet_sh "rsync -aq#{excludes} #{Jets.root}/ #{build_root}/stage/code-temp"
+      # Create zip file
+      check_zip_installed!
+      quiet_sh "cd #{build_root}/stage/code-temp && zip -q -r #{build_root}/stage/code-temp.zip ."
+    end
+
+    def check_zip_installed!
+      return if system("type zip > /dev/null 2>&1")
+      abort "ERROR: zip command is required. Please install zip command."
+    end
+  end
+end

data/lib/jets/code/dummy.rb

@@ -0,0 +1,11 @@
+class Jets::Code
+  class Dummy < Stager
+    def stage_code
+      # copies jets config
+      return unless File.exist?("#{Jets.root}/config/jets")
+      FileUtils.rm_rf("#{build_root}/stage/code/config/jets")
+      FileUtils.mkdir_p("#{build_root}/stage/code/config")
+      FileUtils.cp_r("#{Jets.root}/config/jets", "#{build_root}/stage/code/config/jets")
+    end
+  end
+end