pangea 0.0.45 → 0.0.46

data/lib/pangea/resources/aws_api_gateway_integration/resource.rb

@@ -1,172 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-require 'pangea/resources/reference'
-require 'pangea/resources/aws_api_gateway_integration/types'
-require 'pangea/resource_registry'
-
-module Pangea
-  module Resources
-    module AWS
-      # AWS API Gateway Integration resource function
-      # Creates backend integrations for API Gateway methods
-      def aws_api_gateway_integration(name, attributes = {})
-        # Validate and coerce attributes
-        integration_attrs = AWS::Types::Types::ApiGatewayIntegrationAttributes.new(attributes)
-        
-        # Generate Terraform resource block
-        resource(:aws_api_gateway_integration, name) do
-          rest_api_id integration_attrs.rest_api_id
-          resource_id integration_attrs.resource_id
-          http_method integration_attrs.http_method
-          type integration_attrs.type
-          
-          # Integration HTTP method (required for HTTP/AWS integrations)
-          if integration_attrs.integration_http_method
-            integration_http_method integration_attrs.integration_http_method
-          end
-          
-          # URI (required for non-MOCK integrations)
-          if integration_attrs.uri
-            uri integration_attrs.uri
-          end
-          
-          # Connection configuration
-          connection_type integration_attrs.connection_type
-          if integration_attrs.connection_id
-            connection_id integration_attrs.connection_id
-          end
-          
-          # Credentials for AWS integrations
-          if integration_attrs.credentials
-            credentials integration_attrs.credentials
-          end
-          
-          # Caching configuration
-          if integration_attrs.cache_key_parameters.any?
-            cache_key_parameters integration_attrs.cache_key_parameters
-          end
-          
-          if integration_attrs.cache_namespace
-            cache_namespace integration_attrs.cache_namespace
-          end
-          
-          # Request templates
-          if integration_attrs.request_templates.any?
-            request_templates do
-              integration_attrs.request_templates.each do |content_type, template|
-                send(content_type.tr('/', '_').tr('-', '_'), template)
-              end
-            end
-          end
-          
-          # Request parameter mapping
-          if integration_attrs.request_parameters.any?
-            request_parameters do
-              integration_attrs.request_parameters.each do |integration_param, method_param|
-                send(integration_param.tr('.', '_').tr('-', '_'), method_param)
-              end
-            end
-          end
-          
-          # Passthrough behavior
-          passthrough_behavior integration_attrs.passthrough_behavior
-          
-          # Content handling
-          if integration_attrs.content_handling
-            content_handling integration_attrs.content_handling
-          end
-          
-          # Timeout
-          timeout_milliseconds integration_attrs.timeout_milliseconds
-        end
-        
-        # Create ResourceReference with outputs and computed properties
-        ref = ResourceReference.new(
-          type: 'aws_api_gateway_integration',
-          name: name,
-          resource_attributes: integration_attrs.to_h,
-          outputs: {
-            # Standard Terraform outputs
-            rest_api_id: "${aws_api_gateway_integration.#{name}.rest_api_id}",
-            resource_id: "${aws_api_gateway_integration.#{name}.resource_id}",
-            http_method: "${aws_api_gateway_integration.#{name}.http_method}",
-            type: "${aws_api_gateway_integration.#{name}.type}",
-            integration_http_method: "${aws_api_gateway_integration.#{name}.integration_http_method}",
-            uri: "${aws_api_gateway_integration.#{name}.uri}",
-            connection_type: "${aws_api_gateway_integration.#{name}.connection_type}",
-            connection_id: "${aws_api_gateway_integration.#{name}.connection_id}",
-            credentials: "${aws_api_gateway_integration.#{name}.credentials}",
-            cache_key_parameters: "${aws_api_gateway_integration.#{name}.cache_key_parameters}",
-            cache_namespace: "${aws_api_gateway_integration.#{name}.cache_namespace}",
-            request_parameters: "${aws_api_gateway_integration.#{name}.request_parameters}",
-            request_templates: "${aws_api_gateway_integration.#{name}.request_templates}",
-            passthrough_behavior: "${aws_api_gateway_integration.#{name}.passthrough_behavior}",
-            content_handling: "${aws_api_gateway_integration.#{name}.content_handling}",
-            timeout_milliseconds: "${aws_api_gateway_integration.#{name}.timeout_milliseconds}"
-          }
-        )
-        
-        # Add computed properties via method delegation
-        ref.define_singleton_method(:is_proxy_integration?) { integration_attrs.is_proxy_integration? }
-        ref.define_singleton_method(:is_lambda_integration?) { integration_attrs.is_lambda_integration? }
-        ref.define_singleton_method(:is_http_integration?) { integration_attrs.is_http_integration? }
-        ref.define_singleton_method(:is_aws_service_integration?) { integration_attrs.is_aws_service_integration? }
-        ref.define_singleton_method(:is_mock_integration?) { integration_attrs.is_mock_integration? }
-        ref.define_singleton_method(:uses_vpc_link?) { integration_attrs.uses_vpc_link? }
-        ref.define_singleton_method(:has_caching?) { integration_attrs.has_caching? }
-        ref.define_singleton_method(:requires_iam_role?) { integration_attrs.requires_iam_role? }
-        ref.define_singleton_method(:lambda_function_name) { integration_attrs.lambda_function_name }
-        ref.define_singleton_method(:aws_service_name) { integration_attrs.aws_service_name }
-        
-        # Add convenience methods
-        ref.define_singleton_method(:integration_type) { integration_attrs.type }
-        ref.define_singleton_method(:backend_uri) { integration_attrs.uri }
-        ref.define_singleton_method(:timeout_seconds) { integration_attrs.timeout_milliseconds / 1000.0 }
-        
-        # Integration-specific helpers
-        ref.define_singleton_method(:cache_configuration) do
-          {
-            enabled: integration_attrs.has_caching?,
-            key_parameters: integration_attrs.cache_key_parameters,
-            namespace: integration_attrs.cache_namespace
-          }
-        end
-        
-        ref.define_singleton_method(:request_configuration) do
-          {
-            templates: integration_attrs.request_templates,
-            parameters: integration_attrs.request_parameters,
-            passthrough: integration_attrs.passthrough_behavior
-          }
-        end
-        
-        ref.define_singleton_method(:connection_configuration) do
-          {
-            type: integration_attrs.connection_type,
-            id: integration_attrs.connection_id,
-            uses_vpc: integration_attrs.uses_vpc_link?
-          }
-        end
-        
-        ref
-      end
-    end
-  end
-end
-
-# Auto-register this module when it's loaded
-Pangea::ResourceRegistry.register(:aws, Pangea::Resources::AWS)

data/lib/pangea/resources/aws_api_gateway_integration/types.rb

@@ -1,257 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-require 'dry-struct'
-require 'pangea/resources/types'
-
-module Pangea
-  module Resources
-    module AWS
-      module Types
-        # API Gateway Integration attributes with validation
-        class ApiGatewayIntegrationAttributes < Dry::Struct
-          transform_keys(&:to_sym)
-          
-          # Core attributes
-          attribute :rest_api_id, Pangea::Resources::Types::String
-          attribute :resource_id, Pangea::Resources::Types::String
-          attribute :http_method, Pangea::Resources::Types::String.constrained(included_in: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS', 'HEAD', 'PATCH', 'ANY'])
-          
-          # Integration type and configuration
-          attribute :type, Pangea::Resources::Types::String.constrained(included_in: ['MOCK', 'HTTP', 'HTTP_PROXY', 'AWS', 'AWS_PROXY'])
-          attribute :integration_http_method, Pangea::Resources::Types::String.optional.default(nil)
-          attribute :uri, Pangea::Resources::Types::String.optional.default(nil)
-          
-          # Connection details
-          attribute :connection_type, Pangea::Resources::Types::String.default('INTERNET').constrained(included_in: ['INTERNET', 'VPC_LINK'])
-          attribute :connection_id, Pangea::Resources::Types::String.optional.default(nil)
-          
-          # Credentials and caching
-          attribute :credentials, Pangea::Resources::Types::String.optional.default(nil)
-          attribute :cache_key_parameters, Pangea::Resources::Types::Array.of(Pangea::Resources::Types::String).default([].freeze)
-          attribute :cache_namespace, Pangea::Resources::Types::String.optional.default(nil)
-          
-          # Request configuration
-          attribute :request_templates, Pangea::Resources::Types::Hash.map(
-            Pangea::Resources::Types::String, Pangea::Resources::Types::String
-          ).default({}.freeze)
-          
-          attribute :request_parameters, Pangea::Resources::Types::Hash.map(
-            Pangea::Resources::Types::String, Pangea::Resources::Types::String
-          ).default({}.freeze)
-          
-          # Response passthrough for proxy integrations
-          attribute :passthrough_behavior, Pangea::Resources::Types::String.default('WHEN_NO_MATCH').constrained(included_in: ['WHEN_NO_MATCH', 'WHEN_NO_TEMPLATES', 'NEVER'])
-          
-          # Content handling
-          attribute :content_handling, Pangea::Resources::Types::String.optional.default(nil)
-          
-          # Timeout configuration
-          attribute :timeout_milliseconds, Pangea::Resources::Types::Integer.default(29000).constrained(gteq: 50, lteq: 29000)
-          
-          # Custom validation
-          def self.new(attributes)
-            attrs = attributes.is_a?(Hash) ? attributes : {}
-            
-            # Validate integration type combinations
-            case attrs[:type]
-            when 'HTTP', 'HTTP_PROXY', 'AWS', 'AWS_PROXY'
-              if attrs[:uri].nil? || attrs[:uri].empty?
-                raise Dry::Struct::Error, "uri is required for #{attrs[:type]} integrations"
-              end
-            when 'MOCK'
-              # URI not required for MOCK integrations
-            end
-            
-            # Validate HTTP method for non-proxy integrations
-            if ['HTTP', 'AWS'].include?(attrs[:type]) && attrs[:integration_http_method].nil?
-              raise Dry::Struct::Error, "integration_http_method is required for #{attrs[:type]} integrations"
-            end
-            
-            # Validate VPC_LINK connection
-            if attrs[:connection_type] == 'VPC_LINK'
-              if attrs[:connection_id].nil? || attrs[:connection_id].empty?
-                raise Dry::Struct::Error, "connection_id is required when connection_type is VPC_LINK"
-              end
-            end
-            
-            # Validate request parameter mapping format
-            if attrs[:request_parameters]
-              attrs[:request_parameters].each do |integration_param, method_param|
-                # Integration parameters should be in format integration.request.{location}.{name}
-                unless integration_param.match?(/^integration\.request\.(path|querystring|header|multivalueheader|multivaluequerystring)\..+/)
-                  raise Dry::Struct::Error, "Invalid integration parameter format: #{integration_param}"
-                end
-                
-                # Method parameters should reference method.request.* or static values
-                unless method_param.match?(/^(method\.request\.|'.*'|".*")/) || method_param == 'context.requestId' || method_param.start_with?('stageVariables.')
-                  raise Dry::Struct::Error, "Invalid method parameter reference: #{method_param}"
-                end
-              end
-            end
-            
-            # Validate content handling types
-            if attrs[:content_handling] && !['CONVERT_TO_BINARY', 'CONVERT_TO_TEXT'].include?(attrs[:content_handling])
-              raise Dry::Struct::Error, "content_handling must be CONVERT_TO_BINARY or CONVERT_TO_TEXT"
-            end
-            
-            super(attrs)
-          end
-          
-          # Computed properties
-          def is_proxy_integration?
-            ['HTTP_PROXY', 'AWS_PROXY'].include?(type)
-          end
-          
-          def is_lambda_integration?
-            type == 'AWS_PROXY' && uri&.include?('lambda')
-          end
-          
-          def is_http_integration?
-            ['HTTP', 'HTTP_PROXY'].include?(type)
-          end
-          
-          def is_aws_service_integration?
-            type == 'AWS' && !is_lambda_integration?
-          end
-          
-          def is_mock_integration?
-            type == 'MOCK'
-          end
-          
-          def uses_vpc_link?
-            connection_type == 'VPC_LINK'
-          end
-          
-          def has_caching?
-            !cache_key_parameters.empty? || !cache_namespace.nil?
-          end
-          
-          def requires_iam_role?
-            ['AWS', 'AWS_PROXY'].include?(type) && !is_lambda_integration?
-          end
-          
-          # URI pattern detection
-          def lambda_function_name
-            return nil unless is_lambda_integration?
-            
-            # Extract function name from ARN or URI
-            if uri.include?('lambda:path')
-              # Path format: arn:aws:apigateway:region:lambda:path/2015-03-31/functions/arn:aws:lambda:region:account:function:function-name/invocations
-              # Look for the nested lambda ARN and extract the last part after the last colon
-              nested_match = uri.match(%r{functions/(arn:aws:lambda:[^/]+)/})
-              if nested_match
-                nested_arn = nested_match[1]
-                nested_arn.split(':').last
-              else
-                # Fallback for direct function reference
-                match = uri.match(%r{functions/([^/]+)/})
-                match ? match[1] : nil
-              end
-            elsif uri.include?('arn:aws:lambda')
-              # Direct ARN format: arn:aws:lambda:region:account:function:function-name
-              uri.split(':').last
-            end
-          end
-          
-          def aws_service_name
-            return nil unless is_aws_service_integration?
-            
-            # Extract service from URI
-            # Format: arn:aws:apigateway:region:service:action/service_api
-            match = uri.match(/arn:aws:apigateway:[^:]+:([^:]+):/)
-            match ? match[1] : nil
-          end
-          
-          # Helper methods for common configurations
-          def self.lambda_proxy_integration(function_arn, credentials: nil)
-            {
-              type: 'AWS_PROXY',
-              integration_http_method: 'POST',
-              uri: "arn:aws:apigateway:${data.aws_region.current.name}:lambda:path/2015-03-31/functions/#{function_arn}/invocations",
-              credentials: credentials
-            }
-          end
-          
-          def self.lambda_integration(function_arn, credentials: nil, request_templates: {})
-            {
-              type: 'AWS',
-              integration_http_method: 'POST',
-              uri: "arn:aws:apigateway:${data.aws_region.current.name}:lambda:path/2015-03-31/functions/#{function_arn}/invocations",
-              credentials: credentials,
-              request_templates: request_templates
-            }
-          end
-          
-          def self.http_proxy_integration(endpoint_url)
-            {
-              type: 'HTTP_PROXY',
-              integration_http_method: 'ANY',
-              uri: endpoint_url
-            }
-          end
-          
-          def self.http_integration(endpoint_url, http_method, request_templates: {})
-            {
-              type: 'HTTP',
-              integration_http_method: http_method,
-              uri: endpoint_url,
-              request_templates: request_templates
-            }
-          end
-          
-          def self.mock_integration(request_templates: { 'application/json' => '{"statusCode": 200}' })
-            {
-              type: 'MOCK',
-              request_templates: request_templates
-            }
-          end
-          
-          def self.s3_integration(bucket_name, credentials:, request_parameters: {})
-            {
-              type: 'AWS',
-              integration_http_method: 'GET',
-              uri: "arn:aws:apigateway:${data.aws_region.current.name}:s3:path/#{bucket_name}/{key}",
-              credentials: credentials,
-              request_parameters: {
-                'integration.request.path.key' => 'method.request.path.key'
-              }.merge(request_parameters)
-            }
-          end
-          
-          def self.dynamodb_integration(table_name, action, credentials:, request_templates: {})
-            {
-              type: 'AWS',
-              integration_http_method: 'POST',
-              uri: "arn:aws:apigateway:${data.aws_region.current.name}:dynamodb:action/#{action}",
-              credentials: credentials,
-              request_templates: {
-                'application/json' => {
-                  TableName: table_name,
-                  Key: {
-                    id: {
-                      S: '$input.params("id")'
-                    }
-                  }
-                }.to_json
-              }.merge(request_templates)
-            }
-          end
-        end
-      end
-    end
-  end
-end

data/lib/pangea/resources/aws_api_gateway_method/CLAUDE.md

@@ -1,235 +0,0 @@
-# AWS API Gateway Method Implementation
-
-## Overview
-
-The `aws_api_gateway_method` resource implements type-safe creation of HTTP methods on API Gateway resources. Methods define the HTTP verbs (GET, POST, etc.) that clients can use to interact with your API endpoints.
-
-## Implementation Details
-
-### Type System
-
-The implementation uses `dry-struct` for runtime validation with the following key validations:
-
-1. **HTTP Method Validation**: Enforces valid HTTP methods including ANY for wildcard
-2. **Authorization Validation**: 
-   - Requires `authorizer_id` for CUSTOM and COGNITO_USER_POOLS
-   - Restricts `authorization_scopes` to COGNITO_USER_POOLS only
-3. **Request Parameter Validation**: 
-   - Validates parameter name format: `method.request.{location}.{name}`
-   - Ensures valid locations (path, querystring, header, etc.)
-4. **Content Type Validation**: Validates MIME type format for request models
-
-### Authorization Types
-
-The resource supports four authorization types:
-
-- **NONE**: No authorization (public access)
-- **AWS_IAM**: AWS signature version 4 authorization
-- **CUSTOM**: Lambda-based custom authorizer
-- **COGNITO_USER_POOLS**: Cognito user pool authorization with OAuth scopes
-
-### Request Configuration
-
-Methods can define:
-
-1. **Request Parameters**: Expected parameters and whether they're required
-2. **Request Models**: JSON schema models for request body validation
-3. **Request Validators**: Validate body, parameters, or both
-
-### Computed Properties
-
-The type class provides helper properties:
-
-- `requires_authorization?`: Check if method needs auth
-- `is_cognito_authorized?`: Check for Cognito auth
-- `is_iam_authorized?`: Check for IAM auth
-- `has_request_validation?`: Check if validation is configured
-- `cors_enabled?`: Check if method handles CORS (OPTIONS)
-
-## Design Patterns
-
-### RESTful Method Mapping
-
-Standard REST conventions:
-
-```
-GET     /resources     - List collection
-POST    /resources     - Create new item
-GET     /resources/{id} - Get specific item
-PUT     /resources/{id} - Update item
-DELETE  /resources/{id} - Delete item
-OPTIONS /resources     - CORS preflight
-```
-
-### Authorization Strategies
-
-1. **Public Endpoints**: Health checks, documentation
-2. **API Key Protected**: Rate-limited public access
-3. **IAM Protected**: Service-to-service communication
-4. **User Pool Protected**: End-user authentication
-5. **Custom Auth**: Complex authorization logic
-
-### Request Validation Patterns
-
-1. **Path Parameters**: Always required, extracted from URL
-2. **Query Parameters**: Optional filters, pagination
-3. **Headers**: Authentication, content negotiation
-4. **Body Models**: Structured request validation
-
-## Integration Patterns
-
-### With Lambda Integration
-
-Methods typically integrate with Lambda functions:
-
-```ruby
-method -> integration -> lambda_function
-```
-
-### With HTTP Integration
-
-Proxy requests to HTTP endpoints:
-
-```ruby
-method -> integration -> http_endpoint
-```
-
-### With AWS Service Integration
-
-Direct integration with AWS services:
-
-```ruby
-method -> integration -> aws_service (S3, DynamoDB, etc.)
-```
-
-## Security Considerations
-
-1. **Authorization Layering**: 
-   - API-level: API keys
-   - Method-level: IAM/Cognito/Custom
-   - Integration-level: IAM roles
-
-2. **Request Validation**:
-   - Prevent injection attacks
-   - Enforce data types
-   - Limit payload sizes
-
-3. **CORS Configuration**:
-   - OPTIONS methods for preflight
-   - Proper header configuration
-   - Origin restrictions
-
-## Performance Optimization
-
-1. **Authorization Caching**: Authorizer results are cached
-2. **Request Validation**: Early rejection of invalid requests
-3. **Method Selection**: Use specific methods vs ANY
-4. **Parameter Optimization**: Only require necessary parameters
-
-## Common Patterns
-
-### CRUD Operations
-
-Complete Create, Read, Update, Delete pattern:
-
-```ruby
-GET    /items     - List
-POST   /items     - Create  
-GET    /items/{id} - Read
-PUT    /items/{id} - Update
-DELETE /items/{id} - Delete
-```
-
-### Search Endpoints
-
-```ruby
-GET /items/search?q=query&filter=value
-```
-
-### Batch Operations
-
-```ruby
-POST /batch/items - Process multiple items
-```
-
-### Webhook Receivers
-
-```ruby
-POST /webhooks/{provider} - Provider-specific webhooks
-```
-
-## Request Parameter Helpers
-
-The implementation provides helper methods:
-
-- `build_request_parameter`: Constructs parameter names correctly
-- `common_request_parameters`: Pre-built common parameters
-- `common_content_types`: Standard MIME types
-
-## Error Handling
-
-Common method-related errors:
-
-1. **Missing Authorizer**: CUSTOM/COGNITO without authorizer_id
-2. **Invalid Scopes**: Scopes used with non-Cognito auth
-3. **Parameter Format**: Incorrect parameter naming
-4. **Content Type**: Invalid MIME type format
-
-## Best Practices
-
-1. **Explicit Methods**: Avoid ANY unless necessary
-2. **Consistent Auth**: Same auth type for related endpoints
-3. **Parameter Validation**: Validate all inputs
-4. **Model Reuse**: Share request/response models
-5. **Operation Names**: Meaningful names for SDK generation
-
-## Testing Strategies
-
-1. **Authorization Testing**: Test each auth type
-2. **Parameter Testing**: Required vs optional parameters
-3. **Content Type Testing**: Multiple content types
-4. **Error Testing**: Invalid requests return proper errors
-
-## Monitoring and Debugging
-
-1. **CloudWatch Metrics**: 
-   - 4xx/5xx errors per method
-   - Latency per method
-   - Request count
-
-2. **CloudWatch Logs**:
-   - Full request/response logging
-   - Authorization failures
-   - Validation errors
-
-3. **X-Ray Tracing**:
-   - End-to-end request flow
-   - Authorization latency
-   - Integration performance
-
-## Integration with Other Resources
-
-Methods work with:
-
-- **Integrations**: Define backend connections
-- **Integration Responses**: Transform responses
-- **Method Responses**: Define possible responses
-- **Models**: Request/response schemas
-- **Authorizers**: Custom authorization logic
-
-## Cost Considerations
-
-1. **Request Pricing**: Charged per million requests
-2. **Authorization Caching**: Reduces authorizer invocations
-3. **Validation**: Cheaper than backend processing
-4. **Method Count**: No charge for method definitions
-
-## Future Enhancements
-
-Potential improvements:
-
-1. **Auto-documentation**: Generate from method definitions
-2. **Type inference**: Infer models from parameters
-3. **Security templates**: Pre-configured auth patterns
-4. **Testing helpers**: Generate test requests
-5. **SDK generation**: Automatic client SDK creation