@anthusai/papyrus 1.18.0 → 1.19.0

package/bin/papyrus-infra.mjs

@@ -12,13 +12,12 @@ import fs from "node:fs";
 import { spawnSync } from "node:child_process";
 import path from "node:path";
 import { createRequire } from "node:module";
-import { buildSpecFor } from "../infra/build-specs.js";
-import { parseSiteConfig, resolveStackName } from "../infra/site-config.js";
 
 const USAGE = [
   "Usage: papyrus-infra synth --site infra/site.json [--out cdk.out] [--account A] [--region R]",
   "       papyrus-infra synth --account-stack github-oidc [--out cdk.out] [--account A] [--region R]",
   "       papyrus-infra print-buildspec --site infra/site.json --app cms-production|cms-staging|reader",
+  "       papyrus-infra deploy-edge --stack NAME --template FILE [--adoption-template FILE --adopt-resources FILE] [--parameter KEY=VALUE]... [--delete-function NAME] [--only-branch main] [--only-app-id ID] [--region R]",
   "       papyrus-infra deploy --site infra/site.json [--only-branch main] [--only-app-id ID] [--out cdk.out] [--account A] [--region R]",
 ].join("\n");
 
@@ -28,11 +27,48 @@ const opt = (name, fallback) => {
   return i >= 0 ? args[i + 1] : fallback;
 };
 const command = args[0];
-if (command !== "synth" && command !== "print-buildspec" && command !== "deploy") {
+if (command !== "synth" && command !== "print-buildspec" && command !== "deploy" && command !== "deploy-edge") {
   console.error(USAGE);
   process.exit(command ? 1 : 0);
 }
 
+if (command === "deploy-edge") {
+  const buildAppId = process.env.AWS_APP_ID;
+  const buildBranch = process.env.AWS_BRANCH;
+  const owningAppId = opt("only-app-id");
+  if (!buildAppId || !buildBranch) {
+    console.log("papyrus-infra deploy-edge: not running inside an Amplify build, skipping");
+    process.exit(0);
+  }
+  if (buildBranch !== opt("only-branch", "main") || (owningAppId && buildAppId !== owningAppId)) {
+    console.log(`papyrus-infra deploy-edge: ${buildAppId}/${buildBranch} does not own the stack, skipping`);
+    process.exit(0);
+  }
+  const parameterValues = {};
+  args.forEach((argument, index) => {
+    if (argument !== "--parameter") return;
+    const [name, ...valueParts] = args[index + 1].split("=");
+    parameterValues[name] = valueParts.join("=");
+  });
+  const adoptResourcesFile = opt("adopt-resources");
+  try {
+    const { deployEdgeStack } = await import("../src/edge-stack-deploy.mjs");
+    deployEdgeStack({
+      stackName: opt("stack"),
+      region: opt("region", process.env.AWS_REGION ?? "us-east-1"),
+      templateFile: opt("template"),
+      parameterValues,
+      adoptionTemplateFile: opt("adoption-template"),
+      adoptionResources: adoptResourcesFile ? JSON.parse(fs.readFileSync(adoptResourcesFile, "utf8")) : [],
+      orphanedFunctionName: opt("delete-function"),
+    });
+  } catch (error) {
+    console.error(`papyrus-infra deploy-edge: ${error instanceof Error ? error.message : error}`);
+    process.exit(1);
+  }
+  process.exit(0);
+}
+
 const accountStack = opt("account-stack");
 if (accountStack !== undefined) {
   if (command !== "synth" || accountStack !== "github-oidc") {
@@ -49,7 +85,7 @@ if (accountStack !== undefined) {
   const { App } = createRequire(path.join(process.cwd(), "noop.js"))("aws-cdk-lib");
   const app = new App({ outdir: path.resolve(opt("out", "cdk.out")) });
   new GithubOidcProviderStack(app, "GithubOidcProviderStack", {
-    env: { account: opt("account", "335163751677"), region: opt("region", "us-east-1") },
+    env: { account: opt("account", process.env.CDK_DEFAULT_ACCOUNT ?? "335163751677"), region: opt("region", process.env.CDK_DEFAULT_REGION ?? "us-east-1") },
     stackName: "github-oidc-provider",
   });
   app.synth();
@@ -57,6 +93,8 @@ if (accountStack !== undefined) {
   process.exit(0);
 }
 
+const { buildSpecFor } = await import("../infra/build-specs.js");
+const { parseSiteConfig, resolveStackName } = await import("../infra/site-config.js");
 let config;
 try {
   config = parseSiteConfig(JSON.parse(fs.readFileSync(path.resolve(opt("site", "infra/site.json")), "utf8")));
@@ -94,6 +132,8 @@ if (command === "deploy") {
     process.exit(0);
   }
   const outputDirectory = path.resolve(opt("out", process.env.CDK_OUTDIR ?? "cdk.out"));
+  const explicitAccount = opt("account");
+  const explicitRegion = opt("region");
   const synthCommand = [
     process.execPath,
     path.resolve(process.argv[1]),
@@ -102,14 +142,12 @@ if (command === "deploy") {
     path.resolve(opt("site", "infra/site.json")),
     "--out",
     outputDirectory,
-    "--account",
-    opt("account", process.env.CDK_DEFAULT_ACCOUNT ?? "335163751677"),
-    "--region",
-    opt("region", process.env.CDK_DEFAULT_REGION ?? "us-east-1"),
+    ...(explicitAccount ? ["--account", explicitAccount] : []),
+    ...(explicitRegion ? ["--region", explicitRegion] : []),
   ].map((part) => JSON.stringify(part)).join(" ");
   const deployment = spawnSync(
     "npx",
-    ["--yes", "aws-cdk@2", "deploy", "--app", synthCommand, "--require-approval", "never", `AmplifyAppShell-${config.siteId}`],
+    ["--yes", "aws-cdk@2", "deploy", "--app", synthCommand, "--require-approval", "never", "--output", outputDirectory, `AmplifyAppShell-${config.siteId}`],
     { stdio: "inherit" },
   );
   process.exit(deployment.status ?? 1);
@@ -126,7 +164,7 @@ try {
 const { App } = createRequire(path.join(process.cwd(), "noop.js"))("aws-cdk-lib");
 const app = new App({ outdir: path.resolve(opt("out", "cdk.out")) });
 new AmplifyAppShellStack(app, `AmplifyAppShell-${config.siteId}`, config, {
-  env: { account: opt("account", "335163751677"), region: opt("region", "us-east-1") },
+  env: { account: opt("account", process.env.CDK_DEFAULT_ACCOUNT ?? "335163751677"), region: opt("region", process.env.CDK_DEFAULT_REGION ?? "us-east-1") },
   stackName: resolveStackName(config),
 });
 app.synth();

package/package.json

@@ -379,7 +379,7 @@
       "optional": true
     }
   },
-  "version": "1.18.0",
+  "version": "1.19.0",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.18.0",
+  "version": "1.19.0",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",

package/src/edge-stack-deploy.mjs

@@ -0,0 +1,104 @@
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+const NO_CHANGES_REASONS = ["didn't contain changes", "No updates are to be performed"];
+const FUNCTION_STILL_ATTACHED_PAUSE_SECONDS = 20;
+const FUNCTION_DELETE_ATTEMPTS = 6;
+
+function runAws(awsArguments, { allowFailure = false } = {}) {
+  const completed = spawnSync("aws", awsArguments, { encoding: "utf8" });
+  if (completed.status !== 0 && !allowFailure) {
+    throw new Error(`aws ${awsArguments.slice(0, 2).join(" ")} failed: ${completed.stderr || completed.stdout}`);
+  }
+  return completed;
+}
+
+function runAwsJson(awsArguments) {
+  const completed = runAws([...awsArguments, "--output", "json"]);
+  return completed.stdout.trim() === "" ? {} : JSON.parse(completed.stdout);
+}
+
+function logicalIdsInStack(stackName, region) {
+  const completed = runAws(["cloudformation", "list-stack-resources", "--stack-name", stackName, "--region", region, "--output", "json"], { allowFailure: true });
+  if (completed.status !== 0) return new Set();
+  return new Set(JSON.parse(completed.stdout).StackResourceSummaries.map((summary) => summary.LogicalResourceId));
+}
+
+function templateParameterFlags(parameterValues, templateFile) {
+  const templateText = fs.readFileSync(templateFile, "utf8");
+  const parametersSection = templateText.split("\nResources:")[0].split("\nParameters:\n")[1] ?? "";
+  const parameterNames = [...parametersSection.matchAll(/^  ([A-Za-z0-9]+):\s*$/gm)].map((match) => match[1]);
+  return parameterNames.map((name) =>
+    name in parameterValues
+      ? `ParameterKey=${name},ParameterValue=${parameterValues[name]}`
+      : `ParameterKey=${name},UsePreviousValue=true`,
+  );
+}
+
+export function applyChangeSet({ stackName, region, templateFile, parameterValues, adoptions }) {
+  const changeSetType = adoptions ? "IMPORT" : "UPDATE";
+  const changeSetName = `papyrus-infra-${Date.now()}`;
+  const createArguments = [
+    "cloudformation", "create-change-set",
+    "--stack-name", stackName,
+    "--change-set-name", changeSetName,
+    "--change-set-type", changeSetType,
+    "--template-body", `file://${path.resolve(templateFile)}`,
+    "--capabilities", "CAPABILITY_IAM",
+    "--region", region,
+    "--parameters", ...templateParameterFlags(parameterValues, templateFile),
+  ];
+  if (adoptions) createArguments.push("--resources-to-import", JSON.stringify(adoptions));
+  runAws(createArguments);
+  const waiting = runAws(["cloudformation", "wait", "change-set-create-complete", "--stack-name", stackName, "--change-set-name", changeSetName, "--region", region], { allowFailure: true });
+  const description = runAwsJson(["cloudformation", "describe-change-set", "--stack-name", stackName, "--change-set-name", changeSetName, "--region", region]);
+  if (waiting.status !== 0) {
+    const reason = description.StatusReason ?? "";
+    runAws(["cloudformation", "delete-change-set", "--stack-name", stackName, "--change-set-name", changeSetName, "--region", region], { allowFailure: true });
+    if (NO_CHANGES_REASONS.some((phrase) => reason.includes(phrase))) {
+      console.log(`papyrus-infra deploy-edge: ${changeSetType} for ${stackName} has no changes`);
+      return false;
+    }
+    throw new Error(`change set ${changeSetName} failed: ${reason}`);
+  }
+  console.log(`papyrus-infra deploy-edge: ${changeSetType} ${changeSetName}: ${(description.Changes ?? []).map((change) => `${change.ResourceChange.Action} ${change.ResourceChange.LogicalResourceId}`).join(", ")}`);
+  runAws(["cloudformation", "execute-change-set", "--stack-name", stackName, "--change-set-name", changeSetName, "--region", region]);
+  const waiter = adoptions ? "stack-import-complete" : "stack-update-complete";
+  runAws(["cloudformation", "wait", waiter, "--stack-name", stackName, "--region", region]);
+  return true;
+}
+
+function sleepSeconds(seconds) {
+  spawnSync("sleep", [String(seconds)]);
+}
+
+export function deleteOrphanedFunction({ functionName }) {
+  const description = runAws(["cloudfront", "describe-function", "--name", functionName, "--output", "json"], { allowFailure: true });
+  if (description.status !== 0) {
+    console.log(`papyrus-infra deploy-edge: function ${functionName} is already gone`);
+    return;
+  }
+  const entityTag = JSON.parse(description.stdout).ETag;
+  for (let attempt = 1; attempt <= FUNCTION_DELETE_ATTEMPTS; attempt += 1) {
+    const deletion = runAws(["cloudfront", "delete-function", "--name", functionName, "--if-match", entityTag], { allowFailure: true });
+    if (deletion.status === 0) {
+      console.log(`papyrus-infra deploy-edge: deleted function ${functionName}`);
+      return;
+    }
+    if (attempt < FUNCTION_DELETE_ATTEMPTS) sleepSeconds(FUNCTION_STILL_ATTACHED_PAUSE_SECONDS);
+    else console.warn(`papyrus-infra deploy-edge: could not delete ${functionName} yet, the next build retries: ${deletion.stderr}`);
+  }
+}
+
+export function deployEdgeStack(options) {
+  const { stackName, region, templateFile, parameterValues, adoptionTemplateFile, adoptionResources, orphanedFunctionName } = options;
+  const logicalIdsPresent = logicalIdsInStack(stackName, region);
+  const pendingAdoptions = (adoptionResources ?? []).filter((resource) => !logicalIdsPresent.has(resource.LogicalResourceId));
+  if (pendingAdoptions.length > 0) {
+    if (!adoptionTemplateFile) throw new Error("resources need adopting but no --adoption-template was given");
+    applyChangeSet({ stackName, region, templateFile: adoptionTemplateFile, parameterValues, adoptions: pendingAdoptions });
+  }
+  applyChangeSet({ stackName, region, templateFile, parameterValues, adoptions: undefined });
+  if (orphanedFunctionName) deleteOrphanedFunction({ functionName: orphanedFunctionName });
+}