@appliance.sh/api-server 1.13.0 → 1.15.0

package/package.json

@@ -1,73 +1,43 @@
 {
   "name": "@appliance.sh/api-server",
-  "version": "1.13.0",
+  "version": "1.15.0",
   "description": "",
   "author": "Eliot Lim",
   "repository": "https://github.com/appliance-sh/appliance.sh",
   "license": "MIT",
   "scripts": {
-    "build": "nest build",
+    "build": "tsc",
     "format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\"",
-    "start": "nest start",
-    "start:dev": "nest start --watch",
-    "start:debug": "nest start --debug --watch",
-    "start:prod": "node dist/main",
+    "start": "node dist/src/main.js",
+    "start:dev": "tsx watch src/main.ts",
+    "start:debug": "tsx watch --inspect src/main.ts",
+    "start:prod": "node dist/src/main.js",
     "lint": "eslint \"{src,apps,libs,test}/**/*.ts\" --fix",
-    "test": "jest",
-    "test:watch": "jest --watch",
-    "test:cov": "jest --coverage",
-    "test:debug": "node --inspect-brk -r tsconfig-paths/register -r ts-node/register node_modules/.bin/jest --runInBand",
-    "test:e2e": "jest --config ./test/jest-e2e.json"
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:cov": "vitest run --coverage",
+    "test:e2e": "vitest run --config vitest.e2e.config.ts"
   },
   "dependencies": {
-    "@nestjs/common": "^11.0.1",
-    "@nestjs/core": "^11.0.1",
-    "@nestjs/platform-express": "^11.0.1",
     "@pulumi/aws": "^7.15.0",
     "@pulumi/pulumi": "^3.213.0",
-    "reflect-metadata": "^0.2.2",
-    "rxjs": "^7.8.1"
+    "express": "^5.2.1"
   },
   "devDependencies": {
     "@eslint/eslintrc": "^3.2.0",
     "@eslint/js": "^9.18.0",
-    "@nestjs/cli": "^11.0.0",
-    "@nestjs/schematics": "^11.0.0",
-    "@nestjs/testing": "^11.0.1",
     "@types/express": "^5.0.0",
-    "@types/jest": "^30.0.0",
     "@types/node": "^22.10.7",
     "@types/supertest": "^6.0.2",
     "eslint": "^9.18.0",
     "eslint-config-prettier": "^10.0.1",
     "eslint-plugin-prettier": "^5.2.2",
     "globals": "^16.0.0",
-    "jest": "^30.0.0",
     "prettier": "^3.4.2",
-    "source-map-support": "^0.5.21",
     "supertest": "^7.0.0",
-    "ts-jest": "^29.2.5",
-    "ts-loader": "^9.5.2",
-    "ts-node": "^10.9.2",
-    "tsconfig-paths": "^4.2.0",
+    "tsx": "^4.19.2",
     "typescript": "^5.7.3",
-    "typescript-eslint": "^8.20.0"
-  },
-  "jest": {
-    "moduleFileExtensions": [
-      "js",
-      "json",
-      "ts"
-    ],
-    "rootDir": "src",
-    "testRegex": ".*\\.spec\\.ts$",
-    "transform": {
-      "^.+\\.(t|j)s$": "ts-jest"
-    },
-    "collectCoverageFrom": [
-      "**/*.(t|j)s"
-    ],
-    "coverageDirectory": "../coverage",
-    "testEnvironment": "node"
+    "typescript-eslint": "^8.20.0",
+    "vitest": "^3.0.4"
   }
 }

package/src/app.controller.spec.ts

@@ -1,22 +1,12 @@
-import { Test, TestingModule } from '@nestjs/testing';
-import { AppController } from './app.controller';
-import { AppService } from './app.service';
-
-describe('AppController', () => {
-  let appController: AppController;
-
-  beforeEach(async () => {
-    const app: TestingModule = await Test.createTestingModule({
-      controllers: [AppController],
-      providers: [AppService],
-    }).compile();
-
-    appController = app.get<AppController>(AppController);
-  });
-
-  describe('root', () => {
-    it('should return "Hello World!"', () => {
-      expect(appController.getHello()).toBe('Hello World!');
-    });
+import { describe, it, expect } from 'vitest';
+import request from 'supertest';
+import { createApp } from './main';
+
+describe('Index Route', () => {
+  it('should return "Hello World!"', async () => {
+    const app = createApp();
+    const response = await request(app).get('/');
+    expect(response.status).toBe(200);
+    expect(response.text).toBe('Hello World!');
   });
 });

package/src/main.ts

@@ -1,8 +1,26 @@
-import { NestFactory } from '@nestjs/core';
-import { AppModule } from './app.module';
+import express from 'express';
+import { indexRoutes } from './routes';
+import { infraRoutes } from './routes/infra';
+
+export function createApp() {
+  const app = express();
+
+  app.use(express.json());
+
+  // Set up routes
+  app.use('/', indexRoutes);
+  app.use('/infra', infraRoutes);
+
+  return app;
+}
 
 async function bootstrap() {
-  const app = await NestFactory.create(AppModule);
-  await app.listen(process.env.PORT ?? 3000);
+  const app = createApp();
+  const port = process.env.PORT ?? 3000;
+
+  app.listen(port, () => {
+    console.log(`Server is running on http://localhost:${port}`);
+  });
 }
+
 bootstrap();

package/src/routes/index.ts

@@ -0,0 +1,7 @@
+import { Router } from 'express';
+
+export const indexRoutes = Router();
+
+indexRoutes.get('/', (_req, res) => {
+  res.send('Hello World!');
+});

package/src/routes/infra/index.ts

@@ -0,0 +1,24 @@
+import { Router } from 'express';
+import { pulumiService } from '../../services/pulumi.service';
+
+export const infraRoutes = Router();
+
+infraRoutes.post('/deploy', async (_req, res) => {
+  try {
+    const result = await pulumiService.deploy();
+    res.json(result);
+  } catch (error) {
+    console.error('Deploy error:', error);
+    res.status(500).json({ error: 'Deploy failed', message: String(error) });
+  }
+});
+
+infraRoutes.post('/destroy', async (_req, res) => {
+  try {
+    const result = await pulumiService.destroy();
+    res.json(result);
+  } catch (error) {
+    console.error('Destroy error:', error);
+    res.status(500).json({ error: 'Destroy failed', message: String(error) });
+  }
+});

package/src/services/ApplianceStack.ts

@@ -0,0 +1,176 @@
+import * as pulumi from '@pulumi/pulumi';
+import * as aws from '@pulumi/aws';
+import * as awsNative from '@pulumi/aws-native';
+import type { ApplianceBaseConfig } from '@appliance.sh/sdk';
+
+export interface ApplianceStackArgs {
+  tags?: Record<string, string>;
+  config: ApplianceBaseConfig;
+}
+
+export interface ApplianceStackOpts extends pulumi.ComponentResourceOptions {
+  globalProvider: aws.Provider;
+  provider: aws.Provider;
+  nativeProvider: awsNative.Provider;
+  nativeGlobalProvider: awsNative.Provider;
+}
+
+export class ApplianceStack extends pulumi.ComponentResource {
+  lambdaRole: aws.iam.Role;
+  lambdaRolePolicy: aws.iam.Policy;
+  lambda: aws.lambda.Function;
+  lambdaUrl: aws.lambda.FunctionUrl;
+  dnsRecord: pulumi.Output<string>;
+
+  constructor(name: string, args: ApplianceStackArgs, opts: ApplianceStackOpts) {
+    super('appliance:aws:ApplianceStack', name, args, opts);
+
+    const defaultOpts = { parent: this, provider: opts.provider };
+    const defaultNativeOpts = { parent: this, provider: opts.nativeProvider };
+    const defaultTags = { stack: name, managed: 'appliance', ...args.tags };
+
+    this.lambdaRole = new aws.iam.Role(`${name}-role`, {
+      path: `/appliance/${name}/`,
+      assumeRolePolicy: aws.iam.assumeRolePolicyForPrincipal({ Service: 'lambda.amazonaws.com' }),
+      tags: defaultTags,
+    });
+
+    this.lambdaRolePolicy = new aws.iam.Policy(`${name}-policy`, {
+      path: `/appliance/${name}/`,
+      policy: {
+        Version: '2012-10-17',
+        Statement: [{ Effect: 'Allow', Action: 'logs:CreateLogGroup', Resource: '*' }],
+      },
+    });
+
+    new aws.iam.RolePolicyAttachment(`${name}-role-policy-attachment`, {
+      role: this.lambdaRole.name,
+      policyArn: this.lambdaRolePolicy.arn,
+    });
+
+    this.lambda = new aws.lambda.CallbackFunction(
+      `${name}-handler`,
+      {
+        runtime: 'nodejs22.x',
+        callback: async () => {
+          return { statusCode: 200, body: JSON.stringify({ message: 'Hello world!' }) };
+        },
+        tags: defaultTags,
+      },
+      defaultOpts
+    );
+
+    // lambda url
+    this.lambdaUrl = new aws.lambda.FunctionUrl(
+      `${name}-url`,
+      {
+        functionName: this.lambda.name,
+        authorizationType: args.config.aws.cloudfrontDistributionId ? 'AWS_IAM' : 'NONE',
+      },
+      defaultOpts
+    );
+
+    this.dnsRecord = pulumi.interpolate`${name}.${args.config.domainName ?? ''}`;
+
+    if (args.config.aws.cloudfrontDistributionId) {
+      new aws.lambda.Permission(
+        `${name}-url-invoke-url-permission`,
+        {
+          function: this.lambda.name,
+          action: 'lambda:InvokeFunctionUrl',
+          principal: 'cloudfront.amazonaws.com',
+          functionUrlAuthType: 'AWS_IAM',
+          sourceArn: pulumi.interpolate`arn:aws:cloudfront::${
+            aws.getCallerIdentityOutput({}, { provider: opts.provider }).accountId
+          }:distribution/${args.config.aws.cloudfrontDistributionId}`,
+          statementId: 'FunctionURLAllowCloudFrontAccess',
+        },
+        defaultOpts
+      );
+
+      // Grant the edge router role permission to invoke the Lambda Function URL
+      // The edge router role is the execution role of the Lambda@Edge function that signs requests
+      if (args.config.aws.edgeRouterRoleArn) {
+        new aws.lambda.Permission(
+          `${name}-invoke-url-edge-router-permission`,
+          {
+            function: this.lambda.name,
+            action: 'lambda:InvokeFunctionUrl',
+            principal: args.config.aws.edgeRouterRoleArn,
+            functionUrlAuthType: 'AWS_IAM',
+            statementId: 'FunctionURLAllowEdgeRouterRoleAccess',
+          },
+          defaultOpts
+        );
+
+        new awsNative.lambda.Permission(
+          `${name}-invoke-edge-router-permission`,
+          {
+            action: 'lambda:InvokeFunction',
+            principal: args.config.aws.edgeRouterRoleArn,
+            functionName: this.lambda.name,
+            invokedViaFunctionUrl: true,
+          },
+          defaultNativeOpts
+        );
+      }
+    } else {
+      new aws.lambda.Permission(
+        `${name}-url-invoke-url-permission`,
+        {
+          function: this.lambda.name,
+          action: 'lambda:InvokeFunctionUrl',
+          principal: '*',
+          functionUrlAuthType: 'NONE',
+          statementId: 'FunctionURLAllowPublicAccess',
+        },
+        defaultOpts
+      );
+    }
+
+    if (args.config.aws.cloudfrontDistributionId && args.config.aws.cloudfrontDistributionDomainName) {
+      new awsNative.lambda.Permission(
+        `${name}-url-invoke-lambda-native-permission`,
+        {
+          action: 'lambda:InvokeFunction',
+          principal: 'cloudfront.amazonaws.com',
+          sourceArn: pulumi.interpolate`arn:aws:cloudfront::${
+            aws.getCallerIdentityOutput({}, { provider: opts.provider }).accountId
+          }:distribution/${args.config.aws.cloudfrontDistributionId}`,
+          functionName: this.lambda.name,
+          invokedViaFunctionUrl: true,
+        },
+        defaultNativeOpts
+      );
+
+      new aws.route53.Record(
+        `${name}-cname-record`,
+        {
+          zoneId: args.config.aws.zoneId,
+          name: pulumi.interpolate`${name}.${args.config.domainName ?? ''}`,
+          type: 'CNAME',
+          ttl: 60,
+          records: [args.config.aws.cloudfrontDistributionDomainName],
+        },
+        { parent: this, provider: opts.globalProvider }
+      );
+
+      new aws.route53.Record(
+        `${name}-txt-record`,
+        {
+          zoneId: args.config.aws.zoneId,
+          name: pulumi.interpolate`origin.${name}.${args.config.domainName ?? ''}`,
+          type: 'TXT',
+          ttl: 60,
+          records: [this.lambdaUrl.functionUrl],
+        },
+        { parent: this, provider: opts.globalProvider }
+      );
+    }
+
+    this.registerOutputs({
+      lambda: this.lambda,
+      lambdaUrl: this.lambdaUrl,
+    });
+  }
+}

package/src/{pulumi → services}/pulumi.service.ts

@@ -1,6 +1,6 @@
-import { Injectable, Logger } from '@nestjs/common';
 import * as auto from '@pulumi/pulumi/automation';
 import * as aws from '@pulumi/aws';
+import * as awsNative from '@pulumi/aws-native';
 import { ApplianceStack } from './ApplianceStack';
 import { applianceBaseConfig } from '@appliance.sh/sdk';
 
@@ -14,34 +14,47 @@ export interface PulumiResult {
   stackName: string;
 }
 
-@Injectable()
-export class PulumiService {
-  private readonly logger = new Logger(PulumiService.name);
-  private readonly region = process.env.AWS_REGION || 'us-east-1';
+class PulumiService {
   private readonly projectName = 'appliance-api-managed-proj';
 
   private readonly baseConfig = process.env.APPLIANCE_BASE_CONFIG
     ? applianceBaseConfig.parse(JSON.parse(process.env.APPLIANCE_BASE_CONFIG))
     : undefined;
+  private readonly region = this.baseConfig?.aws.region || 'us-east-1';
 
   private inlineProgram() {
     return async () => {
       const name = 'appliance';
+
+      if (!this.baseConfig) {
+        throw new Error('Missing base config');
+      }
+
       const regionalProvider = new aws.Provider(`${name}-regional`, {
-        region: this.baseConfig?.region ?? 'ap-southeast-1',
+        region: (this.baseConfig?.aws.region as aws.Region) ?? 'ap-southeast-1',
       });
       const globalProvider = new aws.Provider(`${name}-global`, {
         region: 'us-east-1',
       });
+      const nativeRegionalProvider = new awsNative.Provider(`${name}-native-regional`, {
+        region: (this.baseConfig?.aws.region as awsNative.Region) ?? 'ap-southeast-1',
+      });
+
+      const nativeGlobalProvider = new awsNative.Provider(`${name}-native-global`, {
+        region: 'us-east-1',
+      });
 
       const applianceStack = new ApplianceStack(
         `${name}-stack`,
         {
           tags: { project: name },
+          config: this.baseConfig,
         },
         {
           globalProvider,
           provider: regionalProvider,
+          nativeProvider: nativeRegionalProvider,
+          nativeGlobalProvider: nativeGlobalProvider,
         }
       );
 
@@ -67,7 +80,7 @@ export class PulumiService {
       { projectName: this.projectName, stackName, program },
       { envVars }
     );
-    await stack.setConfig('aws:region', { value: this.region });
+    await stack.setConfig('aws:region', { value: this.baseConfig.aws.region });
     return stack;
   }
 
@@ -92,7 +105,7 @@ export class PulumiService {
 
   async deploy(stackName = 'appliance-api-managed'): Promise<PulumiResult> {
     const stack = await this.getOrCreateStack(stackName);
-    const result = await stack.up({ onOutput: (m) => this.logger.log(m) });
+    const result = await stack.up({ onOutput: (m) => console.log(m) });
     const changes = result.summary.resourceChanges || {};
     const totalChanges = Object.entries(changes)
       .filter(([k]) => k !== 'same')
@@ -110,7 +123,7 @@ export class PulumiService {
   async destroy(stackName = 'appliance-api-managed'): Promise<PulumiResult> {
     try {
       const stack = await this.selectExistingStack(stackName);
-      await stack.destroy({ onOutput: (m) => this.logger.log(m) });
+      await stack.destroy({ onOutput: (m) => console.log(m) });
       return { action: 'destroy', ok: true, idempotentNoop: false, message: 'Stack resources deleted', stackName };
     } catch (e) {
       if (!(e instanceof Error)) throw e;
@@ -128,3 +141,6 @@ export class PulumiService {
     }
   }
 }
+
+// Export a singleton instance
+export const pulumiService = new PulumiService();

package/test/app.e2e-spec.ts

@@ -1,22 +1,18 @@
-import { Test, TestingModule } from '@nestjs/testing';
-import { INestApplication } from '@nestjs/common';
+import { describe, it, expect, beforeAll } from 'vitest';
 import request from 'supertest';
-import { App } from 'supertest/types';
-import { AppModule } from '../src/app.module';
+import { createApp } from '../src/main';
+import type { Express } from 'express';
 
-describe('AppController (e2e)', () => {
-  let app: INestApplication<App>;
+describe('App (e2e)', () => {
+  let app: Express;
 
-  beforeEach(async () => {
-    const moduleFixture: TestingModule = await Test.createTestingModule({
-      imports: [AppModule],
-    }).compile();
-
-    app = moduleFixture.createNestApplication();
-    await app.init();
+  beforeAll(() => {
+    app = createApp();
   });
 
-  it('/ (GET)', () => {
-    return request(app.getHttpServer()).get('/').expect(200).expect('Hello World!');
+  it('/ (GET)', async () => {
+    const response = await request(app).get('/');
+    expect(response.status).toBe(200);
+    expect(response.text).toBe('Hello World!');
   });
 });

package/vitest.config.ts

@@ -0,0 +1,8 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    include: ['src/**/*.spec.ts'],
+    globals: false,
+  },
+});

package/vitest.e2e.config.ts

@@ -0,0 +1,8 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    include: ['test/**/*.e2e-spec.ts'],
+    globals: false,
+  },
+});

package/nest-cli.json

@@ -1,8 +0,0 @@
-{
-  "$schema": "https://json.schemastore.org/nest-cli",
-  "collection": "@nestjs/schematics",
-  "sourceRoot": "src",
-  "compilerOptions": {
-    "deleteOutDir": true
-  }
-}

package/src/app.controller.ts

@@ -1,12 +0,0 @@
-import { Controller, Get } from '@nestjs/common';
-import { AppService } from './app.service';
-
-@Controller()
-export class AppController {
-  constructor(private readonly appService: AppService) {}
-
-  @Get()
-  getHello(): string {
-    return this.appService.getHello();
-  }
-}

package/src/app.module.ts

@@ -1,11 +0,0 @@
-import { Module } from '@nestjs/common';
-import { AppController } from './app.controller';
-import { AppService } from './app.service';
-import { PulumiModule } from './pulumi/pulumi.module';
-
-@Module({
-  imports: [PulumiModule],
-  controllers: [AppController],
-  providers: [AppService],
-})
-export class AppModule {}

package/src/app.service.ts

@@ -1,8 +0,0 @@
-import { Injectable } from '@nestjs/common';
-
-@Injectable()
-export class AppService {
-  getHello(): string {
-    return 'Hello World!';
-  }
-}

package/src/pulumi/ApplianceStack.ts

@@ -1,86 +0,0 @@
-import * as pulumi from '@pulumi/pulumi';
-import * as aws from '@pulumi/aws';
-
-export interface ApplianceStackArgs {
-  tags?: Record<string, string>;
-}
-
-export interface ApplianceStackOpts extends pulumi.ComponentResourceOptions {
-  globalProvider: aws.Provider;
-  provider: aws.Provider;
-}
-
-export class ApplianceStack extends pulumi.ComponentResource {
-  lambdaRole: aws.iam.Role;
-  lambdaRolePolicy: aws.iam.Policy;
-  lambda: aws.lambda.Function;
-  lambdaUrl: aws.lambda.FunctionUrl;
-
-  constructor(name: string, args: ApplianceStackArgs, opts: ApplianceStackOpts) {
-    super('appliance:aws:ApplianceStack', name, args, opts);
-
-    const defaultOpts = { parent: this, provider: opts.provider };
-    const defaultTags = { stack: name, managed: 'appliance', ...args.tags };
-
-    this.lambdaRole = new aws.iam.Role(`${name}-role`, {
-      path: `/appliance/${name}/`,
-      assumeRolePolicy: aws.iam.assumeRolePolicyForPrincipal({ Service: 'lambda.amazonaws.com' }),
-      tags: defaultTags,
-    });
-
-    this.lambdaRolePolicy = new aws.iam.Policy(`${name}-policy`, {
-      path: `/appliance/${name}/`,
-      policy: {
-        Version: '2012-10-17',
-        Statement: [{ Effect: 'Allow', Action: 'logs:CreateLogGroup', Resource: '*' }],
-      },
-    });
-
-    new aws.iam.RolePolicyAttachment(`${name}-role-policy-attachment`, {
-      role: this.lambdaRole.name,
-      policyArn: this.lambdaRolePolicy.arn,
-    });
-
-    this.lambda = new aws.lambda.CallbackFunction(
-      `${name}-handler`,
-      {
-        runtime: 'nodejs22.x',
-        callback: async () => {
-          return { statusCode: 200, body: JSON.stringify({ message: 'Hello world!' }) };
-        },
-        tags: defaultTags,
-      },
-      defaultOpts
-    );
-
-    // lambda url
-    this.lambdaUrl = new aws.lambda.FunctionUrl(
-      `${name}-url`,
-      {
-        functionName: this.lambda.name,
-        authorizationType: 'NONE',
-      },
-      defaultOpts
-    );
-
-    new aws.lambda.Permission(`${name}-url-invoke-url-permission`, {
-      function: this.lambda.name,
-      action: 'lambda:InvokeFunctionUrl',
-      principal: '*',
-      functionUrlAuthType: 'NONE',
-      statementId: 'FunctionURLAllowPublicAccess',
-    });
-
-    new aws.lambda.Permission(`${name}-url-invoke-lambda-permission`, {
-      function: this.lambda.name,
-      action: 'lambda:InvokeFunction',
-      principal: '*',
-      statementId: 'FunctionURLAllowInvokeAction',
-    });
-
-    this.registerOutputs({
-      lambda: this.lambda,
-      lambdaUrl: this.lambdaUrl,
-    });
-  }
-}

package/src/pulumi/pulumi.controller.ts

@@ -1,19 +0,0 @@
-import { Controller, HttpCode, Post } from '@nestjs/common';
-import { PulumiService } from './pulumi.service';
-
-@Controller('infra')
-export class PulumiController {
-  constructor(private readonly pulumi: PulumiService) {}
-
-  @Post('deploy')
-  @HttpCode(200)
-  async deploy() {
-    return await this.pulumi.deploy();
-  }
-
-  @Post('destroy')
-  @HttpCode(200)
-  async destroy() {
-    return await this.pulumi.destroy();
-  }
-}

package/src/pulumi/pulumi.module.ts

@@ -1,9 +0,0 @@
-import { Module } from '@nestjs/common';
-import { PulumiService } from './pulumi.service';
-import { PulumiController } from './pulumi.controller';
-
-@Module({
-  providers: [PulumiService],
-  controllers: [PulumiController],
-})
-export class PulumiModule {}

package/test/jest-e2e.json

@@ -1,9 +0,0 @@
-{
-  "moduleFileExtensions": ["js", "json", "ts"],
-  "rootDir": ".",
-  "testEnvironment": "node",
-  "testRegex": ".e2e-spec.ts$",
-  "transform": {
-    "^.+\\.(t|j)s$": "ts-jest"
-  }
-}