@auth-craft/aws-cf-stack 1.7.0 → 1.8.0

package/lib/common.sh

@@ -76,11 +76,18 @@ load_env_file() {
 }
 
 # ── Stage / naming derivation (mirrors the CI workflow + CDK app.ts) ──────────
-# Inputs: STAGE, PROJECT, optional AUTH_CRAFT_APP_NAME.
-# Exports STAGE (normalized), PROJECT, APP_NAME, RESOURCE_NAME, RUNTIME_NODE_ENV.
+# Inputs: STAGE, PROJECT, LAYER, optional AUTH_CRAFT_APP_NAME.
+# Exports STAGE (normalized), PROJECT, APP_NAME, LAYER, RESOURCE_NAME, RUNTIME_NODE_ENV.
+#
+# Naming pattern: {app}-{env}-{layer}, with a per-resource {component} appended
+#   (data/api/system/…). So table = {app}-{env}-{layer}-data, lambda = …-api, etc.
+#   RESOURCE_NAME is the {app}-{env}-{layer} base (also the AUTH_SYSTEM_NAME / JWT
+#   issuer). LAYER (default "auth") namespaces this deploy within a larger app that
+#   has other layers (e.g. billing); a consumer sets --layer/LAYER to reuse the CLI.
 derive_naming() {
   STAGE="${STAGE:-dev}"
   PROJECT="${PROJECT:-default}"
+  LAYER="${LAYER:-auth}"
 
   # #2 Normalize common stage aliases so a consumer can pass either form.
   #   production -> prod, development -> dev, staging stays staging.
@@ -103,9 +110,12 @@ derive_naming() {
     APP_NAME="auth-craft-${PROJECT}"
   fi
 
-  RESOURCE_NAME="${APP_NAME}-${STAGE}"
+  # Base name shared by every resource: {app}-{env}-{layer}. Per-resource component
+  # (data/api/system/…) is appended at each call site. Also the AUTH_SYSTEM_NAME /
+  # JWT issuer, so it must NOT carry a component (keeps the iss claim stable).
+  RESOURCE_NAME="${APP_NAME}-${STAGE}-${LAYER}"
   RUNTIME_NODE_ENV="$([[ "$STAGE" == "prod" ]] && echo production || echo development)"
-  export STAGE PROJECT APP_NAME RESOURCE_NAME RUNTIME_NODE_ENV
+  export STAGE PROJECT APP_NAME LAYER RESOURCE_NAME RUNTIME_NODE_ENV
 }
 
 # ── Gateway JWT key pair (#5: one source, derive the rest) ────────────────────
@@ -188,16 +198,16 @@ gateway_mode() {
 }
 
 # Derive a gateway worker URL for a scope (custom domain > workers.dev > empty).
-# In shared mode all scopes resolve to the single worker ${APP_NAME}-${STAGE}.
+# In shared mode all scopes resolve to the single worker ${RESOURCE_NAME}.
 gateway_url_for() {
   local scope="$1" upper dom_var custom worker_name
   upper="$(echo "$scope" | tr '[:lower:]' '[:upper:]')"
   dom_var="CF_WORKER_CUSTOM_DOMAIN_${upper}"
   custom="${!dom_var:-}"
   if [[ "$(gateway_mode)" == "shared" ]]; then
-    worker_name="${APP_NAME}-${STAGE}"
+    worker_name="${RESOURCE_NAME}"
   else
-    worker_name="${APP_NAME}-${STAGE}-${scope}"
+    worker_name="${RESOURCE_NAME}-${scope}"
   fi
   if [[ -n "$custom" ]]; then
     echo "https://$custom"
@@ -221,7 +231,7 @@ gateway_url_for() {
 print_outputs_json() {
   require_cmd aws; require_cmd jq
   require_aws_identity
-  local api_stack="${APP_NAME}-${STAGE}-api"
+  local api_stack="${RESOURCE_NAME}-api"
   local url base name table fn backend issuer
   url="$(cfn_output "$api_stack" LambdaFunctionUrl)"
   base="$(cfn_output "$api_stack" ApiBasePath)"
@@ -244,20 +254,20 @@ print_outputs_json() {
   svcPub="$(lambda_env "$fn" INTERNAL_JWT_PUBLIC_KEY)";   svcPub="${svcPub:-${LAMBDA_INTERNAL_JWT_PUBLIC_KEY:-}}"
 
   # Worker names per scope. In multi mode (default) each scope is its own worker
-  # (${APP_NAME}-${STAGE}-${scope}); in shared mode all scopes are the single worker
-  # ${APP_NAME}-${STAGE}. These are what a consumer's Cloudflare Pages project references
+  # (${RESOURCE_NAME}-${scope}); in shared mode all scopes are the single worker
+  # ${RESOURCE_NAME}. These are what a consumer's Cloudflare Pages project references
   # in a Service Binding (`[[services]] service = "<worker name>"`) to front auth
   # same-origin via @auth-craft/pages-auth-proxy. The binding lives in the consumer's
   # Pages project, not here — `serviceBindings` is a ready-to-paste snippet.
   local mode wnSystem wnTenant wnCustomer bindingService
   mode="$(gateway_mode)"
   if [[ "$mode" == "shared" ]]; then
-    wnSystem="${APP_NAME}-${STAGE}"; wnTenant="$wnSystem"; wnCustomer="$wnSystem"
+    wnSystem="${RESOURCE_NAME}"; wnTenant="$wnSystem"; wnCustomer="$wnSystem"
     bindingService="$wnSystem"
   else
-    wnSystem="${APP_NAME}-${STAGE}-system"
-    wnTenant="${APP_NAME}-${STAGE}-tenant"
-    wnCustomer="${APP_NAME}-${STAGE}-customer"
+    wnSystem="${RESOURCE_NAME}-system"
+    wnTenant="${RESOURCE_NAME}-tenant"
+    wnCustomer="${RESOURCE_NAME}-customer"
     bindingService="$wnCustomer"
   fi
   local bindingSnippet

package/lib/deploy-gateway.sh

@@ -295,7 +295,7 @@ deploy_gateway() {
     # ── Shared worker: one worker serves all scopes; scope comes from the path's first
     # segment (worker AUTH_SCOPE unset). CORS unions all scopes; KV uses the customer id.
     local worker_name custom_domain allowed_origins origin_suffixes cors_kv_id
-    worker_name="${APP_NAME}-${STAGE}"
+    worker_name="${RESOURCE_NAME}"
     custom_domain="$(custom_domain_for shared)"
     allowed_origins="$(merge_cors_for_shared allowed_origins_for)"
     origin_suffixes="$(merge_cors_for_shared origin_suffixes_for)"
@@ -324,7 +324,7 @@ deploy_gateway() {
   local scope worker_name route_prefix custom_domain
   local allowed_origins origin_suffixes cors_kv_id
   for scope in system tenant customer; do
-    worker_name="${APP_NAME}-${STAGE}-${scope}"
+    worker_name="${RESOURCE_NAME}-${scope}"
     route_prefix="$(route_prefix_for "$scope")"
     custom_domain="$(custom_domain_for "$scope")"
     allowed_origins="$(allowed_origins_for "$scope")"

package/lib/deploy-lambda.sh

@@ -21,11 +21,11 @@ deploy_lambda() {
   [[ -f "$LAMBDA_ASSET_DIR/index.mjs" ]] \
     || die "Prebuilt Lambda bundle missing: $LAMBDA_ASSET_DIR/index.mjs (was the package built?)"
 
-  local api_stack="${APP_NAME}-${STAGE}-api"
+  local api_stack="${RESOURCE_NAME}-api"
   OUTPUTS_FILE="${OUTPUTS_FILE:-$(mktemp -t auth-craft-cdk-outputs.XXXXXX.json)}"
   export OUTPUTS_FILE
 
-  info "Deploying CDK stacks (${APP_NAME}-${STAGE}-data, ${api_stack})…"
+  info "Deploying CDK stacks (${RESOURCE_NAME}-data, ${api_stack})…"
   (
     cd "$CDK_DIR"
     CDK_DEFAULT_ACCOUNT="$AWS_ACCOUNT_ID" \

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@auth-craft/aws-cf-stack",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "Self-contained, versioned distribution of the Auth Craft AWS (DynamoDB + Lambda) + Cloudflare gateway stack. Bundles prebuilt Lambda/worker artifacts + CDK app so consumers deploy without cloning auth-craft.",
   "type": "module",
   "bin": {