@auth-craft/aws-cf-stack 1.8.0 → 1.9.0

package/bin/deploy.sh

@@ -54,6 +54,12 @@ Options (each also reads an env var; the flag wins):
   --edge-gate-secret <v>       env CF_EDGE_GATE_SECRET
   --cf-account-id <v>          env CLOUDFLARE_ACCOUNT_ID
   --cf-api-token <v>           env CLOUDFLARE_API_TOKEN
+  --log-retention-days <n>     CloudWatch log retention (env LAMBDA_LOG_RETENTION_DAYS).
+                               Default: 3 in dev, 30 otherwise. Use 'infinite' to never
+                               expire. Only CloudWatch's fixed set is valid
+                               (1,3,5,7,14,30,60,90,120,150,180,365,400,545,731,…).
+  --tracing <mode>             X-Ray tracing: active|disabled|pass_through
+                               (env LAMBDA_TRACING; default disabled in dev, active otherwise)
   --outputs-file <path>        (lambda) write CDK outputs JSON here for your own steps
   --env-file <path>            Optional: source a file first (flags/env still override)
   --skip-build                 No-op (artifacts are prebuilt in the package)
@@ -89,6 +95,8 @@ while [[ $# -gt 0 ]]; do
     --edge-gate-secret) FLAG[CF_EDGE_GATE_SECRET]="${2:?}"; shift 2 ;;
     --cf-account-id)    FLAG[CLOUDFLARE_ACCOUNT_ID]="${2:?}"; shift 2 ;;
     --cf-api-token)     FLAG[CLOUDFLARE_API_TOKEN]="${2:?}"; shift 2 ;;
+    --log-retention-days) FLAG[LAMBDA_LOG_RETENTION_DAYS]="${2:?}"; shift 2 ;;
+    --tracing)          FLAG[LAMBDA_TRACING]="${2:?}"; shift 2 ;;
     --outputs-file)     OUTPUTS_FILE="${2:?}"; export OUTPUTS_FILE; shift 2 ;;
     --env-file)         ENV_FILE="${2:?}"; shift 2 ;;
     --skip-build)       shift ;;

package/cdk/bin/app.ts

@@ -27,8 +27,7 @@ const env = {
 //   it carries no component so the iss claim stays stable across resources.
 //   Examples: snapshot-commerce-prod-auth-data, snapshot-commerce-prod-auth-api
 
-const appName =
-  process.env.AUTH_CRAFT_APP_NAME || (project === 'default' ? 'auth-craft' : `auth-craft-${project}`);
+const appName = process.env.AUTH_CRAFT_APP_NAME || (project === 'default' ? 'auth-craft' : `auth-craft-${project}`);
 
 // Base name shared by every resource (also AUTH_SYSTEM_NAME / JWT issuer).
 const resourceBase = `${appName}-${stage}-${layer}`;

package/cdk/lib/lambda-stack.ts

@@ -16,6 +16,78 @@ const __dirname = path.dirname(__filename);
 //   packages/aws-cf-stack/cdk/lib/lambda-stack.ts -> packages/aws-cf-stack/assets/lambda
 const LAMBDA_ASSET_DIR = path.resolve(__dirname, '../../assets/lambda');
 
+// CloudWatch Logs only accepts a fixed set of retention periods — an arbitrary day
+// count is rejected at deploy time. Map the supported values so a typo fails fast at
+// synth (with the valid list) instead of mid-deploy.
+const RETENTION_BY_DAYS: Record<number, logs.RetentionDays> = {
+  1: logs.RetentionDays.ONE_DAY,
+  3: logs.RetentionDays.THREE_DAYS,
+  5: logs.RetentionDays.FIVE_DAYS,
+  7: logs.RetentionDays.ONE_WEEK,
+  14: logs.RetentionDays.TWO_WEEKS,
+  30: logs.RetentionDays.ONE_MONTH,
+  60: logs.RetentionDays.TWO_MONTHS,
+  90: logs.RetentionDays.THREE_MONTHS,
+  120: logs.RetentionDays.FOUR_MONTHS,
+  150: logs.RetentionDays.FIVE_MONTHS,
+  180: logs.RetentionDays.SIX_MONTHS,
+  365: logs.RetentionDays.ONE_YEAR,
+  400: logs.RetentionDays.THIRTEEN_MONTHS,
+  545: logs.RetentionDays.EIGHTEEN_MONTHS,
+  731: logs.RetentionDays.TWO_YEARS,
+  1096: logs.RetentionDays.THREE_YEARS,
+  1827: logs.RetentionDays.FIVE_YEARS,
+  2192: logs.RetentionDays.SIX_YEARS,
+  2557: logs.RetentionDays.SEVEN_YEARS,
+  2922: logs.RetentionDays.EIGHT_YEARS,
+  3288: logs.RetentionDays.NINE_YEARS,
+  3653: logs.RetentionDays.TEN_YEARS,
+};
+
+/**
+ * Resolve the CloudWatch log retention from LAMBDA_LOG_RETENTION_DAYS.
+ * Accepts a supported day count (e.g. "3") or 'infinite' / 'never' to keep logs
+ * forever. Unset → stage default: 3 days in dev (cheap), 1 month otherwise.
+ */
+export function resolveLogRetention(raw: string | undefined, stage: string): logs.RetentionDays {
+  const value = raw?.trim().toLowerCase();
+
+  if (!value) {
+    return stage === 'dev' ? logs.RetentionDays.THREE_DAYS : logs.RetentionDays.ONE_MONTH;
+  }
+
+  if (value === 'infinite' || value === 'never' || value === '0') {
+    return logs.RetentionDays.INFINITE;
+  }
+
+  const days = Number(value);
+  const retention = Number.isInteger(days) ? RETENTION_BY_DAYS[days] : undefined;
+  if (retention === undefined) {
+    throw new Error(
+      `Unsupported LAMBDA_LOG_RETENTION_DAYS: '${raw}'. ` +
+        `CloudWatch Logs accepts only: ${Object.keys(RETENTION_BY_DAYS).join(', ')} (or 'infinite').`,
+    );
+  }
+  return retention;
+}
+
+/**
+ * Resolve X-Ray tracing from LAMBDA_TRACING ('active' | 'disabled').
+ * Unset → disabled in dev (traces are billed per request), active otherwise.
+ */
+export function resolveTracing(raw: string | undefined, stage: string): lambda.Tracing {
+  const value = raw?.trim().toLowerCase();
+
+  if (!value) {
+    return stage === 'dev' ? lambda.Tracing.DISABLED : lambda.Tracing.ACTIVE;
+  }
+  if (value === 'active' || value === 'true' || value === 'enabled') return lambda.Tracing.ACTIVE;
+  if (value === 'disabled' || value === 'false' || value === 'off') return lambda.Tracing.DISABLED;
+  if (value === 'pass_through' || value === 'passthrough') return lambda.Tracing.PASS_THROUGH;
+
+  throw new Error(`Unsupported LAMBDA_TRACING: '${raw}'. Use 'active', 'disabled', or 'pass_through'.`);
+}
+
 interface LambdaStackProps extends cdk.StackProps {
   table: dynamodb.ITable;
   functionName: string; // {app}-{env}-{layer}-api, e.g. "snapshot-commerce-prod-auth-api"
@@ -93,13 +165,24 @@ export class LambdaStack extends cdk.Stack {
     // Naming: functionName = {app}-{env}-{layer}-api (the deployed resource);
     // resourceName = {app}-{env}-{layer} base (AUTH_SYSTEM_NAME / JWT issuer).
 
-    // Log group for Lambda function (matches the function name)
+    // Log group for Lambda function (matches the function name).
+    // Retention drives CloudWatch Logs storage cost, so it is configurable:
+    // LAMBDA_LOG_RETENTION_DAYS accepts any retention CloudWatch supports, plus
+    // 'infinite' (never expire). Unset → a stage-aware default that keeps dev cheap
+    // (3 days) while staging/prod keep a useful history (1 month).
+    const retention = resolveLogRetention(process.env.LAMBDA_LOG_RETENTION_DAYS, stage);
+
     const logGroup = new logs.LogGroup(this, 'AuthLambdaLogGroup', {
       logGroupName: `/aws/lambda/${functionName}`,
-      retention: logs.RetentionDays.ONE_MONTH,
+      retention,
       removalPolicy: stage === 'prod' ? cdk.RemovalPolicy.RETAIN : cdk.RemovalPolicy.DESTROY,
     });
 
+    // X-Ray tracing is billed per trace and is rarely worth it in dev, so it is
+    // opt-out there: LAMBDA_TRACING = 'active' | 'disabled' (default: disabled in
+    // dev, active elsewhere).
+    const tracing = resolveTracing(process.env.LAMBDA_TRACING, stage);
+
     // Lambda function from the PREBUILT bundle shipped in this package.
     // Unlike the in-repo app stack (which uses NodejsFunction to build from
     // src/index.ts at synth time), this self-contained package deploys the
@@ -234,8 +317,8 @@ export class LambdaStack extends cdk.Stack {
         }),
       },
 
-      // Tracing
-      tracing: lambda.Tracing.ACTIVE, // Enable X-Ray tracing
+      // Tracing (X-Ray) — see resolveTracing above; off by default in dev.
+      tracing,
     });
 
     // Grant DynamoDB permissions
@@ -291,6 +374,20 @@ export class LambdaStack extends cdk.Stack {
       exportName: `${this.stackName}-ApiBasePath`,
     });
 
+    // Cost-relevant knobs, echoed so `auth-craft-stack outputs` can show what was
+    // actually deployed (rather than what the caller thinks they set).
+    new cdk.CfnOutput(this, 'LogRetentionDays', {
+      value: String(retention),
+      description: 'CloudWatch log retention in days (0 = never expire)',
+      exportName: `${this.stackName}-LogRetentionDays`,
+    });
+
+    new cdk.CfnOutput(this, 'TracingMode', {
+      value: tracing,
+      description: 'X-Ray tracing mode',
+      exportName: `${this.stackName}-TracingMode`,
+    });
+
     // Output auth system name — used as JWT issuer by Workers to verify tokens
     new cdk.CfnOutput(this, 'AuthSystemName', {
       value: resourceName,

package/lib/common.sh

@@ -259,6 +259,14 @@ print_outputs_json() {
   # in a Service Binding (`[[services]] service = "<worker name>"`) to front auth
   # same-origin via @auth-craft/pages-auth-proxy. The binding lives in the consumer's
   # Pages project, not here — `serviceBindings` is a ready-to-paste snippet.
+  # Cost knobs, read back from the deployed stack so `outputs` reports what is live
+  # rather than what the caller's env happens to say.
+  local logRetention tracingMode
+  logRetention="$(cfn_output "$api_stack" LogRetentionDays)"
+  tracingMode="$(cfn_output "$api_stack" TracingMode)"
+  [[ -n "$logRetention" && "$logRetention" != "None" ]] || logRetention=""
+  [[ -n "$tracingMode" && "$tracingMode" != "None" ]] || tracingMode=""
+
   local mode wnSystem wnTenant wnCustomer bindingService
   mode="$(gateway_mode)"
   if [[ "$mode" == "shared" ]]; then
@@ -288,11 +296,13 @@ print_outputs_json() {
     --arg rpCustomer "${CF_WORKER_ROUTE_PREFIX_CUSTOMER:-/customer}" \
     --arg wnSystem "$wnSystem" --arg wnTenant "$wnTenant" --arg wnCustomer "$wnCustomer" \
     --arg bindingSnippet "$bindingSnippet" \
+    --arg logRetention "$logRetention" --arg tracingMode "$tracingMode" \
     '{stage:$stage, project:$project, region:$region,
       lambdaFunctionUrl:$url, apiBasePath:$base, authSystemName:$name,
       dynamodbTable:$table, backendUrl:$backend,
       jwtPublicKey:$jwtPub, jwtIssuer:$jwtIssuer, jwtAlgorithm:$jwtAlg,
       serviceJwtPublicKey:$svcPub,
+      observability:{logRetentionDays:$logRetention, tracingMode:$tracingMode},
       gatewayUrls:{system:$gwSystem, tenant:$gwTenant, customer:$gwCustomer},
       workerNames:{system:$wnSystem, tenant:$wnTenant, customer:$wnCustomer},
       routePrefixes:{system:$rpSystem, tenant:$rpTenant, customer:$rpCustomer},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@auth-craft/aws-cf-stack",
-  "version": "1.8.0",
+  "version": "1.9.0",
   "description": "Self-contained, versioned distribution of the Auth Craft AWS (DynamoDB + Lambda) + Cloudflare gateway stack. Bundles prebuilt Lambda/worker artifacts + CDK app so consumers deploy without cloning auth-craft.",
   "type": "module",
   "bin": {
@@ -10,19 +10,23 @@
     "bin",
     "lib",
     "cdk",
+    "!cdk/cdk.out",
     "assets",
     "wrangler",
     "README.md",
     ".env.example"
   ],
   "dependencies": {
-    "aws-cdk-lib": "^2.260.0",
-    "constructs": "^10.6.0"
+    "aws-cdk-lib": "^2.265.0",
+    "constructs": "^10.8.1"
   },
   "devDependencies": {
-    "@types/node": "^25.9.3",
-    "tsx": "^4.22.4",
-    "typescript": "^6.0.3"
+    "@types/node": "^26.2.0",
+    "tsx": "^4.23.12",
+    "typescript": "^7.0.2",
+    "@auth-craft/auth-admin-cli": "2.0.0",
+    "@auth-craft/auth-hono-dynamodb-lambda": "1.0.0",
+    "@auth-craft/cloudflare-auth-gateway": "1.0.0"
   },
   "peerDependencies": {
     "aws-cdk": "^2.1128.0",