@aws-blocks/core 0.1.12 → 0.1.17

package/src/errors.test.ts

@@ -3,7 +3,35 @@
 
 import { describe, it } from 'node:test';
 import assert from 'node:assert';
-import { ApiError, isBlocksError, hasAuthError } from './errors.js';
+import { ApiError, DEFAULT_API_ERROR_NAME, isBlocksError, hasAuthError } from './errors.js';
+
+describe('ApiError constructor', () => {
+  it('exposes message and status, and stays a real Error', () => {
+    const e = new ApiError('Not found', 404);
+    assert.ok(e instanceof Error);
+    assert.strictEqual(e.message, 'Not found');
+    assert.strictEqual(e.status, 404);
+  });
+
+  it('defaults name to ApiError and retriable to false', () => {
+    const e = new ApiError('boom', 500);
+    assert.strictEqual(e.name, DEFAULT_API_ERROR_NAME);
+    assert.strictEqual(e.retriable, false);
+  });
+
+  it('takes name, cause and retriable from the options argument', () => {
+    const cause = new Error('root');
+    const e = new ApiError('Username already taken', 409, {
+      name: 'ConditionalCheckFailedException',
+      cause,
+      retriable: true,
+    });
+    assert.strictEqual(e.name, 'ConditionalCheckFailedException');
+    assert.strictEqual(e.status, 409);
+    assert.strictEqual(e.retriable, true);
+    assert.strictEqual(e.cause, cause);
+  });
+});
 
 describe('isBlocksError', () => {
   it('matches a thrown ApiError by name', () => {

package/src/hosting.test.ts

@@ -1507,4 +1507,111 @@ describe('Hosting', () => {
       );
     });
   });
+
+  describe('config.json stale-placeholder guard (#173)', () => {
+    // Helper: pull every BucketDeployment custom resource's Properties.
+    const bucketDeployments = (stack: Stack) => {
+      const crs = Template.fromStack(stack).findResources(
+        'Custom::CDKBucketDeployment',
+      );
+      return Object.values(crs).map(
+        (cr) => (cr as { Properties: Record<string, unknown> }).Properties,
+      );
+    };
+
+    it('uploads the placeholder config.json with a no-cache directive, never the 1-year mutable cache-control', () => {
+      // The build-time placeholder (`{_placeholder:true}`) is written into the
+      // static dir. If it inherits the mutable asset tier's
+      // `s-maxage=31536000` and an edge caches it during the deploy window, the
+      // edge serves the placeholder for up to a year — breaking every client
+      // API call. It must instead be uploaded as a no-cache path so the edge
+      // never caches it long-term.
+      createSpaBuildOutput(tmpDir);
+      const app = new App();
+      const stack = new Stack(app, 'PlaceholderCacheStack');
+      new Hosting(stack, 'Hosting', { root: tmpDir, api: MOCK_API });
+
+      const deployments = bucketDeployments(stack);
+      const cc = (p: Record<string, unknown>) =>
+        (p.SystemMetadata as Record<string, string> | undefined)?.['cache-control'];
+      const includes = (p: Record<string, unknown>) =>
+        (p.Include as string[] | undefined) ?? [];
+      const excludes = (p: Record<string, unknown>) =>
+        (p.Exclude as string[] | undefined) ?? [];
+
+      // A deployment must upload `.blocks-sandbox/config.json` with the
+      // no-cache directive (this is the placeholder upload).
+      const noCacheDeploy = deployments.find(
+        (p) =>
+          includes(p).includes('.blocks-sandbox/config.json') &&
+          cc(p) === 'no-cache, no-store, must-revalidate',
+      );
+      assert.ok(
+        noCacheDeploy,
+        'placeholder .blocks-sandbox/config.json must be uploaded with ' +
+          '"no-cache, no-store, must-revalidate"',
+      );
+
+      // No deployment may cover the placeholder with the 1-year mutable
+      // cache-control: the mutable/other tier must EXCLUDE it.
+      const leaks = deployments.filter((p) => {
+        const directive = cc(p);
+        return (
+          typeof directive === 'string' &&
+          directive.includes('s-maxage=31536000') &&
+          !excludes(p).includes('.blocks-sandbox/config.json')
+        );
+      });
+      assert.strictEqual(
+        leaks.length,
+        0,
+        'no mutable-tier deployment may apply s-maxage=31536000 to ' +
+          '.blocks-sandbox/config.json',
+      );
+    });
+
+    it('registers the placeholder as a no-cache path even for a static-only site (no api)', () => {
+      // The placeholder is always written (step 5), so its no-cache
+      // registration must not depend on `props.api`. This guards against a
+      // regression that moves the registration inside an `if (props.api)`
+      // block, which would reopen the stale-placeholder window for
+      // static-only sites.
+      createSpaBuildOutput(tmpDir);
+      const app = new App();
+      const stack = new Stack(app, 'StaticOnlyPlaceholderStack');
+      new Hosting(stack, 'Hosting', { root: tmpDir });
+
+      Template.fromStack(stack).hasResourceProperties(
+        'Custom::CDKBucketDeployment',
+        Match.objectLike({
+          Include: Match.arrayWith(['.blocks-sandbox/config.json']),
+          SystemMetadata: Match.objectLike({
+            'cache-control': 'no-cache, no-store, must-revalidate',
+          }),
+        }),
+      );
+    });
+
+    it('invalidates the post-rewrite cache key (/builds/<id>/.blocks-sandbox/*)', () => {
+      // The viewer-request skew-protection function rewrites the URI to
+      // `/builds/<buildId>/.blocks-sandbox/config.json` BEFORE the cache
+      // lookup, so the real edge cache key lives under `/builds/<id>/`.
+      // Invalidating only `/.blocks-sandbox/*` never matches it.
+      createSpaBuildOutput(tmpDir);
+      const app = new App();
+      const stack = new Stack(app, 'InvalidationPathStack');
+      new Hosting(stack, 'Hosting', { root: tmpDir, api: MOCK_API });
+
+      // Assert via Template + Match so a CDK property rename fails loudly here
+      // rather than silently skipping a structural-heuristic lookup.
+      Template.fromStack(stack).hasResourceProperties(
+        'Custom::CDKBucketDeployment',
+        Match.objectLike({
+          DistributionPaths: Match.arrayWith([
+            Match.stringLikeRegexp('^/builds/.+/\\.blocks-sandbox/\\*$'),
+          ]),
+        }),
+      );
+    });
+  });
 });

package/src/hosting.ts

@@ -35,6 +35,7 @@ import type {
   FrameworkType,
 } from '@aws-blocks/hosting';
 import { BLOCKS_RPC_PREFIX, BLOCKS_AUTH_PREFIX } from './constants.js';
+import { BLOCKS_SANDBOX_DIR } from './common/constants.js';
 import { registerConfig } from './cdk/config-registry.js';
 import { getRegisteredRoutes } from './raw-route.js';
 
@@ -341,6 +342,7 @@ export interface HostingProps {
 
 const DEFAULT_BUILD_DIRS: Record<string, string> = {
   nextjs: '.next',
+  sveltekit: 'build',
   spa: 'dist',
   static: 'dist',
 };
@@ -509,6 +511,19 @@ export class Hosting extends Construct {
       JSON.stringify({ _placeholder: true }),
     );
 
+    // ── 5a. Mark config.json as a no-cache path ─────────────────────
+    //    config.json is a fixed-name, mutable runtime-config file: it must
+    //    NOT inherit the content-hashed mutable-asset cache-control
+    //    (`s-maxage=31536000`) applied to `/assets/<hash>.js`. Registering it
+    //    as a no-cache path uploads the build-time placeholder with
+    //    `no-cache, no-store, must-revalidate` so an edge never caches it
+    //    long-term; the real config is deployed in step 8 with `max-age=60`.
+    const configNoCachePath = `${BLOCKS_SANDBOX_DIR}/config.json`;
+    const existingNoCachePaths = manifest.staticAssets.noCachePaths ?? [];
+    manifest.staticAssets.noCachePaths = existingNoCachePaths.includes(configNoCachePath)
+      ? existingNoCachePaths
+      : [...existingNoCachePaths, configNoCachePath];
+
     // ── 5b. Inject static route for .blocks-sandbox config ──────────
     //    Insert a static route for /.blocks-sandbox/* so CloudFront
     //    serves config.json from S3 instead of routing to compute.
@@ -606,7 +621,18 @@ export class Hosting extends Construct {
         destinationKeyPrefix: `builds/${buildId}/.blocks-sandbox`,
         prune: false,
         distribution: hosting.distribution,
-        distributionPaths: ['/.blocks-sandbox/*'],
+        // The skew-protection viewer-request CloudFront function rewrites the
+        // URI to `/builds/<buildId>/.blocks-sandbox/config.json` BEFORE the
+        // cache lookup, so the real edge cache key lives under `/builds/<id>/`.
+        // Invalidating only `/.blocks-sandbox/*` never matches that key and is
+        // a no-op for config.json. Invalidate the post-rewrite key too. (The
+        // primary guard against staleness is step 5a's no-cache placeholder;
+        // this is defense-in-depth so a post-deploy invalidation actually
+        // clears any edge entry at its real key.)
+        distributionPaths: [
+          `/builds/${buildId}/.blocks-sandbox/*`,
+          '/.blocks-sandbox/*',
+        ],
         cacheControl: [s3deploy.CacheControl.fromString('public, max-age=60, must-revalidate')],
       });
 

package/src/lambda-handler.test.ts

@@ -3,7 +3,7 @@
 
 import { describe, it, beforeEach } from 'node:test';
 import assert from 'node:assert';
-import { createLambdaHandler, requestCookies, isApiGatewayHttpEvent, computeHttpDeadlineMs, classifyEvent, buildEventUrl, isLoopbackForwardedHost } from './lambda-handler.js';
+import { createLambdaHandler, _resetCorsPatterns, requestCookies, isApiGatewayHttpEvent, computeHttpDeadlineMs, classifyEvent, buildEventUrl, isLoopbackForwardedHost } from './lambda-handler.js';
 import type { LambdaContext } from './lambda-handler.js';
 import { registerRoute, clearRouteRegistry } from './raw-route.js';
 import { decodeRpcResponse } from './rpc.js';
@@ -607,7 +607,7 @@ describe('createLambdaHandler — timeout guard for API Gateway events', () => {
     assert.strictEqual(body.error.code, 504);
   });
 
-  it('504 response includes CORS headers from event origin', async () => {
+  it('504 response includes CORS headers for an allowed origin', async () => {
     const backend = {
       api: () => ({
         async echo() {
@@ -617,6 +617,10 @@ describe('createLambdaHandler — timeout guard for API Gateway events', () => {
       }),
     };
 
+    process.env.CORS_ALLOWED_ORIGINS = 'https://myapp\\.example\\.com';
+    delete process.env.CORS_HOSTING_ORIGINS;
+    _resetCorsPatterns();
+
     const event = makeEvent({
       headers: {
         'Content-Type': 'application/json',
@@ -629,6 +633,71 @@ describe('createLambdaHandler — timeout guard for API Gateway events', () => {
     assert.strictEqual(result.statusCode, 504);
     assert.strictEqual(result.headers['Access-Control-Allow-Origin'], 'https://myapp.example.com');
     assert.strictEqual(result.headers['Access-Control-Allow-Credentials'], 'true');
+
+    delete process.env.CORS_ALLOWED_ORIGINS;
+    _resetCorsPatterns();
+  });
+
+  it('504 response omits CORS headers when no allowlist is configured', async () => {
+    const backend = {
+      api: () => ({
+        async echo() {
+          await new Promise(resolve => setTimeout(resolve, 5_000));
+          return {};
+        },
+      }),
+    };
+
+    delete process.env.CORS_ALLOWED_ORIGINS;
+    delete process.env.CORS_HOSTING_ORIGINS;
+    _resetCorsPatterns();
+
+    const event = makeEvent({
+      headers: {
+        'Content-Type': 'application/json',
+        origin: 'https://evil.example.com',
+      },
+    });
+    const ctx = makeLambdaContext(50);
+    const result = await invokeWithContext(backend, event, ctx);
+
+    assert.strictEqual(result.statusCode, 504);
+    assert.strictEqual(result.headers['Access-Control-Allow-Origin'], undefined);
+    assert.strictEqual(result.headers['Access-Control-Allow-Credentials'], undefined);
+
+    delete process.env.CORS_ALLOWED_ORIGINS;
+    _resetCorsPatterns();
+  });
+
+  it('disallowed origin with a configured allowlist is rejected with 403 before the timeout path', async () => {
+    const backend = {
+      api: () => ({
+        async echo() {
+          await new Promise(resolve => setTimeout(resolve, 5_000));
+          return {};
+        },
+      }),
+    };
+
+    process.env.CORS_ALLOWED_ORIGINS = 'https://myapp\\.example\\.com';
+    delete process.env.CORS_HOSTING_ORIGINS;
+    _resetCorsPatterns();
+
+    const event = makeEvent({
+      headers: {
+        'Content-Type': 'application/json',
+        origin: 'https://evil.example.com',
+      },
+    });
+    const ctx = makeLambdaContext(50);
+    const result = await invokeWithContext(backend, event, ctx);
+
+    assert.strictEqual(result.statusCode, 403);
+    assert.strictEqual(result.headers['Access-Control-Allow-Origin'], undefined);
+    assert.strictEqual(result.headers['Access-Control-Allow-Credentials'], undefined);
+
+    delete process.env.CORS_ALLOWED_ORIGINS;
+    _resetCorsPatterns();
   });
 });
 

package/src/lambda-handler.ts

@@ -15,7 +15,7 @@ import {
   errorResponseFromCatch,
   methodNotFoundResponse,
 } from './rpc.js';
-import { getCorsPatterns, isOriginAllowed, corsRejection } from './cors.js';
+import { getCorsPatterns, isOriginAllowed, corsRejection, buildCorsHeaders, CORS_MAX_AGE } from './cors.js';
 
 export { parseCorsPatterns, _resetCorsPatterns } from './cors.js';
 
@@ -39,21 +39,6 @@ export const EventSourceMapping = {
   SQS: 'aws:sqs',
 } as const;
 
-// ── CORS helpers (private to handler) ───────────────────────────────────────
-
-function buildCorsHeaders(origin: string): Record<string, string> {
-  const headers: Record<string, string> = {};
-  if (isOriginAllowed(origin)) {
-    headers['Access-Control-Allow-Origin'] = origin;
-    headers['Access-Control-Allow-Credentials'] = 'true';
-  } else if (origin) {
-    console.warn(
-      `[CORS] Origin "${origin}" is not allowed. Set the CORS_ALLOWED_ORIGINS environment variable to allow this origin. Example: CORS_ALLOWED_ORIGINS=https://myapp\\.com,^https?://(localhost|127\\.0\\.0\\.1)(:\\d+)?$`
-    );
-  }
-  return headers;
-}
-
 // ── Helpers ─────────────────────────────────────────────────────────────────
 
 /**
@@ -377,7 +362,7 @@ export function createLambdaHandler(backendFactory: () => Promise<any>) {
         // Timeout won the race — build a 504 response. Format depends on
         // whether the request targeted an RPC endpoint (structured JSON-RPC
         // error envelope) or a plain HTTP path (simple error JSON).
-        const origin = event.headers?.origin || event.headers?.Origin || '*';
+        const origin = event.headers?.origin || event.headers?.Origin || '';
         const requestPath = getRequestPath(event);
         const isRpcPath = requestPath === BLOCKS_RPC_PREFIX || requestPath.startsWith(BLOCKS_RPC_PREFIX + '/');
         const body = isRpcPath
@@ -387,8 +372,7 @@ export function createLambdaHandler(backendFactory: () => Promise<any>) {
           statusCode: 504,
           headers: {
             'Content-Type': 'application/json',
-            'Access-Control-Allow-Origin': origin,
-            'Access-Control-Allow-Credentials': 'true',
+            ...buildCorsHeaders(origin),
           },
           body,
         };
@@ -472,7 +456,7 @@ function createHandler(backend: any) {
           ...corsHeaders,
           'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS',
           'Access-Control-Allow-Headers': 'Content-Type, Authorization',
-          'Access-Control-Max-Age': '86400',
+          'Access-Control-Max-Age': CORS_MAX_AGE,
         },
         body: '',
       };

package/src/redact.test.ts

@@ -201,6 +201,18 @@ describe('redactToJson', () => {
     assert.equal(redactToJson({ big: 10n }), '[unserializable]');
   });
 
+  it('returns a string for undefined', () => {
+    assert.equal(redactToJson(undefined), 'undefined');
+  });
+
+  it('returns a string for function values', () => {
+    assert.equal(redactToJson(() => {}), 'undefined');
+  });
+
+  it('returns a string for symbol values', () => {
+    assert.equal(redactToJson(Symbol('x')), 'undefined');
+  });
+
   it('does not leak secrets even when truncation would apply downstream', () => {
     const json = redactToJson([{ action: 'signIn', username: 'u', password: 'p'.repeat(50) }]);
     assert.ok(!json.includes('pppp'));

package/src/redact.ts

@@ -131,12 +131,13 @@ export function redactForLogging(value: unknown, seen: WeakSet<object> = new Wea
 
 /**
  * Convenience for log call sites: redact `value` and serialize it to a JSON
- * string. Returns a safe placeholder instead of throwing if serialization
- * fails (e.g. a BigInt slips through), so logging can never crash a request.
+ * string. Returns `'undefined'` when JSON serialization produces no output,
+ * or a safe placeholder if serialization throws (e.g. a BigInt slips through),
+ * so logging can never crash a request.
  */
 export function redactToJson(value: unknown): string {
   try {
-    return JSON.stringify(redactForLogging(value));
+    return JSON.stringify(redactForLogging(value)) ?? 'undefined';
   } catch {
     return '[unserializable]';
   }

package/src/rpc.test.ts

@@ -3,7 +3,8 @@
 
 import { describe, it } from 'node:test';
 import assert from 'node:assert';
-import { parseRpcRequest, RpcErrorCode } from './rpc.js';
+import { decodeRpcResponse, errorResponseFromCatch, parseRpcRequest, RpcErrorCode } from './rpc.js';
+import { ApiError, isBlocksError } from './errors.js';
 
 describe('-32600 Invalid Request error shape', () => {
   it('returns proper JSON-RPC 2.0 envelope with error code', () => {
@@ -71,3 +72,97 @@ describe('-32600 Invalid Request error shape', () => {
     }
   });
 });
+
+describe('params decoding', () => {
+  it('uses an array of params as positional args', () => {
+    const result = parseRpcRequest(JSON.stringify({ jsonrpc: '2.0', method: 'api.greet', params: ['World', 42], id: 1 }));
+    assert.strictEqual(result.ok, true);
+    if (result.ok) {
+      assert.deepStrictEqual(result.request.args, ['World', 42]);
+      assert.strictEqual(result.request.apiNamespace, 'api');
+      assert.strictEqual(result.request.method, 'greet');
+    }
+  });
+
+  it('flattens an object of named params in key order', () => {
+    const result = parseRpcRequest(JSON.stringify({ jsonrpc: '2.0', method: 'api.greet', params: { name: 'World', times: 42 }, id: 1 }));
+    assert.strictEqual(result.ok, true);
+    if (result.ok) assert.deepStrictEqual(result.request.args, ['World', 42]);
+  });
+
+  it('yields no args when params is omitted', () => {
+    const result = parseRpcRequest(JSON.stringify({ jsonrpc: '2.0', method: 'api.ping', id: 7 }));
+    assert.strictEqual(result.ok, true);
+    if (result.ok) assert.deepStrictEqual(result.request.args, []);
+  });
+});
+
+describe('batch requests (top-level JSON array body)', () => {
+  it('rejects an array body as Invalid Request with a null id', () => {
+    const result = parseRpcRequest(JSON.stringify([
+      { jsonrpc: '2.0', method: 'api.greet', params: ['a'], id: 1 },
+      { jsonrpc: '2.0', method: 'api.greet', params: ['b'], id: 2 },
+    ]));
+    assert.strictEqual(result.ok, false);
+    if (!result.ok) {
+      const parsed = JSON.parse(result.response);
+      assert.strictEqual(parsed.error.code, RpcErrorCode.InvalidRequest);
+      assert.strictEqual(parsed.error.data.name, 'InvalidRequest');
+      assert.strictEqual(parsed.id, null);
+    }
+  });
+
+  it('reports a parse error for a body that is not JSON at all', () => {
+    const result = parseRpcRequest('{oops');
+    assert.strictEqual(result.ok, false);
+    if (!result.ok) {
+      const parsed = JSON.parse(result.response);
+      assert.strictEqual(parsed.error.code, RpcErrorCode.ParseError);
+      assert.strictEqual(parsed.id, null);
+    }
+  });
+});
+
+describe('ApiError status ↔ JSON-RPC error code', () => {
+  it('encodes the HTTP status as the error code, with name and retriable in data', () => {
+    const encoded = errorResponseFromCatch(
+      new ApiError('Username already taken', 409, { name: 'ConditionalCheckFailedException', retriable: true }),
+      1,
+    );
+    const parsed = JSON.parse(encoded);
+    assert.strictEqual(parsed.error.code, 409);
+    assert.strictEqual(parsed.error.message, 'Username already taken');
+    assert.strictEqual(parsed.error.data.name, 'ConditionalCheckFailedException');
+    assert.strictEqual(parsed.error.data.retriable, true);
+  });
+
+  it('encodes a non-ApiError throw as code 500 with no data.name', () => {
+    const parsed = JSON.parse(errorResponseFromCatch(new Error('plain'), 2));
+    assert.strictEqual(parsed.error.code, 500);
+    assert.strictEqual(parsed.error.data, undefined);
+  });
+
+  it('round-trips status, name and retriable back into an ApiError on the client', () => {
+    const wire = JSON.parse(errorResponseFromCatch(
+      new ApiError('Username already taken', 409, { name: 'ConditionalCheckFailedException', retriable: true }),
+      1,
+    ));
+    assert.throws(
+      () => decodeRpcResponse(wire),
+      (e: unknown) => {
+        assert.ok(e instanceof ApiError);
+        assert.strictEqual(e.status, 409);
+        assert.strictEqual(e.retriable, true);
+        assert.ok(isBlocksError(e, 'ConditionalCheckFailedException'));
+        return true;
+      },
+    );
+  });
+
+  it('decodes reserved -32xxx codes as status 500', () => {
+    assert.throws(
+      () => decodeRpcResponse({ jsonrpc: '2.0', error: { code: RpcErrorCode.InvalidRequest, message: 'Invalid Request' }, id: null }),
+      (e: unknown) => e instanceof ApiError && e.status === 500,
+    );
+  });
+});

package/src/scripts/console.ts

@@ -10,6 +10,33 @@ export interface ConsoleOptions {
   outputsFile?: string;
 }
 
+function resolveRegion(): string {
+  const fromEnv = process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION;
+  if (fromEnv) return fromEnv;
+  try {
+    const fromConfig = execFileSync('aws', ['configure', 'get', 'region'], { encoding: 'utf-8' }).trim();
+    if (fromConfig) return fromConfig;
+  } catch {
+    // aws CLI not configured — fall through to default.
+  }
+  return 'us-east-1';
+}
+
+/** Launch the URL in the default browser. Best-effort: no opener (headless/CI) is not a failure. */
+function openInBrowser(url: string): void {
+  const opener =
+    process.platform === 'darwin' ? 'open' :
+    process.platform === 'win32' ? 'cmd' :
+    'xdg-open';
+  const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
+  try {
+    execFileSync(opener, args, { stdio: 'ignore' });
+  } catch {
+    // Headless environment (CI, remote shell) — the URL is already printed above.
+    console.log('(Could not launch a browser automatically — open the URL above manually.)');
+  }
+}
+
 export async function openConsole(options: ConsoleOptions) {
   return trackCommand('console', async () => {
     let stackName: string;
@@ -23,12 +50,12 @@ export async function openConsole(options: ConsoleOptions) {
       throw new Error('Must provide either stackId or outputsFile');
     }
 
-    const region = execFileSync('aws', ['configure', 'get', 'region'], { encoding: 'utf-8' }).trim() || 'us-east-1';
+    const region = resolveRegion();
     const stackUrl = `https://${region}.console.aws.amazon.com/cloudformation/home?region=${region}#/stacks?filteringText=${encodeURIComponent(stackName)}`;
 
     console.log('Opening AWS Console...');
     console.log(stackUrl);
 
-    execFileSync('open', [stackUrl], { stdio: 'inherit' });
+    openInBrowser(stackUrl);
   });
 }