@aws-blocks/core 0.1.7 → 0.1.11

package/src/db-naming.test.ts

@@ -1,9 +1,13 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import { test, describe } from 'node:test';
+import { test, describe, afterEach } from 'node:test';
 import assert from 'node:assert';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
 import { extractDbRef, dbConnectionParameterName } from './db-naming.js';
+import { getStackName } from './scripts/stack-id.js';
 
 describe('extractDbRef', () => {
   test('pooler form (postgres.{ref}@) yields ref', () => {
@@ -39,10 +43,51 @@ describe('extractDbRef', () => {
 });
 
 describe('dbConnectionParameterName', () => {
-  test('composes the stage into the SSM name', () => {
-    assert.strictEqual(
-      dbConnectionParameterName('production'),
-      '/blocks/production/db-connection-string',
+  test('formats stack name into parameter path', () => {
+    assert.strictEqual(dbConnectionParameterName('my-app-k7x2mf-prod'), '/my-app-k7x2mf-prod-db-url');
+  });
+
+  test('two distinct stack names produce distinct parameter names', () => {
+    assert.notStrictEqual(
+      dbConnectionParameterName('app-a-111111-prod'),
+      dbConnectionParameterName('app-b-222222-prod'),
     );
   });
 });
+
+describe('cross-site invariant: write name == read name', () => {
+  let tmpDir: string;
+  let originalCwd: string;
+
+  afterEach(() => {
+    if (originalCwd) process.chdir(originalCwd);
+    if (tmpDir) rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  function setupProject(stackId: string, sandboxId: string): string {
+    tmpDir = mkdtempSync(join(tmpdir(), 'cross-site-'));
+    mkdirSync(join(tmpDir, '.blocks'), { recursive: true });
+    writeFileSync(join(tmpDir, '.blocks', 'config.json'), JSON.stringify({ stackId }));
+    mkdirSync(join(tmpDir, '.blocks-sandbox'), { recursive: true });
+    writeFileSync(join(tmpDir, '.blocks-sandbox', 'sandbox-id.txt'), sandboxId);
+    return tmpDir;
+  }
+
+  test('write-side name == read-side name (sandbox)', () => {
+    const root = setupProject('my-app-k7x2mf', 'alice-0d7e1c');
+    const writeName = dbConnectionParameterName(getStackName({ sandbox: true, projectRoot: root }));
+    originalCwd = process.cwd();
+    process.chdir(root);
+    const readName = dbConnectionParameterName(getStackName({ sandbox: true }));
+    assert.strictEqual(writeName, readName);
+  });
+
+  test('write-side name == read-side name (production)', () => {
+    const root = setupProject('my-app-k7x2mf', 'alice-0d7e1c');
+    const writeName = dbConnectionParameterName(getStackName({ sandbox: false, projectRoot: root }));
+    originalCwd = process.cwd();
+    process.chdir(root);
+    const readName = dbConnectionParameterName(getStackName({ sandbox: false }));
+    assert.strictEqual(writeName, readName);
+  });
+});

package/src/db-naming.ts

@@ -6,9 +6,15 @@
  * database connection string, and for the project ref derived from a Postgres
  * connection string.
  *
- * Both the deploy-time provisioner (`ensure-secrets`) and the `db pull`
- * generated code derive this name from the stage alone. Keep this the only
- * place the name is constructed.
+ * The connection-string parameter name is **stack-scoped** (embeds the
+ * deployment's stack name), so two Blocks apps in the same account + region +
+ * stage get distinct names and cannot overwrite each other's credentials.
+ *
+ * Two call sites compute the name: the pre-deploy writer (`ensure-secrets`) and
+ * the `db pull` generated wiring at synth. Both pass the result of
+ * `getStackName({ sandbox, projectRoot })` into this function, so they produce
+ * the same name by construction. The runtime Lambda does not call this function;
+ * it reads the name recorded at synth.
  */
 
 /**
@@ -35,7 +41,13 @@ export function extractDbRef(connectionString: string): string {
   throw new Error('Cannot extract database identifier from connection string.');
 }
 
-/** SSM parameter name storing the connection string for a given stage. */
-export function dbConnectionParameterName(stage: string): string {
-  return `/blocks/${stage}/db-connection-string`;
+/**
+ * SSM SecureString parameter name for a deployment's external database
+ * connection string.
+ *
+ * Pure string transform: `/<stackName>-db-url`. The caller is responsible for
+ * computing the stack name via `getStackName({ sandbox, projectRoot })`.
+ */
+export function dbConnectionParameterName(stackName: string): string {
+  return `/${stackName}-db-url`;
 }

package/src/hosting.test.ts

@@ -1428,4 +1428,83 @@ describe('Hosting', () => {
       template.resourceCountIs('AWS::CloudFront::Distribution', 1);
     });
   });
+
+  // ── basePath prop (caller-declared source of truth) ─────────
+  // Under KVS edge routing, basePath is no longer expressed as a per-behavior
+  // PathPattern prefix — it lives in the KVS route table's `meta.bp`, which the
+  // edge router uses for the canonical 308 + static strip. So these tests read
+  // the basePath out of the RouteStoreKeys custom resource's Entries.
+  describe('basePath prop', () => {
+    const metaBasePath = (root: string, basePath?: string): string => {
+      const app = new App();
+      const stack = new Stack(app, 'BasePathStack', {
+        env: { account: '123456789012', region: 'us-east-1' },
+      });
+      new Hosting(stack, 'Web', {
+        root,
+        framework: 'spa',
+        buildOutputDir: 'dist',
+        ...(basePath !== undefined ? { basePath } : {}),
+      });
+      const tpl = Template.fromStack(stack).toJSON() as {
+        Resources: Record<string, { Type: string; Properties?: any }>;
+      };
+      const kvKeys = Object.entries(tpl.Resources).find(
+        ([id, r]) =>
+          r.Type === 'AWS::CloudFormation::CustomResource' &&
+          /RouteStoreKeys/.test(id),
+      );
+      assert.ok(kvKeys, 'expected a RouteStoreKeys custom resource');
+      const entries = JSON.parse(kvKeys![1].Properties.Entries);
+      const meta = JSON.parse(entries.meta);
+      return meta.bp as string;
+    };
+
+    it('records basePath in the KVS route table when set (SPA, no framework base)', () => {
+      createSpaBuildOutput(tmpDir);
+      assert.strictEqual(metaBasePath(tmpDir, '/app'), '/app');
+    });
+
+    it('normalizes a trailing slash (/app/ → /app)', () => {
+      createSpaBuildOutput(tmpDir);
+      assert.strictEqual(metaBasePath(tmpDir, '/app/'), '/app');
+    });
+
+    it('treats "/" as no base path', () => {
+      createSpaBuildOutput(tmpDir);
+      assert.strictEqual(metaBasePath(tmpDir, '/'), '');
+    });
+  });
+
+  // ── P0.4: config.json ordering dependency ────────────────────
+  describe('config.json deploy ordering (P0.4)', () => {
+    it('BlocksConfigDeployment depends on the asset deployments', () => {
+      // The asset deployments upload the whole static dir — including the
+      // placeholder `.blocks-sandbox/config.json` — to the same key the
+      // resolved config writes to. Without an ordering dependency the
+      // placeholder can clobber the real config. The previous
+      // `tryFindChild('AssetDeployment')` never matched the real child ids
+      // (AssetDeploymentImmutable/Html/Mutable), so the dep was never wired.
+      createSpaBuildOutput(tmpDir);
+      const app = new App();
+      const stack = new Stack(app, 'ConfigOrderStack');
+      new Hosting(stack, 'Hosting', { root: tmpDir, api: MOCK_API });
+
+      const tpl = Template.fromStack(stack).toJSON() as {
+        Resources: Record<string, { Type: string; DependsOn?: string[] }>;
+      };
+      const configId = Object.keys(tpl.Resources).find(
+        (id) => /BlocksConfigDeployment/.test(id) && /CustomResource/.test(id),
+      );
+      assert.ok(configId, 'expected a BlocksConfigDeployment custom resource');
+
+      const dependsOn = tpl.Resources[configId].DependsOn ?? [];
+      const assetDeps = dependsOn.filter((d) => /AssetDeployment/.test(d));
+      assert.ok(
+        assetDeps.length >= 1,
+        `BlocksConfigDeployment must DependsOn the asset deployment(s); ` +
+          `found DependsOn=${JSON.stringify(dependsOn)}`,
+      );
+    });
+  });
 });

package/src/hosting.ts

@@ -26,6 +26,7 @@ import {
 import {
   detectFramework,
   getAdapter,
+  normalizeBasePath,
   type FrameworkAdapterFn,
 } from '@aws-blocks/hosting/adapters';
 import type {
@@ -150,6 +151,27 @@ export interface HostingProps {
   /** Supply a custom adapter when using an unsupported framework. */
   customAdapter?: FrameworkAdapterFn;
 
+  /**
+   * URL prefix the whole site is served under (Next.js `basePath`, Astro
+   * `base`, Nuxt `app.baseURL`). When set, CloudFront behaviors are prefixed
+   * with it and the bare root issues a 308 redirect to `/<basePath>/`.
+   *
+   * Declaring it here is the recommended source of truth: the value is
+   * caller-provided rather than reverse-engineered from build output, so it
+   * can't drift with framework/bundler internals. When omitted, the adapter
+   * falls back to detecting the framework's own base-path config from the
+   * build output.
+   *
+   * Format: leading slash, no trailing slash (e.g. `'/app'`). A trailing
+   * slash or bare `'/'` is normalized/ignored.
+   *
+   * @example
+   * ```ts
+   * new Hosting(stack, 'Web', { root, framework: 'nuxt', basePath: '/app' });
+   * ```
+   */
+  basePath?: string;
+
   // ── Blocks backend integration ────────────────────────────────────
   /**
    * The Blocks backend stack (or any object with `apiUrl`).
@@ -204,6 +226,36 @@ export interface HostingProps {
     countries: string[];
   };
 
+  /**
+   * Overrides for the adjustable AWS Service Quotas the CloudFront
+   * distribution draws on. Each field maps to a named AWS quota you can
+   * request an increase on:
+   *
+   *   - `cacheBehaviors` — "Cache behaviors per distribution" (default 25).
+   *     Consumed by routed paths, prerendered pages, per-pattern header
+   *     rules, assetPrefix, and the error-page behavior.
+   *   - `edgeFunctions` — Lambda@Edge associations per distribution
+   *     (default 25). Consumed by `runtime: 'edge'` routes.
+   *   - `headerPolicies` — "Response headers policies per AWS account"
+   *     (default 20, account-wide).
+   *
+   * Omitted fields use the AWS default. Set a field ONLY to match a quota
+   * increase AWS has actually granted — synth cannot verify your real quota,
+   * so an over-set value does not raise the AWS ceiling; it just moves the
+   * failure from a clear synth error to an opaque CloudFormation rollback.
+   *
+   * @example
+   * ```ts
+   * // After AWS grants "Cache behaviors per distribution" = 50:
+   * new Hosting(stack, 'Web', { root, quotas: { cacheBehaviors: 50 } });
+   * ```
+   */
+  quotas?: {
+    cacheBehaviors?: number;
+    edgeFunctions?: number;
+    headerPolicies?: number;
+  };
+
   /**
    * Build cache configuration. When enabled, provisions an S3 bucket for
    * framework build caches (e.g. Next.js .next/cache) and exports the bucket
@@ -401,6 +453,23 @@ export class Hosting extends Construct {
       manifest.buildId = generateBuildId();
     }
 
+    // ── 4b'. basePath: prop is the source of truth ───────────────
+    //    A caller-declared `basePath` overrides whatever the adapter
+    //    detected from build output. This is the robust path: the value
+    //    is provided rather than reverse-engineered from framework/bundler
+    //    internals (which drift across versions). When the prop is omitted,
+    //    the adapter's detected `manifest.basePath` (if any) stands.
+    if (props.basePath !== undefined) {
+      const normalized = normalizeBasePath(props.basePath);
+      if (normalized) {
+        manifest.basePath = normalized;
+      } else {
+        // Explicit '/' (or empty) means "no base path" — clear any value
+        // the adapter may have detected so the prop genuinely wins.
+        delete manifest.basePath;
+      }
+    }
+
     // ── 4c. Prevent duplicate error pages ────────────────────────
     //    The adapter may auto-detect error pages (e.g. SPA adapter finds
     //    404.html in build output and sets manifest.errorPages). When the
@@ -470,11 +539,12 @@ export class Hosting extends Construct {
       storage: props.retainOnDelete != null
         ? { retainOnDelete: props.retainOnDelete }
         : undefined,
-      cdn: (props.contentSecurityPolicy || props.priceClass || props.geoRestriction)
+      cdn: (props.contentSecurityPolicy || props.priceClass || props.geoRestriction || props.quotas)
         ? {
             contentSecurityPolicy: props.contentSecurityPolicy,
             priceClass: props.priceClass,
             geoRestriction: props.geoRestriction,
+            quotas: props.quotas,
           }
         : undefined,
       logging: props.logging,
@@ -492,17 +562,26 @@ export class Hosting extends Construct {
     }
 
     // ── 7a. Inject Blocks env vars into compute functions ───────────
-    const primaryFunction = hosting.computeFunctions.values().next().value as cdk.aws_lambda.Function | undefined;
+    // Lambda@Edge functions (edge-runtime routes) do NOT support environment
+    // variables — they surface in computeFunctions as EdgeFunction/IVersion
+    // without an `addEnvironment` method. Skip any function that can't take
+    // env vars instead of crashing (`fn.addEnvironment is not a function`).
+    const canAddEnv = (
+      fn: unknown,
+    ): fn is cdk.aws_lambda.Function =>
+      typeof (fn as { addEnvironment?: unknown })?.addEnvironment === 'function';
+
+    const primaryFunction = [...hosting.computeFunctions.values()].find(
+      canAddEnv,
+    );
 
     for (const [, fn] of hosting.computeFunctions) {
+      if (!canAddEnv(fn)) continue; // Lambda@Edge: no env var support
       if (props.api) {
-        (fn as cdk.aws_lambda.Function).addEnvironment('BLOCKS_API_URL', props.api.apiUrl);
+        fn.addEnvironment('BLOCKS_API_URL', props.api.apiUrl);
       }
       if (props.backendConfig) {
-        (fn as cdk.aws_lambda.Function).addEnvironment(
-          'BLOCKS_CONFIG',
-          JSON.stringify(props.backendConfig),
-        );
+        fn.addEnvironment('BLOCKS_CONFIG', JSON.stringify(props.backendConfig));
       }
     }
 
@@ -521,11 +600,25 @@ export class Hosting extends Construct {
         cacheControl: [s3deploy.CacheControl.fromString('public, max-age=60, must-revalidate')],
       });
 
-      // Ensure config deployment runs after the hosting construct's
-      // asset deployment so the resolved config.json is not overwritten.
-      const assetDeployment = hosting.node.tryFindChild('AssetDeployment') as Construct | undefined;
-      if (assetDeployment) {
-        configDeployment.node.addDependency(assetDeployment);
+      // Ensure the config deployment runs AFTER the hosting construct's
+      // asset deployments. Those deployments upload the whole static dir —
+      // which includes the *placeholder* `.blocks-sandbox/config.json`
+      // (`{_placeholder:true}`) written during synth — to the same
+      // `builds/<id>/.blocks-sandbox/config.json` key this deployment writes
+      // the resolved config to. Without an ordering dependency the
+      // placeholder can land last and clobber the real config.
+      //
+      // We depend on EVERY BucketDeployment under the hosting construct
+      // rather than a single hard-coded child id: the real children are
+      // `AssetDeploymentImmutable` / `AssetDeploymentHtml` / `...Mutable`
+      // (and vary by deploy shape), so the previous
+      // `tryFindChild('AssetDeployment')` never matched and the dependency
+      // was silently never wired.
+      const assetDeployments = hosting.node
+        .findAll()
+        .filter((c): c is s3deploy.BucketDeployment => c instanceof s3deploy.BucketDeployment);
+      for (const dep of assetDeployments) {
+        configDeployment.node.addDependency(dep);
       }
     }
 

package/src/scripts/deploy.ts

@@ -25,8 +25,10 @@ export async function deploy(options: DeployOptions) {
 
     process.env.BLOCKS_STAGE = 'production';
 
-    // Provision secrets for production
-    const secrets = await ensureSecrets('production');
+    // Provision secrets for production. projectRoot must match the root cdk
+    // synth uses (passed as --context below) so the written parameter name
+    // equals the one the app resolves at synth.
+    const secrets = await ensureSecrets('production', options.projectRoot);
     if (secrets.created.length > 0 || secrets.updated.length > 0) {
       console.log(`🔐 Secrets provisioned: ${[...secrets.created, ...secrets.updated].join(', ')}`);
     }