@aws/nx-plugin 0.111.0 → 0.112.1

package/src/ts/rdb/files/Dockerfile.template

@@ -0,0 +1,15 @@
+FROM public.ecr.aws/lambda/nodejs:24
+
+WORKDIR ${LAMBDA_TASK_ROOT}
+
+RUN npm install prisma@<%= prismaVersion %>
+
+COPY index.js ./index.js
+COPY prisma ./prisma
+COPY prisma.config.ts ./prisma.config.ts
+
+RUN curl -fsSL "https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem" \
+    -o /etc/pki/ca-trust/source/anchors/rds-bundle.pem && \
+    update-ca-trust
+
+CMD ["index.handler"]

package/src/ts/rdb/files/prisma/models/example.prisma.template

@@ -0,0 +1,5 @@
+model ExampleTable {
+  id          Int      @id @default(autoincrement()) 
+  column1     String
+  column2     String
+}

package/src/ts/rdb/files/prisma/schema.prisma.template

@@ -0,0 +1,9 @@
+generator client {
+  provider = "prisma-client"
+  output   = "../generated/prisma"
+}
+
+datasource db {
+  provider = "<%= databaseProvider %>"
+}
+

package/src/ts/rdb/files/prisma.config.ts.template

@@ -0,0 +1,24 @@
+import { defineConfig } from 'prisma/config';
+
+const getDatabaseUrl = async () => {
+  if (process.env.SERVE_LOCAL === 'true') {
+    const { LOCAL_DB_HOST, LOCAL_DB_NAME, LOCAL_DB_PASSWORD, LOCAL_DB_PORT, LOCAL_DB_USER } =
+      await import('./src/constants.js');
+<%_ if (engine === 'MySQL') { _%>
+    return `mysql://${LOCAL_DB_USER}:${LOCAL_DB_PASSWORD}@${LOCAL_DB_HOST}:${LOCAL_DB_PORT}/${LOCAL_DB_NAME}`;
+<%_ } else { _%>
+    return `postgresql://${LOCAL_DB_USER}:${LOCAL_DB_PASSWORD}@${LOCAL_DB_HOST}:${LOCAL_DB_PORT}/${LOCAL_DB_NAME}`;
+<%_ } _%>
+  }
+  return process.env.DATABASE_URL;
+};
+
+export default defineConfig({
+  schema: 'prisma/',
+  migrations: {
+    path: 'prisma/migrations',
+  },
+  datasource: {
+    url: await getDatabaseUrl(),
+  },
+});

package/src/ts/rdb/files/scripts/docker-pull.ts.template

@@ -0,0 +1,15 @@
+import Docker from 'dockerode';
+import { promisify } from 'util';
+
+const docker = new Docker();
+const image = process.argv[2];
+
+try {
+  await docker.getImage(image).inspect();
+} catch (e) {
+  if ((e as { statusCode?: number }).statusCode !== 404) throw e;
+  const stream = (await promisify(docker.pull.bind(docker))(
+    image,
+  )) as NodeJS.ReadableStream;
+  await promisify(docker.modem.followProgress.bind(docker.modem))(stream);
+}

package/src/ts/rdb/files/scripts/docker-start.ts.template

@@ -0,0 +1,81 @@
+import Docker from 'dockerode';
+
+<%_ if (engine === 'MySQL') { _%>
+const [containerName, image, hostPort, dbName, dbPassword] =
+  process.argv.slice(2);
+<%_ } else { _%>
+const [containerName, image, hostPort, dbName, dbUser, dbPassword] =
+  process.argv.slice(2);
+<%_ } _%>
+
+const docker = new Docker();
+
+let container: Docker.Container;
+
+try {
+  const existing = docker.getContainer(containerName);
+  const info = await existing.inspect();
+  container = existing;
+  if (!info.State.Running) {
+    await container.start();
+  }
+} catch (e) {
+  if ((e as { statusCode?: number }).statusCode !== 404) throw e;
+  container = await docker.createContainer({
+    name: containerName,
+<%_ if (engine === 'MySQL') { _%>
+    Image: image,
+    Env: [
+      `MYSQL_DATABASE=${dbName}`,
+      `MYSQL_ROOT_PASSWORD=${dbPassword}`,
+    ],
+    ExposedPorts: { '3306/tcp': {} },
+    HostConfig: {
+      AutoRemove: true,
+      PortBindings: { '3306/tcp': [{ HostPort: hostPort }] },
+      Binds: [`${containerName}-data:/var/lib/mysql`],
+    },
+<%_ } else { _%>
+    Image: image,
+    Env: [
+      `POSTGRES_DB=${dbName}`,
+      `POSTGRES_USER=${dbUser}`,
+      `POSTGRES_PASSWORD=${dbPassword}`,
+    ],
+    ExposedPorts: { '5432/tcp': {} },
+    HostConfig: {
+      AutoRemove: true,
+      PortBindings: { '5432/tcp': [{ HostPort: hostPort }] },
+      Binds: [`${containerName}-data:/var/lib/postgresql`],
+    },
+<%_ } _%>
+  });
+  await container.start();
+}
+
+const stream = await container.attach({
+  stream: true,
+  stdout: true,
+  stderr: true,
+});
+container.modem.demuxStream(stream, process.stdout, process.stderr);
+
+let exiting = false;
+
+async function cleanup() {
+  if (exiting) return;
+  exiting = true;
+  try {
+    await container.stop();
+  } catch (e) {
+    if ((e as { statusCode?: number }).statusCode !== 404) console.error(e);
+  }
+  process.exit(0);
+}
+
+process.on('SIGTERM', () => void cleanup());
+process.on('SIGINT', () => void cleanup());
+process.on('SIGHUP', () => void cleanup());
+
+const { StatusCode } = await container.wait();
+if (!exiting) process.exit(StatusCode);

package/src/ts/rdb/files/scripts/wait-for-db.ts.template

@@ -0,0 +1,55 @@
+<%_ if (engine === 'MySQL') { _%>
+import { createConnection, Connection } from 'mariadb';
+<%_ } else { _%>
+import { Client } from 'pg';
+<%_ } _%>
+
+const noop = () => undefined;
+
+const [portArg, dbArg, userArg, passwordArg] = process.argv.slice(2);
+const timeoutAt = Date.now() + 60000;
+
+while (Date.now() < timeoutAt) {
+<%_ if (engine === 'MySQL') { _%>
+  let conn: Connection | undefined;
+  try {
+    conn = await createConnection({
+      host: 'localhost',
+      port: parseInt(portArg),
+      user: userArg,
+      password: passwordArg,
+      database: dbArg,
+      connectTimeout: 500,
+      allowPublicKeyRetrieval: true,
+    });
+    await conn.end();
+    console.log('Database is ready.');
+    process.exit(0);
+  } catch {
+    console.log('Database is not ready.');
+    await conn?.end().catch(noop);
+  }
+<%_ } else { _%>
+  const client = new Client({
+    host: 'localhost',
+    port: parseInt(portArg),
+    user: userArg,
+    password: passwordArg,
+    database: dbArg,
+    connectionTimeoutMillis: 500,
+  });
+  client.on('error', noop);
+  try {
+    await client.connect();
+    await client.end();
+    console.log('Database is ready.');
+    process.exit(0);
+  } catch {
+    console.log('Database is not ready.');
+    await client.end().catch(noop);
+  }
+<%_ } _%>
+  await new Promise((r) => setTimeout(r, 200));
+}
+
+throw new Error(`Timed out waiting for <%= engine === 'MySQL' ? 'mysql' : 'postgres' %> on port ${portArg}`);

package/src/ts/rdb/files/src/constants.ts.template

@@ -0,0 +1,8 @@
+export const DB_PACKAGE_NAME = '<%= runtimeConfigKey %>';
+
+// Local development connection details (used when SERVE_LOCAL=true, see serve-local Nx target)
+export const LOCAL_DB_PORT = <%= localDbPort %>;
+export const LOCAL_DB_HOST = '<%= localDbHost %>';
+export const LOCAL_DB_NAME = '<%= localDbName %>';
+export const LOCAL_DB_USER = '<%= localDbUser %>';
+export const LOCAL_DB_PASSWORD = '<%= localDbPassword %>';

package/src/ts/rdb/files/src/create-db-user-handler.ts.template

@@ -0,0 +1,128 @@
+import type { CloudFormationCustomResourceEvent } from 'aws-lambda';
+import { randomBytes } from 'node:crypto';
+<%_ if (engine === 'MySQL') { _%>
+import { createPool, type PoolConnection } from 'mariadb';
+import { getDatabaseSecret, withConnectionRetry } from './utils.js';
+<%_ } else { _%>
+import { Client, escapeIdentifier } from 'pg';
+import { getDatabaseSecret, withConnectionRetry } from './utils.js';
+<%_ } _%>
+
+type OnEventResult = {
+  PhysicalResourceId: string;
+  Data?: Record<string, unknown>;
+};
+
+const physicalResourceIdPrefix = 'db-user:';
+
+const resolveDbUser = (physicalResourceId?: string): string =>
+  physicalResourceId?.startsWith(physicalResourceIdPrefix)
+    ? physicalResourceId.slice(physicalResourceIdPrefix.length)
+    : `db_${randomBytes(8).toString('hex')}`;
+
+const ensureDatabaseUser = async (dbUser: string): Promise<void> => {
+<%_ if (engine === 'MySQL') { _%>
+  const { dbname, username, password, host, port } = await getDatabaseSecret();
+  const pool = createPool({
+    host,
+    port,
+    database: dbname,
+    user: username,
+    password,
+    ssl: {
+      rejectUnauthorized: true,
+    },
+    connectionLimit: 1,
+    multipleStatements: true,
+    connectTimeout: 10_000,
+  });
+
+  const quotedDbName = pool.escapeId(dbname);
+  const quotedUser = pool.escape(dbUser);
+  const quotedHost = pool.escape('%');
+
+  let connection: PoolConnection | undefined;
+
+  try {
+    connection = await pool.getConnection();
+    await connection.query(
+      [
+        `CREATE USER IF NOT EXISTS ${quotedUser}@${quotedHost} IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS'`,
+        `ALTER USER ${quotedUser}@${quotedHost} IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS' REQUIRE SSL`,
+        `GRANT ALL PRIVILEGES ON ${quotedDbName}.* TO ${quotedUser}@${quotedHost}`,
+      ].join(';\n'),
+    );
+  } finally {
+    await connection?.release();
+    await pool.end();
+  }
+<%_ } else { _%>
+  const { dbname, username, password, host, port } = await getDatabaseSecret();
+  const quotedDbUser = escapeIdentifier(dbUser);
+  const quotedDbName = escapeIdentifier(dbname);
+  const client = new Client({
+    host,
+    port,
+    database: dbname,
+    user: username,
+    password,
+    ssl: {
+      rejectUnauthorized: true,
+    },
+    connectionTimeoutMillis: 10_000,
+  });
+
+  await client.connect();
+
+  try {
+    await client.query('BEGIN');
+    
+    const roleExists = await client.query(
+      'SELECT 1 FROM pg_roles WHERE rolname = $1',
+      [dbUser],
+    );
+    if (roleExists.rowCount === 0) {
+      await client.query(`CREATE ROLE ${quotedDbUser} WITH LOGIN;`);
+    }
+
+    await client.query(
+      `ALTER ROLE ${quotedDbUser} WITH LOGIN;
+      GRANT ALL PRIVILEGES ON DATABASE ${quotedDbName} TO ${quotedDbUser};
+      GRANT USAGE, CREATE ON SCHEMA public TO ${quotedDbUser};
+      GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO ${quotedDbUser};
+      GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO ${quotedDbUser};
+      GRANT ALL PRIVILEGES ON ALL FUNCTIONS IN SCHEMA public TO ${quotedDbUser};
+      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL PRIVILEGES ON TABLES TO ${quotedDbUser};
+      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL PRIVILEGES ON SEQUENCES TO ${quotedDbUser};
+      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL PRIVILEGES ON FUNCTIONS TO ${quotedDbUser};
+      GRANT rds_iam TO ${quotedDbUser};`,
+    );
+
+    await client.query('COMMIT');
+  } catch (error) {
+    await client.query('ROLLBACK');
+    throw error;
+  } finally {
+    await client.end();
+  }
+<%_ } _%>
+};
+
+export const handler = async (
+  event: CloudFormationCustomResourceEvent,
+): Promise<OnEventResult> => {
+  const dbUser = resolveDbUser(
+    'PhysicalResourceId' in event ? event.PhysicalResourceId : undefined,
+  );
+
+  if (event.RequestType !== 'Delete') {
+    await withConnectionRetry(() => ensureDatabaseUser(dbUser));
+  }
+
+  return {
+    PhysicalResourceId: `${physicalResourceIdPrefix}${dbUser}`,
+    Data: {
+      dbUser,
+    },
+  };
+};

package/src/ts/rdb/files/src/index.ts.template

@@ -0,0 +1,2 @@
+export { DB_PACKAGE_NAME } from './constants.js';
+export { getPrisma } from './prisma.js';

package/src/ts/rdb/files/src/migration-handler.ts.template

@@ -0,0 +1,54 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+<%_ if (engine === 'MySQL') { _%>
+import { getDatabaseSecret, withConnectionRetry } from './utils.js';
+<%_ } else { _%>
+import { Signer } from '@aws-sdk/rds-signer';
+import { withConnectionRetry } from './utils.js';
+<%_ } _%>
+
+const buildDatabaseUrl = async (): Promise<string> => {
+<%_ if (engine === 'MySQL') { _%>
+  const { host, port, dbname, username, password } = await getDatabaseSecret();
+
+  return (
+    `mysql://${encodeURIComponent(username)}` +
+    `:${encodeURIComponent(password)}` +
+    `@${host}:${port}/${dbname}` +
+    `?sslaccept=strict`
+  );
+<%_ } else { _%>
+  const hostname = process.env.HOSTNAME!;
+  const port = process.env.PORT!;
+  const database = process.env.DATABASE!;
+  const dbUser = process.env.DBUSER!;
+  const region = process.env.AWS_REGION!;
+
+  const iamAuthToken = await new Signer({
+    hostname,
+    port: Number(port),
+    region,
+    username: dbUser,
+  }).getAuthToken();
+
+  return (
+    `postgresql://${encodeURIComponent(dbUser)}` +
+    `:${encodeURIComponent(iamAuthToken)}` +
+    `@${hostname}:${port}/${database}` +
+    `?sslaccept=strict` // `sslaccept` is the correct parameter here for postgresql. The Prisma CLI Rust engine does not use the standard libpq `sslmode` option.
+  );
+<%_ } _%>
+};
+
+export const handler = async () => {
+  await withConnectionRetry(async () => {
+    const databaseUrl = await buildDatabaseUrl();
+    await promisify(execFile)('npx', ['prisma', 'migrate', 'deploy'], {
+      cwd: __dirname,
+      env: {
+        ...process.env,
+        DATABASE_URL: databaseUrl,
+      },
+    });
+  });
+};

package/src/ts/rdb/files/src/prisma.ts.template

@@ -0,0 +1,104 @@
+import { <%= prismaAdapterClassName %> } from '<%= prismaAdapterPackage %>';
+import { Signer } from '@aws-sdk/rds-signer';
+<%_ if (engine === 'MySQL') { _%>
+import { PrismaClient } from '../generated/prisma/client.js';
+<%_ } else { _%>
+import { Pool } from 'pg';
+import { PrismaClient } from '../generated/prisma/client.js';
+<%_ } _%>
+import {
+  DB_PACKAGE_NAME,
+  LOCAL_DB_HOST,
+  LOCAL_DB_NAME,
+  LOCAL_DB_PASSWORD,
+  LOCAL_DB_PORT,
+  LOCAL_DB_USER,
+} from './constants.js';
+import { getDatabaseConfig } from './utils.js';
+<%_ if (engine === 'MySQL') { _%>
+
+export const getPrisma = async (): Promise<PrismaClient> => {
+  if (process.env.SERVE_LOCAL === 'true') {
+    const adapter = new PrismaMariaDb({
+      host: LOCAL_DB_HOST,
+      port: LOCAL_DB_PORT,
+      database: LOCAL_DB_NAME,
+      user: LOCAL_DB_USER,
+      password: LOCAL_DB_PASSWORD,
+      allowPublicKeyRetrieval: true,
+    });
+    return new PrismaClient({ adapter });
+  }
+
+  const { hostname, port, database, dbUser, region } =
+    await getDatabaseConfig(DB_PACKAGE_NAME);
+  const iamAuthToken = await new Signer({
+    hostname,
+    port,
+    region,
+    username: dbUser,
+  }).getAuthToken();
+
+  const adapter = new PrismaMariaDb({
+    host: hostname,
+    port,
+    database,
+    user: dbUser,
+    password: iamAuthToken,
+    ssl: {
+      rejectUnauthorized: true,
+    },
+  });
+
+  return new PrismaClient({ adapter });
+};
+<%_ } else { _%>
+
+let prismaPromise: Promise<PrismaClient> | undefined;
+
+export const getPrisma = (): Promise<PrismaClient> => {
+  prismaPromise ??= (async () => {
+    if (process.env.SERVE_LOCAL === 'true') {
+      const adapter = new PrismaPg(
+        new Pool({
+          host: LOCAL_DB_HOST,
+          port: LOCAL_DB_PORT,
+          database: LOCAL_DB_NAME,
+          user: LOCAL_DB_USER,
+          password: LOCAL_DB_PASSWORD,
+          allowExitOnIdle: true,
+        }),
+      );
+      return new PrismaClient({ adapter });
+    }
+
+    const { hostname, port, database, dbUser, region } =
+      await getDatabaseConfig(DB_PACKAGE_NAME);
+    const adapter = new PrismaPg(
+      new Pool({
+        host: hostname,
+        port,
+        database,
+        user: dbUser,
+        ssl: {
+          rejectUnauthorized: true,
+        },
+        allowExitOnIdle: true,
+        password: async () => {
+          const token = await new Signer({
+            hostname,
+            port,
+            region,
+            username: dbUser,
+          }).getAuthToken();
+          return token;
+        },
+      }),
+    );
+
+    return new PrismaClient({ adapter });
+  })();
+
+  return prismaPromise;
+};
+<%_ } _%>

package/src/ts/rdb/files/src/utils.ts.template

@@ -0,0 +1,145 @@
+import { getAppConfig } from '@aws-lambda-powertools/parameters/appconfig';
+import {
+  GetSecretValueCommand,
+  SecretsManagerClient,
+} from '@aws-sdk/client-secrets-manager';
+
+export type DatabaseConfig = {
+  hostname: string;
+  port: number;
+  database: string;
+  adminUser: string;
+  dbUser: string;
+  region: string;
+};
+
+export type DatabaseSecret = {
+  dbname: string;
+  username: string;
+  password: string;
+  host: string;
+  port: number;
+};
+
+const databaseConfigPromises: Record<string, Promise<DatabaseConfig>> = {};
+
+const getSecretValue = async (secretArn: string): Promise<string> => {
+  const client = new SecretsManagerClient();
+  const data = await client.send(
+    new GetSecretValueCommand({
+      SecretId: secretArn,
+    }),
+  );
+
+  if (!data.SecretString) {
+    throw new Error('Database secret does not contain SecretString.');
+  }
+
+  return data.SecretString;
+};
+
+export const getDatabaseSecret = async (): Promise<DatabaseSecret> => {
+  const secretArn = process.env.DATABASE_SECRET_ARN;
+
+  if (!secretArn) {
+    throw new Error(
+      'Missing required environment variable DATABASE_SECRET_ARN.',
+    );
+  }
+
+  return JSON.parse(await getSecretValue(secretArn)) as DatabaseSecret;
+};
+
+const loadDatabaseConfig = async (
+  runtimeConfigKey: string,
+): Promise<DatabaseConfig> => {
+  const appId = process.env.RUNTIME_CONFIG_APP_ID;
+
+  if (!appId) {
+    throw new Error(
+      'Missing required environment variable RUNTIME_CONFIG_APP_ID.',
+    );
+  }
+
+  const config = await getAppConfig<{
+    [key: string]: DatabaseConfig | undefined;
+  }>('database', {
+    application: appId,
+    environment: 'default',
+    transform: 'json',
+  });
+
+  const databaseConfig = config?.[runtimeConfigKey];
+
+  if (!databaseConfig) {
+    throw new Error(`RuntimeConfig is missing database.${runtimeConfigKey}.`);
+  }
+
+  return databaseConfig;
+};
+
+export const getDatabaseConfig = (
+  runtimeConfigKey: string,
+): Promise<DatabaseConfig> => {
+  databaseConfigPromises[runtimeConfigKey] ??=
+    loadDatabaseConfig(runtimeConfigKey);
+  return databaseConfigPromises[runtimeConfigKey];
+};
+
+// Aurora's writer endpoint is briefly unreachable from within the VPC right
+// after the cluster reports ready, and IAM policy attachments can take tens
+// of seconds to propagate before RDS accepts an IAM auth token. Both surface
+// as errors that resolve on retry.
+const transientErrorPatterns = [
+  'ETIMEDOUT',
+  'ECONNREFUSED',
+  'ENOTFOUND',
+  'P1000', // Prisma: authentication failed
+  'ER_ACCESS_DENIED_ERROR', // MySQL: access denied
+];
+
+const asString = (value: unknown): string => {
+  if (value == null) return '';
+  if (typeof value === 'string') return value;
+  if (Buffer.isBuffer(value)) return value.toString('utf-8');
+  return String(value);
+};
+
+export const isTransientConnectionError = (error: unknown): boolean => {
+  const err = error as {
+    message?: unknown;
+    code?: unknown;
+    stderr?: unknown;
+    stdout?: unknown;
+  };
+  const haystack = [
+    error instanceof Error ? error.message : asString(err?.message),
+    asString(err?.code),
+    asString(err?.stderr),
+    asString(err?.stdout),
+  ].join('\n');
+  return transientErrorPatterns.some((p) => haystack.includes(p));
+};
+
+export const withConnectionRetry = async <T>(
+  fn: () => Promise<T>,
+  { maxAttempts = 6, delayMs = 10_000 }: { maxAttempts?: number; delayMs?: number } = {},
+): Promise<T> => {
+  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+    try {
+      return await fn();
+    } catch (error) {
+      if (attempt === maxAttempts || !isTransientConnectionError(error)) {
+        throw error;
+      }
+      const wait = delayMs * attempt;
+      console.log(
+        `Transient connection error (attempt ${attempt}/${maxAttempts}), retrying in ${wait}ms: ${
+          error instanceof Error ? error.message : String(error)
+        }`,
+      );
+      await new Promise((resolve) => setTimeout(resolve, wait));
+    }
+  }
+  throw new Error('unreachable');
+};

package/src/ts/rdb/generator.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { GeneratorCallback, Tree } from '@nx/devkit';
+import { TsRdbGeneratorSchema } from './schema';
+import { NxGeneratorInfo } from '../../utils/nx';
+export declare const TS_RDB_GENERATOR_INFO: NxGeneratorInfo;
+export declare const tsRdbGenerator: (tree: Tree, options: TsRdbGeneratorSchema) => Promise<GeneratorCallback>;
+export default tsRdbGenerator;