@aws/nx-plugin 1.0.0-rc.3 → 1.0.0-rc.30

package/src/utils/api-constructs/files/terraform/app/apis/rest/__apiNameKebabCase__/__apiNameKebabCase__.tf.template

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "<%- awsProviderVersion %>"
     }
   }
 }
@@ -105,6 +105,11 @@ resource "aws_s3_object" "lambda_zip" {
 }
 
 # Use the core REST API module
+# Account-level CloudWatch role required for REST API access logging
+module "account" {
+  source = "../../../core/api/api-gateway-account"
+}
+
 module "rest_api" {
   source = "../../../core/api/rest-api"
 
@@ -413,6 +418,9 @@ resource "aws_api_gateway_method" "proxy_method" {
   <%_ } else if (auth === 'cognito') { _%>
   authorization = "COGNITO_USER_POOLS"
   authorizer_id = aws_api_gateway_authorizer.cognito_authorizer.id
+  # Accept access tokens from both sign-in flows: 'openid' (Cognito hosted UI)
+  # and 'aws.cognito.signin.user.admin' (Cognito admin/SRP auth APIs).
+  authorization_scopes = ["openid", "aws.cognito.signin.user.admin"]
   <%_ } else if (auth === 'custom') { _%>
   authorization = "CUSTOM"
   authorizer_id = aws_api_gateway_authorizer.custom_authorizer.id
@@ -506,11 +514,63 @@ resource "aws_api_gateway_deployment" "api_deployment" {
   ]
 }
 
+# KMS key for encrypting access logs at rest
+resource "aws_kms_key" "access_logs" {
+  description             = "<%- apiNameClassName %> API access log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:log-group:/aws/apigateway/<%- apiNameKebabCase %>-${random_string.suffix.result}/access"
+          }
+        }
+      }
+    ]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_kms_alias" "access_logs" {
+  name          = "alias/<%- apiNameKebabCase %>-${random_string.suffix.result}-access-logs"
+  target_key_id = aws_kms_key.access_logs.key_id
+}
+
+# Access logs for the API Gateway stage
+resource "aws_cloudwatch_log_group" "access_logs" {
+  name              = "/aws/apigateway/<%- apiNameKebabCase %>-${random_string.suffix.result}/access"
+  retention_in_days = 365
+  kms_key_id        = aws_kms_key.access_logs.arn
+  tags              = var.tags
+}
+
 # API Gateway stage
 resource "aws_api_gateway_stage" "api_stage" {
   #checkov:skip=CKV_AWS_120:API Gateway caching not required for this use case
-  #checkov:skip=CKV_AWS_76:API Gateway access logging disabled due to account-level CloudWatch Logs role ARN requirement
-  #checkov:skip=CKV2_AWS_4:API Gateway logging level not applicable as access logging is disabled
+  #checkov:skip=CKV2_AWS_4:Access logging is enabled below; verbose execution logging is intentionally not enabled
   #checkov:skip=CKV2_AWS_51:Client certificate authentication not required for this use case
   #checkov:skip=CKV2_AWS_77:WAFv2 Web ACL is attached via aws_wafv2_web_acl_association when var.enable_waf is true (default) and includes AWSManagedRulesKnownBadInputsRuleSet for Log4j protection; Checkov does not track the association across modules
   deployment_id        = aws_api_gateway_deployment.api_deployment.id
@@ -518,9 +578,39 @@ resource "aws_api_gateway_stage" "api_stage" {
   stage_name           = "prod"
   xray_tracing_enabled = true
 
+  access_log_settings {
+    destination_arn = aws_cloudwatch_log_group.access_logs.arn
+    format = jsonencode({
+      requestId      = "$context.requestId"
+      ip             = "$context.identity.sourceIp"
+      caller         = "$context.identity.caller"
+      user           = "$context.identity.user"
+      requestTime    = "$context.requestTime"
+      httpMethod     = "$context.httpMethod"
+      resourcePath   = "$context.resourcePath"
+      status         = "$context.status"
+      protocol       = "$context.protocol"
+      responseLength = "$context.responseLength"
+    })
+  }
+
   tags = var.tags
 
-  depends_on = [aws_api_gateway_deployment.api_deployment]
+  # Ensure the account-level role is configured before the stage is created
+  depends_on = [aws_api_gateway_deployment.api_deployment, module.account]
+}
+
+# Default throttling applied to all resource paths and methods
+resource "aws_api_gateway_method_settings" "throttling" {
+  #checkov:skip=CKV_AWS_225:API Gateway caching not required for this use case
+  rest_api_id = module.rest_api.api_id
+  stage_name  = aws_api_gateway_stage.api_stage.stage_name
+  method_path = "*/*"
+
+  settings {
+    throttling_rate_limit  = 10000
+    throttling_burst_limit = 5000
+  }
 }
 
 # API Gateway Resource Policy

package/src/utils/api-constructs/files/terraform/core/api/http/http-api/http-api.tf.template

@@ -7,7 +7,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "<%- awsProviderVersion %>"
     }
   }
 }

package/src/utils/api-constructs/files/terraform/core/api/rest/api-gateway-account/api-gateway-account.tf.template

@@ -0,0 +1,83 @@
+# Account-level CloudWatch Logs role used by API Gateway REST APIs for access
+# logging. The setting is a singleton per region per account, so it is managed
+# idempotently: the role is set only when none is already configured (the first
+# deployment wins, others defer) and is never reset on destroy. This keeps
+# logging working across multiple deployments sharing an account.
+
+terraform {
+  required_version = ">= 1.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "<%- awsProviderVersion %>"
+    }
+  }
+}
+
+data "aws_region" "current" {}
+
+resource "aws_iam_role" "cloudwatch" {
+  name_prefix = "apigw-cloudwatch-"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "apigateway.amazonaws.com" }
+      Action    = "sts:AssumeRole"
+    }]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "cloudwatch" {
+  role       = aws_iam_role.cloudwatch.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs"
+}
+
+# Configures the account role on create/update only; destroying this resource is
+# a no-op, so teardown never disables logging for other REST APIs in the region.
+resource "terraform_data" "account" {
+  triggers_replace = [aws_iam_role.cloudwatch.arn]
+
+  provisioner "local-exec" {
+    command = "uv run --with boto3<%= boto3Version %> python -c \"$SCRIPT\""
+    environment = {
+      ROLE_ARN = aws_iam_role.cloudwatch.arn
+      REGION   = data.aws_region.current.region
+      SCRIPT   = <<-PY
+        import os, time, boto3
+        from botocore.exceptions import ClientError
+        apigw = boto3.client("apigateway", region_name=os.environ["REGION"])
+
+        def has_live_role():
+            arn = apigw.get_account().get("cloudwatchRoleArn")
+            if not arn:
+                return False
+            try:
+                boto3.client("iam").get_role(RoleName=arn.split("/")[-1])
+                return True
+            except ClientError as e:
+                if e.response["Error"]["Code"] == "NoSuchEntity":
+                    return False
+                raise
+
+        if not has_live_role():
+            op = {"op": "replace", "path": "/cloudwatchRoleArn", "value": os.environ["ROLE_ARN"]}
+            # Retry while the freshly created role propagates through IAM, and on throttling
+            retryable = ("BadRequestException", "TooManyRequestsException")
+            for attempt in range(12):
+                try:
+                    apigw.update_account(patchOperations=[op])
+                    break
+                except ClientError as e:
+                    if e.response["Error"]["Code"] in retryable and attempt < 11:
+                        time.sleep(5)
+                    else:
+                        raise
+      PY
+    }
+  }
+
+  depends_on = [aws_iam_role_policy_attachment.cloudwatch]
+}

package/src/utils/api-constructs/files/terraform/core/api/rest/rest-api/rest-api.tf.template

@@ -7,11 +7,11 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "<%- awsProviderVersion %>"
     }
     random = {
       source  = "hashicorp/random"
-      version = "~> 3.1"
+      version = "<%- randomProviderVersion %>"
     }
   }
 }
@@ -81,8 +81,6 @@ data "aws_caller_identity" "current" {}
 
 # Resources
 
-# Note: CloudWatch logging removed due to account-level CloudWatch Logs role ARN requirement
-
 # REST API Gateway
 resource "aws_api_gateway_rest_api" "rest_api" {
   name        = var.api_name
@@ -99,10 +97,8 @@ resource "aws_api_gateway_rest_api" "rest_api" {
   tags = var.tags
 }
 
-# Note: Deployment and stage are created in the consuming module (e.g., foo-api.tf)
-# after all methods and integrations are defined
-
-# Note: CloudWatch Log Group removed due to account-level CloudWatch Logs role ARN requirement
+# Note: Deployment, stage and access logging are created in the consuming module
+# (e.g., foo-api.tf) after all methods and integrations are defined
 
 # Gateway Response for CORS (4XX errors)
 resource "aws_api_gateway_gateway_response" "cors_4xx" {
@@ -260,6 +256,4 @@ output "waf_web_acl_arn" {
   value       = var.enable_waf ? aws_wafv2_web_acl.api_waf[0].arn : null
 }
 
-# Note: Stage and deployment outputs are provided by the consuming module
-
-# Note: CloudWatch log group outputs removed due to account-level CloudWatch Logs role ARN requirement
+# Note: Stage, deployment and access log outputs are provided by the consuming module

package/src/utils/api-constructs/open-api-metadata.d.ts

@@ -2,8 +2,8 @@
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
-import { Tree } from '@nx/devkit';
-import { Iac } from '../iac';
+import { type Tree } from '@nx/devkit';
+import type { Iac } from '../iac';
 export interface AddOpenApiMetadataGenerateTargetOptions {
     iac: Iac;
     apiNameKebabCase: string;

package/src/utils/api-constructs/open-api-metadata.js

@@ -1,27 +1,22 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.addSharedConstructsOpenApiMetadataGenerateTarget = void 0;
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */
-const devkit_1 = require("@nx/devkit");
-const git_1 = require("../git");
-const nx_1 = require("../nx");
-const shared_constructs_constants_1 = require("../shared-constructs-constants");
+ */ import { joinPathFragments, updateJson } from "@nx/devkit";
+import { updateGitIgnore } from "../git.js";
+import { addDependencyToTargetIfNotPresent } from "../nx.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR } from "../shared-constructs-constants.js";
 /**
  * Adds a generate:<api-name>-metadata target to shared constructs (CDK only)
  * This allows for API CDK constructs to have type-safety for integrations based on an OpenAPI Specification
- */
-const addSharedConstructsOpenApiMetadataGenerateTarget = (tree, { iac, apiNameKebabCase, specPath, specBuildTargetName, }) => {
+ */ export const addSharedConstructsOpenApiMetadataGenerateTarget = (tree, { iac, apiNameKebabCase, specPath, specBuildTargetName })=>{
     if (iac !== 'cdk') {
         // For Terraform, we do not support type-safe integration builders, rather only the single lambda
         // router pattern, and therefore do not need to add depenencies on metadata generation.
         return;
     }
-    const generatedMetadataDir = (0, devkit_1.joinPathFragments)('generated', apiNameKebabCase);
-    const generatedMetadataDirFromRoot = (0, devkit_1.joinPathFragments)((0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR), 'src', generatedMetadataDir);
-    (0, devkit_1.updateJson)(tree, (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'project.json'), (config) => {
+    const generatedMetadataDir = joinPathFragments('generated', apiNameKebabCase);
+    const generatedMetadataDirFromRoot = joinPathFragments(joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR), 'src', generatedMetadataDir);
+    updateJson(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'project.json'), (config)=>{
         if (!config.targets) {
             config.targets = {};
         }
@@ -37,26 +32,31 @@ const addSharedConstructsOpenApiMetadataGenerateTarget = (tree, { iac, apiNameKe
                 executor: 'nx:run-commands',
                 inputs: [
                     {
-                        dependentTasksOutputFiles: '**/*.json',
-                    },
+                        dependentTasksOutputFiles: '**/*.json'
+                    }
                 ],
                 outputs: [
-                    (0, devkit_1.joinPathFragments)('{workspaceRoot}', generatedMetadataDirFromRoot),
+                    joinPathFragments('{workspaceRoot}', generatedMetadataDirFromRoot)
                 ],
                 options: {
                     commands: [
-                        `nx g @aws/nx-plugin:open-api#ts-metadata --openApiSpecPath="${specPath}" --outputPath="${generatedMetadataDirFromRoot}" --no-interactive`,
-                    ],
+                        `nx g @aws/nx-plugin:open-api#ts-metadata --openApiSpecPath="${specPath}" --outputPath="${generatedMetadataDirFromRoot}" --no-interactive`
+                    ]
                 },
-                dependsOn: [specBuildTargetName],
+                dependsOn: [
+                    specBuildTargetName
+                ]
             };
         }
-        (0, nx_1.addDependencyToTargetIfNotPresent)(config, 'compile', metadataTargetName);
+        addDependencyToTargetIfNotPresent(config, 'compile', metadataTargetName);
         return config;
     });
     // Ignore the generated metadata by default
     // Users can safely remove the entry from the .gitignore if they prefer to check it in
-    (0, git_1.updateGitIgnore)(tree, (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR), (patterns) => [...patterns, (0, devkit_1.joinPathFragments)('src', generatedMetadataDir)]);
+    updateGitIgnore(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR), (patterns)=>[
+            ...patterns,
+            joinPathFragments('src', generatedMetadataDir)
+        ]);
 };
-exports.addSharedConstructsOpenApiMetadataGenerateTarget = addSharedConstructsOpenApiMetadataGenerateTarget;
+
 //# sourceMappingURL=open-api-metadata.js.map

package/src/utils/api-constructs/open-api-metadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"open-api-metadata.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/utils/api-constructs/open-api-metadata.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,uCAKoB;AAEpB,gCAAyC;AACzC,8BAA0D;AAC1D,gFAGwC;AASxC;;;GAGG;AACI,MAAM,gDAAgD,GAAG,CAC9D,IAAU,EACV,EACE,GAAG,EACH,gBAAgB,EAChB,QAAQ,EACR,mBAAmB,GACqB,EAC1C,EAAE;IACF,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAClB,iGAAiG;QACjG,uFAAuF;QACvF,OAAO;IACT,CAAC;IAED,MAAM,oBAAoB,GAAG,IAAA,0BAAiB,EAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IAC9E,MAAM,4BAA4B,GAAG,IAAA,0BAAiB,EACpD,IAAA,0BAAiB,EAAC,0CAAY,EAAE,mDAAqB,CAAC,EACtD,KAAK,EACL,oBAAoB,CACrB,CAAC;IAEF,IAAA,mBAAU,EACR,IAAI,EACJ,IAAA,0BAAiB,EAAC,0CAAY,EAAE,mDAAqB,EAAE,cAAc,CAAC,EACtE,CAAC,MAA4B,EAAE,EAAE;QAC/B,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,OAAO,GAAG,EAAE,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAC1B,MAAM,CAAC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC;QAC5B,CAAC;QACD,wFAAwF;QACxF,0CAA0C;QAC1C,MAAM,kBAAkB,GAAG,YAAY,gBAAgB,WAAW,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG;gBACnC,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,iBAAiB;gBAC3B,MAAM,EAAE;oBACN;wBACE,yBAAyB,EAAE,WAAW;qBACvC;iBACF;gBACD,OAAO,EAAE;oBACP,IAAA,0BAAiB,EAAC,iBAAiB,EAAE,4BAA4B,CAAC;iBACnE;gBACD,OAAO,EAAE;oBACP,QAAQ,EAAE;wBACR,+DAA+D,QAAQ,mBAAmB,4BAA4B,oBAAoB;qBAC3I;iBACF;gBACD,SAAS,EAAE,CAAC,mBAAmB,CAAC;aACjC,CAAC;QACJ,CAAC;QACD,IAAA,sCAAiC,EAAC,MAAM,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;QACzE,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;IAEF,2CAA2C;IAC3C,sFAAsF;IACtF,IAAA,qBAAe,EACb,IAAI,EACJ,IAAA,0BAAiB,EAAC,0CAAY,EAAE,mDAAqB,CAAC,EACtD,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAA,0BAAiB,EAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAC5E,CAAC;AACJ,CAAC,CAAC;AAnEW,QAAA,gDAAgD,oDAmE3D"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/api-constructs/open-api-metadata.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { updateGitIgnore } from '../git';\nimport type { Iac } from '../iac';\nimport { addDependencyToTargetIfNotPresent } from '../nx';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n} from '../shared-constructs-constants';\n\nexport interface AddOpenApiMetadataGenerateTargetOptions {\n  iac: Iac;\n  apiNameKebabCase: string;\n  specPath: string;\n  specBuildTargetName: string;\n}\n\n/**\n * Adds a generate:<api-name>-metadata target to shared constructs (CDK only)\n * This allows for API CDK constructs to have type-safety for integrations based on an OpenAPI Specification\n */\nexport const addSharedConstructsOpenApiMetadataGenerateTarget = (\n  tree: Tree,\n  {\n    iac,\n    apiNameKebabCase,\n    specPath,\n    specBuildTargetName,\n  }: AddOpenApiMetadataGenerateTargetOptions,\n) => {\n  if (iac !== 'cdk') {\n    // For Terraform, we do not support type-safe integration builders, rather only the single lambda\n    // router pattern, and therefore do not need to add depenencies on metadata generation.\n    return;\n  }\n\n  const generatedMetadataDir = joinPathFragments('generated', apiNameKebabCase);\n  const generatedMetadataDirFromRoot = joinPathFragments(\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR),\n    'src',\n    generatedMetadataDir,\n  );\n\n  updateJson(\n    tree,\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'project.json'),\n    (config: ProjectConfiguration) => {\n      if (!config.targets) {\n        config.targets = {};\n      }\n      if (!config.targets.build) {\n        config.targets.build = {};\n      }\n      // If not already defined, add a target to generate metadata from the OpenAPI spec, used\n      // for providing a type-safe CDK construct\n      const metadataTargetName = `generate:${apiNameKebabCase}-metadata`;\n      if (!config.targets[metadataTargetName]) {\n        config.targets[metadataTargetName] = {\n          cache: true,\n          executor: 'nx:run-commands',\n          inputs: [\n            {\n              dependentTasksOutputFiles: '**/*.json',\n            },\n          ],\n          outputs: [\n            joinPathFragments('{workspaceRoot}', generatedMetadataDirFromRoot),\n          ],\n          options: {\n            commands: [\n              `nx g @aws/nx-plugin:open-api#ts-metadata --openApiSpecPath=\"${specPath}\" --outputPath=\"${generatedMetadataDirFromRoot}\" --no-interactive`,\n            ],\n          },\n          dependsOn: [specBuildTargetName],\n        };\n      }\n      addDependencyToTargetIfNotPresent(config, 'compile', metadataTargetName);\n      return config;\n    },\n  );\n\n  // Ignore the generated metadata by default\n  // Users can safely remove the entry from the .gitignore if they prefer to check it in\n  updateGitIgnore(\n    tree,\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR),\n    (patterns) => [...patterns, joinPathFragments('src', generatedMetadataDir)],\n  );\n};\n"],"names":["joinPathFragments","updateJson","updateGitIgnore","addDependencyToTargetIfNotPresent","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","addSharedConstructsOpenApiMetadataGenerateTarget","tree","iac","apiNameKebabCase","specPath","specBuildTargetName","generatedMetadataDir","generatedMetadataDirFromRoot","config","targets","build","metadataTargetName","cache","executor","inputs","dependentTasksOutputFiles","outputs","options","commands","dependsOn","patterns"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,eAAe,QAAQ,YAAS;AAEzC,SAASC,iCAAiC,QAAQ,WAAQ;AAC1D,SACEC,YAAY,EACZC,qBAAqB,QAChB,oCAAiC;AASxC;;;CAGC,GACD,OAAO,MAAMC,mDAAmD,CAC9DC,MACA,EACEC,GAAG,EACHC,gBAAgB,EAChBC,QAAQ,EACRC,mBAAmB,EACqB;IAE1C,IAAIH,QAAQ,OAAO;QACjB,iGAAiG;QACjG,uFAAuF;QACvF;IACF;IAEA,MAAMI,uBAAuBZ,kBAAkB,aAAaS;IAC5D,MAAMI,+BAA+Bb,kBACnCA,kBAAkBI,cAAcC,wBAChC,OACAO;IAGFX,WACEM,MACAP,kBAAkBI,cAAcC,uBAAuB,iBACvD,CAACS;QACC,IAAI,CAACA,OAAOC,OAAO,EAAE;YACnBD,OAAOC,OAAO,GAAG,CAAC;QACpB;QACA,IAAI,CAACD,OAAOC,OAAO,CAACC,KAAK,EAAE;YACzBF,OAAOC,OAAO,CAACC,KAAK,GAAG,CAAC;QAC1B;QACA,wFAAwF;QACxF,0CAA0C;QAC1C,MAAMC,qBAAqB,CAAC,SAAS,EAAER,iBAAiB,SAAS,CAAC;QAClE,IAAI,CAACK,OAAOC,OAAO,CAACE,mBAAmB,EAAE;YACvCH,OAAOC,OAAO,CAACE,mBAAmB,GAAG;gBACnCC,OAAO;gBACPC,UAAU;gBACVC,QAAQ;oBACN;wBACEC,2BAA2B;oBAC7B;iBACD;gBACDC,SAAS;oBACPtB,kBAAkB,mBAAmBa;iBACtC;gBACDU,SAAS;oBACPC,UAAU;wBACR,CAAC,4DAA4D,EAAEd,SAAS,gBAAgB,EAAEG,6BAA6B,kBAAkB,CAAC;qBAC3I;gBACH;gBACAY,WAAW;oBAACd;iBAAoB;YAClC;QACF;QACAR,kCAAkCW,QAAQ,WAAWG;QACrD,OAAOH;IACT;IAGF,2CAA2C;IAC3C,sFAAsF;IACtFZ,gBACEK,MACAP,kBAAkBI,cAAcC,wBAChC,CAACqB,WAAa;eAAIA;YAAU1B,kBAAkB,OAAOY;SAAsB;AAE/E,EAAE"}

package/src/utils/ast/website.d.ts

@@ -1,4 +1,8 @@
-import { Tree } from '@nx/devkit';
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { Tree } from '@nx/devkit';
 export interface AddHookResultToRouterProviderContextProps {
     hook: string;
     module: string;

package/src/utils/ast/website.js

@@ -1,27 +1,25 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.addHookResultToRouterProviderContext = void 0;
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */
-const ast_1 = require("../ast");
-const addHookResultToRouterProviderContext = async (tree, mainTsxPath, { hook, module, contextProp }) => {
+ */ import { addDestructuredImport, applyGritQL, matchGritQL } from "../ast.js";
+export const addHookResultToRouterProviderContext = async (tree, mainTsxPath, { hook, module, contextProp })=>{
     // All 4 patterns must exist for this transform to apply
     const checks = await Promise.all([
-        (0, ast_1.matchGritQL)(tree, mainTsxPath, '`RouterProviderContext`'),
-        (0, ast_1.matchGritQL)(tree, mainTsxPath, '`createRouter($_)`'),
-        (0, ast_1.matchGritQL)(tree, mainTsxPath, '`const App = $_`'),
-        (0, ast_1.matchGritQL)(tree, mainTsxPath, '`<RouterProvider $_ />`'),
+        matchGritQL(tree, mainTsxPath, '`RouterProviderContext`'),
+        matchGritQL(tree, mainTsxPath, '`createRouter($_)`'),
+        matchGritQL(tree, mainTsxPath, '`const App = $_`'),
+        matchGritQL(tree, mainTsxPath, '`<RouterProvider $_ />`')
     ]);
-    if (checks.some((c) => !c)) {
+    if (checks.some((c)=>!c)) {
         return;
     }
-    await (0, ast_1.addDestructuredImport)(tree, mainTsxPath, [hook], module);
+    await addDestructuredImport(tree, mainTsxPath, [
+        hook
+    ], module);
     // 1. Add property to RouterProviderContext type
     //    'some' checks direct members only (not nested), so a nested 'auth' won't block adding a top-level one.
     //    Type members use ; as terminators, so += with leading \n handles separation.
-    await (0, ast_1.applyGritQL)(tree, mainTsxPath, `or {
+    await applyGritQL(tree, mainTsxPath, `or {
       \`type RouterProviderContext = {}\` => \`type RouterProviderContext = {
   ${contextProp}?: ReturnType<typeof ${hook}>;
 }\`,
@@ -34,25 +32,25 @@ ${contextProp}?: ReturnType<typeof ${hook}>\`
     // 2. Add context property to createRouter config
     //    'some' checks direct properties of the createRouter argument object only.
     //    Use += for multi-prop objects, => rewrite for single-prop.
-    await (0, ast_1.applyGritQL)(tree, mainTsxPath, `\`createRouter({ $props })\` where {
+    await applyGritQL(tree, mainTsxPath, `\`createRouter({ $props })\` where {
       $props <: not some \`context: $_\`,
       $props += \`context: { ${contextProp}: undefined }\`
     }`);
     // If context already exists, add the new prop to it.
     // Handle empty context: {} via nested contains => rewrite, scoped to createRouter.
-    await (0, ast_1.applyGritQL)(tree, mainTsxPath, `\`createRouter({ $props })\` where {
+    await applyGritQL(tree, mainTsxPath, `\`createRouter({ $props })\` where {
       $props <: contains \`context: {}\` => \`context: { ${contextProp}: undefined }\`
     }`);
     // Handle non-empty context via rewrite (the context object may be single-prop
     // from the first hook call, where += concatenates without comma)
-    await (0, ast_1.applyGritQL)(tree, mainTsxPath, `\`context: { $cprops }\` => \`context: { $cprops, ${contextProp}: undefined }\` where {
+    await applyGritQL(tree, mainTsxPath, `\`context: { $cprops }\` => \`context: { $cprops, ${contextProp}: undefined }\` where {
       $cprops <: within \`createRouter($_)\`,
       $cprops <: not some \`${contextProp}: $_\`
     }`);
     // 3. Add hook call to App component body
     //    Block body: 'some' checks direct statements.
     //    Expression body: 'contains' to also prevent matching block bodies.
-    await (0, ast_1.applyGritQL)(tree, mainTsxPath, `or {
+    await applyGritQL(tree, mainTsxPath, `or {
       \`const App = () => { $body }\` => raw\`const App = () => {
   const ${contextProp} = ${hook}();
   $body
@@ -64,15 +62,15 @@ ${contextProp}?: ReturnType<typeof ${hook}>\`
     }`);
     // 4. Add context prop to RouterProvider JSX element
     //    'some' checks direct JSX attributes only.
-    await (0, ast_1.applyGritQL)(tree, mainTsxPath, `or {
+    await applyGritQL(tree, mainTsxPath, `or {
       \`<RouterProvider $attrs context={{}} />\` => \`<RouterProvider $attrs context={{ ${contextProp} }} />\`,
       \`<RouterProvider $attrs context={{ $cprops }} />\` => \`<RouterProvider $attrs context={{ $cprops, ${contextProp} }} />\` where {
         $cprops <: not some \`${contextProp}\`
       },
       \`<RouterProvider $attrs />\` => \`<RouterProvider $attrs context={{ ${contextProp} }} />\` where {
-        $attrs <: not some \`context\`
+        $attrs <: not some \`context={$_}\`
       }
     }`);
 };
-exports.addHookResultToRouterProviderContext = addHookResultToRouterProviderContext;
+
 //# sourceMappingURL=website.js.map

package/src/utils/ast/website.js.map

@@ -1 +1 @@
-{"version":3,"file":"website.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/utils/ast/website.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,gCAAyE;AASlE,MAAM,oCAAoC,GAAG,KAAK,EACvD,IAAU,EACV,WAAmB,EACnB,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAA6C,EACxE,EAAE;IACF,wDAAwD;IACxD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/B,IAAA,iBAAW,EAAC,IAAI,EAAE,WAAW,EAAE,yBAAyB,CAAC;QACzD,IAAA,iBAAW,EAAC,IAAI,EAAE,WAAW,EAAE,oBAAoB,CAAC;QACpD,IAAA,iBAAW,EAAC,IAAI,EAAE,WAAW,EAAE,kBAAkB,CAAC;QAClD,IAAA,iBAAW,EAAC,IAAI,EAAE,WAAW,EAAE,yBAAyB,CAAC;KAC1D,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,MAAM,IAAA,2BAAqB,EAAC,IAAI,EAAE,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAE/D,gDAAgD;IAChD,4GAA4G;IAC5G,kFAAkF;IAClF,MAAM,IAAA,iBAAW,EACf,IAAI,EACJ,WAAW,EACX;;IAEA,WAAW,wBAAwB,IAAI;;;iCAGV,WAAW;;EAE1C,WAAW,wBAAwB,IAAI;;MAEnC,CACH,CAAC;IAEF,iDAAiD;IACjD,+EAA+E;IAC/E,gEAAgE;IAChE,MAAM,IAAA,iBAAW,EACf,IAAI,EACJ,WAAW,EACX;;+BAE2B,WAAW;MACpC,CACH,CAAC;IAEF,qDAAqD;IACrD,mFAAmF;IACnF,MAAM,IAAA,iBAAW,EACf,IAAI,EACJ,WAAW,EACX;2DACuD,WAAW;MAChE,CACH,CAAC;IACF,8EAA8E;IAC9E,iEAAiE;IACjE,MAAM,IAAA,iBAAW,EACf,IAAI,EACJ,WAAW,EACX,qDAAqD,WAAW;;8BAEtC,WAAW;MACnC,CACH,CAAC;IAEF,yCAAyC;IACzC,kDAAkD;IAClD,wEAAwE;IACxE,MAAM,IAAA,iBAAW,EACf,IAAI,EACJ,WAAW,EACX;;UAEM,WAAW,MAAM,IAAI;;wCAES,WAAW,MAAM,IAAI;;UAEnD,WAAW,MAAM,IAAI;;sCAEO,IAAI;MACpC,CACH,CAAC;IAEF,oDAAoD;IACpD,+CAA+C;IAC/C,MAAM,IAAA,iBAAW,EACf,IAAI,EACJ,WAAW,EACX;0FACsF,WAAW;4GACO,WAAW;gCACvF,WAAW;;6EAEkC,WAAW;;;MAGlF,CACH,CAAC;AACJ,CAAC,CAAC;AAtGW,QAAA,oCAAoC,wCAsG/C"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/ast/website.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nimport type { Tree } from '@nx/devkit';\nimport { addDestructuredImport, applyGritQL, matchGritQL } from '../ast';\n\nexport interface AddHookResultToRouterProviderContextProps {\n  hook: string; // eg useAuth\n  module: string; // eg. react-oidc-context\n  contextProp: string; // eg. auth\n}\n\nexport const addHookResultToRouterProviderContext = async (\n  tree: Tree,\n  mainTsxPath: string,\n  { hook, module, contextProp }: AddHookResultToRouterProviderContextProps,\n) => {\n  // All 4 patterns must exist for this transform to apply\n  const checks = await Promise.all([\n    matchGritQL(tree, mainTsxPath, '`RouterProviderContext`'),\n    matchGritQL(tree, mainTsxPath, '`createRouter($_)`'),\n    matchGritQL(tree, mainTsxPath, '`const App = $_`'),\n    matchGritQL(tree, mainTsxPath, '`<RouterProvider $_ />`'),\n  ]);\n\n  if (checks.some((c) => !c)) {\n    return;\n  }\n\n  await addDestructuredImport(tree, mainTsxPath, [hook], module);\n\n  // 1. Add property to RouterProviderContext type\n  //    'some' checks direct members only (not nested), so a nested 'auth' won't block adding a top-level one.\n  //    Type members use ; as terminators, so += with leading \\n handles separation.\n  await applyGritQL(\n    tree,\n    mainTsxPath,\n    `or {\n      \\`type RouterProviderContext = {}\\` => \\`type RouterProviderContext = {\n  ${contextProp}?: ReturnType<typeof ${hook}>;\n}\\`,\n      \\`type RouterProviderContext = { $members }\\` where {\n        $members <: not some \\`${contextProp}?: $_\\`,\n        $members += \\`\n${contextProp}?: ReturnType<typeof ${hook}>\\`\n      }\n    }`,\n  );\n\n  // 2. Add context property to createRouter config\n  //    'some' checks direct properties of the createRouter argument object only.\n  //    Use += for multi-prop objects, => rewrite for single-prop.\n  await applyGritQL(\n    tree,\n    mainTsxPath,\n    `\\`createRouter({ $props })\\` where {\n      $props <: not some \\`context: $_\\`,\n      $props += \\`context: { ${contextProp}: undefined }\\`\n    }`,\n  );\n\n  // If context already exists, add the new prop to it.\n  // Handle empty context: {} via nested contains => rewrite, scoped to createRouter.\n  await applyGritQL(\n    tree,\n    mainTsxPath,\n    `\\`createRouter({ $props })\\` where {\n      $props <: contains \\`context: {}\\` => \\`context: { ${contextProp}: undefined }\\`\n    }`,\n  );\n  // Handle non-empty context via rewrite (the context object may be single-prop\n  // from the first hook call, where += concatenates without comma)\n  await applyGritQL(\n    tree,\n    mainTsxPath,\n    `\\`context: { $cprops }\\` => \\`context: { $cprops, ${contextProp}: undefined }\\` where {\n      $cprops <: within \\`createRouter($_)\\`,\n      $cprops <: not some \\`${contextProp}: $_\\`\n    }`,\n  );\n\n  // 3. Add hook call to App component body\n  //    Block body: 'some' checks direct statements.\n  //    Expression body: 'contains' to also prevent matching block bodies.\n  await applyGritQL(\n    tree,\n    mainTsxPath,\n    `or {\n      \\`const App = () => { $body }\\` => raw\\`const App = () => {\n  const ${contextProp} = ${hook}();\n  $body\n}\\` where { $body <: not some \\`const ${contextProp} = ${hook}()\\` },\n      \\`const App = () => $expr\\` => raw\\`const App = () => {\n  const ${contextProp} = ${hook}();\n  return $expr;\n}\\` where { $expr <: not contains \\`${hook}()\\` }\n    }`,\n  );\n\n  // 4. Add context prop to RouterProvider JSX element\n  //    'some' checks direct JSX attributes only.\n  await applyGritQL(\n    tree,\n    mainTsxPath,\n    `or {\n      \\`<RouterProvider $attrs context={{}} />\\` => \\`<RouterProvider $attrs context={{ ${contextProp} }} />\\`,\n      \\`<RouterProvider $attrs context={{ $cprops }} />\\` => \\`<RouterProvider $attrs context={{ $cprops, ${contextProp} }} />\\` where {\n        $cprops <: not some \\`${contextProp}\\`\n      },\n      \\`<RouterProvider $attrs />\\` => \\`<RouterProvider $attrs context={{ ${contextProp} }} />\\` where {\n        $attrs <: not some \\`context={$_}\\`\n      }\n    }`,\n  );\n};\n"],"names":["addDestructuredImport","applyGritQL","matchGritQL","addHookResultToRouterProviderContext","tree","mainTsxPath","hook","module","contextProp","checks","Promise","all","some","c"],"mappings":"AAAA;;;CAGC,GAGD,SAASA,qBAAqB,EAAEC,WAAW,EAAEC,WAAW,QAAQ,YAAS;AAQzE,OAAO,MAAMC,uCAAuC,OAClDC,MACAC,aACA,EAAEC,IAAI,EAAEC,MAAM,EAAEC,WAAW,EAA6C;IAExE,wDAAwD;IACxD,MAAMC,SAAS,MAAMC,QAAQC,GAAG,CAAC;QAC/BT,YAAYE,MAAMC,aAAa;QAC/BH,YAAYE,MAAMC,aAAa;QAC/BH,YAAYE,MAAMC,aAAa;QAC/BH,YAAYE,MAAMC,aAAa;KAChC;IAED,IAAII,OAAOG,IAAI,CAAC,CAACC,IAAM,CAACA,IAAI;QAC1B;IACF;IAEA,MAAMb,sBAAsBI,MAAMC,aAAa;QAACC;KAAK,EAAEC;IAEvD,gDAAgD;IAChD,4GAA4G;IAC5G,kFAAkF;IAClF,MAAMN,YACJG,MACAC,aACA,CAAC;;EAEH,EAAEG,YAAY,qBAAqB,EAAEF,KAAK;;;+BAGb,EAAEE,YAAY;;AAE7C,EAAEA,YAAY,qBAAqB,EAAEF,KAAK;;KAErC,CAAC;IAGJ,iDAAiD;IACjD,+EAA+E;IAC/E,gEAAgE;IAChE,MAAML,YACJG,MACAC,aACA,CAAC;;6BAEwB,EAAEG,YAAY;KACtC,CAAC;IAGJ,qDAAqD;IACrD,mFAAmF;IACnF,MAAMP,YACJG,MACAC,aACA,CAAC;yDACoD,EAAEG,YAAY;KAClE,CAAC;IAEJ,8EAA8E;IAC9E,iEAAiE;IACjE,MAAMP,YACJG,MACAC,aACA,CAAC,kDAAkD,EAAEG,YAAY;;4BAEzC,EAAEA,YAAY;KACrC,CAAC;IAGJ,yCAAyC;IACzC,kDAAkD;IAClD,wEAAwE;IACxE,MAAMP,YACJG,MACAC,aACA,CAAC;;QAEG,EAAEG,YAAY,GAAG,EAAEF,KAAK;;sCAEM,EAAEE,YAAY,GAAG,EAAEF,KAAK;;QAEtD,EAAEE,YAAY,GAAG,EAAEF,KAAK;;oCAEI,EAAEA,KAAK;KACtC,CAAC;IAGJ,oDAAoD;IACpD,+CAA+C;IAC/C,MAAML,YACJG,MACAC,aACA,CAAC;wFACmF,EAAEG,YAAY;0GACI,EAAEA,YAAY;8BAC1F,EAAEA,YAAY;;2EAE+B,EAAEA,YAAY;;;KAGpF,CAAC;AAEN,EAAE"}

package/src/utils/ast.d.ts

@@ -2,7 +2,7 @@
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
-import { Tree } from '@nx/devkit';
+import type { Tree } from '@nx/devkit';
 export declare const addDestructuredImport: (tree: Tree, filePath: string, variableNames: string[], from: string) => Promise<void>;
 /**
  * Ensure a Python `from <module> import <name1>, <name2>, ...` statement
@@ -46,3 +46,35 @@ export declare const applyGritQL: (tree: Tree, filePath: string, pattern: string
  * straight through to QueryBuilder without any wrapping rewrite.
  */
 export declare const matchGritQL: (tree: Tree, filePath: string, pattern: string) => Promise<boolean>;
+/**
+ * Capture the source text of the first match of a GritQL pattern.
+ *
+ * For example `` `dependencyCheck: $_` `` returns the whole
+ * `dependencyCheck: { ... }` property text. Returns undefined if nothing
+ * matches. The file is not modified.
+ */
+export declare const captureGritQL: (tree: Tree, filePath: string, pattern: string) => Promise<string | undefined>;
+/**
+ * Return the text of every node matching the GritQL pattern, in document order.
+ */
+export declare const captureAllGritQL: (tree: Tree, filePath: string, pattern: string) => Promise<string[]>;
+/**
+ * A unique token that is a valid identifier, so it can stand in for an array
+ * element or object property inside a GritQL rewrite.
+ */
+export declare const GRIT_INSERT_PLACEHOLDER = "__GRIT_INSERT_PLACEHOLDER__";
+/**
+ * Apply a GritQL rewrite that inserts {@link GRIT_INSERT_PLACEHOLDER}, then
+ * replace the placeholder with `text`. Routing user-provided text through a
+ * placeholder keeps it out of the GritQL pattern, where quotes, backticks or
+ * `${...}` would otherwise break parsing.
+ *
+ * Any separator (e.g. a leading `, ` when appending to an array) must be part
+ * of the GritQL pattern, not `text`. The one adjustment made here: if the
+ * placeholder lands after a trailing line comment (`// ...`) — which would
+ * comment out the text — the text is moved to its own line.
+ *
+ * The caller formats afterwards. Returns true if the pattern matched and the
+ * file changed.
+ */
+export declare const insertViaGritQL: (tree: Tree, filePath: string, pattern: string, text: string) => Promise<boolean>;