@aws/nx-plugin 1.0.0-rc.57 → 1.0.0-rc.59

package/src/migrations/latest/user-identity-waf-allow-localhost-callback/migration.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/user-identity-waf-allow-localhost-callback/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { MigrationReturnObject, Tree } from '@nx/devkit';\nimport { applyGritQL, matchGritQL } from '../../../utils/ast';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants';\n\n/**\n * Count the EC2MetaDataSSRF_QUERYARGUMENTS WAF rule on the UserIdentity Web ACL\n *\n * `AWSManagedRulesCommonRuleSet` treats the loopback `redirect_uri` the Cognito\n * Hosted UI receives during local sign-in as an SSRF attempt, so sign-in against\n * a local dev server fails with an opaque 403 before the login page renders. The\n * rule is overridden to Count while a local callback URL is allowed; every other\n * rule in the group still blocks.\n *\n * The local callback URLs are lifted into a named constant so the override can be\n * derived from them rather than restating the condition.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n *\n * Guardrails:\n * - Pattern-match before writing: skip files that have diverged from the shape\n *   your generators produce and report them via `nextSteps`, rather than\n *   clobbering the user's changes.\n * - Idempotent: re-running must be a no-op.\n * - Format what you write: finish with `formatFilesInSubtree` so the files your\n *   migration wrote are formatted correctly.\n */\n\nconst CDK_USER_IDENTITY_FILE = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/user-identity.ts`;\nconst TERRAFORM_IDENTITY_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/user-identity/identity/identity.tf`;\n\nconst SSRF_RULE_NAME = 'EC2MetaDataSSRF_QUERYARGUMENTS';\n\n// Guards each file: present only once the override has been added.\nconst CDK_MIGRATED_PATTERN = `\\`ruleActionOverrides: allowsLocalCallback ? $_ : undefined\\``;\nconst TERRAFORM_MIGRATED_PATTERN = `language hcl\\n\\`name = \"${SSRF_RULE_NAME}\"\\``;\n\n// Every CDK edit site, matched structurally so formatting doesn't affect whether\n// the construct is recognised.\nconst CDK_CONSTANT_ANCHOR_PATTERN = \"`const WEB_CLIENT_ID = 'WebClient'`\";\n// Scoped to the `.concat` callsite so it can't also rewrite the array literal\n// inside the constant this migration inserts.\nconst CDK_LOCAL_URLS_PATTERN =\n  \"`['http://localhost:4200', 'http://localhost:4300'].concat($rest)`\";\nconst CDK_CALL_PATTERN = '`this.createWebAcl($id, this.userPool)`';\nconst CDK_SIGNATURE_PATTERN =\n  '`private createWebAcl = ($id: string, $pool: UserPool) => $body`';\nconst CDK_STATEMENT_PATTERN =\n  \"`managedRuleGroupStatement: { name: 'AWSManagedRulesCommonRuleSet', vendorName: 'AWS' }`\";\n\nconst CDK_EDITS: Array<[string, string]> = [\n  // Local callback URLs become a named constant the override can key off.\n  [\n    CDK_CONSTANT_ANCHOR_PATTERN,\n    `${CDK_CONSTANT_ANCHOR_PATTERN} => \\`const WEB_CLIENT_ID = 'WebClient';\n\n/** Local dev server origins permitted to complete the sign-in redirect */\nconst LOCAL_CALLBACK_URLS = ['http://localhost:4200', 'http://localhost:4300']\\``,\n  ],\n  [\n    CDK_LOCAL_URLS_PATTERN,\n    `${CDK_LOCAL_URLS_PATTERN} => \\`LOCAL_CALLBACK_URLS.concat($rest)\\``,\n  ],\n  [\n    CDK_CALL_PATTERN,\n    `${CDK_CALL_PATTERN} => \\`this.createWebAcl($id, this.userPool, LOCAL_CALLBACK_URLS.length > 0)\\``,\n  ],\n  [\n    CDK_SIGNATURE_PATTERN,\n    `${CDK_SIGNATURE_PATTERN} => \\`private createWebAcl = (\n    $id: string,\n    $pool: UserPool,\n    allowsLocalCallback: boolean\n  ) => $body\\``,\n  ],\n  [\n    CDK_STATEMENT_PATTERN,\n    `${CDK_STATEMENT_PATTERN} => \\`managedRuleGroupStatement: {\n              name: 'AWSManagedRulesCommonRuleSet',\n              vendorName: 'AWS',\n              // ${SSRF_RULE_NAME} treats the loopback redirect_uri the\n              // Hosted UI receives during local sign-in as an SSRF attempt. Counted\n              // only while a local callback URL is allowed; every other rule blocks.\n              ruleActionOverrides: allowsLocalCallback\n                ? [\n                    {\n                      name: '${SSRF_RULE_NAME}',\n                      actionToUse: { count: {} },\n                    },\n                  ]\n                : undefined,\n            }\\``,\n  ],\n];\n\nconst TERRAFORM_DATA_SOURCES_PATTERN = [\n  'language hcl',\n  '`data \"aws_region\" \"current\" {}`',\n].join('\\n');\n\nconst TERRAFORM_EDITS: Array<[string, string]> = [\n  // Local callback URLs become a local the override can key off.\n  [\n    TERRAFORM_DATA_SOURCES_PATTERN,\n    [\n      'language hcl',\n      '`data \"aws_region\" \"current\" {}` => `data \"aws_region\" \"current\" {}',\n      '',\n      'locals {',\n      '  # Local dev server origins permitted to complete the sign-in redirect',\n      '  local_callback_urls = [',\n      '    \"http://localhost:4200\",',\n      '    \"http://localhost:4300\"',\n      '  ]',\n      '}`',\n    ].join('\\n'),\n  ],\n  [\n    [\n      'language hcl',\n      '`callback_urls = concat([',\n      '    \"http://localhost:4200\",',\n      '    \"http://localhost:4300\"',\n      '  ], var.callback_urls)`',\n    ].join('\\n'),\n    [\n      'language hcl',\n      '`callback_urls = concat([',\n      '    \"http://localhost:4200\",',\n      '    \"http://localhost:4300\"',\n      '  ], var.callback_urls)` => `callback_urls = concat(local.local_callback_urls, var.callback_urls)`',\n    ].join('\\n'),\n  ],\n  [\n    [\n      'language hcl',\n      '`logout_urls = concat([',\n      '    \"http://localhost:4200\",',\n      '    \"http://localhost:4300\"',\n      '  ], var.logout_urls)`',\n    ].join('\\n'),\n    [\n      'language hcl',\n      '`logout_urls = concat([',\n      '    \"http://localhost:4200\",',\n      '    \"http://localhost:4300\"',\n      '  ], var.logout_urls)` => `logout_urls = concat(local.local_callback_urls, var.logout_urls)`',\n    ].join('\\n'),\n  ],\n  [\n    [\n      'language hcl',\n      '`managed_rule_group_statement {',\n      '        name        = \"AWSManagedRulesCommonRuleSet\"',\n      '        vendor_name = \"AWS\"',\n      '      }`',\n    ].join('\\n'),\n    [\n      'language hcl',\n      '`managed_rule_group_statement {',\n      '        name        = \"AWSManagedRulesCommonRuleSet\"',\n      '        vendor_name = \"AWS\"',\n      '      }` => `managed_rule_group_statement {',\n      '        name        = \"AWSManagedRulesCommonRuleSet\"',\n      '        vendor_name = \"AWS\"',\n      '',\n      `        # ${SSRF_RULE_NAME} treats the loopback redirect_uri the`,\n      '        # Hosted UI receives during local sign-in as an SSRF attempt. Counted',\n      '        # only while a local callback URL is allowed; every other rule blocks.',\n      '        dynamic \"rule_action_override\" {',\n      '          for_each = length(local.local_callback_urls) > 0 ? [1] : []',\n      '',\n      '          content {',\n      `            name = \"${SSRF_RULE_NAME}\"`,\n      '',\n      '            action_to_use {',\n      '              count {}',\n      '            }',\n      '          }',\n      '        }',\n      '      }`',\n    ].join('\\n'),\n  ],\n];\n\nconst divergedNextStep = (filePath: string) =>\n  `${filePath}: the UserIdentity Web ACL has diverged from the generated shape - left untouched. To sign in against a local dev server, override ${SSRF_RULE_NAME} in the AWSManagedRulesCommonRuleSet rule group to Count, otherwise the Cognito Hosted UI returns 403 for localhost redirect URIs.`;\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [filePath, migratedPattern, edits] of [\n    [CDK_USER_IDENTITY_FILE, CDK_MIGRATED_PATTERN, CDK_EDITS],\n    [TERRAFORM_IDENTITY_FILE, TERRAFORM_MIGRATED_PATTERN, TERRAFORM_EDITS],\n  ] as const) {\n    if (!tree.exists(filePath)) {\n      // This workspace doesn't use this IaC provider, or has no UserIdentity.\n      continue;\n    }\n\n    if (await matchGritQL(tree, filePath, migratedPattern)) {\n      // Already migrated - silent skip keeps re-runs a no-op.\n      continue;\n    }\n\n    // Confirm every edit site is present before writing any of them, so a file\n    // that only partly matches is left whole rather than half-edited.\n    const allSitesPresent = (\n      await Promise.all(\n        edits.map(([match]) => matchGritQL(tree, filePath, match)),\n      )\n    ).every(Boolean);\n\n    if (!allSitesPresent) {\n      nextSteps.push(divergedNextStep(filePath));\n      continue;\n    }\n\n    for (const [, rewrite] of edits) {\n      await applyGritQL(tree, filePath, rewrite);\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["applyGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","CDK_USER_IDENTITY_FILE","TERRAFORM_IDENTITY_FILE","SSRF_RULE_NAME","CDK_MIGRATED_PATTERN","TERRAFORM_MIGRATED_PATTERN","CDK_CONSTANT_ANCHOR_PATTERN","CDK_LOCAL_URLS_PATTERN","CDK_CALL_PATTERN","CDK_SIGNATURE_PATTERN","CDK_STATEMENT_PATTERN","CDK_EDITS","TERRAFORM_DATA_SOURCES_PATTERN","join","TERRAFORM_EDITS","divergedNextStep","filePath","migration","tree","nextSteps","migratedPattern","edits","exists","allSitesPresent","Promise","all","map","match","every","Boolean","push","rewrite"],"mappings":"AAAA;;;CAGC,GAED,SAASA,WAAW,EAAEC,WAAW,QAAQ,wBAAqB;AAC9D,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,gDAA6C;AAEpD;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GAED,MAAMC,yBAAyB,GAAGH,aAAa,CAAC,EAAEC,sBAAsB,0BAA0B,CAAC;AACnG,MAAMG,0BAA0B,GAAGJ,aAAa,CAAC,EAAEE,qBAAqB,4CAA4C,CAAC;AAErH,MAAMG,iBAAiB;AAEvB,mEAAmE;AACnE,MAAMC,uBAAuB,CAAC,6DAA6D,CAAC;AAC5F,MAAMC,6BAA6B,CAAC,wBAAwB,EAAEF,eAAe,GAAG,CAAC;AAEjF,iFAAiF;AACjF,+BAA+B;AAC/B,MAAMG,8BAA8B;AACpC,8EAA8E;AAC9E,8CAA8C;AAC9C,MAAMC,yBACJ;AACF,MAAMC,mBAAmB;AACzB,MAAMC,wBACJ;AACF,MAAMC,wBACJ;AAEF,MAAMC,YAAqC;IACzC,wEAAwE;IACxE;QACEL;QACA,GAAGA,4BAA4B;;;gFAG6C,CAAC;KAC9E;IACD;QACEC;QACA,GAAGA,uBAAuB,yCAAyC,CAAC;KACrE;IACD;QACEC;QACA,GAAGA,iBAAiB,6EAA6E,CAAC;KACnG;IACD;QACEC;QACA,GAAGA,sBAAsB;;;;cAIf,CAAC;KACZ;IACD;QACEC;QACA,GAAGA,sBAAsB;;;iBAGZ,EAAEP,eAAe;;;;;;6BAML,EAAEA,eAAe;;;;;eAK/B,CAAC;KACb;CACF;AAED,MAAMS,iCAAiC;IACrC;IACA;CACD,CAACC,IAAI,CAAC;AAEP,MAAMC,kBAA2C;IAC/C,+DAA+D;IAC/D;QACEF;QACA;YACE;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA;SACD,CAACC,IAAI,CAAC;KACR;IACD;QACE;YACE;YACA;YACA;YACA;YACA;SACD,CAACA,IAAI,CAAC;QACP;YACE;YACA;YACA;YACA;YACA;SACD,CAACA,IAAI,CAAC;KACR;IACD;QACE;YACE;YACA;YACA;YACA;YACA;SACD,CAACA,IAAI,CAAC;QACP;YACE;YACA;YACA;YACA;YACA;SACD,CAACA,IAAI,CAAC;KACR;IACD;QACE;YACE;YACA;YACA;YACA;YACA;SACD,CAACA,IAAI,CAAC;QACP;YACE;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA,CAAC,UAAU,EAAEV,eAAe,qCAAqC,CAAC;YAClE;YACA;YACA;YACA;YACA;YACA;YACA,CAAC,oBAAoB,EAAEA,eAAe,CAAC,CAAC;YACxC;YACA;YACA;YACA;YACA;YACA;YACA;SACD,CAACU,IAAI,CAAC;KACR;CACF;AAED,MAAME,mBAAmB,CAACC,WACxB,GAAGA,SAAS,mIAAmI,EAAEb,eAAe,kIAAkI,CAAC;AAErS,eAAe,eAAec,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACH,UAAUI,iBAAiBC,MAAM,IAAI;QAC/C;YAACpB;YAAwBG;YAAsBO;SAAU;QACzD;YAACT;YAAyBG;YAA4BS;SAAgB;KACvE,CAAW;QACV,IAAI,CAACI,KAAKI,MAAM,CAACN,WAAW;YAE1B;QACF;QAEA,IAAI,MAAMpB,YAAYsB,MAAMF,UAAUI,kBAAkB;YAEtD;QACF;QAEA,2EAA2E;QAC3E,kEAAkE;QAClE,MAAMG,kBAAkB,AACtB,CAAA,MAAMC,QAAQC,GAAG,CACfJ,MAAMK,GAAG,CAAC,CAAC,CAACC,MAAM,GAAK/B,YAAYsB,MAAMF,UAAUW,QACrD,EACAC,KAAK,CAACC;QAER,IAAI,CAACN,iBAAiB;YACpBJ,UAAUW,IAAI,CAACf,iBAAiBC;YAChC;QACF;QAEA,KAAK,MAAM,GAAGe,QAAQ,IAAIV,MAAO;YAC/B,MAAM1B,YAAYuB,MAAMF,UAAUe;QACpC;IACF;IAEA,MAAMlC,qBAAqBqB;IAE3B,OAAO;QAAEC;IAAU;AACrB"}