@aws/nx-plugin 1.0.0-rc.6 → 1.0.0-rc.60

package/src/migrations/v1.0.0-rc.54/order-access-log-delivery-after-bucket-policy/migration.js

@@ -0,0 +1,93 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { addDestructuredImport, applyGritQL, captureGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Order the S3 server access log delivery source after the bucket policy.
+ *
+ * S3 rejects concurrent configuration writes against the same bucket with a 409
+ * (OperationAborted). The generated StaticWebsite construct left the delivery
+ * source and the bucket policy unordered, so CloudFormation could submit both at
+ * once and fail the stack.
+ */ const STATIC_WEBSITE_FILE = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/static-website.ts`;
+const BUCKET_ARN_SUFFIX = '.bucketArn';
+/**
+ * The bucket whose policy the delivery source must be ordered after is the one
+ * the delivery source itself targets, so read it off `resourceArn` rather than
+ * assuming the generated parameter name. Returns undefined unless exactly one
+ * simple identifier is found, so a diverged helper is left alone.
+ */ const findDeliverySourceBucket = async (tree, filePath)=>{
+    const captured = await captureGritQL(tree, filePath, '`resourceArn: $bucket.bucketArn`');
+    if (!captured) return undefined;
+    const bucket = captured.slice(captured.indexOf(':') + 1).replace(BUCKET_ARN_SUFFIX, '').trim();
+    // Only a plain identifier can be cast and dereferenced safely in the
+    // statement this migration writes.
+    return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(bucket) ? bucket : undefined;
+};
+/**
+ * Confirm the bucket the delivery source targets is declared as a parameter of
+ * the enclosing helper, so the statement this migration writes references a
+ * variable that is actually in scope.
+ */ const isBucketDeclaredParameter = async (tree, filePath, bucket)=>await matchGritQL(tree, filePath, `\`private deliverAccessLogsToCloudWatch($params) { $_ }\` where {
+      $params <: contains \`${bucket}: $bucketType\`,
+      $bucketType <: or { \`IBucket\`, \`Bucket\` }
+    }`);
+// Inserts the bucket policy dependency between the delivery source and the
+// delivery destination, matching the shape generators produced prior to this
+// fix. Anchored on the destination declaration so the source's own (multi-line,
+// Lazy-valued) arguments don't need to be matched.
+const addDependencyPattern = (bucket)=>`\`const $dest: CfnDeliveryDestination = new CfnDeliveryDestination($destArgs)\` as $decl where {
+  $dest <: \`destination\`
+} => \`const bucketPolicy = (${bucket} as Bucket).policy;
+    if (bucketPolicy) {
+      source.node.addDependency(bucketPolicy);
+    }
+    $decl\``;
+export default async function migration(tree) {
+    const nextSteps = [];
+    if (!tree.exists(STATIC_WEBSITE_FILE)) {
+        // No vended StaticWebsite construct in this workspace - nothing to migrate.
+        return {
+            nextSteps
+        };
+    }
+    const contents = tree.read(STATIC_WEBSITE_FILE, 'utf-8') ?? '';
+    if (contents.includes('source.node.addDependency(bucketPolicy)')) {
+        // Already migrated.
+        return {
+            nextSteps
+        };
+    }
+    const divergedMessage = `${STATIC_WEBSITE_FILE}: deliverAccessLogsToCloudWatch has diverged from the generated shape - left untouched. Manually order the S3 server access log delivery source after the bucket policy of the bucket it targets (\`source.node.addDependency(bucketPolicy)\`), avoiding a 409 (OperationAborted) from concurrent bucket configuration writes.`;
+    // The rewrite is anchored on the delivery destination but references the
+    // `source` variable, so only apply it when the delivery source still has the
+    // generated shape.
+    const hasGeneratedSource = await matchGritQL(tree, STATIC_WEBSITE_FILE, '`const source: CfnDeliverySource = new CfnDeliverySource($_)`');
+    const bucket = hasGeneratedSource ? await findDeliverySourceBucket(tree, STATIC_WEBSITE_FILE) : undefined;
+    if (!bucket || !await isBucketDeclaredParameter(tree, STATIC_WEBSITE_FILE, bucket)) {
+        nextSteps.push(divergedMessage);
+        return {
+            nextSteps
+        };
+    }
+    const rewrote = await applyGritQL(tree, STATIC_WEBSITE_FILE, addDependencyPattern(bucket));
+    if (!rewrote) {
+        nextSteps.push(divergedMessage);
+        return {
+            nextSteps
+        };
+    }
+    // The inserted statement casts to the concrete Bucket to reach its policy,
+    // which the helper's own `IBucket` parameter type does not expose.
+    await addDestructuredImport(tree, STATIC_WEBSITE_FILE, [
+        'Bucket'
+    ], 'aws-cdk-lib/aws-s3');
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.54/order-access-log-delivery-after-bucket-policy/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.54/order-access-log-delivery-after-bucket-policy/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { MigrationReturnObject, Tree } from '@nx/devkit';\nimport {\n  addDestructuredImport,\n  applyGritQL,\n  captureGritQL,\n  matchGritQL,\n} from '../../../utils/ast';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n} from '../../../utils/shared-constructs-constants';\n\n/**\n * Order the S3 server access log delivery source after the bucket policy.\n *\n * S3 rejects concurrent configuration writes against the same bucket with a 409\n * (OperationAborted). The generated StaticWebsite construct left the delivery\n * source and the bucket policy unordered, so CloudFormation could submit both at\n * once and fail the stack.\n */\n\nconst STATIC_WEBSITE_FILE = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/static-website.ts`;\n\nconst BUCKET_ARN_SUFFIX = '.bucketArn';\n\n/**\n * The bucket whose policy the delivery source must be ordered after is the one\n * the delivery source itself targets, so read it off `resourceArn` rather than\n * assuming the generated parameter name. Returns undefined unless exactly one\n * simple identifier is found, so a diverged helper is left alone.\n */\nconst findDeliverySourceBucket = async (\n  tree: Tree,\n  filePath: string,\n): Promise<string | undefined> => {\n  const captured = await captureGritQL(\n    tree,\n    filePath,\n    '`resourceArn: $bucket.bucketArn`',\n  );\n  if (!captured) return undefined;\n\n  const bucket = captured\n    .slice(captured.indexOf(':') + 1)\n    .replace(BUCKET_ARN_SUFFIX, '')\n    .trim();\n\n  // Only a plain identifier can be cast and dereferenced safely in the\n  // statement this migration writes.\n  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(bucket) ? bucket : undefined;\n};\n\n/**\n * Confirm the bucket the delivery source targets is declared as a parameter of\n * the enclosing helper, so the statement this migration writes references a\n * variable that is actually in scope.\n */\nconst isBucketDeclaredParameter = async (\n  tree: Tree,\n  filePath: string,\n  bucket: string,\n): Promise<boolean> =>\n  await matchGritQL(\n    tree,\n    filePath,\n    `\\`private deliverAccessLogsToCloudWatch($params) { $_ }\\` where {\n      $params <: contains \\`${bucket}: $bucketType\\`,\n      $bucketType <: or { \\`IBucket\\`, \\`Bucket\\` }\n    }`,\n  );\n\n// Inserts the bucket policy dependency between the delivery source and the\n// delivery destination, matching the shape generators produced prior to this\n// fix. Anchored on the destination declaration so the source's own (multi-line,\n// Lazy-valued) arguments don't need to be matched.\nconst addDependencyPattern = (bucket: string) =>\n  `\\`const $dest: CfnDeliveryDestination = new CfnDeliveryDestination($destArgs)\\` as $decl where {\n  $dest <: \\`destination\\`\n} => \\`const bucketPolicy = (${bucket} as Bucket).policy;\n    if (bucketPolicy) {\n      source.node.addDependency(bucketPolicy);\n    }\n    $decl\\``;\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (!tree.exists(STATIC_WEBSITE_FILE)) {\n    // No vended StaticWebsite construct in this workspace - nothing to migrate.\n    return { nextSteps };\n  }\n\n  const contents = tree.read(STATIC_WEBSITE_FILE, 'utf-8') ?? '';\n  if (contents.includes('source.node.addDependency(bucketPolicy)')) {\n    // Already migrated.\n    return { nextSteps };\n  }\n\n  const divergedMessage = `${STATIC_WEBSITE_FILE}: deliverAccessLogsToCloudWatch has diverged from the generated shape - left untouched. Manually order the S3 server access log delivery source after the bucket policy of the bucket it targets (\\`source.node.addDependency(bucketPolicy)\\`), avoiding a 409 (OperationAborted) from concurrent bucket configuration writes.`;\n\n  // The rewrite is anchored on the delivery destination but references the\n  // `source` variable, so only apply it when the delivery source still has the\n  // generated shape.\n  const hasGeneratedSource = await matchGritQL(\n    tree,\n    STATIC_WEBSITE_FILE,\n    '`const source: CfnDeliverySource = new CfnDeliverySource($_)`',\n  );\n\n  const bucket = hasGeneratedSource\n    ? await findDeliverySourceBucket(tree, STATIC_WEBSITE_FILE)\n    : undefined;\n\n  if (\n    !bucket ||\n    !(await isBucketDeclaredParameter(tree, STATIC_WEBSITE_FILE, bucket))\n  ) {\n    nextSteps.push(divergedMessage);\n    return { nextSteps };\n  }\n\n  const rewrote = await applyGritQL(\n    tree,\n    STATIC_WEBSITE_FILE,\n    addDependencyPattern(bucket),\n  );\n\n  if (!rewrote) {\n    nextSteps.push(divergedMessage);\n    return { nextSteps };\n  }\n\n  // The inserted statement casts to the concrete Bucket to reach its policy,\n  // which the helper's own `IBucket` parameter type does not expose.\n  await addDestructuredImport(\n    tree,\n    STATIC_WEBSITE_FILE,\n    ['Bucket'],\n    'aws-cdk-lib/aws-s3',\n  );\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["addDestructuredImport","applyGritQL","captureGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","STATIC_WEBSITE_FILE","BUCKET_ARN_SUFFIX","findDeliverySourceBucket","tree","filePath","captured","undefined","bucket","slice","indexOf","replace","trim","test","isBucketDeclaredParameter","addDependencyPattern","migration","nextSteps","exists","contents","read","includes","divergedMessage","hasGeneratedSource","push","rewrote"],"mappings":"AAAA;;;CAGC,GAED,SACEA,qBAAqB,EACrBC,WAAW,EACXC,aAAa,EACbC,WAAW,QACN,wBAAqB;AAC5B,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SACEC,YAAY,EACZC,qBAAqB,QAChB,gDAA6C;AAEpD;;;;;;;CAOC,GAED,MAAMC,sBAAsB,GAAGF,aAAa,CAAC,EAAEC,sBAAsB,2BAA2B,CAAC;AAEjG,MAAME,oBAAoB;AAE1B;;;;;CAKC,GACD,MAAMC,2BAA2B,OAC/BC,MACAC;IAEA,MAAMC,WAAW,MAAMV,cACrBQ,MACAC,UACA;IAEF,IAAI,CAACC,UAAU,OAAOC;IAEtB,MAAMC,SAASF,SACZG,KAAK,CAACH,SAASI,OAAO,CAAC,OAAO,GAC9BC,OAAO,CAACT,mBAAmB,IAC3BU,IAAI;IAEP,qEAAqE;IACrE,mCAAmC;IACnC,OAAO,6BAA6BC,IAAI,CAACL,UAAUA,SAASD;AAC9D;AAEA;;;;CAIC,GACD,MAAMO,4BAA4B,OAChCV,MACAC,UACAG,SAEA,MAAMX,YACJO,MACAC,UACA,CAAC;4BACuB,EAAEG,OAAO;;KAEhC,CAAC;AAGN,2EAA2E;AAC3E,6EAA6E;AAC7E,gFAAgF;AAChF,mDAAmD;AACnD,MAAMO,uBAAuB,CAACP,SAC5B,CAAC;;6BAE0B,EAAEA,OAAO;;;;WAI3B,CAAC;AAEZ,eAAe,eAAeQ,UAC5BZ,IAAU;IAEV,MAAMa,YAAsB,EAAE;IAE9B,IAAI,CAACb,KAAKc,MAAM,CAACjB,sBAAsB;QACrC,4EAA4E;QAC5E,OAAO;YAAEgB;QAAU;IACrB;IAEA,MAAME,WAAWf,KAAKgB,IAAI,CAACnB,qBAAqB,YAAY;IAC5D,IAAIkB,SAASE,QAAQ,CAAC,4CAA4C;QAChE,oBAAoB;QACpB,OAAO;YAAEJ;QAAU;IACrB;IAEA,MAAMK,kBAAkB,GAAGrB,oBAAoB,8TAA8T,CAAC;IAE9W,yEAAyE;IACzE,6EAA6E;IAC7E,mBAAmB;IACnB,MAAMsB,qBAAqB,MAAM1B,YAC/BO,MACAH,qBACA;IAGF,MAAMO,SAASe,qBACX,MAAMpB,yBAAyBC,MAAMH,uBACrCM;IAEJ,IACE,CAACC,UACD,CAAE,MAAMM,0BAA0BV,MAAMH,qBAAqBO,SAC7D;QACAS,UAAUO,IAAI,CAACF;QACf,OAAO;YAAEL;QAAU;IACrB;IAEA,MAAMQ,UAAU,MAAM9B,YACpBS,MACAH,qBACAc,qBAAqBP;IAGvB,IAAI,CAACiB,SAAS;QACZR,UAAUO,IAAI,CAACF;QACf,OAAO;YAAEL;QAAU;IACrB;IAEA,2EAA2E;IAC3E,mEAAmE;IACnE,MAAMvB,sBACJU,MACAH,qBACA;QAAC;KAAS,EACV;IAGF,MAAMH,qBAAqBM;IAE3B,OAAO;QAAEa;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.55/backfill-generator-metadata/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Backfill the project metadata the version sync reads, recovered from the files the generators left behind"
+}

package/src/migrations/v1.0.0-rc.55/backfill-generator-metadata/migration.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type ProjectConfiguration, type Tree } from '@nx/devkit';
+import type { ComponentMetadata } from '../../../utils/nx';
+/** Metadata as a project records it, over the fields this backfill reads. */
+interface ProjectMetadata {
+    generator?: string;
+    components?: ComponentMetadata[];
+    iac?: string;
+    smithyType?: string;
+    namespace?: string;
+    tailwind?: boolean;
+    tanstackRouter?: boolean;
+    [key: string]: unknown;
+}
+/**
+ * A connection generator, and how to recognise a run of it.
+ *
+ * A connection is found from the source component it was made from and the target
+ * it reaches: `evidence` is a check that only passes if that exact pair was wired
+ * up — a client import named after the target, a vended file named after it, or
+ * the dev-target dependency on its project. So `name` and `sourcePath` are
+ * recovered facts rather than guesses.
+ *
+ * Every connection generator is listed, including those that add no dependencies
+ * today. The sync reads the metadata rather than the generator, so recording a
+ * connection now is what lets it be picked up the moment its generator starts
+ * owning packages — a later release would otherwise need another backfill.
+ */
+interface ConnectionKind {
+    /** The generator id to record. */
+    readonly id: string;
+    /**
+     * The generator that created a source component of this connection, or
+     * undefined when the connection is made from the project as a whole.
+     */
+    readonly sourceGenerator?: string;
+    /** The generators that could have created its target. */
+    readonly targetGenerators: readonly string[];
+    /**
+     * Whether this connection was made from `source` to `target`, and what to record
+     * as the component's `path` if so. Undefined means it was not.
+     */
+    readonly evidence: (context: ConnectionContext) => string | undefined | Promise<string | undefined>;
+    /**
+     * The `name` this connection records, when it is not the target's class name.
+     * Matched to what each generator writes so a re-run recognises its own entry.
+     */
+    readonly recordedName?: (context: ConnectionContext) => string;
+    /** What this connection records beyond the path, which its predicates read. */
+    readonly metadata?: (context: ConnectionContext) => Record<string, unknown> | undefined;
+}
+/** What a connection's evidence check has to work from. */
+interface ConnectionContext {
+    readonly tree: Tree;
+    /** The project the connection lives on — the source side. */
+    readonly project: ProjectConfiguration;
+    /**
+     * The source component, or the project's own metadata standing in for it when
+     * the connection is made from the project as a whole.
+     */
+    readonly source: ComponentMetadata;
+    /** The target being connected to. */
+    readonly target: ConnectionTarget;
+}
+/**
+ * Every connection generator, and the trace each leaves on the project it connects
+ * from.
+ *
+ * Grouped by how a run is recognised, since that follows what the generator does
+ * rather than which pair it joins.
+ */
+export declare const CONNECTION_KINDS: readonly ConnectionKind[];
+/**
+ * A thing in the workspace a connection could have been made to, by the names its
+ * generated code is derived from.
+ */
+interface ConnectionTarget {
+    /** The class name a client or provider for this target is named after. */
+    readonly className: string;
+    /**
+     * The last segment of the target project's name, which the database connections
+     * derive their identifiers from.
+     */
+    readonly databaseName: string;
+    /** The target project's name, which a dev-target dependency names. */
+    readonly projectName: string;
+    /** The target project's root, recorded as `path` by the connections that vend no file. */
+    readonly projectRoot: string;
+    /** The target project's metadata, which a connection's own fields come from. */
+    readonly project: ProjectMetadata;
+}
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;
+export {};