@aws/nx-plugin 1.0.0-rc.7 → 1.0.0-rc.71

package/src/utils/api-constructs/files/terraform/app/apis/rest/__apiNameKebabCase__/__apiNameKebabCase__.tf.template

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "<%- awsProviderVersion %>"
     }
   }
 }
@@ -38,11 +38,47 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "appconfig_application_id" {
+  description = "ID of the shared runtime-config AppConfig application (from `core/runtime-config/appconfig.application_id`). When set, the Lambda functions receive `RUNTIME_CONFIG_APP_ID` and read access to the application."
+  type        = string
+  default     = null
+}
+
+variable "appconfig_application_arn" {
+  description = "ARN of the shared runtime-config AppConfig application (from `core/runtime-config/appconfig.application_arn`). Used to scope the IAM read permission granted to the Lambda functions."
+  type        = string
+  default     = null
+}
+
 variable "asset_bucket_name" {
   description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the `core/asset-bucket` module once per deployment and pass its `bucket_name` output here."
   type        = string
 }
 
+# VPC Configuration (optional)
+variable "enable_vpc" {
+  description = "Deploy the Lambda function into a VPC. Set alongside vpc_id/subnet_ids."
+  type        = bool
+  default     = false
+}
+
+variable "vpc_id" {
+  description = "VPC ID to deploy the Lambda function into. Required when enable_vpc is true."
+  type        = string
+  default     = null
+
+  validation {
+    condition     = !var.enable_vpc || (var.vpc_id != null && var.subnet_ids != null)
+    error_message = "vpc_id and subnet_ids must be set when enable_vpc is true."
+  }
+}
+
+variable "subnet_ids" {
+  description = "Subnet IDs to deploy the Lambda function into. Required when enable_vpc is true."
+  type        = list(string)
+  default     = null
+}
+
 # CORS Configuration (passed to core module)
 
 variable "cors_allow_headers" {
@@ -105,6 +141,11 @@ resource "aws_s3_object" "lambda_zip" {
 }
 
 # Use the core REST API module
+# Account-level CloudWatch role required for REST API access logging
+module "account" {
+  source = "../../../core/api/api-gateway-account"
+}
+
 module "rest_api" {
   source = "../../../core/api/rest-api"
 
@@ -134,9 +175,31 @@ resource "aws_wafv2_web_acl_association" "api_waf_association" {
   depends_on = [aws_api_gateway_stage.api_stage]
 }
 
+# Security group for the API Lambda function, used when deployed into a VPC
+resource "aws_security_group" "api_lambda" {
+  count = var.enable_vpc ? 1 : 0
+
+  #checkov:skip=CKV2_AWS_5:Attached to api_lambda via vpc_config block; Checkov cannot resolve this reference
+  name_prefix = "<%- apiNameKebabCase %>-lambda-"
+  description = "Security group for the <%- apiNameClassName %> API Lambda function"
+  vpc_id      = var.vpc_id
+  tags        = var.tags
+}
+
+resource "aws_vpc_security_group_egress_rule" "api_lambda_https" {
+  count = var.enable_vpc ? 1 : 0
+
+  security_group_id = aws_security_group.api_lambda[0].id
+  cidr_ipv4         = "0.0.0.0/0"
+  from_port         = 443
+  to_port           = 443
+  ip_protocol       = "tcp"
+  description       = "Allow outbound HTTPS to AWS service endpoints"
+}
+
 # Lambda function
 resource "aws_lambda_function" "api_lambda" {
-  #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
+  #checkov:skip=CKV_AWS_117:Lambda function is optionally deployed into a VPC via vpc_id/subnet_ids; not required for this use case
   #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this simple API use case
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
@@ -167,6 +230,14 @@ resource "aws_lambda_function" "api_lambda" {
     mode = "Active"
   }
 
+  dynamic "vpc_config" {
+    for_each = var.enable_vpc ? [1] : []
+    content {
+      subnet_ids         = var.subnet_ids
+      security_group_ids = [aws_security_group.api_lambda[0].id]
+    }
+  }
+
   <%_ if (backend.type === 'fastapi') { _%>
   # Enable SnapStart for faster cold starts
   snap_start {
@@ -181,10 +252,14 @@ resource "aws_lambda_function" "api_lambda" {
       AWS_LWA_INVOKE_MODE         = "response_stream"
       AWS_LAMBDA_EXEC_WRAPPER     = "/opt/bootstrap"
       <%_ } _%>
-    }, var.env)
+    }, var.appconfig_application_id != null ? {
+      RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
+    } : {}, var.env)
   }
 
   tags = var.tags
+
+  depends_on = [aws_iam_role_policy_attachment.lambda_vpc_access]
 }
 
 # IAM role for Lambda execution
@@ -219,18 +294,39 @@ resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
   role       = aws_iam_role.lambda_execution_role.name
 }
 
+# Attach VPC access policy to Lambda role when deployed into a VPC
+resource "aws_iam_role_policy_attachment" "lambda_vpc_access" {
+  count      = var.enable_vpc ? 1 : 0
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+  role       = aws_iam_role.lambda_execution_role.name
+}
+
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
-  count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
+  count = length(local.lambda_policy_statements) > 0 ? 1 : 0
   name  = "<%- apiNameClassName %>Handler-additional-policies-${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
     Version = "2012-10-17"
-    Statement = var.additional_iam_policy_statements
+    Statement = local.lambda_policy_statements
   })
 }
 
+locals {
+  # Grant read access to the runtime-config AppConfig application when wired
+  lambda_policy_statements = concat(var.appconfig_application_arn != null ? [
+    {
+      Effect = "Allow"
+      Action = [
+        "appconfig:StartConfigurationSession",
+        "appconfig:GetLatestConfiguration"
+      ]
+      Resource = ["${var.appconfig_application_arn}/*"]
+    }
+  ] : [], var.additional_iam_policy_statements)
+}
+
 # CloudWatch Log Group for Lambda
 resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
@@ -413,6 +509,9 @@ resource "aws_api_gateway_method" "proxy_method" {
   <%_ } else if (auth === 'cognito') { _%>
   authorization = "COGNITO_USER_POOLS"
   authorizer_id = aws_api_gateway_authorizer.cognito_authorizer.id
+  # Accept access tokens from both sign-in flows: 'openid' (Cognito hosted UI)
+  # and 'aws.cognito.signin.user.admin' (Cognito admin/SRP auth APIs).
+  authorization_scopes = ["openid", "aws.cognito.signin.user.admin"]
   <%_ } else if (auth === 'custom') { _%>
   authorization = "CUSTOM"
   authorizer_id = aws_api_gateway_authorizer.custom_authorizer.id
@@ -506,11 +605,63 @@ resource "aws_api_gateway_deployment" "api_deployment" {
   ]
 }
 
+# KMS key for encrypting access logs at rest
+resource "aws_kms_key" "access_logs" {
+  description             = "<%- apiNameClassName %> API access log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:log-group:/aws/apigateway/<%- apiNameKebabCase %>-${random_string.suffix.result}/access"
+          }
+        }
+      }
+    ]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_kms_alias" "access_logs" {
+  name          = "alias/<%- apiNameKebabCase %>-${random_string.suffix.result}-access-logs"
+  target_key_id = aws_kms_key.access_logs.key_id
+}
+
+# Access logs for the API Gateway stage
+resource "aws_cloudwatch_log_group" "access_logs" {
+  name              = "/aws/apigateway/<%- apiNameKebabCase %>-${random_string.suffix.result}/access"
+  retention_in_days = 365
+  kms_key_id        = aws_kms_key.access_logs.arn
+  tags              = var.tags
+}
+
 # API Gateway stage
 resource "aws_api_gateway_stage" "api_stage" {
   #checkov:skip=CKV_AWS_120:API Gateway caching not required for this use case
-  #checkov:skip=CKV_AWS_76:API Gateway access logging disabled due to account-level CloudWatch Logs role ARN requirement
-  #checkov:skip=CKV2_AWS_4:API Gateway logging level not applicable as access logging is disabled
+  #checkov:skip=CKV2_AWS_4:Access logging is enabled below; verbose execution logging is intentionally not enabled
   #checkov:skip=CKV2_AWS_51:Client certificate authentication not required for this use case
   #checkov:skip=CKV2_AWS_77:WAFv2 Web ACL is attached via aws_wafv2_web_acl_association when var.enable_waf is true (default) and includes AWSManagedRulesKnownBadInputsRuleSet for Log4j protection; Checkov does not track the association across modules
   deployment_id        = aws_api_gateway_deployment.api_deployment.id
@@ -518,9 +669,39 @@ resource "aws_api_gateway_stage" "api_stage" {
   stage_name           = "prod"
   xray_tracing_enabled = true
 
+  access_log_settings {
+    destination_arn = aws_cloudwatch_log_group.access_logs.arn
+    format = jsonencode({
+      requestId      = "$context.requestId"
+      ip             = "$context.identity.sourceIp"
+      caller         = "$context.identity.caller"
+      user           = "$context.identity.user"
+      requestTime    = "$context.requestTime"
+      httpMethod     = "$context.httpMethod"
+      resourcePath   = "$context.resourcePath"
+      status         = "$context.status"
+      protocol       = "$context.protocol"
+      responseLength = "$context.responseLength"
+    })
+  }
+
   tags = var.tags
 
-  depends_on = [aws_api_gateway_deployment.api_deployment]
+  # Ensure the account-level role is configured before the stage is created
+  depends_on = [aws_api_gateway_deployment.api_deployment, module.account]
+}
+
+# Default throttling applied to all resource paths and methods
+resource "aws_api_gateway_method_settings" "throttling" {
+  #checkov:skip=CKV_AWS_225:API Gateway caching not required for this use case
+  rest_api_id = module.rest_api.api_id
+  stage_name  = aws_api_gateway_stage.api_stage.stage_name
+  method_path = "*/*"
+
+  settings {
+    throttling_rate_limit  = 10000
+    throttling_burst_limit = 5000
+  }
 }
 
 # API Gateway Resource Policy
@@ -704,6 +885,11 @@ output "lambda_execution_role_name" {
   value       = aws_iam_role.lambda_execution_role.name
 }
 
+output "security_group_id" {
+  description = "Security group ID of the API Lambda function, for use in ingress rules on resources it must reach (e.g. a database). Null unless enable_vpc is true."
+  value       = var.enable_vpc ? aws_security_group.api_lambda[0].id : null
+}
+
 # Integration Outputs
 output "integration_id" {
   description = "ID of the Lambda integration"

package/src/utils/api-constructs/files/terraform/core/api/http/http-api/http-api.tf.template

@@ -7,7 +7,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "<%- awsProviderVersion %>"
     }
   }
 }

package/src/utils/api-constructs/files/terraform/core/api/rest/api-gateway-account/api-gateway-account.tf.template

@@ -0,0 +1,83 @@
+# Account-level CloudWatch Logs role used by API Gateway REST APIs for access
+# logging. The setting is a singleton per region per account, so it is managed
+# idempotently: the role is set only when none is already configured (the first
+# deployment wins, others defer) and is never reset on destroy. This keeps
+# logging working across multiple deployments sharing an account.
+
+terraform {
+  required_version = ">= 1.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "<%- awsProviderVersion %>"
+    }
+  }
+}
+
+data "aws_region" "current" {}
+
+resource "aws_iam_role" "cloudwatch" {
+  name_prefix = "apigw-cloudwatch-"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "apigateway.amazonaws.com" }
+      Action    = "sts:AssumeRole"
+    }]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "cloudwatch" {
+  role       = aws_iam_role.cloudwatch.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs"
+}
+
+# Configures the account role on create/update only; destroying this resource is
+# a no-op, so teardown never disables logging for other REST APIs in the region.
+resource "terraform_data" "account" {
+  triggers_replace = [aws_iam_role.cloudwatch.arn]
+
+  provisioner "local-exec" {
+    command = "uv run --with boto3<%= boto3Version %> python -c \"$SCRIPT\""
+    environment = {
+      ROLE_ARN = aws_iam_role.cloudwatch.arn
+      REGION   = data.aws_region.current.region
+      SCRIPT   = <<-PY
+        import os, time, boto3
+        from botocore.exceptions import ClientError
+        apigw = boto3.client("apigateway", region_name=os.environ["REGION"])
+
+        def has_live_role():
+            arn = apigw.get_account().get("cloudwatchRoleArn")
+            if not arn:
+                return False
+            try:
+                boto3.client("iam").get_role(RoleName=arn.split("/")[-1])
+                return True
+            except ClientError as e:
+                if e.response["Error"]["Code"] == "NoSuchEntity":
+                    return False
+                raise
+
+        if not has_live_role():
+            op = {"op": "replace", "path": "/cloudwatchRoleArn", "value": os.environ["ROLE_ARN"]}
+            # Retry while the freshly created role propagates through IAM, and on throttling
+            retryable = ("BadRequestException", "TooManyRequestsException")
+            for attempt in range(12):
+                try:
+                    apigw.update_account(patchOperations=[op])
+                    break
+                except ClientError as e:
+                    if e.response["Error"]["Code"] in retryable and attempt < 11:
+                        time.sleep(5)
+                    else:
+                        raise
+      PY
+    }
+  }
+
+  depends_on = [aws_iam_role_policy_attachment.cloudwatch]
+}

package/src/utils/api-constructs/files/terraform/core/api/rest/rest-api/rest-api.tf.template

@@ -7,11 +7,11 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "<%- awsProviderVersion %>"
     }
     random = {
       source  = "hashicorp/random"
-      version = "~> 3.1"
+      version = "<%- randomProviderVersion %>"
     }
   }
 }
@@ -81,8 +81,6 @@ data "aws_caller_identity" "current" {}
 
 # Resources
 
-# Note: CloudWatch logging removed due to account-level CloudWatch Logs role ARN requirement
-
 # REST API Gateway
 resource "aws_api_gateway_rest_api" "rest_api" {
   name        = var.api_name
@@ -99,10 +97,8 @@ resource "aws_api_gateway_rest_api" "rest_api" {
   tags = var.tags
 }
 
-# Note: Deployment and stage are created in the consuming module (e.g., foo-api.tf)
-# after all methods and integrations are defined
-
-# Note: CloudWatch Log Group removed due to account-level CloudWatch Logs role ARN requirement
+# Note: Deployment, stage and access logging are created in the consuming module
+# (e.g., foo-api.tf) after all methods and integrations are defined
 
 # Gateway Response for CORS (4XX errors)
 resource "aws_api_gateway_gateway_response" "cors_4xx" {
@@ -260,6 +256,4 @@ output "waf_web_acl_arn" {
   value       = var.enable_waf ? aws_wafv2_web_acl.api_waf[0].arn : null
 }
 
-# Note: Stage and deployment outputs are provided by the consuming module
-
-# Note: CloudWatch log group outputs removed due to account-level CloudWatch Logs role ARN requirement
+# Note: Stage, deployment and access log outputs are provided by the consuming module

package/src/utils/api-constructs/open-api-metadata.js

@@ -1,27 +1,22 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.addSharedConstructsOpenApiMetadataGenerateTarget = void 0;
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */
-const devkit_1 = require("@nx/devkit");
-const git_1 = require("../git");
-const nx_1 = require("../nx");
-const shared_constructs_constants_1 = require("../shared-constructs-constants");
+ */ import { joinPathFragments, updateJson } from "@nx/devkit";
+import { updateGitIgnore } from "../git.js";
+import { addDependencyToTargetIfNotPresent } from "../nx.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR } from "../shared-constructs-constants.js";
 /**
  * Adds a generate:<api-name>-metadata target to shared constructs (CDK only)
  * This allows for API CDK constructs to have type-safety for integrations based on an OpenAPI Specification
- */
-const addSharedConstructsOpenApiMetadataGenerateTarget = (tree, { iac, apiNameKebabCase, specPath, specBuildTargetName, }) => {
+ */ export const addSharedConstructsOpenApiMetadataGenerateTarget = (tree, { iac, apiNameKebabCase, specPath, specBuildTargetName })=>{
     if (iac !== 'cdk') {
         // For Terraform, we do not support type-safe integration builders, rather only the single lambda
         // router pattern, and therefore do not need to add depenencies on metadata generation.
         return;
     }
-    const generatedMetadataDir = (0, devkit_1.joinPathFragments)('generated', apiNameKebabCase);
-    const generatedMetadataDirFromRoot = (0, devkit_1.joinPathFragments)((0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR), 'src', generatedMetadataDir);
-    (0, devkit_1.updateJson)(tree, (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'project.json'), (config) => {
+    const generatedMetadataDir = joinPathFragments('generated', apiNameKebabCase);
+    const generatedMetadataDirFromRoot = joinPathFragments(joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR), 'src', generatedMetadataDir);
+    updateJson(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'project.json'), (config)=>{
         if (!config.targets) {
             config.targets = {};
         }
@@ -37,26 +32,31 @@ const addSharedConstructsOpenApiMetadataGenerateTarget = (tree, { iac, apiNameKe
                 executor: 'nx:run-commands',
                 inputs: [
                     {
-                        dependentTasksOutputFiles: '**/*.json',
-                    },
+                        dependentTasksOutputFiles: '**/*.json'
+                    }
                 ],
                 outputs: [
-                    (0, devkit_1.joinPathFragments)('{workspaceRoot}', generatedMetadataDirFromRoot),
+                    joinPathFragments('{workspaceRoot}', generatedMetadataDirFromRoot)
                 ],
                 options: {
                     commands: [
-                        `nx g @aws/nx-plugin:open-api#ts-metadata --openApiSpecPath="${specPath}" --outputPath="${generatedMetadataDirFromRoot}" --no-interactive`,
-                    ],
+                        `nx g @aws/nx-plugin:open-api#ts-metadata --openApiSpecPath="${specPath}" --outputPath="${generatedMetadataDirFromRoot}" --no-interactive`
+                    ]
                 },
-                dependsOn: [specBuildTargetName],
+                dependsOn: [
+                    specBuildTargetName
+                ]
             };
         }
-        (0, nx_1.addDependencyToTargetIfNotPresent)(config, 'compile', metadataTargetName);
+        addDependencyToTargetIfNotPresent(config, 'compile', metadataTargetName);
         return config;
     });
     // Ignore the generated metadata by default
     // Users can safely remove the entry from the .gitignore if they prefer to check it in
-    (0, git_1.updateGitIgnore)(tree, (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR), (patterns) => [...patterns, (0, devkit_1.joinPathFragments)('src', generatedMetadataDir)]);
+    updateGitIgnore(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR), (patterns)=>[
+            ...patterns,
+            joinPathFragments('src', generatedMetadataDir)
+        ]);
 };
-exports.addSharedConstructsOpenApiMetadataGenerateTarget = addSharedConstructsOpenApiMetadataGenerateTarget;
+
 //# sourceMappingURL=open-api-metadata.js.map

package/src/utils/api-constructs/open-api-metadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"open-api-metadata.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/utils/api-constructs/open-api-metadata.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,uCAKoB;AACpB,gCAAyC;AAEzC,8BAA0D;AAC1D,gFAGwC;AASxC;;;GAGG;AACI,MAAM,gDAAgD,GAAG,CAC9D,IAAU,EACV,EACE,GAAG,EACH,gBAAgB,EAChB,QAAQ,EACR,mBAAmB,GACqB,EAC1C,EAAE;IACF,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAClB,iGAAiG;QACjG,uFAAuF;QACvF,OAAO;IACT,CAAC;IAED,MAAM,oBAAoB,GAAG,IAAA,0BAAiB,EAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IAC9E,MAAM,4BAA4B,GAAG,IAAA,0BAAiB,EACpD,IAAA,0BAAiB,EAAC,0CAAY,EAAE,mDAAqB,CAAC,EACtD,KAAK,EACL,oBAAoB,CACrB,CAAC;IAEF,IAAA,mBAAU,EACR,IAAI,EACJ,IAAA,0BAAiB,EAAC,0CAAY,EAAE,mDAAqB,EAAE,cAAc,CAAC,EACtE,CAAC,MAA4B,EAAE,EAAE;QAC/B,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,OAAO,GAAG,EAAE,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAC1B,MAAM,CAAC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC;QAC5B,CAAC;QACD,wFAAwF;QACxF,0CAA0C;QAC1C,MAAM,kBAAkB,GAAG,YAAY,gBAAgB,WAAW,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG;gBACnC,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,iBAAiB;gBAC3B,MAAM,EAAE;oBACN;wBACE,yBAAyB,EAAE,WAAW;qBACvC;iBACF;gBACD,OAAO,EAAE;oBACP,IAAA,0BAAiB,EAAC,iBAAiB,EAAE,4BAA4B,CAAC;iBACnE;gBACD,OAAO,EAAE;oBACP,QAAQ,EAAE;wBACR,+DAA+D,QAAQ,mBAAmB,4BAA4B,oBAAoB;qBAC3I;iBACF;gBACD,SAAS,EAAE,CAAC,mBAAmB,CAAC;aACjC,CAAC;QACJ,CAAC;QACD,IAAA,sCAAiC,EAAC,MAAM,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;QACzE,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;IAEF,2CAA2C;IAC3C,sFAAsF;IACtF,IAAA,qBAAe,EACb,IAAI,EACJ,IAAA,0BAAiB,EAAC,0CAAY,EAAE,mDAAqB,CAAC,EACtD,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAA,0BAAiB,EAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAC5E,CAAC;AACJ,CAAC,CAAC;AAnEW,QAAA,gDAAgD,oDAmE3D"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/api-constructs/open-api-metadata.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { updateGitIgnore } from '../git';\nimport type { Iac } from '../iac';\nimport { addDependencyToTargetIfNotPresent } from '../nx';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n} from '../shared-constructs-constants';\n\nexport interface AddOpenApiMetadataGenerateTargetOptions {\n  iac: Iac;\n  apiNameKebabCase: string;\n  specPath: string;\n  specBuildTargetName: string;\n}\n\n/**\n * Adds a generate:<api-name>-metadata target to shared constructs (CDK only)\n * This allows for API CDK constructs to have type-safety for integrations based on an OpenAPI Specification\n */\nexport const addSharedConstructsOpenApiMetadataGenerateTarget = (\n  tree: Tree,\n  {\n    iac,\n    apiNameKebabCase,\n    specPath,\n    specBuildTargetName,\n  }: AddOpenApiMetadataGenerateTargetOptions,\n) => {\n  if (iac !== 'cdk') {\n    // For Terraform, we do not support type-safe integration builders, rather only the single lambda\n    // router pattern, and therefore do not need to add depenencies on metadata generation.\n    return;\n  }\n\n  const generatedMetadataDir = joinPathFragments('generated', apiNameKebabCase);\n  const generatedMetadataDirFromRoot = joinPathFragments(\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR),\n    'src',\n    generatedMetadataDir,\n  );\n\n  updateJson(\n    tree,\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'project.json'),\n    (config: ProjectConfiguration) => {\n      if (!config.targets) {\n        config.targets = {};\n      }\n      if (!config.targets.build) {\n        config.targets.build = {};\n      }\n      // If not already defined, add a target to generate metadata from the OpenAPI spec, used\n      // for providing a type-safe CDK construct\n      const metadataTargetName = `generate:${apiNameKebabCase}-metadata`;\n      if (!config.targets[metadataTargetName]) {\n        config.targets[metadataTargetName] = {\n          cache: true,\n          executor: 'nx:run-commands',\n          inputs: [\n            {\n              dependentTasksOutputFiles: '**/*.json',\n            },\n          ],\n          outputs: [\n            joinPathFragments('{workspaceRoot}', generatedMetadataDirFromRoot),\n          ],\n          options: {\n            commands: [\n              `nx g @aws/nx-plugin:open-api#ts-metadata --openApiSpecPath=\"${specPath}\" --outputPath=\"${generatedMetadataDirFromRoot}\" --no-interactive`,\n            ],\n          },\n          dependsOn: [specBuildTargetName],\n        };\n      }\n      addDependencyToTargetIfNotPresent(config, 'compile', metadataTargetName);\n      return config;\n    },\n  );\n\n  // Ignore the generated metadata by default\n  // Users can safely remove the entry from the .gitignore if they prefer to check it in\n  updateGitIgnore(\n    tree,\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR),\n    (patterns) => [...patterns, joinPathFragments('src', generatedMetadataDir)],\n  );\n};\n"],"names":["joinPathFragments","updateJson","updateGitIgnore","addDependencyToTargetIfNotPresent","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","addSharedConstructsOpenApiMetadataGenerateTarget","tree","iac","apiNameKebabCase","specPath","specBuildTargetName","generatedMetadataDir","generatedMetadataDirFromRoot","config","targets","build","metadataTargetName","cache","executor","inputs","dependentTasksOutputFiles","outputs","options","commands","dependsOn","patterns"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,eAAe,QAAQ,YAAS;AAEzC,SAASC,iCAAiC,QAAQ,WAAQ;AAC1D,SACEC,YAAY,EACZC,qBAAqB,QAChB,oCAAiC;AASxC;;;CAGC,GACD,OAAO,MAAMC,mDAAmD,CAC9DC,MACA,EACEC,GAAG,EACHC,gBAAgB,EAChBC,QAAQ,EACRC,mBAAmB,EACqB;IAE1C,IAAIH,QAAQ,OAAO;QACjB,iGAAiG;QACjG,uFAAuF;QACvF;IACF;IAEA,MAAMI,uBAAuBZ,kBAAkB,aAAaS;IAC5D,MAAMI,+BAA+Bb,kBACnCA,kBAAkBI,cAAcC,wBAChC,OACAO;IAGFX,WACEM,MACAP,kBAAkBI,cAAcC,uBAAuB,iBACvD,CAACS;QACC,IAAI,CAACA,OAAOC,OAAO,EAAE;YACnBD,OAAOC,OAAO,GAAG,CAAC;QACpB;QACA,IAAI,CAACD,OAAOC,OAAO,CAACC,KAAK,EAAE;YACzBF,OAAOC,OAAO,CAACC,KAAK,GAAG,CAAC;QAC1B;QACA,wFAAwF;QACxF,0CAA0C;QAC1C,MAAMC,qBAAqB,CAAC,SAAS,EAAER,iBAAiB,SAAS,CAAC;QAClE,IAAI,CAACK,OAAOC,OAAO,CAACE,mBAAmB,EAAE;YACvCH,OAAOC,OAAO,CAACE,mBAAmB,GAAG;gBACnCC,OAAO;gBACPC,UAAU;gBACVC,QAAQ;oBACN;wBACEC,2BAA2B;oBAC7B;iBACD;gBACDC,SAAS;oBACPtB,kBAAkB,mBAAmBa;iBACtC;gBACDU,SAAS;oBACPC,UAAU;wBACR,CAAC,4DAA4D,EAAEd,SAAS,gBAAgB,EAAEG,6BAA6B,kBAAkB,CAAC;qBAC3I;gBACH;gBACAY,WAAW;oBAACd;iBAAoB;YAClC;QACF;QACAR,kCAAkCW,QAAQ,WAAWG;QACrD,OAAOH;IACT;IAGF,2CAA2C;IAC3C,sFAAsF;IACtFZ,gBACEK,MACAP,kBAAkBI,cAAcC,wBAChC,CAACqB,WAAa;eAAIA;YAAU1B,kBAAkB,OAAOY;SAAsB;AAE/E,EAAE"}

package/src/utils/ast/website.js

@@ -1,27 +1,25 @@
-"use strict";
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.addHookResultToRouterProviderContext = void 0;
-const ast_1 = require("../ast");
-const addHookResultToRouterProviderContext = async (tree, mainTsxPath, { hook, module, contextProp }) => {
+ */ import { addDestructuredImport, applyGritQL, matchGritQL } from "../ast.js";
+export const addHookResultToRouterProviderContext = async (tree, mainTsxPath, { hook, module, contextProp })=>{
     // All 4 patterns must exist for this transform to apply
     const checks = await Promise.all([
-        (0, ast_1.matchGritQL)(tree, mainTsxPath, '`RouterProviderContext`'),
-        (0, ast_1.matchGritQL)(tree, mainTsxPath, '`createRouter($_)`'),
-        (0, ast_1.matchGritQL)(tree, mainTsxPath, '`const App = $_`'),
-        (0, ast_1.matchGritQL)(tree, mainTsxPath, '`<RouterProvider $_ />`'),
+        matchGritQL(tree, mainTsxPath, '`RouterProviderContext`'),
+        matchGritQL(tree, mainTsxPath, '`createRouter($_)`'),
+        matchGritQL(tree, mainTsxPath, '`const App = $_`'),
+        matchGritQL(tree, mainTsxPath, '`<RouterProvider $_ />`')
     ]);
-    if (checks.some((c) => !c)) {
+    if (checks.some((c)=>!c)) {
         return;
     }
-    await (0, ast_1.addDestructuredImport)(tree, mainTsxPath, [hook], module);
+    await addDestructuredImport(tree, mainTsxPath, [
+        hook
+    ], module);
     // 1. Add property to RouterProviderContext type
     //    'some' checks direct members only (not nested), so a nested 'auth' won't block adding a top-level one.
     //    Type members use ; as terminators, so += with leading \n handles separation.
-    await (0, ast_1.applyGritQL)(tree, mainTsxPath, `or {
+    await applyGritQL(tree, mainTsxPath, `or {
       \`type RouterProviderContext = {}\` => \`type RouterProviderContext = {
   ${contextProp}?: ReturnType<typeof ${hook}>;
 }\`,
@@ -34,25 +32,25 @@ ${contextProp}?: ReturnType<typeof ${hook}>\`
     // 2. Add context property to createRouter config
     //    'some' checks direct properties of the createRouter argument object only.
     //    Use += for multi-prop objects, => rewrite for single-prop.
-    await (0, ast_1.applyGritQL)(tree, mainTsxPath, `\`createRouter({ $props })\` where {
+    await applyGritQL(tree, mainTsxPath, `\`createRouter({ $props })\` where {
       $props <: not some \`context: $_\`,
       $props += \`context: { ${contextProp}: undefined }\`
     }`);
     // If context already exists, add the new prop to it.
     // Handle empty context: {} via nested contains => rewrite, scoped to createRouter.
-    await (0, ast_1.applyGritQL)(tree, mainTsxPath, `\`createRouter({ $props })\` where {
+    await applyGritQL(tree, mainTsxPath, `\`createRouter({ $props })\` where {
       $props <: contains \`context: {}\` => \`context: { ${contextProp}: undefined }\`
     }`);
     // Handle non-empty context via rewrite (the context object may be single-prop
     // from the first hook call, where += concatenates without comma)
-    await (0, ast_1.applyGritQL)(tree, mainTsxPath, `\`context: { $cprops }\` => \`context: { $cprops, ${contextProp}: undefined }\` where {
+    await applyGritQL(tree, mainTsxPath, `\`context: { $cprops }\` => \`context: { $cprops, ${contextProp}: undefined }\` where {
       $cprops <: within \`createRouter($_)\`,
       $cprops <: not some \`${contextProp}: $_\`
     }`);
     // 3. Add hook call to App component body
     //    Block body: 'some' checks direct statements.
     //    Expression body: 'contains' to also prevent matching block bodies.
-    await (0, ast_1.applyGritQL)(tree, mainTsxPath, `or {
+    await applyGritQL(tree, mainTsxPath, `or {
       \`const App = () => { $body }\` => raw\`const App = () => {
   const ${contextProp} = ${hook}();
   $body
@@ -64,15 +62,15 @@ ${contextProp}?: ReturnType<typeof ${hook}>\`
     }`);
     // 4. Add context prop to RouterProvider JSX element
     //    'some' checks direct JSX attributes only.
-    await (0, ast_1.applyGritQL)(tree, mainTsxPath, `or {
+    await applyGritQL(tree, mainTsxPath, `or {
       \`<RouterProvider $attrs context={{}} />\` => \`<RouterProvider $attrs context={{ ${contextProp} }} />\`,
       \`<RouterProvider $attrs context={{ $cprops }} />\` => \`<RouterProvider $attrs context={{ $cprops, ${contextProp} }} />\` where {
         $cprops <: not some \`${contextProp}\`
       },
       \`<RouterProvider $attrs />\` => \`<RouterProvider $attrs context={{ ${contextProp} }} />\` where {
-        $attrs <: not some \`context\`
+        $attrs <: not some \`context={$_}\`
       }
     }`);
 };
-exports.addHookResultToRouterProviderContext = addHookResultToRouterProviderContext;
+
 //# sourceMappingURL=website.js.map