@aws/nx-plugin 1.0.0-rc.8 → 1.0.0-rc.80

package/src/migrations/v1.0.0-rc.50/0001-modernize-function-props-cast/migration.js

@@ -0,0 +1,65 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { visitNotIgnoredFiles } from "@nx/devkit";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Replace the legacy angle-bracket FunctionProps type assertion with the modern as syntax in generated API constructs
+ *
+ * The legacy `<FunctionProps>{ ... }` cast form is not supported by GritQL's
+ * TypeScript parser, which silently breaks parsing (and therefore matching)
+ * for the entire containing file. Since several other migrations rely on
+ * GritQL to update these API construct files, this cast is replaced here with
+ * the equivalent, GritQL-compatible `{ ... } as FunctionProps` form. This is
+ * matched as an exact literal (rather than via GritQL) since GritQL cannot
+ * parse the file while the legacy cast is still present.
+ *
+ * How to write a migration:
+ * - https://nx.dev/docs/kb/migration-generators
+ * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject
+ *
+ * Guardrails:
+ * - Pattern-match before writing: skip files that have diverged from the shape
+ *   your generators produce and report them via `nextSteps`, or consider a
+ *   hybrid migration, rather than clobbering the user's changes.
+ * - Idempotent: re-running must be a no-op.
+ * - Format what you write: finish with `formatFilesInSubtree` so the files your
+ *   migration wrote are formatted correctly.
+ */ const APIS_APP_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/apis`;
+const OLD_CAST_OPEN = 'defaultIntegrationOptions: <FunctionProps>{';
+const NEW_CAST_OPEN = 'defaultIntegrationOptions: {';
+const OLD_CAST_CLOSE = '\n      },\n      buildDefaultIntegration:';
+const NEW_CAST_CLOSE = '\n      } as FunctionProps,\n      buildDefaultIntegration:';
+export default async function migration(tree) {
+    const nextSteps = [];
+    if (!tree.exists(APIS_APP_DIR)) {
+        return {
+            nextSteps
+        };
+    }
+    const apiAppFiles = [];
+    visitNotIgnoredFiles(tree, APIS_APP_DIR, (filePath)=>{
+        apiAppFiles.push(filePath);
+    });
+    for (const filePath of apiAppFiles){
+        if (!filePath.endsWith('.ts') || filePath.endsWith('/index.ts')) {
+            continue;
+        }
+        const contents = tree.read(filePath, 'utf-8') ?? '';
+        if (!contents.includes(OLD_CAST_OPEN)) {
+            continue;
+        }
+        if (!contents.includes(OLD_CAST_CLOSE)) {
+            nextSteps.push(`${filePath}: the defaultIntegrationOptions cast has diverged from the generated shape - left untouched. Manually replace \`<FunctionProps>{ ... }\` with \`{ ... } as FunctionProps\`.`);
+            continue;
+        }
+        tree.write(filePath, contents.replace(OLD_CAST_OPEN, NEW_CAST_OPEN).replace(OLD_CAST_CLOSE, NEW_CAST_CLOSE));
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.50/0001-modernize-function-props-cast/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.50/0001-modernize-function-props-cast/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type MigrationReturnObject,\n  type Tree,\n  visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Replace the legacy angle-bracket FunctionProps type assertion with the modern as syntax in generated API constructs\n *\n * The legacy `<FunctionProps>{ ... }` cast form is not supported by GritQL's\n * TypeScript parser, which silently breaks parsing (and therefore matching)\n * for the entire containing file. Since several other migrations rely on\n * GritQL to update these API construct files, this cast is replaced here with\n * the equivalent, GritQL-compatible `{ ... } as FunctionProps` form. This is\n * matched as an exact literal (rather than via GritQL) since GritQL cannot\n * parse the file while the legacy cast is still present.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n *\n * Guardrails:\n * - Pattern-match before writing: skip files that have diverged from the shape\n *   your generators produce and report them via `nextSteps`, or consider a\n *   hybrid migration, rather than clobbering the user's changes.\n * - Idempotent: re-running must be a no-op.\n * - Format what you write: finish with `formatFilesInSubtree` so the files your\n *   migration wrote are formatted correctly.\n */\n\nconst APIS_APP_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/apis`;\n\nconst OLD_CAST_OPEN = 'defaultIntegrationOptions: <FunctionProps>{';\nconst NEW_CAST_OPEN = 'defaultIntegrationOptions: {';\nconst OLD_CAST_CLOSE = '\\n      },\\n      buildDefaultIntegration:';\nconst NEW_CAST_CLOSE =\n  '\\n      } as FunctionProps,\\n      buildDefaultIntegration:';\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (!tree.exists(APIS_APP_DIR)) {\n    return { nextSteps };\n  }\n\n  const apiAppFiles: string[] = [];\n  visitNotIgnoredFiles(tree, APIS_APP_DIR, (filePath) => {\n    apiAppFiles.push(filePath);\n  });\n\n  for (const filePath of apiAppFiles) {\n    if (!filePath.endsWith('.ts') || filePath.endsWith('/index.ts')) {\n      continue;\n    }\n    const contents = tree.read(filePath, 'utf-8') ?? '';\n    if (!contents.includes(OLD_CAST_OPEN)) {\n      // Already migrated, or doesn't use this shape.\n      continue;\n    }\n    if (!contents.includes(OLD_CAST_CLOSE)) {\n      nextSteps.push(\n        `${filePath}: the defaultIntegrationOptions cast has diverged from the generated shape - left untouched. Manually replace \\`<FunctionProps>{ ... }\\` with \\`{ ... } as FunctionProps\\`.`,\n      );\n      continue;\n    }\n    tree.write(\n      filePath,\n      contents\n        .replace(OLD_CAST_OPEN, NEW_CAST_OPEN)\n        .replace(OLD_CAST_CLOSE, NEW_CAST_CLOSE),\n    );\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["visitNotIgnoredFiles","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","APIS_APP_DIR","OLD_CAST_OPEN","NEW_CAST_OPEN","OLD_CAST_CLOSE","NEW_CAST_CLOSE","migration","tree","nextSteps","exists","apiAppFiles","filePath","push","endsWith","contents","read","includes","write","replace"],"mappings":"AAAA;;;CAGC,GACD,SAGEA,oBAAoB,QACf,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,qBAAqB,QAChB,gDAAgD;AAEvD;;;;;;;;;;;;;;;;;;;;;;CAsBC,GAED,MAAMC,eAAe,GAAGF,aAAa,CAAC,EAAEC,sBAAsB,aAAa,CAAC;AAE5E,MAAME,gBAAgB;AACtB,MAAMC,gBAAgB;AACtB,MAAMC,iBAAiB;AACvB,MAAMC,iBACJ;AAEF,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAI,CAACD,KAAKE,MAAM,CAACR,eAAe;QAC9B,OAAO;YAAEO;QAAU;IACrB;IAEA,MAAME,cAAwB,EAAE;IAChCb,qBAAqBU,MAAMN,cAAc,CAACU;QACxCD,YAAYE,IAAI,CAACD;IACnB;IAEA,KAAK,MAAMA,YAAYD,YAAa;QAClC,IAAI,CAACC,SAASE,QAAQ,CAAC,UAAUF,SAASE,QAAQ,CAAC,cAAc;YAC/D;QACF;QACA,MAAMC,WAAWP,KAAKQ,IAAI,CAACJ,UAAU,YAAY;QACjD,IAAI,CAACG,SAASE,QAAQ,CAACd,gBAAgB;YAErC;QACF;QACA,IAAI,CAACY,SAASE,QAAQ,CAACZ,iBAAiB;YACtCI,UAAUI,IAAI,CACZ,GAAGD,SAAS,2KAA2K,CAAC;YAE1L;QACF;QACAJ,KAAKU,KAAK,CACRN,UACAG,SACGI,OAAO,CAAChB,eAAeC,eACvBe,OAAO,CAACd,gBAAgBC;IAE/B;IAEA,MAAMP,qBAAqBS;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.50/0002-restrict-cors-to-custom-domains/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Include CloudFront custom domain aliases in restrictCorsTo and UserIdentity callback URLs"
+}

package/src/migrations/v1.0.0-rc.50/0002-restrict-cors-to-custom-domains/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.0-rc.50/0002-restrict-cors-to-custom-domains/migration.js

@@ -0,0 +1,108 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { visitNotIgnoredFiles } from "@nx/devkit";
+import { addDestructuredImport, addStarExport, applyGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { isEsmWorkspace } from "../../../utils/module-format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Include CloudFront custom domain aliases in restrictCorsTo and UserIdentity callback URLs
+ *
+ * How to write a migration:
+ * - https://nx.dev/docs/kb/migration-generators
+ * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject
+ *
+ * Guardrails:
+ * - Pattern-match before writing: skip files that have diverged from the shape
+ *   your generators produce and report them via `nextSteps`, rather than
+ *   clobbering the user's changes.
+ * - Idempotent: re-running must be a no-op.
+ * - Format what you write: finish with `formatFilesInSubtree` so the files your
+ *   migration wrote are formatted correctly.
+ */ const CORE_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core`;
+const APIS_APP_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/apis`;
+const CLOUDFRONT_CORE_FILE = `${CORE_DIR}/cloudfront.ts`;
+const CORE_INDEX_FILE = `${CORE_DIR}/index.ts`;
+const USER_IDENTITY_FILE = `${CORE_DIR}/user-identity.ts`;
+const CLOUDFRONT_HELPER_CONTENT = `import { CfnDistribution, Distribution } from 'aws-cdk-lib/aws-cloudfront';
+
+/**
+ * Finds the domain names associated with a CloudFront distribution.
+ *
+ * Includes the distribution's default \`*.cloudfront.net\` domain name plus any custom
+ * domain names (aliases) configured on it.
+ */
+export const findCloudFrontDomainNames = (
+  distribution: Distribution,
+): string[] => {
+  const cfnDistribution = distribution.node.defaultChild as CfnDistribution;
+  const distributionConfig =
+    cfnDistribution.distributionConfig as CfnDistribution.DistributionConfigProperty;
+  return [distribution.domainName, ...(distributionConfig.aliases ?? [])];
+};
+`;
+// Rewrites the `restrictCorsTo` body as produced by generators prior to this fix.
+const RESTRICT_CORS_TO_GRITQL_PATTERN = "`origins.map(($o) => typeof $o === 'string' ? $o : 'cloudFrontDistribution' in $o ? $branch1 : $branch2)` where { $branch1 <: contains `distributionDomainName`, $branch2 <: contains `distributionDomainName` } => raw`origins.flatMap(($o) => typeof $o === 'string' ? [$o] : findCloudFrontDomainNames('cloudFrontDistribution' in $o ? $o.cloudFrontDistribution : $o).map((domain) => \\`https://${domain}\\`))`";
+// Rewrites UserIdentity's callback/logout URL logic as produced by generators
+// prior to this fix.
+const USER_IDENTITY_CALLBACK_URLS_GRITQL_PATTERN = '`this.findCloudFrontDomainNames()` => `Stack.of(this).node.findAll().filter((child): child is Distribution => child instanceof Distribution).flatMap(findCloudFrontDomainNames)`';
+export default async function migration(tree) {
+    const nextSteps = [];
+    if (!tree.exists(CORE_INDEX_FILE)) {
+        // No common/constructs shared library in this workspace - nothing to migrate.
+        return {
+            nextSteps
+        };
+    }
+    const esm = isEsmWorkspace(tree);
+    const apiCloudFrontImportSpecifier = esm ? '../../core/cloudfront.js' : '../../core/cloudfront';
+    const coreCloudFrontImportSpecifier = esm ? './cloudfront.js' : './cloudfront';
+    if (!tree.exists(CLOUDFRONT_CORE_FILE)) {
+        tree.write(CLOUDFRONT_CORE_FILE, CLOUDFRONT_HELPER_CONTENT);
+    }
+    await addStarExport(tree, CORE_INDEX_FILE, './cloudfront.js');
+    const apiAppFiles = [];
+    visitNotIgnoredFiles(tree, APIS_APP_DIR, (filePath)=>{
+        apiAppFiles.push(filePath);
+    });
+    for (const filePath of apiAppFiles){
+        if (!filePath.endsWith('.ts') || filePath.endsWith('/index.ts')) {
+            continue;
+        }
+        const rewrote = await applyGritQL(tree, filePath, RESTRICT_CORS_TO_GRITQL_PATTERN);
+        if (rewrote) {
+            await addDestructuredImport(tree, filePath, [
+                'findCloudFrontDomainNames'
+            ], apiCloudFrontImportSpecifier);
+            continue;
+        }
+        const contents = tree.read(filePath, 'utf-8') ?? '';
+        if (!contents.includes('findCloudFrontDomainNames(')) {
+            nextSteps.push(`${filePath}: restrictCorsTo has diverged from the generated shape - left untouched. Manually apply the CloudFront custom domain fix (see findCloudFrontDomainNames in common/constructs/src/core/cloudfront.ts).`);
+        }
+    // Otherwise already migrated - silent skip.
+    }
+    if (tree.exists(USER_IDENTITY_FILE)) {
+        const rewrote = await applyGritQL(tree, USER_IDENTITY_FILE, USER_IDENTITY_CALLBACK_URLS_GRITQL_PATTERN);
+        if (rewrote) {
+            await applyGritQL(tree, USER_IDENTITY_FILE, "`import { CfnDistribution, Distribution } from 'aws-cdk-lib/aws-cloudfront'` => `import { Distribution } from 'aws-cdk-lib/aws-cloudfront';`");
+            await applyGritQL(tree, USER_IDENTITY_FILE, "or { `// Includes each distribution's default domain name plus any custom domain names (aliases) configured on it.` => ., `private findCloudFrontDomainNames = (): string[] => $body` => . }");
+            await addDestructuredImport(tree, USER_IDENTITY_FILE, [
+                'findCloudFrontDomainNames'
+            ], coreCloudFrontImportSpecifier);
+        } else {
+            const contents = tree.read(USER_IDENTITY_FILE, 'utf-8') ?? '';
+            if (!contents.includes('.flatMap(findCloudFrontDomainNames)')) {
+                nextSteps.push(`${USER_IDENTITY_FILE}: the callback URL logic has diverged from the generated shape - left untouched. Manually apply the shared findCloudFrontDomainNames helper (see common/constructs/src/core/cloudfront.ts).`);
+            }
+        // Otherwise already migrated - silent skip.
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.50/0002-restrict-cors-to-custom-domains/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.50/0002-restrict-cors-to-custom-domains/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type MigrationReturnObject,\n  type Tree,\n  visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport {\n  addDestructuredImport,\n  addStarExport,\n  applyGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { isEsmWorkspace } from '../../../utils/module-format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Include CloudFront custom domain aliases in restrictCorsTo and UserIdentity callback URLs\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n *\n * Guardrails:\n * - Pattern-match before writing: skip files that have diverged from the shape\n *   your generators produce and report them via `nextSteps`, rather than\n *   clobbering the user's changes.\n * - Idempotent: re-running must be a no-op.\n * - Format what you write: finish with `formatFilesInSubtree` so the files your\n *   migration wrote are formatted correctly.\n */\n\nconst CORE_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core`;\nconst APIS_APP_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/apis`;\nconst CLOUDFRONT_CORE_FILE = `${CORE_DIR}/cloudfront.ts`;\nconst CORE_INDEX_FILE = `${CORE_DIR}/index.ts`;\nconst USER_IDENTITY_FILE = `${CORE_DIR}/user-identity.ts`;\n\nconst CLOUDFRONT_HELPER_CONTENT = `import { CfnDistribution, Distribution } from 'aws-cdk-lib/aws-cloudfront';\n\n/**\n * Finds the domain names associated with a CloudFront distribution.\n *\n * Includes the distribution's default \\`*.cloudfront.net\\` domain name plus any custom\n * domain names (aliases) configured on it.\n */\nexport const findCloudFrontDomainNames = (\n  distribution: Distribution,\n): string[] => {\n  const cfnDistribution = distribution.node.defaultChild as CfnDistribution;\n  const distributionConfig =\n    cfnDistribution.distributionConfig as CfnDistribution.DistributionConfigProperty;\n  return [distribution.domainName, ...(distributionConfig.aliases ?? [])];\n};\n`;\n\n// Rewrites the `restrictCorsTo` body as produced by generators prior to this fix.\nconst RESTRICT_CORS_TO_GRITQL_PATTERN =\n  \"`origins.map(($o) => typeof $o === 'string' ? $o : 'cloudFrontDistribution' in $o ? $branch1 : $branch2)` where { $branch1 <: contains `distributionDomainName`, $branch2 <: contains `distributionDomainName` } => raw`origins.flatMap(($o) => typeof $o === 'string' ? [$o] : findCloudFrontDomainNames('cloudFrontDistribution' in $o ? $o.cloudFrontDistribution : $o).map((domain) => \\\\`https://${domain}\\\\`))`\";\n\n// Rewrites UserIdentity's callback/logout URL logic as produced by generators\n// prior to this fix.\nconst USER_IDENTITY_CALLBACK_URLS_GRITQL_PATTERN =\n  '`this.findCloudFrontDomainNames()` => `Stack.of(this).node.findAll().filter((child): child is Distribution => child instanceof Distribution).flatMap(findCloudFrontDomainNames)`';\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (!tree.exists(CORE_INDEX_FILE)) {\n    // No common/constructs shared library in this workspace - nothing to migrate.\n    return { nextSteps };\n  }\n\n  const esm = isEsmWorkspace(tree);\n  const apiCloudFrontImportSpecifier = esm\n    ? '../../core/cloudfront.js'\n    : '../../core/cloudfront';\n  const coreCloudFrontImportSpecifier = esm\n    ? './cloudfront.js'\n    : './cloudfront';\n\n  if (!tree.exists(CLOUDFRONT_CORE_FILE)) {\n    tree.write(CLOUDFRONT_CORE_FILE, CLOUDFRONT_HELPER_CONTENT);\n  }\n  await addStarExport(tree, CORE_INDEX_FILE, './cloudfront.js');\n\n  const apiAppFiles: string[] = [];\n  visitNotIgnoredFiles(tree, APIS_APP_DIR, (filePath) => {\n    apiAppFiles.push(filePath);\n  });\n\n  for (const filePath of apiAppFiles) {\n    if (!filePath.endsWith('.ts') || filePath.endsWith('/index.ts')) {\n      continue;\n    }\n    const rewrote = await applyGritQL(\n      tree,\n      filePath,\n      RESTRICT_CORS_TO_GRITQL_PATTERN,\n    );\n    if (rewrote) {\n      await addDestructuredImport(\n        tree,\n        filePath,\n        ['findCloudFrontDomainNames'],\n        apiCloudFrontImportSpecifier,\n      );\n      continue;\n    }\n    const contents = tree.read(filePath, 'utf-8') ?? '';\n    if (!contents.includes('findCloudFrontDomainNames(')) {\n      nextSteps.push(\n        `${filePath}: restrictCorsTo has diverged from the generated shape - left untouched. Manually apply the CloudFront custom domain fix (see findCloudFrontDomainNames in common/constructs/src/core/cloudfront.ts).`,\n      );\n    }\n    // Otherwise already migrated - silent skip.\n  }\n\n  if (tree.exists(USER_IDENTITY_FILE)) {\n    const rewrote = await applyGritQL(\n      tree,\n      USER_IDENTITY_FILE,\n      USER_IDENTITY_CALLBACK_URLS_GRITQL_PATTERN,\n    );\n    if (rewrote) {\n      await applyGritQL(\n        tree,\n        USER_IDENTITY_FILE,\n        \"`import { CfnDistribution, Distribution } from 'aws-cdk-lib/aws-cloudfront'` => `import { Distribution } from 'aws-cdk-lib/aws-cloudfront';`\",\n      );\n      await applyGritQL(\n        tree,\n        USER_IDENTITY_FILE,\n        \"or { `// Includes each distribution's default domain name plus any custom domain names (aliases) configured on it.` => ., `private findCloudFrontDomainNames = (): string[] => $body` => . }\",\n      );\n      await addDestructuredImport(\n        tree,\n        USER_IDENTITY_FILE,\n        ['findCloudFrontDomainNames'],\n        coreCloudFrontImportSpecifier,\n      );\n    } else {\n      const contents = tree.read(USER_IDENTITY_FILE, 'utf-8') ?? '';\n      if (!contents.includes('.flatMap(findCloudFrontDomainNames)')) {\n        nextSteps.push(\n          `${USER_IDENTITY_FILE}: the callback URL logic has diverged from the generated shape - left untouched. Manually apply the shared findCloudFrontDomainNames helper (see common/constructs/src/core/cloudfront.ts).`,\n        );\n      }\n      // Otherwise already migrated - silent skip.\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["visitNotIgnoredFiles","addDestructuredImport","addStarExport","applyGritQL","formatFilesInSubtree","isEsmWorkspace","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","CORE_DIR","APIS_APP_DIR","CLOUDFRONT_CORE_FILE","CORE_INDEX_FILE","USER_IDENTITY_FILE","CLOUDFRONT_HELPER_CONTENT","RESTRICT_CORS_TO_GRITQL_PATTERN","USER_IDENTITY_CALLBACK_URLS_GRITQL_PATTERN","migration","tree","nextSteps","exists","esm","apiCloudFrontImportSpecifier","coreCloudFrontImportSpecifier","write","apiAppFiles","filePath","push","endsWith","rewrote","contents","read","includes"],"mappings":"AAAA;;;CAGC,GACD,SAGEA,oBAAoB,QACf,aAAa;AACpB,SACEC,qBAAqB,EACrBC,aAAa,EACbC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,cAAc,QAAQ,kCAAkC;AACjE,SACEC,YAAY,EACZC,qBAAqB,QAChB,gDAAgD;AAEvD;;;;;;;;;;;;;;CAcC,GAED,MAAMC,WAAW,GAAGF,aAAa,CAAC,EAAEC,sBAAsB,SAAS,CAAC;AACpE,MAAME,eAAe,GAAGH,aAAa,CAAC,EAAEC,sBAAsB,aAAa,CAAC;AAC5E,MAAMG,uBAAuB,GAAGF,SAAS,cAAc,CAAC;AACxD,MAAMG,kBAAkB,GAAGH,SAAS,SAAS,CAAC;AAC9C,MAAMI,qBAAqB,GAAGJ,SAAS,iBAAiB,CAAC;AAEzD,MAAMK,4BAA4B,CAAC;;;;;;;;;;;;;;;;AAgBnC,CAAC;AAED,kFAAkF;AAClF,MAAMC,kCACJ;AAEF,8EAA8E;AAC9E,qBAAqB;AACrB,MAAMC,6CACJ;AAEF,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAI,CAACD,KAAKE,MAAM,CAACR,kBAAkB;QACjC,8EAA8E;QAC9E,OAAO;YAAEO;QAAU;IACrB;IAEA,MAAME,MAAMf,eAAeY;IAC3B,MAAMI,+BAA+BD,MACjC,6BACA;IACJ,MAAME,gCAAgCF,MAClC,oBACA;IAEJ,IAAI,CAACH,KAAKE,MAAM,CAACT,uBAAuB;QACtCO,KAAKM,KAAK,CAACb,sBAAsBG;IACnC;IACA,MAAMX,cAAce,MAAMN,iBAAiB;IAE3C,MAAMa,cAAwB,EAAE;IAChCxB,qBAAqBiB,MAAMR,cAAc,CAACgB;QACxCD,YAAYE,IAAI,CAACD;IACnB;IAEA,KAAK,MAAMA,YAAYD,YAAa;QAClC,IAAI,CAACC,SAASE,QAAQ,CAAC,UAAUF,SAASE,QAAQ,CAAC,cAAc;YAC/D;QACF;QACA,MAAMC,UAAU,MAAMzB,YACpBc,MACAQ,UACAX;QAEF,IAAIc,SAAS;YACX,MAAM3B,sBACJgB,MACAQ,UACA;gBAAC;aAA4B,EAC7BJ;YAEF;QACF;QACA,MAAMQ,WAAWZ,KAAKa,IAAI,CAACL,UAAU,YAAY;QACjD,IAAI,CAACI,SAASE,QAAQ,CAAC,+BAA+B;YACpDb,UAAUQ,IAAI,CACZ,GAAGD,SAAS,qMAAqM,CAAC;QAEtN;IACA,4CAA4C;IAC9C;IAEA,IAAIR,KAAKE,MAAM,CAACP,qBAAqB;QACnC,MAAMgB,UAAU,MAAMzB,YACpBc,MACAL,oBACAG;QAEF,IAAIa,SAAS;YACX,MAAMzB,YACJc,MACAL,oBACA;YAEF,MAAMT,YACJc,MACAL,oBACA;YAEF,MAAMX,sBACJgB,MACAL,oBACA;gBAAC;aAA4B,EAC7BU;QAEJ,OAAO;YACL,MAAMO,WAAWZ,KAAKa,IAAI,CAAClB,oBAAoB,YAAY;YAC3D,IAAI,CAACiB,SAASE,QAAQ,CAAC,wCAAwC;gBAC7Db,UAAUQ,IAAI,CACZ,GAAGd,mBAAmB,2LAA2L,CAAC;YAEtN;QACA,4CAA4C;QAC9C;IACF;IAEA,MAAMR,qBAAqBa;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.50/0003-terraform-bootstrap-adopt-existing-bucket/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Adopt an existing Terraform state bucket in the vended bootstrap script when its state object is missing"
+}

package/src/migrations/v1.0.0-rc.50/0003-terraform-bootstrap-adopt-existing-bucket/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.0-rc.50/0003-terraform-bootstrap-adopt-existing-bucket/migration.js

@@ -0,0 +1,128 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments } from "@nx/devkit";
+import { TERRAFORM_PROJECT_GENERATOR_INFO } from "../../../terraform/project/generator.js";
+import { applyGritQL, GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * Adopt an existing Terraform state bucket in the vended bootstrap script when its state object is missing
+ *
+ * The state bucket stores its own tfstate inside itself, so if that object is
+ * deleted while the bucket survives, `bootstrap` reads the 404 as a first run
+ * and asks terraform to create a bucket that already exists — failing with
+ * `BucketAlreadyOwnedByYou` on every subsequent run, with no retry that clears
+ * it. The vended script now imports the existing bucket instead.
+ *
+ * Every edit is expressed as a GritQL rewrite so the script is matched on its
+ * AST rather than its formatting.
+ *
+ * How to write a migration:
+ * - https://nx.dev/docs/kb/migration-generators
+ * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject
+ *
+ * Guardrails:
+ * - Pattern-match before writing: skip files that have diverged from the shape
+ *   your generators produce and report them via `nextSteps`, or consider a
+ *   hybrid migration, rather than clobbering the user's changes.
+ * - Idempotent: re-running must be a no-op.
+ * - Format what you write: finish with `formatFilesInSubtree` so the files your
+ *   migration wrote are formatted correctly.
+ */ // Guards the whole migration: present only once the import step exists.
+const MIGRATED_PATTERN = '`bucketExists($_, $_)`';
+// Every edit site, matched structurally so formatting and argument layout
+// don't affect whether the script is recognised.
+const STATE_FETCH_TRY_PATTERN = 'try_statement() as $try where { $try <: contains `GetObjectCommand` }';
+const STATE_FLAG_SET_PATTERN = '`if (out.Body) { $body }`';
+const HELPER_PATTERN = '`const main = async () => { $body }`';
+const INIT_PATTERN = "`execFileSync('terraform', ['init'], $opts)`";
+const S3_IMPORT_PATTERN = "`import { $before, GetObjectCommand, $after } from '@aws-sdk/client-s3'`";
+const HEADER_COMMENT_PATTERN = 'comment() as $c where { $c <: includes "state back to S3." }';
+// GritQL snippets are parsed as backtick-quoted patterns, so any backtick in
+// the inserted source has to survive that layer escaped.
+const BUCKET_EXISTS_HELPER = `// S3 answers 404 only when the name is genuinely free; 403 means it exists
+// but is not readable with these credentials.
+const bucketExists = async (s3: S3Client, bucket: string) => {
+  try {
+    await s3.send(new HeadBucketCommand({ Bucket: bucket }));
+    return true;
+  } catch (err: any) {
+    const status = err?.$metadata?.httpStatusCode;
+    if (status === 404) return false;
+    if (status === 403) return true;
+    throw err;
+  }
+};`;
+const IMPORT_STEP = `// The bucket holds its own state, so losing the state object while the
+  // bucket survives would otherwise wedge bootstrap on a permanent
+  // \`BucketAlreadyOwnedByYou\`. Adopt the existing bucket instead.
+  if (!haveState && (await bucketExists(s3, bucket))) {
+    console.log(
+      \`State bucket \${bucket} already exists but its bootstrap state is missing — importing it.\`,
+    );
+    execFileSync(
+      'terraform',
+      [
+        'import',
+        \`-state=\${tfStatePath}\`,
+        \`-var=aws_region=\${region}\`,
+        'aws_s3_bucket.terraform_state',
+        bucket,
+      ],
+      { cwd: bootstrapDir, stdio: 'inherit' },
+    );
+  }`;
+// Rewritten wholesale rather than appended to, since the summary sentence
+// changes rather than gaining a clause.
+const NEW_HEADER_COMMENT = `/**
+ * Bootstraps the remote Terraform state bucket.
+ *
+ * Equivalent to \\\`cdk bootstrap\\\` — resolves account + region from the AWS
+ * SDK credential chain, pulls any existing bootstrap tfstate from S3,
+ * runs \\\`terraform apply\\\` in the \\\`bootstrap\\\` dir, then pushes the new
+ * state back to S3. Adopts an already-existing state bucket when its
+ * state object is missing.
+ */`;
+const DIVERGED_NEXT_STEP = (filePath)=>`${filePath}: the bootstrap script has diverged from the generated shape - left untouched. Manually \`terraform import aws_s3_bucket.terraform_state <bucket>\` before \`terraform apply\` when the state bucket exists but its \`bootstrap.tfstate\` object does not, otherwise bootstrap fails with BucketAlreadyOwnedByYou.`;
+export default async function migration(tree) {
+    const nextSteps = [];
+    // Terraform application projects are the only ones that vend bootstrap.ts.
+    const bootstrapScripts = [
+        ...getProjects(tree).values()
+    ].filter((project)=>project.metadata?.generator === TERRAFORM_PROJECT_GENERATOR_INFO.id).map((project)=>joinPathFragments(project.root, 'scripts/bootstrap.ts')).filter((filePath)=>tree.exists(filePath));
+    for (const filePath of bootstrapScripts){
+        if (await matchGritQL(tree, filePath, MIGRATED_PATTERN)) {
+            continue;
+        }
+        // Confirm every edit site is present before writing any of them, so a
+        // script that only partly matches is left whole rather than half-edited.
+        const allSitesPresent = (await Promise.all([
+            STATE_FETCH_TRY_PATTERN,
+            STATE_FLAG_SET_PATTERN,
+            HELPER_PATTERN,
+            INIT_PATTERN,
+            S3_IMPORT_PATTERN,
+            HEADER_COMMENT_PATTERN
+        ].map((pattern)=>matchGritQL(tree, filePath, pattern)))).every(Boolean);
+        if (!allSitesPresent) {
+            nextSteps.push(DIVERGED_NEXT_STEP(filePath));
+            continue;
+        }
+        // `haveState` distinguishes "no remote state" from "no bucket", so the
+        // import only runs when terraform has no prior knowledge of the bucket.
+        await insertViaGritQL(tree, filePath, `${STATE_FETCH_TRY_PATTERN} => \`${GRIT_INSERT_PLACEHOLDER}\n  $try\``, 'let haveState = false;');
+        await applyGritQL(tree, filePath, `${STATE_FLAG_SET_PATTERN} => \`if (out.Body) {\n      $body\n      haveState = true;\n    }\``);
+        await insertViaGritQL(tree, filePath, `${HELPER_PATTERN} => \`${GRIT_INSERT_PLACEHOLDER}\n\nconst main = async () => { $body }\``, BUCKET_EXISTS_HELPER);
+        await insertViaGritQL(tree, filePath, `${INIT_PATTERN} => \`execFileSync('terraform', ['init'], $opts);\n\n  ${GRIT_INSERT_PLACEHOLDER}\n\``, IMPORT_STEP);
+        // Placed in the generator's import position rather than appended, so a
+        // migrated workspace matches a freshly generated one.
+        await applyGritQL(tree, filePath, `${S3_IMPORT_PATTERN} => \`import { $before, GetObjectCommand, HeadBucketCommand, $after } from '@aws-sdk/client-s3'\``);
+        await applyGritQL(tree, filePath, `${HEADER_COMMENT_PATTERN} => \`${NEW_HEADER_COMMENT}\``);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.50/0003-terraform-bootstrap-adopt-existing-bucket/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.50/0003-terraform-bootstrap-adopt-existing-bucket/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { TERRAFORM_PROJECT_GENERATOR_INFO } from '../../../terraform/project/generator.js';\nimport {\n  applyGritQL,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * Adopt an existing Terraform state bucket in the vended bootstrap script when its state object is missing\n *\n * The state bucket stores its own tfstate inside itself, so if that object is\n * deleted while the bucket survives, `bootstrap` reads the 404 as a first run\n * and asks terraform to create a bucket that already exists — failing with\n * `BucketAlreadyOwnedByYou` on every subsequent run, with no retry that clears\n * it. The vended script now imports the existing bucket instead.\n *\n * Every edit is expressed as a GritQL rewrite so the script is matched on its\n * AST rather than its formatting.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n *\n * Guardrails:\n * - Pattern-match before writing: skip files that have diverged from the shape\n *   your generators produce and report them via `nextSteps`, or consider a\n *   hybrid migration, rather than clobbering the user's changes.\n * - Idempotent: re-running must be a no-op.\n * - Format what you write: finish with `formatFilesInSubtree` so the files your\n *   migration wrote are formatted correctly.\n */\n\n// Guards the whole migration: present only once the import step exists.\nconst MIGRATED_PATTERN = '`bucketExists($_, $_)`';\n\n// Every edit site, matched structurally so formatting and argument layout\n// don't affect whether the script is recognised.\nconst STATE_FETCH_TRY_PATTERN =\n  'try_statement() as $try where { $try <: contains `GetObjectCommand` }';\nconst STATE_FLAG_SET_PATTERN = '`if (out.Body) { $body }`';\nconst HELPER_PATTERN = '`const main = async () => { $body }`';\nconst INIT_PATTERN = \"`execFileSync('terraform', ['init'], $opts)`\";\nconst S3_IMPORT_PATTERN =\n  \"`import { $before, GetObjectCommand, $after } from '@aws-sdk/client-s3'`\";\nconst HEADER_COMMENT_PATTERN =\n  'comment() as $c where { $c <: includes \"state back to S3.\" }';\n\n// GritQL snippets are parsed as backtick-quoted patterns, so any backtick in\n// the inserted source has to survive that layer escaped.\nconst BUCKET_EXISTS_HELPER = `// S3 answers 404 only when the name is genuinely free; 403 means it exists\n// but is not readable with these credentials.\nconst bucketExists = async (s3: S3Client, bucket: string) => {\n  try {\n    await s3.send(new HeadBucketCommand({ Bucket: bucket }));\n    return true;\n  } catch (err: any) {\n    const status = err?.$metadata?.httpStatusCode;\n    if (status === 404) return false;\n    if (status === 403) return true;\n    throw err;\n  }\n};`;\n\nconst IMPORT_STEP = `// The bucket holds its own state, so losing the state object while the\n  // bucket survives would otherwise wedge bootstrap on a permanent\n  // \\`BucketAlreadyOwnedByYou\\`. Adopt the existing bucket instead.\n  if (!haveState && (await bucketExists(s3, bucket))) {\n    console.log(\n      \\`State bucket \\${bucket} already exists but its bootstrap state is missing — importing it.\\`,\n    );\n    execFileSync(\n      'terraform',\n      [\n        'import',\n        \\`-state=\\${tfStatePath}\\`,\n        \\`-var=aws_region=\\${region}\\`,\n        'aws_s3_bucket.terraform_state',\n        bucket,\n      ],\n      { cwd: bootstrapDir, stdio: 'inherit' },\n    );\n  }`;\n\n// Rewritten wholesale rather than appended to, since the summary sentence\n// changes rather than gaining a clause.\nconst NEW_HEADER_COMMENT = `/**\n * Bootstraps the remote Terraform state bucket.\n *\n * Equivalent to \\\\\\`cdk bootstrap\\\\\\` — resolves account + region from the AWS\n * SDK credential chain, pulls any existing bootstrap tfstate from S3,\n * runs \\\\\\`terraform apply\\\\\\` in the \\\\\\`bootstrap\\\\\\` dir, then pushes the new\n * state back to S3. Adopts an already-existing state bucket when its\n * state object is missing.\n */`;\n\nconst DIVERGED_NEXT_STEP = (filePath: string) =>\n  `${filePath}: the bootstrap script has diverged from the generated shape - left untouched. Manually \\`terraform import aws_s3_bucket.terraform_state <bucket>\\` before \\`terraform apply\\` when the state bucket exists but its \\`bootstrap.tfstate\\` object does not, otherwise bootstrap fails with BucketAlreadyOwnedByYou.`;\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  // Terraform application projects are the only ones that vend bootstrap.ts.\n  const bootstrapScripts = [...getProjects(tree).values()]\n    .filter(\n      (project) =>\n        (project.metadata as any)?.generator ===\n        TERRAFORM_PROJECT_GENERATOR_INFO.id,\n    )\n    .map((project) => joinPathFragments(project.root, 'scripts/bootstrap.ts'))\n    .filter((filePath) => tree.exists(filePath));\n\n  for (const filePath of bootstrapScripts) {\n    if (await matchGritQL(tree, filePath, MIGRATED_PATTERN)) {\n      // Already migrated - silent skip keeps re-runs a no-op.\n      continue;\n    }\n\n    // Confirm every edit site is present before writing any of them, so a\n    // script that only partly matches is left whole rather than half-edited.\n    const allSitesPresent = (\n      await Promise.all(\n        [\n          STATE_FETCH_TRY_PATTERN,\n          STATE_FLAG_SET_PATTERN,\n          HELPER_PATTERN,\n          INIT_PATTERN,\n          S3_IMPORT_PATTERN,\n          HEADER_COMMENT_PATTERN,\n        ].map((pattern) => matchGritQL(tree, filePath, pattern)),\n      )\n    ).every(Boolean);\n\n    if (!allSitesPresent) {\n      nextSteps.push(DIVERGED_NEXT_STEP(filePath));\n      continue;\n    }\n\n    // `haveState` distinguishes \"no remote state\" from \"no bucket\", so the\n    // import only runs when terraform has no prior knowledge of the bucket.\n    await insertViaGritQL(\n      tree,\n      filePath,\n      `${STATE_FETCH_TRY_PATTERN} => \\`${GRIT_INSERT_PLACEHOLDER}\\n  $try\\``,\n      'let haveState = false;',\n    );\n    await applyGritQL(\n      tree,\n      filePath,\n      `${STATE_FLAG_SET_PATTERN} => \\`if (out.Body) {\\n      $body\\n      haveState = true;\\n    }\\``,\n    );\n    await insertViaGritQL(\n      tree,\n      filePath,\n      `${HELPER_PATTERN} => \\`${GRIT_INSERT_PLACEHOLDER}\\n\\nconst main = async () => { $body }\\``,\n      BUCKET_EXISTS_HELPER,\n    );\n    await insertViaGritQL(\n      tree,\n      filePath,\n      `${INIT_PATTERN} => \\`execFileSync('terraform', ['init'], $opts);\\n\\n  ${GRIT_INSERT_PLACEHOLDER}\\n\\``,\n      IMPORT_STEP,\n    );\n\n    // Placed in the generator's import position rather than appended, so a\n    // migrated workspace matches a freshly generated one.\n    await applyGritQL(\n      tree,\n      filePath,\n      `${S3_IMPORT_PATTERN} => \\`import { $before, GetObjectCommand, HeadBucketCommand, $after } from '@aws-sdk/client-s3'\\``,\n    );\n\n    await applyGritQL(\n      tree,\n      filePath,\n      `${HEADER_COMMENT_PATTERN} => \\`${NEW_HEADER_COMMENT}\\``,\n    );\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","TERRAFORM_PROJECT_GENERATOR_INFO","applyGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","MIGRATED_PATTERN","STATE_FETCH_TRY_PATTERN","STATE_FLAG_SET_PATTERN","HELPER_PATTERN","INIT_PATTERN","S3_IMPORT_PATTERN","HEADER_COMMENT_PATTERN","BUCKET_EXISTS_HELPER","IMPORT_STEP","NEW_HEADER_COMMENT","DIVERGED_NEXT_STEP","filePath","migration","tree","nextSteps","bootstrapScripts","values","filter","project","metadata","generator","id","map","root","exists","allSitesPresent","Promise","all","pattern","every","Boolean","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,gCAAgC,QAAQ,0CAA0C;AAC3F,SACEC,WAAW,EACXC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GAED,wEAAwE;AACxE,MAAMC,mBAAmB;AAEzB,0EAA0E;AAC1E,iDAAiD;AACjD,MAAMC,0BACJ;AACF,MAAMC,yBAAyB;AAC/B,MAAMC,iBAAiB;AACvB,MAAMC,eAAe;AACrB,MAAMC,oBACJ;AACF,MAAMC,yBACJ;AAEF,6EAA6E;AAC7E,yDAAyD;AACzD,MAAMC,uBAAuB,CAAC;;;;;;;;;;;;EAY5B,CAAC;AAEH,MAAMC,cAAc,CAAC;;;;;;;;;;;;;;;;;;GAkBlB,CAAC;AAEJ,0EAA0E;AAC1E,wCAAwC;AACxC,MAAMC,qBAAqB,CAAC;;;;;;;;GAQzB,CAAC;AAEJ,MAAMC,qBAAqB,CAACC,WAC1B,GAAGA,SAAS,kTAAkT,CAAC;AAEjU,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,2EAA2E;IAC3E,MAAMC,mBAAmB;WAAIvB,YAAYqB,MAAMG,MAAM;KAAG,CACrDC,MAAM,CACL,CAACC,UACC,AAACA,QAAQC,QAAQ,EAAUC,cAC3B1B,iCAAiC2B,EAAE,EAEtCC,GAAG,CAAC,CAACJ,UAAYzB,kBAAkByB,QAAQK,IAAI,EAAE,yBACjDN,MAAM,CAAC,CAACN,WAAaE,KAAKW,MAAM,CAACb;IAEpC,KAAK,MAAMA,YAAYI,iBAAkB;QACvC,IAAI,MAAMjB,YAAYe,MAAMF,UAAUX,mBAAmB;YAEvD;QACF;QAEA,sEAAsE;QACtE,yEAAyE;QACzE,MAAMyB,kBAAkB,AACtB,CAAA,MAAMC,QAAQC,GAAG,CACf;YACE1B;YACAC;YACAC;YACAC;YACAC;YACAC;SACD,CAACgB,GAAG,CAAC,CAACM,UAAY9B,YAAYe,MAAMF,UAAUiB,UACjD,EACAC,KAAK,CAACC;QAER,IAAI,CAACL,iBAAiB;YACpBX,UAAUiB,IAAI,CAACrB,mBAAmBC;YAClC;QACF;QAEA,uEAAuE;QACvE,wEAAwE;QACxE,MAAMd,gBACJgB,MACAF,UACA,GAAGV,wBAAwB,MAAM,EAAEL,wBAAwB,UAAU,CAAC,EACtE;QAEF,MAAMD,YACJkB,MACAF,UACA,GAAGT,uBAAuB,oEAAoE,CAAC;QAEjG,MAAML,gBACJgB,MACAF,UACA,GAAGR,eAAe,MAAM,EAAEP,wBAAwB,wCAAwC,CAAC,EAC3FW;QAEF,MAAMV,gBACJgB,MACAF,UACA,GAAGP,aAAa,uDAAuD,EAAER,wBAAwB,IAAI,CAAC,EACtGY;QAGF,uEAAuE;QACvE,sDAAsD;QACtD,MAAMb,YACJkB,MACAF,UACA,GAAGN,kBAAkB,iGAAiG,CAAC;QAGzH,MAAMV,YACJkB,MACAF,UACA,GAAGL,uBAAuB,MAAM,EAAEG,mBAAmB,EAAE,CAAC;IAE5D;IAEA,MAAMV,qBAAqBc;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.52/0001-user-identity-waf-allow-localhost-callback/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Count the EC2MetaDataSSRF_QUERYARGUMENTS WAF rule on the UserIdentity Web ACL so sign-in from a local dev server is not blocked"
+}

package/src/migrations/v1.0.0-rc.52/0001-user-identity-waf-allow-localhost-callback/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { MigrationReturnObject, Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.0-rc.52/0001-user-identity-waf-allow-localhost-callback/migration.js

@@ -0,0 +1,215 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { applyGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Count the EC2MetaDataSSRF_QUERYARGUMENTS WAF rule on the UserIdentity Web ACL
+ *
+ * `AWSManagedRulesCommonRuleSet` treats the loopback `redirect_uri` the Cognito
+ * Hosted UI receives during local sign-in as an SSRF attempt, so sign-in against
+ * a local dev server fails with an opaque 403 before the login page renders. The
+ * rule is overridden to Count while a local callback URL is allowed; every other
+ * rule in the group still blocks.
+ *
+ * The local callback URLs are lifted into a named constant so the override can be
+ * derived from them rather than restating the condition.
+ *
+ * How to write a migration:
+ * - https://nx.dev/docs/kb/migration-generators
+ * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject
+ *
+ * Guardrails:
+ * - Pattern-match before writing: skip files that have diverged from the shape
+ *   your generators produce and report them via `nextSteps`, rather than
+ *   clobbering the user's changes.
+ * - Idempotent: re-running must be a no-op.
+ * - Format what you write: finish with `formatFilesInSubtree` so the files your
+ *   migration wrote are formatted correctly.
+ */ const CDK_USER_IDENTITY_FILE = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/user-identity.ts`;
+const TERRAFORM_IDENTITY_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/user-identity/identity/identity.tf`;
+const SSRF_RULE_NAME = 'EC2MetaDataSSRF_QUERYARGUMENTS';
+// Guards each file: present only once the override has been added.
+const CDK_MIGRATED_PATTERN = `\`ruleActionOverrides: allowsLocalCallback ? $_ : undefined\``;
+const TERRAFORM_MIGRATED_PATTERN = `language hcl\n\`name = "${SSRF_RULE_NAME}"\``;
+// Every CDK edit site, matched structurally so formatting doesn't affect whether
+// the construct is recognised.
+const CDK_CONSTANT_ANCHOR_PATTERN = "`const WEB_CLIENT_ID = 'WebClient'`";
+// Scoped to the `.concat` callsite so it can't also rewrite the array literal
+// inside the constant this migration inserts.
+const CDK_LOCAL_URLS_PATTERN = "`['http://localhost:4200', 'http://localhost:4300'].concat($rest)`";
+const CDK_CALL_PATTERN = '`this.createWebAcl($id, this.userPool)`';
+const CDK_SIGNATURE_PATTERN = '`private createWebAcl = ($id: string, $pool: UserPool) => $body`';
+const CDK_STATEMENT_PATTERN = "`managedRuleGroupStatement: { name: 'AWSManagedRulesCommonRuleSet', vendorName: 'AWS' }`";
+const CDK_EDITS = [
+    // Local callback URLs become a named constant the override can key off.
+    [
+        CDK_CONSTANT_ANCHOR_PATTERN,
+        `${CDK_CONSTANT_ANCHOR_PATTERN} => \`const WEB_CLIENT_ID = 'WebClient';
+
+/** Local dev server origins permitted to complete the sign-in redirect */
+const LOCAL_CALLBACK_URLS = ['http://localhost:4200', 'http://localhost:4300']\``
+    ],
+    [
+        CDK_LOCAL_URLS_PATTERN,
+        `${CDK_LOCAL_URLS_PATTERN} => \`LOCAL_CALLBACK_URLS.concat($rest)\``
+    ],
+    [
+        CDK_CALL_PATTERN,
+        `${CDK_CALL_PATTERN} => \`this.createWebAcl($id, this.userPool, LOCAL_CALLBACK_URLS.length > 0)\``
+    ],
+    [
+        CDK_SIGNATURE_PATTERN,
+        `${CDK_SIGNATURE_PATTERN} => \`private createWebAcl = (
+    $id: string,
+    $pool: UserPool,
+    allowsLocalCallback: boolean
+  ) => $body\``
+    ],
+    [
+        CDK_STATEMENT_PATTERN,
+        `${CDK_STATEMENT_PATTERN} => \`managedRuleGroupStatement: {
+              name: 'AWSManagedRulesCommonRuleSet',
+              vendorName: 'AWS',
+              // ${SSRF_RULE_NAME} treats the loopback redirect_uri the
+              // Hosted UI receives during local sign-in as an SSRF attempt. Counted
+              // only while a local callback URL is allowed; every other rule blocks.
+              ruleActionOverrides: allowsLocalCallback
+                ? [
+                    {
+                      name: '${SSRF_RULE_NAME}',
+                      actionToUse: { count: {} },
+                    },
+                  ]
+                : undefined,
+            }\``
+    ]
+];
+const TERRAFORM_DATA_SOURCES_PATTERN = [
+    'language hcl',
+    '`data "aws_region" "current" {}`'
+].join('\n');
+const TERRAFORM_EDITS = [
+    // Local callback URLs become a local the override can key off.
+    [
+        TERRAFORM_DATA_SOURCES_PATTERN,
+        [
+            'language hcl',
+            '`data "aws_region" "current" {}` => `data "aws_region" "current" {}',
+            '',
+            'locals {',
+            '  # Local dev server origins permitted to complete the sign-in redirect',
+            '  local_callback_urls = [',
+            '    "http://localhost:4200",',
+            '    "http://localhost:4300"',
+            '  ]',
+            '}`'
+        ].join('\n')
+    ],
+    [
+        [
+            'language hcl',
+            '`callback_urls = concat([',
+            '    "http://localhost:4200",',
+            '    "http://localhost:4300"',
+            '  ], var.callback_urls)`'
+        ].join('\n'),
+        [
+            'language hcl',
+            '`callback_urls = concat([',
+            '    "http://localhost:4200",',
+            '    "http://localhost:4300"',
+            '  ], var.callback_urls)` => `callback_urls = concat(local.local_callback_urls, var.callback_urls)`'
+        ].join('\n')
+    ],
+    [
+        [
+            'language hcl',
+            '`logout_urls = concat([',
+            '    "http://localhost:4200",',
+            '    "http://localhost:4300"',
+            '  ], var.logout_urls)`'
+        ].join('\n'),
+        [
+            'language hcl',
+            '`logout_urls = concat([',
+            '    "http://localhost:4200",',
+            '    "http://localhost:4300"',
+            '  ], var.logout_urls)` => `logout_urls = concat(local.local_callback_urls, var.logout_urls)`'
+        ].join('\n')
+    ],
+    [
+        [
+            'language hcl',
+            '`managed_rule_group_statement {',
+            '        name        = "AWSManagedRulesCommonRuleSet"',
+            '        vendor_name = "AWS"',
+            '      }`'
+        ].join('\n'),
+        [
+            'language hcl',
+            '`managed_rule_group_statement {',
+            '        name        = "AWSManagedRulesCommonRuleSet"',
+            '        vendor_name = "AWS"',
+            '      }` => `managed_rule_group_statement {',
+            '        name        = "AWSManagedRulesCommonRuleSet"',
+            '        vendor_name = "AWS"',
+            '',
+            `        # ${SSRF_RULE_NAME} treats the loopback redirect_uri the`,
+            '        # Hosted UI receives during local sign-in as an SSRF attempt. Counted',
+            '        # only while a local callback URL is allowed; every other rule blocks.',
+            '        dynamic "rule_action_override" {',
+            '          for_each = length(local.local_callback_urls) > 0 ? [1] : []',
+            '',
+            '          content {',
+            `            name = "${SSRF_RULE_NAME}"`,
+            '',
+            '            action_to_use {',
+            '              count {}',
+            '            }',
+            '          }',
+            '        }',
+            '      }`'
+        ].join('\n')
+    ]
+];
+const divergedNextStep = (filePath)=>`${filePath}: the UserIdentity Web ACL has diverged from the generated shape - left untouched. To sign in against a local dev server, override ${SSRF_RULE_NAME} in the AWSManagedRulesCommonRuleSet rule group to Count, otherwise the Cognito Hosted UI returns 403 for localhost redirect URIs.`;
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const [filePath, migratedPattern, edits] of [
+        [
+            CDK_USER_IDENTITY_FILE,
+            CDK_MIGRATED_PATTERN,
+            CDK_EDITS
+        ],
+        [
+            TERRAFORM_IDENTITY_FILE,
+            TERRAFORM_MIGRATED_PATTERN,
+            TERRAFORM_EDITS
+        ]
+    ]){
+        if (!tree.exists(filePath)) {
+            continue;
+        }
+        if (await matchGritQL(tree, filePath, migratedPattern)) {
+            continue;
+        }
+        // Confirm every edit site is present before writing any of them, so a file
+        // that only partly matches is left whole rather than half-edited.
+        const allSitesPresent = (await Promise.all(edits.map(([match])=>matchGritQL(tree, filePath, match)))).every(Boolean);
+        if (!allSitesPresent) {
+            nextSteps.push(divergedNextStep(filePath));
+            continue;
+        }
+        for (const [, rewrite] of edits){
+            await applyGritQL(tree, filePath, rewrite);
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map