@aws/nx-plugin 1.0.0-rc.9 → 1.0.0-rc.90

package/src/migrations/latest/terraform-fmt-check/migration.js

@@ -0,0 +1,165 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments, updateProjectConfiguration } from "@nx/devkit";
+import { addLicenseCheckToLintTarget } from "../../../license/config.js";
+import { TERRAFORM_FORMAT_TARGET, TERRAFORM_PROJECT_GENERATOR_INFO } from "../../../terraform/project/generator.js";
+import { applyGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { sortObjectKeys } from "../../../utils/object.js";
+/**
+ * Converges a Terraform project's format target on the shape ts and py projects
+ * carry: a `format` target that checks, a `fix` configuration that writes, and a
+ * `lint` target orchestrating it so `run-many --target lint` reaches Terraform
+ * projects with its `fix` and `skip-lint` configurations propagating.
+ *
+ * The target was named `fmt` and ran `terraform fmt`, which rewrites the files it
+ * reads. Those files are its own declared `inputs`, so every run changed the hash
+ * it had just been computed from and it could never cache-hit — Nx reported it
+ * flaky on every build. That per-run write is also what kept the vended
+ * `providers.tf` backend block aligned, so this realigns it.
+ */ /** The command the base target ran before it checked rather than wrote. */ const WRITING_COMMAND = 'terraform fmt';
+/**
+ * The `backend "s3"` arguments the generator vends. Realignment only applies to a
+ * block holding exactly these.
+ */ const BACKEND_ARGUMENTS = [
+    'encrypt',
+    'use_lockfile'
+];
+/** Matches the arguments of a `backend "s3"` block, and their alignment. */ const BACKEND_BLOCK = /backend\s+"s3"\s*\{([^}]*)\}/;
+const BACKEND_ARGUMENT = /^[ \t]*([A-Za-z_][A-Za-z0-9_]*)([ \t]*)=/gm;
+/**
+ * The arguments a `providers.tf` declares in its `backend "s3"` block, in order,
+ * each with the column its `=` currently sits at.
+ */ const readBackendArguments = (contents)=>{
+    const block = BACKEND_BLOCK.exec(contents)?.[1];
+    if (block === undefined) return undefined;
+    return [
+        ...block.matchAll(BACKEND_ARGUMENT)
+    ].map(([, name, gap])=>({
+            name,
+            column: name.length + gap.length
+        }));
+};
+/**
+ * Realigns the `backend "s3"` arguments in an application's `providers.tf`, which
+ * the checking target requires and the per-run write had been supplying.
+ *
+ * `terraform fmt` aligns `=` to the widest key in the whole block, so a block
+ * carrying arguments beyond the two vended ones has a width this cannot know.
+ * Such a block is left alone and reported: rewriting it to the vended width
+ * would push those two out of alignment with the user's own arguments and fail
+ * the very check this migration installs.
+ */ const realignProviders = async (tree, projectName, projectRoot, nextSteps)=>{
+    const filePath = joinPathFragments(projectRoot, 'src', 'providers.tf');
+    if (!tree.exists(filePath)) return;
+    const declared = readBackendArguments(tree.read(filePath, 'utf-8') ?? '');
+    if (!declared?.length) return;
+    const isVendedBlock = declared.length === BACKEND_ARGUMENTS.length && declared.every(({ name })=>BACKEND_ARGUMENTS.includes(name));
+    if (!isVendedBlock) {
+        nextSteps.push(`${filePath}: its \`backend "s3"\` block declares arguments beyond the generated ones, so its alignment was left as it is. Run \`nx run ${projectName}:format --configuration=fix\` if the new format check reports it.`);
+        return;
+    }
+    const width = Math.max(...BACKEND_ARGUMENTS.map((name)=>name.length));
+    // Already at the width `terraform fmt` aligns this block to, so a re-run — and
+    // a workspace whose file is formatted — is a no-op.
+    if (declared.every(({ column })=>column === width)) return;
+    // Each argument is realigned around whatever value it holds, so a value the
+    // user changed is preserved. An argument whose name already fills the width
+    // rewrites to a textually identical pattern, which GritQL notes; the rewrite
+    // still normalises the whitespace around its `=`, which is the point.
+    for (const { name } of declared){
+        await applyGritQL(tree, filePath, `language hcl\n\`${name} = $value\` => \`${name.padEnd(width)} = $value\`` + ` where { $value <: within \`backend "s3" { $_ }\` }`);
+    }
+};
+/** The target name this migration converges on, matching ts and py projects. */ const FORMAT_TARGET = 'format';
+/** The name the generator vended this target under before the rename. */ const LEGACY_TARGET = 'fmt';
+/**
+ * Repoints `dependsOn` entries naming the old target at the new one. A stale
+ * entry is not an error in Nx — it silently drops the edge — so `build` would
+ * stop checking formatting altogether.
+ */ const repointDependsOn = (project)=>{
+    let changed = false;
+    for (const target of Object.values(project.targets ?? {})){
+        const dependsOn = target.dependsOn;
+        if (!Array.isArray(dependsOn) || !dependsOn.includes(LEGACY_TARGET)) {
+            continue;
+        }
+        target.dependsOn = dependsOn.map((entry)=>entry === LEGACY_TARGET ? FORMAT_TARGET : entry);
+        changed = true;
+    }
+    return changed;
+};
+/**
+ * Renames the `fmt` target to `format`, moves it onto the checking form, and
+ * adds the `lint` target that orchestrates it.
+ *
+ * A target whose command is not the one the generator produced is the user's, so
+ * it is reported instead. Both the vended name and the new one are accepted as
+ * the starting point, so a workspace part-way through converges either way.
+ */ const migrateProject = (projectName, project, nextSteps)=>{
+    const targets = project.targets ?? {};
+    const existingName = targets[FORMAT_TARGET] ? FORMAT_TARGET : targets[LEGACY_TARGET] ? LEGACY_TARGET : undefined;
+    if (!existingName) return false;
+    const format = targets[existingName];
+    let changed = false;
+    if (format.options?.command === WRITING_COMMAND) {
+        targets[existingName] = {
+            ...format,
+            inputs: TERRAFORM_FORMAT_TARGET.inputs,
+            options: {
+                ...format.options,
+                command: TERRAFORM_FORMAT_TARGET.options.command
+            },
+            // The user's own configurations win, as their `options` do above: someone
+            // who set `fix` to `terraform fmt -recursive` to cover nested modules
+            // keeps it.
+            configurations: {
+                ...TERRAFORM_FORMAT_TARGET.configurations,
+                ...format.configurations
+            }
+        };
+        changed = true;
+    } else if (!format.configurations?.fix) {
+        nextSteps.push(`${projectName}: its '${existingName}' target has been customised, so it was left as it is. Have it run \`${TERRAFORM_FORMAT_TARGET.options.command}\` and move the writing form to a 'fix' configuration — writing from the base target rewrites the inputs its cache key is computed from, so it can never cache-hit.`);
+        return false;
+    }
+    if (existingName === LEGACY_TARGET) {
+        targets[FORMAT_TARGET] = targets[LEGACY_TARGET];
+        delete targets[LEGACY_TARGET];
+        changed = true;
+    }
+    changed = repointDependsOn(project) || changed;
+    if (!targets.lint) {
+        targets.lint = {
+            dependsOn: [
+                FORMAT_TARGET
+            ]
+        };
+        changed = true;
+    }
+    return changed;
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const [projectName, project] of getProjects(tree)){
+        const generator = project.metadata?.generator;
+        if (generator !== TERRAFORM_PROJECT_GENERATOR_INFO.id) continue;
+        if (migrateProject(projectName, project, nextSteps)) {
+            updateProjectConfiguration(tree, projectName, {
+                ...project,
+                targets: sortObjectKeys(project.targets)
+            });
+            // The new `lint` target checks licenses alongside formatting, as every
+            // other linting project's does in a workspace that has run `license`.
+            addLicenseCheckToLintTarget(tree, projectName);
+        }
+        await realignProviders(tree, projectName, project.root, nextSteps);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/terraform-fmt-check/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/terraform-fmt-check/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { addLicenseCheckToLintTarget } from '../../../license/config.js';\nimport {\n  TERRAFORM_FORMAT_TARGET,\n  TERRAFORM_PROJECT_GENERATOR_INFO,\n} from '../../../terraform/project/generator.js';\nimport { applyGritQL } from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { sortObjectKeys } from '../../../utils/object.js';\n\n/**\n * Converges a Terraform project's format target on the shape ts and py projects\n * carry: a `format` target that checks, a `fix` configuration that writes, and a\n * `lint` target orchestrating it so `run-many --target lint` reaches Terraform\n * projects with its `fix` and `skip-lint` configurations propagating.\n *\n * The target was named `fmt` and ran `terraform fmt`, which rewrites the files it\n * reads. Those files are its own declared `inputs`, so every run changed the hash\n * it had just been computed from and it could never cache-hit — Nx reported it\n * flaky on every build. That per-run write is also what kept the vended\n * `providers.tf` backend block aligned, so this realigns it.\n */\n\n/** The command the base target ran before it checked rather than wrote. */\nconst WRITING_COMMAND = 'terraform fmt';\n\n/**\n * The `backend \"s3\"` arguments the generator vends. Realignment only applies to a\n * block holding exactly these.\n */\nconst BACKEND_ARGUMENTS = ['encrypt', 'use_lockfile'];\n\n/** Matches the arguments of a `backend \"s3\"` block, and their alignment. */\nconst BACKEND_BLOCK = /backend\\s+\"s3\"\\s*\\{([^}]*)\\}/;\nconst BACKEND_ARGUMENT = /^[ \\t]*([A-Za-z_][A-Za-z0-9_]*)([ \\t]*)=/gm;\n\n/**\n * The arguments a `providers.tf` declares in its `backend \"s3\"` block, in order,\n * each with the column its `=` currently sits at.\n */\nconst readBackendArguments = (\n  contents: string,\n): { name: string; column: number }[] | undefined => {\n  const block = BACKEND_BLOCK.exec(contents)?.[1];\n  if (block === undefined) return undefined;\n  return [...block.matchAll(BACKEND_ARGUMENT)].map(([, name, gap]) => ({\n    name,\n    column: name.length + gap.length,\n  }));\n};\n\n/**\n * Realigns the `backend \"s3\"` arguments in an application's `providers.tf`, which\n * the checking target requires and the per-run write had been supplying.\n *\n * `terraform fmt` aligns `=` to the widest key in the whole block, so a block\n * carrying arguments beyond the two vended ones has a width this cannot know.\n * Such a block is left alone and reported: rewriting it to the vended width\n * would push those two out of alignment with the user's own arguments and fail\n * the very check this migration installs.\n */\nconst realignProviders = async (\n  tree: Tree,\n  projectName: string,\n  projectRoot: string,\n  nextSteps: string[],\n): Promise<void> => {\n  const filePath = joinPathFragments(projectRoot, 'src', 'providers.tf');\n  if (!tree.exists(filePath)) return;\n\n  const declared = readBackendArguments(tree.read(filePath, 'utf-8') ?? '');\n  if (!declared?.length) return;\n\n  const isVendedBlock =\n    declared.length === BACKEND_ARGUMENTS.length &&\n    declared.every(({ name }) => BACKEND_ARGUMENTS.includes(name));\n  if (!isVendedBlock) {\n    nextSteps.push(\n      `${filePath}: its \\`backend \"s3\"\\` block declares arguments beyond the generated ones, so its alignment was left as it is. Run \\`nx run ${projectName}:format --configuration=fix\\` if the new format check reports it.`,\n    );\n    return;\n  }\n\n  const width = Math.max(...BACKEND_ARGUMENTS.map((name) => name.length));\n\n  // Already at the width `terraform fmt` aligns this block to, so a re-run — and\n  // a workspace whose file is formatted — is a no-op.\n  if (declared.every(({ column }) => column === width)) return;\n\n  // Each argument is realigned around whatever value it holds, so a value the\n  // user changed is preserved. An argument whose name already fills the width\n  // rewrites to a textually identical pattern, which GritQL notes; the rewrite\n  // still normalises the whitespace around its `=`, which is the point.\n  for (const { name } of declared) {\n    await applyGritQL(\n      tree,\n      filePath,\n      `language hcl\\n\\`${name} = $value\\` => \\`${name.padEnd(width)} = $value\\`` +\n        ` where { $value <: within \\`backend \"s3\" { $_ }\\` }`,\n    );\n  }\n};\n\n/** The target name this migration converges on, matching ts and py projects. */\nconst FORMAT_TARGET = 'format';\n/** The name the generator vended this target under before the rename. */\nconst LEGACY_TARGET = 'fmt';\n\n/**\n * Repoints `dependsOn` entries naming the old target at the new one. A stale\n * entry is not an error in Nx — it silently drops the edge — so `build` would\n * stop checking formatting altogether.\n */\nconst repointDependsOn = (project: ProjectConfiguration): boolean => {\n  let changed = false;\n  for (const target of Object.values(project.targets ?? {})) {\n    const dependsOn = target.dependsOn;\n    if (!Array.isArray(dependsOn) || !dependsOn.includes(LEGACY_TARGET)) {\n      continue;\n    }\n    target.dependsOn = dependsOn.map((entry) =>\n      entry === LEGACY_TARGET ? FORMAT_TARGET : entry,\n    );\n    changed = true;\n  }\n  return changed;\n};\n\n/**\n * Renames the `fmt` target to `format`, moves it onto the checking form, and\n * adds the `lint` target that orchestrates it.\n *\n * A target whose command is not the one the generator produced is the user's, so\n * it is reported instead. Both the vended name and the new one are accepted as\n * the starting point, so a workspace part-way through converges either way.\n */\nconst migrateProject = (\n  projectName: string,\n  project: ProjectConfiguration,\n  nextSteps: string[],\n): boolean => {\n  const targets = project.targets ?? {};\n  const existingName = targets[FORMAT_TARGET]\n    ? FORMAT_TARGET\n    : targets[LEGACY_TARGET]\n      ? LEGACY_TARGET\n      : undefined;\n  if (!existingName) return false;\n\n  const format = targets[existingName];\n  let changed = false;\n\n  if (format.options?.command === WRITING_COMMAND) {\n    targets[existingName] = {\n      ...format,\n      inputs: TERRAFORM_FORMAT_TARGET.inputs,\n      options: {\n        ...format.options,\n        command: TERRAFORM_FORMAT_TARGET.options.command,\n      },\n      // The user's own configurations win, as their `options` do above: someone\n      // who set `fix` to `terraform fmt -recursive` to cover nested modules\n      // keeps it.\n      configurations: {\n        ...TERRAFORM_FORMAT_TARGET.configurations,\n        ...format.configurations,\n      },\n    };\n    changed = true;\n  } else if (!format.configurations?.fix) {\n    nextSteps.push(\n      `${projectName}: its '${existingName}' target has been customised, so it was left as it is. Have it run \\`${TERRAFORM_FORMAT_TARGET.options.command}\\` and move the writing form to a 'fix' configuration — writing from the base target rewrites the inputs its cache key is computed from, so it can never cache-hit.`,\n    );\n    return false;\n  }\n\n  if (existingName === LEGACY_TARGET) {\n    targets[FORMAT_TARGET] = targets[LEGACY_TARGET];\n    delete targets[LEGACY_TARGET];\n    changed = true;\n  }\n\n  changed = repointDependsOn(project) || changed;\n\n  if (!targets.lint) {\n    targets.lint = { dependsOn: [FORMAT_TARGET] };\n    changed = true;\n  }\n\n  return changed;\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [projectName, project] of getProjects(tree)) {\n    const generator = (project.metadata as { generator?: string } | undefined)\n      ?.generator;\n    if (generator !== TERRAFORM_PROJECT_GENERATOR_INFO.id) continue;\n\n    if (migrateProject(projectName, project, nextSteps)) {\n      updateProjectConfiguration(tree, projectName, {\n        ...project,\n        targets: sortObjectKeys(project.targets),\n      });\n      // The new `lint` target checks licenses alongside formatting, as every\n      // other linting project's does in a workspace that has run `license`.\n      addLicenseCheckToLintTarget(tree, projectName);\n    }\n\n    await realignProviders(tree, projectName, project.root, nextSteps);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","updateProjectConfiguration","addLicenseCheckToLintTarget","TERRAFORM_FORMAT_TARGET","TERRAFORM_PROJECT_GENERATOR_INFO","applyGritQL","formatFilesInSubtree","sortObjectKeys","WRITING_COMMAND","BACKEND_ARGUMENTS","BACKEND_BLOCK","BACKEND_ARGUMENT","readBackendArguments","contents","block","exec","undefined","matchAll","map","name","gap","column","length","realignProviders","tree","projectName","projectRoot","nextSteps","filePath","exists","declared","read","isVendedBlock","every","includes","push","width","Math","max","padEnd","FORMAT_TARGET","LEGACY_TARGET","repointDependsOn","project","changed","target","Object","values","targets","dependsOn","Array","isArray","entry","migrateProject","existingName","format","options","command","inputs","configurations","fix","lint","migration","generator","metadata","id","root"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,EAIjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,2BAA2B,QAAQ,6BAA6B;AACzE,SACEC,uBAAuB,EACvBC,gCAAgC,QAC3B,0CAA0C;AACjD,SAASC,WAAW,QAAQ,wBAAwB;AACpD,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,cAAc,QAAQ,2BAA2B;AAE1D;;;;;;;;;;;CAWC,GAED,yEAAyE,GACzE,MAAMC,kBAAkB;AAExB;;;CAGC,GACD,MAAMC,oBAAoB;IAAC;IAAW;CAAe;AAErD,0EAA0E,GAC1E,MAAMC,gBAAgB;AACtB,MAAMC,mBAAmB;AAEzB;;;CAGC,GACD,MAAMC,uBAAuB,CAC3BC;IAEA,MAAMC,QAAQJ,cAAcK,IAAI,CAACF,WAAW,CAAC,EAAE;IAC/C,IAAIC,UAAUE,WAAW,OAAOA;IAChC,OAAO;WAAIF,MAAMG,QAAQ,CAACN;KAAkB,CAACO,GAAG,CAAC,CAAC,GAAGC,MAAMC,IAAI,GAAM,CAAA;YACnED;YACAE,QAAQF,KAAKG,MAAM,GAAGF,IAAIE,MAAM;QAClC,CAAA;AACF;AAEA;;;;;;;;;CASC,GACD,MAAMC,mBAAmB,OACvBC,MACAC,aACAC,aACAC;IAEA,MAAMC,WAAW5B,kBAAkB0B,aAAa,OAAO;IACvD,IAAI,CAACF,KAAKK,MAAM,CAACD,WAAW;IAE5B,MAAME,WAAWlB,qBAAqBY,KAAKO,IAAI,CAACH,UAAU,YAAY;IACtE,IAAI,CAACE,UAAUR,QAAQ;IAEvB,MAAMU,gBACJF,SAASR,MAAM,KAAKb,kBAAkBa,MAAM,IAC5CQ,SAASG,KAAK,CAAC,CAAC,EAAEd,IAAI,EAAE,GAAKV,kBAAkByB,QAAQ,CAACf;IAC1D,IAAI,CAACa,eAAe;QAClBL,UAAUQ,IAAI,CACZ,GAAGP,SAAS,4HAA4H,EAAEH,YAAY,iEAAiE,CAAC;QAE1N;IACF;IAEA,MAAMW,QAAQC,KAAKC,GAAG,IAAI7B,kBAAkBS,GAAG,CAAC,CAACC,OAASA,KAAKG,MAAM;IAErE,+EAA+E;IAC/E,oDAAoD;IACpD,IAAIQ,SAASG,KAAK,CAAC,CAAC,EAAEZ,MAAM,EAAE,GAAKA,WAAWe,QAAQ;IAEtD,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,sEAAsE;IACtE,KAAK,MAAM,EAAEjB,IAAI,EAAE,IAAIW,SAAU;QAC/B,MAAMzB,YACJmB,MACAI,UACA,CAAC,gBAAgB,EAAET,KAAK,iBAAiB,EAAEA,KAAKoB,MAAM,CAACH,OAAO,WAAW,CAAC,GACxE,CAAC,mDAAmD,CAAC;IAE3D;AACF;AAEA,8EAA8E,GAC9E,MAAMI,gBAAgB;AACtB,uEAAuE,GACvE,MAAMC,gBAAgB;AAEtB;;;;CAIC,GACD,MAAMC,mBAAmB,CAACC;IACxB,IAAIC,UAAU;IACd,KAAK,MAAMC,UAAUC,OAAOC,MAAM,CAACJ,QAAQK,OAAO,IAAI,CAAC,GAAI;QACzD,MAAMC,YAAYJ,OAAOI,SAAS;QAClC,IAAI,CAACC,MAAMC,OAAO,CAACF,cAAc,CAACA,UAAUf,QAAQ,CAACO,gBAAgB;YACnE;QACF;QACAI,OAAOI,SAAS,GAAGA,UAAU/B,GAAG,CAAC,CAACkC,QAChCA,UAAUX,gBAAgBD,gBAAgBY;QAE5CR,UAAU;IACZ;IACA,OAAOA;AACT;AAEA;;;;;;;CAOC,GACD,MAAMS,iBAAiB,CACrB5B,aACAkB,SACAhB;IAEA,MAAMqB,UAAUL,QAAQK,OAAO,IAAI,CAAC;IACpC,MAAMM,eAAeN,OAAO,CAACR,cAAc,GACvCA,gBACAQ,OAAO,CAACP,cAAc,GACpBA,gBACAzB;IACN,IAAI,CAACsC,cAAc,OAAO;IAE1B,MAAMC,SAASP,OAAO,CAACM,aAAa;IACpC,IAAIV,UAAU;IAEd,IAAIW,OAAOC,OAAO,EAAEC,YAAYjD,iBAAiB;QAC/CwC,OAAO,CAACM,aAAa,GAAG;YACtB,GAAGC,MAAM;YACTG,QAAQvD,wBAAwBuD,MAAM;YACtCF,SAAS;gBACP,GAAGD,OAAOC,OAAO;gBACjBC,SAAStD,wBAAwBqD,OAAO,CAACC,OAAO;YAClD;YACA,0EAA0E;YAC1E,sEAAsE;YACtE,YAAY;YACZE,gBAAgB;gBACd,GAAGxD,wBAAwBwD,cAAc;gBACzC,GAAGJ,OAAOI,cAAc;YAC1B;QACF;QACAf,UAAU;IACZ,OAAO,IAAI,CAACW,OAAOI,cAAc,EAAEC,KAAK;QACtCjC,UAAUQ,IAAI,CACZ,GAAGV,YAAY,OAAO,EAAE6B,aAAa,qEAAqE,EAAEnD,wBAAwBqD,OAAO,CAACC,OAAO,CAAC,mKAAmK,CAAC;QAE1T,OAAO;IACT;IAEA,IAAIH,iBAAiBb,eAAe;QAClCO,OAAO,CAACR,cAAc,GAAGQ,OAAO,CAACP,cAAc;QAC/C,OAAOO,OAAO,CAACP,cAAc;QAC7BG,UAAU;IACZ;IAEAA,UAAUF,iBAAiBC,YAAYC;IAEvC,IAAI,CAACI,QAAQa,IAAI,EAAE;QACjBb,QAAQa,IAAI,GAAG;YAAEZ,WAAW;gBAACT;aAAc;QAAC;QAC5CI,UAAU;IACZ;IAEA,OAAOA;AACT;AAEA,eAAe,eAAekB,UAC5BtC,IAAU;IAEV,MAAMG,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACF,aAAakB,QAAQ,IAAI5C,YAAYyB,MAAO;QACtD,MAAMuC,YAAapB,QAAQqB,QAAQ,EAC/BD;QACJ,IAAIA,cAAc3D,iCAAiC6D,EAAE,EAAE;QAEvD,IAAIZ,eAAe5B,aAAakB,SAAShB,YAAY;YACnD1B,2BAA2BuB,MAAMC,aAAa;gBAC5C,GAAGkB,OAAO;gBACVK,SAASzC,eAAeoC,QAAQK,OAAO;YACzC;YACA,uEAAuE;YACvE,sEAAsE;YACtE9C,4BAA4BsB,MAAMC;QACpC;QAEA,MAAMF,iBAAiBC,MAAMC,aAAakB,QAAQuB,IAAI,EAAEvC;IAC1D;IAEA,MAAMrB,qBAAqBkB;IAE3B,OAAO;QAAEG;IAAU;AACrB"}

package/src/migrations/latest/terraform-provider-plugin-cache/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Share Terraform provider downloads across terraform init targets via TF_PLUGIN_CACHE_DIR"
+}

package/src/migrations/latest/terraform-provider-plugin-cache/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/terraform-provider-plugin-cache/migration.js

@@ -0,0 +1,164 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { generateFiles, getProjects, joinPathFragments, OverwriteStrategy, updateProjectConfiguration } from "@nx/devkit";
+import { relative } from "path";
+import { TERRAFORM_PROJECT_GENERATOR_INFO } from "../../../terraform/project/generator.js";
+import { addDestructuredImport, applyGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { kebabCase } from "../../../utils/names.js";
+/**
+ * Terraform projects share their provider downloads through
+ * `TF_PLUGIN_CACHE_DIR`, so a `terraform init` whose `.terraform` was cleaned
+ * links the providers already on disk instead of re-downloading them. The AWS
+ * provider alone is several hundred megabytes, which dominated the `test`
+ * target's runtime on every cache miss.
+ *
+ * The cache lives under the already-gitignored `.terraform` at the workspace
+ * root, one directory per project. Terraform reports an error and silently falls
+ * back to downloading when the directory does not exist, so each target creates
+ * it first, and the vended `init` script gets an `env` helper that does the same.
+ *
+ * A directory per project rather than one shared: two `terraform init` runs
+ * filling one cache concurrently each compute a different hash for the same
+ * provider, and terraform then rejects the mismatch against the lock file.
+ *
+ * Nx does not interpolate `{workspaceRoot}` inside `env`, so the value is
+ * relative to the target's own `cwd` of `{projectRoot}/src`.
+ */ const TF_PLUGIN_CACHE_DIR = 'TF_PLUGIN_CACHE_DIR';
+const divergedStep = (projectName, targetName)=>`${projectName}: its '${targetName}' target no longer matches the shape the generator produced - left untouched. To reuse provider downloads, set the \`TF_PLUGIN_CACHE_DIR\` env var to \`.terraform/plugin-cache/<projectRoot>\` under the workspace root (relative to the target's \`cwd\`), creating that directory before \`terraform init\` runs.`;
+/** Path to this project's cache from a target running in `{projectRoot}/src`. */ const pluginCacheDirFor = (projectRoot)=>joinPathFragments(relative(joinPathFragments(projectRoot, 'src'), '.') || '.', '.terraform', 'plugin-cache', '{projectRoot}').replace(/\\/g, '/');
+/** Whether a target already runs the command, however it is expressed. */ const hasCommand = (commands, predicate)=>Array.isArray(commands) && commands.some((c)=>{
+        const command = typeof c === 'string' ? c : c?.command;
+        return typeof command === 'string' && predicate(command);
+    });
+/**
+ * Prepend the `make-dir` that creates the cache directory. `forwardAllArgs` is
+ * off for it alone, so args meant for `terraform` are not passed to `make-dir`.
+ */ const withMakeDir = (commands, pluginCacheDir)=>[
+        {
+            command: `make-dir ${pluginCacheDir}`,
+            forwardAllArgs: false
+        },
+        ...commands
+    ];
+/**
+ * The `terraform init` call in the vended `init` script, matched structurally so
+ * formatting and argument layout don't affect whether it is recognised.
+ */ const INIT_CALL = "`execFileSync('terraform', [$args], { cwd: srcDir, stdio: 'inherit' })`";
+const INIT_CALL_WITH_ENV = "`execFileSync('terraform', [$args], { cwd: srcDir, stdio: 'inherit', env: pluginCacheEnv(projectRootRel) })`";
+const divergedScriptStep = (filePath)=>`${filePath}: its \`terraform init\` call no longer matches the shape the generator produced - left untouched. Pass \`env: pluginCacheEnv(projectRootRel)\` to that \`execFileSync\` so it shares the provider cache in \`scripts/env.ts\`.`;
+/**
+ * Route the vended `init` script's `terraform init` through the shared cache.
+ *
+ * Guarded on the helper not already being imported, so a re-run — and a project
+ * generated with the cache — is a no-op.
+ */ const migrateInitScript = async (tree, filePath, nextSteps)=>{
+    if (!tree.exists(filePath)) return;
+    if (await matchGritQL(tree, filePath, '`pluginCacheEnv($_)`')) return;
+    if (!await matchGritQL(tree, filePath, INIT_CALL)) {
+        nextSteps.push(divergedScriptStep(filePath));
+        return;
+    }
+    await applyGritQL(tree, filePath, `${INIT_CALL} => ${INIT_CALL_WITH_ENV}`);
+    // Placed in the generator's import position rather than prepended, so a
+    // migrated workspace matches a freshly generated one.
+    const awsConfigImport = "`import { resolveAwsConfig } from './aws-config'`";
+    if (await matchGritQL(tree, filePath, awsConfigImport)) {
+        await applyGritQL(tree, filePath, `${awsConfigImport} => \`import { resolveAwsConfig } from './aws-config';\nimport { pluginCacheEnv } from './env'\``);
+    } else {
+        await addDestructuredImport(tree, filePath, [
+            'pluginCacheEnv'
+        ], './env');
+    }
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const [projectName, project] of getProjects(tree)){
+        const generator = project.metadata?.generator;
+        if (generator !== TERRAFORM_PROJECT_GENERATOR_INFO.id) continue;
+        const targets = project.targets ?? {};
+        const pluginCacheDir = pluginCacheDirFor(project.root);
+        let changed = false;
+        /**
+     * Wire the cache into a target that runs `terraform init`. Only the exact
+     * shape the generator produced is rewritten; anything else is the user's and
+     * is reported instead. Guarded on the env var being absent, so a re-run —
+     * and a project already generated with the cache — is a no-op.
+     */ const migrateTarget = (targetName, target, /** Where the commands live: on the target, or under a configuration. */ commandsHolder, env)=>{
+            if (!target) return;
+            if (env?.[TF_PLUGIN_CACHE_DIR]) return;
+            if (!hasCommand(commandsHolder.commands, (c)=>c.includes('terraform init'))) {
+                nextSteps.push(divergedStep(projectName, targetName));
+                return;
+            }
+            commandsHolder.commands = withMakeDir(commandsHolder.commands, pluginCacheDir);
+            target.options = {
+                ...target.options,
+                parallel: false,
+                env: {
+                    ...target.options?.env,
+                    [TF_PLUGIN_CACHE_DIR]: pluginCacheDir
+                }
+            };
+            changed = true;
+        };
+        // `test` carries its `terraform init -backend=false` on the target itself.
+        const test = targets.test;
+        if (test?.options) {
+            const wasMigrated = test.options.env?.[TF_PLUGIN_CACHE_DIR] !== undefined;
+            migrateTarget('test', test, test.options, test.options.env);
+            // The data dir becomes symlinks into the shared cache, so it is no longer
+            // a self-contained artifact worth restoring on another machine. Only the
+            // exact output the generator declared is dropped.
+            if (!wasMigrated && test.outputs?.length === 1 && test.outputs[0] === '{workspaceRoot}/dist/{projectRoot}/terraform-test') {
+                test.outputs = [];
+                changed = true;
+            }
+        }
+        // `init` carries its command under the `dev` configuration. A library's
+        // runs `terraform init` directly; an application's delegates to the vended
+        // script, which reads the cache from its own helper rather than the target.
+        const init = targets.init;
+        const initDev = init?.configurations?.dev;
+        if (init?.options && initDev) {
+            const isScriptDriven = hasCommand(initDev.commands ?? init.options.commands, (c)=>c.includes('scripts/init.ts'));
+            if (!isScriptDriven) {
+                // The pre-fix generator vended a single `command`; normalise it to the
+                // `commands` array `make-dir` has to be prepended to.
+                if (typeof initDev.command === 'string' && !initDev.commands) {
+                    initDev.commands = [
+                        initDev.command
+                    ];
+                    delete initDev.command;
+                }
+                migrateTarget('init', init, initDev, init.options.env);
+            }
+        }
+        if (changed) {
+            updateProjectConfiguration(tree, projectName, {
+                ...project,
+                targets
+            });
+        }
+        // An application's `init` target runs `terraform init` from the vended
+        // script rather than the target, so the cache reaches it via the `env`
+        // helper. The helper is new, so KeepExisting adds it while leaving a user's
+        // own copy alone; the script that calls it already exists, so it is
+        // rewritten below.
+        if (tree.exists(joinPathFragments(project.root, 'bootstrap'))) {
+            generateFiles(tree, joinPathFragments(import.meta.dirname, '../../../terraform/project/files/application/scripts'), joinPathFragments(project.root, 'scripts'), {
+                stateKeyPrefix: kebabCase(projectName)
+            }, {
+                overwriteStrategy: OverwriteStrategy.KeepExisting
+            });
+            await migrateInitScript(tree, joinPathFragments(project.root, 'scripts', 'init.ts'), nextSteps);
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/terraform-provider-plugin-cache/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/terraform-provider-plugin-cache/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  OverwriteStrategy,\n  type TargetConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { relative } from 'path';\nimport { TERRAFORM_PROJECT_GENERATOR_INFO } from '../../../terraform/project/generator.js';\nimport {\n  addDestructuredImport,\n  applyGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { kebabCase } from '../../../utils/names.js';\n\n/**\n * Terraform projects share their provider downloads through\n * `TF_PLUGIN_CACHE_DIR`, so a `terraform init` whose `.terraform` was cleaned\n * links the providers already on disk instead of re-downloading them. The AWS\n * provider alone is several hundred megabytes, which dominated the `test`\n * target's runtime on every cache miss.\n *\n * The cache lives under the already-gitignored `.terraform` at the workspace\n * root, one directory per project. Terraform reports an error and silently falls\n * back to downloading when the directory does not exist, so each target creates\n * it first, and the vended `init` script gets an `env` helper that does the same.\n *\n * A directory per project rather than one shared: two `terraform init` runs\n * filling one cache concurrently each compute a different hash for the same\n * provider, and terraform then rejects the mismatch against the lock file.\n *\n * Nx does not interpolate `{workspaceRoot}` inside `env`, so the value is\n * relative to the target's own `cwd` of `{projectRoot}/src`.\n */\n\nconst TF_PLUGIN_CACHE_DIR = 'TF_PLUGIN_CACHE_DIR';\n\nconst divergedStep = (projectName: string, targetName: string) =>\n  `${projectName}: its '${targetName}' target no longer matches the shape the generator produced - left untouched. To reuse provider downloads, set the \\`TF_PLUGIN_CACHE_DIR\\` env var to \\`.terraform/plugin-cache/<projectRoot>\\` under the workspace root (relative to the target's \\`cwd\\`), creating that directory before \\`terraform init\\` runs.`;\n\n/** Path to this project's cache from a target running in `{projectRoot}/src`. */\nconst pluginCacheDirFor = (projectRoot: string) =>\n  joinPathFragments(\n    relative(joinPathFragments(projectRoot, 'src'), '.') || '.',\n    '.terraform',\n    'plugin-cache',\n    '{projectRoot}',\n  ).replace(/\\\\/g, '/');\n\n/** Whether a target already runs the command, however it is expressed. */\nconst hasCommand = (\n  commands: unknown,\n  predicate: (command: string) => boolean,\n): boolean =>\n  Array.isArray(commands) &&\n  commands.some((c) => {\n    const command = typeof c === 'string' ? c : (c?.command as string);\n    return typeof command === 'string' && predicate(command);\n  });\n\n/**\n * Prepend the `make-dir` that creates the cache directory. `forwardAllArgs` is\n * off for it alone, so args meant for `terraform` are not passed to `make-dir`.\n */\nconst withMakeDir = (commands: unknown[], pluginCacheDir: string) => [\n  { command: `make-dir ${pluginCacheDir}`, forwardAllArgs: false },\n  ...commands,\n];\n\n/**\n * The `terraform init` call in the vended `init` script, matched structurally so\n * formatting and argument layout don't affect whether it is recognised.\n */\nconst INIT_CALL =\n  \"`execFileSync('terraform', [$args], { cwd: srcDir, stdio: 'inherit' })`\";\nconst INIT_CALL_WITH_ENV =\n  \"`execFileSync('terraform', [$args], { cwd: srcDir, stdio: 'inherit', env: pluginCacheEnv(projectRootRel) })`\";\n\nconst divergedScriptStep = (filePath: string) =>\n  `${filePath}: its \\`terraform init\\` call no longer matches the shape the generator produced - left untouched. Pass \\`env: pluginCacheEnv(projectRootRel)\\` to that \\`execFileSync\\` so it shares the provider cache in \\`scripts/env.ts\\`.`;\n\n/**\n * Route the vended `init` script's `terraform init` through the shared cache.\n *\n * Guarded on the helper not already being imported, so a re-run — and a project\n * generated with the cache — is a no-op.\n */\nconst migrateInitScript = async (\n  tree: Tree,\n  filePath: string,\n  nextSteps: string[],\n): Promise<void> => {\n  if (!tree.exists(filePath)) return;\n  if (await matchGritQL(tree, filePath, '`pluginCacheEnv($_)`')) return;\n\n  if (!(await matchGritQL(tree, filePath, INIT_CALL))) {\n    nextSteps.push(divergedScriptStep(filePath));\n    return;\n  }\n\n  await applyGritQL(tree, filePath, `${INIT_CALL} => ${INIT_CALL_WITH_ENV}`);\n\n  // Placed in the generator's import position rather than prepended, so a\n  // migrated workspace matches a freshly generated one.\n  const awsConfigImport = \"`import { resolveAwsConfig } from './aws-config'`\";\n  if (await matchGritQL(tree, filePath, awsConfigImport)) {\n    await applyGritQL(\n      tree,\n      filePath,\n      `${awsConfigImport} => \\`import { resolveAwsConfig } from './aws-config';\\nimport { pluginCacheEnv } from './env'\\``,\n    );\n  } else {\n    await addDestructuredImport(tree, filePath, ['pluginCacheEnv'], './env');\n  }\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [projectName, project] of getProjects(tree)) {\n    const generator = (project.metadata as { generator?: string } | undefined)\n      ?.generator;\n    if (generator !== TERRAFORM_PROJECT_GENERATOR_INFO.id) continue;\n\n    const targets = project.targets ?? {};\n    const pluginCacheDir = pluginCacheDirFor(project.root);\n    let changed = false;\n\n    /**\n     * Wire the cache into a target that runs `terraform init`. Only the exact\n     * shape the generator produced is rewritten; anything else is the user's and\n     * is reported instead. Guarded on the env var being absent, so a re-run —\n     * and a project already generated with the cache — is a no-op.\n     */\n    const migrateTarget = (\n      targetName: string,\n      target: TargetConfiguration | undefined,\n      /** Where the commands live: on the target, or under a configuration. */\n      commandsHolder: { commands?: unknown; env?: Record<string, string> },\n      env: Record<string, string> | undefined,\n    ) => {\n      if (!target) return;\n      if (env?.[TF_PLUGIN_CACHE_DIR]) return;\n\n      if (\n        !hasCommand(commandsHolder.commands, (c) =>\n          c.includes('terraform init'),\n        )\n      ) {\n        nextSteps.push(divergedStep(projectName, targetName));\n        return;\n      }\n\n      commandsHolder.commands = withMakeDir(\n        commandsHolder.commands as unknown[],\n        pluginCacheDir,\n      );\n      target.options = {\n        ...target.options,\n        parallel: false,\n        env: { ...target.options?.env, [TF_PLUGIN_CACHE_DIR]: pluginCacheDir },\n      };\n      changed = true;\n    };\n\n    // `test` carries its `terraform init -backend=false` on the target itself.\n    const test = targets.test;\n    if (test?.options) {\n      const wasMigrated = test.options.env?.[TF_PLUGIN_CACHE_DIR] !== undefined;\n      migrateTarget('test', test, test.options, test.options.env);\n\n      // The data dir becomes symlinks into the shared cache, so it is no longer\n      // a self-contained artifact worth restoring on another machine. Only the\n      // exact output the generator declared is dropped.\n      if (\n        !wasMigrated &&\n        test.outputs?.length === 1 &&\n        test.outputs[0] === '{workspaceRoot}/dist/{projectRoot}/terraform-test'\n      ) {\n        test.outputs = [];\n        changed = true;\n      }\n    }\n\n    // `init` carries its command under the `dev` configuration. A library's\n    // runs `terraform init` directly; an application's delegates to the vended\n    // script, which reads the cache from its own helper rather than the target.\n    const init = targets.init;\n    const initDev = init?.configurations?.dev;\n    if (init?.options && initDev) {\n      const isScriptDriven = hasCommand(\n        initDev.commands ?? init.options.commands,\n        (c) => c.includes('scripts/init.ts'),\n      );\n      if (!isScriptDriven) {\n        // The pre-fix generator vended a single `command`; normalise it to the\n        // `commands` array `make-dir` has to be prepended to.\n        if (typeof initDev.command === 'string' && !initDev.commands) {\n          initDev.commands = [initDev.command];\n          delete initDev.command;\n        }\n        migrateTarget('init', init, initDev, init.options.env);\n      }\n    }\n\n    if (changed) {\n      updateProjectConfiguration(tree, projectName, { ...project, targets });\n    }\n\n    // An application's `init` target runs `terraform init` from the vended\n    // script rather than the target, so the cache reaches it via the `env`\n    // helper. The helper is new, so KeepExisting adds it while leaving a user's\n    // own copy alone; the script that calls it already exists, so it is\n    // rewritten below.\n    if (tree.exists(joinPathFragments(project.root, 'bootstrap'))) {\n      generateFiles(\n        tree,\n        joinPathFragments(\n          import.meta.dirname,\n          '../../../terraform/project/files/application/scripts',\n        ),\n        joinPathFragments(project.root, 'scripts'),\n        { stateKeyPrefix: kebabCase(projectName) },\n        { overwriteStrategy: OverwriteStrategy.KeepExisting },\n      );\n\n      await migrateInitScript(\n        tree,\n        joinPathFragments(project.root, 'scripts', 'init.ts'),\n        nextSteps,\n      );\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["generateFiles","getProjects","joinPathFragments","OverwriteStrategy","updateProjectConfiguration","relative","TERRAFORM_PROJECT_GENERATOR_INFO","addDestructuredImport","applyGritQL","matchGritQL","formatFilesInSubtree","kebabCase","TF_PLUGIN_CACHE_DIR","divergedStep","projectName","targetName","pluginCacheDirFor","projectRoot","replace","hasCommand","commands","predicate","Array","isArray","some","c","command","withMakeDir","pluginCacheDir","forwardAllArgs","INIT_CALL","INIT_CALL_WITH_ENV","divergedScriptStep","filePath","migrateInitScript","tree","nextSteps","exists","push","awsConfigImport","migration","project","generator","metadata","id","targets","root","changed","migrateTarget","target","commandsHolder","env","includes","options","parallel","test","wasMigrated","undefined","outputs","length","init","initDev","configurations","dev","isScriptDriven","dirname","stateKeyPrefix","overwriteStrategy","KeepExisting"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,WAAW,EACXC,iBAAiB,EAEjBC,iBAAiB,EAGjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,QAAQ,QAAQ,OAAO;AAChC,SAASC,gCAAgC,QAAQ,0CAA0C;AAC3F,SACEC,qBAAqB,EACrBC,WAAW,EACXC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,SAAS,QAAQ,0BAA0B;AAEpD;;;;;;;;;;;;;;;;;;CAkBC,GAED,MAAMC,sBAAsB;AAE5B,MAAMC,eAAe,CAACC,aAAqBC,aACzC,GAAGD,YAAY,OAAO,EAAEC,WAAW,oTAAoT,CAAC;AAE1V,+EAA+E,GAC/E,MAAMC,oBAAoB,CAACC,cACzBf,kBACEG,SAASH,kBAAkBe,aAAa,QAAQ,QAAQ,KACxD,cACA,gBACA,iBACAC,OAAO,CAAC,OAAO;AAEnB,wEAAwE,GACxE,MAAMC,aAAa,CACjBC,UACAC,YAEAC,MAAMC,OAAO,CAACH,aACdA,SAASI,IAAI,CAAC,CAACC;QACb,MAAMC,UAAU,OAAOD,MAAM,WAAWA,IAAKA,GAAGC;QAChD,OAAO,OAAOA,YAAY,YAAYL,UAAUK;IAClD;AAEF;;;CAGC,GACD,MAAMC,cAAc,CAACP,UAAqBQ,iBAA2B;QACnE;YAAEF,SAAS,CAAC,SAAS,EAAEE,gBAAgB;YAAEC,gBAAgB;QAAM;WAC5DT;KACJ;AAED;;;CAGC,GACD,MAAMU,YACJ;AACF,MAAMC,qBACJ;AAEF,MAAMC,qBAAqB,CAACC,WAC1B,GAAGA,SAAS,+NAA+N,CAAC;AAE9O;;;;;CAKC,GACD,MAAMC,oBAAoB,OACxBC,MACAF,UACAG;IAEA,IAAI,CAACD,KAAKE,MAAM,CAACJ,WAAW;IAC5B,IAAI,MAAMxB,YAAY0B,MAAMF,UAAU,yBAAyB;IAE/D,IAAI,CAAE,MAAMxB,YAAY0B,MAAMF,UAAUH,YAAa;QACnDM,UAAUE,IAAI,CAACN,mBAAmBC;QAClC;IACF;IAEA,MAAMzB,YAAY2B,MAAMF,UAAU,GAAGH,UAAU,IAAI,EAAEC,oBAAoB;IAEzE,wEAAwE;IACxE,sDAAsD;IACtD,MAAMQ,kBAAkB;IACxB,IAAI,MAAM9B,YAAY0B,MAAMF,UAAUM,kBAAkB;QACtD,MAAM/B,YACJ2B,MACAF,UACA,GAAGM,gBAAgB,gGAAgG,CAAC;IAExH,OAAO;QACL,MAAMhC,sBAAsB4B,MAAMF,UAAU;YAAC;SAAiB,EAAE;IAClE;AACF;AAEA,eAAe,eAAeO,UAC5BL,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACtB,aAAa2B,QAAQ,IAAIxC,YAAYkC,MAAO;QACtD,MAAMO,YAAaD,QAAQE,QAAQ,EAC/BD;QACJ,IAAIA,cAAcpC,iCAAiCsC,EAAE,EAAE;QAEvD,MAAMC,UAAUJ,QAAQI,OAAO,IAAI,CAAC;QACpC,MAAMjB,iBAAiBZ,kBAAkByB,QAAQK,IAAI;QACrD,IAAIC,UAAU;QAEd;;;;;KAKC,GACD,MAAMC,gBAAgB,CACpBjC,YACAkC,QACA,sEAAsE,GACtEC,gBACAC;YAEA,IAAI,CAACF,QAAQ;YACb,IAAIE,KAAK,CAACvC,oBAAoB,EAAE;YAEhC,IACE,CAACO,WAAW+B,eAAe9B,QAAQ,EAAE,CAACK,IACpCA,EAAE2B,QAAQ,CAAC,oBAEb;gBACAhB,UAAUE,IAAI,CAACzB,aAAaC,aAAaC;gBACzC;YACF;YAEAmC,eAAe9B,QAAQ,GAAGO,YACxBuB,eAAe9B,QAAQ,EACvBQ;YAEFqB,OAAOI,OAAO,GAAG;gBACf,GAAGJ,OAAOI,OAAO;gBACjBC,UAAU;gBACVH,KAAK;oBAAE,GAAGF,OAAOI,OAAO,EAAEF,GAAG;oBAAE,CAACvC,oBAAoB,EAAEgB;gBAAe;YACvE;YACAmB,UAAU;QACZ;QAEA,2EAA2E;QAC3E,MAAMQ,OAAOV,QAAQU,IAAI;QACzB,IAAIA,MAAMF,SAAS;YACjB,MAAMG,cAAcD,KAAKF,OAAO,CAACF,GAAG,EAAE,CAACvC,oBAAoB,KAAK6C;YAChET,cAAc,QAAQO,MAAMA,KAAKF,OAAO,EAAEE,KAAKF,OAAO,CAACF,GAAG;YAE1D,0EAA0E;YAC1E,yEAAyE;YACzE,kDAAkD;YAClD,IACE,CAACK,eACDD,KAAKG,OAAO,EAAEC,WAAW,KACzBJ,KAAKG,OAAO,CAAC,EAAE,KAAK,qDACpB;gBACAH,KAAKG,OAAO,GAAG,EAAE;gBACjBX,UAAU;YACZ;QACF;QAEA,wEAAwE;QACxE,2EAA2E;QAC3E,4EAA4E;QAC5E,MAAMa,OAAOf,QAAQe,IAAI;QACzB,MAAMC,UAAUD,MAAME,gBAAgBC;QACtC,IAAIH,MAAMP,WAAWQ,SAAS;YAC5B,MAAMG,iBAAiB7C,WACrB0C,QAAQzC,QAAQ,IAAIwC,KAAKP,OAAO,CAACjC,QAAQ,EACzC,CAACK,IAAMA,EAAE2B,QAAQ,CAAC;YAEpB,IAAI,CAACY,gBAAgB;gBACnB,uEAAuE;gBACvE,sDAAsD;gBACtD,IAAI,OAAOH,QAAQnC,OAAO,KAAK,YAAY,CAACmC,QAAQzC,QAAQ,EAAE;oBAC5DyC,QAAQzC,QAAQ,GAAG;wBAACyC,QAAQnC,OAAO;qBAAC;oBACpC,OAAOmC,QAAQnC,OAAO;gBACxB;gBACAsB,cAAc,QAAQY,MAAMC,SAASD,KAAKP,OAAO,CAACF,GAAG;YACvD;QACF;QAEA,IAAIJ,SAAS;YACX3C,2BAA2B+B,MAAMrB,aAAa;gBAAE,GAAG2B,OAAO;gBAAEI;YAAQ;QACtE;QAEA,uEAAuE;QACvE,uEAAuE;QACvE,4EAA4E;QAC5E,oEAAoE;QACpE,mBAAmB;QACnB,IAAIV,KAAKE,MAAM,CAACnC,kBAAkBuC,QAAQK,IAAI,EAAE,eAAe;YAC7D9C,cACEmC,MACAjC,kBACE,YAAY+D,OAAO,EACnB,yDAEF/D,kBAAkBuC,QAAQK,IAAI,EAAE,YAChC;gBAAEoB,gBAAgBvD,UAAUG;YAAa,GACzC;gBAAEqD,mBAAmBhE,kBAAkBiE,YAAY;YAAC;YAGtD,MAAMlC,kBACJC,MACAjC,kBAAkBuC,QAAQK,IAAI,EAAE,WAAW,YAC3CV;QAEJ;IACF;IAEA,MAAM1B,qBAAqByB;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/terraform-rdb-proxy-iam-connect-grant/__snapshots__/migration.spec.ts.snap

@@ -0,0 +1,23 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`terraform-rdb-proxy-iam-connect-grant migration > should replace the mysql admin secret grant with rds-db:connect 1`] = `
+"resource "aws_iam_role_policy" "proxy_db_user_connect" {
+  count = var.enable_rds_proxy ? 1 : 0
+
+  role = module.aurora.proxy_role_name
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = ["rds-db:connect"]
+        Resource = [
+          "arn:aws:rds-db:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:dbuser:\${module.aurora.cluster_resource_id}/\${local.database_runtime_user}"
+        ]
+      }
+    ]
+  })
+}
+"
+`;

package/src/migrations/latest/terraform-rdb-proxy-iam-connect-grant/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Replace the MySQL RDS Proxy role's admin secret access with the rds-db:connect grant it needs for end-to-end IAM auth"
+}

package/src/migrations/latest/terraform-rdb-proxy-iam-connect-grant/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/terraform-rdb-proxy-iam-connect-grant/migration.js

@@ -0,0 +1,88 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments } from "@nx/devkit";
+import { applyGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Give the RDS Proxy role in every vended Terraform Aurora app module the
+ * `rds-db:connect` grant for the application database user.
+ *
+ * The proxy is created with `default_auth_scheme = "IAM_AUTH"` and no secrets
+ * registered, so `rds-db:connect` on the application user is the only
+ * permission it needs to reach the cluster. MySQL modules instead granted the
+ * role `secretsmanager:GetSecretValue` on the admin credentials secret plus
+ * `kms:Decrypt` — credentials the proxy never uses, and a far wider grant than
+ * connecting as the application user.
+ *
+ * These files are generated with `KeepExisting`, so an upgraded MySQL workspace
+ * keeps the admin secret grant until this runs. Diverged files are left
+ * untouched and reported via `nextSteps`.
+ */ const TERRAFORM_DBS_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/dbs`;
+const hcl = (pattern)=>`language hcl\n${pattern}`;
+const CONNECT_STATEMENT_TEXT = [
+    '{',
+    '        Effect = "Allow"',
+    '        Action = ["rds-db:connect"]',
+    '        Resource = [',
+    '          "arn:aws:rds-db:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:dbuser:${module.aurora.cluster_resource_id}/${local.database_runtime_user}"',
+    '        ]',
+    '      }'
+].join('\n');
+const divergedMessage = (filePath)=>`${filePath}: the aws_iam_role_policy.proxy_db_user_connect policy has diverged from the generated shape - left untouched. The RDS Proxy authenticates to the cluster with IAM, so replace any secretsmanager:GetSecretValue / kms:Decrypt statements on the proxy role with a single rds-db:connect statement for local.database_runtime_user (see the ts#rdb generator's database app template).`;
+const proxyPolicyBlock = (body)=>hcl(`\`resource "aws_iam_role_policy" "proxy_db_user_connect" { ${body} }\``);
+const migrateModule = async (tree, filePath, nextSteps)=>{
+    if (!await matchGritQL(tree, filePath, proxyPolicyBlock('$_'))) {
+        return; // No proxy policy in this module - nothing this migration owns.
+    }
+    if (await matchGritQL(tree, filePath, proxyPolicyBlock('$props') + ' where { $props <: contains `"rds-db:connect"` }')) {
+        return; // Already granted.
+    }
+    // The whole statement list is replaced, so the policy must still hold exactly
+    // the two statements the generator vended and nothing the user has added.
+    const secretStatements = hcl([
+        '`Statement = [',
+        '      {',
+        '        Effect = "Allow"',
+        '        Action = [',
+        '          "secretsmanager:GetSecretValue"',
+        '        ]',
+        '        Resource = [module.aurora.secret_arn]',
+        '      },',
+        '      {',
+        '        Effect = "Allow"',
+        '        Action = [',
+        '          "kms:Decrypt"',
+        '        ]',
+        '        Resource = [module.aurora.kms_key_arn]',
+        '      }',
+        '    ]`'
+    ].join('\n'));
+    if (!await matchGritQL(tree, filePath, secretStatements)) {
+        nextSteps.push(divergedMessage(filePath));
+        return;
+    }
+    await applyGritQL(tree, filePath, `${secretStatements} => \`Statement = [\n      ${CONNECT_STATEMENT_TEXT}\n    ]\``);
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    if (!tree.exists(TERRAFORM_DBS_DIR)) {
+        return {
+            nextSteps
+        }; // This workspace has no Terraform database modules.
+    }
+    for (const dirName of tree.children(TERRAFORM_DBS_DIR)){
+        const filePath = joinPathFragments(TERRAFORM_DBS_DIR, dirName, `${dirName}.tf`);
+        if (!tree.exists(filePath)) {
+            continue; // Not a database app module directory.
+        }
+        await migrateModule(tree, filePath, nextSteps);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/terraform-rdb-proxy-iam-connect-grant/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/terraform-rdb-proxy-iam-connect-grant/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { applyGritQL, matchGritQL } from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Give the RDS Proxy role in every vended Terraform Aurora app module the\n * `rds-db:connect` grant for the application database user.\n *\n * The proxy is created with `default_auth_scheme = \"IAM_AUTH\"` and no secrets\n * registered, so `rds-db:connect` on the application user is the only\n * permission it needs to reach the cluster. MySQL modules instead granted the\n * role `secretsmanager:GetSecretValue` on the admin credentials secret plus\n * `kms:Decrypt` — credentials the proxy never uses, and a far wider grant than\n * connecting as the application user.\n *\n * These files are generated with `KeepExisting`, so an upgraded MySQL workspace\n * keeps the admin secret grant until this runs. Diverged files are left\n * untouched and reported via `nextSteps`.\n */\n\nconst TERRAFORM_DBS_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/dbs`;\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\nconst CONNECT_STATEMENT_TEXT = [\n  '{',\n  '        Effect = \"Allow\"',\n  '        Action = [\"rds-db:connect\"]',\n  '        Resource = [',\n  '          \"arn:aws:rds-db:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:dbuser:${module.aurora.cluster_resource_id}/${local.database_runtime_user}\"',\n  '        ]',\n  '      }',\n].join('\\n');\n\nconst divergedMessage = (filePath: string) =>\n  `${filePath}: the aws_iam_role_policy.proxy_db_user_connect policy has diverged from the generated shape - left untouched. The RDS Proxy authenticates to the cluster with IAM, so replace any secretsmanager:GetSecretValue / kms:Decrypt statements on the proxy role with a single rds-db:connect statement for local.database_runtime_user (see the ts#rdb generator's database app template).`;\n\nconst proxyPolicyBlock = (body: string) =>\n  hcl(`\\`resource \"aws_iam_role_policy\" \"proxy_db_user_connect\" { ${body} }\\``);\n\nconst migrateModule = async (\n  tree: Tree,\n  filePath: string,\n  nextSteps: string[],\n): Promise<void> => {\n  if (!(await matchGritQL(tree, filePath, proxyPolicyBlock('$_')))) {\n    return; // No proxy policy in this module - nothing this migration owns.\n  }\n\n  if (\n    await matchGritQL(\n      tree,\n      filePath,\n      proxyPolicyBlock('$props') +\n        ' where { $props <: contains `\"rds-db:connect\"` }',\n    )\n  ) {\n    return; // Already granted.\n  }\n\n  // The whole statement list is replaced, so the policy must still hold exactly\n  // the two statements the generator vended and nothing the user has added.\n  const secretStatements = hcl(\n    [\n      '`Statement = [',\n      '      {',\n      '        Effect = \"Allow\"',\n      '        Action = [',\n      '          \"secretsmanager:GetSecretValue\"',\n      '        ]',\n      '        Resource = [module.aurora.secret_arn]',\n      '      },',\n      '      {',\n      '        Effect = \"Allow\"',\n      '        Action = [',\n      '          \"kms:Decrypt\"',\n      '        ]',\n      '        Resource = [module.aurora.kms_key_arn]',\n      '      }',\n      '    ]`',\n    ].join('\\n'),\n  );\n\n  if (!(await matchGritQL(tree, filePath, secretStatements))) {\n    nextSteps.push(divergedMessage(filePath));\n    return;\n  }\n\n  await applyGritQL(\n    tree,\n    filePath,\n    `${secretStatements} => \\`Statement = [\\n      ${CONNECT_STATEMENT_TEXT}\\n    ]\\``,\n  );\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (!tree.exists(TERRAFORM_DBS_DIR)) {\n    return { nextSteps }; // This workspace has no Terraform database modules.\n  }\n\n  for (const dirName of tree.children(TERRAFORM_DBS_DIR)) {\n    const filePath = joinPathFragments(\n      TERRAFORM_DBS_DIR,\n      dirName,\n      `${dirName}.tf`,\n    );\n    if (!tree.exists(filePath)) {\n      continue; // Not a database app module directory.\n    }\n\n    await migrateModule(tree, filePath, nextSteps);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","applyGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_TERRAFORM_DIR","TERRAFORM_DBS_DIR","hcl","pattern","CONNECT_STATEMENT_TEXT","join","divergedMessage","filePath","proxyPolicyBlock","body","migrateModule","tree","nextSteps","secretStatements","push","migration","exists","dirName","children"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SAASC,WAAW,EAAEC,WAAW,QAAQ,wBAAwB;AACjE,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;;;CAcC,GAED,MAAMC,oBAAoB,GAAGF,aAAa,CAAC,EAAEC,qBAAqB,YAAY,CAAC;AAE/E,MAAME,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,MAAMC,yBAAyB;IAC7B;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAACC,IAAI,CAAC;AAEP,MAAMC,kBAAkB,CAACC,WACvB,GAAGA,SAAS,sXAAsX,CAAC;AAErY,MAAMC,mBAAmB,CAACC,OACxBP,IAAI,CAAC,2DAA2D,EAAEO,KAAK,IAAI,CAAC;AAE9E,MAAMC,gBAAgB,OACpBC,MACAJ,UACAK;IAEA,IAAI,CAAE,MAAMf,YAAYc,MAAMJ,UAAUC,iBAAiB,QAAS;QAChE,QAAQ,gEAAgE;IAC1E;IAEA,IACE,MAAMX,YACJc,MACAJ,UACAC,iBAAiB,YACf,qDAEJ;QACA,QAAQ,mBAAmB;IAC7B;IAEA,8EAA8E;IAC9E,0EAA0E;IAC1E,MAAMK,mBAAmBX,IACvB;QACE;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;KACD,CAACG,IAAI,CAAC;IAGT,IAAI,CAAE,MAAMR,YAAYc,MAAMJ,UAAUM,mBAAoB;QAC1DD,UAAUE,IAAI,CAACR,gBAAgBC;QAC/B;IACF;IAEA,MAAMX,YACJe,MACAJ,UACA,GAAGM,iBAAiB,2BAA2B,EAAET,uBAAuB,SAAS,CAAC;AAEtF;AAEA,eAAe,eAAeW,UAC5BJ,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAI,CAACD,KAAKK,MAAM,CAACf,oBAAoB;QACnC,OAAO;YAAEW;QAAU,GAAG,oDAAoD;IAC5E;IAEA,KAAK,MAAMK,WAAWN,KAAKO,QAAQ,CAACjB,mBAAoB;QACtD,MAAMM,WAAWZ,kBACfM,mBACAgB,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAACN,KAAKK,MAAM,CAACT,WAAW;YAC1B,UAAU,uCAAuC;QACnD;QAEA,MAAMG,cAAcC,MAAMJ,UAAUK;IACtC;IAEA,MAAMd,qBAAqBa;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/vitest-coverage-output-dir/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Write vitest coverage reports to the project's dist directory rather than inside the project"
+}

package/src/migrations/latest/vitest-coverage-output-dir/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;