@awsless/cli 0.0.45 → 0.0.46-next.0

package/dist/handlers/rpc.mjs

@@ -0,0 +1,465 @@
+// src/feature/rpc/server/handle.ts
+import { ExpectedError, ViewableError } from "@awsless/lambda";
+import { invokeRoute as invokeRoute2 } from "awsless";
+import { randomUUID } from "node:crypto";
+
+// src/feature/rpc/server/auth.ts
+import { toSeconds } from "@awsless/duration";
+import { WeakCache } from "@awsless/weak-cache";
+import { addSeconds, isFuture } from "date-fns";
+import { getRouteEnv, invokeRoute } from "awsless";
+
+// src/feature/rpc/server/validate.ts
+import {
+  array,
+  duration,
+  json,
+  literal,
+  maxLength,
+  minLength,
+  object,
+  optional,
+  pipe,
+  record,
+  safeParse,
+  string,
+  union,
+  unknown
+} from "@awsless/validate";
+var requestSchema = object({
+  requestContext: object({
+    http: object({
+      method: literal("POST"),
+      userAgent: string(),
+      sourceIp: string()
+    })
+  }),
+  headers: record(string(), string()),
+  body: json(pipe(array(object({
+    name: pipe(string(), minLength(1), maxLength(64)),
+    payload: optional(record(string(), unknown()))
+  })), minLength(1), maxLength(10)))
+});
+var parseRequest = (body) => {
+  return safeParse(requestSchema, body);
+};
+var authResponseSchema = union([
+  object({
+    authorized: literal(true),
+    context: optional(record(string(), unknown())),
+    allowedFunctions: optional(array(string())),
+    lockKey: optional(string()),
+    ttl: duration()
+  }),
+  object({
+    authorized: literal(false)
+  })
+]);
+var parseAuthResponse = (body) => {
+  return safeParse(authResponseSchema, body);
+};
+
+// src/feature/rpc/server/auth.ts
+var cache = new WeakCache;
+var authenticate = async (token) => {
+  const authRoute = getRouteEnv("AUTH");
+  if (!authRoute) {
+    return {
+      authorized: true,
+      context: {}
+    };
+  }
+  if (!token) {
+    return {
+      authorized: false,
+      reason: "No authentication token provided"
+    };
+  }
+  const cacheKey = `${authRoute}:${token}`;
+  const entry = cache.get(cacheKey);
+  if (entry) {
+    if (isFuture(entry.ttl)) {
+      return {
+        authorized: true,
+        context: entry.context,
+        lockKey: entry.lockKey,
+        allowedFunctions: entry.allowedFunctions
+      };
+    } else {
+      cache.delete(cacheKey);
+    }
+  }
+  let response;
+  try {
+    response = await invokeRoute(authRoute, { token });
+  } catch (error) {
+    console.error(error);
+    return {
+      authorized: false,
+      reason: "Invoke auth handle error"
+    };
+  }
+  const result = parseAuthResponse(response);
+  if (!result.success) {
+    return {
+      authorized: false,
+      reason: "Invalid auth handle response"
+    };
+  }
+  if (!result.output.authorized) {
+    return {
+      authorized: false,
+      reason: "Invalid auth token"
+    };
+  }
+  const now = new Date;
+  const ttl = addSeconds(now, Number(toSeconds(result.output.ttl)));
+  const context = result.output.context;
+  const allowedFunctions = result.output.allowedFunctions;
+  const lockKey = result.output.lockKey;
+  cache.set(cacheKey, {
+    ttl,
+    context,
+    lockKey,
+    allowedFunctions
+  });
+  return {
+    authorized: true,
+    context,
+    lockKey,
+    allowedFunctions
+  };
+};
+
+// src/feature/rpc/server/error.ts
+var INVALID_REQUEST = (issues) => {
+  return {
+    type: "invalid-request",
+    message: `Invalid request payload: ${issues.at(0)?.message}`
+  };
+};
+var UNAUTHORIZED = (reason) => ({
+  type: "unauthorized",
+  message: reason ?? "Unauthorized"
+});
+var INTERNAL_SERVER_ERROR = {
+  type: "internal-server-error",
+  message: "Internal Server Error"
+};
+var TOO_MANY_REQUESTS = {
+  type: "too-many-requests",
+  message: "Only one request can be processed at a time. Please try again shortly."
+};
+var ONE_FUNCTION_AT_A_TIME = {
+  type: "one-function-at-a-time",
+  message: "Only one locked function is allowed to be called at a time."
+};
+var NO_LOCK_KEY_PROVIDED = {
+  type: "no-lock-key-provided",
+  message: "Your trying to call a locked function without providing a `lockKey`."
+};
+var PERMISSION_ACCESS_DENIED = {
+  ok: false,
+  error: {
+    type: "permission-access-denied",
+    message: `You do not have permissions to call this function.`
+  }
+};
+var UNKNOWN_FUNCTION_NAME = {
+  ok: false,
+  error: {
+    type: "unknown-function-name",
+    message: "Unknown function name"
+  }
+};
+var INTERNAL_FUNCTION_ERROR = {
+  ok: false,
+  error: {
+    type: "internal-function-error",
+    message: "Oops, something went wrong!"
+  }
+};
+var UNKNOWN_ERROR = {
+  ok: false,
+  error: {
+    type: "unknown-error",
+    message: "Unknown error"
+  }
+};
+var EXPECTED_ERROR = (error) => ({
+  ok: false,
+  error: {
+    type: error.type,
+    message: error.message
+  }
+});
+
+// src/feature/rpc/server/internal/allowed-functions.ts
+import { getRouteEnv as getRouteEnv2 } from "awsless";
+var allowedFunctions = (_, auth) => {
+  return {
+    ok: true,
+    data: getAllowedFunctions(auth)
+  };
+};
+var getAllowedFunctions = (auth) => {
+  if (!getRouteEnv2("AUTH")) {
+    return ["*"];
+  }
+  if (!auth.authorized) {
+    return [];
+  }
+  if (typeof auth.allowedFunctions === "undefined") {
+    return ["*"];
+  }
+  return auth.allowedFunctions;
+};
+
+// src/feature/rpc/server/internal/index.ts
+var internalFunctions = {
+  allowedFunctions
+};
+var invokeInternalFunction = (name, payload, auth) => {
+  const fn = internalFunctions[name];
+  if (!fn) {
+    return UNKNOWN_FUNCTION_NAME;
+  }
+  return fn(payload, auth);
+};
+
+// src/feature/rpc/server/lock.ts
+import { ConditionalCheckFailedException, deleteItem, updateItem } from "@awsless/dynamodb";
+import { addSeconds as addSeconds2 } from "date-fns";
+import { getRouteEnv as getRouteEnv4 } from "awsless";
+
+// src/feature/rpc/server/table.ts
+import { define, object as object2, string as string2, ttl } from "@awsless/dynamodb";
+import { getRouteEnv as getRouteEnv3 } from "awsless";
+var getLockTable = () => {
+  return define(getRouteEnv3("LOCK_TABLE") ?? "lock", {
+    hash: "key",
+    schema: object2({
+      key: string2(),
+      ttl: ttl(),
+      requestId: string2()
+    })
+  });
+};
+
+// src/feature/rpc/server/lock.ts
+var lockRequest = async (requestId, key) => {
+  const timeout = parseInt(getRouteEnv4("TIMEOUT") ?? "60", 10);
+  const now = new Date;
+  const ttl2 = addSeconds2(now, timeout * 2);
+  try {
+    await updateItem(getLockTable(), { key }, {
+      update: (e) => [
+        e.requestId.set(requestId),
+        e.ttl.set(ttl2)
+      ],
+      when: (e) => e.or([
+        e.key.notExists(),
+        e.ttl.lt(now)
+      ])
+    });
+  } catch (error) {
+    if (error instanceof ConditionalCheckFailedException) {
+      return false;
+    }
+    throw error;
+  }
+  return true;
+};
+var unlockRequest = async (requestId, key) => {
+  try {
+    await deleteItem(getLockTable(), { key }, {
+      when: (e) => [
+        e.key.exists(),
+        e.requestId.eq(requestId)
+      ]
+    });
+  } catch (error) {
+    if (error instanceof ConditionalCheckFailedException) {
+      console.error("Failed to unlock request");
+      return;
+    }
+    throw error;
+  }
+};
+var lock = (requestId, key) => {
+  return lockRequest(requestId, key);
+};
+var unlock = async (requestId, key) => {
+  return unlockRequest(requestId, key);
+};
+
+// src/feature/rpc/server/response.ts
+import { stringify } from "@awsless/json";
+var response = (statusCode, results) => {
+  return {
+    headers: {
+      "content-type": "application/json"
+    },
+    statusCode,
+    body: stringify(results)
+  };
+};
+
+// src/feature/rpc/server/schema.ts
+import { getRouteEnv as getRouteEnv5 } from "awsless";
+var getFunctionDetails = (name) => {
+  const entry = getRouteEnv5(`QUERY:${name}`);
+  if (!entry) {
+    return;
+  }
+  const details = JSON.parse(entry);
+  return {
+    name: details.function,
+    lock: details.lock
+  };
+};
+
+// src/feature/rpc/server/viewer.ts
+var toNumber = (value) => {
+  if (!value) {
+    return;
+  }
+  return parseFloat(value);
+};
+var stripPortFromIp = (value) => {
+  if (!value) {
+    return;
+  }
+  const parts = value.split(":");
+  parts.pop();
+  return parts.join(":");
+};
+var buildViewerPayload = (request) => {
+  const http = request.requestContext.http;
+  const getViewer = (name) => {
+    return request.headers[`cloudfront-viewer-${name}`];
+  };
+  const isViewer = (enums) => {
+    for (const [name, value] of Object.entries(enums)) {
+      if (request.headers[`cloudfront-is-${name}-viewer`] === "true") {
+        return value;
+      }
+    }
+    return;
+  };
+  return {
+    userAgent: http.userAgent,
+    ip: stripPortFromIp(getViewer("address")),
+    city: getViewer("city"),
+    region: {
+      code: getViewer("country-region"),
+      name: getViewer("country-region-name")
+    },
+    country: {
+      code: getViewer("country"),
+      name: getViewer("country-name")
+    },
+    metroCode: getViewer("metro-code"),
+    postalCode: getViewer("postal-code"),
+    timeZone: getViewer("time-zone"),
+    latitude: toNumber(getViewer("latitude")),
+    longitude: toNumber(getViewer("longitude")),
+    device: isViewer({
+      mobile: "mobile",
+      tablet: "tablet",
+      desktop: "desktop",
+      smarttv: "tv"
+    }),
+    os: isViewer({
+      ios: "ios",
+      android: "android"
+    })
+  };
+};
+
+// src/feature/rpc/server/handle.ts
+var handle_default = async (event) => {
+  try {
+    const requestId = randomUUID();
+    const request = parseRequest(event);
+    if (!request.success) {
+      return response(400, INVALID_REQUEST(request.issues));
+    }
+    const auth = await authenticate(request.output.headers.authentication);
+    if (!auth.authorized) {
+      return response(405, UNAUTHORIZED(auth.reason));
+    }
+    console.log({
+      requestId,
+      lockKey: auth.lockKey,
+      authContext: auth.context,
+      request: request.output.body,
+      ip: request.output.requestContext.http.sourceIp
+    });
+    const calls = request.output.body.map((fn) => {
+      return {
+        ...fn,
+        details: fn.name.startsWith("$") ? undefined : getFunctionDetails(fn.name)
+      };
+    });
+    const lockedCalls = calls.filter((fn) => fn.details?.lock === true);
+    if (lockedCalls.length > 0 && !auth.lockKey) {
+      return response(400, NO_LOCK_KEY_PROVIDED);
+    }
+    if (lockedCalls.length > 1) {
+      return response(400, ONE_FUNCTION_AT_A_TIME);
+    }
+    if (lockedCalls.length > 0 && auth.lockKey) {
+      const locked = await lock(requestId, auth.lockKey);
+      if (!locked) {
+        return response(429, TOO_MANY_REQUESTS);
+      }
+    }
+    const result = await Promise.allSettled(calls.map(async (fn) => {
+      if (fn.name.startsWith("$")) {
+        return invokeInternalFunction(fn.name.slice(1), fn.payload, auth);
+      }
+      if (!(("details" in fn) && fn.details)) {
+        return UNKNOWN_FUNCTION_NAME;
+      }
+      if (Array.isArray(auth.allowedFunctions) && !auth.allowedFunctions.includes(fn.name) && !auth.allowedFunctions.includes("*")) {
+        return PERMISSION_ACCESS_DENIED;
+      }
+      let data;
+      try {
+        data = await invokeRoute2(fn.details.name, {
+          ...fn.payload ?? {},
+          ...auth.context ?? {},
+          viewer: buildViewerPayload(request.output)
+        });
+      } catch (error) {
+        if (error instanceof ViewableError || error instanceof ExpectedError) {
+          return EXPECTED_ERROR(error);
+        } else {
+          console.error(error);
+          return INTERNAL_FUNCTION_ERROR;
+        }
+      }
+      return {
+        ok: true,
+        data
+      };
+    }));
+    if (lockedCalls.length > 0 && auth.lockKey) {
+      await unlock(requestId, auth.lockKey);
+    }
+    return response(200, result.map((item) => {
+      if (item.status === "fulfilled") {
+        return item.value;
+      }
+      return UNKNOWN_ERROR;
+    }));
+  } catch (error) {
+    console.log("internal error");
+    console.error(error);
+    return response(500, INTERNAL_SERVER_ERROR);
+  }
+};
+export {
+  handle_default as default
+};