@continuous-excellence/ze-great-dashboard-aws 0.9.2 → 0.11.0

package/README.md

@@ -20,8 +20,13 @@ AWS to try it.
 - A consumer-owned gateway that can privately invoke Lambda and enforce your access policy.
 
 The included deployment works out of the box with public GitHub repositories and HTTP endpoints
-that do not require credentials. Private sources require a consumer-owned runtime integration; the
-stock template does not turn a Secrets Manager reference into `token_env` variables.
+that do not require credentials. For private GitHub sources, `SecretReference` is the ARN of one
+consumer-owned Secrets Manager JSON map (for example, `{"GITHUB_TOKEN":"github_pat_…"}`). The
+runtime resolves configured `token_env` names only at Lambda cold start and never exposes token
+values to the browser, API responses, logs, CloudFormation parameters, or Lambda environment.
+This is the one added runtime dependency: AWS's Secrets Manager client supplies IAM-authenticated
+`GetSecretValue` support in the bundled Lambda, at the cost of its bundled SDK code and a single
+cold-start request when private sources are configured.
 
 ## Deployment map
 
@@ -73,7 +78,7 @@ Changing `board.yaml` or upgrading the pinned package uses this same path.
 | Board validation and Lambda packaging | Board content and source access |
 | Compatible immutable browser assets | The protected gateway and authentication |
 | Private application CloudFormation template | AWS account administration |
-| Restricted bootstrap templates | Secret values and runtime credential loading |
+| Restricted bootstrap templates | Secret values and the credential-map ARN |
 | Read-only preflight and consistency checks | Reviewing and executing AWS changes |
 
 Bootstrap commands never execute mutating AWS operations. They produce plans, parameters, and

package/dist/cli.js

@@ -810,10 +810,18 @@ async function validateBoardConfig(path) {
     throw new Error(`Invalid board configuration:
 ${z2.prettifyError(result.error)}`);
   const yaml = stringify(result.data, { sortMapEntries: true });
-  return { yaml, sha256: sha256(yaml) };
+  return {
+    yaml,
+    sha256: sha256(yaml),
+    usesCredentials: Object.values(result.data.sources).some((source2) => Boolean(source2.token_env))
+  };
 }
 async function assembleRelease(input) {
   const board = await validateBoardConfig(input.boardConfigPath);
+  if (board.usesCredentials && !input.secretReference)
+    throw new Error(
+      "Board config uses token_env; SecretReference must name the Secrets Manager credential-map ARN"
+    );
   const outputDir = resolve(input.outputDir);
   await mkdir(outputDir, { recursive: true });
   await writeFile(join(outputDir, "board.yaml"), board.yaml);
@@ -2004,7 +2012,8 @@ async function packageLambda(options) {
     outputDir: runtimeDir,
     version: options.version,
     providers: ["aws-lambda"],
-    assetDomain: options.assetDomain
+    assetDomain: options.assetDomain,
+    secretReference: options.secretReference
   });
   const runtimeMetadata = {
     ...release.metadata,
@@ -2764,11 +2773,13 @@ ${plan.notes.join("\n")}`);
       await existingParameters(parametersPath),
       template
     );
+    const secretReference = consumerParameters.SecretReference ?? String(template.definitions.SecretReference?.Default ?? "");
     const metadata = await packageLambda({
       boardConfigPath: boardConfig,
       outputDir,
       version,
-      assetDomain: option("--asset-domain")
+      assetDomain: option("--asset-domain"),
+      secretReference
     });
     const resolvedParameters = resolvedReleaseParameters(consumerParameters, template, {
       LambdaArtifactKey: metadata.artifactKey,

package/dist/index.d.ts

@@ -20,6 +20,8 @@ export type LambdaPackageOptions = {
     outputDir: string;
     version: string;
     assetDomain?: string;
+    /** ARN of the consumer-owned JSON credential-map secret, never a secret value. */
+    secretReference?: string;
 };
 export declare function packageLambda(options: LambdaPackageOptions): Promise<PackagedRelease>;
 export type PublishClientAssetsOptions = {

package/dist/index.js

@@ -797,10 +797,18 @@ async function validateBoardConfig(path) {
     throw new Error(`Invalid board configuration:
 ${z2.prettifyError(result.error)}`);
   const yaml = stringify(result.data, { sortMapEntries: true });
-  return { yaml, sha256: sha256(yaml) };
+  return {
+    yaml,
+    sha256: sha256(yaml),
+    usesCredentials: Object.values(result.data.sources).some((source2) => Boolean(source2.token_env))
+  };
 }
 async function assembleRelease(input) {
   const board = await validateBoardConfig(input.boardConfigPath);
+  if (board.usesCredentials && !input.secretReference)
+    throw new Error(
+      "Board config uses token_env; SecretReference must name the Secrets Manager credential-map ARN"
+    );
   const outputDir = resolve(input.outputDir);
   await mkdir(outputDir, { recursive: true });
   await writeFile(join(outputDir, "board.yaml"), board.yaml);
@@ -1991,7 +1999,8 @@ async function packageLambda(options) {
     outputDir: runtimeDir,
     version: options.version,
     providers: ["aws-lambda"],
-    assetDomain: options.assetDomain
+    assetDomain: options.assetDomain,
+    secretReference: options.secretReference
   });
   const runtimeMetadata = {
     ...release.metadata,