@deployfoundation/foundation-deploy 0.2.15 → 0.2.16

package/dist/{chunk-83781ggk.js → chunk-rq4dc5ns.js}

@@ -19,7 +19,7 @@ import {
   scheduledJobBindings,
   slackCommandPrefixes,
   webhookJobBindings
-} from "./chunk-7qn00ny1.js";
+} from "./chunk-9rasrppa.js";
 
 // src/stacks/agent-stack.ts
 import * as cdk from "aws-cdk-lib";
@@ -240,6 +240,60 @@ class FoundationAgent extends cdk.Stack {
       resources: [secretArnPattern(knockOauthClient), secretArnPattern(knockCredential)]
     }));
   }
+  pagesPolicy(id, role, instance, options) {
+    if (!provisionsIntegration(instance, "pages"))
+      return;
+    const stack = cdk.Stack.of(this);
+    const table = stack.formatArn({
+      service: "dynamodb",
+      resource: "table",
+      resourceName: "*-PagesTable*"
+    });
+    const statements = [
+      new iam.PolicyStatement({
+        sid: "DenyDirectPagesAccess",
+        effect: iam.Effect.DENY,
+        actions: [
+          "s3:*",
+          "dynamodb:*",
+          "secretsmanager:GetSecretValue",
+          "secretsmanager:BatchGetSecretValue",
+          "cloudfront-keyvaluestore:*"
+        ],
+        resources: [
+          `arn:${stack.partition}:s3:::*pagesbucket*`,
+          `arn:${stack.partition}:s3:::*pagesbucket*/*`,
+          table,
+          `${table}/index/*`,
+          stack.formatArn({
+            service: "secretsmanager",
+            resource: "secret",
+            resourceName: `${this.names.secretPagesCookieKey}-??????`,
+            arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME
+          }),
+          `arn:${stack.partition}:cloudfront::${stack.account}:key-value-store/*`
+        ]
+      })
+    ];
+    if (options.invoke)
+      statements.push(new iam.PolicyStatement({
+        sid: "PagesApiInvoke",
+        actions: ["lambda:InvokeFunction"],
+        resources: [
+          stack.formatArn({
+            service: "lambda",
+            resource: "function",
+            resourceName: this.names.pagesApiFunctionName,
+            arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME
+          })
+        ]
+      }));
+    new iam.ManagedPolicy(this, id, {
+      description: `${instance.displayName} hosted pages: only through the Pages API`,
+      roles: [role],
+      statements
+    });
+  }
   denyDirectUpworkApprovalAccess(role, upworkApprovalTable) {
     if (upworkApprovalTable === undefined)
       return;
@@ -290,6 +344,7 @@ class FoundationAgent extends cdk.Stack {
     this.denyDirectKnockSecretAccess(role, props);
     this.denyDirectUpworkApprovalAccess(role, props.upworkApprovalTable);
     this.denyDirectEtradeAccess(role, props);
+    this.pagesPolicy("AgentReadOnlyPagesPolicy", role, props.instance, { invoke: false });
     role.addToPolicy(new iam.PolicyStatement({
       sid: "DenyAgentCoreBrowserMetadata",
       effect: iam.Effect.DENY,
@@ -350,6 +405,7 @@ class FoundationAgent extends cdk.Stack {
     this.denyDirectKnockSecretAccess(role, props);
     this.denyDirectUpworkApprovalAccess(role, props.upworkApprovalTable);
     this.denyDirectEtradeAccess(role, props);
+    this.pagesPolicy("AgentExecutionPagesPolicy", role, props.instance, { invoke: true });
     const releaseRepositoryArn = releaseImageRepositoryArn(this);
     role.addToPolicy(new iam.PolicyStatement({
       sid: "EcrPull",
@@ -2679,18 +2735,500 @@ function senderAddressFor(sender) {
   return address;
 }
 
-// src/stacks/pipeline-stack.ts
+// src/stacks/pages-stack.ts
 import * as cdk7 from "aws-cdk-lib";
+import * as acm2 from "aws-cdk-lib/aws-certificatemanager";
+import * as cloudfront from "aws-cdk-lib/aws-cloudfront";
+import * as origins from "aws-cdk-lib/aws-cloudfront-origins";
+import * as dynamodb3 from "aws-cdk-lib/aws-dynamodb";
+import * as iam8 from "aws-cdk-lib/aws-iam";
+import * as lambda3 from "aws-cdk-lib/aws-lambda";
+import * as route532 from "aws-cdk-lib/aws-route53";
+import * as route53Targets2 from "aws-cdk-lib/aws-route53-targets";
+import * as s32 from "aws-cdk-lib/aws-s3";
+import * as secretsmanager4 from "aws-cdk-lib/aws-secretsmanager";
+
+// src/stacks/pages-edge-function.ts
+var PAGES_EDGE_KEY_NAME = "cookie-key-v1";
+var PAGES_HOST_HEADER = "x-foundation-pages-host";
+var PAGES_VIEWER_REQUEST_SOURCE = `import cf from 'cloudfront';
+import crypto from 'crypto';
+
+var kvs = cf.kvs('__KVS_ID__');
+var COOKIE = 'fpa';
+var KEY_NAME = '${PAGES_EDGE_KEY_NAME}';
+var HOST_HEADER = '${PAGES_HOST_HEADER}';
+var PAGE_RE = /^\\/p\\/([a-z0-9]{24})(\\/.*)?$/;
+var VERSION_RE = /^\\/v([1-9][0-9]{0,5})(\\/.*)?$/;
+var EXPORT_RE = /^\\/exports\\/v([1-9][0-9]{0,5})\\/([^\\/]+)$/;
+var UNSAFE_RE = /(^|\\/)\\.\\.?(\\/|$)|\\/\\/|%2e|%2f|%5c|\\\\/i;
+var USER_RE = /^[UW][A-Z0-9]{2,31}$/;
+var EXP_RE = /^[0-9]{1,12}$/;
+
+function reply(status, description, body) {
+  return {
+    statusCode: status,
+    statusDescription: description,
+    headers: {
+      'content-type': { value: 'text/plain; charset=utf-8' },
+      'cache-control': { value: 'no-store' }
+    },
+    body: { encoding: 'text', data: body }
+  };
+}
+
+function redirect(location) {
+  return {
+    statusCode: 302,
+    statusDescription: 'Found',
+    headers: { location: { value: location }, 'cache-control': { value: 'no-store' } }
+  };
+}
+
+function equal(a, b) {
+  if (a.length !== b.length) return false;
+  var diff = 0;
+  for (var i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+
+function validCookie(value, pageId, key, now) {
+  if (typeof value !== 'string' || value.length > 256) return false;
+  var parts = value.split('.');
+  if (parts.length !== 5 || parts[0] !== 'v1' || parts[1] !== pageId) return false;
+  if (!USER_RE.test(parts[2]) || !EXP_RE.test(parts[3]) || Number(parts[3]) <= now) return false;
+  var mac = crypto.createHmac('sha256', key).update(parts.slice(0, 4).join('.')).digest('hex');
+  return equal(mac, parts[4]);
+}
+
+function cookieValues(request) {
+  var cookie = request.cookies ? request.cookies[COOKIE] : undefined;
+  if (!cookie) return [];
+  var values = [cookie.value];
+  if (cookie.multiValue) {
+    for (var i = 0; i < cookie.multiValue.length; i++) values.push(cookie.multiValue[i].value);
+  }
+  return values;
+}
+
+function objectPath(pageId, rest) {
+  var prefix = '/pages/' + pageId;
+  if (rest === '/') return prefix + '/latest.html';
+  var version = VERSION_RE.exec(rest);
+  if (version) {
+    var sub = version[2];
+    if (sub.charAt(sub.length - 1) === '/') {
+      sub = sub + 'index.html';
+    } else if (sub.slice(sub.lastIndexOf('/') + 1).indexOf('.') === -1) {
+      sub = '/index.html';
+    }
+    return prefix + '/v' + version[1] + '/build' + sub;
+  }
+  var download = EXPORT_RE.exec(rest);
+  if (download) return prefix + '/v' + download[1] + '/exports/' + download[2];
+  return null;
+}
+
+async function handler(event) {
+  var request = event.request;
+  var uri = request.uri;
+  if (uri.indexOf('/_auth/') === 0) {
+    request.headers[HOST_HEADER] = { value: request.headers.host ? request.headers.host.value : '' };
+    return request;
+  }
+  var page = PAGE_RE.exec(uri);
+  if (!page || UNSAFE_RE.test(uri)) return reply(404, 'Not Found', 'Not found');
+  var pageId = page[1];
+  var rest = page[2] || '';
+  if (rest === '') return redirect(uri + '/');
+  var version = VERSION_RE.exec(rest);
+  if (version && version[2] === undefined) return redirect(uri + '/');
+  var target = objectPath(pageId, rest);
+  if (target === null) return reply(404, 'Not Found', 'Not found');
+
+  var key;
+  try {
+    key = await kvs.get(KEY_NAME);
+  } catch (err) {
+    return reply(503, 'Service Unavailable', 'Pages sign-in is starting up. Try again in a minute.');
+  }
+  var now = Math.floor(Date.now() / 1000);
+  var values = cookieValues(request);
+  for (var i = 0; i < values.length; i++) {
+    if (validCookie(values[i], pageId, key, now)) {
+      request.uri = target;
+      return request;
+    }
+  }
+  return redirect('/_auth/start?page=' + pageId + '&next=' + encodeURIComponent(uri));
+}
+`;
+function pagesViewerRequestCode(kvsId) {
+  return PAGES_VIEWER_REQUEST_SOURCE.replace("__KVS_ID__", kvsId);
+}
+
+// src/stacks/pages-stack.ts
+function pagesDomainPlan(instance, delegated) {
+  const { domain, hostedZoneId } = instance.pages;
+  if (domain === undefined)
+    return { ownZone: false };
+  const ownZone = hostedZoneId === undefined;
+  return ownZone && !delegated ? { pending: domain, ownZone } : { attached: domain, ownZone };
+}
+var PAGES_CONTENT_SECURITY_POLICY = [
+  "default-src 'self'",
+  "script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:",
+  "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
+  "font-src 'self' data: https://fonts.gstatic.com",
+  "img-src 'self' data: blob:",
+  "media-src 'self' data: blob:",
+  "connect-src 'self' data: blob:",
+  "worker-src 'self' blob:",
+  "frame-src 'self'",
+  "object-src 'none'",
+  "base-uri 'self'",
+  "form-action 'self'",
+  "frame-ancestors 'self'"
+].join("; ");
+
+class FoundationPages extends cdk7.Stack {
+  bucket;
+  table;
+  apiFunction;
+  distribution;
+  constructor(scope, id, props) {
+    super(scope, id, props);
+    const { instance } = props;
+    if (!instance.integrations.pages)
+      throw new Error(`${id}: FoundationPages needs integrations.pages: true`);
+    const names = instanceNames(instance);
+    const display = instance.displayName;
+    const plan = pagesDomainPlan(instance, props.domainDelegated === true);
+    const domain = plan.attached;
+    this.bucket = new s32.Bucket(this, "PagesBucket", {
+      blockPublicAccess: s32.BlockPublicAccess.BLOCK_ALL,
+      encryption: s32.BucketEncryption.S3_MANAGED,
+      enforceSSL: true,
+      versioned: true,
+      objectOwnership: s32.ObjectOwnership.BUCKET_OWNER_ENFORCED,
+      removalPolicy: cdk7.RemovalPolicy.RETAIN,
+      lifecycleRules: [
+        { id: "StagedUploads", prefix: "uploads/", expiration: cdk7.Duration.days(1) },
+        { id: "NoncurrentObjects", noncurrentVersionExpiration: cdk7.Duration.days(30) },
+        { id: "IncompleteMultipart", abortIncompleteMultipartUploadAfter: cdk7.Duration.days(1) }
+      ]
+    });
+    this.table = new dynamodb3.Table(this, "PagesTable", {
+      partitionKey: { name: "pk", type: dynamodb3.AttributeType.STRING },
+      sortKey: { name: "sk", type: dynamodb3.AttributeType.STRING },
+      billingMode: dynamodb3.BillingMode.PAY_PER_REQUEST,
+      encryption: dynamodb3.TableEncryption.CUSTOMER_MANAGED,
+      encryptionKey: props.dataKey,
+      pointInTimeRecoverySpecification: { pointInTimeRecoveryEnabled: true },
+      timeToLiveAttribute: "ttl",
+      removalPolicy: cdk7.RemovalPolicy.RETAIN
+    });
+    this.table.addGlobalSecondaryIndex({
+      indexName: "ChannelIndex",
+      partitionKey: { name: "gsi1pk", type: dynamodb3.AttributeType.STRING },
+      sortKey: { name: "gsi1sk", type: dynamodb3.AttributeType.STRING },
+      projectionType: dynamodb3.ProjectionType.ALL
+    });
+    const cookieKey = new secretsmanager4.Secret(this, "CookieKey", {
+      secretName: names.secretPagesCookieKey,
+      description: `${display} hosted-pages cookie signing key ({ key }); read by the sign-in Lambda and copied to the edge key store`,
+      removalPolicy: cdk7.RemovalPolicy.DESTROY,
+      generateSecretString: {
+        secretStringTemplate: "{}",
+        generateStringKey: "key",
+        passwordLength: 64,
+        excludePunctuation: true
+      }
+    });
+    const edgeKeys = new cloudfront.KeyValueStore(this, "EdgeKeys", {
+      comment: `${display} pages cookie key for the viewer function`
+    });
+    const authRole = new iam8.Role(this, "PagesAuthRole", {
+      assumedBy: new iam8.ServicePrincipal("lambda.amazonaws.com"),
+      description: `${display} pages sign-in Lambda (Slack OIDC + membership check)`,
+      managedPolicies: [
+        iam8.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
+      ]
+    });
+    authRole.addToPolicy(new iam8.PolicyStatement({
+      sid: "PagesAuthSecrets",
+      actions: ["secretsmanager:GetSecretValue"],
+      resources: [secretArnPattern3(props.secrets.slackApp), cookieKey.secretArn]
+    }));
+    authRole.addToPolicy(new iam8.PolicyStatement({
+      sid: "PagesAuthPageLookup",
+      actions: ["dynamodb:GetItem"],
+      resources: [this.table.tableArn]
+    }));
+    authRole.addToPolicy(new iam8.PolicyStatement({
+      sid: "PagesTableKey",
+      actions: ["kms:Decrypt", "kms:DescribeKey"],
+      resources: [props.dataKey.keyArn]
+    }));
+    const authFunction = new lambda3.Function(this, "PagesAuthFunction", {
+      runtime: lambda3.Runtime.NODEJS_22_X,
+      handler: "index.handler",
+      code: lambdaCode(this, "pages-auth"),
+      role: authRole,
+      timeout: cdk7.Duration.seconds(15),
+      memorySize: 256,
+      environment: {
+        FOUNDATION_SLACK_APP_SECRET_ID: props.secrets.slackApp.secretName,
+        FOUNDATION_PAGES_COOKIE_SECRET_ID: cookieKey.secretName,
+        FOUNDATION_SLACK_TEAM_ID: instance.slack.teamId,
+        FOUNDATION_PAGES_TABLE_NAME: this.table.tableName,
+        FOUNDATION_DISPLAY_NAME: display,
+        ...domain === undefined ? {} : { FOUNDATION_PAGES_DOMAIN: domain }
+      }
+    });
+    const authUrl = authFunction.addFunctionUrl({ authType: lambda3.FunctionUrlAuthType.AWS_IAM });
+    const seedRole = new iam8.Role(this, "EdgeKeySeedRole", {
+      assumedBy: new iam8.ServicePrincipal("lambda.amazonaws.com"),
+      description: `${display} copies the pages cookie key into the edge key store`,
+      managedPolicies: [
+        iam8.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
+      ]
+    });
+    seedRole.addToPolicy(new iam8.PolicyStatement({
+      sid: "ReadCookieKey",
+      actions: ["secretsmanager:GetSecretValue"],
+      resources: [cookieKey.secretArn]
+    }));
+    seedRole.addToPolicy(new iam8.PolicyStatement({
+      sid: "WriteEdgeKey",
+      actions: [
+        "cloudfront-keyvaluestore:DescribeKeyValueStore",
+        "cloudfront-keyvaluestore:PutKey"
+      ],
+      resources: [edgeKeys.keyValueStoreArn]
+    }));
+    const seedFunction = new lambda3.Function(this, "EdgeKeySeedFunction", {
+      runtime: lambda3.Runtime.NODEJS_22_X,
+      handler: "index.edgeKeyHandler",
+      code: lambdaCode(this, "pages-auth"),
+      role: seedRole,
+      timeout: cdk7.Duration.seconds(60),
+      memorySize: 256
+    });
+    new cdk7.CustomResource(this, "EdgeKeySeed", {
+      serviceToken: seedFunction.functionArn,
+      resourceType: "Custom::FoundationPagesEdgeKey",
+      properties: {
+        SecretId: cookieKey.secretArn,
+        KeyValueStoreArn: edgeKeys.keyValueStoreArn,
+        Generation: "1"
+      }
+    });
+    const viewerRequest = new cloudfront.Function(this, "ViewerRequest", {
+      runtime: cloudfront.FunctionRuntime.JS_2_0,
+      keyValueStore: edgeKeys,
+      comment: `${display} pages: cookie check and path mapping`,
+      code: cloudfront.FunctionCode.fromInline(pagesViewerRequestCode(edgeKeys.keyValueStoreId))
+    });
+    const headers = new cloudfront.ResponseHeadersPolicy(this, "PagesHeaders", {
+      comment: `${display} pages security headers`,
+      securityHeadersBehavior: {
+        contentSecurityPolicy: {
+          contentSecurityPolicy: PAGES_CONTENT_SECURITY_POLICY,
+          override: true
+        },
+        strictTransportSecurity: {
+          accessControlMaxAge: cdk7.Duration.days(365),
+          includeSubdomains: false,
+          override: true
+        },
+        contentTypeOptions: { override: true },
+        frameOptions: { frameOption: cloudfront.HeadersFrameOption.SAMEORIGIN, override: true },
+        referrerPolicy: {
+          referrerPolicy: cloudfront.HeadersReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN,
+          override: true
+        }
+      },
+      customHeadersBehavior: {
+        customHeaders: [{ header: "X-Robots-Tag", value: "noindex, nofollow", override: true }]
+      }
+    });
+    const zoneDomain = instance.pages.domain;
+    const zone = zoneDomain === undefined ? undefined : instance.pages.hostedZoneId !== undefined ? route532.HostedZone.fromHostedZoneId(this, "PagesParentZone", instance.pages.hostedZoneId) : new route532.PublicHostedZone(this, "PagesZone", {
+      zoneName: zoneDomain,
+      comment: `${display} hosted pages (delegated from the company's DNS)`
+    });
+    let certificate;
+    if (domain !== undefined && zone !== undefined) {
+      const certificateRole = new iam8.Role(this, "PagesCertificateRole", {
+        assumedBy: new iam8.ServicePrincipal("lambda.amazonaws.com"),
+        description: `${display} issues the pages domain certificate in us-east-1`,
+        managedPolicies: [
+          iam8.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
+        ]
+      });
+      certificateRole.addToPolicy(new iam8.PolicyStatement({
+        sid: "RequestCertificate",
+        actions: ["acm:RequestCertificate"],
+        resources: ["*"]
+      }));
+      certificateRole.addToPolicy(new iam8.PolicyStatement({
+        sid: "ManageCertificate",
+        actions: ["acm:DescribeCertificate", "acm:DeleteCertificate"],
+        resources: [`arn:${this.partition}:acm:us-east-1:${this.account}:certificate/*`]
+      }));
+      certificateRole.addToPolicy(new iam8.PolicyStatement({
+        sid: "ValidationRecord",
+        actions: ["route53:ChangeResourceRecordSets"],
+        resources: [`arn:${this.partition}:route53:::hostedzone/${zone.hostedZoneId}`]
+      }));
+      const certificateFunction = new lambda3.Function(this, "PagesCertificateFunction", {
+        runtime: lambda3.Runtime.NODEJS_22_X,
+        handler: "index.certificateHandler",
+        code: lambdaCode(this, "pages-auth"),
+        role: certificateRole,
+        timeout: cdk7.Duration.minutes(15),
+        memorySize: 256
+      });
+      const issued = new cdk7.CustomResource(this, "PagesCertificate", {
+        serviceToken: certificateFunction.functionArn,
+        resourceType: "Custom::FoundationPagesCertificate",
+        properties: { DomainName: domain, HostedZoneId: zone.hostedZoneId }
+      });
+      certificate = acm2.Certificate.fromCertificateArn(this, "PagesCertificateArn", issued.getAttString("CertificateArn"));
+    }
+    const functionAssociations = [
+      { function: viewerRequest, eventType: cloudfront.FunctionEventType.VIEWER_REQUEST }
+    ];
+    this.distribution = new cloudfront.Distribution(this, "Distribution", {
+      comment: `${display} pages`,
+      ...domain === undefined || certificate === undefined ? {} : { domainNames: [domain], certificate },
+      defaultRootObject: "index.html",
+      minimumProtocolVersion: cloudfront.SecurityPolicyProtocol.TLS_V1_2_2021,
+      httpVersion: cloudfront.HttpVersion.HTTP2_AND_3,
+      priceClass: cloudfront.PriceClass.PRICE_CLASS_100,
+      defaultBehavior: {
+        origin: origins.S3BucketOrigin.withOriginAccessControl(this.bucket, {
+          originAccessLevels: [cloudfront.AccessLevel.READ, cloudfront.AccessLevel.LIST]
+        }),
+        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        allowedMethods: cloudfront.AllowedMethods.ALLOW_GET_HEAD,
+        cachePolicy: cloudfront.CachePolicy.CACHING_OPTIMIZED,
+        responseHeadersPolicy: headers,
+        functionAssociations
+      },
+      additionalBehaviors: {
+        "/_auth/*": {
+          origin: origins.FunctionUrlOrigin.withOriginAccessControl(authUrl),
+          viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+          allowedMethods: cloudfront.AllowedMethods.ALLOW_GET_HEAD,
+          cachePolicy: cloudfront.CachePolicy.CACHING_DISABLED,
+          originRequestPolicy: cloudfront.OriginRequestPolicy.ALL_VIEWER_EXCEPT_HOST_HEADER,
+          responseHeadersPolicy: headers,
+          functionAssociations
+        }
+      }
+    });
+    cdk7.Annotations.of(this.distribution).acknowledgeWarning("@aws-cdk/aws-cloudfront-origins:listBucketSecurityRisk", "The viewer function forwards only mapped object keys and 404s `/`; defaultRootObject is set too. LIST only turns a missing key into 404 instead of 403.");
+    if (domain !== undefined && zone !== undefined) {
+      const target = route532.RecordTarget.fromAlias(new route53Targets2.CloudFrontTarget(this.distribution));
+      new route532.ARecord(this, "PagesAliasA", { zone, recordName: `${domain}.`, target });
+      new route532.AaaaRecord(this, "PagesAliasAaaa", { zone, recordName: `${domain}.`, target });
+    }
+    const defaultUrl = `https://${this.distribution.distributionDomainName}`;
+    const baseUrl = domain === undefined ? defaultUrl : `https://${domain}`;
+    const apiRole = new iam8.Role(this, "PagesApiRole", {
+      assumedBy: new iam8.ServicePrincipal("lambda.amazonaws.com"),
+      description: `${display} Pages API proxy (the only writer of the pages bucket and table)`,
+      managedPolicies: [
+        iam8.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
+      ]
+    });
+    apiRole.addToPolicy(new iam8.PolicyStatement({
+      sid: "PagesApiSigningSecret",
+      actions: ["secretsmanager:GetSecretValue"],
+      resources: [secretArnPattern3(props.secrets.signing)]
+    }));
+    apiRole.addToPolicy(new iam8.PolicyStatement({
+      sid: "PagesTableData",
+      actions: [
+        "dynamodb:GetItem",
+        "dynamodb:PutItem",
+        "dynamodb:UpdateItem",
+        "dynamodb:Query",
+        "dynamodb:TransactWriteItems",
+        "dynamodb:ConditionCheckItem"
+      ],
+      resources: [this.table.tableArn]
+    }));
+    apiRole.addToPolicy(new iam8.PolicyStatement({
+      sid: "PagesTableKey",
+      actions: ["kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:DescribeKey"],
+      resources: [props.dataKey.keyArn]
+    }));
+    apiRole.addToPolicy(new iam8.PolicyStatement({
+      sid: "PagesObjects",
+      actions: ["s3:GetObject", "s3:PutObject"],
+      resources: [this.bucket.arnForObjects("pages/*"), this.bucket.arnForObjects("uploads/*")]
+    }));
+    this.apiFunction = new lambda3.Function(this, "PagesApiFunction", {
+      functionName: names.pagesApiFunctionName,
+      runtime: lambda3.Runtime.NODEJS_22_X,
+      handler: "index.handler",
+      code: lambdaCode(this, "pages-api"),
+      role: apiRole,
+      timeout: cdk7.Duration.seconds(300),
+      memorySize: 1024,
+      environment: {
+        FOUNDATION_PAGES_TABLE_NAME: this.table.tableName,
+        FOUNDATION_PAGES_BUCKET_NAME: this.bucket.bucketName,
+        FOUNDATION_PAGES_BASE_URL: baseUrl,
+        FOUNDATION_SLACK_TEAM_ID: instance.slack.teamId,
+        FOUNDATION_SLACK_SIGNING_SECRET_ID: props.secrets.signing.secretName
+      }
+    });
+    new cdk7.CfnOutput(this, "PagesApiFunctionArn", { value: this.apiFunction.functionArn });
+    new cdk7.CfnOutput(this, "PagesBaseUrl", { value: baseUrl });
+    new cdk7.CfnOutput(this, "PagesDistributionDomainName", {
+      value: this.distribution.distributionDomainName
+    });
+    new cdk7.CfnOutput(this, "PagesAuthRedirectUrl", {
+      description: "Slack OAuth redirect URL for Sign in with Slack on the pages domain",
+      value: `${baseUrl}/_auth/callback`
+    });
+    new cdk7.CfnOutput(this, "PagesDefaultAuthRedirectUrl", {
+      value: `${defaultUrl}/_auth/callback`
+    });
+    new cdk7.CfnOutput(this, "PagesCustomDomainAttached", {
+      value: domain === undefined ? "false" : "true"
+    });
+    if (domain !== undefined)
+      new cdk7.CfnOutput(this, "PagesCustomDomain", { value: domain });
+    if (zone instanceof route532.PublicHostedZone) {
+      new cdk7.CfnOutput(this, "PagesHostedZoneId", { value: zone.hostedZoneId });
+      new cdk7.CfnOutput(this, "PagesNameServers", {
+        description: `NS records to add for ${zoneDomain} at the company's DNS provider`,
+        value: cdk7.Fn.join(",", zone.hostedZoneNameServers ?? [])
+      });
+    }
+  }
+}
+function secretArnPattern3(secret) {
+  return secret.secretFullArn ?? `${secret.secretArn}-??????`;
+}
+
+// src/stacks/pipeline-stack.ts
+import * as cdk8 from "aws-cdk-lib";
 import * as codebuild from "aws-cdk-lib/aws-codebuild";
 import * as codepipeline from "aws-cdk-lib/aws-codepipeline";
 import * as actions from "aws-cdk-lib/aws-codepipeline-actions";
-import * as iam8 from "aws-cdk-lib/aws-iam";
+import * as iam9 from "aws-cdk-lib/aws-iam";
 import * as sns3 from "aws-cdk-lib/aws-sns";
 import * as subscriptions from "aws-cdk-lib/aws-sns-subscriptions";
 var DEFAULT_BUILDSPEC_PATH = "buildspec.yml";
-var BUILD_TIMEOUT = cdk7.Duration.minutes(60);
+var BUILD_TIMEOUT = cdk8.Duration.minutes(60);
 
-class FoundationPipeline extends cdk7.Stack {
+class FoundationPipeline extends cdk8.Stack {
   pipeline;
   buildRole;
   constructor(scope, id, props) {
@@ -2701,11 +3239,11 @@ class FoundationPipeline extends cdk7.Stack {
     if (deploy.connectionArn === undefined)
       throw new Error(`instance ${props.instance.name}: deploy.connectionArn is required for a pipeline`);
     const [owner = "", repo = ""] = props.instance.github.repo.split("/");
-    this.buildRole = new iam8.Role(this, "BuildRole", {
+    this.buildRole = new iam9.Role(this, "BuildRole", {
       description: `CodePipeline deployer for ${props.instance.name}`,
-      assumedBy: new iam8.ServicePrincipal("codebuild.amazonaws.com"),
+      assumedBy: new iam9.ServicePrincipal("codebuild.amazonaws.com"),
       inlinePolicies: {
-        FoundationDeploy: new iam8.PolicyDocument({
+        FoundationDeploy: new iam9.PolicyDocument({
           statements: deployStatements(this, names, { bucket: props.bucket, dataKey: props.dataKey }, props.instance)
         })
       }
@@ -2799,11 +3337,11 @@ class FoundationPipeline extends cdk7.Stack {
     this.pipeline.onStateChange("OnFailure", {
       description: `${props.instance.name} deploy failed`,
       eventPattern: { detail: { state: ["FAILED"] } },
-      target: new cdk7.aws_events_targets.SnsTopic(failureTopic)
+      target: new cdk8.aws_events_targets.SnsTopic(failureTopic)
     });
-    new cdk7.CfnOutput(this, "PipelineName", { value: this.pipeline.pipelineName });
-    new cdk7.CfnOutput(this, "BuildRoleArn", { value: this.buildRole.roleArn });
+    new cdk8.CfnOutput(this, "PipelineName", { value: this.pipeline.pipelineName });
+    new cdk8.CfnOutput(this, "BuildRoleArn", { value: this.buildRole.roleArn });
   }
 }
 
-export { FoundationAgent, FoundationApi, deployStatements, FoundationCi, FoundationData, FoundationNetwork, NewsletterStack, DEFAULT_BUILDSPEC_PATH, BUILD_TIMEOUT, FoundationPipeline };
+export { FoundationAgent, FoundationApi, deployStatements, FoundationCi, FoundationData, FoundationNetwork, NewsletterStack, FoundationPages, DEFAULT_BUILDSPEC_PATH, BUILD_TIMEOUT, FoundationPipeline };

package/dist/src/index.js

@@ -6,10 +6,11 @@ import {
   FoundationCi,
   FoundationData,
   FoundationNetwork,
+  FoundationPages,
   FoundationPipeline,
   NewsletterStack,
   deployStatements
-} from "../chunk-83781ggk.js";
+} from "../chunk-rq4dc5ns.js";
 import {
   BUN_VERSION,
   LAMBDA_ENTRY_POINTS,
@@ -42,7 +43,7 @@ import {
   skillsKey,
   skipBundle,
   verifyManifest
-} from "../chunk-7qn00ny1.js";
+} from "../chunk-9rasrppa.js";
 export {
   BUILD_TIMEOUT,
   BUN_VERSION,
@@ -52,6 +53,7 @@ export {
   FoundationCi,
   FoundationData,
   FoundationNetwork,
+  FoundationPages,
   FoundationPipeline,
   LAMBDA_ENTRY_POINTS,
   LIVE_ENDPOINT_NAME,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.2.15",
+  "version": "0.2.16",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,

package/src/artifacts.ts

@@ -66,6 +66,8 @@ export const LAMBDA_ENTRY_POINTS = {
   "crm-proxy": { entry: "packages/capability-crm/src/proxy/handler.ts" },
   "upwork-proxy": { entry: "packages/capability-upwork/src/proxy/handler.ts" },
   "etrade-proxy": { entry: "packages/capability-etrade/src/proxy/handler.ts" },
+  "pages-api": { entry: "packages/capability-pages/src/proxy/handler.ts" },
+  "pages-auth": { entry: "packages/capability-pages/src/auth/lambda.ts" },
   "browser-proxy": { entry: "packages/gateway/src/browser-proxy.ts", playwright: true },
   "newsletter-public": { entry: "packages/newsletter/src/lambda-public.ts" },
   "newsletter-campaign": { entry: "packages/newsletter/src/lambda-campaign.ts" },

package/src/deploy/cli.ts

@@ -149,6 +149,9 @@ export async function main(argv: readonly string[] = process.argv.slice(2)): Pro
           ...(process.env.INTERACTIVE_REQUEST_URL === undefined
             ? {}
             : { INTERACTIVE_REQUEST_URL: process.env.INTERACTIVE_REQUEST_URL }),
+          ...(process.env.PAGES_AUTH_REDIRECT_URL === undefined
+            ? {}
+            : { PAGES_AUTH_REDIRECT_URL: process.env.PAGES_AUTH_REDIRECT_URL }),
         }),
       ),
     );