@deployfoundation/foundation-deploy 0.2.15 → 0.2.17

package/agent-image/Dockerfile

@@ -253,6 +253,7 @@ COPY packages/capability-email/ ./packages/capability-email/
 COPY packages/capability-crm/ ./packages/capability-crm/
 COPY packages/capability-upwork/ ./packages/capability-upwork/
 COPY packages/capability-etrade/ ./packages/capability-etrade/
+COPY packages/capability-pages/ ./packages/capability-pages/
 COPY packages/agent/ ./packages/agent/
 # Manifest only: the gateway and every proxy are Lambdas, the newsletter is a
 # Lambda service, and the infra package is the CDK app a pipeline runs. None of

package/dist/bin/app.js

@@ -5,14 +5,16 @@ import {
   FoundationCi,
   FoundationData,
   FoundationNetwork,
+  FoundationPages,
   FoundationPipeline,
   NewsletterStack
-} from "../chunk-83781ggk.js";
+} from "../chunk-rq4dc5ns.js";
 import {
   adminsFor,
   instanceNames,
-  loadInstanceFile
-} from "../chunk-7qn00ny1.js";
+  loadInstanceFile,
+  provisionsIntegration
+} from "../chunk-9rasrppa.js";
 
 // bin/app.ts
 import { execFileSync } from "node:child_process";
@@ -33,6 +35,14 @@ var alarmEmail = app.node.tryGetContext("alarmEmail");
 var pipelineInstanceFile = app.node.tryGetContext("pipelineInstanceFile") ?? repoRelativePath(instanceFilePath);
 var network = new FoundationNetwork(app, names.network, { env, instance, configPath });
 var data = new FoundationData(app, names.data, { env, instance });
+if (provisionsIntegration(instance, "pages"))
+  new FoundationPages(app, names.pages, {
+    env,
+    instance,
+    dataKey: data.dataKey,
+    secrets: { signing: data.secrets.signing, slackApp: data.secrets.slackApp },
+    domainDelegated: app.node.tryGetContext("pagesDomainDelegated") === "true"
+  });
 var agent = new FoundationAgent(app, names.agent, {
   env,
   instance,

package/dist/bin/foundation-deploy.js

@@ -29,7 +29,7 @@ import {
   stackExists,
   stackOutput,
   toolVersion
-} from "../chunk-e9vs85ah.js";
+} from "../chunk-pygj3x43.js";
 import {
   BASE_SLACK_EVENTS,
   CAPABILITY_IDS,
@@ -45,7 +45,7 @@ import {
   requiredSlackScopes,
   skillsKey,
   slackCommandPrefix
-} from "../chunk-7qn00ny1.js";
+} from "../chunk-9rasrppa.js";
 
 // src/deploy/config-sync.ts
 import { existsSync, mkdirSync, mkdtempSync, readdirSync } from "node:fs";
@@ -749,6 +749,63 @@ async function failureText(response) {
   }
 }
 
+// src/deploy/pages-domain.ts
+import { Resolver } from "node:dns/promises";
+function pagesDomainMode(instance) {
+  if (!instance.integrations.pages || instance.pages.domain === undefined)
+    return "none";
+  return instance.pages.hostedZoneId === undefined ? "own-zone" : "parent-zone";
+}
+function normal(name) {
+  return name.trim().toLowerCase().replace(/\.$/, "");
+}
+async function pagesDomainState(instance, deps) {
+  const mode = pagesDomainMode(instance);
+  const domain = instance.pages.domain;
+  if (mode === "none" || domain === undefined)
+    return { mode, delegated: false, nameServers: [] };
+  if (mode === "parent-zone")
+    return { mode, domain, delegated: true, nameServers: [] };
+  const nameServers = (await deps.output("PagesNameServers") ?? "").split(",").map(normal).filter((server) => server !== "");
+  if (await deps.output("PagesCustomDomainAttached") === "true" && await deps.output("PagesCustomDomain") === domain)
+    return { mode, domain, delegated: true, nameServers };
+  if (nameServers.length === 0)
+    return { mode, domain, delegated: false, nameServers };
+  let answer;
+  try {
+    answer = (await deps.resolveNs(domain)).map(normal);
+  } catch {
+    answer = [];
+  }
+  const delegated = nameServers.every((server) => answer.includes(server));
+  return { mode, domain, delegated, nameServers };
+}
+async function publicNs(name) {
+  const resolver = new Resolver({ timeout: 5000, tries: 2 });
+  resolver.setServers(["1.1.1.1", "8.8.8.8"]);
+  try {
+    return await resolver.resolveNs(name);
+  } catch {
+    return [];
+  }
+}
+function pagesDomainReport(state, baseUrl) {
+  if (state.mode === "none" || state.domain === undefined)
+    return baseUrl === undefined ? [] : [`  pages are served at ${baseUrl}`];
+  if (state.delegated)
+    return [`  pages are served at https://${state.domain}`];
+  if (state.nameServers.length === 0)
+    return [
+      `  ${state.domain}: the pages zone is created by this deploy; its NS records follow on the next run.`
+    ];
+  return [
+    `  ☐ add these NS records for ${state.domain} at your DNS provider:`,
+    ...state.nameServers.map((server) => `      ${state.domain}.  NS  ${server}.`),
+    `    until they resolve, pages are served at ${baseUrl ?? "the CloudFront default domain"}.`,
+    "    Deploy again once they do: that deploy issues the certificate and moves pages to the domain."
+  ];
+}
+
 // src/deploy/runtime-secret.ts
 var LIVE_ENDPOINT = "live";
 function composeRuntimeSecret(inputs) {
@@ -797,6 +854,7 @@ function composeRuntimeSecret(inputs) {
     ...inputs.browserProxyFunctionArn !== undefined && inputs.browserProxyFunctionArn !== "" ? { FOUNDATION_BROWSER_PROXY_FUNCTION_ARN: inputs.browserProxyFunctionArn } : {},
     ...inputs.crmProxyFunctionArn !== undefined && inputs.crmProxyFunctionArn !== "" ? { FOUNDATION_CRM_PROXY_FUNCTION_ARN: inputs.crmProxyFunctionArn } : {},
     ...inputs.crmPolicyFingerprint !== undefined && inputs.crmPolicyFingerprint !== "" ? { FOUNDATION_CRM_POLICY_FINGERPRINT: inputs.crmPolicyFingerprint } : {},
+    ...inputs.pagesApiFunctionArn !== undefined && inputs.pagesApiFunctionArn !== "" ? { FOUNDATION_PAGES_API_FUNCTION_ARN: inputs.pagesApiFunctionArn } : {},
     ...inputs.otterProxyFunctionArn !== undefined && inputs.otterProxyFunctionArn !== "" ? { FOUNDATION_OTTER_PROXY_FUNCTION_ARN: inputs.otterProxyFunctionArn } : {},
     ...inputs.knockProxyFunctionArn !== undefined && inputs.knockProxyFunctionArn !== "" ? { FOUNDATION_KNOCK_PROXY_FUNCTION_ARN: inputs.knockProxyFunctionArn } : {},
     ...inputs.upworkProxyFunctionArn !== undefined && inputs.upworkProxyFunctionArn !== "" ? { FOUNDATION_UPWORK_PROXY_ARN: inputs.upworkProxyFunctionArn } : {},
@@ -1032,7 +1090,8 @@ async function cdkDeploy(ctx, opts) {
     ...opts.phase1 === true ? ["-c", "deployRuntime=false"] : [],
     ...opts.tag === undefined || opts.release !== undefined ? [] : ["-c", `agentImageTag=${opts.tag}`],
     ...opts.release === undefined ? [] : releaseContext(opts.release),
-    ...opts.runtimeSecretDigest === undefined ? [] : ["-c", `runtimeSecretDigest=${opts.runtimeSecretDigest}`]
+    ...opts.runtimeSecretDigest === undefined ? [] : ["-c", `runtimeSecretDigest=${opts.runtimeSecretDigest}`],
+    ...await pagesDomainContext(ctx)
   ];
   await run([
     ...cdkCommand(),
@@ -1049,6 +1108,30 @@ async function cdkDeploy(ctx, opts) {
     dryRun: ctx.dryRun
   });
 }
+async function pagesDomain(ctx) {
+  return pagesDomainState(ctx.instance, {
+    output: (key) => optionalOutput(ctx, ctx.names.pages, key),
+    resolveNs: publicNs
+  });
+}
+async function pagesDomainContext(ctx) {
+  if (pagesDomainMode(ctx.instance) !== "own-zone" || ctx.dryRun === true)
+    return [];
+  return (await pagesDomain(ctx)).delegated ? ["-c", "pagesDomainDelegated=true"] : [];
+}
+async function reportPagesDomain(ctx) {
+  if (!ctx.instance.integrations.pages)
+    return;
+  console.log("▶ hosted pages");
+  if (ctx.dryRun === true) {
+    console.log(`  <${ctx.names.pages}.PagesBaseUrl>; NS records from <${ctx.names.pages}.PagesNameServers>`);
+    return;
+  }
+  const state = await pagesDomain(ctx);
+  const baseUrl = await optionalOutput(ctx, ctx.names.pages, "PagesBaseUrl");
+  for (const line of pagesDomainReport(state, baseUrl))
+    console.log(line);
+}
 async function optionalOutput(ctx, stack, key) {
   try {
     return await stackOutput(ctx, stack, key);
@@ -1098,6 +1181,7 @@ async function syncRuntimeSecret(ctx) {
   const browserProxyFunctionArn = dry ? `<${api}.BrowserProxyFunctionArn>` : await optionalOutput(ctx, api, "BrowserProxyFunctionArn");
   const crmProxyFunctionArn = ctx.instance.integrations.crm ? dry ? `<${api}.CrmProxyFunctionArn>` : await optionalOutput(ctx, api, "CrmProxyFunctionArn") : undefined;
   const crmPolicyFingerprint = ctx.instance.integrations.crm ? dry ? `<${api}.CrmPolicyFingerprint>` : await optionalOutput(ctx, api, "CrmPolicyFingerprint") : undefined;
+  const pagesApiFunctionArn = ctx.instance.integrations.pages ? dry ? `<${ctx.names.pages}.PagesApiFunctionArn>` : await optionalOutput(ctx, ctx.names.pages, "PagesApiFunctionArn") : undefined;
   const otterProxyFunctionArn = dry ? `<${api}.OtterProxyFunctionArn>` : await optionalOutput(ctx, api, "OtterProxyFunctionArn");
   const knockProxyFunctionArn = ctx.instance.integrations.knock ? dry ? `<${api}.KnockProxyFunctionArn>` : await optionalOutput(ctx, api, "KnockProxyFunctionArn") : undefined;
   const upworkProxyFunctionArn = ctx.instance.integrations.upwork ? dry ? `<${api}.UpworkProxyFunctionArn>` : await optionalOutput(ctx, api, "UpworkProxyFunctionArn") : undefined;
@@ -1123,6 +1207,7 @@ async function syncRuntimeSecret(ctx) {
     ...browserProxyFunctionArn === undefined ? {} : { browserProxyFunctionArn },
     ...crmProxyFunctionArn === undefined ? {} : { crmProxyFunctionArn },
     ...crmPolicyFingerprint === undefined ? {} : { crmPolicyFingerprint },
+    ...pagesApiFunctionArn === undefined ? {} : { pagesApiFunctionArn },
     ...otterProxyFunctionArn === undefined ? {} : { otterProxyFunctionArn },
     ...knockProxyFunctionArn === undefined ? {} : { knockProxyFunctionArn },
     ...upworkProxyFunctionArn === undefined ? {} : { upworkProxyFunctionArn },
@@ -1218,6 +1303,7 @@ async function deploy(ctx, opts) {
     ...runtimeSecretDigest2 === undefined ? {} : { runtimeSecretDigest: runtimeSecretDigest2 }
   });
   await deployStacks(deployed);
+  await reportPagesDomain(ctx);
   if (ctx.instance.integrations.knock) {
     console.log(`▶ Knock OAuth public-client registration (${ctx.names.secretKnockOauthClient})`);
     console.log(`  ${await syncKnockOAuthClient(ctx)}`);
@@ -1473,6 +1559,14 @@ function buildSlackManifest(template, instance, env) {
   if (manifest.oauth_config?.scopes?.bot !== undefined)
     throw new Error("app-manifest.yml: bot scopes are generated from the Foundation capability registry; remove them from the template");
   manifest.oauth_config = { scopes: { bot: requiredSlackScopes(CAPABILITY_IDS) } };
+  if (instance.pages === true) {
+    manifest.oauth_config.scopes.user = ["openid"];
+    const redirects = [
+      ...new Set((env.PAGES_AUTH_REDIRECT_URL ?? "").split(",").map((url) => url.trim()).filter((url) => url !== ""))
+    ];
+    if (redirects.length > 0)
+      manifest.oauth_config.redirect_urls = redirects;
+  }
   const declared = new Set((manifest.features.slash_commands ?? []).map((c) => c.command));
   for (const command of requiredSlackCommands(CAPABILITY_IDS, instance.commandPrefix))
     if (!declared.has(command))
@@ -1492,7 +1586,19 @@ function buildSlackManifest(template, instance, env) {
   return manifest;
 }
 function slackManifestFor(instance, env) {
-  return buildSlackManifest(readFileSync5(SLACK_APP_MANIFEST_PATH, "utf8"), { displayName: instance.displayName, commandPrefix: slackCommandPrefix(instance) }, env);
+  return buildSlackManifest(readFileSync5(SLACK_APP_MANIFEST_PATH, "utf8"), {
+    displayName: instance.displayName,
+    commandPrefix: slackCommandPrefix(instance),
+    pages: instance.integrations.pages
+  }, {
+    ...env,
+    ...instance.integrations.pages && instance.pages.domain !== undefined ? {
+      PAGES_AUTH_REDIRECT_URL: [
+        `https://${instance.pages.domain}/_auth/callback`,
+        ...env.PAGES_AUTH_REDIRECT_URL === undefined ? [] : [env.PAGES_AUTH_REDIRECT_URL]
+      ].join(",")
+    } : {}
+  });
 }
 
 // src/deploy/tracing.ts
@@ -1721,7 +1827,13 @@ async function reportSlackManifest(ctx) {
   const manifest = slackManifestFor(ctx.instance, {
     EVENTS_REQUEST_URL: await output(ctx, ctx.names.api, "EventsUrl"),
     COMMANDS_REQUEST_URL: await output(ctx, ctx.names.api, "CommandsUrl"),
-    INTERACTIVE_REQUEST_URL: await output(ctx, ctx.names.api, "InteractiveUrl")
+    INTERACTIVE_REQUEST_URL: await output(ctx, ctx.names.api, "InteractiveUrl"),
+    ...ctx.instance.integrations.pages ? {
+      PAGES_AUTH_REDIRECT_URL: [
+        await output(ctx, ctx.names.pages, "PagesAuthRedirectUrl"),
+        await output(ctx, ctx.names.pages, "PagesDefaultAuthRedirectUrl")
+      ].join(",")
+    } : {}
   });
   console.log(`  manifest: ${JSON.stringify(manifest)}`);
   console.log([
@@ -1874,8 +1986,9 @@ async function setup(ctx, opts = {}) {
   await setDeployRoleVariable(ctx);
   step(13, "deploy the instance's own pipeline, if it has one");
   await deployPipelineStack(ctx);
-  step(14, "the Slack app manifest for the deployed API");
+  step(14, "the Slack app manifest for the deployed API, and the pages domain");
   await reportSlackManifest(ctx);
+  await reportPagesDomain(ctx);
   step(15, "smoke test the runtime");
   await smokeTest(ctx);
   console.log(`
@@ -1987,7 +2100,8 @@ ${USAGE}`);
     console.log(JSON.stringify(slackManifestFor(paths.instance, {
       ...process.env.EVENTS_REQUEST_URL === undefined ? {} : { EVENTS_REQUEST_URL: process.env.EVENTS_REQUEST_URL },
       ...process.env.COMMANDS_REQUEST_URL === undefined ? {} : { COMMANDS_REQUEST_URL: process.env.COMMANDS_REQUEST_URL },
-      ...process.env.INTERACTIVE_REQUEST_URL === undefined ? {} : { INTERACTIVE_REQUEST_URL: process.env.INTERACTIVE_REQUEST_URL }
+      ...process.env.INTERACTIVE_REQUEST_URL === undefined ? {} : { INTERACTIVE_REQUEST_URL: process.env.INTERACTIVE_REQUEST_URL },
+      ...process.env.PAGES_AUTH_REDIRECT_URL === undefined ? {} : { PAGES_AUTH_REDIRECT_URL: process.env.PAGES_AUTH_REDIRECT_URL }
     })));
     return 0;
   }

package/dist/bin/release-account.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env bun
 import {
   DEFAULT_RELEASE_BUCKET
-} from "../chunk-e9vs85ah.js";
-import"../chunk-7qn00ny1.js";
+} from "../chunk-pygj3x43.js";
+import"../chunk-9rasrppa.js";
 
 // bin/release-account.ts
 import * as cdk2 from "aws-cdk-lib";

package/dist/{chunk-7qn00ny1.js → chunk-9rasrppa.js}

@@ -266,6 +266,7 @@ var RawTodosCapability = z.object({
   digestHour: z.union([z.number().int().min(0).max(23), z.literal("off")]).default(8)
 }).strict().default({});
 var RawRoutinesCapability = z.object({ enabled: z.boolean().default(true) }).strict().default({});
+var RawPagesCapability = z.object({ enabled: z.boolean().default(false) }).strict().default({});
 var NONE = {
   secrets: [],
   resources: [],
@@ -461,6 +462,14 @@ var CAPABILITIES = [
     resources: ["upworkProxyFunctionName"],
     slackCommands: ["upwork-connect"]
   },
+  {
+    id: "pages",
+    summary: "Private, versioned web pages (decks, reports, dashboards) the agent publishes; members of the channel they were made in open them with a Slack sign-in.",
+    config: RawPagesCapability,
+    integration: true,
+    ...NONE,
+    resources: ["pagesApiFunctionName"]
+  },
   {
     id: "etrade",
     summary: "E*TRADE account data through six fixed reads for named admins and deployment jobs in configured private channels.",
@@ -699,6 +708,7 @@ var RawIntegrations = z2.object({
   knock: z2.boolean().default(false),
   upwork: z2.boolean().default(false),
   etrade: z2.boolean().default(false),
+  pages: z2.boolean().default(false),
   crm: z2.boolean().default(false),
   crmStorage: z2.boolean().optional()
 }).strict().default({}).transform((integrations) => ({
@@ -706,6 +716,18 @@ var RawIntegrations = z2.object({
   crmStorage: integrations.crmStorage ?? integrations.crm
 }));
 var RawLicense = z2.object({ key: z2.string().min(1) }).strict();
+var PAGES_DOMAIN_RE = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/;
+var RawPages = z2.object({
+  domain: z2.string().regex(PAGES_DOMAIN_RE, "pages.domain must be a lowercase host name without a scheme or path").optional(),
+  hostedZoneId: z2.string().regex(HOSTED_ZONE_ID_RE, "pages.hostedZoneId must be a Route 53 hosted zone id (Z…)").optional()
+}).strict().superRefine((pages, ctx) => {
+  if (pages.hostedZoneId !== undefined && pages.domain === undefined)
+    ctx.addIssue({
+      code: z2.ZodIssueCode.custom,
+      path: ["hostedZoneId"],
+      message: "pages.hostedZoneId needs pages.domain"
+    });
+}).default({});
 var RawInstance = z2.object({
   name: z2.string().min(1).max(63).regex(/^[a-z][a-z0-9-]*$/),
   displayName: z2.string().min(1).max(120),
@@ -722,8 +744,15 @@ var RawInstance = z2.object({
   runtime: RawRuntime,
   network: RawNetwork,
   integrations: RawIntegrations,
-  newsletter: RawNewsletter
+  newsletter: RawNewsletter,
+  pages: RawPages
 }).strict().superRefine((doc, ctx) => {
+  if (doc.pages.domain !== undefined && !doc.integrations.pages)
+    ctx.addIssue({
+      code: z2.ZodIssueCode.custom,
+      path: ["pages", "domain"],
+      message: "pages.domain needs integrations.pages: true"
+    });
   if (doc.customization !== undefined && doc.deploy.via !== "codepipeline")
     ctx.addIssue({
       code: z2.ZodIssueCode.custom,
@@ -772,12 +801,13 @@ function instanceNames(instance) {
   const { prefix, secretPrefix, runtimeName } = instance.naming;
   const stack = (suffix) => `${prefix}${suffix}`;
   const secret = (suffix) => `${secretPrefix}/${suffix}`;
-  const [network, data, api, agent, newsletter] = [
+  const [network, data, api, agent, newsletter, pages] = [
     stack("Network"),
     stack("Data"),
     stack("Api"),
     stack("Agent"),
-    stack("Newsletter")
+    stack("Newsletter"),
+    stack("Pages")
   ];
   return {
     network,
@@ -786,8 +816,16 @@ function instanceNames(instance) {
     api,
     ci: stack("Ci"),
     newsletter,
+    pages,
     pipeline: stack("Pipeline"),
-    allStacks: [network, data, api, agent, ...instance.newsletter.enabled ? [newsletter] : []],
+    allStacks: [
+      network,
+      data,
+      ...instance.integrations.pages ? [pages] : [],
+      api,
+      agent,
+      ...instance.newsletter.enabled ? [newsletter] : []
+    ],
     secretSlackSigning: secret("slack/signing"),
     secretSlackApp: secret("slack/app"),
     secretGithubApp: secret("github/app"),
@@ -822,6 +860,8 @@ function instanceNames(instance) {
     emailProxyFunctionName: stack("EmailProxy"),
     otterProxyFunctionName: stack("OtterProxy"),
     crmProxyFunctionName: stack("CrmProxy"),
+    pagesApiFunctionName: stack("PagesApi"),
+    secretPagesCookieKey: secret("pages/cookie-key"),
     browserProxyFunctionName: stack("BrowserProxy"),
     knockProxyFunctionName: stack("KnockProxy"),
     upworkProxyFunctionName: stack("UpworkProxy"),
@@ -1493,6 +1533,8 @@ var LAMBDA_ENTRY_POINTS = {
   "crm-proxy": { entry: "packages/capability-crm/src/proxy/handler.ts" },
   "upwork-proxy": { entry: "packages/capability-upwork/src/proxy/handler.ts" },
   "etrade-proxy": { entry: "packages/capability-etrade/src/proxy/handler.ts" },
+  "pages-api": { entry: "packages/capability-pages/src/proxy/handler.ts" },
+  "pages-auth": { entry: "packages/capability-pages/src/auth/lambda.ts" },
   "browser-proxy": { entry: "packages/gateway/src/browser-proxy.ts", playwright: true },
   "newsletter-public": { entry: "packages/newsletter/src/lambda-public.ts" },
   "newsletter-campaign": { entry: "packages/newsletter/src/lambda-campaign.ts" },

package/dist/{chunk-e9vs85ah.js → chunk-pygj3x43.js}

@@ -6,7 +6,7 @@ import {
   manifestKey,
   releaseCacheDir,
   verifyManifest
-} from "./chunk-7qn00ny1.js";
+} from "./chunk-9rasrppa.js";
 
 // src/deploy/release.ts
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2 } from "node:fs";