@deployfoundation/foundation-deploy 0.2.53 → 0.2.55

package/src/deploy/crm.ts

@@ -5,6 +5,9 @@
  *   foundation-deploy crm-key    --instance <path> --stdin
  *   foundation-deploy crm-check  --instance <path> [--allow-skips]
  *   foundation-deploy crm-check  --base-url <url> --tenant <id> --key-stdin [--write] [--allow-skips]
+ *                                [--harness-url <url> --harness-key-stdin] [--readonly-key-stdin]
+ *                                [--status-policy <file>] [--suppressed-statuses <file>]
+ *                                [--spend-weekly-allowance]
  *   foundation-deploy crm-replay --instance <path> --from <writes.jsonl> [--dry-run]
  *
  * - `crm-key` writes the `crm/1` key into the secret FoundationData created
@@ -14,9 +17,13 @@
  *   uses the deployment's base URL, tenant and stored key and runs only the
  *   read cases, since the write cases create records and spend the week's
  *   outreach allowance. With `--base-url` (no instance at all) it is what a
- *   CRM's own CI runs against a sandbox tenant, `--write` included. Strict
- *   unless `--allow-skips`: a case only a person can set up counts as failed
- *   when it could not run.
+ *   CRM's own CI runs against a sandbox tenant, `--write` included, with the
+ *   deployment inputs the remaining cases need: the CRM's harness endpoint
+ *   (`crm-harness/1`) for what only a person can do, a read-only key, the
+ *   deployment's status policy and suppressed statuses, and leave to spend
+ *   the week's caps. Every key comes on stdin, one per line. Strict unless
+ *   `--allow-skips`: a case only a person can set up counts as failed when it
+ *   could not run.
  * - `crm-replay` is the rollback half of a cutover: once `crm.provider` is
  *   back on `dynamodb`, it writes the agent's writes made in the company's CRM
  *   since the cutover (exported as JSONL) into the instance's own table,
@@ -54,12 +61,19 @@ import {
   parseCrmUpsertRecordsArgs,
 } from "@deployfoundation/foundation-connectors/crm";
 import { crmHttpBaseUrl, isCrmHttpKey } from "@deployfoundation/foundation-connectors/crm-http";
+import type { FetchLike } from "@deployfoundation/foundation-connectors/github";
 import {
   type CrmCapabilityConfig,
   type InstanceConfig,
   crmOutreachConfigured,
   parseInstanceConfig,
 } from "@deployfoundation/foundation-core";
+import {
+  RawCrmStatusPolicy,
+  RawCrmStatusesByType,
+} from "@deployfoundation/foundation-core/capabilities";
+import { parse as parseYaml } from "yaml";
+import type { z } from "zod";
 import { type AwsContext, aws, putSecretString, readSecretString, secretExists } from "./aws.ts";
 
 /** What these commands reach outside the process; tests replace every one. */
@@ -75,6 +89,8 @@ export interface CrmCommandDeps {
   /** A DocumentClient on the operator's own credentials. */
   documentClient: (ctx: AwsContext) => Promise<CrmDocumentClient>;
   readFile: (path: string) => string;
+  /** What the HTTP harness calls the CRM's harness endpoint with. */
+  fetch: FetchLike;
   log: (line: string) => void;
 }
 
@@ -175,15 +191,35 @@ export interface CrmCheckTargetOptions extends CrmCheckOptions {
   baseUrl: string;
   tenantId: string;
   write: boolean;
+  /** The CRM's harness endpoint (`crm-harness/1`); its key is read from stdin. */
+  harnessUrl?: string;
+  /** Read a key for the same tenant without write scopes from stdin (`read_only_scope`). */
+  readOnlyKeyStdin?: boolean;
+  /** The deployment's `capabilities.crm.statusPolicy`, as a JSON or YAML file. */
+  statusPolicyFile?: string;
+  /** The deployment's `capabilities.crm.outreach.suppressedStatuses`, as a JSON or YAML file. */
+  suppressedStatusesFile?: string;
+  /** Drive this week's first-touch and follow-up caps to their limits: a throwaway database only. */
+  spendWeeklyAllowance?: boolean;
 }
 
+/** The keys `crm-check --base-url` reads from stdin: one per line, in this order. */
+const STDIN_KEYS = [
+  { flag: "--key-stdin", name: "the crm/1 key" },
+  { flag: "--readonly-key-stdin", name: "the read-only key" },
+  { flag: "--harness-key-stdin", name: "the harness key" },
+] as const;
+
+type StdinKey = (typeof STDIN_KEYS)[number];
+
 /**
  * The suite against any `crm/1` server, no instance involved: what a CRM's
- * own CI runs from the published tool. The key comes from stdin.
+ * own CI runs from the published tool. Keys come from stdin; everything else
+ * is a flag or a file, all checked before stdin is read.
  */
 export async function crmCheckTarget(
   options: CrmCheckTargetOptions,
-  deps: Pick<CrmCommandDeps, "readStdin" | "runConformance" | "log">,
+  deps: Pick<CrmCommandDeps, "readStdin" | "runConformance" | "readFile" | "fetch" | "log">,
 ): Promise<number> {
   let baseUrl: string;
   try {
@@ -194,24 +230,153 @@ export async function crmCheckTarget(
   }
   if (!/^[\x21-\x7e]{1,256}$/.test(options.tenantId))
     throw new Error("--tenant must be the tenant id the server's /meta names");
-  const apiKey = (await deps.readStdin()).trim();
-  if (!isCrmHttpKey(apiKey)) throw new Error("stdin did not hold a usable crm/1 key (--key-stdin)");
+  // Each of these feeds write cases only: without --write it would do nothing.
+  const writeInputs = (
+    [
+      ["--harness-url", options.harnessUrl !== undefined],
+      ["--readonly-key-stdin", options.readOnlyKeyStdin === true],
+      ["--status-policy", options.statusPolicyFile !== undefined],
+      ["--suppressed-statuses", options.suppressedStatusesFile !== undefined],
+      ["--spend-weekly-allowance", options.spendWeeklyAllowance === true],
+    ] as const
+  )
+    .filter(([, given]) => given)
+    .map(([flag]) => flag);
+  if (!options.write && writeInputs.length > 0)
+    throw new Error(
+      `${writeInputs.join(", ")} only feed the write cases: add --write, against a sandbox tenant`,
+    );
+  // Loaded here, like the suite: no other command needs it.
+  const { createCrmHttpHarness, crmHarnessUrl } = await import(
+    "@deployfoundation/foundation-capability-crm/contract/http-harness"
+  );
+  let harnessUrl: string | undefined;
+  try {
+    harnessUrl = options.harnessUrl === undefined ? undefined : crmHarnessUrl(options.harnessUrl);
+  } catch {
+    throw new Error("--harness-url must be an HTTPS URL with no userinfo, query or fragment");
+  }
+  const statusPolicy =
+    options.statusPolicyFile === undefined
+      ? undefined
+      : deploymentInput(deps, "--status-policy", options.statusPolicyFile, RawCrmStatusPolicy);
+  const suppressedStatuses =
+    options.suppressedStatusesFile === undefined
+      ? undefined
+      : deploymentInput(
+          deps,
+          "--suppressed-statuses",
+          options.suppressedStatusesFile,
+          RawCrmStatusesByType,
+        );
+
+  const wanted = STDIN_KEYS.filter(
+    ({ flag }) =>
+      flag === "--key-stdin" ||
+      (flag === "--readonly-key-stdin" && options.readOnlyKeyStdin === true) ||
+      (flag === "--harness-key-stdin" && harnessUrl !== undefined),
+  );
+  const keys = stdinKeys(await deps.readStdin(), wanted);
+  const key = (flag: StdinKey["flag"]) => keys[wanted.findIndex((entry) => entry.flag === flag)];
+  const apiKey = key("--key-stdin") as string;
+  const readOnlyApiKey = key("--readonly-key-stdin");
+  const harnessKey = key("--harness-key-stdin");
+  const harness =
+    harnessUrl === undefined || harnessKey === undefined
+      ? undefined
+      : createCrmHttpHarness({
+          url: harnessUrl,
+          apiKey: harnessKey,
+          tenantId: options.tenantId,
+          fetchImpl: deps.fetch,
+        });
   const report = await deps.runConformance({
     baseUrl,
     apiKey,
     tenantId: options.tenantId,
     write: options.write,
     strict: !options.allowSkips,
+    ...(readOnlyApiKey === undefined ? {} : { readOnlyApiKey }),
+    ...(statusPolicy === undefined ? {} : { statusPolicy }),
+    ...(suppressedStatuses === undefined ? {} : { suppressedStatuses }),
+    ...(options.spendWeeklyAllowance === true ? { spendWeeklyAllowance: true } : {}),
+    ...(harness === undefined ? {} : { harness }),
   });
-  return reportConformance(report, baseUrl, deps.log);
+  return reportConformance(report, baseUrl, deps.log, harnessUrl);
+}
+
+/**
+ * The keys on stdin, one per non-blank line, exactly as many as the flags
+ * asked for. Errors name a line and its flag, never what it held.
+ */
+function stdinKeys(text: string, wanted: readonly StdinKey[]): string[] {
+  const lines = text
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter((line) => line !== "");
+  if (wanted.length === 1) {
+    if (lines.length !== 1 || !isCrmHttpKey(lines[0]))
+      throw new Error("stdin did not hold a usable crm/1 key (--key-stdin)");
+    return lines;
+  }
+  if (lines.length !== wanted.length)
+    throw new Error(
+      `stdin must hold ${wanted.length} keys, one per line: ${wanted
+        .map(({ name, flag }) => `${name} (${flag})`)
+        .join(", then ")}; it held ${lines.length}`,
+    );
+  lines.forEach((line, index) => {
+    const entry = wanted[index] as StdinKey;
+    if (!isCrmHttpKey(line))
+      throw new Error(
+        `stdin line ${index + 1}, ${entry.name} (${entry.flag}), is not a usable key: 16 to 1024 visible ASCII characters, no spaces`,
+      );
+  });
+  return lines;
+}
+
+/**
+ * A block of the deployment's `capabilities.crm`, from a JSON or YAML file,
+ * validated by the same schema as that block in `config.yaml`. Errors name
+ * the file and the rule; these files hold policy, never a key.
+ */
+function deploymentInput<T>(
+  deps: Pick<CrmCommandDeps, "readFile">,
+  flag: string,
+  path: string,
+  schema: z.ZodType<T, z.ZodTypeDef, unknown>,
+): T {
+  let text: string;
+  try {
+    text = deps.readFile(path);
+  } catch {
+    throw new Error(`${flag} ${path} could not be read`);
+  }
+  let value: unknown;
+  try {
+    value = parseYaml(text);
+  } catch {
+    throw new Error(`${flag} ${path} is not JSON or YAML`);
+  }
+  const parsed = schema.safeParse(value);
+  if (!parsed.success)
+    throw new Error(
+      `${flag} ${path}: ${parsed.error.issues
+        .map((issue) => `${issue.path.join(".") || "(top level)"}: ${issue.message}`)
+        .join("; ")}`,
+    );
+  return parsed.data;
 }
 
 function reportConformance(
   report: CrmConformanceReport,
   baseUrl: string,
   log: (line: string) => void,
+  harnessUrl?: string,
 ): number {
-  log(`crm/1 conformance against ${baseUrl}`);
+  log(
+    `crm/1 conformance against ${baseUrl}${harnessUrl === undefined ? "" : `, harness ${harnessUrl}`}`,
+  );
   for (const entry of report.cases) {
     const mark = entry.outcome === "fail" ? "FAIL" : entry.outcome;
     log(
@@ -486,6 +651,7 @@ export function defaultCrmCommandDeps(): CrmCommandDeps {
     crmTableName: crmTableNameFromStack,
     documentClient: operatorDocumentClient,
     readFile: (path) => readFileSync(path, "utf8"),
+    fetch: (input, init) => fetch(input, init),
     log: (line) => console.log(line),
   };
 }

package/src/stacks/api-stack.ts

@@ -1566,8 +1566,10 @@ export function addConfigLoadAlarm(
       `${args.instance.displayName}'s runtime is not serving the config deployed for it: the`,
       "config failed to load, so it runs on its last good config with company-data",
       "capabilities off, or on the built-in fallback. The config_fallback_active or",
-      "config_reload_failed line in the runtime's live log group names the refused field.",
-      "Fix config.yaml, run foundation-deploy check, then deploy or config:sync.",
+      "config_reload_failed line in the runtime's live log group says why: its error_message",
+      "names the refused field (record keys shown as *), the YAML error and line, or the",
+      "S3/KMS error and the IAM action it cites (error_type s3_read_failed).",
+      "Fix config.yaml or the grant, run foundation-deploy check, then deploy or config:sync.",
     ].join(" "),
     metric: filter.metric({ statistic: "Sum", period: cdk.Duration.hours(1) }),
     threshold: 1,

package/src/stacks/network-stack.ts

@@ -247,6 +247,21 @@ export class FoundationNetwork extends cdk.Stack {
           resources: [`arn:${this.partition}:s3:::prod-${this.region}-starport-layer-bucket/*`],
         }),
       );
+      // Amplify serves build and deploy logs the same way: `amplify:GetJob`
+      // returns a URL presigned by Amplify into an AWS-owned bucket, so the
+      // same-account rule refused it with 403. Olivia then could not read why
+      // GrowLab's frontend build failed and asked for the error 19 times while
+      // a Node-version break kept every release out of production
+      // (2026-10-26). Read-only, and only that bucket's objects.
+      s3Endpoint.addToPolicy(
+        new iam.PolicyStatement({
+          sid: "AmplifyArtifactsBucket",
+          effect: iam.Effect.ALLOW,
+          principals: [new iam.AnyPrincipal()],
+          actions: ["s3:GetObject"],
+          resources: [`arn:${this.partition}:s3:::aws-amplify-prod-${this.region}-artifacts/*`],
+        }),
+      );
     }
     if (!skipEndpoints.has("dynamodb")) {
       const dynamoEndpoint = this.vpc.addGatewayEndpoint("DynamoDbEndpoint", {