@digitraffic/common 2026.3.17-1 → 2026.3.26-1-beta

package/dist/__test__/runtime/dt-logger.test.js

@@ -0,0 +1,193 @@
+import { Writable } from "node:stream";
+import { describe, expect, test } from "vitest";
+import { DtLogger } from "../../aws/runtime/dt-logger.js";
+const LOG_LINE = {
+    method: "dt-logger.test",
+    message: "FOO",
+};
+const EXPECTED_LOG_LINE = {
+    method: "dt-logger.test",
+    message: "dt-logger.test FOO",
+};
+describe("dt-logger", () => {
+    function assertLog(config, message, expected) {
+        assertWrite(config, (logger) => {
+            logger.info(message);
+        }, expected);
+    }
+    function assertDebug(config, message, expected) {
+        assertWrite(config, (logger) => {
+            logger.debug(message);
+        }, expected);
+    }
+    function assertError(config, message, expected) {
+        assertWrite(config, (logger) => {
+            logger.error(message);
+        }, expected);
+    }
+    function assertWrite(config, writeFunction, expected) {
+        const logged = [];
+        const writeStream = new Writable({
+            write: (chunk) => {
+                logged.push(chunk.toString());
+            },
+        });
+        const logger = new DtLogger({
+            ...config,
+            ...{ writeStream: writeStream },
+        });
+        writeFunction(logger);
+        expect(logged.length).toBe(1);
+        const loggedLine = JSON.parse(logged[0]);
+        console.info(loggedLine);
+        if (typeof expected === "object" && "stack" in expected && expected.stack) {
+            const stack = loggedLine.stack;
+            expect(stack).toBeDefined();
+            // stack should be multiline string
+            const stackLines = stack.split("\n");
+            expect(stackLines.length).toBeGreaterThanOrEqual(2);
+            expect(stackLines[0]).toEqual(expected.stack);
+            expect(stackLines[1]?.trim()?.startsWith("at ")).toBe(true);
+            delete loggedLine.stack;
+            delete expected.stack;
+        }
+        expect(loggedLine).toMatchObject(expected);
+    }
+    test("custom date, number, text and '=' values", () => {
+        const date = new Date();
+        assertLog({}, {
+            ...LOG_LINE,
+            customDate: date,
+            customNumber: 123,
+            customText: "abc",
+            customEqualsText: "foo=bar",
+        }, {
+            method: EXPECTED_LOG_LINE.method,
+            message: `${EXPECTED_LOG_LINE.message} date=${date.toISOString()} number=123 text=abc equalsText="foo=bar"`,
+            date: date.toISOString(),
+            number: 123,
+            text: "abc",
+        });
+    });
+    test("custom count should be a number", () => {
+        assertLog({}, {
+            ...LOG_LINE,
+            customFooCount: 123,
+        }, {
+            method: EXPECTED_LOG_LINE.method,
+            message: `${EXPECTED_LOG_LINE.message} fooCount=123`,
+            fooCount: 123,
+        });
+    });
+    test("default values", () => {
+        assertLog({}, LOG_LINE, {
+            method: EXPECTED_LOG_LINE.method,
+            message: EXPECTED_LOG_LINE.message,
+            level: "INFO",
+        });
+    });
+    test("method not duplicated", () => {
+        assertLog({}, EXPECTED_LOG_LINE, {
+            method: EXPECTED_LOG_LINE.method,
+            message: EXPECTED_LOG_LINE.message,
+            level: "INFO",
+        });
+    });
+    test("set lambdaName", () => {
+        const LAMBDA_NAME = "test_lambda_name";
+        assertLog({ lambdaName: LAMBDA_NAME }, LOG_LINE, {
+            lambdaName: LAMBDA_NAME,
+            method: EXPECTED_LOG_LINE.method,
+            message: EXPECTED_LOG_LINE.message,
+            level: "INFO",
+        });
+    });
+    test("set runtime", () => {
+        const RUNTIME = "test_runtime";
+        assertLog({ runTime: RUNTIME }, LOG_LINE, {
+            message: EXPECTED_LOG_LINE.message,
+            method: EXPECTED_LOG_LINE.method,
+            level: "INFO",
+            runtime: RUNTIME,
+        });
+    });
+    test("debug - string", () => {
+        const DEBUG_STRING = "debug string";
+        assertDebug({}, DEBUG_STRING, {
+            message: DEBUG_STRING,
+            level: "DEBUG",
+        });
+    });
+    test("debug - json", () => {
+        const DEBUG_JSON = {
+            debug: "debug",
+            thing: 42,
+        };
+        assertDebug({}, DEBUG_JSON, {
+            message: {
+                debug: "debug",
+                thing: 42,
+            },
+            level: "DEBUG",
+        });
+    });
+    test("error - Error string", () => {
+        const error = "FAIL!";
+        assertError({}, {
+            ...LOG_LINE,
+            error,
+        }, {
+            ...EXPECTED_LOG_LINE,
+            error: "FAIL!",
+            level: "ERROR",
+        });
+    });
+    test("error - Error object", () => {
+        const error = {
+            errorMessage: "FAIL!",
+            errorCode: 123,
+        };
+        assertError({}, {
+            ...LOG_LINE,
+            error,
+        }, {
+            ...EXPECTED_LOG_LINE,
+            error: '{"errorMessage":"FAIL!","errorCode":123}',
+            level: "ERROR",
+        });
+    });
+    test("error - Error", () => {
+        const error = new Error("FAIL!");
+        assertError({}, {
+            ...LOG_LINE,
+            error,
+        }, {
+            ...EXPECTED_LOG_LINE,
+            error: "Error: FAIL!",
+            level: "ERROR",
+        });
+    });
+    test("error - Error with stack", () => {
+        let error;
+        try {
+            // @ts-expect-error
+            console.log(`Result: ${undefined.length}`);
+        }
+        catch (e) {
+            // @ts-expect-error
+            console.debug(`Failed message: ${e.message}`);
+            console.debug(`Failed stack: ${e.stack}`);
+            error = e;
+        }
+        assertError({}, {
+            ...LOG_LINE,
+            error,
+        }, {
+            ...EXPECTED_LOG_LINE,
+            error: "TypeError: Cannot read properties of undefined (reading 'length')",
+            level: "ERROR",
+            stack: "TypeError: Cannot read properties of undefined (reading 'length')",
+        });
+    });
+});
+//# sourceMappingURL=dt-logger.test.js.map

package/dist/__test__/secrets/secret-holder.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__test__/secrets/secret-holder.test.js

@@ -0,0 +1,96 @@
+import { SecretsManager } from "@aws-sdk/client-secrets-manager";
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+import { setEnvVariable, setEnvVariableAwsRegion } from "../../utils/utils.js";
+const SECRET_WITH_PREFIX = {
+    "prefix.value": "value",
+    "prefix.name": "name",
+    "wrong.value": "value",
+    username: "DB_USER",
+};
+const emptySecret = { $metadata: {} };
+const getSecretValueMock = vi.fn();
+vi.spyOn(SecretsManager.prototype, "getSecretValue").mockImplementation(getSecretValueMock);
+const { SecretHolder } = await import("../../aws/runtime/secrets/secret-holder.js");
+const { DatabaseEnvironmentKeys } = await import("../../database/database.js");
+function mockSecret(secret) {
+    if (!secret) {
+        getSecretValueMock.mockImplementation(() => Promise.resolve(emptySecret));
+    }
+    else {
+        getSecretValueMock.mockImplementation(() => Promise.resolve({
+            ...emptySecret,
+            ...{ SecretString: JSON.stringify(secret) },
+        }));
+    }
+}
+describe("SecretHolder - tests", () => {
+    beforeEach(() => {
+        setEnvVariable("SECRET_ID", "test-id");
+        setEnvVariableAwsRegion("eu-west-1");
+    });
+    afterEach(() => {
+        delete process.env[DatabaseEnvironmentKeys.DB_USER];
+    });
+    test("get - no secret", () => {
+        mockSecret(null);
+        const holder = SecretHolder.create();
+        const secret = holder.get();
+        return expect(secret).rejects.toThrow("No secret found!");
+    }, 10000);
+    test("get - empty secret", () => {
+        mockSecret({});
+        const holder = SecretHolder.create();
+        const secret = holder.get();
+        return expect(secret).resolves.toEqual({});
+    });
+    test("get - no prefix", () => {
+        mockSecret(SECRET_WITH_PREFIX);
+        const holder = SecretHolder.create();
+        const secret = holder.get();
+        return expect(secret).resolves.toEqual(SECRET_WITH_PREFIX);
+    });
+    test("get - check keys - not found", () => {
+        mockSecret(SECRET_WITH_PREFIX);
+        const holder = SecretHolder.create("", ["not_found"]);
+        const secret = holder.get();
+        return expect(secret).rejects.toThrow();
+    });
+    test("get - check keys - found", () => {
+        mockSecret(SECRET_WITH_PREFIX);
+        const holder = SecretHolder.create("", ["prefix.value", "username"]);
+        return expect(holder.get()).resolves.toBeDefined();
+    });
+    test("getSecret - with prefix", () => {
+        mockSecret(SECRET_WITH_PREFIX);
+        const holder = SecretHolder.create("prefix");
+        const secret = holder.get();
+        return expect(secret).resolves.toEqual({
+            value: "value",
+            name: "name",
+        });
+    });
+    test("get - ttl - do not fetch", async () => {
+        mockSecret(SECRET_WITH_PREFIX);
+        const holder = SecretHolder.create();
+        const callCount = getSecretValueMock.mock.calls.length;
+        await holder.get();
+        expect(getSecretValueMock).toHaveBeenCalledTimes(callCount + 1);
+        // gets cached secret
+        await holder.get();
+        expect(getSecretValueMock).toHaveBeenCalledTimes(callCount + 1);
+    });
+    test("get - ttl - fetch", async () => {
+        mockSecret(SECRET_WITH_PREFIX);
+        const holder = new SecretHolder("", "", [], {
+            ttl: 1,
+        });
+        const callCount = getSecretValueMock.mock.calls.length;
+        await holder.get();
+        expect(getSecretValueMock).toHaveBeenCalledTimes(callCount + 1);
+        // cache expires, fetches secret again
+        await new Promise((resolve) => setTimeout(resolve, 2000));
+        await holder.get();
+        expect(getSecretValueMock).toHaveBeenCalledTimes(callCount + 2);
+    });
+});
+//# sourceMappingURL=secret-holder.test.js.map

package/dist/__test__/secrets/secret.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__test__/secrets/secret.test.js

@@ -0,0 +1,57 @@
+import { afterEach } from "node:test";
+import { SecretsManager } from "@aws-sdk/client-secrets-manager";
+import { describe, expect, test, vi } from "vitest";
+import { setEnvVariableAwsRegion } from "../../utils/utils.js";
+const SECRET_ID = "test_secret";
+const SECRET_WITH_PREFIX = {
+    "prefix.value": "value",
+    "prefix.name": "name",
+    "wrong.value": "value",
+};
+const emptySecret = { $metadata: {} };
+const getSecretValueMock = vi.fn();
+vi.spyOn(SecretsManager.prototype, "getSecretValue").mockImplementation(getSecretValueMock);
+function mockSecret(secret) {
+    if (!secret) {
+        getSecretValueMock.mockImplementation(() => Promise.resolve(emptySecret));
+    }
+    else {
+        getSecretValueMock.mockImplementation(() => Promise.resolve({
+            ...emptySecret,
+            ...{ SecretString: JSON.stringify(secret) },
+        }));
+    }
+}
+setEnvVariableAwsRegion("eu-west-1");
+const secret = await import("../../aws/runtime/secrets/secret.js");
+const { getSecret } = secret;
+describe("secret - test", () => {
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+    test("getSecret - no secret", async () => {
+        mockSecret(null);
+        await expect(async () => {
+            await getSecret(SECRET_ID, "");
+        }).rejects.toThrow("No secret found!");
+    });
+    test("getSecret - empty secret", async () => {
+        mockSecret({});
+        const secret = await getSecret(SECRET_ID, "");
+        expect(secret).toEqual({});
+    });
+    test("getSecret - no prefix", async () => {
+        mockSecret(SECRET_WITH_PREFIX);
+        const secret = await getSecret(SECRET_ID, "");
+        expect(secret).toEqual(SECRET_WITH_PREFIX);
+    });
+    test("getSecret - with prefix", async () => {
+        mockSecret(SECRET_WITH_PREFIX);
+        const secret = await getSecret(SECRET_ID, "prefix");
+        expect(secret).toEqual({
+            value: "value",
+            name: "name",
+        });
+    });
+});
+//# sourceMappingURL=secret.test.js.map

package/dist/__test__/stack/dt-function.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__test__/stack/dt-function.test.js

@@ -0,0 +1,340 @@
+import { App, Duration } from "aws-cdk-lib";
+import { Match, Template } from "aws-cdk-lib/assertions";
+import { PolicyStatement, Role, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import { Architecture, Code, Runtime } from "aws-cdk-lib/aws-lambda";
+import { describe, expect, test } from "vitest";
+import { FunctionBuilder } from "../../aws/infra/stack/dt-function.js";
+import { DigitrafficStack } from "../../aws/infra/stack/stack.js";
+import { EnvKeys } from "../../aws/runtime/environment.js";
+import { TrafficType } from "../../types/traffictype.js";
+const TEST_ENV_VAR = "TEST_ENV_VAR";
+const TEST_ENV_VALUE = "testValue";
+// AWS::Lambda::Function Template Reference
+// https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-function.html
+describe("FunctionBuilder test", () => {
+    function createTemplate(tester, plain = false, lambdaName = "test") {
+        const app = new App();
+        const stack = new DigitrafficStack(app, "test-stack", {
+            alarmTopicArn: "",
+            production: false,
+            shortName: "test",
+            stackProps: {},
+            secretId: "testSecret",
+            trafficType: TrafficType.ROAD,
+            warningTopicArn: "",
+        });
+        const environment = {
+            [TEST_ENV_VAR]: TEST_ENV_VALUE,
+        };
+        const builder = plain
+            ? FunctionBuilder.plain(stack, lambdaName)
+                .withEnvironment(environment)
+                .withCode(Code.fromInline("{}"))
+            : FunctionBuilder.create(stack, lambdaName)
+                .withoutDatabaseAccess()
+                .withEnvironment(environment)
+                .withCode(Code.fromInline("{}"));
+        tester(builder);
+        builder.build();
+        return Template.fromStack(stack);
+    }
+    function expectEnvironmentValue(template, key, value) {
+        template.hasResourceProperties("AWS::Lambda::Function", {
+            Environment: {
+                Variables: Match.objectLike({
+                    [key]: value,
+                }),
+            },
+        });
+    }
+    function expectEnvironmentValueMissing(template, key) {
+        template.hasResourceProperties("AWS::Lambda::Function", {
+            Environment: {
+                Variables: Match.objectLike({
+                    [key]: Match.absent(),
+                }),
+            },
+        });
+    }
+    test("default builder", () => {
+        const template = createTemplate((_builder) => { });
+        template.hasResourceProperties("AWS::Lambda::Function", {
+            Environment: {
+                Variables: {
+                    [EnvKeys.SECRET_ID]: "testSecret",
+                    [TEST_ENV_VAR]: TEST_ENV_VALUE,
+                },
+            },
+            Runtime: Runtime.NODEJS_24_X.name,
+            MemorySize: 128,
+            Timeout: 60,
+            Handler: "test.handler",
+        });
+    });
+    test("plain builder", () => {
+        const template = createTemplate((_builder) => { }, true);
+        expectEnvironmentValue(template, TEST_ENV_VAR, TEST_ENV_VALUE);
+        expectEnvironmentValueMissing(template, EnvKeys.SECRET_ID);
+    });
+    test("withoutSecretAccess does not add secret-related environment variable", () => {
+        const template = createTemplate((builder) => {
+            builder.withoutSecretAccess();
+        });
+        expectEnvironmentValueMissing(template, EnvKeys.SECRET_ID);
+    });
+    test("Lambda runtime is set", () => {
+        const template = createTemplate((builder) => {
+            builder.withRuntime(Runtime.NODEJS_24_X);
+        });
+        template.hasResourceProperties("AWS::Lambda::Function", {
+            Runtime: Runtime.NODEJS_24_X.name,
+        });
+    });
+    test("Lambda description is set", () => {
+        const template = createTemplate((builder) => {
+            builder.withDescription("Does something useful");
+        });
+        template.hasResourceProperties("AWS::Lambda::Function", {
+            Description: "Does something useful",
+        });
+    });
+    test("Lambda memory size is set", () => {
+        const template = createTemplate((builder) => {
+            builder.withMemorySize(256);
+        });
+        template.hasResourceProperties("AWS::Lambda::Function", {
+            MemorySize: 256,
+        });
+    });
+    test("Lambda architecture is set", () => {
+        const template = createTemplate((builder) => {
+            builder.withArchitecture(Architecture.X86_64);
+        });
+        template.hasResourceProperties("AWS::Lambda::Function", {
+            Architectures: [Architecture.X86_64.name],
+        });
+    });
+    test("Lambda timeout is set", () => {
+        const template = createTemplate((builder) => {
+            builder.withTimeout(Duration.seconds(120));
+        });
+        template.hasResourceProperties("AWS::Lambda::Function", {
+            Timeout: 120,
+        });
+    });
+    test("Lambda reserved concurrency is set", () => {
+        const template = createTemplate((builder) => {
+            builder.withReservedConcurrentExecutions(5);
+        });
+        template.hasResourceProperties("AWS::Lambda::Function", {
+            ReservedConcurrentExecutions: 5,
+        });
+    });
+    test("Lambda handler is set", () => {
+        const template = createTemplate((builder) => {
+            builder.withHandler("custom", "main");
+        });
+        template.hasResourceProperties("AWS::Lambda::Function", {
+            Handler: "custom.main",
+        });
+    });
+    test("Lambda handler module is resolved from path last element", () => {
+        const template = createTemplate((_builder) => { }, false, "api/charging-network/v1/operators");
+        // const lambdas = template.findResources("AWS::Lambda::Function");
+        // console.debug(JSON.stringify(lambdas, null, 2));
+        template.hasResourceProperties("AWS::Lambda::Function", {
+            Handler: "operators.handler",
+        });
+    });
+    test("Lambda handler module is same as lambda name", () => {
+        const template = createTemplate((_builder) => { }, false, "operators");
+        template.hasResourceProperties("AWS::Lambda::Function", {
+            Handler: "operators.handler",
+        });
+    });
+    test("withRolePolicies adds custom policy to lambda role", () => {
+        const template = createTemplate((builder) => {
+            builder.withRolePolicies(new PolicyStatement({
+                actions: ["s3:GetObject"],
+                resources: ["arn:aws:s3:::my-bucket/*"],
+            }));
+        });
+        template.hasResourceProperties("AWS::IAM::Policy", {
+            PolicyDocument: {
+                Statement: Match.arrayWith([
+                    Match.objectLike({
+                        Action: "s3:GetObject",
+                        Resource: "arn:aws:s3:::my-bucket/*",
+                    }),
+                ]),
+            },
+        });
+    });
+    test("withAllowedActions adds policy with specified actions", () => {
+        const template = createTemplate((builder) => {
+            builder.withAllowedActions("dynamodb:PutItem", "dynamodb:GetItem");
+        });
+        template.hasResourceProperties("AWS::IAM::Policy", {
+            PolicyDocument: {
+                Statement: Match.arrayWith([
+                    Match.objectLike({
+                        Action: ["dynamodb:PutItem", "dynamodb:GetItem"],
+                        Resource: "*",
+                    }),
+                ]),
+            },
+        });
+    });
+    test("withRolePolicies and withAllowedActions can be used together", () => {
+        const template = createTemplate((builder) => {
+            builder
+                .withRolePolicies(new PolicyStatement({
+                actions: ["s3:GetObject"],
+                resources: ["arn:aws:s3:::my-bucket/*"],
+            }))
+                .withAllowedActions("dynamodb:PutItem", "dynamodb:GetItem");
+        });
+        template.hasResourceProperties("AWS::IAM::Policy", {
+            PolicyDocument: {
+                Statement: Match.arrayWith([
+                    Match.objectLike({
+                        Action: "s3:GetObject",
+                        Resource: "arn:aws:s3:::my-bucket/*",
+                    }),
+                    Match.objectLike({
+                        Action: ["dynamodb:PutItem", "dynamodb:GetItem"],
+                        Resource: "*",
+                    }),
+                ]),
+            },
+        });
+    });
+    test("Multiple withRolePolicies calls add multiple policies", () => {
+        const template = createTemplate((builder) => {
+            builder
+                .withRolePolicies(new PolicyStatement({
+                actions: ["s3:GetObject"],
+                resources: ["arn:aws:s3:::my-bucket/*"],
+            }))
+                .withRolePolicies(new PolicyStatement({
+                actions: ["sqs:SendMessage"],
+                resources: ["arn:aws:sqs:us-east-1:123456789012:my-queue"],
+            }));
+        });
+        template.hasResourceProperties("AWS::IAM::Policy", {
+            PolicyDocument: {
+                Statement: Match.arrayWith([
+                    Match.objectLike({
+                        Action: "s3:GetObject",
+                        Resource: "arn:aws:s3:::my-bucket/*",
+                    }),
+                    Match.objectLike({
+                        Action: "sqs:SendMessage",
+                        Resource: "arn:aws:sqs:us-east-1:123456789012:my-queue",
+                    }),
+                ]),
+            },
+        });
+    });
+    test("Multiple withAllowedActions calls accumulate actions", () => {
+        const template = createTemplate((builder) => {
+            builder
+                .withAllowedActions("dynamodb:PutItem", "dynamodb:GetItem")
+                .withAllowedActions("s3:ListBucket");
+        });
+        template.hasResourceProperties("AWS::IAM::Policy", {
+            PolicyDocument: {
+                Statement: Match.arrayWith([
+                    Match.objectLike({
+                        Action: ["dynamodb:PutItem", "dynamodb:GetItem", "s3:ListBucket"],
+                        Resource: "*",
+                    }),
+                ]),
+            },
+        });
+    });
+    test("withRole and withRolePolicies work together", () => {
+        const app = new App();
+        const stack = new DigitrafficStack(app, "test-stack", {
+            alarmTopicArn: "",
+            production: false,
+            shortName: "test",
+            stackProps: {},
+            secretId: "testSecret",
+            trafficType: TrafficType.ROAD,
+            warningTopicArn: "",
+        });
+        // Create a custom role
+        const customRole = new Role(stack, "CustomRole", {
+            assumedBy: new ServicePrincipal("lambda.amazonaws.com"),
+        });
+        FunctionBuilder.plain(stack, "test")
+            .withCode(Code.fromInline("{}"))
+            .withRole(customRole)
+            .withRolePolicies(new PolicyStatement({
+            actions: ["s3:GetObject"],
+            resources: ["arn:aws:s3:::my-bucket/*"],
+        }))
+            .withAllowedActions("dynamodb:Query")
+            .build();
+        const template = Template.fromStack(stack);
+        // Verify the custom role is used
+        template.hasResourceProperties("AWS::Lambda::Function", {
+            Role: Match.objectLike({
+                "Fn::GetAtt": Match.arrayWith([Match.stringLikeRegexp("CustomRole")]),
+            }),
+        });
+        // Verify the policies are attached
+        template.hasResourceProperties("AWS::IAM::Policy", {
+            PolicyDocument: {
+                Statement: Match.arrayWith([
+                    Match.objectLike({
+                        Action: "s3:GetObject",
+                        Resource: "arn:aws:s3:::my-bucket/*",
+                    }),
+                    Match.objectLike({
+                        Action: "dynamodb:Query",
+                        Resource: "*",
+                    }),
+                ]),
+            },
+        });
+    });
+    test("withAllowedActions throws error when wildcard action is used", () => {
+        const app = new App();
+        const stack = new DigitrafficStack(app, "test-stack", {
+            alarmTopicArn: "",
+            production: false,
+            shortName: "test",
+            stackProps: {},
+            secretId: "testSecret",
+            trafficType: TrafficType.ROAD,
+            warningTopicArn: "",
+        });
+        expect(() => {
+            FunctionBuilder.plain(stack, "test")
+                .withCode(Code.fromInline("{}"))
+                .withAllowedActions("*")
+                .build();
+        }).toThrow('Lambda test-Test cannot use wildcard action "*" in withAllowedActions');
+    });
+    test("withAllowedActions throws error when wildcard action is mixed with other actions", () => {
+        const app = new App();
+        const stack = new DigitrafficStack(app, "test-stack", {
+            alarmTopicArn: "",
+            production: false,
+            shortName: "test",
+            stackProps: {},
+            secretId: "testSecret",
+            trafficType: TrafficType.ROAD,
+            warningTopicArn: "",
+        });
+        expect(() => {
+            FunctionBuilder.plain(stack, "test")
+                .withCode(Code.fromInline("{}"))
+                .withAllowedActions("s3:GetObject", "*", "dynamodb:Query")
+                .build();
+        }).toThrow('Lambda test-Test cannot use wildcard action "*" in withAllowedActions');
+    });
+});
+//# sourceMappingURL=dt-function.test.js.map