@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/generators/slice/built-in-plan-web-files.js

@@ -0,0 +1,430 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderProductWebFiles = renderProductWebFiles;
+const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+/** @internal */
+function renderProductWebFiles(name, pascalName, workspace) {
+    return {
+        'web/next-env.d.ts': `/// <reference types="next" />
+/// <reference types="next/image-types/global" />
+import "./.next/types/routes.d.ts";
+
+// NOTE: This file should not be edited
+// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
+`,
+        'web/tsconfig.json': (0, built_in_plan_shared_js_1.json)({
+            extends: '../tsconfig.json',
+            compilerOptions: {
+                incremental: true,
+                plugins: [{ name: 'next' }],
+            },
+            include: ['next-env.d.ts', '.next/types/**/*.ts', '**/*.ts', '**/*.tsx'],
+            exclude: ['node_modules'],
+        }),
+        'web/next.config.ts': `import type { NextConfig } from 'next';
+
+const fleetOrigin = process.env.EBK_FLEET_ORIGIN?.trim();
+
+const config: NextConfig = {
+  ...(fleetOrigin ? { allowedDevOrigins: [new URL(fleetOrigin).hostname] } : {}),
+  basePath: '/${name}',
+  reactStrictMode: true,
+};
+
+export default config;
+`,
+        'web/src/proxy.ts': `import { randomBytes } from 'node:crypto';
+import {
+  composeFrontendSecurityHeaders,
+  resolveFrontendSecurityHeaderProfile,
+} from '@empire-builder-kit/nx/frontend-security';
+import { NextResponse, type NextRequest } from 'next/server';
+import foundationPolicy from '../../../foundation/contracts/frontend-security-headers.json';
+import slicePolicy from '../../frontend/security-headers.json';
+
+function requestNonce(): string {
+  return randomBytes(18).toString('base64');
+}
+
+export function proxy(request: NextRequest): NextResponse {
+  const profile = resolveFrontendSecurityHeaderProfile({
+    ...process.env,
+    EBK_STAGE:
+      process.env.EBK_STAGE ??
+      (process.env.NODE_ENV === 'production' ? 'production' : 'development'),
+  });
+  const nonce = profile === 'deployed-https' ? requestNonce() : undefined;
+  const securityHeaders = composeFrontendSecurityHeaders({
+    foundation: foundationPolicy,
+    nonce,
+    profile,
+    slice: slicePolicy,
+    sliceName: '${name}',
+  });
+  const requestHeaders = new Headers(request.headers);
+  const csp = securityHeaders.find(
+    ({ name }) => name.toLowerCase() === 'content-security-policy',
+  );
+  if (!csp) {
+    throw new Error('The ${name} frontend proxy requires an enforced CSP.');
+  }
+  requestHeaders.set('Content-Security-Policy', csp.value);
+  if (nonce) requestHeaders.set('x-nonce', nonce);
+  else requestHeaders.delete('x-nonce');
+
+  const response = NextResponse.next({ request: { headers: requestHeaders } });
+  for (const { name, value } of securityHeaders) {
+    response.headers.set(name, value);
+  }
+  return response;
+}
+`,
+        'web/src/lib/server-logging.ts': `import 'server-only';
+import { createLogger, type Logger } from '@empire-builder-kit/runtime/logging';
+import { createNextServerContext } from '@empire-builder-kit/runtime/request-context';
+import { recordReliabilityOperation } from '../../../reliability/metrics';
+
+export interface ObserveNextOperationOptions {
+  feature: string;
+  handle(logger: Logger): Promise<Response> | Response;
+  operation: string;
+  request?: Request;
+}
+
+export async function observeNextOperation({
+  feature,
+  handle,
+  operation,
+  request,
+}: ObserveNextOperationOptions): Promise<Response> {
+  const requestId = request?.headers.get('x-request-id') ?? undefined;
+  const stage = process.env.EBK_STAGE ?? 'development';
+  const context = createNextServerContext({
+    causationId: request?.headers.get('x-causation-id') ?? undefined,
+    correlationId:
+      request?.headers.get('x-correlation-id') ?? requestId,
+    operation,
+    requestId,
+    slice: '${name}',
+    source: 'http',
+    stage,
+    traceParent: request?.headers.get('traceparent') ?? undefined,
+    traceState: request?.headers.get('tracestate') ?? undefined,
+  });
+  const logger = createLogger({
+    component: 'next-server',
+    context,
+    feature,
+    operation,
+    slice: '${name}',
+    stage,
+    workspace: '${workspace}',
+  });
+  const startedAt = performance.now();
+  let outcomeRecorded = false;
+  const recordOutcome = (outcome: 'failure' | 'success') => {
+    if (outcomeRecorded) return;
+    outcomeRecorded = true;
+    const durationMilliseconds = Math.max(
+      0,
+      performance.now() - startedAt,
+    );
+    recordReliabilityOperation({
+      component: 'next-server',
+      durationMilliseconds,
+      feature: 'web',
+      good: outcome === 'success' && durationMilliseconds <= 1000,
+      operation: 'request',
+      outcome,
+    });
+  };
+  logger.info('${name} Next.js operation received');
+  try {
+    const response = await handle(logger);
+    recordOutcome(response.status < 400 ? 'success' : 'failure');
+    logger.info('${name} Next.js operation completed', {
+      attributes: { httpStatus: response.status },
+      outcome: response.status < 400 ? 'success' : 'failure',
+    });
+    return response;
+  } catch (error) {
+    recordOutcome('failure');
+    logger.error('${name} Next.js operation failed', {
+      error,
+      outcome: 'failure',
+    });
+    throw error;
+  }
+}
+`,
+        'web/open-next.config.ts': `const config = {
+  // OpenNext runs from this web directory. Point it at the slice package so it
+  // builds only this application instead of recursively invoking the Nx root.
+  buildCommand: 'pnpm exec next build web',
+  default: {},
+  packageJsonPath: '../package.json',
+};
+
+export default config;
+`,
+        'web/src/app/globals.css': `:root { color-scheme: light dark; font-family: system-ui, sans-serif; }
+body { margin: 0; background: #07111f; color: #edf6ff; }
+main { max-width: 64rem; margin: 0 auto; padding: 5rem 1.5rem; }
+.card { background: #102238; border: 1px solid #29425e; border-radius: 1rem; padding: 1.5rem; }
+a { color: #78d5ff; }
+input, button { box-sizing: border-box; display: block; margin-top: .75rem; padding: .75rem; width: 100%; }
+button { background: #48b7de; border: 0; color: #04111b; cursor: pointer; font-weight: 700; }
+`,
+        'web/src/app/icon.svg': `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <rect width="64" height="64" rx="12" fill="#102238"/>
+  <path d="M17 17h30v8H25v7h18v8H25v7h22v8H17z" fill="#78d5ff"/>
+</svg>
+`,
+        'web/src/app/layout.tsx': `import type { Metadata } from 'next';
+import { connection } from 'next/server';
+import type { ReactNode } from 'react';
+import './globals.css';
+
+export const metadata: Metadata = { title: '${pascalName}' };
+
+export default async function Layout({ children }: Readonly<{ children: ReactNode }>) {
+  await connection();
+  return <html lang="en"><body>{children}</body></html>;
+}
+`,
+        'web/src/app/page.tsx': `export default function Home() {
+  return <main>
+    <p>Empire Builder Kit Product Slice</p>
+    <h1>${pascalName}</h1>
+    <div className="card">
+      <p>The web app, Lambda API, logical Postgres database, Cognito client,
+      event buffer/DLQ, dashboard, and alarms are wired and owned here.</p>
+      <a href="/${name}/sign-in">Sign in</a>
+    </div>
+  </main>;
+}
+`,
+        'web/src/app/sign-in/page.tsx': `'use client';
+
+import { useState, type FormEvent } from 'react';
+
+export default function SignIn() {
+  const [message, setMessage] = useState('');
+  async function submit(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    const data = new FormData(event.currentTarget);
+    const response = await fetch('/${name}/api/auth/sign-in', {
+      body: JSON.stringify({ email: data.get('email'), password: data.get('password') }),
+      headers: { 'content-type': 'application/json' },
+      method: 'POST',
+    });
+    setMessage(response.ok ? 'Signed in.' : 'Sign-in failed.');
+  }
+  return <main><div className="card"><h1>Sign in</h1>
+    <form onSubmit={submit}>
+      <label>Email<input name="email" type="email" autoComplete="username" required /></label>
+      <label>Password<input name="password" type="password" autoComplete="current-password" required /></label>
+      <button type="submit">Sign in</button>
+    </form><p role="status">{message}</p>
+    <a href="/${name}/password-reset">Reset password</a>
+  </div></main>;
+}
+`,
+        'web/src/app/password-reset/page.tsx': `'use client';
+
+import { useState, type FormEvent } from 'react';
+
+export default function PasswordReset() {
+  const [message, setMessage] = useState('');
+  async function submit(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    const data = new FormData(event.currentTarget);
+    const response = await fetch('/${name}/api/auth/password-reset', {
+      body: JSON.stringify({ email: data.get('email') }),
+      headers: { 'content-type': 'application/json' },
+      method: 'POST',
+    });
+    setMessage(response.ok ? 'If the account exists, a reset code was sent.' : 'Request failed.');
+  }
+  return <main><div className="card"><h1>Reset password</h1>
+    <form onSubmit={submit}><label>Email<input name="email" type="email" required /></label>
+      <button type="submit">Send reset code</button></form><p role="status">{message}</p>
+  </div></main>;
+}
+`,
+        'web/src/app/api/auth/sign-in/route.ts': `import 'server-only';
+import { InitiateAuthCommand, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';
+import { createSessionTokenCookiePlan } from '@empire-builder-kit/runtime/auth-session';
+import { cookies } from 'next/headers';
+import { NextResponse } from 'next/server';
+import { observeNextOperation } from '../../../../lib/server-logging';
+
+const cognito = new CognitoIdentityProviderClient({});
+
+export async function POST(request: Request) {
+  return observeNextOperation({
+    feature: 'authorization',
+    operation: 'sign-in',
+    request,
+    async handle() {
+      const body = await request.json() as { email?: string; password?: string };
+      if (!body.email || !body.password) return NextResponse.json({ ok: false }, { status: 400 });
+      const result = await cognito.send(new InitiateAuthCommand({
+        AuthFlow: 'USER_PASSWORD_AUTH',
+        ClientId: process.env.AUTH_CLIENT_ID,
+        AuthParameters: { USERNAME: body.email, PASSWORD: body.password },
+      }));
+      const auth = result.AuthenticationResult;
+      if (!auth?.AccessToken || !auth.ExpiresIn) return NextResponse.json({ ok: false }, { status: 401 });
+      const secure = process.env.EBK_SECURE_COOKIES === 'true' || process.env.NODE_ENV === 'production';
+      const store = await cookies();
+      for (const { name, value, ...options } of createSessionTokenCookiePlan({
+        accessToken: auth.AccessToken,
+        expiresAt: Math.floor(Date.now() / 1000) + auth.ExpiresIn,
+        refreshToken: auth.RefreshToken,
+      }, { namespace: '${name}', secure })) store.set(name, value, options);
+      return NextResponse.json({ ok: true });
+    },
+  });
+}
+`,
+        'web/src/app/api/auth/refresh/route.ts': `import 'server-only';
+import { InitiateAuthCommand, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';
+import { createSessionTokenCookiePlan, getSessionTokenCookieNames } from '@empire-builder-kit/runtime/auth-session';
+import { cookies } from 'next/headers';
+import { NextResponse } from 'next/server';
+import { observeNextOperation } from '../../../../lib/server-logging';
+
+const cognito = new CognitoIdentityProviderClient({});
+
+export async function POST(request: Request) {
+  return observeNextOperation({
+    feature: 'authorization',
+    operation: 'refresh-session',
+    request,
+    async handle() {
+      const store = await cookies();
+      const secure = process.env.EBK_SECURE_COOKIES === 'true' || process.env.NODE_ENV === 'production';
+      const names = getSessionTokenCookieNames({ namespace: '${name}', secure });
+      const refreshToken = store.get(names.refresh)?.value;
+      if (!refreshToken) return NextResponse.json({ ok: false }, { status: 401 });
+      const result = await cognito.send(new InitiateAuthCommand({
+        AuthFlow: 'REFRESH_TOKEN_AUTH', ClientId: process.env.AUTH_CLIENT_ID,
+        AuthParameters: { REFRESH_TOKEN: refreshToken },
+      }));
+      const auth = result.AuthenticationResult;
+      if (!auth?.AccessToken || !auth.ExpiresIn) return NextResponse.json({ ok: false }, { status: 401 });
+      for (const { name, value, ...options } of createSessionTokenCookiePlan({
+        accessToken: auth.AccessToken,
+        expiresAt: Math.floor(Date.now() / 1000) + auth.ExpiresIn,
+        refreshToken: auth.RefreshToken ?? refreshToken,
+      }, { namespace: '${name}', secure })) store.set(name, value, options);
+      return NextResponse.json({ ok: true });
+    },
+  });
+}
+`,
+        'web/src/app/api/auth/sign-out/route.ts': `import 'server-only';
+import { createSessionTokenCookieDeletionPlan } from '@empire-builder-kit/runtime/auth-session';
+import { cookies } from 'next/headers';
+import { NextResponse } from 'next/server';
+import { observeNextOperation } from '../../../../lib/server-logging';
+
+export async function POST(request: Request) {
+  return observeNextOperation({
+    feature: 'authorization',
+    operation: 'sign-out',
+    request,
+    async handle() {
+      const store = await cookies();
+      const secure = process.env.EBK_SECURE_COOKIES === 'true' || process.env.NODE_ENV === 'production';
+      for (const { name, value, ...options } of createSessionTokenCookieDeletionPlan({
+        namespace: '${name}',
+        secure,
+      })) store.set(name, value, options);
+      return NextResponse.json({ ok: true });
+    },
+  });
+}
+`,
+        'web/src/app/api/auth/password-reset/route.ts': `import 'server-only';
+import { ForgotPasswordCommand, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';
+import { NextResponse } from 'next/server';
+import { observeNextOperation } from '../../../../lib/server-logging';
+
+const cognito = new CognitoIdentityProviderClient({});
+export async function POST(request: Request) {
+  return observeNextOperation({
+    feature: 'authorization',
+    operation: 'password-reset',
+    request,
+    async handle() {
+      const body = await request.json() as { email?: string };
+      if (body.email) await cognito.send(new ForgotPasswordCommand({
+        ClientId: process.env.AUTH_CLIENT_ID, Username: body.email,
+      }));
+      return NextResponse.json({ ok: true });
+    },
+  });
+}
+`,
+        'web/src/app/api/auth/callback/route.ts': `import 'server-only';
+import { NextResponse } from 'next/server';
+import { observeNextOperation } from '../../../../lib/server-logging';
+
+export function GET(request: Request) {
+  return observeNextOperation({
+    feature: 'authorization',
+    operation: 'auth-callback',
+    request,
+    handle: () => NextResponse.json({
+      message: 'The Standard Blueprint uses server-side Cognito password auth; OAuth Blueprints may replace this callback.',
+    }),
+  });
+}
+`,
+        'web/src/app/api/protected/route.ts': `import 'server-only';
+import { getSessionTokenCookieNames } from '@empire-builder-kit/runtime/auth-session';
+import { cookies } from 'next/headers';
+import { NextResponse } from 'next/server';
+import { observeNextOperation } from '../../../lib/server-logging';
+
+export async function GET(request: Request) {
+  return observeNextOperation({
+    feature: 'authorization',
+    operation: 'protected-proxy',
+    request,
+    async handle() {
+      const store = await cookies();
+      const names = getSessionTokenCookieNames({
+        namespace: '${name}',
+        secure: process.env.EBK_SECURE_COOKIES === 'true' || process.env.NODE_ENV === 'production',
+      });
+      const accessToken = store.get(names.access)?.value;
+      if (!accessToken) return NextResponse.json({ ok: false }, { status: 401 });
+      const response = await fetch((process.env.NEXT_PUBLIC_API_URL ?? '') + '/protected', {
+        headers: { authorization: 'Bearer ' + accessToken },
+      });
+      return new NextResponse(await response.text(), {
+        headers: { 'content-type': 'application/json' },
+        status: response.status,
+      });
+    },
+  });
+}
+`,
+        'web/src/app/page.spec.tsx': `import { renderToStaticMarkup } from 'react-dom/server';
+import { describe, expect, it } from 'vitest';
+import Home from './page';
+
+describe('home page', () => {
+  it('renders the Product Slice identity and sign-in path', () => {
+    const html = renderToStaticMarkup(<Home />);
+    expect(html).toContain('${pascalName}');
+    expect(html).toContain('/sign-in');
+  });
+});
+`,
+    };
+}
+//# sourceMappingURL=built-in-plan-web-files.js.map

package/src/generators/slice/built-in-plan-web-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"built-in-plan-web-files.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/slice/built-in-plan-web-files.ts"],"names":[],"mappings":";;AAGA,sDA2aC;AA9aD,uEAAiD;AAEjD,gBAAgB;AAChB,SAAgB,qBAAqB,CACnC,IAAY,EACZ,UAAkB,EAClB,SAAiB;IAEjB,OAAO;QACL,mBAAmB,EAAE;;;;;;CAMxB;QACG,mBAAmB,EAAE,IAAA,8BAAI,EAAC;YACxB,OAAO,EAAE,kBAAkB;YAC3B,eAAe,EAAE;gBACf,WAAW,EAAE,IAAI;gBACjB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;aAC5B;YACD,OAAO,EAAE,CAAC,eAAe,EAAE,qBAAqB,EAAE,SAAS,EAAE,UAAU,CAAC;YACxE,OAAO,EAAE,CAAC,cAAc,CAAC;SAC1B,CAAC;QACF,oBAAoB,EAAE;;;;;;gBAMV,IAAI;;;;;CAKnB;QACG,kBAAkB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;kBA0BN,IAAI;;;;;;;2BAOK,IAAI;;;;;;;;;;;;CAY9B;QACG,+BAA+B,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;cA0BvB,IAAI;;;;;;;;;;;cAWJ,IAAI;;kBAEA,SAAS;;;;;;;;;;;;;;;;;;;;iBAoBV,IAAI;;;;mBAIF,IAAI;;;;;;;oBAOH,IAAI;;;;;;;CAOvB;QACG,yBAAyB,EAAE;;;;;;;;;CAS9B;QACG,yBAAyB,EAAE;;;;;;;CAO9B;QACG,sBAAsB,EAAE;;;;CAI3B;QACG,wBAAwB,EAAE;;;;;8CAKgB,UAAU;;;;;;CAMvD;QACG,sBAAsB,EAAE;;;UAGlB,UAAU;;;;kBAIF,IAAI;;;;CAIrB;QACG,8BAA8B,EAAE;;;;;;;;;qCASC,IAAI;;;;;;;;;;;;;gBAazB,IAAI;;;CAGnB;QACG,qCAAqC,EAAE;;;;;;;;;qCASN,IAAI;;;;;;;;;;;;CAYxC;QACG,uCAAuC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBA8BpB,IAAI;;;;;CAK5B;QACG,uCAAuC,EAAE;;;;;;;;;;;;;;;;;+DAiBkB,IAAI;;;;;;;;;;;;;yBAa1C,IAAI;;;;;CAK5B;QACG,wCAAwC,EAAE;;;;;;;;;;;;;;;sBAexB,IAAI;;;;;;;CAOzB;QACG,8CAA8C,EAAE;;;;;;;;;;;;;;;;;;;;CAoBnD;QACG,wCAAwC,EAAE;;;;;;;;;;;;;;CAc7C;QACG,oCAAoC,EAAE;;;;;;;;;;;;;;sBAcpB,IAAI;;;;;;;;;;;;;;;CAezB;QACG,2BAA2B,EAAE;;;;;;;8BAOH,UAAU;;;;CAIvC;KACE,CAAC;AACJ,CAAC"}

package/src/generators/slice/built-in-plan-workload-role-files.d.ts

@@ -0,0 +1,2 @@
+/** @internal */
+export declare function renderStandardSliceWorkloadRoleFiles(name: string, workspace: string): Readonly<Record<string, string>>;