@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/generators/preset/workspace-files-foundation-workload-roles.js

@@ -0,0 +1,406 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderFoundationWorkloadRoleFiles = renderFoundationWorkloadRoleFiles;
+/**
+ * Renders the Foundation's single generated workload role. It stays separate
+ * from the broad workspace template so candidate, preflight, and injection
+ * semantics can be inspected without parsing unrelated Foundation resources.
+ */
+function renderFoundationWorkloadRoleFiles() {
+    return {
+        'packages/foundation/infra/workload-roles/candidate.ts': `import {
+  WORKLOAD_ROLE_MANIFEST_SCHEMA_VERSION,
+  canonicalizeWorkloadRoleManifest,
+  createWorkloadRoleEffectivePolicy,
+  workloadRoleBoundaryArn,
+  type RegisteredWorkloadRoleManifestDocument,
+  type WorkloadRolePermissionIntent,
+} from '@empire-builder-kit/nx/workload-roles';
+
+const ROLE_ID = 'foundation.nat-instance';
+
+export function foundationNatWorkloadRoleName(stage: string) {
+  return 'ebk-' + stage + '-foundation-nat';
+}
+
+export function createFoundationWorkloadRoleIntents(): Readonly<
+  Record<string, readonly WorkloadRolePermissionIntent[]>
+> {
+  return {
+    [ROLE_ID]: [
+      {
+        actions: [
+          'ssm:DescribeAssociation',
+          'ssm:DescribeDocument',
+          'ssm:GetDeployablePatchSnapshotForInstance',
+          'ssm:GetDocument',
+          'ssm:GetManifest',
+          'ssm:GetParameter',
+          'ssm:GetParameters',
+          'ssm:ListAssociations',
+          'ssm:ListInstanceAssociations',
+          'ssm:PutComplianceItems',
+          'ssm:PutConfigurePackageResult',
+          'ssm:PutInventory',
+          'ssm:UpdateAssociationStatus',
+          'ssm:UpdateInstanceAssociationStatus',
+          'ssm:UpdateInstanceInformation',
+        ],
+        id: 'foundation.nat-instance.ssm-agent',
+        resources: ['*'],
+        source: { kind: 'framework', name: 'foundation-ssm-bastion' },
+        wildcardResourceJustification:
+          'SSM managed-instance agent control-plane operations do not support resource-level permissions.',
+      },
+      {
+        actions: [
+          'ssmmessages:CreateControlChannel',
+          'ssmmessages:CreateDataChannel',
+          'ssmmessages:OpenControlChannel',
+          'ssmmessages:OpenDataChannel',
+        ],
+        id: 'foundation.nat-instance.ssm-channels',
+        resources: ['*'],
+        source: { kind: 'framework', name: 'foundation-ssm-bastion' },
+        wildcardResourceJustification:
+          'SSM managed-instance session channels do not support resource-level permissions.',
+      },
+      {
+        actions: [
+          'ec2messages:AcknowledgeMessage',
+          'ec2messages:DeleteMessage',
+          'ec2messages:FailMessage',
+          'ec2messages:GetEndpoint',
+          'ec2messages:GetMessages',
+          'ec2messages:SendReply',
+        ],
+        id: 'foundation.nat-instance.ec2-messages',
+        resources: ['*'],
+        source: { kind: 'framework', name: 'foundation-ssm-bastion' },
+        wildcardResourceJustification:
+          'EC2 managed-instance message operations do not support resource-level permissions.',
+      },
+    ],
+  };
+}
+
+export function createFoundationWorkloadRoleCandidate(options: {
+  accountId: string;
+  candidateIdentity: string;
+  partition: string;
+  stage: string;
+}) {
+  const boundaryArn = workloadRoleBoundaryArn({
+    accountId: options.accountId,
+    partition: options.partition,
+    stage: options.stage,
+  });
+  const intentsByRole = createFoundationWorkloadRoleIntents();
+  const draft = {
+    boundaryArn,
+    id: ROLE_ID,
+    ownership: { project: 'foundation', resource: 'nat-instance' },
+    passDestinations: ['ec2.amazonaws.com'],
+    permissionPolicyDigest: '0'.repeat(64),
+    roleName: foundationNatWorkloadRoleName(options.stage),
+    surface: 'foundation-nat-instance' as const,
+    trustClass: 'ec2' as const,
+  };
+  const declaration = {
+    ...draft,
+    permissionPolicyDigest: createWorkloadRoleEffectivePolicy(
+      draft,
+      intentsByRole[ROLE_ID] ?? [],
+    ).digest,
+  };
+  const manifest = canonicalizeWorkloadRoleManifest({
+    candidate: {
+      identity: options.candidateIdentity,
+      stage: options.stage,
+    },
+    roles: [declaration],
+    schemaVersion: WORKLOAD_ROLE_MANIFEST_SCHEMA_VERSION,
+  });
+  return { intentsByRole, manifest };
+}
+
+export function recreateRegisteredFoundationWorkloadRoleCandidate(
+  document: RegisteredWorkloadRoleManifestDocument,
+) {
+  return createFoundationWorkloadRoleCandidate({
+    accountId: document.accountId,
+    candidateIdentity: document.manifest.candidate.identity,
+    partition: document.partition,
+    stage: document.manifest.candidate.stage,
+  });
+}
+`,
+        'packages/foundation/infra/workload-roles/injection.ts': `import {
+  createSstVpcNatRoleInput,
+  type ExactProvisionedWorkloadRoleRegistry,
+} from '@empire-builder-kit/nx/workload-roles';
+
+export function createFoundationWorkloadRoleBindings(
+  registry: ExactProvisionedWorkloadRoleRegistry,
+) {
+  const vpc = createSstVpcNatRoleInput(
+    registry,
+    'foundation.nat-instance',
+  );
+  return {
+    nat: {
+      instanceProfileName: vpc.nat.ec2.role + '-profile',
+      roleName: vpc.nat.ec2.role,
+      vpc,
+    },
+  };
+}
+`,
+        'packages/foundation/infra/workload-roles/report.ts': `import {
+  GetCallerIdentityCommand,
+  STSClient,
+} from '@aws-sdk/client-sts';
+import {
+  createRegisteredWorkloadRoleManifestDocument,
+  digestWorkloadRoleManifest,
+  workloadRoleProvisionerAliasArn,
+} from '@empire-builder-kit/nx/workload-roles';
+import { createFoundationWorkloadRoleCandidate } from './candidate.js';
+
+/**
+ * Builds the initial or full-stage Foundation candidate using only generated
+ * intent and read-only caller-identity discovery. It does not require an
+ * existing workload-role registration or any Foundation deployment output.
+ */
+export async function reportWorkloadRoleCandidate(options: {
+  candidateIdentity: string;
+  region: string;
+  stage: string;
+}) {
+  if (
+    !/^[a-z0-9][a-z0-9._-]{0,127}$/.test(options.candidateIdentity) ||
+    !/^[a-z]{2}(?:-gov)?-[a-z]+-\\d$/.test(options.region) ||
+    !['development', 'staging', 'production'].includes(options.stage)
+  ) {
+    throw new Error(
+      'Protected Foundation workload-role candidate report input is invalid.',
+    );
+  }
+  const identity = await new STSClient({ region: options.region }).send(
+    new GetCallerIdentityCommand({}),
+  );
+  const accountId = identity.Account;
+  const partition = /^arn:([^:]+):/.exec(identity.Arn ?? '')?.[1];
+  if (
+    !accountId ||
+    !/^\\d{12}$/.test(accountId) ||
+    !partition ||
+    !['aws', 'aws-cn', 'aws-us-gov'].includes(partition)
+  ) {
+    throw new Error(
+      'Foundation workload-role candidate report could not prove the active AWS identity.',
+    );
+  }
+  const candidate = createFoundationWorkloadRoleCandidate({
+    accountId,
+    candidateIdentity: options.candidateIdentity,
+    partition,
+    stage: options.stage,
+  });
+  const manifestDigest = digestWorkloadRoleManifest(candidate.manifest);
+  return createRegisteredWorkloadRoleManifestDocument({
+    accountId,
+    intentsByRole: candidate.intentsByRole,
+    manifest: candidate.manifest,
+    partition,
+    project: 'foundation',
+    provisionerFunctionArn: workloadRoleProvisionerAliasArn({
+      accountId,
+      manifestDigest,
+      partition,
+      project: 'foundation',
+      region: options.region,
+      stage: options.stage,
+    }),
+  });
+}
+`,
+        'packages/foundation/infra/workload-roles/preflight.ts': `import { GetObjectCommand, S3Client } from '@aws-sdk/client-s3';
+import { GetParameterCommand, SSMClient } from '@aws-sdk/client-ssm';
+import { GetCallerIdentityCommand, STSClient } from '@aws-sdk/client-sts';
+import {
+  digestWorkloadRoleManifest,
+  provisionedWorkloadRoleRegistrationObjectKey,
+  registeredWorkloadRoleManifestObjectKey,
+  requireRegisteredWorkloadRoleManifestDocument,
+  requireWorkloadRoleStorageRegistration,
+  validateWorkloadRolePreflight,
+  workloadRoleStorageRegistrationPath,
+} from '@empire-builder-kit/nx/workload-roles';
+import { recreateRegisteredFoundationWorkloadRoleCandidate } from './candidate.js';
+import { createFoundationWorkloadRoleBindings } from './injection.js';
+
+function requiredRegion(): string {
+  const value = (
+    process.env.AWS_REGION ??
+    process.env.AWS_DEFAULT_REGION ??
+    ''
+  ).trim();
+  if (!/^[a-z]{2}(?:-gov)?-[a-z]+-\\d$/.test(value)) {
+    throw new Error(
+      'Protected Foundation workload-role preflight requires one explicit AWS Region.',
+    );
+  }
+  return value;
+}
+
+function requiredCandidateIdentity(): string {
+  const value = process.env.EBK_CANDIDATE_IDENTITY?.trim();
+  if (!value || !/^[a-z0-9][a-z0-9._-]{0,127}$/.test(value)) {
+    throw new Error(
+      'EBK_CANDIDATE_IDENTITY must name the exact protected candidate.',
+    );
+  }
+  return value;
+}
+
+async function readParameter(ssm: SSMClient, name: string): Promise<unknown> {
+  const response = await ssm.send(
+    new GetParameterCommand({ Name: name, WithDecryption: false }),
+  );
+  if (!response.Parameter?.Value) {
+    throw new Error('Foundation workload-role registration is absent.');
+  }
+  try {
+    return JSON.parse(response.Parameter.Value) as unknown;
+  } catch {
+    throw new Error('Foundation workload-role registration is malformed.');
+  }
+}
+
+async function readObject(
+  s3: S3Client,
+  bucketName: string,
+  key: string,
+): Promise<unknown> {
+  const response = await s3.send(
+    new GetObjectCommand({ Bucket: bucketName, Key: key }),
+  );
+  if (!response.Body) {
+    throw new Error('Foundation workload-role object is absent.');
+  }
+  try {
+    return JSON.parse(await response.Body.transformToString()) as unknown;
+  } catch {
+    throw new Error('Foundation workload-role object is malformed.');
+  }
+}
+
+/**
+ * Resolves completely before infra/index.ts is imported. Protected Foundation
+ * construction has no synthesized-role fallback.
+ */
+export async function preflightFoundationWorkloadRoles(stage: string) {
+  const region = requiredRegion();
+  const s3 = new S3Client({ region });
+  const ssm = new SSMClient({ region });
+  const identity = await new STSClient({ region }).send(
+    new GetCallerIdentityCommand({}),
+  );
+  const accountId = identity.Account;
+  const partition = /^arn:([^:]+):/.exec(identity.Arn ?? '')?.[1];
+  if (
+    !accountId ||
+    !/^\\d{12}$/.test(accountId) ||
+    !partition ||
+    !['aws', 'aws-cn', 'aws-us-gov'].includes(partition)
+  ) {
+    throw new Error(
+      'Foundation workload-role preflight could not prove the active AWS identity.',
+    );
+  }
+  const candidateIdentity = requiredCandidateIdentity();
+  const storageValue = await readParameter(
+    ssm,
+    workloadRoleStorageRegistrationPath(stage, 'foundation'),
+  );
+  const storage = requireWorkloadRoleStorageRegistration(storageValue);
+  if (
+    storage.candidateIdentity !== candidateIdentity ||
+    storage.project !== 'foundation' ||
+    storage.stage !== stage
+  ) {
+    throw new Error(
+      'Foundation workload-role registration differs from this deployment.',
+    );
+  }
+  const registeredValue = await readObject(
+    s3,
+    storage.bucketName,
+    registeredWorkloadRoleManifestObjectKey({
+      manifestDigest: storage.manifestDigest,
+      project: 'foundation',
+      provisionerFunctionArn: storage.provisionerFunctionArn,
+      stage,
+    }),
+  );
+  const registered =
+    requireRegisteredWorkloadRoleManifestDocument(registeredValue);
+  if (
+    registered.accountId !== accountId ||
+    registered.partition !== partition
+  ) {
+    throw new Error(
+      'Foundation workload-role registration differs from the active AWS identity.',
+    );
+  }
+  const recreated =
+    recreateRegisteredFoundationWorkloadRoleCandidate(registered);
+  if (
+    digestWorkloadRoleManifest(recreated.manifest) !==
+      registered.manifestDigest ||
+    registered.manifestDigest !== storage.manifestDigest ||
+    JSON.stringify(recreated.intentsByRole) !==
+      JSON.stringify(registered.intentsByRole)
+  ) {
+    throw new Error(
+      'Foundation workload-role registration differs from generated intent.',
+    );
+  }
+  const provisionedValue = await readObject(
+    s3,
+    storage.bucketName,
+    provisionedWorkloadRoleRegistrationObjectKey({
+      manifestDigest: storage.manifestDigest,
+      project: 'foundation',
+      provisionerFunctionArn: storage.provisionerFunctionArn,
+      stage,
+    }),
+  );
+  const preflight = validateWorkloadRolePreflight({
+    expectedCandidateIdentity: candidateIdentity,
+    expectedProject: 'foundation',
+    expectedStage: stage,
+    provisionedRegistration: provisionedValue,
+    registeredManifest: registeredValue,
+    storageRegistration: storage,
+  });
+  return {
+    authorityPlan: preflight.authorityPlan,
+    bindings: createFoundationWorkloadRoleBindings(preflight.registry),
+    registry: preflight.registry,
+  };
+}
+
+export type FoundationWorkloadRolePreflight = Awaited<
+  ReturnType<typeof preflightFoundationWorkloadRoles>
+>;
+`,
+        'packages/foundation/infra/workload-roles/index.ts': `export * from './candidate.js';
+export * from './injection.js';
+export * from './preflight.js';
+export * from './report.js';
+`,
+    };
+}
+//# sourceMappingURL=workspace-files-foundation-workload-roles.js.map

package/src/generators/preset/workspace-files-foundation-workload-roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-files-foundation-workload-roles.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/workspace-files-foundation-workload-roles.ts"],"names":[],"mappings":";;AAKA,8EA8YC;AAnZD;;;;GAIG;AACH,SAAgB,iCAAiC;IAG/C,OAAO;QACL,uDAAuD,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8H5D;QACG,uDAAuD,EAAE;;;;;;;;;;;;;;;;;;;;CAoB5D;QACG,oDAAoD,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoEzD;QACG,uDAAuD,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0K5D;QACG,mDAAmD,EAAE;;;;CAIxD;KACE,CAAC;AACJ,CAAC"}

package/src/generators/preset/workspace-files-performance-cost.d.ts

@@ -0,0 +1,66 @@
+export declare const PROTECTED_PERFORMANCE_COST_WORKFLOW_PATH: ".github/workflows/performance-cost-actual.yml";
+export declare const PROTECTED_AGGREGATE_COUNT_WORKFLOW_NAME: "Protected aggregate counts";
+export declare const PROTECTED_AGGREGATE_COUNT_WORKFLOW_PATH: ".github/workflows/performance-aggregate-counts.yml";
+export declare const PROTECTED_AGGREGATE_COUNT_TARGET: "performance-aggregate-counts";
+interface ProtectedPerformanceCostArtifact {
+    expired?: boolean;
+    name?: string;
+}
+interface ProtectedPerformanceCostWorkflowRun {
+    conclusion?: string;
+    event?: string;
+    head_branch?: string;
+    head_repository?: {
+        full_name?: string;
+    } | null;
+    head_sha?: string;
+    id?: number | string;
+    name?: string;
+    path?: string;
+    run_attempt?: number | string;
+    status?: string;
+}
+export interface ProtectedPerformanceCostSourceAuthority {
+    aggregateArtifactName: string;
+    aggregateArtifactTotal: number;
+    aggregateArtifacts: ProtectedPerformanceCostArtifact[];
+    aggregateRun: ProtectedPerformanceCostWorkflowRun;
+    aggregateRunId: string;
+    candidate: string;
+    project: string;
+    releaseArtifactName: string;
+    releaseArtifactTotal: number;
+    releaseArtifacts: ProtectedPerformanceCostArtifact[];
+    releaseRun: ProtectedPerformanceCostWorkflowRun;
+    releaseRunId: string;
+    repository: string;
+    stage: string;
+}
+export interface ProtectedAggregateCountSourceAuthority {
+    artifacts: ProtectedPerformanceCostArtifact[];
+    artifactTotal: number;
+    candidate: string;
+    project: string;
+    repository: string;
+    run: ProtectedPerformanceCostWorkflowRun;
+    runId: string;
+    stage: string;
+}
+/**
+ * Treats the selected Deploy run as a locator only. The run and its exact
+ * release-evidence artifact must independently prove the current protected
+ * branch candidate before generated aggregate code is allowed to execute.
+ */
+export declare function validateProtectedAggregateCountSourceAuthority(input: ProtectedAggregateCountSourceAuthority): Readonly<{
+    artifactName: string;
+    runAttempt: string;
+}>;
+export declare function renderProtectedAggregateCountWorkflow(): Readonly<Record<typeof PROTECTED_AGGREGATE_COUNT_WORKFLOW_PATH, string>>;
+/**
+ * Treats caller-supplied run IDs and artifact names only as selectors. The
+ * selected producer runs and artifacts must independently match the fixed
+ * protected workflow contracts before AWS authority is introduced.
+ */
+export declare function validateProtectedPerformanceCostSourceAuthority(input: ProtectedPerformanceCostSourceAuthority): void;
+export declare function renderProtectedPerformanceCostWorkflow(): Readonly<Record<typeof PROTECTED_PERFORMANCE_COST_WORKFLOW_PATH, string>>;
+export {};