@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/generators/slice/built-in-plan-data-deletion-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"built-in-plan-data-deletion-files.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/slice/built-in-plan-data-deletion-files.ts"],"names":[],"mappings":";;AAGA,wEA0kCC;AA7kCD,uEAAuE;AAEvE,gBAAgB;AAChB,SAAgB,8BAA8B,CAC5C,IAAY,EACZ,UAAkB,EAClB,SAAiB;IAEjB,MAAM,gBAAgB,GAAG,IAAA,8CAAoB,EAAC,UAAU,CAAC,CAAC;IAC1D,OAAO;QACL,+BAA+B,EAAE,IAAA,8BAAI,EAAC;YACpC,eAAe,EAAE,CAAC,IAAI,CAAC;YACvB,aAAa,EAAE,CAAC;SACjB,CAAC;QACF,gCAAgC,EAAE;;;;;;;cAOxB,IAAI;;;;;;;;;;;;;;CAcjB;QACG,uBAAuB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA6BzB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;;oBAEA,UAAU;;IAE1B,gBAAgB;SACX,UAAU;;;IAGf,UAAU;;;UAGJ,UAAU;;;;;;;IAOhB,UAAU;;;;;IAKV,UAAU;;IAEV,gBAAgB;;;;yCAIqB,UAAU;;;;;;;;;;;;;;;;;;;;iBAoBlC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SA8JZ,IAAI;;;;;;;;;;;;;;;;;;;;;SAqBJ,UAAU;;;;;;WAMR,gBAAgB;;;;;eAKZ,gBAAgB;gBACf,SAAS;wBACD,UAAU;;;;;;;6CAOW,UAAU;iBACtC,IAAI;;;;;;;gBAOL,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uBAqDG,IAAI;;;;;;;;;;;;;;;;;;;;;;;;WAwBhB,gBAAgB;;;;;eAKZ,gBAAgB;gBACf,SAAS;wBACD,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uBA6CX,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oCA+CS,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eA+BzB,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mCA2EgB,UAAU;;;;;;;;QAQrC,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA2KG,IAAI;;;;;;;;;;;;;;;;;WAiBd,gBAAgB;;;;;eAKZ,gBAAgB;gBACf,SAAS;wBACD,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwDjC;QACG,uCAAuC,EAAE;;;;;;;;;;;;;iBAa5B,UAAU;;;;;;;;;;;;;;;;;;;;;kCAqBO,IAAI;;;;;;YAM1B,UAAU;;;iBAGL,IAAI;;;;;;;gBAOL,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBA6BD,IAAI;;;;;;;;;;;;;;;;iBAgBN,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0BA2CK,UAAU;;;;;;;;;;;;;;;;;;;;;;;iBAuBnB,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyEpB;KACE,CAAC;AACJ,CAAC"}

package/src/generators/slice/built-in-plan-data-export-infrastructure-files.d.ts

@@ -0,0 +1,2 @@
+/** @internal */
+export declare function renderStandardSliceDataExportInfrastructureFiles(name: string, pascalName: string): Readonly<Record<string, string>>;

package/src/generators/slice/built-in-plan-data-export-infrastructure-files.js

@@ -0,0 +1,249 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderStandardSliceDataExportInfrastructureFiles = renderStandardSliceDataExportInfrastructureFiles;
+/** @internal */
+function renderStandardSliceDataExportInfrastructureFiles(name, pascalName) {
+    return {
+        'infra/data-export.ts': `export interface StandardDataExportStoreOptions {
+  bucketName?: string;
+  keyAliasName?: string;
+  workloadRoleArn?: string;
+}
+
+/**
+ * Creates the bounded Standard confidential-export store. The explicit
+ * application cleanup workflow remains authoritative; S3 lifecycle is a
+ * defense-in-depth backstop and never substitutes for version discovery,
+ * durable cleanup state, or audit.
+ */
+export function createStandardDataExportStore(
+  options: StandardDataExportStoreOptions,
+) {
+  const retain = { retainOnDelete: true };
+  const tags = {
+    'ebk:classification': 'confidential',
+    'ebk:management': 'standard-data-export',
+    'ebk:slice': '${name}',
+    'sst:stage': $app.stage,
+  };
+  const account = aws.getCallerIdentityOutput({});
+  const partition = aws.getPartitionOutput({});
+  const rootArn = $interpolate\`arn:\${partition.partition}:iam::\${account.accountId}:root\`;
+  const keyStatements: any[] = [
+    {
+      actions: ['kms:*'],
+      principals: [{ identifiers: [rootArn], type: 'AWS' }],
+      resources: ['*'],
+      sid: 'AccountKeyAdministration',
+    },
+  ];
+  if (options.workloadRoleArn) {
+    keyStatements.push({
+      actions: [
+        'kms:Decrypt',
+        'kms:Encrypt',
+        'kms:GenerateDataKey',
+      ],
+      principals: [
+        { identifiers: [options.workloadRoleArn], type: 'AWS' },
+      ],
+      resources: ['*'],
+      sid: 'ExactDataRightsWorkloadCryptographicUse',
+    });
+  }
+  const encryptionKey = new aws.kms.Key('${pascalName}DataExportKey', {
+    deletionWindowInDays: 30,
+    description:
+      'Slice-owned key for bounded ${name} confidential subject exports.',
+    enableKeyRotation: true,
+    policy: aws.iam.getPolicyDocumentOutput({
+      statements: keyStatements,
+    }).json,
+    tags,
+  }, retain);
+  const encryptionAlias = new aws.kms.Alias(
+    '${pascalName}DataExportKeyAlias',
+    {
+      name:
+        options.keyAliasName ??
+        ('alias/ebk-' + $app.stage + '-${name}-data-export'),
+      targetKeyId: encryptionKey.keyId,
+    },
+    retain,
+  );
+  const bucket = new aws.s3.Bucket('${pascalName}DataExportBucket', {
+    ...(options.bucketName ? { bucket: options.bucketName } : {}),
+    forceDestroy: false,
+    tags,
+  }, retain);
+  const ownership = new aws.s3.BucketOwnershipControls(
+    '${pascalName}DataExportOwnership',
+    {
+      bucket: bucket.id,
+      rule: { objectOwnership: 'BucketOwnerEnforced' },
+    },
+    retain,
+  );
+  const publicAccessBlock = new aws.s3.BucketPublicAccessBlock(
+    '${pascalName}DataExportPublicAccessBlock',
+    {
+      blockPublicAcls: true,
+      blockPublicPolicy: true,
+      bucket: bucket.id,
+      ignorePublicAcls: true,
+      restrictPublicBuckets: true,
+    },
+    retain,
+  );
+  const versioning = new aws.s3.BucketVersioningV2(
+    '${pascalName}DataExportVersioning',
+    {
+      bucket: bucket.id,
+      versioningConfiguration: { status: 'Enabled' },
+    },
+    retain,
+  );
+  const encryption =
+    new aws.s3.BucketServerSideEncryptionConfigurationV2(
+      '${pascalName}DataExportEncryption',
+      {
+        bucket: bucket.id,
+        rules: [
+          {
+            applyServerSideEncryptionByDefault: {
+              kmsMasterKeyId: encryptionKey.arn,
+              sseAlgorithm: 'aws:kms',
+            },
+            bucketKeyEnabled: true,
+          },
+        ],
+      },
+      retain,
+    );
+  const lifecycle = new aws.s3.BucketLifecycleConfigurationV2(
+    '${pascalName}DataExportLifecycle',
+    {
+      bucket: bucket.id,
+      rules: [
+        {
+          abortIncompleteMultipartUpload: { daysAfterInitiation: 1 },
+          expiration: { days: 1 },
+          filter: { prefix: 'confidential-exports/' },
+          id: 'confidential-export-fallback-expiry',
+          noncurrentVersionExpiration: { noncurrentDays: 1 },
+          status: 'Enabled',
+        },
+        {
+          expiration: { expiredObjectDeleteMarker: true },
+          filter: { prefix: 'confidential-exports/' },
+          id: 'confidential-export-delete-markers',
+          status: 'Enabled',
+        },
+      ],
+    },
+    { ...retain, dependsOn: [versioning] },
+  );
+  const bucketPolicy = new aws.s3.BucketPolicy(
+    '${pascalName}DataExportBucketPolicy',
+    {
+      bucket: bucket.id,
+      policy: aws.iam.getPolicyDocumentOutput({
+        statements: [
+          {
+            actions: ['s3:*'],
+            conditions: [
+              {
+                test: 'Bool',
+                values: ['false'],
+                variable: 'aws:SecureTransport',
+              },
+            ],
+            effect: 'Deny',
+            principals: [{ identifiers: ['*'], type: '*' }],
+            resources: [bucket.arn, $interpolate\`\${bucket.arn}/*\`],
+            sid: 'DenyInsecureTransport',
+          },
+          {
+            actions: ['s3:PutObject'],
+            conditions: [
+              {
+                test: 'StringNotEquals',
+                values: ['aws:kms'],
+                variable: 's3:x-amz-server-side-encryption',
+              },
+            ],
+            effect: 'Deny',
+            principals: [{ identifiers: ['*'], type: '*' }],
+            resources: [
+              $interpolate\`\${bucket.arn}/confidential-exports/*\`,
+            ],
+            sid: 'DenyMissingOrWrongEncryptionAlgorithm',
+          },
+          {
+            actions: ['s3:PutObject'],
+            conditions: [
+              {
+                test: 'StringNotEquals',
+                values: [encryptionKey.arn],
+                variable:
+                  's3:x-amz-server-side-encryption-aws-kms-key-id',
+              },
+            ],
+            effect: 'Deny',
+            principals: [{ identifiers: ['*'], type: '*' }],
+            resources: [
+              $interpolate\`\${bucket.arn}/confidential-exports/*\`,
+            ],
+            sid: 'DenyMissingOrWrongEncryptionKey',
+          },
+        ],
+      }).json,
+    },
+    { ...retain, dependsOn: [encryption, ownership, publicAccessBlock] },
+  );
+  const bucketArn = bucket.arn;
+  const exportObjectArn =
+    $interpolate\`\${bucket.arn}/confidential-exports/*\`;
+  const cleanupPermissions = [
+    {
+      actions: ['s3:ListBucketVersions'],
+      resources: [bucketArn],
+    },
+    {
+      actions: ['s3:DeleteObjectVersion'],
+      resources: [exportObjectArn],
+    },
+  ];
+  const dataRightsPermissions = [
+    ...cleanupPermissions,
+    {
+      actions: [
+        's3:GetObject',
+        's3:GetObjectVersion',
+        's3:PutObject',
+      ],
+      resources: [exportObjectArn],
+    },
+    {
+      actions: ['kms:Decrypt', 'kms:Encrypt', 'kms:GenerateDataKey'],
+      resources: [encryptionKey.arn],
+    },
+  ];
+  return {
+    bucket,
+    bucketPolicy,
+    cleanupPermissions,
+    dataRightsPermissions,
+    encryption,
+    encryptionAlias,
+    encryptionKey,
+    lifecycle,
+    ownership,
+    publicAccessBlock,
+    versioning,
+  };
+}
+`,
+    };
+}
+//# sourceMappingURL=built-in-plan-data-export-infrastructure-files.js.map

package/src/generators/slice/built-in-plan-data-export-infrastructure-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"built-in-plan-data-export-infrastructure-files.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/slice/built-in-plan-data-export-infrastructure-files.ts"],"names":[],"mappings":";;AACA,4GAsPC;AAvPD,gBAAgB;AAChB,SAAgB,gDAAgD,CAC9D,IAAY,EACZ,UAAkB;IAElB,OAAO;QACL,sBAAsB,EAAE;;;;;;;;;;;;;;;;;;;oBAmBR,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CA4BmB,UAAU;;;qCAGhB,IAAI;;;;;;;;OAQlC,UAAU;;;;yCAIwB,IAAI;;;;;sCAKP,UAAU;;;;;;OAMzC,UAAU;;;;;;;;OAQV,UAAU;;;;;;;;;;;OAWV,UAAU;;;;;;;;;SASR,UAAU;;;;;;;;;;;;;;;;OAgBZ,UAAU;;;;;;;;;;;;;;;;;;;;;;;OAuBV,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmGhB;KACE,CAAC;AACJ,CAAC"}

package/src/generators/slice/built-in-plan-data-files.d.ts

@@ -0,0 +1,2 @@
+/** @internal */
+export declare function renderProductDataFiles(name: string, pascalName: string): Readonly<Record<string, string>>;