@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.40

package/src/generators/slice/built-in-plan-web-files.js

@@ -2,32 +2,83 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderProductWebFiles = renderProductWebFiles;
 const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+const sst_environment_source_format_js_1 = require("../../sst-environment-source-format.js");
 /** @internal */
-function renderProductWebFiles(name, pascalName, workspace) {
+function renderProductWebFiles(name, pascalName, workspace, sql = false) {
     return {
-        'web/next-env.d.ts': `/// <reference types="next" />
-/// <reference types="next/image-types/global" />
-import "./.next/types/routes.d.ts";
-
-// NOTE: This file should not be edited
-// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
-`,
+        'web/next-env.d.ts': (0, sst_environment_source_format_js_1.generatedNextEnvironmentSource)(),
         'web/tsconfig.json': (0, built_in_plan_shared_js_1.json)({
             extends: '../tsconfig.json',
             compilerOptions: {
+                // The workspace base is composite for project references; the web
+                // app is a leaf checked by Next's project-local tsc (16.3+), which
+                // enforces composite file lists and would reject the Slice imports
+                // outside web/ (TS6307).
+                composite: false,
                 incremental: true,
                 plugins: [{ name: 'next' }],
             },
-            include: ['next-env.d.ts', '.next/types/**/*.ts', '**/*.ts', '**/*.tsx'],
+            // Next 16.3 regenerates next-env.d.ts and rewrites tsconfig.json when
+            // these entries are missing; the generated files match its output so
+            // a build leaves the tracked workspace unchanged.
+            include: [
+                'next-env.d.ts',
+                '.next/types/**/*.ts',
+                '**/*.ts',
+                '**/*.tsx',
+                '.next/dev/types/**/*.ts',
+            ],
             exclude: ['node_modules'],
         }),
         'web/next.config.ts': `import type { NextConfig } from 'next';
 
 const fleetOrigin = process.env.EBK_FLEET_ORIGIN?.trim();
+const sourceCommit = process.env.EBK_SOURCE_COMMIT?.trim();
+const sourceCommitPattern = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
+
+function exactBuildId(): string {
+  if (sourceCommitPattern.test(sourceCommit ?? '')) return sourceCommit!;
+  if (process.env.SST === '1') {
+    throw new Error(
+      'A deployed Next build requires one exact EBK source commit.',
+    );
+  }
+  return 'local-development';
+}
 
 const config: NextConfig = {
   ...(fleetOrigin ? { allowedDevOrigins: [new URL(fleetOrigin).hostname] } : {}),
+  // Generated Node ESM modules retain their .js/.cjs runtime specifiers;
+  // Webpack resolves those to the TypeScript source during Next dev/build.
+  experimental: { extensionAlias: { '.js': ['.ts', '.js'], '.cjs': ['.cts', '.cjs'] } },
   basePath: '/${name}',
+  generateBuildId: async () => exactBuildId(),
+  async rewrites() {
+    if (!fleetOrigin || process.env.NODE_ENV !== 'development') return [];
+    const stage = process.env.EBK_STAGE;
+    if (!/^personal-[a-f0-9]{24}$/.test(stage ?? '') ||
+        process.env.EBK_CONSUMER_STAGE !== stage) {
+      throw new Error('Fleet Function routing requires the owned task stage. Restart with ebk dev up ${name}.');
+    }
+    // SST injects this Slice's API URL into its owned Next child. This is the
+    // current task API, not the optional deployed-development HTTP fallback.
+    const rawApiUrl = process.env.NEXT_PUBLIC_API_URL?.trim();
+    let apiUrl: URL;
+    try { apiUrl = new URL(rawApiUrl ?? ''); }
+    catch { throw new Error('Fleet Function routing requires the SST task API URL. Restart with ebk dev up ${name}.'); }
+    if (apiUrl.protocol !== 'https:' || apiUrl.username || apiUrl.password ||
+        apiUrl.port || apiUrl.pathname !== '/' || apiUrl.search || apiUrl.hash ||
+        !/^[a-z0-9]+\\.execute-api\\.[a-z0-9-]+\\.amazonaws\\.com(?:\\.cn)?$/.test(apiUrl.hostname)) {
+      throw new Error('Fleet Function routing requires the SST task API origin, without credentials or a path. Restart with ebk dev up ${name}.');
+    }
+    return {
+      beforeFiles: [{
+        source: '/${name}/api/functions/:function',
+        destination: apiUrl.origin + '/functions/:function',
+        basePath: false,
+      }],
+    };
+  },
   reactStrictMode: true,
 };
 
@@ -81,12 +132,12 @@ export function proxy(request: NextRequest): NextResponse {
 `,
         'web/src/lib/server-logging.ts': `import 'server-only';
 import { createLogger, type Logger } from '@empire-builder-kit/runtime/logging';
-import { createNextServerContext } from '@empire-builder-kit/runtime/request-context';
+import { createNextServerContext, type RequestContext } from '@empire-builder-kit/runtime/request-context';
 import { recordReliabilityOperation } from '../../../reliability/metrics';
 
 export interface ObserveNextOperationOptions {
   feature: string;
-  handle(logger: Logger): Promise<Response> | Response;
+  handle(logger: Logger, context: RequestContext): Promise<Response> | Response;
   operation: string;
   request?: Request;
 }
@@ -140,7 +191,7 @@ export async function observeNextOperation({
   };
   logger.info('${name} Next.js operation received');
   try {
-    const response = await handle(logger);
+    const response = await handle(logger, context);
     recordOutcome(response.status < 400 ? 'success' : 'failure');
     logger.info('${name} Next.js operation completed', {
       attributes: { httpStatus: response.status },
@@ -160,7 +211,7 @@ export async function observeNextOperation({
         'web/open-next.config.ts': `const config = {
   // OpenNext runs from this web directory. Point it at the slice package so it
   // builds only this application instead of recursively invoking the Nx root.
-  buildCommand: 'pnpm exec next build web',
+  buildCommand: 'pnpm exec next build --webpack web',
   default: {},
   packageJsonPath: '../package.json',
 };
@@ -197,7 +248,7 @@ export default async function Layout({ children }: Readonly<{ children: ReactNod
     <p>Empire Builder Kit Product Slice</p>
     <h1>${pascalName}</h1>
     <div className="card">
-      <p>The web app, Lambda API, logical Postgres database, Cognito client,
+      <p>The web app, Lambda API, DynamoDB persistence${sql ? ', declared PostgreSQL database' : ''}, Cognito client,
       event buffer/DLQ, dashboard, and alarms are wired and owned here.</p>
       <a href="/${name}/sign-in">Sign in</a>
     </div>
@@ -206,10 +257,12 @@ export default async function Layout({ children }: Readonly<{ children: ReactNod
 `,
         'web/src/app/sign-in/page.tsx': `'use client';
 
-import { useState, type FormEvent } from 'react';
+import { useEffect, useState, type FormEvent } from 'react';
 
 export default function SignIn() {
+  const [hydrated, setHydrated] = useState(false);
   const [message, setMessage] = useState('');
+  useEffect(() => setHydrated(true), []);
   async function submit(event: FormEvent<HTMLFormElement>) {
     event.preventDefault();
     const data = new FormData(event.currentTarget);
@@ -224,7 +277,7 @@ export default function SignIn() {
     <form onSubmit={submit}>
       <label>Email<input name="email" type="email" autoComplete="username" required /></label>
       <label>Password<input name="password" type="password" autoComplete="current-password" required /></label>
-      <button type="submit">Sign in</button>
+      <button disabled={!hydrated} type="submit">Sign in</button>
     </form><p role="status">{message}</p>
     <a href="/${name}/password-reset">Reset password</a>
   </div></main>;
@@ -412,6 +465,160 @@ export async function GET(request: Request) {
     },
   });
 }
+`,
+        'web/src/lib/fleet-records.ts': `import 'server-only';
+import { getSessionTokenCookieNames } from '@empire-builder-kit/runtime/auth-session';
+import { extractBearerToken } from '@empire-builder-kit/runtime/auth-backend';
+import { ApiContractError } from '@empire-builder-kit/runtime/api-contract';
+import { createErrorResponse, createSuccessResponse, RuntimeError } from '@empire-builder-kit/runtime/response';
+import type { Logger } from '@empire-builder-kit/runtime/logging';
+import type { RequestContext } from '@empire-builder-kit/runtime/request-context';
+import { cookies } from 'next/headers';
+import { ${(0, built_in_plan_shared_js_1.lowerCamelIdentifier)(pascalName)}GetRecord, ${(0, built_in_plan_shared_js_1.lowerCamelIdentifier)(pascalName)}PutRecord } from '../../../api/contracts/protected';
+import { authorize${pascalName}FleetRecordOperation } from '../../../authorization/runtime';
+import { putRecordWithLifecycle } from '../../../data/record-correction';
+import { getOwnedRecord } from '../../../data/records';
+
+type RecordMethod = 'GET' | 'PUT';
+const noStore = { 'cache-control': 'no-store' };
+
+function fleetOrigin(request: Request): URL | null {
+  if (process.env.NODE_ENV !== 'development') return null;
+  const stage = process.env.EBK_STAGE;
+  if (!/^personal-[a-f0-9]{24}$/.test(stage ?? '') ||
+      process.env.EBK_CONSUMER_STAGE !== stage ||
+      process.env.EBK_SECURE_COOKIES !== 'true') return null;
+  try {
+    const raw = process.env.EBK_FLEET_ORIGIN ?? '';
+    const origin = new URL(raw);
+    const target = new URL(request.url);
+    const localPort = process.env.EBK_DEV_PORT ?? '';
+    const parsedLocalPort = Number(localPort);
+    if (origin.protocol !== 'https:' || origin.origin !== raw ||
+        origin.username || origin.password || origin.pathname !== '/' || origin.search || origin.hash ||
+        !(origin.hostname.endsWith('.ebk.localhost') || origin.hostname.endsWith('.test')) ||
+        !Number.isSafeInteger(parsedLocalPort) || parsedLocalPort < 1 || parsedLocalPort > 65535 ||
+        String(parsedLocalPort) !== localPort ||
+        target.protocol !== 'https:' ||
+        (target.hostname !== 'localhost' && target.hostname !== '127.0.0.1') ||
+        target.port !== localPort ||
+        target.username || target.password ||
+        request.headers.get('host') !== origin.host ||
+        request.headers.get('x-forwarded-host') !== origin.host ||
+        request.headers.get('x-forwarded-proto') !== 'https' ||
+        request.headers.get('x-forwarded-port') !== (origin.port || '443') ||
+        request.headers.get('x-forwarded-for') !== '127.0.0.1') return null;
+    const suppliedOrigin = request.headers.get('origin');
+    if (suppliedOrigin !== null && suppliedOrigin !== origin.origin) return null;
+    return origin;
+  } catch {
+    return null;
+  }
+}
+
+async function boundedBody(request: Request, maxBytes: number): Promise<unknown> {
+  if (request.headers.get('content-type')?.split(';', 1)[0]?.trim().toLowerCase() !== 'application/json')
+    throw new RuntimeError({ code: 'invalid_request', message: 'JSON request body is required.', status: 400 });
+  const reader = request.body?.getReader();
+  if (!reader) throw new RuntimeError({ code: 'invalid_request', message: 'JSON request body is required.', status: 400 });
+  const chunks: Uint8Array[] = [];
+  let length = 0;
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      length += value.byteLength;
+      if (length > maxBytes) throw new RuntimeError({ code: 'invalid_request', message: 'Request body is too large.', status: 400 });
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  try {
+    return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks)));
+  } catch {
+    throw new RuntimeError({ code: 'invalid_request', message: 'JSON request body is invalid.', status: 400 });
+  }
+}
+
+async function accessToken(request: Request): Promise<{ token: string | null; cookie: boolean }> {
+  if (request.headers.has('authorization'))
+    return { token: extractBearerToken(request.headers.get('authorization') ?? undefined), cookie: false };
+  const store = await cookies();
+  const names = getSessionTokenCookieNames({ namespace: '${name}', secure: true });
+  return { token: store.get(names.access)?.value ?? null, cookie: true };
+}
+
+/** Only the owned task's Next server exposes a native record path. */
+export async function handleFleetRecord(request: Request, recordId: string, method: RecordMethod,
+  logger: Logger, context: RequestContext): Promise<Response> {
+  const origin = fleetOrigin(request);
+  if (!origin || request.method !== method)
+    return Response.json(createErrorResponse(new RuntimeError({ code: 'record_not_found',
+      message: 'The record route is unavailable.', status: 404 })), { status: 404, headers: noStore });
+  try {
+    const auth = await accessToken(request);
+    // Cookie-backed writes require the browser's exact same-origin proof.
+    if (method === 'PUT' && auth.cookie && request.headers.get('origin') !== origin.origin)
+      throw new RuntimeError({ code: 'authorization_denied', message: 'Same-origin authorization is required.', status: 403 });
+    if (method === 'PUT') {
+      const operation = ${(0, built_in_plan_shared_js_1.lowerCamelIdentifier)(pascalName)}PutRecord;
+      const path = operation.request.path.parse({ recordId }, 'request.path');
+      const body = operation.request.body.parse(
+        await boundedBody(request, operation.request.maxBodyBytes ?? 512), 'request.body');
+      const principal = await authorize${pascalName}FleetRecordOperation({
+        accessToken: auth.token, context, logger, operation, request: { path, body },
+      });
+      const value = await putRecordWithLifecycle({ correlationId: context.correlationId, principal,
+        recordId: path.recordId, name: body.name, runScope: body.runScope,
+        testExpiresAt: body.testExpiresAt });
+      const projected = operation.response.body.project({
+        id: value.id, name: value.name, runScope: value.runScope,
+      }, 'response.data');
+      return Response.json(createSuccessResponse(projected, { status: operation.response.status }),
+        { status: operation.response.status, headers: noStore });
+    }
+    const operation = ${(0, built_in_plan_shared_js_1.lowerCamelIdentifier)(pascalName)}GetRecord;
+    if (request.body !== null)
+      throw new RuntimeError({ code: 'invalid_request', message: 'GET does not accept a body.', status: 400 });
+    const path = operation.request.path.parse({ recordId }, 'request.path');
+    const principal = await authorize${pascalName}FleetRecordOperation({
+      accessToken: auth.token, context, logger, operation, request: { path },
+    });
+    const record = await getOwnedRecord(path.recordId, principal.actor.id);
+    if (!record) throw new RuntimeError({ code: 'record_not_found',
+      message: 'The record was not found.', status: 404 });
+    const projected = operation.response.body.project({
+      id: record.id, name: record.name, runScope: record.runScope,
+    }, 'response.data');
+    return Response.json(createSuccessResponse(projected, { status: operation.response.status }),
+      { status: operation.response.status, headers: noStore });
+  } catch (error) {
+    const normalized = error instanceof ApiContractError &&
+        error.classification === 'api-schema-validation-failed'
+      ? new RuntimeError({ code: 'invalid_request',
+          message: 'The request does not satisfy the record contract.', status: 400 })
+      : error;
+    const response = createErrorResponse(normalized);
+    return Response.json(response, { status: response.status, headers: noStore });
+  }
+}
+`,
+        'web/src/app/api/records/[recordId]/route.ts': `import 'server-only';
+import { observeNextOperation } from '../../../../lib/server-logging';
+import { handleFleetRecord } from '../../../../lib/fleet-records';
+
+type RecordRouteContext = { params: Promise<{ recordId: string }> };
+
+export async function GET(request: Request, route: RecordRouteContext) {
+  return observeNextOperation({ feature: 'database', operation: 'get-record', request,
+    handle: async (logger, context) => handleFleetRecord(request, (await route.params).recordId, 'GET', logger, context) });
+}
+
+export async function PUT(request: Request, route: RecordRouteContext) {
+  return observeNextOperation({ feature: 'database', operation: 'put-record', request,
+    handle: async (logger, context) => handleFleetRecord(request, (await route.params).recordId, 'PUT', logger, context) });
+}
 `,
         'web/src/app/page.spec.tsx': `import { renderToStaticMarkup } from 'react-dom/server';
 import { describe, expect, it } from 'vitest';

package/src/generators/slice/built-in-plan-workload-role-files.d.ts

@@ -1,2 +1,2 @@
 /** @internal */
-export declare function renderStandardSliceWorkloadRoleFiles(name: string, workspace: string): Readonly<Record<string, string>>;
+export declare function renderStandardSliceWorkloadRoleFiles(name: string, workspace: string, sql?: boolean): Readonly<Record<string, string>>;