@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/generators/slice/built-in-plan-data-retention-launcher-files.js

@@ -4,16 +4,18 @@ exports.renderProductDataRetentionLauncherFiles = renderProductDataRetentionLaun
 /** @internal */
 function renderProductDataRetentionLauncherFiles(name) {
     return {
-        'scripts/data-retention.mjs': `import { randomUUID } from 'node:crypto';
+        'scripts/data-retention.mjs': `import { execFileSync } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
 import { mkdirSync, writeFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import {
   DescribeExecutionCommand,
   SFNClient,
   StartExecutionCommand,
 } from '@aws-sdk/client-sfn';
 import { GetParameterCommand, SSMClient } from '@aws-sdk/client-ssm';
+import { assertWorkspaceStageOwnershipForWorkspace } from '@empire-builder-kit/nx/workspace-deployment';
 
 const require = createRequire(import.meta.url);
 const {
@@ -43,9 +45,9 @@ if (
     'Retention apply requires exact UUID --run-ref and --approval-request values.',
   );
 }
-if (report && (requestedRunId || approvalRequestId)) {
+if (report && (approvalRequestId !== undefined || (requestedRunId !== undefined && !UUID.test(requestedRunId)))) {
   throw new Error(
-    'Retention report creates a new run and accepts no references.',
+    'Retention report accepts only an optional exact UUID --run-ref to resume, never an approval reference.',
   );
 }
 const stage =
@@ -56,7 +58,45 @@ const stages = resolveFoundationStages({
   foundationStage:
     argument('foundation-stage') ?? process.env.EBK_FOUNDATION_STAGE,
 });
-const ssm = new SSMClient({});
+const workspaceRoot = resolve(import.meta.dirname, '../../..');
+// Caller source metadata, not deployment or retention-apply authority. The
+// deployed worker independently enforces its workload and approved run.
+let sourceCommit = process.env.EBK_SOURCE_COMMIT;
+if (sourceCommit === undefined) {
+  try {
+    sourceCommit = execFileSync('git', ['rev-parse', '--verify', 'HEAD^{commit}'], {
+      cwd: workspaceRoot,
+      env: Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith('GIT_'))),
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+      timeout: 10000,
+      windowsHide: true,
+    }).trim();
+  } catch {
+    throw new Error('Retention source identity requires a readable workspace HEAD or a full EBK_SOURCE_COMMIT.');
+  }
+}
+if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(sourceCommit)) {
+  throw new Error('Retention source identity requires a full commit SHA.');
+}
+const ownership = await assertWorkspaceStageOwnershipForWorkspace(
+  workspaceRoot,
+  stages.consumerStage,
+  {
+    ...(process.env.AWS_PROFILE ? { profile: process.env.AWS_PROFILE } : {}),
+    ...(process.env.AWS_CONFIG_FILE ? { configFilepath: process.env.AWS_CONFIG_FILE } : {}),
+    ...(process.env.AWS_SHARED_CREDENTIALS_FILE
+      ? { credentialsFilepath: process.env.AWS_SHARED_CREDENTIALS_FILE }
+      : {}),
+  },
+);
+if (
+  process.env.AWS_REGION?.trim() &&
+  process.env.AWS_REGION.trim() !== ownership.region
+) {
+  throw new Error('Data retention Region differs from its exact workspace owner tuple.');
+}
+const ssm = new SSMClient({ region: ownership.region });
 const registration = await ssm.send(
   new GetParameterCommand({
     Name: productSliceRetentionPath(
@@ -74,7 +114,7 @@ if (!stateMachineArn) {
 }
 const runId = requestedRunId ?? randomUUID();
 const asOf = new Date().toISOString();
-const sfn = new SFNClient({});
+const sfn = new SFNClient({ region: ownership.region });
 const started = await sfn.send(
   new StartExecutionCommand({
     input: JSON.stringify({
@@ -82,9 +122,10 @@ const started = await sfn.send(
       asOf,
       correlationId: randomUUID(),
       mode: apply ? 'apply' : 'report',
+      ...(report && requestedRunId ? { resume: true } : {}),
       runId,
       slice: '${name}',
-      sourceCommit: process.env.EBK_SOURCE_COMMIT ?? 'unresolved',
+      sourceCommit,
       stage: stages.consumerStage,
     }),
     name:
@@ -118,7 +159,8 @@ if (execution?.status !== 'SUCCEEDED' || !execution.output) {
   throw new Error(
     'Retention workflow failed with status ' +
       (execution?.status ?? 'timeout') +
-      '. Inspect its content-free workflow logs.',
+      '. Inspect its content-free workflow logs.' +
+      (report ? ' Resume this report from its original source: EBK_SOURCE_COMMIT=' + sourceCommit + ' pnpm nx run ${name}:data-retention -- --report --stage=' + stages.consumerStage + ' --run-ref=' + runId + '. Keep the original source/artifacts; a different source cannot resume this run.' : ''),
   );
 }
 const result = JSON.parse(execution.output);