@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/generators/slice/built-in-plan-native-runtime-authority-files.js

@@ -0,0 +1,324 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderStandardSliceNativeRuntimeAuthorityFiles = renderStandardSliceNativeRuntimeAuthorityFiles;
+const built_in_plan_workload_role_files_js_1 = require("./built-in-plan-workload-role-files.js");
+function renderTopology(name, sql) {
+    return `${sql ? "import { createDatabaseBindingPlan } from '@empire-builder-kit/nx/foundation';\n" : ''}\
+import {
+  createStandardSliceWorkloadRoleTopology as createRuntimeTopology,
+  type StandardSliceServiceAdapterMetadata,
+  type StandardSliceWorkloadExtension,
+} from '@empire-builder-kit/nx/workload-roles';
+${sql ? "import databaseBindings from '../../database/bindings.json';\n" : ''}\
+import performanceOperations from '../../operations/performance.json';
+
+export const STANDARD_SLICE_RUNTIME_EXTENSIONS = [
+  // <ebk:native-runtime-extensions:start>
+  // <ebk:native-runtime-extensions:end>
+] as const satisfies readonly StandardSliceWorkloadExtension[];
+
+function serviceAdapterMetadata(value: unknown): StandardSliceServiceAdapterMetadata {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error('Performance operations must be an object.');
+  }
+  const load = (value as { load?: unknown }).load;
+  if (load === null || typeof load !== 'object' || Array.isArray(load)) {
+    throw new Error('Performance operations load authority must be an object.');
+  }
+  const owner = (load as { serviceAdapterOwner?: unknown }).serviceAdapterOwner;
+  const status = (load as { serviceAdapterStatus?: unknown }).serviceAdapterStatus;
+  if (
+    (status === 'requires-adopter-service-runtime-endpoint' && owner === null) ||
+    (status === 'managed-generated-service-runtime-endpoint' &&
+      typeof owner === 'string' && owner.length > 0)
+  ) {
+    return { owner, status };
+  }
+  throw new Error('Performance operations Service adapter authority is inconsistent.');
+}
+
+const SERVICE_ADAPTER = serviceAdapterMetadata(performanceOperations);
+
+export function createStandardSliceRuntimeTopology(stage: string) {
+${sql
+        ? `  const databases = createDatabaseBindingPlan(databaseBindings, {
+    slice: '${name}',
+    stage,
+  }).provisioned;
+`
+        : `  void stage;
+  const databases: string[] = [];
+`}\
+  return createRuntimeTopology({
+    databaseIdentifiers: databases,
+    extensions: STANDARD_SLICE_RUNTIME_EXTENSIONS,
+    serviceAdapter: SERVICE_ADAPTER,
+    slice: '${name}',
+  });
+}
+`;
+}
+function renderEffectiveIntent(name, workspace, sql) {
+    const source = (0, built_in_plan_workload_role_files_js_1.renderStandardSliceWorkloadRoleFiles)(name, workspace, sql)['infra/workload-roles/effective-intent.ts'];
+    if (!source) {
+        throw new Error('Standard Slice native authority source is unavailable.');
+    }
+    const withoutRoleNameImport = source.replace('  standardSliceWorkloadRoleName,\n', '');
+    const legacyRoleArn = `function roleArn(
+  context: StandardSliceWorkloadRoleIntentContext,
+  resource: string,
+) {
+  return (
+    'arn:' +
+    context.partition +
+    ':iam::' +
+    context.accountId +
+    ':role/' +
+    standardSliceWorkloadRoleName(context.stage, '${name}', resource)
+  );
+}`;
+    const nativeRoleArn = `function roleArn(
+  context: StandardSliceWorkloadRoleIntentContext,
+  _resource: string,
+) {
+  void _resource;
+  return (
+    'arn:' +
+    context.partition +
+    ':iam::' +
+    context.accountId +
+    ':role/ebk/' +
+    context.stage +
+    '/workloads/*'
+  );
+}`;
+    if (sql && !withoutRoleNameImport.includes(legacyRoleArn)) {
+        throw new Error('Standard Slice role ARN source seam changed unexpectedly.');
+    }
+    return withoutRoleNameImport
+        .replace(legacyRoleArn, nativeRoleArn)
+        .replace('<ebk:workload-role-intent-contributions:start>', '<ebk:native-runtime-intent-contributions:start>')
+        .replace('<ebk:workload-role-intent-contributions:end>', '<ebk:native-runtime-intent-contributions:end>');
+}
+function renderRuntime(name, workspace, sql) {
+    return `import { canonicalOperatorSecretName } from '@empire-builder-kit/nx/secrets';
+import {
+  createStandardSliceWorkloadRoleIntents,
+  standardSliceBoundOperatorSecretDeclarations,
+  standardSliceResourceNames,
+  type StandardSliceWorkloadRoleIntentContext,
+} from './effective-intent.js';
+import { createStandardSliceRuntimeTopology } from './topology.js';
+
+type NativePermission = {
+  actions: string[];
+  conditions?: Array<{ test: string; variable: string; values: string[] }>;
+  resources: any[];
+};
+
+function requiredAccountId(): string {
+  const value = process.env.AWS_EXPECTED_ACCOUNT_ID?.trim() ?? '';
+  if (!/^[0-9]{12}$/.test(value)) {
+    throw new Error('Native Slice runtime authority requires AWS_EXPECTED_ACCOUNT_ID.');
+  }
+  return value;
+}
+
+function requiredRegion(): string {
+  const value = (process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION ?? '').trim();
+  if (!/^[a-z]{2}(?:-gov)?-[a-z]+(?:-[a-z]+)*-[0-9]$/.test(value)) {
+    throw new Error('Native Slice runtime authority requires one exact AWS Region.');
+  }
+  return value;
+}
+
+function partitionForRegion(region: string): 'aws' | 'aws-cn' | 'aws-us-gov' {
+  if (region.startsWith('cn-')) return 'aws-cn';
+  if (region.startsWith('us-gov-')) return 'aws-us-gov';
+  return 'aws';
+}
+
+function permissionConditions(
+  conditions: Record<string, Record<string, string | string[]>> | undefined,
+) {
+  if (!conditions) return undefined;
+  return Object.entries(conditions).flatMap(([test, entries]) =>
+    Object.entries(entries).map(([variable, rawValues]) => ({
+      test,
+      values: Array.isArray(rawValues) ? rawValues : [rawValues],
+      variable,
+    })),
+  );
+}
+
+function policyJson(permissions: readonly NativePermission[]): string {
+  return JSON.stringify({
+    Statement: permissions.map((permission) => ({
+      Action: permission.actions,
+      ...(permission.conditions
+        ? {
+            Condition: permission.conditions.reduce<
+              Record<string, Record<string, string | string[]>>
+            >((result, { test, values, variable }) => {
+              result[test] = {
+                ...(result[test] ?? {}),
+                [variable]: values.length === 1 ? values[0] : values,
+              };
+              return result;
+            }, {}),
+          }
+        : {}),
+      Effect: 'Allow',
+      Resource: permission.resources,
+    })),
+    Version: '2012-10-17',
+  });
+}
+
+export function createStandardSliceNativeRuntimeAuthority(input: {
+${sql
+        ? `  clusterId: any;
+  clusterResourceId: any;
+  masterSecretArn: any;
+`
+        : ''}\
+  eventBusArn: any;
+  identityUserPoolArn: any;
+}) {
+  const accountId = requiredAccountId();
+  const region = requiredRegion();
+  const partition = partitionForRegion(region);
+  const authorityStage = $dev ? 'development' : $app.stage;
+  const topology = createStandardSliceRuntimeTopology(authorityStage);
+  const declarations = standardSliceBoundOperatorSecretDeclarations(
+    authorityStage,
+    topology,
+  );
+  const developmentAuthority = Object.freeze({
+    createAppConfigMonitorRole(_logicalName: string): never {
+      void _logicalName;
+      throw new Error('Personal stages do not create protected AppConfig roles.');
+    },
+    createStepFunctionsRole(_logicalName: string, _resource: string): never {
+      void _logicalName;
+      void _resource;
+      throw new Error('Personal stages do not create protected Step Functions roles.');
+    },
+    permissions(_resource: string): NativePermission[] {
+      void _resource;
+      return [];
+    },
+    resourceNames: standardSliceResourceNames({ accountId, stage: $app.stage }),
+  });
+  if ($dev) return developmentAuthority;
+  const secretReferences = declarations.map((declaration) => {
+    const secretName = canonicalOperatorSecretName(
+      { slice: '${name}', stage: $app.stage, workspace: '${workspace}' },
+      declaration.logicalName,
+    );
+    return {
+      declaration,
+      observed: aws.secretsmanager.getSecretOutput({ name: secretName }),
+    };
+  });
+  const resolved = $resolve({
+${sql
+        ? `    clusterId: input.clusterId,
+    clusterResourceId: input.clusterResourceId,
+    masterSecretArn: input.masterSecretArn,
+`
+        : ''}\
+    eventBusArn: input.eventBusArn,
+    identityUserPoolArn: input.identityUserPoolArn,
+    secretArns: secretReferences.map(({ observed }) => observed.arn),
+  }).apply((values) => {
+${sql
+        ? `    const clusterId = values.clusterId ?? '';
+    const clusterName = clusterId.split('/').at(-1) ?? '';
+    if (!clusterName || !/^[A-Za-z0-9_-]{1,255}$/.test(clusterName)) {
+      throw new Error('Foundation cluster identity is malformed.');
+    }
+`
+        : ''}\
+    const context: StandardSliceWorkloadRoleIntentContext = {
+      accountId,
+${sql
+        ? `      clusterName,
+      clusterResourceId: values.clusterResourceId ?? '',
+      masterSecretArn: values.masterSecretArn ?? '',
+`
+        : ''}\
+      eventBusArn: values.eventBusArn ?? '',
+      identityUserPoolArn: values.identityUserPoolArn ?? '',
+      partition,
+      region,
+      stage: authorityStage,
+    };
+    const references = secretReferences.map(({ declaration }, index) => ({
+      logicalName: declaration.logicalName,
+      provider: 'aws-secrets-manager' as const,
+      secretArn: values.secretArns[index] ?? '',
+    }));
+    return createStandardSliceWorkloadRoleIntents(
+      context,
+      topology,
+      references,
+    );
+  });
+
+  const permissions = (resource: string) =>
+    resolved.apply((intentsByRole) => {
+      const roleId = '${name}.' + resource;
+      const intents = intentsByRole[roleId];
+      if (!intents) {
+        throw new Error('Native Slice runtime authority omitted ' + roleId + '.');
+      }
+      return intents.map((intent) => ({
+        actions: intent.actions,
+        ...(intent.conditions
+          ? { conditions: permissionConditions(intent.conditions) }
+          : {}),
+        resources: intent.resources,
+      }));
+    });
+
+  const createServiceRole = (
+    logicalName: string,
+    resource: string,
+    service: 'appconfig.amazonaws.com' | 'states.amazonaws.com',
+  ) =>
+    new aws.iam.Role(logicalName, {
+      assumeRolePolicy: aws.iam.assumeRolePolicyForPrincipal({ Service: service }),
+      inlinePolicies: [{
+        name: 'runtime',
+        policy: permissions(resource).apply(policyJson),
+      }],
+    });
+
+  return Object.freeze({
+    createAppConfigMonitorRole(logicalName: string) {
+      return createServiceRole(
+        logicalName,
+        'configuration-monitor',
+        'appconfig.amazonaws.com',
+      );
+    },
+    createStepFunctionsRole(logicalName: string, resource: string) {
+      return createServiceRole(logicalName, resource, 'states.amazonaws.com');
+    },
+    permissions,
+    resourceNames: standardSliceResourceNames({ accountId, stage: $app.stage }),
+  });
+}
+`;
+}
+/** @internal */
+function renderStandardSliceNativeRuntimeAuthorityFiles(name, workspace, sql = false) {
+    return {
+        'infra/native-runtime-authority/effective-intent.ts': renderEffectiveIntent(name, workspace, sql),
+        'infra/native-runtime-authority/index.ts': `export * from './runtime.js';\n`,
+        'infra/native-runtime-authority/runtime.ts': renderRuntime(name, workspace, sql),
+        'infra/native-runtime-authority/topology.ts': renderTopology(name, sql),
+    };
+}
+//# sourceMappingURL=built-in-plan-native-runtime-authority-files.js.map

package/src/generators/slice/built-in-plan-operations-files.d.ts

@@ -1,2 +1,2 @@
 /** @internal */
-export declare function renderSliceOperationsFiles(name: string, workspace?: string, frameworkVersion?: string): Readonly<Record<string, string>>;
+export declare function renderSliceOperationsFiles(name: string, workspace?: string, frameworkVersion?: string, sql?: boolean): Readonly<Record<string, string>>;