@empire-builder-kit/runtime 1.0.0-beta.10 → 1.0.0-beta.11

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@empire-builder-kit/runtime",
3
- "version": "1.0.0-beta.10",
3
+ "version": "1.0.0-beta.11",
4
4
  "description": "Runtime contracts for Empire Builder Kit Foundation and product workloads",
5
5
  "license": "Apache-2.0",
6
6
  "type": "module",
@@ -32,6 +32,10 @@
32
32
  "types": "./src/config.d.ts",
33
33
  "default": "./src/config.js"
34
34
  },
35
+ "./database": {
36
+ "types": "./src/database.d.ts",
37
+ "default": "./src/database.js"
38
+ },
35
39
  "./events": {
36
40
  "types": "./src/events.d.ts",
37
41
  "default": "./src/events.js"
@@ -70,6 +74,7 @@
70
74
  "provenance": false
71
75
  },
72
76
  "dependencies": {
77
+ "@aws-sdk/client-secrets-manager": "^3.700.0",
73
78
  "jose": "^6.2.2",
74
79
  "tslib": "^2.3.0"
75
80
  },
@@ -0,0 +1,32 @@
1
+ export interface DatabaseCredential {
2
+ database: string;
3
+ host: string;
4
+ password: string;
5
+ port: number;
6
+ username: string;
7
+ }
8
+ export interface LocalDatabaseResource extends DatabaseCredential {
9
+ provider: 'local';
10
+ }
11
+ export interface SecretsManagerDatabaseResource {
12
+ database: string;
13
+ host: string;
14
+ port: number;
15
+ provider: 'aws-secrets-manager';
16
+ secretArn: string;
17
+ username: string;
18
+ }
19
+ export type LinkedDatabaseResource = LocalDatabaseResource | SecretsManagerDatabaseResource;
20
+ export interface DatabaseTlsOptions {
21
+ ca: string;
22
+ rejectUnauthorized: true;
23
+ }
24
+ export interface ResolveDatabaseCredentialOptions {
25
+ cacheTtlMs?: number;
26
+ loadSecret?: (secretArn: string) => Promise<string>;
27
+ now?: () => number;
28
+ }
29
+ export declare function databaseTlsOptions(resource: LinkedDatabaseResource): false | DatabaseTlsOptions;
30
+ export declare function resolveDatabaseCredential(resource: LinkedDatabaseResource, options?: ResolveDatabaseCredentialOptions): Promise<DatabaseCredential>;
31
+ export declare function invalidateDatabaseCredential(resource: SecretsManagerDatabaseResource | string): void;
32
+ export { RDS_GLOBAL_CA_BUNDLE } from './rds-global-ca-bundle.js';
@@ -0,0 +1,119 @@
1
+ import { __awaiter } from "tslib";
2
+ import { GetSecretValueCommand, SecretsManagerClient, } from '@aws-sdk/client-secrets-manager';
3
+ import { RDS_GLOBAL_CA_BUNDLE } from './rds-global-ca-bundle.js';
4
+ export function databaseTlsOptions(resource) {
5
+ if (resource.provider === 'local')
6
+ return false;
7
+ if (resource.provider === 'aws-secrets-manager') {
8
+ return {
9
+ ca: RDS_GLOBAL_CA_BUNDLE,
10
+ rejectUnauthorized: true,
11
+ };
12
+ }
13
+ throw new Error('Unsupported linked database credential provider.');
14
+ }
15
+ const credentialCache = new Map();
16
+ let secretsManagerClient;
17
+ function requireString(value, field) {
18
+ if (typeof value !== 'string' || value.trim() === '') {
19
+ throw new Error(`Database credential ${field} must be a non-empty string.`);
20
+ }
21
+ return value;
22
+ }
23
+ function requirePort(value) {
24
+ if (typeof value !== 'number' ||
25
+ !Number.isSafeInteger(value) ||
26
+ value < 1 ||
27
+ value > 65535) {
28
+ throw new Error('Database credential port must be from 1 through 65535.');
29
+ }
30
+ return value;
31
+ }
32
+ function requireSecretArn(value) {
33
+ if (typeof value !== 'string' || value.trim() === '') {
34
+ throw new Error('Linked database credential secretArn must be a non-empty string.');
35
+ }
36
+ return value;
37
+ }
38
+ function parseCredential(value) {
39
+ let parsed;
40
+ try {
41
+ parsed = JSON.parse(value);
42
+ }
43
+ catch (_a) {
44
+ throw new Error('Database credential secret must contain valid JSON.');
45
+ }
46
+ if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
47
+ throw new Error('Database credential secret must contain a JSON object.');
48
+ }
49
+ const fields = parsed;
50
+ return {
51
+ database: requireString(fields['database'], 'database'),
52
+ host: requireString(fields['host'], 'host'),
53
+ password: requireString(fields['password'], 'password'),
54
+ port: requirePort(fields['port']),
55
+ username: requireString(fields['username'], 'username'),
56
+ };
57
+ }
58
+ function loadSecretFromAws(secretArn) {
59
+ return __awaiter(this, void 0, void 0, function* () {
60
+ secretsManagerClient !== null && secretsManagerClient !== void 0 ? secretsManagerClient : (secretsManagerClient = new SecretsManagerClient({}));
61
+ const result = yield secretsManagerClient.send(new GetSecretValueCommand({ SecretId: secretArn }));
62
+ if (!result.SecretString) {
63
+ throw new Error('Database credential secret must use a JSON SecretString value.');
64
+ }
65
+ return result.SecretString;
66
+ });
67
+ }
68
+ function assertReferenceMatches(resource, credential) {
69
+ for (const field of ['database', 'host', 'port', 'username']) {
70
+ if (credential[field] !== resource[field]) {
71
+ throw new Error(`Database credential ${field} does not match its linked reference.`);
72
+ }
73
+ }
74
+ }
75
+ export function resolveDatabaseCredential(resource_1) {
76
+ return __awaiter(this, arguments, void 0, function* (resource, options = {}) {
77
+ var _a, _b, _c, _d;
78
+ if (resource.provider === 'local') {
79
+ return {
80
+ database: requireString(resource.database, 'database'),
81
+ host: requireString(resource.host, 'host'),
82
+ password: requireString(resource.password, 'password'),
83
+ port: requirePort(resource.port),
84
+ username: requireString(resource.username, 'username'),
85
+ };
86
+ }
87
+ if (resource.provider !== 'aws-secrets-manager') {
88
+ throw new Error('Unsupported linked database credential provider.');
89
+ }
90
+ const secretArn = requireSecretArn(resource.secretArn);
91
+ const now = (_b = (_a = options.now) === null || _a === void 0 ? void 0 : _a.call(options)) !== null && _b !== void 0 ? _b : Date.now();
92
+ const cacheTtlMs = (_c = options.cacheTtlMs) !== null && _c !== void 0 ? _c : 60000;
93
+ if (!Number.isSafeInteger(cacheTtlMs) ||
94
+ cacheTtlMs < 0 ||
95
+ cacheTtlMs > 15 * 60000) {
96
+ throw new Error('Database credential cacheTtlMs must be from 0 through 900000.');
97
+ }
98
+ const cached = credentialCache.get(secretArn);
99
+ if (cached && cached.expiresAt > now) {
100
+ assertReferenceMatches(resource, cached.value);
101
+ return cached.value;
102
+ }
103
+ const secret = yield ((_d = options.loadSecret) !== null && _d !== void 0 ? _d : loadSecretFromAws)(secretArn);
104
+ const credential = parseCredential(secret);
105
+ assertReferenceMatches(resource, credential);
106
+ if (cacheTtlMs > 0) {
107
+ credentialCache.set(secretArn, {
108
+ expiresAt: now + cacheTtlMs,
109
+ value: credential,
110
+ });
111
+ }
112
+ return credential;
113
+ });
114
+ }
115
+ export function invalidateDatabaseCredential(resource) {
116
+ credentialCache.delete(typeof resource === 'string' ? resource : resource.secretArn);
117
+ }
118
+ export { RDS_GLOBAL_CA_BUNDLE } from './rds-global-ca-bundle.js';
119
+ //# sourceMappingURL=database.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"database.js","sourceRoot":"","sources":["../../../../packages/runtime/src/database.ts"],"names":[],"mappings":";AAAA,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AA0CjE,MAAM,UAAU,kBAAkB,CAChC,QAAgC;IAEhC,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,QAAQ,CAAC,QAAQ,KAAK,qBAAqB,EAAE,CAAC;QAChD,OAAO;YACL,EAAE,EAAE,oBAAoB;YACxB,kBAAkB,EAAE,IAAI;SACzB,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,eAAe,GAAG,IAAI,GAAG,EAA4B,CAAC;AAC5D,IAAI,oBAAsD,CAAC;AAE3D,SAAS,aAAa,CACpB,KAAc,EACd,KAA+B;IAE/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,uBAAuB,KAAK,8BAA8B,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAC5B,KAAK,GAAG,CAAC;QACT,KAAK,GAAG,KAAK,EACb,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,WAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,OAAO;QACL,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;QACvD,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAC3C,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;QACvD,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,SAAe,iBAAiB,CAAC,SAAiB;;QAChD,oBAAoB,aAApB,oBAAoB,cAApB,oBAAoB,IAApB,oBAAoB,GAAK,IAAI,oBAAoB,CAAC,EAAE,CAAC,EAAC;QACtD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAC5C,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CACnD,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;CAAA;AAED,SAAS,sBAAsB,CAC7B,QAAwC,EACxC,UAA8B;IAE9B,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAU,EAAE,CAAC;QACtE,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,uBAAuB,KAAK,uCAAuC,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAgB,yBAAyB;yDAC7C,QAAgC,EAChC,UAA4C,EAAE;;QAE9C,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAClC,OAAO;gBACL,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;gBACtD,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAC1C,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;gBACtD,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAChC,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;aACvD,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,qBAAqB,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,MAAA,MAAA,OAAO,CAAC,GAAG,uDAAI,mCAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,MAAA,OAAO,CAAC,UAAU,mCAAI,KAAM,CAAC;QAChD,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC;YACjC,UAAU,GAAG,CAAC;YACd,UAAU,GAAG,EAAE,GAAG,KAAM,EACxB,CAAC;YACD,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YACrC,sBAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/C,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAA,OAAO,CAAC,UAAU,mCAAI,iBAAiB,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1E,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAC3C,sBAAsB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7C,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE;gBAC7B,SAAS,EAAE,GAAG,GAAG,UAAU;gBAC3B,KAAK,EAAE,UAAU;aAClB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;CAAA;AAED,MAAM,UAAU,4BAA4B,CAC1C,QAAiD;IAEjD,eAAe,CAAC,MAAM,CACpB,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAC7D,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC"}
package/src/index.d.ts CHANGED
@@ -10,6 +10,6 @@ export * from './observability.js';
10
10
  export * from './request-context.js';
11
11
  export * from './response.js';
12
12
  export declare const runtimePackage: {
13
- readonly exports: readonly ["@empire-builder-kit/runtime/auth", "@empire-builder-kit/runtime/auth-backend", "@empire-builder-kit/runtime/auth-web", "@empire-builder-kit/runtime/auth-session", "@empire-builder-kit/runtime/config", "@empire-builder-kit/runtime/events", "@empire-builder-kit/runtime/frontend", "@empire-builder-kit/runtime/hosts", "@empire-builder-kit/runtime/request-context", "@empire-builder-kit/runtime/logging", "@empire-builder-kit/runtime/lambda", "@empire-builder-kit/runtime/observability", "@empire-builder-kit/runtime/response"];
13
+ readonly exports: readonly ["@empire-builder-kit/runtime/auth", "@empire-builder-kit/runtime/auth-backend", "@empire-builder-kit/runtime/auth-web", "@empire-builder-kit/runtime/auth-session", "@empire-builder-kit/runtime/config", "@empire-builder-kit/runtime/database", "@empire-builder-kit/runtime/events", "@empire-builder-kit/runtime/frontend", "@empire-builder-kit/runtime/hosts", "@empire-builder-kit/runtime/request-context", "@empire-builder-kit/runtime/logging", "@empire-builder-kit/runtime/lambda", "@empire-builder-kit/runtime/observability", "@empire-builder-kit/runtime/response"];
14
14
  readonly name: "@empire-builder-kit/runtime";
15
15
  };
package/src/index.js CHANGED
@@ -16,6 +16,7 @@ export const runtimePackage = {
16
16
  '@empire-builder-kit/runtime/auth-web',
17
17
  '@empire-builder-kit/runtime/auth-session',
18
18
  '@empire-builder-kit/runtime/config',
19
+ '@empire-builder-kit/runtime/database',
19
20
  '@empire-builder-kit/runtime/events',
20
21
  '@empire-builder-kit/runtime/frontend',
21
22
  '@empire-builder-kit/runtime/hosts',
package/src/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../packages/runtime/src/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,eAAe,CAAC;AAE9B,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,OAAO,EAAE;QACP,kCAAkC;QAClC,0CAA0C;QAC1C,sCAAsC;QACtC,0CAA0C;QAC1C,oCAAoC;QACpC,oCAAoC;QACpC,sCAAsC;QACtC,mCAAmC;QACnC,6CAA6C;QAC7C,qCAAqC;QACrC,oCAAoC;QACpC,2CAA2C;QAC3C,sCAAsC;KACvC;IACD,IAAI,EAAE,6BAA6B;CAC3B,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../packages/runtime/src/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,eAAe,CAAC;AAE9B,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,OAAO,EAAE;QACP,kCAAkC;QAClC,0CAA0C;QAC1C,sCAAsC;QACtC,0CAA0C;QAC1C,oCAAoC;QACpC,sCAAsC;QACtC,oCAAoC;QACpC,sCAAsC;QACtC,mCAAmC;QACnC,6CAA6C;QAC7C,qCAAqC;QACrC,oCAAoC;QACpC,2CAA2C;QAC3C,sCAAsC;KACvC;IACD,IAAI,EAAE,6BAA6B;CAC3B,CAAC"}