@fishawack/lab-env 5.2.0 → 5.3.0-beta.1

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 ## Changelog
 
+### 5.3.0-beta.1 (2026-02-04)
+
+#### Features
+
+* can now customize headers for static provisions ([a3bc776](https://bitbucket.org/fishawackdigital/lab-env/commits/a3bc776c6acca3555de4ef5667ffdf9f8b37a518))
+* can now specify redirects for use in cloudfront functions ([67706d7](https://bitbucket.org/fishawackdigital/lab-env/commits/67706d76300fc6743f7a5ceb9bf31748cf8acb31))
+
+#### Bug Fixes
+
+* deprov now correctly removes the response function for static sites ([69fbc2b](https://bitbucket.org/fishawackdigital/lab-env/commits/69fbc2b8f60898d3d33416328752897dff6f752b))
+* prompt if redirects are needed first ([e087bf0](https://bitbucket.org/fishawackdigital/lab-env/commits/e087bf0f6d86c543f31d9f0c401793222f8f0d9a))
+* set aws client on key command ([3b15512](https://bitbucket.org/fishawackdigital/lab-env/commits/3b15512b168d4ba35871047fd0ea9230cf394804))
+
+### 5.2.1-beta.1 (2026-01-26)
+
+#### Bug Fixes
+
+* issue with lab-env calling lab-env and concatanating repo env variable ([03313c3](https://bitbucket.org/fishawackdigital/lab-env/commits/03313c3c43c793222620170c381af05ec4b1c348))
+* use correct prod base image on python images ([db0ace4](https://bitbucket.org/fishawackdigital/lab-env/commits/db0ace419e8c635c727aa33330a3156c0956af0b))
+
 ### 5.2.0 (2026-01-17)
 
 #### Features

package/commands/create/cmds/dekey.js

@@ -1,6 +1,9 @@
 const _ = require("../../../globals.js");
 const inquirer = require("inquirer");
 const aws = require("../services/aws/index.js");
+const {
+    setAWSClientDefaults,
+} = require("../../../commands/create/services/aws/misc.js");
 
 module.exports = [
     "dekey",
@@ -63,6 +66,8 @@ module.exports = [
         for (let i = 0; i < clients.length; i++) {
             let client = clients[i];
 
+            setAWSClientDefaults(client);
+
             for (let j = 0; j < users.length; j++) {
                 let user = users[j];
 

package/commands/create/cmds/key.js

@@ -7,6 +7,9 @@ const htmlEmail = require("fs").readFileSync(
     `${__dirname}/../templates/credentials.html`,
     { encoding: "utf8" },
 );
+const {
+    setAWSClientDefaults,
+} = require("../../../commands/create/services/aws/misc.js");
 
 module.exports = [
     "key",
@@ -83,6 +86,8 @@ module.exports = [
         for (let i = 0; i < clients.length; i++) {
             let client = clients[i];
 
+            setAWSClientDefaults(client);
+
             for (let j = 0; j < users.length; j++) {
                 let user = users[j];
 

package/commands/create/cmds/provision.js

@@ -32,12 +32,169 @@ module.exports = [
             },
         ]);
 
+        // Check for existing redirects in config
+        let redirects = _.coreConfig?.attributes?.deploy?.redirects || [];
+
         if (!answer.check) {
             process.exit(1);
         }
 
         let answers = await inquirer.prompt([stack]);
 
+        // Prompt for redirects if static stack and no existing redirects
+        if (answers.stack === "static" && redirects.length === 0) {
+            let wantsRedirects = await inquirer.prompt([
+                {
+                    type: "confirm",
+                    name: "setup",
+                    message: "Setup redirects?",
+                    default: false,
+                },
+            ]);
+
+            if (wantsRedirects.setup) {
+                let addRedirect = { continue: true };
+
+                while (addRedirect.continue) {
+                    addRedirect = await inquirer.prompt([
+                        {
+                            type: "input",
+                            name: "src",
+                            message:
+                                "Redirect source path (e.g., /old-path or /news/*)",
+                            validate: (input) => {
+                                if (!input || !input.startsWith("/")) {
+                                    return "Source must start with /";
+                                }
+                                return true;
+                            },
+                        },
+                        {
+                            type: "input",
+                            name: "dest",
+                            message:
+                                "Redirect destination (e.g., /new-path or https://example.com/news/*)",
+                            validate: (input) => !!input.length,
+                        },
+                        {
+                            type: "confirm",
+                            name: "continue",
+                            message: "Add another redirect?",
+                            default: true,
+                        },
+                    ]);
+
+                    if (addRedirect.src && addRedirect.dest) {
+                        redirects.push({
+                            src: addRedirect.src,
+                            dest: addRedirect.dest,
+                        });
+                    }
+                }
+            }
+        }
+
+        // Prompt for custom headers if static stack and no existing headers
+        let headers = _.coreConfig?.attributes?.deploy?.headers || [];
+
+        if (answers.stack === "static" && headers.length === 0) {
+            let customHeaders = await inquirer.prompt([
+                {
+                    type: "confirm",
+                    name: "customize",
+                    message: "Customize response headers?",
+                    default: false,
+                },
+            ]);
+
+            if (customHeaders.customize) {
+                // Prompt for standard headers with defaults
+                let standardHeaders = await inquirer.prompt([
+                    {
+                        type: "input",
+                        name: "strict-transport-security",
+                        message: "strict-transport-security header value:",
+                        default: "max-age=31536000; includeSubDomains",
+                        validate: (input) => !!input.length,
+                    },
+                    {
+                        type: "input",
+                        name: "content-security-policy",
+                        message: "content-security-policy header value:",
+                        default:
+                            "default-src 'self' https: data: 'unsafe-inline';",
+                        validate: (input) => !!input.length,
+                    },
+                    {
+                        type: "input",
+                        name: "x-content-type-options",
+                        message: "x-content-type-options header value:",
+                        default: "nosniff",
+                        validate: (input) => !!input.length,
+                    },
+                    {
+                        type: "input",
+                        name: "x-frame-options",
+                        message: "x-frame-options header value:",
+                        default: "sameorigin",
+                        validate: (input) => !!input.length,
+                    },
+                ]);
+
+                // Add standard headers to array
+                Object.keys(standardHeaders).forEach((name) => {
+                    headers.push({
+                        name: name,
+                        value: standardHeaders[name],
+                    });
+                });
+
+                // Prompt for additional custom headers
+                let wantsCustomHeaders = await inquirer.prompt([
+                    {
+                        type: "confirm",
+                        name: "add",
+                        message: "Add custom headers?",
+                        default: false,
+                    },
+                ]);
+
+                if (wantsCustomHeaders.add) {
+                    let addHeader = { continue: true };
+
+                    while (addHeader.continue) {
+                        addHeader = await inquirer.prompt([
+                            {
+                                type: "input",
+                                name: "name",
+                                message: "Custom header name:",
+                                validate: (input) => !!input.length,
+                            },
+                            {
+                                type: "input",
+                                name: "value",
+                                message: "Custom header value:",
+                                validate: (input) => !!input.length,
+                            },
+                            {
+                                type: "confirm",
+                                name: "continue",
+                                message: "Add another custom header?",
+                                default: false,
+                            },
+                        ]);
+
+                        if (addHeader.name && addHeader.value) {
+                            headers.push({
+                                name: addHeader.name,
+                                value: addHeader.value,
+                            });
+                        }
+                    }
+                }
+            }
+        }
+
         if (answers.stack === "fullstack") {
             answers = {
                 ...answers,
@@ -135,20 +292,36 @@ module.exports = [
         setAWSClientDefaults(answers.client, answers.region);
 
         try {
-            infastructure = await aws[answers.stack](
-                slug,
-                [
-                    { Key: "repository", Value: _.repo },
-                    { Key: "environment", Value: branch },
-                    { Key: "automated", Value: true },
-                ],
-                credentials,
-                _.repoSafe,
-                branch,
-                answers.framework,
-                answers.availability,
-                answers.database,
-            );
+            if (answers.stack === "static") {
+                infastructure = await aws.static(
+                    slug,
+                    [
+                        { Key: "repository", Value: _.repo },
+                        { Key: "environment", Value: branch },
+                        { Key: "automated", Value: true },
+                    ],
+                    credentials,
+                    _.repoSafe,
+                    branch,
+                    redirects,
+                    headers,
+                );
+            } else {
+                infastructure = await aws.fullstack(
+                    slug,
+                    [
+                        { Key: "repository", Value: _.repo },
+                        { Key: "environment", Value: branch },
+                        { Key: "automated", Value: true },
+                    ],
+                    credentials,
+                    _.repoSafe,
+                    branch,
+                    answers.framework,
+                    answers.availability,
+                    answers.database,
+                );
+            }
         } catch (e) {
             console.log(e.message);
             process.exit(1);
@@ -175,6 +348,14 @@ module.exports = [
             config[branch].deploy.users = credentials;
         }
 
+        if (redirects.length) {
+            config[branch].deploy.redirects = redirects;
+        }
+
+        if (headers.length) {
+            config[branch].deploy.headers = headers;
+        }
+
         let stringify = JSON.stringify(config, null, 4);
         let output = stringify.substring(1, stringify.length - 1).trim();
         execSync(`printf '${output}' | pbcopy`);

package/commands/create/libs/aws-cloudfront-request.js

@@ -0,0 +1,156 @@
+// eslint-disable-next-line no-unused-vars
+function handler(event) {
+    var query, index, key, response;
+
+    // Redirect if www to non-www
+    if (event.request.headers.host.value.includes("www.")) {
+        query = "";
+        index = 0;
+
+        for (key in event.request.querystring) {
+            query += `${index ? "&" : "?"}${key}=${event.request.querystring[key].value}`;
+            index++;
+        }
+
+        response = {
+            statusCode: 301,
+            statusDescription: "Moved Permanently",
+            headers: {
+                location: {
+                    value: `https://${event.request.headers.host.value.split("www.")[1]}${event.request.uri}${query}`,
+                },
+                "strict-transport-security": {
+                    value: "max-age=31536000; includeSubDomains",
+                },
+            },
+        };
+
+        return response;
+    }
+
+    // Check authentication if credentials are configured
+    var expected = "<%= credentials %>";
+
+    if (expected && expected.length > 0) {
+        var authHeaders = event.request.headers.authorization;
+
+        // If no auth header or credentials don't match, return 401
+        if (!authHeaders || !expected.find((d) => d === authHeaders.value)) {
+            response = {
+                statusCode: 401,
+                statusDescription: "Unauthorized",
+                headers: {
+                    "www-authenticate": { value: "Basic" },
+                    "strict-transport-security": {
+                        value: "max-age=31536000; includeSubDomains",
+                    },
+                    "content-security-policy": {
+                        value: "default-src 'self' https: data: 'unsafe-inline';",
+                    },
+                    "x-content-type-options": { value: "nosniff" },
+                    "x-frame-options": { value: "sameorigin" },
+                },
+            };
+
+            return response;
+        }
+    }
+
+    // Redirect if no trailing slash (BEFORE custom redirects)
+    if (!event.request.uri.includes(".") && !event.request.uri.endsWith("/")) {
+        query = "";
+        index = 0;
+
+        for (key in event.request.querystring) {
+            query += `${index ? "&" : "?"}${key}=${event.request.querystring[key].value}`;
+            index++;
+        }
+
+        return {
+            statusCode: 301,
+            statusDescription: "Moved Permanently",
+            headers: { location: { value: `${event.request.uri}/${query}` } },
+        };
+    }
+
+    // Check for custom redirects (URI is guaranteed to have trailing slash now)
+    var customRedirects = "<%= redirects %>";
+    var currentUri = event.request.uri;
+    var i, redirect, srcPattern, captured, destination;
+
+    for (i = 0; i < customRedirects.length; i++) {
+        redirect = customRedirects[i];
+
+        // Handle wildcard redirects
+        if (redirect.src.endsWith("/*")) {
+            srcPattern = redirect.src.slice(0, -2);
+            if (
+                currentUri.startsWith(srcPattern + "/") ||
+                currentUri === srcPattern
+            ) {
+                captured = currentUri.slice(srcPattern.length);
+                destination = redirect.dest;
+
+                // Replace wildcard in destination with captured path
+                if (destination.endsWith("/*")) {
+                    destination = destination.slice(0, -2) + captured;
+                } else {
+                    destination = destination + captured;
+                }
+
+                // Handle relative vs absolute destinations
+                if (!destination.startsWith("http")) {
+                    destination =
+                        "https://" +
+                        event.request.headers.host.value +
+                        destination;
+                }
+
+                return {
+                    statusCode: 301,
+                    statusDescription: "Moved Permanently",
+                    headers: { location: { value: destination } },
+                };
+            }
+        }
+        // Handle exact match redirects (normalize src to have trailing slash)
+        else {
+            var normalizedSrc = redirect.src.endsWith("/")
+                ? redirect.src
+                : redirect.src + "/";
+
+            if (normalizedSrc === currentUri) {
+                destination = redirect.dest;
+
+                // Handle relative vs absolute destinations
+                if (!destination.startsWith("http")) {
+                    destination =
+                        "https://" +
+                        event.request.headers.host.value +
+                        destination;
+                }
+
+                return {
+                    statusCode: 301,
+                    statusDescription: "Moved Permanently",
+                    headers: { location: { value: destination } },
+                };
+            }
+        }
+    }
+
+    // Rewrite url to append index.html if not present
+    var request = event.request;
+    var uri = request.uri;
+
+    // Check whether the URI is missing a file name.
+    if (uri.endsWith("/")) {
+        request.uri += "index.html";
+    }
+    // Check whether the URI is missing a file extension.
+    else if (!uri.includes(".")) {
+        request.uri += "/index.html";
+    }
+
+    return request;
+}

package/commands/create/libs/aws-cloudfront-response.js

@@ -3,15 +3,26 @@ function handler(event) {
     // Add security headers
     var response = event.response;
     var headers = response.headers;
+    var customHeaders = "<%= headers %>";
+    var i, header;
 
-    headers["strict-transport-security"] = {
-        value: "max-age=31536000; includeSubDomains",
-    };
-    headers["content-security-policy"] = {
-        value: "default-src 'self' https: data: 'unsafe-inline';",
-    };
-    headers["x-content-type-options"] = { value: "nosniff" };
-    headers["x-frame-options"] = { value: "sameorigin" };
+    // If custom headers provided, use them; otherwise use defaults
+    if (customHeaders && customHeaders.length > 0) {
+        for (i = 0; i < customHeaders.length; i++) {
+            header = customHeaders[i];
+            headers[header.name] = { value: header.value };
+        }
+    } else {
+        // Default headers
+        headers["strict-transport-security"] = {
+            value: "max-age=31536000; includeSubDomains",
+        };
+        headers["content-security-policy"] = {
+            value: "default-src 'self' https: data: 'unsafe-inline';",
+        };
+        headers["x-content-type-options"] = { value: "nosniff" };
+        headers["x-frame-options"] = { value: "sameorigin" };
+    }
 
     return response;
 }

package/commands/create/services/aws/index.js

@@ -66,6 +66,8 @@ module.exports.static = async (
     credentials = [],
     repo,
     branch,
+    redirects = [],
+    headers = [],
 ) => {
     let s3 = await module.exports.s3.createS3Bucket(name, tags);
 
@@ -76,14 +78,13 @@ module.exports.static = async (
             (
                 await module.exports.cloudfront.createCloudFrontFunction(
                     name,
-                    credentials.length
-                        ? "aws-cloudfront-auth"
-                        : "aws-cloudfront-simple",
+                    "aws-cloudfront-request",
                     {
                         credentials: credentials.map(
                             (d) =>
                                 `Basic ${Buffer.from(`${d.username}:${d.password}`).toString("base64")}`,
                         ),
+                        redirects: redirects,
                     },
                 )
             ).FunctionSummary.FunctionMetadata.FunctionARN,
@@ -95,7 +96,9 @@ module.exports.static = async (
                         branch,
                     ),
                     "aws-cloudfront-response",
-                    {},
+                    {
+                        headers: headers,
+                    },
                 )
             ).FunctionSummary.FunctionMetadata.FunctionARN,
         );
@@ -143,7 +146,11 @@ module.exports.staticTerminate = async (name, repo, branch, id) => {
 
     try {
         await module.exports.cloudfront.removeCloudFrontFunction(
-            module.exports.slug(`${repo}-response`, branch),
+            module.exports.slug(
+                `${repo}-response`,
+                process.env.AWS_PROFILE,
+                branch,
+            ),
         );
     } catch {
         /* empty */

package/globals.js

@@ -847,7 +847,7 @@ module.exports = {
         let alreadyRunning = running;
 
         if (!running) {
-            execSync(`lab-env up -d`, opts);
+            execSync(`${docker} up -d`, opts);
             running = true;
         }
 
@@ -858,7 +858,7 @@ module.exports = {
             throw e;
         } finally {
             if (!alreadyRunning) {
-                execSync(`lab-env down`, opts);
+                execSync(`${docker} down`, opts);
                 running = false;
             }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@fishawack/lab-env",
-    "version": "5.2.0",
+    "version": "5.3.0-beta.1",
     "description": "Docker manager for FW",
     "main": "cli.js",
     "scripts": {

package/python/0/Dockerfile

@@ -2,7 +2,7 @@ FROM ghcr.io/astral-sh/uv:python3.13-bookworm AS development
 
 LABEL org.opencontainers.image.authors="Mike Mellor <mike.mellor@avalerehealth.com>"
 
-FROM fishawack/lab-env-laravel-8-nginx:latest AS production
+FROM fishawack/lab-env-python-0:latest AS production
 
 # Copy source code into container
 COPY . /app

package/commands/create/libs/aws-cloudfront-auth.js

@@ -1,93 +0,0 @@
-// eslint-disable-next-line no-unused-vars
-function handler(event) {
-    var query, index, key, response;
-
-    // Redirect if www to non-www
-    if (event.request.headers.host.value.includes("www.")) {
-        query = "";
-        index = 0;
-
-        for (key in event.request.querystring) {
-            query += `${index ? "&" : "?"}${key}=${event.request.querystring[key].value}`;
-            index++;
-        }
-
-        response = {
-            statusCode: 301,
-            statusDescription: "Moved Permanently",
-            headers: {
-                location: {
-                    value: `https://${event.request.headers.host.value.split("www.")[1]}${event.request.uri}${query}`,
-                },
-                "strict-transport-security": {
-                    value: "max-age=31536000; includeSubDomains",
-                },
-            },
-        };
-
-        return response;
-    }
-
-    // Redirect if no trailing slash
-    if (!event.request.uri.includes(".") && !event.request.uri.endsWith("/")) {
-        query = "";
-        index = 0;
-
-        for (key in event.request.querystring) {
-            query += `${index ? "&" : "?"}${key}=${event.request.querystring[key].value}`;
-            index++;
-        }
-
-        return {
-            statusCode: 301,
-            statusDescription: "Moved Permanently",
-            headers: { location: { value: `${event.request.uri}/${query}` } },
-        };
-    }
-
-    var authHeaders = event.request.headers.authorization;
-
-    // The Base64-encoded Auth string that should be present.
-    // It is an encoding of `Basic base64([username]:[password])`
-    var expected = "<%= credentials %>";
-
-    // If an Authorization header is supplied and it's an exact match, pass the
-    // request on through to CF/the origin without any modification.
-    if (authHeaders && expected.find((d) => d === authHeaders.value)) {
-        // Rewrite url to append index.html if not present
-        var request = event.request;
-        var uri = request.uri;
-
-        // Check whether the URI is missing a file name.
-        if (uri.endsWith("/")) {
-            request.uri += "index.html";
-        }
-        // Check whether the URI is missing a file extension.
-        else if (!uri.includes(".")) {
-            request.uri += "/index.html";
-        }
-
-        return request;
-    }
-
-    // But if we get here, we must either be missing the auth header or the
-    // credentials failed to match what we expected.
-    // Request the browser present the Basic Auth dialog.
-    response = {
-        statusCode: 401,
-        statusDescription: "Unauthorized",
-        headers: {
-            "www-authenticate": { value: "Basic" },
-            "strict-transport-security": {
-                value: "max-age=31536000; includeSubDomains",
-            },
-            "content-security-policy": {
-                value: "default-src 'self' https: data: 'unsafe-inline';",
-            },
-            "x-content-type-options": { value: "nosniff" },
-            "x-frame-options": { value: "sameorigin" },
-        },
-    };
-
-    return response;
-}

package/commands/create/libs/aws-cloudfront-simple.js

@@ -1,61 +0,0 @@
-// eslint-disable-next-line no-unused-vars
-function handler(event) {
-    var query, index, key, response;
-
-    // Redirect if www to non-www
-    if (event.request.headers.host.value.includes("www.")) {
-        query = "";
-        index = 0;
-
-        for (key in event.request.querystring) {
-            query += `${index ? "&" : "?"}${key}=${event.request.querystring[key].value}`;
-            index++;
-        }
-
-        response = {
-            statusCode: 301,
-            statusDescription: "Moved Permanently",
-            headers: {
-                location: {
-                    value: `https://${event.request.headers.host.value.split("www.")[1]}${event.request.uri}${query}`,
-                },
-                "strict-transport-security": {
-                    value: "max-age=31536000; includeSubDomains",
-                },
-            },
-        };
-
-        return response;
-    }
-
-    // Redirect if no trailing slash
-    if (!event.request.uri.includes(".") && !event.request.uri.endsWith("/")) {
-        query = "";
-        index = 0;
-
-        for (key in event.request.querystring) {
-            query += `${index ? "&" : "?"}${key}=${event.request.querystring[key].value}`;
-            index++;
-        }
-
-        return {
-            statusCode: 301,
-            statusDescription: "Moved Permanently",
-            headers: { location: { value: `${event.request.uri}/${query}` } },
-        };
-    }
-
-    var request = event.request;
-    var uri = request.uri;
-
-    // Check whether the URI is missing a file name.
-    if (uri.endsWith("/")) {
-        request.uri += "index.html";
-    }
-    // Check whether the URI is missing a file extension.
-    else if (!uri.includes(".")) {
-        request.uri += "/index.html";
-    }
-
-    return request;
-}