@fjall/components-infrastructure 2.22.0 → 2.23.0

package/dist/lib/patterns/aws/compute.js

@@ -1,5 +1,6 @@
 import { Token } from "aws-cdk-lib";
 import { Runtime } from "aws-cdk-lib/aws-lambda";
+import { buildParameterPath } from "@fjall/util";
 import { isCompute, isEcsCompute, isLambdaCompute, isEc2Compute } from "./interfaces/compute.js";
 import { warnIfPropertiesIgnored } from "../../utils/validationLogger.js";
 import { applyInferredPublicBuildArgs } from "./computeBuildArgInference.js";
@@ -205,7 +206,11 @@ export class ComputeFactory {
                         // Include ssmSecretsPath (explicit or derived)
                         manifestService.ssmSecretsPath =
                             service.ssmSecretsPath ??
-                                `/${appName}/${clusterName}/${service.name}`;
+                                buildParameterPath({
+                                    app: appName,
+                                    cluster: clusterName,
+                                    service: service.name
+                                });
                         collector.addService(manifestService);
                     }
                     return new EcsCompute(scope, id, computeProps);
@@ -223,7 +228,10 @@ export class ComputeFactory {
                     const manifestLambda = {
                         name: id,
                         ssmSecretsPath: lambdaComputeProps.ssmSecretsPath ||
-                            `/${lambdaComputeProps.appName}/lambda/${id}`
+                            buildParameterPath({
+                                app: lambdaComputeProps.appName,
+                                lambda: id
+                            })
                     };
                     if (lambdaComputeProps.secrets &&
                         lambdaComputeProps.secrets.length > 0) {

package/dist/lib/patterns/aws/computeEcs.js

@@ -23,7 +23,8 @@ import { toPascalCase } from "../../utils/capitaliseString.js";
 import { FjallLogger } from "../../utils/validationLogger.js";
 import { VALIDATION_PATTERNS } from "@fjall/generator";
 import { evaluateBakeGuard } from "@fjall/util/docker";
-import { toKebab } from "@fjall/util";
+import { toKebab, buildParameterPath } from "@fjall/util";
+import { validateSecretName } from "../../resources/aws/compute/ecsValidation.js";
 import { COMPUTE_DEFAULTS, collectImportedSecretNames } from "./compute.js";
 import { isHookMigrations } from "./computeEcsTypes.js";
 export { ScalingType } from "./computeEcsTypes.js";
@@ -1228,9 +1229,14 @@ export class EcsCompute extends Construct {
                         `is set and EcsComputeProps.appName is missing — set one to enable ` +
                         `SSM path derivation (/<appName>/<clusterName>/<serviceName>).`);
                 }
-                ssmPath = `/${this.appName}/${this.clusterId}/${svcConfig.name}`;
+                ssmPath = buildParameterPath({
+                    app: this.appName,
+                    cluster: this.clusterId,
+                    service: svcConfig.name
+                });
             }
             for (const secretName of migrations.secrets) {
+                validateSecretName(secretName, `migrations of service '${svcConfig.name}'`);
                 const param = StringParameter.fromSecureStringParameterAttributes(this, `${idPrefix}${secretName}SsmParam`, { parameterName: `${ssmPath}/${secretName}` });
                 secretsResolved[secretName] = EcsSecret.fromSsmParameter(param);
             }

package/dist/lib/resources/aws/compute/ecsTaskDefinition.js

@@ -2,8 +2,9 @@ import { AwsLogDriver, ContainerDependencyCondition, FargateTaskDefinition, Ec2T
 import { Duration, RemovalPolicy } from "aws-cdk-lib";
 import { Secret as EcsSecret } from "aws-cdk-lib/aws-ecs";
 import { StringParameter } from "aws-cdk-lib/aws-ssm";
+import { buildParameterPath } from "@fjall/util";
 import { resolveOrgId } from "../../../utils/cdkContext.js";
-import { validateSsmPathComponent } from "./ecsValidation.js";
+import { validateSsmPathComponent, validateSecretName } from "./ecsValidation.js";
 import { DEFAULT_LOG_RETENTION, DEFAULT_FARGATE_CPU, DEFAULT_FARGATE_MEMORY_MIB, DEFAULT_EC2_CONTAINER_MEMORY_MIB } from "./ecsConstants.js";
 import { LogGroup } from "../logging/logGroup.js";
 import { getContainerImage } from "./ecsImages.js";
@@ -46,7 +47,21 @@ export function deriveSsmSecretsPath(props, serviceName, explicitPath) {
     validateSsmPathComponent(appName, "appName");
     validateSsmPathComponent(props.clusterName, "clusterName");
     validateSsmPathComponent(serviceName, "serviceName");
-    return `/${appName}/${props.clusterName}/${serviceName}`;
+    // "lambda" is the lambda-scope path marker: /<app>/lambda/<x> decodes as a
+    // lambda namespace everywhere (SecretNamespaceSchema reserves the name), so
+    // a cluster called "lambda" would derive paths the secrets tooling cannot
+    // address as ECS scopes.
+    if (props.clusterName === "lambda") {
+        throw new Error(`Cluster name "lambda" is reserved for lambda-scoped parameter paths. ` +
+            `The derived secrets path /${appName}/lambda/${serviceName} would be ` +
+            `read as a lambda namespace. Rename the cluster, or set ssmSecretsPath ` +
+            `explicitly on service '${serviceName}'.`);
+    }
+    return buildParameterPath({
+        app: appName,
+        cluster: props.clusterName,
+        service: serviceName
+    });
 }
 export function createTaskDefinition(ctx, serviceName, serviceProps, executionRole, taskRole) {
     const cpu = serviceProps.cpu ?? DEFAULT_FARGATE_CPU;
@@ -155,6 +170,7 @@ export function addContainersToTask(ctx, serviceName, serviceProps, taskDefiniti
             }
             const ssmSecretsPath = deriveSsmSecretsPath(ctx.props, serviceName, serviceProps.ssmSecretsPath);
             for (const secretName of containerConfig.secrets) {
+                validateSecretName(secretName, `container '${containerConfig.name}' of service '${serviceName}'`);
                 const paramPath = `${ssmSecretsPath}/${secretName}`;
                 const param = StringParameter.fromSecureStringParameterAttributes(ctx.scope, `${ctx.props.clusterName}${serviceName}${containerConfig.name}${secretName}SsmParam`, { parameterName: paramPath });
                 secrets[secretName] = EcsSecret.fromSsmParameter(param);

package/dist/lib/resources/aws/compute/ecsValidation.d.ts

@@ -32,3 +32,10 @@ export declare function validateEcsClusterProps(props: EcsClusterProps): void;
  * @throws Error if the component is invalid
  */
 export declare function validateSsmPathComponent(component: string, fieldName: string): void;
+/**
+ * Validates a secret name wired into a container or migration task.
+ * The construct is the last validation line for direct-CDK consumers: a name
+ * failing SECRET_NAME_PATTERN (slash, digit-leading) synthesises a parameter
+ * reference the fjall secrets tooling can never write.
+ */
+export declare function validateSecretName(name: string, context: string): void;

package/dist/lib/resources/aws/compute/ecsValidation.js

@@ -1,6 +1,6 @@
 import { NetworkMode } from "aws-cdk-lib/aws-ecs";
 import { evaluateBakeGuard } from "@fjall/util/docker";
-import { toKebab } from "@fjall/util";
+import { toKebab, SSM_COMPONENT_PATTERN, SSM_COMPONENT_ERROR, SECRET_NAME_PATTERN, SECRET_NAME_ERROR } from "@fjall/util";
 import { ScalingType } from "./ecsTypes.js";
 /**
  * Validates ECS cluster props before construction.
@@ -185,8 +185,10 @@ export function validateSsmPathComponent(component, fieldName) {
     if (!component || component.trim() === "") {
         throw new Error(`${fieldName} cannot be empty for SSM path derivation`);
     }
-    if (component.includes("/")) {
-        throw new Error(`${fieldName} cannot contain forward slashes (/). Invalid value: "${component}".`);
+    if (!SSM_COMPONENT_PATTERN.test(component)) {
+        throw new Error(`${fieldName} is not a valid SSM path component. ${SSM_COMPONENT_ERROR}. ` +
+            `Invalid value: "${component}". A path derived from it could not be ` +
+            `managed through fjall secrets — rename it, or set ssmSecretsPath explicitly.`);
     }
     // SSM parameter name hierarchy labels have a max length of 2048, but we use a more
     // reasonable limit since each component is just one part of the path
@@ -194,3 +196,14 @@ export function validateSsmPathComponent(component, fieldName) {
         throw new Error(`${fieldName} exceeds maximum length (128 characters).`);
     }
 }
+/**
+ * Validates a secret name wired into a container or migration task.
+ * The construct is the last validation line for direct-CDK consumers: a name
+ * failing SECRET_NAME_PATTERN (slash, digit-leading) synthesises a parameter
+ * reference the fjall secrets tooling can never write.
+ */
+export function validateSecretName(name, context) {
+    if (!SECRET_NAME_PATTERN.test(name)) {
+        throw new Error(`Secret name "${name}" in ${context} is invalid. ${SECRET_NAME_ERROR}.`);
+    }
+}

package/dist/lib/resources/aws/compute/lambda.js

@@ -10,7 +10,9 @@ import { PolicyStatement, Effect } from "aws-cdk-lib/aws-iam";
 import { RetentionDays } from "aws-cdk-lib/aws-logs";
 import { LogGroup } from "../logging/logGroup.js";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
+import { buildParameterPath } from "@fjall/util";
 import { resolveImportedSecret } from "../secrets/index.js";
+import { validateSsmPathComponent } from "./ecsValidation.js";
 import { toPascalCase } from "../../../utils/capitaliseString.js";
 import { resolvePrivateSubnetType } from "../../../utils/vpcUtils.js";
 import { createLambdaAlarms } from "../monitoring/index.js";
@@ -369,6 +371,8 @@ export class LambdaFunction extends Function {
                 "and appName/functionName are not available. " +
                 "Either set ssmSecretsPath explicitly, or ensure App.getName() returns a value.");
         }
-        return `/${appName}/lambda/${functionName}`;
+        validateSsmPathComponent(appName, "appName");
+        validateSsmPathComponent(functionName, "functionName");
+        return buildParameterPath({ app: appName, lambda: functionName });
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "2.22.0",
+  "version": "2.23.0",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
@@ -63,8 +63,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1038.0",
-    "@fjall/generator": "^2.22.0",
-    "@fjall/util": "^2.22.0",
+    "@fjall/generator": "^2.23.0",
+    "@fjall/util": "^2.23.0",
     "constructs": "^10.6.0"
   },
   "overrides": {
@@ -78,5 +78,5 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "gitHead": "448c771d258e87f0535ae7698f11438e0f7c57b1"
+  "gitHead": "dadd84e6118f03252877974eec755e812cb5b42f"
 }