@friggframework/devtools 2.0.0--canary.397.155fecd.0 → 2.0.0--canary.398.e2147f7.0

package/infrastructure/__tests__/helpers/test-utils.js

@@ -0,0 +1,277 @@
+/**
+ * Test utilities for VPC/KMS/SSM testing
+ */
+
+const { mockEnvironmentVariables, mockFallbackEnvironmentVariables } = require('../fixtures/mock-aws-resources');
+
+/**
+ * Set up environment variables for testing
+ * @param {Object} envVars - Environment variables to set
+ */
+function setTestEnvironmentVariables(envVars = mockEnvironmentVariables) {
+    Object.keys(envVars).forEach(key => {
+        process.env[key] = envVars[key];
+    });
+}
+
+/**
+ * Clean up environment variables after testing
+ * @param {Object} envVars - Environment variables to clean up
+ */
+function cleanupTestEnvironmentVariables(envVars = mockEnvironmentVariables) {
+    Object.keys(envVars).forEach(key => {
+        delete process.env[key];
+    });
+}
+
+/**
+ * Set up fallback environment variables for error testing
+ */
+function setFallbackEnvironmentVariables() {
+    setTestEnvironmentVariables(mockFallbackEnvironmentVariables);
+}
+
+/**
+ * Create a mock AWS SDK client send function
+ * @param {Array} responses - Array of responses to return in order
+ * @returns {Function} Mock send function
+ */
+function createMockSendFunction(responses) {
+    let callCount = 0;
+    return jest.fn().mockImplementation(() => {
+        const response = responses[callCount] || responses[responses.length - 1];
+        callCount++;
+        return Promise.resolve(response);
+    });
+}
+
+/**
+ * Create a mock serverless object for plugin testing
+ * @param {Object} serviceConfig - Serverless service configuration
+ * @param {Array} commands - Commands in processedInput
+ * @returns {Object} Mock serverless object
+ */
+function createMockServerless(serviceConfig = {}, commands = []) {
+    return {
+        cli: {
+            log: jest.fn()
+        },
+        service: {
+            provider: {
+                name: 'aws',
+                region: 'us-east-1',
+                ...serviceConfig.provider
+            },
+            plugins: serviceConfig.plugins || [],
+            custom: serviceConfig.custom || {},
+            functions: serviceConfig.functions || {},
+            ...serviceConfig
+        },
+        processedInput: {
+            commands: commands
+        },
+        getProvider: jest.fn(() => ({})),
+        extendConfiguration: jest.fn()
+    };
+}
+
+/**
+ * Verify that environment variables are set correctly
+ * @param {Object} expectedVars - Expected environment variables
+ */
+function verifyEnvironmentVariables(expectedVars) {
+    Object.keys(expectedVars).forEach(key => {
+        expect(process.env[key]).toBe(expectedVars[key]);
+    });
+}
+
+/**
+ * Create a mock integration definition
+ * @param {string} name - Integration name
+ * @returns {Object} Mock integration
+ */
+function createMockIntegration(name = 'testIntegration') {
+    return {
+        Definition: {
+            name: name
+        }
+    };
+}
+
+/**
+ * Create a mock app definition with specified features
+ * @param {Object} features - Features to enable (vpc, kms, ssm)
+ * @param {Array} integrations - Integration definitions
+ * @returns {Object} Mock app definition
+ */
+function createMockAppDefinition(features = {}, integrations = []) {
+    const appDefinition = {
+        name: 'test-app',
+        integrations: integrations
+    };
+
+    if (features.vpc) {
+        appDefinition.vpc = { enable: true };
+    }
+
+    if (features.kms) {
+        appDefinition.encryption = { useDefaultKMSForFieldLevelEncryption: true };
+    }
+
+    if (features.ssm) {
+        appDefinition.ssm = { enable: true };
+    }
+
+    return appDefinition;
+}
+
+/**
+ * Verify serverless configuration contains expected VPC settings
+ * @param {Object} config - Serverless configuration
+ */
+function verifyVpcConfiguration(config) {
+    expect(config.provider.vpc).toBe('${self:custom.vpc.${self:provider.stage}}');
+    expect(config.custom.vpc).toEqual({
+        '${self:provider.stage}': {
+            securityGroupIds: ['${env:AWS_DISCOVERY_SECURITY_GROUP_ID}'],
+            subnetIds: [
+                '${env:AWS_DISCOVERY_SUBNET_ID_1}',
+                '${env:AWS_DISCOVERY_SUBNET_ID_2}'
+            ]
+        }
+    });
+    expect(config.resources.Resources.VPCEndpointS3).toBeDefined();
+}
+
+/**
+ * Verify serverless configuration contains expected KMS settings
+ * @param {Object} config - Serverless configuration
+ */
+function verifyKmsConfiguration(config) {
+    expect(config.plugins).toContain('serverless-kms-grants');
+    expect(config.provider.environment.KMS_KEY_ARN).toBe('${self:custom.kmsGrants.kmsKeyId}');
+    expect(config.custom.kmsGrants).toEqual({
+        kmsKeyId: '${env:AWS_DISCOVERY_KMS_KEY_ID}'
+    });
+
+    // Verify KMS IAM permissions
+    const kmsPermission = config.provider.iamRoleStatements.find(
+        statement => statement.Action.includes('kms:GenerateDataKey')
+    );
+    expect(kmsPermission).toBeDefined();
+}
+
+/**
+ * Verify serverless configuration contains expected SSM settings
+ * @param {Object} config - Serverless configuration
+ */
+function verifySsmConfiguration(config) {
+    expect(config.provider.layers).toEqual([
+        'arn:aws:lambda:${self:provider.region}:177933569100:layer:AWS-Parameters-and-Secrets-Lambda-Extension:11'
+    ]);
+    expect(config.provider.environment.SSM_PARAMETER_PREFIX).toBe('/${self:service}/${self:provider.stage}');
+
+    // Verify SSM IAM permissions
+    const ssmPermission = config.provider.iamRoleStatements.find(
+        statement => statement.Action.includes('ssm:GetParameter')
+    );
+    expect(ssmPermission).toBeDefined();
+}
+
+/**
+ * Verify integration-specific resources are created
+ * @param {Object} config - Serverless configuration
+ * @param {string} integrationName - Name of the integration
+ */
+function verifyIntegrationConfiguration(config, integrationName) {
+    const capitalizedName = integrationName.charAt(0).toUpperCase() + integrationName.slice(1);
+    
+    // Verify integration function
+    expect(config.functions[integrationName]).toBeDefined();
+    
+    // Verify queue worker function
+    expect(config.functions[`${integrationName}QueueWorker`]).toBeDefined();
+    
+    // Verify SQS queue resource
+    expect(config.resources.Resources[`${capitalizedName}Queue`]).toBeDefined();
+    
+    // Verify environment variable
+    expect(config.provider.environment[`${integrationName.toUpperCase()}_QUEUE_URL`]).toBeDefined();
+}
+
+/**
+ * Wait for async operations to complete
+ * @param {number} ms - Milliseconds to wait
+ */
+function wait(ms = 0) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}
+
+/**
+ * Capture console output for testing
+ */
+function captureConsoleOutput() {
+    const originalLog = console.log;
+    const originalError = console.error;
+    const originalWarn = console.warn;
+    
+    const logs = [];
+    const errors = [];
+    const warnings = [];
+    
+    console.log = (...args) => {
+        logs.push(args.join(' '));
+    };
+    
+    console.error = (...args) => {
+        errors.push(args.join(' '));
+    };
+    
+    console.warn = (...args) => {
+        warnings.push(args.join(' '));
+    };
+    
+    return {
+        logs,
+        errors,
+        warnings,
+        restore: () => {
+            console.log = originalLog;
+            console.error = originalError;
+            console.warn = originalWarn;
+        }
+    };
+}
+
+/**
+ * Mock process.argv for testing
+ * @param {Array} argv - Arguments to set
+ */
+function mockProcessArgv(argv = ['node', 'test']) {
+    const originalArgv = process.argv;
+    jest.spyOn(process, 'argv', 'get').mockReturnValue(argv);
+    
+    return {
+        restore: () => {
+            process.argv = originalArgv;
+        }
+    };
+}
+
+module.exports = {
+    setTestEnvironmentVariables,
+    cleanupTestEnvironmentVariables,
+    setFallbackEnvironmentVariables,
+    createMockSendFunction,
+    createMockServerless,
+    verifyEnvironmentVariables,
+    createMockIntegration,
+    createMockAppDefinition,
+    verifyVpcConfiguration,
+    verifyKmsConfiguration,
+    verifySsmConfiguration,
+    verifyIntegrationConfiguration,
+    wait,
+    captureConsoleOutput,
+    mockProcessArgv
+};

package/infrastructure/aws-discovery.js

@@ -0,0 +1,395 @@
+const { EC2Client, DescribeVpcsCommand, DescribeSubnetsCommand, DescribeSecurityGroupsCommand, DescribeRouteTablesCommand } = require('@aws-sdk/client-ec2');
+const { KMSClient, ListKeysCommand, DescribeKeyCommand } = require('@aws-sdk/client-kms');
+const { STSClient, GetCallerIdentityCommand } = require('@aws-sdk/client-sts');
+
+/**
+ * AWS Resource Discovery utilities for Frigg applications
+ * These functions use AWS credentials to discover default resources during build time
+ */
+class AWSDiscovery {
+    /**
+     * Creates an instance of AWSDiscovery
+     * @param {string} [region='us-east-1'] - AWS region to use for discovery
+     */
+    constructor(region = 'us-east-1') {
+        this.region = region;
+        this.ec2Client = new EC2Client({ region });
+        this.kmsClient = new KMSClient({ region });
+        this.stsClient = new STSClient({ region });
+    }
+
+    /**
+     * Get AWS account ID
+     * @returns {Promise<string>} The AWS account ID
+     * @throws {Error} If unable to retrieve account ID
+     */
+    async getAccountId() {
+        try {
+            const command = new GetCallerIdentityCommand({});
+            const response = await this.stsClient.send(command);
+            return response.Account;
+        } catch (error) {
+            console.error('Error getting AWS account ID:', error);
+            throw error;
+        }
+    }
+
+    /**
+     * Find the default VPC for the account
+     * @returns {Promise<Object>} VPC object containing VpcId and other properties
+     * @throws {Error} If no VPC is found in the account
+     */
+    async findDefaultVpc() {
+        try {
+            const command = new DescribeVpcsCommand({
+                Filters: [
+                    {
+                        Name: 'is-default',
+                        Values: ['true']
+                    }
+                ]
+            });
+            
+            const response = await this.ec2Client.send(command);
+            
+            if (response.Vpcs && response.Vpcs.length > 0) {
+                return response.Vpcs[0];
+            }
+            
+            // If no default VPC, get the first available VPC
+            const allVpcsCommand = new DescribeVpcsCommand({});
+            const allVpcsResponse = await this.ec2Client.send(allVpcsCommand);
+            
+            if (allVpcsResponse.Vpcs && allVpcsResponse.Vpcs.length > 0) {
+                console.log('No default VPC found, using first available VPC');
+                return allVpcsResponse.Vpcs[0];
+            }
+            
+            throw new Error('No VPC found in the account');
+        } catch (error) {
+            console.error('Error finding default VPC:', error);
+            throw error;
+        }
+    }
+
+    /**
+     * Find private subnets for the given VPC
+     * @param {string} vpcId - The VPC ID to search within
+     * @returns {Promise<Array>} Array of subnet objects (at least 2 for high availability)
+     * @throws {Error} If no subnets are found in the VPC
+     */
+    async findPrivateSubnets(vpcId) {
+        try {
+            const command = new DescribeSubnetsCommand({
+                Filters: [
+                    {
+                        Name: 'vpc-id',
+                        Values: [vpcId]
+                    }
+                ]
+            });
+            
+            const response = await this.ec2Client.send(command);
+            
+            if (!response.Subnets || response.Subnets.length === 0) {
+                throw new Error(`No subnets found in VPC ${vpcId}`);
+            }
+
+            // Prefer private subnets (no direct route to IGW)
+            const privateSubnets = [];
+            const publicSubnets = [];
+
+            for (const subnet of response.Subnets) {
+                // Check route tables to determine if subnet is private
+                const isPrivate = await this.isSubnetPrivate(subnet.SubnetId);
+                if (isPrivate) {
+                    privateSubnets.push(subnet);
+                } else {
+                    publicSubnets.push(subnet);
+                }
+            }
+
+            // Return at least 2 subnets for high availability
+            const selectedSubnets = privateSubnets.length >= 2 ? 
+                privateSubnets.slice(0, 2) : 
+                response.Subnets.slice(0, 2);
+
+            return selectedSubnets;
+        } catch (error) {
+            console.error('Error finding private subnets:', error);
+            throw error;
+        }
+    }
+
+    /**
+     * Check if a subnet is private (no direct route to Internet Gateway)
+     * @param {string} subnetId - The subnet ID to check
+     * @returns {Promise<boolean>} True if subnet is private, false if public
+     */
+    async isSubnetPrivate(subnetId) {
+        try {
+            const command = new DescribeRouteTablesCommand({
+                Filters: [
+                    {
+                        Name: 'association.subnet-id',
+                        Values: [subnetId]
+                    }
+                ]
+            });
+            
+            const response = await this.ec2Client.send(command);
+            
+            for (const routeTable of response.RouteTables || []) {
+                for (const route of routeTable.Routes || []) {
+                    // If there's a route to an Internet Gateway, it's a public subnet
+                    if (route.GatewayId && route.GatewayId.startsWith('igw-')) {
+                        return false;
+                    }
+                }
+            }
+            
+            return true; // No IGW route found, assume private
+        } catch (error) {
+            console.warn(`Could not determine if subnet ${subnetId} is private:`, error);
+            return true; // Default to private for safety
+        }
+    }
+
+    /**
+     * Find or create a default security group for Lambda functions
+     * @param {string} vpcId - The VPC ID to search within
+     * @returns {Promise<Object>} Security group object containing GroupId and other properties
+     * @throws {Error} If no security group is found for the VPC
+     */
+    async findDefaultSecurityGroup(vpcId) {
+        try {
+            // First try to find existing Frigg security group
+            const friggSgCommand = new DescribeSecurityGroupsCommand({
+                Filters: [
+                    {
+                        Name: 'vpc-id',
+                        Values: [vpcId]
+                    },
+                    {
+                        Name: 'group-name',
+                        Values: ['frigg-lambda-sg']
+                    }
+                ]
+            });
+            
+            const friggResponse = await this.ec2Client.send(friggSgCommand);
+            if (friggResponse.SecurityGroups && friggResponse.SecurityGroups.length > 0) {
+                return friggResponse.SecurityGroups[0];
+            }
+
+            // Fall back to default security group
+            const defaultSgCommand = new DescribeSecurityGroupsCommand({
+                Filters: [
+                    {
+                        Name: 'vpc-id',
+                        Values: [vpcId]
+                    },
+                    {
+                        Name: 'group-name',
+                        Values: ['default']
+                    }
+                ]
+            });
+            
+            const defaultResponse = await this.ec2Client.send(defaultSgCommand);
+            if (defaultResponse.SecurityGroups && defaultResponse.SecurityGroups.length > 0) {
+                return defaultResponse.SecurityGroups[0];
+            }
+            
+            throw new Error(`No security group found for VPC ${vpcId}`);
+        } catch (error) {
+            console.error('Error finding default security group:', error);
+            throw error;
+        }
+    }
+
+    /**
+     * Find public subnets for NAT Gateway placement
+     * @param {string} vpcId - The VPC ID to search within
+     * @returns {Promise<Object>} First public subnet object for NAT Gateway placement
+     * @throws {Error} If no public subnets are found in the VPC
+     */
+    async findPublicSubnets(vpcId) {
+        try {
+            const command = new DescribeSubnetsCommand({
+                Filters: [
+                    {
+                        Name: 'vpc-id',
+                        Values: [vpcId]
+                    }
+                ]
+            });
+            
+            const response = await this.ec2Client.send(command);
+            
+            if (!response.Subnets || response.Subnets.length === 0) {
+                throw new Error(`No subnets found in VPC ${vpcId}`);
+            }
+
+            // Find public subnets (have direct route to IGW)
+            const publicSubnets = [];
+
+            for (const subnet of response.Subnets) {
+                // Check route tables to determine if subnet is public
+                const isPrivate = await this.isSubnetPrivate(subnet.SubnetId);
+                if (!isPrivate) {
+                    publicSubnets.push(subnet);
+                }
+            }
+
+            if (publicSubnets.length === 0) {
+                throw new Error(`No public subnets found in VPC ${vpcId} for NAT Gateway placement`);
+            }
+
+            // Return first public subnet for NAT Gateway
+            return publicSubnets[0];
+        } catch (error) {
+            console.error('Error finding public subnets:', error);
+            throw error;
+        }
+    }
+
+    /**
+     * Find private route table for VPC endpoints
+     * @param {string} vpcId - The VPC ID to search within
+     * @returns {Promise<Object>} Route table object containing RouteTableId and other properties
+     * @throws {Error} If no route tables are found for the VPC
+     */
+    async findPrivateRouteTable(vpcId) {
+        try {
+            const command = new DescribeRouteTablesCommand({
+                Filters: [
+                    {
+                        Name: 'vpc-id',
+                        Values: [vpcId]
+                    }
+                ]
+            });
+            
+            const response = await this.ec2Client.send(command);
+            
+            if (!response.RouteTables || response.RouteTables.length === 0) {
+                throw new Error(`No route tables found for VPC ${vpcId}`);
+            }
+
+            // Find a route table that doesn't have direct IGW route (private)
+            for (const routeTable of response.RouteTables) {
+                let hasIgwRoute = false;
+                for (const route of routeTable.Routes || []) {
+                    if (route.GatewayId && route.GatewayId.startsWith('igw-')) {
+                        hasIgwRoute = true;
+                        break;
+                    }
+                }
+                if (!hasIgwRoute) {
+                    return routeTable;
+                }
+            }
+
+            // If no private route table found, return the first one
+            return response.RouteTables[0];
+        } catch (error) {
+            console.error('Error finding private route table:', error);
+            throw error;
+        }
+    }
+
+    /**
+     * Find the default KMS key for the account
+     * @returns {Promise<string>} KMS key ARN or wildcard pattern as fallback
+     */
+    async findDefaultKmsKey() {
+        try {
+            // First try to find a key with alias/aws/lambda
+            const command = new ListKeysCommand({});
+            const response = await this.kmsClient.send(command);
+            
+            if (!response.Keys || response.Keys.length === 0) {
+                // Return AWS managed key ARN pattern as fallback
+                const accountId = await this.getAccountId();
+                return `arn:aws:kms:${this.region}:${accountId}:key/*`;
+            }
+
+            // Look for customer managed keys first
+            for (const key of response.Keys) {
+                try {
+                    const describeCommand = new DescribeKeyCommand({ KeyId: key.KeyId });
+                    const keyDetails = await this.kmsClient.send(describeCommand);
+                    
+                    if (keyDetails.KeyMetadata && 
+                        keyDetails.KeyMetadata.KeyManager === 'CUSTOMER' &&
+                        keyDetails.KeyMetadata.KeyState === 'Enabled') {
+                        return keyDetails.KeyMetadata.Arn;
+                    }
+                } catch (error) {
+                    // Continue to next key if we can't describe this one
+                    continue;
+                }
+            }
+
+            // Fallback to wildcard pattern for AWS managed keys
+            const accountId = await this.getAccountId();
+            return `arn:aws:kms:${this.region}:${accountId}:key/*`;
+        } catch (error) {
+            console.error('Error finding default KMS key:', error);
+            // Return wildcard pattern as ultimate fallback
+            return '*';
+        }
+    }
+
+    /**
+     * Discover all AWS resources needed for Frigg deployment
+     * @returns {Promise<Object>} Object containing discovered resource IDs:
+     * @returns {string} return.defaultVpcId - The default VPC ID
+     * @returns {string} return.defaultSecurityGroupId - The default security group ID
+     * @returns {string} return.privateSubnetId1 - First private subnet ID
+     * @returns {string} return.privateSubnetId2 - Second private subnet ID
+     * @returns {string} return.publicSubnetId - Public subnet ID for NAT Gateway
+     * @returns {string} return.privateRouteTableId - Private route table ID
+     * @returns {string} return.defaultKmsKeyId - Default KMS key ARN
+     * @throws {Error} If resource discovery fails
+     */
+    async discoverResources() {
+        try {
+            console.log('Discovering AWS resources for Frigg deployment...');
+            
+            const vpc = await this.findDefaultVpc();
+            console.log(`Found VPC: ${vpc.VpcId}`);
+            
+            const privateSubnets = await this.findPrivateSubnets(vpc.VpcId);
+            console.log(`Found ${privateSubnets.length} private subnets: ${privateSubnets.map(s => s.SubnetId).join(', ')}`);
+            
+            const publicSubnet = await this.findPublicSubnets(vpc.VpcId);
+            console.log(`Found public subnet for NAT Gateway: ${publicSubnet.SubnetId}`);
+            
+            const securityGroup = await this.findDefaultSecurityGroup(vpc.VpcId);
+            console.log(`Found security group: ${securityGroup.GroupId}`);
+            
+            const routeTable = await this.findPrivateRouteTable(vpc.VpcId);
+            console.log(`Found route table: ${routeTable.RouteTableId}`);
+            
+            const kmsKeyArn = await this.findDefaultKmsKey();
+            console.log(`Found KMS key: ${kmsKeyArn}`);
+
+            return {
+                defaultVpcId: vpc.VpcId,
+                defaultSecurityGroupId: securityGroup.GroupId,
+                privateSubnetId1: privateSubnets[0]?.SubnetId,
+                privateSubnetId2: privateSubnets[1]?.SubnetId || privateSubnets[0]?.SubnetId,
+                publicSubnetId: publicSubnet.SubnetId,
+                privateRouteTableId: routeTable.RouteTableId,
+                defaultKmsKeyId: kmsKeyArn
+            };
+        } catch (error) {
+            console.error('Error discovering AWS resources:', error);
+            throw error;
+        }
+    }
+}
+
+module.exports = { AWSDiscovery };