@friggframework/devtools 2.0.0--canary.428.d004aeb.0 → 2.0.0--canary.428.1a6e465.0

package/infrastructure/serverless-template.test.js

@@ -55,6 +55,37 @@ describe('composeServerlessDefinition', () => {
         jest.restoreAllMocks();
         // Restore env
         delete process.env.AWS_REGION;
+        process.argv = ['node', 'test'];
+    });
+
+    describe('AWS discovery gating', () => {
+        it('should skip AWS discovery when no features require it', async () => {
+            AWSDiscovery.mockClear();
+
+            const appDefinition = {
+                integrations: [],
+                vpc: { enable: false },
+                encryption: { fieldLevelEncryptionMethod: 'aes' },
+                ssm: { enable: false },
+            };
+
+            await composeServerlessDefinition(appDefinition);
+
+            expect(AWSDiscovery).not.toHaveBeenCalled();
+        });
+
+        it('should run AWS discovery when VPC features are enabled', async () => {
+            AWSDiscovery.mockClear();
+
+            const appDefinition = {
+                integrations: [],
+                vpc: { enable: true },
+            };
+
+            await composeServerlessDefinition(appDefinition);
+
+            expect(AWSDiscovery).toHaveBeenCalledTimes(1);
+        });
     });
 
     describe('Basic Configuration', () => {
@@ -124,6 +155,38 @@ describe('composeServerlessDefinition', () => {
         });
     });
 
+    describe('Environment variables', () => {
+        it('should include only non-reserved environment flags', async () => {
+            const appDefinition = {
+                integrations: [],
+                environment: {
+                    CUSTOM_FLAG: true,
+                    AWS_REGION: true,
+                    OPTIONAL_DISABLED: false,
+                },
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+
+            expect(result.provider.environment.CUSTOM_FLAG).toBe("${env:CUSTOM_FLAG, ''}");
+            expect(result.provider.environment).not.toHaveProperty('AWS_REGION');
+            expect(result.provider.environment).not.toHaveProperty('OPTIONAL_DISABLED');
+        });
+
+        it('should ignore string-valued environment entries', async () => {
+            const appDefinition = {
+                integrations: [],
+                environment: {
+                    CUSTOM_FLAG: 'enabled',
+                },
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+
+            expect(result.provider.environment).not.toHaveProperty('CUSTOM_FLAG');
+        });
+    });
+
     describe('VPC Configuration', () => {
         it('should add VPC configuration when vpc.enable is true with discover mode', async () => {
             const appDefinition = {
@@ -261,6 +324,49 @@ describe('composeServerlessDefinition', () => {
             expect(result.provider.vpc.subnetIds).toEqual(['subnet-explicit1', 'subnet-explicit2']);
         });
 
+        it('should respect provided security group IDs when supplied', async () => {
+            const appDefinition = {
+                vpc: {
+                    enable: true,
+                    management: 'discover',
+                    securityGroupIds: ['sg-custom-1', 'sg-custom-2'],
+                },
+                integrations: [],
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+
+            expect(result.provider.vpc.securityGroupIds).toEqual([
+                'sg-custom-1',
+                'sg-custom-2',
+            ]);
+        });
+
+        it('should throw when discover mode finds no subnets and self-heal is disabled', async () => {
+            const discoveryInstance = {
+                discoverResources: jest.fn().mockResolvedValue(
+                    createDiscoveryResponse({
+                        privateSubnetId1: null,
+                        privateSubnetId2: null,
+                    })
+                ),
+            };
+            AWSDiscovery.mockImplementation(() => discoveryInstance);
+
+            const appDefinition = {
+                vpc: {
+                    enable: true,
+                    management: 'discover',
+                    subnets: { management: 'discover' },
+                },
+                integrations: [],
+            };
+
+            await expect(composeServerlessDefinition(appDefinition)).rejects.toThrow(
+                'No subnets discovered and subnets.management is "discover". Either enable vpc.selfHeal, set subnets.management to "create", or provide subnet IDs.'
+            );
+        });
+
         it('should use Fn::Cidr for subnet CIDR blocks in new VPC to avoid conflicts', async () => {
             const appDefinition = {
                 vpc: {
@@ -357,6 +463,39 @@ describe('composeServerlessDefinition', () => {
             expect(result.resources.Resources.VPCEndpointS3.Properties.VpcId).toBe('vpc-123456');
         });
 
+        it('should skip creating VPC endpoints when disabled explicitly', async () => {
+            const appDefinition = {
+                vpc: {
+                    enable: true,
+                    management: 'discover',
+                    enableVPCEndpoints: false,
+                },
+                integrations: [],
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+
+            expect(result.resources.Resources.VPCEndpointS3).toBeUndefined();
+            expect(result.resources.Resources.VPCEndpointKMS).toBeUndefined();
+            expect(result.resources.Resources.VPCEndpointSecretsManager).toBeUndefined();
+        });
+
+        it('should add Secrets Manager endpoint only when enabled', async () => {
+            const appDefinition = {
+                vpc: {
+                    enable: true,
+                    management: 'discover',
+                },
+                secretsManager: { enable: true },
+                encryption: { fieldLevelEncryptionMethod: 'kms' },
+                integrations: [],
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+
+            expect(result.resources.Resources.VPCEndpointSecretsManager).toBeDefined();
+        });
+
         it('should allow Lambda security group access for VPC endpoints when security group is discovered', async () => {
             const appDefinition = {
                 vpc: {
@@ -511,6 +650,114 @@ describe('composeServerlessDefinition', () => {
         });
     });
 
+    describe('NAT Gateway behaviour', () => {
+        it('should reuse discovered NAT gateway in discover mode without creating new resources', async () => {
+            const discoveryInstance = {
+                discoverResources: jest.fn().mockResolvedValue(
+                    createDiscoveryResponse({
+                        existingNatGatewayId: 'nat-existing123',
+                        natGatewayInPrivateSubnet: false,
+                    })
+                ),
+            };
+            AWSDiscovery.mockImplementation(() => discoveryInstance);
+
+            const appDefinition = {
+                vpc: {
+                    enable: true,
+                    management: 'discover',
+                    natGateway: { management: 'discover' },
+                },
+                integrations: [],
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+
+            expect(result.resources.Resources.FriggNATGateway).toBeUndefined();
+            expect(result.resources.Resources.FriggNATRoute).toBeDefined();
+        });
+
+        it('should reference provided NAT gateway when management set to useExisting', async () => {
+            const discoveryInstance = {
+                discoverResources: jest.fn().mockResolvedValue(
+                    createDiscoveryResponse({ existingNatGatewayId: null })
+                ),
+            };
+            AWSDiscovery.mockImplementation(() => discoveryInstance);
+
+            const appDefinition = {
+                vpc: {
+                    enable: true,
+                    management: 'discover',
+                    natGateway: { management: 'useExisting', id: 'nat-custom-001' },
+                },
+                integrations: [],
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+
+            expect(result.resources.Resources.FriggNATGateway).toBeUndefined();
+            expect(result.resources.Resources.FriggNATRoute.Properties.NatGatewayId).toBe('nat-custom-001');
+        });
+
+        it('should reuse existing elastic IP allocation when creating managed NAT', async () => {
+            const discoveryInstance = {
+                discoverResources: jest.fn().mockResolvedValue(
+                    createDiscoveryResponse({
+                        existingNatGatewayId: null,
+                        existingElasticIpAllocationId: 'eip-alloc-123',
+                    })
+                ),
+            };
+            AWSDiscovery.mockImplementation(() => discoveryInstance);
+
+            const appDefinition = {
+                vpc: {
+                    enable: true,
+                    management: 'discover',
+                    natGateway: { management: 'createAndManage' },
+                    selfHeal: true,
+                },
+                integrations: [],
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+
+            expect(result.resources.Resources.FriggNATGatewayEIP).toBeUndefined();
+            expect(result.resources.Resources.FriggNATGateway.Properties.AllocationId).toBe(
+                'eip-alloc-123'
+            );
+        });
+
+        it('should create a public subnet when discovery provides none', async () => {
+            const discoveryInstance = {
+                discoverResources: jest.fn().mockResolvedValue(
+                    createDiscoveryResponse({
+                        publicSubnetId: null,
+                        internetGatewayId: null,
+                        existingNatGatewayId: null,
+                    })
+                ),
+            };
+            AWSDiscovery.mockImplementation(() => discoveryInstance);
+
+            const appDefinition = {
+                vpc: {
+                    enable: true,
+                    management: 'discover',
+                    natGateway: { management: 'createAndManage' },
+                    selfHeal: true,
+                },
+                integrations: [],
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+
+            expect(result.resources.Resources.FriggPublicSubnet).toBeDefined();
+            expect(result.resources.Resources.FriggPublicRouteTable).toBeDefined();
+        });
+    });
+
     describe('KMS Configuration', () => {
         it('should add KMS configuration when encryption is enabled and key is found', async () => {
             const appDefinition = {
@@ -913,6 +1160,27 @@ describe('composeServerlessDefinition', () => {
         });
     });
 
+    describe('Handler path adjustments', () => {
+        const fs = require('fs');
+        const path = require('path');
+
+        it('should rewrite handler paths in offline mode', async () => {
+            process.argv = ['node', 'test', 'offline'];
+            const existsSpy = jest.spyOn(fs, 'existsSync');
+            const fallbackNodeModules = path.resolve(process.cwd(), '..', 'node_modules');
+            existsSpy.mockImplementation((p) => p === fallbackNodeModules);
+
+            const appDefinition = { integrations: [] };
+
+            const result = await composeServerlessDefinition(appDefinition);
+
+            expect(existsSpy).toHaveBeenCalled();
+            expect(result.functions.auth.handler.startsWith('../node_modules/')).toBe(true);
+
+            existsSpy.mockRestore();
+        });
+    });
+
     describe('NAT Gateway Management', () => {
         it('should handle NAT Gateway with createAndManage mode', async () => {
             const appDefinition = {
@@ -932,6 +1200,24 @@ describe('composeServerlessDefinition', () => {
             expect(result.resources.Resources.FriggNATRoute).toBeDefined();
         });
 
+        it('should mark managed NAT Gateway resources for retention', async () => {
+            const appDefinition = {
+                vpc: {
+                    enable: true,
+                    management: 'discover',
+                    natGateway: { management: 'createAndManage' },
+                    selfHeal: true,
+                },
+                integrations: [],
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+
+            expect(result.resources.Resources.FriggNATGateway).toBeDefined();
+            expect(result.resources.Resources.FriggNATGateway.DeletionPolicy).toBe('Retain');
+            expect(result.resources.Resources.FriggNATGateway.UpdateReplacePolicy).toBe('Retain');
+        });
+
         it('should handle NAT Gateway with discover mode', async () => {
             // Mock discovery to return existing NAT Gateway
             const { AWSDiscovery } = require('./aws-discovery');

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.428.d004aeb.0",
+  "version": "2.0.0--canary.428.1a6e465.0",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -9,8 +9,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0--canary.428.d004aeb.0",
-    "@friggframework/test": "2.0.0--canary.428.d004aeb.0",
+    "@friggframework/schemas": "2.0.0--canary.428.1a6e465.0",
+    "@friggframework/test": "2.0.0--canary.428.1a6e465.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -32,8 +32,8 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.428.d004aeb.0",
-    "@friggframework/prettier-config": "2.0.0--canary.428.d004aeb.0",
+    "@friggframework/eslint-config": "2.0.0--canary.428.1a6e465.0",
+    "@friggframework/prettier-config": "2.0.0--canary.428.1a6e465.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -68,5 +68,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "d004aeb0c0ca1bd8a94b7f9881dde227862dce9f"
+  "gitHead": "1a6e465d8c4c0d552ca460371a7739b8e06e001e"
 }