@friggframework/devtools 2.0.0--canary.461.2ca8c89.0 → 2.0.0--canary.461.4f3c330.0

package/infrastructure/domains/database/aurora-builder.js

@@ -268,17 +268,234 @@ class AuroraBuilder extends InfrastructureBuilder {
 
         console.log(`  ✅ Using discovered Aurora cluster: ${discoveredResources.auroraClusterEndpoint}`);
 
+        const dbConfig = appDefinition.database.postgres;
+
         // Use discovered cluster details
         result.environment.DATABASE_HOST = discoveredResources.auroraClusterEndpoint;
         result.environment.DATABASE_PORT = String(discoveredResources.auroraPort || 5432);
 
-        if (discoveredResources.databaseSecretArn) {
+        // Check if we should auto-create credentials
+        if (dbConfig.autoCreateCredentials && !discoveredResources.databaseSecretArn) {
+            console.log('  Creating Secrets Manager secret and rotating Aurora password...');
+            
+            // Create Secrets Manager secret with auto-generated password
+            result.resources.FriggDBSecret = {
+                Type: 'AWS::SecretsManager::Secret',
+                Properties: {
+                    Name: '${self:service}-${self:provider.stage}-db-credentials',
+                    Description: 'Aurora database credentials (auto-created for discovered cluster)',
+                    GenerateSecretString: {
+                        SecretStringTemplate: JSON.stringify({ username: dbConfig.username || 'postgres' }),
+                        GenerateStringKey: 'password',
+                        PasswordLength: 32,
+                        ExcludeCharacters: '"@/\\',
+                    },
+                    Tags: [
+                        { Key: 'Name', Value: '${self:service}-${self:provider.stage}-db-secret' },
+                        { Key: 'ManagedBy', Value: 'Frigg' },
+                        { Key: 'Purpose', Value: 'DiscoveredClusterCredentials' },
+                    ],
+                },
+            };
+
+            // Get the cluster identifier from the endpoint
+            // Format: cluster-name.cluster-xyz.region.rds.amazonaws.com
+            const clusterIdentifier = discoveredResources.auroraClusterEndpoint.split('.')[0];
+
+            // Create custom resource to rotate the Aurora master password
+            // This uses a Lambda-backed CloudFormation custom resource
+            result.resources.FriggAuroraPasswordRotator = {
+                Type: 'Custom::AuroraPasswordRotator',
+                Properties: {
+                    ServiceToken: { 'Fn::GetAtt': ['PasswordRotatorLambda', 'Arn'] },
+                    ClusterIdentifier: clusterIdentifier,
+                    SecretArn: { Ref: 'FriggDBSecret' },
+                    Region: '${self:provider.region}',
+                },
+                DependsOn: ['FriggDBSecret', 'PasswordRotatorLambda'],
+            };
+
+            // Lambda function to rotate the password
+            result.resources.PasswordRotatorLambda = {
+                Type: 'AWS::Lambda::Function',
+                Properties: {
+                    FunctionName: '${self:service}-${self:provider.stage}-password-rotator',
+                    Runtime: 'nodejs22.x',
+                    Handler: 'index.handler',
+                    Role: { 'Fn::GetAtt': ['PasswordRotatorRole', 'Arn'] },
+                    Timeout: 60,
+                    Code: {
+                        ZipFile: `
+const { RDSClient, ModifyDBClusterCommand } = require('@aws-sdk/client-rds');
+const { SecretsManagerClient, GetSecretValueCommand } = require('@aws-sdk/client-secrets-manager');
+
+exports.handler = async (event, context) => {
+    console.log('Event:', JSON.stringify(event, null, 2));
+    
+    const { RequestType, ResourceProperties } = event;
+    const { ClusterIdentifier, SecretArn, Region } = ResourceProperties;
+    
+    const sendResponse = async (status, data = {}) => {
+        const responseBody = JSON.stringify({
+            Status: status,
+            Reason: data.Reason || 'See CloudWatch logs',
+            PhysicalResourceId: context.logStreamName,
+            StackId: event.StackId,
+            RequestId: event.RequestId,
+            LogicalResourceId: event.LogicalResourceId,
+            Data: data,
+        });
+        
+        await fetch(event.ResponseURL, {
+            method: 'PUT',
+            body: responseBody,
+            headers: { 'Content-Type': '' },
+        });
+    };
+    
+    try {
+        if (RequestType === 'Delete') {
+            await sendResponse('SUCCESS', { Message: 'Delete not required' });
+            return;
+        }
+        
+        // Get the new password from Secrets Manager
+        const smClient = new SecretsManagerClient({ region: Region });
+        const secretResponse = await smClient.send(
+            new GetSecretValueCommand({ SecretId: SecretArn })
+        );
+        const secret = JSON.parse(secretResponse.SecretString);
+        const newPassword = secret.password;
+        
+        // Rotate the Aurora cluster master password
+        const rdsClient = new RDSClient({ region: Region });
+        await rdsClient.send(
+            new ModifyDBClusterCommand({
+                DBClusterIdentifier: ClusterIdentifier,
+                MasterUserPassword: newPassword,
+                ApplyImmediately: true,
+            })
+        );
+        
+        console.log(\`Successfully rotated password for cluster: \${ClusterIdentifier}\`);
+        await sendResponse('SUCCESS', { 
+            Message: 'Password rotated successfully',
+            ClusterIdentifier,
+        });
+    } catch (error) {
+        console.error('Error rotating password:', error);
+        await sendResponse('FAILED', { Reason: error.message });
+    }
+};
+                        `,
+                    },
+                },
+            };
+
+            // IAM role for the password rotator Lambda
+            result.resources.PasswordRotatorRole = {
+                Type: 'AWS::IAM::Role',
+                Properties: {
+                    AssumeRolePolicyDocument: {
+                        Version: '2012-10-17',
+                        Statement: [
+                            {
+                                Effect: 'Allow',
+                                Principal: { Service: 'lambda.amazonaws.com' },
+                                Action: 'sts:AssumeRole',
+                            },
+                        ],
+                    },
+                    ManagedPolicyArns: [
+                        'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole',
+                    ],
+                    Policies: [
+                        {
+                            PolicyName: 'PasswordRotatorPolicy',
+                            PolicyDocument: {
+                                Version: '2012-10-17',
+                                Statement: [
+                                    {
+                                        Effect: 'Allow',
+                                        Action: [
+                                            'rds:ModifyDBCluster',
+                                            'rds:DescribeDBClusters',
+                                        ],
+                                        Resource: '*',
+                                    },
+                                    {
+                                        Effect: 'Allow',
+                                        Action: ['secretsmanager:GetSecretValue'],
+                                        Resource: { Ref: 'FriggDBSecret' },
+                                    },
+                                ],
+                            },
+                        },
+                    ],
+                },
+            };
+
+            // Use the secret for DATABASE_URL
+            result.environment.DATABASE_SECRET_ARN = { Ref: 'FriggDBSecret' };
+            result.environment.DATABASE_URL = this.buildDatabaseUrl(
+                discoveredResources.auroraClusterEndpoint,
+                discoveredResources.auroraPort || 5432,
+                dbConfig.database || 'frigg',
+                { Ref: 'FriggDBSecret' }
+            );
+
+            // Grant Lambda functions permission to read the secret
+            result.iamStatements.push({
+                Effect: 'Allow',
+                Action: ['secretsmanager:GetSecretValue'],
+                Resource: { Ref: 'FriggDBSecret' },
+            });
+
+            console.log('  ✅ Credentials auto-creation configured');
+        } else if (discoveredResources.databaseSecretArn) {
+            // Use existing discovered secret
             result.environment.DATABASE_SECRET_ARN = discoveredResources.databaseSecretArn;
+            result.environment.DATABASE_URL = this.buildDatabaseUrl(
+                discoveredResources.auroraClusterEndpoint,
+                discoveredResources.auroraPort || 5432,
+                dbConfig.database || 'frigg',
+                discoveredResources.databaseSecretArn
+            );
+
             result.iamStatements.push({
                 Effect: 'Allow',
                 Action: ['secretsmanager:GetSecretValue'],
                 Resource: discoveredResources.databaseSecretArn,
             });
+
+            console.log('  ✅ Using discovered Secrets Manager credentials');
+        } else {
+            // No secret and no auto-create - construct DATABASE_URL using environment variables at runtime
+            const dbName = dbConfig.database || 'frigg';
+            
+            // Set individual environment variables for flexible credential management
+            result.environment.DATABASE_HOST = discoveredResources.auroraClusterEndpoint;
+            result.environment.DATABASE_PORT = String(discoveredResources.auroraPort || 5432);
+            result.environment.DATABASE_NAME = dbName;
+            
+            // Build DATABASE_URL using CloudFormation intrinsic functions to reference
+            // the environment variables at runtime (not build time)
+            result.environment.DATABASE_URL = {
+                'Fn::Sub': [
+                    'postgresql://${DatabaseUser}:${DatabasePassword}@${DatabaseHost}:${DatabasePort}/${DatabaseName}',
+                    {
+                        DatabaseUser: '${env:DATABASE_USER, "postgres"}',
+                        DatabasePassword: '${env:DATABASE_PASSWORD}',
+                        DatabaseHost: discoveredResources.auroraClusterEndpoint,
+                        DatabasePort: String(discoveredResources.auroraPort || 5432),
+                        DatabaseName: dbName,
+                    },
+                ],
+            };
+            
+            console.log('  ℹ️  No Secrets Manager secret found - DATABASE_URL will use DATABASE_USER and DATABASE_PASSWORD from environment');
+            console.log('  ℹ️  Set DATABASE_USER and DATABASE_PASSWORD in Lambda environment or via serverless deploy --param');
+            console.log('  ℹ️  Or enable autoCreateCredentials=true to automatically create and rotate credentials');
         }
 
         // Add security group ingress rule to allow Lambda to connect to Aurora

package/infrastructure/domains/database/migration-builder.js

@@ -0,0 +1,138 @@
+/**
+ * Migration Infrastructure Builder
+ * 
+ * Domain Layer - Hexagonal Architecture
+ * 
+ * Responsible for:
+ * - SQS queue for migration jobs
+ * - Migration worker Lambda function (triggered by SQS)
+ * - Migration router Lambda function (HTTP API)
+ * - IAM permissions for SQS
+ * 
+ * Only creates infrastructure when PostgreSQL is enabled.
+ * MongoDB uses `db push` which doesn't require migration queue/worker.
+ */
+
+const { InfrastructureBuilder, ValidationResult } = require('../shared/base-builder');
+
+class MigrationBuilder extends InfrastructureBuilder {
+    constructor() {
+        super();
+        this.name = 'MigrationBuilder';
+    }
+
+    shouldExecute(appDefinition) {
+        // Only create migration infrastructure for PostgreSQL
+        // MongoDB uses `db push` which doesn't need queue/worker
+        // Skip in local mode
+        if (process.env.FRIGG_SKIP_AWS_DISCOVERY === 'true') {
+            return false;
+        }
+
+        // Default to true if not explicitly disabled
+        return appDefinition.database?.postgres?.enable !== false;
+    }
+
+    getDependencies() {
+        return []; // No dependencies - migrations can run independently
+    }
+
+    validate(appDefinition) {
+        const result = new ValidationResult();
+
+        // No specific validation needed - PostgreSQL builder handles DB validation
+        // This builder just creates the migration infrastructure
+
+        return result;
+    }
+
+    /**
+     * Build migration infrastructure
+     */
+    async build(appDefinition, discoveredResources) {
+        console.log(`\n[${this.name}] Configuring database migration infrastructure...`);
+
+        const result = {
+            resources: {},
+            functions: {},
+            iamStatements: [],
+            environment: {},
+        };
+
+        // Create SQS queue for migration jobs
+        result.resources.DbMigrationQueue = {
+            Type: 'AWS::SQS::Queue',
+            Properties: {
+                QueueName: '${self:service}-${self:provider.stage}-DbMigrationQueue',
+                VisibilityTimeout: 900, // 15 minutes for long-running migrations
+                MessageRetentionPeriod: 1209600, // 14 days
+                ReceiveMessageWaitTimeSeconds: 20, // Long polling
+            },
+        };
+
+        console.log('  ✓ Created DbMigrationQueue resource');
+
+        // Create migration worker Lambda (triggered by SQS)
+        result.functions.dbMigrationWorker = {
+            handler: 'node_modules/@friggframework/core/handlers/workers/db-migration.handler',
+            layers: [{ Ref: 'PrismaLambdaLayer' }],
+            skipEsbuild: true,
+            timeout: 900, // 15 minutes for long migrations
+            memorySize: 1024, // Extra memory for Prisma operations
+            reservedConcurrency: 1, // Process one migration at a time (critical for safety)
+            description: 'Database migration worker (triggered by SQS queue)',
+            events: [
+                {
+                    sqs: {
+                        arn: { 'Fn::GetAtt': ['DbMigrationQueue', 'Arn'] },
+                        batchSize: 1, // Process one migration at a time
+                    },
+                },
+            ],
+        };
+
+        console.log('  ✓ Created dbMigrationWorker function');
+
+        // Create migration router Lambda (HTTP API)
+        result.functions.dbMigrationRouter = {
+            handler: 'node_modules/@friggframework/core/handlers/routers/db-migration.handler',
+            layers: [{ Ref: 'PrismaLambdaLayer' }],
+            skipEsbuild: true,
+            timeout: 30, // Router just queues jobs, doesn't run migrations
+            memorySize: 512,
+            description: 'Database migration HTTP API (POST to trigger, GET to check status)',
+            events: [
+                { httpApi: { path: '/db-migrate', method: 'POST' } },
+                { httpApi: { path: '/db-migrate/{processId}', method: 'GET' } },
+            ],
+        };
+
+        console.log('  ✓ Created dbMigrationRouter function');
+
+        // Add queue URL to environment
+        result.environment.DB_MIGRATION_QUEUE_URL = { Ref: 'DbMigrationQueue' };
+
+        console.log('  ✓ Added DB_MIGRATION_QUEUE_URL environment variable');
+
+        // Add IAM permissions for SQS
+        result.iamStatements.push({
+            Effect: 'Allow',
+            Action: [
+                'sqs:SendMessage',
+                'sqs:GetQueueUrl',
+                'sqs:GetQueueAttributes',
+            ],
+            Resource: { 'Fn::GetAtt': ['DbMigrationQueue', 'Arn'] },
+        });
+
+        console.log('  ✓ Added SQS IAM permissions');
+
+        console.log(`[${this.name}] ✅ Migration infrastructure configuration completed`);
+        return result;
+    }
+}
+
+module.exports = {
+    MigrationBuilder,
+};
+

package/infrastructure/domains/database/migration-builder.test.js

@@ -0,0 +1,250 @@
+/**
+ * Tests for MigrationBuilder
+ */
+
+const { MigrationBuilder } = require('./migration-builder');
+
+describe('MigrationBuilder', () => {
+    let builder;
+    let originalEnv;
+
+    beforeEach(() => {
+        builder = new MigrationBuilder();
+        originalEnv = { ...process.env };
+    });
+
+    afterEach(() => {
+        process.env = originalEnv;
+    });
+
+    describe('shouldExecute', () => {
+        it('should return true for PostgreSQL by default', () => {
+            const appDef = {
+                database: {},
+            };
+
+            expect(builder.shouldExecute(appDef)).toBe(true);
+        });
+
+        it('should return true when PostgreSQL is explicitly enabled', () => {
+            const appDef = {
+                database: {
+                    postgres: {
+                        enable: true,
+                    },
+                },
+            };
+
+            expect(builder.shouldExecute(appDef)).toBe(true);
+        });
+
+        it('should return false when PostgreSQL is explicitly disabled', () => {
+            const appDef = {
+                database: {
+                    postgres: {
+                        enable: false,
+                    },
+                },
+            };
+
+            expect(builder.shouldExecute(appDef)).toBe(false);
+        });
+
+        it('should return false in local mode', () => {
+            process.env.FRIGG_SKIP_AWS_DISCOVERY = 'true';
+
+            const appDef = {
+                database: {
+                    postgres: {
+                        enable: true,
+                    },
+                },
+            };
+
+            expect(builder.shouldExecute(appDef)).toBe(false);
+        });
+
+        it('should return true for MongoDB-only (defaults to PostgreSQL)', () => {
+            const appDef = {
+                database: {
+                    mongodb: {
+                        enable: true,
+                    },
+                },
+            };
+
+            expect(builder.shouldExecute(appDef)).toBe(true);
+        });
+    });
+
+    describe('getDependencies', () => {
+        it('should have no dependencies', () => {
+            expect(builder.getDependencies()).toEqual([]);
+        });
+    });
+
+    describe('validate', () => {
+        it('should always return valid', () => {
+            const appDef = {
+                database: {
+                    postgres: {
+                        enable: true,
+                    },
+                },
+            };
+
+            const result = builder.validate(appDef);
+
+            expect(result.valid).toBe(true);
+            expect(result.errors).toEqual([]);
+        });
+    });
+
+    describe('build', () => {
+        it('should create SQS queue resource', async () => {
+            const appDef = {
+                database: {
+                    postgres: {
+                        enable: true,
+                    },
+                },
+            };
+
+            const result = await builder.build(appDef, {});
+
+            expect(result.resources.DbMigrationQueue).toBeDefined();
+            expect(result.resources.DbMigrationQueue.Type).toBe('AWS::SQS::Queue');
+            expect(result.resources.DbMigrationQueue.Properties.QueueName).toBe(
+                '${self:service}-${self:provider.stage}-DbMigrationQueue'
+            );
+            expect(result.resources.DbMigrationQueue.Properties.VisibilityTimeout).toBe(900);
+        });
+
+        it('should create migration worker function', async () => {
+            const appDef = {
+                database: {
+                    postgres: {
+                        enable: true,
+                    },
+                },
+            };
+
+            const result = await builder.build(appDef, {});
+
+            expect(result.functions.dbMigrationWorker).toBeDefined();
+            expect(result.functions.dbMigrationWorker.handler).toBe(
+                'node_modules/@friggframework/core/handlers/workers/db-migration.handler'
+            );
+            expect(result.functions.dbMigrationWorker.timeout).toBe(900);
+            expect(result.functions.dbMigrationWorker.memorySize).toBe(1024);
+            expect(result.functions.dbMigrationWorker.reservedConcurrency).toBe(1);
+            expect(result.functions.dbMigrationWorker.events).toEqual([
+                {
+                    sqs: {
+                        arn: { 'Fn::GetAtt': ['DbMigrationQueue', 'Arn'] },
+                        batchSize: 1,
+                    },
+                },
+            ]);
+        });
+
+        it('should create migration router function', async () => {
+            const appDef = {
+                database: {
+                    postgres: {
+                        enable: true,
+                    },
+                },
+            };
+
+            const result = await builder.build(appDef, {});
+
+            expect(result.functions.dbMigrationRouter).toBeDefined();
+            expect(result.functions.dbMigrationRouter.handler).toBe(
+                'node_modules/@friggframework/core/handlers/routers/db-migration.handler'
+            );
+            expect(result.functions.dbMigrationRouter.timeout).toBe(30);
+            expect(result.functions.dbMigrationRouter.events).toContainEqual({
+                httpApi: { path: '/db-migrate', method: 'POST' },
+            });
+            expect(result.functions.dbMigrationRouter.events).toContainEqual({
+                httpApi: { path: '/db-migrate/{processId}', method: 'GET' },
+            });
+        });
+
+        it('should add queue URL to environment', async () => {
+            const appDef = {
+                database: {
+                    postgres: {
+                        enable: true,
+                    },
+                },
+            };
+
+            const result = await builder.build(appDef, {});
+
+            expect(result.environment.DB_MIGRATION_QUEUE_URL).toEqual({
+                Ref: 'DbMigrationQueue',
+            });
+        });
+
+        it('should add SQS IAM permissions', async () => {
+            const appDef = {
+                database: {
+                    postgres: {
+                        enable: true,
+                    },
+                },
+            };
+
+            const result = await builder.build(appDef, {});
+
+            expect(result.iamStatements).toContainEqual({
+                Effect: 'Allow',
+                Action: [
+                    'sqs:SendMessage',
+                    'sqs:GetQueueUrl',
+                    'sqs:GetQueueAttributes',
+                ],
+                Resource: { 'Fn::GetAtt': ['DbMigrationQueue', 'Arn'] },
+            });
+        });
+
+        it('should include Prisma layer in both functions', async () => {
+            const appDef = {
+                database: {
+                    postgres: {
+                        enable: true,
+                    },
+                },
+            };
+
+            const result = await builder.build(appDef, {});
+
+            expect(result.functions.dbMigrationWorker.layers).toEqual([{ Ref: 'PrismaLambdaLayer' }]);
+            expect(result.functions.dbMigrationRouter.layers).toEqual([{ Ref: 'PrismaLambdaLayer' }]);
+        });
+
+        it('should set skipEsbuild for both functions', async () => {
+            const appDef = {
+                database: {
+                    postgres: {
+                        enable: true,
+                    },
+                },
+            };
+
+            const result = await builder.build(appDef, {});
+
+            expect(result.functions.dbMigrationWorker.skipEsbuild).toBe(true);
+            expect(result.functions.dbMigrationRouter.skipEsbuild).toBe(true);
+        });
+    });
+
+    describe('getName', () => {
+        it('should return MigrationBuilder', () => {
+            expect(builder.getName()).toBe('MigrationBuilder');
+        });
+    });
+});
+

package/infrastructure/infrastructure-composer.js

@@ -12,6 +12,7 @@ const { BuilderOrchestrator } = require('./domains/shared/builder-orchestrator')
 const { VpcBuilder } = require('./domains/networking/vpc-builder');
 const { KmsBuilder } = require('./domains/security/kms-builder');
 const { AuroraBuilder } = require('./domains/database/aurora-builder');
+const { MigrationBuilder } = require('./domains/database/migration-builder');
 const { SsmBuilder } = require('./domains/parameters/ssm-builder');
 const { WebsocketBuilder } = require('./domains/integration/websocket-builder');
 const { IntegrationBuilder } = require('./domains/integration/integration-builder');
@@ -38,6 +39,7 @@ const composeServerlessDefinition = async (AppDefinition) => {
         new VpcBuilder(),
         new KmsBuilder(),
         new AuroraBuilder(),
+        new MigrationBuilder(), // Add migration infrastructure after Aurora
         new SsmBuilder(),
         new WebsocketBuilder(),
         new IntegrationBuilder(),

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.461.2ca8c89.0",
+  "version": "2.0.0--canary.461.4f3c330.0",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -11,8 +11,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0--canary.461.2ca8c89.0",
-    "@friggframework/test": "2.0.0--canary.461.2ca8c89.0",
+    "@friggframework/schemas": "2.0.0--canary.461.4f3c330.0",
+    "@friggframework/test": "2.0.0--canary.461.4f3c330.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -34,8 +34,8 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.461.2ca8c89.0",
-    "@friggframework/prettier-config": "2.0.0--canary.461.2ca8c89.0",
+    "@friggframework/eslint-config": "2.0.0--canary.461.4f3c330.0",
+    "@friggframework/prettier-config": "2.0.0--canary.461.4f3c330.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -70,5 +70,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "2ca8c892d55c02f9040a052d8d077f6f2459e802"
+  "gitHead": "4f3c33010ab48c11f66a630ea72f75afc2e21762"
 }