@friggframework/devtools 2.0.0--canary.461.4f3c330.0 → 2.0.0--canary.461.8f65f96.0

package/infrastructure/domains/database/aurora-builder.js

@@ -377,7 +377,7 @@ exports.handler = async (event, context) => {
             })
         );
         
-        console.log(\`Successfully rotated password for cluster: \${ClusterIdentifier}\`);
+        console.log('Successfully rotated password for cluster: ' + ClusterIdentifier);
         await sendResponse('SUCCESS', { 
             Message: 'Password rotated successfully',
             ClusterIdentifier,

package/infrastructure/domains/database/aurora-builder.test.js

@@ -343,6 +343,161 @@ describe('AuroraBuilder', () => {
             expect(result.resources.FriggAuroraIngressRule.Properties.ToPort).toBe(5432);
             expect(result.resources.FriggAuroraIngressRule.Properties.SourceSecurityGroupId).toEqual({ Ref: 'FriggLambdaSecurityGroup' });
         });
+
+        describe('autoCreateCredentials', () => {
+            it('should create Secrets Manager secret and password rotator when autoCreateCredentials is enabled', async () => {
+                const appDefinition = {
+                    database: {
+                        postgres: {
+                            enable: true,
+                            management: 'discover',
+                            autoCreateCredentials: true,
+                            username: 'postgres',
+                            database: 'frigg',
+                        },
+                    },
+                };
+
+                const discoveredResources = {
+                    auroraClusterEndpoint: 'quo-aurora-cluster.cluster-abc123.us-east-1.rds.amazonaws.com',
+                    auroraPort: 5432,
+                };
+
+                const result = await auroraBuilder.build(appDefinition, discoveredResources);
+
+                // Check secret creation
+                expect(result.resources.FriggDBSecret).toBeDefined();
+                expect(result.resources.FriggDBSecret.Type).toBe('AWS::SecretsManager::Secret');
+                expect(result.resources.FriggDBSecret.Properties.GenerateSecretString.SecretStringTemplate).toContain('postgres');
+                expect(result.resources.FriggDBSecret.Properties.GenerateSecretString.PasswordLength).toBe(32);
+
+                // Check password rotator Lambda
+                expect(result.resources.PasswordRotatorLambda).toBeDefined();
+                expect(result.resources.PasswordRotatorLambda.Type).toBe('AWS::Lambda::Function');
+                expect(result.resources.PasswordRotatorLambda.Properties.Runtime).toBe('nodejs22.x');
+
+                // Check custom resource
+                expect(result.resources.FriggAuroraPasswordRotator).toBeDefined();
+                expect(result.resources.FriggAuroraPasswordRotator.Type).toBe('Custom::AuroraPasswordRotator');
+                expect(result.resources.FriggAuroraPasswordRotator.Properties.ClusterIdentifier).toBe('quo-aurora-cluster');
+
+                // Check IAM role
+                expect(result.resources.PasswordRotatorRole).toBeDefined();
+                expect(result.resources.PasswordRotatorRole.Type).toBe('AWS::IAM::Role');
+
+                // Check DATABASE_URL uses the secret
+                expect(result.environment.DATABASE_URL).toBeDefined();
+                expect(result.environment.DATABASE_URL['Fn::Sub']).toBeDefined();
+                expect(result.environment.DATABASE_URL['Fn::Sub'][1].Username).toContain('resolve:secretsmanager');
+                expect(result.environment.DATABASE_URL['Fn::Sub'][1].Password).toContain('resolve:secretsmanager');
+
+                // Check IAM permissions for secret access
+                const secretPermission = result.iamStatements.find(stmt =>
+                    stmt.Action.includes('secretsmanager:GetSecretValue')
+                );
+                expect(secretPermission).toBeDefined();
+            });
+
+            it('should not create credentials when autoCreateCredentials is false', async () => {
+                const appDefinition = {
+                    database: {
+                        postgres: {
+                            enable: true,
+                            management: 'discover',
+                            autoCreateCredentials: false,
+                        },
+                    },
+                };
+
+                const discoveredResources = {
+                    auroraClusterEndpoint: 'cluster.abc.us-east-1.rds.amazonaws.com',
+                    auroraPort: 5432,
+                };
+
+                const result = await auroraBuilder.build(appDefinition, discoveredResources);
+
+                // Should not create secret or rotator
+                expect(result.resources.FriggDBSecret).toBeUndefined();
+                expect(result.resources.PasswordRotatorLambda).toBeUndefined();
+                expect(result.resources.FriggAuroraPasswordRotator).toBeUndefined();
+                expect(result.resources.PasswordRotatorRole).toBeUndefined();
+
+                // DATABASE_URL should use env variables
+                expect(result.environment.DATABASE_URL).toBeDefined();
+                expect(result.environment.DATABASE_URL['Fn::Sub']).toBeDefined();
+                expect(result.environment.DATABASE_URL['Fn::Sub'][1].DatabaseUser).toContain('env:DATABASE_USER');
+                expect(result.environment.DATABASE_URL['Fn::Sub'][1].DatabasePassword).toContain('env:DATABASE_PASSWORD');
+            });
+
+            it('should not create credentials when secret is already discovered', async () => {
+                const appDefinition = {
+                    database: {
+                        postgres: {
+                            enable: true,
+                            management: 'discover',
+                            autoCreateCredentials: true, // Enabled, but secret already exists
+                        },
+                    },
+                };
+
+                const discoveredResources = {
+                    auroraClusterEndpoint: 'cluster.abc.us-east-1.rds.amazonaws.com',
+                    auroraPort: 5432,
+                    databaseSecretArn: 'arn:aws:secretsmanager:us-east-1:123:secret:existing-secret',
+                };
+
+                const result = await auroraBuilder.build(appDefinition, discoveredResources);
+
+                // Should use existing secret, not create new one
+                expect(result.resources.FriggDBSecret).toBeUndefined();
+                expect(result.resources.PasswordRotatorLambda).toBeUndefined();
+                expect(result.environment.DATABASE_SECRET_ARN).toBe('arn:aws:secretsmanager:us-east-1:123:secret:existing-secret');
+            });
+
+            it('should extract correct cluster identifier from endpoint', async () => {
+                const appDefinition = {
+                    database: {
+                        postgres: {
+                            enable: true,
+                            management: 'discover',
+                            autoCreateCredentials: true,
+                        },
+                    },
+                };
+
+                const discoveredResources = {
+                    auroraClusterEndpoint: 'my-cluster-name.cluster-xyz123.us-west-2.rds.amazonaws.com',
+                    auroraPort: 5432,
+                };
+
+                const result = await auroraBuilder.build(appDefinition, discoveredResources);
+
+                expect(result.resources.FriggAuroraPasswordRotator.Properties.ClusterIdentifier).toBe('my-cluster-name');
+            });
+
+            it('should set DATABASE_HOST, DATABASE_PORT, DATABASE_NAME when autoCreateCredentials is enabled', async () => {
+                const appDefinition = {
+                    database: {
+                        postgres: {
+                            enable: true,
+                            management: 'discover',
+                            autoCreateCredentials: true,
+                            database: 'mydb',
+                        },
+                    },
+                };
+
+                const discoveredResources = {
+                    auroraClusterEndpoint: 'cluster.abc.us-east-1.rds.amazonaws.com',
+                    auroraPort: 5432,
+                };
+
+                const result = await auroraBuilder.build(appDefinition, discoveredResources);
+
+                expect(result.environment.DATABASE_HOST).toBe('cluster.abc.us-east-1.rds.amazonaws.com');
+                expect(result.environment.DATABASE_PORT).toBe('5432');
+            });
+        });
     });
 
     describe('build() - create-new mode', () => {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.461.4f3c330.0",
+  "version": "2.0.0--canary.461.8f65f96.0",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -11,8 +11,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0--canary.461.4f3c330.0",
-    "@friggframework/test": "2.0.0--canary.461.4f3c330.0",
+    "@friggframework/schemas": "2.0.0--canary.461.8f65f96.0",
+    "@friggframework/test": "2.0.0--canary.461.8f65f96.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -34,8 +34,8 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.461.4f3c330.0",
-    "@friggframework/prettier-config": "2.0.0--canary.461.4f3c330.0",
+    "@friggframework/eslint-config": "2.0.0--canary.461.8f65f96.0",
+    "@friggframework/prettier-config": "2.0.0--canary.461.8f65f96.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -70,5 +70,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "4f3c33010ab48c11f66a630ea72f75afc2e21762"
+  "gitHead": "8f65f96aa1317fa9ab104de69b229e751dea2694"
 }