@friggframework/devtools 2.0.0--canary.490.feacde9.0 → 2.0.0--canary.497.a3f25f9.0

package/infrastructure/domains/networking/vpc-resolver.test.js

@@ -9,7 +9,7 @@ describe('VpcResourceResolver', () => {
     });
 
     describe('resolveVpc', () => {
-        it('should resolve to EXTERNAL with hardcoded vpcId', () => {
+        it('should resolve to EXTERNAL when user specifies external', () => {
             const appDefinition = {
                 vpc: {
                     ownership: { vpc: 'external' },
@@ -22,46 +22,20 @@ describe('VpcResourceResolver', () => {
 
             expect(decision.ownership).toBe(ResourceOwnership.EXTERNAL);
             expect(decision.physicalId).toBe('vpc-external-123');
-            expect(decision.reason).toContain('hardcoded vpcId');
+            expect(decision.reason).toContain('User specified ownership=external');
         });
 
-        it('should resolve to EXTERNAL using discovered VPC when no hardcoded ID', () => {
+        it('should throw when external specified but vpcId missing', () => {
             const appDefinition = {
                 vpc: {
-                    ownership: { vpc: 'external' }
-                    // No external.vpcId provided
-                }
-            };
-            const discovery = {
-                stackManaged: [],
-                external: [],
-                fromCloudFormation: false,
-                defaultVpcId: 'vpc-discovered-123'
-            };
-
-            const decision = resolver.resolveVpc(appDefinition, discovery);
-
-            expect(decision.ownership).toBe(ResourceOwnership.EXTERNAL);
-            expect(decision.physicalId).toBe('vpc-discovered-123');
-            expect(decision.reason).toContain('discovered VPC');
-        });
-
-        it('should throw when external specified but no vpcId and no discovery', () => {
-            const appDefinition = {
-                vpc: {
-                    ownership: { vpc: 'external' }
-                    // No external.vpcId provided
+                    ownership: { vpc: 'external' },
+                    external: {}
                 }
             };
-            const discovery = {
-                stackManaged: [],
-                external: [],
-                fromCloudFormation: false
-                // No defaultVpcId discovered
-            };
+            const discovery = { stackManaged: [], external: [], fromCloudFormation: false };
 
             expect(() => resolver.resolveVpc(appDefinition, discovery)).toThrow(
-                /ownership='external' for VPC requires either/
+                "ownership='external' for vpcId requires external.vpcId"
             );
         });
 
@@ -123,63 +97,22 @@ describe('VpcResourceResolver', () => {
             expect(decision.physicalId).toBe('vpc-external');
         });
 
-        it('should throw error when auto mode finds no VPC (changed behavior)', () => {
+        it('should auto-resolve to STACK when not found (create new)', () => {
             const appDefinition = {
                 vpc: { ownership: { vpc: 'auto' } }
-                // No management specified - defaults to discover
             };
             const discovery = { stackManaged: [], external: [], fromCloudFormation: false };
 
-            // NEW BEHAVIOR: Auto mode with no VPC found should throw error (prevent accidental VPC creation)
-            expect(() => resolver.resolveVpc(appDefinition, discovery)).toThrow(
-                'VPC discovery failed: No VPC found'
-            );
-        });
-
-        it('should throw error when auto mode finds no VPC and management is not create-new', () => {
-            const appDefinition = {
-                vpc: {
-                    enable: true,
-                    // No management specified - defaults to discover
-                    // No ownership specified - defaults to auto
-                }
-            };
-            const discovery = { 
-                stackManaged: [], 
-                external: [], 
-                fromCloudFormation: false 
-            };
-
-            // Should throw error instead of trying to create VPC
-            expect(() => resolver.resolveVpc(appDefinition, discovery)).toThrow(
-                'VPC discovery failed: No VPC found'
-            );
-        });
-
-        it('should allow creating VPC when management is create-new', () => {
-            const appDefinition = {
-                vpc: {
-                    enable: true,
-                    management: 'create-new',
-                    ownership: { vpc: 'auto' }
-                }
-            };
-            const discovery = { 
-                stackManaged: [], 
-                external: [], 
-                fromCloudFormation: false 
-            };
-
-            // Should NOT throw - create-new explicitly allows VPC creation
             const decision = resolver.resolveVpc(appDefinition, discovery);
-            
+
             expect(decision.ownership).toBe(ResourceOwnership.STACK);
-            expect(decision.physicalId).toBeUndefined(); // resolveResourceOwnership returns undefined, not null
+            expect(decision.physicalId).toBeUndefined();
+            expect(decision.reason).toContain('No existing resource found');
         });
     });
 
     describe('resolveSecurityGroup', () => {
-        it('should resolve to EXTERNAL with user-provided hardcoded IDs', () => {
+        it('should resolve to EXTERNAL with user-provided IDs', () => {
             const appDefinition = {
                 vpc: {
                     ownership: { securityGroup: 'external' },
@@ -192,71 +125,6 @@ describe('VpcResourceResolver', () => {
 
             expect(decision.ownership).toBe(ResourceOwnership.EXTERNAL);
             expect(decision.physicalIds).toEqual(['sg-1', 'sg-2']);
-            expect(decision.reason).toContain('hardcoded');
-        });
-
-        it('should resolve to EXTERNAL using discovered default SG when no hardcoded IDs', () => {
-            const appDefinition = {
-                vpc: {
-                    ownership: { securityGroup: 'external' }
-                    // No external.securityGroupIds provided
-                }
-            };
-            const discovery = {
-                stackManaged: [],
-                external: [],
-                fromCloudFormation: false,
-                defaultSecurityGroupId: 'sg-discovered-default'
-            };
-
-            const decision = resolver.resolveSecurityGroup(appDefinition, discovery);
-
-            expect(decision.ownership).toBe(ResourceOwnership.EXTERNAL);
-            expect(decision.physicalIds).toEqual(['sg-discovered-default']);
-            expect(decision.reason).toContain('discovered default security group');
-        });
-
-        it('should throw error when ownership=external but no IDs and no discovery', () => {
-            const appDefinition = {
-                vpc: {
-                    ownership: { securityGroup: 'external' }
-                    // No external.securityGroupIds provided
-                }
-            };
-            const discovery = {
-                stackManaged: [],
-                external: [],
-                fromCloudFormation: false
-                // No defaultSecurityGroupId discovered
-            };
-
-            expect(() => resolver.resolveSecurityGroup(appDefinition, discovery)).toThrow(
-                /ownership='external' for securityGroup requires either/
-            );
-        });
-
-        it('should prefer default SG over stack-managed SG when ownership=external and both discovered', () => {
-            const appDefinition = {
-                vpc: {
-                    ownership: { securityGroup: 'external' }
-                }
-            };
-            const discovery = {
-                stackManaged: [
-                    { logicalId: 'FriggLambdaSecurityGroup', physicalId: 'sg-stack-managed', resourceType: 'AWS::EC2::SecurityGroup' }
-                ],
-                external: [],
-                fromCloudFormation: true,
-                lambdaSecurityGroupId: 'sg-stack-managed', // Stack-managed SG
-                defaultSecurityGroupId: 'sg-default-vpc'   // Default VPC SG
-            };
-
-            const decision = resolver.resolveSecurityGroup(appDefinition, discovery);
-
-            // Should use default SG, NOT the stack-managed one
-            expect(decision.ownership).toBe(ResourceOwnership.EXTERNAL);
-            expect(decision.physicalIds).toEqual(['sg-default-vpc']);
-            expect(decision.reason).toContain('discovered default security group');
         });
 
         it('should auto-resolve to STACK when FriggLambdaSecurityGroup in stack', () => {
@@ -278,7 +146,7 @@ describe('VpcResourceResolver', () => {
     });
 
     describe('resolveSubnets', () => {
-        it('should resolve to EXTERNAL with user-provided hardcoded subnet IDs', () => {
+        it('should resolve to EXTERNAL with user-provided subnet IDs', () => {
             const appDefinition = {
                 vpc: {
                     ownership: { subnets: 'external' },
@@ -291,48 +159,6 @@ describe('VpcResourceResolver', () => {
 
             expect(decision.ownership).toBe(ResourceOwnership.EXTERNAL);
             expect(decision.physicalIds).toEqual(['subnet-1', 'subnet-2', 'subnet-3']);
-            expect(decision.reason).toContain('hardcoded');
-        });
-
-        it('should resolve to EXTERNAL using discovered subnets when no hardcoded IDs', () => {
-            const appDefinition = {
-                vpc: {
-                    ownership: { subnets: 'external' }
-                    // No external.subnetIds provided
-                }
-            };
-            const discovery = {
-                stackManaged: [],
-                external: [],
-                fromCloudFormation: false,
-                privateSubnetId1: 'subnet-discovered-1',
-                privateSubnetId2: 'subnet-discovered-2'
-            };
-
-            const decision = resolver.resolveSubnets(appDefinition, discovery);
-
-            expect(decision.ownership).toBe(ResourceOwnership.EXTERNAL);
-            expect(decision.physicalIds).toEqual(['subnet-discovered-1', 'subnet-discovered-2']);
-            expect(decision.reason).toContain('discovered subnets');
-        });
-
-        it('should throw error when ownership=external but no IDs and no discovery', () => {
-            const appDefinition = {
-                vpc: {
-                    ownership: { subnets: 'external' }
-                    // No external.subnetIds provided
-                }
-            };
-            const discovery = {
-                stackManaged: [],
-                external: [],
-                fromCloudFormation: false
-                // No privateSubnetId1/2 discovered
-            };
-
-            expect(() => resolver.resolveSubnets(appDefinition, discovery)).toThrow(
-                /ownership='external' for subnets requires either/
-            );
         });
 
         it('should resolve to STACK when subnets found in stack', () => {
@@ -401,7 +227,7 @@ describe('VpcResourceResolver', () => {
             expect(decision.reason).toContain('NAT Gateway disabled');
         });
 
-        it('should resolve to EXTERNAL with user-provided hardcoded ID', () => {
+        it('should resolve to EXTERNAL with user-provided ID', () => {
             const appDefinition = {
                 vpc: {
                     ownership: { natGateway: 'external' },
@@ -414,47 +240,6 @@ describe('VpcResourceResolver', () => {
 
             expect(decision.ownership).toBe(ResourceOwnership.EXTERNAL);
             expect(decision.physicalId).toBe('nat-external-123');
-            expect(decision.reason).toContain('hardcoded');
-        });
-
-        it('should resolve to EXTERNAL using discovered NAT when no hardcoded ID', () => {
-            const appDefinition = {
-                vpc: {
-                    ownership: { natGateway: 'external' }
-                    // No external.natGatewayId provided
-                }
-            };
-            const discovery = {
-                stackManaged: [],
-                external: [],
-                fromCloudFormation: false,
-                natGatewayId: 'nat-discovered-123'
-            };
-
-            const decision = resolver.resolveNatGateway(appDefinition, discovery);
-
-            expect(decision.ownership).toBe(ResourceOwnership.EXTERNAL);
-            expect(decision.physicalId).toBe('nat-discovered-123');
-            expect(decision.reason).toContain('discovered NAT gateway');
-        });
-
-        it('should throw error when ownership=external but no ID and no discovery', () => {
-            const appDefinition = {
-                vpc: {
-                    ownership: { natGateway: 'external' }
-                    // No external.natGatewayId provided
-                }
-            };
-            const discovery = {
-                stackManaged: [],
-                external: [],
-                fromCloudFormation: false
-                // No natGatewayId discovered
-            };
-
-            expect(() => resolver.resolveNatGateway(appDefinition, discovery)).toThrow(
-                /ownership='external' for NAT gateway requires either/
-            );
         });
 
         it('should auto-resolve to STACK when found in stack', () => {
@@ -475,82 +260,6 @@ describe('VpcResourceResolver', () => {
     });
 
     describe('resolveVpcEndpoints', () => {
-        it('should skip DynamoDB endpoint when application uses MongoDB', () => {
-            const appDefinition = {
-                vpc: { ownership: { vpcEndpoints: 'auto' } },
-                database: { mongoDB: { enable: true } }, // Using MongoDB, not DynamoDB
-                encryption: { fieldLevelEncryptionMethod: 'kms' }
-            };
-            const discovery = {
-                stackManaged: [],
-                external: [],
-                fromCloudFormation: false
-            };
-
-            const decisions = resolver.resolveVpcEndpoints(appDefinition, discovery);
-
-            expect(decisions.s3.ownership).toBe('stack'); // S3 always needed
-            expect(decisions.dynamodb.ownership).toBeNull(); // DynamoDB NOT needed
-            expect(decisions.dynamodb.reason).toContain('MongoDB/PostgreSQL');
-            expect(decisions.kms.ownership).toBe('stack'); // KMS needed (encryption enabled)
-            expect(decisions.secretsManager.ownership).toBe('stack'); // SM always needed
-            expect(decisions.sqs.ownership).toBe('stack'); // SQS always needed
-        });
-
-        it('should skip DynamoDB endpoint when application uses PostgreSQL', () => {
-            const appDefinition = {
-                vpc: { ownership: { vpcEndpoints: 'auto' } },
-                database: { postgres: { enable: true } }, // Using PostgreSQL, not DynamoDB
-            };
-            const discovery = {
-                stackManaged: [],
-                external: [],
-                fromCloudFormation: false
-            };
-
-            const decisions = resolver.resolveVpcEndpoints(appDefinition, discovery);
-
-            expect(decisions.dynamodb.ownership).toBeNull();
-            expect(decisions.dynamodb.reason).toContain('MongoDB/PostgreSQL');
-        });
-
-        it('should create DynamoDB endpoint when explicitly enabled', () => {
-            const appDefinition = {
-                vpc: { ownership: { vpcEndpoints: 'auto' } },
-                database: { dynamodb: { enable: true } }, // Explicitly using DynamoDB
-            };
-            const discovery = {
-                stackManaged: [],
-                external: [],
-                fromCloudFormation: false
-            };
-
-            const decisions = resolver.resolveVpcEndpoints(appDefinition, discovery);
-
-            expect(decisions.dynamodb.ownership).toBe('stack'); // DynamoDB needed
-        });
-
-        it('should allow deletion of DynamoDB endpoint when not needed', () => {
-            const appDefinition = {
-                vpc: { ownership: { vpcEndpoints: 'auto' } },
-                database: { mongoDB: { enable: true } }, // Using MongoDB (DynamoDB not needed)
-            };
-            const discovery = {
-                stackManaged: [
-                    { logicalId: 'FriggDynamoDBVPCEndpoint', physicalId: 'vpce-ddb-legacy', resourceType: 'AWS::EC2::VPCEndpoint' }
-                ],
-                external: [],
-                fromCloudFormation: true
-            };
-
-            const decisions = resolver.resolveVpcEndpoints(appDefinition, discovery);
-
-            // Should return null (allow CloudFormation to delete it since not needed)
-            expect(decisions.dynamodb.ownership).toBeNull();
-            expect(decisions.dynamodb.reason).toContain('MongoDB/PostgreSQL');
-        });
-
-
         it('should return null decisions when endpoints disabled', () => {
             const appDefinition = {
                 vpc: {
@@ -579,8 +288,7 @@ describe('VpcResourceResolver', () => {
                             dynamodb: 'vpce-ddb-456'
                         }
                     }
-                },
-                database: { dynamodb: { enable: true } } // Enable DynamoDB
+                }
             };
             const discovery = { stackManaged: [], external: [], fromCloudFormation: false };
 
@@ -594,10 +302,7 @@ describe('VpcResourceResolver', () => {
         });
 
         it('should auto-resolve to STACK when endpoints found in stack', () => {
-            const appDefinition = {
-                vpc: { ownership: { vpcEndpoints: 'auto' } },
-                database: { dynamodb: { enable: true } } // Enable DynamoDB
-            };
+            const appDefinition = { vpc: { ownership: { vpcEndpoints: 'auto' } } };
             const discovery = {
                 stackManaged: [
                     { logicalId: 'FriggS3VPCEndpoint', physicalId: 'vpce-s3-stack', resourceType: 'AWS::EC2::VPCEndpoint' },
@@ -618,8 +323,7 @@ describe('VpcResourceResolver', () => {
         it('should auto-resolve mixed: some in stack, some new', () => {
             const appDefinition = {
                 vpc: { ownership: { vpcEndpoints: 'auto' } },
-                encryption: { fieldLevelEncryptionMethod: 'kms' },  // Enable KMS endpoint
-                database: { dynamodb: { enable: true } }  // Enable DynamoDB
+                encryption: { fieldLevelEncryptionMethod: 'kms' }  // Enable KMS endpoint
             };
             const discovery = {
                 stackManaged: [
@@ -716,11 +420,7 @@ describe('VpcResourceResolver', () => {
     describe('real-world scenarios', () => {
         it('scenario: fresh deploy, no resources exist', () => {
             const appDefinition = {
-                vpc: { 
-                    enable: true, 
-                    ownership: {},
-                    management: 'create-new' // Explicitly allow VPC creation
-                }
+                vpc: { enable: true, ownership: {} }
             };
             const discovery = { stackManaged: [], external: [], fromCloudFormation: false };
 

package/infrastructure/domains/security/kms-builder.js

@@ -78,20 +78,8 @@ class KmsBuilder extends InfrastructureBuilder {
         const resolver = new KmsResourceResolver();
         const decisions = resolver.resolveAll(appDefinition, discovery);
 
-        // Check if external key exists (for accurate logging)
-        const externalKmsKey = discoveredResources?.defaultKmsKeyId ||
-                              discoveredResources?.kmsKeyArn ||
-                              discoveredResources?.kmsKeyId;
-        const willUseExternal = decisions.key.ownership === ResourceOwnership.STACK && 
-                                !decisions.key.physicalId && 
-                                externalKmsKey;
-
         console.log('\n  📋 Resource Ownership Decisions:');
-        if (willUseExternal) {
-            console.log(`     Key: external - Found external KMS key (not in stack)`);
-        } else {
-            console.log(`     Key: ${decisions.key.ownership} - ${decisions.key.reason}`);
-        }
+        console.log(`     Key: ${decisions.key.ownership} - ${decisions.key.reason}`);
 
         // Build resources based on ownership decisions
         await this.buildFromDecisions(decisions, appDefinition, discoveredResources, result);
@@ -253,30 +241,13 @@ class KmsBuilder extends InfrastructureBuilder {
         if (decisions.key.ownership === ResourceOwnership.STACK && decisions.key.physicalId) {
             // Key exists in stack - add definitions (CloudFormation idempotency)
             console.log('  → Adding KMS definitions to template (existing in stack)');
-            
-            // CRITICAL: Check if alias exists in stack before trying to create it
-            // Matches old serverless-template.js behavior: only create alias if it doesn't exist
-            const aliasExistsInStack = discoveredResources?.existingLogicalIds?.includes('FriggKMSKeyAlias');
-            if (!aliasExistsInStack) {
-                if (appDefinition.encryption?.kmsKeyAlias !== true) {
-                    // Alias doesn't exist in stack - skip creation unless explicitly enabled
-                    // This avoids kms:CreateAlias permission errors
-                    console.log('  ℹ KMS alias not in stack - skipping creation (set kmsKeyAlias: true to force)');
-                    appDefinition.encryption = appDefinition.encryption || {};
-                    appDefinition.encryption.kmsKeyAlias = false;
-                } else {
-                    console.log('  → Will create KMS alias (kmsKeyAlias: true explicitly set)');
-                }
-            } else {
-                console.log('  ✓ KMS alias found in stack - will keep in template');
-            }
-            
             result.resources = this.createKmsKey(appDefinition);
             result.environment.KMS_KEY_ARN = { 'Fn::GetAtt': ['FriggKMSKey', 'Arn'] };
             console.log('  ✅ KMS key resources created');
         } else if (decisions.key.ownership === ResourceOwnership.STACK && !decisions.key.physicalId && externalKmsKey) {
             // ORPHANED KEY FIX: Key exists externally but not in stack
             // Use it as external instead of trying to create (would fail with "already exists")
+            console.log('  ⚠️  KMS key exists externally but not in stack - using as external resource');
             console.log(`  → Using external KMS key: ${externalKmsKey}`);
 
             // Format as ARN if it's just a key ID
@@ -288,17 +259,6 @@ class KmsBuilder extends InfrastructureBuilder {
         } else if (decisions.key.ownership === ResourceOwnership.STACK && !decisions.key.physicalId && !useEnvVarFallback) {
             // Create new KMS key (only if not using env var fallback and no external key found)
             console.log('  → Creating new KMS key in stack');
-            
-            // CRITICAL: Don't create alias by default to avoid kms:CreateAlias permission errors
-            // Matches old serverless-template.js behavior: only create alias if explicitly requested
-            if (appDefinition.encryption?.kmsKeyAlias !== true) {
-                console.log('  ℹ Skipping KMS alias creation by default (set kmsKeyAlias: true to enable)');
-                appDefinition.encryption = appDefinition.encryption || {};
-                appDefinition.encryption.kmsKeyAlias = false;
-            } else {
-                console.log('  → Will create KMS alias (kmsKeyAlias: true explicitly set)');
-            }
-            
             result.resources = this.createKmsKey(appDefinition);
             result.environment.KMS_KEY_ARN = { 'Fn::GetAtt': ['FriggKMSKey', 'Arn'] };
             console.log('  ✅ KMS key resources created');
@@ -336,7 +296,7 @@ class KmsBuilder extends InfrastructureBuilder {
      * Create KMS key CloudFormation resources
      */
     createKmsKey(appDefinition) {
-        const resources = {
+        return {
             FriggKMSKey: {
                 Type: 'AWS::KMS::Key',
                 DeletionPolicy: 'Retain',
@@ -390,24 +350,15 @@ class KmsBuilder extends InfrastructureBuilder {
                     ],
                 },
             },
-        };
-
-        // Only create alias if explicitly enabled (default: true for backwards compatibility)
-        const createAlias = appDefinition.encryption?.kmsKeyAlias !== false;
-        if (createAlias) {
-            resources.FriggKMSKeyAlias = {
+            FriggKMSKeyAlias: {
                 Type: 'AWS::KMS::Alias',
                 DeletionPolicy: 'Retain',
                 Properties: {
                     AliasName: 'alias/${self:service}-${self:provider.stage}-frigg-kms',
                     TargetKeyId: { 'Fn::GetAtt': ['FriggKMSKey', 'Arn'] },
                 },
-            };
-        } else {
-            console.log('  ℹ Skipping KMS key alias creation (kmsKeyAlias: false)');
-        }
-
-        return resources;
+            },
+        };
     }
 }
 

package/infrastructure/domains/security/kms-builder.test.js

@@ -209,12 +209,11 @@ describe('KmsBuilder', () => {
             expect(result.resources.FriggKMSKey.Type).toBe('AWS::KMS::Key');
         });
 
-        it('should create KMS key alias when explicitly enabled', async () => {
+        it('should create KMS key alias', async () => {
             const appDefinition = {
                 encryption: {
                     fieldLevelEncryptionMethod: 'kms',
                     createResourceIfNoneFound: true,
-                    kmsKeyAlias: true,  // Explicitly enable alias creation
                 },
             };
 
@@ -226,23 +225,6 @@ describe('KmsBuilder', () => {
             expect(result.resources.FriggKMSKeyAlias.Type).toBe('AWS::KMS::Alias');
         });
 
-        it('should skip alias creation when kmsKeyAlias: false', async () => {
-            const appDefinition = {
-                encryption: {
-                    fieldLevelEncryptionMethod: 'kms',
-                    createResourceIfNoneFound: true,
-                    kmsKeyAlias: false,
-                },
-            };
-
-            const discoveredResources = {};
-
-            const result = await kmsBuilder.build(appDefinition, discoveredResources);
-
-            expect(result.resources.FriggKMSKey).toBeDefined();
-            expect(result.resources.FriggKMSKeyAlias).toBeUndefined();
-        });
-
         it('should enable key rotation for new keys', async () => {
             const appDefinition = {
                 encryption: {