@friggframework/devtools 2.0.0--canary.517.b384239.0 → 2.0.0--canary.517.a353e20.0

package/infrastructure/domains/admin-scripts/admin-script-builder.js

@@ -9,6 +9,8 @@
  * - Creating Lambda function for admin API routes (router)
  * - Creating EventBridge Scheduler resources (Phase 2)
  * - Creating IAM roles for scheduler to invoke Lambda
+ * - Granting the router/executor Lambdas IAM permission to send to the queue
+ *   and (when scheduling is enabled) manage EventBridge schedules
  */
 
 const { InfrastructureBuilder, ValidationResult } = require('../shared/base-builder');
@@ -105,6 +107,21 @@ class AdminScriptBuilder extends InfrastructureBuilder {
         };
 
         result.environment.ADMIN_SCRIPT_QUEUE_URL = { Ref: 'AdminScriptQueue' };
+
+        // The router enqueues async executions and scripts enqueue continuations
+        // via queueScript()/queueScriptBatch(). The base role's wildcard does not
+        // cover this queue's name, so grant SendMessage explicitly.
+        result.iamStatements.push({
+            Effect: 'Allow',
+            Action: [
+                'sqs:SendMessage',
+                'sqs:SendMessageBatch',
+                'sqs:GetQueueUrl',
+                'sqs:GetQueueAttributes',
+            ],
+            Resource: { 'Fn::GetAtt': ['AdminScriptQueue', 'Arn'] },
+        });
+
         console.log('  ✓ Created AdminScriptQueue');
     }
 
@@ -205,6 +222,37 @@ class AdminScriptBuilder extends InfrastructureBuilder {
             'Fn::GetAtt': ['AdminScriptExecutorLambdaFunction', 'Arn'],
         };
 
+        // The router manages schedules through the AWS scheduler adapter, so it
+        // needs scheduler:* on this group plus iam:PassRole for the role it hands
+        // to EventBridge. (UpdateSchedule covers the upsert conflict path.)
+        result.iamStatements.push(
+            {
+                Effect: 'Allow',
+                Action: [
+                    'scheduler:CreateSchedule',
+                    'scheduler:UpdateSchedule',
+                    'scheduler:DeleteSchedule',
+                    'scheduler:GetSchedule',
+                ],
+                Resource: {
+                    'Fn::Sub': [
+                        'arn:aws:scheduler:${AWS::Region}:${AWS::AccountId}:schedule/${GroupName}/*',
+                        { GroupName: { Ref: 'AdminScriptScheduleGroup' } },
+                    ],
+                },
+            },
+            {
+                Effect: 'Allow',
+                Action: ['iam:PassRole'],
+                Resource: { 'Fn::GetAtt': ['AdminScriptSchedulerRole', 'Arn'] },
+                Condition: {
+                    StringEquals: {
+                        'iam:PassedToService': 'scheduler.amazonaws.com',
+                    },
+                },
+            }
+        );
+
         console.log('  ✓ Created EventBridge Scheduler resources');
     }
 }

package/infrastructure/domains/admin-scripts/admin-script-builder.test.js

@@ -500,6 +500,79 @@ describe('AdminScriptBuilder', () => {
                 Resource: { 'Fn::GetAtt': ['AdminScriptExecutorLambdaFunction', 'Arn'] },
             });
         });
+
+        it('should grant the router SendMessage on AdminScriptQueue', async () => {
+            const appDefinition = {
+                adminScripts: [{ Definition: { name: 'test-script' } }],
+            };
+
+            const result = await adminScriptBuilder.build(appDefinition, {});
+
+            const sqsGrant = result.iamStatements.find(
+                (s) =>
+                    Array.isArray(s.Action) &&
+                    s.Action.includes('sqs:SendMessage')
+            );
+            expect(sqsGrant).toBeDefined();
+            expect(sqsGrant.Action).toContain('sqs:SendMessageBatch');
+            expect(sqsGrant.Resource).toEqual({
+                'Fn::GetAtt': ['AdminScriptQueue', 'Arn'],
+            });
+        });
+
+        it('should grant scheduler:* + iam:PassRole when scheduling is enabled', async () => {
+            const appDefinition = {
+                adminScripts: [{ Definition: { name: 'test-script' } }],
+                admin: { enableScheduling: true },
+            };
+
+            const result = await adminScriptBuilder.build(appDefinition, {});
+
+            const schedulerGrant = result.iamStatements.find(
+                (s) =>
+                    Array.isArray(s.Action) &&
+                    s.Action.includes('scheduler:CreateSchedule')
+            );
+            expect(schedulerGrant).toBeDefined();
+            expect(schedulerGrant.Action).toEqual(
+                expect.arrayContaining([
+                    'scheduler:CreateSchedule',
+                    'scheduler:UpdateSchedule',
+                    'scheduler:DeleteSchedule',
+                    'scheduler:GetSchedule',
+                ])
+            );
+            expect(schedulerGrant.Resource['Fn::Sub'][1]).toEqual({
+                GroupName: { Ref: 'AdminScriptScheduleGroup' },
+            });
+
+            const passRole = result.iamStatements.find(
+                (s) =>
+                    Array.isArray(s.Action) && s.Action.includes('iam:PassRole')
+            );
+            expect(passRole).toBeDefined();
+            expect(passRole.Resource).toEqual({
+                'Fn::GetAtt': ['AdminScriptSchedulerRole', 'Arn'],
+            });
+            expect(passRole.Condition.StringEquals['iam:PassedToService']).toBe(
+                'scheduler.amazonaws.com'
+            );
+        });
+
+        it('should add no scheduler IAM statements when scheduling is disabled', async () => {
+            const appDefinition = {
+                adminScripts: [{ Definition: { name: 'test-script' } }],
+            };
+
+            const result = await adminScriptBuilder.build(appDefinition, {});
+
+            const schedulerGrant = result.iamStatements.find(
+                (s) =>
+                    Array.isArray(s.Action) &&
+                    s.Action.some((a) => a.startsWith('scheduler:'))
+            );
+            expect(schedulerGrant).toBeUndefined();
+        });
     });
 
     describe('getName()', () => {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.517.b384239.0",
+  "version": "2.0.0--canary.517.a353e20.0",
   "bin": {
     "frigg": "./frigg-cli/index.js"
   },
@@ -25,9 +25,9 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/core": "2.0.0--canary.517.b384239.0",
-    "@friggframework/schemas": "2.0.0--canary.517.b384239.0",
-    "@friggframework/test": "2.0.0--canary.517.b384239.0",
+    "@friggframework/core": "2.0.0--canary.517.a353e20.0",
+    "@friggframework/schemas": "2.0.0--canary.517.a353e20.0",
+    "@friggframework/test": "2.0.0--canary.517.a353e20.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.18.0",
@@ -55,8 +55,8 @@
     "validate-npm-package-name": "^5.0.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.517.b384239.0",
-    "@friggframework/prettier-config": "2.0.0--canary.517.b384239.0",
+    "@friggframework/eslint-config": "2.0.0--canary.517.a353e20.0",
+    "@friggframework/prettier-config": "2.0.0--canary.517.a353e20.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -88,5 +88,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "b384239f327baa975cb82c0f63888e67f40160c3"
+  "gitHead": "a353e204564567f210a23149f4fa7fdb6d779d72"
 }