@friggframework/devtools 2.0.0--canary.627.ce32cdc.0 → 2.0.0--canary.640.b31eb4a.0

package/infrastructure/domains/admin-scripts/admin-script-builder.test.js

@@ -620,6 +620,319 @@ describe('AdminScriptBuilder', () => {
         });
     });
 
+    describe('reports (ReportQueue + reportExecutor)', () => {
+        it('creates ReportQueue + reportExecutor and wires REPORT_QUEUE_URL when reports are present', async () => {
+            const appDefinition = {
+                reports: [{ Definition: { name: 'my-report', version: '1.0.0' } }],
+            };
+
+            const result = await adminScriptBuilder.build(appDefinition, {});
+
+            // Queue
+            expect(result.resources.ReportQueue).toBeDefined();
+            expect(result.resources.ReportQueue.Type).toBe('AWS::SQS::Queue');
+            expect(
+                result.resources.ReportQueue.Properties.MessageRetentionPeriod
+            ).toBe(86400);
+            expect(
+                result.resources.ReportQueue.Properties.VisibilityTimeout
+            ).toBe(900);
+            expect(
+                result.resources.ReportQueue.Properties.RedrivePolicy
+            ).toEqual({
+                maxReceiveCount: 3,
+                deadLetterTargetArn: {
+                    'Fn::GetAtt': ['InternalErrorQueue', 'Arn'],
+                },
+            });
+
+            // Executor function
+            expect(result.functions.reportExecutor).toBeDefined();
+            expect(result.functions.reportExecutor.handler).toBe(
+                'node_modules/@friggframework/admin-scripts/src/infrastructure/report-executor-handler.handler'
+            );
+            expect(result.functions.reportExecutor.timeout).toBe(900);
+            expect(result.functions.reportExecutor.memorySize).toBe(1024);
+            expect(result.functions.reportExecutor.events).toEqual([
+                {
+                    sqs: {
+                        arn: { 'Fn::GetAtt': ['ReportQueue', 'Arn'] },
+                        batchSize: 1,
+                    },
+                },
+            ]);
+            expect(result.functions.reportExecutor.skipEsbuild).toBe(true);
+            expect(result.functions.reportExecutor.layers).toEqual([
+                { Ref: 'PrismaLambdaLayer' },
+            ]);
+
+            // Env wired app-wide (scoped flag off)
+            expect(result.environment.REPORT_QUEUE_URL).toEqual({
+                Ref: 'ReportQueue',
+            });
+
+            // IAM SendMessage grant on the queue Arn
+            const grant = result.iamStatements.find(
+                (s) =>
+                    Array.isArray(s.Action) &&
+                    s.Action.includes('sqs:SendMessage') &&
+                    s.Resource &&
+                    s.Resource['Fn::GetAtt'] &&
+                    s.Resource['Fn::GetAtt'][0] === 'ReportQueue'
+            );
+            expect(grant).toBeDefined();
+            expect(grant.Action).toContain('sqs:SendMessageBatch');
+        });
+
+        it('scopes REPORT_QUEUE_URL to reportRouter + reportExecutor when scopedEnvironment is on', async () => {
+            const appDefinition = {
+                lambda: { scopedEnvironment: true },
+                reports: [{ Definition: { name: 'my-report', version: '1.0.0' } }],
+            };
+
+            const result = await adminScriptBuilder.build(appDefinition, {});
+
+            expect(result.environment.REPORT_QUEUE_URL).toBeUndefined();
+            for (const fnName of ['reportRouter', 'reportExecutor']) {
+                expect(
+                    result.functionEnvironments[fnName].REPORT_QUEUE_URL
+                ).toEqual({ Ref: 'ReportQueue' });
+            }
+        });
+
+        it('creates ReportQueue + reportExecutor when only builtin reports are enabled', async () => {
+            const appDefinition = {
+                admin: { includeBuiltinReports: true },
+            };
+
+            const result = await adminScriptBuilder.build(appDefinition, {});
+
+            expect(result.resources.ReportQueue).toBeDefined();
+            expect(result.functions.reportExecutor).toBeDefined();
+        });
+
+        it('does NOT create ReportQueue or reportExecutor when only adminScripts are present', async () => {
+            const appDefinition = {
+                adminScripts: [{ Definition: { name: 'test-script' } }],
+            };
+
+            const result = await adminScriptBuilder.build(appDefinition, {});
+
+            expect(result.resources.ReportQueue).toBeUndefined();
+            expect(result.functions.reportExecutor).toBeUndefined();
+            expect(result.functions.reportRouter).toBeUndefined();
+            expect(result.environment.REPORT_QUEUE_URL).toBeUndefined();
+        });
+    });
+
+    describe('report artifacts (ReportArtifactBucket for non-JSON output)', () => {
+        it('provisions a private encrypted bucket + IAM + env when a report emits non-JSON', async () => {
+            const appDefinition = {
+                reports: [
+                    {
+                        Definition: {
+                            name: 'sales-csv',
+                            version: '1.0.0',
+                            output: { format: 'csv' },
+                        },
+                    },
+                ],
+            };
+
+            const result = await adminScriptBuilder.build(appDefinition, {});
+
+            const bucket = result.resources.ReportArtifactBucket;
+            expect(bucket).toBeDefined();
+            expect(bucket.Type).toBe('AWS::S3::Bucket');
+            expect(
+                bucket.Properties.BucketEncryption
+                    .ServerSideEncryptionConfiguration[0]
+                    .ServerSideEncryptionByDefault.SSEAlgorithm
+            ).toBe('AES256');
+            expect(bucket.Properties.PublicAccessBlockConfiguration).toEqual({
+                BlockPublicAcls: true,
+                BlockPublicPolicy: true,
+                IgnorePublicAcls: true,
+                RestrictPublicBuckets: true,
+            });
+
+            // Env wired app-wide (scoped flag off).
+            expect(result.environment.REPORT_ARTIFACT_BUCKET).toEqual({
+                Ref: 'ReportArtifactBucket',
+            });
+
+            // IAM: object-level Put/Get scoped to the bucket keys.
+            const grant = result.iamStatements.find(
+                (s) =>
+                    Array.isArray(s.Action) &&
+                    s.Action.includes('s3:PutObject')
+            );
+            expect(grant).toBeDefined();
+            expect(grant.Action).toContain('s3:GetObject');
+            expect(grant.Resource['Fn::Sub'][0]).toBe('${BucketArn}/*');
+            expect(grant.Resource['Fn::Sub'][1]).toEqual({
+                BucketArn: { 'Fn::GetAtt': ['ReportArtifactBucket', 'Arn'] },
+            });
+        });
+
+        it('does NOT provision the bucket for JSON-only reports', async () => {
+            const appDefinition = {
+                reports: [
+                    {
+                        Definition: {
+                            name: 'json-report',
+                            version: '1.0.0',
+                            output: { format: 'json' },
+                        },
+                    },
+                    // No output field defaults to JSON.
+                    { Definition: { name: 'plain', version: '1.0.0' } },
+                ],
+            };
+
+            const result = await adminScriptBuilder.build(appDefinition, {});
+
+            expect(result.resources.ReportArtifactBucket).toBeUndefined();
+            expect(result.environment.REPORT_ARTIFACT_BUCKET).toBeUndefined();
+            const grant = result.iamStatements.find(
+                (s) =>
+                    Array.isArray(s.Action) &&
+                    s.Action.includes('s3:PutObject')
+            );
+            expect(grant).toBeUndefined();
+        });
+
+        it('scopes REPORT_ARTIFACT_BUCKET to report functions when scopedEnvironment is on', async () => {
+            const appDefinition = {
+                lambda: { scopedEnvironment: true },
+                reports: [
+                    {
+                        Definition: {
+                            name: 'sales-csv',
+                            version: '1.0.0',
+                            output: { format: 'csv' },
+                        },
+                    },
+                ],
+            };
+
+            const result = await adminScriptBuilder.build(appDefinition, {});
+
+            expect(result.environment.REPORT_ARTIFACT_BUCKET).toBeUndefined();
+            for (const fnName of ['reportRouter', 'reportExecutor']) {
+                expect(
+                    result.functionEnvironments[fnName].REPORT_ARTIFACT_BUCKET
+                ).toEqual({ Ref: 'ReportArtifactBucket' });
+            }
+        });
+    });
+
+    describe('report scheduling (enableScheduling && reports)', () => {
+        it('wires the report scheduler env onto reportRouter targeting the report executor', async () => {
+            const appDefinition = {
+                reports: [{ Definition: { name: 'my-report', version: '1.0.0' } }],
+                admin: { enableScheduling: true },
+            };
+
+            const result = await adminScriptBuilder.build(appDefinition, {});
+
+            // Shared scheduler role + group are created even without scripts.
+            expect(result.resources.AdminScriptSchedulerRole).toBeDefined();
+            expect(result.resources.AdminScriptScheduleGroup).toBeDefined();
+
+            const routerEnv = result.functions.reportRouter.environment;
+            expect(routerEnv.SCHEDULER_PROVIDER).toBe('aws');
+            expect(routerEnv.SCHEDULER_ROLE_ARN).toEqual({
+                'Fn::GetAtt': ['AdminScriptSchedulerRole', 'Arn'],
+            });
+            expect(routerEnv.REPORT_SCHEDULE_GROUP).toEqual({
+                Ref: 'AdminScriptScheduleGroup',
+            });
+            // Constructed ARN (Fn::Sub), not Fn::GetAtt — avoids a circular dep.
+            expect(routerEnv.REPORT_EXECUTOR_LAMBDA_ARN).toEqual({
+                'Fn::Sub':
+                    'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${self:service}-${self:provider.stage}-reportExecutor',
+            });
+
+            // Must NOT leak onto the shared provider env.
+            expect(result.environment.SCHEDULER_PROVIDER).toBeUndefined();
+            expect(result.environment.REPORT_EXECUTOR_LAMBDA_ARN).toBeUndefined();
+        });
+
+        it('grants the scheduler role invoke on the report executor (reports-only)', async () => {
+            const appDefinition = {
+                reports: [{ Definition: { name: 'my-report', version: '1.0.0' } }],
+                admin: { enableScheduling: true },
+            };
+
+            const result = await adminScriptBuilder.build(appDefinition, {});
+
+            const statement =
+                result.resources.AdminScriptSchedulerRole.Properties.Policies[0]
+                    .PolicyDocument.Statement[0];
+            // Only reports present -> single Resource, the report executor ARN.
+            expect(statement.Resource).toEqual({
+                'Fn::Sub':
+                    'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${self:service}-${self:provider.stage}-reportExecutor',
+            });
+
+            // scheduler:* + iam:PassRole grants present.
+            const schedulerGrant = result.iamStatements.find(
+                (s) =>
+                    Array.isArray(s.Action) &&
+                    s.Action.includes('scheduler:CreateSchedule')
+            );
+            expect(schedulerGrant).toBeDefined();
+        });
+
+        it('lets the scheduler role invoke BOTH executors when scripts and reports coexist', async () => {
+            const appDefinition = {
+                adminScripts: [{ Definition: { name: 'test-script' } }],
+                reports: [{ Definition: { name: 'my-report', version: '1.0.0' } }],
+                admin: { enableScheduling: true },
+            };
+
+            const result = await adminScriptBuilder.build(appDefinition, {});
+
+            const statement =
+                result.resources.AdminScriptSchedulerRole.Properties.Policies[0]
+                    .PolicyDocument.Statement[0];
+            expect(statement.Resource).toEqual([
+                {
+                    'Fn::Sub':
+                        'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${self:service}-${self:provider.stage}-adminScriptExecutor',
+                },
+                {
+                    'Fn::Sub':
+                        'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${self:service}-${self:provider.stage}-reportExecutor',
+                },
+            ]);
+
+            // Both routers get their own scheduler env.
+            expect(
+                result.functions.adminScriptRouter.environment
+                    .ADMIN_SCRIPT_EXECUTOR_LAMBDA_ARN
+            ).toBeDefined();
+            expect(
+                result.functions.reportRouter.environment
+                    .REPORT_EXECUTOR_LAMBDA_ARN
+            ).toBeDefined();
+        });
+
+        it('does NOT wire report scheduler env when enableScheduling is off', async () => {
+            const appDefinition = {
+                reports: [{ Definition: { name: 'my-report', version: '1.0.0' } }],
+            };
+
+            const result = await adminScriptBuilder.build(appDefinition, {});
+
+            expect(result.resources.AdminScriptSchedulerRole).toBeUndefined();
+            expect(
+                result.functions.reportRouter.environment
+            ).toBeUndefined();
+        });
+    });
+
     describe('getName()', () => {
         it('should return AdminScriptBuilder', () => {
             expect(adminScriptBuilder.getName()).toBe('AdminScriptBuilder');