@friggframework/devtools 2.0.0--canary.640.b31eb4a.0 → 2.0.0--canary.640.5140601.0

package/infrastructure/__tests__/aurora-scale-to-zero-connectivity.test.js

@@ -57,9 +57,15 @@ describe('ADR-033: Aurora scale-to-zero + connectivity', () => {
     describe('validator (AuroraBuilder.validate)', () => {
         const build = new AuroraBuilder();
         // ValidationResult exposes hasErrors(); "valid" means no errors.
-        const validateResult = (postgres) =>
-            build.validate({ database: { postgres: { enable: true, ...postgres } } });
-        const isValid = (postgres) => !validateResult(postgres).hasErrors();
+        // vpc.enable defaults to true so connectivity:'public' cases don't trip the
+        // "public requires vpc.enable" rule; pass appOverrides to change it.
+        const validateResult = (postgres, appOverrides = {}) =>
+            build.validate({
+                vpc: { enable: true },
+                database: { postgres: { enable: true, ...postgres } },
+                ...appOverrides,
+            });
+        const isValid = (postgres, appOverrides) => !validateResult(postgres, appOverrides).hasErrors();
 
         test('accepts minCapacity: 0 (scale-to-zero)', () => {
             expect(isValid({ minCapacity: 0 })).toBe(true);
@@ -102,6 +108,57 @@ describe('ADR-033: Aurora scale-to-zero + connectivity', () => {
             expect(isValid({ allowedCidrs: ['10.0.0.0/8', '203.0.113.5/32'] })).toBe(true);
         });
 
+        test('rejects out-of-range CIDR octets/prefix (numeric, not just shape)', () => {
+            expect(isValid({ allowedCidrs: ['999.999.999.999/99'] })).toBe(false);
+            expect(isValid({ allowedCidrs: ['10.0.0.0/33'] })).toBe(false);
+            expect(isValid({ allowedCidrs: ['256.1.1.1/24'] })).toBe(false);
+            expect(isValid({ allowedCidrs: ['0.0.0.0/0'] })).toBe(true);
+        });
+
+        test('rejects empty allowedCidrs in public mode (no silent full-internet fallback)', () => {
+            const r = validateResult({ connectivity: 'public', allowedCidrs: [] });
+            expect(r.hasErrors()).toBe(true);
+            expect(r.errors.join(' ')).toMatch(/allowedCidrs is empty with connectivity="public"/);
+        });
+
+        test('rejects minCapacity > maxCapacity', () => {
+            const r = validateResult({ minCapacity: 8, maxCapacity: 4 });
+            expect(r.hasErrors()).toBe(true);
+            expect(r.errors.join(' ')).toMatch(/minCapacity \(8\) must be <= maxCapacity \(4\)/);
+            // equal is fine
+            expect(isValid({ minCapacity: 4, maxCapacity: 4 })).toBe(true);
+        });
+
+        test("connectivity:'public' requires vpc.enable=true", () => {
+            const r = validateResult({ connectivity: 'public' }, { vpc: { enable: false } });
+            expect(r.hasErrors()).toBe(true);
+            expect(r.errors.join(' ')).toMatch(/connectivity="public" requires vpc\.enable=true/);
+            // With vpc.enable true (default helper), it's valid
+            expect(isValid({ connectivity: 'public' })).toBe(true);
+        });
+
+        test('warns when secondsUntilAutoPause set with minCapacity !== 0', () => {
+            const r = validateResult({ minCapacity: 0.5, secondsUntilAutoPause: 3600 });
+            expect(r.hasErrors()).toBe(false);
+            expect(r.warnings.join(' ')).toMatch(/secondsUntilAutoPause is ignored unless minCapacity is 0/);
+            // No such warning when minCapacity is 0
+            const r0 = validateResult({ minCapacity: 0, secondsUntilAutoPause: 3600 });
+            expect(r0.warnings.join(' ')).not.toMatch(/ignored unless minCapacity is 0/);
+        });
+
+        test("warns (not errors) for connectivity:'public' with discover/use-existing management", () => {
+            const rDiscover = validateResult({ connectivity: 'public', management: 'discover' });
+            expect(rDiscover.hasErrors()).toBe(false);
+            expect(rDiscover.warnings.join(' ')).toMatch(/assumes the EXISTING Aurora cluster is already publicly accessible/);
+
+            const rUseExisting = validateResult({
+                connectivity: 'public',
+                management: 'use-existing',
+                endpoint: 'db.example.com',
+            });
+            expect(rUseExisting.warnings.join(' ')).toMatch(/only affects TLS/);
+        });
+
         test('warns (does not fail) when minCapacity:0 with an older pinned engine version', () => {
             const r = validateResult({ minCapacity: 0, engineVersion: '15.4' });
             expect(r.hasErrors()).toBe(false); // warning, not error
@@ -188,6 +245,45 @@ describe('ADR-033: Aurora scale-to-zero + connectivity', () => {
             expect(nats).toHaveLength(0);
         });
 
+        test('public subnets get an IGW default route + route table + both associations (create-new VPC)', async () => {
+            const t = await composeServerlessDefinition(makeApp({ connectivity: 'public' }));
+            const R = t.resources.Resources;
+
+            // Public route table
+            expect(R.FriggPublicRouteTable).toBeDefined();
+            expect(R.FriggPublicRouteTable.Type).toBe('AWS::EC2::RouteTable');
+
+            // 0.0.0.0/0 -> Internet Gateway default route
+            const igwRoutes = findResources(
+                t,
+                (r) =>
+                    r.Type === 'AWS::EC2::Route' &&
+                    r.Properties.DestinationCidrBlock === '0.0.0.0/0' &&
+                    r.Properties.GatewayId &&
+                    r.Properties.GatewayId.Ref === 'FriggInternetGateway'
+            );
+            expect(igwRoutes).toHaveLength(1);
+
+            // Both public subnet associations
+            expect(R.FriggPublicSubnet1RouteTableAssociation).toBeDefined();
+            expect(R.FriggPublicSubnet2RouteTableAssociation).toBeDefined();
+            expect(R.FriggPublicSubnet1RouteTableAssociation.Properties.RouteTableId).toEqual({
+                Ref: 'FriggPublicRouteTable',
+            });
+
+            // And there must be NO NAT route (that would imply a NAT default route)
+            const natRoutes = findResources(
+                t,
+                (r) => r.Type === 'AWS::EC2::Route' && r.Properties.NatGatewayId
+            );
+            expect(natRoutes).toHaveLength(0);
+        });
+
+        test('VPC_ENABLED is false in public mode (Lambda not VPC-attached)', async () => {
+            const t = await composeServerlessDefinition(makeApp({ connectivity: 'public' }));
+            expect(t.provider.environment.VPC_ENABLED).toBe('false');
+        });
+
         test('Lambda is NOT attached to the VPC (provider.vpc unset)', async () => {
             const t = await composeServerlessDefinition(makeApp({ connectivity: 'public' }));
             expect(t.provider.vpc).toBeUndefined();
@@ -251,5 +347,10 @@ describe('ADR-033: Aurora scale-to-zero + connectivity', () => {
             const url = t.provider.environment.DATABASE_URL;
             expect(url['Fn::Sub'][0]).not.toContain('sslmode=require');
         });
+
+        test('VPC_ENABLED stays true in vpc mode', async () => {
+            const t = await composeServerlessDefinition(makeApp());
+            expect(t.provider.environment.VPC_ENABLED).toBe('true');
+        });
     });
 });

package/infrastructure/domains/database/aurora-builder.js

@@ -107,6 +107,17 @@ class AuroraBuilder extends InfrastructureBuilder {
         if (dbConfig.maxCapacity !== undefined && (dbConfig.maxCapacity < 0.5 || dbConfig.maxCapacity > 128)) {
             result.addError('database.postgres.maxCapacity must be between 0.5 and 128');
         }
+        // Cross-check: minCapacity must not exceed maxCapacity, or CloudFormation
+        // rejects the ServerlessV2ScalingConfiguration at deploy time.
+        if (
+            dbConfig.minCapacity !== undefined &&
+            dbConfig.maxCapacity !== undefined &&
+            dbConfig.minCapacity > dbConfig.maxCapacity
+        ) {
+            result.addError(
+                `database.postgres.minCapacity (${dbConfig.minCapacity}) must be <= maxCapacity (${dbConfig.maxCapacity})`
+            );
+        }
 
         // Validate scale-to-zero auto-pause window (seconds). AWS-valid range is
         // 300–86400 (5 minutes to 24 hours) and it must be an integer.
@@ -115,6 +126,12 @@ class AuroraBuilder extends InfrastructureBuilder {
             if (!Number.isInteger(s) || s < 300 || s > 86400) {
                 result.addError('database.postgres.secondsUntilAutoPause must be an integer between 300 and 86400');
             }
+            // secondsUntilAutoPause only takes effect for scale-to-zero clusters.
+            if (dbConfig.minCapacity !== 0) {
+                result.addWarning(
+                    'database.postgres.secondsUntilAutoPause is ignored unless minCapacity is 0 (scale-to-zero).'
+                );
+            }
         }
 
         // Validate connectivity mode. 'vpc' (default) keeps today's behavior;
@@ -129,20 +146,37 @@ class AuroraBuilder extends InfrastructureBuilder {
             }
         }
 
-        // Validate allowedCidrs is an array of CIDR-looking strings when present.
+        // Public connectivity requires an enabled VPC (Aurora must live in a VPC —
+        // an AWS constraint — and the builder creates the public subnets there).
+        // Validate it here so the failure is a clear message rather than a downstream
+        // "Aurora requires 2 public subnets" throw.
+        if (dbConfig.connectivity === 'public' && appDefinition.vpc?.enable !== true) {
+            result.addError(
+                'database.postgres.connectivity="public" requires vpc.enable=true (Aurora needs public subnets in a VPC).'
+            );
+        }
+
+        // Validate allowedCidrs is an array of syntactically valid IPv4 CIDRs when
+        // present. NOTE: IPv4 only — IPv6 (CidrIpv6) is not supported here.
         if (dbConfig.allowedCidrs !== undefined) {
-            const cidrPattern = /^([0-9]{1,3}\.){3}[0-9]{1,3}\/[0-9]{1,2}$/;
             if (!Array.isArray(dbConfig.allowedCidrs)) {
                 result.addError('database.postgres.allowedCidrs must be an array of CIDR strings');
             } else {
-                const bad = dbConfig.allowedCidrs.filter(
-                    (c) => typeof c !== 'string' || !cidrPattern.test(c)
-                );
+                const bad = dbConfig.allowedCidrs.filter((c) => !this.isValidIpv4Cidr(c));
                 if (bad.length > 0) {
                     result.addError(
                         `database.postgres.allowedCidrs contains invalid CIDR value(s): ${bad.join(', ')}`
                     );
                 }
+                // An empty allowlist in public mode is almost always a mistake that
+                // would silently fall back to 0.0.0.0/0 (full internet exposure) —
+                // reject it so "allow nothing" cannot mean "allow everything".
+                if (dbConfig.allowedCidrs.length === 0 && dbConfig.connectivity === 'public') {
+                    result.addError(
+                        'database.postgres.allowedCidrs is empty with connectivity="public". List at least one CIDR ' +
+                            "(use ['0.0.0.0/0'] to intentionally allow the whole internet)."
+                    );
+                }
             }
         }
 
@@ -171,18 +205,67 @@ class AuroraBuilder extends InfrastructureBuilder {
                 'database.postgres.connectivity="public" exposes the Aurora endpoint to the internet. ' +
                     'TLS is enforced (sslmode=require) and access is restricted to allowedCidrs, but prefer "vpc" for production.'
             );
-            const cidrs = Array.isArray(dbConfig.allowedCidrs) ? dbConfig.allowedCidrs : ['0.0.0.0/0'];
+            // Only the default fallback (empty array is now an error above) or an
+            // explicit 0.0.0.0/0 reaches here as "whole internet".
+            const cidrs =
+                Array.isArray(dbConfig.allowedCidrs) && dbConfig.allowedCidrs.length > 0
+                    ? dbConfig.allowedCidrs
+                    : ['0.0.0.0/0'];
             if (cidrs.includes('0.0.0.0/0')) {
                 result.addWarning(
                     'database.postgres.allowedCidrs allows 0.0.0.0/0 (the whole internet). ' +
                         'Narrow this to known egress ranges wherever the deployment can.'
                 );
             }
+
+            // Public connectivity only makes Frigg place the cluster in public
+            // subnets when Frigg CREATES the cluster (management='managed'). In
+            // discover/use-existing mode Frigg cannot flip an existing cluster to
+            // public subnets / PubliclyAccessible, yet the Lambda is still detached
+            // from the VPC — so if the existing cluster is private it becomes
+            // unreachable. Warn loudly. (management defaults to 'discover'.)
+            const mgmt = dbConfig.management || 'discover';
+            if (mgmt === 'discover' || mgmt === 'use-existing') {
+                result.addWarning(
+                    `database.postgres.connectivity="public" with management="${mgmt}" assumes the EXISTING Aurora cluster ` +
+                        'is already publicly accessible. Frigg detaches the Lambda from the VPC in public mode, so a private ' +
+                        'existing cluster will be unreachable. Ensure the cluster has a public endpoint and open security group.'
+                );
+            }
+            if (mgmt === 'use-existing') {
+                result.addWarning(
+                    'database.postgres.connectivity="public" with management="use-existing" only affects TLS (sslmode=require) on the ' +
+                        'connection string — Frigg does not manage the existing cluster\'s subnets or ingress.'
+                );
+            }
         }
 
         return result;
     }
 
+    /**
+     * Validate an IPv4 CIDR string with real numeric range checks (each octet
+     * 0–255, prefix 0–32) — not just shape — so values like 999.999.999.999/99
+     * are rejected. IPv4 only; IPv6 is out of scope for allowedCidrs.
+     * @param {string} cidr
+     * @returns {boolean}
+     */
+    isValidIpv4Cidr(cidr) {
+        if (typeof cidr !== 'string') {
+            return false;
+        }
+        const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})\/(\d{1,2})$/.exec(cidr);
+        if (!match) {
+            return false;
+        }
+        const octets = [match[1], match[2], match[3], match[4]].map(Number);
+        if (octets.some((o) => o > 255)) {
+            return false;
+        }
+        const prefix = Number(match[5]);
+        return prefix >= 0 && prefix <= 32;
+    }
+
     /**
      * Determine whether an Aurora PostgreSQL engine version supports
      * Serverless v2 scale-to-zero (minCapacity: 0). Minimum capable versions:
@@ -429,9 +512,14 @@ class AuroraBuilder extends InfrastructureBuilder {
             }
         }
 
-        // Preserve other database config.
-        // NOTE: use `!== undefined` (not truthiness) so a requested minCapacity
-        // of 0 (scale-to-zero) flows through instead of being dropped.
+        // Mirror config into translated.database.postgres.config for completeness.
+        // NOTE: this is NOT the load-bearing path — createNewAurora/discoverAurora
+        // read the TOP-LEVEL database.postgres fields (preserved by the deep clone
+        // above), and 0-propagation for scale-to-zero comes from that clone plus the
+        // `?? 0.5` in the scaling config, not from here. These `.config.*` copies are
+        // kept only so any future consumer that reads `config` sees the same values;
+        // `!== undefined` (not truthiness) is used so a minCapacity of 0 is mirrored
+        // rather than dropped.
         if (appDefinition.database?.postgres?.minCapacity !== undefined) {
             translated.database.postgres.config.minCapacity = appDefinition.database.postgres.minCapacity;
         }
@@ -679,6 +767,12 @@ class AuroraBuilder extends InfrastructureBuilder {
             throw new Error('database.postgres.endpoint is required when management="use-existing"');
         }
 
+        // ADR-033: for use-existing, `connectivity` only affects TLS on the
+        // connection params — Frigg does not own the cluster, so it manages neither
+        // its subnets nor its ingress (the validator warns about this). Public mode
+        // still requires TLS, so append sslmode=require.
+        const publicConnectivity = dbConfig.connectivity === 'public';
+
         // Set environment variables for existing cluster
         result.environment.DATABASE_HOST = dbConfig.endpoint;
         result.environment.DATABASE_PORT = String(dbConfig.port || 5432);
@@ -687,7 +781,9 @@ class AuroraBuilder extends InfrastructureBuilder {
         // Consumers that build DATABASE_URL from components at runtime MUST
         // append `?${DATABASE_URL_PARAMS}` to get the same hang-prevention
         // timeouts as the managed path.
-        result.environment.DATABASE_URL_PARAMS = LAMBDA_DATABASE_URL_QUERY_PARAMS;
+        result.environment.DATABASE_URL_PARAMS = publicConnectivity
+            ? `${LAMBDA_DATABASE_URL_QUERY_PARAMS}&sslmode=require`
+            : LAMBDA_DATABASE_URL_QUERY_PARAMS;
 
         console.log(`  ✅ Using existing cluster: ${dbConfig.endpoint}`);
     }

package/infrastructure/domains/database/aurora-builder.test.js

@@ -194,7 +194,7 @@ describe('AuroraBuilder', () => {
             const result = auroraBuilder.validate(appDefinition);
 
             expect(result.valid).toBe(false);
-            expect(result.errors.some(e => e.includes('minCapacity must be between 0.5 and 128'))).toBe(true);
+            expect(result.errors.some(e => e.includes('minCapacity must be 0 (scale-to-zero) or between 0.5 and 128'))).toBe(true);
         });
 
         it('should error when maxCapacity is out of range', () => {

package/infrastructure/domains/networking/vpc-builder.js

@@ -603,6 +603,34 @@ class VpcBuilder extends InfrastructureBuilder {
             console.log(
                 '  ⊝ NAT Gateway skipped (database.postgres.connectivity=public — Lambda is not VPC-attached, so no NAT is needed)'
             );
+
+            // ADR-033: the public subnets Aurora sits in still need an Internet
+            // Gateway default route + subnet→route-table associations to be
+            // internet-routable. Those are normally emitted only as a SIDE EFFECT
+            // of the NAT build (createPublicRouting is called from inside the NAT
+            // methods), so skipping NAT would otherwise leave the public subnets on
+            // the VPC main route table (local-only) and the public Aurora endpoint
+            // unreachable — a green deploy with a dead DB. Decouple the public-subnet
+            // routing from NAT here.
+            //
+            // GUARD: only do this for a Frigg-created (stack) VPC — signalled by the
+            // presence of FriggInternetGateway in the template (emitted by
+            // buildVpcFromDecision only for STACK ownership). createPublicRouting
+            // references { Ref: 'FriggInternetGateway' } and DependsOn
+            // 'FriggVPCGatewayAttachment', and associates the stack-created
+            // FriggPublicSubnet* — all of which exist only in that case. For a
+            // discovered/existing VPC, its public subnets already route to an IGW, so
+            // creating our own public route table would be redundant/conflicting.
+            if (result.resources.FriggInternetGateway) {
+                console.log(
+                    '  → Public-subnet routing (IGW default route + associations) for stack-created VPC'
+                );
+                this.createPublicRouting(appDefinition, discoveredResources, result);
+            } else {
+                console.log(
+                    '  ℹ Public connectivity on a discovered/existing VPC — assuming its public subnets already route to an Internet Gateway; not creating conflicting routing'
+                );
+            }
         } else {
             // Build NAT Gateway based on ownership decision
             this.buildNatGatewayFromDecision(decisions.natGateway, appDefinition, discoveredResources, result);
@@ -620,8 +648,10 @@ class VpcBuilder extends InfrastructureBuilder {
             this.buildVpcEndpointsFromDecisions(decisions.vpcEndpoints, decisions.securityGroup, appDefinition, discoveredResources, result);
         }
 
-        // Set VPC_ENABLED environment variable
-        result.environment.VPC_ENABLED = 'true';
+        // Set VPC_ENABLED environment variable.
+        // ADR-033: in public connectivity the Lambda is NOT attached to the VPC, so
+        // report VPC_ENABLED=false — otherwise /health would misreport isInVpc:true.
+        result.environment.VPC_ENABLED = publicDbConnectivity ? 'false' : 'true';
 
         console.log(`\n[${this.name}] ✅ VPC infrastructure built successfully`);
         console.log(`  - VPC ID: ${result.vpcId || 'from discovery'}`);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.640.b31eb4a.0",
+  "version": "2.0.0--canary.640.5140601.0",
   "bin": {
     "frigg": "./frigg-cli/index.js"
   },
@@ -26,9 +26,9 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/core": "2.0.0--canary.640.b31eb4a.0",
-    "@friggframework/schemas": "2.0.0--canary.640.b31eb4a.0",
-    "@friggframework/test": "2.0.0--canary.640.b31eb4a.0",
+    "@friggframework/core": "2.0.0--canary.640.5140601.0",
+    "@friggframework/schemas": "2.0.0--canary.640.5140601.0",
+    "@friggframework/test": "2.0.0--canary.640.5140601.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.18.0",
@@ -56,8 +56,8 @@
     "validate-npm-package-name": "^5.0.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.640.b31eb4a.0",
-    "@friggframework/prettier-config": "2.0.0--canary.640.b31eb4a.0",
+    "@friggframework/eslint-config": "2.0.0--canary.640.5140601.0",
+    "@friggframework/prettier-config": "2.0.0--canary.640.5140601.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -89,5 +89,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "b31eb4a3ddaeae1044d98050b6a436f6d9c08db6"
+  "gitHead": "51406015cf670753915e87f84a29f2d6067cd5be"
 }