@friggframework/devtools 2.0.0--canary.666.81647c4.0 → 2.0.0--canary.668.8e53aa9.0

package/frigg-cli/validate-command/__tests__/validate-command.test.js

@@ -1,241 +0,0 @@
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-
-const { validateCommand, runValidation, preflightValidation } = require('..');
-
-const GOOD_INDEX = `
-class Api { static requesterType = 'apiKey'; }
-const definition = {
-    moduleName: 'acme',
-    API: Api,
-    requiredAuthMethods: {
-        getEntityDetails: async () => {},
-        getCredentialDetails: async () => {},
-        testAuthRequest: async () => {},
-        apiPropertiesToPersist: { credential: ['api_key'], entity: [] },
-    },
-};
-class AcmeIntegration {
-    static Definition = { name: 'acme', version: '1.0.0', modules: { acme: { definition } } };
-}
-module.exports = {
-    Definition: {
-        name: 'frigg-app',
-        integrations: [AcmeIntegration],
-        user: { usePassword: true },
-        encryption: { fieldLevelEncryptionMethod: 'kms', createResourceIfNoneFound: true },
-        database: { postgres: { enable: true, management: 'use-existing', endpoint: 'db.example.com' } },
-        environment: { DATABASE_URL: true },
-    },
-};
-`;
-
-const BAD_INDEX = `
-module.exports = {
-    Definition: {
-        integrations: [{ name: 'not-a-class' }],
-        database: { postgres: { enable: true, management: 'create-new' } },
-        encrpytion: { fieldLevelEncryptionMethod: 'kms' },
-    },
-};
-`;
-
-function backend(indexSource) {
-    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'frigg-validate-'));
-    fs.writeFileSync(path.join(dir, 'package.json'), '{"name":"backend"}');
-    fs.writeFileSync(path.join(dir, 'index.js'), indexSource);
-    return dir;
-}
-
-describe('frigg validate', () => {
-    const dirs = [];
-    let log;
-    let warn;
-    let error;
-    let exit;
-
-    beforeEach(() => {
-        log = jest.spyOn(console, 'log').mockImplementation(() => {});
-        warn = jest.spyOn(console, 'warn').mockImplementation(() => {});
-        error = jest.spyOn(console, 'error').mockImplementation(() => {});
-        exit = jest.spyOn(process, 'exit').mockImplementation(() => {});
-        process.exitCode = undefined;
-    });
-
-    afterEach(() => {
-        jest.restoreAllMocks();
-        process.exitCode = undefined;
-        for (const dir of dirs.splice(0))
-            fs.rmSync(dir, { recursive: true, force: true });
-    });
-
-    const inBackend = (source) => {
-        const dir = backend(source);
-        dirs.push(dir);
-        jest.spyOn(process, 'cwd').mockReturnValue(dir);
-        return dir;
-    };
-
-    it('passes an app with integration classes and exits 0', async () => {
-        inBackend(GOOD_INDEX);
-
-        const report = await validateCommand({ stage: 'prod' });
-
-        expect(report.errors).toEqual([]);
-        expect(process.exitCode).toBeUndefined();
-        expect(log.mock.calls.flat().join('\n')).toContain(
-            'The app definition is valid'
-        );
-    });
-
-    it('prints errors with pointers and hints and exits 1', async () => {
-        inBackend(BAD_INDEX);
-
-        const report = await validateCommand({});
-        const output = log.mock.calls.flat().join('\n');
-
-        expect(process.exitCode).toBe(1);
-        expect(report.errors.map((e) => e.pointer)).toEqual(
-            expect.arrayContaining([
-                '/encrpytion',
-                '/database/postgres/management',
-                '/integrations/0',
-            ])
-        );
-        expect(output).toContain('/encrpytion');
-        expect(output).toContain('Did you mean "encryption"?');
-        expect(output).toContain(
-            'Use one of: "discover", "managed", "use-existing"'
-        );
-    });
-
-    it('--json prints a machine-readable report', async () => {
-        inBackend(BAD_INDEX);
-
-        await validateCommand({ json: true, stage: 'prod' });
-        const json = JSON.parse(log.mock.calls[0][0]);
-
-        expect(json).toEqual(
-            expect.objectContaining({
-                valid: false,
-                stage: 'prod',
-                errors: expect.arrayContaining([
-                    expect.objectContaining({
-                        pointer: '/encrpytion',
-                        code: 'unknown-key',
-                        severity: 'error',
-                    }),
-                ]),
-                warnings: expect.any(Array),
-            })
-        );
-    });
-
-    it('reports a backend that fails to load', () => {
-        const dir = backend("require('./missing-file');");
-        dirs.push(dir);
-
-        const report = runValidation({ cwd: dir });
-
-        expect(report.errors).toEqual([
-            expect.objectContaining({
-                code: 'load-failed',
-                message: expect.stringContaining('missing-file'),
-            }),
-        ]);
-    });
-
-    it('reports a directory without a backend', () => {
-        const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'frigg-empty-'));
-        dirs.push(dir);
-
-        expect(runValidation({ cwd: dir }).errors).toEqual([
-            expect.objectContaining({ code: 'backend-not-found' }),
-        ]);
-    });
-
-    it('finds the backend/ directory from the project root', () => {
-        const root = fs.mkdtempSync(path.join(os.tmpdir(), 'frigg-root-'));
-        dirs.push(root);
-        fs.mkdirSync(path.join(root, 'backend'));
-        fs.writeFileSync(path.join(root, 'backend', 'package.json'), '{}');
-        fs.writeFileSync(path.join(root, 'backend', 'index.js'), GOOD_INDEX);
-
-        expect(runValidation({ cwd: root }).source).toBe(
-            path.join(root, 'backend', 'index.js')
-        );
-    });
-
-    it('reports an index.js without a Definition', () => {
-        const dir = backend('module.exports = {};');
-        dirs.push(dir);
-
-        expect(runValidation({ cwd: dir }).errors).toEqual([
-            expect.objectContaining({ code: 'definition-not-exported' }),
-        ]);
-    });
-
-    describe('preflightValidation', () => {
-        it('stops build/deploy on errors', () => {
-            inBackend(BAD_INDEX);
-
-            const proceed = preflightValidation({
-                command: 'deploy',
-                options: { stage: 'prod' },
-                failOnErrors: true,
-            });
-
-            expect(proceed).toBe(false);
-            expect(exit).toHaveBeenCalledWith(1);
-            expect(error.mock.calls.flat().join('\n')).toContain(
-                '--skip-validate'
-            );
-        });
-
-        it('lets build/deploy continue on a valid definition', () => {
-            inBackend(GOOD_INDEX);
-
-            expect(
-                preflightValidation({
-                    command: 'build',
-                    options: { stage: 'prod' },
-                    failOnErrors: true,
-                })
-            ).toBe(true);
-            expect(exit).not.toHaveBeenCalled();
-        });
-
-        it('only warns for start', () => {
-            inBackend(BAD_INDEX);
-
-            expect(
-                preflightValidation({
-                    command: 'start',
-                    options: {},
-                    failOnErrors: false,
-                })
-            ).toBe(true);
-            expect(exit).not.toHaveBeenCalled();
-            const output = log.mock.calls.flat().join('\n');
-            expect(output).toContain('warning');
-            expect(output).not.toMatch(/^\s+error /m);
-        });
-
-        it('--skip-validate skips validation, loudly', () => {
-            inBackend(BAD_INDEX);
-
-            expect(
-                preflightValidation({
-                    command: 'deploy',
-                    options: { skipValidate: true },
-                    failOnErrors: true,
-                })
-            ).toBe(true);
-            expect(exit).not.toHaveBeenCalled();
-            expect(warn.mock.calls.flat().join('\n')).toContain(
-                'VALIDATION SKIPPED'
-            );
-        });
-    });
-});

package/frigg-cli/validate-command/checks/config.js

@@ -1,468 +0,0 @@
-/**
- * Semantic checks of the app definition: rules JSON Schema cannot express,
- * each tied to what a builder or core does with the value (ADR-051).
- *
- * Every check receives the definition with the schema defaults applied
- * (`definition`) and the definition as written (`raw`), so it can tell a
- * value the app set from a default.
- */
-
-const { getSchema } = require('@friggframework/schemas');
-
-const ENCRYPTION_BYPASS_STAGES = ['dev', 'test', 'local'];
-
-function issue(severity, code, pointer, message, hint) {
-    return { severity, code, pointer, message, hint };
-}
-
-/** Keys the schema marks `deprecated` (nothing reads them) that the app sets. */
-function checkDeprecatedKeys({ raw }) {
-    const issues = [];
-    const walk = (schemaNode, data, pointer) => {
-        if (
-            !schemaNode?.properties ||
-            data === null ||
-            typeof data !== 'object'
-        )
-            return;
-        for (const [key, child] of Object.entries(schemaNode.properties)) {
-            if (data[key] === undefined) continue;
-            const childPointer = `${pointer}/${key}`;
-            if (child.deprecated) {
-                const alias = key === 'password' && pointer === '/user';
-                issues.push(
-                    issue(
-                        'warning',
-                        alias ? 'deprecated-alias' : 'no-effect',
-                        childPointer,
-                        alias
-                            ? 'user.password is the deprecated spelling of user.usePassword.'
-                            : `${childPointer
-                                  .slice(1)
-                                  .replace(
-                                      /\//g,
-                                      '.'
-                                  )} is not read by Frigg: it has no effect.`,
-                        alias ? 'Rename it to usePassword.' : 'Remove it.'
-                    )
-                );
-                continue;
-            }
-            walk(child, data[key], childPointer);
-        }
-    };
-    walk(getSchema('app-definition'), raw, '');
-    return issues;
-}
-
-function checkManagement({ raw }) {
-    const issues = [];
-    const mode = raw.managementMode;
-    const vpc = raw.vpc || {};
-    const postgres = raw.database?.postgres || {};
-
-    if (mode === 'custom') {
-        issues.push(
-            issue(
-                'warning',
-                'no-effect',
-                '/managementMode',
-                "managementMode 'custom' behaves like 'discover'.",
-                "Use 'discover', or remove the key."
-            )
-        );
-    }
-    if (mode === 'managed' && raw.vpcIsolation === undefined) {
-        issues.push(
-            issue(
-                'warning',
-                'ambiguous-default',
-                '/vpcIsolation',
-                "managementMode 'managed' without vpcIsolation: the builders do not agree on a default (some treat it as 'shared', some as 'isolated').",
-                "Set vpcIsolation to 'isolated' (resources per stage) or 'shared'."
-            )
-        );
-    }
-    if (mode === 'managed') {
-        for (const [key, value] of [
-            ['management', vpc.management],
-            ['subnets/management', vpc.subnets?.management],
-            ['natGateway/management', vpc.natGateway?.management],
-            ['shareAcrossStages', vpc.shareAcrossStages],
-        ]) {
-            if (value !== undefined) {
-                issues.push(
-                    issue(
-                        'warning',
-                        'conflicting-settings',
-                        `/vpc/${key}`,
-                        `managementMode 'managed' and vpc.${key.replace(
-                            '/',
-                            '.'
-                        )} are both set. The build logs that it ignores vpc.${key.replace(
-                            '/',
-                            '.'
-                        )}, but the VPC builder still applies it on top of the managed settings.`,
-                        `Remove vpc.${key.replace(
-                            '/',
-                            '.'
-                        )}, or drop managementMode 'managed'.`
-                    )
-                );
-            }
-        }
-    }
-    if (
-        (mode === 'managed' || mode === 'existing') &&
-        postgres.management !== undefined &&
-        postgres.management !== 'external'
-    ) {
-        issues.push(
-            issue(
-                'warning',
-                'no-effect',
-                '/database/postgres/management',
-                `database.postgres.management is ignored when managementMode is '${mode}'.`,
-                'Remove it.'
-            )
-        );
-    }
-
-    for (const [pointer, value, useful] of [
-        [
-            '/vpc/subnets/management',
-            vpc.subnets?.management,
-            "'create' or 'use-existing'",
-        ],
-        [
-            '/vpc/natGateway/management',
-            vpc.natGateway?.management,
-            "'createAndManage', or set natGateway.id",
-        ],
-    ]) {
-        if (['discover', 'create-new', 'existing'].includes(value)) {
-            issues.push(
-                issue(
-                    'warning',
-                    'no-effect',
-                    pointer,
-                    `${pointer
-                        .slice(1)
-                        .replace(
-                            /\//g,
-                            '.'
-                        )} '${value}' has no effect: the VPC builder ignores it.`,
-                    `Use ${useful}, or remove it.`
-                )
-            );
-        }
-    }
-
-    if (
-        vpc.enable === true &&
-        vpc.management === 'use-existing' &&
-        !vpc.vpcId &&
-        !vpc.ownership
-    ) {
-        issues.push(
-            issue(
-                'error',
-                'missing-key',
-                '/vpc/vpcId',
-                "vpc.management 'use-existing' needs vpc.vpcId; the VPC builder fails without it.",
-                'Set vpc.vpcId (vpc-...).'
-            )
-        );
-    }
-    if (
-        vpc.enable === true &&
-        vpc.subnets?.management === 'use-existing' &&
-        !(Array.isArray(vpc.subnets.ids) && vpc.subnets.ids.length >= 2)
-    ) {
-        issues.push(
-            issue(
-                'error',
-                'missing-key',
-                '/vpc/subnets/ids',
-                "vpc.subnets.management 'use-existing' needs at least 2 subnet ids; the VPC builder fails without them.",
-                'Set vpc.subnets.ids.'
-            )
-        );
-    }
-    if (
-        postgres.enable === true &&
-        postgres.management === 'use-existing' &&
-        !postgres.endpoint &&
-        mode !== 'managed' &&
-        mode !== 'existing'
-    ) {
-        issues.push(
-            issue(
-                'error',
-                'missing-key',
-                '/database/postgres/endpoint',
-                "database.postgres.management 'use-existing' needs database.postgres.endpoint; the Aurora builder fails without it.",
-                'Set the endpoint host name.'
-            )
-        );
-    }
-    const provisionsAurora =
-        postgres.enable === true &&
-        postgres.management !== 'use-existing' &&
-        postgres.management !== 'external';
-    if (
-        provisionsAurora &&
-        vpc.enable !== true &&
-        postgres.publiclyAccessible !== true
-    ) {
-        issues.push(
-            issue(
-                'warning',
-                'unreachable-database',
-                '/vpc/enable',
-                'Frigg provisions or discovers a private Aurora cluster, but the Lambda functions run outside a VPC and cannot reach it.',
-                "Set vpc.enable: true, or use database.postgres.management: 'use-existing' with a reachable endpoint."
-            )
-        );
-    }
-    return issues;
-}
-
-function checkDatabase({ raw }) {
-    const database = raw.database;
-    const enabled = ['postgres', 'mongoDB', 'documentDB'].filter(
-        (key) => database?.[key]?.enable === true
-    );
-    if (enabled.length === 0) {
-        return [
-            issue(
-                'error',
-                'no-database',
-                '/database',
-                'No database is enabled. Core refuses to start without one (database.postgres, database.mongoDB or database.documentDB with enable: true).',
-                'Add `database: { postgres: { enable: true } }` (or mongoDB / documentDB).'
-            ),
-        ];
-    }
-    if (enabled.length > 1) {
-        return [
-            issue(
-                'warning',
-                'several-databases',
-                '/database',
-                `Several databases are enabled (${enabled.join(
-                    ', '
-                )}); core uses ${enabled[0]}.`,
-                'Enable only the database the app uses.'
-            ),
-        ];
-    }
-    return [];
-}
-
-function checkEncryption({ raw, stage, env }) {
-    const issues = [];
-    const method = raw.encryption?.fieldLevelEncryptionMethod;
-    const environment = raw.environment || {};
-    const deployedStage = stage && !ENCRYPTION_BYPASS_STAGES.includes(stage);
-
-    if (method === 'aes') {
-        for (const key of ['AES_KEY_ID', 'AES_KEY']) {
-            if (environment[key] !== true) {
-                issues.push(
-                    issue(
-                        'error',
-                        'missing-encryption-env',
-                        `/environment/${key}`,
-                        `fieldLevelEncryptionMethod 'aes' needs ${key} in the Lambda environment, and only keys listed in \`environment\` (as true) reach it. Without it, deployed stages store sensitive fields unencrypted.`,
-                        `Add \`${key}: true\` to environment (it cannot be offloaded to SSM).`
-                    )
-                );
-            } else if (deployedStage && !env[key]) {
-                issues.push(
-                    issue(
-                        'warning',
-                        'missing-env-value',
-                        `/environment/${key}`,
-                        `${key} is not set in this shell; \`frigg deploy --stage ${stage}\` would deploy it empty.`,
-                        `Export ${key} before deploying.`
-                    )
-                );
-            }
-        }
-    }
-    if (
-        method === 'kms' &&
-        raw.managementMode !== 'managed' &&
-        raw.encryption?.createResourceIfNoneFound === undefined &&
-        !raw.encryption?.ownership
-    ) {
-        issues.push(
-            issue(
-                'warning',
-                'kms-key-source',
-                '/encryption/createResourceIfNoneFound',
-                'With no KMS key found by discovery, KMS_KEY_ARN falls back to the AWS_DISCOVERY_KMS_KEY_ID environment variable.',
-                "Set createResourceIfNoneFound: true (or managementMode: 'managed') to let Frigg create the key."
-            )
-        );
-    }
-    if (method === undefined && deployedStage) {
-        issues.push(
-            issue(
-                'warning',
-                'no-field-encryption',
-                '/encryption/fieldLevelEncryptionMethod',
-                `No field-level encryption method: stage '${stage}' stores credentials and tokens unencrypted.`,
-                "Set encryption.fieldLevelEncryptionMethod to 'kms' (Frigg creates the key) or 'aes'."
-            )
-        );
-    }
-    if (
-        method !== undefined &&
-        stage &&
-        ENCRYPTION_BYPASS_STAGES.includes(stage)
-    ) {
-        issues.push(
-            issue(
-                'warning',
-                'encryption-bypassed',
-                '/encryption/fieldLevelEncryptionMethod',
-                `Core skips field-level encryption when STAGE is ${ENCRYPTION_BYPASS_STAGES.join(
-                    ', '
-                )}; stage '${stage}' stores sensitive fields unencrypted even when deployed.`,
-                'Deploy production data to another stage name (e.g. prod).'
-            )
-        );
-    }
-    return issues;
-}
-
-function checkUser({ definition, raw }) {
-    const issues = [];
-    const user = definition.user || {};
-    const authModes = user.authModes;
-
-    if (
-        user.individualUserRequired === false &&
-        user.organizationUserRequired !== true
-    ) {
-        issues.push(
-            issue(
-                'error',
-                'no-login',
-                '/user',
-                'Neither individual nor organization users are required: POST /user/login always fails.',
-                'Set user.individualUserRequired: true (the default) or user.organizationUserRequired: true.'
-            )
-        );
-    }
-    if (
-        raw.user?.organizationUserRequired === true &&
-        raw.user?.individualUserRequired === undefined
-    ) {
-        issues.push(
-            issue(
-                'warning',
-                'default-changed',
-                '/user/individualUserRequired',
-                'individualUserRequired is not set, so it defaults to true: login and x-frigg headers look up an individual user first.',
-                'For organization-only login, set user.individualUserRequired: false.'
-            )
-        );
-    }
-    if (authModes) {
-        const anyMode =
-            authModes.friggToken !== false ||
-            authModes.sharedSecret !== false ||
-            authModes.adopterJwt === true;
-        if (!anyMode) {
-            issues.push(
-                issue(
-                    'error',
-                    'no-auth-mode',
-                    '/user/authModes',
-                    'Every authentication mode is disabled: no request can authenticate.',
-                    'Enable friggToken, sharedSecret or adopterJwt.'
-                )
-            );
-        }
-        if (authModes.adopterJwt === true && !user.jwtConfig?.secret) {
-            issues.push(
-                issue(
-                    'error',
-                    'missing-key',
-                    '/user/jwtConfig/secret',
-                    'authModes.adopterJwt needs user.jwtConfig.secret to verify tokens.',
-                    'Set user.jwtConfig: { secret: process.env.JWT_SECRET }.'
-                )
-            );
-        }
-        if (
-            raw.user?.authModes?.sharedSecret === true &&
-            !raw.environment?.FRIGG_API_KEY
-        ) {
-            issues.push(
-                issue(
-                    'warning',
-                    'missing-env',
-                    '/environment/FRIGG_API_KEY',
-                    'authModes.sharedSecret checks x-frigg-api-key against FRIGG_API_KEY, which is not listed in environment.',
-                    "Add FRIGG_API_KEY: true (or 'ssm') to environment."
-                )
-            );
-        }
-    }
-    return issues;
-}
-
-function checkEnvironment({ raw }) {
-    const issues = [];
-    const environment = raw.environment || {};
-    if (raw.ssm?.enable !== true) {
-        for (const [key, value] of Object.entries(environment)) {
-            if (value === 'ssm') {
-                issues.push(
-                    issue(
-                        'warning',
-                        'ssm-inactive',
-                        `/environment/${key}`,
-                        `${key} is marked 'ssm' but ssm.enable is not true, so it is passed in the Lambda environment instead.`,
-                        'Set ssm: { enable: true } to offload it.'
-                    )
-                );
-            }
-        }
-    }
-    return issues;
-}
-
-const CHECKS = [
-    checkDeprecatedKeys,
-    checkManagement,
-    checkDatabase,
-    checkEncryption,
-    checkUser,
-    checkEnvironment,
-];
-
-/**
- * @param {object} context
- * @param {object} context.definition app definition with defaults applied
- * @param {object} context.raw app definition as written
- * @param {string} [context.stage]
- * @param {object} [context.env]
- */
-function checkConfig({ definition, raw, stage, env = process.env }) {
-    return CHECKS.flatMap((check) => check({ definition, raw, stage, env }));
-}
-
-module.exports = {
-    checkConfig,
-    checkDeprecatedKeys,
-    checkManagement,
-    checkDatabase,
-    checkEncryption,
-    checkUser,
-    checkEnvironment,
-};