@friggframework/devtools 2.0.0-next.11 → 2.0.0-next.110

package/infrastructure/domains/parameters/ssm-builder.test.js

@@ -0,0 +1,346 @@
+/**
+ * Tests for SSM Builder
+ * 
+ * Tests SSM Parameter Store configuration
+ */
+
+const { SsmBuilder } = require('./ssm-builder');
+const { ValidationResult } = require('../shared/base-builder');
+
+describe('SsmBuilder', () => {
+    let ssmBuilder;
+
+    beforeEach(() => {
+        ssmBuilder = new SsmBuilder();
+        delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+    });
+
+    afterEach(() => {
+        delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+    });
+
+    describe('shouldExecute()', () => {
+        it('should return true when SSM is enabled', () => {
+            const appDefinition = {
+                ssm: { enable: true },
+            };
+
+            expect(ssmBuilder.shouldExecute(appDefinition)).toBe(true);
+        });
+
+        it('should return false when SSM is disabled', () => {
+            const appDefinition = {
+                ssm: { enable: false },
+            };
+
+            expect(ssmBuilder.shouldExecute(appDefinition)).toBe(false);
+        });
+
+        it('should return false when SSM is not defined', () => {
+            const appDefinition = {};
+
+            expect(ssmBuilder.shouldExecute(appDefinition)).toBe(false);
+        });
+
+        it('should return false when FRIGG_SKIP_AWS_DISCOVERY is set (local mode)', () => {
+            process.env.FRIGG_SKIP_AWS_DISCOVERY = 'true';
+            const appDefinition = {
+                ssm: { enable: true },
+            };
+
+            expect(ssmBuilder.shouldExecute(appDefinition)).toBe(false);
+        });
+    });
+
+    describe('validate()', () => {
+        it('should pass validation for valid SSM config', () => {
+            const appDefinition = {
+                ssm: {
+                    enable: true,
+                },
+            };
+
+            const result = ssmBuilder.validate(appDefinition);
+
+            expect(result).toBeInstanceOf(ValidationResult);
+            expect(result.valid).toBe(true);
+            expect(result.errors).toEqual([]);
+        });
+
+        it('should pass validation with parameters object', () => {
+            const appDefinition = {
+                ssm: {
+                    enable: true,
+                    parameters: {
+                        SERVICE_TOKEN: '/my-app/service-token',
+                        API_KEY: '/my-app/api-key',
+                    },
+                },
+            };
+
+            const result = ssmBuilder.validate(appDefinition);
+
+            expect(result.valid).toBe(true);
+        });
+
+        it('should error if SSM configuration is missing', () => {
+            const appDefinition = {};
+
+            const result = ssmBuilder.validate(appDefinition);
+
+            expect(result.valid).toBe(false);
+            expect(result.errors).toContain('SSM configuration is missing');
+        });
+
+        it('should error if parameters is not an object', () => {
+            const appDefinition = {
+                ssm: {
+                    enable: true,
+                    parameters: 'invalid',
+                },
+            };
+
+            const result = ssmBuilder.validate(appDefinition);
+
+            expect(result.valid).toBe(false);
+            expect(result.errors.some(e => e.includes('ssm.parameters must be an object'))).toBe(true);
+        });
+
+        it('should error if parameters is an array', () => {
+            const appDefinition = {
+                ssm: {
+                    enable: true,
+                    parameters: ['param1', 'param2'],
+                },
+            };
+
+            const result = ssmBuilder.validate(appDefinition);
+
+            expect(result.valid).toBe(false);
+            expect(result.errors.some(e => e.includes('ssm.parameters must be an object'))).toBe(true);
+        });
+
+        it('should error when keys are marked for offload but ssm.enable is not true', () => {
+            const appDefinition = {
+                ssm: { enable: false },
+                environment: { FOO: 'ssm' },
+            };
+
+            const result = ssmBuilder.validate(appDefinition);
+
+            expect(result.valid).toBe(false);
+            expect(result.errors.some(e => e.includes('ssm.enable is not true'))).toBe(true);
+        });
+
+        it('should error when a blocklisted key is marked for offload', () => {
+            const appDefinition = {
+                ssm: { enable: true },
+                environment: { DATABASE_URL: 'ssm' },
+            };
+
+            const result = ssmBuilder.validate(appDefinition);
+
+            expect(result.valid).toBe(false);
+            expect(result.errors.some(e => e.includes('DATABASE_URL'))).toBe(true);
+        });
+
+        it('should error when an invalid env name is marked for offload', () => {
+            const appDefinition = {
+                ssm: { enable: true },
+                environment: { 'bad-name': 'ssm' },
+            };
+
+            const result = ssmBuilder.validate(appDefinition);
+
+            expect(result.valid).toBe(false);
+            expect(result.errors.some(e => e.includes('bad-name'))).toBe(true);
+        });
+    });
+
+    describe('build()', () => {
+        it('should add IAM permissions for SSM operations', async () => {
+            const appDefinition = {
+                ssm: {
+                    enable: true,
+                },
+            };
+
+            const result = await ssmBuilder.build(appDefinition, {});
+
+            expect(result.iamStatements).toHaveLength(1);
+            expect(result.iamStatements[0]).toEqual({
+                Effect: 'Allow',
+                Action: [
+                    'ssm:GetParameter',
+                    'ssm:GetParameters',
+                    'ssm:GetParametersByPath',
+                ],
+                Resource: {
+                    'Fn::Sub': 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/*',
+                },
+            });
+        });
+
+        it('should return environment object even if empty', async () => {
+            const appDefinition = {
+                ssm: {
+                    enable: true,
+                },
+            };
+
+            const result = await ssmBuilder.build(appDefinition, {});
+
+            expect(result.environment).toBeDefined();
+            expect(typeof result.environment).toBe('object');
+        });
+
+        it('should not depend on discovered resources', async () => {
+            const appDefinition = {
+                ssm: {
+                    enable: true,
+                },
+            };
+
+            const result1 = await ssmBuilder.build(appDefinition, {});
+            const result2 = await ssmBuilder.build(appDefinition, { someResource: 'value' });
+
+            expect(result1.iamStatements).toEqual(result2.iamStatements);
+        });
+
+        it('should return empty environment when no keys are offloaded', async () => {
+            const appDefinition = {
+                ssm: { enable: true },
+            };
+
+            const result = await ssmBuilder.build(appDefinition, {});
+
+            expect(result.environment).toEqual({});
+            expect(result.iamStatements).toHaveLength(1);
+        });
+    });
+
+    describe('build() - offload active', () => {
+        it('should add prefix and offloaded keys env vars', async () => {
+            const appDefinition = {
+                ssm: { enable: true },
+                environment: { FOO: 'ssm', BAR: 'ssm' },
+            };
+
+            const result = await ssmBuilder.build(appDefinition, {});
+
+            expect(result.environment.SSM_PARAMETER_PREFIX).toBe(
+                '/frigg/${self:service}/${self:provider.stage}'
+            );
+            expect(result.environment.FRIGG_SSM_OFFLOADED_KEYS).toBe('BAR,FOO');
+        });
+
+        it('does not set NODE_OPTIONS globally (the composer scopes it to skipEsbuild functions)', async () => {
+            const appDefinition = {
+                ssm: { enable: true },
+                environment: { FOO: 'ssm' },
+            };
+
+            const result = await ssmBuilder.build(appDefinition, {});
+
+            // NODE_OPTIONS=--import would fatally abort esbuild-bundled functions
+            // that lack the preload file, so it must never be provider-global.
+            expect(result.environment.NODE_OPTIONS).toBeUndefined();
+        });
+
+        it('should add a prefix-scoped read statement while retaining the broad grant by default', async () => {
+            const appDefinition = {
+                ssm: { enable: true },
+                environment: { FOO: 'ssm' },
+            };
+
+            const result = await ssmBuilder.build(appDefinition, {});
+
+            const broad = result.iamStatements.find(
+                s => s.Resource && s.Resource['Fn::Sub'] === 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/*'
+            );
+            expect(broad).toBeDefined();
+
+            const scoped = result.iamStatements.find(
+                s => s.Resource === 'arn:aws:ssm:${self:provider.region}:${aws:accountId}:parameter/frigg/${self:service}/${self:provider.stage}/*'
+            );
+            expect(scoped).toBeDefined();
+            expect(scoped.Action).toEqual([
+                'ssm:GetParameter',
+                'ssm:GetParameters',
+                'ssm:GetParametersByPath',
+            ]);
+        });
+
+        it('should drop the broad grant when restrictIamToPrefix is set', async () => {
+            const appDefinition = {
+                ssm: { enable: true, restrictIamToPrefix: true },
+                environment: { FOO: 'ssm' },
+            };
+
+            const result = await ssmBuilder.build(appDefinition, {});
+
+            const broad = result.iamStatements.find(
+                s => s.Resource && s.Resource['Fn::Sub']
+            );
+            expect(broad).toBeUndefined();
+
+            const scoped = result.iamStatements.find(
+                s => s.Resource === 'arn:aws:ssm:${self:provider.region}:${aws:accountId}:parameter/frigg/${self:service}/${self:provider.stage}/*'
+            );
+            expect(scoped).toBeDefined();
+        });
+
+        it('should add kms:Decrypt when kmsKeyArn is set', async () => {
+            const appDefinition = {
+                ssm: {
+                    enable: true,
+                    kmsKeyArn: 'arn:aws:kms:us-east-1:123456789012:key/abc-123',
+                },
+                environment: { FOO: 'ssm' },
+            };
+
+            const result = await ssmBuilder.build(appDefinition, {});
+
+            const decrypt = result.iamStatements.find(
+                s => Array.isArray(s.Action) && s.Action.includes('kms:Decrypt')
+            );
+            expect(decrypt).toEqual({
+                Effect: 'Allow',
+                Action: ['kms:Decrypt'],
+                Resource: 'arn:aws:kms:us-east-1:123456789012:key/abc-123',
+            });
+        });
+
+        it('should honor a custom parameterPrefix', async () => {
+            const appDefinition = {
+                ssm: { enable: true, parameterPrefix: '/custom/${self:provider.stage}' },
+                environment: { FOO: 'ssm' },
+            };
+
+            const result = await ssmBuilder.build(appDefinition, {});
+
+            expect(result.environment.SSM_PARAMETER_PREFIX).toBe(
+                '/custom/${self:provider.stage}'
+            );
+            const scoped = result.iamStatements.find(
+                s => s.Resource === 'arn:aws:ssm:${self:provider.region}:${aws:accountId}:parameter/custom/${self:provider.stage}/*'
+            );
+            expect(scoped).toBeDefined();
+        });
+    });
+
+    describe('getDependencies()', () => {
+        it('should have no dependencies', () => {
+            const deps = ssmBuilder.getDependencies();
+
+            expect(deps).toEqual([]);
+        });
+    });
+
+    describe('getName()', () => {
+        it('should return SsmBuilder', () => {
+            expect(ssmBuilder.getName()).toBe('SsmBuilder');
+        });
+    });
+});
+

package/infrastructure/domains/parameters/ssm-discovery.js

@@ -0,0 +1,84 @@
+/**
+ * SSM Discovery Service
+ * 
+ * Domain Service - Hexagonal Architecture
+ * 
+ * Discovers SSM Parameter Store and Secrets Manager resources
+ * using the cloud provider adapter.
+ */
+
+class SsmDiscovery {
+    /**
+     * @param {CloudProviderAdapter} provider - Cloud provider adapter instance
+     */
+    constructor(provider) {
+        this.provider = provider;
+    }
+
+    /**
+     * Discover SSM parameters and secrets
+     * 
+     * @param {Object} config - Discovery configuration
+     * @param {string} [config.parameterPath] - SSM parameter path prefix
+     * @param {string} [config.serviceName] - Service name for filtering
+     * @param {string} [config.stage] - Deployment stage
+     * @param {boolean} [config.includeSecrets] - Whether to include Secrets Manager
+     * @returns {Promise<Object>} Discovered parameter resources
+     */
+    async discover(config) {
+        console.log('🔍 Discovering SSM parameters...');
+
+        try {
+            // Build parameter path if not provided
+            if (!config.parameterPath && config.serviceName && config.stage) {
+                config.parameterPath = `/${config.serviceName}/${config.stage}`;
+            }
+
+            const rawResources = await this.provider.discoverParameters({
+                ...config,
+                includeSecrets: config.includeSecrets !== false,
+            });
+
+            const result = {
+                parameters: rawResources.parameters || [],
+                secrets: rawResources.secrets || [],
+                parameterPath: config.parameterPath,
+            };
+
+            // Find database secret if exists
+            if (result.secrets.length > 0) {
+                const dbSecret = result.secrets.find(
+                    s => s.Name?.includes('database') || s.Name?.includes('rds')
+                );
+                if (dbSecret) {
+                    result.databaseSecretArn = dbSecret.ARN;
+                    result.databaseSecretName = dbSecret.Name;
+                }
+            }
+
+            if (result.parameters.length > 0) {
+                console.log(`  ✓ Found ${result.parameters.length} SSM parameters`);
+            }
+            if (result.secrets.length > 0) {
+                console.log(`  ✓ Found ${result.secrets.length} secrets`);
+            }
+            if (!result.parameters.length && !result.secrets.length) {
+                console.log('  ℹ No parameters or secrets found');
+            }
+
+            return result;
+        } catch (error) {
+            console.error('  ✗ SSM discovery failed:', error.message);
+            return {
+                parameters: [],
+                secrets: [],
+                parameterPath: config.parameterPath,
+            };
+        }
+    }
+}
+
+module.exports = {
+    SsmDiscovery,
+};
+

package/infrastructure/domains/parameters/ssm-discovery.test.js

@@ -0,0 +1,210 @@
+/**
+ * Tests for SSM Discovery Service
+ * 
+ * Tests SSM Parameter Store and Secrets Manager discovery with mocked provider
+ */
+
+const { SsmDiscovery } = require('./ssm-discovery');
+
+describe('SsmDiscovery', () => {
+    let mockProvider;
+    let ssmDiscovery;
+
+    beforeEach(() => {
+        mockProvider = {
+            discoverParameters: jest.fn(),
+            getName: jest.fn().mockReturnValue('aws'),
+        };
+        ssmDiscovery = new SsmDiscovery(mockProvider);
+    });
+
+    describe('discover()', () => {
+        it('should delegate to provider and transform results', async () => {
+            const mockProviderResponse = {
+                parameters: [
+                    {
+                        Name: '/my-service/prod/API_KEY',
+                        Value: 'encrypted-value',
+                        Type: 'SecureString',
+                    },
+                    {
+                        Name: '/my-service/prod/DATABASE_URL',
+                        Value: 'postgres://...',
+                        Type: 'SecureString',
+                    },
+                ],
+                secrets: [
+                    {
+                        Name: 'my-service/database-credentials',
+                        ARN: 'arn:aws:secretsmanager:us-east-1:123456:secret:my-service/database-credentials',
+                    },
+                ],
+            };
+
+            mockProvider.discoverParameters.mockResolvedValue(mockProviderResponse);
+
+            const result = await ssmDiscovery.discover({
+                serviceName: 'my-service',
+                stage: 'prod',
+            });
+
+            expect(mockProvider.discoverParameters).toHaveBeenCalled();
+            expect(result.parameters).toHaveLength(2);
+            expect(result.secrets).toHaveLength(1);
+            expect(result.parameterPath).toBe('/my-service/prod');
+        });
+
+        it('should build parameter path from serviceName and stage', async () => {
+            mockProvider.discoverParameters.mockResolvedValue({
+                parameters: [],
+                secrets: [],
+            });
+
+            await ssmDiscovery.discover({
+                serviceName: 'test-app',
+                stage: 'dev',
+            });
+
+            expect(mockProvider.discoverParameters).toHaveBeenCalledWith(
+                expect.objectContaining({
+                    parameterPath: '/test-app/dev',
+                    includeSecrets: true,
+                })
+            );
+        });
+
+        it('should use provided parameterPath if specified', async () => {
+            mockProvider.discoverParameters.mockResolvedValue({
+                parameters: [],
+                secrets: [],
+            });
+
+            await ssmDiscovery.discover({
+                parameterPath: '/custom/path',
+            });
+
+            expect(mockProvider.discoverParameters).toHaveBeenCalledWith(
+                expect.objectContaining({
+                    parameterPath: '/custom/path',
+                })
+            );
+        });
+
+        it('should handle no parameters found', async () => {
+            mockProvider.discoverParameters.mockResolvedValue({
+                parameters: [],
+                secrets: [],
+            });
+
+            const result = await ssmDiscovery.discover({});
+
+            expect(result.parameters).toEqual([]);
+            expect(result.secrets).toEqual([]);
+        });
+
+        it('should find database secret if exists', async () => {
+            mockProvider.discoverParameters.mockResolvedValue({
+                parameters: [],
+                secrets: [
+                    {
+                        Name: 'my-app/config',
+                        ARN: 'arn:aws:secretsmanager:us-east-1:123456:secret:my-app/config',
+                    },
+                    {
+                        Name: 'my-app/database-secret',
+                        ARN: 'arn:aws:secretsmanager:us-east-1:123456:secret:my-app/database-secret',
+                    },
+                ],
+            });
+
+            const result = await ssmDiscovery.discover({});
+
+            expect(result.databaseSecretArn).toBe('arn:aws:secretsmanager:us-east-1:123456:secret:my-app/database-secret');
+            expect(result.databaseSecretName).toBe('my-app/database-secret');
+        });
+
+        it('should find RDS secret if exists', async () => {
+            mockProvider.discoverParameters.mockResolvedValue({
+                parameters: [],
+                secrets: [
+                    {
+                        Name: 'rds/postgres/credentials',
+                        ARN: 'arn:aws:secretsmanager:us-east-1:123456:secret:rds/postgres/credentials',
+                    },
+                ],
+            });
+
+            const result = await ssmDiscovery.discover({});
+
+            expect(result.databaseSecretArn).toBe('arn:aws:secretsmanager:us-east-1:123456:secret:rds/postgres/credentials');
+            expect(result.databaseSecretName).toBe('rds/postgres/credentials');
+        });
+
+        it('should handle includeSecrets flag', async () => {
+            mockProvider.discoverParameters.mockResolvedValue({
+                parameters: [],
+                secrets: [],
+            });
+
+            await ssmDiscovery.discover({
+                includeSecrets: false,
+            });
+
+            expect(mockProvider.discoverParameters).toHaveBeenCalledWith(
+                expect.objectContaining({
+                    includeSecrets: false,
+                })
+            );
+        });
+
+        it('should default includeSecrets to true', async () => {
+            mockProvider.discoverParameters.mockResolvedValue({
+                parameters: [],
+                secrets: [],
+            });
+
+            await ssmDiscovery.discover({});
+
+            expect(mockProvider.discoverParameters).toHaveBeenCalledWith(
+                expect.objectContaining({
+                    includeSecrets: true,
+                })
+            );
+        });
+
+        it('should handle discovery errors gracefully', async () => {
+            mockProvider.discoverParameters.mockRejectedValue(new Error('SSM API Error'));
+
+            const result = await ssmDiscovery.discover({});
+
+            expect(result.parameters).toEqual([]);
+            expect(result.secrets).toEqual([]);
+        });
+
+        it('should preserve parameterPath in result', async () => {
+            mockProvider.discoverParameters.mockResolvedValue({
+                parameters: [],
+                secrets: [],
+            });
+
+            const result = await ssmDiscovery.discover({
+                parameterPath: '/my-service/staging',
+            });
+
+            expect(result.parameterPath).toBe('/my-service/staging');
+        });
+
+        it('should handle null/undefined parameters and secrets', async () => {
+            mockProvider.discoverParameters.mockResolvedValue({
+                parameters: null,
+                secrets: undefined,
+            });
+
+            const result = await ssmDiscovery.discover({});
+
+            expect(result.parameters).toEqual([]);
+            expect(result.secrets).toEqual([]);
+        });
+    });
+});
+