@friggframework/devtools 2.0.0-next.11 → 2.0.0-next.110

package/infrastructure/domains/security/iam-generator.test.js

@@ -0,0 +1,287 @@
+const { generateIAMCloudFormation, getFeatureSummary } = require('./iam-generator');
+
+describe('IAM Generator', () => {
+    describe('getFeatureSummary', () => {
+        it('should detect all features when enabled', () => {
+            const appDefinition = {
+                name: 'test-app',
+                integrations: ['Integration1', 'Integration2'],
+                vpc: { enable: true },
+                encryption: { fieldLevelEncryptionMethod: 'kms' },
+                ssm: { enable: true },
+                websockets: { enable: true }
+            };
+
+            const summary = getFeatureSummary(appDefinition);
+
+            expect(summary.appName).toBe('test-app');
+            expect(summary.integrationCount).toBe(2);
+            expect(summary.features.core).toBe(true);
+            expect(summary.features.vpc).toBe(true);
+            expect(summary.features.kms).toBe(true);
+            expect(summary.features.ssm).toBe(true);
+            expect(summary.features.websockets).toBe(true);
+        });
+
+        it('should detect minimal features when disabled', () => {
+            const appDefinition = {
+                integrations: []
+            };
+
+            const summary = getFeatureSummary(appDefinition);
+
+            expect(summary.appName).toBe('Unnamed Frigg App');
+            expect(summary.integrationCount).toBe(0);
+            expect(summary.features.core).toBe(true);
+            expect(summary.features.vpc).toBe(false);
+            expect(summary.features.kms).toBe(false);
+            expect(summary.features.ssm).toBe(false);
+            expect(summary.features.websockets).toBe(false);
+        });
+
+        it('should surface ssm.kmsKeyArn from the app definition', () => {
+            const appDefinition = {
+                name: 'test-app',
+                ssm: {
+                    enable: true,
+                    kmsKeyArn:
+                        'arn:aws:kms:us-east-1:123456789012:key/abcd-1234'
+                }
+            };
+
+            const summary = getFeatureSummary(appDefinition);
+
+            expect(summary.ssmKmsKeyArn).toBe(
+                'arn:aws:kms:us-east-1:123456789012:key/abcd-1234'
+            );
+        });
+
+        it('should leave ssmKmsKeyArn undefined when not configured', () => {
+            const appDefinition = {
+                name: 'test-app',
+                ssm: { enable: true }
+            };
+
+            const summary = getFeatureSummary(appDefinition);
+
+            expect(summary.ssmKmsKeyArn).toBeUndefined();
+        });
+    });
+
+    describe('generateIAMCloudFormation', () => {
+        it('should generate valid CloudFormation YAML', () => {
+            const appDefinition = {
+                name: 'test-app',
+                integrations: [],
+                vpc: { enable: false },
+                encryption: { fieldLevelEncryptionMethod: 'aes' },
+                ssm: { enable: false },
+                websockets: { enable: false }
+            };
+
+            const summary = getFeatureSummary(appDefinition);
+            const yaml = generateIAMCloudFormation({
+                appName: summary.appName,
+                features: summary.features
+            });
+
+            expect(yaml).toContain('AWSTemplateFormatVersion');
+            expect(yaml).toContain('FriggDeploymentUser');
+            expect(yaml).toContain('FriggCoreDeploymentPolicy');
+            expect(yaml).toContain('FriggDiscoveryPolicy');
+        });
+
+        it('should include VPC policy when VPC is enabled', () => {
+            const appDefinition = {
+                name: 'test-app',
+                integrations: [],
+                vpc: { enable: true }
+            };
+
+            const summary = getFeatureSummary(appDefinition);
+            const yaml = generateIAMCloudFormation({
+                appName: summary.appName,
+                features: summary.features
+            });
+
+            expect(yaml).toContain('FriggVPCPolicy');
+            expect(yaml).toContain('CreateVPCPermissions');
+            expect(yaml).toContain('EnableVPCSupport');
+            expect(yaml).toContain('ec2:ReplaceRoute');
+        });
+
+        it('should include KMS policy when encryption is enabled', () => {
+            const appDefinition = {
+                name: 'test-app',
+                integrations: [],
+                encryption: { fieldLevelEncryptionMethod: 'kms' }
+            };
+
+            const summary = getFeatureSummary(appDefinition);
+            const yaml = generateIAMCloudFormation({
+                appName: summary.appName,
+                features: summary.features
+            });
+
+            expect(yaml).toContain('FriggKMSPolicy');
+            expect(yaml).toContain('CreateKMSPermissions');
+            expect(yaml).toContain('EnableKMSSupport');
+            expect(yaml).toContain('FriggKMSKeyAlias');
+            expect(yaml).toContain('kms:CreateAlias');
+        });
+
+        it('should include SSM policy when SSM is enabled', () => {
+            const appDefinition = {
+                name: 'test-app',
+                integrations: [],
+                ssm: { enable: true }
+            };
+
+            const summary = getFeatureSummary(appDefinition);
+            const yaml = generateIAMCloudFormation({
+                appName: summary.appName,
+                features: summary.features
+            });
+
+            expect(yaml).toContain('FriggSSMPolicy');
+            expect(yaml).toContain('CreateSSMPermissions');
+            expect(yaml).toContain('EnableSSMSupport');
+        });
+
+        it('should grant SSM-mediated KMS access via ssm.*.amazonaws.com when SSM is enabled', () => {
+            const appDefinition = {
+                name: 'test-app',
+                integrations: [],
+                ssm: { enable: true }
+            };
+
+            const summary = getFeatureSummary(appDefinition);
+            const yaml = generateIAMCloudFormation({
+                appName: summary.appName,
+                features: summary.features
+            });
+
+            expect(yaml).toContain('FriggSSMParameterKMSEncryption');
+            expect(yaml).toContain('kms:Encrypt');
+            expect(yaml).toContain('ssm.*.amazonaws.com');
+            // No customer-managed key configured: falls back to the account key wildcard
+            expect(yaml).toContain('arn:aws:kms:*:${AWS::AccountId}:key/*');
+
+            // The regional ViaService wildcard must be matched with StringLike;
+            // StringEquals would compare literally and never match
+            // ssm.<region>.amazonaws.com, denying the SecureString KMS call.
+            const ssmKmsBlock = yaml.slice(
+                yaml.indexOf('FriggSSMParameterKMSEncryption'),
+                yaml.indexOf('FriggSSMParameterKMSEncryption') + 600
+            );
+            expect(ssmKmsBlock).toContain('StringLike');
+            expect(ssmKmsBlock).not.toContain('StringEquals');
+        });
+
+        it('should scope the SSM KMS grant to ssm.kmsKeyArn when provided', () => {
+            const appDefinition = {
+                name: 'test-app',
+                integrations: [],
+                ssm: {
+                    enable: true,
+                    kmsKeyArn:
+                        'arn:aws:kms:us-east-1:123456789012:key/abcd-1234'
+                }
+            };
+
+            const summary = getFeatureSummary(appDefinition);
+            const yaml = generateIAMCloudFormation({
+                appName: summary.appName,
+                features: summary.features,
+                ssmKmsKeyArn: appDefinition.ssm.kmsKeyArn
+            });
+
+            expect(yaml).toContain('FriggSSMParameterKMSEncryption');
+            expect(yaml).toContain(
+                'arn:aws:kms:us-east-1:123456789012:key/abcd-1234'
+            );
+            expect(yaml).not.toContain('arn:aws:kms:*:${AWS::AccountId}:key/*');
+        });
+
+        it('should set correct default parameter values based on features', () => {
+            const appDefinition = {
+                name: 'test-app',
+                integrations: [],
+                vpc: { enable: true },
+                encryption: { fieldLevelEncryptionMethod: 'aes' },
+                ssm: { enable: true }
+            };
+
+            const summary = getFeatureSummary(appDefinition);
+            const yaml = generateIAMCloudFormation({
+                appName: summary.appName,
+                features: summary.features
+            });
+
+            // Check parameter defaults match the enabled features
+            expect(yaml).toContain("Default: 'true'"); // VPC enabled
+            expect(yaml).toContain("Default: 'false'"); // KMS disabled
+            expect(yaml).toContain('alias/frigg-deployment');
+        });
+
+        it('should include all core permissions', () => {
+            const appDefinition = {
+                name: 'test-app',
+                integrations: []
+            };
+
+            const summary = getFeatureSummary(appDefinition);
+            const yaml = generateIAMCloudFormation({
+                appName: summary.appName,
+                features: summary.features
+            });
+
+            // Check for core permissions
+            expect(yaml).toContain('cloudformation:CreateStack');
+            expect(yaml).toContain('cloudformation:ListStackResources');
+            expect(yaml).toContain('lambda:CreateFunction');
+            expect(yaml).toContain('iam:CreateRole');
+            expect(yaml).toContain('s3:CreateBucket');
+            expect(yaml).toContain('sqs:CreateQueue');
+            expect(yaml).toContain('sns:CreateTopic');
+            expect(yaml).toContain('logs:CreateLogGroup');
+            expect(yaml).toContain('apigateway:POST');
+            expect(yaml).toContain('lambda:ListVersionsByFunction');
+            expect(yaml).toContain('iam:ListPolicyVersions');
+        });
+
+        it('should include internal-error-queue pattern in SQS resources', () => {
+            const appDefinition = {
+                name: 'test-app',
+                integrations: []
+            };
+
+            const summary = getFeatureSummary(appDefinition);
+            const yaml = generateIAMCloudFormation({
+                appName: summary.appName,
+                features: summary.features
+            });
+
+            expect(yaml).toContain('internal-error-queue-*');
+        });
+
+        it('should generate outputs section', () => {
+            const appDefinition = {
+                name: 'test-app',
+                integrations: []
+            };
+
+            const summary = getFeatureSummary(appDefinition);
+            const yaml = generateIAMCloudFormation({
+                appName: summary.appName,
+                features: summary.features
+            });
+
+            expect(yaml).toContain('Outputs:');
+            expect(yaml).toContain('DeploymentUserArn:');
+            expect(yaml).toContain('AccessKeyId:');
+            expect(yaml).toContain('SecretAccessKeyCommand:');
+            expect(yaml).toContain('CredentialsSecretArn:');
+        });
+    });
+});