@friggframework/devtools 2.0.0-next.36 → 2.0.0-next.38

package/infrastructure/integration.test.js

@@ -49,7 +49,7 @@ describe('VPC/KMS/SSM Integration Tests', () => {
             const appDefinition = {
                 name: 'test-frigg-app',
                 vpc: { enable: true },
-                encryption: { useDefaultKMSForFieldLevelEncryption: true },
+                encryption: { fieldLevelEncryptionMethod: 'kms' },
                 ssm: { enable: true },
                 integrations: [{
                     Definition: {
@@ -67,7 +67,7 @@ describe('VPC/KMS/SSM Integration Tests', () => {
             process.env.AWS_DISCOVERY_SUBNET_ID_1 = discoveredResources.privateSubnetId1;
             process.env.AWS_DISCOVERY_SUBNET_ID_2 = discoveredResources.privateSubnetId2;
             process.env.AWS_DISCOVERY_ROUTE_TABLE_ID = discoveredResources.privateRouteTableId;
-            process.env.AWS_DISCOVERY_KMS_KEY_ID = discoveredResources.defaultKmsKeyId;
+            process.env.AWS_DISCOVERY_KMS_KEY_ID =discoveredResources.defaultKmsKeyId;
 
             // Generate serverless configuration
             const serverlessConfig = composeServerlessDefinition(appDefinition);
@@ -173,11 +173,11 @@ describe('VPC/KMS/SSM Integration Tests', () => {
         it('should generate config with only KMS enabled', async () => {
             const appDefinition = {
                 name: 'kms-only-app',
-                encryption: { useDefaultKMSForFieldLevelEncryption: true },
+                encryption: { fieldLevelEncryptionMethod: 'kms' },
                 integrations: []
             };
 
-            process.env.AWS_DISCOVERY_KMS_KEY_ID = mockAWSResources.defaultKmsKeyId;
+            process.env.AWS_DISCOVERY_KMS_KEY_ID =mockAWSResources.defaultKmsKeyId;
 
             const serverlessConfig = composeServerlessDefinition(appDefinition);
 
@@ -231,7 +231,7 @@ describe('VPC/KMS/SSM Integration Tests', () => {
             expect(mockBuildTimeDiscovery.preBuildHook).toHaveBeenCalledWith(
                 expect.objectContaining({
                     vpc: { enable: true },
-                    encryption: { useDefaultKMSForFieldLevelEncryption: true }
+                    encryption: { fieldLevelEncryptionMethod: 'kms' }
                 }),
                 'us-east-1'
             );
@@ -302,7 +302,7 @@ describe('VPC/KMS/SSM Integration Tests', () => {
             process.env.AWS_DISCOVERY_SECURITY_GROUP_ID = mockAWSResources.defaultSecurityGroupId;
             process.env.AWS_DISCOVERY_SUBNET_ID_1 = mockAWSResources.privateSubnetId1;
             process.env.AWS_DISCOVERY_SUBNET_ID_2 = mockAWSResources.privateSubnetId2;
-            process.env.AWS_DISCOVERY_KMS_KEY_ID = mockAWSResources.defaultKmsKeyId;
+            process.env.AWS_DISCOVERY_KMS_KEY_ID =mockAWSResources.defaultKmsKeyId;
 
             // In a real deployment, serverless framework would resolve these environment variables
             // For testing, we can verify the placeholders are correctly formatted
@@ -353,7 +353,7 @@ describe('VPC/KMS/SSM Integration Tests', () => {
 
             const appDefinition = {
                 vpc: { enable: true },
-                encryption: { useDefaultKMSForFieldLevelEncryption: true },
+                encryption: { fieldLevelEncryptionMethod: 'kms' },
                 integrations: []
             };
 

package/infrastructure/run-discovery.js

@@ -41,7 +41,7 @@ async function runDiscovery() {
 
         // Check if discovery is needed
         const needsDiscovery = appDefinition.vpc?.enable || 
-                              appDefinition.encryption?.useDefaultKMSForFieldLevelEncryption ||
+                              appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms' ||
                               appDefinition.ssm?.enable;
         
         if (!needsDiscovery) {
@@ -51,7 +51,7 @@ async function runDiscovery() {
 
         console.log('📋 App requires AWS discovery for:');
         if (appDefinition.vpc?.enable) console.log('   ✅ VPC support');
-        if (appDefinition.encryption?.useDefaultKMSForFieldLevelEncryption) console.log('   ✅ KMS encryption');
+        if (appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms') console.log('   ✅ KMS encryption');
         if (appDefinition.ssm?.enable) console.log('   ✅ SSM parameters');
 
         // Run discovery
@@ -82,7 +82,7 @@ async function runDiscovery() {
         } else {
             console.error('🚨 Discovery is required because your AppDefinition has these features enabled:');
             if (appDefinition.vpc?.enable) console.error('   ❌ VPC support (vpc.enable: true)');
-            if (appDefinition.encryption?.useDefaultKMSForFieldLevelEncryption) console.error('   ❌ KMS encryption (encryption.useDefaultKMSForFieldLevelEncryption: true)');
+            if (appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms') console.error('   ❌ KMS encryption (encryption.fieldLevelEncryptionMethod: \'kms\')');
             if (appDefinition.ssm?.enable) console.error('   ❌ SSM parameters (ssm.enable: true)');
             console.error('');
             console.error('💡 To fix this issue:');
@@ -95,7 +95,7 @@ async function runDiscovery() {
         
         console.error('🔧 Or disable features in backend/index.js:');
         console.error('   vpc: { enable: false }');
-        console.error('   encryption: { useDefaultKMSForFieldLevelEncryption: false }');
+        console.error('   encryption: { fieldLevelEncryptionMethod: \'aes\' }');
         console.error('   ssm: { enable: false }');
         
         process.exit(1);

package/infrastructure/serverless-template.js

@@ -10,8 +10,7 @@ const { AWSDiscovery } = require('./aws-discovery');
 const shouldRunDiscovery = (AppDefinition) => {
     return (
         AppDefinition.vpc?.enable === true ||
-        AppDefinition.encryption?.useDefaultKMSForFieldLevelEncryption ===
-            true ||
+        AppDefinition.encryption?.fieldLevelEncryptionMethod === 'kms' ||
         AppDefinition.ssm?.enable === true
     );
 };
@@ -450,6 +449,13 @@ const createVPCInfrastructure = (AppDefinition) => {
                         CidrIp: '0.0.0.0/0',
                         Description: 'DNS UDP',
                     },
+                    {
+                        IpProtocol: 'tcp',
+                        FromPort: 27017,
+                        ToPort: 27017,
+                        CidrIp: '0.0.0.0/0',
+                        Description: 'MongoDB outbound',
+                    },
                 ],
                 Tags: [
                     {
@@ -486,10 +492,7 @@ const createVPCInfrastructure = (AppDefinition) => {
         };
 
         // KMS Interface Endpoint (paid, but useful if using KMS)
-        if (
-            AppDefinition.encryption?.useDefaultKMSForFieldLevelEncryption ===
-            true
-        ) {
+        if (AppDefinition.encryption?.fieldLevelEncryptionMethod === 'kms') {
             vpcResources.FriggKMSVPCEndpoint = {
                 Type: 'AWS::EC2::VPCEndpoint',
                 Properties: {
@@ -884,9 +887,7 @@ const composeServerlessDefinition = async (AppDefinition) => {
     };
 
     // KMS Configuration based on App Definition
-    if (
-        AppDefinition.encryption?.useDefaultKMSForFieldLevelEncryption === true
-    ) {
+    if (AppDefinition.encryption?.fieldLevelEncryptionMethod === 'kms') {
         // Check if a KMS key was discovered
         if (discoveredResources.defaultKmsKeyId) {
             // Use the existing discovered KMS key
@@ -900,55 +901,112 @@ const composeServerlessDefinition = async (AppDefinition) => {
                 Resource: [discoveredResources.defaultKmsKeyId],
             });
 
-            definition.provider.environment.KMS_KEY_ARN =
-                discoveredResources.defaultKmsKeyId;
+            // KMS_KEY_ARN will be set later from custom.kmsGrants for consistency
         } else {
-            // No existing key found, provision a dedicated KMS key
-            console.log('No existing KMS key found, creating a new one...');
+            // No existing key found - check if we should create one or error
+            if (AppDefinition.encryption?.createResourceIfNoneFound === true) {
+                // Create a new KMS key
+                console.log('No existing KMS key found, creating a new one...');
 
-            definition.resources.Resources.FriggKMSKey = {
-                Type: 'AWS::KMS::Key',
-                Properties: {
-                    EnableKeyRotation: true,
-                    KeyPolicy: {
-                        Version: '2012-10-17',
-                        Statement: [
-                            {
-                                Sid: 'AllowRootAccountAdmin',
-                                Effect: 'Allow',
-                                Principal: {
-                                    AWS: {
-                                        'Fn::Sub':
-                                            'arn:aws:iam::${AWS::AccountId}:root',
+                definition.resources.Resources.FriggKMSKey = {
+                    Type: 'AWS::KMS::Key',
+                    Properties: {
+                        EnableKeyRotation: true,
+                        Description: 'Frigg KMS key for field-level encryption',
+                        KeyPolicy: {
+                            Version: '2012-10-17',
+                            Statement: [
+                                {
+                                    Sid: 'AllowRootAccountAdmin',
+                                    Effect: 'Allow',
+                                    Principal: {
+                                        AWS: {
+                                            'Fn::Sub':
+                                                'arn:aws:iam::${AWS::AccountId}:root',
+                                        },
                                     },
+                                    Action: 'kms:*',
+                                    Resource: '*',
                                 },
-                                Action: 'kms:*',
-                                Resource: '*',
+                                {
+                                    Sid: 'AllowLambdaService',
+                                    Effect: 'Allow',
+                                    Principal: {
+                                        Service: 'lambda.amazonaws.com',
+                                    },
+                                    Action: [
+                                        'kms:GenerateDataKey',
+                                        'kms:Decrypt',
+                                        'kms:DescribeKey',
+                                    ],
+                                    Resource: '*',
+                                    Condition: {
+                                        StringEquals: {
+                                            'kms:ViaService': `lambda.${
+                                                process.env.AWS_REGION ||
+                                                'us-east-1'
+                                            }.amazonaws.com`,
+                                        },
+                                    },
+                                },
+                            ],
+                        },
+                        Tags: [
+                            {
+                                Key: 'Name',
+                                Value: '${self:service}-${self:provider.stage}-frigg-kms-key',
+                            },
+                            {
+                                Key: 'Purpose',
+                                Value: 'Field-level encryption for Frigg application',
                             },
                         ],
                     },
-                },
-            };
+                };
 
-            definition.provider.iamRoleStatements.push({
-                Effect: 'Allow',
-                Action: ['kms:GenerateDataKey', 'kms:Decrypt'],
-                Resource: [{ 'Fn::GetAtt': ['FriggKMSKey', 'Arn'] }],
-            });
+                definition.provider.iamRoleStatements.push({
+                    Effect: 'Allow',
+                    Action: ['kms:GenerateDataKey', 'kms:Decrypt'],
+                    Resource: [{ 'Fn::GetAtt': ['FriggKMSKey', 'Arn'] }],
+                });
 
-            definition.provider.environment.KMS_KEY_ARN = {
-                'Fn::GetAtt': ['FriggKMSKey', 'Arn'],
-            };
+                definition.provider.environment.KMS_KEY_ARN = {
+                    'Fn::GetAtt': ['FriggKMSKey', 'Arn'],
+                };
+
+                // Configure KMS grants to reference the created key
+                definition.custom.kmsGrants = {
+                    kmsKeyId: { 'Fn::GetAtt': ['FriggKMSKey', 'Arn'] }
+                };
+            } else {
+                // No key found and createIfNoneFound is not enabled - error
+                throw new Error(
+                    'KMS field-level encryption is enabled but no KMS key was found. ' +
+                        'Either provide an existing KMS key or set encryption.createResourceIfNoneFound to true to create a new key.'
+                );
+            }
         }
 
         definition.plugins.push('serverless-kms-grants');
 
-        // Configure KMS grants with discovered default key or environment variable
-        definition.custom.kmsGrants = {
-            kmsKeyId:
+        // Configure KMS grants if not already set (when using existing key)
+        if (!definition.custom.kmsGrants) {
+            definition.custom.kmsGrants = {
+                kmsKeyId:
+                    discoveredResources.defaultKmsKeyId ||
+                    '${env:AWS_DISCOVERY_KMS_KEY_ID}',
+            };
+        }
+
+        // Always set KMS_KEY_ARN from custom.kmsGrants for consistency
+        // This translates AWS_DISCOVERY_KMS_KEY_ID to the runtime variable KMS_KEY_ARN
+        if (!definition.provider.environment.KMS_KEY_ARN) {
+            // Use the discovered value directly when available (from in-process discovery)
+            // Otherwise fall back to environment variable (from separate discovery process)
+            definition.provider.environment.KMS_KEY_ARN =
                 discoveredResources.defaultKmsKeyId ||
-                '${env:AWS_DISCOVERY_KMS_KEY_ID}',
-        };
+                '${env:AWS_DISCOVERY_KMS_KEY_ID}';
+        }
     }
 
     // VPC Configuration based on App Definition
@@ -1245,62 +1303,6 @@ const composeServerlessDefinition = async (AppDefinition) => {
                 definition.custom[queueReference] = queueName;
             }
         }
-
-        // Discovery has already run successfully at this point if needed
-        // The discoveredResources object contains all the necessary AWS resources
-
-        // Add websocket function if enabled
-        if (AppDefinition.websockets?.enable === true) {
-            definition.functions.defaultWebsocket = {
-                handler:
-                    'node_modules/@friggframework/core/handlers/routers/websocket.handler',
-                events: [
-                    {
-                        websocket: {
-                            route: '$connect',
-                        },
-                    },
-                    {
-                        websocket: {
-                            route: '$default',
-                        },
-                    },
-                    {
-                        websocket: {
-                            route: '$disconnect',
-                        },
-                    },
-                ],
-            };
-        }
-
-        // Discovery has already run successfully at this point if needed
-        // The discoveredResources object contains all the necessary AWS resources
-
-        // Add websocket function if enabled
-        if (AppDefinition.websockets?.enable === true) {
-            definition.functions.defaultWebsocket = {
-                handler:
-                    'node_modules/@friggframework/core/handlers/routers/websocket.handler',
-                events: [
-                    {
-                        websocket: {
-                            route: '$connect',
-                        },
-                    },
-                    {
-                        websocket: {
-                            route: '$default',
-                        },
-                    },
-                    {
-                        websocket: {
-                            route: '$disconnect',
-                        },
-                    },
-                ],
-            };
-        }
     }
 
     // Discovery has already run successfully at this point if needed
@@ -1331,9 +1333,6 @@ const composeServerlessDefinition = async (AppDefinition) => {
         };
     }
 
-    // Discovery has already run successfully at this point if needed
-    // The discoveredResources object contains all the necessary AWS resources
-
     // Modify handler paths to point to the correct node_modules location
     definition.functions = modifyHandlerPaths(definition.functions);