@fy-stack/cli 0.0.147-3-preview → 0.0.147-alpha.301

package/dist/commands/assets/get-infra.js.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-infra.js.d.ts","sourceRoot":"","sources":["../../../src/commands/assets/get-infra.js.ts"],"names":[],"mappings":"AAEA,KAAK,kBAAkB,GAAG;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,wBAAgB,QAAQ,CAAC,MAAM,EAAE,kBAAkB;;;EA4DlD"}
+{"version":3,"file":"get-infra.js.d.ts","sourceRoot":"","sources":["../../../src/commands/assets/get-infra.js.ts"],"names":[],"mappings":"AAEA,KAAK,kBAAkB,GAAG;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,wBAAgB,QAAQ,CAAC,MAAM,EAAE,kBAAkB;;;EAkElD"}

package/dist/commands/assets/get-infra.js.js

@@ -5,7 +5,8 @@ const get_cdk_json_1 = require("./get-cdk-json");
 function getInfra(params) {
     const infraFile = `#!/usr/bin/env node
 const cdk = require("aws-cdk-lib");
-const { FullStackConstruct, AppType } = require("@fy-stack/fullstack-construct");
+const { FullStackConstruct } = require("@fy-stack/fullstack-construct");
+const { AppType } = require("@fy-stack/types");
 const { STSClient, GetCallerIdentityCommand } = require('@aws-sdk/client-sts');
 
 const env = {
@@ -31,7 +32,12 @@ class AppStack extends cdk.Stack {
       name: \${appName},
       ownerArn: props.ownerArn,
       storage: { retainOnDelete: false },
-      apps: {}
+      lambda: {
+        demo: {
+          type: AppType.NODE_APP,
+          output: './dist'
+        }
+      }
     });
   }
 }

package/dist/commands/init-app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init-app.d.ts","sourceRoot":"","sources":["../../src/commands/init-app.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAavC,wBAAsB,OAAO,CAAC,KAAK,EAAE,YAAY,iBAgKhD"}
+{"version":3,"file":"init-app.d.ts","sourceRoot":"","sources":["../../src/commands/init-app.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAoBvC,wBAAsB,OAAO,CAAC,KAAK,EAAE,YAAY,iBAqThD"}

package/dist/commands/init-app.js

@@ -4,40 +4,42 @@ exports.initApp = initApp;
 const tslib_1 = require("tslib");
 const fs = tslib_1.__importStar(require("node:fs"));
 const path = tslib_1.__importStar(require("node:path"));
+const client_cloudfront_1 = require("@aws-sdk/client-cloudfront");
 const client_iam_1 = require("@aws-sdk/client-iam");
+const client_ssm_1 = require("@aws-sdk/client-ssm");
 const client_sts_1 = require("@aws-sdk/client-sts");
 const get_infra_js_1 = require("./assets/get-infra.js");
 const get_yaml_file_1 = require("./assets/get-yaml-file");
 const iamClient = new client_iam_1.IAMClient();
+const ssmClient = new client_ssm_1.SSMClient();
+const cdnClient = new client_cloudfront_1.CloudFrontClient();
 async function attachManagedPolicies(roleName, attachedPolices) {
     for (const policy of attachedPolices ?? []) {
         await iamClient.send(new client_iam_1.AttachRolePolicyCommand({
             PolicyArn: policy.PolicyArn,
-            RoleName: roleName
+            RoleName: roleName,
         }));
     }
 }
 async function initApp(props) {
     const stsClient = new client_sts_1.STSClient();
     const user = await stsClient.send(new client_sts_1.GetCallerIdentityCommand());
-    const username = user.Arn?.split("/").pop();
+    const username = user.Arn?.split('/').pop();
     if (!username)
-        throw new Error("username not found");
-    const isRoot = username.endsWith(":root");
+        throw new Error('username not found');
+    const isRoot = username.endsWith(':root');
     const workingDir = process.cwd();
     if (props.githubRepo) {
         const githubFolderPath = path.join(workingDir, '.github/workflows/');
-        if (!fs.existsSync(githubFolderPath))
+        if (!fs.existsSync(githubFolderPath)) {
             fs.mkdirSync(githubFolderPath, { recursive: true });
-        const deployYamlPath = path.join(githubFolderPath, "fy-stack.deploy.yml");
-        if (fs.existsSync(deployYamlPath))
-            throw new Error("fy-stack.deploy.yml already exists");
+        }
         const existingRes = await iamClient.send(new client_iam_1.ListOpenIDConnectProvidersCommand());
         let idProviderArn;
         const providerUrl = 'token.actions.githubusercontent.com';
         for (const i in existingRes.OpenIDConnectProviderList ?? []) {
             const provider = await iamClient.send(new client_iam_1.GetOpenIDConnectProviderCommand({
-                OpenIDConnectProviderArn: existingRes.OpenIDConnectProviderList?.[i].Arn
+                OpenIDConnectProviderArn: existingRes.OpenIDConnectProviderList?.[i].Arn,
             }));
             if (provider.Url === providerUrl) {
                 idProviderArn = existingRes.OpenIDConnectProviderList?.[i].Arn;
@@ -47,109 +49,192 @@ async function initApp(props) {
         if (!idProviderArn) {
             const idProviderRes = await iamClient.send(new client_iam_1.CreateOpenIDConnectProviderCommand({
                 Url: providerUrl,
-                ClientIDList: ['sts.amazonaws.com']
+                ClientIDList: ['sts.amazonaws.com'],
             }));
-            if (!idProviderRes.OpenIDConnectProviderArn)
-                throw new Error('unable to Github open id provider');
             idProviderArn = idProviderRes.OpenIDConnectProviderArn;
         }
-        const roleRes = await iamClient.send(new client_iam_1.CreateRoleCommand({
-            RoleName: `${props.app}GithubRole`,
-            AssumeRolePolicyDocument: JSON.stringify({
-                Version: "2012-10-17",
-                Statement: [{
-                        Effect: "Allow",
-                        Principal: { Federated: idProviderArn },
-                        Action: "sts:AssumeRoleWithWebIdentity",
-                        Condition: {
-                            StringEquals: { "token.actions.githubusercontent.com:aud": "sts.amazonaws.com" },
-                            StringLike: { "token.actions.githubusercontent.com:sub": `repo:${props.githubRepo}:*` }
-                        }
-                    }]
-            }),
-        }));
-        if (!roleRes.Role?.Arn || !roleRes.Role.RoleName)
+        if (!idProviderArn) {
+            throw new Error('unable to create Github OpenID provider');
+        }
+        const roleName = `${props.app}GithubRole`;
+        let roleArn;
+        try {
+            const existingRole = await iamClient.send(new client_iam_1.GetRoleCommand({ RoleName: roleName }));
+            roleArn = existingRole.Role?.Arn;
+        }
+        catch {
+            /** empty */
+        }
+        if (!roleArn) {
+            const roleRes = await iamClient.send(new client_iam_1.CreateRoleCommand({
+                RoleName: roleName,
+                AssumeRolePolicyDocument: JSON.stringify({
+                    Version: '2012-10-17',
+                    Statement: [
+                        {
+                            Effect: 'Allow',
+                            Principal: { Federated: idProviderArn },
+                            Action: 'sts:AssumeRoleWithWebIdentity',
+                            Condition: {
+                                StringEquals: {
+                                    'token.actions.githubusercontent.com:aud': 'sts.amazonaws.com',
+                                },
+                                StringLike: {
+                                    'token.actions.githubusercontent.com:sub': `repo:${props.githubRepo}:*`,
+                                },
+                            },
+                        },
+                    ],
+                }),
+            }));
+            roleArn = roleRes.Role?.Arn;
+        }
+        if (!roleArn) {
             throw new Error('unable to Github role');
-        const roleName = roleRes.Role.RoleName;
+        }
         if (isRoot) {
             await iamClient.send(new client_iam_1.AttachRolePolicyCommand({
                 PolicyArn: 'arn:aws:iam::aws:policy/AdministratorAccess',
-                RoleName: roleRes.Role.RoleName
+                RoleName: roleName,
             }));
         }
         else {
+            // clone policies from logged in aws user to openid user
             // attach managed polices
             const attachedPolices = await iamClient.send(new client_iam_1.ListAttachedUserPoliciesCommand({
-                UserName: username
+                UserName: username,
             }));
             await attachManagedPolicies(roleName, attachedPolices.AttachedPolicies);
             // attach inline polices
             const inlinePolices = await iamClient.send(new client_iam_1.ListUserPoliciesCommand({
-                UserName: username
+                UserName: username,
             }));
             for (const policyName of inlinePolices.PolicyNames ?? []) {
-                const policyDocument = await iamClient.send(new client_iam_1.GetUserPolicyCommand({ UserName: username, PolicyName: policyName }));
+                const policyDocument = await iamClient.send(new client_iam_1.GetUserPolicyCommand({
+                    UserName: username,
+                    PolicyName: policyName,
+                }));
                 if (!policyDocument.PolicyDocument)
                     continue;
                 await iamClient.send(new client_iam_1.PutRolePolicyCommand({
                     PolicyName: policyName,
                     PolicyDocument: decodeURIComponent(policyDocument.PolicyDocument),
-                    RoleName: roleRes.Role.RoleName
+                    RoleName: roleName,
                 }));
             }
             const groups = await iamClient.send(new client_iam_1.ListGroupsForUserCommand({
-                UserName: username
+                UserName: username,
             }));
             for (const group of groups.Groups ?? []) {
                 // attach managed polices
                 const attachedPolices = await iamClient.send(new client_iam_1.ListAttachedGroupPoliciesCommand({
-                    GroupName: group.GroupName
+                    GroupName: group.GroupName,
                 }));
                 await attachManagedPolicies(roleName, attachedPolices.AttachedPolicies);
                 // attach inline polices
                 const inlinePolices = await iamClient.send(new client_iam_1.ListGroupPoliciesCommand({
-                    GroupName: group.GroupName
+                    GroupName: group.GroupName,
                 }));
                 for (const policyName of inlinePolices.PolicyNames ?? []) {
-                    const policyDocument = await iamClient.send(new client_iam_1.GetUserPolicyCommand({ UserName: username, PolicyName: policyName }));
+                    const policyDocument = await iamClient.send(new client_iam_1.GetUserPolicyCommand({
+                        UserName: username,
+                        PolicyName: policyName,
+                    }));
                     if (!policyDocument.PolicyDocument)
                         continue;
                     await iamClient.send(new client_iam_1.PutRolePolicyCommand({
                         PolicyName: policyName,
                         PolicyDocument: decodeURIComponent(policyDocument.PolicyDocument),
-                        RoleName: roleRes.Role.RoleName
+                        RoleName: roleName,
                     }));
                 }
             }
         }
-        const yamlFile = (0, get_yaml_file_1.getYAMLFile)({ ...props, roleArn: roleRes.Role.Arn, region: await stsClient.config.region() });
-        fs.writeFileSync(deployYamlPath, yamlFile);
+        const yamlFile = (0, get_yaml_file_1.getYAMLFile)({
+            ...props,
+            roleArn,
+            region: await stsClient.config.region(),
+        });
+        const deployYamlPath = path.join(githubFolderPath, 'fy-stack.deploy.yml');
+        if (!fs.existsSync(deployYamlPath)) {
+            fs.writeFileSync(deployYamlPath, yamlFile);
+        }
     }
-    const { infraFile, cdkJsonFile } = (0, get_infra_js_1.getInfra)({
-        app: props.app,
-        domain: props.domainName
-            ? `process.env.ENVIRONMENT === "production" ? "${props.domainName}" : \`\${process.env.ENVIRONMENT}.${props.domainName}\``
-            : undefined
-    });
+    /* Configure image CDN cache policy */
+    const imagePolicyParameterName = '/fy-stack/ImagePolicyID';
+    const imageCachePolicyConfig = {
+        Name: 'AppImagePolicy',
+        MinTTL: 0,
+        DefaultTTL: 31536000,
+        MaxTTL: 31536000,
+        ParametersInCacheKeyAndForwardedToOrigin: {
+            EnableAcceptEncodingBrotli: true,
+            EnableAcceptEncodingGzip: true,
+            QueryStringsConfig: { QueryStringBehavior: 'all' },
+            HeadersConfig: { HeaderBehavior: 'none' },
+            CookiesConfig: { CookieBehavior: 'none' },
+        },
+    };
+    let imagePolicy;
+    try {
+        const foundParam = await ssmClient.send(new client_ssm_1.GetParameterCommand({ Name: imagePolicyParameterName }));
+        if (foundParam.Parameter?.Value) {
+            const existingCachePolicy = await cdnClient.send(new client_cloudfront_1.GetCachePolicyCommand({
+                Id: foundParam.Parameter.Value,
+            }));
+            await cdnClient.send(new client_cloudfront_1.UpdateCachePolicyCommand({
+                Id: foundParam.Parameter?.Value,
+                CachePolicyConfig: imageCachePolicyConfig,
+                IfMatch: existingCachePolicy.ETag,
+            }));
+            imagePolicy = existingCachePolicy.CachePolicy;
+        }
+    }
+    catch {
+        /* empty */
+    }
+    if (!imagePolicy) {
+        console.log('image cache policy not found, attempting to create...');
+        const cachePolicy = await cdnClient.send(new client_cloudfront_1.CreateCachePolicyCommand({
+            CachePolicyConfig: imageCachePolicyConfig,
+        }));
+        imagePolicy = cachePolicy.CachePolicy;
+    }
+    if (!imagePolicy) {
+        throw new Error('unable to get image cache policy');
+    }
+    await ssmClient.send(new client_ssm_1.PutParameterCommand({
+        Value: imagePolicy.Id,
+        Name: imagePolicyParameterName,
+        Type: 'String',
+        Overwrite: true,
+    }));
     const packageJsonPath = path.join(workingDir, 'package.json');
     const infraPath = path.join(workingDir, 'infra.js');
     const cdkPath = path.join(workingDir, 'cdk.json');
-    if (!fs.existsSync(packageJsonPath))
+    if (!fs.existsSync(packageJsonPath)) {
         throw new Error('unable to find package.json file');
-    if (fs.existsSync(infraPath))
-        throw new Error('infra.js file already exists');
-    const packageJsonFile = JSON.parse(fs.readFileSync(path.join(workingDir, 'package.json'), "utf8"));
-    packageJsonFile["devDependencies"] = {
-        ...packageJsonFile["devDependencies"],
-        "aws-cdk": "^2.1016.1",
-        "aws-cdk-lib": "^2.198.0",
-        "@aws-sdk/client-sts": "^3.799.0",
-        "constructs": "^10.4.2",
-        "@fy-stack/fullstack-construct": "^0.0.146"
+    }
+    const packageJsonFile = JSON.parse(fs.readFileSync(path.join(workingDir, 'package.json'), 'utf8'));
+    packageJsonFile['devDependencies'] = {
+        ...packageJsonFile['devDependencies'],
+        'aws-cdk': packageJsonFile.devDependencies?.['aws-cdk'] ?? '^2.1016.1',
+        'aws-cdk-lib': packageJsonFile.devDependencies?.['aws-cdk-lib'] ?? '^2.229.1',
+        '@aws-sdk/client-sts': packageJsonFile.devDependencies?.['@aws-sdk/client-sts'] ?? '^3.799.0',
+        constructs: packageJsonFile.devDependencies?.['constructs'] ?? '^10.4.3',
+        '@fy-stack/fullstack-construct': packageJsonFile.devDependencies?.['@fy-stack/fullstack-construct'] ??
+            '^0.0.147',
+        '@fy-stack/types': packageJsonFile.devDependencies?.['@fy-stack/types'] ?? '^0.0.147',
     };
+    const domain = props.domainName
+        ? `process.env.ENVIRONMENT === "production" ? "${props.domainName}" : \`\${process.env.ENVIRONMENT}.${props.domainName}\``
+        : undefined;
+    const { infraFile, cdkJsonFile } = (0, get_infra_js_1.getInfra)({ app: props.app, domain });
+    fs.writeFileSync(packageJsonPath, JSON.stringify(packageJsonFile, null, 2));
     if (!fs.existsSync(cdkPath))
         fs.writeFileSync(cdkPath, cdkJsonFile);
-    fs.writeFileSync(packageJsonPath, JSON.stringify(packageJsonFile, null, 2));
-    fs.writeFileSync(infraPath, infraFile);
-    console.log("App initialized, run npm install to complete");
+    if (!fs.existsSync(infraPath)) {
+        fs.writeFileSync(infraPath, infraFile);
+    }
+    console.log('App initialized, run npm install to complete');
 }

package/package.json

@@ -1,9 +1,11 @@
 {
   "name": "@fy-stack/cli",
-  "version": "0.0.147-3-preview",
+  "version": "0.0.147-alpha.301",
   "dependencies": {
     "@aws-sdk/client-iam": "^3.731.1",
     "@aws-sdk/client-sts": "^3.731.1",
+    "@aws-sdk/client-ssm": "^3.731.1",
+    "@aws-sdk/client-cloudfront": "^3.731.1",
     "@inquirer/prompts": "^7.2.3",
     "commander": "^13.0.0",
     "tslib": "^2.3.0"