@geekmidas/cli 10.0.0-alpha.123 → 10.0.0-alpha.124

package/dist/{dns-Bmnuttja.cjs → snsSubscriptions-CSkteK2J.cjs}

@@ -1,7 +1,8 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_errors = require("./errors-DMC4Umsb.cjs");
+const require_credentials = require("./credentials-D7XJypNd.cjs");
 const require_workspace = require("./workspace-C82GLPnf.cjs");
-const require_seeds = require("./seeds-BWC-qjSI.cjs");
+const require_seeds = require("./seeds-DOfxmDRO.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
@@ -470,6 +471,79 @@ function saltFor(password) {
 	return `$2a$10$${salt}`;
 }
 //#endregion
+//#region src/providers/aws.ts
+/**
+* The AWS account a provider provisions in — the stage's, found the way the
+* SSM and Secrets Manager stores find it.
+*
+* 1. `--profile`, resolved on its own: exported keys left over from another
+*    account never win over a profile someone named.
+* 2. `AWS_PROFILE`, else `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` — the
+*    deploy's own `aws` credential kind (`storedCredentials`).
+* 3. The SDK's default chain: `~/.aws` default profile, SSO, a role. In CI,
+*    whatever `aws-actions/configure-aws-credentials` exported.
+*
+* None of them: the provider has no provisioning credentials, and the stage
+* is treated as `external`.
+*/
+async function awsProvisioningCredentials(lookup) {
+	const region = lookup.env.AWS_REGION ?? lookup.env.AWS_DEFAULT_REGION;
+	const where = region ? { region } : {};
+	if (lookup.profile) return {
+		profile: lookup.profile,
+		...where
+	};
+	const stored = await require_credentials.storedCredentials({
+		env: lookup.env,
+		...lookup.home ? { home: lookup.home } : {}
+	}).get({
+		kind: "aws",
+		stage: lookup.stage
+	});
+	if (stored) return stored;
+	try {
+		const { fromNodeProviderChain } = await import("@aws-sdk/credential-providers");
+		await fromNodeProviderChain({
+			timeout: 1e3,
+			maxRetries: 0
+		})();
+		return {
+			chain: true,
+			...where
+		};
+	} catch {
+		return;
+	}
+}
+/**
+* An S3-compatible endpoint the environment points the SDK at — the AWS
+* emulator in tests. The SDK reads it itself; it is read here too, because
+* an emulator takes path-style requests, and a key written for one has to
+* say where it is.
+*/
+function awsEndpoint(env, service) {
+	return env[`AWS_ENDPOINT_URL_${service}`] ?? env.AWS_ENDPOINT_URL;
+}
+/** An SDK client's config for a provisioning credential. */
+async function awsClientConfig(credential, region) {
+	if ("profile" in credential) {
+		const { fromIni } = await import("@aws-sdk/credential-providers");
+		return {
+			region,
+			credentials: fromIni({ profile: credential.profile })
+		};
+	}
+	if ("accessKeyId" in credential) return {
+		region,
+		credentials: {
+			accessKeyId: credential.accessKeyId,
+			secretAccessKey: credential.secretAccessKey,
+			...credential.sessionToken ? { sessionToken: credential.sessionToken } : {}
+		}
+	};
+	return { region };
+}
+//#endregion
 //#region src/compose/dns.ts
 /**
 * A compose stage's DNS: the records its public hosts need, and the check that
@@ -1210,6 +1284,208 @@ async function stageDns(input) {
 	};
 }
 //#endregion
+//#region src/deploy/snsSubscriptions.ts
+/** The type every recorded subscription has in the stage's state. */
+const SUBSCRIPTION_TYPE = "sns-subscription";
+/** The state key a subscriber's SNS subscription is recorded under. */
+const subscriptionKey = (worker, name) => `${SUBSCRIPTION_TYPE}:${worker}/${name}`;
+/** What a recorded subscription is written to the stage's state as. */
+function subscriptionResource(subscription, arn) {
+	const { name, ...data } = subscription;
+	return {
+		key: subscriptionKey(subscription.worker, name),
+		type: SUBSCRIPTION_TYPE,
+		id: arn,
+		status: "ready",
+		data: {
+			...data,
+			...data.events ? { events: [...data.events] } : {}
+		}
+	};
+}
+/** The subscription a record holds, as an endpoint to reconcile. */
+function specOf(record) {
+	const events = record.data?.events;
+	return {
+		name: record.key.split("/").pop(),
+		endpoint: String(record.data?.endpoint),
+		...record.data?.deadLetterQueueArn ? { deadLetterQueueArn: String(record.data.deadLetterQueueArn) } : {},
+		...Array.isArray(events) ? { events: events.map(String) } : {}
+	};
+}
+/**
+* The subscriptions the deploy recorded, by worker and export — what each
+* worker is handed as `GKM_SNS_SUBSCRIPTIONS`.
+*/
+function recordedPushSubscriptions(resources) {
+	const byWorker = {};
+	for (const record of Object.values(resources ?? {})) {
+		if (record.type !== "sns-subscription" || !record.id) continue;
+		const [worker, name] = record.key.slice(`${SUBSCRIPTION_TYPE}:`.length).split("/");
+		if (!worker || !name) continue;
+		byWorker[worker] = {
+			...byWorker[worker],
+			[name]: record.id
+		};
+	}
+	return byWorker;
+}
+/** A topic connection string the deploy cannot sign with. */
+var TopicSubscriptionUnsigned = class extends require_errors.GkmError {
+	connectionKey;
+	constructor(connectionKey) {
+		super(`'${connectionKey}' carries no keys, and the deploy found no AWS credentials of its own to subscribe the worker's routes with. Put accessKeyId and secretAccessKey in it — keys allowed sns:Subscribe, sns:ListSubscriptionsByTopic, sns:GetSubscriptionAttributes, sns:SetSubscriptionAttributes and sns:Unsubscribe on the topic — or sign in with \`gkm login\`.`);
+		this.connectionKey = connectionKey;
+		this.name = "TopicSubscriptionUnsigned";
+	}
+};
+/**
+* A connection to the topic a stage's connection string names, signed with
+* its own keys — or, carrying none, the deploy's.
+*
+* The emulator the environment points the SDK at stands in for SNS, as it
+* does for every provider: a string with no `endpoint` is SNS itself.
+*
+* @throws {TopicSubscriptionUnsigned} with no keys from either
+*/
+async function topicConnection(input) {
+	const { SNSConnection, snsUrl } = await import("@geekmidas/events/sns");
+	const { topicArn, region, endpoint } = snsUrl.parse(input.connectionString);
+	const params = new URL(input.connectionString).searchParams;
+	const accessKeyId = params.get("accessKeyId");
+	const secretAccessKey = params.get("secretAccessKey");
+	const where = region ?? topicArn.split(":")[3];
+	let credentials;
+	if (accessKeyId && secretAccessKey) {
+		const sessionToken = params.get("sessionToken");
+		credentials = {
+			accessKeyId,
+			secretAccessKey,
+			...sessionToken ? { sessionToken } : {}
+		};
+	} else {
+		const provisioning = await awsProvisioningCredentials({
+			stage: input.stage,
+			env: input.env,
+			...input.home ? { home: input.home } : {}
+		});
+		if (!provisioning) throw new TopicSubscriptionUnsigned(input.connectionKey);
+		credentials = (await awsClientConfig(provisioning, where ?? "us-east-1")).credentials;
+	}
+	const override = endpoint ?? awsEndpoint(input.env, "SNS");
+	return new SNSConnection({
+		topicArn,
+		...where ? { region: where } : {},
+		...override ? { endpoint: override } : {},
+		...credentials ? { credentials } : {}
+	});
+}
+/** A subscription still waiting to be confirmed once its worker is up. */
+var PushSubscriptionsUnconfirmed = class extends require_errors.GkmError {
+	endpoints;
+	constructor(endpoints) {
+		super(`SNS still waits for ${endpoints.join(", ")} to confirm ${endpoints.length === 1 ? "its subscription" : "their subscriptions"}, so nothing is pushed there yet. Check the worker's logs for the confirmation it refused, and that its host answers from the internet; the next deploy sends the confirmation again.`);
+		this.endpoints = endpoints;
+		this.name = "PushSubscriptionsUnconfirmed";
+	}
+};
+/**
+* Once the workers are up: every subscription recorded as pending is
+* subscribed again — SNS resends its confirmation to a worker now there to
+* answer it — and waited on until confirmed.
+*
+* The first deploy needs it: the subscription is made before the worker
+* starts, so SNS's first confirmation finds nobody.
+*
+* A bucket's subscriptions are reached with the deploy's provisioning
+* credentials; a hand-set topic's with the connection string they were made
+* with, read from the stage's secrets.
+*
+* @returns what is still pending when the wait ran out — none, normally.
+*/
+async function confirmPendingSubscriptions(input) {
+	const env = input.env ?? process.env;
+	const records = Object.values(input.resources ?? {}).filter((r) => r.type === "sns-subscription" && r.id);
+	if (!records.some((r) => r.data?.pending === true)) return [];
+	const { SNSConnection, reconcileHttpSubscriptions } = await import("@geekmidas/events/sns");
+	const { GetSubscriptionAttributesCommand } = await import("@aws-sdk/client-sns");
+	const endpoint = awsEndpoint(env, "SNS");
+	let provisioning = null;
+	const groups = /* @__PURE__ */ new Map();
+	for (const record of records) {
+		const host = new URL(String(record.data?.endpoint)).host;
+		const group = `${record.data?.topicArn}|${host}`;
+		groups.set(group, [...groups.get(group) ?? [], record]);
+	}
+	const left = [];
+	for (const [group, members] of groups) {
+		const pending = members.filter((r) => r.data?.pending === true);
+		if (pending.length === 0) continue;
+		const [topicArn, host] = group.split("|");
+		const unreachable = () => left.push(...pending.map((r) => String(r.data?.endpoint)));
+		let connection;
+		const connectionKey = members[0].data?.connectionKey;
+		if (typeof connectionKey === "string") {
+			const connectionString = input.secrets?.[connectionKey];
+			if (!connectionString?.startsWith("sns:")) {
+				unreachable();
+				continue;
+			}
+			connection = await topicConnection({
+				connectionKey,
+				connectionString,
+				stage: input.stage,
+				env,
+				...input.home ? { home: input.home } : {}
+			});
+		} else {
+			if (provisioning === null) provisioning = await awsProvisioningCredentials({
+				stage: input.stage,
+				env,
+				...input.home ? { home: input.home } : {}
+			});
+			if (!provisioning) {
+				unreachable();
+				continue;
+			}
+			const region = topicArn.split(":")[3];
+			const { credentials } = await awsClientConfig(provisioning, region);
+			connection = new SNSConnection({
+				topicArn,
+				region,
+				...endpoint ? { endpoint } : {},
+				...credentials ? { credentials } : {}
+			});
+		}
+		await reconcileHttpSubscriptions(connection, {
+			endpoints: members.map(specOf),
+			ownedHost: host
+		});
+		const deadline = Date.now() + (input.timeoutMs ?? 6e4);
+		for (const record of pending) {
+			let confirmed = false;
+			while (!confirmed) {
+				const { Attributes = {} } = await connection.snsClient.send(new GetSubscriptionAttributesCommand({ SubscriptionArn: record.id }));
+				confirmed = Attributes.PendingConfirmation !== "true";
+				if (confirmed || Date.now() > deadline) break;
+				await new Promise((resolve) => setTimeout(resolve, 1e3));
+			}
+			if (confirmed) {
+				input.log?.(`   ✓ ${record.data?.endpoint} confirmed its subscription`);
+				await input.record?.({
+					...record,
+					data: {
+						...record.data,
+						pending: false
+					}
+				});
+			} else left.push(String(record.data?.endpoint));
+		}
+		await connection.close();
+	}
+	return left;
+}
+//#endregion
 Object.defineProperty(exports, "BACKUPS_SERVICE", {
 	enumerable: true,
 	get: function() {
@@ -1228,18 +1504,48 @@ Object.defineProperty(exports, "HostNotPointingAtServer", {
 		return HostNotPointingAtServer;
 	}
 });
+Object.defineProperty(exports, "PushSubscriptionsUnconfirmed", {
+	enumerable: true,
+	get: function() {
+		return PushSubscriptionsUnconfirmed;
+	}
+});
 Object.defineProperty(exports, "RUNNER_PATH", {
 	enumerable: true,
 	get: function() {
 		return RUNNER_PATH;
 	}
 });
+Object.defineProperty(exports, "SUBSCRIPTION_TYPE", {
+	enumerable: true,
+	get: function() {
+		return SUBSCRIPTION_TYPE;
+	}
+});
 Object.defineProperty(exports, "assertSitePasswordTarget", {
 	enumerable: true,
 	get: function() {
 		return assertSitePasswordTarget;
 	}
 });
+Object.defineProperty(exports, "awsClientConfig", {
+	enumerable: true,
+	get: function() {
+		return awsClientConfig;
+	}
+});
+Object.defineProperty(exports, "awsEndpoint", {
+	enumerable: true,
+	get: function() {
+		return awsEndpoint;
+	}
+});
+Object.defineProperty(exports, "awsProvisioningCredentials", {
+	enumerable: true,
+	get: function() {
+		return awsProvisioningCredentials;
+	}
+});
 Object.defineProperty(exports, "backupDatabases", {
 	enumerable: true,
 	get: function() {
@@ -1276,6 +1582,12 @@ Object.defineProperty(exports, "backupsService", {
 		return backupsService;
 	}
 });
+Object.defineProperty(exports, "confirmPendingSubscriptions", {
+	enumerable: true,
+	get: function() {
+		return confirmPendingSubscriptions;
+	}
+});
 Object.defineProperty(exports, "deploysWithCompose", {
 	enumerable: true,
 	get: function() {
@@ -1300,6 +1612,12 @@ Object.defineProperty(exports, "passwordSites", {
 		return passwordSites;
 	}
 });
+Object.defineProperty(exports, "recordedPushSubscriptions", {
+	enumerable: true,
+	get: function() {
+		return recordedPushSubscriptions;
+	}
+});
 Object.defineProperty(exports, "requiredServerAddress", {
 	enumerable: true,
 	get: function() {
@@ -1360,12 +1678,30 @@ Object.defineProperty(exports, "stageDnsDomains", {
 		return stageDnsDomains;
 	}
 });
+Object.defineProperty(exports, "subscriptionKey", {
+	enumerable: true,
+	get: function() {
+		return subscriptionKey;
+	}
+});
+Object.defineProperty(exports, "subscriptionResource", {
+	enumerable: true,
+	get: function() {
+		return subscriptionResource;
+	}
+});
 Object.defineProperty(exports, "systemLookup", {
 	enumerable: true,
 	get: function() {
 		return systemLookup;
 	}
 });
+Object.defineProperty(exports, "topicConnection", {
+	enumerable: true,
+	get: function() {
+		return topicConnection;
+	}
+});
 Object.defineProperty(exports, "withSitePasswords", {
 	enumerable: true,
 	get: function() {
@@ -1373,4 +1709,4 @@ Object.defineProperty(exports, "withSitePasswords", {
 	}
 });
 
-//# sourceMappingURL=dns-Bmnuttja.cjs.map
+//# sourceMappingURL=snsSubscriptions-CSkteK2J.cjs.map