@intentius/chant-lexicon-aws 0.44.13 → 0.45.0

package/src/serializer.test.ts

@@ -8,6 +8,7 @@ import { AWS } from "./pseudo";
 import { nestedStack, NestedStackOutputRef } from "./nested-stack";
 import { stackOutput } from "@intentius/chant/stack-output";
 import { createResource } from "@intentius/chant/runtime";
+import { resolveAttrRefs } from "@intentius/chant/discovery/resolve";
 import type { SerializerResult } from "@intentius/chant/serializer";
 import type { BuildResult } from "@intentius/chant/build";
 import { Parameter } from "./parameter";
@@ -41,7 +42,7 @@ describe("awsSerializer", () => {
 describe("awsSerializer.serialize", () => {
   test("produces valid CF template structure", () => {
     const entities = new Map<string, Declarable>();
-    const output = awsSerializer.serialize(entities);
+    const output = awsSerializer.serialize(entities) as string;
     const template = JSON.parse(output);
 
     expect(template.AWSTemplateFormatVersion).toBe("2010-09-09");
@@ -50,7 +51,7 @@ describe("awsSerializer.serialize", () => {
 
   test("serializes empty entities", () => {
     const entities = new Map<string, Declarable>();
-    const output = awsSerializer.serialize(entities);
+    const output = awsSerializer.serialize(entities) as string;
     const template = JSON.parse(output);
 
     expect(template.Resources).toEqual({});
@@ -61,7 +62,7 @@ describe("awsSerializer.serialize", () => {
     const entities = new Map<string, Declarable>();
     entities.set("MyBucket", new MockBucket({ BucketName: "my-bucket" }));
 
-    const output = awsSerializer.serialize(entities);
+    const output = awsSerializer.serialize(entities) as string;
     const template = JSON.parse(output);
 
     expect(template.Resources.MyBucket).toBeDefined();
@@ -74,7 +75,7 @@ describe("awsSerializer.serialize", () => {
     entities.set("MyBucket", new MockBucket({ BucketName: "my-bucket" }));
     entities.set("rotationTransform", templateTransform("AWS::SecretsManager-2020-07-23"));
 
-    const template = JSON.parse(awsSerializer.serialize(entities));
+    const template = JSON.parse(awsSerializer.serialize(entities) as string);
 
     expect(template.Transform).toBe("AWS::SecretsManager-2020-07-23");
     expect(template.Resources.rotationTransform).toBeUndefined();
@@ -87,7 +88,7 @@ describe("awsSerializer.serialize", () => {
     entities.set("t2", templateTransform("AWS::LanguageExtensions"));
     entities.set("t3", templateTransform("AWS::SecretsManager-2020-07-23")); // dup
 
-    const template = JSON.parse(awsSerializer.serialize(entities));
+    const template = JSON.parse(awsSerializer.serialize(entities) as string);
 
     expect(template.Transform).toEqual(["AWS::SecretsManager-2020-07-23", "AWS::LanguageExtensions"]);
   });
@@ -96,7 +97,7 @@ describe("awsSerializer.serialize", () => {
     const entities = new Map<string, Declarable>();
     entities.set("MyBucket", new MockBucket({ BucketName: "my-bucket" }));
 
-    const template = JSON.parse(awsSerializer.serialize(entities));
+    const template = JSON.parse(awsSerializer.serialize(entities) as string);
 
     expect(template.Transform).toBeUndefined();
   });
@@ -108,7 +109,7 @@ describe("awsSerializer.serialize", () => {
       defaultValue: "dev",
     }));
 
-    const output = awsSerializer.serialize(entities);
+    const output = awsSerializer.serialize(entities) as string;
     const template = JSON.parse(output);
 
     expect(template.Parameters).toBeDefined();
@@ -124,7 +125,7 @@ describe("awsSerializer.serialize", () => {
       VersioningConfiguration: { Status: "Enabled" },
     }));
 
-    const output = awsSerializer.serialize(entities);
+    const output = awsSerializer.serialize(entities) as string;
     const template = JSON.parse(output);
 
     expect(template.Resources.MyBucket.Properties.VersioningConfiguration).toEqual({
@@ -136,7 +137,7 @@ describe("awsSerializer.serialize", () => {
     const entities = new Map<string, Declarable>();
     entities.set("MyBucket", new MockBucket({ BucketName: "test" }));
 
-    const output = awsSerializer.serialize(entities);
+    const output = awsSerializer.serialize(entities) as string;
     const template = JSON.parse(output);
 
     expect(template.Resources.MyBucket.Properties.BucketName).toBeDefined();
@@ -147,7 +148,7 @@ describe("awsSerializer.serialize", () => {
     entities.set("DataBucket", new MockBucket({ BucketName: "data-bucket" }));
     entities.set("LogsBucket", new MockBucket({ BucketName: "logs-bucket" }));
 
-    const output = awsSerializer.serialize(entities);
+    const output = awsSerializer.serialize(entities) as string;
     const template = JSON.parse(output);
 
     expect(Object.keys(template.Resources)).toHaveLength(2);
@@ -160,7 +161,7 @@ describe("awsSerializer.serialize", () => {
     entities.set("Env", new Parameter("String"));
     entities.set("MyBucket", new MockBucket({ BucketName: "bucket" }));
 
-    const output = awsSerializer.serialize(entities);
+    const output = awsSerializer.serialize(entities) as string;
     const template = JSON.parse(output);
 
     expect(template.Parameters).toBeDefined();
@@ -173,7 +174,7 @@ describe("awsSerializer.serialize", () => {
     const entities = new Map<string, Declarable>();
     entities.set("MyBucket", new MockBucket({})); // No properties set
 
-    const output = awsSerializer.serialize(entities);
+    const output = awsSerializer.serialize(entities) as string;
     const template = JSON.parse(output);
 
     // Should have no Properties key or empty properties
@@ -210,7 +211,7 @@ describe("property-kind Declarables", () => {
     entities.set("DataEncryption", encryption);
     entities.set("MyBucket", bucket);
 
-    const output = awsSerializer.serialize(entities);
+    const output = awsSerializer.serialize(entities) as string;
     const template = JSON.parse(output);
 
     // Encryption should be inlined, not a Ref
@@ -232,7 +233,7 @@ describe("property-kind Declarables", () => {
     entities.set("DataEncryption", encryption);
     entities.set("MyBucket", new MockBucket({ BucketName: "my-bucket" }));
 
-    const output = awsSerializer.serialize(entities);
+    const output = awsSerializer.serialize(entities) as string;
     const template = JSON.parse(output);
 
     expect(template.Resources.DataEncryption).toBeUndefined();
@@ -257,7 +258,7 @@ describe("property-kind Declarables", () => {
     entities.set("SourceBucket", sourceBucket);
     entities.set("Config", new MockConfig(sourceBucket));
 
-    const output = awsSerializer.serialize(entities);
+    const output = awsSerializer.serialize(entities) as string;
     const template = JSON.parse(output);
 
     expect(template.Resources.Config.Properties.Bucket).toEqual({ Ref: "SourceBucket" });
@@ -268,7 +269,7 @@ describe("intrinsic serialization", () => {
   test("handles AttrRef in properties", () => {
     const source = new MockBucket({ BucketName: "source" });
     // Set the logical name on the AttrRef before using it
-    (source.arn as Record<string, unknown>)._setLogicalName("SourceBucket");
+    (source.arn as unknown as { _setLogicalName(n: string): void })._setLogicalName("SourceBucket");
 
     class MockReplication implements Declarable {
       readonly [DECLARABLE_MARKER] = true as const;
@@ -285,27 +286,61 @@ describe("intrinsic serialization", () => {
     entities.set("SourceBucket", source);
     entities.set("Replication", new MockReplication(source.arn));
 
-    const output = awsSerializer.serialize(entities);
+    const output = awsSerializer.serialize(entities) as string;
     const template = JSON.parse(output);
 
     expect(template.Resources.Replication.Properties.SourceArn).toEqual({
       "Fn::GetAtt": ["SourceBucket", "Arn"],
     });
   });
+
+  // chant #1535 — the issue's example: a sibling attr-ref inside a nested
+  // policy document. The serializer walks it to Fn::GetAtt at any depth; the
+  // `Principal: {}` the issue saw came from the fold path dropping the ref
+  // before the serializer ever ran (see core's fold.ts). Pinned here so the
+  // aws side of that contract stays covered.
+  test("handles AttrRef nested inside a policy document (#1535)", () => {
+    const OIDCProvider = createResource("AWS::IAM::OIDCProvider", "aws", { Arn: "Arn" });
+    const Role = createResource("AWS::IAM::Role", "aws", { Arn: "Arn", RoleId: "RoleId" });
+    const provider = new OIDCProvider({ Url: "https://token.actions.githubusercontent.com" });
+    const role = new Role({
+      AssumeRolePolicyDocument: {
+        Version: "2012-10-17",
+        Statement: [
+          {
+            Effect: "Allow",
+            Principal: { Federated: provider.Arn },
+            Action: "sts:AssumeRoleWithWebIdentity",
+          },
+        ],
+      },
+    });
+    const entities = new Map<string, Declarable>([
+      ["Provider", provider],
+      ["Role", role],
+    ]);
+    resolveAttrRefs(entities);
+
+    const template = JSON.parse(awsSerializer.serialize(entities) as string);
+
+    expect(template.Resources.Role.Properties.AssumeRolePolicyDocument.Statement[0].Principal).toEqual({
+      Federated: { "Fn::GetAtt": ["Provider", "Arn"] },
+    });
+  });
 });
 
 describe("LexiconOutput serialization", () => {
   test("resolves AttrRef nested in a Join output to Fn::GetAtt, not the __attrRef envelope (chant#935)", () => {
     const s1 = new MockBucket({ BucketName: "subnet-1" });
     const s2 = new MockBucket({ BucketName: "subnet-2" });
-    (s1.arn as Record<string, unknown>)._setLogicalName("Subnet1");
-    (s2.arn as Record<string, unknown>)._setLogicalName("Subnet2");
+    (s1.arn as unknown as { _setLogicalName(n: string): void })._setLogicalName("Subnet1");
+    (s2.arn as unknown as { _setLogicalName(n: string): void })._setLogicalName("Subnet2");
     const joined = new LexiconOutput(Join(":", [s1.arn, s2.arn]), "SubnetIds");
     joined._setSourceEntity("Subnet1");
     const entities = new Map<string, Declarable>();
     entities.set("Subnet1", s1);
     entities.set("Subnet2", s2);
-    const template = JSON.parse(awsSerializer.serialize(entities, [joined]));
+    const template = JSON.parse(awsSerializer.serialize(entities, [joined]) as string);
     const value = JSON.stringify(template.Outputs.SubnetIds.Value);
     expect(value).not.toContain("__attrRef");
     expect(value).toContain("Fn::GetAtt");
@@ -320,7 +355,7 @@ describe("LexiconOutput serialization", () => {
     const entities = new Map<string, Declarable>();
     entities.set("dataBucket", bucket);
 
-    const result = awsSerializer.serialize(entities, [lexiconOutput]);
+    const result = awsSerializer.serialize(entities, [lexiconOutput]) as string;
     const template = JSON.parse(result);
 
     expect(template.Outputs).toBeDefined();
@@ -342,7 +377,7 @@ describe("LexiconOutput serialization", () => {
     entities.set("dataBucket", dataBucket);
     entities.set("logsBucket", logsBucket);
 
-    const result = awsSerializer.serialize(entities, [dataOutput, logsOutput]);
+    const result = awsSerializer.serialize(entities, [dataOutput, logsOutput]) as string;
     const template = JSON.parse(result);
 
     expect(template.Outputs).toBeDefined();
@@ -376,7 +411,7 @@ describe("LexiconOutput serialization", () => {
     const entities = new Map<string, Declarable>();
     entities.set("MyBucket", new MockBucket({ BucketName: "bucket" }));
 
-    const result = awsSerializer.serialize(entities);
+    const result = awsSerializer.serialize(entities) as string;
     const template = JSON.parse(result);
 
     expect(template.Outputs).toBeUndefined();
@@ -458,7 +493,12 @@ function mockChildBuildResult(childTemplate: object): BuildResult {
     entities: new Map(),
     warnings: [],
     errors: [],
-    manifest: { lexicons: ["aws"], outputs: {}, deployOrder: ["aws"] },
+    manifest: {
+      lexicons: ["aws"],
+      outputs: {},
+      deployOrder: ["aws"],
+      stackGraph: { nodes: ["aws"], edges: [], order: ["aws"], waves: [["aws"]], cycles: [] },
+    },
     sourceFileCount: 1,
   };
 }
@@ -623,7 +663,7 @@ class MockResourceWithAttrs implements Declarable {
   readonly lexicon = "aws";
   readonly entityType: string;
   readonly props: Record<string, unknown>;
-  readonly attributes: Record<string, unknown>;
+  readonly attributes!: Record<string, unknown>;
 
   constructor(
     type: string,
@@ -639,7 +679,7 @@ class MockResourceWithAttrs implements Declarable {
 describe("resource-level CF attributes", () => {
   function serialize(...entries: [string, Declarable][]) {
     const entities = new Map<string, Declarable>(entries);
-    const output = awsSerializer.serialize(entities);
+    const output = awsSerializer.serialize(entities) as string;
     return JSON.parse(output as string);
   }
 
@@ -839,7 +879,7 @@ describe("default tags serialization", () => {
     entities.set("MyBucket", new MockBucket({ BucketName: "bucket" }));
     entities.set("tags", defaultTags([{ Key: "Env", Value: "prod" }]) as unknown as Declarable);
 
-    const output = awsSerializer.serialize(entities);
+    const output = awsSerializer.serialize(entities) as string;
     const template = JSON.parse(output as string);
 
     expect(template.Resources.tags).toBeUndefined();
@@ -851,7 +891,7 @@ describe("default tags serialization", () => {
     entities.set("MyBucket", new MockBucket({ BucketName: "bucket" }));
     entities.set("tags", defaultTags([{ Key: "Env", Value: "prod" }]) as unknown as Declarable);
 
-    const output = awsSerializer.serialize(entities);
+    const output = awsSerializer.serialize(entities) as string;
     const template = JSON.parse(output as string);
 
     expect(template.Resources.MyBucket.Properties.Tags).toEqual([
@@ -868,7 +908,7 @@ describe("default tags serialization", () => {
     }));
     entities.set("tags", defaultTags([{ Key: "Env", Value: "prod" }]) as unknown as Declarable);
 
-    const output = awsSerializer.serialize(entities);
+    const output = awsSerializer.serialize(entities) as string;
     const template = JSON.parse(output as string);
 
     expect(template.Resources.Perm.Properties.Tags).toBeUndefined();
@@ -885,7 +925,7 @@ describe("default tags serialization", () => {
       { Key: "Team", Value: "platform" },
     ]) as unknown as Declarable);
 
-    const output = awsSerializer.serialize(entities);
+    const output = awsSerializer.serialize(entities) as string;
     const template = JSON.parse(output as string);
 
     const tags = template.Resources.MyBucket.Properties.Tags;
@@ -904,7 +944,7 @@ describe("default tags serialization", () => {
       { Key: "Stack", Value: Sub`${AWS.StackName}` },
     ]) as unknown as Declarable);
 
-    const output = awsSerializer.serialize(entities);
+    const output = awsSerializer.serialize(entities) as string;
     const template = JSON.parse(output as string);
 
     const tags = template.Resources.MyBucket.Properties.Tags;
@@ -922,7 +962,7 @@ describe("default tags serialization", () => {
       { Key: "Environment", Value: env },
     ]) as unknown as Declarable);
 
-    const output = awsSerializer.serialize(entities);
+    const output = awsSerializer.serialize(entities) as string;
     const template = JSON.parse(output as string);
 
     const tags = template.Resources.MyBucket.Properties.Tags;
@@ -935,7 +975,7 @@ describe("default tags serialization", () => {
     const entities = new Map<string, Declarable>();
     entities.set("MyBucket", new MockBucket({ BucketName: "bucket" }));
 
-    const output = awsSerializer.serialize(entities);
+    const output = awsSerializer.serialize(entities) as string;
     const template = JSON.parse(output as string);
 
     expect(template.Resources.MyBucket.Properties.Tags).toBeUndefined();

package/src/spec/fetch.test.ts

@@ -125,3 +125,43 @@ describe("loadPinnedSchemas (#1511)", () => {
     );
   });
 });
+
+// #1481 — the live fallback is the nondeterminism that made `chant` and
+// `publish` disagree about the same commit. Under the release gate it is a
+// refusal, and the refusal fires before any request to the live archive.
+describe("fetchSchemaZip under CHANT_RELEASE_GATE (#1481)", () => {
+  test("refuses to fall back to the live archive when the pinned asset is unavailable", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "chant-spec-pin-"));
+    try {
+      await expect(
+        fetchSchemaZip(false, {
+          env: { CHANT_RELEASE_GATE: "1" },
+          download: async () => undefined,
+          pinCacheDir: dir,
+        }),
+      ).rejects.toThrow(/CHANT_RELEASE_GATE=1 and the pinned spec asset could not be loaded/);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("the gate goes through the pinned loader, never the live path", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "chant-spec-pin-"));
+    try {
+      const { zipSync } = await import("fflate");
+      const { AWS_SPEC_PIN } = await import("./pin");
+      // A zip that digests to the committed pin cannot be forged here, so use
+      // the verified-cache path: a cached asset that does NOT digest to the
+      // pin is refused by the loader, which is only reachable on the pinned
+      // path. The live path would have returned whatever upstream serves.
+      const bogus = Buffer.from(zipSync({ "x.json": Buffer.from(JSON.stringify({ typeName: "AWS::X::Y" })) }));
+      mkdirSync(dir, { recursive: true });
+      writeFileSync(join(dir, pinAssetName(AWS_SPEC_PIN)), bogus);
+      await expect(
+        fetchSchemaZip(false, { env: { CHANT_RELEASE_GATE: "1" }, pinCacheDir: dir }),
+      ).rejects.toThrow(/extracts to/);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});

package/src/spec/fetch.ts

@@ -4,6 +4,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { execFile } from "child_process";
 import { promisify } from "util";
 import { fetchWithCache, extractFromZip, clearCacheFile } from "@intentius/chant/codegen/fetch";
+import { RELEASE_GATE_ENV } from "@intentius/chant/codegen/validate";
 import { ACCEPT_ENV, AWS_SPEC_PIN, specContentDigest, type SpecPin } from "./pin";
 
 /**
@@ -203,12 +204,32 @@ async function uploadPinAsset(zipData: Buffer, digest: string): Promise<void> {
  * `force`, the accept flow (`CHANT_ACCEPT_AWS_SPEC=1`, which must sample
  * upstream — and bypasses the 24h cache for the same reason), and when the
  * asset is unreachable. The live path keeps its 24h local cache.
+ *
+ * chant #1481 — the fallback is what made two workflows disagree about one
+ * commit. The live archive is served from CloudFront and two fetches seconds
+ * apart can get different variants; under the release gate, building from
+ * it would ship a surface nobody reviewed on a retry lottery, so the gate
+ * refuses instead. Anywhere else the fallback stays, but says so, because a
+ * silent fallback is indistinguishable from the pinned path in a CI log.
  */
-export async function fetchSchemaZip(force = false): Promise<Map<string, Buffer>> {
-  const accepting = !!process.env[ACCEPT_ENV];
+export async function fetchSchemaZip(
+  force = false,
+  options: { env?: NodeJS.ProcessEnv; download?: PinAssetDownloader; pinCacheDir?: string } = {},
+): Promise<Map<string, Buffer>> {
+  const env = options.env ?? process.env;
+  const accepting = !!env[ACCEPT_ENV];
   if (!force && !accepting) {
-    const pinned = await loadPinnedSchemas();
+    const pinned = await loadPinnedSchemas({ download: options.download, cacheDir: options.pinCacheDir });
     if (pinned) return pinned;
+    if (env[RELEASE_GATE_ENV] === "1") {
+      throw new Error(
+        `${RELEASE_GATE_ENV}=1 and the pinned spec asset could not be loaded (${pinAssetUrl()}) — ` +
+          `refusing to build a release from the live CloudFormation archive, which is not the content ` +
+          `the pin was reviewed against. Check the asset exists on the ${SPEC_PIN_RELEASE_TAG} release ` +
+          `(the accept flow uploads it: ${ACCEPT_ENV}=1 npm run generate).`,
+      );
+    }
+    console.error(`pinned spec asset unavailable (${pinAssetUrl()}); falling back to the live CloudFormation archive`);
   }
   const zipData = await fetchWithCache(
     { url: SCHEMA_ZIP_URL, cacheFile: CACHE_FILE },