@itssergio91/sandman 0.2.0 → 0.3.0

package/dist/providers/aws/adapter.js

@@ -1,6 +1,10 @@
+import { enableResult } from "../enable-result.js";
+import { logger } from "../../utils/logger.js";
 export class AwsAdapter {
     accountId = null;
+    callerArn = null;
     region = "us-east-1";
+    regionExplicit = false;
     async init() {
         try {
             const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
@@ -8,7 +12,10 @@ export class AwsAdapter {
             const command = new GetCallerIdentityCommand({});
             const response = await client.send(command);
             this.accountId = response.Account || null;
-            this.region = process.env.AWS_DEFAULT_REGION || "us-east-1";
+            this.callerArn = response.Arn || null;
+            if (!this.regionExplicit) {
+                this.region = process.env.AWS_DEFAULT_REGION || "us-east-1";
+            }
         }
         catch (error) {
             if (error.name === "CredentialsProviderError") {
@@ -17,60 +24,124 @@ export class AwsAdapter {
             throw error;
         }
     }
+    setRegion(region) {
+        this.region = region;
+        this.regionExplicit = true;
+    }
     async createEnvironment(name) {
         const bucketName = `sandman-${name}-${Date.now()}`;
         const resources = {};
+        const warnings = [];
         try {
-            // Create S3 bucket
             const { S3Client, CreateBucketCommand } = await import("@aws-sdk/client-s3");
             const s3Client = new S3Client({ region: this.region });
             await s3Client.send(new CreateBucketCommand({
                 Bucket: bucketName,
             }));
+            const { PutPublicAccessBlockCommand, PutBucketEncryptionCommand, PutBucketTaggingCommand, } = await import("@aws-sdk/client-s3");
+            await s3Client.send(new PutPublicAccessBlockCommand({
+                Bucket: bucketName,
+                PublicAccessBlockConfiguration: {
+                    BlockPublicAcls: true,
+                    IgnorePublicAcls: true,
+                    BlockPublicPolicy: true,
+                    RestrictPublicBuckets: true,
+                },
+            }));
+            await s3Client.send(new PutBucketEncryptionCommand({
+                Bucket: bucketName,
+                ServerSideEncryptionConfiguration: {
+                    Rules: [
+                        {
+                            ApplyServerSideEncryptionByDefault: {
+                                SSEAlgorithm: "AES256",
+                            },
+                            BucketKeyEnabled: true,
+                        },
+                    ],
+                },
+            }));
+            try {
+                await s3Client.send(new PutBucketTaggingCommand({
+                    Bucket: bucketName,
+                    Tagging: {
+                        TagSet: [
+                            { Key: "CreatedBy", Value: "sandman" },
+                            { Key: "Name", Value: `sandman-${name}` },
+                        ],
+                    },
+                }));
+            }
+            catch (error) {
+                logger.warn(`Could not tag bucket: ${error.message}`);
+            }
             resources.bucketName = bucketName;
         }
         catch (error) {
-            if (error.name !== "BucketAlreadyOwnedByYou") {
-                console.warn("Could not create bucket:", error.message);
+            if (error.name === "BucketAlreadyOwnedByYou") {
+                resources.bucketName = bucketName;
+            }
+            else {
+                warnings.push(`bucket: ${error.message}`);
+                logger.warn(`Could not create bucket: ${error.message}`);
             }
         }
-        // Create VPC and networking
         try {
             const vpcResources = await this.createVpcResources(name);
-            Object.assign(resources, vpcResources);
+            for (const [key, value] of Object.entries(vpcResources)) {
+                if (value) {
+                    resources[key] = value;
+                }
+            }
         }
         catch (error) {
-            console.warn("Could not create VPC:", error.message);
+            warnings.push(`vpc: ${error.message}`);
+            logger.warn(`Could not create VPC: ${error.message}`);
         }
-        // Create IAM role
         try {
             const iamResources = await this.createIamResources(name);
-            Object.assign(resources, iamResources);
+            for (const [key, value] of Object.entries(iamResources)) {
+                if (value) {
+                    resources[key] = value;
+                }
+            }
         }
         catch (error) {
-            console.warn("Could not create IAM role:", error.message);
+            warnings.push(`iam: ${error.message}`);
+            logger.warn(`Could not create IAM role: ${error.message}`);
         }
-        // Create EC2 instance
         try {
             if (resources.vpcId && resources.subnetId && resources.securityGroupId) {
                 const instanceId = await this.createEc2Instance(name, resources.subnetId, resources.securityGroupId, resources.iamInstanceProfile);
-                resources.instanceId = instanceId;
+                if (instanceId) {
+                    resources.instanceId = instanceId;
+                }
             }
         }
         catch (error) {
-            console.warn("Could not create EC2 instance:", error.message);
+            warnings.push(`ec2: ${error.message}`);
+            logger.warn(`Could not create EC2 instance: ${error.message}`);
         }
         const now = new Date().toISOString();
+        const hasResources = Object.keys(resources).length > 0;
+        if (!hasResources) {
+            throw new Error(`Failed to create any AWS resources for "${name}"${warnings.length ? `: ${warnings.join("; ")}` : "."}`);
+        }
+        const complete = Boolean(resources.bucketName &&
+            resources.vpcId &&
+            resources.subnetId &&
+            resources.securityGroupId);
         return {
             name,
             provider: "aws",
             accountId: this.accountId || undefined,
             region: this.region,
-            status: "active",
+            status: complete ? "active" : "failed",
             services: [],
             resources,
             createdAt: now,
             updatedAt: now,
+            error: complete ? undefined : warnings.join("; ") || "Partial AWS create",
         };
     }
     async createVpcResources(name) {
@@ -171,16 +242,11 @@ export class AwsAdapter {
             ],
         }));
         resources.securityGroupId = sgResponse.GroupId || "";
-        // Allow SSH and HTTP/HTTPS
+        // HTTP/HTTPS for demos. SSH is not opened to the internet; use SSM
+        // (AmazonSSMManagedInstanceCore is attached to the instance role).
         await ec2Client.send(new AuthorizeSecurityGroupIngressCommand({
             GroupId: resources.securityGroupId,
             IpPermissions: [
-                {
-                    IpProtocol: "tcp",
-                    FromPort: 22,
-                    ToPort: 22,
-                    IpRanges: [{ CidrIp: "0.0.0.0/0", Description: "SSH" }],
-                },
                 {
                     IpProtocol: "tcp",
                     FromPort: 80,
@@ -236,7 +302,8 @@ export class AwsAdapter {
             InstanceProfileName: instanceProfileName,
         }));
         resources.iamInstanceProfile =
-            profileResponse.InstanceProfile?.InstanceProfileName || "";
+            profileResponse.InstanceProfile?.InstanceProfileName ||
+                instanceProfileName;
         // Add role to instance profile
         await iamClient.send(new AddRoleToInstanceProfileCommand({
             InstanceProfileName: instanceProfileName,
@@ -247,8 +314,9 @@ export class AwsAdapter {
     async createEc2Instance(name, subnetId, securityGroupId, iamInstanceProfile) {
         const { EC2Client, RunInstancesCommand } = await import("@aws-sdk/client-ec2");
         const ec2Client = new EC2Client({ region: this.region });
+        const imageId = await this.resolveAmi();
         const instanceResponse = await ec2Client.send(new RunInstancesCommand({
-            ImageId: "ami-0c7217cdde317cfec", // Amazon Linux 2023
+            ImageId: imageId,
             InstanceType: "t2.micro",
             MinCount: 1,
             MaxCount: 1,
@@ -269,8 +337,72 @@ export class AwsAdapter {
         }));
         return instanceResponse.Instances?.[0]?.InstanceId || "";
     }
+    static FALLBACK_AMI = "ami-0c7217cdde317cfec";
+    async resolveAmi() {
+        try {
+            const { SSMClient, GetParameterCommand } = await import("@aws-sdk/client-ssm");
+            const ssm = new SSMClient({ region: this.region });
+            const response = await ssm.send(new GetParameterCommand({
+                Name: "/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64",
+            }));
+            const ami = response.Parameter?.Value;
+            if (ami) {
+                return ami;
+            }
+        }
+        catch (error) {
+            logger.warn(`Could not resolve latest AL2023 AMI via SSM (${error.message}); falling back to ${AwsAdapter.FALLBACK_AMI}`);
+        }
+        return AwsAdapter.FALLBACK_AMI;
+    }
     async enableServices(env, services) {
-        console.log(`Enabling AWS services: ${services.join(", ")}`);
+        const provisioned = [];
+        const localOnly = [];
+        const warnings = [];
+        const alreadyInCloud = {
+            s3: Boolean(env.resources.bucketName),
+            ec2: Boolean(env.resources.instanceId),
+            iam: Boolean(env.resources.iamRoleArn || env.resources.iamInstanceProfile),
+        };
+        for (const service of services) {
+            if (alreadyInCloud[service]) {
+                provisioned.push(service);
+                continue;
+            }
+            localOnly.push(service);
+            if (service === "lambda") {
+                warnings.push("lambda is not provisioned by sandman enable; recorded locally only.");
+            }
+            else if (service === "s3" || service === "ec2" || service === "iam") {
+                warnings.push(`${service} was not created by sandman create; recorded locally only.`);
+            }
+            else {
+                warnings.push(`${service} is recorded locally only and was not provisioned in AWS.`);
+            }
+        }
+        logger.info(`AWS enable recorded ${services.join(", ")} (cloud: ${provisioned.join(", ") || "none"}; local-only: ${localOnly.join(", ") || "none"})`);
+        return enableResult({
+            recorded: services,
+            provisioned,
+            localOnly,
+            warnings,
+        });
+    }
+    async whoami() {
+        if (!this.accountId) {
+            try {
+                await this.init();
+            }
+            catch {
+                // Leave identity empty; doctor will surface AUTH_REQUIRED.
+            }
+        }
+        return {
+            provider: "aws",
+            accountId: this.accountId,
+            region: this.region,
+            callerArn: this.callerArn,
+        };
     }
     async connect(env) {
         const result = {
@@ -297,47 +429,35 @@ export class AwsAdapter {
         return result;
     }
     async destroyEnvironment(env) {
+        await this.assertCallerAccount(env);
+        await this.assertSandmanOwnership(env);
         const { EC2Client } = await import("@aws-sdk/client-ec2");
-        const ec2Client = new EC2Client({ region: env.region });
+        const ec2Client = new EC2Client({ region: env.region || this.region });
+        const failures = [];
         // Terminate EC2 instance
         if (env.resources.instanceId) {
             try {
-                const { TerminateInstancesCommand } = await import("@aws-sdk/client-ec2");
+                const { TerminateInstancesCommand, waitUntilInstanceTerminated } = await import("@aws-sdk/client-ec2");
                 await ec2Client.send(new TerminateInstancesCommand({
                     InstanceIds: [env.resources.instanceId],
                 }));
-                console.log(`Terminated EC2 instance: ${env.resources.instanceId}`);
+                if (typeof waitUntilInstanceTerminated === "function") {
+                    await waitUntilInstanceTerminated({ client: ec2Client, maxWaitTime: 60 }, { InstanceIds: [env.resources.instanceId] });
+                }
+                logger.info(`Terminated EC2 instance: ${env.resources.instanceId}`);
             }
             catch (error) {
-                console.warn("Could not terminate instance:", error.message);
+                failures.push(`instance: ${error.message}`);
             }
         }
-        // Delete S3 bucket
         if (env.resources.bucketName) {
             try {
-                const { S3Client, DeleteBucketCommand, ListObjectsV2Command, DeleteObjectsCommand, } = await import("@aws-sdk/client-s3");
-                const s3Client = new S3Client({ region: env.region });
-                const listResponse = await s3Client.send(new ListObjectsV2Command({
-                    Bucket: env.resources.bucketName,
-                }));
-                if (listResponse.Contents?.length) {
-                    await s3Client.send(new DeleteObjectsCommand({
-                        Bucket: env.resources.bucketName,
-                        Delete: {
-                            Objects: listResponse.Contents.map((obj) => ({
-                                Key: obj.Key,
-                            })),
-                        },
-                    }));
-                }
-                await s3Client.send(new DeleteBucketCommand({
-                    Bucket: env.resources.bucketName,
-                }));
-                console.log(`Deleted S3 bucket: ${env.resources.bucketName}`);
+                await this.emptyAndDeleteBucket(env.resources.bucketName, env.region);
+                logger.info(`Deleted S3 bucket: ${env.resources.bucketName}`);
             }
             catch (error) {
                 if (error.name !== "NoSuchBucket") {
-                    console.warn("Could not delete bucket:", error.message);
+                    failures.push(`bucket: ${error.message}`);
                 }
             }
         }
@@ -348,53 +468,45 @@ export class AwsAdapter {
                 const iamClient = new IAMClient({ region: env.region });
                 const roleName = `sandman-${env.name}-role`;
                 const instanceProfileName = env.resources.iamInstanceProfile;
-                // Remove role from instance profile
                 await iamClient.send(new RemoveRoleFromInstanceProfileCommand({
                     InstanceProfileName: instanceProfileName,
                     RoleName: roleName,
                 }));
-                // Delete instance profile
                 await iamClient.send(new DeleteInstanceProfileCommand({
                     InstanceProfileName: instanceProfileName,
                 }));
-                // Detach policy from role
                 await iamClient.send(new DetachRolePolicyCommand({
                     RoleName: roleName,
                     PolicyArn: "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
                 }));
-                // Delete role
                 await iamClient.send(new DeleteRoleCommand({
                     RoleName: roleName,
                 }));
-                console.log(`Deleted IAM role and instance profile for: ${env.name}`);
+                logger.info(`Deleted IAM role and instance profile for: ${env.name}`);
             }
             catch (error) {
-                console.warn("Could not delete IAM resources:", error.message);
+                failures.push(`iam: ${error.message}`);
             }
         }
         // Delete VPC resources
         if (env.resources.vpcId) {
             try {
                 const { DeleteSecurityGroupCommand, DeleteRouteTableCommand, DeleteSubnetCommand, DetachInternetGatewayCommand, DeleteInternetGatewayCommand, DeleteVpcCommand, } = await import("@aws-sdk/client-ec2");
-                // Delete security group
                 if (env.resources.securityGroupId) {
                     await ec2Client.send(new DeleteSecurityGroupCommand({
                         GroupId: env.resources.securityGroupId,
                     }));
                 }
-                // Delete route table
                 if (env.resources.routeTableId) {
                     await ec2Client.send(new DeleteRouteTableCommand({
                         RouteTableId: env.resources.routeTableId,
                     }));
                 }
-                // Delete subnet
                 if (env.resources.subnetId) {
                     await ec2Client.send(new DeleteSubnetCommand({
                         SubnetId: env.resources.subnetId,
                     }));
                 }
-                // Detach and delete internet gateway
                 if (env.resources.internetGatewayId) {
                     await ec2Client.send(new DetachInternetGatewayCommand({
                         InternetGatewayId: env.resources.internetGatewayId,
@@ -404,19 +516,246 @@ export class AwsAdapter {
                         InternetGatewayId: env.resources.internetGatewayId,
                     }));
                 }
-                // Delete VPC
                 await ec2Client.send(new DeleteVpcCommand({
                     VpcId: env.resources.vpcId,
                 }));
-                console.log(`Deleted VPC and associated resources for: ${env.name}`);
+                logger.info(`Deleted VPC and associated resources for: ${env.name}`);
+            }
+            catch (error) {
+                failures.push(`vpc: ${error.message}`);
+            }
+        }
+        if (failures.length > 0) {
+            throw new Error(`Failed to fully destroy environment "${env.name}": ${failures.join("; ")}. Local state was not updated — retry destroy after resolving these errors.`);
+        }
+    }
+    async assertCallerAccount(env) {
+        if (!env.accountId) {
+            return;
+        }
+        const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
+        const sts = new STSClient({ region: env.region || this.region });
+        const identity = await sts.send(new GetCallerIdentityCommand({}));
+        if (identity.Account && identity.Account !== env.accountId) {
+            throw new Error(`Refusing to destroy "${env.name}": state account ${env.accountId} does not match caller ${identity.Account}.`);
+        }
+    }
+    isSandmanOwned(tags, fallbackName) {
+        if (tags?.some((t) => t.Key === "CreatedBy" && t.Value === "sandman")) {
+            return true;
+        }
+        return Boolean(fallbackName?.startsWith("sandman-"));
+    }
+    isMissingAwsResource(error) {
+        const name = error?.name || "";
+        const message = error?.message || "";
+        return (name === "NoSuchBucket" ||
+            name === "NotFound" ||
+            name === "NoSuchTagSet" ||
+            name === "NoSuchEntity" ||
+            name === "InvalidInstanceID.NotFound" ||
+            name === "InvalidVpcID.NotFound" ||
+            name === "InvalidGroup.NotFound" ||
+            name === "InvalidSubnetID.NotFound" ||
+            name === "InvalidInternetGatewayID.NotFound" ||
+            error?.$metadata?.httpStatusCode === 404 ||
+            /not found|does not exist/i.test(message));
+    }
+    async assertSandmanOwnership(env) {
+        const region = env.region || this.region;
+        const { EC2Client } = await import("@aws-sdk/client-ec2");
+        const ec2Client = new EC2Client({ region });
+        const refuse = (resource, id) => {
+            throw new Error(`Refusing to destroy ${resource} ${id}: it is not tagged CreatedBy=sandman and does not use a sandman- name prefix.`);
+        };
+        if (env.resources.instanceId) {
+            try {
+                const { DescribeInstancesCommand } = await import("@aws-sdk/client-ec2");
+                const described = await ec2Client.send(new DescribeInstancesCommand({
+                    InstanceIds: [env.resources.instanceId],
+                }));
+                const instance = described.Reservations?.[0]?.Instances?.[0];
+                const nameTag = instance?.Tags?.find((t) => t.Key === "Name")?.Value;
+                if (instance && !this.isSandmanOwned(instance.Tags, nameTag)) {
+                    refuse("instance", env.resources.instanceId);
+                }
             }
             catch (error) {
-                console.warn("Could not delete VPC resources:", error.message);
+                if (!this.isMissingAwsResource(error)) {
+                    throw error;
+                }
+            }
+        }
+        if (env.resources.vpcId) {
+            try {
+                const { DescribeVpcsCommand } = await import("@aws-sdk/client-ec2");
+                const described = await ec2Client.send(new DescribeVpcsCommand({ VpcIds: [env.resources.vpcId] }));
+                const vpc = described.Vpcs?.[0];
+                const nameTag = vpc?.Tags?.find((t) => t.Key === "Name")?.Value;
+                if (vpc && !this.isSandmanOwned(vpc.Tags, nameTag)) {
+                    refuse("vpc", env.resources.vpcId);
+                }
+            }
+            catch (error) {
+                if (!this.isMissingAwsResource(error)) {
+                    throw error;
+                }
+            }
+        }
+        if (env.resources.bucketName) {
+            const bucket = env.resources.bucketName;
+            try {
+                const { S3Client, GetBucketTaggingCommand } = await import("@aws-sdk/client-s3");
+                const s3 = new S3Client({ region });
+                const tagging = await s3.send(new GetBucketTaggingCommand({ Bucket: bucket }));
+                if (!this.isSandmanOwned(tagging.TagSet, bucket)) {
+                    refuse("bucket", bucket);
+                }
+            }
+            catch (error) {
+                if (error.name !== "NoSuchBucket" && !bucket.startsWith("sandman-")) {
+                    refuse("bucket", bucket);
+                }
+            }
+        }
+        if (env.resources.iamInstanceProfile) {
+            const profile = String(env.resources.iamInstanceProfile);
+            if (!profile.startsWith("sandman-")) {
+                refuse("iam instance profile", profile);
             }
         }
     }
+    async emptyAndDeleteBucket(bucket, region) {
+        const { S3Client, DeleteBucketCommand, ListObjectsV2Command, ListObjectVersionsCommand, DeleteObjectsCommand, } = await import("@aws-sdk/client-s3");
+        const s3Client = new S3Client({ region });
+        let token;
+        do {
+            const listResponse = await s3Client.send(new ListObjectsV2Command({
+                Bucket: bucket,
+                ContinuationToken: token,
+            }));
+            if (listResponse.Contents?.length) {
+                await s3Client.send(new DeleteObjectsCommand({
+                    Bucket: bucket,
+                    Delete: {
+                        Objects: listResponse.Contents.map((obj) => ({
+                            Key: obj.Key,
+                        })),
+                    },
+                }));
+            }
+            token = listResponse.IsTruncated
+                ? listResponse.NextContinuationToken
+                : undefined;
+        } while (token);
+        let keyMarker;
+        let versionIdMarker;
+        do {
+            const versions = await s3Client.send(new ListObjectVersionsCommand({
+                Bucket: bucket,
+                KeyMarker: keyMarker,
+                VersionIdMarker: versionIdMarker,
+            }));
+            const objects = [
+                ...(versions.Versions ?? []).map((v) => ({
+                    Key: v.Key,
+                    VersionId: v.VersionId,
+                })),
+                ...(versions.DeleteMarkers ?? []).map((m) => ({
+                    Key: m.Key,
+                    VersionId: m.VersionId,
+                })),
+            ];
+            if (objects.length) {
+                await s3Client.send(new DeleteObjectsCommand({
+                    Bucket: bucket,
+                    Delete: { Objects: objects },
+                }));
+            }
+            keyMarker = versions.IsTruncated ? versions.NextKeyMarker : undefined;
+            versionIdMarker = versions.IsTruncated
+                ? versions.NextVersionIdMarker
+                : undefined;
+        } while (keyMarker);
+        await s3Client.send(new DeleteBucketCommand({
+            Bucket: bucket,
+        }));
+    }
     async getStatus(env) {
-        return env;
+        const region = env.region || this.region;
+        const missing = [];
+        const unhealthy = [];
+        if (env.resources.bucketName) {
+            const bucket = env.resources.bucketName;
+            try {
+                const { S3Client, HeadBucketCommand } = await import("@aws-sdk/client-s3");
+                const s3 = new S3Client({ region });
+                await s3.send(new HeadBucketCommand({ Bucket: bucket }));
+            }
+            catch (error) {
+                if (this.isMissingAwsResource(error)) {
+                    missing.push(`bucket ${bucket}`);
+                }
+                else {
+                    unhealthy.push(`bucket ${bucket}: ${error.message}`);
+                }
+            }
+        }
+        if (env.resources.instanceId) {
+            const instanceId = env.resources.instanceId;
+            try {
+                const { EC2Client, DescribeInstancesCommand } = await import("@aws-sdk/client-ec2");
+                const ec2 = new EC2Client({ region });
+                const described = await ec2.send(new DescribeInstancesCommand({ InstanceIds: [instanceId] }));
+                const instance = described.Reservations?.[0]?.Instances?.[0];
+                const state = instance?.State?.Name;
+                if (!instance || state === "terminated" || state === "shutting-down") {
+                    missing.push(`instance ${instanceId}`);
+                }
+                else if (state && state !== "running" && state !== "pending") {
+                    unhealthy.push(`instance ${instanceId} is ${state}`);
+                }
+            }
+            catch (error) {
+                if (this.isMissingAwsResource(error)) {
+                    missing.push(`instance ${instanceId}`);
+                }
+                else {
+                    unhealthy.push(`instance ${instanceId}: ${error.message}`);
+                }
+            }
+        }
+        const tracked = Boolean(env.resources.bucketName) || Boolean(env.resources.instanceId);
+        if (!tracked) {
+            return env;
+        }
+        const now = new Date().toISOString();
+        if (missing.length > 0 && unhealthy.length === 0) {
+            const allGone = (!env.resources.bucketName ||
+                missing.some((m) => m.startsWith("bucket "))) &&
+                (!env.resources.instanceId ||
+                    missing.some((m) => m.startsWith("instance ")));
+            return {
+                ...env,
+                status: allGone ? "destroyed" : "failed",
+                error: `Cloud resources missing: ${missing.join("; ")}`,
+                updatedAt: now,
+            };
+        }
+        if (missing.length > 0 || unhealthy.length > 0) {
+            return {
+                ...env,
+                status: "failed",
+                error: [...missing.map((m) => `missing ${m}`), ...unhealthy].join("; "),
+                updatedAt: now,
+            };
+        }
+        return {
+            ...env,
+            status: "active",
+            error: undefined,
+            updatedAt: now,
+        };
     }
     getAccountInfo() {
         return {