@izara_project/izara-core-generate-service-code 1.0.51 → 1.0.53

package/src/codeGenerators/app/sls_yaml/SharedResourceYamlGenerator.js

@@ -0,0 +1,471 @@
+import fs from 'fs/promises';
+import path from 'path';
+import ejs from 'ejs';
+import { fileURLToPath } from 'url';
+import { policyRegistry } from './_policy/PolicyRegistry.js';
+import { getFlowsForGeneration } from '../src/generatedCode/Flow/_internal/shared/flowSelection.js';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+const APP_SOURCE_FILES = [
+  'find-data.yml',
+  'flow-schema.yml',
+  'per-action-function.yml',
+  'process-logical.yml',
+  'relationship-per-action.yml'
+];
+
+const QUEUE_OWNERSHIP_PREFIXES = {
+  PerActionEndpointRole: ['Create', 'Update', 'Delete', 'Get'],
+  RelationshipRole: [
+    'CreateRelationship',
+    'UpdateRelationship',
+    'DeleteRelationship',
+    'GetRelationship',
+    'ChangeRelationship',
+    'MoveRelationship'
+  ],
+  ProcFindDataRole: ['FindData', 'ProcessLogical', 'PaginateProcessLogical'],
+  RegisterRole: ['Register'],
+  WebSocketMainRole: ['WebSocket']
+};
+
+function upperCase(str) {
+  if (!str) return str;
+  return str.charAt(0).toUpperCase() + str.slice(1);
+}
+
+async function readTextIfExists(filePath) {
+  try {
+    return await fs.readFile(filePath, 'utf8');
+  } catch {
+    return '';
+  }
+}
+
+function collectMatches(text, regex) {
+  const out = new Set();
+  for (const match of text.matchAll(regex)) {
+    if (match[1]) out.add(match[1]);
+  }
+  return out;
+}
+
+async function collectExplicitResourceNames(outputPath) {
+  const appSourceDir = path.join(
+    outputPath,
+    'app',
+    'sls_yaml',
+    'generatedCode',
+    'source'
+  );
+  const resourceSourceDir = path.join(
+    outputPath,
+    'resource',
+    'sls_yaml',
+    'generatedCode',
+    'source'
+  );
+
+  const resourceFiles = await Promise.all([
+    readTextIfExists(path.join(resourceSourceDir, 'generated-dynamoDB-table.yml')),
+    readTextIfExists(path.join(resourceSourceDir, 'generated-sns-in-sqs.yml')),
+    readTextIfExists(path.join(resourceSourceDir, 'generated-sns-out.yml')),
+    ...APP_SOURCE_FILES.map(fileName =>
+      readTextIfExists(path.join(appSourceDir, fileName))
+    )
+  ]);
+
+  const [dynamoText, snsInSqsText, snsOutText, ...appSourceTexts] = resourceFiles;
+  const appJoinedText = appSourceTexts.join('\n');
+
+  const tableNames = new Set([
+    ...collectMatches(
+      dynamoText,
+      /TableName:\s+\$\{self:custom\.iz_resourcePrefix\}([A-Za-z0-9]+)/g
+    )
+  ]);
+
+  const queueNames = new Set([
+    ...collectMatches(
+      snsInSqsText,
+      /QueueName:\s+\$\{self:custom\.iz_resourcePrefix\}([A-Za-z0-9]+)/g
+    ),
+    ...collectMatches(
+      appJoinedText,
+      /arn:aws:sqs:\$\{self:custom\.iz_region\}:\$\{self:custom\.iz_accountId\}:\$\{self:custom\.iz_resourcePrefix\}([A-Za-z0-9]+)/g
+    )
+  ]);
+
+  const topicNames = new Set([
+    ...collectMatches(
+      snsInSqsText,
+      /TopicName:\s+\$\{self:custom\.iz_serviceTag\}_\$\{self:custom\.iz_stage\}_([A-Za-z0-9]+)/g
+    ),
+    ...collectMatches(
+      snsOutText,
+      /TopicName:\s+\$\{self:custom\.iz_serviceTag\}_\$\{self:custom\.iz_stage\}_([A-Za-z0-9]+)/g
+    )
+  ]);
+
+  return {
+    tableNames: Array.from(tableNames).sort(),
+    queueNames: Array.from(queueNames).sort(),
+    topicNames: Array.from(topicNames).sort()
+  };
+}
+
+function splitTopLevelBlocks(text) {
+  const lines = text.split(/\r?\n/);
+  const blocks = [];
+  let current = [];
+
+  for (const line of lines) {
+    if (/^[A-Za-z0-9][A-Za-z0-9]*:/.test(line) && current.length > 0) {
+      blocks.push(current.join('\n'));
+      current = [line];
+      continue;
+    }
+    current.push(line);
+  }
+
+  if (current.length > 0) blocks.push(current.join('\n'));
+  return blocks;
+}
+
+function rolePrefixes(roleName) {
+  if (QUEUE_OWNERSHIP_PREFIXES[roleName]) {
+    return QUEUE_OWNERSHIP_PREFIXES[roleName];
+  }
+
+  if (roleName.endsWith('Role')) {
+    return [roleName.replace(/Role$/, '')];
+  }
+
+  return [roleName];
+}
+
+function topicBelongsToRole(roleName, topicName) {
+  const prefixes = rolePrefixes(roleName);
+
+  if (roleName === 'PerActionEndpointRole') {
+    return (
+      prefixes.some(prefix => topicName.startsWith(prefix)) &&
+      !topicName.includes('Relationship')
+    );
+  }
+
+  if (roleName === 'RelationshipRole') {
+    return prefixes.some(prefix => topicName.startsWith(prefix));
+  }
+
+  return prefixes.some(prefix => topicName.startsWith(prefix));
+}
+
+async function collectRoleScopedResourceNames(outputPath) {
+  const appSourceDir = path.join(
+    outputPath,
+    'app',
+    'sls_yaml',
+    'generatedCode',
+    'source'
+  );
+  const resourceSourceDir = path.join(
+    outputPath,
+    'resource',
+    'sls_yaml',
+    'generatedCode',
+    'source'
+  );
+
+  const texts = await Promise.all([
+    ...APP_SOURCE_FILES.map(fileName =>
+      readTextIfExists(path.join(appSourceDir, fileName))
+    ),
+    readTextIfExists(path.join(resourceSourceDir, 'generated-sns-in-sqs.yml')),
+    readTextIfExists(path.join(resourceSourceDir, 'generated-sns-out.yml'))
+  ]);
+
+  const appTexts = texts.slice(0, APP_SOURCE_FILES.length);
+  const snsInSqsText = texts[APP_SOURCE_FILES.length];
+  const snsOutText = texts[APP_SOURCE_FILES.length + 1];
+
+  const roleQueues = new Map();
+
+  for (const text of appTexts) {
+    for (const block of splitTopLevelBlocks(text)) {
+      const roleMatch = block.match(/role:\s+([A-Za-z0-9]+)/);
+      if (!roleMatch) continue;
+      const roleName = roleMatch[1];
+      const queueMatches = collectMatches(
+        block,
+        /arn:aws:sqs:\$\{self:custom\.iz_region\}:\$\{self:custom\.iz_accountId\}:\$\{self:custom\.iz_resourcePrefix\}([A-Za-z0-9]+)/g
+      );
+      if (!roleQueues.has(roleName)) roleQueues.set(roleName, new Set());
+      for (const queueName of queueMatches) {
+        roleQueues.get(roleName).add(queueName);
+      }
+    }
+  }
+
+  const topicToQueuePairs = [
+    ...snsInSqsText.matchAll(
+      /TopicName:\s+\$\{self:custom\.iz_serviceTag\}_\$\{self:custom\.iz_stage\}_([A-Za-z0-9]+)[\s\S]*?Endpoint:\s+"arn:aws:sqs:\$\{self:custom\.iz_region\}:\$\{self:custom\.iz_accountId\}:\$\{self:custom\.iz_resourcePrefix\}([A-Za-z0-9]+)"/g
+    )
+  ].map(match => ({
+    topicName: match[1],
+    queueName: match[2]
+  }));
+
+  const outTopics = Array.from(
+    collectMatches(
+      snsOutText,
+      /TopicName:\s+\$\{self:custom\.iz_serviceTag\}_\$\{self:custom\.iz_stage\}_([A-Za-z0-9]+)/g
+    )
+  );
+
+  const scoped = new Map();
+
+  for (const [roleName, queues] of roleQueues.entries()) {
+    const prefixes = rolePrefixes(roleName);
+    const topics = new Set();
+
+    for (const { topicName, queueName } of topicToQueuePairs) {
+      if (queues.has(queueName)) topics.add(topicName);
+    }
+
+    for (const topicName of outTopics) {
+      if (topicBelongsToRole(roleName, topicName)) {
+        topics.add(topicName);
+      }
+    }
+
+    scoped.set(roleName, {
+      queueNames: Array.from(queues).sort(),
+      topicNames: Array.from(topics).sort()
+    });
+  }
+
+  return scoped;
+}
+
+function buildBaselineStatements(roleName, resources, scopedResources) {
+  const statements = [
+    {
+      action: 's3:GetObject',
+      resource:
+        'arn:aws:s3:::${self:custom.iz_serviceSchemaBucketName}/perServiceSchemas/*'
+    },
+    {
+      action: 's3:GetObjectVersion',
+      resource:
+        'arn:aws:s3:::${self:custom.iz_serviceSchemaBucketName}/perServiceSchemas/*'
+    },
+    {
+      action: 's3:GetObject',
+      resource:
+        'arn:aws:s3:::${self:custom.iz_serviceSchemaBucketName}/serviceConfig/GraphServerTags.json'
+    },
+    {
+      action: 's3:GetObjectVersion',
+      resource:
+        'arn:aws:s3:::${self:custom.iz_serviceSchemaBucketName}/serviceConfig/GraphServerTags.json'
+    },
+    {
+      action: 's3:ListBucket',
+      resource: 'arn:aws:s3:::${self:custom.iz_serviceSchemaBucketName}'
+    }
+  ];
+
+  const roleScoped = scopedResources.get(roleName) || {
+    queueNames: [],
+    topicNames: []
+  };
+
+  for (const tableName of resources.tableNames) {
+    const arn =
+      'arn:aws:dynamodb:${self:custom.iz_region}:${self:custom.iz_accountId}:table/' +
+      '${self:custom.iz_resourcePrefix}' +
+      tableName;
+
+    for (const action of [
+      'dynamodb:DeleteItem',
+      'dynamodb:GetItem',
+      'dynamodb:PutItem',
+      'dynamodb:Query',
+      'dynamodb:UpdateItem'
+    ]) {
+      statements.push({ action, resource: arn });
+    }
+  }
+
+  for (const queueName of roleScoped.queueNames) {
+    const arn =
+      'arn:aws:sqs:${self:custom.iz_region}:${self:custom.iz_accountId}:' +
+      '${self:custom.iz_resourcePrefix}' +
+      queueName;
+
+    for (const action of [
+      'sqs:DeleteMessage',
+      'sqs:DeleteMessageBatch',
+      'sqs:GetQueueAttributes',
+      'sqs:GetQueueUrl',
+      'sqs:ReceiveMessage',
+      'sqs:SendMessage'
+    ]) {
+      statements.push({ action, resource: arn });
+    }
+  }
+
+  for (const topicName of roleScoped.topicNames) {
+    const arn =
+      'arn:aws:sns:${self:custom.iz_region}:${self:custom.iz_accountId}:' +
+      '${self:custom.iz_serviceTag}_${self:custom.iz_stage}_' +
+      topicName;
+
+    statements.push({ action: 'sns:Publish', resource: arn });
+    statements.push({ action: 'sns:Subscribe', resource: arn });
+  }
+
+  return statements;
+}
+
+function groupStatementsByResources(statements) {
+  const grouped = new Map();
+
+  for (const statement of statements) {
+    const resources = [...(statement.resource || [])].sort();
+    const key = JSON.stringify(resources);
+
+    if (!grouped.has(key)) {
+      grouped.set(key, {
+        action: new Set(),
+        resource: resources
+      });
+    }
+
+    const entry = grouped.get(key);
+    for (const action of statement.action || []) {
+      entry.action.add(action);
+    }
+  }
+
+  return [...grouped.values()].map(entry => ({
+    action: [...entry.action].sort(),
+    resource: entry.resource
+  }));
+}
+
+export async function generateSharedResourceYaml(allSchemas, options) {
+  console.log(
+    '  [SharedResourceYamlGenerator] Generating Shared Resource YAML (IAM Roles)...'
+  );
+
+  const slsYamlDir = path.join(
+    options.outputPath,
+    'app',
+    'sls_yaml',
+    'generatedCode',
+    'source'
+  );
+  await fs.mkdir(slsYamlDir, { recursive: true });
+
+  const roleNameConfigs = new Set();
+
+  roleNameConfigs.add('ProcFindDataRole');
+  roleNameConfigs.add('RegisterRole');
+
+  if (allSchemas.objects && allSchemas.objects.length > 0) {
+    roleNameConfigs.add('PerActionEndpointRole');
+  }
+
+  if (allSchemas.relationships && allSchemas.relationships.length > 0) {
+    roleNameConfigs.add('RelationshipRole');
+  }
+
+  const flows = getFlowsForGeneration(allSchemas);
+  if (
+    flows.length > 0 &&
+    flows.some(flow => flow.event && flow.event.includes('ownTopic'))
+  ) {
+    roleNameConfigs.add('WebSocketMainRole');
+  }
+
+  const standardRoles = [
+    'PerActionEndpointRole',
+    'RelationshipRole',
+    'WebSocketMainRole',
+    'ProcFindDataRole',
+    'RegisterRole'
+  ];
+
+  for (const flow of flows) {
+    if (!flow.flowTag) continue;
+    const upperFlowTag = upperCase(flow.flowTag);
+    if (QUEUE_OWNERSHIP_PREFIXES.RelationshipRole.includes(upperFlowTag)) {
+      continue;
+    }
+    if (!standardRoles.includes(`${upperFlowTag}Role`)) {
+      roleNameConfigs.add(`${upperFlowTag}Role`);
+    }
+  }
+
+  const allResources = await collectExplicitResourceNames(options.outputPath);
+  const scopedResources = await collectRoleScopedResourceNames(options.outputPath);
+
+  for (const roleName of roleNameConfigs) {
+    policyRegistry.addMany(
+      roleName,
+      buildBaselineStatements(roleName, allResources, scopedResources)
+    );
+
+    if (roleName === 'WebSocketMainRole') {
+      policyRegistry.addMany(roleName, [
+        {
+          action: 'execute-api:ManageConnections',
+          resource:
+            'arn:aws:execute-api:${self:custom.iz_region}:${self:custom.iz_accountId}:${self:custom.iz_webSocketHostId}/*'
+        },
+        {
+          action: 'execute-api:Invoke',
+          resource:
+            'arn:aws:execute-api:${self:custom.iz_region}:${self:custom.iz_accountId}:${self:custom.iz_webSocketHostId}/*'
+        }
+      ]);
+    }
+  }
+
+  const groupedStatements = policyRegistry.toGroupedByRole();
+  const roles = Array.from(roleNameConfigs).map(roleName => ({
+    roleName,
+    statements: groupStatementsByResources(
+      groupedStatements[roleName]?.statements || []
+    )
+  }));
+
+  const templatePath = path.join(__dirname, 'templates', 'SharedResource_Yaml.ejs');
+  let templateString;
+  try {
+    templateString = await fs.readFile(templatePath, 'utf-8');
+  } catch (error) {
+    console.error('Error reading SharedResource YAML template:', error);
+    return;
+  }
+
+  const fileContent = ejs.render(templateString, { roles });
+  let normalizedContent = fileContent
+    .split('\n')
+    .filter(line => line.trim() !== '')
+    .join('\n');
+    
+  normalizedContent = normalizedContent
+    .replace(/^  [A-Za-z0-9]+:/gm, '\n$&')
+    .replace(/^Resources:\n+  /, 'Resources:\n  ') + '\n';
+
+  const outputPath = path.join(slsYamlDir, 'generate-shared-resource.yml');
+  await fs.writeFile(outputPath, normalizedContent, 'utf-8');
+  console.log(
+    `  [SharedResourceYamlGenerator] Wrote generate-shared-resource.yml to ${outputPath}`
+  );
+}

package/src/codeGenerators/app/sls_yaml/__tests__/SharedResourceYamlGenerator.test.js

@@ -0,0 +1,176 @@
+import { describe, it, expect, beforeEach } from '@jest/globals';
+import path from 'path';
+import fs from 'fs/promises';
+import os from 'os';
+import { policyRegistry } from '../_policy/PolicyRegistry.js';
+import { generateSharedResourceYaml } from '../SharedResourceYamlGenerator.js';
+
+describe('generateSharedResourceYaml', () => {
+  let tmpDir;
+
+  beforeEach(async () => {
+    tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'iz-shared-resource-'));
+    policyRegistry.clear();
+
+    await fs.mkdir(
+      path.join(tmpDir, 'resource', 'sls_yaml', 'generatedCode', 'source'),
+      { recursive: true }
+    );
+    await fs.mkdir(
+      path.join(tmpDir, 'app', 'sls_yaml', 'generatedCode', 'source'),
+      { recursive: true }
+    );
+
+    await fs.writeFile(
+      path.join(
+        tmpDir,
+        'resource',
+        'sls_yaml',
+        'generatedCode',
+        'source',
+        'generated-dynamoDB-table.yml'
+      ),
+      [
+        'Resources:',
+        '  AwaitingStepTable:',
+        '    Properties:',
+        '      TableName: ${self:custom.iz_resourcePrefix}AwaitingStep'
+      ].join('\n'),
+      'utf8'
+    );
+
+    await fs.writeFile(
+      path.join(
+        tmpDir,
+        'resource',
+        'sls_yaml',
+        'generatedCode',
+        'source',
+        'generated-sns-in-sqs.yml'
+      ),
+      [
+        'Resources:',
+        '  ReservationsSqs:',
+        '    Properties:',
+        '      QueueName: ${self:custom.iz_resourcePrefix}ReservationsSqs',
+        '  ReservationsSqsDLQ:',
+        '    Properties:',
+        '      QueueName: ${self:custom.iz_resourcePrefix}ReservationsSqsDLQ',
+        '  InReservations:',
+        '    Properties:',
+        '      TopicName: ${self:custom.iz_serviceTag}_${self:custom.iz_stage}_Reservations_In'
+      ].join('\n'),
+      'utf8'
+    );
+
+    await fs.writeFile(
+      path.join(
+        tmpDir,
+        'resource',
+        'sls_yaml',
+        'generatedCode',
+        'source',
+        'generated-sns-out.yml'
+      ),
+      [
+        'Resources:',
+        '  OutReservations:',
+        '    Properties:',
+        '      TopicName: ${self:custom.iz_serviceTag}_${self:custom.iz_stage}_Reservations_Out'
+      ].join('\n'),
+      'utf8'
+    );
+
+    await fs.writeFile(
+      path.join(
+        tmpDir,
+        'app',
+        'sls_yaml',
+        'generatedCode',
+        'source',
+        'flow-schema.yml'
+      ),
+      [
+        'ReservationsCompleteSqs:',
+        '  events:',
+        '    - sqs:',
+        '        arn: arn:aws:sqs:${self:custom.iz_region}:${self:custom.iz_accountId}:${self:custom.iz_resourcePrefix}ReservationsCompleteSqs'
+      ].join('\n'),
+      'utf8'
+    );
+  });
+
+  it('registers baseline IAM statements with explicit resources', async () => {
+    await generateSharedResourceYaml(
+      { objects: [{ objectType: 'Foo' }], flows: [] },
+      { outputPath: tmpDir }
+    );
+
+    const grouped = policyRegistry.toGroupedByRole();
+    expect(Object.keys(grouped).sort()).toEqual(
+      expect.arrayContaining([
+        'PerActionEndpointRole',
+        'ProcFindDataRole',
+        'RegisterRole'
+      ])
+    );
+
+    const resources = grouped.PerActionEndpointRole.statements.flatMap(
+      statement => statement.resource
+    );
+
+    expect(resources).toContain(
+      'arn:aws:s3:::${self:custom.iz_serviceSchemaBucketName}/perServiceSchemas/*'
+    );
+    expect(resources).toContain(
+      'arn:aws:dynamodb:${self:custom.iz_region}:${self:custom.iz_accountId}:table/${self:custom.iz_resourcePrefix}AwaitingStep'
+    );
+    expect(resources).toContain(
+      'arn:aws:sqs:${self:custom.iz_region}:${self:custom.iz_accountId}:${self:custom.iz_resourcePrefix}ReservationsSqs'
+    );
+    expect(resources).toContain(
+      'arn:aws:sqs:${self:custom.iz_region}:${self:custom.iz_accountId}:${self:custom.iz_resourcePrefix}ReservationsCompleteSqs'
+    );
+    expect(resources).toContain(
+      'arn:aws:sns:${self:custom.iz_region}:${self:custom.iz_accountId}:${self:custom.iz_serviceTag}_${self:custom.iz_stage}_Reservations_Out'
+    );
+    expect(resources).not.toContain(
+      'arn:aws:dynamodb:${self:custom.iz_region}:${self:custom.iz_accountId}:table/${self:custom.iz_resourcePrefix}*'
+    );
+    expect(resources).not.toContain(
+      'arn:aws:sqs:${self:custom.iz_region}:${self:custom.iz_accountId}:${self:custom.iz_resourcePrefix}*'
+    );
+  });
+
+  it('adds WebSocket permissions only for WebSocketMainRole when ownTopic flow exists', async () => {
+    await generateSharedResourceYaml(
+      { flows: [{ flowTag: 'dummy', event: ['ownTopic'] }] },
+      { outputPath: tmpDir }
+    );
+
+    const grouped = policyRegistry.toGroupedByRole();
+    expect(Object.keys(grouped)).toContain('WebSocketMainRole');
+    const wsActions = grouped.WebSocketMainRole.statements.flatMap(
+      statement => statement.action
+    );
+    expect(wsActions).toEqual(
+      expect.arrayContaining(['execute-api:ManageConnections'])
+    );
+  });
+
+  it('does not add WebSocket permissions for roles other than WebSocketMainRole', async () => {
+    await generateSharedResourceYaml(
+      { flows: [{ flowTag: 'dummy', event: ['ownTopic'] }] },
+      { outputPath: tmpDir }
+    );
+
+    const grouped = policyRegistry.toGroupedByRole();
+    for (const roleName of Object.keys(grouped)) {
+      if (roleName === 'WebSocketMainRole') continue;
+      const actions = grouped[roleName].statements.flatMap(
+        statement => statement.action
+      );
+      expect(actions).not.toContain('execute-api:ManageConnections');
+    }
+  });
+});

package/src/codeGenerators/app/sls_yaml/_policy/PolicyEmitter.js

@@ -0,0 +1,45 @@
+// src/codeGenerators/app/sls_yaml/_policy/PolicyEmitter.js
+//
+// Reads the PolicyRegistry at the end of the generation run and emits one
+// per-role .yml file containing a single AWS::IAM::ManagedPolicy. Each
+// managed policy attaches to its base role via `Roles: [ !Ref <RoleName> ]`.
+//
+// IMPORTANT: This emitter runs AFTER SharedResourceYamlGenerator so the
+// managed policies can reference the roles that generator just emitted.
+// See generateCode.js for the ordering.
+
+import fs from 'fs/promises';
+import path from 'path';
+import ejs from 'ejs';
+import { fileURLToPath } from 'url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+/**
+ * @param {import('./PolicyRegistry.js').PolicyRegistry} registry
+ * @param {{ outputPath: string }} options
+ */
+export async function emitManagedPolicies(registry, options) {
+  const outDir = path.join(
+    options.outputPath,
+    'app',
+    'sls_yaml',
+    'generatedCode',
+    'source',
+    'iam-managed-policies'
+  );
+  await fs.mkdir(outDir, { recursive: true });
+
+  const grouped = registry.toGroupedByRole();
+  const templatePath = path.join(__dirname, 'templates', 'ManagedPolicy_Yaml.ejs');
+  const tpl = await fs.readFile(templatePath, 'utf8');
+
+  for (const [roleName, { statements }] of Object.entries(grouped)) {
+    const content = ejs.render(tpl, { roleName, statements });
+    const outFile = path.join(outDir, `${roleName}Policy.yml`);
+    await fs.writeFile(outFile, content, 'utf8');
+  }
+
+  console.log(`  [PolicyEmitter] Wrote ${Object.keys(grouped).length} managed-policy file(s) to ${outDir}`);
+}