@izara_project/izara-core-generate-service-code 1.0.67 → 1.0.68

package/src/emit/resource/emitResourceArtifacts.js

@@ -13,6 +13,7 @@ import { hasSystemWebSocket } from '../system/emitSystemWebSocketArtifacts.js';
 const TEMPLATE_URL = new URL('./templates/', import.meta.url);
 const RESOURCE_ROOT = 'resource/sls_yaml/generatedCode/source';
 const APP_ROOT = 'app/sls_yaml/generatedCode/source';
+const INITIAL_SETUP_ROOT = 'app/initial_setup/generatedCode/source';
 const CRUD_ACTIONS = ['Create', 'Update', 'Delete', 'Get'];
 const RELATIONSHIP_ACTIONS = [
   'CreateRelationship',
@@ -83,11 +84,13 @@ export async function emitResourceArtifacts({
     throw new TypeError('objects, relationships, and flows must be arrays');
   }
   const state = createResourceState({ objects, relationships, flows });
-  const [inSqs, out, dynamo, iam] = await Promise.all([
+  const [inSqs, out, dynamo, iam, lambdaRoleConfig, s3] = await Promise.all([
     renderInSqs(state),
     renderOut(state),
     renderDynamo(state),
-    renderIam(state)
+    renderIam(state),
+    renderLambdaRoleConfig(state),
+    renderS3(state)
   ]);
   return [
     {
@@ -102,9 +105,17 @@ export async function emitResourceArtifacts({
       path: `${RESOURCE_ROOT}/generated-dynamoDB-table.yml`,
       content: normalizeYaml(dynamo)
     },
+    {
+      path: `${RESOURCE_ROOT}/generated-s3.yml`,
+      content: normalizeYaml(s3)
+    },
     {
       path: `${APP_ROOT}/generate-shared-resource.yml`,
       content: normalizeYaml(iam)
+    },
+    {
+      path: `${INITIAL_SETUP_ROOT}/generatedLambdaRoleServiceConfig.js`,
+      content: lambdaRoleConfig
     }
   ];
 }
@@ -113,7 +124,9 @@ export const resourceArtifactPaths = [
   `${RESOURCE_ROOT}/generated-sns-in-sqs.yml`,
   `${RESOURCE_ROOT}/generated-sns-out.yml`,
   `${RESOURCE_ROOT}/generated-dynamoDB-table.yml`,
-  `${APP_ROOT}/generate-shared-resource.yml`
+  `${RESOURCE_ROOT}/generated-s3.yml`,
+  `${APP_ROOT}/generate-shared-resource.yml`,
+  `${INITIAL_SETUP_ROOT}/generatedLambdaRoleServiceConfig.js`
 ];
 
 function createResourceState({ objects, relationships, flows }) {
@@ -169,9 +182,10 @@ function createResourceState({ objects, relationships, flows }) {
     });
     objects
       .filter(hasRbacAddOn)
-      .forEach(object =>
-        sqsQueues.add(`Process${upperFirst(object.objectType)}RbacFlowHdrInv`)
-      );
+      .forEach(object => {
+        const flowTag = upperFirst(object.objectType) + 'RbacFlow';
+        ownTopics.add(flowTag);
+      });
   }
   const beforeLogicalByAction = new Map();
   for (const flow of flows.filter(
@@ -197,9 +211,7 @@ function createResourceState({ objects, relationships, flows }) {
       ...flowExtTopicSteps(flows).map(({ flow }) =>
         customFlowRoleName(flow.flowTag)
       ),
-      ...flowDsqSteps(flows).map(({ flow }) =>
-        customFlowRoleName(flow.flowTag)
-      )
+      ...flowDsqSteps(flows).map(({ flow }) => customFlowRoleName(flow.flowTag))
     ])
   ];
   const websocket = hasSystemWebSocket(flows, {
@@ -227,6 +239,13 @@ function createResourceState({ objects, relationships, flows }) {
     ...collectTables(objects),
     ...collectTables(relationships)
   ]);
+  const externalDynamoTables = objects.flatMap(
+    object => object.externalDynamoResources ?? []
+  );
+  const s3Buckets = flows
+    .filter(flow => includesEvent(flow, 's3') && flow.createBucket === true)
+    .map(flow => flow.bucketName)
+    .filter(Boolean);
   return {
     crud,
     rbac,
@@ -243,7 +262,11 @@ function createResourceState({ objects, relationships, flows }) {
           .filter(
             topic =>
               flows.some(
-                flow => (flow?.outputTopic || (includesEvent(flow, 'ownTopic') && flow.initiateBy === 'user')) && upperFirst(flow.flowTag) === topic
+                flow =>
+                  (flow?.outputTopic ||
+                    (includesEvent(flow, 'ownTopic') &&
+                      flow.initiateBy === 'user')) &&
+                  upperFirst(flow.flowTag) === topic
               ) ||
               (relationships.length > 0 &&
                 topic !== 'GetRelationship' &&
@@ -259,6 +282,7 @@ function createResourceState({ objects, relationships, flows }) {
     allTableNames: [...new Set([...SYSTEM_TABLES, ...tableMap.keys()])].sort(),
     objectTableNames,
     relationshipTableNames,
+    externalDynamoTables,
     objectTablesByType: new Map(
       objects
         .map(object => [
@@ -269,10 +293,20 @@ function createResourceState({ objects, relationships, flows }) {
         ])
         .filter(([, tableName]) => tableName)
     ),
+    s3Buckets,
     flows
   };
 }
 
+async function renderS3(state) {
+  if (state.s3Buckets.length === 0) return 'Resources:';
+  const template = await readFile(new URL('S3Bucket_Yaml.ejs', TEMPLATE_URL), 'utf8');
+  const chunks = await Promise.all(
+    state.s3Buckets.map(bucketName => ejs.render(template, { bucketName }))
+  );
+  return `Resources:\n${chunks.join('\n')}`;
+}
+
 async function renderInSqs(state) {
   const chunks = await Promise.all([
     ...state.ownTopics.map(queueName =>
@@ -328,6 +362,19 @@ async function renderIam(state) {
   });
 }
 
+async function renderLambdaRoleConfig(state) {
+  const s3Flows = state.flows
+    .filter(flow => includesEvent(flow, 's3'))
+    .map(flow => ({
+      roleName: upperFirst(flow.flowTag)
+    }));
+  return render('GeneratedLambdaRoleServiceConfig.ejs', {
+    crud: state.crud,
+    relationships: state.relationships,
+    s3Flows
+  });
+}
+
 function roleStatements(state, roleName) {
   const statements = [];
   if (roleNeedsSchemaRead(state, roleName)) {
@@ -341,7 +388,10 @@ function roleStatements(state, roleName) {
   addStatement(
     statements,
     dynamoActionsForRole(roleName),
-    dynamoArns(roleTableNames(state, roleName))
+    [
+      ...dynamoArns(roleTableNames(state, roleName)),
+      ...externalDynamoArns(roleExternalDynamoTables(state, roleName))
+    ]
   );
   addStatement(
     statements,
@@ -501,6 +551,52 @@ function dynamoArns(tableNames) {
     );
 }
 
+/**
+ * Generates DynamoDB ARNs for tables that belong to a parent service
+ * (via extendObjType). Uses the parent serviceTag instead of the
+ * current service's resourcePrefix, because those tables are owned
+ * by a different CloudFormation stack.
+ *
+ * ARN format:
+ *   ...table/{parentServiceTag}_{iz_stage}_{tableName}
+ */
+function externalDynamoArns(externalTables) {
+  const seen = new Set();
+  const unique = [];
+  for (const table of externalTables) {
+    const dedupeKey = `${table.serviceTag}::${table.tableName}`;
+    if (!seen.has(dedupeKey)) {
+      seen.add(dedupeKey);
+      unique.push(table);
+    }
+  }
+  return unique
+    .sort((a, b) =>
+      `${a.serviceTag}_${a.tableName}`.localeCompare(
+        `${b.serviceTag}_${b.tableName}`
+      )
+    )
+    .map(
+      ({ serviceTag, tableName }) =>
+        `arn:aws:dynamodb:${'${self:custom.iz_region}'}:${'${self:custom.iz_accountId}'}:table/${serviceTag}${'${self:custom.iz_stage}'}${tableName}`
+    );
+}
+
+/**
+ * Returns the external DynamoDB table references (cross-service)
+ * that should be accessible from a given IAM role.
+ */
+function roleExternalDynamoTables(state, roleName) {
+  if (
+    roleName === 'FlowObjectsRole' ||
+    roleName === 'FlowRelationshipRole' ||
+    roleName === 'ProcFindDataRole'
+  ) {
+    return state.externalDynamoTables;
+  }
+  return [];
+}
+
 function queueArns(queueNames) {
   return [...new Set(queueNames)]
     .sort()

package/src/emit/resource/templates/DynamoDBTable_Yaml.ejs

@@ -1,20 +1,20 @@
 ##===== [DynamoDB Table: <%- tableName %>]
-  <%- tableName %>Table:
-    Type: AWS::DynamoDB::Table
-    Properties:
-      TableName: ${self:custom.iz_resourcePrefix}<%- tableName %>
-      BillingMode: PAY_PER_REQUEST
-      AttributeDefinitions:
-        - AttributeName: "<%- pk %>"
-          AttributeType: "S"
-<% if (sk) { %>
-        - AttributeName: "<%- sk %>"
-          AttributeType: "S"
-<% } %>
-      KeySchema:
-        - AttributeName: "<%- pk %>"
-          KeyType: "HASH"
-<% if (sk) { %>
-        - AttributeName: "<%- sk %>"
-          KeyType: "RANGE"
+<%- tableName %>Table:
+  Type: AWS::DynamoDB::Table
+  Properties:
+    TableName: ${self:custom.iz_resourcePrefix}<%- tableName %>
+    BillingMode: PAY_PER_REQUEST
+    AttributeDefinitions:
+      - AttributeName: '<%- pk %>'
+        AttributeType: 'S'
+      <% if (sk) { %>
+      - AttributeName: '<%- sk %>'
+        AttributeType: 'S'
+    <% } %>
+    KeySchema:
+      - AttributeName: '<%- pk %>'
+        KeyType: 'HASH'
+      <% if (sk) { %>
+      - AttributeName: '<%- sk %>'
+        KeyType: 'RANGE'
 <% } %>

package/src/emit/resource/templates/FlowOut_Yaml.ejs

@@ -1,6 +1,6 @@
 ##===== [Topic Out]
-  Out<%- topicName %>:
-    Type: AWS::SNS::Topic
-    Properties:
-      DisplayName: "SNS Message out"
-      TopicName: ${self:custom.iz_serviceTag}_${self:custom.iz_stage}_<%- topicName %>_Out
+Out<%- topicName %>:
+  Type: AWS::SNS::Topic
+  Properties:
+    DisplayName: 'SNS Message out'
+    TopicName: ${self:custom.iz_serviceTag}_${self:custom.iz_stage}_<%- topicName %>_Out

package/src/emit/resource/templates/GeneratedLambdaRoleServiceConfig.ejs

@@ -0,0 +1,138 @@
+/*
+Copyright (C) 2020 Sven Mason <http://izara.io>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import Logger from '@izara_project/izara-core-library-logger';
+import dynamodbSharedLib from '@izara_project/izara-core-library-dynamodb';
+import lambdaSharedLib from '@izara_project/izara-core-library-lambda';
+import snsSharedLib from '@izara_project/izara-core-library-sns';
+import initialSetupConfig from '../../config/Config.js';
+
+const _izContext = { logger: Logger };
+
+export function generatedLambdaRole() {
+  const externalLambdaRole = [
+    <% if (crud) { -%>
+    {
+      roleName: 'FlowObjects',
+      statement: [
+        {
+          Sid: 'FlowObjectsRoleTest0',
+          Effect: 'Allow',
+          Action: ['lambda:InvokeFunction'],
+          Resource: [
+            `arn:aws:lambda:${process.env.iz_region}:${process.env.iz_accountId}:function:${lambdaSharedLib.lambdaFunctionName(_izContext, 'GetNodeHdrInv', 'GraphHandler')}`
+          ]
+        },
+
+        {
+          Sid: 'FlowObjectsRoleTest1',
+          Effect: 'Allow',
+          Action: ['sns:Publish'],
+          Resource: [
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'UpdateNode_In', 'GraphHandler')}`
+          ]
+        },
+
+        {
+          Sid: 'FlowObjectsRoleTest2',
+          Effect: 'Allow',
+          Action: ['sns:Publish'],
+          Resource: [
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'CreateNode_In', 'GraphHandler')}`
+          ]
+        }
+        //(<createFlowObjectsRole>)
+        //(</createFlowObjectsRole>)
+      ]
+    },
+    <% } -%>
+
+    {
+      roleName: 'ProcFindData',
+      statement: [
+        {
+          Sid: 'ProcFindDataRoleTest0',
+          Effect: 'Allow',
+          Action: ['lambda:InvokeFunction'],
+          Resource: [
+            `arn:aws:lambda:${process.env.iz_region}:${process.env.iz_accountId}:function:${lambdaSharedLib.lambdaFunctionName(_izContext, 'GetNodeHdrInv', 'GraphHandler')}`
+          ]
+        }
+        //(<createProcFindDataRole>)
+        //(</createProcFindDataRole>)
+      ]
+    } <% if (relationships) { %>,
+
+    {
+      roleName: 'FlowRelationship',
+      statement: [
+        {
+          Sid: 'FlowRelationshipRoleTest0',
+          Effect: 'Allow',
+          Action: ['lambda:InvokeFunction'],
+          Resource: [
+            `arn:aws:lambda:${process.env.iz_region}:${process.env.iz_accountId}:function:${lambdaSharedLib.lambdaFunctionName(_izContext, 'GetRelationshipHdrInv', 'GraphHandler')}`
+          ]
+        },
+
+        {
+          Sid: 'FlowRelationshipRoleTest1',
+          Effect: 'Allow',
+          Action: ['sns:Publish'],
+          Resource: [
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'CreateRelationship_In', 'GraphHandler')}`,
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'UpdateRelationship_In', 'GraphHandler')}`,
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'DeleteRelationship_In', 'GraphHandler')}`,
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ChangeRelationship_In', 'GraphHandler')}`,
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'MoveRelationship_In', 'GraphHandler')}`
+          ]
+        }
+        //(<createFlowRelationshipRole>)
+        //(</createFlowRelationshipRole>)
+      ]
+    } <% } -%>,
+
+    <% s3Flows.forEach(function(flow) { -%> {
+      roleName: '<%= flow.roleName %>',
+      statement: [
+        {
+          Sid: '<%= flow.roleName %>RoleTest0',
+          Effect: 'Allow',
+          Action: ['sns:Publish'],
+          Resource: [
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ReservedDynamicUsage_In', 'AccountLimits')}`
+          ]
+        },
+
+        {
+          Sid: '<%= flow.roleName %>RoleTest1',
+          Effect: 'Allow',
+          Action: ['sns:Publish'],
+          Resource: [
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ConfirmDynamicAfterUpload_In', 'AccountLimits')}`
+          ]
+        }
+        //(<create<%= flow.roleName %>Role>)
+        //(</create<%= flow.roleName %>Role>)
+      ]
+    } <% }); %>
+    //(<additionalRole>)
+    //(</additionalRole>)
+  ];
+
+  return externalLambdaRole;
+}

package/src/emit/resource/templates/ResourceBeforeLogicalYaml.ejs

@@ -1,47 +1,47 @@
-  <%_ flowTags.forEach(flowTag => { _%>
-  SubscriptionOut<%- flowTag.charAt(0).toUpperCase() + flowTag.slice(1) %>To<%- queueName %>:
-    Type: AWS::SNS::Subscription
-    Properties:
-      TopicArn: !Ref Out<%- flowTag.charAt(0).toUpperCase() + flowTag.slice(1) %>
-      Endpoint: "arn:aws:sqs:${self:custom.iz_region}:${self:custom.iz_accountId}:${self:custom.iz_resourcePrefix}<%- queueName %>HdrSqs"
-      Protocol: "sqs"
-  <%_ }) _%>
-  ##===== [Queue]
-  <%- queueName %>HdrSqs:
-    Type: "AWS::SQS::Queue"
-    Properties:
-      QueueName: ${self:custom.iz_resourcePrefix}<%- queueName %>HdrSqs
-      RedrivePolicy:
-        deadLetterTargetArn:
-          Fn::GetAtt:
-            - <%- queueName %>HdrSqsDLQ
-            - Arn
-        maxReceiveCount: 3
-      VisibilityTimeout: 120
+<%_ flowTags.forEach(flowTag => { _%>
+SubscriptionOut<%- flowTag.charAt(0).toUpperCase() + flowTag.slice(1) %>To<%- queueName %>:
+  Type: AWS::SNS::Subscription
+  Properties:
+    TopicArn: !Ref Out<%- flowTag.charAt(0).toUpperCase() + flowTag.slice(1) %>
+    Endpoint: 'arn:aws:sqs:${self:custom.iz_region}:${self:custom.iz_accountId}:${self:custom.iz_resourcePrefix}<%- queueName %>HdrSqs'
+    Protocol: 'sqs'
+<%_ }) _%>
+##===== [Queue]
+<%- queueName %>HdrSqs:
+  Type: 'AWS::SQS::Queue'
+  Properties:
+    QueueName: ${self:custom.iz_resourcePrefix}<%- queueName %>HdrSqs
+    RedrivePolicy:
+      deadLetterTargetArn:
+        Fn::GetAtt:
+          - <%- queueName %>HdrSqsDLQ
+          - Arn
+      maxReceiveCount: 3
+    VisibilityTimeout: 120
 
-  ##===== [Queue DLQ]
-  <%- queueName %>HdrSqsDLQ:
-    Type: AWS::SQS::Queue
-    Properties:
-      QueueName: ${self:custom.iz_resourcePrefix}<%- queueName %>HdrSqsDLQ
+##===== [Queue DLQ]
+<%- queueName %>HdrSqsDLQ:
+  Type: AWS::SQS::Queue
+  Properties:
+    QueueName: ${self:custom.iz_resourcePrefix}<%- queueName %>HdrSqsDLQ
 
-  ##===== [Queue Policy]
-  <%- queueName %>HdrSqsPolicy:
-    Type: AWS::SQS::QueuePolicy
-    Properties:
-      PolicyDocument:
-        Version: "2012-10-17"
-        Statement:
-          - Sid: "allow-sns-messages"
-            Effect: Allow
-            Principal: "*"
-            Resource:
-              Fn::GetAtt:
-                - <%- queueName %>HdrSqs
-                - Arn
-            Action: "SQS:SendMessage"
-      Queues:
-        - Ref: <%- queueName %>HdrSqs
+##===== [Queue Policy]
+<%- queueName %>HdrSqsPolicy:
+  Type: AWS::SQS::QueuePolicy
+  Properties:
+    PolicyDocument:
+      Version: '2012-10-17'
+      Statement:
+        - Sid: 'allow-sns-messages'
+          Effect: Allow
+          Principal: '*'
+          Resource:
+            Fn::GetAtt:
+              - <%- queueName %>HdrSqs
+              - Arn
+          Action: 'SQS:SendMessage'
+    Queues:
+      - Ref: <%- queueName %>HdrSqs
 
-  #<#<%- queueName %>QueueSetting#>
-  #<#/<%- queueName %>QueueSetting#>
+#<#<%- queueName %>QueueSetting#>
+#<#/<%- queueName %>QueueSetting#>

package/src/emit/resource/templates/ResourceSqsYaml.ejs

@@ -1,39 +1,39 @@
-  ##===== [Queue]
-  <%- resourceQueueName || queueName %>:
-    Type: "AWS::SQS::Queue"
-    Properties:
-      QueueName: ${self:custom.iz_resourcePrefix}<%- queueName %>
-      RedrivePolicy:
-        deadLetterTargetArn:
-          Fn::GetAtt:
-            - <%- resourceQueueName || queueName %>DLQ
-            - Arn
-        maxReceiveCount: 3
-      VisibilityTimeout: 120
+##===== [Queue]
+<%- resourceQueueName || queueName %>:
+  Type: 'AWS::SQS::Queue'
+  Properties:
+    QueueName: ${self:custom.iz_resourcePrefix}<%- queueName %>
+    RedrivePolicy:
+      deadLetterTargetArn:
+        Fn::GetAtt:
+          - <%- resourceQueueName || queueName %>DLQ
+          - Arn
+      maxReceiveCount: 3
+    VisibilityTimeout: 120
 
-  ##===== [Queue DLQ]
-  <%- resourceQueueName || queueName %>DLQ:
-    Type: AWS::SQS::Queue
-    Properties:
-      QueueName: ${self:custom.iz_resourcePrefix}<%- queueName %>DLQ
+##===== [Queue DLQ]
+<%- resourceQueueName || queueName %>DLQ:
+  Type: AWS::SQS::Queue
+  Properties:
+    QueueName: ${self:custom.iz_resourcePrefix}<%- queueName %>DLQ
 
-  ##===== [Queue Policy]
-  <%- resourceQueueName || queueName %>Policy:
-    Type: AWS::SQS::QueuePolicy
-    Properties:
-      PolicyDocument:
-        Version: "2012-10-17"
-        Statement:
-          - Sid: "allow-sns-messages"
-            Effect: Allow
-            Principal: "*"
-            Resource:
-              Fn::GetAtt:
-                - <%- resourceQueueName || queueName %>
-                - Arn
-            Action: "SQS:SendMessage"
-      Queues:
-        - Ref: <%- resourceQueueName || queueName %>
+##===== [Queue Policy]
+<%- resourceQueueName || queueName %>Policy:
+  Type: AWS::SQS::QueuePolicy
+  Properties:
+    PolicyDocument:
+      Version: '2012-10-17'
+      Statement:
+        - Sid: 'allow-sns-messages'
+          Effect: Allow
+          Principal: '*'
+          Resource:
+            Fn::GetAtt:
+              - <%- resourceQueueName || queueName %>
+              - Arn
+          Action: 'SQS:SendMessage'
+    Queues:
+      - Ref: <%- resourceQueueName || queueName %>
 
-  #<#<%- queueName %>QueueSetting#>
-  #<#/<%- queueName %>QueueSetting#>
+#<#<%- queueName %>QueueSetting#>
+#<#/<%- queueName %>QueueSetting#>