@jaypie/constructs 1.2.54 → 1.2.56

package/dist/esm/JaypieDistribution.d.ts

@@ -8,6 +8,17 @@ import { LambdaDestination } from "aws-cdk-lib/aws-s3-notifications";
 import * as wafv2 from "aws-cdk-lib/aws-wafv2";
 import { Construct } from "constructs";
 import { HostConfig } from "./helpers";
+/**
+ * One entry in a `waf.allow` list. Names one or more URL paths and, for each
+ * managed rule group key, the sub-rule names to flip from `block` to `count`
+ * on that path set. See JaypieWafConfig.allow.
+ */
+export interface JaypieWafAllowEntry {
+    /** URL path or paths. Trailing `*` → STARTS_WITH; otherwise EXACTLY. */
+    path: string | string[];
+    /** Managed-rule-group keys (e.g. AWSManagedRulesCommonRuleSet) → sub-rule names. */
+    [ruleGroupKey: string]: string | string[] | undefined;
+}
 export interface JaypieWafConfig {
     /**
      * Unique name for this distribution's WAF resources. Required when passing a
@@ -76,6 +87,26 @@ export interface JaypieWafConfig {
      * @default 2000
      */
     rateLimitPerIp?: number;
+    /**
+     * Path-scoped relaxations layered on top of the default managed-rule groups.
+     * Each entry names one or more URL paths and, for each managed rule group
+     * key, the sub-rule names to flip from `block` to `count` on that path set.
+     * Strict default action is preserved on every other path.
+     *
+     * Composes with `managedRuleOverrides`: the baseline override list applies
+     * to both the relaxed and strict emissions of a group; entries in `allow`
+     * additionally relax specific (path × sub-rule) intersections.
+     *
+     * @example
+     * allow: [
+     *   {
+     *     path: "/hooks/*",
+     *     AWSManagedRulesCommonRuleSet: ["ExploitablePaths_URIPATH"],
+     *     AWSManagedRulesKnownBadInputsRuleSet: ["CrossSiteScripting_BODY"],
+     *   },
+     * ]
+     */
+    allow?: JaypieWafAllowEntry | JaypieWafAllowEntry[];
     /**
      * Use an existing WebACL ARN instead of creating one
      */

package/dist/esm/JaypieMigration.d.ts

@@ -1,4 +1,5 @@
 import { Construct } from "constructs";
+import * as cdk from "aws-cdk-lib";
 import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
 import * as lambda from "aws-cdk-lib/aws-lambda";
 import { JaypieLambda } from "./JaypieLambda";
@@ -12,10 +13,16 @@ export interface JaypieMigrationProps {
     environment?: Record<string, string> | (Record<string, string> | string)[];
     /** Lambda handler entry point */
     handler?: string;
+    /** Polling interval between isCompleteHandler invocations. Default: 60 seconds. */
+    queryInterval?: cdk.Duration;
     /** Secrets to make available to the migration Lambda */
     secrets?: SecretsArrayItem[];
     /** DynamoDB tables to grant read/write access */
     tables?: dynamodb.ITable[];
+    /** Lambda timeout per invocation. Defaults to 15 minutes (Lambda max). */
+    timeout?: cdk.Duration;
+    /** Maximum total wall time across all isCompleteHandler invocations. Default: 2 hours. */
+    totalTimeout?: cdk.Duration;
 }
 export declare class JaypieMigration extends Construct {
     readonly lambda: JaypieLambda;

package/dist/esm/index.js

@@ -950,7 +950,7 @@ function checkEnvIsProvider$1(env = process.env) {
 function cleanName$1(name) {
     return name.replace(/[^a-zA-Z0-9:-]/g, "");
 }
-function exportEnvName$1(name, env = process.env) {
+function exportEnvName$1(name, env = process.env, consumer = false) {
     let rawName;
     if (checkEnvIsProvider$1(env)) {
         rawName = `env-${env.PROJECT_ENV}-${env.PROJECT_KEY}-${name}`;
@@ -958,7 +958,7 @@ function exportEnvName$1(name, env = process.env) {
         return cleanName$1(rawName);
     }
     else {
-        if (checkEnvIsConsumer$1(env)) {
+        if (consumer || checkEnvIsConsumer$1(env)) {
             rawName = `env-${CDK$2.ENV.SANDBOX}-${env.PROJECT_KEY}-${name}`;
         }
         else {
@@ -986,7 +986,7 @@ class JaypieEnvSecret extends Construct {
         this._envKey = envKey;
         let exportName;
         if (!exportParam) {
-            exportName = exportEnvName$1(id);
+            exportName = exportEnvName$1(envKey || id, process.env, consumer);
         }
         else {
             exportName = cleanName$1(exportParam);
@@ -2681,13 +2681,110 @@ class JaypieDistribution extends Construct {
             }
             else {
                 // Create new WebACL
-                const { managedRuleOverrides, managedRuleScopeDowns, managedRules = DEFAULT_MANAGED_RULES$1, rateLimitPerIp = DEFAULT_RATE_LIMIT$1, } = wafConfig;
+                const { allow, managedRuleOverrides, managedRuleScopeDowns, managedRules = DEFAULT_MANAGED_RULES$1, rateLimitPerIp = DEFAULT_RATE_LIMIT$1, } = wafConfig;
+                const allowEntries = allow
+                    ? Array.isArray(allow)
+                        ? allow
+                        : [allow]
+                    : [];
+                const groupAllowances = {};
+                for (const entry of allowEntries) {
+                    const paths = Array.isArray(entry.path) ? entry.path : [entry.path];
+                    for (const key of Object.keys(entry)) {
+                        if (key === "path")
+                            continue;
+                        const raw = entry[key];
+                        if (raw == null)
+                            continue;
+                        const ruleNames = Array.isArray(raw) ? raw : [raw];
+                        if (!groupAllowances[key])
+                            groupAllowances[key] = [];
+                        groupAllowances[key].push({ paths, ruleNames });
+                    }
+                }
+                const pathToStatement = (path) => {
+                    const isPrefix = path.endsWith("*");
+                    return {
+                        byteMatchStatement: {
+                            fieldToMatch: { uriPath: {} },
+                            positionalConstraint: isPrefix ? "STARTS_WITH" : "EXACTLY",
+                            searchString: isPrefix ? path.slice(0, -1) : path,
+                            textTransformations: [{ priority: 0, type: "NONE" }],
+                        },
+                    };
+                };
+                const pathsToStatement = (paths) => {
+                    if (paths.length === 1)
+                        return pathToStatement(paths[0]);
+                    return {
+                        orStatement: { statements: paths.map(pathToStatement) },
+                    };
+                };
+                const andScopeDown = (base, extra) => base ? { andStatement: { statements: [base, extra] } } : extra;
                 let priority = 0;
                 const rules = [];
                 // Add managed rule groups
                 for (const ruleName of managedRules) {
-                    const ruleActionOverrides = managedRuleOverrides?.[ruleName];
-                    const scopeDownStatement = managedRuleScopeDowns?.[ruleName];
+                    const baseOverrides = managedRuleOverrides?.[ruleName];
+                    const baseScopeDown = managedRuleScopeDowns?.[ruleName];
+                    const allowances = groupAllowances[ruleName];
+                    if (!allowances || allowances.length === 0) {
+                        rules.push({
+                            name: ruleName,
+                            priority: priority++,
+                            overrideAction: { none: {} },
+                            statement: {
+                                managedRuleGroupStatement: {
+                                    name: ruleName,
+                                    vendorName: "AWS",
+                                    ...(baseOverrides && { ruleActionOverrides: baseOverrides }),
+                                    ...(baseScopeDown && { scopeDownStatement: baseScopeDown }),
+                                },
+                            },
+                            visibilityConfig: {
+                                cloudWatchMetricsEnabled: true,
+                                metricName: ruleName,
+                                sampledRequestsEnabled: true,
+                            },
+                        });
+                        continue;
+                    }
+                    // Emit one relaxed rule per allow entry that names this group
+                    allowances.forEach(({ paths, ruleNames }, index) => {
+                        const entryOverrides = ruleNames.map((n) => ({
+                            name: n,
+                            actionToUse: { count: {} },
+                        }));
+                        const combinedOverrides = [
+                            ...(baseOverrides ?? []),
+                            ...entryOverrides,
+                        ];
+                        const relaxedScopeDown = andScopeDown(baseScopeDown, pathsToStatement(paths));
+                        const relaxedName = `${ruleName}-allow-${index}`;
+                        rules.push({
+                            name: relaxedName,
+                            priority: priority++,
+                            overrideAction: { none: {} },
+                            statement: {
+                                managedRuleGroupStatement: {
+                                    name: ruleName,
+                                    vendorName: "AWS",
+                                    ruleActionOverrides: combinedOverrides,
+                                    scopeDownStatement: relaxedScopeDown,
+                                },
+                            },
+                            visibilityConfig: {
+                                cloudWatchMetricsEnabled: true,
+                                metricName: relaxedName,
+                                sampledRequestsEnabled: true,
+                            },
+                        });
+                    });
+                    // Emit one strict rule whose scope-down excludes every relaxed path
+                    const allPaths = allowances.flatMap((a) => a.paths);
+                    const strictScopeDown = andScopeDown(baseScopeDown, {
+                        notStatement: { statement: pathsToStatement(allPaths) },
+                    });
                     rules.push({
                         name: ruleName,
                         priority: priority++,
@@ -2696,8 +2793,8 @@ class JaypieDistribution extends Construct {
                             managedRuleGroupStatement: {
                                 name: ruleName,
                                 vendorName: "AWS",
-                                ...(ruleActionOverrides && { ruleActionOverrides }),
-                                ...(scopeDownStatement && { scopeDownStatement }),
+                                ...(baseOverrides && { ruleActionOverrides: baseOverrides }),
+                                scopeDownStatement: strictScopeDown,
                             },
                         },
                         visibilityConfig: {
@@ -3536,8 +3633,7 @@ const DYNAMODB_CONTROL_PLANE_ACTIONS = [
 class JaypieMigration extends Construct {
     constructor(scope, id, props) {
         super(scope, id);
-        const { code, dependencies = [], environment, handler = "index.handler", secrets = [], tables = [], } = props;
-        // Migration Lambda — 5 minute timeout for long-running migrations
+        const { code, dependencies = [], environment, handler = "index.handler", queryInterval = cdk.Duration.seconds(60), secrets = [], tables = [], timeout = cdk.Duration.minutes(15), totalTimeout = cdk.Duration.hours(2), } = props;
         this.lambda = new JaypieLambda(this, "MigrationLambda", {
             code,
             description: "DynamoDB migration custom resource",
@@ -3546,7 +3642,7 @@ class JaypieMigration extends Construct {
             roleTag: CDK$2.ROLE.PROCESSING,
             secrets,
             tables,
-            timeout: cdk.Duration.minutes(5),
+            timeout,
         });
         // Grant control-plane perms on the passed tables so migrations that
         // alter table shape (GSIs, TTL, streams, backups) succeed. JaypieLambda
@@ -3560,9 +3656,14 @@ class JaypieMigration extends Construct {
                 ]),
             }));
         }
-        // Custom Resource provider wrapping the Lambda
+        // cr.Provider with isCompleteHandler enables the waiter pattern: onEventHandler
+        // returns PhysicalResourceId immediately; isCompleteHandler is polled via Step
+        // Functions until migrationHandler returns pending: false (or omits pending).
         const provider = new cr.Provider(this, "MigrationProvider", {
+            isCompleteHandler: this.lambda,
             onEventHandler: this.lambda,
+            queryInterval,
+            totalTimeout,
         });
         // Custom Resource that triggers on every deploy.
         // deployNonce forces CloudFormation to re-invoke the custom resource