@justworkflowit/cdk-constructs 0.0.312 → 0.0.314

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 JustWorkflowIt
+Copyright (c) 2026 JustWorkflowIt
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/dist/__tests__/constructs/justWorkflowItConstructs.test.js

@@ -319,7 +319,7 @@ describe('JustWorkflowItConstructs', () => {
                             $ref: '#/definitions/metadataType',
                         },
                     },
-                    required: ['businessId'],
+                    required: ['businessId', 'metadata'],
                     additionalProperties: false,
                 },
                 metadataType: {

package/dist/constructs/justWorkflowItConstructs.d.ts

@@ -1,11 +1,16 @@
 import { Construct } from 'constructs';
+import { Role } from 'aws-cdk-lib/aws-iam';
 export interface JustWorkflowItConstructsProps {
     disambiguator: string;
     organizationId: string;
     workflowDefinitions: string[];
     ignoreDefinitionDeployerFailures?: boolean;
+    lambdaArns?: string[];
+    snsTopicArns?: string[];
+    sqsQueueArns?: string[];
 }
 export declare class JustWorkflowItConstructs extends Construct {
     private static readonly CONSTRUCT_ID_PREFIX;
+    readonly executionRole: Role;
     constructor(scope: Construct, props: JustWorkflowItConstructsProps);
 }

package/dist/constructs/justWorkflowItConstructs.js

@@ -95,11 +95,14 @@ class JustWorkflowItConstructs extends constructs_1.Construct {
         const secret = new aws_secretsmanager_1.Secret(this, 'JustWorkflowItAuthTokenSecret', {
             secretName,
             secretStringValue: aws_cdk_lib_1.SecretValue.unsafePlainText('REPLACE_ME_WITH_JUST_WORKFLOW_IT_AUTH_TOKEN'),
-            description: 'Paste your JustWorkflowIt API auth token here to enable secure communication.',
+            description: 'Replace this placeholder with your JustWorkflowIt API auth token to enable workflow deployment.',
         });
         const bucket = new aws_s3_1.Bucket(this, 'WorkflowDefinitionsBucket', {
             removalPolicy: aws_cdk_lib_1.RemovalPolicy.DESTROY,
             autoDeleteObjects: true,
+            blockPublicAccess: aws_s3_1.BlockPublicAccess.BLOCK_ALL,
+            enforceSSL: true,
+            encryption: aws_s3_1.BucketEncryption.S3_MANAGED,
         });
         // Upload each definition and collect its S3 key
         const definitionKeys = [];
@@ -119,7 +122,7 @@ class JustWorkflowItConstructs extends constructs_1.Construct {
                 exclude: ['*.ts', '*.d.ts'],
             }),
             handler: 'definitionDeployerLambda.handler',
-            runtime: aws_lambda_1.Runtime.NODEJS_20_X,
+            runtime: aws_lambda_1.Runtime.NODEJS_24_X,
             timeout: aws_cdk_lib_1.Duration.minutes(5),
             environment: {
                 AUTH_SECRET_NAME: secretName,
@@ -149,20 +152,28 @@ class JustWorkflowItConstructs extends constructs_1.Construct {
         const executionRole = new aws_iam_1.Role(this, 'JustWorkflowItAutomationExecutionRole', {
             roleName: `JustWorkflowItExecutionRole`,
             assumedBy: new aws_iam_1.AccountPrincipal(JUSTWORKFLOWIT_PRODUCTION_ACCOUNT),
+            externalIds: [props.organizationId],
             description: 'Role assumed by JustWorkflowIt backend to perform workflow actions in this account.',
         });
-        executionRole.addToPolicy(new aws_iam_1.PolicyStatement({
-            actions: ['lambda:InvokeFunction'],
-            resources: ['*'],
-        }));
-        executionRole.addToPolicy(new aws_iam_1.PolicyStatement({
-            actions: ['sns:Publish'],
-            resources: ['*'],
-        }));
-        executionRole.addToPolicy(new aws_iam_1.PolicyStatement({
-            actions: ['sqs:SendMessage'],
-            resources: ['*'],
-        }));
+        if (props.lambdaArns && props.lambdaArns.length > 0) {
+            executionRole.addToPolicy(new aws_iam_1.PolicyStatement({
+                actions: ['lambda:InvokeFunction'],
+                resources: props.lambdaArns,
+            }));
+        }
+        if (props.snsTopicArns && props.snsTopicArns.length > 0) {
+            executionRole.addToPolicy(new aws_iam_1.PolicyStatement({
+                actions: ['sns:Publish'],
+                resources: props.snsTopicArns,
+            }));
+        }
+        if (props.sqsQueueArns && props.sqsQueueArns.length > 0) {
+            executionRole.addToPolicy(new aws_iam_1.PolicyStatement({
+                actions: ['sqs:SendMessage'],
+                resources: props.sqsQueueArns,
+            }));
+        }
+        this.executionRole = executionRole;
     }
 }
 exports.JustWorkflowItConstructs = JustWorkflowItConstructs;