@kirschbaum-development/sst-laravel 0.2.15 → 0.3.0

package/laravel-sst.ts

@@ -55,6 +55,36 @@ export interface LaravelServiceArgs {
     health?: ServiceArgs['health'];
     executionRole?: ServiceArgs['executionRole'];
     permissions?: ServiceArgs['permissions'];
+
+    /**
+     * Transform the underlying ECS Service resources. Useful for hardening the
+     * ALB (e.g. restricting the load-balancer security group to a fixed set of
+     * upstream CIDRs) or adjusting other inner resources.
+     *
+     * `image` and `taskDefinition` are managed internally and cannot be
+     * overridden here — they carry the env-file dependency wiring and the
+     * `initProcessEnabled: false` setting required by this package.
+     *
+     * @example
+     * ```js
+     * web: {
+     *   transform: {
+     *     loadBalancerSecurityGroup: (sgArgs) => {
+     *       sgArgs.ingress = [{
+     *         protocol: "tcp",
+     *         fromPort: 443,
+     *         toPort: 443,
+     *         cidrBlocks: ["173.245.48.0/20", "103.21.244.0/22"],
+     *       }];
+     *     },
+     *   },
+     * }
+     * ```
+     */
+    transform?: Omit<
+        NonNullable<ServiceArgs['transform']>,
+        'image' | 'taskDefinition'
+    >;
 }
 
 export interface LaravelWebArgs extends LaravelServiceArgs {
@@ -353,6 +383,7 @@ export class LaravelService extends Component {
                     },
 
                     transform: {
+                        ...(args.web?.transform ?? {}),
                         image: addEnvironmentFileImageDependency,
                         taskDefinition: (args) => {
                             args.containerDefinitions = (
@@ -467,6 +498,7 @@ export class LaravelService extends Component {
                     },
 
                     transform: {
+                        ...(workerConfig.transform ?? {}),
                         image: addEnvironmentFileImageDependency,
                         taskDefinition: (args) => {
                             args.containerDefinitions = (

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kirschbaum-development/sst-laravel",
-  "version": "0.2.15",
+  "version": "0.3.0",
   "type": "module",
   "description": "An unofficial extension of SST to deploy containerized Laravel applications to AWS Fargate.",
   "main": "laravel-sst.ts",
@@ -28,6 +28,7 @@
   ],
   "scripts": {
     "build": "tsc",
+    "test": "vitest run",
     "release": "./scripts/publish.sh"
   },
   "repository": {
@@ -65,7 +66,8 @@
   },
   "devDependencies": {
     "@types/node": "^20.0.0",
-    "typescript": "^5.0.0"
+    "typescript": "^5.0.0",
+    "vitest": "4.1.5"
   },
   "publishConfig": {
     "access": "public",

package/src/remote-env-file.ts

@@ -213,19 +213,38 @@ function buildEnvFileContent(
   ].filter(Boolean).join('\n\n');
 }
 
-function toEnvFileContent(vars: Record<string, string>): string {
+export function toEnvFileContent(vars: Record<string, string>): string {
   const sortedKeys = Object.keys(vars).sort();
 
   return sortedKeys
     .map((key) => {
       const value = vars[key];
+      const needsQuoting =
+        value.includes(' ') ||
+        value.includes('"') ||
+        value.includes("'") ||
+        value.includes('\n') ||
+        value.includes('$') ||
+        value.includes('\\') ||
+        value.includes('#');
+
+      if (!needsQuoting) {
+        return `${key}=${value}`;
+      }
 
-      if (value.includes(' ') || value.includes('"') || value.includes("'") || value.includes('\n')) {
-        const escaped = value.replace(/"/g, '\\"');
-        return `${key}="${escaped}"`;
+      // Single quotes are phpdotenv "raw literal" mode — no $ expansion, no escapes.
+      // Use them whenever possible so randomly-generated secrets round-trip safely.
+      if (!value.includes("'") && !value.includes('\n')) {
+        return `${key}='${value}'`;
       }
 
-      return `${key}=${value}`;
+      // Fall back to double quotes when the value itself contains a single quote
+      // or newline. Escape \, $, and " so phpdotenv reads the literal value.
+      const escaped = value
+        .replace(/\\/g, '\\\\')
+        .replace(/\$/g, '\\$')
+        .replace(/"/g, '\\"');
+      return `${key}="${escaped}"`;
     })
     .join('\n');
 }