@macedon-technologies/batman 1.32.1 → 1.33.0

package/templates/app/pnpm-workspace.yaml

@@ -0,0 +1,7 @@
+onlyBuiltDependencies:
+  - esbuild
+ignoredBuiltDependencies:
+  - '@parcel/watcher'
+allowBuilds:
+  esbuild: true
+  '@parcel/watcher': false

package/templates/app/src/aspects/DataDogAspect.ts

@@ -0,0 +1,14 @@
+import { IAspect } from 'aws-cdk-lib';
+import { Function } from 'aws-cdk-lib/aws-lambda';
+import { IConstruct } from 'constructs';
+import { DatadogLambda } from 'datadog-cdk-constructs-v2'; // or v1
+
+export class DataDogAspect implements IAspect {
+  constructor(private props: { datadog: DatadogLambda }) {}
+
+  visit(node: IConstruct): void {
+    if (node instanceof Function) {
+      this.props.datadog.addLambdaFunctions([node]);
+    }
+  }
+}

package/templates/app/src/constructs/Secret.ts

@@ -0,0 +1,50 @@
+// Copied from @matthewbonig/secret (MIT, https://github.com/mbonig/secret).
+// This file is generated by Batman and is yours to modify.
+import { join } from 'path';
+import { CustomResource } from 'aws-cdk-lib';
+import { Effect, PolicyStatement } from 'aws-cdk-lib/aws-iam';
+import { Runtime } from 'aws-cdk-lib/aws-lambda';
+import { NodejsFunction } from 'aws-cdk-lib/aws-lambda-nodejs';
+import { Secret as AWSSecret, SecretProps, SecretStringGenerator } from 'aws-cdk-lib/aws-secretsmanager';
+import { Provider } from 'aws-cdk-lib/custom-resources';
+import { Construct } from 'constructs';
+
+export class Secret extends AWSSecret {
+  constructor(scope: Construct, id: string, props: SecretProps) {
+    super(scope, id, {
+      ...props,
+      generateSecretString: undefined, // explicitly set this to undefined so that we never use the built-in functionality
+    });
+
+    if (props.generateSecretString?.secretStringTemplate) {
+      // now we're going to use a custom resource for this instead
+      this.createCustomResource(props.generateSecretString);
+    }
+  }
+
+  private createCustomResource(generateSecretString: SecretStringGenerator) {
+    const eventHandler = new NodejsFunction(this, 'EventHandlerFunction', {
+      runtime: Runtime.NODEJS_24_X,
+      entry: join(__dirname, 'handler/Secret.Function.ts'),
+    });
+    this.grantWrite(eventHandler);
+    this.grantRead(eventHandler);
+    eventHandler.addToRolePolicy(new PolicyStatement({
+      effect: Effect.ALLOW,
+      resources: ['*'],
+      actions: ['secretsmanager:GetRandomPassword'],
+    }));
+    const provider = new Provider(this, 'CustomResourceProvider', {
+      onEventHandler: eventHandler,
+    });
+    const customResource = new CustomResource(this, 'GenerateSecretStringCR', {
+      resourceType: 'Custom::GenerateSecretString',
+      serviceToken: provider.serviceToken,
+      properties: {
+        Secret: this.secretArn,
+        GenerateSecretString: generateSecretString,
+      },
+    });
+    customResource.node.addDependency(this);
+  }
+}

package/templates/app/src/constructs/handler/Secret.Function.ts

@@ -0,0 +1,38 @@
+// Copied from @matthewbonig/secret (MIT, https://github.com/mbonig/secret).
+// This file is generated by Batman and is yours to modify.
+import { createSecretValue } from './secret/createSecretValue';
+import { updateSecretValue } from './secret/updateSecretValue';
+
+interface CustomResource {
+  RequestType: 'Create' | 'Update' | 'Delete';
+  LogicalResourceId: string;
+  ResourceProperties: any;
+  OldResourceProperties?: any;
+  PhysicalResourceId?: string;
+}
+
+export const handler = async (event: CustomResource) => {
+  console.log('Received event:', JSON.stringify(event, null, 2));
+
+  switch (event.RequestType) {
+    case 'Create':
+      console.log(`Create secret value for secret ${event.LogicalResourceId};`);
+      await createSecretValue({
+        secretArn: event.ResourceProperties.Secret,
+        generateSecretString: event.ResourceProperties.GenerateSecretString,
+      });
+      break;
+    case 'Update':
+      console.log('Updating secret with physical id:', event.PhysicalResourceId);
+      await updateSecretValue({
+        secretArn: event.ResourceProperties.Secret,
+        generateSecretString: event.ResourceProperties.GenerateSecretString,
+        oldGenerateSecretString: event.OldResourceProperties.GenerateSecretString,
+      });
+      break;
+    case 'Delete':
+      console.log('Deleting secret with physical id:', event.PhysicalResourceId);
+      console.log('Doing nothing. deleting secrets requires no work at all.');
+      break;
+  }
+};

package/templates/app/src/constructs/handler/secret/client.ts

@@ -0,0 +1,5 @@
+// Copied from @matthewbonig/secret (MIT, https://github.com/mbonig/secret).
+// This file is generated by Batman and is yours to modify.
+import { SecretsManager } from '@aws-sdk/client-secrets-manager';
+
+export const client = new SecretsManager({});

package/templates/app/src/constructs/handler/secret/createSecretValue.ts

@@ -0,0 +1,30 @@
+// Copied from @matthewbonig/secret (MIT, https://github.com/mbonig/secret).
+// This file is generated by Batman and is yours to modify.
+import { GetRandomPasswordCommand, PutSecretValueCommand } from '@aws-sdk/client-secrets-manager';
+import { client } from './client';
+
+export async function createSecretValue({ generateSecretString, secretArn }: {
+  secretArn: any;
+  generateSecretString: any;
+}) {
+  // since this is a create, we can just write the value as-is...
+  const secretValue = JSON.parse(generateSecretString.secretStringTemplate);
+  if (generateSecretString.generateStringKey) {
+    const randomValue = await client.send(new GetRandomPasswordCommand({
+      ExcludeCharacters: generateSecretString.excludeCharacters,
+      ExcludeLowercase: generateSecretString.excludeLowercase,
+      ExcludeNumbers: generateSecretString.excludeNumbers,
+      ExcludePunctuation: generateSecretString.excludePunctuation,
+      ExcludeUppercase: generateSecretString.excludeUppercase,
+      IncludeSpace: generateSecretString.includeSpace,
+      PasswordLength: generateSecretString.passwordLength,
+      RequireEachIncludedType: generateSecretString.requireEachIncludedType,
+    }));
+    secretValue[generateSecretString.generateStringKey] = randomValue.RandomPassword;
+  }
+
+  await client.send(new PutSecretValueCommand({
+    SecretId: secretArn,
+    SecretString: JSON.stringify(secretValue),
+  }));
+}

package/templates/app/src/constructs/handler/secret/didRandomPropertiesChange.ts

@@ -0,0 +1,13 @@
+// Copied from @matthewbonig/secret (MIT, https://github.com/mbonig/secret).
+// This file is generated by Batman and is yours to modify.
+export function didRandomPropertiesChange(oldGenerateSecretString: any, generateSecretString: any) {
+  return oldGenerateSecretString.excludeCharacters !== generateSecretString.excludeCharacters ||
+    oldGenerateSecretString.excludeLowercase !== generateSecretString.excludeLowercase ||
+    oldGenerateSecretString.excludeNumbers !== generateSecretString.excludeNumbers ||
+    oldGenerateSecretString.excludePunctuation !== generateSecretString.excludePunctuation ||
+    oldGenerateSecretString.excludeUppercase !== generateSecretString.excludeUppercase ||
+    oldGenerateSecretString.includeSpace !== generateSecretString.includeSpace ||
+    oldGenerateSecretString.passwordLength !== generateSecretString.passwordLength ||
+    oldGenerateSecretString.requireEachIncludedType !== generateSecretString.requireEachIncludedType;
+
+}

package/templates/app/src/constructs/handler/secret/updateSecretValue.ts

@@ -0,0 +1,71 @@
+// Copied from @matthewbonig/secret (MIT, https://github.com/mbonig/secret).
+// This file is generated by Batman and is yours to modify.
+import {
+  GetRandomPasswordCommand,
+  GetSecretValueCommand,
+  PutSecretValueCommand,
+} from '@aws-sdk/client-secrets-manager';
+import { client } from './client';
+import { didRandomPropertiesChange } from './didRandomPropertiesChange';
+
+export async function updateSecretValue({ oldGenerateSecretString, generateSecretString, secretArn }: {
+  secretArn: any;
+  generateSecretString: any;
+  oldGenerateSecretString: any;
+}) {
+  // let's get the existing value
+  const existingSecretValue = await client.send(new GetSecretValueCommand({
+    SecretId: secretArn,
+  }));
+  // and parse the existing value
+  let parsedValue: any = {};
+
+  try {
+    parsedValue = JSON.parse(existingSecretValue.SecretString!);
+  } catch (err) {
+    // the existing value couldn't be parsed, it was probably a random string.
+    // let's go ahead and just start fresh then,
+  }
+
+  // now let's check what properties have changed
+  const newSecretStringTemplate = JSON.parse(generateSecretString.secretStringTemplate);
+  const oldSecretStringTemplate = JSON.parse(oldGenerateSecretString.secretStringTemplate);
+  for (const key in newSecretStringTemplate) {
+    if (oldSecretStringTemplate[key] === undefined) {
+      // ok, so here's something to add...
+      parsedValue[key] = newSecretStringTemplate[key];
+    }
+    if (oldSecretStringTemplate[key] !== newSecretStringTemplate[key]) {
+      // ok, so here's something to update...
+      parsedValue[key] = newSecretStringTemplate[key];
+    }
+  }
+  for (const key in oldSecretStringTemplate) {
+    if (newSecretStringTemplate[key] === undefined) {
+      // ok, so here's something to remove...
+      delete parsedValue[key];
+    }
+  }
+
+  // did anything around the GenerateStringKey change?
+  if (didRandomPropertiesChange(oldGenerateSecretString, generateSecretString)
+    || generateSecretString.generateStringKey !== oldGenerateSecretString.generateStringKey) {
+    const { RandomPassword: newRandomValue } = await client.send(new GetRandomPasswordCommand({
+      ExcludeLowercase: generateSecretString.excludeLowercase === 'true',
+      ExcludeNumbers: generateSecretString.excludeNumbers === 'true',
+      ExcludePunctuation: generateSecretString.excludePunctuation === 'true',
+      ExcludeUppercase: generateSecretString.excludeUppercase === 'true',
+      IncludeSpace: generateSecretString.includeSpace === 'true',
+      PasswordLength: +generateSecretString.passwordLength,
+      RequireEachIncludedType: generateSecretString.requireEachIncludedType === 'true',
+    }));
+    parsedValue[generateSecretString.generateStringKey] = newRandomValue;
+  }
+
+  // update the secret in AWS
+  await client.send(new PutSecretValueCommand({
+    SecretId: secretArn,
+    SecretString: JSON.stringify(parsedValue),
+  }));
+
+}

package/templates/app/swamp-bootstrap/pull-extensions.ts

@@ -0,0 +1,68 @@
+/**
+ * Pulls each swamp extension at the version pinned in
+ * extensions/models/upstream_extensions.json, so a fresh clone runs the
+ * same extensions as the rest of the team, including any the repo added
+ * itself. A repo with no lockfile yet pulls DEFAULT_EXTENSIONS at their
+ * latest stable versions, which creates the lockfile.
+ *
+ * A pull rewrites the lockfile even at an identical version, and on Windows
+ * it writes backslash paths and deletes the committed files it tracks (e.g.
+ * .claude/skills/software-factory/). So afterwards the lockfile and every
+ * git-tracked file it lists are restored from git.
+ */
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+
+const LOCKFILE = 'extensions/models/upstream_extensions.json';
+const DEFAULT_EXTENSIONS = ['@swamp/software-factory', '@webframp/github', '@goodcraft/github'];
+
+interface LockfileEntry {
+  version: string;
+  files?: string[];
+}
+
+function readLockfile(): Record<string, LockfileEntry> | undefined {
+  if (!existsSync(LOCKFILE)) {
+    return undefined;
+  }
+  return JSON.parse(readFileSync(LOCKFILE, 'utf8')) as Record<string, LockfileEntry>;
+}
+
+function run(command: string, args: string[]): string {
+  return execFileSync(command, args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'inherit'] });
+}
+
+function pull(extension: string): void {
+  console.log(`swamp extension pull ${extension} --force`);
+  execFileSync('swamp', ['extension', 'pull', extension, '--force'], { stdio: 'inherit' });
+}
+
+function restoreTrackedFiles(lockfile: Record<string, LockfileEntry>): void {
+  const listed = Object.values(lockfile)
+    .flatMap((entry) => entry.files ?? [])
+    .map((file) => file.replace(/\\/g, '/'))
+    .filter((file) => !file.startsWith('.swamp/'));
+  const tracked = run('git', ['ls-files', '-z', '--', LOCKFILE, ...listed])
+    .split('\0')
+    .filter(Boolean);
+  if (tracked.length > 0) {
+    run('git', ['checkout', '--', ...tracked]);
+    console.log(`Restored ${tracked.length} tracked file(s) from git`);
+  }
+}
+
+function main(): void {
+  const lockfile = readLockfile();
+  if (!lockfile) {
+    console.log(`No ${LOCKFILE} yet: pulling the latest stable software-factory extensions`);
+    DEFAULT_EXTENSIONS.forEach(pull);
+    return;
+  }
+
+  for (const [name, entry] of Object.entries(lockfile)) {
+    pull(`${name}@${entry.version}`);
+  }
+  restoreTrackedFiles(lockfile);
+}
+
+main();

package/templates/app/swamp-bootstrap/tsconfig.json

@@ -0,0 +1,13 @@
+{
+  "extends": "../tsconfig.json",
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": "."
+  },
+  "include": [
+    "*.ts"
+  ],
+  "exclude": [
+    "node_modules"
+  ]
+}

package/templates/app/test/DataDogAspect.test.ts

@@ -0,0 +1,31 @@
+import { App, Aspects, Stack } from 'aws-cdk-lib';
+import { Match, Template } from 'aws-cdk-lib/assertions';
+import { Code, Function, Runtime } from 'aws-cdk-lib/aws-lambda';
+import { DatadogLambda } from 'datadog-cdk-constructs-v2';
+import { DataDogAspect } from '../src/aspects/DataDogAspect';
+
+describe('DataDogAspect', () => {
+  test('adds every Lambda function in the stack to Datadog', () => {
+    const app = new App();
+    const stack = new Stack(app, 'TestStack', { env: { account: '111111111111', region: 'us-east-1' } });
+    const datadog = new DatadogLambda(stack, 'Datadog', {
+      nodeLayerVersion: 120,
+      extensionLayerVersion: 80,
+      site: 'datadoghq.com',
+      apiKeySecretArn: 'arn:aws:secretsmanager:us-east-1:111111111111:secret:datadog',
+    });
+    new Function(stack, 'Handler', {
+      runtime: Runtime.NODEJS_22_X,
+      handler: 'index.handler',
+      code: Code.fromInline('exports.handler = async () => {};'),
+    });
+
+    Aspects.of(stack).add(new DataDogAspect({ datadog }));
+    const template = Template.fromStack(stack);
+
+    template.hasResourceProperties('AWS::Lambda::Function', {
+      Environment: { Variables: Match.objectLike({ DD_LAMBDA_HANDLER: 'index.handler' }) },
+      Layers: Match.arrayWith([Match.stringLikeRegexp('Datadog-Extension')]),
+    });
+  });
+});

package/templates/app/test/Secret.test.ts

@@ -0,0 +1,40 @@
+import { App, Stack } from 'aws-cdk-lib';
+import { Match, Template } from 'aws-cdk-lib/assertions';
+import { Secret } from '../src/constructs/Secret';
+
+function synth(addSecret: (stack: Stack) => void): Template {
+  const app = new App({ context: { 'aws:cdk:bundling-stacks': [] } });
+  const stack = new Stack(app, 'TestStack');
+  addSecret(stack);
+  return Template.fromStack(stack);
+}
+
+describe('Secret', () => {
+  test('generates a templated secret value through a custom resource', () => {
+    const template = synth((stack) => new Secret(stack, 'Secret', {
+      generateSecretString: { secretStringTemplate: '{"username":"app"}', generateStringKey: 'password' },
+    }));
+
+    template.resourceCountIs('Custom::GenerateSecretString', 1);
+    template.hasResourceProperties('AWS::SecretsManager::Secret', {
+      GenerateSecretString: Match.objectEquals({}),
+    });
+    template.hasResourceProperties('AWS::Lambda::Function', { Runtime: 'nodejs24.x' });
+    template.hasResourceProperties('AWS::IAM::Policy', {
+      PolicyDocument: {
+        Statement: Match.arrayWith([
+          Match.objectLike({ Action: 'secretsmanager:GetRandomPassword', Effect: 'Allow', Resource: '*' }),
+        ]),
+      },
+    });
+  });
+
+  test('creates no custom resource without a secret string template', () => {
+    const template = synth((stack) => new Secret(stack, 'Secret', {
+      generateSecretString: { passwordLength: 32 },
+    }));
+
+    template.resourceCountIs('Custom::GenerateSecretString', 0);
+    template.resourceCountIs('AWS::Lambda::Function', 0);
+  });
+});

package/templates/app/test/didRandomPropertiesChange.test.ts

@@ -0,0 +1,19 @@
+import { didRandomPropertiesChange } from '../src/constructs/handler/secret/didRandomPropertiesChange';
+
+describe('didRandomPropertiesChange', () => {
+  const base = { passwordLength: 32, excludePunctuation: true, secretStringTemplate: '{}', generateStringKey: 'password' };
+
+  test('is false when only non-random properties change', () => {
+    expect(didRandomPropertiesChange(base, { ...base, secretStringTemplate: '{"a":1}', generateStringKey: 'pw' })).toBe(false);
+  });
+
+  test.each([
+    ['passwordLength', 64],
+    ['excludePunctuation', false],
+    ['excludeCharacters', '"@/'],
+    ['includeSpace', true],
+    ['requireEachIncludedType', true],
+  ])('is true when %s changes', (key, value) => {
+    expect(didRandomPropertiesChange(base, { ...base, [key]: value })).toBe(true);
+  });
+});

package/templates/app/test/tsconfig.json

@@ -0,0 +1,13 @@
+{
+  "extends": "../tsconfig.json",
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": ".."
+  },
+  "include": [
+    "**/*.ts"
+  ],
+  "exclude": [
+    "node_modules"
+  ]
+}

package/templates/app/tsconfig.json

@@ -0,0 +1,50 @@
+{
+  "compilerOptions": {
+    "rootDir": "src",
+    "outDir": "lib",
+    "alwaysStrict": true,
+    "declaration": true,
+    "esModuleInterop": true,
+    "experimentalDecorators": true,
+    "inlineSourceMap": true,
+    "inlineSources": true,
+    "lib": [
+      "es2022"
+    ],
+    "module": "NodeNext",
+    "noEmitOnError": false,
+    "noFallthroughCasesInSwitch": false,
+    "noImplicitAny": true,
+    "noImplicitReturns": true,
+    "noImplicitThis": true,
+    "noUnusedLocals": false,
+    "noUnusedParameters": false,
+    "resolveJsonModule": true,
+    "strict": true,
+    "strictNullChecks": true,
+    "strictPropertyInitialization": false,
+    "stripInternal": true,
+    "target": "ES2022",
+    "types": [
+      "jest",
+      "jsonwebtoken",
+      "node",
+      "aws-lambda",
+      "express",
+      "pg"
+    ],
+    "moduleResolution": "nodenext",
+    "typeRoots": [
+      "./node_modules/@types"
+    ],
+    "isolatedModules": true,
+    "allowImportingTsExtensions": true
+  },
+  "include": [
+    "src/**/*.ts"
+  ],
+  "exclude": [
+    "node_modules",
+    "cdk.out"
+  ]
+}