@mbc-cqrs-serverless/cli 1.2.7-beta.0 → 1.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mbc-cqrs-serverless/cli",
-  "version": "1.2.7-beta.0",
+  "version": "1.3.0",
   "description": "a CLI to get started with MBC CQRS serverless framework",
   "keywords": [
     "mbc",
@@ -58,5 +58,5 @@
     "@faker-js/faker": "^8.3.1",
     "copyfiles": "^2.4.1"
   },
-  "gitHead": "1975de0bba0555ec74f3f0607bd4f86b6c65c1f5"
+  "gitHead": "3e6f1b6d57bf38433d5f63dfb9f5e03a4c9bb25d"
 }

package/templates/infra/config/type.ts

@@ -10,8 +10,33 @@ export type Config = {
   domain: {
     http: string
     appsync: string
+    appsyncEvents?: string // optional: custom domain for AppSync Events API
   }
 
+  appsyncEvents?: {
+    /** Set true to create the AppSync Events API and inject env vars into Lambda/ECS */
+    enabled: boolean
+    /**
+     * Channel namespace name — must be a pre-registered name in the AppSync Event API.
+     * Becomes segment 1 of every channel path: /{namespace}/{tenantCode}/{table}/{action}/{id}
+     * Defaults to 'default'.
+     */
+    namespace: string
+    /** API key TTL in days. Defaults to 365. */
+    apiKeyExpireDays?: number
+  }
+
+  /**
+   * Value injected as NOTIFICATION_TRANSPORTS env var into Lambda/ECS.
+   * Controls which transports NotificationEventHandler uses.
+   * Examples:
+   *   'appsync-event'                    — Events API only
+   *   'appsync-graphql'                  — GraphQL API only
+   *   'appsync-graphql,appsync-event'    — dual-publish (migration mode)
+   * Defaults to 'appsync-event' when appsyncEvents is enabled.
+   */
+  notificationTransports?: string
+
   // existing resources
   userPoolId?: string
 

package/templates/infra/libs/infra-stack.ts

@@ -249,6 +249,76 @@ export class InfraStack extends cdk.Stack {
     this.graphqlApiKey = new cdk.CfnOutput(this, 'GraphQLAPIKey', {
       value: appSyncApi.apiKey || '',
     })
+
+    // AppSync Events API (HTTP pub/sub, schema-free)
+    // Uses L2 EventApi so that ChannelNamespace can set explicit publishAuthModeTypes
+    // and subscribeAuthModeTypes — without these the namespace has no effective
+    // authorization and Lambda publish calls receive 401.
+    let appSyncEventsApi: cdk.aws_appsync.EventApi | undefined
+    if (props.config.appsyncEvents?.enabled) {
+      const expireDays = props.config.appsyncEvents.apiKeyExpireDays ?? 365
+
+      appSyncEventsApi = new cdk.aws_appsync.EventApi(this, 'events-api', {
+        apiName: prefix + 'events',
+        authorizationConfig: {
+          authProviders: [
+            {
+              authorizationType: cdk.aws_appsync.AppSyncAuthorizationType.IAM,
+            },
+            {
+              authorizationType:
+                cdk.aws_appsync.AppSyncAuthorizationType.API_KEY,
+              apiKeyConfig: {
+                expires: cdk.Expiration.after(cdk.Duration.days(expireDays)),
+              },
+            },
+          ],
+          // API-level defaults — overridden per-namespace below
+          connectionAuthModeTypes: [
+            cdk.aws_appsync.AppSyncAuthorizationType.API_KEY,
+          ],
+          defaultPublishAuthModeTypes: [
+            cdk.aws_appsync.AppSyncAuthorizationType.IAM,
+          ],
+          defaultSubscribeAuthModeTypes: [
+            cdk.aws_appsync.AppSyncAuthorizationType.API_KEY,
+          ],
+        },
+      })
+
+      // Namespace — explicitly sets auth per operation so it is never left
+      // without authorization (which caused the 401).
+      //   publish  = AWS_IAM   → Lambda signs with its execution role
+      //   subscribe = API_KEY  → browser clients pass x-api-key header
+      new cdk.aws_appsync.ChannelNamespace(this, 'events-namespace', {
+        api: appSyncEventsApi,
+        channelNamespaceName: props.config.appsyncEvents.namespace ?? 'default',
+        authorizationConfig: {
+          publishAuthModeTypes: [cdk.aws_appsync.AppSyncAuthorizationType.IAM],
+          subscribeAuthModeTypes: [
+            cdk.aws_appsync.AppSyncAuthorizationType.API_KEY,
+          ],
+        },
+      })
+
+      // Outputs
+      new cdk.CfnOutput(this, 'AppSyncEventsHttpEndpoint', {
+        value: `https://${appSyncEventsApi.httpDns}/event`,
+        description:
+          'AppSync Events HTTP endpoint — APPSYNC_EVENTS_ENDPOINT env var',
+      })
+      new cdk.CfnOutput(this, 'AppSyncEventsRealtimeEndpoint', {
+        value: `wss://${appSyncEventsApi.realtimeDns}/event/realtime`,
+        description:
+          'AppSync Events WebSocket endpoint for client subscriptions',
+      })
+      new cdk.CfnOutput(this, 'AppSyncEventsNamespace', {
+        value: props.config.appsyncEvents.namespace ?? 'default',
+        description:
+          'AppSync Events namespace — APPSYNC_EVENTS_NAMESPACE env var',
+      })
+    }
+
     // S3
     const ddbBucket = new cdk.aws_s3.Bucket(this, 'ddb-attributes', {
       bucketName: prefix + 'ddb-attributes', // Globally unique bucket name
@@ -398,6 +468,16 @@ export class InfraStack extends cdk.Stack {
       SNS_ALARM_TOPIC_ARN: alarmSns.topicArn,
       COGNITO_USER_POOL_ID: userPool.userPoolId,
       APPSYNC_ENDPOINT: appSyncApi.graphqlUrl,
+      // AppSync Events — only injected when feature is enabled
+      ...(props.config.appsyncEvents?.enabled && appSyncEventsApi
+        ? {
+            NOTIFICATION_TRANSPORTS:
+              props.config.notificationTransports ?? 'appsync-event',
+            APPSYNC_EVENTS_ENDPOINT: `https://${appSyncEventsApi.httpDns}/event`,
+            APPSYNC_EVENTS_NAMESPACE:
+              props.config.appsyncEvents.namespace ?? 'default',
+          }
+        : {}),
       SES_FROM_EMAIL: props.config.fromEmailAddress,
       DATABASE_URL: `postgresql://${props.config.rds.accountSsmKey}@${props.config.rds.endpoint}/${props.config.rds.dbName}?schema=public`,
       S3_PUBLIC_BUCKET_NAME: publicBucket.bucketName,
@@ -645,6 +725,14 @@ export class InfraStack extends cdk.Stack {
       domainName: httpDistribution.distributionDomainName,
     })
 
+    if (props.config.domain.appsyncEvents && appSyncEventsApi) {
+      new cdk.aws_route53.CnameRecord(this, 'AppSyncEventsCnameRecord', {
+        zone: hostedZone,
+        recordName: props.config.domain.appsyncEvents,
+        domainName: appSyncEventsApi.httpDns,
+      })
+    }
+
     this.httpDistributionDomain = new cdk.CfnOutput(
       this,
       'http-distribution-domain',
@@ -1100,6 +1188,8 @@ export class InfraStack extends cdk.Stack {
     appSyncApi.grantMutation(lambdaApi)
     importActionSqs.grantSendMessages(lambdaApi)
 
+    appSyncEventsApi?.grantPublish(lambdaApi)
+
     // Define an IAM policy for full DynamoDB access
     const dynamoDbTablePrefixArn = cdk.Arn.format({
       partition: 'aws',
@@ -1231,6 +1321,7 @@ export class InfraStack extends cdk.Stack {
           statements: [ssmPolicy],
         }),
       )
+      appSyncEventsApi?.grantPublish(taskRole)
     }
   }
 }