@mettlecast/domain-cdk-packer 0.2.111 → 0.2.112

package/dist/DomainStack.js

@@ -664,6 +664,22 @@ export class DomainStack extends cdk.Stack {
                 const queuePolicies = iamBuilder.forJob({ queueArn: queue.queueArn, dlqArn: dlq.queueArn });
                 queuePolicies.forEach(statement => fn.addToRolePolicy(statement));
             }
+            // Cross-domain action dispatch from jobs (#5389): job consumers are
+            // first-class orchestrators — the claim-guarded delivery job invokes
+            // `email.send-template-email` through `ctx.actions`, exactly like the
+            // subscriber path (#5226). Without this grant the durable delivery
+            // path would fail with AccessDenied on every attempt and land
+            // everything in the job DLQ. Same resolved deterministic-ARN list the
+            // subscriber wiring uses — never a wildcard.
+            const jobCrossDomainActionArns = Object.values(crossDomainActionArns);
+            if (jobCrossDomainActionArns.length > 0) {
+                jobLambdas.forEach((fn) => {
+                    fn.addToRolePolicy(new iam.PolicyStatement({
+                        actions: ['lambda:InvokeFunction'],
+                        resources: jobCrossDomainActionArns,
+                    }));
+                });
+            }
             // Add dbSecretArn grant if provided
             if (dbSecretArn) {
                 jobLambdas.forEach(fn => fn.addToRolePolicy(new iam.PolicyStatement({

package/dist/__tests__/invitation-delivery-wiring.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/invitation-delivery-wiring.test.js

@@ -0,0 +1,170 @@
+import { describe, it, expect, afterAll } from 'vitest';
+import * as cdk from 'aws-cdk-lib';
+import { Template } from 'aws-cdk-lib/assertions';
+import fs from 'node:fs';
+import path from 'node:path';
+import { DomainStack } from '../DomainStack.js';
+/**
+ * #5389 — synth-level contract for the durable invitation-delivery wiring
+ * in the auth domain stack:
+ *
+ *  1. the domain declares `auth.outbox`, so every Lambda gets
+ *     TIB_OUTBOX_TABLE (the dispatcher schedule needs a real ctx.outbox);
+ *  2. the claim-guarded `deliver-invitation-email` job gets its encrypted
+ *     queue + DLQ, redrive `maxReceiveCount = maxRetries + 1`, and the
+ *     standard DLQ depth/age alarms wired to the SNS topic;
+ *  3. the JOB Lambda role receives the cross-domain
+ *     `lambda:InvokeFunction` grant scoped to the resolved internal-action
+ *     ARNs — without it, the job's ctx.actions.email['send-template-email']
+ *     call would AccessDenied on every attempt (the gap this issue found:
+ *     jobs were never granted what subscribers already had);
+ *  4. reconciliation + dispatch schedules synthesize EventBridge Scheduler
+ *     rules.
+ */
+const DOMAIN_ROOT = path.join(process.cwd(), '.test-domain-cdk-packer-5389');
+const handlerDir = path.join(DOMAIN_ROOT, 'subscribers');
+fs.mkdirSync(handlerDir, { recursive: true });
+fs.mkdirSync(path.join(DOMAIN_ROOT, 'jobs'), { recursive: true });
+fs.mkdirSync(path.join(DOMAIN_ROOT, 'schedules'), { recursive: true });
+fs.writeFileSync(path.join(handlerDir, 'on-member-invited.ts'), 'export const onMemberInvited = { id: "on-member-invited", _kind: "subscriber", event: "auth.member.invited", semverRange: ">=1", handler: async () => undefined };\n');
+fs.writeFileSync(path.join(DOMAIN_ROOT, 'jobs', 'deliver-invitation-email.ts'), 'export const deliverInvitationEmail = { id: "deliver-invitation-email", _kind: "job", maxRetries: 5, visibilityTimeoutSeconds: 300, handler: async () => undefined };\n');
+fs.writeFileSync(path.join(DOMAIN_ROOT, 'schedules', 'dispatch-invitation-outbox.ts'), 'export const dispatchInvitationOutbox = { id: "dispatch-invitation-outbox", _kind: "schedule", cron: "rate(1 minute)", enabled: true, handler: async () => undefined };\n');
+fs.writeFileSync(path.join(DOMAIN_ROOT, 'schedules', 'reconcile-invitation-delivery.ts'), 'export const reconcileInvitationDelivery = { id: "reconcile-invitation-delivery", _kind: "schedule", cron: "rate(15 minutes)", enabled: true, handler: async () => undefined };\n');
+// Grouped Lambdas use Code.fromAsset('dist/domains/{domain}/{type}') — stub
+// the asset dirs so Template.fromStack can synth without a real bundle.
+const assetDirs = ['subscriber', 'schedule', 'job'].map(type => path.join(process.cwd(), 'dist', 'domains', 'auth', type));
+for (const dir of assetDirs) {
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(path.join(dir, 'index.js'), 'exports.handler = async () => ({});\n');
+}
+afterAll(() => {
+    fs.rmSync(DOMAIN_ROOT, { recursive: true, force: true });
+    for (const dir of assetDirs) {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+});
+const EMAIL_ACTION_ARN = 'arn:aws:lambda:eu-north-1:123456789012:function:MTC-Dev-domain-email-actionapi';
+const authRegistry = {
+    schemaVersion: '1',
+    domainRoot: DOMAIN_ROOT,
+    domain: {
+        id: 'auth',
+        kind: 'domain',
+        name: 'Auth',
+        tenancy: 'required',
+        outboxTableName: 'auth.outbox',
+    },
+    webhooks: [],
+    subscribers: [
+        {
+            id: 'on-member-invited', kind: 'subscriber', handlerFile: 'subscribers/on-member-invited.ts',
+            event: 'auth.member.invited', semverRange: '>=1',
+        },
+    ],
+    schedules: [
+        {
+            id: 'dispatch-invitation-outbox', kind: 'schedule', handlerFile: 'schedules/dispatch-invitation-outbox.ts',
+            cron: 'rate(1 minute)', enabled: true,
+        },
+        {
+            id: 'reconcile-invitation-delivery', kind: 'schedule', handlerFile: 'schedules/reconcile-invitation-delivery.ts',
+            cron: 'rate(15 minutes)', enabled: true,
+        },
+    ],
+    jobs: [
+        {
+            id: 'deliver-invitation-email', kind: 'job', handlerFile: 'jobs/deliver-invitation-email.ts',
+            maxRetries: 5, visibilityTimeoutSeconds: 300,
+        },
+    ],
+    actions: [],
+    integrations: [],
+    events: [],
+};
+const app = new cdk.App();
+const stack = new DomainStack(app, 'InvitationDelivery5389Stack', {
+    registry: authRegistry,
+    eventBusArn: 'arn:aws:events:eu-north-1:123456789012:event-bus/tib-event-bus',
+    projectId: 'Test',
+    envCode: 'Dev',
+    alarmSnsTopicArn: 'arn:aws:sns:eu-north-1:123456789012:alerts',
+    crossDomainActionArns: { email: EMAIL_ACTION_ARN },
+});
+const template = Template.fromStack(stack);
+/**
+ * Identify the delivery JOB Lambda via its SQS event-source mapping (only
+ * the job consumes the JobQueue; env-var maps are injected into every
+ * domain Lambda, so they cannot identify it), then resolve its execution
+ * role logical id through the Lambda's Fn::GetAtt.
+ */
+function jobLambdaRoleLogicalId() {
+    const mappings = Object.values(template.findResources('AWS::Lambda::EventSourceMapping'));
+    const jobMapping = mappings.find(m => JSON.stringify(m.Properties.EventSourceArn ?? '').includes('JobQueue'));
+    expect(jobMapping, 'job SQS event-source mapping must exist').toBeDefined();
+    const jobLambdaLogicalId = jobMapping.Properties.FunctionName.Ref;
+    const lambdas = template.findResources('AWS::Lambda::Function');
+    const jobLambda = lambdas[jobLambdaLogicalId];
+    expect(jobLambda, `job Lambda resource ${jobLambdaLogicalId} must exist`).toBeDefined();
+    const roleRef = jobLambda.Properties.Role;
+    expect(roleRef['Fn::GetAtt'], 'job Lambda role must be a GetAtt reference').toBeDefined();
+    return roleRef['Fn::GetAtt'][0];
+}
+describe('DomainStack invitation-delivery wiring (#5389)', () => {
+    it('injects TIB_OUTBOX_TABLE=auth.outbox into the domain Lambdas', () => {
+        const envs = Object.values(template.findResources('AWS::Lambda::Function'))
+            .map(res => (res.Properties.Environment?.Variables ?? {}))
+            .filter(env => env.TIB_OUTBOX_TABLE !== undefined);
+        expect(envs.length).toBeGreaterThan(0);
+        for (const env of envs) {
+            expect(env.TIB_OUTBOX_TABLE).toBe('auth.outbox');
+        }
+    });
+    it('gives the delivery job queue+DLQ with maxReceiveCount = maxRetries + 1 (6)', () => {
+        const queues = Object.values(template.findResources('AWS::SQS::Queue'));
+        const redrive = queues
+            .map(q => q.Properties.RedrivePolicy?.maxReceiveCount)
+            .filter(v => v !== undefined)
+            .map(v => String(v));
+        expect(redrive).toContain('6');
+        // the job queue keeps its configured visibility timeout
+        expect(queues.some(q => q.Properties.VisibilityTimeout === 300)).toBe(true);
+    });
+    it('creates DLQ depth + oldest-age alarms for the delivery job wired to SNS', () => {
+        const alarms = Object.values(template.findResources('AWS::CloudWatch::Alarm'));
+        const depth = alarms.find(a => a.Properties.AlarmName?.includes('-job-deliver-invitation-email-dlq-depth'));
+        const age = alarms.find(a => a.Properties.AlarmName?.includes('-job-deliver-invitation-email-dlq-oldest-age'));
+        expect(depth).toBeDefined();
+        expect(age).toBeDefined();
+        expect(JSON.stringify(depth.Properties.AlarmActions)).toContain('alerts');
+    });
+    it('grants the JOB Lambda role cross-domain lambda:InvokeFunction on the resolved action ARNs (#5389 gap)', () => {
+        const jobRoleLogicalId = jobLambdaRoleLogicalId();
+        const policies = Object.values(template.findResources('AWS::IAM::Policy'));
+        const jobPolicy = policies.find(p => {
+            const roles = p.Properties.Roles;
+            return roles.some(r => (typeof r === 'string' ? r : r.Ref) === jobRoleLogicalId);
+        });
+        expect(jobPolicy, 'IAM policy attached to the job Lambda role must exist').toBeDefined();
+        const statements = jobPolicy.Properties.PolicyDocument.Statement;
+        const invokeStatements = statements.filter(s => (Array.isArray(s.Action) ? s.Action : [s.Action]).includes('lambda:InvokeFunction'));
+        expect(invokeStatements.length).toBeGreaterThan(0);
+        const resources = JSON.stringify(invokeStatements.map(s => s.Resource));
+        expect(resources).toContain('MTC-Dev-domain-email-actionapi');
+        // scoped to exact ARNs, never a wildcard
+        expect(resources).not.toContain('"*"');
+    });
+    it('synthesizes EventBridge Scheduler rules for the dispatcher and reconciliation schedules', () => {
+        const schedules = Object.values(template.findResources('AWS::Scheduler::Schedule'));
+        const expressions = schedules.map(s => s.Properties.ScheduleExpression);
+        expect(expressions).toContain('rate(1 minute)');
+        expect(expressions).toContain('rate(15 minutes)');
+    });
+    it('keeps the subscriber cross-domain grant (delivery mirror path) intact', () => {
+        const policies = Object.values(template.findResources('AWS::IAM::Policy'));
+        const invokeForSubscriber = policies.some(p => {
+            const statements = p.Properties.PolicyDocument.Statement;
+            return statements.some(s => (Array.isArray(s.Action) ? s.Action : [s.Action]).includes('lambda:InvokeFunction'));
+        });
+        expect(invokeForSubscriber).toBe(true);
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mettlecast/domain-cdk-packer",
-  "version": "0.2.111",
+  "version": "0.2.112",
   "type": "module",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",