@mettlecast/domain-cdk-packer 0.2.76 → 0.2.78

package/dist/DomainStack.js

@@ -82,8 +82,12 @@ export class DomainStack extends cdk.Stack {
             })
             : undefined);
         const domainId = registry.domain.id;
-        const projectId = props.projectId ?? this.stackName.split('-')[0] ?? 'tib';
-        const envCode = props.envCode ?? this.stackName.split('-')[1] ?? 'dev';
+        const projectId = props.projectId ?? this.stackName.split('-')[0];
+        if (!projectId)
+            throw new Error('DomainStack requires projectId — pass it via packDomain options or ensure the stack name starts with the project prefix');
+        const envCode = props.envCode ?? this.stackName.split('-')[1];
+        if (!envCode)
+            throw new Error('DomainStack requires envCode — pass it via packDomain options or ensure the stack name includes the environment code');
         const resourceBaseName = domainResourceName(projectId, envCode, domainId);
         const allowedOrigins = corsAllowedOrigins ?? ['*'];
         this.httpApi = httpApi ?? new apigwv2.HttpApi(this, 'HttpApi', {
@@ -173,6 +177,9 @@ export class DomainStack extends cdk.Stack {
         if (appSecretArn) {
             environment.APP_SECRET_ARN = appSecretArn;
         }
+        if (process.env['SES_FROM_EMAIL']) {
+            environment.SES_FROM_EMAIL = process.env['SES_FROM_EMAIL'];
+        }
         const resolveSubnetSelection = (access) => {
             if (access === 'internet')
                 return internetSubnetSelection ?? internalSubnetSelection;
@@ -547,6 +554,22 @@ export class DomainStack extends cdk.Stack {
                 }));
             }
         }
+        // Grant SES SendEmail permission when a verified sending address is configured.
+        // Scoped to the SES identity ARN derived from SES_FROM_EMAIL (e.g. an
+        // address or domain identity) — least-privilege. Falls back to 'arn:aws:ses:*:*:*'
+        // only when the address is not address-shaped (tests/local).
+        if (process.env['SES_FROM_EMAIL']) {
+            const sesFrom = process.env['SES_FROM_EMAIL'];
+            const sesIdentity = sesFrom.includes('@')
+                ? `arn:aws:ses:${this.region}:${this.account}:identity/${sesFrom}`
+                : `arn:aws:ses:${this.region}:${this.account}:identity/${sesFrom}`;
+            for (const fn of allDomainLambdas) {
+                fn.addToRolePolicy(new iam.PolicyStatement({
+                    actions: ['ses:SendEmail', 'ses:SendRawEmail'],
+                    resources: [sesIdentity],
+                }));
+            }
+        }
         // Replace the tenant-scoped role trust policy — only domain Lambdas can assume with tenantId tag
         // Use a single Statement with ArnLike wildcard to stay under the 2048-byte ACL size limit
         const cfnRole = tenantScopedRole.node.defaultChild;

package/dist/pack-domain.d.ts

@@ -63,4 +63,4 @@ export interface PackDomainOptions {
  * @param options - Optional configuration including VPC, auth, and DB settings.
  * @returns The constructed DomainStack.
  */
-export declare function packDomain(registry: DomainRegistry, app: cdk.App, stackId: string, eventBusArn: string, options?: PackDomainOptions | cdk.Environment): DomainStack;
+export declare function packDomain(registry: DomainRegistry, app: cdk.App, stackId: string, eventBusArn: string, options?: PackDomainOptions): DomainStack;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mettlecast/domain-cdk-packer",
-  "version": "0.2.76",
+  "version": "0.2.78",
   "type": "module",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",