@mstuercke/pulumi-modules 0.0.5 → 0.0.7

package/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@mstuercke/pulumi-modules",
-  "version": "0.0.5",
+  "version": "0.0.7",
   "files": [
-    "src/**/!(*.test|*.fixture).ts",
-    "tsconfig.json",
+    "dist/**/!(*.test|*.fixture)(.d.ts|.js)",
     "README.md"
   ],
-  "exports": "./src/index.ts",
+  "exports": "./dist/index.js",
   "type": "module",
   "scripts": {
     "typeCheck": "tsc --noEmit",
+    "build": "tsc",
     "bump:major": "npm version major --git-tag-version false",
     "bump:minor": "npm version minor --git-tag-version false",
     "bump:patch": "npm version patch --git-tag-version false",

package/src/auth0/Auth0.ts

@@ -1,162 +0,0 @@
-import {type CustomResourceOptions, type Output, Resource} from '@pulumi/pulumi'
-import {Client, ClientCredentials, Connection, ConnectionClient, Provider, Tenant, User} from '@pulumi/auth0'
-
-export type Auth0Domain = `${string}.auth0.com`
-export type Auth0URL = `http://${string}` | `https://${string}`
-
-export interface Auth0User {
-  name: string
-  email: string
-  password: string
-  emailVerified: boolean
-  appMetadata?: Record<string, unknown>
-}
-
-export interface Auth0Args {
-  projectId: string
-  environmentName: string
-  tenantDisplayName: string
-  clientDisplayName: string
-  domain: Auth0Domain
-  m2mClientId: string
-  allowedUrls: Auth0URL[]
-  allowedLoginCallbackUrls?: Auth0URL[]
-  allowedLogoutCallbackUrls?: Auth0URL[]
-  nativeAppId?: `com.${string}`
-  defaultUsers?: Auth0User[]
-  disableSignup?: boolean
-}
-
-export class Auth0 extends Resource {
-  domain: string
-  clientId: Output<string>
-
-  constructor(id: string, args: Auth0Args, opts?: CustomResourceOptions) {
-    super('mstuercke:auth0:Auth0', id, false, undefined, opts)
-
-    const {
-      projectId,
-      environmentName,
-      tenantDisplayName,
-      clientDisplayName,
-      domain,
-      m2mClientId,
-      allowedUrls,
-      allowedLoginCallbackUrls,
-      allowedLogoutCallbackUrls,
-      nativeAppId,
-      defaultUsers = [],
-      disableSignup = false,
-    } = args
-
-    new Provider('provider', {}, {parent: this})
-
-    new Tenant(
-      'tenant',
-      {
-        friendlyName: tenantDisplayName,
-        flags: {
-          enableClientConnections: false,
-        },
-      },
-      {parent: this},
-    )
-
-    const nativeAppCallbackUrls = nativeAppId
-      ? [
-          `${nativeAppId}.auth0://${domain}/ios/${nativeAppId}/callback`,
-          `${nativeAppId}.auth0://${domain}/android/${nativeAppId}/callback`,
-        ]
-      : []
-    const client = new Client(
-      'client',
-      {
-        name: clientDisplayName,
-        appType: 'spa',
-        callbacks: [...(allowedLoginCallbackUrls || allowedUrls), ...nativeAppCallbackUrls],
-        webOrigins: allowedUrls,
-        allowedLogoutUrls: [...(allowedLogoutCallbackUrls || allowedUrls), ...nativeAppCallbackUrls],
-        jwtConfiguration: {
-          alg: 'RS256',
-        },
-        addons: {},
-      },
-      {parent: this},
-    )
-
-    const connection = new Connection(
-      'password-authentication',
-      {
-        name: `${projectId}-${environmentName}`,
-        strategy: 'auth0',
-        options: {
-          disableSignup: disableSignup,
-          bruteForceProtection: true,
-        },
-      },
-      {parent: this},
-    )
-
-    const m2mClientConnection = new ConnectionClient(
-      'password-authentication-m2m-client',
-      {
-        clientId: m2mClientId,
-        connectionId: connection.id,
-      },
-      {parent: client},
-    )
-
-    const clientConnection = new ConnectionClient(
-      'password-authentication-client',
-      {
-        clientId: client.id,
-        connectionId: connection.id,
-      },
-      {parent: client},
-    )
-
-    // TODO: Implement disabling of google-oauth2 (If possible, also disable "Username-Password-Authentication")
-    // // disable google-oauth2 on all clients
-    // const googleOauth2Connection = output(getConnection({name: 'google-oauth2'}))
-    // new ConnectionClients(
-    //   'google-oauth2-clients',
-    //   {
-    //     connectionId: googleOauth2Connection.id,
-    //     enabledClients: [],
-    //   },
-    //   {parent: client, dependsOn: [client]},
-    // )
-
-    new ClientCredentials(
-      'credentials',
-      {
-        clientId: client.id,
-        authenticationMethod: 'none',
-      },
-      {parent: this},
-    )
-
-    for (const defaultUser of defaultUsers) {
-      const {name, email, emailVerified, password, appMetadata} = defaultUser
-
-      new User(
-        `default-user-${defaultUser.email}`,
-        {
-          connectionName: connection.name,
-          name: name,
-          email: email,
-          emailVerified: emailVerified,
-          password: password,
-          appMetadata: appMetadata ? JSON.stringify(appMetadata) : undefined,
-        },
-        {
-          dependsOn: [m2mClientConnection, clientConnection],
-          parent: connection,
-        },
-      )
-    }
-
-    this.domain = domain
-    this.clientId = client.id
-  }
-}

package/src/auth0/index.ts

@@ -1,7 +0,0 @@
-import {Auth0} from './Auth0.ts'
-
-export * from './Auth0.ts'
-
-export const auth0 = {
-  Auth0,
-}

package/src/domain/getDomain.ts

@@ -1,32 +0,0 @@
-import {acm, type Provider, route53} from '@pulumi/aws'
-
-export interface DataDomainOptions {
-  usEast1Provider: Provider
-  name: `${string}.${string}`
-}
-
-export type DomainResult = {
-  name: string
-  zoneId: string
-  nameServers: string[]
-  usEast1CertificateArn: string
-  euCentral1CertificateArn: string
-}
-
-export const getDomain = async (options: DataDomainOptions): Promise<DomainResult> => {
-  const {usEast1Provider, name} = options
-
-  const zone = await route53.getZone({name})
-
-  const euCentral1Certificate = await acm.getCertificate({domain: name})
-
-  const usEast1Certificate = await acm.getCertificate({domain: name}, {provider: usEast1Provider})
-
-  return {
-    name: zone.name,
-    zoneId: zone.zoneId,
-    nameServers: zone.nameServers,
-    usEast1CertificateArn: usEast1Certificate.arn,
-    euCentral1CertificateArn: euCentral1Certificate.arn,
-  }
-}

package/src/domain/index.ts

@@ -1,7 +0,0 @@
-import {getDomain} from './getDomain.ts'
-
-export * from './getDomain.ts'
-
-export const domain = {
-  getDomain,
-}

package/src/iam/SimpleIamRolePolicy.ts

@@ -1,164 +0,0 @@
-import {iam} from '@pulumi/aws'
-import type {SimpleIamRolePolicyConfig} from './SimpleIamRolePolicyConfig.js'
-import {type CustomResourceOptions, type Input, output} from '@pulumi/pulumi'
-import type {PolicyStatement, RolePolicyArgs} from '@pulumi/aws/iam'
-
-export class SimpleIamRolePolicy extends iam.RolePolicy {
-  constructor(iamRoleId: string, config: SimpleIamRolePolicyConfig, opts?: CustomResourceOptions) {
-    switch (config.type) {
-      case 'custom':
-        super(config.name, mapIamRolePolicyConfig(iamRoleId, config.name, config.statements), opts)
-        break
-
-      case 'dynamodb':
-        if (config.level !== 'full-access') throw mapError(config)
-        super(
-          config.name,
-          mapIamRolePolicyConfig(iamRoleId, config.name, [
-            {
-              Action: ['dynamodb:*'],
-              Effect: 'Allow',
-              Resource: output(config.tableArn).apply((tableArn) => [`${tableArn}`, `${tableArn}/*`]),
-            },
-          ]),
-          opts,
-        )
-        break
-
-      case 'timestream':
-        if (config.level !== 'full-access') throw mapError(config)
-
-        super(
-          config.name,
-          mapIamRolePolicyConfig(iamRoleId, config.name, [
-            {
-              Action: ['timestream:*'],
-              Effect: 'Allow',
-              Resource: [config.dbArn, config.tableArn],
-            },
-            {
-              Action: ['timestream:DescribeEndpoints'],
-              Effect: 'Allow',
-              Resource: ['*'],
-            },
-          ]),
-          opts,
-        )
-        break
-
-      case 's3':
-        if (config.level !== 'full-access') throw mapError(config)
-
-        super(
-          config.name,
-          mapIamRolePolicyConfig(iamRoleId, config.name, [
-            {
-              Action: ['s3:*'],
-              Effect: 'Allow',
-              Resource: output(config.bucketArn).apply((bucketArn) => [`${bucketArn}`, `${bucketArn}/*`]),
-            },
-          ]),
-          opts,
-        )
-        break
-
-      case 'cognito':
-        if (config.level !== 'full-access') throw mapError(config)
-
-        super(
-          config.name,
-          mapIamRolePolicyConfig(iamRoleId, config.name, [
-            {
-              Action: ['cognito-idp:*'],
-              Effect: 'Allow',
-              Resource: [config.userPoolArn],
-            },
-          ]),
-          opts,
-        )
-        break
-
-      case 'websocket':
-        if (config.level !== 'full-access') throw mapError(config)
-
-        super(
-          config.name,
-          mapIamRolePolicyConfig(iamRoleId, config.name, [
-            {
-              Effect: 'Allow',
-              Action: 'execute-api:*',
-              Resource: config.apiArn,
-            },
-          ]),
-          opts,
-        )
-        break
-
-      case 'sns':
-        if (config.level !== 'publish-message') throw mapError(config)
-
-        super(
-          config.name,
-          mapIamRolePolicyConfig(iamRoleId, config.name, [
-            {
-              Effect: 'Allow',
-              Action: 'sns:Publish',
-              Resource: config.snsTopicArn,
-            },
-          ]),
-          opts,
-        )
-        break
-
-      case 'execute-lambda':
-        super(
-          config.name,
-          mapIamRolePolicyConfig(iamRoleId, config.name, [
-            {
-              Effect: 'Allow',
-              Action: 'lambda:InvokeFunction',
-              Resource: config.lambdaArn,
-            },
-          ]),
-          opts,
-        )
-        break
-
-      case 'event-bridge':
-        super(
-          config.name,
-          mapIamRolePolicyConfig(iamRoleId, config.name, [
-            {
-              Effect: 'Allow',
-              Action: ['events:DescribeRule', 'events:DisableRule', 'events:EnableRule'],
-              Resource: config.ruleArn,
-            },
-          ]),
-          opts,
-        )
-        break
-
-      default:
-        throw mapError(config)
-    }
-  }
-}
-
-function mapIamRolePolicyConfig(
-  iamRoleId: Input<string>,
-  name: string,
-  statements: Input<Input<PolicyStatement>[]>,
-): RolePolicyArgs {
-  return {
-    role: iamRoleId,
-    name: name,
-    policy: {
-      Version: '2012-10-17',
-      Statement: statements,
-    },
-  }
-}
-
-function mapError(config: SimpleIamRolePolicyConfig): Error {
-  return new Error(`Unable to create policy with config: ${JSON.stringify(config)}`)
-}

package/src/iam/SimpleIamRolePolicyConfig.ts

@@ -1,75 +0,0 @@
-import type {Input} from '@pulumi/pulumi'
-import type {PolicyStatement} from '@pulumi/aws/iam'
-
-export type SimpleIamRolePolicyConfig =
-  | CustomPolicyConfig
-  | DynamoDbPolicyConfig
-  | TimestreamPolicyConfig
-  | S3PolicyConfig
-  | CognitoPolicyConfig
-  | WebsocketPolicyConfig
-  | ExecuteLambdaConfig
-  | SnsPolicyConfig
-  | EventBridgeConfig
-
-interface CustomPolicyConfig {
-  type: 'custom'
-  name: string
-  statements: PolicyStatement[]
-}
-
-interface DynamoDbPolicyConfig {
-  type: 'dynamodb'
-  level: 'full-access'
-  name: string
-  tableArn: Input<string>
-}
-
-interface TimestreamPolicyConfig {
-  type: 'timestream'
-  level: 'full-access'
-  name: string
-  dbArn: Input<string>
-  tableArn: Input<string>
-}
-
-interface S3PolicyConfig {
-  type: 's3'
-  level: 'full-access'
-  name: string
-  bucketArn: Input<string>
-}
-
-interface CognitoPolicyConfig {
-  type: 'cognito'
-  level: 'full-access'
-  name: string
-  userPoolArn: Input<string>
-}
-
-interface WebsocketPolicyConfig {
-  type: 'websocket'
-  level: 'full-access'
-  name: string
-  apiArn: '*'
-}
-
-interface SnsPolicyConfig {
-  type: 'sns'
-  level: 'publish-message'
-  name: string
-  snsTopicArn: Input<string>
-}
-
-interface ExecuteLambdaConfig {
-  type: 'execute-lambda'
-  name: string
-  lambdaArn: Input<string>
-}
-
-interface EventBridgeConfig {
-  type: 'event-bridge'
-  level: 'enable-disable-rule'
-  name: string
-  ruleArn: Input<string>
-}

package/src/iam/index.ts

@@ -1,8 +0,0 @@
-import {SimpleIamRolePolicy} from './SimpleIamRolePolicy.ts'
-
-export * from './SimpleIamRolePolicy.ts'
-export * from './SimpleIamRolePolicyConfig.ts'
-
-export const iam = {
-  SimpleIamRolePolicy,
-}

package/src/index.ts

@@ -1,31 +0,0 @@
-import {auth0} from './auth0/index.ts'
-import {domain} from './domain/index.ts'
-import {iam} from './iam/index.ts'
-import {rest} from './rest/index.ts'
-import {lambda} from './lambda/index.ts'
-import {mongodb} from './mongodb/index.ts'
-import {s3} from './s3/index.ts'
-import {website} from './website/index.ts'
-import {websocket} from './websocket/index.ts'
-
-export * from './auth0/index.ts'
-export * from './domain/index.ts'
-export * from './iam/index.ts'
-export * from './lambda/index.ts'
-export * from './mongodb/index.ts'
-export * from './rest/index.ts'
-export * from './s3/index.ts'
-export * from './website/index.ts'
-export * from './websocket/index.ts'
-
-export const mstuercke = {
-  auth0,
-  domain,
-  iam,
-  lambda,
-  mongodb,
-  rest,
-  s3,
-  website,
-  websocket: websocket,
-}

package/src/lambda/NodeLambdaFunction.ts

@@ -1,119 +0,0 @@
-import {iam, lambda} from '@pulumi/aws'
-import {getFile} from '@pulumi/archive'
-import {asset, type CustomResourceOptions, type Output, Resource} from '@pulumi/pulumi'
-
-import {SimpleIamRolePolicy, type SimpleIamRolePolicyConfig} from '../iam/index.ts'
-import type {WithInputs} from './WithInputs.js'
-
-export type NodeLambdaFunctionArgs<EnvironmentVariables> = {
-  name: string
-  runtime?: string
-  functionHandler?: string
-  memorySize?: number
-  timeoutSeconds?: number
-  lambdaPath: string
-  additionalIamRolePolicies?: SimpleIamRolePolicyConfig[]
-  environmentVariables?: WithInputs<EnvironmentVariables>
-  projectId: string
-}
-
-export class NodeLambdaFunction<
-  EnvironmentVariables extends Record<string, string> = Record<string, string>,
-> extends Resource {
-  name: string
-  arn: Output<string>
-  invokeArn: Output<string>
-
-  constructor(args: NodeLambdaFunctionArgs<EnvironmentVariables>, opts?: CustomResourceOptions) {
-    super('mstuercke:lambda:NodeLambdaFunction', args.name, false, undefined, opts)
-    const {
-      name,
-      additionalIamRolePolicies = [],
-      environmentVariables = undefined,
-      runtime = 'nodejs22.x',
-      functionHandler = 'lambdaFunction.lambdaHandler',
-      memorySize = 128,
-      timeoutSeconds = 30,
-      projectId,
-    } = args
-
-    const role = new iam.Role(
-      name,
-      {
-        name: `${name}-lambda`,
-        assumeRolePolicy: JSON.stringify({
-          Version: '2012-10-17',
-          Statement: [
-            {
-              Action: 'sts:AssumeRole',
-              Principal: {Service: 'lambda.amazonaws.com'},
-              Effect: 'Allow',
-            },
-          ],
-        }),
-        tags: {
-          project: projectId,
-        },
-      },
-      {parent: this},
-    )
-
-    role.id.apply((roleId) => {
-      new SimpleIamRolePolicy(
-        roleId,
-        {
-          type: 'custom',
-          name: 'logging',
-          statements: [
-            {
-              Effect: 'Allow',
-              Action: ['logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEvents'],
-              Resource: '*',
-            },
-          ],
-        },
-        {parent: this},
-      )
-
-      for (const config of additionalIamRolePolicies) {
-        new SimpleIamRolePolicy(roleId, config, {parent: this})
-      }
-    })
-
-    const lambdaZip = getFile({
-      type: 'zip',
-      sourceDir: args.lambdaPath,
-      outputPath: `dist/lambda/${name}.zip`,
-    })
-
-    const lambdaFunction = new lambda.Function(
-      name,
-      {
-        name: name,
-        handler: functionHandler,
-        runtime: runtime,
-        memorySize: memorySize,
-        timeout: timeoutSeconds,
-
-        code: new asset.FileArchive(lambdaZip.then((lambdaZip) => lambdaZip.outputPath)),
-        sourceCodeHash: lambdaZip.then((lambdaZip) => lambdaZip.outputBase64sha256),
-
-        role: role.arn,
-
-        environment: {
-          variables: {
-            ...environmentVariables,
-          },
-        },
-        tags: {
-          project: projectId,
-        },
-      },
-      {parent: this},
-    )
-
-    this.name = name
-    this.arn = lambdaFunction.arn
-    this.invokeArn = lambdaFunction.invokeArn
-  }
-}

package/src/lambda/WithInputs.ts

@@ -1,5 +0,0 @@
-import type {Input} from '@pulumi/pulumi'
-
-export type WithInputs<T> = {
-  [key in keyof T]: Input<T[key]>
-}

package/src/lambda/index.ts

@@ -1,7 +0,0 @@
-import {NodeLambdaFunction} from './NodeLambdaFunction.ts'
-
-export * from './NodeLambdaFunction.ts'
-
-export const lambda = {
-  NodeLambdaFunction,
-}