@openhi/constructs 0.0.151 → 0.0.153

package/lib/seed-demo-data.handler.js

@@ -707,27 +707,34 @@ var require_lib = __commonJS({
 var seed_demo_data_handler_exports = {};
 __export(seed_demo_data_handler_exports, {
   SEED_DEMO_DATA_USER_POOL_ID_ENV_VAR: () => SEED_DEMO_DATA_USER_POOL_ID_ENV_VAR,
-  devPasswordForEmail: () => devPasswordForEmail,
+  SEED_USER_PASSWORD_PARAMETER_PREFIX: () => SEED_USER_PASSWORD_PARAMETER_PREFIX,
+  __resetSsmClientForTests: () => __resetSsmClientForTests,
+  emailToSsmPath: () => emailToSsmPath,
+  fetchSeedUserPassword: () => fetchSeedUserPassword,
   handler: () => handler,
   productionCognitoProvisioner: () => productionCognitoProvisioner,
   runSeedDemoData: () => runSeedDemoData,
   seedDemoGraph: () => seedDemoGraph
 });
 module.exports = __toCommonJS(seed_demo_data_handler_exports);
-var import_node_crypto = require("crypto");
 var import_client_cognito_identity_provider = require("@aws-sdk/client-cognito-identity-provider");
 var import_client_dynamodb2 = require("@aws-sdk/client-dynamodb");
+var import_client_ssm = require("@aws-sdk/client-ssm");
 var import_types12 = require("@openhi/types");
 var import_workflows2 = __toESM(require_lib());
 
 // src/workflows/control-plane/seed-demo-data/events.ts
 var import_types = require("@openhi/types");
 var import_workflows = __toESM(require_lib());
+
+// src/data/operations/control/membership-constraints/platform-scope-tenant-id.ts
+var PLATFORM_SCOPE_TENANT_ID = "platform";
+
+// src/workflows/control-plane/seed-demo-data/events.ts
 var SEED_DEMO_DATA_CONSUMER_NAME = "seed-demo-data";
 var DEMO_URN_SYSTEM = "urn:openhi:demo";
 var OPENHI_RESOURCE_URN_SYSTEM = "http://openhi.org/";
 var DEMO_PERIOD = { start: "2026-01-01T00:00:00Z" };
-var PLATFORM_SCOPE_TENANT_ID = "platform";
 var PLACEHOLDER_TENANT_ID = "placeholder-tenant-id";
 var PLACEHOLDER_WORKSPACE_ID = "placeholder-workspace-id";
 var DEV_USERS = [
@@ -3510,6 +3517,9 @@ function buildRoleAssignmentWorkspaceProjectionItem(input) {
 var TENANT_LANE_SK_PREFIX = "MEMBERSHIP#TENANT#";
 async function assertUserHasTenantMembershipOperation(params) {
   const { userId, tenantId, tableName } = params;
+  if (tenantId === PLATFORM_SCOPE_TENANT_ID) {
+    return;
+  }
   const service = getDynamoControlService(tableName);
   const result = await service.entities.membershipUserProjection.query.record({ userId }).begins({ sk: TENANT_LANE_SK_PREFIX }).go();
   const matched = (result.data ?? []).some((row) => row.tenantId === tenantId);
@@ -5017,6 +5027,25 @@ var errorMessage = (err) => {
   }
   return String(err);
 };
+var tryRun = async (failures, phase, scope, resourceType, resourceId, fn) => {
+  try {
+    await fn();
+    return true;
+  } catch (err) {
+    failures.push({ phase, scope, resourceType, resourceId, error: err });
+    return false;
+  }
+};
+var aggregateFailureError = (failures) => {
+  const summary = failures.map(
+    (f) => `${f.phase} ${f.scope}/${f.resourceType}/${f.resourceId}: ${errorMessage(
+      f.error
+    )}`
+  ).join("; ");
+  return new Error(
+    `seed-demo-data: ${failures.length} item(s) failed across phases: ${summary}`
+  );
+};
 var idForRoleCode = (code) => {
   for (const key of Object.keys(import_types12.PLATFORM_ROLE_IDS)) {
     if (import_types12.PLATFORM_ROLE_CONCEPTS[key].code === code) {
@@ -5126,95 +5155,180 @@ var upsertUser = async (context, user, cognitoSub) => {
     lastUpdated: context.date ?? (/* @__PURE__ */ new Date()).toISOString()
   }).go();
 };
-var seedWorkspaceDataPlane = async (baseContext, group) => {
+var seedWorkspaceDataPlane = async (baseContext, group, failures) => {
   const workspaceContext = {
     ...baseContext,
     tenantId: group.tenantId,
     workspaceId: group.workspaceId
   };
+  const scope = `${group.tenantId}/${group.workspaceId}`;
   for (const patient of group.patients) {
-    await createPatientOperation({
-      context: workspaceContext,
-      body: patient
-    });
+    await tryRun(
+      failures,
+      "phase-3",
+      scope,
+      "Patient",
+      patient.id ?? "",
+      () => createPatientOperation({
+        context: workspaceContext,
+        body: patient
+      })
+    );
   }
   for (const practitioner of group.practitioners) {
-    await createPractitionerOperation({
-      context: workspaceContext,
-      body: practitioner
-    });
+    await tryRun(
+      failures,
+      "phase-3",
+      scope,
+      "Practitioner",
+      practitioner.id ?? "",
+      () => createPractitionerOperation({
+        context: workspaceContext,
+        body: practitioner
+      })
+    );
   }
   for (const observation of group.observations) {
-    await createObservationOperation({
-      context: workspaceContext,
-      body: observation
-    });
+    await tryRun(
+      failures,
+      "phase-3",
+      scope,
+      "Observation",
+      observation.id ?? "",
+      () => createObservationOperation({
+        context: workspaceContext,
+        body: observation
+      })
+    );
   }
   for (const encounter of group.encounters) {
-    await createEncounterOperation({
-      context: workspaceContext,
-      body: encounter
-    });
+    await tryRun(
+      failures,
+      "phase-3",
+      scope,
+      "Encounter",
+      encounter.id ?? "",
+      () => createEncounterOperation({
+        context: workspaceContext,
+        body: encounter
+      })
+    );
   }
   for (const account of group.accounts) {
-    await createAccountOperation({
-      context: workspaceContext,
-      body: account
-    });
+    await tryRun(
+      failures,
+      "phase-3",
+      scope,
+      "Account",
+      account.id ?? "",
+      () => createAccountOperation({
+        context: workspaceContext,
+        body: account
+      })
+    );
   }
 };
 var seedDemoGraph = async (params) => {
   const { baseContext, devUsers, cognito } = params;
+  const failures = [];
   for (const spec of DEMO_TENANT_SPECS) {
     const tenantContext = {
       ...baseContext,
       tenantId: spec.tenantId
     };
-    await createTenantOperation({
-      context: tenantContext,
-      body: { id: spec.tenantId, resource: tenantResourceBody(spec) }
-    });
-    for (const workspace of spec.workspaces) {
-      await createWorkspaceOperation({
+    await tryRun(
+      failures,
+      "phase-1",
+      spec.tenantId,
+      "Tenant",
+      spec.tenantId,
+      () => createTenantOperation({
         context: tenantContext,
-        body: {
-          id: workspace.id,
-          resource: workspaceResourceBody(spec, workspace)
-        }
-      });
+        body: { id: spec.tenantId, resource: tenantResourceBody(spec) }
+      })
+    );
+    for (const workspace of spec.workspaces) {
+      await tryRun(
+        failures,
+        "phase-1",
+        spec.tenantId,
+        "Workspace",
+        workspace.id,
+        () => createWorkspaceOperation({
+          context: tenantContext,
+          body: {
+            id: workspace.id,
+            resource: workspaceResourceBody(spec, workspace)
+          }
+        })
+      );
     }
   }
   for (const user of devUsers) {
-    const cognitoSub = await cognito.ensureUser(user.email);
-    await upsertUser(baseContext, user, cognitoSub);
+    let cognitoSub;
+    try {
+      cognitoSub = await cognito.ensureUser(user.email);
+    } catch (err) {
+      failures.push({
+        phase: "phase-2",
+        scope: user.id,
+        resourceType: "CognitoUser",
+        resourceId: user.email,
+        error: err
+      });
+      continue;
+    }
+    await tryRun(
+      failures,
+      "phase-2",
+      user.id,
+      "User",
+      user.id,
+      () => upsertUser(baseContext, user, cognitoSub)
+    );
     for (const spec of DEMO_TENANT_SPECS) {
       const tenantContext = {
         ...baseContext,
         tenantId: spec.tenantId
       };
+      const userScope = `${user.id}@${spec.tenantId}`;
       const membershipId = demoMembershipId(user.id, spec.tenantId);
-      await createMembershipOperation({
-        context: tenantContext,
-        body: {
-          id: membershipId,
-          resource: membershipResourceBody(spec, user, membershipId)
-        }
-      });
-      for (const roleCode of demoRolesForUserInTenant(user, spec.tenantId)) {
-        const raId = demoRoleAssignmentId(user.id, spec.tenantId, roleCode);
-        await createRoleAssignmentOperation({
+      await tryRun(
+        failures,
+        "phase-2",
+        userScope,
+        "Membership",
+        membershipId,
+        () => createMembershipOperation({
           context: tenantContext,
           body: {
-            id: raId,
-            resource: roleAssignmentResourceBody(
-              spec.scenario,
-              spec.tenantId,
-              user,
-              roleCode,
-              raId
-            )
+            id: membershipId,
+            resource: membershipResourceBody(spec, user, membershipId)
           }
-        });
+        })
+      );
+      for (const roleCode of demoRolesForUserInTenant(user, spec.tenantId)) {
+        const raId = demoRoleAssignmentId(user.id, spec.tenantId, roleCode);
+        await tryRun(
+          failures,
+          "phase-2",
+          userScope,
+          "RoleAssignment",
+          raId,
+          () => createRoleAssignmentOperation({
+            context: tenantContext,
+            body: {
+              id: raId,
+              resource: roleAssignmentResourceBody(
+                spec.scenario,
+                spec.tenantId,
+                user,
+                roleCode,
+                raId
+              )
+            }
+          })
+        );
       }
     }
     const platformContext = {
@@ -5227,22 +5341,42 @@ var seedDemoGraph = async (params) => {
       PLATFORM_SCOPE_TENANT_ID,
       platformRoleCode
     );
-    await createRoleAssignmentOperation({
-      context: platformContext,
-      body: {
-        id: platformRaId,
-        resource: roleAssignmentResourceBody(
-          "platform",
-          PLATFORM_SCOPE_TENANT_ID,
-          user,
-          platformRoleCode,
-          platformRaId
-        )
-      }
-    });
+    await tryRun(
+      failures,
+      "phase-2",
+      `${user.id}@${PLATFORM_SCOPE_TENANT_ID}`,
+      "RoleAssignment",
+      platformRaId,
+      () => createRoleAssignmentOperation({
+        context: platformContext,
+        body: {
+          id: platformRaId,
+          resource: roleAssignmentResourceBody(
+            "platform",
+            PLATFORM_SCOPE_TENANT_ID,
+            user,
+            platformRoleCode,
+            platformRaId
+          )
+        }
+      })
+    );
   }
   for (const group of DEMO_DATA_PLANE_FIXTURES) {
-    await seedWorkspaceDataPlane(baseContext, group);
+    try {
+      await seedWorkspaceDataPlane(baseContext, group, failures);
+    } catch (err) {
+      failures.push({
+        phase: "phase-3",
+        scope: `${group.tenantId}/${group.workspaceId}`,
+        resourceType: "Workspace",
+        resourceId: group.workspaceId,
+        error: err
+      });
+    }
+  }
+  if (failures.length > 0) {
+    throw aggregateFailureError(failures);
   }
 };
 var runSeedDemoData = async (event, deps, devUsers) => {
@@ -5281,10 +5415,66 @@ var runSeedDemoData = async (event, deps, devUsers) => {
     throw err;
   }
 };
-var devPasswordForEmail = (email) => {
-  const digest = (0, import_node_crypto.createHash)("sha256").update(email).digest();
-  const base64url = digest.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
-  return `Dev-${base64url.slice(0, 20)}!1`;
+var SEED_USER_PASSWORD_PARAMETER_PREFIX = "/openhi/seed/users/";
+var SSM_PATH_SEGMENT = /^[A-Za-z0-9_.-]+$/;
+var emailToSsmPath = (email) => {
+  if (typeof email !== "string" || email.length === 0) {
+    throw new Error(
+      `emailToSsmPath: email must be a non-empty string (received "${String(email)}").`
+    );
+  }
+  const atIdx = email.indexOf("@");
+  if (atIdx === -1 || atIdx !== email.lastIndexOf("@")) {
+    throw new Error(
+      `emailToSsmPath: email "${email}" must contain exactly one "@" character.`
+    );
+  }
+  const localPart = email.slice(0, atIdx);
+  const domainPart = email.slice(atIdx + 1);
+  if (localPart.length === 0 || domainPart.length === 0) {
+    throw new Error(
+      `emailToSsmPath: email "${email}" must have a non-empty local-part and domain.`
+    );
+  }
+  if (!SSM_PATH_SEGMENT.test(localPart) || !SSM_PATH_SEGMENT.test(domainPart)) {
+    throw new Error(
+      `emailToSsmPath: email "${email}" contains characters that would produce an invalid SSM parameter path (only A-Z, a-z, 0-9, '.', '-', and '_' are allowed).`
+    );
+  }
+  return `${SEED_USER_PASSWORD_PARAMETER_PREFIX}${localPart}_at_${domainPart}/password`;
+};
+var cachedSsmClient;
+var getSsmClient = () => {
+  if (!cachedSsmClient) {
+    cachedSsmClient = new import_client_ssm.SSMClient({});
+  }
+  return cachedSsmClient;
+};
+var __resetSsmClientForTests = () => {
+  cachedSsmClient = void 0;
+};
+var fetchSeedUserPassword = async (email) => {
+  const path = emailToSsmPath(email);
+  const client = getSsmClient();
+  try {
+    const result = await client.send(
+      new import_client_ssm.GetParameterCommand({ Name: path, WithDecryption: true })
+    );
+    const value = result.Parameter?.Value;
+    if (typeof value !== "string" || value.length === 0) {
+      throw new Error(
+        `fetchSeedUserPassword: SSM parameter "${path}" returned an empty value.`
+      );
+    }
+    return value;
+  } catch (err) {
+    if (err instanceof import_client_ssm.ParameterNotFound) {
+      throw new Error(
+        `fetchSeedUserPassword: SSM parameter "${path}" not found. Provision a SecureString at "${path}" with the dev user's password before re-running seed-demo-data.`
+      );
+    }
+    throw err;
+  }
 };
 var productionCognitoProvisioner = () => {
   const client = new import_client_cognito_identity_provider.CognitoIdentityProviderClient({});
@@ -5302,8 +5492,19 @@ var productionCognitoProvisioner = () => {
     }
     return void 0;
   };
+  const setPassword = async (email, password) => {
+    await client.send(
+      new import_client_cognito_identity_provider.AdminSetUserPasswordCommand({
+        UserPoolId: userPoolId,
+        Username: email,
+        Password: password,
+        Permanent: true
+      })
+    );
+  };
   return {
     ensureUser: async (email) => {
+      const password = await fetchSeedUserPassword(email);
       try {
         const created = await client.send(
           new import_client_cognito_identity_provider.AdminCreateUserCommand({
@@ -5316,14 +5517,7 @@ var productionCognitoProvisioner = () => {
             ]
           })
         );
-        await client.send(
-          new import_client_cognito_identity_provider.AdminSetUserPasswordCommand({
-            UserPoolId: userPoolId,
-            Username: email,
-            Password: devPasswordForEmail(email),
-            Permanent: true
-          })
-        );
+        await setPassword(email, password);
         const sub = subFromAttributes(created.User?.Attributes);
         if (!sub) {
           throw new Error(
@@ -5333,6 +5527,7 @@ var productionCognitoProvisioner = () => {
         return sub;
       } catch (err) {
         if (err instanceof import_client_cognito_identity_provider.UsernameExistsException) {
+          await setPassword(email, password);
           const got = await client.send(
             new import_client_cognito_identity_provider.AdminGetUserCommand({
               UserPoolId: userPoolId,
@@ -5366,7 +5561,10 @@ var handler = async (event) => runSeedDemoData(event, productionDependencies(),
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   SEED_DEMO_DATA_USER_POOL_ID_ENV_VAR,
-  devPasswordForEmail,
+  SEED_USER_PASSWORD_PARAMETER_PREFIX,
+  __resetSsmClientForTests,
+  emailToSsmPath,
+  fetchSeedUserPassword,
   handler,
   productionCognitoProvisioner,
   runSeedDemoData,