@openhi/constructs 0.0.151 → 0.0.153

package/lib/index.mjs

@@ -18,7 +18,6 @@ import {
   OPENHI_RESOURCE_URN_SYSTEM,
   PLACEHOLDER_TENANT_ID,
   PLACEHOLDER_WORKSPACE_ID,
-  PLATFORM_SCOPE_TENANT_ID,
   SEED_DEMO_DATA_CONSUMER_NAME,
   SEED_DEMO_DATA_USER_POOL_ID_ENV_VAR,
   demoMembershipId,
@@ -27,7 +26,7 @@ import {
   demoScenarioIdentifier,
   import_workflows,
   openhiResourceIdentifier
-} from "./chunk-WGA43MMY.mjs";
+} from "./chunk-ZVDVKCNC.mjs";
 import {
   OWNING_DELETE_CASCADE_CONSUMER_NAME,
   OWNING_DELETE_CASCADE_DEFAULT_CONCURRENCY,
@@ -61,7 +60,9 @@ import {
 import {
   require_lib
 } from "./chunk-ZM4GDHHC.mjs";
-import "./chunk-AWYZJFPL.mjs";
+import {
+  PLATFORM_SCOPE_TENANT_ID
+} from "./chunk-CFJDATDK.mjs";
 import "./chunk-HQ67J7BP.mjs";
 import "./chunk-QJDHVMKT.mjs";
 import "./chunk-MVQWAIMC.mjs";
@@ -2313,7 +2314,7 @@ var SeedDemoDataLambda = class extends Construct13 {
     this.lambda.addToRolePolicy(
       new PolicyStatement3({
         effect: Effect3.ALLOW,
-        actions: ["dynamodb:PutItem", "dynamodb:UpdateItem"],
+        actions: ["dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:Query"],
         resources: [props.dataStoreTable.tableArn]
       })
     );
@@ -2334,6 +2335,32 @@ var SeedDemoDataLambda = class extends Construct13 {
         ]
       })
     );
+    this.lambda.addToRolePolicy(
+      new PolicyStatement3({
+        effect: Effect3.ALLOW,
+        actions: ["ssm:GetParameter"],
+        resources: [
+          Stack5.of(this).formatArn({
+            service: "ssm",
+            resource: "parameter",
+            resourceName: "openhi/seed/users/*/password"
+          })
+        ]
+      })
+    );
+    this.lambda.addToRolePolicy(
+      new PolicyStatement3({
+        effect: Effect3.ALLOW,
+        actions: ["kms:Decrypt"],
+        resources: [
+          Stack5.of(this).formatArn({
+            service: "kms",
+            resource: "alias",
+            resourceName: "aws/ssm"
+          })
+        ]
+      })
+    );
     this.rule = new Rule2(this, "rule", {
       eventBus: props.controlEventBus,
       eventPattern: {
@@ -2569,6 +2596,7 @@ var OpenHiDataService = _OpenHiDataService;
 
 // src/services/open-hi-website-service.ts
 var import_config6 = __toESM(require_lib2());
+import { CfnOutput } from "aws-cdk-lib";
 import { Bucket as Bucket3 } from "aws-cdk-lib/aws-s3";
 
 // src/services/open-hi-rest-api-service.ts
@@ -3157,6 +3185,7 @@ var _OpenHiWebsiteService = class _OpenHiWebsiteService extends OpenHiService {
     const isReleaseBranch = this.branchName === this.defaultReleaseBranch;
     const hostedZone = this.createHostedZone();
     this.fullDomain = this.computeFullDomain(hostedZone);
+    this.createAdminConsoleEndpointOutput();
     const shouldCreateHostingInfra = props.createHostingInfrastructure ?? isReleaseBranch;
     if (shouldCreateHostingInfra) {
       const certificate = this.createCertificate();
@@ -3296,6 +3325,25 @@ var _OpenHiWebsiteService = class _OpenHiWebsiteService extends OpenHiService {
       description: "Full website domain (e.g. www.example.com)"
     });
   }
+  /**
+   * Adds a CloudFormation `AdminConsoleEndpoint` output exposing the
+   * admin-console invocation URL (`https://<fullDomain>`) on every
+   * deploy of this stack — release-branch and per-PR alike. The
+   * configulator `aws-deploy-workflow` filters CFN outputs by the
+   * `Endpoint$` logical-id suffix to surface them in the GitHub
+   * Actions run summary and sticky PR comment, so the logical id is
+   * pinned via {@link CfnOutput.overrideLogicalId} to keep the
+   * literal key stable across synths.
+   */
+  createAdminConsoleEndpointOutput() {
+    const output = new CfnOutput(this, "admin-console-endpoint-output", {
+      value: `https://${this.fullDomain}`,
+      description: "Admin console endpoint for this deploy (https://<fullDomain>). Surfaced by the deploy workflow's sticky PR comment and job summary."
+    });
+    output.overrideLogicalId(
+      _OpenHiWebsiteService.ADMIN_CONSOLE_ENDPOINT_OUTPUT_NAME
+    );
+  }
   /**
    * Creates the StaticContent uploader. Receives the resolved static-hosting
    * bucket from the constructor — on the release-branch deploy this is the
@@ -3362,6 +3410,15 @@ _OpenHiWebsiteService.SERVICE_TYPE = "website";
  * `www-<childZonePrefix>.<zone>`.
  */
 _OpenHiWebsiteService.DEFAULT_DOMAIN_PREFIX = "www";
+/**
+ * CloudFormation logical key for the admin-console endpoint `CfnOutput`.
+ * The configulator deploy workflow filters outputs whose logical id
+ * matches the `Endpoint$` regex to surface them in the GitHub Actions
+ * run summary and sticky PR comment, so the suffix must be `Endpoint`.
+ * The logical id is pinned via {@link CfnOutput.overrideLogicalId} so
+ * it does not pick up a synth-time hash suffix.
+ */
+_OpenHiWebsiteService.ADMIN_CONSOLE_ENDPOINT_OUTPUT_NAME = "AdminConsoleEndpoint";
 var OpenHiWebsiteService = _OpenHiWebsiteService;
 
 // src/workflows/control-plane/user-onboarding/provision-default-workspace-lambda.ts