@phila/cli 0.0.17 → 0.0.19
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/commands/init.d.ts.map +1 -1
- package/dist/commands/init.js +43 -17
- package/dist/commands/init.js.map +1 -1
- package/dist/templates/lambda-api-nodejs/README.md.tmpl +52 -4
- package/dist/templates/lambda-api-nodejs/apps/__lambdaName__/package.json +3 -2
- package/dist/templates/lambda-api-nodejs/cdk/app.ts.tmpl +1 -1
- package/dist/templates/lambda-dynamo-api/README.md.tmpl +52 -4
- package/dist/templates/lambda-dynamo-api/apps/__lambdaName__/package.json +3 -2
- package/dist/templates/lambda-dynamo-api/cdk/app.ts.tmpl +1 -1
- package/dist/templates/lambda-postgres-api/README.md.tmpl +54 -6
- package/dist/templates/lambda-postgres-api/apps/__lambdaName__/package.json +3 -2
- package/dist/templates/lambda-postgres-api/cdk/app.ts.tmpl +1 -1
- package/dist/templates/webapp-ecs-dotnet/cdk/package.json.tmpl +23 -0
- package/dist/templates/webapp-ecs-node/cdk/package.json.tmpl +23 -0
- package/dist/templates/webapp-ecs-postgres-dotnet/cdk/package.json.tmpl +23 -0
- package/dist/templates/webapp-ecs-postgres-node/cdk/package.json.tmpl +23 -0
- package/dist/templates/webapp-lambda-dotnet/README.md.tmpl +28 -5
- package/dist/templates/webapp-lambda-dotnet/cdk/package.json.tmpl +23 -0
- package/dist/templates/webapp-lambda-dynamo-dotnet/README.md.tmpl +28 -5
- package/dist/templates/webapp-lambda-dynamo-dotnet/cdk/package.json.tmpl +23 -0
- package/dist/templates/webapp-lambda-dynamo-node/README.md.tmpl +28 -5
- package/dist/templates/webapp-lambda-dynamo-node/apps/api/package.json +3 -2
- package/dist/templates/webapp-lambda-dynamo-node/cdk/app.ts.tmpl +1 -1
- package/dist/templates/webapp-lambda-dynamo-node/cdk/package.json.tmpl +23 -0
- package/dist/templates/webapp-lambda-node/README.md.tmpl +28 -5
- package/dist/templates/webapp-lambda-node/apps/api/package.json +3 -2
- package/dist/templates/webapp-lambda-node/cdk/app.ts.tmpl +1 -1
- package/dist/templates/webapp-lambda-node/cdk/package.json.tmpl +23 -0
- package/dist/templates/webapp-lambda-postgres-dotnet/README.md.tmpl +29 -6
- package/dist/templates/webapp-lambda-postgres-dotnet/cdk/package.json.tmpl +23 -0
- package/dist/templates/webapp-lambda-postgres-node/README.md.tmpl +28 -5
- package/dist/templates/webapp-lambda-postgres-node/apps/api/package.json +3 -2
- package/dist/templates/webapp-lambda-postgres-node/cdk/app.ts.tmpl +1 -1
- package/dist/templates/webapp-lambda-postgres-node/cdk/package.json.tmpl +23 -0
- package/package.json +2 -2
- package/dist/templates/_shared/nuxt-frontend/app.vue +0 -3
- package/dist/templates/_shared/nuxt-frontend/nuxt.config.ts +0 -25
- package/dist/templates/_shared/nuxt-frontend/package.json.tmpl +0 -19
- package/dist/templates/_shared/nuxt-frontend/pages/index.vue +0 -6
- package/dist/templates/_shared/nuxt-frontend/tsconfig.json +0 -3
- package/dist/templates/_shared/webapp-frontend/app.vue +0 -3
- package/dist/templates/_shared/webapp-frontend/nuxt.config.ts +0 -25
- package/dist/templates/_shared/webapp-frontend/package.json.tmpl +0 -19
- package/dist/templates/_shared/webapp-frontend/pages/index.vue +0 -7
- package/dist/templates/_shared/webapp-frontend/public/.gitkeep +0 -0
- package/dist/templates/_shared/webapp-frontend/tsconfig.json +0 -3
- package/dist/templates/static-site/frontend/.gitkeep +0 -0
- package/dist/templates/static-site/frontend/build.js +0 -42
- /package/dist/templates/_shared/{nuxt-frontend/public → frontend}/.gitkeep +0 -0
- /package/dist/templates/{static-site → _shared}/frontend/README.md +0 -0
- /package/dist/templates/{static-site → _shared/frontend}/README.md.tmpl +0 -0
- /package/dist/templates/{static-site → _shared}/frontend/package.json +0 -0
- /package/dist/templates/{static-site → _shared/frontend}/package.json.tmpl +0 -0
- /package/dist/templates/{static-site → _shared/frontend}/pnpm-workspace.yaml.tmpl +0 -0
- /package/dist/templates/{static-site → _shared/frontend}/tsconfig.json +0 -0
- /package/dist/templates/_shared/{webapp-cdk-package.json.tmpl → package.json.tmpl} +0 -0
|
@@ -0,0 +1,23 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "cdk",
|
|
3
|
+
"version": "1.0.0",
|
|
4
|
+
"private": true,
|
|
5
|
+
"scripts": {
|
|
6
|
+
"build": "tsc",
|
|
7
|
+
"watch": "tsc -w",
|
|
8
|
+
"cdk": "cdk"
|
|
9
|
+
},
|
|
10
|
+
"dependencies": {
|
|
11
|
+
"@phila/constructs": "^{{constructsVersion}}",
|
|
12
|
+
"aws-cdk-lib": "^2.236.0",
|
|
13
|
+
"cdk-nag": "^2.28.0",
|
|
14
|
+
"constructs": "^10.4.4",
|
|
15
|
+
"source-map-support": "^0.5.21"
|
|
16
|
+
},
|
|
17
|
+
"devDependencies": {
|
|
18
|
+
"@types/node": "^20.10.0",
|
|
19
|
+
"aws-cdk": "^2.1103.0",
|
|
20
|
+
"ts-node": "^10.9.0",
|
|
21
|
+
"typescript": "^5.3.0"
|
|
22
|
+
}
|
|
23
|
+
}
|
|
@@ -112,6 +112,27 @@ This automatically creates a route at `/about`.
|
|
|
112
112
|
|
|
113
113
|
The API uses [.NET Minimal API](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/minimal-apis) with AWS Lambda hosting.
|
|
114
114
|
|
|
115
|
+
### Authentication
|
|
116
|
+
|
|
117
|
+
The API uses path-based authentication:
|
|
118
|
+
|
|
119
|
+
| Path Pattern | Authentication | Use Case |
|
|
120
|
+
|--------------|----------------|----------|
|
|
121
|
+
| `/public/*` | None | Health checks, public data |
|
|
122
|
+
| `/private/key/*` | API Key required | Protected endpoints |
|
|
123
|
+
|
|
124
|
+
**Retrieve the API key:**
|
|
125
|
+
|
|
126
|
+
```bash
|
|
127
|
+
SECRET_ARN=$(aws ssm get-parameter \
|
|
128
|
+
--name "/dev/{{appName}}/api/main/key-secret-arn" \
|
|
129
|
+
--query Parameter.Value --output text)
|
|
130
|
+
API_KEY=$(aws secretsmanager get-secret-value \
|
|
131
|
+
--secret-id "$SECRET_ARN" --query SecretString --output text)
|
|
132
|
+
```
|
|
133
|
+
|
|
134
|
+
The API key is stored in Secrets Manager, encrypted with a dedicated KMS key. Keys are not auto-rotated; coordinate manual rotation with API consumers.
|
|
135
|
+
|
|
115
136
|
### Adding Endpoints
|
|
116
137
|
|
|
117
138
|
Edit `apps/api/Program.cs`:
|
|
@@ -152,15 +173,17 @@ This application creates:
|
|
|
152
173
|
- **Origin Access Control** - Secure S3 access
|
|
153
174
|
|
|
154
175
|
**API:**
|
|
155
|
-
- **API Gateway REST API** - HTTP endpoint
|
|
176
|
+
- **API Gateway REST API** - HTTP endpoint with path-based auth
|
|
177
|
+
- **API Key & Usage Plan** - For protected endpoint authentication
|
|
178
|
+
- **Secrets Manager Secret** - Stores API key (KMS encrypted)
|
|
179
|
+
- **WAF Web ACL** - Protects API from common attacks
|
|
156
180
|
- **Lambda Function** - .NET 8 serverless compute
|
|
157
|
-
- **VPC Security Group** - Network security
|
|
158
181
|
- **IAM Role** - Permissions for Lambda execution
|
|
159
182
|
|
|
160
183
|
**Shared:**
|
|
161
|
-
- **SSM Parameters** - Resource discovery
|
|
162
|
-
- **CloudWatch Logs** - Application logs
|
|
163
|
-
- **KMS Keys** - Encryption
|
|
184
|
+
- **SSM Parameters** - Resource discovery (URLs, API key secret ARN)
|
|
185
|
+
- **CloudWatch Logs** - Application and API access logs
|
|
186
|
+
- **KMS Keys** - Encryption for secrets
|
|
164
187
|
|
|
165
188
|
## URLs
|
|
166
189
|
|
|
@@ -0,0 +1,23 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "cdk",
|
|
3
|
+
"version": "1.0.0",
|
|
4
|
+
"private": true,
|
|
5
|
+
"scripts": {
|
|
6
|
+
"build": "tsc",
|
|
7
|
+
"watch": "tsc -w",
|
|
8
|
+
"cdk": "cdk"
|
|
9
|
+
},
|
|
10
|
+
"dependencies": {
|
|
11
|
+
"@phila/constructs": "^{{constructsVersion}}",
|
|
12
|
+
"aws-cdk-lib": "^2.236.0",
|
|
13
|
+
"cdk-nag": "^2.28.0",
|
|
14
|
+
"constructs": "^10.4.4",
|
|
15
|
+
"source-map-support": "^0.5.21"
|
|
16
|
+
},
|
|
17
|
+
"devDependencies": {
|
|
18
|
+
"@types/node": "^20.10.0",
|
|
19
|
+
"aws-cdk": "^2.1103.0",
|
|
20
|
+
"ts-node": "^10.9.0",
|
|
21
|
+
"typescript": "^5.3.0"
|
|
22
|
+
}
|
|
23
|
+
}
|
|
@@ -112,6 +112,27 @@ This automatically creates a route at `/about`.
|
|
|
112
112
|
|
|
113
113
|
The API uses [.NET Minimal API](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/minimal-apis) with AWS Lambda hosting and DynamoDB.
|
|
114
114
|
|
|
115
|
+
### Authentication
|
|
116
|
+
|
|
117
|
+
The API uses path-based authentication:
|
|
118
|
+
|
|
119
|
+
| Path Pattern | Authentication | Use Case |
|
|
120
|
+
|--------------|----------------|----------|
|
|
121
|
+
| `/public/*` | None | Health checks, public data |
|
|
122
|
+
| `/private/key/*` | API Key required | Protected endpoints |
|
|
123
|
+
|
|
124
|
+
**Retrieve the API key:**
|
|
125
|
+
|
|
126
|
+
```bash
|
|
127
|
+
SECRET_ARN=$(aws ssm get-parameter \
|
|
128
|
+
--name "/dev/{{appName}}/api/main/key-secret-arn" \
|
|
129
|
+
--query Parameter.Value --output text)
|
|
130
|
+
API_KEY=$(aws secretsmanager get-secret-value \
|
|
131
|
+
--secret-id "$SECRET_ARN" --query SecretString --output text)
|
|
132
|
+
```
|
|
133
|
+
|
|
134
|
+
The API key is stored in Secrets Manager, encrypted with a dedicated KMS key. Keys are not auto-rotated; coordinate manual rotation with API consumers.
|
|
135
|
+
|
|
115
136
|
### Adding Endpoints
|
|
116
137
|
|
|
117
138
|
Edit `apps/api/Program.cs`:
|
|
@@ -191,16 +212,18 @@ This application creates:
|
|
|
191
212
|
- **Origin Access Control** - Secure S3 access
|
|
192
213
|
|
|
193
214
|
**API:**
|
|
194
|
-
- **API Gateway REST API** - HTTP endpoint
|
|
215
|
+
- **API Gateway REST API** - HTTP endpoint with path-based auth
|
|
216
|
+
- **API Key & Usage Plan** - For protected endpoint authentication
|
|
217
|
+
- **Secrets Manager Secret** - Stores API key (KMS encrypted)
|
|
218
|
+
- **WAF Web ACL** - Protects API from common attacks
|
|
195
219
|
- **Lambda Function** - .NET 8 serverless compute
|
|
196
220
|
- **DynamoDB Table** - NoSQL database
|
|
197
|
-
- **VPC Security Group** - Network security
|
|
198
221
|
- **IAM Role** - Permissions for Lambda and DynamoDB
|
|
199
222
|
|
|
200
223
|
**Shared:**
|
|
201
|
-
- **SSM Parameters** - Resource discovery
|
|
202
|
-
- **CloudWatch Logs** - Application logs
|
|
203
|
-
- **KMS Keys** - Encryption
|
|
224
|
+
- **SSM Parameters** - Resource discovery (URLs, API key secret ARN)
|
|
225
|
+
- **CloudWatch Logs** - Application and API access logs
|
|
226
|
+
- **KMS Keys** - Encryption for secrets and DynamoDB
|
|
204
227
|
|
|
205
228
|
## URLs
|
|
206
229
|
|
|
@@ -0,0 +1,23 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "cdk",
|
|
3
|
+
"version": "1.0.0",
|
|
4
|
+
"private": true,
|
|
5
|
+
"scripts": {
|
|
6
|
+
"build": "tsc",
|
|
7
|
+
"watch": "tsc -w",
|
|
8
|
+
"cdk": "cdk"
|
|
9
|
+
},
|
|
10
|
+
"dependencies": {
|
|
11
|
+
"@phila/constructs": "^{{constructsVersion}}",
|
|
12
|
+
"aws-cdk-lib": "^2.236.0",
|
|
13
|
+
"cdk-nag": "^2.28.0",
|
|
14
|
+
"constructs": "^10.4.4",
|
|
15
|
+
"source-map-support": "^0.5.21"
|
|
16
|
+
},
|
|
17
|
+
"devDependencies": {
|
|
18
|
+
"@types/node": "^20.10.0",
|
|
19
|
+
"aws-cdk": "^2.1103.0",
|
|
20
|
+
"ts-node": "^10.9.0",
|
|
21
|
+
"typescript": "^5.3.0"
|
|
22
|
+
}
|
|
23
|
+
}
|
|
@@ -110,6 +110,27 @@ This automatically creates a route at `/about`.
|
|
|
110
110
|
|
|
111
111
|
The API uses [@phila/philaroute](https://www.npmjs.com/package/@phila/philaroute) for HTTP routing with DynamoDB for data persistence.
|
|
112
112
|
|
|
113
|
+
### Authentication
|
|
114
|
+
|
|
115
|
+
The API uses path-based authentication:
|
|
116
|
+
|
|
117
|
+
| Path Pattern | Authentication | Use Case |
|
|
118
|
+
|--------------|----------------|----------|
|
|
119
|
+
| `/public/*` | None | Health checks, public data |
|
|
120
|
+
| `/private/key/*` | API Key required | Protected endpoints |
|
|
121
|
+
|
|
122
|
+
**Retrieve the API key:**
|
|
123
|
+
|
|
124
|
+
```bash
|
|
125
|
+
SECRET_ARN=$(aws ssm get-parameter \
|
|
126
|
+
--name "/dev/{{appName}}/api/main/key-secret-arn" \
|
|
127
|
+
--query Parameter.Value --output text)
|
|
128
|
+
API_KEY=$(aws secretsmanager get-secret-value \
|
|
129
|
+
--secret-id "$SECRET_ARN" --query SecretString --output text)
|
|
130
|
+
```
|
|
131
|
+
|
|
132
|
+
The API key is stored in Secrets Manager, encrypted with a dedicated KMS key. Keys are not auto-rotated; coordinate manual rotation with API consumers.
|
|
133
|
+
|
|
113
134
|
### DynamoDB Operations
|
|
114
135
|
|
|
115
136
|
The template includes CRUD operations in `apps/api/index.ts`:
|
|
@@ -157,16 +178,18 @@ This application creates:
|
|
|
157
178
|
- **Origin Access Control** - Secure S3 access
|
|
158
179
|
|
|
159
180
|
**API:**
|
|
160
|
-
- **API Gateway REST API** - HTTP endpoint
|
|
181
|
+
- **API Gateway REST API** - HTTP endpoint with path-based auth
|
|
182
|
+
- **API Key & Usage Plan** - For protected endpoint authentication
|
|
183
|
+
- **Secrets Manager Secret** - Stores API key (KMS encrypted)
|
|
184
|
+
- **WAF Web ACL** - Protects API from common attacks
|
|
161
185
|
- **Lambda Function** - Serverless compute
|
|
162
186
|
- **DynamoDB Table** - NoSQL database with encryption
|
|
163
|
-
- **VPC Security Group** - Network security
|
|
164
187
|
- **IAM Role** - Permissions for Lambda and DynamoDB
|
|
165
188
|
|
|
166
189
|
**Shared:**
|
|
167
|
-
- **SSM Parameters** - Resource discovery
|
|
168
|
-
- **CloudWatch Logs** - Application logs
|
|
169
|
-
- **KMS Keys** - Encryption
|
|
190
|
+
- **SSM Parameters** - Resource discovery (URLs, API key secret ARN)
|
|
191
|
+
- **CloudWatch Logs** - Application and API access logs
|
|
192
|
+
- **KMS Keys** - Encryption for secrets and DynamoDB
|
|
170
193
|
|
|
171
194
|
## URLs
|
|
172
195
|
|
|
@@ -4,8 +4,8 @@
|
|
|
4
4
|
"description": "Lambda API handler with DynamoDB",
|
|
5
5
|
"private": true,
|
|
6
6
|
"scripts": {
|
|
7
|
-
"build": "
|
|
8
|
-
"watch": "
|
|
7
|
+
"build": "esbuild index.ts --bundle --platform=node --target=node22 --outfile=dist/index.js --external:@aws-sdk/*",
|
|
8
|
+
"watch": "esbuild index.ts --bundle --platform=node --target=node22 --outfile=dist/index.js --external:@aws-sdk/* --watch"
|
|
9
9
|
},
|
|
10
10
|
"dependencies": {
|
|
11
11
|
"@phila/philaroute": "^1.0.14",
|
|
@@ -14,6 +14,7 @@
|
|
|
14
14
|
"@types/aws-lambda": "^8.10.0"
|
|
15
15
|
},
|
|
16
16
|
"devDependencies": {
|
|
17
|
+
"esbuild": "^0.24.0",
|
|
17
18
|
"typescript": "^5.3.0"
|
|
18
19
|
}
|
|
19
20
|
}
|
|
@@ -48,7 +48,7 @@ new LambdaDynamoApi(stack as any, '{{appName}}Api', {
|
|
|
48
48
|
apiId: 'api',
|
|
49
49
|
runtime: 'nodejs22',
|
|
50
50
|
handler: 'index.handler',
|
|
51
|
-
codeDir: '../apps/api',
|
|
51
|
+
codeDir: '../apps/api/dist',
|
|
52
52
|
// DynamoDB table configuration
|
|
53
53
|
partitionKey: { name: 'pk', type: 'S' },
|
|
54
54
|
// Uncomment for composite key (partition + sort):
|
|
@@ -0,0 +1,23 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "cdk",
|
|
3
|
+
"version": "1.0.0",
|
|
4
|
+
"private": true,
|
|
5
|
+
"scripts": {
|
|
6
|
+
"build": "tsc",
|
|
7
|
+
"watch": "tsc -w",
|
|
8
|
+
"cdk": "cdk"
|
|
9
|
+
},
|
|
10
|
+
"dependencies": {
|
|
11
|
+
"@phila/constructs": "^{{constructsVersion}}",
|
|
12
|
+
"aws-cdk-lib": "^2.236.0",
|
|
13
|
+
"cdk-nag": "^2.28.0",
|
|
14
|
+
"constructs": "^10.4.4",
|
|
15
|
+
"source-map-support": "^0.5.21"
|
|
16
|
+
},
|
|
17
|
+
"devDependencies": {
|
|
18
|
+
"@types/node": "^20.10.0",
|
|
19
|
+
"aws-cdk": "^2.1103.0",
|
|
20
|
+
"ts-node": "^10.9.0",
|
|
21
|
+
"typescript": "^5.3.0"
|
|
22
|
+
}
|
|
23
|
+
}
|
|
@@ -110,6 +110,27 @@ This automatically creates a route at `/about`.
|
|
|
110
110
|
|
|
111
111
|
The API uses [@phila/philaroute](https://www.npmjs.com/package/@phila/philaroute) for HTTP routing.
|
|
112
112
|
|
|
113
|
+
### Authentication
|
|
114
|
+
|
|
115
|
+
The API uses path-based authentication:
|
|
116
|
+
|
|
117
|
+
| Path Pattern | Authentication | Use Case |
|
|
118
|
+
|--------------|----------------|----------|
|
|
119
|
+
| `/public/*` | None | Health checks, public data |
|
|
120
|
+
| `/private/key/*` | API Key required | Protected endpoints |
|
|
121
|
+
|
|
122
|
+
**Retrieve the API key:**
|
|
123
|
+
|
|
124
|
+
```bash
|
|
125
|
+
SECRET_ARN=$(aws ssm get-parameter \
|
|
126
|
+
--name "/dev/{{appName}}/api/main/key-secret-arn" \
|
|
127
|
+
--query Parameter.Value --output text)
|
|
128
|
+
API_KEY=$(aws secretsmanager get-secret-value \
|
|
129
|
+
--secret-id "$SECRET_ARN" --query SecretString --output text)
|
|
130
|
+
```
|
|
131
|
+
|
|
132
|
+
The API key is stored in Secrets Manager, encrypted with a dedicated KMS key. Keys are not auto-rotated; coordinate manual rotation with API consumers.
|
|
133
|
+
|
|
113
134
|
### Adding Endpoints
|
|
114
135
|
|
|
115
136
|
Edit `apps/api/index.ts`:
|
|
@@ -143,15 +164,17 @@ This application creates:
|
|
|
143
164
|
- **Origin Access Control** - Secure S3 access
|
|
144
165
|
|
|
145
166
|
**API:**
|
|
146
|
-
- **API Gateway REST API** - HTTP endpoint
|
|
167
|
+
- **API Gateway REST API** - HTTP endpoint with path-based auth
|
|
168
|
+
- **API Key & Usage Plan** - For protected endpoint authentication
|
|
169
|
+
- **Secrets Manager Secret** - Stores API key (KMS encrypted)
|
|
170
|
+
- **WAF Web ACL** - Protects API from common attacks
|
|
147
171
|
- **Lambda Function** - Serverless compute
|
|
148
|
-
- **VPC Security Group** - Network security
|
|
149
172
|
- **IAM Role** - Permissions for Lambda execution
|
|
150
173
|
|
|
151
174
|
**Shared:**
|
|
152
|
-
- **SSM Parameters** - Resource discovery
|
|
153
|
-
- **CloudWatch Logs** - Application logs
|
|
154
|
-
- **KMS Keys** - Encryption
|
|
175
|
+
- **SSM Parameters** - Resource discovery (URLs, API key secret ARN)
|
|
176
|
+
- **CloudWatch Logs** - Application and API access logs
|
|
177
|
+
- **KMS Keys** - Encryption for secrets
|
|
155
178
|
|
|
156
179
|
## URLs
|
|
157
180
|
|
|
@@ -4,14 +4,15 @@
|
|
|
4
4
|
"description": "Lambda API handler",
|
|
5
5
|
"private": true,
|
|
6
6
|
"scripts": {
|
|
7
|
-
"build": "
|
|
8
|
-
"watch": "
|
|
7
|
+
"build": "esbuild index.ts --bundle --platform=node --target=node22 --outfile=dist/index.js",
|
|
8
|
+
"watch": "esbuild index.ts --bundle --platform=node --target=node22 --outfile=dist/index.js --watch"
|
|
9
9
|
},
|
|
10
10
|
"dependencies": {
|
|
11
11
|
"@phila/philaroute": "^1.0.14",
|
|
12
12
|
"@types/aws-lambda": "^8.10.0"
|
|
13
13
|
},
|
|
14
14
|
"devDependencies": {
|
|
15
|
+
"esbuild": "^0.24.0",
|
|
15
16
|
"typescript": "^5.3.0"
|
|
16
17
|
}
|
|
17
18
|
}
|
|
@@ -0,0 +1,23 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "cdk",
|
|
3
|
+
"version": "1.0.0",
|
|
4
|
+
"private": true,
|
|
5
|
+
"scripts": {
|
|
6
|
+
"build": "tsc",
|
|
7
|
+
"watch": "tsc -w",
|
|
8
|
+
"cdk": "cdk"
|
|
9
|
+
},
|
|
10
|
+
"dependencies": {
|
|
11
|
+
"@phila/constructs": "^{{constructsVersion}}",
|
|
12
|
+
"aws-cdk-lib": "^2.236.0",
|
|
13
|
+
"cdk-nag": "^2.28.0",
|
|
14
|
+
"constructs": "^10.4.4",
|
|
15
|
+
"source-map-support": "^0.5.21"
|
|
16
|
+
},
|
|
17
|
+
"devDependencies": {
|
|
18
|
+
"@types/node": "^20.10.0",
|
|
19
|
+
"aws-cdk": "^2.1103.0",
|
|
20
|
+
"ts-node": "^10.9.0",
|
|
21
|
+
"typescript": "^5.3.0"
|
|
22
|
+
}
|
|
23
|
+
}
|
|
@@ -112,6 +112,27 @@ This automatically creates a route at `/about`.
|
|
|
112
112
|
|
|
113
113
|
The API uses [.NET Minimal API](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/minimal-apis) with AWS Lambda hosting and PostgreSQL via Npgsql.
|
|
114
114
|
|
|
115
|
+
### Authentication
|
|
116
|
+
|
|
117
|
+
The API uses path-based authentication:
|
|
118
|
+
|
|
119
|
+
| Path Pattern | Authentication | Use Case |
|
|
120
|
+
|--------------|----------------|----------|
|
|
121
|
+
| `/public/*` | None | Health checks, public data |
|
|
122
|
+
| `/private/key/*` | API Key required | Protected endpoints |
|
|
123
|
+
|
|
124
|
+
**Retrieve the API key:**
|
|
125
|
+
|
|
126
|
+
```bash
|
|
127
|
+
SECRET_ARN=$(aws ssm get-parameter \
|
|
128
|
+
--name "/dev/{{appName}}/api/main/key-secret-arn" \
|
|
129
|
+
--query Parameter.Value --output text)
|
|
130
|
+
API_KEY=$(aws secretsmanager get-secret-value \
|
|
131
|
+
--secret-id "$SECRET_ARN" --query SecretString --output text)
|
|
132
|
+
```
|
|
133
|
+
|
|
134
|
+
The API key is stored in Secrets Manager, encrypted with a dedicated KMS key. Keys are not auto-rotated; coordinate manual rotation with API consumers.
|
|
135
|
+
|
|
115
136
|
### Adding Endpoints
|
|
116
137
|
|
|
117
138
|
Edit `apps/api/Program.cs`:
|
|
@@ -207,17 +228,19 @@ This application creates:
|
|
|
207
228
|
- **Origin Access Control** - Secure S3 access
|
|
208
229
|
|
|
209
230
|
**API:**
|
|
210
|
-
- **API Gateway REST API** - HTTP endpoint
|
|
231
|
+
- **API Gateway REST API** - HTTP endpoint with path-based auth
|
|
232
|
+
- **API Key & Usage Plan** - For protected endpoint authentication
|
|
233
|
+
- **Secrets Manager Secrets** - API key and database credentials (KMS encrypted)
|
|
234
|
+
- **WAF Web ACL** - Protects API from common attacks
|
|
211
235
|
- **Lambda Function** - .NET 8 serverless compute
|
|
212
236
|
- **RDS PostgreSQL** - Relational database
|
|
213
|
-
- **Secrets Manager** - Database credentials
|
|
214
237
|
- **VPC Security Group** - Network security
|
|
215
|
-
- **IAM Role** - Permissions for Lambda and database
|
|
238
|
+
- **IAM Role** - Permissions for Lambda, Secrets Manager, and database
|
|
216
239
|
|
|
217
240
|
**Shared:**
|
|
218
|
-
- **SSM Parameters** - Resource discovery
|
|
219
|
-
- **CloudWatch Logs** - Application logs
|
|
220
|
-
- **KMS Keys** - Encryption
|
|
241
|
+
- **SSM Parameters** - Resource discovery (URLs, API key secret ARN)
|
|
242
|
+
- **CloudWatch Logs** - Application and API access logs
|
|
243
|
+
- **KMS Keys** - Encryption for secrets
|
|
221
244
|
|
|
222
245
|
## URLs
|
|
223
246
|
|
|
@@ -0,0 +1,23 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "cdk",
|
|
3
|
+
"version": "1.0.0",
|
|
4
|
+
"private": true,
|
|
5
|
+
"scripts": {
|
|
6
|
+
"build": "tsc",
|
|
7
|
+
"watch": "tsc -w",
|
|
8
|
+
"cdk": "cdk"
|
|
9
|
+
},
|
|
10
|
+
"dependencies": {
|
|
11
|
+
"@phila/constructs": "^{{constructsVersion}}",
|
|
12
|
+
"aws-cdk-lib": "^2.236.0",
|
|
13
|
+
"cdk-nag": "^2.28.0",
|
|
14
|
+
"constructs": "^10.4.4",
|
|
15
|
+
"source-map-support": "^0.5.21"
|
|
16
|
+
},
|
|
17
|
+
"devDependencies": {
|
|
18
|
+
"@types/node": "^20.10.0",
|
|
19
|
+
"aws-cdk": "^2.1103.0",
|
|
20
|
+
"ts-node": "^10.9.0",
|
|
21
|
+
"typescript": "^5.3.0"
|
|
22
|
+
}
|
|
23
|
+
}
|
|
@@ -110,6 +110,27 @@ This automatically creates a route at `/about`.
|
|
|
110
110
|
|
|
111
111
|
The API uses [@phila/philaroute](https://www.npmjs.com/package/@phila/philaroute) for HTTP routing with PostgreSQL for data persistence.
|
|
112
112
|
|
|
113
|
+
### Authentication
|
|
114
|
+
|
|
115
|
+
The API uses path-based authentication:
|
|
116
|
+
|
|
117
|
+
| Path Pattern | Authentication | Use Case |
|
|
118
|
+
|--------------|----------------|----------|
|
|
119
|
+
| `/public/*` | None | Health checks, public data |
|
|
120
|
+
| `/private/key/*` | API Key required | Protected endpoints |
|
|
121
|
+
|
|
122
|
+
**Retrieve the API key:**
|
|
123
|
+
|
|
124
|
+
```bash
|
|
125
|
+
SECRET_ARN=$(aws ssm get-parameter \
|
|
126
|
+
--name "/dev/{{appName}}/api/main/key-secret-arn" \
|
|
127
|
+
--query Parameter.Value --output text)
|
|
128
|
+
API_KEY=$(aws secretsmanager get-secret-value \
|
|
129
|
+
--secret-id "$SECRET_ARN" --query SecretString --output text)
|
|
130
|
+
```
|
|
131
|
+
|
|
132
|
+
The API key is stored in Secrets Manager, encrypted with a dedicated KMS key. Keys are not auto-rotated; coordinate manual rotation with API consumers.
|
|
133
|
+
|
|
113
134
|
### Database Setup
|
|
114
135
|
|
|
115
136
|
1. Install a PostgreSQL client:
|
|
@@ -157,17 +178,19 @@ This application creates:
|
|
|
157
178
|
- **Origin Access Control** - Secure S3 access
|
|
158
179
|
|
|
159
180
|
**API:**
|
|
160
|
-
- **API Gateway REST API** - HTTP endpoint
|
|
181
|
+
- **API Gateway REST API** - HTTP endpoint with path-based auth
|
|
182
|
+
- **API Key & Usage Plan** - For protected endpoint authentication
|
|
183
|
+
- **Secrets Manager Secrets** - API key and database credentials (KMS encrypted)
|
|
184
|
+
- **WAF Web ACL** - Protects API from common attacks
|
|
161
185
|
- **Lambda Function** - Serverless compute in VPC
|
|
162
186
|
- **RDS PostgreSQL** - Managed relational database
|
|
163
|
-
- **Secrets Manager Secret** - Database credentials
|
|
164
187
|
- **VPC Security Groups** - Network security for Lambda and RDS
|
|
165
188
|
- **IAM Role** - Permissions for Lambda and Secrets Manager
|
|
166
189
|
|
|
167
190
|
**Shared:**
|
|
168
|
-
- **SSM Parameters** - Resource discovery
|
|
169
|
-
- **CloudWatch Logs** - Application logs
|
|
170
|
-
- **KMS Keys** - Encryption
|
|
191
|
+
- **SSM Parameters** - Resource discovery (URLs, API key secret ARN)
|
|
192
|
+
- **CloudWatch Logs** - Application and API access logs
|
|
193
|
+
- **KMS Keys** - Encryption for secrets
|
|
171
194
|
|
|
172
195
|
## URLs
|
|
173
196
|
|
|
@@ -4,8 +4,8 @@
|
|
|
4
4
|
"description": "Lambda API handler with PostgreSQL database access",
|
|
5
5
|
"private": true,
|
|
6
6
|
"scripts": {
|
|
7
|
-
"build": "
|
|
8
|
-
"watch": "
|
|
7
|
+
"build": "esbuild index.ts --bundle --platform=node --target=node22 --outfile=dist/index.js",
|
|
8
|
+
"watch": "esbuild index.ts --bundle --platform=node --target=node22 --outfile=dist/index.js --watch"
|
|
9
9
|
},
|
|
10
10
|
"dependencies": {
|
|
11
11
|
"@phila/philaroute": "^1.0.14",
|
|
@@ -13,6 +13,7 @@
|
|
|
13
13
|
"@types/aws-lambda": "^8.10.0"
|
|
14
14
|
},
|
|
15
15
|
"devDependencies": {
|
|
16
|
+
"esbuild": "^0.24.0",
|
|
16
17
|
"typescript": "^5.3.0"
|
|
17
18
|
}
|
|
18
19
|
}
|
|
@@ -48,7 +48,7 @@ new LambdaPostgresApi(stack as any, '{{appName}}Api', {
|
|
|
48
48
|
apiId: 'api',
|
|
49
49
|
runtime: 'nodejs22',
|
|
50
50
|
handler: 'index.handler',
|
|
51
|
-
codeDir: '../apps/api',
|
|
51
|
+
codeDir: '../apps/api/dist',
|
|
52
52
|
// Uncomment for serverless Aurora instead of provisioned RDS:
|
|
53
53
|
// serverless: true,
|
|
54
54
|
});
|
|
@@ -0,0 +1,23 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "cdk",
|
|
3
|
+
"version": "1.0.0",
|
|
4
|
+
"private": true,
|
|
5
|
+
"scripts": {
|
|
6
|
+
"build": "tsc",
|
|
7
|
+
"watch": "tsc -w",
|
|
8
|
+
"cdk": "cdk"
|
|
9
|
+
},
|
|
10
|
+
"dependencies": {
|
|
11
|
+
"@phila/constructs": "^{{constructsVersion}}",
|
|
12
|
+
"aws-cdk-lib": "^2.236.0",
|
|
13
|
+
"cdk-nag": "^2.28.0",
|
|
14
|
+
"constructs": "^10.4.4",
|
|
15
|
+
"source-map-support": "^0.5.21"
|
|
16
|
+
},
|
|
17
|
+
"devDependencies": {
|
|
18
|
+
"@types/node": "^20.10.0",
|
|
19
|
+
"aws-cdk": "^2.1103.0",
|
|
20
|
+
"ts-node": "^10.9.0",
|
|
21
|
+
"typescript": "^5.3.0"
|
|
22
|
+
}
|
|
23
|
+
}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@phila/cli",
|
|
3
|
-
"version": "0.0.
|
|
3
|
+
"version": "0.0.19",
|
|
4
4
|
"description": "CLI tool for City of Philadelphia AWS infrastructure",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"bin": {
|
|
@@ -24,7 +24,7 @@
|
|
|
24
24
|
"commander": "^11.0.0",
|
|
25
25
|
"fs-extra": "^11.1.0",
|
|
26
26
|
"inquirer": "^8.2.5",
|
|
27
|
-
"@phila/constructs": "0.0.
|
|
27
|
+
"@phila/constructs": "0.0.12",
|
|
28
28
|
"@phila/db-postgres": "0.0.6"
|
|
29
29
|
},
|
|
30
30
|
"devDependencies": {
|
|
@@ -1,25 +0,0 @@
|
|
|
1
|
-
// ABOUTME: Nuxt 3 configuration for Static Site Generation
|
|
2
|
-
// ABOUTME: Outputs static files to dist/ for S3/CloudFront deployment
|
|
3
|
-
|
|
4
|
-
export default defineNuxtConfig({
|
|
5
|
-
// Enable SSR for static generation
|
|
6
|
-
ssr: true,
|
|
7
|
-
|
|
8
|
-
// Static site generation preset
|
|
9
|
-
nitro: {
|
|
10
|
-
preset: 'static',
|
|
11
|
-
output: {
|
|
12
|
-
publicDir: 'dist',
|
|
13
|
-
},
|
|
14
|
-
},
|
|
15
|
-
|
|
16
|
-
// TypeScript support
|
|
17
|
-
typescript: {
|
|
18
|
-
strict: true,
|
|
19
|
-
},
|
|
20
|
-
|
|
21
|
-
// Disable telemetry
|
|
22
|
-
telemetry: false,
|
|
23
|
-
|
|
24
|
-
compatibilityDate: '2025-01-01',
|
|
25
|
-
});
|
|
@@ -1,19 +0,0 @@
|
|
|
1
|
-
{
|
|
2
|
-
"name": "{{appName}}-frontend",
|
|
3
|
-
"version": "0.0.1",
|
|
4
|
-
"private": true,
|
|
5
|
-
"type": "module",
|
|
6
|
-
"scripts": {
|
|
7
|
-
"build": "nuxt generate",
|
|
8
|
-
"dev": "nuxt dev",
|
|
9
|
-
"preview": "nuxt preview",
|
|
10
|
-
"postinstall": "nuxt prepare"
|
|
11
|
-
},
|
|
12
|
-
"dependencies": {
|
|
13
|
-
"vue": "^3.5.13"
|
|
14
|
-
},
|
|
15
|
-
"devDependencies": {
|
|
16
|
-
"nuxt": "^3.14.0",
|
|
17
|
-
"typescript": "^5.7.0"
|
|
18
|
-
}
|
|
19
|
-
}
|