@phila/cli 0.0.17 → 0.0.19

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (56) hide show
  1. package/dist/commands/init.d.ts.map +1 -1
  2. package/dist/commands/init.js +43 -17
  3. package/dist/commands/init.js.map +1 -1
  4. package/dist/templates/lambda-api-nodejs/README.md.tmpl +52 -4
  5. package/dist/templates/lambda-api-nodejs/apps/__lambdaName__/package.json +3 -2
  6. package/dist/templates/lambda-api-nodejs/cdk/app.ts.tmpl +1 -1
  7. package/dist/templates/lambda-dynamo-api/README.md.tmpl +52 -4
  8. package/dist/templates/lambda-dynamo-api/apps/__lambdaName__/package.json +3 -2
  9. package/dist/templates/lambda-dynamo-api/cdk/app.ts.tmpl +1 -1
  10. package/dist/templates/lambda-postgres-api/README.md.tmpl +54 -6
  11. package/dist/templates/lambda-postgres-api/apps/__lambdaName__/package.json +3 -2
  12. package/dist/templates/lambda-postgres-api/cdk/app.ts.tmpl +1 -1
  13. package/dist/templates/webapp-ecs-dotnet/cdk/package.json.tmpl +23 -0
  14. package/dist/templates/webapp-ecs-node/cdk/package.json.tmpl +23 -0
  15. package/dist/templates/webapp-ecs-postgres-dotnet/cdk/package.json.tmpl +23 -0
  16. package/dist/templates/webapp-ecs-postgres-node/cdk/package.json.tmpl +23 -0
  17. package/dist/templates/webapp-lambda-dotnet/README.md.tmpl +28 -5
  18. package/dist/templates/webapp-lambda-dotnet/cdk/package.json.tmpl +23 -0
  19. package/dist/templates/webapp-lambda-dynamo-dotnet/README.md.tmpl +28 -5
  20. package/dist/templates/webapp-lambda-dynamo-dotnet/cdk/package.json.tmpl +23 -0
  21. package/dist/templates/webapp-lambda-dynamo-node/README.md.tmpl +28 -5
  22. package/dist/templates/webapp-lambda-dynamo-node/apps/api/package.json +3 -2
  23. package/dist/templates/webapp-lambda-dynamo-node/cdk/app.ts.tmpl +1 -1
  24. package/dist/templates/webapp-lambda-dynamo-node/cdk/package.json.tmpl +23 -0
  25. package/dist/templates/webapp-lambda-node/README.md.tmpl +28 -5
  26. package/dist/templates/webapp-lambda-node/apps/api/package.json +3 -2
  27. package/dist/templates/webapp-lambda-node/cdk/app.ts.tmpl +1 -1
  28. package/dist/templates/webapp-lambda-node/cdk/package.json.tmpl +23 -0
  29. package/dist/templates/webapp-lambda-postgres-dotnet/README.md.tmpl +29 -6
  30. package/dist/templates/webapp-lambda-postgres-dotnet/cdk/package.json.tmpl +23 -0
  31. package/dist/templates/webapp-lambda-postgres-node/README.md.tmpl +28 -5
  32. package/dist/templates/webapp-lambda-postgres-node/apps/api/package.json +3 -2
  33. package/dist/templates/webapp-lambda-postgres-node/cdk/app.ts.tmpl +1 -1
  34. package/dist/templates/webapp-lambda-postgres-node/cdk/package.json.tmpl +23 -0
  35. package/package.json +2 -2
  36. package/dist/templates/_shared/nuxt-frontend/app.vue +0 -3
  37. package/dist/templates/_shared/nuxt-frontend/nuxt.config.ts +0 -25
  38. package/dist/templates/_shared/nuxt-frontend/package.json.tmpl +0 -19
  39. package/dist/templates/_shared/nuxt-frontend/pages/index.vue +0 -6
  40. package/dist/templates/_shared/nuxt-frontend/tsconfig.json +0 -3
  41. package/dist/templates/_shared/webapp-frontend/app.vue +0 -3
  42. package/dist/templates/_shared/webapp-frontend/nuxt.config.ts +0 -25
  43. package/dist/templates/_shared/webapp-frontend/package.json.tmpl +0 -19
  44. package/dist/templates/_shared/webapp-frontend/pages/index.vue +0 -7
  45. package/dist/templates/_shared/webapp-frontend/public/.gitkeep +0 -0
  46. package/dist/templates/_shared/webapp-frontend/tsconfig.json +0 -3
  47. package/dist/templates/static-site/frontend/.gitkeep +0 -0
  48. package/dist/templates/static-site/frontend/build.js +0 -42
  49. /package/dist/templates/_shared/{nuxt-frontend/public → frontend}/.gitkeep +0 -0
  50. /package/dist/templates/{static-site → _shared}/frontend/README.md +0 -0
  51. /package/dist/templates/{static-site → _shared/frontend}/README.md.tmpl +0 -0
  52. /package/dist/templates/{static-site → _shared}/frontend/package.json +0 -0
  53. /package/dist/templates/{static-site → _shared/frontend}/package.json.tmpl +0 -0
  54. /package/dist/templates/{static-site → _shared/frontend}/pnpm-workspace.yaml.tmpl +0 -0
  55. /package/dist/templates/{static-site → _shared/frontend}/tsconfig.json +0 -0
  56. /package/dist/templates/_shared/{webapp-cdk-package.json.tmpl → package.json.tmpl} +0 -0
@@ -0,0 +1,23 @@
1
+ {
2
+ "name": "cdk",
3
+ "version": "1.0.0",
4
+ "private": true,
5
+ "scripts": {
6
+ "build": "tsc",
7
+ "watch": "tsc -w",
8
+ "cdk": "cdk"
9
+ },
10
+ "dependencies": {
11
+ "@phila/constructs": "^{{constructsVersion}}",
12
+ "aws-cdk-lib": "^2.236.0",
13
+ "cdk-nag": "^2.28.0",
14
+ "constructs": "^10.4.4",
15
+ "source-map-support": "^0.5.21"
16
+ },
17
+ "devDependencies": {
18
+ "@types/node": "^20.10.0",
19
+ "aws-cdk": "^2.1103.0",
20
+ "ts-node": "^10.9.0",
21
+ "typescript": "^5.3.0"
22
+ }
23
+ }
@@ -112,6 +112,27 @@ This automatically creates a route at `/about`.
112
112
 
113
113
  The API uses [.NET Minimal API](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/minimal-apis) with AWS Lambda hosting.
114
114
 
115
+ ### Authentication
116
+
117
+ The API uses path-based authentication:
118
+
119
+ | Path Pattern | Authentication | Use Case |
120
+ |--------------|----------------|----------|
121
+ | `/public/*` | None | Health checks, public data |
122
+ | `/private/key/*` | API Key required | Protected endpoints |
123
+
124
+ **Retrieve the API key:**
125
+
126
+ ```bash
127
+ SECRET_ARN=$(aws ssm get-parameter \
128
+ --name "/dev/{{appName}}/api/main/key-secret-arn" \
129
+ --query Parameter.Value --output text)
130
+ API_KEY=$(aws secretsmanager get-secret-value \
131
+ --secret-id "$SECRET_ARN" --query SecretString --output text)
132
+ ```
133
+
134
+ The API key is stored in Secrets Manager, encrypted with a dedicated KMS key. Keys are not auto-rotated; coordinate manual rotation with API consumers.
135
+
115
136
  ### Adding Endpoints
116
137
 
117
138
  Edit `apps/api/Program.cs`:
@@ -152,15 +173,17 @@ This application creates:
152
173
  - **Origin Access Control** - Secure S3 access
153
174
 
154
175
  **API:**
155
- - **API Gateway REST API** - HTTP endpoint
176
+ - **API Gateway REST API** - HTTP endpoint with path-based auth
177
+ - **API Key & Usage Plan** - For protected endpoint authentication
178
+ - **Secrets Manager Secret** - Stores API key (KMS encrypted)
179
+ - **WAF Web ACL** - Protects API from common attacks
156
180
  - **Lambda Function** - .NET 8 serverless compute
157
- - **VPC Security Group** - Network security
158
181
  - **IAM Role** - Permissions for Lambda execution
159
182
 
160
183
  **Shared:**
161
- - **SSM Parameters** - Resource discovery
162
- - **CloudWatch Logs** - Application logs
163
- - **KMS Keys** - Encryption
184
+ - **SSM Parameters** - Resource discovery (URLs, API key secret ARN)
185
+ - **CloudWatch Logs** - Application and API access logs
186
+ - **KMS Keys** - Encryption for secrets
164
187
 
165
188
  ## URLs
166
189
 
@@ -0,0 +1,23 @@
1
+ {
2
+ "name": "cdk",
3
+ "version": "1.0.0",
4
+ "private": true,
5
+ "scripts": {
6
+ "build": "tsc",
7
+ "watch": "tsc -w",
8
+ "cdk": "cdk"
9
+ },
10
+ "dependencies": {
11
+ "@phila/constructs": "^{{constructsVersion}}",
12
+ "aws-cdk-lib": "^2.236.0",
13
+ "cdk-nag": "^2.28.0",
14
+ "constructs": "^10.4.4",
15
+ "source-map-support": "^0.5.21"
16
+ },
17
+ "devDependencies": {
18
+ "@types/node": "^20.10.0",
19
+ "aws-cdk": "^2.1103.0",
20
+ "ts-node": "^10.9.0",
21
+ "typescript": "^5.3.0"
22
+ }
23
+ }
@@ -112,6 +112,27 @@ This automatically creates a route at `/about`.
112
112
 
113
113
  The API uses [.NET Minimal API](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/minimal-apis) with AWS Lambda hosting and DynamoDB.
114
114
 
115
+ ### Authentication
116
+
117
+ The API uses path-based authentication:
118
+
119
+ | Path Pattern | Authentication | Use Case |
120
+ |--------------|----------------|----------|
121
+ | `/public/*` | None | Health checks, public data |
122
+ | `/private/key/*` | API Key required | Protected endpoints |
123
+
124
+ **Retrieve the API key:**
125
+
126
+ ```bash
127
+ SECRET_ARN=$(aws ssm get-parameter \
128
+ --name "/dev/{{appName}}/api/main/key-secret-arn" \
129
+ --query Parameter.Value --output text)
130
+ API_KEY=$(aws secretsmanager get-secret-value \
131
+ --secret-id "$SECRET_ARN" --query SecretString --output text)
132
+ ```
133
+
134
+ The API key is stored in Secrets Manager, encrypted with a dedicated KMS key. Keys are not auto-rotated; coordinate manual rotation with API consumers.
135
+
115
136
  ### Adding Endpoints
116
137
 
117
138
  Edit `apps/api/Program.cs`:
@@ -191,16 +212,18 @@ This application creates:
191
212
  - **Origin Access Control** - Secure S3 access
192
213
 
193
214
  **API:**
194
- - **API Gateway REST API** - HTTP endpoint
215
+ - **API Gateway REST API** - HTTP endpoint with path-based auth
216
+ - **API Key & Usage Plan** - For protected endpoint authentication
217
+ - **Secrets Manager Secret** - Stores API key (KMS encrypted)
218
+ - **WAF Web ACL** - Protects API from common attacks
195
219
  - **Lambda Function** - .NET 8 serverless compute
196
220
  - **DynamoDB Table** - NoSQL database
197
- - **VPC Security Group** - Network security
198
221
  - **IAM Role** - Permissions for Lambda and DynamoDB
199
222
 
200
223
  **Shared:**
201
- - **SSM Parameters** - Resource discovery
202
- - **CloudWatch Logs** - Application logs
203
- - **KMS Keys** - Encryption
224
+ - **SSM Parameters** - Resource discovery (URLs, API key secret ARN)
225
+ - **CloudWatch Logs** - Application and API access logs
226
+ - **KMS Keys** - Encryption for secrets and DynamoDB
204
227
 
205
228
  ## URLs
206
229
 
@@ -0,0 +1,23 @@
1
+ {
2
+ "name": "cdk",
3
+ "version": "1.0.0",
4
+ "private": true,
5
+ "scripts": {
6
+ "build": "tsc",
7
+ "watch": "tsc -w",
8
+ "cdk": "cdk"
9
+ },
10
+ "dependencies": {
11
+ "@phila/constructs": "^{{constructsVersion}}",
12
+ "aws-cdk-lib": "^2.236.0",
13
+ "cdk-nag": "^2.28.0",
14
+ "constructs": "^10.4.4",
15
+ "source-map-support": "^0.5.21"
16
+ },
17
+ "devDependencies": {
18
+ "@types/node": "^20.10.0",
19
+ "aws-cdk": "^2.1103.0",
20
+ "ts-node": "^10.9.0",
21
+ "typescript": "^5.3.0"
22
+ }
23
+ }
@@ -110,6 +110,27 @@ This automatically creates a route at `/about`.
110
110
 
111
111
  The API uses [@phila/philaroute](https://www.npmjs.com/package/@phila/philaroute) for HTTP routing with DynamoDB for data persistence.
112
112
 
113
+ ### Authentication
114
+
115
+ The API uses path-based authentication:
116
+
117
+ | Path Pattern | Authentication | Use Case |
118
+ |--------------|----------------|----------|
119
+ | `/public/*` | None | Health checks, public data |
120
+ | `/private/key/*` | API Key required | Protected endpoints |
121
+
122
+ **Retrieve the API key:**
123
+
124
+ ```bash
125
+ SECRET_ARN=$(aws ssm get-parameter \
126
+ --name "/dev/{{appName}}/api/main/key-secret-arn" \
127
+ --query Parameter.Value --output text)
128
+ API_KEY=$(aws secretsmanager get-secret-value \
129
+ --secret-id "$SECRET_ARN" --query SecretString --output text)
130
+ ```
131
+
132
+ The API key is stored in Secrets Manager, encrypted with a dedicated KMS key. Keys are not auto-rotated; coordinate manual rotation with API consumers.
133
+
113
134
  ### DynamoDB Operations
114
135
 
115
136
  The template includes CRUD operations in `apps/api/index.ts`:
@@ -157,16 +178,18 @@ This application creates:
157
178
  - **Origin Access Control** - Secure S3 access
158
179
 
159
180
  **API:**
160
- - **API Gateway REST API** - HTTP endpoint
181
+ - **API Gateway REST API** - HTTP endpoint with path-based auth
182
+ - **API Key & Usage Plan** - For protected endpoint authentication
183
+ - **Secrets Manager Secret** - Stores API key (KMS encrypted)
184
+ - **WAF Web ACL** - Protects API from common attacks
161
185
  - **Lambda Function** - Serverless compute
162
186
  - **DynamoDB Table** - NoSQL database with encryption
163
- - **VPC Security Group** - Network security
164
187
  - **IAM Role** - Permissions for Lambda and DynamoDB
165
188
 
166
189
  **Shared:**
167
- - **SSM Parameters** - Resource discovery
168
- - **CloudWatch Logs** - Application logs
169
- - **KMS Keys** - Encryption
190
+ - **SSM Parameters** - Resource discovery (URLs, API key secret ARN)
191
+ - **CloudWatch Logs** - Application and API access logs
192
+ - **KMS Keys** - Encryption for secrets and DynamoDB
170
193
 
171
194
  ## URLs
172
195
 
@@ -4,8 +4,8 @@
4
4
  "description": "Lambda API handler with DynamoDB",
5
5
  "private": true,
6
6
  "scripts": {
7
- "build": "tsc",
8
- "watch": "tsc -w"
7
+ "build": "esbuild index.ts --bundle --platform=node --target=node22 --outfile=dist/index.js --external:@aws-sdk/*",
8
+ "watch": "esbuild index.ts --bundle --platform=node --target=node22 --outfile=dist/index.js --external:@aws-sdk/* --watch"
9
9
  },
10
10
  "dependencies": {
11
11
  "@phila/philaroute": "^1.0.14",
@@ -14,6 +14,7 @@
14
14
  "@types/aws-lambda": "^8.10.0"
15
15
  },
16
16
  "devDependencies": {
17
+ "esbuild": "^0.24.0",
17
18
  "typescript": "^5.3.0"
18
19
  }
19
20
  }
@@ -48,7 +48,7 @@ new LambdaDynamoApi(stack as any, '{{appName}}Api', {
48
48
  apiId: 'api',
49
49
  runtime: 'nodejs22',
50
50
  handler: 'index.handler',
51
- codeDir: '../apps/api',
51
+ codeDir: '../apps/api/dist',
52
52
  // DynamoDB table configuration
53
53
  partitionKey: { name: 'pk', type: 'S' },
54
54
  // Uncomment for composite key (partition + sort):
@@ -0,0 +1,23 @@
1
+ {
2
+ "name": "cdk",
3
+ "version": "1.0.0",
4
+ "private": true,
5
+ "scripts": {
6
+ "build": "tsc",
7
+ "watch": "tsc -w",
8
+ "cdk": "cdk"
9
+ },
10
+ "dependencies": {
11
+ "@phila/constructs": "^{{constructsVersion}}",
12
+ "aws-cdk-lib": "^2.236.0",
13
+ "cdk-nag": "^2.28.0",
14
+ "constructs": "^10.4.4",
15
+ "source-map-support": "^0.5.21"
16
+ },
17
+ "devDependencies": {
18
+ "@types/node": "^20.10.0",
19
+ "aws-cdk": "^2.1103.0",
20
+ "ts-node": "^10.9.0",
21
+ "typescript": "^5.3.0"
22
+ }
23
+ }
@@ -110,6 +110,27 @@ This automatically creates a route at `/about`.
110
110
 
111
111
  The API uses [@phila/philaroute](https://www.npmjs.com/package/@phila/philaroute) for HTTP routing.
112
112
 
113
+ ### Authentication
114
+
115
+ The API uses path-based authentication:
116
+
117
+ | Path Pattern | Authentication | Use Case |
118
+ |--------------|----------------|----------|
119
+ | `/public/*` | None | Health checks, public data |
120
+ | `/private/key/*` | API Key required | Protected endpoints |
121
+
122
+ **Retrieve the API key:**
123
+
124
+ ```bash
125
+ SECRET_ARN=$(aws ssm get-parameter \
126
+ --name "/dev/{{appName}}/api/main/key-secret-arn" \
127
+ --query Parameter.Value --output text)
128
+ API_KEY=$(aws secretsmanager get-secret-value \
129
+ --secret-id "$SECRET_ARN" --query SecretString --output text)
130
+ ```
131
+
132
+ The API key is stored in Secrets Manager, encrypted with a dedicated KMS key. Keys are not auto-rotated; coordinate manual rotation with API consumers.
133
+
113
134
  ### Adding Endpoints
114
135
 
115
136
  Edit `apps/api/index.ts`:
@@ -143,15 +164,17 @@ This application creates:
143
164
  - **Origin Access Control** - Secure S3 access
144
165
 
145
166
  **API:**
146
- - **API Gateway REST API** - HTTP endpoint
167
+ - **API Gateway REST API** - HTTP endpoint with path-based auth
168
+ - **API Key & Usage Plan** - For protected endpoint authentication
169
+ - **Secrets Manager Secret** - Stores API key (KMS encrypted)
170
+ - **WAF Web ACL** - Protects API from common attacks
147
171
  - **Lambda Function** - Serverless compute
148
- - **VPC Security Group** - Network security
149
172
  - **IAM Role** - Permissions for Lambda execution
150
173
 
151
174
  **Shared:**
152
- - **SSM Parameters** - Resource discovery
153
- - **CloudWatch Logs** - Application logs
154
- - **KMS Keys** - Encryption
175
+ - **SSM Parameters** - Resource discovery (URLs, API key secret ARN)
176
+ - **CloudWatch Logs** - Application and API access logs
177
+ - **KMS Keys** - Encryption for secrets
155
178
 
156
179
  ## URLs
157
180
 
@@ -4,14 +4,15 @@
4
4
  "description": "Lambda API handler",
5
5
  "private": true,
6
6
  "scripts": {
7
- "build": "tsc",
8
- "watch": "tsc -w"
7
+ "build": "esbuild index.ts --bundle --platform=node --target=node22 --outfile=dist/index.js",
8
+ "watch": "esbuild index.ts --bundle --platform=node --target=node22 --outfile=dist/index.js --watch"
9
9
  },
10
10
  "dependencies": {
11
11
  "@phila/philaroute": "^1.0.14",
12
12
  "@types/aws-lambda": "^8.10.0"
13
13
  },
14
14
  "devDependencies": {
15
+ "esbuild": "^0.24.0",
15
16
  "typescript": "^5.3.0"
16
17
  }
17
18
  }
@@ -48,7 +48,7 @@ new LambdaApi(stack as any, '{{appName}}Api', {
48
48
  apiId: 'api',
49
49
  runtime: 'nodejs22',
50
50
  handler: 'index.handler',
51
- codeDir: '../apps/api',
51
+ codeDir: '../apps/api/dist',
52
52
  });
53
53
 
54
54
  // Apply compliance checks
@@ -0,0 +1,23 @@
1
+ {
2
+ "name": "cdk",
3
+ "version": "1.0.0",
4
+ "private": true,
5
+ "scripts": {
6
+ "build": "tsc",
7
+ "watch": "tsc -w",
8
+ "cdk": "cdk"
9
+ },
10
+ "dependencies": {
11
+ "@phila/constructs": "^{{constructsVersion}}",
12
+ "aws-cdk-lib": "^2.236.0",
13
+ "cdk-nag": "^2.28.0",
14
+ "constructs": "^10.4.4",
15
+ "source-map-support": "^0.5.21"
16
+ },
17
+ "devDependencies": {
18
+ "@types/node": "^20.10.0",
19
+ "aws-cdk": "^2.1103.0",
20
+ "ts-node": "^10.9.0",
21
+ "typescript": "^5.3.0"
22
+ }
23
+ }
@@ -112,6 +112,27 @@ This automatically creates a route at `/about`.
112
112
 
113
113
  The API uses [.NET Minimal API](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/minimal-apis) with AWS Lambda hosting and PostgreSQL via Npgsql.
114
114
 
115
+ ### Authentication
116
+
117
+ The API uses path-based authentication:
118
+
119
+ | Path Pattern | Authentication | Use Case |
120
+ |--------------|----------------|----------|
121
+ | `/public/*` | None | Health checks, public data |
122
+ | `/private/key/*` | API Key required | Protected endpoints |
123
+
124
+ **Retrieve the API key:**
125
+
126
+ ```bash
127
+ SECRET_ARN=$(aws ssm get-parameter \
128
+ --name "/dev/{{appName}}/api/main/key-secret-arn" \
129
+ --query Parameter.Value --output text)
130
+ API_KEY=$(aws secretsmanager get-secret-value \
131
+ --secret-id "$SECRET_ARN" --query SecretString --output text)
132
+ ```
133
+
134
+ The API key is stored in Secrets Manager, encrypted with a dedicated KMS key. Keys are not auto-rotated; coordinate manual rotation with API consumers.
135
+
115
136
  ### Adding Endpoints
116
137
 
117
138
  Edit `apps/api/Program.cs`:
@@ -207,17 +228,19 @@ This application creates:
207
228
  - **Origin Access Control** - Secure S3 access
208
229
 
209
230
  **API:**
210
- - **API Gateway REST API** - HTTP endpoint
231
+ - **API Gateway REST API** - HTTP endpoint with path-based auth
232
+ - **API Key & Usage Plan** - For protected endpoint authentication
233
+ - **Secrets Manager Secrets** - API key and database credentials (KMS encrypted)
234
+ - **WAF Web ACL** - Protects API from common attacks
211
235
  - **Lambda Function** - .NET 8 serverless compute
212
236
  - **RDS PostgreSQL** - Relational database
213
- - **Secrets Manager** - Database credentials
214
237
  - **VPC Security Group** - Network security
215
- - **IAM Role** - Permissions for Lambda and database
238
+ - **IAM Role** - Permissions for Lambda, Secrets Manager, and database
216
239
 
217
240
  **Shared:**
218
- - **SSM Parameters** - Resource discovery
219
- - **CloudWatch Logs** - Application logs
220
- - **KMS Keys** - Encryption
241
+ - **SSM Parameters** - Resource discovery (URLs, API key secret ARN)
242
+ - **CloudWatch Logs** - Application and API access logs
243
+ - **KMS Keys** - Encryption for secrets
221
244
 
222
245
  ## URLs
223
246
 
@@ -0,0 +1,23 @@
1
+ {
2
+ "name": "cdk",
3
+ "version": "1.0.0",
4
+ "private": true,
5
+ "scripts": {
6
+ "build": "tsc",
7
+ "watch": "tsc -w",
8
+ "cdk": "cdk"
9
+ },
10
+ "dependencies": {
11
+ "@phila/constructs": "^{{constructsVersion}}",
12
+ "aws-cdk-lib": "^2.236.0",
13
+ "cdk-nag": "^2.28.0",
14
+ "constructs": "^10.4.4",
15
+ "source-map-support": "^0.5.21"
16
+ },
17
+ "devDependencies": {
18
+ "@types/node": "^20.10.0",
19
+ "aws-cdk": "^2.1103.0",
20
+ "ts-node": "^10.9.0",
21
+ "typescript": "^5.3.0"
22
+ }
23
+ }
@@ -110,6 +110,27 @@ This automatically creates a route at `/about`.
110
110
 
111
111
  The API uses [@phila/philaroute](https://www.npmjs.com/package/@phila/philaroute) for HTTP routing with PostgreSQL for data persistence.
112
112
 
113
+ ### Authentication
114
+
115
+ The API uses path-based authentication:
116
+
117
+ | Path Pattern | Authentication | Use Case |
118
+ |--------------|----------------|----------|
119
+ | `/public/*` | None | Health checks, public data |
120
+ | `/private/key/*` | API Key required | Protected endpoints |
121
+
122
+ **Retrieve the API key:**
123
+
124
+ ```bash
125
+ SECRET_ARN=$(aws ssm get-parameter \
126
+ --name "/dev/{{appName}}/api/main/key-secret-arn" \
127
+ --query Parameter.Value --output text)
128
+ API_KEY=$(aws secretsmanager get-secret-value \
129
+ --secret-id "$SECRET_ARN" --query SecretString --output text)
130
+ ```
131
+
132
+ The API key is stored in Secrets Manager, encrypted with a dedicated KMS key. Keys are not auto-rotated; coordinate manual rotation with API consumers.
133
+
113
134
  ### Database Setup
114
135
 
115
136
  1. Install a PostgreSQL client:
@@ -157,17 +178,19 @@ This application creates:
157
178
  - **Origin Access Control** - Secure S3 access
158
179
 
159
180
  **API:**
160
- - **API Gateway REST API** - HTTP endpoint
181
+ - **API Gateway REST API** - HTTP endpoint with path-based auth
182
+ - **API Key & Usage Plan** - For protected endpoint authentication
183
+ - **Secrets Manager Secrets** - API key and database credentials (KMS encrypted)
184
+ - **WAF Web ACL** - Protects API from common attacks
161
185
  - **Lambda Function** - Serverless compute in VPC
162
186
  - **RDS PostgreSQL** - Managed relational database
163
- - **Secrets Manager Secret** - Database credentials
164
187
  - **VPC Security Groups** - Network security for Lambda and RDS
165
188
  - **IAM Role** - Permissions for Lambda and Secrets Manager
166
189
 
167
190
  **Shared:**
168
- - **SSM Parameters** - Resource discovery
169
- - **CloudWatch Logs** - Application logs
170
- - **KMS Keys** - Encryption
191
+ - **SSM Parameters** - Resource discovery (URLs, API key secret ARN)
192
+ - **CloudWatch Logs** - Application and API access logs
193
+ - **KMS Keys** - Encryption for secrets
171
194
 
172
195
  ## URLs
173
196
 
@@ -4,8 +4,8 @@
4
4
  "description": "Lambda API handler with PostgreSQL database access",
5
5
  "private": true,
6
6
  "scripts": {
7
- "build": "tsc",
8
- "watch": "tsc -w"
7
+ "build": "esbuild index.ts --bundle --platform=node --target=node22 --outfile=dist/index.js",
8
+ "watch": "esbuild index.ts --bundle --platform=node --target=node22 --outfile=dist/index.js --watch"
9
9
  },
10
10
  "dependencies": {
11
11
  "@phila/philaroute": "^1.0.14",
@@ -13,6 +13,7 @@
13
13
  "@types/aws-lambda": "^8.10.0"
14
14
  },
15
15
  "devDependencies": {
16
+ "esbuild": "^0.24.0",
16
17
  "typescript": "^5.3.0"
17
18
  }
18
19
  }
@@ -48,7 +48,7 @@ new LambdaPostgresApi(stack as any, '{{appName}}Api', {
48
48
  apiId: 'api',
49
49
  runtime: 'nodejs22',
50
50
  handler: 'index.handler',
51
- codeDir: '../apps/api',
51
+ codeDir: '../apps/api/dist',
52
52
  // Uncomment for serverless Aurora instead of provisioned RDS:
53
53
  // serverless: true,
54
54
  });
@@ -0,0 +1,23 @@
1
+ {
2
+ "name": "cdk",
3
+ "version": "1.0.0",
4
+ "private": true,
5
+ "scripts": {
6
+ "build": "tsc",
7
+ "watch": "tsc -w",
8
+ "cdk": "cdk"
9
+ },
10
+ "dependencies": {
11
+ "@phila/constructs": "^{{constructsVersion}}",
12
+ "aws-cdk-lib": "^2.236.0",
13
+ "cdk-nag": "^2.28.0",
14
+ "constructs": "^10.4.4",
15
+ "source-map-support": "^0.5.21"
16
+ },
17
+ "devDependencies": {
18
+ "@types/node": "^20.10.0",
19
+ "aws-cdk": "^2.1103.0",
20
+ "ts-node": "^10.9.0",
21
+ "typescript": "^5.3.0"
22
+ }
23
+ }
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@phila/cli",
3
- "version": "0.0.17",
3
+ "version": "0.0.19",
4
4
  "description": "CLI tool for City of Philadelphia AWS infrastructure",
5
5
  "main": "dist/index.js",
6
6
  "bin": {
@@ -24,7 +24,7 @@
24
24
  "commander": "^11.0.0",
25
25
  "fs-extra": "^11.1.0",
26
26
  "inquirer": "^8.2.5",
27
- "@phila/constructs": "0.0.10",
27
+ "@phila/constructs": "0.0.12",
28
28
  "@phila/db-postgres": "0.0.6"
29
29
  },
30
30
  "devDependencies": {
@@ -1,3 +0,0 @@
1
- <template>
2
- <NuxtPage />
3
- </template>
@@ -1,25 +0,0 @@
1
- // ABOUTME: Nuxt 3 configuration for Static Site Generation
2
- // ABOUTME: Outputs static files to dist/ for S3/CloudFront deployment
3
-
4
- export default defineNuxtConfig({
5
- // Enable SSR for static generation
6
- ssr: true,
7
-
8
- // Static site generation preset
9
- nitro: {
10
- preset: 'static',
11
- output: {
12
- publicDir: 'dist',
13
- },
14
- },
15
-
16
- // TypeScript support
17
- typescript: {
18
- strict: true,
19
- },
20
-
21
- // Disable telemetry
22
- telemetry: false,
23
-
24
- compatibilityDate: '2025-01-01',
25
- });
@@ -1,19 +0,0 @@
1
- {
2
- "name": "{{appName}}-frontend",
3
- "version": "0.0.1",
4
- "private": true,
5
- "type": "module",
6
- "scripts": {
7
- "build": "nuxt generate",
8
- "dev": "nuxt dev",
9
- "preview": "nuxt preview",
10
- "postinstall": "nuxt prepare"
11
- },
12
- "dependencies": {
13
- "vue": "^3.5.13"
14
- },
15
- "devDependencies": {
16
- "nuxt": "^3.14.0",
17
- "typescript": "^5.7.0"
18
- }
19
- }
@@ -1,6 +0,0 @@
1
- <template>
2
- <div>
3
- <h1>Welcome</h1>
4
- <p>Your static site is ready. Edit this page in pages/index.vue.</p>
5
- </div>
6
- </template>
@@ -1,3 +0,0 @@
1
- {
2
- "extends": "./.nuxt/tsconfig.json"
3
- }
@@ -1,3 +0,0 @@
1
- <template>
2
- <NuxtPage />
3
- </template>