@quadnix/octo-aws-cdk 0.1.0 → 0.2.1

package/dist/resources/cloudfront-distribution/cloudfront-behavior.schema.js

@@ -0,0 +1,215 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Schema, Validate } from '@quadnix/octo';
+import { CLOUDFRONT_MANAGED_CACHE_POLICIES, CLOUDFRONT_MANAGED_ORIGIN_REQUEST_POLICIES, CLOUDFRONT_MANAGED_RESPONSE_HEADERS_POLICIES, } from './cloudfront-policy.schema.js';
+/**
+ * @internal
+ */
+export const CLOUDFRONT_ALLOWED_METHODS = [
+    ['GET', 'HEAD'],
+    ['GET', 'HEAD', 'OPTIONS'],
+    ['GET', 'HEAD', 'OPTIONS', 'PUT', 'POST', 'PATCH', 'DELETE'],
+];
+/**
+ * @internal
+ */
+export const CLOUDFRONT_CACHED_METHODS = [
+    ['GET', 'HEAD'],
+    ['GET', 'HEAD', 'OPTIONS'],
+];
+const CLOUDFRONT_FUNCTION_EVENT_TYPES = [
+    'origin-request',
+    'origin-response',
+    'viewer-request',
+    'viewer-response',
+];
+const CLOUDFRONT_FUNCTION_KINDS = ['cloudfront-function', 'lambda-edge'];
+/**
+ * @internal
+ */
+export const CLOUDFRONT_VIEWER_PROTOCOL_POLICIES = ['allow-all', 'https-only', 'redirect-to-https'];
+/**
+ * An edge function CloudFront runs for a behavior. The function itself is not created here - pass
+ * the ARN of one that already exists.
+ *
+ * @group Resources/CloudFrontDistribution
+ *
+ * @hideconstructor
+ */
+export class CloudFrontFunctionAssociationSchema {
+    constructor() {
+        /**
+         * The ARN of the CloudFront Function or the Lambda@Edge function version.
+         */
+        this.arn = Schema();
+        /**
+         * Which lifecycle event the function runs on. See {@link ICloudFrontFunctionEventType}.
+         */
+        this.eventType = Schema();
+        /**
+         * Which engine runs it. See {@link ICloudFrontFunctionKind}.
+         */
+        this.kind = Schema();
+    }
+}
+__decorate([
+    Validate({ options: { minLength: 1 } }),
+    __metadata("design:type", Object)
+], CloudFrontFunctionAssociationSchema.prototype, "arn", void 0);
+__decorate([
+    Validate({
+        options: {
+            custom: (value) => CLOUDFRONT_FUNCTION_EVENT_TYPES.includes(value),
+        },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontFunctionAssociationSchema.prototype, "eventType", void 0);
+__decorate([
+    Validate({
+        options: { custom: (value) => CLOUDFRONT_FUNCTION_KINDS.includes(value) },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontFunctionAssociationSchema.prototype, "kind", void 0);
+/**
+ * One rule binding a set of paths to an origin, and deciding everything about how those paths are
+ * served.
+ *
+ * @group Resources/CloudFrontDistribution
+ *
+ * @hideconstructor
+ */
+export class CloudFrontBehaviorSchema {
+    constructor() {
+        /**
+         * The HTTP methods CloudFront forwards to the origin. See {@link ICloudFrontAllowedMethods}.
+         */
+        this.allowedMethods = Schema(['GET', 'HEAD']);
+        /**
+         * The subset of `allowedMethods` whose responses CloudFront caches. See
+         * {@link ICloudFrontCachedMethods}.
+         */
+        this.cachedMethods = Schema(['GET', 'HEAD']);
+        /**
+         * Which policy decides the cache key and the TTLs. See {@link ICloudFrontPolicyReference}, and
+         * {@link ICloudFrontManagedCachePolicy} for the managed ones.
+         */
+        this.cachePolicy = Schema();
+        /**
+         * Whether CloudFront compresses the response for viewers that accept it.
+         */
+        this.compress = Schema(true);
+        /**
+         * Edge functions to run for this behavior. See {@link CloudFrontFunctionAssociationSchema}.
+         */
+        this.functionAssociations = Schema([]);
+        /**
+         * Which policy decides what reaches the origin, independently of the cache key.
+         * `null` forwards only what the cache policy already selected.
+         * See {@link ICloudFrontManagedOriginRequestPolicy} for the managed ones.
+         */
+        this.originRequestPolicy = Schema(null);
+        /**
+         * The paths this behavior claims, e.g. `/api/*`. Absent on the default behavior, which claims
+         * everything no other behavior did.
+         */
+        this.pathPattern = Schema(null);
+        /**
+         * Which policy decides the headers CloudFront adds on the way out - CORS, HSTS, and the app's own
+         * content security policy.
+         * See {@link ICloudFrontManagedResponseHeadersPolicy} for the managed ones.
+         */
+        this.responseHeadersPolicy = Schema(null);
+        /**
+         * The `originId` or `originGroupId` serving these paths.
+         */
+        this.targetOriginId = Schema();
+        /**
+         * What CloudFront does with a plain HTTP request. See {@link ICloudFrontViewerProtocolPolicy}.
+         */
+        this.viewerProtocolPolicy = Schema('redirect-to-https');
+    }
+}
+__decorate([
+    Validate({
+        destruct: (value) => [[...value]],
+        options: {
+            custom: (value) => CLOUDFRONT_ALLOWED_METHODS.some((m) => m.length === value.length && m.every((method) => value.includes(method))),
+        },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontBehaviorSchema.prototype, "allowedMethods", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => [[...value]],
+        options: {
+            custom: (value) => CLOUDFRONT_CACHED_METHODS.some((m) => m.length === value.length && m.every((method) => value.includes(method))),
+        },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontBehaviorSchema.prototype, "cachedMethods", void 0);
+__decorate([
+    Validate({
+        options: {
+            custom: (value) => value.kind === 'managed'
+                ? CLOUDFRONT_MANAGED_CACHE_POLICIES.includes(value.name)
+                : value.kind === 'custom' && value.name.length > 0,
+        },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontBehaviorSchema.prototype, "cachePolicy", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => value,
+        options: { isSchema: { schema: CloudFrontFunctionAssociationSchema } },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontBehaviorSchema.prototype, "functionAssociations", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => value ? [value] : [],
+        options: {
+            custom: (value) => value.kind === 'managed'
+                ? CLOUDFRONT_MANAGED_ORIGIN_REQUEST_POLICIES.includes(value.name)
+                : value.kind === 'custom' && value.name.length > 0,
+        },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontBehaviorSchema.prototype, "originRequestPolicy", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => (value ? [value] : []),
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontBehaviorSchema.prototype, "pathPattern", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => value ? [value] : [],
+        options: {
+            custom: (value) => value.kind === 'managed'
+                ? CLOUDFRONT_MANAGED_RESPONSE_HEADERS_POLICIES.includes(value.name)
+                : value.kind === 'custom' && value.name.length > 0,
+        },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontBehaviorSchema.prototype, "responseHeadersPolicy", void 0);
+__decorate([
+    Validate({ options: { minLength: 1 } }),
+    __metadata("design:type", Object)
+], CloudFrontBehaviorSchema.prototype, "targetOriginId", void 0);
+__decorate([
+    Validate({
+        options: {
+            custom: (value) => CLOUDFRONT_VIEWER_PROTOCOL_POLICIES.includes(value),
+        },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontBehaviorSchema.prototype, "viewerProtocolPolicy", void 0);
+//# sourceMappingURL=cloudfront-behavior.schema.js.map

package/dist/resources/cloudfront-distribution/cloudfront-behavior.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudfront-behavior.schema.js","sourceRoot":"","sources":["../../../src/resources/cloudfront-distribution/cloudfront-behavior.schema.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,iCAAiC,EACjC,0CAA0C,EAC1C,4CAA4C,GAK7C,MAAM,+BAA+B,CAAC;AAEvC;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,CAAC,KAAK,EAAE,MAAM,CAAC;IACf,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;IAC1B,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;CACpD,CAAC;AAYX;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,CAAC,KAAK,EAAE,MAAM,CAAC;IACf,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;CAClB,CAAC;AASX,MAAM,+BAA+B,GAAG;IACtC,gBAAgB;IAChB,iBAAiB;IACjB,gBAAgB;IAChB,iBAAiB;CACT,CAAC;AASX,MAAM,yBAAyB,GAAG,CAAC,qBAAqB,EAAE,aAAa,CAAU,CAAC;AAUlF;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,mBAAmB,CAAU,CAAC;AAW7G;;;;;;;GAOG;AACH,MAAM,OAAO,mCAAmC;IAAhD;QACE;;WAEG;QAEH,QAAG,GAAG,MAAM,EAAU,CAAC;QAEvB;;WAEG;QAMH,cAAS,GAAG,MAAM,EAAgC,CAAC;QAEnD;;WAEG;QAIH,SAAI,GAAG,MAAM,EAA2B,CAAC;IAC3C,CAAC;CAAA;AAnBC;IADC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;;gEACjB;AAUvB;IALC,QAAQ,CAAC;QACR,OAAO,EAAE;YACP,MAAM,EAAE,CAAC,KAAa,EAAW,EAAE,CAAE,+BAAqD,CAAC,QAAQ,CAAC,KAAK,CAAC;SAC3G;KACF,CAAC;;sEACiD;AAQnD;IAHC,QAAQ,CAAC;QACR,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,KAAa,EAAW,EAAE,CAAE,yBAA+C,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;KAClH,CAAC;;iEACuC;AAG3C;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAwB;IAArC;QACE;;WAEG;QAUH,mBAAc,GAAI,MAAM,CAA4B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QAErE;;;WAGG;QAQH,kBAAa,GAAI,MAAM,CAA2B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QAEnE;;;WAGG;QASH,gBAAW,GAAG,MAAM,EAA6D,CAAC;QAElF;;WAEG;QACH,aAAQ,GAAI,MAAM,CAAU,IAAI,CAAC,CAAC;QAElC;;WAEG;QAMH,yBAAoB,GAAI,MAAM,CAAwC,EAAE,CAAC,CAAC;QAE1E;;;;WAIG;QAWH,wBAAmB,GAAI,MAAM,CAA2E,IAAI,CAAC,CAAC;QAE9G;;;WAGG;QAKH,gBAAW,GAAI,MAAM,CAAgB,IAAI,CAAC,CAAC;QAE3C;;;;WAIG;QAWH,0BAAqB,GAAI,MAAM,CAA6E,IAAI,CAAC,CAAC;QAElH;;WAEG;QAEH,mBAAc,GAAG,MAAM,EAAU,CAAC;QAElC;;WAEG;QAMH,yBAAoB,GAAI,MAAM,CAAkC,mBAAmB,CAAC,CAAC;IACvF,CAAC;CAAA;AAvGC;IATC,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAiD,EAAc,EAAE,CAAC,CAAC,CAAC,GAAG,KAAM,CAAC,CAAC;QAC1F,OAAO,EAAE;YACP,MAAM,EAAE,CAAC,KAAe,EAAW,EAAE,CACnC,0BAA0B,CAAC,IAAI,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAChF;SACJ;KACF,CAAC;;gEACmE;AAarE;IAPC,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAgD,EAAc,EAAE,CAAC,CAAC,CAAC,GAAG,KAAM,CAAC,CAAC;QACzF,OAAO,EAAE;YACP,MAAM,EAAE,CAAC,KAAe,EAAW,EAAE,CACnC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;SAClH;KACF,CAAC;;+DACiE;AAcnE;IARC,QAAQ,CAAC;QACR,OAAO,EAAE;YACP,MAAM,EAAE,CAAC,KAA8C,EAAW,EAAE,CAClE,KAAK,CAAC,IAAI,KAAK,SAAS;gBACtB,CAAC,CAAE,iCAAuD,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC/E,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;SACvD;KACF,CAAC;;6DACgF;AAelF;IALC,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAuD,EAAyC,EAAE,CAC3G,KAAM;QACR,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,mCAAmC,EAAE,EAAE;KACvE,CAAC;;sEACwE;AAiB1E;IAVC,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAsD,EAAgC,EAAE,CACjG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;QACtB,OAAO,EAAE;YACP,MAAM,EAAE,CAAC,KAAiC,EAAW,EAAE,CACrD,KAAK,CAAC,IAAI,KAAK,SAAS;gBACtB,CAAC,CAAE,0CAAgE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBACxF,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;SACvD;KACF,CAAC;;qEAC4G;AAU9G;IAJC,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAA8C,EAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;6DACyC;AAiB3C;IAVC,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAwD,EAAgC,EAAE,CACnG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;QACtB,OAAO,EAAE;YACP,MAAM,EAAE,CAAC,KAAiC,EAAW,EAAE,CACrD,KAAK,CAAC,IAAI,KAAK,SAAS;gBACtB,CAAC,CAAE,4CAAkE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC1F,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;SACvD;KACF,CAAC;;uEACgH;AAMlH;IADC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;;gEACN;AAUlC;IALC,QAAQ,CAAC;QACR,OAAO,EAAE;YACP,MAAM,EAAE,CAAC,KAAa,EAAW,EAAE,CAAE,mCAAyD,CAAC,QAAQ,CAAC,KAAK,CAAC;SAC/G;KACF,CAAC;;sEACmF"}

package/dist/resources/cloudfront-distribution/cloudfront-distribution.resource.d.ts

@@ -0,0 +1,129 @@
+import { ATerraformResource, Diff, type MatchingResource, type TerraformModuleScope } from '@quadnix/octo';
+import type { AlbSchema } from '../alb/index.schema.js';
+import type { LambdaFunctionSchema } from '../lambda-function/index.schema.js';
+import { CloudFrontDistributionSchema } from './index.schema.js';
+/**
+ * @internal
+ */
+export declare class CloudFrontDistribution extends ATerraformResource<CloudFrontDistributionSchema, CloudFrontDistribution> {
+    parents: (MatchingResource<AlbSchema> | MatchingResource<LambdaFunctionSchema>)[];
+    properties: CloudFrontDistributionSchema['properties'];
+    response: CloudFrontDistributionSchema['response'];
+    /**
+     * A distribution is built with no parents. The functions and ALBs it serves are attached later,
+     * with `addLambdaOrigin()` and `addAlbOrigin()`, by the actions that find them.
+     *
+     * @internal
+     */
+    constructor(resourceId: string, properties: CloudFrontDistributionSchema['properties']);
+    /**
+     * How a policy reference is looked up once every policy has been emitted.
+     *
+     * @internal
+     */
+    private static policyKey;
+    /**
+     * Attaches an ALB to the `alb` origin `originId`, making the ALB a parent of this distribution.
+     * The origin reads its host name off the ALB, which AWS assigns when the ALB is created, so the ALB
+     * has to exist first.
+     *
+     * The origin itself is declared with the distribution, since behaviors name it from the start.
+     * This method only supplies the ALB behind it.
+     *
+     * @internal
+     */
+    addAlbOrigin(originId: string, alb: MatchingResource<AlbSchema>): void;
+    /**
+     * Attaches a Lambda function to the `lambda` origin `originId`, making the function a parent of
+     * this distribution. The origin reads its host name off the function's URL, which AWS assigns when
+     * the URL is created, so the function has to exist first.
+     *
+     * The origin itself is declared with the distribution, since behaviors name it from the start.
+     * This method only supplies the function behind it.
+     *
+     * CloudFront waits 60 seconds for the function to answer, so a function allowed to run longer is
+     * refused: CloudFront would give up on a request the function is still serving.
+     *
+     * @internal
+     */
+    addLambdaOrigin(originId: string, lambdaFunction: MatchingResource<LambdaFunctionSchema>): void;
+    /**
+     * Nothing about a distribution is force-new. Origins, behaviors, aliases, the certificate, the WAF
+     * association - AWS edits all of them in place on a live distribution, so every change is an
+     * update. What is left is identity, and the distribution's name is already in the resource id, so
+     * only the account can move a distribution to being a different one.
+     *
+     * @internal
+     */
+    diffProperties(previous: CloudFrontDistribution): Promise<Diff[]>;
+    /**
+     * @internal
+     */
+    toHCL(terraform: TerraformModuleScope): Promise<void>;
+    /**
+     * Makes the resource behind an `alb` or `lambda` origin a parent of this distribution, and records
+     * its resource id on the origin.
+     *
+     * @internal
+     */
+    private attachOriginParent;
+    /**
+     * Every managed policy a behavior names, paired with the slot it fills.
+     *
+     * @internal
+     */
+    private collectManagedPolicyReferences;
+    /**
+     * The behavior claiming everything no other behavior did.
+     *
+     * @internal
+     */
+    private getDefaultBehavior;
+    /**
+     * The behaviors matched, in order, before the default one.
+     *
+     * @internal
+     */
+    private getOrderedBehaviors;
+    /**
+     * The parent an origin reads its hostname from.
+     *
+     * @internal
+     */
+    private getOriginParent;
+    /**
+     * @internal
+     */
+    private renderBehavior;
+    /**
+     * @internal
+     */
+    private renderOrigin;
+    /**
+     * One origin access control per S3 or Lambda origin. It is what lets the distribution sign its
+     * requests to a bucket or a function URL that admits nothing else.
+     *
+     * @internal
+     */
+    private renderOriginAccessControls;
+    /**
+     * Emits every policy the behaviors reach for, and returns the id expression each reference
+     * resolves to.
+     *
+     * A managed policy is read by name through a `data` block, so the id AWS assigns is never written
+     * down here. A custom policy is created, and only the behaviors of this distribution can name it.
+     *
+     * @internal
+     */
+    private renderPolicies;
+    /**
+     * Everything a distribution says about itself that terraform would only reject later, or that AWS
+     * would accept and then serve wrongly.
+     *
+     * @internal
+     * @throws If ids collide or do not resolve, if an alias has no certificate to serve it, if the
+     * certificate is not one CloudFront can read, if a behavior caches a method it does not allow, or if
+     * a CloudFront Function is bound to an event it cannot run on.
+     */
+    private validateReferences;
+}