@quiltdata/benchling-webhook 0.5.4 → 0.6.1-20251104T043302Z
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +295 -12
- package/dist/bin/benchling-webhook.d.ts +1 -1
- package/dist/bin/benchling-webhook.d.ts.map +1 -1
- package/dist/bin/benchling-webhook.js +12 -22
- package/dist/bin/benchling-webhook.js.map +1 -1
- package/dist/bin/cdk-dev.js +59 -3
- package/dist/bin/cli.js +27 -9
- package/dist/bin/cli.js.map +1 -1
- package/dist/bin/commands/deploy.d.ts +6 -2
- package/dist/bin/commands/deploy.d.ts.map +1 -1
- package/dist/bin/commands/deploy.js +151 -90
- package/dist/bin/commands/deploy.js.map +1 -1
- package/dist/bin/commands/setup-wizard.d.ts +22 -0
- package/dist/bin/commands/setup-wizard.d.ts.map +1 -0
- package/dist/bin/commands/setup-wizard.js +47 -0
- package/dist/bin/commands/setup-wizard.js.map +1 -0
- package/dist/bin/config-profiles.d.ts +59 -0
- package/dist/bin/config-profiles.d.ts.map +1 -0
- package/dist/bin/config-profiles.js +272 -0
- package/dist/bin/config-profiles.js.map +1 -0
- package/dist/bin/create-secret.d.ts +25 -0
- package/dist/bin/create-secret.d.ts.map +1 -0
- package/dist/bin/create-secret.js +239 -0
- package/dist/bin/create-secret.js.map +1 -0
- package/dist/lib/benchling-auth-validator.d.ts +65 -0
- package/dist/lib/benchling-auth-validator.d.ts.map +1 -0
- package/dist/lib/benchling-auth-validator.js +213 -0
- package/dist/lib/benchling-auth-validator.js.map +1 -0
- package/dist/lib/benchling-webhook-stack.d.ts +13 -10
- package/dist/lib/benchling-webhook-stack.d.ts.map +1 -1
- package/dist/lib/benchling-webhook-stack.js +25 -69
- package/dist/lib/benchling-webhook-stack.js.map +1 -1
- package/dist/lib/config-logger.d.ts +191 -0
- package/dist/lib/config-logger.d.ts.map +1 -0
- package/dist/lib/config-logger.js +372 -0
- package/dist/lib/config-logger.js.map +1 -0
- package/dist/lib/configuration-saver.d.ts +75 -0
- package/dist/lib/configuration-saver.d.ts.map +1 -0
- package/dist/lib/configuration-saver.js +145 -0
- package/dist/lib/configuration-saver.js.map +1 -0
- package/dist/lib/configuration-validator.d.ts +63 -0
- package/dist/lib/configuration-validator.d.ts.map +1 -0
- package/dist/lib/configuration-validator.js +136 -0
- package/dist/lib/configuration-validator.js.map +1 -0
- package/dist/lib/configuration-wizard.d.ts +52 -0
- package/dist/lib/configuration-wizard.d.ts.map +1 -0
- package/dist/lib/configuration-wizard.js +193 -0
- package/dist/lib/configuration-wizard.js.map +1 -0
- package/dist/lib/fargate-service.d.ts +18 -9
- package/dist/lib/fargate-service.d.ts.map +1 -1
- package/dist/lib/fargate-service.js +177 -61
- package/dist/lib/fargate-service.js.map +1 -1
- package/dist/lib/quilt-config-resolver.d.ts +53 -0
- package/dist/lib/quilt-config-resolver.d.ts.map +1 -0
- package/dist/lib/quilt-config-resolver.js +100 -0
- package/dist/lib/quilt-config-resolver.js.map +1 -0
- package/dist/lib/s3-bucket-validator.d.ts +76 -0
- package/dist/lib/s3-bucket-validator.d.ts.map +1 -0
- package/dist/lib/s3-bucket-validator.js +237 -0
- package/dist/lib/s3-bucket-validator.js.map +1 -0
- package/dist/lib/types/config.d.ts +398 -0
- package/dist/lib/types/config.d.ts.map +1 -0
- package/dist/lib/types/config.js +11 -0
- package/dist/lib/types/config.js.map +1 -0
- package/dist/lib/utils/config-loader.d.ts +48 -0
- package/dist/lib/utils/config-loader.d.ts.map +1 -0
- package/dist/lib/utils/config-loader.js +109 -0
- package/dist/lib/utils/config-loader.js.map +1 -0
- package/dist/lib/utils/config-resolver.d.ts +138 -0
- package/dist/lib/utils/config-resolver.d.ts.map +1 -0
- package/dist/lib/utils/config-resolver.js +272 -0
- package/dist/lib/utils/config-resolver.js.map +1 -0
- package/dist/lib/utils/config.d.ts +50 -0
- package/dist/lib/utils/config.d.ts.map +1 -1
- package/dist/lib/utils/config.js +86 -0
- package/dist/lib/utils/config.js.map +1 -1
- package/dist/lib/utils/secrets.d.ts +174 -0
- package/dist/lib/utils/secrets.d.ts.map +1 -0
- package/dist/lib/utils/secrets.js +351 -0
- package/dist/lib/utils/secrets.js.map +1 -0
- package/dist/lib/xdg-cli-wrapper.d.ts +113 -0
- package/dist/lib/xdg-cli-wrapper.d.ts.map +1 -0
- package/dist/lib/xdg-cli-wrapper.js +288 -0
- package/dist/lib/xdg-cli-wrapper.js.map +1 -0
- package/dist/lib/xdg-config.d.ts +187 -0
- package/dist/lib/xdg-config.d.ts.map +1 -0
- package/dist/lib/xdg-config.js +562 -0
- package/dist/lib/xdg-config.js.map +1 -0
- package/dist/package.json +34 -26
- package/dist/scripts/config-health-check.d.ts +78 -0
- package/dist/scripts/config-health-check.d.ts.map +1 -0
- package/dist/scripts/config-health-check.js +559 -0
- package/dist/scripts/config-health-check.js.map +1 -0
- package/dist/scripts/infer-quilt-config.d.ts +50 -0
- package/dist/scripts/infer-quilt-config.d.ts.map +1 -0
- package/dist/scripts/infer-quilt-config.js +353 -0
- package/dist/scripts/infer-quilt-config.js.map +1 -0
- package/dist/scripts/install-wizard.d.ts +34 -0
- package/dist/scripts/install-wizard.d.ts.map +1 -0
- package/dist/scripts/install-wizard.js +719 -0
- package/dist/scripts/install-wizard.js.map +1 -0
- package/dist/scripts/sync-secrets.d.ts +63 -0
- package/dist/scripts/sync-secrets.d.ts.map +1 -0
- package/dist/scripts/sync-secrets.js +424 -0
- package/dist/scripts/sync-secrets.js.map +1 -0
- package/env.template +60 -47
- package/package.json +34 -26
package/README.md
CHANGED
|
@@ -7,26 +7,65 @@ Connects Benchling lab notebook entries to Quilt data packages via webhooks.
|
|
|
7
7
|
- `npx` from Node.js 18+ ([download](https://nodejs.org))
|
|
8
8
|
- [AWS credentials](https://docs.aws.amazon.com/cli/v1/userguide/cli-configure-files.html) configured
|
|
9
9
|
- Existing [Quilt deployment](https://www.quilt.bio/install)
|
|
10
|
+
- Benchling tenant with OAuth app configured
|
|
10
11
|
|
|
11
12
|
## Setup
|
|
12
13
|
|
|
13
14
|
### 1. Create Benchling App
|
|
14
15
|
|
|
15
16
|
```bash
|
|
16
|
-
npx @quiltdata/benchling-webhook manifest
|
|
17
|
+
npx @quiltdata/benchling-webhook@latest manifest
|
|
17
18
|
```
|
|
18
19
|
|
|
19
20
|
Follow the displayed instructions to [upload the manifest](https://docs.benchling.com/docs/getting-started-benchling-apps#creating-an-app-from-a-manifest) to Benchling and get your App Definition ID.
|
|
20
21
|
|
|
21
|
-
### 2.
|
|
22
|
+
### 2. Store Benchling Secrets in AWS Secrets Manager
|
|
23
|
+
|
|
24
|
+
Create a secret in AWS Secrets Manager with your Benchling credentials:
|
|
25
|
+
|
|
26
|
+
```bash
|
|
27
|
+
aws secretsmanager create-secret \
|
|
28
|
+
--name benchling-webhook-credentials \
|
|
29
|
+
--description "Benchling OAuth credentials" \
|
|
30
|
+
--secret-string '{
|
|
31
|
+
"client_id": "your-benchling-client-id",
|
|
32
|
+
"client_secret": "your-benchling-client-secret",
|
|
33
|
+
"tenant": "your-tenant",
|
|
34
|
+
"app_definition_id": "your-app-definition-id"
|
|
35
|
+
}'
|
|
36
|
+
```
|
|
37
|
+
|
|
38
|
+
> **Note**: The secret must contain `client_id`, `client_secret`, and `tenant`. The `app_definition_id` is optional but recommended.
|
|
39
|
+
|
|
40
|
+
### 3. Deploy to AWS (Secrets-Only Mode - v0.6.0+)
|
|
41
|
+
|
|
42
|
+
**Recommended: Secrets-Only Mode** - Minimal configuration, all settings resolved from AWS:
|
|
22
43
|
|
|
23
44
|
```bash
|
|
24
|
-
npx @quiltdata/benchling-webhook
|
|
45
|
+
npx @quiltdata/benchling-webhook@latest deploy \
|
|
46
|
+
--quilt-stack-arn "arn:aws:cloudformation:us-east-1:123456789012:stack/QuiltStack/abc123" \
|
|
47
|
+
--benchling-secret "benchling-webhook-credentials"
|
|
25
48
|
```
|
|
26
49
|
|
|
27
|
-
|
|
50
|
+
That's it! The deployment automatically resolves:
|
|
28
51
|
|
|
29
|
-
|
|
52
|
+
- Quilt catalog URL from your stack
|
|
53
|
+
- S3 bucket configuration
|
|
54
|
+
- Athena database name
|
|
55
|
+
- SQS queue ARN
|
|
56
|
+
- AWS region and account
|
|
57
|
+
|
|
58
|
+
**Alternative: Legacy Mode** - For existing deployments or manual configuration:
|
|
59
|
+
|
|
60
|
+
```bash
|
|
61
|
+
npx @quiltdata/benchling-webhook@latest deploy \
|
|
62
|
+
--benchling-secrets @benchling-secrets.json \
|
|
63
|
+
--catalog your-catalog.quiltdata.com
|
|
64
|
+
```
|
|
65
|
+
|
|
66
|
+
**See [Secrets Configuration Guide](./docs/SECRETS_CONFIGURATION.md) and [Migration Guide](./docs/MIGRATION_GUIDE_V06.md) for more options**
|
|
67
|
+
|
|
68
|
+
### 4. Install in Benchling
|
|
30
69
|
|
|
31
70
|
After deployment, you'll receive a webhook URL. Set it in your Benchling app settings and [install the app](https://docs.benchling.com/docs/getting-started-benchling-apps#installing-your-app) in your tenant.
|
|
32
71
|
|
|
@@ -34,12 +73,173 @@ After deployment, you'll receive a webhook URL. Set it in your Benchling app set
|
|
|
34
73
|
|
|
35
74
|
In Benchling: Create entry → Insert Canvas → "Quilt Integration" → Create/Update package
|
|
36
75
|
|
|
76
|
+
## Configuration
|
|
77
|
+
|
|
78
|
+
### Deployment Modes (v0.6.0+)
|
|
79
|
+
|
|
80
|
+
#### Secrets-Only Mode (Recommended)
|
|
81
|
+
|
|
82
|
+
The simplest deployment method - just provide two parameters:
|
|
83
|
+
|
|
84
|
+
```bash
|
|
85
|
+
npx @quiltdata/benchling-webhook@latest deploy \
|
|
86
|
+
--quilt-stack-arn "arn:aws:cloudformation:region:account:stack/QuiltStack/id" \
|
|
87
|
+
--benchling-secret "my-secret-name"
|
|
88
|
+
```
|
|
89
|
+
|
|
90
|
+
**Benefits**:
|
|
91
|
+
|
|
92
|
+
- ✅ Minimal configuration - only 2 parameters needed
|
|
93
|
+
- ✅ Centralized secrets in AWS Secrets Manager
|
|
94
|
+
- ✅ Automatic configuration resolution from CloudFormation
|
|
95
|
+
- ✅ No manual parameter updates when infrastructure changes
|
|
96
|
+
- ✅ Better security - no secrets in CI/CD pipelines
|
|
97
|
+
|
|
98
|
+
**How to find your Quilt Stack ARN**:
|
|
99
|
+
|
|
100
|
+
```bash
|
|
101
|
+
# List your CloudFormation stacks
|
|
102
|
+
aws cloudformation describe-stacks --query 'Stacks[?contains(StackName, `Quilt`)].StackId'
|
|
103
|
+
|
|
104
|
+
# Or from the AWS Console → CloudFormation → Stack Details → Stack info → ARN
|
|
105
|
+
```
|
|
106
|
+
|
|
107
|
+
#### Legacy Mode
|
|
108
|
+
|
|
109
|
+
For existing deployments or manual configuration:
|
|
110
|
+
|
|
111
|
+
```bash
|
|
112
|
+
# Option 1: Inline JSON
|
|
113
|
+
npx @quiltdata/benchling-webhook@latest deploy \
|
|
114
|
+
--benchling-secrets '{"client_id":"xxx","client_secret":"yyy","tenant":"company"}' \
|
|
115
|
+
--catalog your-catalog.quiltdata.com
|
|
116
|
+
|
|
117
|
+
# Option 2: JSON File
|
|
118
|
+
npx @quiltdata/benchling-webhook@latest deploy \
|
|
119
|
+
--benchling-secrets @benchling-secrets.json \
|
|
120
|
+
--catalog your-catalog.quiltdata.com
|
|
121
|
+
|
|
122
|
+
# Option 3: AWS Secrets Manager ARN
|
|
123
|
+
npx @quiltdata/benchling-webhook@latest deploy \
|
|
124
|
+
--benchling-secrets "arn:aws:secretsmanager:region:account:secret:name" \
|
|
125
|
+
--catalog your-catalog.quiltdata.com
|
|
126
|
+
```
|
|
127
|
+
|
|
128
|
+
**📖 [Complete Configuration Guide](./docs/SECRETS_CONFIGURATION.md)**
|
|
129
|
+
**📖 [Migration Guide to v0.6.0](./docs/MIGRATION_GUIDE_V06.md)**
|
|
130
|
+
|
|
131
|
+
### Secret Format
|
|
132
|
+
|
|
133
|
+
**Required fields**:
|
|
134
|
+
|
|
135
|
+
- `client_id`: Benchling OAuth client ID
|
|
136
|
+
- `client_secret`: Benchling OAuth client secret
|
|
137
|
+
- `tenant`: Benchling tenant name (e.g., "company" for company.benchling.com)
|
|
138
|
+
|
|
139
|
+
**Optional fields**:
|
|
140
|
+
|
|
141
|
+
- `app_definition_id`: Benchling app definition ID
|
|
142
|
+
- `api_url`: Custom Benchling API URL
|
|
143
|
+
|
|
144
|
+
**Example**:
|
|
145
|
+
|
|
146
|
+
```json
|
|
147
|
+
{
|
|
148
|
+
"client_id": "abc123",
|
|
149
|
+
"client_secret": "secret_key",
|
|
150
|
+
"tenant": "mycompany",
|
|
151
|
+
"app_definition_id": "app_def_123"
|
|
152
|
+
}
|
|
153
|
+
```
|
|
154
|
+
|
|
155
|
+
### Updating Secrets
|
|
156
|
+
|
|
157
|
+
To update Benchling credentials after deployment:
|
|
158
|
+
|
|
159
|
+
**Method 1: Update in AWS Secrets Manager (Recommended)**
|
|
160
|
+
|
|
161
|
+
```bash
|
|
162
|
+
aws secretsmanager update-secret \
|
|
163
|
+
--secret-id benchling-webhook/credentials \
|
|
164
|
+
--secret-string '{"client_id":"new_id","client_secret":"new_secret","tenant":"company"}'
|
|
165
|
+
|
|
166
|
+
# Restart ECS service to pick up changes
|
|
167
|
+
aws ecs update-service \
|
|
168
|
+
--cluster benchling-webhook-cluster \
|
|
169
|
+
--service benchling-webhook-service \
|
|
170
|
+
--force-new-deployment
|
|
171
|
+
```
|
|
172
|
+
|
|
173
|
+
**Method 2: Redeploy Stack**
|
|
174
|
+
|
|
175
|
+
```bash
|
|
176
|
+
npx @quiltdata/benchling-webhook@latest deploy \
|
|
177
|
+
--benchling-secrets @updated-secrets.json
|
|
178
|
+
```
|
|
179
|
+
|
|
180
|
+
## All Available Commands
|
|
181
|
+
|
|
37
182
|
For all available commands, run:
|
|
38
183
|
|
|
39
184
|
```bash
|
|
40
|
-
npx @quiltdata/benchling-webhook --help
|
|
185
|
+
npx @quiltdata/benchling-webhook@latest --help
|
|
41
186
|
```
|
|
42
187
|
|
|
188
|
+
### Commands
|
|
189
|
+
|
|
190
|
+
- `deploy` - Deploy the CDK stack to AWS (default command)
|
|
191
|
+
- `init` - Initialize configuration interactively
|
|
192
|
+
- `validate` - Validate configuration without deploying
|
|
193
|
+
- `test` - Test the deployed webhook endpoint
|
|
194
|
+
- `manifest` - Generate Benchling app manifest file
|
|
195
|
+
|
|
196
|
+
### Deploy Options
|
|
197
|
+
|
|
198
|
+
```bash
|
|
199
|
+
npx @quiltdata/benchling-webhook@latest deploy [options]
|
|
200
|
+
```
|
|
201
|
+
|
|
202
|
+
**Secrets-Only Mode (v0.6.0+ - Recommended)**:
|
|
203
|
+
|
|
204
|
+
- `--quilt-stack-arn <arn>` - ARN of Quilt CloudFormation stack
|
|
205
|
+
- `--benchling-secret <name>` - Name or ARN of Benchling secret in Secrets Manager
|
|
206
|
+
|
|
207
|
+
**Legacy Mode Configuration**:
|
|
208
|
+
|
|
209
|
+
- `--benchling-secrets <value>` - Benchling secrets (ARN, JSON, or @file)
|
|
210
|
+
- `--catalog <url>` - Quilt catalog URL
|
|
211
|
+
- `--bucket <name>` - S3 bucket for data
|
|
212
|
+
|
|
213
|
+
**AWS Configuration**:
|
|
214
|
+
|
|
215
|
+
- `--profile <name>` - AWS profile to use
|
|
216
|
+
- `--region <region>` - AWS region to deploy to (auto-detected in secrets-only mode)
|
|
217
|
+
- `--image-tag <tag>` - Docker image tag to deploy (default: latest)
|
|
218
|
+
|
|
219
|
+
**Deployment Options**:
|
|
220
|
+
|
|
221
|
+
- `--env-file <path>` - Path to .env file (default: .env)
|
|
222
|
+
- `--yes` - Skip confirmation prompts
|
|
223
|
+
- `--no-bootstrap-check` - Skip CDK bootstrap verification
|
|
224
|
+
- `--require-approval <level>` - CDK approval level (default: never)
|
|
225
|
+
|
|
226
|
+
### Deprecated Parameters (v0.6.0+)
|
|
227
|
+
|
|
228
|
+
> ⚠️ **Warning**: The following parameters are deprecated and will be removed in v1.0.0
|
|
229
|
+
|
|
230
|
+
- `--tenant` - Use `--benchling-secrets` or secrets-only mode instead
|
|
231
|
+
- `--client-id` - Use `--benchling-secrets` or secrets-only mode instead
|
|
232
|
+
- `--client-secret` - Use `--benchling-secrets` or secrets-only mode instead
|
|
233
|
+
- `--app-id` - Use `--benchling-secrets` or secrets-only mode instead
|
|
234
|
+
|
|
235
|
+
**Migration guide**: See [Migration Guide to v0.6.0](./docs/MIGRATION_GUIDE_V06.md)
|
|
236
|
+
|
|
237
|
+
## Documentation
|
|
238
|
+
|
|
239
|
+
- 📖 [Secrets Configuration Guide](./docs/SECRETS_CONFIGURATION.md) - Comprehensive secrets management documentation
|
|
240
|
+
- 📖 [Architecture Decision Record: Secrets Management](./docs/ADR-001-SECRETS-MANAGEMENT.md) - Design decisions and rationale
|
|
241
|
+
- 📖 [CHANGELOG.md](./CHANGELOG.md) - Version history and release notes
|
|
242
|
+
|
|
43
243
|
## Development
|
|
44
244
|
|
|
45
245
|
For local development and contributing:
|
|
@@ -47,16 +247,99 @@ For local development and contributing:
|
|
|
47
247
|
```bash
|
|
48
248
|
git clone https://github.com/quiltdata/benchling-webhook.git
|
|
49
249
|
cd benchling-webhook
|
|
50
|
-
npm install
|
|
51
250
|
|
|
52
|
-
#
|
|
53
|
-
npm run
|
|
54
|
-
|
|
251
|
+
# Install dependencies and configure (interactive)
|
|
252
|
+
npm run setup
|
|
253
|
+
|
|
254
|
+
# Build package
|
|
255
|
+
npm run build
|
|
256
|
+
```
|
|
257
|
+
|
|
258
|
+
### Testing Workflow
|
|
259
|
+
|
|
260
|
+
```bash
|
|
261
|
+
# 1. Run unit tests (lint + typecheck + mocked tests)
|
|
262
|
+
npm run test
|
|
263
|
+
|
|
264
|
+
# 2. Run local integration tests (builds Docker, uses real Benchling payloads)
|
|
265
|
+
npm run test:local
|
|
266
|
+
|
|
267
|
+
# 3. Run remote integration tests (deploys dev stack, tests through API Gateway)
|
|
268
|
+
npm run test:remote
|
|
55
269
|
|
|
56
|
-
|
|
57
|
-
npm run
|
|
270
|
+
# Individual test commands
|
|
271
|
+
npm run test:ts # TypeScript tests only
|
|
272
|
+
npm run test:python # Python unit tests only
|
|
273
|
+
npm run build:typecheck # Type checking only
|
|
274
|
+
npm run lint # Linting only
|
|
58
275
|
```
|
|
59
276
|
|
|
277
|
+
### Release Workflow
|
|
278
|
+
|
|
279
|
+
```bash
|
|
280
|
+
# Create and push version tag (triggers release pipeline)
|
|
281
|
+
npm run release:tag
|
|
282
|
+
|
|
283
|
+
# CI will run:
|
|
284
|
+
# - npm run test:remote (builds dev image, deploys dev stack, tests)
|
|
285
|
+
# - npm run release (promotes to production after tests pass)
|
|
286
|
+
```
|
|
287
|
+
|
|
288
|
+
## Troubleshooting
|
|
289
|
+
|
|
290
|
+
### Common Issues
|
|
291
|
+
|
|
292
|
+
**Error: "Invalid secret ARN format"**
|
|
293
|
+
|
|
294
|
+
- Verify ARN format: `arn:aws:secretsmanager:region:account:secret:name`
|
|
295
|
+
- See [Troubleshooting Guide](./docs/SECRETS_CONFIGURATION.md#troubleshooting)
|
|
296
|
+
|
|
297
|
+
**Error: "Missing required field: client_id"**
|
|
298
|
+
|
|
299
|
+
- Check secret JSON includes all required fields: `client_id`, `client_secret`, `tenant`
|
|
300
|
+
- Validate JSON syntax: `echo '{"client_id":"..."}' | jq .`
|
|
301
|
+
|
|
302
|
+
**Deprecation Warning**
|
|
303
|
+
|
|
304
|
+
- Migrate to `--benchling-secrets` parameter
|
|
305
|
+
- See [Migration Guide](./docs/SECRETS_CONFIGURATION.md#migration-guide)
|
|
306
|
+
|
|
307
|
+
**For more help**: See [Secrets Configuration - Troubleshooting](./docs/SECRETS_CONFIGURATION.md#troubleshooting)
|
|
308
|
+
|
|
309
|
+
## Security
|
|
310
|
+
|
|
311
|
+
- Secrets are stored in AWS Secrets Manager with encryption at rest
|
|
312
|
+
- Secrets are masked in all CLI output
|
|
313
|
+
- CloudFormation parameters use `noEcho: true`
|
|
314
|
+
- IAM policies grant least-privilege access
|
|
315
|
+
- CloudTrail logs all secret access for audit
|
|
316
|
+
|
|
317
|
+
**Best Practices**:
|
|
318
|
+
|
|
319
|
+
- Never commit secrets to version control
|
|
320
|
+
- Use AWS Secrets Manager for production deployments
|
|
321
|
+
- Rotate secrets regularly
|
|
322
|
+
- Review IAM policies periodically
|
|
323
|
+
|
|
324
|
+
**For detailed security guidance**: See [Secrets Configuration - Security](./docs/SECRETS_CONFIGURATION.md#security-best-practices)
|
|
325
|
+
|
|
326
|
+
## Support
|
|
327
|
+
|
|
328
|
+
- 🐛 [Report Issues](https://github.com/quiltdata/benchling-webhook/issues)
|
|
329
|
+
- 📧 Security vulnerabilities: <security@quiltdata.com>
|
|
330
|
+
- 📖 [Documentation](./docs/)
|
|
331
|
+
- 💬 [Discussions](https://github.com/quiltdata/benchling-webhook/discussions)
|
|
332
|
+
|
|
60
333
|
## License
|
|
61
334
|
|
|
62
335
|
Apache-2.0
|
|
336
|
+
|
|
337
|
+
## Version
|
|
338
|
+
|
|
339
|
+
See [CHANGELOG.md](./CHANGELOG.md) for version history.
|
|
340
|
+
|
|
341
|
+
**Important:** Always use `@latest` with npx to avoid caching issues:
|
|
342
|
+
|
|
343
|
+
```bash
|
|
344
|
+
npx @quiltdata/benchling-webhook@latest --help
|
|
345
|
+
```
|
|
@@ -43,7 +43,7 @@ export declare function checkCdkBootstrap(account: string, region: string): Prom
|
|
|
43
43
|
export declare function inferConfiguration(catalogUrl: string): Promise<InferenceResult>;
|
|
44
44
|
/**
|
|
45
45
|
* Create CDK app and stack (synthesis only, no deployment)
|
|
46
|
-
*
|
|
46
|
+
* Secrets-only mode (v0.6.0+) - requires QUILT_STACK_ARN and BENCHLING_SECRET
|
|
47
47
|
*/
|
|
48
48
|
export declare function createStack(config: Config): DeploymentResult;
|
|
49
49
|
export { inferStackConfig };
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"benchling-webhook.d.ts","sourceRoot":"","sources":["../../bin/benchling-webhook.ts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AACvB,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAEvE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAIlD,QAAA,MAAQ,gBAAgB,KAA4B,CAAC;AAErD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC;IACb,KAAK,EAAE,qBAAqB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACnC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACf,OAAO,CAAC,eAAe,CAAC,CAsC1B;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAoBrF;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,
|
|
1
|
+
{"version":3,"file":"benchling-webhook.d.ts","sourceRoot":"","sources":["../../bin/benchling-webhook.ts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AACvB,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAEvE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAIlD,QAAA,MAAQ,gBAAgB,KAA4B,CAAC;AAErD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC;IACb,KAAK,EAAE,qBAAqB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACnC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACf,OAAO,CAAC,eAAe,CAAC,CAsC1B;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAoBrF;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAuB5D;AAuKD,OAAO,EAAE,gBAAgB,EAAE,CAAC"}
|
|
@@ -107,7 +107,7 @@ async function inferConfiguration(catalogUrl) {
|
|
|
107
107
|
}
|
|
108
108
|
/**
|
|
109
109
|
* Create CDK app and stack (synthesis only, no deployment)
|
|
110
|
-
*
|
|
110
|
+
* Secrets-only mode (v0.6.0+) - requires QUILT_STACK_ARN and BENCHLING_SECRET
|
|
111
111
|
*/
|
|
112
112
|
function createStack(config) {
|
|
113
113
|
const app = new cdk.App();
|
|
@@ -116,16 +116,9 @@ function createStack(config) {
|
|
|
116
116
|
account: config.cdkAccount,
|
|
117
117
|
region: config.cdkRegion,
|
|
118
118
|
},
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
|
|
122
|
-
prefix: config.pkgPrefix || "benchling",
|
|
123
|
-
benchlingClientId: config.benchlingClientId,
|
|
124
|
-
benchlingClientSecret: config.benchlingClientSecret,
|
|
125
|
-
benchlingTenant: config.benchlingTenant,
|
|
126
|
-
quiltCatalog: config.quiltCatalog,
|
|
127
|
-
quiltDatabase: config.quiltDatabase,
|
|
128
|
-
webhookAllowList: config.webhookAllowList,
|
|
119
|
+
// Secrets-only mode parameters (v0.6.0+)
|
|
120
|
+
quiltStackArn: config.quiltStackArn,
|
|
121
|
+
benchlingSecret: config.benchlingSecret,
|
|
129
122
|
logLevel: config.logLevel || "INFO",
|
|
130
123
|
createEcrRepository: config.createEcrRepository === "true",
|
|
131
124
|
ecrRepositoryName: config.ecrRepositoryName || "quiltdata/benchling",
|
|
@@ -241,23 +234,20 @@ async function legacyMain() {
|
|
|
241
234
|
else {
|
|
242
235
|
console.log(`✓ CDK is bootstrapped (CDKToolkit stack: ${bootstrapStatus.status})\n`);
|
|
243
236
|
}
|
|
244
|
-
// Create stack
|
|
237
|
+
// Create stack - Secrets-only mode (v0.6.0+)
|
|
245
238
|
const app = new cdk.App();
|
|
239
|
+
// Get parameters from environment (set by CLI deploy command)
|
|
240
|
+
// These take precedence over legacy config
|
|
241
|
+
const quiltStackArn = process.env.QUILT_STACK_ARN || config.QUILT_STACK_ARN;
|
|
242
|
+
const benchlingSecret = process.env.BENCHLING_SECRET || config.BENCHLING_SECRET;
|
|
246
243
|
new benchling_webhook_stack_1.BenchlingWebhookStack(app, "BenchlingWebhookStack", {
|
|
247
244
|
env: {
|
|
248
245
|
account: config.CDK_DEFAULT_ACCOUNT,
|
|
249
246
|
region: config.CDK_DEFAULT_REGION,
|
|
250
247
|
},
|
|
251
|
-
|
|
252
|
-
|
|
253
|
-
|
|
254
|
-
prefix: config.PKG_PREFIX || "benchling",
|
|
255
|
-
benchlingClientId: config.BENCHLING_CLIENT_ID,
|
|
256
|
-
benchlingClientSecret: config.BENCHLING_CLIENT_SECRET,
|
|
257
|
-
benchlingTenant: config.BENCHLING_TENANT,
|
|
258
|
-
quiltCatalog: config.QUILT_CATALOG,
|
|
259
|
-
quiltDatabase: config.QUILT_DATABASE,
|
|
260
|
-
webhookAllowList: config.WEBHOOK_ALLOW_LIST,
|
|
248
|
+
// Secrets-only mode parameters (v0.6.0+)
|
|
249
|
+
quiltStackArn: quiltStackArn,
|
|
250
|
+
benchlingSecret: benchlingSecret,
|
|
261
251
|
logLevel: config.LOG_LEVEL || "INFO",
|
|
262
252
|
// ECR repository configuration
|
|
263
253
|
createEcrRepository: config.CREATE_ECR_REPOSITORY === "true",
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"benchling-webhook.js","sourceRoot":"","sources":["../../bin/benchling-webhook.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,8CAyCC;AAMD,gDAoBC;AAMD,
|
|
1
|
+
{"version":3,"file":"benchling-webhook.js","sourceRoot":"","sources":["../../bin/benchling-webhook.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,8CAyCC;AAMD,gDAoBC;AAMD,kCAuBC;AA5ID,yBAAuB;AACvB,iDAAmC;AACnC,4EAAuE;AACvE,iDAAyC;AAGzC,mCAAmC;AACnC,iEAAiE;AACjE,MAAM,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;AA2S5C,4CAAgB;AA3QzB;;;GAGG;AACI,KAAK,UAAU,iBAAiB,CACnC,OAAe,EACf,MAAc;IAEd,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,wBAAQ,EACnB,+CAA+C,MAAM,6EAA6E,EAClI,EAAE,QAAQ,EAAE,OAAO,EAAE,CACxB,CAAC;QAEF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAElC,IACI,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAC5C,WAAW,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EACnC,CAAC;YACC,OAAO;gBACH,YAAY,EAAE,KAAK;gBACnB,OAAO,EAAE,uCAAuC,OAAO,cAAc,MAAM,EAAE;gBAC7E,OAAO,EAAE,2BAA2B,OAAO,IAAI,MAAM,EAAE;aAC1D,CAAC;QACN,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,OAAO;gBACH,YAAY,EAAE,IAAI;gBAClB,MAAM,EAAE,WAAW;gBACnB,OAAO,EAAE,iCAAiC,WAAW,qCAAqC;aAC7F,CAAC;QACN,CAAC;QAED,OAAO;YACH,YAAY,EAAE,IAAI;YAClB,MAAM,EAAE,WAAW;SACtB,CAAC;IACN,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO;YACH,YAAY,EAAE,KAAK;YACnB,OAAO,EAAE,0CAA2C,KAAe,CAAC,OAAO,EAAE;SAChF,CAAC;IACN,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,kBAAkB,CAAC,UAAkB;IACvD,IAAI,CAAC;QACL,gBAAgB;QACZ,MAAM,aAAa,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC;YAC/C,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,WAAW,UAAU,EAAE,CAAC;QAE9B,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAErD,OAAO;YACH,OAAO,EAAE,IAAI;YACb,YAAY,EAAE,MAAM,CAAC,YAAY;SACpC,CAAC;IACN,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO;YACH,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,EAAE;YAChB,KAAK,EAAG,KAAe,CAAC,OAAO;SAClC,CAAC;IACN,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAgB,WAAW,CAAC,MAAc;IACtC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;IAE1B,MAAM,KAAK,GAAG,IAAI,+CAAqB,CAAC,GAAG,EAAE,uBAAuB,EAAE;QAClE,GAAG,EAAE;YACD,OAAO,EAAE,MAAM,CAAC,UAAU;YAC1B,MAAM,EAAE,MAAM,CAAC,SAAS;SAC3B;QACD,yCAAyC;QACzC,aAAa,EAAE,MAAM,CAAC,aAAc;QACpC,eAAe,EAAE,MAAM,CAAC,eAAgB;QACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,MAAM;QACnC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,KAAK,MAAM;QAC1D,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,qBAAqB;QACpE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,QAAQ;KACxC,CAAC,CAAC;IAEH,OAAO;QACH,GAAG;QACH,KAAK;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;KACzB,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,eAAe;IAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;IAC5B,IAAI,WAAW,GAA2B,EAAE,CAAC;IAE7C,sEAAsE;IACtE,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QACxB,IAAI,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,yCAAyC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;YAC9E,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACjC,WAAW,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,CACjE,CAAC;YACF,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACT,wDAAyD,KAAe,CAAC,OAAO,EAAE,CACrF,CAAC;YACF,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;IACL,CAAC;IAED,wDAAwD;IACxD,MAAM,MAAM,GAAG,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,EAAE,CAAC;IAE9C,yCAAyC;IACzC,MAAM,gBAAgB,GAAG;QACrB,eAAe;QACf,mBAAmB;QACnB,qBAAqB;QACrB,yBAAyB;QACzB,kBAAkB;KACrB,CAAC;IAEF,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3E,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAChE,WAAW,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC5B,OAAO,CAAC,KAAK,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,uCAAuC;IACvC,MAAM,oBAAoB,GAAG;QACzB,qBAAqB;QACrB,oBAAoB;QACpB,WAAW;QACX,gBAAgB;KACnB,CAAC;IAEF,MAAM,mBAAmB,GAAG,oBAAoB,CAAC,MAAM,CACnD,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAChC,CAAC;IAEF,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAChE,mBAAmB,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YACpC,OAAO,CAAC,KAAK,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CACT,0EAA0E,CAC7E,CAAC;QACF,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACrD,OAAO,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;QAChF,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAC;QACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,qCAAqC;IACrC,MAAM,uBAAuB,GAAG;QAC5B,kBAAkB;QAClB,qBAAqB;QACrB,yBAAyB;QACzB,6BAA6B;KACvB,CAAC;IAEX,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,MAAM,CACnD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAC5B,CAAC;IAEF,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CACT,mEAAmE,CACtE,CAAC;QACF,gBAAgB,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC;QACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,UAAU;IACrB,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;IAEvC,kBAAkB;IAClB,MAAM,eAAe,GAAG,MAAM,iBAAiB,CAC/C,MAAM,CAAC,mBAAoB,EAC3B,MAAM,CAAC,kBAAmB,CACzB,CAAC;IAEF,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACzC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACvC,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC1C,OAAO,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9C,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC7C,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACvC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,4CAA4C,eAAe,CAAC,MAAM,KAAK,CAAC,CAAC;IACzF,CAAC;IAED,6CAA6C;IAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;IAE1B,8DAA8D;IAC9D,2CAA2C;IAC3C,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC;IAC5E,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,MAAM,CAAC,gBAAgB,CAAC;IAEhF,IAAI,+CAAqB,CAAC,GAAG,EAAE,uBAAuB,EAAE;QACpD,GAAG,EAAE;YACD,OAAO,EAAE,MAAM,CAAC,mBAAmB;YACnC,MAAM,EAAE,MAAM,CAAC,kBAAkB;SACpC;QACD,yCAAyC;QACzC,aAAa,EAAE,aAAc;QAC7B,eAAe,EAAE,eAAgB;QACjC,QAAQ,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM;QACpC,+BAA+B;QAC/B,mBAAmB,EAAE,MAAM,CAAC,qBAAqB,KAAK,MAAM;QAC5D,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,IAAI,qBAAqB;KACzE,CAAC,CAAC;AACP,CAAC;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACzB,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;AACP,CAAC"}
|
package/dist/bin/cdk-dev.js
CHANGED
|
@@ -230,13 +230,69 @@ async function main() {
|
|
|
230
230
|
|
|
231
231
|
await waitForWorkflow(commitSha);
|
|
232
232
|
|
|
233
|
-
// 5. Deploy CDK stack with CI-built image tag
|
|
233
|
+
// 5. Deploy CDK stack with CI-built image tag using secrets-only mode
|
|
234
234
|
console.log('');
|
|
235
|
-
console.log(`Step 5: Deploying CDK stack with CI-built image...`);
|
|
235
|
+
console.log(`Step 5: Deploying CDK stack with CI-built image (secrets-only mode)...`);
|
|
236
236
|
process.chdir(path.join(__dirname, '..'));
|
|
237
237
|
// Use the full version with timestamp (without 'v' prefix)
|
|
238
238
|
const imageTag = devTag.replace(/^v/, '');
|
|
239
|
-
|
|
239
|
+
|
|
240
|
+
// Secrets-only mode parameters
|
|
241
|
+
const quiltStackArn = 'arn:aws:cloudformation:us-east-1:712023778557:stack/quilt-staging/e51b0c10-10c9-11ee-9b41-12fda87498a3';
|
|
242
|
+
const benchlingSecret = 'benchling-webhook-dev';
|
|
243
|
+
|
|
244
|
+
run(`npm run deploy:prod -- --quilt-stack-arn ${quiltStackArn} --benchling-secret ${benchlingSecret} --image-tag ${imageTag} --yes`);
|
|
245
|
+
|
|
246
|
+
// 6. Get and store the deployment endpoint
|
|
247
|
+
console.log('');
|
|
248
|
+
console.log('Step 6: Retrieving deployment endpoint...');
|
|
249
|
+
|
|
250
|
+
try {
|
|
251
|
+
const { CloudFormationClient, DescribeStacksCommand } = require('@aws-sdk/client-cloudformation');
|
|
252
|
+
const os = require('os');
|
|
253
|
+
|
|
254
|
+
const cloudformation = new CloudFormationClient({ region: 'us-east-1' });
|
|
255
|
+
const command = new DescribeStacksCommand({ StackName: 'BenchlingWebhookStack' });
|
|
256
|
+
const response = await cloudformation.send(command);
|
|
257
|
+
|
|
258
|
+
if (response.Stacks && response.Stacks.length > 0) {
|
|
259
|
+
const stack = response.Stacks[0];
|
|
260
|
+
const endpointOutput = stack.Outputs?.find(o => o.OutputKey === 'WebhookEndpoint');
|
|
261
|
+
const webhookUrl = endpointOutput?.OutputValue || '';
|
|
262
|
+
|
|
263
|
+
if (webhookUrl) {
|
|
264
|
+
// Store endpoint in XDG config
|
|
265
|
+
const configDir = path.join(os.homedir(), '.config', 'benchling-webhook');
|
|
266
|
+
const deployJsonPath = path.join(configDir, 'deploy.json');
|
|
267
|
+
|
|
268
|
+
// Read existing deploy.json or create new one
|
|
269
|
+
let deployConfig = {};
|
|
270
|
+
if (fs.existsSync(deployJsonPath)) {
|
|
271
|
+
deployConfig = JSON.parse(fs.readFileSync(deployJsonPath, 'utf8'));
|
|
272
|
+
}
|
|
273
|
+
|
|
274
|
+
// Update dev section
|
|
275
|
+
deployConfig.dev = {
|
|
276
|
+
endpoint: webhookUrl,
|
|
277
|
+
imageTag: imageTag,
|
|
278
|
+
deployedAt: new Date().toISOString(),
|
|
279
|
+
stackName: 'BenchlingWebhookStack'
|
|
280
|
+
};
|
|
281
|
+
|
|
282
|
+
// Ensure config directory exists
|
|
283
|
+
if (!fs.existsSync(configDir)) {
|
|
284
|
+
fs.mkdirSync(configDir, { recursive: true });
|
|
285
|
+
}
|
|
286
|
+
|
|
287
|
+
// Write deploy.json
|
|
288
|
+
fs.writeFileSync(deployJsonPath, JSON.stringify(deployConfig, null, 2));
|
|
289
|
+
console.log(`✅ Stored deployment endpoint in ${deployJsonPath}`);
|
|
290
|
+
console.log(` Endpoint: ${webhookUrl}`);
|
|
291
|
+
}
|
|
292
|
+
}
|
|
293
|
+
} catch (error) {
|
|
294
|
+
console.warn(`⚠️ Could not retrieve/store deployment endpoint: ${error.message}`);
|
|
295
|
+
}
|
|
240
296
|
|
|
241
297
|
console.log('');
|
|
242
298
|
console.log('✅ Development deployment complete!');
|
package/dist/bin/cli.js
CHANGED
|
@@ -11,6 +11,7 @@ const init_1 = require("./commands/init");
|
|
|
11
11
|
const validate_1 = require("./commands/validate");
|
|
12
12
|
const test_1 = require("./commands/test");
|
|
13
13
|
const manifest_1 = require("./commands/manifest");
|
|
14
|
+
const setup_wizard_1 = require("./commands/setup-wizard");
|
|
14
15
|
// Load package.json for version
|
|
15
16
|
// eslint-disable-next-line @typescript-eslint/no-require-imports
|
|
16
17
|
const pkg = require("../package.json");
|
|
@@ -24,19 +25,29 @@ program
|
|
|
24
25
|
program
|
|
25
26
|
.command("deploy", { isDefault: true })
|
|
26
27
|
.description("Deploy the CDK stack to AWS")
|
|
27
|
-
.option("--
|
|
28
|
-
.option("--
|
|
29
|
-
.option("--tenant <name>", "Benchling tenant")
|
|
30
|
-
.option("--client-id <id>", "Benchling OAuth client ID")
|
|
31
|
-
.option("--client-secret <secret>", "Benchling OAuth client secret")
|
|
32
|
-
.option("--app-id <id>", "Benchling app definition ID")
|
|
28
|
+
.option("--quilt-stack-arn <arn>", "ARN of Quilt CloudFormation stack")
|
|
29
|
+
.option("--benchling-secret <name>", "Name or ARN of Benchling secret in Secrets Manager (defaults to package name)", "@quiltdata/benchling-webhook")
|
|
33
30
|
.option("--env-file <path>", "Path to .env file", ".env")
|
|
31
|
+
// Common options
|
|
34
32
|
.option("--no-bootstrap-check", "Skip CDK bootstrap verification")
|
|
35
33
|
.option("--require-approval <level>", "CDK approval level", "never")
|
|
36
34
|
.option("--profile <name>", "AWS profile to use")
|
|
37
35
|
.option("--region <region>", "AWS region to deploy to")
|
|
38
36
|
.option("--image-tag <tag>", "Docker image tag to deploy (default: latest)")
|
|
39
37
|
.option("--yes", "Skip confirmation prompts")
|
|
38
|
+
.addHelpText("after", `
|
|
39
|
+
Examples:
|
|
40
|
+
Deploy with default secret name:
|
|
41
|
+
$ npx @quiltdata/benchling-webhook deploy \\
|
|
42
|
+
--quilt-stack-arn "arn:aws:cloudformation:us-east-1:123456789012:stack/QuiltStack/abc123"
|
|
43
|
+
|
|
44
|
+
Deploy with custom secret name:
|
|
45
|
+
$ npx @quiltdata/benchling-webhook deploy \\
|
|
46
|
+
--quilt-stack-arn "arn:aws:cloudformation:us-east-1:123456789012:stack/QuiltStack/abc123" \\
|
|
47
|
+
--benchling-secret "my-benchling-credentials"
|
|
48
|
+
|
|
49
|
+
For more information: https://github.com/quiltdata/benchling-webhook#deployment
|
|
50
|
+
`)
|
|
40
51
|
.action(async (options) => {
|
|
41
52
|
try {
|
|
42
53
|
await (0, deploy_1.deployCommand)(options);
|
|
@@ -106,9 +117,16 @@ program
|
|
|
106
117
|
process.exit(1);
|
|
107
118
|
}
|
|
108
119
|
});
|
|
109
|
-
//
|
|
120
|
+
// Run setup wizard when no command provided
|
|
110
121
|
if (!process.argv.slice(2).length) {
|
|
111
|
-
|
|
122
|
+
(0, setup_wizard_1.setupWizardCommand)()
|
|
123
|
+
.then(() => process.exit(0))
|
|
124
|
+
.catch((error) => {
|
|
125
|
+
console.error(chalk_1.default.red(error.message));
|
|
126
|
+
process.exit(1);
|
|
127
|
+
});
|
|
128
|
+
}
|
|
129
|
+
else {
|
|
130
|
+
program.parse();
|
|
112
131
|
}
|
|
113
|
-
program.parse();
|
|
114
132
|
//# sourceMappingURL=cli.js.map
|
package/dist/bin/cli.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../bin/cli.ts"],"names":[],"mappings":";;;;;;AACA,yCAAoC;AACpC,kDAA0B;AAC1B,8CAAkD;AAClD,0CAA8C;AAC9C,kDAAsD;AACtD,0CAA8C;AAC9C,kDAAsD;
|
|
1
|
+
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../bin/cli.ts"],"names":[],"mappings":";;;;;;AACA,yCAAoC;AACpC,kDAA0B;AAC1B,8CAAkD;AAClD,0CAA8C;AAC9C,kDAAsD;AACtD,0CAA8C;AAC9C,kDAAsD;AACtD,0DAA6D;AAE7D,gCAAgC;AAChC,iEAAiE;AACjE,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEvC,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;AAE9B,OAAO;KACF,IAAI,CAAC,mBAAmB,CAAC;KACzB,WAAW,CAAC,kFAAkF,CAAC;KAC/F,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,EAAE,wBAAwB,CAAC;KAC/D,UAAU,CAAC,YAAY,EAAE,0BAA0B,CAAC,CAAC;AAE1D,2BAA2B;AAC3B,OAAO;KACF,OAAO,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KACtC,WAAW,CAAC,6BAA6B,CAAC;KAC1C,MAAM,CAAC,yBAAyB,EAAE,mCAAmC,CAAC;KACtE,MAAM,CAAC,2BAA2B,EAAE,+EAA+E,EAAE,8BAA8B,CAAC;KACpJ,MAAM,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,CAAC;IACzD,iBAAiB;KAChB,MAAM,CAAC,sBAAsB,EAAE,iCAAiC,CAAC;KACjE,MAAM,CAAC,4BAA4B,EAAE,oBAAoB,EAAE,OAAO,CAAC;KACnE,MAAM,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;KAChD,MAAM,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;KACtD,MAAM,CAAC,mBAAmB,EAAE,8CAA8C,CAAC;KAC3E,MAAM,CAAC,OAAO,EAAE,2BAA2B,CAAC;KAC5C,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;CAYzB,CAAC;KACG,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACtB,IAAI,CAAC;QACD,MAAM,IAAA,sBAAa,EAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC,CAAC,CAAC;AAEP,eAAe;AACf,OAAO;KACF,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,wCAAwC,CAAC;KACrD,MAAM,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,CAAC;KACrD,MAAM,CAAC,SAAS,EAAE,yBAAyB,CAAC;KAC5C,MAAM,CAAC,WAAW,EAAE,iCAAiC,CAAC;KACtD,MAAM,CAAC,SAAS,EAAE,sCAAsC,CAAC;KACzD,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACtB,IAAI,CAAC;QACD,MAAM,IAAA,kBAAW,EAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC,CAAC,CAAC;AAEP,mBAAmB;AACnB,OAAO;KACF,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,0CAA0C,CAAC;KACvD,MAAM,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,CAAC;KACxD,MAAM,CAAC,WAAW,EAAE,sCAAsC,CAAC;KAC3D,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACtB,IAAI,CAAC;QACD,MAAM,IAAA,0BAAe,EAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC,CAAC,CAAC;AAEP,eAAe;AACf,OAAO;KACF,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,oCAAoC,CAAC;KACjD,MAAM,CAAC,aAAa,EAAE,2DAA2D,CAAC;KAClF,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACtB,IAAI,CAAC;QACD,MAAM,IAAA,kBAAW,EAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC,CAAC,CAAC;AAEP,mBAAmB;AACnB,OAAO;KACF,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,sCAAsC,CAAC;KACnD,MAAM,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,mBAAmB,CAAC;KAClE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACtB,IAAI,CAAC;QACD,MAAM,IAAA,0BAAe,EAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC,CAAC,CAAC;AAEP,4CAA4C;AAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChC,IAAA,iCAAkB,GAAE;SACf,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SAC3B,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;AACX,CAAC;KAAM,CAAC;IACJ,OAAO,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC"}
|
|
@@ -1,7 +1,11 @@
|
|
|
1
|
-
|
|
2
|
-
export declare function deployCommand(options: ConfigOptions & {
|
|
1
|
+
export declare function deployCommand(options: {
|
|
3
2
|
yes?: boolean;
|
|
4
3
|
bootstrapCheck?: boolean;
|
|
5
4
|
requireApproval?: string;
|
|
5
|
+
quiltStackArn?: string;
|
|
6
|
+
benchlingSecret?: string;
|
|
7
|
+
imageTag?: string;
|
|
8
|
+
region?: string;
|
|
9
|
+
envFile?: string;
|
|
6
10
|
}): Promise<void>;
|
|
7
11
|
//# sourceMappingURL=deploy.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../../bin/commands/deploy.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../../bin/commands/deploy.ts"],"names":[],"mappings":"AAaA,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAgCzO"}
|