@sst-community/sst 4.19.0 → 5.0.0-alpha.1

package/platform/src/components/args.ts

@@ -0,0 +1,133 @@
+import { type Unwrap, Output, output } from "@pulumi/pulumi";
+import type { Input } from "./input";
+import { VisibleError } from "./error";
+
+/**
+ * The plain form of an arg that 4.x takes as an `Input`: the value itself,
+ * not an output or a promise of it. What's inside it can still be inputs.
+ *
+ * ```ts
+ * cors?: Plain<BucketArgs["cors"]>;
+ * ```
+ */
+export type Plain<T> = T extends Input<infer U> ? U : T;
+
+/**
+ * An arg's value, or `fallback` when the user left it out. Pass `convert` to
+ * turn it into what the resource takes.
+ *
+ * ```ts
+ * withDefault(args.engine, "redis");
+ * withDefault(args.delay, "0 seconds", toSeconds);
+ * ```
+ */
+export function withDefault<T>(
+  value: Input<T | undefined> | undefined,
+  fallback: T,
+): Output<T>;
+export function withDefault<T, R>(
+  value: Input<T | undefined> | undefined,
+  fallback: T,
+  convert: (value: Unwrap<T>) => R,
+): Output<R>;
+export function withDefault(
+  value: any,
+  fallback: unknown,
+  convert?: (value: unknown) => unknown,
+) {
+  return output(value).apply((value) => {
+    const set = value ?? fallback;
+    return convert ? convert(set) : set;
+  });
+}
+
+/**
+ * What a resource takes for an arg the user may have left out: the value
+ * when they set it, and nothing when they didn't. Pass `convert` to turn the
+ * value into what the resource takes.
+ *
+ * ```ts
+ * authorizerId: ifSet(auth.authorizer),
+ * redrivePolicy: ifSet(args.dlq, (dlq) => jsonStringify({ ... })),
+ * ```
+ */
+export function ifSet<T>(value: Input<T | undefined> | undefined): Output<T>;
+export function ifSet<T, R>(
+  value: Input<T | undefined> | undefined,
+  convert: (value: Unwrap<T>) => Input<R>,
+): Output<R>;
+export function ifSet(value: any, convert?: (value: unknown) => unknown) {
+  return output(value).apply((value) =>
+    value === undefined || value === null || !convert ? value : convert(value),
+  );
+}
+
+/**
+ * Check that an arg is a plain value. An arg that decides which resources a
+ * component creates has to be known up front, so it can't be an output. The
+ * fields inside it still can.
+ *
+ * ```ts
+ * const domain = plain(args.domain, `The "domain" of the "${name}" API`);
+ * ```
+ *
+ * @param what The arg, as the start of the error message.
+ */
+export function plain<T>(value: T, what: string): T {
+  if (Output.isInstance(value) || value instanceof Promise)
+    throw new VisibleError(
+      `${what} has to be a plain value, not an output. It decides which resources are created, so it has to be known before they are.`,
+    );
+  return value;
+}
+
+/**
+ * Check that an arg is plain all the way down: the value, and everything
+ * inside it. This is for an arg a resource is named after, like the
+ * conditions of a load balancer rule.
+ *
+ * ```ts
+ * plainDeep(rule, `Rule ${i + 1} of the "${name}" service`);
+ * ```
+ *
+ * @param what The arg, as the start of the error message.
+ */
+export function plainDeep<T>(value: T, what: string): T {
+  plain(value, what);
+  if (value && typeof value === "object")
+    for (const inner of Object.values(value)) plainDeep(inner, what);
+  return value;
+}
+
+/**
+ * Fail when a method is given an option it doesn't take, saying what to use
+ * instead. The types flag this too, but a config runs without being
+ * type-checked, and the option would be dropped without a word.
+ *
+ * ```ts
+ * notAnOption(args, "transform", `Use the "transform" of the "${name}" queue.`);
+ * ```
+ */
+export function notAnOption(args: object, option: string, instead: string) {
+  if ((args as Record<string, unknown>)[option] !== undefined)
+    throw new VisibleError(`"${option}" isn't an option here. ${instead}`);
+}
+
+/**
+ * The same value, without the resources it came from: what's given it doesn't
+ * depend on them, though it still waits for the value. For a value that's
+ * made on this machine from things in AWS, like a function's built code,
+ * which is given its links. Without this the code would depend on everything
+ * that's linked.
+ */
+export function withoutDependencies<T>(value: Output<T>): Output<T> {
+  const from = value as any;
+  // As Pulumi's own `unsecret()` rebuilds an output
+  return new (Output as any)(
+    [],
+    from.promise(/* withUnknowns */ true),
+    from.isKnown,
+    from.isSecret,
+    Promise.resolve([]),
+  );
+}

package/platform/src/components/aws/alb.ts

@@ -0,0 +1,577 @@
+import {
+  ComponentResourceOptions,
+  Output,
+  output,
+} from "@pulumi/pulumi";
+import { Component, Transform, transform } from "../component.js";
+import { dns as awsDns } from "./dns.js";
+import { VisibleError } from "../error.js";
+import { DnsValidatedCertificate } from "./dns-validated-certificate.js";
+import { Link } from "../link.js";
+import { ec2, lb } from "@pulumi/aws";
+import { Vpc } from "./vpc.js";
+import { Input } from "../input.js";
+import { Dns } from "../dns.js";
+import { listenerKey } from "./helpers/load-balancer.js";
+
+export interface AlbListenerArgs {
+  /**
+   * The port to listen on.
+   *
+   * @example
+   * ```js
+   * {
+   *   port: 443
+   * }
+   * ```
+   */
+  port: number;
+  /**
+   * The protocol to listen on. Only `http` and `https` are supported (ALB-only).
+   *
+   * @example
+   * ```js
+   * {
+   *   protocol: "https"
+   * }
+   * ```
+   */
+  protocol: "http" | "https";
+}
+
+export interface AlbArgs {
+  /**
+   * The VPC to deploy the ALB in. Can be an SST `Vpc` component or a custom VPC configuration.
+   *
+   * @example
+   *
+   * Using an SST Vpc component:
+   * ```js
+   * {
+   *   vpc: myVpc
+   * }
+   * ```
+   *
+   * Using a custom VPC:
+   * ```js
+   * {
+   *   vpc: {
+   *     id: "vpc-0123456789abcdef0",
+   *     publicSubnets: ["subnet-abc", "subnet-def"],
+   *     privateSubnets: ["subnet-ghi", "subnet-jkl"]
+   *   }
+   * }
+   * ```
+   */
+  vpc: Vpc | Input<{
+    /**
+     * The VPC ID.
+     */
+    id: Input<string>;
+    /**
+     * The public subnet IDs.
+     */
+    publicSubnets: Input<Input<string>[]>;
+    /**
+     * The private subnet IDs.
+     */
+    privateSubnets: Input<Input<string>[]>;
+  }>;
+  /**
+   * Configure if the load balancer should be public (internet-facing) or private (internal).
+   *
+   * When set to `false`, the load balancer endpoint will only be accessible within the VPC.
+   *
+   * @default `true`
+   */
+  public?: Input<boolean>;
+  /**
+   * Set a custom domain for the load balancer.
+   *
+   * Automatically manages domains hosted on AWS Route 53, Cloudflare, and Vercel. For other
+   * providers, you'll need to pass in a `cert` that validates domain ownership and add the
+   * DNS records.
+   *
+   * When SST creates the certificate, the load balancer is created after the certificate
+   * is validated, and removed before the certificate.
+   *
+   * @example
+   *
+   * ```js
+   * {
+   *   domain: "example.com"
+   * }
+   * ```
+   *
+   * For domains on Cloudflare:
+   * ```js
+   * {
+   *   domain: {
+   *     name: "example.com",
+   *     dns: sst.cloudflare.dns()
+   *   }
+   * }
+   * ```
+   */
+  domain?:
+    | string
+    | {
+        /**
+         * The custom domain name.
+         */
+        name: string;
+        /**
+         * Alias domains that should also point to this load balancer.
+         */
+        aliases?: string[];
+        /**
+         * The ARN of an ACM certificate that proves ownership of the domain.
+         * By default, a certificate is created and validated automatically.
+         */
+        cert?: Input<string>;
+        /**
+         * The DNS provider to use. Defaults to AWS Route 53.
+         * Set to `false` for manual DNS setup.
+         *
+         * @default `sst.aws.dns`
+         */
+        dns?: false | (Dns & {});
+      };
+  /**
+   * The listeners for the load balancer. Each entry creates a listener on the specified
+   * port and protocol.
+   *
+   * @example
+   * ```js
+   * {
+   *   listeners: [
+ *     { port: 80, protocol: "http" },
+ *     { port: 443, protocol: "https" }
+ *   ]
+   * }
+   * ```
+   */
+  listeners: AlbListenerArgs[];
+  /**
+   * [Transform](/docs/components#transform) how this component creates its underlying resources.
+   */
+  transform?: {
+    /**
+     * Transform the AWS Load Balancer resource.
+     */
+    loadBalancer?: Transform<lb.LoadBalancerArgs>;
+    /**
+     * Transform the AWS Security Group resource for the Load Balancer.
+     */
+    securityGroup?: Transform<ec2.SecurityGroupArgs>;
+    /**
+     * Transform the AWS Load Balancer listener resource.
+     */
+    listener?: Transform<lb.ListenerArgs>;
+  };
+}
+
+interface AlbRef {
+  ref: true;
+  loadBalancerArn: Input<string>;
+}
+
+/**
+ * The `Alb` component lets you create a standalone Application Load Balancer that can be
+ * shared across multiple services.
+ *
+ * @example
+ *
+ * #### Create a shared ALB
+ *
+ * ```ts title="sst.config.ts"
+ * const vpc = new sst.aws.Vpc("MyVpc");
+ *
+ * const alb = new sst.aws.Alb("SharedAlb", {
+ *   vpc,
+ *   domain: "app.example.com",
+ *   listeners: [
+ *     { port: 80, protocol: "http" },
+ *     { port: 443, protocol: "https" },
+ *   ],
+ * });
+ * ```
+ *
+ * #### Attach services to the ALB
+ *
+ * ```ts title="sst.config.ts"
+ * new sst.aws.Service("Api", {
+ *   cluster,
+ *   image: "api:latest",
+ *   loadBalancer: {
+ *     instance: alb,
+ *     rules: [
+ *       { listen: "443/https", forward: "8080/http", conditions: { path: "/api/*" }, priority: 100 },
+ *     ],
+ *   },
+ * });
+ * ```
+ *
+ * #### Reference an existing ALB
+ *
+ * ```ts title="sst.config.ts"
+ * const alb = sst.aws.Alb.get("SharedAlb", "arn:aws:elasticloadbalancing:...");
+ * ```
+ */
+export class Alb extends Component implements Link.Linkable {
+  private loadBalancer: lb.LoadBalancer;
+  private securityGroup: ec2.SecurityGroup;
+  private listeners: Record<string, lb.Listener> = {};
+  private certificateArn?: Output<string | undefined>;
+  private vpcId: Output<string>;
+  private _url: Output<string>;
+  private constructorName: string;
+
+  constructor(
+    name: string,
+    args: AlbArgs,
+    opts: ComponentResourceOptions = {},
+  ) {
+    super(__pulumiType, name, args, opts);
+
+    this.constructorName = name;
+
+    if (args && "ref" in args) {
+      const ref = args as unknown as AlbRef;
+      const loadBalancer = lb.LoadBalancer.get(
+        `${name}LoadBalancer`,
+        output(ref.loadBalancerArn),
+        {},
+        { parent: this },
+      );
+      const securityGroup = ec2.SecurityGroup.get(
+        `${name}SecurityGroup`,
+        loadBalancer.securityGroups.apply((sgs) => {
+          if (!sgs?.length) {
+            throw new VisibleError(
+              `No security groups found on the referenced ALB "${name}".`,
+            );
+          }
+          return sgs[0];
+        }),
+        {},
+        { parent: this },
+      );
+      this.loadBalancer = loadBalancer;
+      this.securityGroup = securityGroup;
+      this.vpcId = loadBalancer.vpcId;
+      this._url = loadBalancer.dnsName.apply(
+        (dnsName) => `http://${dnsName}`,
+      );
+      this.registerOutputs({ _hint: this._url });
+      return;
+    }
+
+    const self = this;
+    const pub = output(args.public ?? true);
+    const { vpcId, subnets } = normalizeVpc();
+    const domain = normalizeDomain();
+    const securityGroup = createSecurityGroup();
+    const { cert, arn: certificateArn } = createSsl();
+    const loadBalancer = createLoadBalancer();
+    createListeners();
+    createDnsRecords();
+
+    this.loadBalancer = loadBalancer;
+    this.securityGroup = securityGroup;
+    this.certificateArn = certificateArn;
+    this.vpcId = vpcId;
+    this._url = domain
+      ? output(`https://${domain.name}/`)
+      : loadBalancer.dnsName.apply((dnsName) => `http://${dnsName}`);
+
+    this.registerOutputs({ _hint: this._url });
+
+    function normalizeVpc() {
+      if (args.vpc instanceof Vpc) {
+        const vpc = args.vpc;
+        return {
+          vpcId: vpc.id,
+          subnets: pub.apply((isPublic) =>
+            isPublic ? vpc.publicSubnets : vpc.privateSubnets,
+          ),
+        };
+      }
+
+      return output(args.vpc).apply((vpc) => ({
+        vpcId: output(vpc.id),
+        subnets: pub.apply((isPublic) =>
+          isPublic
+            ? output(vpc.publicSubnets)
+            : output(vpc.privateSubnets),
+        ),
+      }));
+    }
+
+    function normalizeDomain() {
+      if (!args.domain) return undefined;
+      const raw =
+        typeof args.domain === "string" ? { name: args.domain } : args.domain;
+      return {
+        name: raw.name,
+        aliases: raw.aliases ?? [],
+        dns: raw.dns === false ? undefined : raw.dns ?? awsDns(),
+        cert: raw.cert,
+      };
+    }
+
+    function createSecurityGroup() {
+      return new ec2.SecurityGroup(
+        ...transform(
+          args.transform?.securityGroup,
+          `${name}SecurityGroup`,
+          {
+            description: "Managed by SST",
+            vpcId,
+            egress: [
+              {
+                fromPort: 0,
+                toPort: 0,
+                protocol: "-1",
+                cidrBlocks: ["0.0.0.0/0"],
+              },
+            ],
+            ingress: [
+              {
+                fromPort: 0,
+                toPort: 0,
+                protocol: "-1",
+                cidrBlocks: ["0.0.0.0/0"],
+              },
+            ],
+          },
+          { parent: self },
+        ),
+      );
+    }
+
+    function createSsl(): {
+      cert?: DnsValidatedCertificate;
+      arn: Output<string | undefined>;
+    } {
+      if (!domain) return { arn: output(undefined) };
+      if (domain.cert) return { arn: output(domain.cert) };
+
+      const cert = new DnsValidatedCertificate(
+        `${name}Ssl`,
+        {
+          domainName: domain.name,
+          alternativeNames: domain.aliases,
+          dns: domain.dns!,
+        },
+        { parent: self },
+      );
+      return { cert, arn: cert.arn };
+    }
+
+    function createLoadBalancer() {
+      return new lb.LoadBalancer(
+        ...transform(
+          args.transform?.loadBalancer,
+          `${name}LoadBalancer`,
+          {
+            internal: pub.apply((v) => !v),
+            loadBalancerType: "application",
+            subnets,
+            securityGroups: [securityGroup.id],
+            enableCrossZoneLoadBalancing: true,
+
+          },
+          // Depend on the certificate, so on remove the load balancer is
+          //   deleted before it.
+          { parent: self, dependsOn: cert ? [cert] : [] },
+        ),
+      );
+    }
+
+    function createListeners() {
+      for (const l of args.listeners) {
+        const protocol = l.protocol.toUpperCase();
+        const port = l.port;
+        const key = listenerKey(protocol, port);
+
+        const listener = new lb.Listener(
+          ...transform(
+            args.transform?.listener,
+            `${name}Listener${protocol}${port}`,
+            {
+              loadBalancerArn: loadBalancer.arn,
+              port,
+              protocol,
+              certificateArn: protocol === "HTTPS"
+                ? certificateArn.apply((arn) => arn!) as Output<string>
+                : undefined,
+              defaultActions: [
+                {
+                  type: "fixed-response",
+                  fixedResponse: {
+                    statusCode: "403",
+                    contentType: "text/plain",
+                    messageBody: "Forbidden",
+                  },
+                },
+              ],
+            },
+            { parent: self },
+          ),
+        );
+
+        self.listeners[key] = listener;
+      }
+    }
+
+    function createDnsRecords() {
+      if (!domain?.dns) return;
+
+      for (const recordName of [domain.name, ...domain.aliases]) {
+        const namePrefix =
+          recordName === domain.name ? name : `${name}${recordName}`;
+        domain.dns.createAlias(
+          namePrefix,
+          {
+            name: recordName,
+            aliasName: loadBalancer.dnsName,
+            aliasZone: loadBalancer.zoneId,
+          },
+          { parent: self },
+        );
+      }
+    }
+  }
+
+  /**
+   * The URL of the load balancer. If a custom domain is set, this will be the custom
+   * domain URL (eg. `https://app.example.com/`). Otherwise, it's the ALB's DNS name.
+   */
+  public get url(): Output<string> {
+    return this._url;
+  }
+
+  /**
+   * The ARN of the load balancer.
+   */
+  public get arn(): Output<string> {
+    return this.loadBalancer.arn;
+  }
+
+  /**
+   * The DNS name of the load balancer.
+   */
+  public get dnsName(): Output<string> {
+    return this.loadBalancer.dnsName;
+  }
+
+  /**
+   * The zone ID of the load balancer.
+   */
+  public get zoneId(): Output<string> {
+    return this.loadBalancer.zoneId;
+  }
+
+  /**
+   * The security group ID of the load balancer.
+   */
+  public get securityGroupId(): Output<string> {
+    return this.securityGroup.id;
+  }
+
+  /**
+   * The underlying resources this component creates.
+   */
+  public get nodes() {
+    return {
+      /**
+       * The AWS Load Balancer resource.
+       */
+      loadBalancer: this.loadBalancer,
+      /**
+       * The AWS Security Group resource.
+       */
+      securityGroup: this.securityGroup,
+      /**
+       * The AWS Listener resources, keyed by "PROTOCOLPORT" (e.g. "HTTPS443").
+       */
+      listeners: this.listeners,
+    };
+  }
+
+  /** @internal */
+  public get _certArn(): Output<string | undefined> {
+    return this.certificateArn ?? output(undefined);
+  }
+
+  /** @internal */
+  public get _vpc(): Output<string> {
+    return this.vpcId;
+  }
+
+  /**
+   * Get a specific listener by protocol and port.
+   *
+   * @example
+   * ```ts
+   * const listener = alb.getListener("https", 443);
+   * ```
+   */
+  public getListener(
+    protocol: string,
+    port: number,
+  ): lb.Listener {
+    const key = listenerKey(protocol, port);
+    if (this.listeners[key]) return this.listeners[key];
+
+    const discovered = lb.Listener.get(
+      `${this.constructorName}Listener${protocol.toUpperCase()}${port}`,
+      lb.getListenerOutput({
+        loadBalancerArn: this.loadBalancer.arn,
+        port,
+      }).arn,
+      {},
+      { parent: this },
+    );
+    this.listeners[key] = discovered;
+    return discovered;
+  }
+
+  /** @internal */
+  public getSSTLink() {
+    return {
+      properties: {
+        url: this._url,
+      },
+    };
+  }
+
+  /**
+   * Reference an existing ALB by its ARN.
+   *
+   * @param name The name of the component.
+   * @param loadBalancerArn The ARN of the existing ALB.
+   * @param opts Component resource options.
+   *
+   * @example
+   * ```ts
+   * const alb = sst.aws.Alb.get("SharedAlb", "arn:aws:elasticloadbalancing:...");
+   * ```
+   */
+  public static get(
+    name: string,
+    loadBalancerArn: Input<string>,
+    opts?: ComponentResourceOptions,
+  ): Alb {
+    return new Alb(
+      name,
+      { ref: true, loadBalancerArn } as unknown as AlbArgs,
+      opts,
+    );
+  }
+}
+
+const __pulumiType = "sst:aws:Alb";
+// @ts-expect-error
+Alb.__pulumiType = __pulumiType;