@sst-community/sst 4.19.0 → 5.0.0-alpha.1

package/platform/src/components/aws/analog.ts

@@ -0,0 +1,462 @@
+import fs from "fs";
+import path from "path";
+import { ComponentResourceOptions, Output } from "@pulumi/pulumi";
+import { VisibleError } from "../error.js";
+import { Plan, SsrSite, SsrSiteArgs } from "./ssr-site.js";
+
+export interface AnalogArgs extends SsrSiteArgs {
+  /**
+   * Configure how this component works in `sst dev`.
+   *
+   * :::note
+   * In `sst dev` your Analog app is run in dev mode; it's not deployed.
+   * :::
+   *
+   * Instead of deploying your Analog app, this starts it in dev mode. It's run
+   * as a separate process in the `sst dev` multiplexer. Read more about
+   * [`sst dev`](/docs/reference/cli/#dev).
+   *
+   * To disable dev mode, pass in `false`.
+   */
+  dev?: SsrSiteArgs["dev"];
+  /**
+   * Permissions and the resources that the [server function](#nodes-server) in your Analog app needs to access. These permissions are used to create the function's IAM role.
+   *
+   * :::tip
+   * If you `link` the function to a resource, the permissions to access it are
+   * automatically added.
+   * :::
+   *
+   * @example
+   * Allow reading and writing to an S3 bucket called `my-bucket`.
+   * ```js
+   * {
+   *   permissions: [
+   *     {
+   *       actions: ["s3:GetObject", "s3:PutObject"],
+   *       resources: ["arn:aws:s3:::my-bucket/*"]
+   *     },
+   *   ]
+   * }
+   * ```
+   *
+   * Perform all actions on an S3 bucket called `my-bucket`.
+   *
+   * ```js
+   * {
+   *   permissions: [
+   *     {
+   *       actions: ["s3:*"],
+   *       resources: ["arn:aws:s3:::my-bucket/*"]
+   *     },
+   *   ]
+   * }
+   * ```
+   *
+   * Grant permissions to access all resources.
+   *
+   * ```js
+   * {
+   *   permissions: [
+   *     {
+   *       actions: ["*"],
+   *       resources: ["*"]
+   *     },
+   *   ]
+   * }
+   * ```
+   */
+  permissions?: SsrSiteArgs["permissions"];
+  /**
+   * Path to the directory where your Analog app is located.  This path is relative to your `sst.config.ts`.
+   *
+   * By default it assumes your Analog app is in the root of your SST app.
+   * @default `"."`
+   *
+   * @example
+   *
+   * If your Analog app is in a package in your monorepo.
+   *
+   * ```js
+   * {
+   *   path: "packages/web"
+   * }
+   * ```
+   */
+  path?: SsrSiteArgs["path"];
+  /**
+   * [Link resources](/docs/linking/) to your Analog app. This will:
+   *
+   * 1. Grant the permissions needed to access the resources.
+   * 2. Allow you to access it in your site using the [SDK](/docs/reference/sdk/).
+   *
+   * @example
+   *
+   * Takes a list of resources to link to the function.
+   *
+   * ```js
+   * {
+   *   link: [bucket, stripeKey]
+   * }
+   * ```
+   */
+  link?: SsrSiteArgs["link"];
+  /**
+   * Configure how the CloudFront cache invalidations are handled. This is run after your Analog app has been deployed.
+   * :::tip
+   * You get 1000 free invalidations per month. After that you pay $0.005 per invalidation path. [Read more here](https://aws.amazon.com/cloudfront/pricing/).
+   * :::
+   * @default `{paths: "all", wait: false}`
+   * @example
+   * Wait for all paths to be invalidated.
+   * ```js
+   * {
+   *   invalidation: {
+   *     paths: "all",
+   *     wait: true
+   *   }
+   * }
+   * ```
+   */
+  invalidation?: SsrSiteArgs["invalidation"];
+  /**
+   * Set [environment variables](https://analogjs.org/docs/guides/migrating#using-environment-variables) in your Analog app. These are made available:
+   *
+   * 1. In `ng build`, they are loaded into `process.env`.
+   * 2. Locally while running `sst dev ng serve`.
+   *
+   * :::tip
+   * You can also `link` resources to your Analog app and access them in a type-safe way with the [SDK](/docs/reference/sdk/). We recommend linking since it's more secure.
+   * :::
+   *
+   * Only variables prefixed with `VITE_` are available in the browser.
+   *
+   * @example
+   * ```js
+   * {
+   *   environment: {
+   *     API_URL: api.url,
+   *     // Accessible in the browser
+   *     VITE_STRIPE_PUBLISHABLE_KEY: "pk_test_123"
+   *   }
+   * }
+   * ```
+   */
+  environment?: SsrSiteArgs["environment"];
+  /**
+   * Set a custom domain for your Analog app.
+   *
+   * Automatically manages domains hosted on AWS Route 53, Cloudflare, and Vercel. For other
+   * providers, you'll need to pass in a `cert` that validates domain ownership and add the
+   * DNS records.
+   *
+   * :::tip
+   * Built-in support for AWS Route 53, Cloudflare, and Vercel. And manual setup for other
+   * providers.
+   * :::
+   *
+   * @example
+   *
+   * By default this assumes the domain is hosted on Route 53.
+   *
+   * ```js
+   * {
+   *   domain: "example.com"
+   * }
+   * ```
+   *
+   * For domains hosted on Cloudflare.
+   *
+   * ```js
+   * {
+   *   domain: {
+   *     name: "example.com",
+   *     dns: sst.cloudflare.dns()
+   *   }
+   * }
+   * ```
+   *
+   * Specify a `www.` version of the custom domain.
+   *
+   * ```js
+   * {
+   *   domain: {
+   *     name: "domain.com",
+   *     redirects: ["www.domain.com"]
+   *   }
+   * }
+   * ```
+   */
+  domain?: SsrSiteArgs["domain"];
+  /**
+   * Serve your Analog app through a `Router` instead of a standalone CloudFront
+   * distribution.
+   *
+   * By default, this component creates a new CloudFront distribution. But you might
+   * want to serve it through the distribution of your `Router` as a:
+   *
+   * - A path like `/docs`
+   * - A subdomain like `docs.example.com`
+   * - Or a combined pattern like `dev.example.com/docs`
+   *
+   * @example
+   *
+   * To serve your Analog app **from a path**, you'll need to configure the root domain
+   * in your `Router` component.
+   *
+   * ```ts title="sst.config.ts" {2}
+   * const router = new sst.aws.Router("Router", {
+   *   domain: "example.com"
+   * });
+   * ```
+   *
+   * Now set the `router` and the `path`.
+   *
+   * ```ts {3,4}
+   * {
+   *   router: {
+   *     instance: router,
+   *     path: "/docs"
+   *   }
+   * }
+   * ```
+   *
+   * You also need to set the `base` and `apiPrefix` options in your `vite.config.ts`.
+   * The `apiPrefix` value should not begin with a slash.
+   *
+   * :::caution
+   * If routing to a path, you need to set that as the base path in your Analog
+   * app as well.
+   * :::
+   *
+   * ```js title="vite.config.ts" {5,8}
+   * export default defineConfig(({ mode }) => ({
+   *   plugins: [
+   *     analog({
+   *       // Does NOT start with a slash
+   *       apiPrefix: "docs/api"
+   *     })
+   *   ],
+   *   base: "/docs"
+   * }));
+   * ```
+   *
+   * To serve your Analog app **from a subdomain**, you'll need to configure the
+   * domain in your `Router` component to match both the root and the subdomain.
+   *
+   * ```ts title="sst.config.ts" {3,4}
+   * const router = new sst.aws.Router("Router", {
+   *   domain: {
+   *     name: "example.com",
+   *     aliases: ["*.example.com"]
+   *   }
+   * });
+   * ```
+   *
+   * Now set the `domain` in the `router` prop.
+   *
+   * ```ts {4}
+   * {
+   *   router: {
+   *     instance: router,
+   *     domain: "docs.example.com"
+   *   }
+   * }
+   * ```
+   *
+   * Finally, to serve your Analog app **from a combined pattern** like
+   * `dev.example.com/docs`, you'll need to configure the domain in your `Router` to
+   * match the subdomain.
+   *
+   * ```ts title="sst.config.ts" {3,4}
+   * const router = new sst.aws.Router("Router", {
+   *   domain: {
+   *     name: "example.com",
+   *     aliases: ["*.example.com"]
+   *   }
+   * });
+   * ```
+   *
+   * And set the `domain` and the `path`.
+   *
+   * ```ts {4,5}
+   * {
+   *   router: {
+   *     instance: router,
+   *     domain: "dev.example.com",
+   *     path: "/docs"
+   *   }
+   * }
+   * ```
+   *
+   * Also, make sure to set the base path and API prefix in your `vite.config.ts`,
+   * like above.
+   */
+  router?: SsrSiteArgs["router"];
+  /**
+   * The command used internally to build your Analog app.
+   *
+   * @default `"npm run build"`
+   *
+   * @example
+   *
+   * If you want to use a different build command.
+   * ```js
+   * {
+   *   buildCommand: "yarn build"
+   * }
+   * ```
+   */
+  buildCommand?: SsrSiteArgs["buildCommand"];
+  /**
+   * Configure the Analog app to use an existing CloudFront cache policy.
+   *
+   * :::note
+   * CloudFront has a limit of 20 cache policies per account, though you can request a limit
+   * increase.
+   * :::
+   *
+   * By default, a new cache policy is created for it. This allows you to reuse an existing
+   * policy instead of creating a new one.
+   *
+   * @default A new cache policy is created
+   * @example
+   * ```js
+   * {
+   *   cachePolicy: "658327ea-f89d-4fab-a63d-7e88639e58f6"
+   * }
+   * ```
+   */
+  cachePolicy?: SsrSiteArgs["cachePolicy"];
+}
+
+/**
+ * The `Analog` component lets you deploy a [Analog](https://analogjs.org) app to AWS.
+ *
+ * @example
+ *
+ * #### Minimal example
+ *
+ * Deploy an Analog app that's in the project root.
+ *
+ * ```js title="sst.config.ts"
+ * new sst.aws.Analog("MyWeb");
+ * ```
+ *
+ * #### Change the path
+ *
+ * Deploys the Analog app in the `my-analog-app/` directory.
+ *
+ * ```js {2} title="sst.config.ts"
+ * new sst.aws.Analog("MyWeb", {
+ *   path: "my-analog-app/"
+ * });
+ * ```
+ *
+ * #### Add a custom domain
+ *
+ * Set a custom domain for your Analog app.
+ *
+ * ```js {2} title="sst.config.ts"
+ * new sst.aws.Analog("MyWeb", {
+ *   domain: "my-app.com"
+ * });
+ * ```
+ *
+ * #### Redirect www to apex domain
+ *
+ * Redirect `www.my-app.com` to `my-app.com`.
+ *
+ * ```js {4} title="sst.config.ts"
+ * new sst.aws.Analog("MyWeb", {
+ *   domain: {
+ *     name: "my-app.com",
+ *     redirects: ["www.my-app.com"]
+ *   }
+ * });
+ * ```
+ *
+ * #### Link resources
+ *
+ * [Link resources](/docs/linking/) to your Analog app. This will grant permissions
+ * to the resources and allow you to access it in your app.
+ *
+ * ```ts {4} title="sst.config.ts"
+ * const bucket = new sst.aws.Bucket("MyBucket");
+ *
+ * new sst.aws.Analog("MyWeb", {
+ *   link: [bucket]
+ * });
+ * ```
+ *
+ * You can use the [SDK](/docs/reference/sdk/) to access the linked resources
+ * in your Analog app.
+ *
+ * ```ts title="src/app/app.config.ts"
+ * import { Resource } from "sst";
+ *
+ * console.log(Resource.MyBucket.name);
+ * ```
+ */
+export class Analog extends SsrSite {
+  constructor(
+    name: string,
+    args: AnalogArgs = {},
+    opts: ComponentResourceOptions = {},
+  ) {
+    super(__pulumiType, name, args, opts);
+  }
+
+  protected normalizeBuildCommand() { }
+
+  protected buildPlan(outputPath: Output<string>): Output<Plan> {
+    return outputPath.apply((outputPath) => {
+      const nitro = JSON.parse(
+        fs.readFileSync(
+          path.join(outputPath, "dist", "analog", "nitro.json"),
+          "utf-8",
+        ),
+      );
+
+      if (!["aws-lambda"].includes(nitro.preset)) {
+        throw new VisibleError(
+          `Analog's vite.config.ts must be configured to use the "aws-lambda" preset. It is currently set to "${nitro.preset}".`,
+        );
+      }
+
+      const basepath = fs
+        .readFileSync(path.join(outputPath, "vite.config.ts"), "utf-8")
+        .match(/base: ['"](.*)['"]/)?.[1];
+
+      return {
+        base: basepath,
+        server: {
+          description: "Server handler for Analog",
+          handler: "index.handler",
+          bundle: path.join(outputPath, "dist", "analog", "server"),
+        },
+        assets: [
+          {
+            from: path.join("dist", "analog", "public"),
+            to: "",
+            cached: true,
+          },
+        ],
+      };
+    });
+  }
+
+  /**
+   * The URL of the Analog app.
+   *
+   * If the `domain` is set, this is the URL with the custom domain.
+   * Otherwise, it's the auto-generated CloudFront URL.
+   */
+  public get url() {
+    return super.url;
+  }
+}
+
+const __pulumiType = "sst:aws:Analog";
+// @ts-expect-error
+Analog.__pulumiType = __pulumiType;

package/platform/src/components/aws/apigateway-websocket-route.ts

@@ -0,0 +1,206 @@
+import {
+  ComponentResourceOptions,
+  Input,
+  Output,
+  all,
+  interpolate,
+  output,
+} from "@pulumi/pulumi";
+import { Component, Transform, transform } from "../component";
+import { VisibleError } from "../error";
+import { FunctionArgs, FunctionArn } from "./function.js";
+import { ApiGatewayWebSocketRouteArgs } from "./apigateway-websocket";
+import { apigatewayv2, lambda } from "@pulumi/aws";
+import { FunctionBuilder, functionBuilder } from "./helpers/function-builder";
+
+export interface Args extends ApiGatewayWebSocketRouteArgs {
+  /**
+   * The API Gateway to use for the service.
+   */
+  api: Input<{
+    /**
+     * The name of the API Gateway.
+     */
+    name: Input<string>;
+    /**
+     * The ID of the API Gateway.
+     */
+    id: Input<string>;
+    /**
+     * The execution ARN of the API Gateway.
+     */
+    executionArn: Input<string>;
+  }>;
+  /**
+   * The path for the route.
+   */
+  route: Input<string>;
+  /**
+   * The function that’ll be invoked.
+   */
+  handler: Input<string | FunctionArgs | FunctionArn>;
+  /**
+   * @internal
+   */
+  handlerTransform?: Transform<FunctionArgs>;
+}
+
+/**
+ * The `ApiGatewayWebSocketRoute` component is internally used by the `ApiGatewayWebSocket`
+ * component to add routes to your [API Gateway WebSocket API](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api.html).
+ *
+ * :::note
+ * This component is not intended to be created directly.
+ * :::
+ *
+ * You'll find this component returned by the `route` method of the `ApiGatewayWebSocket` component.
+ */
+export class ApiGatewayWebSocketRoute extends Component {
+  private readonly fn: FunctionBuilder;
+  private readonly permission: lambda.Permission;
+  private readonly apiRoute: Output<apigatewayv2.Route>;
+  private readonly integration: apigatewayv2.Integration;
+
+  constructor(name: string, args: Args, opts?: ComponentResourceOptions) {
+    super(__pulumiType, name, args, opts);
+
+    const self = this;
+    const api = output(args.api);
+    const route = output(args.route);
+
+    validateJwtAuth();
+    const fn = createFunction();
+    const permission = createPermission();
+    const integration = createIntegration();
+    const apiRoute = createApiRoute();
+
+    this.fn = fn;
+    this.permission = permission;
+    this.apiRoute = apiRoute;
+    this.integration = integration;
+
+    // WebSocket routes take NONE, AWS_IAM or CUSTOM auth, not JWT. When the route
+    // and its auth are plain values, check here, so that `sst diff` stops even if
+    // the authorizer's ID isn't known yet. createApiRoute checks the rest. `iam`
+    // and `lambda` win over `jwt` there, so a route with either isn't stopped.
+    function validateJwtAuth() {
+      const auth = args.auth;
+      if (args.route !== "$connect") return;
+      if (!auth || Output.isInstance(auth) || auth instanceof Promise) return;
+      if (auth.jwt && !auth.iam && !auth.lambda) throw jwtAuthError("$connect");
+    }
+
+    function jwtAuthError(route: string) {
+      return new VisibleError(
+        `The ${route} route uses "auth.jwt", but API Gateway only supports JWT auth on HTTP APIs. Use "auth.lambda" with a Lambda authorizer that verifies the token.`,
+      );
+    }
+
+    function createFunction() {
+      return functionBuilder(
+        `${name}Handler`,
+        args.handler,
+        {
+          description: interpolate`${api.name} route ${route}`,
+        },
+        args.handlerTransform,
+        { parent: self },
+      );
+    }
+
+    function createPermission() {
+      return new lambda.Permission(
+        `${name}Permissions`,
+        {
+          action: "lambda:InvokeFunction",
+          function: fn.arn,
+          qualifier: fn.qualifier.apply((qualifier) => qualifier!),
+          principal: "apigateway.amazonaws.com",
+          sourceArn: interpolate`${api.executionArn}/*`,
+        },
+        { parent: self },
+      );
+    }
+
+    function createIntegration() {
+      return new apigatewayv2.Integration(
+        ...transform(
+          args.transform?.integration,
+          `${name}Integration`,
+          {
+            apiId: api.id,
+            integrationType: "AWS_PROXY",
+            integrationUri: fn.targetArn.apply((arn) => {
+              const [, partition, , region] = arn.split(":");
+              return `arn:${partition}:apigateway:${region}:lambda:path/2015-03-31/functions/${arn}/invocations`;
+            }),
+          },
+          { parent: self, dependsOn: [permission] },
+        ),
+      );
+    }
+
+    function createApiRoute() {
+      const authArgs = all([args.route, args.auth]).apply(([route, auth]) => {
+        if (route !== "$connect") return { authorizationType: "NONE" };
+        if (!auth) return { authorizationType: "NONE" };
+        if (auth.iam) return { authorizationType: "AWS_IAM" };
+        if (auth.lambda)
+          return {
+            authorizationType: "CUSTOM",
+            authorizerId: auth.lambda,
+          };
+        if (auth.jwt) throw jwtAuthError(route);
+        return { authorizationType: "NONE" };
+      });
+
+      return authArgs.apply(
+        (authArgs) =>
+          new apigatewayv2.Route(
+            ...transform(
+              args.transform?.route,
+              `${name}Route`,
+              {
+                apiId: api.id,
+                routeKey: route,
+                target: interpolate`integrations/${integration.id}`,
+                ...authArgs,
+              },
+              { parent: self },
+            ),
+          ),
+      );
+    }
+  }
+
+  /**
+   * The underlying [resources](/docs/components/#nodes) this component creates.
+   */
+  public get nodes() {
+    const self = this;
+    return {
+      /**
+       * The Lambda function.
+       */
+      get function() {
+        return self.fn.apply((fn) => fn.getFunction());
+      },
+      /**
+       * The Lambda permission.
+       */
+      permission: this.permission,
+      /**
+       * The API Gateway HTTP API route.
+       */
+      route: this.apiRoute,
+      /**
+       * The API Gateway HTTP API integration.
+       */
+      integration: this.integration,
+    };
+  }
+}
+
+const __pulumiType = "sst:aws:ApiGatewayWebSocketRoute";
+// @ts-expect-error
+ApiGatewayWebSocketRoute.__pulumiType = __pulumiType;