@sst-community/sst 4.20.0 → 5.0.0-alpha.1

package/platform/src/components/aws/takeover/bucket.ts

@@ -0,0 +1,94 @@
+import { interpolate } from "@pulumi/pulumi";
+import { takeover } from "../../takeover";
+import { hashStringToPrettyString, logicalName } from "../../naming";
+import { Bucket } from "../v5/bucket";
+import { childOf } from "./helpers";
+
+// The 4.x `Bucket` keeps what `notify()` creates in a component of its own,
+// named after the bucket. It's created with the bucket's own options, so it's
+// next to the bucket wherever the bucket is. The V5 one keeps it inside the
+// bucket, with each notification's resources under the notification's name.
+//
+// A bucket referenced with the 4.x `Bucket.get` isn't given the options `get`
+// is given, so its notifications are at the top of the app whatever those say.
+const NOTIFICATION = "sst:aws:BucketNotification";
+const notified = (bucket: Bucket, name: string, child: string) => [
+  childOf(NOTIFICATION, `${name}Notifications`, child, bucket),
+  childOf(NOTIFICATION, `${name}Notifications`, child),
+];
+
+// The deprecated `subscribe()`, `subscribeQueue()` and `subscribeTopic()`
+// keep theirs in a subscriber component at the top of the app, named after
+// the bucket's ARN. A bucket has at most one, and never next to a `notify()`.
+const FUNCTION = "sst:aws:BucketLambdaSubscriber";
+const SUBSCRIBERS = [
+  FUNCTION,
+  "sst:aws:BucketQueueSubscriber",
+  "sst:aws:BucketTopicSubscriber",
+];
+const subscriber = (bucket: Bucket, name: string) =>
+  bucket.nodes.bucket.arn.apply(
+    (arn) => `${name}Subscriber${logicalName(hashStringToPrettyString(arn, 6))}`,
+  );
+// The policy of a subscribed queue or topic was created outside of the
+// subscriber component, with no parent.
+const subscriberPolicy = (bucket: Bucket, name: string) => ({
+  name: interpolate`${subscriber(bucket, name)}Policy`,
+  parent: false as const,
+});
+// The static `subscribeEventBridge()` keeps each subscription in a component
+// at the top of the app, named after the bucket's own name. It only had the
+// name, so the bucket was the bucket's physical name or one given by hand.
+const BUS_FUNCTION = "sst:aws:BusLambdaSubscriber";
+const eventBridgeSubscriber = (bucket: Bucket, id?: string) =>
+  bucket.name.apply(
+    (bucketName) => `${logicalName(bucketName)}EventBridgeSubscriber${id}`,
+  );
+
+// The one subscriber becomes one notification: the first of its kind. Two
+// resources can't both be what it was.
+const first = (created: Record<string, unknown>) =>
+  Object.keys(created).length === 0;
+
+takeover(Bucket, {
+  moved: {
+    notification: (bucket, { name }) => [
+      ...notified(bucket, name, "Notification"),
+      ...SUBSCRIBERS.map((type) =>
+        childOf(type, subscriber(bucket, name), "Notification"),
+      ),
+    ],
+    subscriber: (bucket, { name, id }) => [
+      ...notified(bucket, name, `Notification${id}`),
+      ...(first(bucket.nodes.subscriber)
+        ? [childOf(FUNCTION, subscriber(bucket, name), "Function")]
+        : []),
+    ],
+    permission: (bucket, { name, id }) => [
+      ...notified(bucket, name, `Notification${id}Permission`),
+      ...(first(bucket.nodes.permission)
+        ? [childOf(FUNCTION, subscriber(bucket, name), "Permission")]
+        : []),
+    ],
+    queuePolicy: (bucket, { name, id }) => [
+      ...notified(bucket, name, `Notification${id}Policy`),
+      ...(first(bucket.nodes.queuePolicy)
+        ? [subscriberPolicy(bucket, name)]
+        : []),
+    ],
+    topicPolicy: (bucket, { name, id }) => [
+      ...notified(bucket, name, `Notification${id}Policy`),
+      ...(first(bucket.nodes.topicPolicy)
+        ? [subscriberPolicy(bucket, name)]
+        : []),
+    ],
+    eventBridgeSubscriber: (bucket, { id }) =>
+      childOf(BUS_FUNCTION, eventBridgeSubscriber(bucket, id), "Function"),
+    eventBridgePermission: (bucket, { id }) =>
+      childOf(BUS_FUNCTION, eventBridgeSubscriber(bucket, id), "Permission"),
+    eventBridgeRule: (bucket, { id }) =>
+      childOf(BUS_FUNCTION, eventBridgeSubscriber(bucket, id), "Rule"),
+    eventBridgeTarget: (bucket, { id }) =>
+      childOf(BUS_FUNCTION, eventBridgeSubscriber(bucket, id), "Target"),
+  },
+});

package/platform/src/components/aws/takeover/bus.ts

@@ -0,0 +1,43 @@
+import { takeover } from "../../takeover";
+import { Bus } from "../v5/bus";
+import { childOf } from "./helpers";
+
+// The 4.x `Bus` keeps each subscription in a component of its own, at the top
+// of the app. The V5 one keeps them inside the bus. The component was named
+// after the bus and the subscriber: after the bus's component for one added
+// with `bus.subscribe()`, and after the bus's own name for one added with the
+// static `Bus.subscribe()`, which only has the bus's ARN.
+const FUNCTION = "sst:aws:BusLambdaSubscriber";
+const QUEUE = "sst:aws:BusQueueSubscriber";
+const subscribers = (bus: Bus, name: string, id?: string) => [
+  `${name}Subscriber${id}`,
+  bus.name.apply((busName) => `${busName}Subscriber${id}`),
+];
+
+takeover(Bus, {
+  moved: {
+    subscriber: (bus, { name, id }) =>
+      subscribers(bus, name, id).map((subscriber) =>
+        childOf(FUNCTION, subscriber, "Function"),
+      ),
+    permission: (bus, { name, id }) =>
+      subscribers(bus, name, id).map((subscriber) =>
+        childOf(FUNCTION, subscriber, "Permission"),
+      ),
+    // A rule and a target were in either kind of subscriber
+    rule: (bus, { name, id }) =>
+      subscribers(bus, name, id).flatMap((subscriber) => [
+        childOf(FUNCTION, subscriber, "Rule"),
+        childOf(QUEUE, subscriber, "Rule"),
+      ]),
+    target: (bus, { name, id }) =>
+      subscribers(bus, name, id).flatMap((subscriber) => [
+        childOf(FUNCTION, subscriber, "Target"),
+        childOf(QUEUE, subscriber, "Target"),
+      ]),
+    queuePolicy: (bus, { name, id }) =>
+      subscribers(bus, name, id).map((subscriber) =>
+        childOf(QUEUE, subscriber, "Policy"),
+      ),
+  },
+});

package/platform/src/components/aws/takeover/cognito-user-pool.ts

@@ -0,0 +1,21 @@
+import { takeover } from "../../takeover";
+import { CognitoUserPool } from "../v5/cognito-user-pool";
+import { childOf } from "./helpers";
+
+// The 4.x `CognitoUserPool` keeps each identity provider in a component of its
+// own. That component isn't inside the user pool or named after it: it's next
+// to it, under the name the provider was added with. The V5 one keeps them
+// inside the user pool, under that name.
+const IDENTITY_PROVIDER = "sst:aws:CognitoIdentityProvider";
+
+takeover(CognitoUserPool, {
+  moved: {
+    certificate: "ssl",
+    // A trigger's function and permission were named after the trigger the
+    // way it's written, "preSignUp", without a capital.
+    trigger: (_, { name, id }) => ({ name: `${name}Trigger${id}` }),
+    permission: (_, { name, id }) => ({ name: `${name}Permission${id}` }),
+    identityProvider: (_, { id }) =>
+      childOf(IDENTITY_PROVIDER, id!, "IdentityProvider"),
+  },
+});

package/platform/src/components/aws/takeover/cron-v2.ts

@@ -0,0 +1,9 @@
+import { takeover } from "../../takeover";
+import { CronV2 } from "../v5/cron-v2";
+
+takeover(CronV2, {
+  moved: {
+    // The 4.x `CronV2` calls the function the job's handler
+    function: "handler",
+  },
+});

package/platform/src/components/aws/takeover/dsql.ts

@@ -0,0 +1,12 @@
+import { takeover } from "../../takeover";
+import { Dsql } from "../v5/dsql";
+
+takeover(Dsql, {
+  moved: {
+    // The 4.x `Dsql` numbers the two sides of the peering
+    clusterPeering: "peering1",
+    peerClusterPeering: "peering2",
+    // What's in the peer region is named "peer" first, like the peer cluster
+    peerBackupVault: "backupVaultPeer",
+  },
+});

package/platform/src/components/aws/takeover/dynamo.ts

@@ -0,0 +1,31 @@
+import { takeover } from "../../takeover";
+import { logicalName } from "../../naming";
+import { Dynamo } from "../v5/dynamo";
+import { childOf } from "./helpers";
+
+// The 4.x `Dynamo` keeps each subscription in a component of its own, at the
+// top of the app. The V5 one keeps them inside the table. The component was
+// named after the table and the subscriber: after the table's component for one
+// added with `table.subscribe()`, and after the table's own name for one added
+// with the static `Dynamo.subscribe()`, which only has a stream ARN.
+//
+// A subscriber that was added without a name isn't carried over: its name was
+// made from the filters and the handler.
+const SUBSCRIBER = "sst:aws:DynamoLambdaSubscriber";
+const subscribers = (table: Dynamo, name: string, id?: string) => [
+  `${name}Subscriber${id}`,
+  table.name.apply((tableName) => `${logicalName(tableName)}Subscriber${id}`),
+];
+
+takeover(Dynamo, {
+  moved: {
+    subscriber: (table, { name, id }) =>
+      subscribers(table, name, id).map((subscriber) =>
+        childOf(SUBSCRIBER, subscriber, "Function"),
+      ),
+    eventSourceMapping: (table, { name, id }) =>
+      subscribers(table, name, id).map((subscriber) =>
+        childOf(SUBSCRIBER, subscriber, "EventSourceMapping"),
+      ),
+  },
+});

package/platform/src/components/aws/takeover/efs.ts

@@ -0,0 +1,9 @@
+import { takeover } from "../../takeover";
+import { Efs } from "../v5/efs";
+
+takeover(Efs, {
+  moved: {
+    // Named after the subnet's id as it's written: `MyEfsMountTargetsubnet-0a1b`
+    mountTarget: (_, { name, id }) => ({ name: `${name}MountTarget${id}` }),
+  },
+});

package/platform/src/components/aws/takeover/function.ts

@@ -0,0 +1,21 @@
+import { takeover } from "../../takeover";
+import { Function } from "../v5/function";
+
+takeover(Function, {
+  moved: {
+    // The 4.x `Function` names the two permissions of a URL after who they're
+    // for: everyone, or the distribution of the router the URL is behind.
+    urlAccess: (_, { name }) => [
+      { name: `${name}PublicFunctionUrlAccess` },
+      { name: `${name}CloudFrontFunctionUrlAccess` },
+    ],
+    urlInvoke: (_, { name }) => [
+      { name: `${name}InvokeFunction` },
+      { name: `${name}PublicInvokeFunction` },
+      { name: `${name}CloudFrontInvokeFunction` },
+    ],
+    // The 4.x `Function` creates the alias outside of the function, with no
+    // parent
+    urlAlias: (_, { name }) => ({ name: `${name}Durable`, parent: false }),
+  },
+});

package/platform/src/components/aws/takeover/helpers.ts

@@ -0,0 +1,26 @@
+import { Input, Resource, interpolate } from "@pulumi/pulumi";
+import type { OldAddress } from "../../takeover";
+
+/**
+ * The old address of a resource that 4.x kept in a component of its own,
+ * next to the one it belongs to now. A subscription was kept this way: in a
+ * subscriber component beside the queue or topic it subscribes to.
+ *
+ * @param type The type of the component it was in.
+ * @param component The name of the component it was in.
+ * @param child What the resource was called inside it, added to that name.
+ * @param beside The component that one was created next to, when 4.x gave it
+ * that component's parent. Leave it out when 4.x always created it at the top
+ * of the app.
+ */
+export function childOf(
+  type: string,
+  component: Input<string>,
+  child: string,
+  beside?: Resource,
+): OldAddress {
+  return {
+    parent: { type, name: component, beside },
+    name: interpolate`${component}${child}`,
+  };
+}

package/platform/src/components/aws/takeover/index.ts

@@ -0,0 +1,27 @@
+/**
+ * How each V5 component takes over from the 4.x component it replaces, so
+ * that changing `sst.aws.Queue` to `sst.aws.v5.Queue` keeps what's already
+ * deployed.
+ *
+ * The V5 components don't know about any of this. When the 4.x components are
+ * removed, this folder goes with them.
+ */
+import "./alb";
+import "./apigatewayv2";
+import "./app-sync";
+import "./aurora";
+import "./bucket";
+import "./bus";
+import "./cognito-user-pool";
+import "./cron-v2";
+import "./dsql";
+import "./dynamo";
+import "./efs";
+import "./function";
+import "./mysql";
+import "./postgres";
+import "./queue";
+import "./redis";
+import "./service";
+import "./sns-topic";
+import "./task";

package/platform/src/components/aws/takeover/mysql.ts

@@ -0,0 +1,17 @@
+import { takeover } from "../../takeover";
+import { Mysql } from "../v5/mysql";
+
+takeover(Mysql, {
+  moved: {
+    // The 4.x `Mysql` calls the secret with the master user's credentials the
+    // "proxy" secret, though it's created without a proxy too
+    secret: "proxySecret",
+    secretVersion: "proxySecretVersion",
+    // The secret of an additional user was named after the username as it
+    // was written
+    proxySecret: (_, { name, id }) => ({ name: `${name}ProxySecret${id}` }),
+    proxySecretVersion: (_, { name, id }) => ({
+      name: `${name}ProxySecretVersion${id}`,
+    }),
+  },
+});

package/platform/src/components/aws/takeover/postgres.ts

@@ -0,0 +1,17 @@
+import { takeover } from "../../takeover";
+import { Postgres } from "../v5/postgres";
+
+takeover(Postgres, {
+  moved: {
+    // The 4.x `Postgres` calls the secret with the master user's credentials
+    // the "proxy" secret, though it's created without a proxy too
+    secret: "proxySecret",
+    secretVersion: "proxySecretVersion",
+    // The secret of an additional user was named after the username as it
+    // was written
+    proxySecret: (_, { name, id }) => ({ name: `${name}ProxySecret${id}` }),
+    proxySecretVersion: (_, { name, id }) => ({
+      name: `${name}ProxySecretVersion${id}`,
+    }),
+  },
+});

package/platform/src/components/aws/takeover/queue.ts

@@ -0,0 +1,21 @@
+import { takeover } from "../../takeover";
+import { hashStringToPrettyString, logicalName } from "../../naming";
+import { Queue } from "../v5/queue";
+import { childOf } from "./helpers";
+
+// The 4.x `Queue` keeps a subscription in a component of its own, next to the
+// queue and named after the queue's ARN. The V5 one keeps it inside the queue.
+const SUBSCRIBER = "sst:aws:QueueLambdaSubscriber";
+const subscriber = (queue: Queue, name: string) =>
+  queue.arn.apply(
+    (arn) => `${name}Subscriber${logicalName(hashStringToPrettyString(arn, 6))}`,
+  );
+
+takeover(Queue, {
+  moved: {
+    subscriber: (queue, { name }) =>
+      childOf(SUBSCRIBER, subscriber(queue, name), "Function"),
+    eventSourceMapping: (queue, { name }) =>
+      childOf(SUBSCRIBER, subscriber(queue, name), "EventSourceMapping"),
+  },
+});

package/platform/src/components/aws/takeover/redis.ts

@@ -0,0 +1,10 @@
+import { takeover } from "../../takeover";
+import { Redis } from "../v5/redis";
+
+takeover(Redis, {
+  moved: {
+    // The 4.x `Redis` calls these "proxy" secrets, though there is no proxy
+    secret: "proxySecret",
+    secretVersion: "proxySecretVersion",
+  },
+});

package/platform/src/components/aws/takeover/service.ts

@@ -0,0 +1,22 @@
+import { takeover } from "../../takeover";
+import { Service } from "../v5/service";
+
+takeover(Service, {
+  moved: {
+    // The 4.x `Service` calls the task definition the task
+    taskDefinition: "task",
+    certificate: "ssl",
+    // These were named after what they're for as it was written: a
+    // container's name, the "TCP_UDP" protocol
+    image: (_, { name, id }) => ({ name: `${name}Image${id}` }),
+    logGroup: (_, { name, id }) => ({ name: `${name}LogGroup${id}` }),
+    target: (_, { name, id }) => ({ name: `${name}Target${id}` }),
+    listener: (_, { name, id }) => ({ name: `${name}Listener${id}` }),
+    // A rule of the service's own load balancer was named after its
+    // listener, and a rule on an `Alb` after the `Alb`
+    listenerRule: (_, { name, id }) => [
+      { name: `${name}Listener${id}` },
+      { name: `${name}AlbRule${id}` },
+    ],
+  },
+});

package/platform/src/components/aws/takeover/sns-topic.ts

@@ -0,0 +1,27 @@
+import { takeover } from "../../takeover";
+import { SnsTopic } from "../v5/sns-topic";
+import { childOf } from "./helpers";
+
+// The 4.x `SnsTopic` keeps each subscription in a component of its own, next to
+// the topic and named after the subscriber. The V5 one keeps them inside the
+// topic. A subscriber that was added without a name isn't carried over: its
+// name was made from the topic's ARN, the filter and the handler.
+const FUNCTION = "sst:aws:SnsTopicLambdaSubscriber";
+const QUEUE = "sst:aws:SnsTopicQueueSubscriber";
+const subscriber = (topic: string, name?: string) => `${topic}Subscriber${name}`;
+
+takeover(SnsTopic, {
+  moved: {
+    subscriber: (_, { name, id }) =>
+      childOf(FUNCTION, subscriber(name, id), "Function"),
+    permission: (_, { name, id }) =>
+      childOf(FUNCTION, subscriber(name, id), "Permission"),
+    // A subscription was in either kind of subscriber
+    subscription: (_, { name, id }) => [
+      childOf(FUNCTION, subscriber(name, id), "Subscription"),
+      childOf(QUEUE, subscriber(name, id), "Subscription"),
+    ],
+    queuePolicy: (_, { name, id }) =>
+      childOf(QUEUE, subscriber(name, id), "Policy"),
+  },
+});

package/platform/src/components/aws/takeover/task.ts

@@ -0,0 +1,13 @@
+import { takeover } from "../../takeover";
+import { Task } from "../v5/task";
+
+takeover(Task, {
+  moved: {
+    // The 4.x `Task` calls the task definition the task
+    taskDefinition: "task",
+    // A container's image and log group were named after the container's
+    // name as it was written
+    image: (_, { name, id }) => ({ name: `${name}Image${id}` }),
+    logGroup: (_, { name, id }) => ({ name: `${name}LogGroup${id}` }),
+  },
+});