@sst-community/sst 4.21.1 → 5.0.0-alpha.2

package/platform/src/components/aws/helpers/function-builder.ts

@@ -0,0 +1,133 @@
+import {
+  all,
+  ComponentResourceOptions,
+  Input,
+  Output,
+  output,
+} from "@pulumi/pulumi";
+import { Function, FunctionArgs, FunctionArn } from "../function.js";
+import { Workflow } from "../workflow.js";
+import { transform, Transform } from "../../component";
+import { VisibleError } from "../../error";
+import { splitQualifiedFunctionArn } from "./arn.js";
+
+export type FunctionBuilder = Output<{
+  getFunction: () => Function;
+  arn: Output<string>;
+  targetArn: Output<string>;
+  qualifier: Output<string | undefined>;
+  targetInvokeArn: Output<string>;
+  targetResponseStreamingInvokeArn: Output<string>;
+}>;
+
+export function functionBuilder(
+  name: string,
+  definition: Input<string | Workflow | Function | FunctionArgs | FunctionArn>,
+  defaultArgs: Pick<
+    FunctionArgs,
+    | "description"
+    | "link"
+    | "environment"
+    | "permissions"
+    | "url"
+    | "streaming"
+    | "_skipHint"
+  >,
+  argsTransform?: Transform<FunctionArgs>,
+  opts?: ComponentResourceOptions,
+): FunctionBuilder {
+  function buildResult(fn: Function) {
+    return {
+      getFunction: () => fn,
+      arn: fn.arn,
+      targetArn: fn.targetArn,
+      qualifier: fn.qualifier,
+      targetInvokeArn: fn.targetInvokeArn,
+      targetResponseStreamingInvokeArn: fn.targetResponseStreamingInvokeArn,
+    };
+  }
+
+  return output(definition).apply((definition) => {
+    if (definition instanceof Workflow) {
+      return buildResult(definition.getFunction());
+    }
+
+    if (definition instanceof Function) {
+      return buildResult(definition);
+    }
+
+    if (typeof definition === "string") {
+      // Case 1: The definition is an ARN
+      if (definition.startsWith("arn:")) {
+        const { unqualifiedArn, qualifier } = splitQualifiedFunctionArn(
+          definition,
+        );
+        const parts = definition.split(":");
+        return {
+          getFunction: () => {
+            throw new VisibleError(
+              "Cannot access the created function because it is referenced as an ARN.",
+            );
+          },
+          arn: output(unqualifiedArn),
+          targetArn: output(definition),
+          qualifier: output(qualifier),
+          targetInvokeArn: output(
+            `arn:${parts[1]}:apigateway:${parts[3]}:lambda:path/2015-03-31/functions/${definition}/invocations`,
+          ),
+          targetResponseStreamingInvokeArn: output(
+            `arn:${parts[1]}:apigateway:${parts[3]}:lambda:path/2021-11-15/functions/${definition}/response-streaming-invocations`,
+          ),
+        };
+      }
+
+      // Case 2: The definition is a handler
+      const fn = new Function(
+        ...transform(
+          argsTransform,
+          name,
+          { handler: definition, ...defaultArgs },
+          opts || {},
+        ),
+      );
+      return buildResult(fn);
+    }
+
+    // Case 3: The definition is a FunctionArgs
+    else if (definition.handler) {
+      const fn = new Function(
+        ...transform(
+          argsTransform,
+          name,
+          {
+            ...defaultArgs,
+            ...definition,
+            link: all([defaultArgs?.link, definition.link]).apply(
+              ([defaultLink, link]) => [
+                ...(defaultLink ?? []),
+                ...(link ?? []),
+              ],
+            ),
+            environment: all([
+              defaultArgs?.environment,
+              definition.environment,
+            ]).apply(([defaultEnvironment, environment]) => ({
+              ...(defaultEnvironment ?? {}),
+              ...(environment ?? {}),
+            })),
+            permissions: all([
+              defaultArgs?.permissions,
+              definition.permissions,
+            ]).apply(([defaultPermissions, permissions]) => [
+              ...(defaultPermissions ?? []),
+              ...(permissions ?? []),
+            ]),
+          },
+          opts || {},
+        ),
+      );
+      return buildResult(fn);
+    }
+    throw new Error(`Invalid function definition for the "${name}" Function`);
+  });
+}

package/platform/src/components/aws/helpers/function-code.ts

@@ -0,0 +1,224 @@
+import fs from "fs";
+import path from "path";
+import crypto from "crypto";
+import archiver from "archiver";
+import { glob } from "glob";
+import { VisibleError } from "../../error";
+import { toPosix } from "../../path";
+import { rpc } from "../../rpc/rpc";
+
+/** What building a function gives: where its code is, and how it's called. */
+export interface FunctionBundle {
+  /** The handler, as Lambda takes it: `index.handler`. */
+  handler: string;
+  /** The directory the built code is in. */
+  bundle: string;
+  /** Source maps the build wrote into the bundle. They aren't deployed with the code. */
+  sourcemaps?: string[];
+}
+
+/** A file added to a function's code: its path in the bundle, and what's in it. */
+export interface FunctionFile {
+  name: string;
+  content: string;
+}
+
+/**
+ * Build a function's code with the CLI.
+ *
+ * @param input What the CLI's `Runtime.Build` takes.
+ * @param postbuild The function's `hook.postbuild`, run on the built directory.
+ */
+export async function buildBundle(
+  input: Record<string, unknown>,
+  postbuild?: (dir: string) => Promise<void>,
+): Promise<FunctionBundle> {
+  const result = await rpc.call<{
+    handler: string;
+    out: string;
+    errors: string[];
+    sourcemaps: string[];
+  }>("Runtime.Build", input);
+  if (result.errors.length > 0) throw new Error(result.errors.join("\n"));
+  if (postbuild) await postbuild(result.out);
+  return {
+    handler: result.handler,
+    bundle: result.out,
+    sourcemaps: result.sourcemaps,
+  };
+}
+
+/**
+ * The stub that's deployed in place of a function in `sst dev`. It passes
+ * each invocation to the function running on the user's machine.
+ *
+ * @param durable A durable function needs the Node.js stub.
+ */
+export function devBridgeBundle(durable: boolean): FunctionBundle {
+  return durable
+    ? {
+        handler: "index.handler",
+        bundle: path.join($cli.paths.platform, "dist", "nodejs-bridge"),
+      }
+    : {
+        handler: "bootstrap",
+        bundle: path.join($cli.paths.platform, "dist", "bridge"),
+      };
+}
+
+/**
+ * Wrap a Node.js handler in a file that runs the function's `injections`
+ * before it. Returns the handler to deploy and the file to add to the code.
+ * Without injections that's the handler as it is, and no file.
+ *
+ * @param name The function's name, for the error message.
+ */
+export function injectHandler(
+  name: string,
+  input: {
+    bundle: string;
+    handler: string;
+    injections: string[];
+    streaming: boolean;
+  },
+): { handler: string; wrapper?: FunctionFile } {
+  const { bundle, handler, injections, streaming } = input;
+  if (injections.length === 0) return { handler };
+
+  const parsed = path.posix.parse(handler);
+  const dir = parsed.dir;
+  const file = parsed.name;
+  const fn = parsed.ext.replace(/^\./, "");
+
+  const ext = [".js", ".mjs", ".cjs"].find((ext) =>
+    fs.existsSync(path.join(bundle, dir, file + ext)),
+  );
+  if (!ext)
+    throw new VisibleError(
+      `Could not find handler file "${handler}" for function "${name}"`,
+    );
+
+  // An injection that starts with "outer:" goes outside of the handler
+  const outer = injections
+    .filter((item) => item.startsWith("outer:"))
+    .map((item) => item.substring("outer:".length));
+  const inner = injections.filter((item) => !item.startsWith("outer:"));
+
+  return {
+    handler: path.posix.join(dir, "server-index.handler"),
+    wrapper: {
+      name: path.posix.join(dir, "server-index.mjs"),
+      content: streaming
+        ? [
+            ...outer,
+            `export const handler = awslambda.streamifyResponse(async (event, responseStream, context) => {`,
+            ...inner,
+            `  const { ${fn}: rawHandler} = await import("./${file}${ext}");`,
+            `  return rawHandler(event, responseStream, context);`,
+            `});`,
+          ].join("\n")
+        : [
+            ...outer,
+            `export const handler = async (event, context) => {`,
+            ...inner,
+            `  const { ${fn}: rawHandler} = await import("./${file}${ext}");`,
+            `  return rawHandler(event, context);`,
+            `};`,
+          ].join("\n"),
+    },
+  };
+}
+
+/**
+ * Zip a function's code. The same code always gives the same zip, so its
+ * hash only changes when the code does.
+ *
+ * Pulumi can't zip the symlinks that pnpm puts in `node_modules`, so the zip
+ * is made here.
+ *
+ * @returns Where the zip is, and the hash of its contents.
+ */
+export async function zipCode(input: {
+  /** Where to write the zip. */
+  to: string;
+  /** The directory with the built code. */
+  bundle: string;
+  /** Files and directories to add from outside the bundle. */
+  copyFiles?: { from: string; to: string; isDir: boolean }[];
+  /** Source maps in the bundle, which are left out. */
+  sourcemaps?: string[];
+  /** A file to add. */
+  wrapper?: FunctionFile;
+  /**
+   * For a function that shares its `bundle` with others: its name. The CLI
+   * writes each one's linked resources to `.sst/<name>/resource.enc` in the
+   * bundle, and the zip keeps only this function's.
+   */
+  sharedBundle?: string;
+}) {
+  const { to, bundle, copyFiles = [], sourcemaps, wrapper, sharedBundle } =
+    input;
+  await fs.promises.mkdir(path.dirname(to), { recursive: true });
+
+  await new Promise(async (resolve, reject) => {
+    const ws = fs.createWriteStream(to);
+    const archive = archiver("zip", {
+      // Ensure deterministic zip file hashes
+      // https://github.com/archiverjs/node-archiver/issues/397#issuecomment-554327338
+      statConcurrency: 1,
+    });
+    archive.on("warning", reject);
+    archive.on("error", reject);
+    // archive has been finalized and the output file descriptor has closed, resolve promise
+    // this has to be done before calling `finalize` since the events may fire immediately after.
+    // see https://www.npmjs.com/package/archiver
+    ws.once("close", () => resolve(to));
+    archive.pipe(ws);
+
+    const files = [];
+    for (const item of [{ from: bundle, to: ".", isDir: true }, ...copyFiles]) {
+      if (!item.isDir) files.push({ from: item.from, to: item.to });
+      const found = await glob("**", {
+        cwd: item.from,
+        dot: true,
+        ignore: sourcemaps?.map((item) => path.relative(bundle, item)) || [],
+      });
+      const kept =
+        sharedBundle && item.from === bundle
+          ? found.filter((file) => ownFile(toPosix(file), sharedBundle))
+          : found;
+      files.push(
+        ...kept.map((file) => ({
+          from: path.join(item.from, file),
+          to: path.join(item.to, file),
+        })),
+      );
+    }
+    files.sort((a, b) => a.to.localeCompare(b.to));
+    for (const file of files)
+      archive.file(file.from, { name: file.to, date: new Date(0) });
+
+    if (wrapper)
+      archive.append(wrapper.content, { name: wrapper.name, date: new Date(0) });
+
+    await archive.finalize();
+  });
+
+  const hash = crypto
+    .createHash("sha256")
+    .update(await fs.promises.readFile(to))
+    .digest("hex");
+  return { path: to, hash };
+}
+
+// Whether a file of a shared bundle goes in the zip of the function named
+// `name`: not another function's `.sst` folder, and not the `resource.enc` an
+// older version wrote at the root, for all of them
+export function ownFile(file: string, name: string) {
+  if (file === "resource.enc") return false;
+  return (
+    !file.startsWith(".sst/") ||
+    file === `.sst/${name}` ||
+    file.startsWith(`.sst/${name}/`)
+  );
+}

package/platform/src/components/aws/helpers/function-part.ts

@@ -0,0 +1,212 @@
+import { all, Input, Output, output } from "@pulumi/pulumi";
+import { VisibleError } from "../../error";
+import { transformPart } from "../../transform";
+import type {
+  DeferredPart,
+  ManyPart,
+  Parts,
+  PartsComponent,
+} from "../../parts-component";
+import {
+  Function as OriginalFunction,
+  FunctionArgs as OriginalFunctionArgs,
+  FunctionArn,
+} from "../function";
+import { Function, FunctionArgs } from "../v5/function";
+import { Workflow } from "../workflow";
+import { splitQualifiedFunctionArn } from "./arn";
+
+/**
+ * A component's function: one the component created, or one the user
+ * already has. Either way it can be invoked through these.
+ */
+export type FunctionPart = Output<{
+  /** The function, when there is one to return: not for one given as an ARN. */
+  getFunction: () => Function;
+  arn: Output<string>;
+  /** The ARN to invoke: the latest version of a function that has versions. */
+  targetArn: Output<string>;
+  qualifier: Output<string | undefined>;
+  targetInvokeArn: Output<string>;
+  targetResponseStreamingInvokeArn: Output<string>;
+}>;
+
+/**
+ * What a user can pass for a function: a handler, its args, or one they
+ * have, as its ARN, the function itself, or the workflow it runs.
+ */
+export type FunctionDefinition = Input<
+  | string
+  | OriginalFunctionArgs
+  | FunctionArgs
+  | FunctionArn
+  | Function
+  | OriginalFunction
+  | Workflow
+>;
+
+/** Args a component adds to its function. Its link, environment and permissions are added to the user's. */
+export type FunctionDefaults = Pick<
+  FunctionArgs,
+  | "description"
+  | "link"
+  | "environment"
+  | "permissions"
+  | "url"
+  | "streaming"
+  | "_skipHint"
+>;
+
+/**
+ * Create a component's function part from what the user passed: a handler,
+ * the function's args, or the ARN of a function they already have.
+ *
+ * The part has to be declared as `deferred(Function)`. It's created once
+ * the definition is known, and not at all when it's an ARN.
+ *
+ * ```ts
+ * const parts = () => ({ function: deferred(Function) });
+ *
+ * const fn = functionPart(this, "function", args.subscriber, {
+ *   description: `Subscribed to ${name}`,
+ *   permissions: [{ actions: ["sqs:ReceiveMessage"], resources: [queueArn] }],
+ * });
+ * fn.arn; // works for all three
+ * ```
+ *
+ * @param component The component the function belongs to.
+ * @param key The part to create.
+ * @param definition The handler, function args, or function ARN.
+ * @param defaults Args the component adds: its link, environment and permissions are added to the user's.
+ */
+export function functionPart<P extends Parts, K extends FunctionKeys<P>>(
+  component: PartsComponent<P>,
+  key: K,
+  definition: FunctionDefinition,
+  defaults: FunctionDefaults,
+): FunctionPart;
+/**
+ * @param id Which one to create, for a part declared as `many(deferred(Function))`.
+ */
+export function functionPart<P extends Parts, K extends ManyFunctionKeys<P>>(
+  component: PartsComponent<P>,
+  key: K,
+  id: string,
+  definition: FunctionDefinition,
+  defaults: FunctionDefaults,
+): FunctionPart;
+export function functionPart(
+  component: PartsComponent<any>,
+  key: string,
+  ...rest: any[]
+): FunctionPart {
+  const [id, definition, defaults]: [
+    string | undefined,
+    FunctionDefinition,
+    FunctionDefaults,
+  ] = rest.length === 3 ? (rest as any) : [undefined, ...rest];
+
+  const part = component.partHandle(key, id);
+  // A function passed in `existing`, or its ARN, is used as it is
+  const given = (part.existing as FunctionDefinition | undefined) ?? definition;
+  // What was passed decides what to do, not the values inside it. Waiting on
+  // those too would leave the function out of a preview whenever an arg isn't
+  // known until the deploy, and `sst diff` would show it as deleted.
+  let fn: FunctionPart;
+  if (Output.isInstance(given) || typeof (given as any)?.then === "function") {
+    fn = output(given).apply(create);
+  } else {
+    const created = create(given);
+    fn = output(undefined).apply(() => created);
+  }
+  part.defer(() => fn.apply((fn) => fn.getFunction()));
+  return fn;
+
+  function create(definition: unknown) {
+    if (definition instanceof Function || definition instanceof OriginalFunction)
+      return use(definition);
+    if (definition instanceof Workflow) return use(definition.getFunction());
+    if (typeof definition === "string" && definition.startsWith("arn:"))
+      return useArn(definition);
+
+    const args: Record<string, any> =
+      typeof definition === "string"
+        ? { handler: definition }
+        : (definition as object);
+    if (!args?.handler)
+      throw new VisibleError(
+        `Invalid function definition for "${part.name}". Pass a handler, the function's args, or the ARN of a function.`,
+      );
+
+    return use(
+      new Function(
+        ...transformPart(
+          part.transform,
+          part.name,
+          // Written the way the 4.x `Function` takes it, or the V5 one
+          {
+            ...defaults,
+            ...args,
+            link: all([defaults.link, args.link]).apply(([added, link]) => [
+              ...(added ?? []),
+              ...(link ?? []),
+            ]),
+            environment: all([defaults.environment, args.environment]).apply(
+              ([added, environment]) => ({ ...added, ...environment }),
+            ),
+            permissions: all([defaults.permissions, args.permissions]).apply(
+              ([added, permissions]) => [
+                ...(added ?? []),
+                ...(permissions ?? []),
+              ],
+            ),
+          },
+          part.opts,
+        ),
+      ),
+    );
+  }
+}
+
+function use(fn: Function | OriginalFunction) {
+  return {
+    getFunction: () => fn as Function,
+    arn: fn.arn,
+    targetArn: fn.targetArn,
+    qualifier: fn.qualifier,
+    targetInvokeArn: fn.targetInvokeArn,
+    targetResponseStreamingInvokeArn: fn.targetResponseStreamingInvokeArn,
+  };
+}
+
+function useArn(arn: string) {
+  const { unqualifiedArn, qualifier } = splitQualifiedFunctionArn(arn);
+  const [, partition, , region] = arn.split(":");
+  const invoke = (api: string, path: string) =>
+    `arn:${partition}:apigateway:${region}:lambda:path/${api}/functions/${arn}/${path}`;
+  return {
+    getFunction: (): Function => {
+      throw new VisibleError(
+        "Cannot access the created function because it is referenced as an ARN.",
+      );
+    },
+    arn: output(unqualifiedArn),
+    targetArn: output(arn),
+    qualifier: output(qualifier),
+    targetInvokeArn: output(invoke("2015-03-31", "invocations")),
+    targetResponseStreamingInvokeArn: output(
+      invoke("2021-11-15", "response-streaming-invocations"),
+    ),
+  };
+}
+
+type FunctionKeys<P extends Parts> = {
+  [K in keyof P]: P[K] extends DeferredPart<typeof Function> ? K : never;
+}[keyof P] &
+  string;
+type ManyFunctionKeys<P extends Parts> = {
+  [K in keyof P]: P[K] extends ManyPart<DeferredPart<typeof Function>>
+    ? K
+    : never;
+}[keyof P] &
+  string;

package/platform/src/components/aws/helpers/function-permission.ts

@@ -0,0 +1,29 @@
+import { lambda } from "@pulumi/aws";
+import type { Input } from "../../input";
+import type { FunctionPart } from "./function-part";
+
+/**
+ * The args of the permission that lets an AWS service invoke a function part.
+ *
+ * ```ts
+ * const fn = functionPart(this, "subscriber", name, subscriber, {});
+ * this.part("permission", name, invokePermissionArgs(fn, "sns.amazonaws.com", this.arn));
+ * ```
+ *
+ * @param fn The function, from `functionPart()`.
+ * @param principal The service that invokes it, like `sns.amazonaws.com`.
+ * @param sourceArn What in that service may invoke it.
+ */
+export function invokePermissionArgs(
+  fn: FunctionPart,
+  principal: string,
+  sourceArn: Input<string>,
+): lambda.PermissionArgs {
+  return {
+    action: "lambda:InvokeFunction",
+    function: fn.arn,
+    qualifier: fn.qualifier.apply((qualifier) => qualifier!),
+    principal,
+    sourceArn,
+  };
+}

package/platform/src/components/aws/helpers/load-balancer-args.ts

@@ -0,0 +1,88 @@
+import type { ComponentResourceOptions } from "@pulumi/pulumi";
+import type { ec2, lb } from "@pulumi/aws";
+import { plainDeep } from "../../args";
+import type { Input } from "../../input";
+import { type CustomDomainArgs, customDomain } from "./custom-domain";
+
+/**
+ * The args of a load balancer's security group. It lets everything in and
+ * out: the listeners decide what's answered.
+ */
+export function securityGroupArgs(vpcId: Input<string>): ec2.SecurityGroupArgs {
+  const anywhere = () => [
+    {
+      fromPort: 0,
+      toPort: 0,
+      protocol: "-1",
+      cidrBlocks: ["0.0.0.0/0"],
+    },
+  ];
+  return {
+    description: "Managed by SST",
+    vpcId,
+    egress: anywhere(),
+    ingress: anywhere(),
+  };
+}
+
+/** What a listener answers when none of its rules match. */
+export function forbidden() {
+  return [
+    {
+      type: "fixed-response",
+      fixedResponse: {
+        statusCode: "403",
+        contentType: "text/plain",
+        messageBody: "Forbidden",
+      },
+    },
+  ];
+}
+
+/**
+ * How a load balancer's custom domain is set up, with the other names it
+ * answers to. The aliases are plain: a DNS record is named after each.
+ *
+ * @param owner What the domain belongs to, for error messages.
+ */
+export function domainOf(
+  domain:
+    | string
+    | (Partial<CustomDomainArgs> & { aliases?: string[] })
+    | undefined,
+  owner: string,
+) {
+  if (!domain) return undefined;
+  const custom = customDomain(domain, owner);
+  const names =
+    (typeof domain === "object"
+      ? plainDeep(domain.aliases, `The domain's "aliases" in ${owner}`)
+      : undefined) ?? [];
+  return { ...custom, aliases: names };
+}
+
+/**
+ * Point a domain and each of its aliases at a load balancer.
+ *
+ * @param name The component's name.
+ * @param opts The component's `delegateOpts()`.
+ */
+export function pointDomainAt(
+  name: string,
+  domain: NonNullable<ReturnType<typeof domainOf>>,
+  loadBalancer: lb.LoadBalancer,
+  opts: ComponentResourceOptions,
+) {
+  const pointAt = (prefix: string, record: Input<string>) =>
+    domain.dns?.createAlias(
+      prefix,
+      {
+        name: record,
+        aliasName: loadBalancer.dnsName,
+        aliasZone: loadBalancer.zoneId,
+      },
+      opts,
+    );
+  pointAt(name, domain.name);
+  for (const alias of domain.aliases) pointAt(`${name}${alias}`, alias);
+}

package/platform/src/components/aws/helpers/load-balancer.ts

@@ -0,0 +1,17 @@
+/**
+ * Build a listener key from protocol and port (e.g. "HTTPS443").
+ */
+export function listenerKey(protocol: string, port: number): string {
+  return `${protocol.toUpperCase()}${port}`;
+}
+
+/**
+ * Build a target group key from container name, protocol and port (e.g. "appHTTP3000").
+ */
+export function targetKey(
+  container: string,
+  protocol: string,
+  port: number,
+): string {
+  return `${container}${protocol.toUpperCase()}${port}`;
+}