@stacksjs/cloud 0.58.48 → 0.58.49

package/src/cloud/lambda/summarize/index.js

@@ -0,0 +1,35 @@
+const AWS = require('aws-sdk')
+
+async function handler(event) {
+  const requestBody = JSON.parse(event.body)
+
+  // Extract the 'question' property from the request body
+  const text = requestBody.text
+  // eslint-disable-next-line no-console
+  console.log(`Text received: ${text}`)
+
+  const bedrockRuntime = new AWS.BedrockRuntime({ apiVersion: '2023-09-30' })
+  const res = await bedrockRuntime.invokeModel({
+    modelId: 'amazon.titan-text-express-v1',
+    contentType: 'application/json',
+    accept: '*/*',
+    body: JSON.stringify({
+      inputText: `Summarize the following text: ${text}`,
+      textGenerationConfig: {
+        maxTokenCount: 512,
+        stopSequences: [],
+        temperature: 0,
+        topP: 0.9,
+      },
+    }),
+  }).promise()
+
+  return {
+    statusCode: 200,
+    body: res.body.toString(),
+  }
+}
+
+module.exports = {
+  handler,
+}

package/src/cloud/network.ts

@@ -0,0 +1,52 @@
+import { aws_ec2 as ec2 } from 'aws-cdk-lib'
+import type { Construct } from 'constructs'
+import type { NestedCloudProps } from '../types'
+
+export interface NetworkStackProps extends NestedCloudProps {
+  //
+}
+
+export class NetworkStack {
+  vpc: ec2.Vpc
+
+  constructor(scope: Construct, props: NetworkStackProps) {
+    this.vpc = new ec2.Vpc(scope, 'Network', {
+      vpcName: `${props.slug}-${props.appEnv}-vpc`,
+      ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16'),
+      maxAzs: 3,
+      natGateways: 0,
+      subnetConfiguration: [
+        {
+          cidrMask: 21,
+          name: `${props.slug}-${props.appEnv}-public-subnet-1`,
+          subnetType: ec2.SubnetType.PUBLIC,
+        },
+        {
+          cidrMask: 21,
+          name: `${props.slug}-${props.appEnv}-public-subnet-2`,
+          subnetType: ec2.SubnetType.PUBLIC,
+        },
+        {
+          cidrMask: 21,
+          name: `${props.slug}-${props.appEnv}-public-subnet-3`,
+          subnetType: ec2.SubnetType.PUBLIC,
+        },
+        {
+          cidrMask: 21,
+          name: `${props.slug}-${props.appEnv}-private-subnet-1`,
+          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
+        },
+        {
+          cidrMask: 21,
+          name: `${props.slug}-${props.appEnv}-private-subnet-2`,
+          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
+        },
+        {
+          cidrMask: 21,
+          name: `${props.slug}-${props.appEnv}-private-subnet-3`,
+          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
+        },
+      ],
+    })
+  }
+}

package/src/cloud/package/README.md

@@ -0,0 +1,59 @@
+# Stacks Router
+
+This package contains the Stacks Router.
+
+## ☘️ Features
+
+wip
+
+- ⚡️
+
+wip
+
+## 🤖 Usage
+
+wip
+
+```bash
+bun install -d @stacksjs/actions
+```
+
+Now, you can use it in your project:
+
+```js
+import * as router from '@stacksjs/router'
+
+// wip
+```
+
+Learn more in the docs.
+
+## 🧪 Testing
+
+```bash
+bun test
+```
+
+## 📈 Changelog
+
+Please see our [releases](https://github.com/stacksjs/stacks/releases) page for more information on what has changed recently.
+
+## 🚜 Contributing
+
+Please review the [Contributing Guide](https://github.com/stacksjs/contributing) for details.
+
+## 🏝 Community
+
+For help, discussion about best practices, or any other conversation that would benefit from being searchable:
+
+[Discussions on GitHub](https://github.com/stacksjs/stacks/discussions)
+
+For casual chit-chat with others using this package:
+
+[Join the Stacks Discord Server](https://discord.gg/stacksjs)
+
+## 📄 License
+
+The MIT License (MIT). Please see [LICENSE](https://github.com/stacksjs/stacks/tree/main/LICENSE.md) for more information.
+
+Made with 💙

package/src/cloud/package/package.json

@@ -0,0 +1,63 @@
+{
+  "name": "@stacksjs/router",
+  "type": "module",
+  "version": "0.58.49",
+  "description": "The Stacks framework router.",
+  "author": "Chris Breuer",
+  "license": "MIT",
+  "funding": "https://github.com/sponsors/chrisbbreuer",
+  "homepage": "https://github.com/stacksjs/stacks/tree/main/storage/framework/core/router#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/stacksjs/stacks.git",
+    "directory": "./storage/framework/core/router"
+  },
+  "bugs": {
+    "url": "https://github.com/stacksjs/stacks/issues"
+  },
+  "keywords": [
+    "router",
+    "stacks",
+    "framework",
+    "typescript",
+    "javascript"
+  ],
+  "exports": {
+    ".": {
+      "bun": "./src/index.ts",
+      "import": "./dist/index.js"
+    },
+    "./*": {
+      "bun": "./src/*",
+      "import": "./dist/*"
+    }
+  },
+  "module": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "contributors": [
+    "Chris Breuer <chris@stacksjs.org>"
+  ],
+  "files": [
+    "README.md",
+    "dist",
+    "src"
+  ],
+  "scripts": {
+    "build": "bun --bun build.ts",
+    "typecheck": "bun --bun tsc --noEmit",
+    "prepublishOnly": "bun --bun run build"
+  },
+  "peerDependencies": {
+    "@stacksjs/config": "latest",
+    "unplugin-vue-router": "^0.7.0",
+    "vue-router": "^4.2.5"
+  },
+  "dependencies": {
+    "@stacksjs/config": "latest",
+    "unplugin-vue-router": "^0.7.0",
+    "vue-router": "^4.2.5"
+  },
+  "devDependencies": {
+    "@stacksjs/development": "latest"
+  }
+}

package/src/cloud/permissions.ts

@@ -0,0 +1,33 @@
+import { SecretValue, aws_iam as iam } from 'aws-cdk-lib'
+import type { Construct } from 'constructs'
+import { config } from '@stacksjs/config'
+import { string } from '@stacksjs/strings'
+import { env } from '@stacksjs/env'
+import type { NestedCloudProps } from '../types'
+
+export interface PermissionsStackProps extends NestedCloudProps {
+  //
+}
+
+export class PermissionsStack {
+  constructor(scope: Construct) {
+    const teamName = config.team.name
+    const users = config.team.members
+    const password = env.AWS_DEFAULT_PASSWORD || string.random()
+
+    for (const name in users) {
+      // const userEmail = users[userName]
+      const id = `User${string.pascalCase(teamName)}${string.pascalCase(name)}`
+      const userName = string.slug(`${teamName}-${name}`)
+      const user = new iam.User(scope, id, {
+        userName,
+        password: SecretValue.unsafePlainText(password),
+        passwordResetRequired: true,
+      })
+
+      user.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess'))
+
+      // TODO: email the userEmail their credentials
+    }
+  }
+}

package/src/cloud/redirects.ts

@@ -0,0 +1,45 @@
+/* eslint-disable no-new */
+import { config } from '@stacksjs/config'
+import { RemovalPolicy, aws_route53 as route53, aws_s3 as s3 } from 'aws-cdk-lib'
+import type { Construct } from 'constructs'
+import type { NestedCloudProps } from '../types'
+
+export interface RedirectsStackProps extends NestedCloudProps {
+  //
+}
+
+export class RedirectsStack {
+  redirectZones: route53.IHostedZone[] = []
+
+  constructor(scope: Construct, props: RedirectsStackProps) {
+    // for each redirect, create a bucket & redirect it to the APP_URL
+    config.dns.redirects?.forEach((redirect) => {
+      // TODO: use string-ts function here instead
+      const slug = redirect.split('.').map((part, index) => index === 0 ? part : part.charAt(0).toUpperCase() + part.slice(1)).join('') // creates a CamelCase slug from the redirect
+      const hostedZone = route53.HostedZone.fromLookup(scope, 'HostedZone', { domainName: redirect })
+
+      const redirectBucket = new s3.Bucket(scope, `RedirectBucket${slug}`, {
+        bucketName: `${redirect}-redirect`,
+        websiteRedirect: {
+          hostName: props.domain,
+          protocol: s3.RedirectProtocol.HTTPS,
+        },
+        removalPolicy: RemovalPolicy.DESTROY,
+        autoDeleteObjects: true,
+      })
+
+      new route53.CnameRecord(scope, `RedirectRecord${slug}`, {
+        zone: hostedZone,
+        recordName: 'redirect',
+        domainName: redirectBucket.bucketWebsiteDomainName,
+      })
+    })
+
+    // TODO: fix this – redirects do not work yet
+    config.dns.redirects?.forEach((redirect) => {
+      const slug = redirect.split('.').map((part, index) => index === 0 ? part : part.charAt(0).toUpperCase() + part.slice(1)).join('') // creates a CamelCase slug from the redirect
+      const hostedZone = route53.HostedZone.fromLookup(scope, `RedirectHostedZone${slug}`, { domainName: redirect })
+      this.redirectZones.push(hostedZone)
+    })
+  }
+}

package/src/cloud/router-layer/nodejs/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "stacks-router-layer",
+  "version": "0.58.49",
+  "description": "",
+  "author": "",
+  "license": "MIT",
+  "keywords": [],
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "dependencies": {
+    "@stacksjs/router": "^0.58.48"
+  }
+}

package/src/cloud/search-engine.ts

@@ -0,0 +1,108 @@
+// async manageSearchEngine() {
+//   const vpc = this.vpc
+
+//   // Security Group
+//   const bastionSecurityGroup = new ec2.SecurityGroup(this, 'BastionSecurityGroup', {
+//     vpc,
+//     allowAllOutbound: true,
+//     securityGroupName: `${this.appName}-${appEnv}-bastion-sg`,
+//   })
+
+//   const opensearchSecurityGroup = new ec2.SecurityGroup(this, 'OpenSearchSecurityGroup', {
+//     vpc,
+//     securityGroupName: `${this.appName}-${appEnv}-opensearch-sg`,
+//   })
+
+//   opensearchSecurityGroup.addIngressRule(bastionSecurityGroup, ec2.Port.tcp(443))
+
+//   // Service-linked role that Amazon OpenSearch Service will use
+//   const iamClient = new IAMClient({})
+//   const response = await iamClient.send(
+//     new ListRolesCommand({
+//       PathPrefix: '/aws-service-role/opensearchservice.amazonaws.com/',
+//     }),
+//   )
+
+//   // Only if the role for OpenSearch Service doesn't exist, it will be created.
+//   if (response.Roles && response.Roles?.length === 0) {
+//     new iam.CfnServiceLinkedRole(this, 'OpenSearchServiceLinkedRole', {
+//       awsServiceName: 'es.amazonaws.com',
+//     })
+//   }
+
+//   // Bastion host to access Opensearch Dashboards
+//   new ec2.BastionHostLinux(this, 'BastionHost', {
+//     vpc,
+//     securityGroup: bastionSecurityGroup,
+//     machineImage: ec2.MachineImage.latestAmazonLinux2023(),
+//     blockDevices: [
+//       {
+//         deviceName: '/dev/xvda',
+//         volume: ec2.BlockDeviceVolume.ebs(10, {
+//           encrypted: true,
+//         }),
+//       },
+//     ],
+//   })
+
+//   // OpenSearch domain
+//   const domain = new opensearch.Domain(this, 'OpenSearchDomain', {
+//     version: opensearch.EngineVersion.OPENSEARCH_2_9,
+//     nodeToNodeEncryption: true,
+//     enforceHttps: true,
+//     encryptionAtRest: {
+//       enabled: true,
+//     },
+//     vpc,
+//     // unsure if there are "better" ways to do this
+//     vpcSubnets: [
+//       { subnetGroupName: `${this.appName}-${appEnv}-private-subnet-1` },
+//       { subnetGroupName: `${this.appName}-${appEnv}-private-subnet-2` },
+//     ],
+
+//     capacity: {
+//       masterNodes: 2,
+//       dataNodes: 2,
+//       multiAzWithStandbyEnabled: true,
+//     },
+//     ebs: {
+//       volumeSize: 10,
+//       volumeType: ec2.EbsDeviceVolumeType.GP3, // or opensearch.EbsVolumeType.IO1
+//     },
+//     removalPolicy: RemovalPolicy.DESTROY,
+//     zoneAwareness: {
+//       enabled: true,
+//       availabilityZoneCount: 2,
+//     },
+//     securityGroups: [opensearchSecurityGroup],
+//   })
+
+//   domain.addAccessPolicies(
+//     new iam.PolicyStatement({
+//       principals: [new iam.AnyPrincipal()],
+//       actions: ['es:ESHttp*'],
+//       resources: [`${domain.domainArn}/*`],
+//     }),
+//   )
+
+//   // // Lambda
+//   // const dataIndexFunction = PythonFunction(this, 'DataIndex', {
+//   //   runtime: lambda.Runtime.PYTHON_3_10,
+//   //   entry: 'lambda',
+//   //   vpc,
+//   //   environment: {
+//   //     OPENSEARCH_HOST: domain.domainEndpoint,
+//   //   },
+//   // })
+
+//   // domain.connections.allowFrom(dataIndexFunction, Port.tcp(443))
+
+//   // Outputs
+//   new Output(this, 'OpenSearchDomainHost', {
+//     value: domain.domainEndpoint,
+//   })
+
+//   // new Output(this, 'IndexingFunctionName', {
+//   //   value: dataIndexFunction.functionName,
+//   // })
+// }

package/src/cloud/security.ts

@@ -0,0 +1,259 @@
+// waf and encryption
+import { config } from '@stacksjs/config'
+import type { aws_route53 as route53 } from 'aws-cdk-lib'
+import { Duration, RemovalPolicy, Tags, aws_certificatemanager as acm, aws_kms as kms, aws_wafv2 as wafv2 } from 'aws-cdk-lib'
+import type { Construct } from 'constructs'
+import type { NestedCloudProps } from '../types'
+
+export interface StorageStackProps extends NestedCloudProps {
+  zone: route53.IHostedZone
+}
+
+export class SecurityStack {
+  firewall: wafv2.CfnWebACL
+  kmsKey: kms.Key
+  certificate: acm.Certificate
+
+  constructor(scope: Construct, props: StorageStackProps) {
+    const firewallOptions = config.cloud.firewall
+
+    if (!firewallOptions)
+      throw new Error('No firewall options found in config')
+
+    const options = {
+      defaultAction: { allow: {} },
+      scope: 'CLOUDFRONT',
+      visibilityConfig: {
+        sampledRequestsEnabled: true,
+        cloudWatchMetricsEnabled: true,
+        metricName: 'firewallMetric',
+      },
+      rules: this.getFirewallRules(),
+    }
+
+    this.firewall = new wafv2.CfnWebACL(scope, 'WebFirewall', options)
+    Tags.of(this.firewall).add('Name', 'waf-cloudfront', { priority: 300 })
+    Tags.of(this.firewall).add('Purpose', 'CloudFront', { priority: 300 })
+    Tags.of(this.firewall).add('CreatedBy', 'CloudFormation', { priority: 300 })
+
+    this.kmsKey = new kms.Key(scope, 'EncryptionKey', {
+      alias: 'stacks-encryption-key',
+      description: 'KMS key for Stacks Cloud',
+      enableKeyRotation: true,
+      removalPolicy: RemovalPolicy.DESTROY,
+      pendingWindow: Duration.days(30),
+    })
+
+    this.certificate = new acm.Certificate(scope, 'Certificate', {
+      domainName: props.domain,
+      validation: acm.CertificateValidation.fromDns(props.zone),
+      subjectAlternativeNames: [`www.${props.domain}`, `api.${props.domain}`],
+    })
+  }
+
+  getFirewallRules() {
+    const rules: wafv2.CfnWebACL.RuleProperty[] = []
+    const priorities = []
+
+    if (config.security.firewall?.countryCodes?.length) {
+      priorities.push(1)
+      rules.push({
+        name: 'CountryRule',
+        priority: priorities.length,
+        statement: {
+          geoMatchStatement: {
+            countryCodes: config.security.firewall.countryCodes,
+          },
+        },
+        action: {
+          block: {},
+        },
+        visibilityConfig: {
+          sampledRequestsEnabled: true,
+          cloudWatchMetricsEnabled: true,
+          metricName: 'CountryRule',
+        },
+      })
+    }
+
+    if (config.security.firewall?.ipAddresses?.length) {
+      const ipSet = new wafv2.CfnIPSet(this, 'IpSet', {
+        name: 'IpSet',
+        description: 'IP Set',
+        scope: 'CLOUDFRONT',
+        addresses: config.security.firewall.ipAddresses,
+        ipAddressVersion: 'IPV4',
+      })
+
+      priorities.push(1)
+      rules.push({
+        name: 'IpAddressRule',
+        priority: priorities.length,
+        statement: {
+          ipSetReferenceStatement: {
+            arn: ipSet.attrArn,
+          },
+        },
+        action: {
+          block: {},
+        },
+        visibilityConfig: {
+          sampledRequestsEnabled: true,
+          cloudWatchMetricsEnabled: true,
+          metricName: 'IpAddressRule',
+        },
+      })
+    }
+
+    if (config.security.firewall?.httpHeaders?.length) {
+      config.security.firewall.httpHeaders.forEach((header, index) => {
+        priorities.push(1)
+        rules.push({
+          name: `HttpHeaderRule${index}`,
+          priority: priorities.length,
+          statement: {
+            byteMatchStatement: {
+              fieldToMatch: {
+                singleHeader: {
+                  name: header,
+                },
+              },
+              positionalConstraint: 'EXACTLY',
+              searchString: 'true',
+              textTransformations: [
+                {
+                  priority: index,
+                  type: 'NONE',
+                },
+              ],
+            },
+          },
+          action: {
+            block: {},
+          },
+          visibilityConfig: {
+            sampledRequestsEnabled: true,
+            cloudWatchMetricsEnabled: true,
+            metricName: `HttpHeaderRule${index}`,
+          },
+        })
+      })
+    }
+
+    // if (config.security.firewall?.queryString?.length) {
+    //   priorities.push(1)
+    //   rules.push({
+    //     name: 'QueryStringRule',
+    //     priority: priorities.length,
+    //     statement: {
+    //       byteMatchStatement: {
+    //         fieldToMatch: {
+    //           queryString: {},
+    //         },
+    //         positionalConstraint: 'EXACTLY',
+    //         searchString: config.security.firewall.queryString.join(', '),
+    //         textTransformations: [
+    //           {
+    //             priority: 0,
+    //             type: 'NONE',
+    //           },
+    //         ],
+    //       },
+    //     },
+    //     action: {
+    //       block: {},
+    //     },
+    //     visibilityConfig: {
+    //       sampledRequestsEnabled: true,
+    //       cloudWatchMetricsEnabled: true,
+    //       metricName: 'QueryStringRule',
+    //     },
+    //   })
+    // }
+
+    // if (config.security.firewall?.rateLimitPerMinute) {
+    //   priorities.push(1)
+    //   rules.push({
+    //     name: 'RateLimitRule',
+    //     priority: priorities.length,
+    //     statement: {
+    //       rateBasedStatement: {
+    //         limit: config.security.firewall.rateLimitPerMinute,
+    //         aggregateKeyType: 'IP',
+    //       },
+    //     },
+    //     action: {
+    //       block: {},
+    //     },
+    //     visibilityConfig: {
+    //       sampledRequestsEnabled: true,
+    //       cloudWatchMetricsEnabled: true,
+    //       metricName: 'RateLimitRule',
+    //     },
+    //   })
+    // }
+
+    // if (config.security.firewall?.useIpReputationLists) {
+    //   priorities.push(1)
+    //   rules.push({
+    //     name: 'IpReputationRule',
+    //     priority: priorities.length,
+    //     statement: {
+    //       managedRuleGroupStatement: {
+    //         vendorName: 'AWS',
+    //         name: 'AWSManagedRulesAmazonIpReputationList',
+    //       },
+    //     },
+    //     action: {
+    //       block: {},
+    //     },
+    //     visibilityConfig: {
+    //       sampledRequestsEnabled: true,
+    //       cloudWatchMetricsEnabled: true,
+    //       metricName: 'IpReputationRule',
+    //     },
+    //   })
+    // }
+
+    // if (config.security.firewall?.useKnownBadInputsRuleSet) {
+    //   priorities.push(1)
+    //   rules.push({
+    //     name: 'KnownBadInputsRule',
+    //     priority: priorities.length,
+    //     statement: {
+    //       managedRuleGroupStatement: {
+    //         vendorName: 'AWS',
+    //         name: 'AWSManagedRulesKnownBadInputsRuleSet',
+    //       },
+    //     },
+    //     action: {
+    //       block: {},
+    //     },
+    //     visibilityConfig: {
+    //       sampledRequestsEnabled: true,
+    //       cloudWatchMetricsEnabled: true,
+    //       metricName: 'KnownBadInputsRule',
+    //     },
+    //   })
+    // }
+    // also add
+    //     }, {
+    //   "name": "AWSManagedRulesAnonymousIpList",
+    //   "priority": 40,
+    //   "overrideAction": "none",
+    //   "excludedRules": []
+    // }, {
+    //   "name": "AWSManagedRulesLinuxRuleSet",
+    //   "priority": 50,
+    //   "overrideAction": "none",
+    //   "excludedRules": []
+    // }, {
+    //   "name": "AWSManagedRulesUnixRuleSet",
+    //   "priority": 60,
+    //   "overrideAction": "none",
+    //   "excludedRules": [],
+    // }];
+
+    return rules
+  }
+}