@stacksjs/cloud 0.67.0 → 0.68.0

package/dist/jump-box.d.ts

@@ -0,0 +1,42 @@
+import type { Construct } from 'constructs';
+import type { NestedCloudProps } from '../types';
+
+export declare interface JumpBoxStackProps extends NestedCloudProps {
+  vpc: ec2.Vpc
+  fileSystem: efs.FileSystem
+}
+export declare class JumpBoxStack {
+  jumpBox?: ec2.Instance
+
+  constructor(scope: Construct, props: JumpBoxStackProps) {
+    const role = new iam.Role(scope, 'JumpBoxInstanceRole', {
+      assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
+      managedPolicies: [
+        iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonSSMManagedInstanceCore'),
+        iam.ManagedPolicy.fromAwsManagedPolicyName('CloudWatchAgentServerPolicy'),
+      ],
+    })
+
+    this.jumpBox = new ec2.Instance(scope, 'JumpBox', {
+      vpc: props.vpc,
+      instanceType: ec2.InstanceType.of(ec2.InstanceClass.T2, ec2.InstanceSize.MICRO),
+      machineImage: new ec2.AmazonLinuxImage(),
+      role,
+      userData: ec2.UserData.custom(`
+      #!/bin/bash
+      yum update -y
+      yum install -y amazon-efs-utils
+      yum install -y git
+      yum install -y https:
+      mkdir /mnt/efs
+      mount -t efs ${props.fileSystem.fileSystemId}:/ /mnt/efs
+      git clone https:
+    `),
+    })
+
+    new Output(scope, 'JumpBoxInstanceId', {
+      value: this.jumpBox.instanceId,
+      description: 'The ID of the EC2 instance that can be used to SSH into the Stacks Cloud.',
+    })
+  }
+}

package/dist/network.d.ts

@@ -0,0 +1,29 @@
+import type { Construct } from 'constructs';
+import type { NestedCloudProps } from '../types';
+
+export declare interface NetworkStackProps extends NestedCloudProps {
+}
+export declare class NetworkStack {
+  vpc: ec2.Vpc
+
+  constructor(scope: Construct, props: NetworkStackProps) {
+    this.vpc = new ec2.Vpc(scope, 'Network', {
+      vpcName: `${props.slug}-${props.appEnv}-vpc`,
+      ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16'),
+      maxAzs: 3,
+      natGateways: 0,
+      subnetConfiguration: [
+        {
+          name: 'public-subnet-1',
+          subnetType: ec2.SubnetType.PUBLIC,
+          cidrMask: 24,
+        },
+        {
+          name: 'private-subnet-1',
+          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
+          cidrMask: 28,
+        },
+      ],
+    })
+  }
+}

package/dist/origin-request.d.ts

@@ -0,0 +1,5 @@
+declare const config: {
+  suffix: '.html';
+  removeTrailingSlash: false
+};
+export declare function handler(event: any, context: any, callback: any): void;

package/dist/permissions.d.ts

@@ -0,0 +1,25 @@
+import type { Construct } from 'constructs';
+import type { NestedCloudProps } from '../types';
+
+export declare interface PermissionsStackProps extends NestedCloudProps {
+}
+export declare class PermissionsStack {
+  constructor(scope: Construct) {
+    const teamName = config.team.name
+    const users = config.team.members
+    const password = env.AWS_DEFAULT_PASSWORD || string.random()
+
+    for (const name in users) {
+      const id = `User${string.pascalCase(teamName)}${string.pascalCase(name)}`
+      const userName = string.slug(`${teamName}-${name}`)
+      const user = new iam.User(scope, id, {
+        userName,
+        password: SecretValue.unsafePlainText(password),
+        passwordResetRequired: true,
+      })
+
+      user.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess'))
+
+    }
+  }
+}

package/dist/queue.d.ts

@@ -0,0 +1,144 @@
+import type { Cluster, TaskDefinition } from 'aws-cdk-lib/aws-ecs';
+import type { Construct } from 'constructs';
+import type { NestedCloudProps } from '../types';
+
+export declare interface QueueStackProps extends NestedCloudProps {
+  cluster: Cluster
+  taskDefinition: TaskDefinition
+}
+export declare class QueueStack {
+  scope: Construct
+  props: QueueStackProps
+
+  constructor(scope: Construct, props: QueueStackProps) {
+    this.scope = scope
+    this.props = props
+  }
+
+  async init(): Promise<void> {
+    const jobsDir = path.jobsPath()
+    const actionsDir = path.appPath('Actions')
+    const ormActionDir = path.builtUserActionsPath('src')
+
+    const jobFiles = await fs.readdir(jobsDir)
+    const actionFiles = await fs.readdir(actionsDir)
+    const ormActionFiles = await fs.readdir(ormActionDir)
+    const jobs = []
+
+    for (const file of jobFiles) {
+      if (!file.endsWith('.ts'))
+        continue
+
+      const jobPath = path.jobsPath(file)
+
+      const job = await this.loadModule(jobPath)
+      this.createQueueRule(job, file)
+      jobs.push(job)
+    }
+
+    for (const ormFile of ormActionFiles) {
+      if (!ormFile.endsWith('.ts'))
+        continue
+
+      const ormActionPath = path.builtUserActionsPath(`src/${ormFile}`)
+
+      const ormAction = await this.loadModule(ormActionPath)
+      this.createQueueRule(ormAction, ormFile)
+      jobs.push(ormAction)
+    }
+
+    for (const file of actionFiles) {
+      if (!file.endsWith('.ts'))
+        continue
+
+      const actionPath = path.appPath(`Actions/${file}`)
+
+      const action = await this.loadModule(actionPath)
+      this.createQueueRule(action, file)
+      jobs.push(action)
+    }
+  }
+
+  cronScheduleFromRate(rate: string): {
+    minute?: string
+    hour?: string
+    month?: string
+    weekDay?: string
+    year?: string
+  } {
+    const parts = rate.split(' ')
+    return {
+      minute: parts[0],
+      hour: parts[1],
+      month: parts[2],
+      weekDay: parts[3],
+      year: parts[4],
+    }
+  }
+
+  async loadModule(filePath: string): Promise<{ default: any }> {
+    const jobModule = await import(filePath)
+
+    return jobModule
+  }
+
+  createQueueRule(module: { default: any }, file: string): void {
+    const rate = module.default?.rate
+
+    if (!rate || module.default?.enabled === false)
+      return
+
+    const schedule = Schedule.cron(this.cronScheduleFromRate(rate))
+
+    const id = `QueueRule${pascalCase(file.replace('.ts', ''))}`
+
+    const rule = new Rule(this.scope, id, {
+      ruleName: `${this.props.appName}-${this.props.appEnv}-queue-rule-${slug(file.replace('.ts', ''))}`,
+      schedule,
+    })
+
+    rule.addTarget(
+      new EcsTask({
+        cluster: this.props.cluster,
+        taskDefinition: this.props.taskDefinition,
+        containerOverrides: [
+          {
+            containerName: `${this.props.appName}-${this.props.appEnv}-api`,
+            environment: [
+              {
+                name: 'QUEUE_WORKER',
+                value: 'true',
+              },
+              {
+                name: 'JOB',
+                value: file,
+              },
+              {
+                name: 'JOB_BACKOFF_FACTOR',
+                value: module.default?.backoffFactor,
+              },
+              {
+                name: 'JOB_RETRIES',
+                value: module.default?.tries,
+              },
+              {
+                name: 'JOB_INITIAL_DELAY',
+                value: module.default?.initialDelay,
+              },
+              {
+                name: 'JOB_JITTER',
+                value: module.default?.jitter,
+              },
+            ],
+          },
+        ],
+
+        retryAttempts: 1, 
+
+        subnetSelection: {
+          subnetType: ec2.SubnetType.PUBLIC, 
+        },
+      }),
+    )
+  }
+}

package/dist/redirects.d.ts

@@ -0,0 +1,45 @@
+import type { Construct } from 'constructs';
+import type { NestedCloudProps } from '../types';
+
+export declare interface RedirectsStackProps extends NestedCloudProps {
+}
+export declare class RedirectsStack {
+  redirectZones: route53.IHostedZone[] = []
+
+  constructor(scope: Construct, props: RedirectsStackProps) {
+    config.dns.redirects?.forEach((redirect: string) => {
+      const slug = redirect
+        .split('.')
+        .map((part: string, index: number) => (index === 0 ? part : part.charAt(0).toUpperCase() + part.slice(1)))
+        .join('') 
+      const hostedZone = route53.HostedZone.fromLookup(scope, 'HostedZone', {
+        domainName: redirect,
+      })
+
+      const redirectBucket = new s3.Bucket(scope, `RedirectBucket${slug}`, {
+        bucketName: `${redirect}-redirect`,
+        websiteRedirect: {
+          hostName: props.domain,
+          protocol: s3.RedirectProtocol.HTTPS,
+        },
+        removalPolicy: RemovalPolicy.DESTROY,
+        autoDeleteObjects: true,
+      })
+
+      new route53.CnameRecord(scope, `RedirectRecord${slug}`, {
+        zone: hostedZone,
+        recordName: 'redirect',
+        domainName: redirectBucket.bucketWebsiteDomainName,
+      })
+    })
+
+    config.dns.redirects?.forEach((redirect: string) => {
+      const slug = redirect
+        .split('.')
+        .map((part: string, index: number) => (index === 0 ? part : part.charAt(0).toUpperCase() + part.slice(1)))
+        .join('') 
+      const hostedZone = route53.HostedZone.fromLookup(scope, `RedirectHostedZone${slug}`, { domainName: redirect })
+      this.redirectZones.push(hostedZone)
+    })
+  }
+}

package/dist/security.d.ts

@@ -0,0 +1,149 @@
+import type { Construct } from 'constructs';
+import type { NestedCloudProps } from '../types';
+
+export declare interface StorageStackProps extends NestedCloudProps {
+  zone: route53.IHostedZone
+}
+export declare class SecurityStack {
+  firewall: wafv2.CfnWebACL
+  kmsKey: kms.Key
+  certificate: acm.Certificate
+  originAccessIdentity: cloudfront.OriginAccessIdentity
+
+  constructor(scope: Construct, props: StorageStackProps) {
+    const firewallOptions = config.cloud.firewall
+
+    if (!firewallOptions)
+      throw new Error('No firewall options found in config')
+
+    const options = {
+      defaultAction: { allow: {} },
+      scope: 'CLOUDFRONT',
+      visibilityConfig: {
+        sampledRequestsEnabled: true,
+        cloudWatchMetricsEnabled: true,
+        metricName: 'firewallMetric',
+      },
+      rules: this.getFirewallRules(scope),
+    }
+
+    this.firewall = new wafv2.CfnWebACL(scope, 'StacksWebFirewall', options)
+    Tags.of(this.firewall).add('Name', 'waf-cloudfront', { priority: 300 })
+    Tags.of(this.firewall).add('Purpose', 'CloudFront', { priority: 300 })
+    Tags.of(this.firewall).add('CreatedBy', 'CloudFormation', {
+      priority: 300,
+    })
+
+    this.kmsKey = new kms.Key(scope, 'EncryptionKey', {
+      alias: 'stacks-encryption-key',
+      description: 'KMS key for Stacks Cloud',
+      enableKeyRotation: true,
+      removalPolicy: RemovalPolicy.DESTROY,
+      pendingWindow: Duration.days(30),
+    })
+
+    this.certificate = new acm.Certificate(scope, 'Certificate', {
+      domainName: props.domain,
+      validation: acm.CertificateValidation.fromDns(props.zone),
+      subjectAlternativeNames: [`www.${props.domain}`, `api.${props.domain}`, `docs.${props.domain}`],
+    })
+
+    this.originAccessIdentity = new cloudfront.OriginAccessIdentity(scope, 'OAI')
+  }
+
+  getFirewallRules(scope: Construct): wafv2.CfnWebACL.RuleProperty[] {
+    const rules: wafv2.CfnWebACL.RuleProperty[] = []
+    const priorities = []
+
+    if (config.security.firewall?.countryCodes?.length) {
+      priorities.push(1)
+      rules.push({
+        name: 'CountryRule',
+        priority: priorities.length,
+        statement: {
+          geoMatchStatement: {
+            countryCodes: config.security.firewall.countryCodes as string[],
+          },
+        },
+        action: {
+          block: {},
+        },
+        visibilityConfig: {
+          sampledRequestsEnabled: true,
+          cloudWatchMetricsEnabled: true,
+          metricName: 'CountryRule',
+        },
+      })
+    }
+
+    if (config.security.firewall?.ipAddresses?.length) {
+      const ipSet = new wafv2.CfnIPSet(scope, 'IpSet', {
+        name: 'IpSet',
+        description: 'IP Set',
+        scope: 'CLOUDFRONT',
+        addresses: config.security.firewall.ipAddresses as string[],
+        ipAddressVersion: 'IPV4',
+      })
+
+      priorities.push(1)
+      rules.push({
+        name: 'IpAddressRule',
+        priority: priorities.length,
+        statement: {
+          ipSetReferenceStatement: {
+            arn: ipSet.attrArn,
+          },
+        },
+        action: {
+          block: {},
+        },
+        visibilityConfig: {
+          sampledRequestsEnabled: true,
+          cloudWatchMetricsEnabled: true,
+          metricName: 'IpAddressRule',
+        },
+      })
+    }
+
+    if (config.security.firewall?.httpHeaders?.length) {
+      config.security.firewall.httpHeaders.forEach((header: string | undefined, index: number) => {
+        priorities.push(1)
+        rules.push({
+          name: `HttpHeaderRule${index}`,
+          priority: priorities.length,
+          statement: {
+            byteMatchStatement: {
+              fieldToMatch: {
+                singleHeader: {
+                  name: header,
+                },
+              },
+              positionalConstraint: 'EXACTLY',
+              searchString: 'true',
+              textTransformations: [
+                {
+                  priority: 0,
+                  type: 'NONE',
+                },
+              ],
+            },
+          },
+          action: {
+            block: {},
+          },
+          visibilityConfig: {
+            sampledRequestsEnabled: true,
+            cloudWatchMetricsEnabled: true,
+            metricName: `HttpHeaderRule${index}`,
+          },
+        })
+      })
+    }
+
+
+
+
+
+    return rules
+  }
+}

package/dist/storage.d.ts

@@ -0,0 +1,189 @@
+import type { Construct } from 'constructs';
+import type { NestedCloudProps } from '../types';
+
+export declare interface StorageStackProps extends NestedCloudProps {
+  kmsKey: kms.Key
+  originAccessIdentity: cloudfront.OriginAccessIdentity
+}
+export declare class StorageStack {
+  publicBucket: s3.Bucket
+  privateBucket: s3.Bucket
+  docsBucket?: s3.Bucket
+  logBucket: s3.Bucket
+  bucketPrefix: string
+  vault: backup.BackupVault
+  backupPlan: backup.BackupPlan
+  backupRole: iam.Role
+
+  constructor(scope: Construct, props: StorageStackProps) {
+    this.bucketPrefix = `${props.slug}-${props.appEnv}`
+
+    this.publicBucket = new s3.Bucket(scope, 'PublicBucket', {
+      bucketName: `${this.bucketPrefix}-public-${props.timestamp}`,
+      versioned: true,
+      autoDeleteObjects: true,
+      removalPolicy: RemovalPolicy.DESTROY,
+      encryption: s3.BucketEncryption.S3_MANAGED,
+      websiteIndexDocument: 'index.html',
+      websiteErrorDocument: 'index.html',
+      publicReadAccess: true,
+      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ACLS,
+    })
+
+    Tags.of(this.publicBucket).add('daily-backup', 'true')
+
+    if (this.shouldDeployDocs()) {
+      this.docsBucket = new s3.Bucket(scope, 'DocsBucket', {
+        bucketName: `${this.bucketPrefix}-docs-${props.timestamp}`,
+        versioned: true,
+        autoDeleteObjects: true,
+        removalPolicy: RemovalPolicy.DESTROY,
+        encryption: s3.BucketEncryption.S3_MANAGED,
+        websiteIndexDocument: 'index.html',
+        websiteErrorDocument: 'index.html',
+        publicReadAccess: true,
+        blockPublicAccess: s3.BlockPublicAccess.BLOCK_ACLS,
+      })
+
+      Tags.of(this.docsBucket).add('weekly-backup', 'true')
+    }
+
+    this.privateBucket = new s3.Bucket(scope, 'PrivateBucket', {
+      bucketName: `${this.bucketPrefix}-private-${props.timestamp}`,
+      versioned: true,
+      removalPolicy: RemovalPolicy.DESTROY,
+      autoDeleteObjects: true,
+      encryption: s3.BucketEncryption.S3_MANAGED,
+      enforceSSL: true,
+      publicReadAccess: false,
+      blockPublicAccess: {
+        blockPublicAcls: true,
+        blockPublicPolicy: true,
+        ignorePublicAcls: true,
+        restrictPublicBuckets: true,
+      },
+    })
+
+    Tags.of(this.privateBucket).add('daily-backup', 'true')
+
+    this.logBucket = new s3.Bucket(scope, 'LogsBucket', {
+      bucketName: `${this.bucketPrefix}-logs-${props.timestamp}`,
+      removalPolicy: RemovalPolicy.RETAIN, 
+      blockPublicAccess: new s3.BlockPublicAccess({
+        blockPublicAcls: false,
+        ignorePublicAcls: true,
+        blockPublicPolicy: true,
+        restrictPublicBuckets: true,
+      }),
+      objectOwnership: s3.ObjectOwnership.BUCKET_OWNER_PREFERRED,
+    })
+
+    Tags.of(this.logBucket).add('daily-backup', 'true')
+
+    this.backupRole = this.createBackupRole(scope)
+
+    this.vault = new backup.BackupVault(scope, 'BackupVault', {
+      backupVaultName: `${props.slug}-${props.appEnv}-daily-backup-vault`,
+      encryptionKey: props.kmsKey,
+      removalPolicy: RemovalPolicy.DESTROY,
+    })
+
+    this.backupPlan = backup.BackupPlan.daily35DayRetention(scope, 'BackupPlan', this.vault)
+
+    this.backupPlan.addSelection('Selection', {
+      role: this.backupRole,
+      resources: [backup.BackupResource.fromTag('daily-backup', 'true')],
+    })
+  }
+
+  createBackupRole(scope: Construct): iam.Role {
+    const backupRole = new iam.Role(scope, 'BackupRole', {
+      assumedBy: new iam.ServicePrincipal('backup.amazonaws.com'),
+    })
+
+    backupRole.addToPolicy(
+      new iam.PolicyStatement({
+        actions: [
+          's3:GetInventoryConfiguration',
+          's3:PutInventoryConfiguration',
+          's3:ListBucketVersions',
+          's3:ListBucket',
+          's3:GetBucketVersioning',
+          's3:GetBucketNotification',
+          's3:PutBucketNotification',
+          's3:GetBucketLocation',
+          's3:GetBucketTagging',
+        ],
+        resources: ['arn:aws:s3:::*'],
+        sid: 'S3BucketBackupPermissions',
+      }),
+    )
+
+    backupRole.addToPolicy(
+      new iam.PolicyStatement({
+        actions: [
+          's3:GetObjectAcl',
+          's3:GetObject',
+          's3:GetObjectVersionTagging',
+          's3:GetObjectVersionAcl',
+          's3:GetObjectTagging',
+          's3:GetObjectVersion',
+        ],
+        resources: ['arn:aws:s3:::*/*'],
+        sid: 'S3ObjectBackupPermissions',
+      }),
+    )
+
+    backupRole.addToPolicy(
+      new iam.PolicyStatement({
+        actions: ['s3:ListAllMyBuckets'],
+        resources: ['*'],
+        sid: 'S3GlobalPermissions',
+      }),
+    )
+
+    backupRole.addToPolicy(
+      new iam.PolicyStatement({
+        actions: ['kms:Decrypt', 'kms:DescribeKey'],
+        resources: ['*'],
+        sid: 'KMSBackupPermissions',
+        conditions: {
+          StringLike: {
+            'kms:ViaService': 's3.*.amazonaws.com',
+          },
+        },
+      }),
+    )
+
+    backupRole.addToPolicy(
+      new iam.PolicyStatement({
+        actions: [
+          'events:DescribeRule',
+          'events:EnableRule',
+          'events:PutRule',
+          'events:DeleteRule',
+          'events:PutTargets',
+          'events:RemoveTargets',
+          'events:ListTargetsByRule',
+          'events:DisableRule',
+        ],
+        resources: ['arn:aws:events:*:*:rule/AwsBackupManagedRule*'],
+        sid: 'EventsPermissions',
+      }),
+    )
+
+    backupRole.addToPolicy(
+      new iam.PolicyStatement({
+        actions: ['cloudwatch:GetMetricData', 'events:ListRules'],
+        resources: ['*'],
+        sid: 'EventsMetricsGlobalPermissions',
+      }),
+    )
+
+    return backupRole
+  }
+
+  shouldDeployDocs(): boolean {
+    return (hasFiles(p.projectPath('docs')) || config.app.docMode) ?? false
+  }
+}

package/dist/types.d.ts

@@ -1,26 +1,27 @@
-import type { AppEnvType } from "@stacksjs/types";
-import type { StackProps } from "aws-cdk-lib";
-export interface CloudOptions extends StackProps {
-	name: string;
-	env: {
-		account: string;
-		region: string;
-	};
-	slug: string;
-	appEnv: AppEnvType;
-	appName: string;
-	domain: string;
-	timestamp: string;
-}
-export interface NestedCloudProps {
-	name: string;
-	env: {
-		account: string;
-		region: string;
-	};
-	slug: string;
-	appEnv: AppEnvType;
-	appName: string;
-	domain: string;
-	timestamp: string;
+import type { AppEnvType } from '@stacksjs/types';
+import type { StackProps } from 'aws-cdk-lib';
+
+export declare interface CloudOptions extends StackProps {
+  name: string
+  env: {
+    account: string
+    region: string
+  }
+  slug: string
+  appEnv: AppEnvType
+  appName: string
+  domain: string
+  timestamp: string
 }
+export declare interface NestedCloudProps {
+  name: string
+  env: {
+    account: string
+    region: string
+  }
+  slug: string
+  appEnv: AppEnvType
+  appName: string
+  domain: string
+  timestamp: string
+}