@stacksjs/cloud 0.70.23 → 0.70.25

package/dist/queue.d.ts

@@ -1,144 +0,0 @@
-import type { Cluster, TaskDefinition } from 'aws-cdk-lib/aws-ecs';
-import type { Construct } from 'constructs';
-import type { NestedCloudProps } from '../types';
-
-export declare interface QueueStackProps extends NestedCloudProps {
-  cluster: Cluster
-  taskDefinition: TaskDefinition
-}
-export declare class QueueStack {
-  scope: Construct
-  props: QueueStackProps
-
-  constructor(scope: Construct, props: QueueStackProps) {
-    this.scope = scope
-    this.props = props
-  }
-
-  async init(): Promise<void> {
-    const jobsDir = path.jobsPath()
-    const actionsDir = path.appPath('Actions')
-    const ormActionDir = path.builtUserActionsPath('src')
-
-    const jobFiles = await fs.readdir(jobsDir)
-    const actionFiles = await fs.readdir(actionsDir)
-    const ormActionFiles = await fs.readdir(ormActionDir)
-    const jobs = []
-
-    for (const file of jobFiles) {
-      if (!file.endsWith('.ts'))
-        continue
-
-      const jobPath = path.jobsPath(file)
-
-      const job = await this.loadModule(jobPath)
-      this.createQueueRule(job, file)
-      jobs.push(job)
-    }
-
-    for (const ormFile of ormActionFiles) {
-      if (!ormFile.endsWith('.ts'))
-        continue
-
-      const ormActionPath = path.builtUserActionsPath(`src/${ormFile}`)
-
-      const ormAction = await this.loadModule(ormActionPath)
-      this.createQueueRule(ormAction, ormFile)
-      jobs.push(ormAction)
-    }
-
-    for (const file of actionFiles) {
-      if (!file.endsWith('.ts'))
-        continue
-
-      const actionPath = path.appPath(`Actions/${file}`)
-
-      const action = await this.loadModule(actionPath)
-      this.createQueueRule(action, file)
-      jobs.push(action)
-    }
-  }
-
-  cronScheduleFromRate(rate: string): {
-    minute?: string
-    hour?: string
-    month?: string
-    weekDay?: string
-    year?: string
-  } {
-    const parts = rate.split(' ')
-    return {
-      minute: parts[0],
-      hour: parts[1],
-      month: parts[2],
-      weekDay: parts[3],
-      year: parts[4],
-    }
-  }
-
-  async loadModule(filePath: string): Promise<{ default: any }> {
-    const jobModule = await import(filePath)
-
-    return jobModule
-  }
-
-  createQueueRule(module: { default: any }, file: string): void {
-    const rate = module.default?.rate
-
-    if (!rate || module.default?.enabled === false)
-      return
-
-    const schedule = Schedule.cron(this.cronScheduleFromRate(rate))
-
-    const id = `QueueRule${pascalCase(file.replace('.ts', ''))}`
-
-    const rule = new Rule(this.scope, id, {
-      ruleName: `${this.props.appName}-${this.props.appEnv}-queue-rule-${slug(file.replace('.ts', ''))}`,
-      schedule,
-    })
-
-    rule.addTarget(
-      new EcsTask({
-        cluster: this.props.cluster,
-        taskDefinition: this.props.taskDefinition,
-        containerOverrides: [
-          {
-            containerName: `${this.props.appName}-${this.props.appEnv}-api`,
-            environment: [
-              {
-                name: 'QUEUE_WORKER',
-                value: 'true',
-              },
-              {
-                name: 'JOB',
-                value: file,
-              },
-              {
-                name: 'JOB_BACKOFF_FACTOR',
-                value: module.default?.backoffFactor,
-              },
-              {
-                name: 'JOB_RETRIES',
-                value: module.default?.tries,
-              },
-              {
-                name: 'JOB_INITIAL_DELAY',
-                value: module.default?.initialDelay,
-              },
-              {
-                name: 'JOB_JITTER',
-                value: module.default?.jitter,
-              },
-            ],
-          },
-        ],
-
-        retryAttempts: 1, 
-
-        subnetSelection: {
-          subnetType: ec2.SubnetType.PUBLIC, 
-        },
-      }),
-    )
-  }
-}

package/dist/redirects.d.ts

@@ -1,45 +0,0 @@
-import type { Construct } from 'constructs';
-import type { NestedCloudProps } from '../types';
-
-export declare interface RedirectsStackProps extends NestedCloudProps {
-}
-export declare class RedirectsStack {
-  redirectZones: route53.IHostedZone[] = []
-
-  constructor(scope: Construct, props: RedirectsStackProps) {
-    config.dns.redirects?.forEach((redirect: string) => {
-      const slug = redirect
-        .split('.')
-        .map((part: string, index: number) => (index === 0 ? part : part.charAt(0).toUpperCase() + part.slice(1)))
-        .join('') 
-      const hostedZone = route53.HostedZone.fromLookup(scope, 'HostedZone', {
-        domainName: redirect,
-      })
-
-      const redirectBucket = new s3.Bucket(scope, `RedirectBucket${slug}`, {
-        bucketName: `${redirect}-redirect`,
-        websiteRedirect: {
-          hostName: props.domain,
-          protocol: s3.RedirectProtocol.HTTPS,
-        },
-        removalPolicy: RemovalPolicy.DESTROY,
-        autoDeleteObjects: true,
-      })
-
-      new route53.CnameRecord(scope, `RedirectRecord${slug}`, {
-        zone: hostedZone,
-        recordName: 'redirect',
-        domainName: redirectBucket.bucketWebsiteDomainName,
-      })
-    })
-
-    config.dns.redirects?.forEach((redirect: string) => {
-      const slug = redirect
-        .split('.')
-        .map((part: string, index: number) => (index === 0 ? part : part.charAt(0).toUpperCase() + part.slice(1)))
-        .join('') 
-      const hostedZone = route53.HostedZone.fromLookup(scope, `RedirectHostedZone${slug}`, { domainName: redirect })
-      this.redirectZones.push(hostedZone)
-    })
-  }
-}

package/dist/security.d.ts

@@ -1,149 +0,0 @@
-import type { Construct } from 'constructs';
-import type { NestedCloudProps } from '../types';
-
-export declare interface StorageStackProps extends NestedCloudProps {
-  zone: route53.IHostedZone
-}
-export declare class SecurityStack {
-  firewall: wafv2.CfnWebACL
-  kmsKey: kms.Key
-  certificate: acm.Certificate
-  originAccessIdentity: cloudfront.OriginAccessIdentity
-
-  constructor(scope: Construct, props: StorageStackProps) {
-    const firewallOptions = config.cloud.firewall
-
-    if (!firewallOptions)
-      throw new Error('No firewall options found in config')
-
-    const options = {
-      defaultAction: { allow: {} },
-      scope: 'CLOUDFRONT',
-      visibilityConfig: {
-        sampledRequestsEnabled: true,
-        cloudWatchMetricsEnabled: true,
-        metricName: 'firewallMetric',
-      },
-      rules: this.getFirewallRules(scope),
-    }
-
-    this.firewall = new wafv2.CfnWebACL(scope, 'StacksWebFirewall', options)
-    Tags.of(this.firewall).add('Name', 'waf-cloudfront', { priority: 300 })
-    Tags.of(this.firewall).add('Purpose', 'CloudFront', { priority: 300 })
-    Tags.of(this.firewall).add('CreatedBy', 'CloudFormation', {
-      priority: 300,
-    })
-
-    this.kmsKey = new kms.Key(scope, 'EncryptionKey', {
-      alias: 'stacks-encryption-key',
-      description: 'KMS key for Stacks Cloud',
-      enableKeyRotation: true,
-      removalPolicy: RemovalPolicy.DESTROY,
-      pendingWindow: Duration.days(30),
-    })
-
-    this.certificate = new acm.Certificate(scope, 'Certificate', {
-      domainName: props.domain,
-      validation: acm.CertificateValidation.fromDns(props.zone),
-      subjectAlternativeNames: [`www.${props.domain}`, `api.${props.domain}`, `docs.${props.domain}`],
-    })
-
-    this.originAccessIdentity = new cloudfront.OriginAccessIdentity(scope, 'OAI')
-  }
-
-  getFirewallRules(scope: Construct): wafv2.CfnWebACL.RuleProperty[] {
-    const rules: wafv2.CfnWebACL.RuleProperty[] = []
-    const priorities = []
-
-    if (config.security.firewall?.countryCodes?.length) {
-      priorities.push(1)
-      rules.push({
-        name: 'CountryRule',
-        priority: priorities.length,
-        statement: {
-          geoMatchStatement: {
-            countryCodes: config.security.firewall.countryCodes as string[],
-          },
-        },
-        action: {
-          block: {},
-        },
-        visibilityConfig: {
-          sampledRequestsEnabled: true,
-          cloudWatchMetricsEnabled: true,
-          metricName: 'CountryRule',
-        },
-      })
-    }
-
-    if (config.security.firewall?.ipAddresses?.length) {
-      const ipSet = new wafv2.CfnIPSet(scope, 'IpSet', {
-        name: 'IpSet',
-        description: 'IP Set',
-        scope: 'CLOUDFRONT',
-        addresses: config.security.firewall.ipAddresses as string[],
-        ipAddressVersion: 'IPV4',
-      })
-
-      priorities.push(1)
-      rules.push({
-        name: 'IpAddressRule',
-        priority: priorities.length,
-        statement: {
-          ipSetReferenceStatement: {
-            arn: ipSet.attrArn,
-          },
-        },
-        action: {
-          block: {},
-        },
-        visibilityConfig: {
-          sampledRequestsEnabled: true,
-          cloudWatchMetricsEnabled: true,
-          metricName: 'IpAddressRule',
-        },
-      })
-    }
-
-    if (config.security.firewall?.httpHeaders?.length) {
-      config.security.firewall.httpHeaders.forEach((header: string | undefined, index: number) => {
-        priorities.push(1)
-        rules.push({
-          name: `HttpHeaderRule${index}`,
-          priority: priorities.length,
-          statement: {
-            byteMatchStatement: {
-              fieldToMatch: {
-                singleHeader: {
-                  name: header,
-                },
-              },
-              positionalConstraint: 'EXACTLY',
-              searchString: 'true',
-              textTransformations: [
-                {
-                  priority: 0,
-                  type: 'NONE',
-                },
-              ],
-            },
-          },
-          action: {
-            block: {},
-          },
-          visibilityConfig: {
-            sampledRequestsEnabled: true,
-            cloudWatchMetricsEnabled: true,
-            metricName: `HttpHeaderRule${index}`,
-          },
-        })
-      })
-    }
-
-
-
-
-
-    return rules
-  }
-}

package/dist/storage.d.ts

@@ -1,189 +0,0 @@
-import type { Construct } from 'constructs';
-import type { NestedCloudProps } from '../types';
-
-export declare interface StorageStackProps extends NestedCloudProps {
-  kmsKey: kms.Key
-  originAccessIdentity: cloudfront.OriginAccessIdentity
-}
-export declare class StorageStack {
-  publicBucket: s3.Bucket
-  privateBucket: s3.Bucket
-  docsBucket?: s3.Bucket
-  logBucket: s3.Bucket
-  bucketPrefix: string
-  vault: backup.BackupVault
-  backupPlan: backup.BackupPlan
-  backupRole: iam.Role
-
-  constructor(scope: Construct, props: StorageStackProps) {
-    this.bucketPrefix = `${props.slug}-${props.appEnv}`
-
-    this.publicBucket = new s3.Bucket(scope, 'PublicBucket', {
-      bucketName: `${this.bucketPrefix}-public-${props.timestamp}`,
-      versioned: true,
-      autoDeleteObjects: true,
-      removalPolicy: RemovalPolicy.DESTROY,
-      encryption: s3.BucketEncryption.S3_MANAGED,
-      websiteIndexDocument: 'index.html',
-      websiteErrorDocument: 'index.html',
-      publicReadAccess: true,
-      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ACLS,
-    })
-
-    Tags.of(this.publicBucket).add('daily-backup', 'true')
-
-    if (this.shouldDeployDocs()) {
-      this.docsBucket = new s3.Bucket(scope, 'DocsBucket', {
-        bucketName: `${this.bucketPrefix}-docs-${props.timestamp}`,
-        versioned: true,
-        autoDeleteObjects: true,
-        removalPolicy: RemovalPolicy.DESTROY,
-        encryption: s3.BucketEncryption.S3_MANAGED,
-        websiteIndexDocument: 'index.html',
-        websiteErrorDocument: 'index.html',
-        publicReadAccess: true,
-        blockPublicAccess: s3.BlockPublicAccess.BLOCK_ACLS,
-      })
-
-      Tags.of(this.docsBucket).add('weekly-backup', 'true')
-    }
-
-    this.privateBucket = new s3.Bucket(scope, 'PrivateBucket', {
-      bucketName: `${this.bucketPrefix}-private-${props.timestamp}`,
-      versioned: true,
-      removalPolicy: RemovalPolicy.DESTROY,
-      autoDeleteObjects: true,
-      encryption: s3.BucketEncryption.S3_MANAGED,
-      enforceSSL: true,
-      publicReadAccess: false,
-      blockPublicAccess: {
-        blockPublicAcls: true,
-        blockPublicPolicy: true,
-        ignorePublicAcls: true,
-        restrictPublicBuckets: true,
-      },
-    })
-
-    Tags.of(this.privateBucket).add('daily-backup', 'true')
-
-    this.logBucket = new s3.Bucket(scope, 'LogsBucket', {
-      bucketName: `${this.bucketPrefix}-logs-${props.timestamp}`,
-      removalPolicy: RemovalPolicy.RETAIN, 
-      blockPublicAccess: new s3.BlockPublicAccess({
-        blockPublicAcls: false,
-        ignorePublicAcls: true,
-        blockPublicPolicy: true,
-        restrictPublicBuckets: true,
-      }),
-      objectOwnership: s3.ObjectOwnership.BUCKET_OWNER_PREFERRED,
-    })
-
-    Tags.of(this.logBucket).add('daily-backup', 'true')
-
-    this.backupRole = this.createBackupRole(scope)
-
-    this.vault = new backup.BackupVault(scope, 'BackupVault', {
-      backupVaultName: `${props.slug}-${props.appEnv}-daily-backup-vault`,
-      encryptionKey: props.kmsKey,
-      removalPolicy: RemovalPolicy.DESTROY,
-    })
-
-    this.backupPlan = backup.BackupPlan.daily35DayRetention(scope, 'BackupPlan', this.vault)
-
-    this.backupPlan.addSelection('Selection', {
-      role: this.backupRole,
-      resources: [backup.BackupResource.fromTag('daily-backup', 'true')],
-    })
-  }
-
-  createBackupRole(scope: Construct): iam.Role {
-    const backupRole = new iam.Role(scope, 'BackupRole', {
-      assumedBy: new iam.ServicePrincipal('backup.amazonaws.com'),
-    })
-
-    backupRole.addToPolicy(
-      new iam.PolicyStatement({
-        actions: [
-          's3:GetInventoryConfiguration',
-          's3:PutInventoryConfiguration',
-          's3:ListBucketVersions',
-          's3:ListBucket',
-          's3:GetBucketVersioning',
-          's3:GetBucketNotification',
-          's3:PutBucketNotification',
-          's3:GetBucketLocation',
-          's3:GetBucketTagging',
-        ],
-        resources: ['arn:aws:s3:::*'],
-        sid: 'S3BucketBackupPermissions',
-      }),
-    )
-
-    backupRole.addToPolicy(
-      new iam.PolicyStatement({
-        actions: [
-          's3:GetObjectAcl',
-          's3:GetObject',
-          's3:GetObjectVersionTagging',
-          's3:GetObjectVersionAcl',
-          's3:GetObjectTagging',
-          's3:GetObjectVersion',
-        ],
-        resources: ['arn:aws:s3:::*/*'],
-        sid: 'S3ObjectBackupPermissions',
-      }),
-    )
-
-    backupRole.addToPolicy(
-      new iam.PolicyStatement({
-        actions: ['s3:ListAllMyBuckets'],
-        resources: ['*'],
-        sid: 'S3GlobalPermissions',
-      }),
-    )
-
-    backupRole.addToPolicy(
-      new iam.PolicyStatement({
-        actions: ['kms:Decrypt', 'kms:DescribeKey'],
-        resources: ['*'],
-        sid: 'KMSBackupPermissions',
-        conditions: {
-          StringLike: {
-            'kms:ViaService': 's3.*.amazonaws.com',
-          },
-        },
-      }),
-    )
-
-    backupRole.addToPolicy(
-      new iam.PolicyStatement({
-        actions: [
-          'events:DescribeRule',
-          'events:EnableRule',
-          'events:PutRule',
-          'events:DeleteRule',
-          'events:PutTargets',
-          'events:RemoveTargets',
-          'events:ListTargetsByRule',
-          'events:DisableRule',
-        ],
-        resources: ['arn:aws:events:*:*:rule/AwsBackupManagedRule*'],
-        sid: 'EventsPermissions',
-      }),
-    )
-
-    backupRole.addToPolicy(
-      new iam.PolicyStatement({
-        actions: ['cloudwatch:GetMetricData', 'events:ListRules'],
-        resources: ['*'],
-        sid: 'EventsMetricsGlobalPermissions',
-      }),
-    )
-
-    return backupRole
-  }
-
-  shouldDeployDocs(): boolean {
-    return (hasFiles(p.projectPath('docs')) || config.app.docMode) ?? false
-  }
-}