@stacksjs/ts-cloud-core 0.1.1

package/src/validators/credentials.test.ts

@@ -0,0 +1,274 @@
+/**
+ * Credential Validation Tests
+ */
+
+import { describe, expect, it, mock } from 'bun:test'
+import type { AWSCredentials } from '../aws/credentials'
+import {
+  validateCredentials,
+  checkIAMPermissions,
+  getRequiredPermissions,
+  suggestIAMPolicy,
+} from './credentials'
+
+describe('getRequiredPermissions', () => {
+  it('should always include CloudFormation permissions', () => {
+    const permissions = getRequiredPermissions({
+      project: { name: 'Test', slug: 'test' },
+    })
+
+    expect(permissions).toContain('cloudformation:CreateStack')
+    expect(permissions).toContain('cloudformation:UpdateStack')
+    expect(permissions).toContain('cloudformation:DeleteStack')
+    expect(permissions).toContain('cloudformation:DescribeStacks')
+  })
+
+  it('should always include IAM permissions', () => {
+    const permissions = getRequiredPermissions({
+      project: { name: 'Test', slug: 'test' },
+    })
+
+    expect(permissions).toContain('iam:CreateRole')
+    expect(permissions).toContain('iam:DeleteRole')
+    expect(permissions).toContain('iam:PassRole')
+  })
+
+  it('should include S3 permissions for storage config', () => {
+    const permissions = getRequiredPermissions({
+      project: { name: 'Test', slug: 'test' },
+      infrastructure: {
+        storage: {
+          uploads: {},
+        },
+      },
+    })
+
+    expect(permissions).toContain('s3:CreateBucket')
+    expect(permissions).toContain('s3:DeleteBucket')
+    expect(permissions).toContain('s3:PutObject')
+    expect(permissions).toContain('s3:GetObject')
+  })
+
+  it('should include EC2 permissions for server compute', () => {
+    const permissions = getRequiredPermissions({
+      project: { name: 'Test', slug: 'test' },
+      infrastructure: {
+        compute: {
+          server: {},
+        },
+      },
+    })
+
+    expect(permissions).toContain('ec2:RunInstances')
+    expect(permissions).toContain('ec2:TerminateInstances')
+    expect(permissions).toContain('autoscaling:CreateAutoScalingGroup')
+    expect(permissions).toContain('elasticloadbalancing:CreateLoadBalancer')
+  })
+
+  it('should include ECS permissions for Fargate compute', () => {
+    const permissions = getRequiredPermissions({
+      project: { name: 'Test', slug: 'test' },
+      infrastructure: {
+        compute: {
+          fargate: {},
+        },
+      },
+    })
+
+    expect(permissions).toContain('ecs:CreateCluster')
+    expect(permissions).toContain('ecs:CreateService')
+    expect(permissions).toContain('ecs:RegisterTaskDefinition')
+  })
+
+  it('should include RDS permissions for database', () => {
+    const permissions = getRequiredPermissions({
+      project: { name: 'Test', slug: 'test' },
+      infrastructure: {
+        database: {
+          postgres: {},
+        },
+      },
+    })
+
+    expect(permissions).toContain('rds:CreateDBInstance')
+    expect(permissions).toContain('rds:DeleteDBInstance')
+    expect(permissions).toContain('rds:ModifyDBInstance')
+  })
+
+  it('should include DynamoDB permissions for DynamoDB database', () => {
+    const permissions = getRequiredPermissions({
+      project: { name: 'Test', slug: 'test' },
+      infrastructure: {
+        database: {
+          dynamodb: {},
+        },
+      },
+    })
+
+    expect(permissions).toContain('dynamodb:CreateTable')
+    expect(permissions).toContain('dynamodb:DeleteTable')
+    expect(permissions).toContain('dynamodb:UpdateTable')
+  })
+
+  it('should include Lambda permissions for functions', () => {
+    const permissions = getRequiredPermissions({
+      project: { name: 'Test', slug: 'test' },
+      infrastructure: {
+        functions: {},
+      },
+    })
+
+    expect(permissions).toContain('lambda:CreateFunction')
+    expect(permissions).toContain('lambda:UpdateFunctionCode')
+  })
+
+  it('should include CloudFront permissions for CDN', () => {
+    const permissions = getRequiredPermissions({
+      project: { name: 'Test', slug: 'test' },
+      infrastructure: {
+        cdn: {},
+      },
+    })
+
+    expect(permissions).toContain('cloudfront:CreateDistribution')
+    expect(permissions).toContain('cloudfront:UpdateDistribution')
+  })
+
+  it('should include VPC permissions for network config', () => {
+    const permissions = getRequiredPermissions({
+      project: { name: 'Test', slug: 'test' },
+      infrastructure: {
+        network: {},
+      },
+    })
+
+    expect(permissions).toContain('ec2:CreateVpc')
+    expect(permissions).toContain('ec2:CreateSubnet')
+    expect(permissions).toContain('ec2:CreateSecurityGroup')
+  })
+
+  it('should return sorted permissions', () => {
+    const permissions = getRequiredPermissions({
+      project: { name: 'Test', slug: 'test' },
+    })
+
+    const sorted = [...permissions].sort()
+    expect(permissions).toEqual(sorted)
+  })
+
+  it('should return unique permissions', () => {
+    const permissions = getRequiredPermissions({
+      project: { name: 'Test', slug: 'test' },
+      infrastructure: {
+        storage: {
+          bucket1: {},
+          bucket2: {},
+        },
+      },
+    })
+
+    const unique = [...new Set(permissions)]
+    expect(permissions.length).toBe(unique.length)
+  })
+})
+
+describe('suggestIAMPolicy', () => {
+  it('should generate valid IAM policy JSON', () => {
+    const policy = suggestIAMPolicy({
+      project: { name: 'Test', slug: 'test' },
+    })
+
+    const parsed = JSON.parse(policy)
+    expect(parsed.Version).toBe('2012-10-17')
+    expect(parsed.Statement).toHaveLength(1)
+    expect(parsed.Statement[0].Effect).toBe('Allow')
+    expect(parsed.Statement[0].Resource).toBe('*')
+  })
+
+  it('should include all required permissions in policy', () => {
+    const policy = suggestIAMPolicy({
+      project: { name: 'Test', slug: 'test' },
+      infrastructure: {
+        storage: {},
+        compute: { server: {} },
+      },
+    })
+
+    const parsed = JSON.parse(policy)
+    expect(parsed.Statement[0].Action).toContain('cloudformation:CreateStack')
+    expect(parsed.Statement[0].Action).toContain('s3:CreateBucket')
+    expect(parsed.Statement[0].Action).toContain('ec2:RunInstances')
+  })
+
+  it('should be properly formatted', () => {
+    const policy = suggestIAMPolicy({
+      project: { name: 'Test', slug: 'test' },
+    })
+
+    // Should be pretty-printed
+    expect(policy).toContain('\n')
+    expect(policy).toContain('  ')
+  })
+})
+
+describe('checkIAMPermissions', () => {
+  it('should return allowed and denied permissions', async () => {
+    const credentials: AWSCredentials = {
+      accessKeyId: 'test',
+      secretAccessKey: 'test',
+      region: 'us-east-1',
+    }
+
+    const result = await checkIAMPermissions(credentials, [
+      'cloudformation:CreateStack',
+      's3:PutObject',
+    ])
+
+    expect(result).toHaveProperty('allowed')
+    expect(result).toHaveProperty('denied')
+    expect(Array.isArray(result.allowed)).toBe(true)
+    expect(Array.isArray(result.denied)).toBe(true)
+  })
+
+  it('should currently return all as allowed (TODO: implement)', async () => {
+    const credentials: AWSCredentials = {
+      accessKeyId: 'test',
+      secretAccessKey: 'test',
+      region: 'us-east-1',
+    }
+
+    const result = await checkIAMPermissions(credentials, [
+      'cloudformation:CreateStack',
+      's3:PutObject',
+    ])
+
+    // TODO: This will change when we implement actual IAM policy simulation
+    expect(result.allowed).toContain('cloudformation:CreateStack')
+    expect(result.allowed).toContain('s3:PutObject')
+    expect(result.denied).toEqual([])
+  })
+})
+
+describe('validateCredentials', () => {
+  it('should return validation result structure', async () => {
+    // This test validates the response structure without making real AWS calls
+    // The function will attempt validation with default profile which may or may not exist
+    try {
+      const result = await validateCredentials('default')
+
+      expect(result).toHaveProperty('valid')
+      expect(typeof result.valid).toBe('boolean')
+
+      if (result.valid) {
+        expect(result.accountId).toBeDefined()
+        expect(result.region).toBeDefined()
+      } else {
+        expect(result.error).toBeDefined()
+      }
+    } catch (error) {
+      // If validation throws, it means credentials are invalid or missing
+      // This is expected behavior in test environment
+      expect(error).toBeDefined()
+    }
+  })
+})

package/src/validators/credentials.ts

@@ -0,0 +1,233 @@
+/**
+ * AWS Credentials Validation
+ * Validate credentials before deployment
+ */
+
+import type { AWSCredentials } from '../aws/credentials'
+import { resolveCredentials, getAccountId } from '../aws/credentials'
+import { CredentialError, DebugLogger } from '../errors'
+
+export interface CredentialValidationResult {
+  valid: boolean
+  accountId?: string
+  region?: string
+  error?: string
+}
+
+/**
+ * Validate AWS credentials
+ */
+export async function validateCredentials(
+  profile: string = 'default',
+): Promise<CredentialValidationResult> {
+  try {
+    DebugLogger.verbose('Resolving AWS credentials...')
+
+    // Resolve credentials
+    const credentials = await resolveCredentials(profile)
+
+    if (!credentials.accessKeyId || !credentials.secretAccessKey) {
+      throw new CredentialError(
+        'AWS credentials are incomplete',
+        'Ensure both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are set',
+      )
+    }
+
+    DebugLogger.verbose('Credentials resolved successfully')
+    DebugLogger.debug('Access Key ID:', credentials.accessKeyId.substring(0, 8) + '...')
+
+    // Test credentials by getting caller identity
+    DebugLogger.verbose('Testing credentials with GetCallerIdentity...')
+
+    let accountId: string
+    try {
+      accountId = await getAccountId(credentials)
+      DebugLogger.verbose('Credentials are valid')
+      DebugLogger.debug('Account ID:', accountId)
+    }
+    catch (error) {
+      if (error instanceof Error) {
+        if (error.message.includes('InvalidClientTokenId')) {
+          throw new CredentialError(
+            'Invalid AWS access key ID',
+            'Check that your AWS_ACCESS_KEY_ID is correct',
+          )
+        }
+        else if (error.message.includes('SignatureDoesNotMatch')) {
+          throw new CredentialError(
+            'Invalid AWS secret access key',
+            'Check that your AWS_SECRET_ACCESS_KEY is correct',
+          )
+        }
+        else if (error.message.includes('ExpiredToken')) {
+          throw new CredentialError(
+            'AWS credentials have expired',
+            'Refresh your temporary credentials or use long-term credentials',
+          )
+        }
+        else {
+          throw new CredentialError(
+            `Failed to validate credentials: ${error.message}`,
+            'Verify your AWS credentials are correct and have the necessary permissions',
+          )
+        }
+      }
+      throw error
+    }
+
+    return {
+      valid: true,
+      accountId,
+      region: credentials.region,
+    }
+  }
+  catch (error) {
+    if (error instanceof CredentialError) {
+      throw error
+    }
+
+    return {
+      valid: false,
+      error: error instanceof Error ? error.message : 'Unknown error',
+    }
+  }
+}
+
+/**
+ * Check IAM permissions
+ */
+export async function checkIAMPermissions(
+  credentials: AWSCredentials,
+  requiredActions: string[],
+): Promise<{ allowed: string[], denied: string[] }> {
+  // TODO: Implement using IAM SimulatePrincipalPolicy API
+  // For now, return all as allowed
+  return {
+    allowed: requiredActions,
+    denied: [],
+  }
+}
+
+/**
+ * Get required IAM permissions for deployment
+ */
+export function getRequiredPermissions(config: any): string[] {
+  const permissions = new Set<string>([
+    // CloudFormation permissions (always required)
+    'cloudformation:CreateStack',
+    'cloudformation:UpdateStack',
+    'cloudformation:DeleteStack',
+    'cloudformation:DescribeStacks',
+    'cloudformation:DescribeStackEvents',
+    'cloudformation:GetTemplate',
+    'cloudformation:ListStacks',
+  ])
+
+  // Add permissions based on infrastructure config
+  if (config.infrastructure) {
+    if (config.infrastructure.storage) {
+      permissions.add('s3:CreateBucket')
+      permissions.add('s3:DeleteBucket')
+      permissions.add('s3:PutBucketPolicy')
+      permissions.add('s3:PutBucketVersioning')
+      permissions.add('s3:PutBucketEncryption')
+      permissions.add('s3:PutObject')
+      permissions.add('s3:GetObject')
+    }
+
+    if (config.infrastructure.compute) {
+      if (config.infrastructure.compute.server) {
+        permissions.add('ec2:RunInstances')
+        permissions.add('ec2:TerminateInstances')
+        permissions.add('ec2:DescribeInstances')
+        permissions.add('autoscaling:CreateAutoScalingGroup')
+        permissions.add('autoscaling:UpdateAutoScalingGroup')
+        permissions.add('autoscaling:DeleteAutoScalingGroup')
+        permissions.add('elasticloadbalancing:CreateLoadBalancer')
+        permissions.add('elasticloadbalancing:DeleteLoadBalancer')
+      }
+
+      if (config.infrastructure.compute.fargate) {
+        permissions.add('ecs:CreateCluster')
+        permissions.add('ecs:DeleteCluster')
+        permissions.add('ecs:CreateService')
+        permissions.add('ecs:UpdateService')
+        permissions.add('ecs:DeleteService')
+        permissions.add('ecs:RegisterTaskDefinition')
+      }
+    }
+
+    if (config.infrastructure.database) {
+      if (config.infrastructure.database.postgres || config.infrastructure.database.mysql) {
+        permissions.add('rds:CreateDBInstance')
+        permissions.add('rds:DeleteDBInstance')
+        permissions.add('rds:ModifyDBInstance')
+        permissions.add('rds:DescribeDBInstances')
+      }
+
+      if (config.infrastructure.database.dynamodb) {
+        permissions.add('dynamodb:CreateTable')
+        permissions.add('dynamodb:DeleteTable')
+        permissions.add('dynamodb:UpdateTable')
+        permissions.add('dynamodb:DescribeTable')
+      }
+    }
+
+    if (config.infrastructure.functions) {
+      permissions.add('lambda:CreateFunction')
+      permissions.add('lambda:DeleteFunction')
+      permissions.add('lambda:UpdateFunctionCode')
+      permissions.add('lambda:UpdateFunctionConfiguration')
+      permissions.add('lambda:AddPermission')
+    }
+
+    if (config.infrastructure.cdn) {
+      permissions.add('cloudfront:CreateDistribution')
+      permissions.add('cloudfront:UpdateDistribution')
+      permissions.add('cloudfront:DeleteDistribution')
+      permissions.add('cloudfront:GetDistribution')
+    }
+
+    if (config.infrastructure.network) {
+      permissions.add('ec2:CreateVpc')
+      permissions.add('ec2:DeleteVpc')
+      permissions.add('ec2:CreateSubnet')
+      permissions.add('ec2:DeleteSubnet')
+      permissions.add('ec2:CreateInternetGateway')
+      permissions.add('ec2:DeleteInternetGateway')
+      permissions.add('ec2:CreateNatGateway')
+      permissions.add('ec2:DeleteNatGateway')
+      permissions.add('ec2:CreateRouteTable')
+      permissions.add('ec2:DeleteRouteTable')
+      permissions.add('ec2:CreateSecurityGroup')
+      permissions.add('ec2:DeleteSecurityGroup')
+    }
+  }
+
+  // IAM permissions (always required for creating roles)
+  permissions.add('iam:CreateRole')
+  permissions.add('iam:DeleteRole')
+  permissions.add('iam:AttachRolePolicy')
+  permissions.add('iam:DetachRolePolicy')
+  permissions.add('iam:PutRolePolicy')
+  permissions.add('iam:GetRole')
+  permissions.add('iam:PassRole')
+
+  return Array.from(permissions).sort()
+}
+
+/**
+ * Suggest IAM policy for deployment
+ */
+export function suggestIAMPolicy(config: any): string {
+  const permissions = getRequiredPermissions(config)
+
+  return JSON.stringify({
+    Version: '2012-10-17',
+    Statement: [{
+      Effect: 'Allow',
+      Action: permissions,
+      Resource: '*',
+    }],
+  }, null, 2)
+}