@stacksjs/ts-cloud-core 0.1.3 → 0.1.7

package/src/validators/credentials.test.ts

@@ -1,274 +0,0 @@
-/**
- * Credential Validation Tests
- */
-
-import { describe, expect, it, mock } from 'bun:test'
-import type { AWSCredentials } from '../aws/credentials'
-import {
-  validateCredentials,
-  checkIAMPermissions,
-  getRequiredPermissions,
-  suggestIAMPolicy,
-} from './credentials'
-
-describe('getRequiredPermissions', () => {
-  it('should always include CloudFormation permissions', () => {
-    const permissions = getRequiredPermissions({
-      project: { name: 'Test', slug: 'test' },
-    })
-
-    expect(permissions).toContain('cloudformation:CreateStack')
-    expect(permissions).toContain('cloudformation:UpdateStack')
-    expect(permissions).toContain('cloudformation:DeleteStack')
-    expect(permissions).toContain('cloudformation:DescribeStacks')
-  })
-
-  it('should always include IAM permissions', () => {
-    const permissions = getRequiredPermissions({
-      project: { name: 'Test', slug: 'test' },
-    })
-
-    expect(permissions).toContain('iam:CreateRole')
-    expect(permissions).toContain('iam:DeleteRole')
-    expect(permissions).toContain('iam:PassRole')
-  })
-
-  it('should include S3 permissions for storage config', () => {
-    const permissions = getRequiredPermissions({
-      project: { name: 'Test', slug: 'test' },
-      infrastructure: {
-        storage: {
-          uploads: {},
-        },
-      },
-    })
-
-    expect(permissions).toContain('s3:CreateBucket')
-    expect(permissions).toContain('s3:DeleteBucket')
-    expect(permissions).toContain('s3:PutObject')
-    expect(permissions).toContain('s3:GetObject')
-  })
-
-  it('should include EC2 permissions for server compute', () => {
-    const permissions = getRequiredPermissions({
-      project: { name: 'Test', slug: 'test' },
-      infrastructure: {
-        compute: {
-          server: {},
-        },
-      },
-    })
-
-    expect(permissions).toContain('ec2:RunInstances')
-    expect(permissions).toContain('ec2:TerminateInstances')
-    expect(permissions).toContain('autoscaling:CreateAutoScalingGroup')
-    expect(permissions).toContain('elasticloadbalancing:CreateLoadBalancer')
-  })
-
-  it('should include ECS permissions for Fargate compute', () => {
-    const permissions = getRequiredPermissions({
-      project: { name: 'Test', slug: 'test' },
-      infrastructure: {
-        compute: {
-          fargate: {},
-        },
-      },
-    })
-
-    expect(permissions).toContain('ecs:CreateCluster')
-    expect(permissions).toContain('ecs:CreateService')
-    expect(permissions).toContain('ecs:RegisterTaskDefinition')
-  })
-
-  it('should include RDS permissions for database', () => {
-    const permissions = getRequiredPermissions({
-      project: { name: 'Test', slug: 'test' },
-      infrastructure: {
-        database: {
-          postgres: {},
-        },
-      },
-    })
-
-    expect(permissions).toContain('rds:CreateDBInstance')
-    expect(permissions).toContain('rds:DeleteDBInstance')
-    expect(permissions).toContain('rds:ModifyDBInstance')
-  })
-
-  it('should include DynamoDB permissions for DynamoDB database', () => {
-    const permissions = getRequiredPermissions({
-      project: { name: 'Test', slug: 'test' },
-      infrastructure: {
-        database: {
-          dynamodb: {},
-        },
-      },
-    })
-
-    expect(permissions).toContain('dynamodb:CreateTable')
-    expect(permissions).toContain('dynamodb:DeleteTable')
-    expect(permissions).toContain('dynamodb:UpdateTable')
-  })
-
-  it('should include Lambda permissions for functions', () => {
-    const permissions = getRequiredPermissions({
-      project: { name: 'Test', slug: 'test' },
-      infrastructure: {
-        functions: {},
-      },
-    })
-
-    expect(permissions).toContain('lambda:CreateFunction')
-    expect(permissions).toContain('lambda:UpdateFunctionCode')
-  })
-
-  it('should include CloudFront permissions for CDN', () => {
-    const permissions = getRequiredPermissions({
-      project: { name: 'Test', slug: 'test' },
-      infrastructure: {
-        cdn: {},
-      },
-    })
-
-    expect(permissions).toContain('cloudfront:CreateDistribution')
-    expect(permissions).toContain('cloudfront:UpdateDistribution')
-  })
-
-  it('should include VPC permissions for network config', () => {
-    const permissions = getRequiredPermissions({
-      project: { name: 'Test', slug: 'test' },
-      infrastructure: {
-        network: {},
-      },
-    })
-
-    expect(permissions).toContain('ec2:CreateVpc')
-    expect(permissions).toContain('ec2:CreateSubnet')
-    expect(permissions).toContain('ec2:CreateSecurityGroup')
-  })
-
-  it('should return sorted permissions', () => {
-    const permissions = getRequiredPermissions({
-      project: { name: 'Test', slug: 'test' },
-    })
-
-    const sorted = [...permissions].sort()
-    expect(permissions).toEqual(sorted)
-  })
-
-  it('should return unique permissions', () => {
-    const permissions = getRequiredPermissions({
-      project: { name: 'Test', slug: 'test' },
-      infrastructure: {
-        storage: {
-          bucket1: {},
-          bucket2: {},
-        },
-      },
-    })
-
-    const unique = [...new Set(permissions)]
-    expect(permissions.length).toBe(unique.length)
-  })
-})
-
-describe('suggestIAMPolicy', () => {
-  it('should generate valid IAM policy JSON', () => {
-    const policy = suggestIAMPolicy({
-      project: { name: 'Test', slug: 'test' },
-    })
-
-    const parsed = JSON.parse(policy)
-    expect(parsed.Version).toBe('2012-10-17')
-    expect(parsed.Statement).toHaveLength(1)
-    expect(parsed.Statement[0].Effect).toBe('Allow')
-    expect(parsed.Statement[0].Resource).toBe('*')
-  })
-
-  it('should include all required permissions in policy', () => {
-    const policy = suggestIAMPolicy({
-      project: { name: 'Test', slug: 'test' },
-      infrastructure: {
-        storage: {},
-        compute: { server: {} },
-      },
-    })
-
-    const parsed = JSON.parse(policy)
-    expect(parsed.Statement[0].Action).toContain('cloudformation:CreateStack')
-    expect(parsed.Statement[0].Action).toContain('s3:CreateBucket')
-    expect(parsed.Statement[0].Action).toContain('ec2:RunInstances')
-  })
-
-  it('should be properly formatted', () => {
-    const policy = suggestIAMPolicy({
-      project: { name: 'Test', slug: 'test' },
-    })
-
-    // Should be pretty-printed
-    expect(policy).toContain('\n')
-    expect(policy).toContain('  ')
-  })
-})
-
-describe('checkIAMPermissions', () => {
-  it('should return allowed and denied permissions', async () => {
-    const credentials: AWSCredentials = {
-      accessKeyId: 'test',
-      secretAccessKey: 'test',
-      region: 'us-east-1',
-    }
-
-    const result = await checkIAMPermissions(credentials, [
-      'cloudformation:CreateStack',
-      's3:PutObject',
-    ])
-
-    expect(result).toHaveProperty('allowed')
-    expect(result).toHaveProperty('denied')
-    expect(Array.isArray(result.allowed)).toBe(true)
-    expect(Array.isArray(result.denied)).toBe(true)
-  })
-
-  it('should currently return all as allowed (TODO: implement)', async () => {
-    const credentials: AWSCredentials = {
-      accessKeyId: 'test',
-      secretAccessKey: 'test',
-      region: 'us-east-1',
-    }
-
-    const result = await checkIAMPermissions(credentials, [
-      'cloudformation:CreateStack',
-      's3:PutObject',
-    ])
-
-    // TODO: This will change when we implement actual IAM policy simulation
-    expect(result.allowed).toContain('cloudformation:CreateStack')
-    expect(result.allowed).toContain('s3:PutObject')
-    expect(result.denied).toEqual([])
-  })
-})
-
-describe('validateCredentials', () => {
-  it('should return validation result structure', async () => {
-    // This test validates the response structure without making real AWS calls
-    // The function will attempt validation with default profile which may or may not exist
-    try {
-      const result = await validateCredentials('default')
-
-      expect(result).toHaveProperty('valid')
-      expect(typeof result.valid).toBe('boolean')
-
-      if (result.valid) {
-        expect(result.accountId).toBeDefined()
-        expect(result.region).toBeDefined()
-      } else {
-        expect(result.error).toBeDefined()
-      }
-    } catch (error) {
-      // If validation throws, it means credentials are invalid or missing
-      // This is expected behavior in test environment
-      expect(error).toBeDefined()
-    }
-  })
-})

package/src/validators/credentials.ts

@@ -1,233 +0,0 @@
-/**
- * AWS Credentials Validation
- * Validate credentials before deployment
- */
-
-import type { AWSCredentials } from '../aws/credentials'
-import { resolveCredentials, getAccountId } from '../aws/credentials'
-import { CredentialError, DebugLogger } from '../errors'
-
-export interface CredentialValidationResult {
-  valid: boolean
-  accountId?: string
-  region?: string
-  error?: string
-}
-
-/**
- * Validate AWS credentials
- */
-export async function validateCredentials(
-  profile: string = 'default',
-): Promise<CredentialValidationResult> {
-  try {
-    DebugLogger.verbose('Resolving AWS credentials...')
-
-    // Resolve credentials
-    const credentials = await resolveCredentials(profile)
-
-    if (!credentials.accessKeyId || !credentials.secretAccessKey) {
-      throw new CredentialError(
-        'AWS credentials are incomplete',
-        'Ensure both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are set',
-      )
-    }
-
-    DebugLogger.verbose('Credentials resolved successfully')
-    DebugLogger.debug('Access Key ID:', credentials.accessKeyId.substring(0, 8) + '...')
-
-    // Test credentials by getting caller identity
-    DebugLogger.verbose('Testing credentials with GetCallerIdentity...')
-
-    let accountId: string
-    try {
-      accountId = await getAccountId(credentials)
-      DebugLogger.verbose('Credentials are valid')
-      DebugLogger.debug('Account ID:', accountId)
-    }
-    catch (error) {
-      if (error instanceof Error) {
-        if (error.message.includes('InvalidClientTokenId')) {
-          throw new CredentialError(
-            'Invalid AWS access key ID',
-            'Check that your AWS_ACCESS_KEY_ID is correct',
-          )
-        }
-        else if (error.message.includes('SignatureDoesNotMatch')) {
-          throw new CredentialError(
-            'Invalid AWS secret access key',
-            'Check that your AWS_SECRET_ACCESS_KEY is correct',
-          )
-        }
-        else if (error.message.includes('ExpiredToken')) {
-          throw new CredentialError(
-            'AWS credentials have expired',
-            'Refresh your temporary credentials or use long-term credentials',
-          )
-        }
-        else {
-          throw new CredentialError(
-            `Failed to validate credentials: ${error.message}`,
-            'Verify your AWS credentials are correct and have the necessary permissions',
-          )
-        }
-      }
-      throw error
-    }
-
-    return {
-      valid: true,
-      accountId,
-      region: credentials.region,
-    }
-  }
-  catch (error) {
-    if (error instanceof CredentialError) {
-      throw error
-    }
-
-    return {
-      valid: false,
-      error: error instanceof Error ? error.message : 'Unknown error',
-    }
-  }
-}
-
-/**
- * Check IAM permissions
- */
-export async function checkIAMPermissions(
-  credentials: AWSCredentials,
-  requiredActions: string[],
-): Promise<{ allowed: string[], denied: string[] }> {
-  // TODO: Implement using IAM SimulatePrincipalPolicy API
-  // For now, return all as allowed
-  return {
-    allowed: requiredActions,
-    denied: [],
-  }
-}
-
-/**
- * Get required IAM permissions for deployment
- */
-export function getRequiredPermissions(config: any): string[] {
-  const permissions = new Set<string>([
-    // CloudFormation permissions (always required)
-    'cloudformation:CreateStack',
-    'cloudformation:UpdateStack',
-    'cloudformation:DeleteStack',
-    'cloudformation:DescribeStacks',
-    'cloudformation:DescribeStackEvents',
-    'cloudformation:GetTemplate',
-    'cloudformation:ListStacks',
-  ])
-
-  // Add permissions based on infrastructure config
-  if (config.infrastructure) {
-    if (config.infrastructure.storage) {
-      permissions.add('s3:CreateBucket')
-      permissions.add('s3:DeleteBucket')
-      permissions.add('s3:PutBucketPolicy')
-      permissions.add('s3:PutBucketVersioning')
-      permissions.add('s3:PutBucketEncryption')
-      permissions.add('s3:PutObject')
-      permissions.add('s3:GetObject')
-    }
-
-    if (config.infrastructure.compute) {
-      if (config.infrastructure.compute.server) {
-        permissions.add('ec2:RunInstances')
-        permissions.add('ec2:TerminateInstances')
-        permissions.add('ec2:DescribeInstances')
-        permissions.add('autoscaling:CreateAutoScalingGroup')
-        permissions.add('autoscaling:UpdateAutoScalingGroup')
-        permissions.add('autoscaling:DeleteAutoScalingGroup')
-        permissions.add('elasticloadbalancing:CreateLoadBalancer')
-        permissions.add('elasticloadbalancing:DeleteLoadBalancer')
-      }
-
-      if (config.infrastructure.compute.fargate) {
-        permissions.add('ecs:CreateCluster')
-        permissions.add('ecs:DeleteCluster')
-        permissions.add('ecs:CreateService')
-        permissions.add('ecs:UpdateService')
-        permissions.add('ecs:DeleteService')
-        permissions.add('ecs:RegisterTaskDefinition')
-      }
-    }
-
-    if (config.infrastructure.database) {
-      if (config.infrastructure.database.postgres || config.infrastructure.database.mysql) {
-        permissions.add('rds:CreateDBInstance')
-        permissions.add('rds:DeleteDBInstance')
-        permissions.add('rds:ModifyDBInstance')
-        permissions.add('rds:DescribeDBInstances')
-      }
-
-      if (config.infrastructure.database.dynamodb) {
-        permissions.add('dynamodb:CreateTable')
-        permissions.add('dynamodb:DeleteTable')
-        permissions.add('dynamodb:UpdateTable')
-        permissions.add('dynamodb:DescribeTable')
-      }
-    }
-
-    if (config.infrastructure.functions) {
-      permissions.add('lambda:CreateFunction')
-      permissions.add('lambda:DeleteFunction')
-      permissions.add('lambda:UpdateFunctionCode')
-      permissions.add('lambda:UpdateFunctionConfiguration')
-      permissions.add('lambda:AddPermission')
-    }
-
-    if (config.infrastructure.cdn) {
-      permissions.add('cloudfront:CreateDistribution')
-      permissions.add('cloudfront:UpdateDistribution')
-      permissions.add('cloudfront:DeleteDistribution')
-      permissions.add('cloudfront:GetDistribution')
-    }
-
-    if (config.infrastructure.network) {
-      permissions.add('ec2:CreateVpc')
-      permissions.add('ec2:DeleteVpc')
-      permissions.add('ec2:CreateSubnet')
-      permissions.add('ec2:DeleteSubnet')
-      permissions.add('ec2:CreateInternetGateway')
-      permissions.add('ec2:DeleteInternetGateway')
-      permissions.add('ec2:CreateNatGateway')
-      permissions.add('ec2:DeleteNatGateway')
-      permissions.add('ec2:CreateRouteTable')
-      permissions.add('ec2:DeleteRouteTable')
-      permissions.add('ec2:CreateSecurityGroup')
-      permissions.add('ec2:DeleteSecurityGroup')
-    }
-  }
-
-  // IAM permissions (always required for creating roles)
-  permissions.add('iam:CreateRole')
-  permissions.add('iam:DeleteRole')
-  permissions.add('iam:AttachRolePolicy')
-  permissions.add('iam:DetachRolePolicy')
-  permissions.add('iam:PutRolePolicy')
-  permissions.add('iam:GetRole')
-  permissions.add('iam:PassRole')
-
-  return Array.from(permissions).sort()
-}
-
-/**
- * Suggest IAM policy for deployment
- */
-export function suggestIAMPolicy(config: any): string {
-  const permissions = getRequiredPermissions(config)
-
-  return JSON.stringify({
-    Version: '2012-10-17',
-    Statement: [{
-      Effect: 'Allow',
-      Action: permissions,
-      Resource: '*',
-    }],
-  }, null, 2)
-}