@staticforge/azure 0.0.0-stage → 0.1.0

package/dist/uploader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uploader.js","sourceRoot":"","sources":["../src/uploader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAoB3D,MAAM,UAAU,GAAG,EAAE,GAAG,MAAM,CAAC;AAE/B,qEAAqE;AACrE,SAAS,SAAS;IAChB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAA6B,CAAC;IAC5F,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,KAAa;IACpD,OAAO,CACL,MAAM;SACH,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC;QACzB,4CAA4C;SAC3C,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC;SAC9B,IAAI,EAAE,CACV,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAa,KAAK,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE;IACjF,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAwC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1F,MAAM,KAAK,GAAG,KAAK,CACjB,OAAO,CAAC,QAAQ,EAChB,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,mBAAmB,CAAC,EACvE;gBACE,GAAG;gBACH,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE;gBAC9E,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;gBACjC,OAAO,EAAE,UAAU;aACpB,CACF,CAAC;YACF,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5D,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,uCAAuC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,WAAW,CACnB,SAAS,CAAC,YAAY,EACtB,2DAA2D,MAAM,CAAC,IAAI,GAAG,EACzE;gBACE,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC5D,IAAI,EAAE,sHAAsH;aAC7H,CACF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,uCAAuC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrE,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;IAC1C,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,55 @@
 {
   "name": "@staticforge/azure",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "Azure provider for staticforge: Static Web Apps, named preview environments, rollback by rebuild",
+  "keywords": [
+    "staticforge",
+    "azure",
+    "static-web-apps",
+    "opentofu",
+    "terraform"
+  ],
+  "homepage": "https://github.com/elchanio-76/sforge#readme",
+  "bugs": {
+    "url": "https://github.com/elchanio-76/sforge/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/elchanio-76/sforge.git",
+    "directory": "packages/providers/azure"
+  },
+  "license": "MIT",
+  "author": "Eleftherios Chaniotakis",
+  "type": "module",
+  "exports": {
+    ".": {
+      "@staticforge/source": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "terraform/**/*.tf",
+    "terraform/**/*.hcl",
+    "!terraform/**/.terraform.lock.hcl",
+    "!terraform/**/tests/**"
+  ],
+  "engines": {
+    "node": "^22.22.0 || >=24.8.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@azure/arm-appservice": "^19.0.0",
+    "@azure/arm-storage": "^21.0.0",
+    "@azure/identity": "^4.14.0",
+    "@azure/static-web-apps-cli": "^2.1.0",
+    "@azure/storage-blob": "^12.34.0",
+    "@staticforge/build": "0.1.0",
+    "@staticforge/core": "0.1.0",
+    "@staticforge/iac": "0.1.0",
+    "@staticforge/provider-api": "0.1.0"
+  }
 }

package/terraform/modules/site/main.tf

@@ -0,0 +1,38 @@
+# An Azure Static Web App that sforge deploys to with the SWA deployment client.
+# The app is not linked to a repository: content arrives through `sforge deploy`,
+# which fetches the deployment token at run time (it is not an output and not in
+# any file sforge writes).
+
+locals {
+  # Static Web App names are 2-60 characters.
+  app_name = substr("${var.name}-${var.target}", 0, 60)
+  tags     = merge(var.tags, { "sforge:role" = "site" })
+}
+
+resource "azurerm_resource_group" "site" {
+  count = var.create_resource_group ? 1 : 0
+
+  name     = var.resource_group_name
+  location = var.location
+  tags     = local.tags
+}
+
+data "azurerm_resource_group" "site" {
+  count = var.create_resource_group ? 0 : 1
+
+  name = var.resource_group_name
+}
+
+resource "azurerm_static_web_app" "site" {
+  name                = local.app_name
+  resource_group_name = var.create_resource_group ? azurerm_resource_group.site[0].name : data.azurerm_resource_group.site[0].name
+  location            = var.location
+
+  sku_tier = var.sku
+  sku_size = var.sku
+
+  # Named preview environments (`sforge deploy --preview pr-42`).
+  preview_environments_enabled = true
+
+  tags = local.tags
+}

package/terraform/modules/site/outputs.tf

@@ -0,0 +1,27 @@
+output "static_web_app_name" {
+  value = azurerm_static_web_app.site.name
+}
+
+output "static_web_app_id" {
+  value = azurerm_static_web_app.site.id
+}
+
+output "resource_group" {
+  value = var.resource_group_name
+}
+
+output "location" {
+  value = var.location
+}
+
+output "sku" {
+  value = var.sku
+}
+
+output "default_host_name" {
+  value = azurerm_static_web_app.site.default_host_name
+}
+
+output "url" {
+  value = "https://${azurerm_static_web_app.site.default_host_name}"
+}

package/terraform/modules/site/variables.tf

@@ -0,0 +1,44 @@
+variable "name" {
+  description = "Project name (iac.name), used in resource names and tags."
+  type        = string
+}
+
+variable "target" {
+  description = "Target name, e.g. prod."
+  type        = string
+}
+
+variable "resource_group_name" {
+  description = "Resource group of the site."
+  type        = string
+}
+
+variable "create_resource_group" {
+  description = "Create the resource group (and delete it with the site). False uses an existing one."
+  type        = bool
+  default     = true
+}
+
+variable "location" {
+  description = "Azure region. Static Web Apps are only available in a few (westus2, centralus, eastus2, westeurope, eastasia)."
+  type        = string
+  validation {
+    condition     = contains(["westus2", "centralus", "eastus2", "westeurope", "eastasia"], var.location)
+    error_message = "Static Web Apps are available in westus2, centralus, eastus2, westeurope and eastasia."
+  }
+}
+
+variable "sku" {
+  description = "Free or Standard."
+  type        = string
+  default     = "Free"
+  validation {
+    condition     = contains(["Free", "Standard"], var.sku)
+    error_message = "sku must be \"Free\" or \"Standard\"."
+  }
+}
+
+variable "tags" {
+  type    = map(string)
+  default = {}
+}

package/terraform/modules/site/versions.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.10.0"
+
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = ">= 4.0, < 5.0"
+    }
+  }
+}

package/terraform/state-bootstrap/main.tf

@@ -0,0 +1,83 @@
+# Remote state for every staticforge site in one Azure subscription.
+# State files are stored in a private blob container at <site>/<target>.tfstate,
+# authenticated with Microsoft Entra ID (no access keys) and locked with blob leases.
+
+data "azurerm_client_config" "current" {}
+
+resource "azurerm_resource_group" "state" {
+  name     = var.resource_group_name
+  location = var.location
+  tags     = merge(var.tags, { "sforge:role" = "state" })
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "azurerm_storage_account" "state" {
+  name                = var.storage_account_name
+  resource_group_name = azurerm_resource_group.state.name
+  location            = azurerm_resource_group.state.location
+
+  account_kind             = "StorageV2"
+  account_tier             = "Standard"
+  account_replication_type = var.replication_type
+
+  min_tls_version                 = "TLS1_2"
+  https_traffic_only_enabled      = true
+  allow_nested_items_to_be_public = false
+  shared_access_key_enabled       = false
+  default_to_oauth_authentication = true
+
+  blob_properties {
+    versioning_enabled = true
+
+    delete_retention_policy {
+      days = var.retention_days
+    }
+
+    container_delete_retention_policy {
+      days = var.retention_days
+    }
+  }
+
+  tags = merge(var.tags, { "sforge:role" = "state" })
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "azurerm_storage_container" "state" {
+  name                  = var.container_name
+  storage_account_id    = azurerm_storage_account.state.id
+  container_access_type = "private"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+# Owner and Contributor manage the account but cannot read blobs: data access is a separate role.
+resource "azurerm_role_assignment" "caller" {
+  scope                = azurerm_storage_account.state.id
+  role_definition_name = "Storage Blob Data Contributor"
+  principal_id         = data.azurerm_client_config.current.object_id
+}
+
+resource "azurerm_role_assignment" "extra" {
+  for_each = toset(var.data_contributors)
+
+  scope                = azurerm_storage_account.state.id
+  role_definition_name = "Storage Blob Data Contributor"
+  principal_id         = each.value
+}
+
+resource "time_sleep" "role_propagation" {
+  create_duration = var.role_propagation_delay
+
+  depends_on = [
+    azurerm_role_assignment.caller,
+    azurerm_role_assignment.extra,
+  ]
+}

package/terraform/state-bootstrap/outputs.tf

@@ -0,0 +1,21 @@
+# Both depend on the role propagation, so the migration into the backend starts after it.
+
+output "resource_group" {
+  value      = azurerm_resource_group.state.name
+  depends_on = [time_sleep.role_propagation]
+}
+
+output "storage_account" {
+  value      = azurerm_storage_account.state.name
+  depends_on = [time_sleep.role_propagation]
+}
+
+output "storage_account_id" {
+  value      = azurerm_storage_account.state.id
+  depends_on = [time_sleep.role_propagation]
+}
+
+output "container" {
+  value      = azurerm_storage_container.state.name
+  depends_on = [time_sleep.role_propagation]
+}

package/terraform/state-bootstrap/variables.tf

@@ -0,0 +1,53 @@
+variable "resource_group_name" {
+  description = "Resource group of the state storage account, e.g. sforge-state."
+  type        = string
+}
+
+variable "location" {
+  description = "Azure region of the state storage account."
+  type        = string
+}
+
+variable "storage_account_name" {
+  description = "Globally unique name (3-24 lowercase letters and digits), e.g. sfstate0123456789ab."
+  type        = string
+  validation {
+    condition     = can(regex("^[a-z0-9]{3,24}$", var.storage_account_name))
+    error_message = "storage_account_name must be 3-24 lowercase letters and digits."
+  }
+}
+
+variable "container_name" {
+  description = "Blob container that holds the state files."
+  type        = string
+  default     = "tfstate"
+}
+
+variable "replication_type" {
+  description = "Storage replication (LRS, ZRS, GRS, ...)."
+  type        = string
+  default     = "LRS"
+}
+
+variable "retention_days" {
+  description = "Days that deleted blobs and containers (and so state files) stay recoverable."
+  type        = number
+  default     = 30
+}
+
+variable "data_contributors" {
+  description = "Object IDs of further principals that may read and write state. The caller always can."
+  type        = list(string)
+  default     = []
+}
+
+variable "role_propagation_delay" {
+  description = "Wait after granting data access: Azure RBAC takes minutes to take effect, and the state is migrated right after."
+  type        = string
+  default     = "120s"
+}
+
+variable "tags" {
+  type    = map(string)
+  default = {}
+}

package/terraform/state-bootstrap/versions.tf

@@ -0,0 +1,14 @@
+terraform {
+  required_version = ">= 1.10.0"
+
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = ">= 4.0, < 5.0"
+    }
+    time = {
+      source  = "hashicorp/time"
+      version = ">= 0.12, < 1.0"
+    }
+  }
+}