@webiny/project-aws 0.0.0-unstable.3c5210ad37

package/project.d.ts

@@ -0,0 +1,139 @@
+export declare const Project: {
+    Id: import("@webiny/project/defineExtension/defineExtension.js").ExtensionComponent<import("zod").ZodObject<{
+        id: import("zod").ZodEffects<import("zod").ZodString, string, string>;
+    }, "strip", import("zod").ZodTypeAny, {
+        id: string;
+    }, {
+        id: string;
+    }>>;
+    Telemetry: import("@webiny/project/defineExtension/defineExtension.js").ExtensionComponent<import("zod").ZodObject<{
+        enabled: import("zod").ZodDefault<import("zod").ZodBoolean>;
+    }, "strip", import("zod").ZodTypeAny, {
+        enabled: boolean;
+    }, {
+        enabled?: boolean | undefined;
+    }>>;
+    AutoInstall: import("@webiny/project/defineExtension/defineExtension.js").ExtensionComponent<import("zod").ZodObject<{
+        adminUser: import("zod").ZodObject<{
+            firstName: import("zod").ZodString;
+            lastName: import("zod").ZodString;
+            email: import("zod").ZodString;
+            password: import("zod").ZodString;
+        }, "strip", import("zod").ZodTypeAny, {
+            firstName: string;
+            lastName: string;
+            email: string;
+            password: string;
+        }, {
+            firstName: string;
+            lastName: string;
+            email: string;
+            password: string;
+        }>;
+    }, "strip", import("zod").ZodTypeAny, {
+        adminUser: {
+            firstName: string;
+            lastName: string;
+            email: string;
+            password: string;
+        };
+    }, {
+        adminUser: {
+            firstName: string;
+            lastName: string;
+            email: string;
+            password: string;
+        };
+    }>>;
+    FeatureFlags: import("@webiny/project/defineExtension/defineExtension.js").ExtensionComponent<import("zod").ZodObject<{
+        features: import("zod").ZodObject<{
+            multiTenancy: import("zod").ZodOptional<import("zod").ZodBoolean>;
+            advancedPublishingWorkflow: import("zod").ZodOptional<import("zod").ZodBoolean>;
+            advancedAccessControlLayer: import("zod").ZodOptional<import("zod").ZodUnion<[import("zod").ZodBoolean, import("zod").ZodObject<{
+                teams: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                privateFiles: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                folderLevelPermissions: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                hcmsFieldPermissions: import("zod").ZodOptional<import("zod").ZodBoolean>;
+            }, "strip", import("zod").ZodTypeAny, {
+                teams?: boolean | undefined;
+                privateFiles?: boolean | undefined;
+                folderLevelPermissions?: boolean | undefined;
+                hcmsFieldPermissions?: boolean | undefined;
+            }, {
+                teams?: boolean | undefined;
+                privateFiles?: boolean | undefined;
+                folderLevelPermissions?: boolean | undefined;
+                hcmsFieldPermissions?: boolean | undefined;
+            }>]>>;
+            auditLogs: import("zod").ZodOptional<import("zod").ZodBoolean>;
+            recordLocking: import("zod").ZodOptional<import("zod").ZodBoolean>;
+            fileManager: import("zod").ZodOptional<import("zod").ZodObject<{
+                threatDetection: import("zod").ZodOptional<import("zod").ZodBoolean>;
+            }, "strip", import("zod").ZodTypeAny, {
+                threatDetection?: boolean | undefined;
+            }, {
+                threatDetection?: boolean | undefined;
+            }>>;
+        }, "strip", import("zod").ZodTypeAny, {
+            multiTenancy?: boolean | undefined;
+            advancedPublishingWorkflow?: boolean | undefined;
+            advancedAccessControlLayer?: boolean | {
+                teams?: boolean | undefined;
+                privateFiles?: boolean | undefined;
+                folderLevelPermissions?: boolean | undefined;
+                hcmsFieldPermissions?: boolean | undefined;
+            } | undefined;
+            auditLogs?: boolean | undefined;
+            recordLocking?: boolean | undefined;
+            fileManager?: {
+                threatDetection?: boolean | undefined;
+            } | undefined;
+        }, {
+            multiTenancy?: boolean | undefined;
+            advancedPublishingWorkflow?: boolean | undefined;
+            advancedAccessControlLayer?: boolean | {
+                teams?: boolean | undefined;
+                privateFiles?: boolean | undefined;
+                folderLevelPermissions?: boolean | undefined;
+                hcmsFieldPermissions?: boolean | undefined;
+            } | undefined;
+            auditLogs?: boolean | undefined;
+            recordLocking?: boolean | undefined;
+            fileManager?: {
+                threatDetection?: boolean | undefined;
+            } | undefined;
+        }>;
+    }, "strip", import("zod").ZodTypeAny, {
+        features: {
+            multiTenancy?: boolean | undefined;
+            advancedPublishingWorkflow?: boolean | undefined;
+            advancedAccessControlLayer?: boolean | {
+                teams?: boolean | undefined;
+                privateFiles?: boolean | undefined;
+                folderLevelPermissions?: boolean | undefined;
+                hcmsFieldPermissions?: boolean | undefined;
+            } | undefined;
+            auditLogs?: boolean | undefined;
+            recordLocking?: boolean | undefined;
+            fileManager?: {
+                threatDetection?: boolean | undefined;
+            } | undefined;
+        };
+    }, {
+        features: {
+            multiTenancy?: boolean | undefined;
+            advancedPublishingWorkflow?: boolean | undefined;
+            advancedAccessControlLayer?: boolean | {
+                teams?: boolean | undefined;
+                privateFiles?: boolean | undefined;
+                folderLevelPermissions?: boolean | undefined;
+                hcmsFieldPermissions?: boolean | undefined;
+            } | undefined;
+            auditLogs?: boolean | undefined;
+            recordLocking?: boolean | undefined;
+            fileManager?: {
+                threatDetection?: boolean | undefined;
+            } | undefined;
+        };
+    }>>;
+};

package/project.js

@@ -0,0 +1,10 @@
+import { ProjectId, Telemetry, FeatureFlags } from "@webiny/project/extensions/index.js";
+import { AutoInstall } from "./extensions/index.js";
+export const Project = {
+  Id: ProjectId,
+  Telemetry,
+  AutoInstall,
+  FeatureFlags
+};
+
+//# sourceMappingURL=project.js.map

package/project.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["ProjectId","Telemetry","FeatureFlags","AutoInstall","Project","Id"],"sources":["project.ts"],"sourcesContent":["import { ProjectId, Telemetry, FeatureFlags } from \"@webiny/project/extensions/index.js\";\nimport { AutoInstall } from \"./extensions/index.js\";\n\nexport const Project = {\n    Id: ProjectId,\n    Telemetry,\n    AutoInstall,\n    FeatureFlags\n};\n"],"mappings":"AAAA,SAASA,SAAS,EAAEC,SAAS,EAAEC,YAAY,QAAQ,qCAAqC;AACxF,SAASC,WAAW;AAEpB,OAAO,MAAMC,OAAO,GAAG;EACnBC,EAAE,EAAEL,SAAS;EACbC,SAAS;EACTE,WAAW;EACXD;AACJ,CAAC","ignoreList":[]}

package/pulumi/apps/admin/createAdminPulumiApp.d.ts

@@ -0,0 +1,12 @@
+import { createReactPulumiApp } from "../../../pulumi/apps/index.js";
+export type AdminPulumiApp = ReturnType<typeof createReactPulumiApp>;
+export declare const createAdminPulumiApp: () => Promise<import("@webiny/pulumi/types").PulumiApp<{
+    cloudfront: import("@webiny/pulumi/PulumiAppResource").PulumiAppResource<typeof import("@pulumi/aws/cloudfront/distribution").Distribution>;
+    bucket: import("@webiny/pulumi/PulumiAppResource").PulumiAppResource<typeof import("@pulumi/aws/s3/bucket").Bucket>;
+    bucketOwnershipControls: import("@webiny/pulumi/PulumiAppResource").PulumiAppResource<typeof import("@pulumi/aws/s3/bucketOwnershipControls").BucketOwnershipControls>;
+    bucketAcl: import("@webiny/pulumi/PulumiAppResource").PulumiAppResource<typeof import("@pulumi/aws/s3/bucketAcl").BucketAcl>;
+    originIdentity: import("@webiny/pulumi/PulumiAppResource").PulumiAppResource<typeof import("@pulumi/aws/cloudfront/originAccessIdentity").OriginAccessIdentity>;
+    origin: import("@pulumi/aws/types/input").cloudfront.DistributionOrigin;
+    bucketPublicAccessBlock: import("@webiny/pulumi/PulumiAppResource").PulumiAppResource<typeof import("@pulumi/aws/s3/bucketPublicAccessBlock").BucketPublicAccessBlock>;
+    bucketPolicy: import("@webiny/pulumi/PulumiAppResource").PulumiAppResource<typeof import("@pulumi/aws/s3/bucketPolicy").BucketPolicy>;
+}> & import("../../utils/withServiceManifest").WithServiceManifest>;

package/pulumi/apps/admin/createAdminPulumiApp.js

@@ -0,0 +1,52 @@
+import { createReactPulumiApp } from "../index.js";
+import { getProjectSdk } from "@webiny/project";
+import { AdminPulumi } from "@webiny/project/abstractions/index.js";
+import { AdminCustomDomains as adminCustomDomainsExt } from "../../extensions/AdminCustomDomains.js";
+import { withServiceManifest } from "../../index.js";
+export const createAdminPulumiApp = async () => {
+  const sdk = await getProjectSdk();
+  const projectConfig = await sdk.getProjectConfig();
+  const baseApp = createReactPulumiApp({
+    name: "admin",
+    folder: "apps/admin",
+    domains: () => {
+      const [adminDomains] = projectConfig.extensionsByType(adminCustomDomainsExt);
+      if (adminDomains) {
+        const {
+          domains,
+          sslMethod,
+          certificateArn
+        } = adminDomains.params;
+        return {
+          domains,
+          sslSupportMethod: sslMethod,
+          acmCertificateArn: certificateArn
+        };
+      }
+      return undefined;
+    },
+    pulumi: async app => {
+      // Overrides must be applied via a handler, registered at the very start of the program.
+      // By doing this, we're ensuring user's adjustments are not applied to late.
+      const pulumiHandlers = sdk.getContainer().resolve(AdminPulumi);
+      app.addHandler(() => {
+        return pulumiHandlers.execute(app);
+      });
+    }
+  });
+  const app = withServiceManifest(baseApp);
+  app.addHandler(() => {
+    app.addServiceManifest({
+      name: "admin",
+      manifest: {
+        cloudfront: {
+          distributionId: baseApp.resources.cloudfront.output.id,
+          domain: baseApp.resources.cloudfront.output.domainName.apply(v => `https://${v}`)
+        }
+      }
+    });
+  });
+  return app;
+};
+
+//# sourceMappingURL=createAdminPulumiApp.js.map

package/pulumi/apps/admin/createAdminPulumiApp.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createReactPulumiApp","getProjectSdk","AdminPulumi","AdminCustomDomains","adminCustomDomainsExt","withServiceManifest","createAdminPulumiApp","sdk","projectConfig","getProjectConfig","baseApp","name","folder","domains","adminDomains","extensionsByType","sslMethod","certificateArn","params","sslSupportMethod","acmCertificateArn","undefined","pulumi","app","pulumiHandlers","getContainer","resolve","addHandler","execute","addServiceManifest","manifest","cloudfront","distributionId","resources","output","id","domain","domainName","apply","v"],"sources":["createAdminPulumiApp.ts"],"sourcesContent":["import { type CorePulumiApp, createReactPulumiApp } from \"~/pulumi/apps/index.js\";\nimport { getProjectSdk } from \"@webiny/project\";\nimport { AdminPulumi } from \"@webiny/project/abstractions/index.js\";\nimport { AdminCustomDomains as adminCustomDomainsExt } from \"~/pulumi/extensions/AdminCustomDomains.js\";\nimport { withServiceManifest } from \"~/pulumi/index.js\";\n\nexport type AdminPulumiApp = ReturnType<typeof createReactPulumiApp>;\n\nexport const createAdminPulumiApp = async () => {\n    const sdk = await getProjectSdk();\n    const projectConfig = await sdk.getProjectConfig();\n    const baseApp = createReactPulumiApp({\n        name: \"admin\",\n        folder: \"apps/admin\",\n        domains: () => {\n            const [adminDomains] = projectConfig.extensionsByType(adminCustomDomainsExt);\n\n            if (adminDomains) {\n                const { domains, sslMethod, certificateArn } = adminDomains.params;\n                return {\n                    domains,\n                    sslSupportMethod: sslMethod,\n                    acmCertificateArn: certificateArn\n                };\n            }\n\n            return undefined;\n        },\n        pulumi: async app => {\n            // Overrides must be applied via a handler, registered at the very start of the program.\n            // By doing this, we're ensuring user's adjustments are not applied to late.\n            const pulumiHandlers = sdk.getContainer().resolve(AdminPulumi);\n\n            app.addHandler(() => {\n                return pulumiHandlers.execute(app as unknown as CorePulumiApp);\n            });\n        }\n    });\n\n    const app = withServiceManifest(baseApp);\n\n    app.addHandler(() => {\n        app.addServiceManifest({\n            name: \"admin\",\n            manifest: {\n                cloudfront: {\n                    distributionId: baseApp.resources.cloudfront.output.id,\n                    domain: baseApp.resources.cloudfront.output.domainName.apply(\n                        v => `https://${v}`\n                    )\n                }\n            }\n        });\n    });\n\n    return app;\n};\n"],"mappings":"AAAA,SAA6BA,oBAAoB;AACjD,SAASC,aAAa,QAAQ,iBAAiB;AAC/C,SAASC,WAAW,QAAQ,uCAAuC;AACnE,SAASC,kBAAkB,IAAIC,qBAAqB;AACpD,SAASC,mBAAmB;AAI5B,OAAO,MAAMC,oBAAoB,GAAG,MAAAA,CAAA,KAAY;EAC5C,MAAMC,GAAG,GAAG,MAAMN,aAAa,CAAC,CAAC;EACjC,MAAMO,aAAa,GAAG,MAAMD,GAAG,CAACE,gBAAgB,CAAC,CAAC;EAClD,MAAMC,OAAO,GAAGV,oBAAoB,CAAC;IACjCW,IAAI,EAAE,OAAO;IACbC,MAAM,EAAE,YAAY;IACpBC,OAAO,EAAEA,CAAA,KAAM;MACX,MAAM,CAACC,YAAY,CAAC,GAAGN,aAAa,CAACO,gBAAgB,CAACX,qBAAqB,CAAC;MAE5E,IAAIU,YAAY,EAAE;QACd,MAAM;UAAED,OAAO;UAAEG,SAAS;UAAEC;QAAe,CAAC,GAAGH,YAAY,CAACI,MAAM;QAClE,OAAO;UACHL,OAAO;UACPM,gBAAgB,EAAEH,SAAS;UAC3BI,iBAAiB,EAAEH;QACvB,CAAC;MACL;MAEA,OAAOI,SAAS;IACpB,CAAC;IACDC,MAAM,EAAE,MAAMC,GAAG,IAAI;MACjB;MACA;MACA,MAAMC,cAAc,GAAGjB,GAAG,CAACkB,YAAY,CAAC,CAAC,CAACC,OAAO,CAACxB,WAAW,CAAC;MAE9DqB,GAAG,CAACI,UAAU,CAAC,MAAM;QACjB,OAAOH,cAAc,CAACI,OAAO,CAACL,GAA+B,CAAC;MAClE,CAAC,CAAC;IACN;EACJ,CAAC,CAAC;EAEF,MAAMA,GAAG,GAAGlB,mBAAmB,CAACK,OAAO,CAAC;EAExCa,GAAG,CAACI,UAAU,CAAC,MAAM;IACjBJ,GAAG,CAACM,kBAAkB,CAAC;MACnBlB,IAAI,EAAE,OAAO;MACbmB,QAAQ,EAAE;QACNC,UAAU,EAAE;UACRC,cAAc,EAAEtB,OAAO,CAACuB,SAAS,CAACF,UAAU,CAACG,MAAM,CAACC,EAAE;UACtDC,MAAM,EAAE1B,OAAO,CAACuB,SAAS,CAACF,UAAU,CAACG,MAAM,CAACG,UAAU,CAACC,KAAK,CACxDC,CAAC,IAAI,WAAWA,CAAC,EACrB;QACJ;MACJ;IACJ,CAAC,CAAC;EACN,CAAC,CAAC;EAEF,OAAOhB,GAAG;AACd,CAAC","ignoreList":[]}

package/pulumi/apps/admin/index.d.ts

@@ -0,0 +1 @@
+export * from "./createAdminPulumiApp.js";

package/pulumi/apps/admin/index.js

@@ -0,0 +1,3 @@
+export * from "./createAdminPulumiApp.js";
+
+//# sourceMappingURL=index.js.map

package/pulumi/apps/admin/index.js.map

@@ -0,0 +1 @@
+{"version":3,"names":[],"sources":["index.ts"],"sourcesContent":["export * from \"./createAdminPulumiApp.js\";\n"],"mappings":"AAAA","ignoreList":[]}

package/pulumi/apps/api/ApiBackgroundTask.d.ts

@@ -0,0 +1,12 @@
+import type { PulumiAppModule } from "@webiny/pulumi";
+export type ApiBackgroundTask = PulumiAppModule<typeof ApiBackgroundTask>;
+export declare const ApiBackgroundTaskLambdaName = "background-task";
+export declare const ApiBackgroundTask: import("@webiny/pulumi").PulumiAppModuleDefinition<{
+    backgroundTask: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda/function.js").Function>;
+    stepFunction: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/sfn/stateMachine.js").StateMachine>;
+    stepFunctionRole: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/role.js").Role>;
+    stepFunctionPolicy: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/policy.js").Policy>;
+    eventPolicy: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/policy.js").Policy>;
+    eventRolePolicyAttachment: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/rolePolicyAttachment.js").RolePolicyAttachment>;
+    eventTarget: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cloudwatch/eventTarget.js").EventTarget>;
+}, void>;

package/pulumi/apps/api/ApiBackgroundTask.js

@@ -0,0 +1,148 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as aws from "@pulumi/aws";
+import { createAppModule } from "@webiny/pulumi";
+import { ApiGraphql, CoreOutput } from "../index.js";
+import { createBackgroundTaskDefinition } from "./backgroundTask/definition.js";
+import { createBackgroundTaskStepFunctionPolicy } from "./backgroundTask/policy.js";
+import { createBackgroundTaskStepFunctionRole } from "./backgroundTask/role.js";
+import { getLayerArn } from "@webiny/aws-layers";
+import { getAwsAccountId, getAwsRegion } from "../awsUtils.js";
+export const ApiBackgroundTaskLambdaName = "background-task";
+export const ApiBackgroundTask = createAppModule({
+  name: "ApiBackgroundTask",
+  config(app) {
+    const awsAccountId = getAwsAccountId(app);
+    const awsRegion = getAwsRegion(app);
+    const core = app.getModule(CoreOutput);
+    const graphql = app.getModule(ApiGraphql);
+    const baseConfig = graphql.functions.graphql.config.clone();
+    const backgroundTask = app.addResource(aws.lambda.Function, {
+      name: ApiBackgroundTaskLambdaName,
+      config: {
+        ...baseConfig,
+        layers: graphql.functions.graphql.output.layers.apply(arns => {
+          return Array.from(new Set([...(arns || []), getLayerArn("sharp")]));
+        }),
+        timeout: 900,
+        memorySize: 1024,
+        description: "Performs background tasks.",
+        loggingConfig: {
+          logFormat: "JSON"
+        }
+      }
+    });
+    const stepFunctionPolicy = createBackgroundTaskStepFunctionPolicy(app, {
+      name: "background-task-sfn-policy",
+      lambdaFunctionArn: backgroundTask.output.arn
+    });
+    const stepFunctionRole = createBackgroundTaskStepFunctionRole(app, {
+      name: "background-task-sfn-role",
+      policy: stepFunctionPolicy.output
+    });
+    const stepFunction = app.addResource(aws.sfn.StateMachine, {
+      name: "background-task-sfn",
+      config: {
+        roleArn: stepFunctionRole.output.arn,
+        definition: pulumi.jsonStringify(createBackgroundTaskDefinition({
+          lambdaName: ApiBackgroundTaskLambdaName,
+          lambdaArn: backgroundTask.output.arn
+        }))
+      }
+    });
+    const policyToAccessStepFunction = app.addResource(aws.iam.Policy, {
+      name: "background-task-step-function-policy",
+      config: {
+        policy: {
+          Version: "2012-10-17",
+          Statement: [{
+            Action: ["states:StartExecution", "states:StopExecution"],
+            Effect: "Allow",
+            Resource: [stepFunction.output.arn.apply(arn => `${arn}`), stepFunction.output.arn.apply(arn => `${arn}*`)]
+          }, {
+            Action: ["states:DescribeExecution", "states:ListExecutions"],
+            Effect: "Allow",
+            Resource: [stepFunction.output.name.apply(name => {
+              return pulumi.interpolate`arn:aws:states:${awsRegion}:${awsAccountId}:execution:${name}:*`;
+            })]
+          }]
+        }
+      }
+    });
+    app.addResource(aws.iam.RolePolicyAttachment, {
+      name: "background-task-step-function-policy-attachment-graphql",
+      config: {
+        policyArn: policyToAccessStepFunction.output.arn,
+        role: graphql.role.output.name
+      }
+    });
+    const eventRole = app.addResource(aws.iam.Role, {
+      name: "background-task-event-role",
+      config: {
+        assumeRolePolicy: {
+          Version: "2012-10-17",
+          Statement: [{
+            Action: "sts:AssumeRole",
+            Effect: "Allow",
+            Principal: {
+              Service: "events.amazonaws.com"
+            }
+          }]
+        }
+      }
+    });
+    const eventPolicy = app.addResource(aws.iam.Policy, {
+      name: "background-task-event-policy",
+      config: {
+        policy: {
+          Version: "2012-10-17",
+          Statement: [{
+            Action: "states:StartExecution",
+            Effect: "Allow",
+            Resource: stepFunction.output.arn
+          }]
+        }
+      }
+    });
+    const eventRolePolicyAttachment = app.addResource(aws.iam.RolePolicyAttachment, {
+      name: "background-task-event-role-policy-attachment",
+      config: {
+        role: eventRole.output.name,
+        policyArn: eventPolicy.output.arn
+      }
+    });
+    const eventRule = app.addResource(aws.cloudwatch.EventRule, {
+      name: "background-task-event-rule",
+      config: {
+        eventBusName: core.eventBusName,
+        roleArn: eventRole.output.arn,
+        eventPattern: JSON.stringify({
+          "detail-type": ["WebinyBackgroundTask"]
+        })
+      }
+    });
+    const eventTarget = app.addResource(aws.cloudwatch.EventTarget, {
+      name: "background-task-event-target",
+      config: {
+        // This is going to get called.
+        arn: stepFunction.output.arn,
+        // This is the rule which determines if this target gets called.
+        rule: eventRule.output.name,
+        // This is the role which gets assumed when calling the target.
+        roleArn: eventRole.output.arn,
+        // This is the event bus name.
+        eventBusName: core.eventBusName
+      }
+    });
+    return {
+      backgroundTask,
+      stepFunction,
+      stepFunctionRole,
+      stepFunctionPolicy,
+      eventPolicy,
+      eventRolePolicyAttachment,
+      eventTarget
+    };
+  }
+});
+
+//# sourceMappingURL=ApiBackgroundTask.js.map

package/pulumi/apps/api/ApiBackgroundTask.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["pulumi","aws","createAppModule","ApiGraphql","CoreOutput","createBackgroundTaskDefinition","createBackgroundTaskStepFunctionPolicy","createBackgroundTaskStepFunctionRole","getLayerArn","getAwsAccountId","getAwsRegion","ApiBackgroundTaskLambdaName","ApiBackgroundTask","name","config","app","awsAccountId","awsRegion","core","getModule","graphql","baseConfig","functions","clone","backgroundTask","addResource","lambda","Function","layers","output","apply","arns","Array","from","Set","timeout","memorySize","description","loggingConfig","logFormat","stepFunctionPolicy","lambdaFunctionArn","arn","stepFunctionRole","policy","stepFunction","sfn","StateMachine","roleArn","definition","jsonStringify","lambdaName","lambdaArn","policyToAccessStepFunction","iam","Policy","Version","Statement","Action","Effect","Resource","interpolate","RolePolicyAttachment","policyArn","role","eventRole","Role","assumeRolePolicy","Principal","Service","eventPolicy","eventRolePolicyAttachment","eventRule","cloudwatch","EventRule","eventBusName","eventPattern","JSON","stringify","eventTarget","EventTarget","rule"],"sources":["ApiBackgroundTask.ts"],"sourcesContent":["import * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\nimport type { PulumiApp, PulumiAppModule } from \"@webiny/pulumi\";\nimport { createAppModule } from \"@webiny/pulumi\";\nimport { ApiGraphql, CoreOutput } from \"~/pulumi/apps/index.js\";\nimport { createBackgroundTaskDefinition } from \"./backgroundTask/definition.js\";\nimport { createBackgroundTaskStepFunctionPolicy } from \"~/pulumi/apps/api/backgroundTask/policy.js\";\nimport { createBackgroundTaskStepFunctionRole } from \"./backgroundTask/role.js\";\nimport { getLayerArn } from \"@webiny/aws-layers\";\nimport { getAwsAccountId, getAwsRegion } from \"~/pulumi/apps/awsUtils.js\";\n\nexport type ApiBackgroundTask = PulumiAppModule<typeof ApiBackgroundTask>;\n\nexport const ApiBackgroundTaskLambdaName = \"background-task\";\n\nexport const ApiBackgroundTask = createAppModule({\n    name: \"ApiBackgroundTask\",\n    config(app: PulumiApp) {\n        const awsAccountId = getAwsAccountId(app);\n        const awsRegion = getAwsRegion(app);\n        const core = app.getModule(CoreOutput);\n        const graphql = app.getModule(ApiGraphql);\n        const baseConfig = graphql.functions.graphql.config.clone();\n\n        const backgroundTask = app.addResource(aws.lambda.Function, {\n            name: ApiBackgroundTaskLambdaName,\n            config: {\n                ...baseConfig,\n                layers: graphql.functions.graphql.output.layers.apply(arns => {\n                    return Array.from(new Set([...(arns || []), getLayerArn(\"sharp\")]));\n                }),\n                timeout: 900,\n                memorySize: 1024,\n                description: \"Performs background tasks.\",\n                loggingConfig: {\n                    logFormat: \"JSON\"\n                }\n            }\n        });\n\n        const stepFunctionPolicy = createBackgroundTaskStepFunctionPolicy(app, {\n            name: \"background-task-sfn-policy\",\n            lambdaFunctionArn: backgroundTask.output.arn\n        });\n\n        const stepFunctionRole = createBackgroundTaskStepFunctionRole(app, {\n            name: \"background-task-sfn-role\",\n            policy: stepFunctionPolicy.output\n        });\n\n        const stepFunction = app.addResource(aws.sfn.StateMachine, {\n            name: \"background-task-sfn\",\n            config: {\n                roleArn: stepFunctionRole.output.arn,\n                definition: pulumi.jsonStringify(\n                    createBackgroundTaskDefinition({\n                        lambdaName: ApiBackgroundTaskLambdaName,\n                        lambdaArn: backgroundTask.output.arn\n                    })\n                )\n            }\n        });\n\n        const policyToAccessStepFunction = app.addResource(aws.iam.Policy, {\n            name: \"background-task-step-function-policy\",\n            config: {\n                policy: {\n                    Version: \"2012-10-17\",\n                    Statement: [\n                        {\n                            Action: [\"states:StartExecution\", \"states:StopExecution\"],\n                            Effect: \"Allow\",\n                            Resource: [\n                                stepFunction.output.arn.apply(arn => `${arn}`),\n                                stepFunction.output.arn.apply(arn => `${arn}*`)\n                            ]\n                        },\n                        {\n                            Action: [\"states:DescribeExecution\", \"states:ListExecutions\"],\n                            Effect: \"Allow\",\n                            Resource: [\n                                stepFunction.output.name.apply(name => {\n                                    return pulumi.interpolate`arn:aws:states:${awsRegion}:${awsAccountId}:execution:${name}:*`;\n                                })\n                            ]\n                        }\n                    ]\n                }\n            }\n        });\n\n        app.addResource(aws.iam.RolePolicyAttachment, {\n            name: \"background-task-step-function-policy-attachment-graphql\",\n            config: {\n                policyArn: policyToAccessStepFunction.output.arn,\n                role: graphql.role.output.name\n            }\n        });\n\n        const eventRole = app.addResource(aws.iam.Role, {\n            name: \"background-task-event-role\",\n            config: {\n                assumeRolePolicy: {\n                    Version: \"2012-10-17\",\n                    Statement: [\n                        {\n                            Action: \"sts:AssumeRole\",\n                            Effect: \"Allow\",\n                            Principal: {\n                                Service: \"events.amazonaws.com\"\n                            }\n                        }\n                    ]\n                }\n            }\n        });\n\n        const eventPolicy = app.addResource(aws.iam.Policy, {\n            name: \"background-task-event-policy\",\n            config: {\n                policy: {\n                    Version: \"2012-10-17\",\n                    Statement: [\n                        {\n                            Action: \"states:StartExecution\",\n                            Effect: \"Allow\",\n                            Resource: stepFunction.output.arn\n                        }\n                    ]\n                }\n            }\n        });\n\n        const eventRolePolicyAttachment = app.addResource(aws.iam.RolePolicyAttachment, {\n            name: \"background-task-event-role-policy-attachment\",\n            config: {\n                role: eventRole.output.name,\n                policyArn: eventPolicy.output.arn\n            }\n        });\n\n        const eventRule = app.addResource(aws.cloudwatch.EventRule, {\n            name: \"background-task-event-rule\",\n            config: {\n                eventBusName: core.eventBusName,\n                roleArn: eventRole.output.arn,\n                eventPattern: JSON.stringify({\n                    \"detail-type\": [\"WebinyBackgroundTask\"]\n                })\n            }\n        });\n\n        const eventTarget = app.addResource(aws.cloudwatch.EventTarget, {\n            name: \"background-task-event-target\",\n            config: {\n                // This is going to get called.\n                arn: stepFunction.output.arn,\n                // This is the rule which determines if this target gets called.\n                rule: eventRule.output.name,\n                // This is the role which gets assumed when calling the target.\n                roleArn: eventRole.output.arn,\n                // This is the event bus name.\n                eventBusName: core.eventBusName\n            }\n        });\n\n        return {\n            backgroundTask,\n            stepFunction,\n            stepFunctionRole,\n            stepFunctionPolicy,\n            eventPolicy,\n            eventRolePolicyAttachment,\n            eventTarget\n        };\n    }\n});\n"],"mappings":"AAAA,OAAO,KAAKA,MAAM,MAAM,gBAAgB;AACxC,OAAO,KAAKC,GAAG,MAAM,aAAa;AAElC,SAASC,eAAe,QAAQ,gBAAgB;AAChD,SAASC,UAAU,EAAEC,UAAU;AAC/B,SAASC,8BAA8B;AACvC,SAASC,sCAAsC;AAC/C,SAASC,oCAAoC;AAC7C,SAASC,WAAW,QAAQ,oBAAoB;AAChD,SAASC,eAAe,EAAEC,YAAY;AAItC,OAAO,MAAMC,2BAA2B,GAAG,iBAAiB;AAE5D,OAAO,MAAMC,iBAAiB,GAAGV,eAAe,CAAC;EAC7CW,IAAI,EAAE,mBAAmB;EACzBC,MAAMA,CAACC,GAAc,EAAE;IACnB,MAAMC,YAAY,GAAGP,eAAe,CAACM,GAAG,CAAC;IACzC,MAAME,SAAS,GAAGP,YAAY,CAACK,GAAG,CAAC;IACnC,MAAMG,IAAI,GAAGH,GAAG,CAACI,SAAS,CAACf,UAAU,CAAC;IACtC,MAAMgB,OAAO,GAAGL,GAAG,CAACI,SAAS,CAAChB,UAAU,CAAC;IACzC,MAAMkB,UAAU,GAAGD,OAAO,CAACE,SAAS,CAACF,OAAO,CAACN,MAAM,CAACS,KAAK,CAAC,CAAC;IAE3D,MAAMC,cAAc,GAAGT,GAAG,CAACU,WAAW,CAACxB,GAAG,CAACyB,MAAM,CAACC,QAAQ,EAAE;MACxDd,IAAI,EAAEF,2BAA2B;MACjCG,MAAM,EAAE;QACJ,GAAGO,UAAU;QACbO,MAAM,EAAER,OAAO,CAACE,SAAS,CAACF,OAAO,CAACS,MAAM,CAACD,MAAM,CAACE,KAAK,CAACC,IAAI,IAAI;UAC1D,OAAOC,KAAK,CAACC,IAAI,CAAC,IAAIC,GAAG,CAAC,CAAC,IAAIH,IAAI,IAAI,EAAE,CAAC,EAAEvB,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACvE,CAAC,CAAC;QACF2B,OAAO,EAAE,GAAG;QACZC,UAAU,EAAE,IAAI;QAChBC,WAAW,EAAE,4BAA4B;QACzCC,aAAa,EAAE;UACXC,SAAS,EAAE;QACf;MACJ;IACJ,CAAC,CAAC;IAEF,MAAMC,kBAAkB,GAAGlC,sCAAsC,CAACS,GAAG,EAAE;MACnEF,IAAI,EAAE,4BAA4B;MAClC4B,iBAAiB,EAAEjB,cAAc,CAACK,MAAM,CAACa;IAC7C,CAAC,CAAC;IAEF,MAAMC,gBAAgB,GAAGpC,oCAAoC,CAACQ,GAAG,EAAE;MAC/DF,IAAI,EAAE,0BAA0B;MAChC+B,MAAM,EAAEJ,kBAAkB,CAACX;IAC/B,CAAC,CAAC;IAEF,MAAMgB,YAAY,GAAG9B,GAAG,CAACU,WAAW,CAACxB,GAAG,CAAC6C,GAAG,CAACC,YAAY,EAAE;MACvDlC,IAAI,EAAE,qBAAqB;MAC3BC,MAAM,EAAE;QACJkC,OAAO,EAAEL,gBAAgB,CAACd,MAAM,CAACa,GAAG;QACpCO,UAAU,EAAEjD,MAAM,CAACkD,aAAa,CAC5B7C,8BAA8B,CAAC;UAC3B8C,UAAU,EAAExC,2BAA2B;UACvCyC,SAAS,EAAE5B,cAAc,CAACK,MAAM,CAACa;QACrC,CAAC,CACL;MACJ;IACJ,CAAC,CAAC;IAEF,MAAMW,0BAA0B,GAAGtC,GAAG,CAACU,WAAW,CAACxB,GAAG,CAACqD,GAAG,CAACC,MAAM,EAAE;MAC/D1C,IAAI,EAAE,sCAAsC;MAC5CC,MAAM,EAAE;QACJ8B,MAAM,EAAE;UACJY,OAAO,EAAE,YAAY;UACrBC,SAAS,EAAE,CACP;YACIC,MAAM,EAAE,CAAC,uBAAuB,EAAE,sBAAsB,CAAC;YACzDC,MAAM,EAAE,OAAO;YACfC,QAAQ,EAAE,CACNf,YAAY,CAAChB,MAAM,CAACa,GAAG,CAACZ,KAAK,CAACY,GAAG,IAAI,GAAGA,GAAG,EAAE,CAAC,EAC9CG,YAAY,CAAChB,MAAM,CAACa,GAAG,CAACZ,KAAK,CAACY,GAAG,IAAI,GAAGA,GAAG,GAAG,CAAC;UAEvD,CAAC,EACD;YACIgB,MAAM,EAAE,CAAC,0BAA0B,EAAE,uBAAuB,CAAC;YAC7DC,MAAM,EAAE,OAAO;YACfC,QAAQ,EAAE,CACNf,YAAY,CAAChB,MAAM,CAAChB,IAAI,CAACiB,KAAK,CAACjB,IAAI,IAAI;cACnC,OAAOb,MAAM,CAAC6D,WAAW,kBAAkB5C,SAAS,IAAID,YAAY,cAAcH,IAAI,IAAI;YAC9F,CAAC,CAAC;UAEV,CAAC;QAET;MACJ;IACJ,CAAC,CAAC;IAEFE,GAAG,CAACU,WAAW,CAACxB,GAAG,CAACqD,GAAG,CAACQ,oBAAoB,EAAE;MAC1CjD,IAAI,EAAE,yDAAyD;MAC/DC,MAAM,EAAE;QACJiD,SAAS,EAAEV,0BAA0B,CAACxB,MAAM,CAACa,GAAG;QAChDsB,IAAI,EAAE5C,OAAO,CAAC4C,IAAI,CAACnC,MAAM,CAAChB;MAC9B;IACJ,CAAC,CAAC;IAEF,MAAMoD,SAAS,GAAGlD,GAAG,CAACU,WAAW,CAACxB,GAAG,CAACqD,GAAG,CAACY,IAAI,EAAE;MAC5CrD,IAAI,EAAE,4BAA4B;MAClCC,MAAM,EAAE;QACJqD,gBAAgB,EAAE;UACdX,OAAO,EAAE,YAAY;UACrBC,SAAS,EAAE,CACP;YACIC,MAAM,EAAE,gBAAgB;YACxBC,MAAM,EAAE,OAAO;YACfS,SAAS,EAAE;cACPC,OAAO,EAAE;YACb;UACJ,CAAC;QAET;MACJ;IACJ,CAAC,CAAC;IAEF,MAAMC,WAAW,GAAGvD,GAAG,CAACU,WAAW,CAACxB,GAAG,CAACqD,GAAG,CAACC,MAAM,EAAE;MAChD1C,IAAI,EAAE,8BAA8B;MACpCC,MAAM,EAAE;QACJ8B,MAAM,EAAE;UACJY,OAAO,EAAE,YAAY;UACrBC,SAAS,EAAE,CACP;YACIC,MAAM,EAAE,uBAAuB;YAC/BC,MAAM,EAAE,OAAO;YACfC,QAAQ,EAAEf,YAAY,CAAChB,MAAM,CAACa;UAClC,CAAC;QAET;MACJ;IACJ,CAAC,CAAC;IAEF,MAAM6B,yBAAyB,GAAGxD,GAAG,CAACU,WAAW,CAACxB,GAAG,CAACqD,GAAG,CAACQ,oBAAoB,EAAE;MAC5EjD,IAAI,EAAE,8CAA8C;MACpDC,MAAM,EAAE;QACJkD,IAAI,EAAEC,SAAS,CAACpC,MAAM,CAAChB,IAAI;QAC3BkD,SAAS,EAAEO,WAAW,CAACzC,MAAM,CAACa;MAClC;IACJ,CAAC,CAAC;IAEF,MAAM8B,SAAS,GAAGzD,GAAG,CAACU,WAAW,CAACxB,GAAG,CAACwE,UAAU,CAACC,SAAS,EAAE;MACxD7D,IAAI,EAAE,4BAA4B;MAClCC,MAAM,EAAE;QACJ6D,YAAY,EAAEzD,IAAI,CAACyD,YAAY;QAC/B3B,OAAO,EAAEiB,SAAS,CAACpC,MAAM,CAACa,GAAG;QAC7BkC,YAAY,EAAEC,IAAI,CAACC,SAAS,CAAC;UACzB,aAAa,EAAE,CAAC,sBAAsB;QAC1C,CAAC;MACL;IACJ,CAAC,CAAC;IAEF,MAAMC,WAAW,GAAGhE,GAAG,CAACU,WAAW,CAACxB,GAAG,CAACwE,UAAU,CAACO,WAAW,EAAE;MAC5DnE,IAAI,EAAE,8BAA8B;MACpCC,MAAM,EAAE;QACJ;QACA4B,GAAG,EAAEG,YAAY,CAAChB,MAAM,CAACa,GAAG;QAC5B;QACAuC,IAAI,EAAET,SAAS,CAAC3C,MAAM,CAAChB,IAAI;QAC3B;QACAmC,OAAO,EAAEiB,SAAS,CAACpC,MAAM,CAACa,GAAG;QAC7B;QACAiC,YAAY,EAAEzD,IAAI,CAACyD;MACvB;IACJ,CAAC,CAAC;IAEF,OAAO;MACHnD,cAAc;MACdqB,YAAY;MACZF,gBAAgB;MAChBH,kBAAkB;MAClB8B,WAAW;MACXC,yBAAyB;MACzBQ;IACJ,CAAC;EACL;AACJ,CAAC,CAAC","ignoreList":[]}

package/pulumi/apps/api/ApiCloudfront.d.ts

@@ -0,0 +1,3 @@
+import type { PulumiAppModule } from "@webiny/pulumi";
+export type ApiCloudfront = PulumiAppModule<typeof ApiCloudfront>;
+export declare const ApiCloudfront: import("@webiny/pulumi").PulumiAppModuleDefinition<import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cloudfront/distribution.js").Distribution>, void>;

package/pulumi/apps/api/ApiCloudfront.js

@@ -0,0 +1,136 @@
+import * as aws from "@pulumi/aws";
+import { createAppModule } from "@webiny/pulumi";
+import { ApiGateway } from "./ApiGateway.js";
+export const ApiCloudfront = createAppModule({
+  name: "ApiCloudfront",
+  config(app) {
+    const gateway = app.getModule(ApiGateway);
+    const cookies = {
+      forward: "whitelist",
+      whitelistedNames: ["wby-id-token"]
+    };
+    const forwardHeaders = ["Origin", "Authorization", "Accept", "Accept-Language", "X-Tenant", "X-Webiny-Sdk"];
+    return app.addResource(aws.cloudfront.Distribution, {
+      name: "api-cloudfront",
+      config: {
+        httpVersion: "http2and3",
+        waitForDeployment: false,
+        isIpv6Enabled: true,
+        enabled: true,
+        defaultCacheBehavior: {
+          compress: true,
+          allowedMethods: ["GET", "HEAD", "OPTIONS", "PUT", "POST", "PATCH", "DELETE"],
+          cachedMethods: ["GET", "HEAD", "OPTIONS"],
+          forwardedValues: {
+            cookies,
+            headers: forwardHeaders,
+            queryString: true
+          },
+          // MinTTL <= DefaultTTL <= MaxTTL
+          minTtl: 0,
+          defaultTtl: 0,
+          maxTtl: 86400,
+          targetOriginId: gateway.api.output.name,
+          viewerProtocolPolicy: "allow-all"
+        },
+        orderedCacheBehaviors: [{
+          compress: true,
+          allowedMethods: ["GET", "HEAD", "OPTIONS", "PUT", "POST", "PATCH", "DELETE"],
+          cachedMethods: ["GET", "HEAD", "OPTIONS"],
+          forwardedValues: {
+            cookies: {
+              forward: "none"
+            },
+            headers: forwardHeaders,
+            queryString: true
+          },
+          pathPattern: "/cms*",
+          viewerProtocolPolicy: "allow-all",
+          targetOriginId: gateway.api.output.name
+        }, {
+          compress: true,
+          allowedMethods: ["GET", "HEAD", "OPTIONS", "PUT", "POST", "PATCH", "DELETE"],
+          cachedMethods: ["GET", "HEAD", "OPTIONS"],
+          forwardedValues: {
+            cookies: {
+              forward: "none"
+            },
+            headers: forwardHeaders,
+            queryString: true
+          },
+          pathPattern: "/wb/*",
+          viewerProtocolPolicy: "allow-all",
+          targetOriginId: gateway.api.output.name
+        }, {
+          allowedMethods: ["HEAD", "GET", "OPTIONS"],
+          cachedMethods: ["HEAD", "GET", "OPTIONS"],
+          forwardedValues: {
+            cookies: {
+              forward: "none"
+            },
+            headers: forwardHeaders,
+            queryString: true
+          },
+          // MinTTL <= DefaultTTL <= MaxTTL
+          minTtl: 0,
+          defaultTtl: 0,
+          maxTtl: 2592000,
+          pathPattern: "/files/*",
+          viewerProtocolPolicy: "allow-all",
+          targetOriginId: gateway.api.output.name
+        }, {
+          allowedMethods: ["HEAD", "GET", "OPTIONS"],
+          cachedMethods: ["HEAD", "GET", "OPTIONS"],
+          forwardedValues: {
+            cookies: cookies,
+            headers: forwardHeaders,
+            queryString: true
+          },
+          // MinTTL <= DefaultTTL <= MaxTTL
+          minTtl: 0,
+          defaultTtl: 0,
+          maxTtl: 2592000,
+          pathPattern: "/private/*",
+          viewerProtocolPolicy: "allow-all",
+          targetOriginId: gateway.api.output.name
+        }],
+        origins: [{
+          domainName: gateway.stage.output.invokeUrl.apply(url => new URL(url).hostname),
+          originPath: gateway.stage.output.invokeUrl.apply(url => new URL(url).pathname),
+          originId: gateway.api.output.name,
+          customOriginConfig: {
+            httpPort: 80,
+            httpsPort: 443,
+            originProtocolPolicy: "https-only",
+            originSslProtocols: ["TLSv1.2"]
+          }
+        }],
+        restrictions: {
+          geoRestriction: {
+            restrictionType: "none"
+          }
+        },
+        viewerCertificate: {
+          cloudfrontDefaultCertificate: true
+        }
+      },
+      opts: {
+        // We are ignoring changes to the "staging" property. This is because of the following.
+        // With the 5.41.0 release of Webiny, we also upgraded Pulumi to v6. This introduced a change
+        // with how Cloudfront distributions are deployed, where Pulumi now also controls the new
+        // `staging` property.
+        // If not set, Pulumi will default it to `false`. Which is fine, but, the problem is
+        // that, because this property did not exist before, it will always be considered as a change
+        // upon deployment.
+        // We might think this is fine, but, the problem is that a change in this property causes
+        // a full replacement of the Cloudfront distribution, which is not acceptable. Especially
+        // if a custom domain has already been associated with the distribution. This then would
+        // require the user to disassociate the domain, wait for the distribution to be replaced,
+        // and then re-associate the domain. This is not a good experience.
+        ignoreChanges: ["staging"]
+      }
+    });
+  }
+});
+
+//# sourceMappingURL=ApiCloudfront.js.map

package/pulumi/apps/api/ApiCloudfront.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["aws","createAppModule","ApiGateway","ApiCloudfront","name","config","app","gateway","getModule","cookies","forward","whitelistedNames","forwardHeaders","addResource","cloudfront","Distribution","httpVersion","waitForDeployment","isIpv6Enabled","enabled","defaultCacheBehavior","compress","allowedMethods","cachedMethods","forwardedValues","headers","queryString","minTtl","defaultTtl","maxTtl","targetOriginId","api","output","viewerProtocolPolicy","orderedCacheBehaviors","pathPattern","origins","domainName","stage","invokeUrl","apply","url","URL","hostname","originPath","pathname","originId","customOriginConfig","httpPort","httpsPort","originProtocolPolicy","originSslProtocols","restrictions","geoRestriction","restrictionType","viewerCertificate","cloudfrontDefaultCertificate","opts","ignoreChanges"],"sources":["ApiCloudfront.ts"],"sourcesContent":["import * as aws from \"@pulumi/aws\";\nimport type { PulumiApp, PulumiAppModule } from \"@webiny/pulumi\";\nimport { createAppModule } from \"@webiny/pulumi\";\n\nimport { ApiGateway } from \"./ApiGateway.js\";\n\nexport type ApiCloudfront = PulumiAppModule<typeof ApiCloudfront>;\n\nexport const ApiCloudfront = createAppModule({\n    name: \"ApiCloudfront\",\n    config(app: PulumiApp) {\n        const gateway = app.getModule(ApiGateway);\n\n        const cookies = {\n            forward: \"whitelist\",\n            whitelistedNames: [\"wby-id-token\"]\n        };\n\n        const forwardHeaders = [\n            \"Origin\",\n            \"Authorization\",\n            \"Accept\",\n            \"Accept-Language\",\n            \"X-Tenant\",\n            \"X-Webiny-Sdk\"\n        ];\n\n        return app.addResource(aws.cloudfront.Distribution, {\n            name: \"api-cloudfront\",\n            config: {\n                httpVersion: \"http2and3\",\n                waitForDeployment: false,\n                isIpv6Enabled: true,\n                enabled: true,\n                defaultCacheBehavior: {\n                    compress: true,\n                    allowedMethods: [\"GET\", \"HEAD\", \"OPTIONS\", \"PUT\", \"POST\", \"PATCH\", \"DELETE\"],\n                    cachedMethods: [\"GET\", \"HEAD\", \"OPTIONS\"],\n                    forwardedValues: {\n                        cookies,\n                        headers: forwardHeaders,\n                        queryString: true\n                    },\n                    // MinTTL <= DefaultTTL <= MaxTTL\n                    minTtl: 0,\n                    defaultTtl: 0,\n                    maxTtl: 86400,\n                    targetOriginId: gateway.api.output.name,\n                    viewerProtocolPolicy: \"allow-all\"\n                },\n                orderedCacheBehaviors: [\n                    {\n                        compress: true,\n                        allowedMethods: [\n                            \"GET\",\n                            \"HEAD\",\n                            \"OPTIONS\",\n                            \"PUT\",\n                            \"POST\",\n                            \"PATCH\",\n                            \"DELETE\"\n                        ],\n                        cachedMethods: [\"GET\", \"HEAD\", \"OPTIONS\"],\n                        forwardedValues: {\n                            cookies: {\n                                forward: \"none\"\n                            },\n                            headers: forwardHeaders,\n                            queryString: true\n                        },\n                        pathPattern: \"/cms*\",\n                        viewerProtocolPolicy: \"allow-all\",\n                        targetOriginId: gateway.api.output.name\n                    },\n                    {\n                        compress: true,\n                        allowedMethods: [\n                            \"GET\",\n                            \"HEAD\",\n                            \"OPTIONS\",\n                            \"PUT\",\n                            \"POST\",\n                            \"PATCH\",\n                            \"DELETE\"\n                        ],\n                        cachedMethods: [\"GET\", \"HEAD\", \"OPTIONS\"],\n                        forwardedValues: {\n                            cookies: {\n                                forward: \"none\"\n                            },\n                            headers: forwardHeaders,\n                            queryString: true\n                        },\n                        pathPattern: \"/wb/*\",\n                        viewerProtocolPolicy: \"allow-all\",\n                        targetOriginId: gateway.api.output.name\n                    },\n                    {\n                        allowedMethods: [\"HEAD\", \"GET\", \"OPTIONS\"],\n                        cachedMethods: [\"HEAD\", \"GET\", \"OPTIONS\"],\n                        forwardedValues: {\n                            cookies: {\n                                forward: \"none\"\n                            },\n                            headers: forwardHeaders,\n                            queryString: true\n                        },\n                        // MinTTL <= DefaultTTL <= MaxTTL\n                        minTtl: 0,\n                        defaultTtl: 0,\n                        maxTtl: 2592000,\n                        pathPattern: \"/files/*\",\n                        viewerProtocolPolicy: \"allow-all\",\n                        targetOriginId: gateway.api.output.name\n                    },\n                    {\n                        allowedMethods: [\"HEAD\", \"GET\", \"OPTIONS\"],\n                        cachedMethods: [\"HEAD\", \"GET\", \"OPTIONS\"],\n                        forwardedValues: {\n                            cookies: cookies,\n                            headers: forwardHeaders,\n                            queryString: true\n                        },\n                        // MinTTL <= DefaultTTL <= MaxTTL\n                        minTtl: 0,\n                        defaultTtl: 0,\n                        maxTtl: 2592000,\n                        pathPattern: \"/private/*\",\n                        viewerProtocolPolicy: \"allow-all\",\n                        targetOriginId: gateway.api.output.name\n                    }\n                ],\n                origins: [\n                    {\n                        domainName: gateway.stage.output.invokeUrl.apply(\n                            (url: string) => new URL(url).hostname\n                        ),\n                        originPath: gateway.stage.output.invokeUrl.apply(\n                            (url: string) => new URL(url).pathname\n                        ),\n                        originId: gateway.api.output.name,\n                        customOriginConfig: {\n                            httpPort: 80,\n                            httpsPort: 443,\n                            originProtocolPolicy: \"https-only\",\n                            originSslProtocols: [\"TLSv1.2\"]\n                        }\n                    }\n                ],\n                restrictions: {\n                    geoRestriction: {\n                        restrictionType: \"none\"\n                    }\n                },\n                viewerCertificate: {\n                    cloudfrontDefaultCertificate: true\n                }\n            },\n            opts: {\n                // We are ignoring changes to the \"staging\" property. This is because of the following.\n                // With the 5.41.0 release of Webiny, we also upgraded Pulumi to v6. This introduced a change\n                // with how Cloudfront distributions are deployed, where Pulumi now also controls the new\n                // `staging` property.\n                // If not set, Pulumi will default it to `false`. Which is fine, but, the problem is\n                // that, because this property did not exist before, it will always be considered as a change\n                // upon deployment.\n                // We might think this is fine, but, the problem is that a change in this property causes\n                // a full replacement of the Cloudfront distribution, which is not acceptable. Especially\n                // if a custom domain has already been associated with the distribution. This then would\n                // require the user to disassociate the domain, wait for the distribution to be replaced,\n                // and then re-associate the domain. This is not a good experience.\n                ignoreChanges: [\"staging\"]\n            }\n        });\n    }\n});\n"],"mappings":"AAAA,OAAO,KAAKA,GAAG,MAAM,aAAa;AAElC,SAASC,eAAe,QAAQ,gBAAgB;AAEhD,SAASC,UAAU;AAInB,OAAO,MAAMC,aAAa,GAAGF,eAAe,CAAC;EACzCG,IAAI,EAAE,eAAe;EACrBC,MAAMA,CAACC,GAAc,EAAE;IACnB,MAAMC,OAAO,GAAGD,GAAG,CAACE,SAAS,CAACN,UAAU,CAAC;IAEzC,MAAMO,OAAO,GAAG;MACZC,OAAO,EAAE,WAAW;MACpBC,gBAAgB,EAAE,CAAC,cAAc;IACrC,CAAC;IAED,MAAMC,cAAc,GAAG,CACnB,QAAQ,EACR,eAAe,EACf,QAAQ,EACR,iBAAiB,EACjB,UAAU,EACV,cAAc,CACjB;IAED,OAAON,GAAG,CAACO,WAAW,CAACb,GAAG,CAACc,UAAU,CAACC,YAAY,EAAE;MAChDX,IAAI,EAAE,gBAAgB;MACtBC,MAAM,EAAE;QACJW,WAAW,EAAE,WAAW;QACxBC,iBAAiB,EAAE,KAAK;QACxBC,aAAa,EAAE,IAAI;QACnBC,OAAO,EAAE,IAAI;QACbC,oBAAoB,EAAE;UAClBC,QAAQ,EAAE,IAAI;UACdC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;UAC5EC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;UACzCC,eAAe,EAAE;YACbf,OAAO;YACPgB,OAAO,EAAEb,cAAc;YACvBc,WAAW,EAAE;UACjB,CAAC;UACD;UACAC,MAAM,EAAE,CAAC;UACTC,UAAU,EAAE,CAAC;UACbC,MAAM,EAAE,KAAK;UACbC,cAAc,EAAEvB,OAAO,CAACwB,GAAG,CAACC,MAAM,CAAC5B,IAAI;UACvC6B,oBAAoB,EAAE;QAC1B,CAAC;QACDC,qBAAqB,EAAE,CACnB;UACIb,QAAQ,EAAE,IAAI;UACdC,cAAc,EAAE,CACZ,KAAK,EACL,MAAM,EACN,SAAS,EACT,KAAK,EACL,MAAM,EACN,OAAO,EACP,QAAQ,CACX;UACDC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;UACzCC,eAAe,EAAE;YACbf,OAAO,EAAE;cACLC,OAAO,EAAE;YACb,CAAC;YACDe,OAAO,EAAEb,cAAc;YACvBc,WAAW,EAAE;UACjB,CAAC;UACDS,WAAW,EAAE,OAAO;UACpBF,oBAAoB,EAAE,WAAW;UACjCH,cAAc,EAAEvB,OAAO,CAACwB,GAAG,CAACC,MAAM,CAAC5B;QACvC,CAAC,EACD;UACIiB,QAAQ,EAAE,IAAI;UACdC,cAAc,EAAE,CACZ,KAAK,EACL,MAAM,EACN,SAAS,EACT,KAAK,EACL,MAAM,EACN,OAAO,EACP,QAAQ,CACX;UACDC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;UACzCC,eAAe,EAAE;YACbf,OAAO,EAAE;cACLC,OAAO,EAAE;YACb,CAAC;YACDe,OAAO,EAAEb,cAAc;YACvBc,WAAW,EAAE;UACjB,CAAC;UACDS,WAAW,EAAE,OAAO;UACpBF,oBAAoB,EAAE,WAAW;UACjCH,cAAc,EAAEvB,OAAO,CAACwB,GAAG,CAACC,MAAM,CAAC5B;QACvC,CAAC,EACD;UACIkB,cAAc,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC;UAC1CC,aAAa,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC;UACzCC,eAAe,EAAE;YACbf,OAAO,EAAE;cACLC,OAAO,EAAE;YACb,CAAC;YACDe,OAAO,EAAEb,cAAc;YACvBc,WAAW,EAAE;UACjB,CAAC;UACD;UACAC,MAAM,EAAE,CAAC;UACTC,UAAU,EAAE,CAAC;UACbC,MAAM,EAAE,OAAO;UACfM,WAAW,EAAE,UAAU;UACvBF,oBAAoB,EAAE,WAAW;UACjCH,cAAc,EAAEvB,OAAO,CAACwB,GAAG,CAACC,MAAM,CAAC5B;QACvC,CAAC,EACD;UACIkB,cAAc,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC;UAC1CC,aAAa,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC;UACzCC,eAAe,EAAE;YACbf,OAAO,EAAEA,OAAO;YAChBgB,OAAO,EAAEb,cAAc;YACvBc,WAAW,EAAE;UACjB,CAAC;UACD;UACAC,MAAM,EAAE,CAAC;UACTC,UAAU,EAAE,CAAC;UACbC,MAAM,EAAE,OAAO;UACfM,WAAW,EAAE,YAAY;UACzBF,oBAAoB,EAAE,WAAW;UACjCH,cAAc,EAAEvB,OAAO,CAACwB,GAAG,CAACC,MAAM,CAAC5B;QACvC,CAAC,CACJ;QACDgC,OAAO,EAAE,CACL;UACIC,UAAU,EAAE9B,OAAO,CAAC+B,KAAK,CAACN,MAAM,CAACO,SAAS,CAACC,KAAK,CAC3CC,GAAW,IAAK,IAAIC,GAAG,CAACD,GAAG,CAAC,CAACE,QAClC,CAAC;UACDC,UAAU,EAAErC,OAAO,CAAC+B,KAAK,CAACN,MAAM,CAACO,SAAS,CAACC,KAAK,CAC3CC,GAAW,IAAK,IAAIC,GAAG,CAACD,GAAG,CAAC,CAACI,QAClC,CAAC;UACDC,QAAQ,EAAEvC,OAAO,CAACwB,GAAG,CAACC,MAAM,CAAC5B,IAAI;UACjC2C,kBAAkB,EAAE;YAChBC,QAAQ,EAAE,EAAE;YACZC,SAAS,EAAE,GAAG;YACdC,oBAAoB,EAAE,YAAY;YAClCC,kBAAkB,EAAE,CAAC,SAAS;UAClC;QACJ,CAAC,CACJ;QACDC,YAAY,EAAE;UACVC,cAAc,EAAE;YACZC,eAAe,EAAE;UACrB;QACJ,CAAC;QACDC,iBAAiB,EAAE;UACfC,4BAA4B,EAAE;QAClC;MACJ,CAAC;MACDC,IAAI,EAAE;QACF;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACAC,aAAa,EAAE,CAAC,SAAS;MAC7B;IACJ,CAAC,CAAC;EACN;AACJ,CAAC,CAAC","ignoreList":[]}

package/pulumi/apps/api/ApiFileManager.d.ts

@@ -0,0 +1,11 @@
+import type { PulumiAppModule } from "@webiny/pulumi";
+export type ApiFileManager = PulumiAppModule<typeof ApiFileManager>;
+interface ApiFileManagerConfig {
+    env: Record<string, any>;
+}
+export declare const ApiFileManager: import("@webiny/pulumi").PulumiAppModuleDefinition<{
+    functions: {
+        download: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda/function").Function>;
+    };
+}, ApiFileManagerConfig>;
+export {};