alchemy 0.0.8 → 0.1.1

package/src/components/aws/function.ts

@@ -0,0 +1,302 @@
+import {
+  Architecture,
+  CreateFunctionCommand,
+  DeleteFunctionCommand,
+  GetFunctionCommand,
+  GetFunctionConfigurationCommand,
+  LambdaClient,
+  ResourceNotFoundException,
+  Runtime,
+  UpdateFunctionCodeCommand,
+  UpdateFunctionConfigurationCommand,
+} from "@aws-sdk/client-lambda";
+import fs from "node:fs";
+import path from "node:path";
+import { ignore } from "../../error";
+import { Resource, type Context } from "../../resource";
+
+async function resolveRegion(client: LambdaClient): Promise<string> {
+  const region = client.config.region;
+  if (typeof region === "string") return region;
+  if (typeof region === "function") return region();
+  throw new Error("Could not resolve AWS region");
+}
+
+export interface FunctionProps {
+  functionName: string;
+  zipPath: string;
+  roleArn: string;
+  handler?: string;
+  runtime?: Runtime;
+  architecture?: Architecture;
+  description?: string;
+  timeout?: number;
+  memorySize?: number;
+  environment?: Record<string, string>;
+  tags?: Record<string, string>;
+  url?: {
+    authType?: "AWS_IAM" | "NONE";
+    cors?: {
+      allowCredentials?: boolean;
+      allowHeaders?: string[];
+      allowMethods?: string[];
+      allowOrigins?: string[];
+      exposeHeaders?: string[];
+      maxAge?: number;
+    };
+  };
+}
+
+export interface FunctionOutput extends FunctionProps {
+  id: string; // Same as functionName
+  arn: string;
+  lastModified: string;
+  version: string;
+  qualifiedArn: string; // ARN with version
+  invokeArn: string; // ARN for API Gateway
+  sourceCodeHash: string;
+  sourceCodeSize: number;
+  ephemeralStorageSize?: number;
+  architectures: string[];
+  masterArn?: string; // Only for Lambda@Edge
+  revisionId: string;
+  state?: string;
+  stateReason?: string;
+  stateReasonCode?: string;
+  lastUpdateStatus?: string;
+  lastUpdateStatusReason?: string;
+  lastUpdateStatusReasonCode?: string;
+  packageType: string;
+  signingProfileVersionArn?: string;
+  signingJobArn?: string;
+}
+
+export class Function extends Resource(
+  "lambda::Function",
+  async (ctx: Context<FunctionOutput>, props: FunctionProps) => {
+    const client = new LambdaClient({});
+    const region = await resolveRegion(client);
+
+    const code = await zipCode(props.zipPath);
+
+    if (ctx.event === "delete") {
+      await ignore(ResourceNotFoundException.name, () =>
+        client.send(
+          new DeleteFunctionCommand({
+            FunctionName: props.functionName,
+          }),
+        ),
+      );
+
+      // Return a minimal FunctionOutput for deleted state
+      return {
+        ...props,
+        id: props.functionName,
+        arn: `arn:aws:lambda:${region}:${process.env.AWS_ACCOUNT_ID}:function:${props.functionName}`,
+        lastModified: new Date().toISOString(),
+        version: "$LATEST",
+        qualifiedArn: `arn:aws:lambda:${region}:${process.env.AWS_ACCOUNT_ID}:function:${props.functionName}:$LATEST`,
+        invokeArn: `arn:aws:apigateway:${region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${region}:${process.env.AWS_ACCOUNT_ID}:function:${props.functionName}/invocations`,
+        sourceCodeHash: "",
+        sourceCodeSize: 0,
+        architectures: props.architecture
+          ? [props.architecture]
+          : [Architecture.x86_64],
+        revisionId: "",
+        state: "Inactive",
+        packageType: "Zip",
+      };
+    } else {
+      try {
+        // Check if function exists
+        const func = await client.send(
+          new GetFunctionCommand({
+            FunctionName: props.functionName,
+          }),
+        );
+
+        if (ctx.event === "update") {
+          // Wait for function to stabilize
+          await waitForFunctionStabilization(client, props.functionName);
+
+          // Update function code
+          await client.send(
+            new UpdateFunctionCodeCommand({
+              FunctionName: props.functionName,
+              ZipFile: code,
+            }),
+          );
+
+          // Wait for code update to stabilize
+          await waitForFunctionStabilization(client, props.functionName);
+
+          // Update function configuration
+          await client.send(
+            new UpdateFunctionConfigurationCommand({
+              FunctionName: props.functionName,
+              Handler: props.handler,
+              Runtime: props.runtime,
+              Role: props.roleArn,
+              Description: props.description,
+              Timeout: props.timeout,
+              MemorySize: props.memorySize,
+              Environment: props.environment
+                ? { Variables: props.environment }
+                : undefined,
+            }),
+          );
+
+          // Wait for configuration update to stabilize
+          await waitForFunctionStabilization(client, props.functionName);
+        }
+      } catch (error: any) {
+        if (error.name === "ResourceNotFoundException") {
+          // Create function if it doesn't exist
+          const startTime = Date.now();
+          let delay = 100; // Start with 100ms delay
+
+          while (true) {
+            try {
+              await client.send(
+                new CreateFunctionCommand({
+                  FunctionName: props.functionName,
+                  Code: { ZipFile: code },
+                  Handler: props.handler || "index.handler",
+                  Runtime: props.runtime || Runtime.nodejs20x,
+                  Role: props.roleArn,
+                  Description: props.description,
+                  Timeout: props.timeout || 3,
+                  MemorySize: props.memorySize || 128,
+                  Environment: props.environment
+                    ? { Variables: props.environment }
+                    : undefined,
+                  Architectures: props.architecture
+                    ? [props.architecture]
+                    : [Architecture.x86_64],
+                  Tags: props.tags,
+                }),
+              );
+              break; // Success - exit retry loop
+            } catch (createError: any) {
+              if (
+                createError.name !== "InvalidParameterValueException" ||
+                !createError.message?.includes("cannot be assumed by Lambda")
+              ) {
+                throw createError; // Different error - rethrow
+              }
+
+              if (Date.now() - startTime > 10000) {
+                throw new Error(
+                  "Timeout waiting for IAM role to be assumable by Lambda after 10s",
+                );
+              }
+
+              await new Promise((resolve) => setTimeout(resolve, delay));
+              delay = Math.min(delay * 2, 1000); // Exponential backoff capped at 1s
+            }
+          }
+
+          // Wait for function to be active
+          let isCreating = true;
+          while (isCreating) {
+            const config = await client.send(
+              new GetFunctionConfigurationCommand({
+                FunctionName: props.functionName,
+              }),
+            );
+            isCreating = config.State === "Pending";
+            if (isCreating) {
+              await new Promise((resolve) => setTimeout(resolve, 1000));
+            }
+          }
+        } else {
+          throw error;
+        }
+      }
+
+      // Get complete function details
+      const [func, config] = await Promise.all([
+        client.send(
+          new GetFunctionCommand({
+            FunctionName: props.functionName,
+          }),
+        ),
+        client.send(
+          new GetFunctionConfigurationCommand({
+            FunctionName: props.functionName,
+          }),
+        ),
+      ]);
+
+      const output: FunctionOutput = {
+        ...props,
+        id: props.functionName,
+        arn: config.FunctionArn!,
+        lastModified: config.LastModified!,
+        version: config.Version!,
+        qualifiedArn: `${config.FunctionArn}:${config.Version}`,
+        invokeArn: `arn:aws:apigateway:${region}:lambda:path/2015-03-31/functions/${config.FunctionArn}/invocations`,
+        sourceCodeHash: config.CodeSha256!,
+        sourceCodeSize: config.CodeSize!,
+        ephemeralStorageSize: config.EphemeralStorage?.Size,
+        architectures: config.Architectures || [],
+        masterArn: config.MasterArn,
+        revisionId: config.RevisionId!,
+        state: config.State,
+        stateReason: config.StateReason,
+        stateReasonCode: config.StateReasonCode,
+        lastUpdateStatus: config.LastUpdateStatus,
+        lastUpdateStatusReason: config.LastUpdateStatusReason,
+        lastUpdateStatusReasonCode: config.LastUpdateStatusReasonCode,
+        packageType: config.PackageType!,
+        signingProfileVersionArn: config.SigningProfileVersionArn,
+        signingJobArn: config.SigningJobArn,
+      };
+
+      return output;
+    }
+  },
+) {}
+
+// Helper to wait for function to stabilize
+async function waitForFunctionStabilization(
+  client: LambdaClient,
+  functionName: string,
+) {
+  while (true) {
+    const config = await client.send(
+      new GetFunctionConfigurationCommand({
+        FunctionName: functionName,
+      }),
+    );
+
+    // Check if function is in a stable state
+    if (config.State === "Active" && config.LastUpdateStatus === "Successful") {
+      break;
+    }
+
+    // If there's a failure, throw an error
+    if (config.State === "Failed" || config.LastUpdateStatus === "Failed") {
+      throw new Error(
+        `Function failed to stabilize: ${config.StateReason || config.LastUpdateStatusReason}`,
+      );
+    }
+
+    await new Promise((resolve) => setTimeout(resolve, 1000));
+  }
+}
+
+// Helper to zip the code
+async function zipCode(filePath: string): Promise<Buffer> {
+  const fileContent = await fs.promises.readFile(filePath);
+  const fileName = path.basename(filePath);
+
+  // Create a zip buffer in memory
+  const zip = new (await import("jszip")).default();
+  zip.file(fileName, fileContent);
+  return zip.generateAsync({
+    type: "nodebuffer",
+    compression: "DEFLATE",
+    platform: "UNIX",
+  });
+}

package/src/components/aws/index.ts

@@ -0,0 +1,6 @@
+export * from "./bucket";
+export * from "./function";
+export * from "./policy";
+export * from "./queue";
+export * from "./role";
+export * from "./table";

package/src/components/aws/policy.ts

@@ -0,0 +1,245 @@
+import {
+  AttachRolePolicyCommand,
+  CreatePolicyCommand,
+  CreatePolicyVersionCommand,
+  DeletePolicyCommand,
+  DeletePolicyVersionCommand,
+  DetachRolePolicyCommand,
+  GetPolicyCommand,
+  GetPolicyVersionCommand,
+  IAMClient,
+  ListPolicyVersionsCommand,
+  NoSuchEntityException,
+} from "@aws-sdk/client-iam";
+import { ignore } from "../../error";
+import { Resource } from "../../resource";
+
+// Type-safe policy document types
+export type Effect = "Allow" | "Deny";
+
+export interface PolicyStatement {
+  Sid?: string;
+  Effect: Effect;
+  Action: string | string[];
+  Resource?: string | string[];
+  Condition?: Record<string, Record<string, string | string[]>>;
+  Principal?: Record<string, string | string[]>;
+  NotPrincipal?: Record<string, string | string[]>;
+  NotAction?: string | string[];
+  NotResource?: string | string[];
+}
+
+export interface PolicyDocument {
+  Version: "2012-10-17";
+  Statement: PolicyStatement[];
+}
+
+// Policy resource
+export interface PolicyProps {
+  policyName: string;
+  document: PolicyDocument;
+  description?: string;
+  path?: string;
+  tags?: Record<string, string>;
+}
+
+export interface PolicyOutput extends PolicyProps {
+  id: string; // Same as policyName
+  arn: string;
+  defaultVersionId: string;
+  attachmentCount: number;
+  createDate: Date;
+  updateDate: Date;
+  isAttachable: boolean;
+}
+
+export class Policy extends Resource(
+  "iam::Policy",
+  async (ctx, props: PolicyProps): Promise<PolicyOutput> => {
+    const client = new IAMClient({});
+    const policyArn = `arn:aws:iam::${process.env.AWS_ACCOUNT_ID}:policy${props.path || "/"}${props.policyName}`;
+
+    if (ctx.event === "delete") {
+      try {
+        // List and delete all non-default versions first
+        const versions = await client.send(
+          new ListPolicyVersionsCommand({
+            PolicyArn: policyArn,
+          }),
+        );
+
+        for (const version of versions.Versions || []) {
+          if (!version.IsDefaultVersion) {
+            await client.send(
+              new DeletePolicyVersionCommand({
+                PolicyArn: policyArn,
+                VersionId: version.VersionId,
+              }),
+            );
+          }
+        }
+
+        // Delete the policy
+        await client.send(
+          new DeletePolicyCommand({
+            PolicyArn: policyArn,
+          }),
+        );
+      } catch (error: any) {
+        if (error.name !== NoSuchEntityException.name) {
+          throw error;
+        }
+      }
+      return {
+        ...props,
+        id: props.policyName,
+        arn: policyArn,
+        defaultVersionId: "v1",
+        attachmentCount: 0,
+        createDate: new Date(),
+        updateDate: new Date(),
+        isAttachable: true,
+      };
+    } else {
+      try {
+        // Check if policy exists
+        const existingPolicy = await client.send(
+          new GetPolicyCommand({
+            PolicyArn: policyArn,
+          }),
+        );
+
+        // Get current policy version
+        const currentVersion = await client.send(
+          new GetPolicyVersionCommand({
+            PolicyArn: policyArn,
+            VersionId: existingPolicy.Policy!.DefaultVersionId!,
+          }),
+        );
+
+        const currentDocument = JSON.parse(
+          decodeURIComponent(currentVersion.PolicyVersion!.Document!),
+        );
+
+        // If policy document changed, create new version
+        if (
+          JSON.stringify(currentDocument) !== JSON.stringify(props.document)
+        ) {
+          // List versions to check if we need to delete old ones
+          const versions = await client.send(
+            new ListPolicyVersionsCommand({
+              PolicyArn: policyArn,
+            }),
+          );
+
+          // Delete oldest version if we have 5 versions (maximum allowed)
+          if (versions.Versions?.length === 5) {
+            const oldestVersion = versions.Versions.sort(
+              (a, b) => a.CreateDate!.getTime() - b.CreateDate!.getTime(),
+            )[0];
+
+            if (!oldestVersion.IsDefaultVersion) {
+              await client.send(
+                new DeletePolicyVersionCommand({
+                  PolicyArn: policyArn,
+                  VersionId: oldestVersion.VersionId!,
+                }),
+              );
+            }
+          }
+
+          // Create new version
+          await client.send(
+            new CreatePolicyVersionCommand({
+              PolicyArn: policyArn,
+              PolicyDocument: JSON.stringify(props.document),
+              SetAsDefault: true,
+            }),
+          );
+        }
+
+        const policy = await client.send(
+          new GetPolicyCommand({
+            PolicyArn: policyArn,
+          }),
+        );
+
+        return {
+          ...props,
+          id: props.policyName,
+          arn: policy.Policy!.Arn!,
+          defaultVersionId: policy.Policy!.DefaultVersionId!,
+          attachmentCount: policy.Policy!.AttachmentCount!,
+          createDate: policy.Policy!.CreateDate!,
+          updateDate: policy.Policy!.UpdateDate!,
+          isAttachable: policy.Policy!.IsAttachable!,
+        };
+      } catch (error: any) {
+        if (error.name === "NoSuchEntity") {
+          // Create new policy
+          const newPolicy = await client.send(
+            new CreatePolicyCommand({
+              PolicyName: props.policyName,
+              PolicyDocument: JSON.stringify(props.document),
+              Description: props.description,
+              Path: props.path,
+              Tags: props.tags
+                ? Object.entries(props.tags).map(([Key, Value]) => ({
+                    Key,
+                    Value,
+                  }))
+                : undefined,
+            }),
+          );
+
+          return {
+            ...props,
+            id: props.policyName,
+            arn: newPolicy.Policy!.Arn!,
+            defaultVersionId: newPolicy.Policy!.DefaultVersionId!,
+            attachmentCount: newPolicy.Policy!.AttachmentCount!,
+            createDate: newPolicy.Policy!.CreateDate!,
+            updateDate: newPolicy.Policy!.UpdateDate!,
+            isAttachable: newPolicy.Policy!.IsAttachable!,
+          };
+        }
+        throw error;
+      }
+    }
+  },
+) {}
+
+// PolicyAttachment resource
+export interface PolicyAttachmentProps {
+  policyArn: string;
+  roleName: string;
+}
+
+export interface PolicyAttachmentOutput extends PolicyAttachmentProps {}
+
+export class PolicyAttachment extends Resource(
+  "iam::PolicyAttachment",
+  async (ctx, props: PolicyAttachmentProps) => {
+    const client = new IAMClient({});
+
+    if (ctx.event === "delete") {
+      await ignore(NoSuchEntityException.name, () =>
+        client.send(
+          new DetachRolePolicyCommand({
+            PolicyArn: props.policyArn,
+            RoleName: props.roleName,
+          }),
+        ),
+      );
+    } else {
+      await client.send(
+        new AttachRolePolicyCommand({
+          PolicyArn: props.policyArn,
+          RoleName: props.roleName,
+        }),
+      );
+    }
+
+    return props;
+  },
+) {}