alchemy 0.1.12 → 0.1.14

package/src/$.ts

@@ -0,0 +1,69 @@
+import type { Input } from "./input";
+import { type Output, OutputChain } from "./output";
+import { getScope } from "./scope";
+
+export type $<T> = T extends
+  | undefined
+  | null
+  | boolean
+  | number
+  | string
+  | symbol
+  | bigint
+  ? Input<T>
+  : T extends (...args: infer Args extends any[]) => infer R
+    ? (
+        ...args: {
+          [i in keyof Args]: $<Args[i]>;
+        }
+      ) => Output<Awaited<R>>
+    : T extends any[]
+      ? $array<T>
+      : $object<T>;
+
+type $object<T> = {
+  [i in keyof T]: $<T[i]>;
+};
+type $array<T extends any[]> = T extends [infer First, ...infer Rest]
+  ? [$<First>, ...$object<Rest>]
+  : [];
+
+export function $<T>(value: T): $<T> {
+  return new Proxy(() => {}, {
+    apply: (_: T, thisArg, args) => {
+      const target = value as (...args: any[]) => any;
+      let argsOutput: Output<any[]> | undefined;
+      for (const arg of args) {
+        if (arg instanceof OutputChain) {
+          if (argsOutput) {
+            argsOutput = arg.apply((arg) =>
+              argsOutput!.apply((...args) => [...args, arg]),
+            );
+          } else {
+            argsOutput = arg.apply((arg) => [arg]);
+          }
+        } else {
+          if (argsOutput) {
+            argsOutput = argsOutput.apply((args) => [...args, arg]);
+          } else {
+            argsOutput = new OutputChain({} as any, () => [arg]);
+          }
+        }
+      }
+
+      const scope = getScope();
+      const output = argsOutput
+        ? argsOutput.apply((args) => target(...args))
+        : new OutputChain({} as any, () => target());
+      scope.callbacks.push(output);
+      return $(output);
+    },
+    get: (_: any, prop) => {
+      const target = value as any;
+      if (target instanceof OutputChain) {
+        return $(target.apply((t) => t[prop]));
+      }
+      return $(target[prop]);
+    },
+  });
+}

package/src/alchemize.ts

@@ -51,6 +51,7 @@ export async function alchemize(options?: AlchemizeOptions) {
   const stateStore = new (options?.stateStore ?? defaultStateStore)(
     scope.getScopePath(stage),
   );
+  const callbacks = scope.callbacks;
 
   if (nodes.size > 0) {
     await stateStore.init?.();
@@ -81,6 +82,17 @@ export async function alchemize(options?: AlchemizeOptions) {
     if (options?.destroyOrphans === false) {
       return;
     }
+
+    await Promise.all(
+      callbacks.map((callback) =>
+        evaluate(callback, {
+          stage,
+          scope,
+          stateStore,
+          quiet: options?.quiet,
+        }),
+      ),
+    );
   }
   const aliveIDs = new Set(
     mode === "up"

package/src/apply.ts

@@ -1,5 +1,5 @@
 import { defaultStage, defaultStateStore } from "./global";
-import { type Output, OutputChain, type Resolve } from "./output";
+import { type Output, OutputChain, type Resolved } from "./output";
 import {
   Input,
   Provider,
@@ -25,7 +25,7 @@ export interface ApplyOptions {
 export async function apply<T>(
   output: T,
   options?: Partial<ApplyOptions>,
-): Promise<Resolve<T>> {
+): Promise<Resolved<T>> {
   const stage = options?.stage ?? defaultStage;
   const scope = options?.scope ?? getScope();
   const statePath = scope.getScopePath(stage);
@@ -33,7 +33,7 @@ export async function apply<T>(
 
   return (
     await evaluate(output, { stage, scope, stateStore, quiet: options?.quiet })
-  ).value as Resolve<T>;
+  ).value as Resolved<T>;
 }
 
 class Evaluated<T> {
@@ -83,7 +83,7 @@ export async function evaluate<T>(
       );
       resolve!(new Evaluated(result, [resourceID, ...deps]));
     } catch (error) {
-      console.error(error);
+      // console.error(error);
       reject!(error);
     }
     return promise;

package/src/aws/account-id.ts

@@ -0,0 +1,11 @@
+import { GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
+
+const sts = new STSClient({});
+
+/**
+ * Helper to get the current AWS account ID
+ */
+export async function getAccountId(): Promise<string> {
+  const identity = await sts.send(new GetCallerIdentityCommand({}));
+  return identity.Account!;
+}

package/src/aws/index.ts

@@ -1,3 +1,4 @@
+export * from "./account-id";
 export * from "./bucket";
 export * from "./function";
 export * from "./policy";

package/src/aws/oidc/github-oidc-provider.ts

@@ -0,0 +1,34 @@
+import type { Input } from "../../input";
+import { isOutput } from "../../output";
+import { OIDCProvider, type OIDCProviderProps } from "./oidc-provider";
+
+/**
+ * Default thumbprint for GitHub's OIDC provider
+ * This is the certificate thumbprint that GitHub uses to sign OIDC tokens
+ * @see https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#adding-the-identity-provider-to-aws
+ */
+const DEFAULT_GITHUB_THUMBPRINT = "6938fd4d98bab03faadb97b34396831e3780aea1";
+
+export interface GitHubOIDCProviderProps
+  extends Omit<OIDCProviderProps, "thumbprint"> {
+  owner: string;
+  repository: string;
+  thumbprint?: string;
+}
+
+export class GitHubOIDCProvider extends OIDCProvider {
+  constructor(id: string, props: Input<GitHubOIDCProviderProps>) {
+    super(
+      id,
+      isOutput<GitHubOIDCProviderProps>(props)
+        ? props.apply((props) => ({
+            ...props,
+            thumbprint: props.thumbprint ?? DEFAULT_GITHUB_THUMBPRINT,
+          }))
+        : ({
+            ...props,
+            thumbprint: props.thumbprint ?? DEFAULT_GITHUB_THUMBPRINT,
+          } as Input<OIDCProviderProps>),
+    );
+  }
+}

package/src/aws/oidc/index.ts

@@ -0,0 +1,2 @@
+export * from "./github-oidc-provider";
+export * from "./oidc-provider";

package/src/aws/oidc/oidc-provider.ts

@@ -0,0 +1,253 @@
+import {
+  CreateOpenIDConnectProviderCommand,
+  DeleteOpenIDConnectProviderCommand,
+  GetOpenIDConnectProviderCommand,
+  GetRoleCommand,
+  IAMClient,
+  type Tag,
+  UpdateAssumeRolePolicyCommand,
+} from "@aws-sdk/client-iam";
+import { type Context, Resource } from "../../resource";
+import { getAccountId } from "../account-id";
+
+/**
+ * Properties for configuring an AWS OIDC provider for GitHub Actions
+ */
+export interface OIDCProviderProps {
+  /**
+   * The GitHub organization or user that owns the repository
+   */
+  owner: string;
+
+  /**
+   * The name of the GitHub repository
+   */
+  repository: string;
+
+  /**
+   * Optional list of branches to restrict access to
+   * If not provided, all branches will be allowed
+   */
+  branches?: string[];
+
+  /**
+   * Optional list of environments to restrict access to
+   * If not provided, all environments will be allowed
+   */
+  environments?: string[];
+
+  /**
+   * The ARN of the IAM role to be assumed
+   */
+  roleArn: string;
+
+  /**
+   * Optional maximum session duration in seconds (default: 3600)
+   */
+  maxSessionDuration?: number;
+
+  /**
+   * Thumbprint for the OIDC provider
+   */
+  thumbprint: string;
+
+  /**
+   * Optional AWS region (defaults to AWS_REGION environment variable)
+   */
+  region?: string;
+}
+
+/**
+ * Output returned after OIDC provider configuration
+ */
+export interface OIDCProviderOutput extends OIDCProviderProps {
+  /**
+   * The ARN of the OIDC provider
+   */
+  providerArn: string;
+
+  /**
+   * Time at which the provider was created
+   */
+  createdAt: number;
+}
+
+/**
+ * Unique identifier for our trust policy statement
+ * Used to track and remove our specific statement without affecting others
+ */
+const TRUST_POLICY_SID = "GitHubOIDCTrust";
+
+/**
+ * Resource for configuring AWS OIDC provider for GitHub Actions
+ */
+export class OIDCProvider extends Resource(
+  "aws::OIDCProvider",
+  async (ctx: Context<OIDCProviderOutput>, props: OIDCProviderProps) => {
+    // Initialize AWS SDK client
+    const client = new IAMClient({
+      region: props.region,
+    });
+
+    if (ctx.event === "delete") {
+      if (ctx.output?.providerArn) {
+        try {
+          // First, remove our trust policy statement from the role
+          const getRole = await client.send(
+            new GetRoleCommand({
+              RoleName: props.roleArn.split("/").pop(),
+            }),
+          );
+
+          if (getRole.Role?.AssumeRolePolicyDocument) {
+            const policy = JSON.parse(
+              decodeURIComponent(getRole.Role.AssumeRolePolicyDocument),
+            );
+
+            // Remove our specific statement while preserving others
+            policy.Statement = policy.Statement.filter(
+              (stmt: any) => stmt.Sid !== TRUST_POLICY_SID,
+            );
+
+            await client.send(
+              new UpdateAssumeRolePolicyCommand({
+                RoleName: props.roleArn.split("/").pop(),
+                PolicyDocument: JSON.stringify(policy),
+              }),
+            );
+          }
+
+          // Then delete the OIDC provider if we're the last user
+          const provider = await client.send(
+            new GetOpenIDConnectProviderCommand({
+              OpenIDConnectProviderArn: ctx.output.providerArn,
+            }),
+          );
+
+          // Only delete the provider if it exists and has no other tags
+          if (provider && (!provider.Tags || provider.Tags.length === 0)) {
+            await client.send(
+              new DeleteOpenIDConnectProviderCommand({
+                OpenIDConnectProviderArn: ctx.output.providerArn,
+              }),
+            );
+          }
+        } catch (error) {
+          // Log but don't throw on cleanup errors
+          console.error("Error during cleanup:", error);
+        }
+      }
+      return;
+    }
+
+    try {
+      const url = "https://token.actions.githubusercontent.com";
+      const thumbprint = props.thumbprint;
+
+      // Create or get existing OIDC provider
+      let providerArn: string;
+      try {
+        const createProvider = await client.send(
+          new CreateOpenIDConnectProviderCommand({
+            Url: url,
+            ClientIDList: ["sts.amazonaws.com"],
+            ThumbprintList: [thumbprint],
+            Tags: [
+              {
+                Key: "ManagedBy",
+                Value: "alchemy",
+              },
+            ] as Tag[],
+          }),
+        );
+        providerArn = createProvider.OpenIDConnectProviderArn!;
+      } catch (error: any) {
+        if (error.name === "EntityAlreadyExistsException") {
+          // Provider exists, use its ARN
+          providerArn = `arn:aws:iam::${await getAccountId()}:oidc-provider/${url}`;
+        } else {
+          throw error;
+        }
+      }
+
+      // Get current role policy
+      const getRole = await client.send(
+        new GetRoleCommand({
+          RoleName: props.roleArn.split("/").pop(),
+        }),
+      );
+
+      let policy: any;
+      if (getRole.Role?.AssumeRolePolicyDocument) {
+        policy = JSON.parse(
+          decodeURIComponent(getRole.Role.AssumeRolePolicyDocument),
+        );
+      } else {
+        policy = {
+          Version: "2012-10-17",
+          Statement: [],
+        };
+      }
+
+      // Construct the trust policy conditions
+      const conditions: Record<string, any> = {
+        StringEquals: {
+          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
+          "token.actions.githubusercontent.com:sub": `repo:${props.owner}/${props.repository}:`,
+        },
+      };
+
+      if (props.branches?.length) {
+        conditions.StringEquals["token.actions.githubusercontent.com:sub"] =
+          props.branches.map(
+            (branch) =>
+              `repo:${props.owner}/${props.repository}:ref:refs/heads/${branch}`,
+          );
+      }
+
+      if (props.environments?.length) {
+        conditions.StringEquals["token.actions.githubusercontent.com:sub"] =
+          props.environments.map(
+            (env) =>
+              `repo:${props.owner}/${props.repository}:environment:${env}`,
+          );
+      }
+
+      // Create our policy statement
+      const ourStatement = {
+        Sid: TRUST_POLICY_SID,
+        Effect: "Allow",
+        Principal: {
+          Federated: providerArn,
+        },
+        Action: "sts:AssumeRoleWithWebIdentity",
+        Condition: conditions,
+      };
+
+      // Remove any existing statement with our SID and add the new one
+      policy.Statement = [
+        ...policy.Statement.filter(
+          (stmt: any) => stmt.Sid !== TRUST_POLICY_SID,
+        ),
+        ourStatement,
+      ];
+
+      // Update the role's trust policy
+      await client.send(
+        new UpdateAssumeRolePolicyCommand({
+          RoleName: props.roleArn.split("/").pop(),
+          PolicyDocument: JSON.stringify(policy),
+        }),
+      );
+
+      return {
+        ...props,
+        providerArn,
+        createdAt: Date.now(),
+      };
+    } catch (error) {
+      console.error("Error configuring OIDC provider:", error);
+      throw error;
+    }
+  },
+) {}

package/src/aws/queue.ts

@@ -8,14 +8,30 @@ import {
 import { Resource } from "../resource";
 
 export interface QueueProps {
+  /**
+   * Name of the queue
+   * For FIFO queues, the name must end with the .fifo suffix
+   */
   queueName: string;
+
+  /**
+   * Whether this is a FIFO queue.
+   * If true, the queueName must end with .fifo suffix
+   */
   fifo?: boolean;
+
   visibilityTimeout?: number;
   messageRetentionPeriod?: number;
   maximumMessageSize?: number;
   delaySeconds?: number;
   receiveMessageWaitTimeSeconds?: number;
+
+  /**
+   * Enables content-based deduplication for FIFO queues.
+   * Only applicable when fifo is true.
+   */
   contentBasedDeduplication?: boolean;
+
   deduplicationScope?: "messageGroup" | "queue";
   fifoThroughputLimit?: "perQueue" | "perMessageGroupId";
   tags?: Record<string, string>;
@@ -31,7 +47,13 @@ export class Queue extends Resource(
   "sqs::Queue",
   async (ctx, props: QueueProps) => {
     const client = new SQSClient({});
-    const queueName = props.fifo ? `${props.queueName}.fifo` : props.queueName;
+    // Don't automatically add .fifo suffix - user must include it in queueName
+    const queueName = props.queueName;
+
+    // Validate that FIFO queues have .fifo suffix
+    if (props.fifo && !queueName.endsWith(".fifo")) {
+      throw new Error("FIFO queue names must end with .fifo suffix");
+    }
 
     if (ctx.event === "delete") {
       try {

package/src/aws/role.ts

@@ -1,10 +1,13 @@
 import {
+  AttachRolePolicyCommand,
   CreateRoleCommand,
   DeleteRoleCommand,
   DeleteRolePolicyCommand,
+  DetachRolePolicyCommand,
   EntityAlreadyExistsException,
   GetRoleCommand,
   IAMClient,
+  ListAttachedRolePoliciesCommand,
   NoSuchEntityException,
   PutRolePolicyCommand,
   type Tag,
@@ -59,6 +62,32 @@ export class Role extends Resource(
         }
       }
 
+      // We need to detach managed policies before deleting the role
+      // First, get all attached policies
+      try {
+        const attachedPoliciesResponse = await client.send(
+          new ListAttachedRolePoliciesCommand({
+            RoleName: props.roleName,
+          }),
+        );
+
+        // Detach all managed policies
+        const attachedPolicies =
+          attachedPoliciesResponse.AttachedPolicies || [];
+        for (const policy of attachedPolicies) {
+          await client.send(
+            new DetachRolePolicyCommand({
+              RoleName: props.roleName,
+              PolicyArn: policy.PolicyArn!,
+            }),
+          );
+        }
+      } catch (error: any) {
+        if (error.name !== NoSuchEntityException.name) {
+          throw error;
+        }
+      }
+
       await ignore(NoSuchEntityException.name, () =>
         client.send(
           new DeleteRoleCommand({
@@ -229,6 +258,46 @@ export class Role extends Resource(
       }
     }
 
+    // Handle managed policy attachments
+    // Get currently attached policies
+    const attachedPoliciesResponse = await client.send(
+      new ListAttachedRolePoliciesCommand({
+        RoleName: props.roleName,
+      }),
+    );
+
+    const currentAttachedPolicies =
+      attachedPoliciesResponse.AttachedPolicies || [];
+    const currentPolicyArns = currentAttachedPolicies.map((p) => p.PolicyArn!);
+
+    // If we're updating, use an empty array as default when managedPolicyArns is undefined
+    // to ensure we detach all managed policies
+    const desiredPolicyArns = props.managedPolicyArns || [];
+
+    // Detach policies that are no longer needed
+    for (const policyArn of currentPolicyArns) {
+      if (!desiredPolicyArns.includes(policyArn)) {
+        await client.send(
+          new DetachRolePolicyCommand({
+            RoleName: props.roleName,
+            PolicyArn: policyArn,
+          }),
+        );
+      }
+    }
+
+    // Attach new policies that weren't attached before
+    for (const policyArn of desiredPolicyArns) {
+      if (!currentPolicyArns.includes(policyArn)) {
+        await client.send(
+          new AttachRolePolicyCommand({
+            RoleName: props.roleName,
+            PolicyArn: policyArn,
+          }),
+        );
+      }
+    }
+
     if (!role?.Role) {
       throw new Error(`Failed to create or update role ${props.roleName}`);
     }