alchemy 0.3.1 → 0.4.0

package/src/aws/role.ts

@@ -219,58 +219,72 @@ export const Role = Resource(
   async function (
     this: Context<Role>,
     id: string,
-    props: RoleProps,
+    props: RoleProps
   ): Promise<Role> {
     const client = new IAMClient({});
 
     if (this.phase === "delete") {
-      // Delete any inline policies first
-      if (props.policies) {
-        for (const policy of props.policies) {
-          await ignore(NoSuchEntityException.name, () =>
-            client.send(
-              new DeleteRolePolicyCommand({
-                RoleName: props.roleName,
-                PolicyName: policy.policyName,
-              }),
-            ),
-          );
-        }
-      }
-
-      // We need to detach managed policies before deleting the role
-      // First, get all attached policies
       try {
-        const attachedPoliciesResponse = await client.send(
-          new ListAttachedRolePoliciesCommand({
-            RoleName: props.roleName,
-          }),
-        );
+        // Delete any inline policies first
+        if (props.policies) {
+          for (const policy of props.policies) {
+            await ignore(NoSuchEntityException.name, () =>
+              client.send(
+                new DeleteRolePolicyCommand({
+                  RoleName: props.roleName,
+                  PolicyName: policy.policyName,
+                })
+              )
+            );
+          }
+        }
 
-        // Detach all managed policies
-        const attachedPolicies =
-          attachedPoliciesResponse.AttachedPolicies || [];
-        for (const policy of attachedPolicies) {
-          await client.send(
-            new DetachRolePolicyCommand({
+        // We need to detach managed policies before deleting the role
+        // First, get all attached policies
+        try {
+          const attachedPoliciesResponse = await client.send(
+            new ListAttachedRolePoliciesCommand({
               RoleName: props.roleName,
-              PolicyArn: policy.PolicyArn!,
-            }),
+            })
           );
+
+          // Detach all managed policies
+          const attachedPolicies =
+            attachedPoliciesResponse.AttachedPolicies || [];
+          for (const policy of attachedPolicies) {
+            await ignore(NoSuchEntityException.name, () =>
+              client.send(
+                new DetachRolePolicyCommand({
+                  RoleName: props.roleName,
+                  PolicyArn: policy.PolicyArn!,
+                })
+              )
+            );
+          }
+        } catch (error: any) {
+          if (error.name !== NoSuchEntityException.name) {
+            throw error;
+          }
+          // Role doesn't exist, no need to continue with detaching policies
         }
+
+        // Try to delete the role, ignoring if it doesn't exist
+        await ignore(NoSuchEntityException.name, () =>
+          client.send(
+            new DeleteRoleCommand({
+              RoleName: props.roleName,
+            })
+          )
+        );
       } catch (error: any) {
+        // If we get any other error besides NoSuchEntityException, log it but don't fail
+        // This ensures the resource is still marked as destroyed
         if (error.name !== NoSuchEntityException.name) {
-          throw error;
+          console.error(`Error deleting role ${props.roleName}:`, error);
         }
       }
 
-      await ignore(NoSuchEntityException.name, () =>
-        client.send(
-          new DeleteRoleCommand({
-            RoleName: props.roleName,
-          }),
-        ),
-      );
+      // Always return destroyed state regardless of any errors
       return this.destroy();
     }
 
@@ -302,7 +316,7 @@ export const Role = Resource(
                 Value: this.id,
               },
             ],
-          }),
+          })
         );
       }
     } catch (error: any) {
@@ -314,7 +328,7 @@ export const Role = Resource(
         const existingRole = await client.send(
           new GetRoleCommand({
             RoleName: props.roleName,
-          }),
+          })
         );
         const roleTags =
           existingRole.Role?.Tags?.reduce(
@@ -322,7 +336,7 @@ export const Role = Resource(
               acc[tag.Key!] = tag.Value!;
               return acc;
             },
-            {} as Record<string, string>,
+            {} as Record<string, string>
           ) || {};
 
         if (
@@ -340,7 +354,7 @@ export const Role = Resource(
     role = await client.send(
       new GetRoleCommand({
         RoleName: props.roleName,
-      }),
+      })
     );
 
     // Update assume role policy if it changed
@@ -349,7 +363,7 @@ export const Role = Resource(
         new UpdateAssumeRolePolicyCommand({
           RoleName: props.roleName,
           PolicyDocument: assumeRolePolicyDocument,
-        }),
+        })
       );
     }
 
@@ -363,7 +377,7 @@ export const Role = Resource(
           RoleName: props.roleName,
           Description: props.description,
           MaxSessionDuration: props.maxSessionDuration,
-        }),
+        })
       );
     }
 
@@ -381,7 +395,7 @@ export const Role = Resource(
       new TagRoleCommand({
         RoleName: props.roleName,
         Tags: tags,
-      }),
+      })
     );
 
     // Handle policy changes
@@ -393,7 +407,7 @@ export const Role = Resource(
     for (const oldPolicy of previousPolicies) {
       if (
         !currentPolicies.some(
-          (p: { policyName: string }) => p.policyName === oldPolicy.policyName,
+          (p: { policyName: string }) => p.policyName === oldPolicy.policyName
         )
       ) {
         await ignore(NoSuchEntityException.name, () =>
@@ -401,8 +415,8 @@ export const Role = Resource(
             new DeleteRolePolicyCommand({
               RoleName: props.roleName,
               PolicyName: oldPolicy.policyName,
-            }),
-          ),
+            })
+          )
         );
       }
     }
@@ -410,7 +424,7 @@ export const Role = Resource(
     // Update or create policies
     for (const policy of currentPolicies) {
       const oldPolicy = previousPolicies.find(
-        (p) => p.policyName === policy.policyName,
+        (p) => p.policyName === policy.policyName
       );
       if (
         !oldPolicy ||
@@ -422,7 +436,7 @@ export const Role = Resource(
             RoleName: props.roleName,
             PolicyName: policy.policyName,
             PolicyDocument: JSON.stringify(policy.policyDocument),
-          }),
+          })
         );
       }
     }
@@ -432,7 +446,7 @@ export const Role = Resource(
     const attachedPoliciesResponse = await client.send(
       new ListAttachedRolePoliciesCommand({
         RoleName: props.roleName,
-      }),
+      })
     );
 
     const currentAttachedPolicies =
@@ -450,7 +464,7 @@ export const Role = Resource(
           new DetachRolePolicyCommand({
             RoleName: props.roleName,
             PolicyArn: policyArn,
-          }),
+          })
         );
       }
     }
@@ -462,7 +476,7 @@ export const Role = Resource(
           new AttachRolePolicyCommand({
             RoleName: props.roleName,
             PolicyArn: policyArn,
-          }),
+          })
         );
       }
     }
@@ -479,5 +493,5 @@ export const Role = Resource(
       roleName: role.Role.RoleName ?? props.roleName,
       createDate: role.Role.CreateDate!,
     });
-  },
+  }
 );

package/src/cloudflare/account-api-token.ts

@@ -0,0 +1,365 @@
+import { alchemy } from "../alchemy";
+import type { Context } from "../context";
+import { Resource } from "../resource";
+import { Secret } from "../secret";
+import { sha256 } from "../util/sha256";
+import { createCloudflareApi } from "./api";
+
+/**
+ * Permission group for a token policy
+ */
+export interface TokenPolicyPermissionGroup {
+  /**
+   * ID of the permission group
+   */
+  id: string;
+
+  /**
+   * Optional metadata for the permission group
+   */
+  meta?: Record<string, any>;
+}
+
+/**
+ * Policy that defines what the token can access
+ */
+export interface TokenPolicy {
+  /**
+   * Effect of the policy
+   */
+  effect: "allow" | "deny";
+
+  /**
+   * Permission groups to include in the policy
+   */
+  permissionGroups: TokenPolicyPermissionGroup[];
+
+  /**
+   * Resources the policy applies to
+   */
+  resources: Record<string, string>;
+}
+
+/**
+ * Condition for token usage (e.g., IP restrictions)
+ */
+export interface TokenCondition {
+  /**
+   * IP address conditions
+   */
+  requestIp?: {
+    /**
+     * IP ranges to allow
+     */
+    in?: string[];
+
+    /**
+     * IP ranges to deny
+     */
+    notIn?: string[];
+  };
+}
+
+/**
+ * Properties for creating or updating an Account API Token
+ */
+export interface AccountApiTokenProps {
+  /**
+   * Name of the token
+   */
+  name: string;
+
+  /**
+   * Policies that define what the token can access
+   */
+  policies: TokenPolicy[];
+
+  /**
+   * Optional expiration date for the token (ISO format)
+   */
+  expiresOn?: string;
+
+  /**
+   * Optional "not before" date (token is not valid before this date) (ISO format)
+   */
+  notBefore?: string;
+
+  /**
+   * Optional conditions for token use (like IP restrictions)
+   */
+  condition?: TokenCondition;
+}
+
+/**
+ * Cloudflare API token format as returned by the API
+ */
+interface CloudflareApiToken {
+  id: string;
+  name: string;
+  status: string;
+  policies: {
+    effect: "allow" | "deny";
+    permission_groups: {
+      id: string;
+      meta: Record<string, any>;
+    }[];
+    resources: Record<string, string>;
+  }[];
+  expires_on?: string;
+  not_before?: string;
+  condition?: {
+    request_ip?: {
+      in?: string[];
+      not_in?: string[];
+    };
+  };
+  value?: string;
+}
+
+/**
+ * Output returned after Account API Token creation/update
+ */
+export interface AccountApiToken
+  extends Resource<"cloudflare::AccountApiToken">,
+    AccountApiTokenProps {
+  /**
+   * The ID of the token
+   *
+   * Equiv. to ACCESS_KEY_ID
+   */
+  id: string;
+
+  /**
+   * Status of the token
+   */
+  status: string;
+
+  /**
+   * Actual token value (only available on creation)
+   * Stored as a Secret for security
+   *
+   * Equiv. to SECRET_ACCESS_KEY
+   */
+  value?: Secret;
+
+  /**
+   * Access key ID for the token
+   *
+   * An alias of {@link id}
+   */
+  accessKeyId: string;
+
+  /**
+   * Secret access key for the token
+   *
+   * The SHA-256 hash of the token {@link value}
+   *
+   * @see https://developers.cloudflare.com/r2/api/tokens/#get-s3-api-credentials-from-an-api-token
+   */
+  secretAccessKey: string;
+}
+
+/**
+ * Creates a Cloudflare Account API Token with specified permissions.
+ *
+ * @see https://developers.cloudflare.com/api/resources/accounts/subresources/tokens/methods/create/
+ *
+ * @example
+ * // First, fetch all permission groups
+ * const permissions = await PermissionGroups("cloudflare-permissions", {
+ *   accountId: cfAccountId,
+ * });
+ *
+ * // Create a token with read-only permissions for specific zones
+ * const readOnlyToken = await AccountApiToken("readonly-token", {
+ *   name: "Readonly Zone Token",
+ *   policies: [
+ *     {
+ *       effect: "allow",
+ *       permissionGroups: [
+ *         { id: permissions["Zone Read"].id },
+ *         { id: permissions["Analytics Read"].id }
+ *       ],
+ *       resources: {
+ *         "com.cloudflare.api.account.zone.22b1de5f1c0e4b3ea97bb1e963b06a43": "*",
+ *         "com.cloudflare.api.account.zone.eb78d65290b24279ba6f44721b3ea3c4": "*"
+ *       }
+ *     }
+ *   ],
+ *   expiresOn: "2024-12-31T23:59:59Z"
+ * });
+ *
+ * @example
+ * // Create a token with time and IP restrictions
+ * const restrictedToken = await AccountApiToken("restricted-token", {
+ *   name: "Restricted Access Token",
+ *   policies: [
+ *     {
+ *       effect: "allow",
+ *       permissionGroups: [
+ *         { id: permissions["Worker Routes Edit"].id }
+ *       ],
+ *       resources: {
+ *         "com.cloudflare.api.account.worker.route.*": "*"
+ *       }
+ *     }
+ *   ],
+ *   notBefore: "2023-01-01T00:00:00Z",
+ *   expiresOn: "2023-12-31T23:59:59Z",
+ *   condition: {
+ *     requestIp: {
+ *       in: ["192.168.1.0/24", "10.0.0.0/8"],
+ *       notIn: ["192.168.1.100/32"]
+ *     }
+ *   }
+ * });
+ */
+export const AccountApiToken = Resource(
+  "cloudflare::AccountApiToken",
+  async function (
+    this: Context<AccountApiToken>,
+    id: string,
+    props: AccountApiTokenProps
+  ): Promise<AccountApiToken> {
+    // Create Cloudflare API client with automatic account discovery
+    const api = await createCloudflareApi();
+
+    if (this.phase === "delete") {
+      // Delete token if we have an ID
+      if (this.output?.id) {
+        try {
+          const deleteResponse = await api.delete(
+            `/accounts/${api.accountId}/tokens/${this.output.id}`
+          );
+
+          if (!deleteResponse.ok && deleteResponse.status !== 404) {
+            const errorData: any = await deleteResponse.json().catch(() => ({
+              errors: [{ message: deleteResponse.statusText }],
+            }));
+            console.error(`Error deleting token '${props.name}':`, errorData);
+          }
+        } catch (error) {
+          console.error(`Error deleting token '${props.name}':`, error);
+        }
+      }
+
+      // Return destroyed state
+      return this.destroy();
+    }
+
+    // Transform our properties to API format
+    const apiPayload = {
+      name: props.name,
+      policies: props.policies.map((policy) => ({
+        effect: policy.effect,
+        permission_groups: policy.permissionGroups.map((pg) => ({
+          id: pg.id,
+          meta: pg.meta || {},
+        })),
+        resources: policy.resources,
+      })),
+      // Format dates for Cloudflare API (removing milliseconds)
+      ...(props.expiresOn
+        ? { expires_on: formatCloudflareDate(props.expiresOn) }
+        : {}),
+      ...(props.notBefore
+        ? { not_before: formatCloudflareDate(props.notBefore) }
+        : {}),
+      ...(props.condition
+        ? {
+            condition: {
+              request_ip: props.condition.requestIp
+                ? {
+                    in: props.condition.requestIp.in || [],
+                    not_in: props.condition.requestIp.notIn || [],
+                  }
+                : undefined,
+            },
+          }
+        : {}),
+    };
+
+    /**
+     * Formats a date string for Cloudflare API by removing milliseconds
+     * Converts from "2023-01-01T00:00:00.000Z" to "2023-01-01T00:00:00Z"
+     */
+    function formatCloudflareDate(dateStr: string): string {
+      return dateStr.replace(/\.\d{3}Z$/, "Z");
+    }
+
+    let response;
+    let tokenValue;
+
+    if (this.phase === "update" && this.output?.id) {
+      // Update existing token
+      response = await api.put(
+        `/accounts/${api.accountId}/tokens/${this.output.id}`,
+        apiPayload
+      );
+    } else {
+      // Create new token
+      response = await api.post(
+        `/accounts/${api.accountId}/tokens`,
+        apiPayload
+      );
+    }
+
+    if (!response.ok) {
+      const errorData: any = await response.json().catch(() => ({
+        errors: [{ message: response.statusText }],
+      }));
+
+      throw new Error(
+        `Error ${this.phase === "update" ? "updating" : "creating"} token '${props.name}': ${
+          errorData.errors?.[0]?.message || response.statusText
+        }`
+      );
+    }
+
+    const result: { result: CloudflareApiToken } = await response.json();
+    const tokenData = result.result;
+
+    if (tokenData.value) {
+      tokenValue = alchemy.secret(tokenData.value);
+    } else {
+      if (!this.output?.value) {
+        throw new Error(
+          `Token '${props.name}' was created but we have no record of its value. Try deleting and recreating the token.`
+        );
+      }
+      tokenValue = this.output?.value;
+    }
+
+    // Transform API response to our format
+    return this({
+      id: tokenData.id,
+      name: tokenData.name,
+      status: tokenData.status,
+      policies: tokenData.policies.map((policy) => ({
+        effect: policy.effect,
+        permissionGroups: policy.permission_groups.map((pg) => ({
+          id: pg.id,
+          meta: pg.meta,
+        })),
+        resources: policy.resources,
+      })),
+      ...(tokenData.expires_on ? { expiresOn: tokenData.expires_on } : {}),
+      ...(tokenData.not_before ? { notBefore: tokenData.not_before } : {}),
+      ...(tokenData.condition
+        ? {
+            condition: {
+              requestIp: tokenData.condition.request_ip
+                ? {
+                    in: tokenData.condition.request_ip.in || [],
+                    notIn: tokenData.condition.request_ip.not_in || [],
+                  }
+                : undefined,
+            },
+          }
+        : {}),
+      value: tokenValue,
+      accessKeyId: tokenData.id,
+      secretAccessKey: sha256(tokenValue.unencrypted),
+    });
+  }
+);