alchemy 0.66.0 → 0.68.0

package/src/auth.ts

@@ -0,0 +1,253 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { Lock } from "./util/lock.ts";
+import { singleFlight } from "./util/memoize.ts";
+
+namespace Path {
+  export const rootDir = path.join(os.homedir(), ".alchemy");
+  export const configFile = path.join(rootDir, "config.json");
+  export const credentialsDir = path.join(rootDir, "credentials");
+  export const credentialsFile = (provider: string, profile: string) =>
+    path.join(credentialsDir, profile, `${provider}.json`);
+}
+
+interface Props {
+  profile: string;
+  provider: string;
+}
+
+interface Config {
+  version: 1;
+  profiles: {
+    [profile: string]: Profile;
+  };
+}
+
+namespace Config {
+  export const read = async () => {
+    const config = await FS.readJSON<Config>(Path.configFile);
+    return config ?? { version: 1, profiles: {} };
+  };
+
+  export const patch = async (updater: (config: Config) => Config) => {
+    const config = await read();
+    const updated = updater(config);
+    await FS.writeJSON<Config>(Path.configFile, updated);
+  };
+}
+
+export interface Profile {
+  [provider: string]: Provider;
+}
+
+export namespace Profile {
+  export const get = async (name: string): Promise<Profile | undefined> => {
+    const config = await Config.read();
+    return config.profiles[name];
+  };
+}
+
+export interface Provider<
+  Metadata extends Record<string, string> = Record<string, string>,
+> {
+  metadata: Metadata;
+  method: "api-key" | "api-token" | "oauth";
+  scopes?: string[];
+}
+
+export namespace Provider {
+  export const get = async <
+    Metadata extends Record<string, string> = Record<string, string>,
+  >(
+    props: Props,
+  ) => {
+    const profile = await Profile.get(props.profile);
+    return profile?.[props.provider] as Provider<Metadata> | undefined;
+  };
+
+  export const getWithCredentials = async <
+    Metadata extends Record<string, string> = Record<string, string>,
+  >(
+    props: Props,
+  ) => {
+    const [provider, credentials] = await Promise.all([
+      Provider.get<Metadata>(props),
+      Credentials.get(props),
+    ]);
+    const suffix = props.profile !== "default" ? ` -p ${props.profile}` : "";
+    if (!provider) {
+      throw new Error(
+        `Provider "${props.provider}" not found in profile "${props.profile}". Please run \`alchemy configure${suffix}\` to configure this provider.`,
+      );
+    }
+    if (!credentials) {
+      throw new Error(
+        `Credentials not found for provider "${props.provider}" and profile "${props.profile}". Please run \`alchemy login ${props.provider}${suffix}\` to login to this provider.`,
+      );
+    }
+    return { provider, credentials };
+  };
+
+  export const set = async <
+    Metadata extends Record<string, string> = Record<string, string>,
+  >(
+    props: Props,
+    provider: Provider<Metadata>,
+  ) => {
+    await Config.patch((config) => {
+      config.profiles[props.profile] ??= {};
+      config.profiles[props.profile][props.provider] = provider;
+      return config;
+    });
+  };
+
+  export const del = async (props: Props) => {
+    await Config.patch((config) => {
+      if (config.profiles[props.profile]) {
+        delete config.profiles[props.profile][props.provider];
+      }
+      if (Object.keys(config.profiles[props.profile]).length === 0) {
+        delete config.profiles[props.profile];
+      }
+      return config;
+    });
+  };
+}
+
+export type Credentials =
+  | Credentials.ApiKey
+  | Credentials.ApiToken
+  | Credentials.OAuth;
+
+export namespace Credentials {
+  export interface ApiKey {
+    type: "api-key";
+    apiKey: string;
+    email: string;
+  }
+
+  export interface ApiToken {
+    type: "api-token";
+    apiToken: string;
+  }
+
+  export interface OAuth {
+    type: "oauth";
+    access: string;
+    refresh: string;
+    expires: number;
+    scopes: string[];
+  }
+
+  /**
+   * Gets the credentials file.
+   * @param props The profile and provider of the credentials.
+   */
+  export const get = async (props: Props) => {
+    return await FS.readJSON<Credentials>(
+      Path.credentialsFile(props.provider, props.profile),
+    );
+  };
+
+  /**
+   * Sets the credentials file.
+   * @param props The profile and provider of the credentials.
+   * @param credentials The credentials to set.
+   */
+  export const set = async (props: Props, credentials: Credentials) => {
+    await FS.writeJSON<Credentials>(
+      Path.credentialsFile(props.provider, props.profile),
+      credentials,
+    );
+  };
+
+  /**
+   * Deletes the credentials file.
+   * @param props The profile and provider of the credentials.
+   */
+  export const del = async (props: Props) => {
+    await fs.unlink(Path.credentialsFile(props.provider, props.profile));
+  };
+
+  /**
+   * Internal function to fetch and refresh credentials.
+   * Uses a lock so the `refresh` function is called by only one process at a time.
+   * If another process is refreshing the credentials, this function will wait for the
+   * other process to release the lock before calling itself recursively to retrieve the updated credentials.
+   */
+  const getRefreshedInternal = async (
+    props: Props,
+    refresh: (credentials: Credentials.OAuth) => Promise<Credentials.OAuth>,
+  ): Promise<Credentials> => {
+    // 1. Get credentials
+    const credentials = await Credentials.get(props);
+    if (!credentials) {
+      throw new Error(
+        `Credentials for provider "${props.provider}" not found in profile "${props.profile}"`,
+      );
+    }
+    // 2. Return credentials if they are not expired
+    if (!Credentials.isOAuthExpired(credentials)) {
+      return credentials;
+    }
+    // 3. Refresh credentials with lock for thread safety
+    const lock = new Lock(`${props.provider}-${props.profile}`);
+    const release = await lock.acquire();
+    if (release) {
+      try {
+        const refreshed = await refresh(credentials);
+        await Credentials.set(props, refreshed);
+        return refreshed;
+      } finally {
+        await release();
+      }
+    }
+    // 4. Another process has the lock, so wait for it to be released
+    await lock.wait();
+    // 5. Call this function again, bypassing the single flight mechanism to avoid a deadlock
+    return await getRefreshedInternal(props, refresh);
+  };
+
+  /**
+   * Fetches OAuth credentials for the given provider and profile, refreshing them if they are expired.
+   * @param props The properties of the credentials.
+   * @param refresh The function to refresh the credentials.
+   * @returns The refreshed credentials.
+   */
+  export const getRefreshed = singleFlight(
+    // The locking mechanism works within the same process, but since the lock uses IO and polling,
+    // wrapping it with `singleFlight` makes it more efficient.
+    getRefreshedInternal,
+    (props) => `${props.provider}-${props.profile}`,
+  );
+
+  /**
+   * Returns true if the given credentials are OAuth and expired.
+   */
+  export const isOAuthExpired = (
+    credentials: Credentials,
+    tolerance = 1000 * 10,
+  ): credentials is Credentials.OAuth => {
+    return (
+      credentials.type === "oauth" &&
+      credentials.expires < Date.now() + tolerance
+    );
+  };
+}
+
+namespace FS {
+  export const readJSON = async <T>(path: string): Promise<T | undefined> => {
+    try {
+      const data = await fs.readFile(path, "utf-8");
+      return JSON.parse(data) as T;
+    } catch {
+      return undefined;
+    }
+  };
+
+  export const writeJSON = async <T>(name: string, data: T) => {
+    await fs.mkdir(path.dirname(name), { recursive: true });
+    await fs.writeFile(name, JSON.stringify(data, null, 2), { mode: 0o600 });
+  };
+}

package/src/aws/bucket.ts

@@ -26,7 +26,7 @@ export interface BucketProps {
 /**
  * Output returned after S3 bucket creation/update
  */
-export interface Bucket extends Resource<"s3::Bucket">, BucketProps {
+export interface Bucket extends BucketProps {
   /**
    * The ARN (Amazon Resource Name) of the bucket
    * Format: arn:aws:s3:::bucket-name
@@ -244,7 +244,7 @@ export const Bucket = Resource(
       }
     }
 
-    return this({
+    return {
       bucketName: bucketName,
       arn: `arn:aws:s3:::${bucketName}`,
       bucketDomainName: `${bucketName}.s3.amazonaws.com`,
@@ -254,7 +254,7 @@ export const Bucket = Resource(
       versioningEnabled: versioningResponse.Status === "Enabled",
       acl: aclResponse.Grants?.[0]?.Permission?.toLowerCase(),
       ...(tags && { tags }),
-    });
+    };
   },
 );
 

package/src/aws/control/resource.ts

@@ -1,5 +1,4 @@
 import jsonpatch from "fast-json-patch";
-const compare = jsonpatch.compare;
 import type { Context } from "../../context.ts";
 import {
   registerDynamicResource,
@@ -15,6 +14,7 @@ import {
   UpdateFailedError,
 } from "./error.ts";
 import readOnlyPropertiesMap from "./properties.ts";
+const compare = jsonpatch.compare;
 
 /**
  * Properties for creating or updating a Cloud Control resource
@@ -60,9 +60,7 @@ export interface CloudControlResourceProps {
 /**
  * Output returned after Cloud Control resource creation/update
  */
-export interface CloudControlResource
-  extends Resource<"aws::CloudControlResource">,
-    CloudControlResourceProps {
+export interface CloudControlResource extends CloudControlResourceProps {
   /**
    * The identifier of the resource
    */
@@ -337,12 +335,12 @@ async function CloudControlLifecycle(
     );
   }
 
-  return this({
+  return {
     ...props,
     id: response.Identifier!,
     createdAt: Date.now(),
     ...(await client.getResource(props.typeName, response.Identifier!)),
-  });
+  };
 }
 
 async function updateResourceWithPatch(

package/src/aws/ec2/internet-gateway-attachment.ts

@@ -38,8 +38,7 @@ export interface InternetGatewayAttachmentProps extends AwsClientProps {
  * Output returned after Internet Gateway Attachment creation/update
  */
 export interface InternetGatewayAttachment
-  extends Resource<"aws::InternetGatewayAttachment">,
-    InternetGatewayAttachmentProps {
+  extends InternetGatewayAttachmentProps {
   /**
    * The ID of the Internet Gateway
    */
@@ -277,12 +276,12 @@ export const InternetGatewayAttachment = Resource(
       const attachment = igw?.Attachments?.find((att) => att.VpcId === vpcId);
 
       if (attachment) {
-        return this({
+        return {
           internetGatewayId,
           vpcId,
           state: "attached",
           ...props,
-        });
+        };
       }
     }
 
@@ -353,12 +352,12 @@ export const InternetGatewayAttachment = Resource(
       "to be attached",
     );
 
-    return this({
+    return {
       internetGatewayId,
       vpcId,
       state: "attached",
       ...props,
-    });
+    };
   },
 );
 

package/src/aws/ec2/internet-gateway.ts

@@ -31,9 +31,7 @@ export interface InternetGatewayProps extends AwsClientProps {
 /**
  * Output returned after Internet Gateway creation/update
  */
-export interface InternetGateway
-  extends Resource<"aws::InternetGateway">,
-    InternetGatewayProps {
+export interface InternetGateway extends InternetGatewayProps {
   /**
    * The ID of the Internet Gateway
    */
@@ -358,7 +356,7 @@ export const InternetGateway = Resource(
       );
     }
 
-    return this({
+    return {
       internetGatewayId: internetGateway.InternetGatewayId!,
       state: "available",
       attachments: internetGateway.Attachments?.map((att) => ({
@@ -367,7 +365,7 @@ export const InternetGateway = Resource(
       })),
       ownerId: internetGateway.OwnerId,
       ...props,
-    });
+    };
   },
 );
 

package/src/aws/ec2/nat-gateway.ts

@@ -48,9 +48,7 @@ export interface NatGatewayProps extends AwsClientProps {
 /**
  * Output returned after NAT Gateway creation/update
  */
-export interface NatGateway
-  extends Resource<"aws::NatGateway">,
-    NatGatewayProps {
+export interface NatGateway extends NatGatewayProps {
   /**
    * The ID of the NAT Gateway
    */
@@ -423,7 +421,7 @@ export const NatGateway = Resource(
       );
     }
 
-    const result = this({
+    const result = {
       natGatewayId: natGateway.NatGatewayId!,
       subnetId: natGateway.SubnetId!,
       vpcId: natGateway.VpcId!,
@@ -434,7 +432,7 @@ export const NatGateway = Resource(
       createdElasticIp,
       ...props,
       subnet: subnetId,
-    });
+    };
     return result;
   },
 );

package/src/aws/ec2/route-table-association.ts

@@ -44,9 +44,7 @@ export interface RouteTableAssociationProps {
 /**
  * Output returned after Route Table Association creation/update
  */
-export interface RouteTableAssociation
-  extends Resource<"aws::RouteTableAssociation">,
-    RouteTableAssociationProps {
+export interface RouteTableAssociation extends RouteTableAssociationProps {
   /**
    * The ID of the route table association
    */
@@ -418,7 +416,7 @@ export const RouteTableAssociation = Resource(
       }
     }
 
-    return this({
+    return {
       associationId,
       routeTableId,
       subnetId,
@@ -429,7 +427,7 @@ export const RouteTableAssociation = Resource(
       routeTable: routeTableId,
       subnet: subnetId,
       gateway: gatewayId,
-    });
+    };
   },
 );
 

package/src/aws/ec2/route-table.ts

@@ -37,9 +37,7 @@ export interface RouteTableProps extends AwsClientProps {
 /**
  * Output returned after Route Table creation/update
  */
-export interface RouteTable
-  extends Resource<"aws::RouteTable">,
-    RouteTableProps {
+export interface RouteTable extends RouteTableProps {
   /**
    * The ID of the route table
    */
@@ -272,12 +270,12 @@ export const RouteTable = Resource(
       logger.log(`  ✅ Route Table ${routeTable.RouteTableId} created`);
     }
 
-    return this({
+    return {
       routeTableId: routeTable.RouteTableId!,
       vpcId: routeTable.VpcId!,
       ...props,
       vpc: vpcId,
-    });
+    };
   },
 );
 

package/src/aws/ec2/route.ts

@@ -52,7 +52,7 @@ export interface RouteProps extends AwsClientProps {
 /**
  * Output returned after Route creation/update
  */
-export interface Route extends Resource<"aws::Route">, RouteProps {
+export interface Route extends RouteProps {
   /**
    * The ID of the route table
    */
@@ -333,7 +333,7 @@ export const Route = Resource(
       throw new Error("Failed to find created route");
     }
 
-    return this({
+    return {
       routeTableId,
       state: route.State as "active" | "blackhole",
       origin: route.Origin as
@@ -342,7 +342,7 @@ export const Route = Resource(
         | "EnableVgwRoutePropagation",
       ...props,
       routeTable: routeTableId,
-    });
+    };
   },
 );
 

package/src/aws/ec2/security-group-rule.ts

@@ -56,9 +56,7 @@ export interface SecurityGroupRuleProps {
 /**
  * Output returned after Security Group Rule creation/update
  */
-export interface SecurityGroupRule
-  extends Resource<"aws::SecurityGroupRule">,
-    SecurityGroupRuleProps {
+export interface SecurityGroupRule extends SecurityGroupRuleProps {
   /**
    * A unique identifier for the rule resource.
    */
@@ -156,10 +154,10 @@ export const SecurityGroupRule = Resource(
       authorizeParams,
     );
 
-    return this({
+    return {
       ruleId,
       ...props,
-    });
+    };
   },
 );
 

package/src/aws/ec2/security-group.ts

@@ -56,9 +56,7 @@ export interface SecurityGroupProps extends AwsClientProps {
 /**
  * Output returned after Security Group creation/update
  */
-export interface SecurityGroup
-  extends Resource<"aws::SecurityGroup">,
-    SecurityGroupProps {
+export interface SecurityGroup extends SecurityGroupProps {
   /**
    * The ID of the security group.
    */
@@ -322,14 +320,14 @@ export const SecurityGroup = Resource(
       securityGroup = sgResponse.SecurityGroups[0];
     }
 
-    return this({
+    return {
       groupId: securityGroup.GroupId,
       groupName,
       vpcId: securityGroup.VpcId,
       ownerId: securityGroup.OwnerId,
       ...props,
       vpc: vpcId,
-    });
+    };
   },
 );
 

package/src/aws/ec2/subnet.ts

@@ -54,7 +54,7 @@ export interface SubnetProps extends AwsClientProps {
 /**
  * Output returned after Subnet creation/update
  */
-export interface Subnet extends Resource<"aws::Subnet">, SubnetProps {
+export interface Subnet extends SubnetProps {
   /**
    * The ID of the subnet
    */
@@ -407,7 +407,7 @@ export const Subnet = Resource(
       await waitForSubnetAvailable(client, subnet.SubnetId, timeoutConfig);
     }
 
-    return this({
+    return {
       subnetId: subnet.SubnetId,
       vpcId: subnet.VpcId,
       state: subnet.State as "pending" | "available",
@@ -415,7 +415,7 @@ export const Subnet = Resource(
       defaultForAz: subnet.DefaultForAz,
       ...props,
       vpc: vpcId,
-    });
+    };
   },
 );
 

package/src/aws/ec2/vpc.ts

@@ -80,7 +80,7 @@ export interface VpcProps extends AwsClientProps {
 /**
  * Output returned after VPC creation/update
  */
-export interface Vpc extends Resource<"aws::Vpc">, VpcProps {
+export interface Vpc extends VpcProps {
   /**
    * The ID of the VPC
    */
@@ -388,13 +388,13 @@ export const Vpc = Resource(
       }
     }
 
-    return this({
+    return {
       vpcId: vpc.VpcId!,
       state: vpc.State as "pending" | "available",
       isDefault: vpc.IsDefault || false,
       dhcpOptionsId: vpc.DhcpOptionsId!,
       ...props,
-    });
+    };
   },
 );
 

package/src/aws/function.ts

@@ -136,7 +136,7 @@ export interface FunctionProps {
 /**
  * Output returned after Lambda function creation/update
  */
-export interface Function extends Resource<"lambda::Function">, FunctionProps {
+export interface Function extends FunctionProps {
   /**
    * ARN of the Lambda function
    */
@@ -745,7 +745,7 @@ export const Function = Resource(
       }
     }
 
-    return this({
+    return {
       ...props,
       arn: config.FunctionArn!,
       functionName,
@@ -769,7 +769,7 @@ export const Function = Resource(
       signingProfileVersionArn: config.SigningProfileVersionArn,
       signingJobArn: config.SigningJobArn,
       functionUrl: functionUrl,
-    });
+    };
   },
 );
 

package/src/aws/oidc/oidc-provider.ts

@@ -71,9 +71,7 @@ export interface OIDCProviderProps {
 /**
  * Output returned after OIDC provider configuration
  */
-export interface OIDCProvider
-  extends Resource<"aws::OIDCProvider">,
-    OIDCProviderProps {
+export interface OIDCProvider extends OIDCProviderProps {
   /**
    * The ARN of the OIDC provider
    * Format: arn:aws:iam::account-id:oidc-provider/token.actions.githubusercontent.com
@@ -280,11 +278,11 @@ export const OIDCProvider = Resource(
         }),
       );
 
-      return this({
+      return {
         ...props,
         providerArn,
         createdAt: Date.now(),
-      });
+      };
     } catch (error) {
       logger.error("Error configuring OIDC provider:", error);
       throw error;

package/src/aws/policy-attachment.ts

@@ -22,9 +22,7 @@ export interface PolicyAttachmentProps {
 /**
  * Output returned after policy attachment creation/update
  */
-export interface PolicyAttachment
-  extends Resource<"iam::PolicyAttachment">,
-    PolicyAttachmentProps {}
+export interface PolicyAttachment extends PolicyAttachmentProps {}
 
 /**
  * AWS IAM Policy Attachment Resource
@@ -97,6 +95,6 @@ export const PolicyAttachment = Resource(
       ),
     );
 
-    return this(props);
+    return props;
   },
 );