alchemy 0.67.0 → 0.68.0

package/src/apply.ts

@@ -11,6 +11,7 @@ import {
   type PendingResource,
   type Provider,
   type Resource,
+  type ResourceAttributes,
   type ResourceProps,
 } from "./resource.ts";
 import type { PendingDeletions } from "./scope.ts";
@@ -26,11 +27,11 @@ export interface ApplyOptions {
   noop?: boolean;
 }
 
-export function apply<Out extends Resource>(
+export function apply<Out extends ResourceAttributes>(
   resource: PendingResource<Out>,
   props: ResourceProps | undefined,
   options?: ApplyOptions,
-): Promise<Awaited<Out>> {
+): Promise<Awaited<Out> & Resource> {
   return _apply(resource, props, options);
 }
 
@@ -48,11 +49,11 @@ export class ReplacedSignal extends Error {
   }
 }
 
-async function _apply<Out extends Resource>(
+async function _apply<Out extends ResourceAttributes>(
   resource: PendingResource<Out>,
   props: ResourceProps | undefined,
   options?: ApplyOptions,
-): Promise<Awaited<Out>> {
+): Promise<Awaited<Out> & Resource> {
   const scope = resource[ResourceScope];
   const start = performance.now();
   try {
@@ -86,7 +87,7 @@ async function _apply<Out extends Resource>(
         event: "resource.read",
         resource: resource[ResourceKind],
       });
-      return state.output as Awaited<Out>;
+      return state.output as Awaited<Out> & Resource;
 
       // -> poll until it does not (i.e. when the owner process applies the change and updates the state store)
       async function waitForConsistentState() {
@@ -116,7 +117,7 @@ async function _apply<Out extends Resource>(
         }
       }
       async function inputsAreEqual(
-        state: State<string, ResourceProps | undefined, Resource<string>>,
+        state: State<string, ResourceProps | undefined, Resource>,
       ) {
         const oldProps = await serialize(scope, state.props, {
           encrypt: false,
@@ -183,7 +184,7 @@ async function _apply<Out extends Resource>(
           resource: resource[ResourceKind],
           status: state.status,
         });
-        return state.output as Awaited<Out>;
+        return state.output as Awaited<Out> & Resource;
       }
     }
 
@@ -238,7 +239,7 @@ async function _apply<Out extends Resource>(
       },
     });
 
-    let output: Resource<string>;
+    let output: any;
     try {
       output = await alchemy.run(
         resource[ResourceID],
@@ -249,7 +250,7 @@ async function _apply<Out extends Resource>(
           noop: options?.noop,
         },
         async () =>
-          await provider.handler.bind(ctx)(resource[ResourceID], props),
+          ctx(await provider.handler.bind(ctx)(resource[ResourceID], props)),
       );
     } catch (error) {
       if (error instanceof ReplacedSignal) {
@@ -287,25 +288,27 @@ async function _apply<Out extends Resource>(
             parent: scope,
             noop: options?.noop,
           },
-          async () =>
-            provider.handler.bind(
-              context({
-                scope,
-                phase: "create",
-                kind: resource[ResourceKind],
-                id: resource[ResourceID],
-                fqn: resource[ResourceFQN],
-                seq: resource[ResourceSeq],
-                props: state!.props,
-                state: state!,
-                isReplacement: true,
-                replace: () => {
-                  throw new Error(
-                    `Resource ${resource[ResourceKind]} ${resource[ResourceFQN]} cannot be replaced in create phase.`,
-                  );
-                },
-              }),
-            )(resource[ResourceID], props),
+          async () => {
+            const ctx = context({
+              scope,
+              phase: "create",
+              kind: resource[ResourceKind],
+              id: resource[ResourceID],
+              fqn: resource[ResourceFQN],
+              seq: resource[ResourceSeq],
+              props: state!.props,
+              state: state!,
+              isReplacement: true,
+              replace: () => {
+                throw new Error(
+                  `Resource ${resource[ResourceKind]} ${resource[ResourceFQN]} cannot be replaced in create phase.`,
+                );
+              },
+            });
+            return ctx(
+              await provider.handler.bind(ctx)(resource[ResourceID], props),
+            );
+          },
         );
       } else {
         throw error;
@@ -342,7 +345,7 @@ async function _apply<Out extends Resource>(
       output,
       props,
     });
-    return output as any;
+    return output as Awaited<Out> & Resource;
   } catch (error) {
     scope.telemetryClient.record({
       event: "resource.error",

package/src/auth.ts

@@ -0,0 +1,253 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { Lock } from "./util/lock.ts";
+import { singleFlight } from "./util/memoize.ts";
+
+namespace Path {
+  export const rootDir = path.join(os.homedir(), ".alchemy");
+  export const configFile = path.join(rootDir, "config.json");
+  export const credentialsDir = path.join(rootDir, "credentials");
+  export const credentialsFile = (provider: string, profile: string) =>
+    path.join(credentialsDir, profile, `${provider}.json`);
+}
+
+interface Props {
+  profile: string;
+  provider: string;
+}
+
+interface Config {
+  version: 1;
+  profiles: {
+    [profile: string]: Profile;
+  };
+}
+
+namespace Config {
+  export const read = async () => {
+    const config = await FS.readJSON<Config>(Path.configFile);
+    return config ?? { version: 1, profiles: {} };
+  };
+
+  export const patch = async (updater: (config: Config) => Config) => {
+    const config = await read();
+    const updated = updater(config);
+    await FS.writeJSON<Config>(Path.configFile, updated);
+  };
+}
+
+export interface Profile {
+  [provider: string]: Provider;
+}
+
+export namespace Profile {
+  export const get = async (name: string): Promise<Profile | undefined> => {
+    const config = await Config.read();
+    return config.profiles[name];
+  };
+}
+
+export interface Provider<
+  Metadata extends Record<string, string> = Record<string, string>,
+> {
+  metadata: Metadata;
+  method: "api-key" | "api-token" | "oauth";
+  scopes?: string[];
+}
+
+export namespace Provider {
+  export const get = async <
+    Metadata extends Record<string, string> = Record<string, string>,
+  >(
+    props: Props,
+  ) => {
+    const profile = await Profile.get(props.profile);
+    return profile?.[props.provider] as Provider<Metadata> | undefined;
+  };
+
+  export const getWithCredentials = async <
+    Metadata extends Record<string, string> = Record<string, string>,
+  >(
+    props: Props,
+  ) => {
+    const [provider, credentials] = await Promise.all([
+      Provider.get<Metadata>(props),
+      Credentials.get(props),
+    ]);
+    const suffix = props.profile !== "default" ? ` -p ${props.profile}` : "";
+    if (!provider) {
+      throw new Error(
+        `Provider "${props.provider}" not found in profile "${props.profile}". Please run \`alchemy configure${suffix}\` to configure this provider.`,
+      );
+    }
+    if (!credentials) {
+      throw new Error(
+        `Credentials not found for provider "${props.provider}" and profile "${props.profile}". Please run \`alchemy login ${props.provider}${suffix}\` to login to this provider.`,
+      );
+    }
+    return { provider, credentials };
+  };
+
+  export const set = async <
+    Metadata extends Record<string, string> = Record<string, string>,
+  >(
+    props: Props,
+    provider: Provider<Metadata>,
+  ) => {
+    await Config.patch((config) => {
+      config.profiles[props.profile] ??= {};
+      config.profiles[props.profile][props.provider] = provider;
+      return config;
+    });
+  };
+
+  export const del = async (props: Props) => {
+    await Config.patch((config) => {
+      if (config.profiles[props.profile]) {
+        delete config.profiles[props.profile][props.provider];
+      }
+      if (Object.keys(config.profiles[props.profile]).length === 0) {
+        delete config.profiles[props.profile];
+      }
+      return config;
+    });
+  };
+}
+
+export type Credentials =
+  | Credentials.ApiKey
+  | Credentials.ApiToken
+  | Credentials.OAuth;
+
+export namespace Credentials {
+  export interface ApiKey {
+    type: "api-key";
+    apiKey: string;
+    email: string;
+  }
+
+  export interface ApiToken {
+    type: "api-token";
+    apiToken: string;
+  }
+
+  export interface OAuth {
+    type: "oauth";
+    access: string;
+    refresh: string;
+    expires: number;
+    scopes: string[];
+  }
+
+  /**
+   * Gets the credentials file.
+   * @param props The profile and provider of the credentials.
+   */
+  export const get = async (props: Props) => {
+    return await FS.readJSON<Credentials>(
+      Path.credentialsFile(props.provider, props.profile),
+    );
+  };
+
+  /**
+   * Sets the credentials file.
+   * @param props The profile and provider of the credentials.
+   * @param credentials The credentials to set.
+   */
+  export const set = async (props: Props, credentials: Credentials) => {
+    await FS.writeJSON<Credentials>(
+      Path.credentialsFile(props.provider, props.profile),
+      credentials,
+    );
+  };
+
+  /**
+   * Deletes the credentials file.
+   * @param props The profile and provider of the credentials.
+   */
+  export const del = async (props: Props) => {
+    await fs.unlink(Path.credentialsFile(props.provider, props.profile));
+  };
+
+  /**
+   * Internal function to fetch and refresh credentials.
+   * Uses a lock so the `refresh` function is called by only one process at a time.
+   * If another process is refreshing the credentials, this function will wait for the
+   * other process to release the lock before calling itself recursively to retrieve the updated credentials.
+   */
+  const getRefreshedInternal = async (
+    props: Props,
+    refresh: (credentials: Credentials.OAuth) => Promise<Credentials.OAuth>,
+  ): Promise<Credentials> => {
+    // 1. Get credentials
+    const credentials = await Credentials.get(props);
+    if (!credentials) {
+      throw new Error(
+        `Credentials for provider "${props.provider}" not found in profile "${props.profile}"`,
+      );
+    }
+    // 2. Return credentials if they are not expired
+    if (!Credentials.isOAuthExpired(credentials)) {
+      return credentials;
+    }
+    // 3. Refresh credentials with lock for thread safety
+    const lock = new Lock(`${props.provider}-${props.profile}`);
+    const release = await lock.acquire();
+    if (release) {
+      try {
+        const refreshed = await refresh(credentials);
+        await Credentials.set(props, refreshed);
+        return refreshed;
+      } finally {
+        await release();
+      }
+    }
+    // 4. Another process has the lock, so wait for it to be released
+    await lock.wait();
+    // 5. Call this function again, bypassing the single flight mechanism to avoid a deadlock
+    return await getRefreshedInternal(props, refresh);
+  };
+
+  /**
+   * Fetches OAuth credentials for the given provider and profile, refreshing them if they are expired.
+   * @param props The properties of the credentials.
+   * @param refresh The function to refresh the credentials.
+   * @returns The refreshed credentials.
+   */
+  export const getRefreshed = singleFlight(
+    // The locking mechanism works within the same process, but since the lock uses IO and polling,
+    // wrapping it with `singleFlight` makes it more efficient.
+    getRefreshedInternal,
+    (props) => `${props.provider}-${props.profile}`,
+  );
+
+  /**
+   * Returns true if the given credentials are OAuth and expired.
+   */
+  export const isOAuthExpired = (
+    credentials: Credentials,
+    tolerance = 1000 * 10,
+  ): credentials is Credentials.OAuth => {
+    return (
+      credentials.type === "oauth" &&
+      credentials.expires < Date.now() + tolerance
+    );
+  };
+}
+
+namespace FS {
+  export const readJSON = async <T>(path: string): Promise<T | undefined> => {
+    try {
+      const data = await fs.readFile(path, "utf-8");
+      return JSON.parse(data) as T;
+    } catch {
+      return undefined;
+    }
+  };
+
+  export const writeJSON = async <T>(name: string, data: T) => {
+    await fs.mkdir(path.dirname(name), { recursive: true });
+    await fs.writeFile(name, JSON.stringify(data, null, 2), { mode: 0o600 });
+  };
+}

package/src/aws/bucket.ts

@@ -26,7 +26,7 @@ export interface BucketProps {
 /**
  * Output returned after S3 bucket creation/update
  */
-export interface Bucket extends Resource<"s3::Bucket">, BucketProps {
+export interface Bucket extends BucketProps {
   /**
    * The ARN (Amazon Resource Name) of the bucket
    * Format: arn:aws:s3:::bucket-name
@@ -244,7 +244,7 @@ export const Bucket = Resource(
       }
     }
 
-    return this({
+    return {
       bucketName: bucketName,
       arn: `arn:aws:s3:::${bucketName}`,
       bucketDomainName: `${bucketName}.s3.amazonaws.com`,
@@ -254,7 +254,7 @@ export const Bucket = Resource(
       versioningEnabled: versioningResponse.Status === "Enabled",
       acl: aclResponse.Grants?.[0]?.Permission?.toLowerCase(),
       ...(tags && { tags }),
-    });
+    };
   },
 );
 

package/src/aws/control/resource.ts

@@ -1,5 +1,4 @@
 import jsonpatch from "fast-json-patch";
-const compare = jsonpatch.compare;
 import type { Context } from "../../context.ts";
 import {
   registerDynamicResource,
@@ -15,6 +14,7 @@ import {
   UpdateFailedError,
 } from "./error.ts";
 import readOnlyPropertiesMap from "./properties.ts";
+const compare = jsonpatch.compare;
 
 /**
  * Properties for creating or updating a Cloud Control resource
@@ -60,9 +60,7 @@ export interface CloudControlResourceProps {
 /**
  * Output returned after Cloud Control resource creation/update
  */
-export interface CloudControlResource
-  extends Resource<"aws::CloudControlResource">,
-    CloudControlResourceProps {
+export interface CloudControlResource extends CloudControlResourceProps {
   /**
    * The identifier of the resource
    */
@@ -337,12 +335,12 @@ async function CloudControlLifecycle(
     );
   }
 
-  return this({
+  return {
     ...props,
     id: response.Identifier!,
     createdAt: Date.now(),
     ...(await client.getResource(props.typeName, response.Identifier!)),
-  });
+  };
 }
 
 async function updateResourceWithPatch(

package/src/aws/ec2/internet-gateway-attachment.ts

@@ -38,8 +38,7 @@ export interface InternetGatewayAttachmentProps extends AwsClientProps {
  * Output returned after Internet Gateway Attachment creation/update
  */
 export interface InternetGatewayAttachment
-  extends Resource<"aws::InternetGatewayAttachment">,
-    InternetGatewayAttachmentProps {
+  extends InternetGatewayAttachmentProps {
   /**
    * The ID of the Internet Gateway
    */
@@ -277,12 +276,12 @@ export const InternetGatewayAttachment = Resource(
       const attachment = igw?.Attachments?.find((att) => att.VpcId === vpcId);
 
       if (attachment) {
-        return this({
+        return {
           internetGatewayId,
           vpcId,
           state: "attached",
           ...props,
-        });
+        };
       }
     }
 
@@ -353,12 +352,12 @@ export const InternetGatewayAttachment = Resource(
       "to be attached",
     );
 
-    return this({
+    return {
       internetGatewayId,
       vpcId,
       state: "attached",
       ...props,
-    });
+    };
   },
 );
 

package/src/aws/ec2/internet-gateway.ts

@@ -31,9 +31,7 @@ export interface InternetGatewayProps extends AwsClientProps {
 /**
  * Output returned after Internet Gateway creation/update
  */
-export interface InternetGateway
-  extends Resource<"aws::InternetGateway">,
-    InternetGatewayProps {
+export interface InternetGateway extends InternetGatewayProps {
   /**
    * The ID of the Internet Gateway
    */
@@ -358,7 +356,7 @@ export const InternetGateway = Resource(
       );
     }
 
-    return this({
+    return {
       internetGatewayId: internetGateway.InternetGatewayId!,
       state: "available",
       attachments: internetGateway.Attachments?.map((att) => ({
@@ -367,7 +365,7 @@ export const InternetGateway = Resource(
       })),
       ownerId: internetGateway.OwnerId,
       ...props,
-    });
+    };
   },
 );
 

package/src/aws/ec2/nat-gateway.ts

@@ -48,9 +48,7 @@ export interface NatGatewayProps extends AwsClientProps {
 /**
  * Output returned after NAT Gateway creation/update
  */
-export interface NatGateway
-  extends Resource<"aws::NatGateway">,
-    NatGatewayProps {
+export interface NatGateway extends NatGatewayProps {
   /**
    * The ID of the NAT Gateway
    */
@@ -423,7 +421,7 @@ export const NatGateway = Resource(
       );
     }
 
-    const result = this({
+    const result = {
       natGatewayId: natGateway.NatGatewayId!,
       subnetId: natGateway.SubnetId!,
       vpcId: natGateway.VpcId!,
@@ -434,7 +432,7 @@ export const NatGateway = Resource(
       createdElasticIp,
       ...props,
       subnet: subnetId,
-    });
+    };
     return result;
   },
 );

package/src/aws/ec2/route-table-association.ts

@@ -44,9 +44,7 @@ export interface RouteTableAssociationProps {
 /**
  * Output returned after Route Table Association creation/update
  */
-export interface RouteTableAssociation
-  extends Resource<"aws::RouteTableAssociation">,
-    RouteTableAssociationProps {
+export interface RouteTableAssociation extends RouteTableAssociationProps {
   /**
    * The ID of the route table association
    */
@@ -418,7 +416,7 @@ export const RouteTableAssociation = Resource(
       }
     }
 
-    return this({
+    return {
       associationId,
       routeTableId,
       subnetId,
@@ -429,7 +427,7 @@ export const RouteTableAssociation = Resource(
       routeTable: routeTableId,
       subnet: subnetId,
       gateway: gatewayId,
-    });
+    };
   },
 );
 

package/src/aws/ec2/route-table.ts

@@ -37,9 +37,7 @@ export interface RouteTableProps extends AwsClientProps {
 /**
  * Output returned after Route Table creation/update
  */
-export interface RouteTable
-  extends Resource<"aws::RouteTable">,
-    RouteTableProps {
+export interface RouteTable extends RouteTableProps {
   /**
    * The ID of the route table
    */
@@ -272,12 +270,12 @@ export const RouteTable = Resource(
       logger.log(`  ✅ Route Table ${routeTable.RouteTableId} created`);
     }
 
-    return this({
+    return {
       routeTableId: routeTable.RouteTableId!,
       vpcId: routeTable.VpcId!,
       ...props,
       vpc: vpcId,
-    });
+    };
   },
 );
 

package/src/aws/ec2/route.ts

@@ -52,7 +52,7 @@ export interface RouteProps extends AwsClientProps {
 /**
  * Output returned after Route creation/update
  */
-export interface Route extends Resource<"aws::Route">, RouteProps {
+export interface Route extends RouteProps {
   /**
    * The ID of the route table
    */
@@ -333,7 +333,7 @@ export const Route = Resource(
       throw new Error("Failed to find created route");
     }
 
-    return this({
+    return {
       routeTableId,
       state: route.State as "active" | "blackhole",
       origin: route.Origin as
@@ -342,7 +342,7 @@ export const Route = Resource(
         | "EnableVgwRoutePropagation",
       ...props,
       routeTable: routeTableId,
-    });
+    };
   },
 );
 

package/src/aws/ec2/security-group-rule.ts

@@ -56,9 +56,7 @@ export interface SecurityGroupRuleProps {
 /**
  * Output returned after Security Group Rule creation/update
  */
-export interface SecurityGroupRule
-  extends Resource<"aws::SecurityGroupRule">,
-    SecurityGroupRuleProps {
+export interface SecurityGroupRule extends SecurityGroupRuleProps {
   /**
    * A unique identifier for the rule resource.
    */
@@ -156,10 +154,10 @@ export const SecurityGroupRule = Resource(
       authorizeParams,
     );
 
-    return this({
+    return {
       ruleId,
       ...props,
-    });
+    };
   },
 );
 

package/src/aws/ec2/security-group.ts

@@ -56,9 +56,7 @@ export interface SecurityGroupProps extends AwsClientProps {
 /**
  * Output returned after Security Group creation/update
  */
-export interface SecurityGroup
-  extends Resource<"aws::SecurityGroup">,
-    SecurityGroupProps {
+export interface SecurityGroup extends SecurityGroupProps {
   /**
    * The ID of the security group.
    */
@@ -322,14 +320,14 @@ export const SecurityGroup = Resource(
       securityGroup = sgResponse.SecurityGroups[0];
     }
 
-    return this({
+    return {
       groupId: securityGroup.GroupId,
       groupName,
       vpcId: securityGroup.VpcId,
       ownerId: securityGroup.OwnerId,
       ...props,
       vpc: vpcId,
-    });
+    };
   },
 );