cdk-nextjs 0.7.12 → 0.7.14

package/lib/nextjs-distribution.d.ts

@@ -1,5 +1,5 @@
 import { ICertificate } from "aws-cdk-lib/aws-certificatemanager";
-import { AddBehaviorOptions, CachePolicyProps, Distribution, ResponseHeadersPolicyProps } from "aws-cdk-lib/aws-cloudfront";
+import { AddBehaviorOptions, CachePolicyProps, Distribution, FunctionCode, IKeyValueStore, ResponseHeadersPolicyProps } from "aws-cdk-lib/aws-cloudfront";
 import { FunctionUrlOriginWithOACProps, VpcOriginWithEndpointProps } from "aws-cdk-lib/aws-cloudfront-origins";
 import { IApplicationLoadBalancer } from "aws-cdk-lib/aws-elasticloadbalancingv2";
 import { IFunctionUrl } from "aws-cdk-lib/aws-lambda";
@@ -76,6 +76,15 @@ export interface NextjsDistributionProps {
      * add static behaviors to distribution.
      */
     readonly publicDirEntries: PublicDirEntry[];
+    /**
+     * The `Service-Worker-Allowed` header for `_next/static/service-worker/*`,
+     * which Next.js sends so a compiled service worker can register at a scope
+     * wider than its own directory, such as `/`. S3 can't send an arbitrary
+     * header, so setting this adds a behavior for those files whose response
+     * headers policy does. Next.js uses the app's `basePath`, or `/` for none.
+     * @default - no behavior; the build has no service worker
+     */
+    readonly serviceWorkerAllowed?: string;
     /**
      * The non-`default` function groups, the origins
      * {@link functionGroupBehaviors} route to.
@@ -101,6 +110,34 @@ export interface NextjsDistributionProps {
      * @see https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cloudfront-limits.html#limits-web-distributions
      */
     readonly maxCacheBehaviors?: number;
+    /**
+     * CloudFront Function code run first on every viewer request, on every
+     * behavior cdk-nextjs adds, static assets included — HTTP Basic auth on a
+     * pre-launch site, geo-gating.
+     *
+     * It must define `viewerRequest(event)` (a function, sync or async, or a
+     * `var`/`let`/`const`): return a response to answer the viewer, or the
+     * request (or nothing) to carry on. It is spliced into cdk-nextjs's own
+     * viewer-request functions, ahead of their logic, so it may not use the
+     * name `handler`, and the combined function must fit CloudFront's 10 KB.
+     * It runs on `cloudfront-js-2.0`, so it may be async and read
+     * {@link viewerRequestKeyValueStore} with `cf.kvs()`. A bring-your-own
+     * {@link distribution}'s default behavior isn't covered.
+     *
+     * @default - none
+     * @see https://github.com/cdklabs/cdk-nextjs#running-code-on-every-viewer-request
+     */
+    readonly viewerRequestFunctionCode?: FunctionCode;
+    /**
+     * A CloudFront KeyValueStore associated with every viewer-request function
+     * {@link viewerRequestFunctionCode} is copied into (up to three, one per kind
+     * of behavior), so values it reads — Basic auth credentials, an allowlist —
+     * live outside the CloudFormation template and change without a deploy.
+     * Read it with `cf.kvs()`, no ID needed.
+     * @default - none
+     * @see https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/functions-custom-methods.html
+     */
+    readonly viewerRequestKeyValueStore?: IKeyValueStore;
 }
 /** A non-default function group and the origin its routes must reach. */
 export interface NextjsDistributionFunctionGroup {
@@ -134,6 +171,18 @@ export declare class NextjsDistribution extends Construct {
     private dynamicOrigin;
     private dynamicOriginResponsePolicy;
     private dynamicCloudFrontFunctionAssociations;
+    /**
+     * `viewerRequestFunctionCode`, rendered and checked once, since
+     * `FunctionCode.fromFile` reads the file on every render.
+     */
+    private viewerRequestCode?;
+    /**
+     * The viewer-request function `viewerRequestFunctionCode` adds to behaviors
+     * with no viewer-request logic of their own, shared by all of them, so the
+     * `assetPrefix` behavior, which has a viewer-request function of its own,
+     * can tell it from an override's.
+     */
+    private passThroughFunction?;
     private isFunctionCompute;
     private staticBehaviorOptions;
     private dynamicBehaviorOptions;
@@ -168,11 +217,40 @@ export declare class NextjsDistribution extends Construct {
      * @see https://open-next.js.org/advanced/workaround#workaround-set-x-forwarded-host-header-aws-specific
      */
     private createDynamicCloudFrontFunctionAssociations;
+    /**
+     * The function a behavior with no viewer-request logic of its own gets when
+     * `viewerRequestFunctionCode` is set, created on first use.
+     */
+    private getPassThroughFunction;
+    /**
+     * The code, runtime and KeyValueStore of a function whose `handler` is
+     * cdk-nextjs's, with `viewerRequestFunctionCode` spliced in
+     * ({@link spliceViewerRequest}) and checked against CloudFront's size limit.
+     *
+     * Every one runs on `cloudfront-js-2.0`, the runtime AWS recommends and the
+     * one with `async` and KeyValueStores, so the handlers are all `async`
+     * whether or not there is user code to await.
+     */
+    private viewerRequestFunctionProps;
+    /**
+     * `viewerRequestFunctionCode`, rendered once, since `FunctionCode.fromFile`
+     * reads the file on every render, and checked
+     * ({@link checkViewerRequestCode}).
+     */
+    private renderViewerRequestCode;
+    /**
+     * CloudFront allows one function per event type per behavior, so an
+     * override's viewer-request association and one cdk-nextjs needs can't both
+     * be kept. Thrown at synth, where both halves are known, rather than left to
+     * a deploy that names neither.
+     */
+    private assertViewerRequestUnclaimed;
     private createStaticBehaviorOptions;
     private createDynamicBehaviorOptions;
     /**
      * The behavior's function associations: an override's, plus the viewer-request
-     * function Global Functions depends on.
+     * function Global Functions depends on, or the one `viewerRequestFunctionCode`
+     * adds on Global Containers.
      *
      * Spreading the override's `functionAssociations` over ours would silently
      * drop that function, and with it the only thing standing between a viewer's
@@ -254,6 +332,18 @@ export declare class NextjsDistribution extends Construct {
      * parse.
      */
     private addAssetPrefixBehavior;
+    /**
+     * Serves `_next/static/service-worker/*` with `Service-Worker-Allowed`, which
+     * the browser requires before it registers a service worker at a scope above
+     * the script's own directory. Added ahead of `_next/static*`, which would
+     * otherwise match first.
+     *
+     * The policy is the static one plus the header, so security headers and any
+     * `staticResponseHeadersPolicyProps` still apply. A whole
+     * `staticBehaviorOptions.responseHeadersPolicy` can't be added to, so it is
+     * used as it is, with a warning.
+     */
+    private addServiceWorkerBehavior;
     private addStaticBehaviors;
     /**
      * The behavior path pattern for each top-level `public/` entry, final form: