cdk-rds-sql 7.3.0 → 7.3.2

package/lambda/engine.mysql.test.ts

@@ -1,228 +0,0 @@
-import { MysqlEngine } from "./engine.mysql"
-
-describe("MySQL Engine", () => {
-  let engine: MysqlEngine
-
-  beforeEach(() => {
-    engine = new MysqlEngine()
-  })
-
-  describe("Database", () => {
-    it("should generate correct SQL for creating a database", () => {
-      const sql = engine.createDatabase("testdb", {})
-      expect(Array.isArray(sql)).toBe(true)
-      expect(sql[0]).toContain("CREATE DATABASE IF NOT EXISTS")
-    })
-
-    it("should generate correct SQL for creating a database with an owner", () => {
-      const sql = engine.createDatabase("testdb", { Owner: "testuser" })
-      expect(Array.isArray(sql)).toBe(true)
-      expect(sql[0]).toContain("CREATE DATABASE IF NOT EXISTS")
-      expect(sql[1]).toContain("GRANT ALL PRIVILEGES")
-    })
-
-    it("should generate correct SQL for deleting a database", () => {
-      const sql = engine.deleteDatabase("testdb", "masteruser")
-      expect(Array.isArray(sql)).toBe(true)
-      expect(sql[0]).toContain("DROP DATABASE IF EXISTS")
-    })
-  })
-
-  describe("Role", () => {
-    it("should throw error when creating a role without password ARN", async () => {
-      await expect(engine.createRole("testrole", {})).rejects.toThrow(
-        "No PasswordArn provided"
-      )
-    })
-
-    it("should generate correct SQL for renaming a role", async () => {
-      // Mock getPassword implementation
-      jest.spyOn(engine as any, "getPassword").mockResolvedValue("test-password")
-
-      const sql = await engine.updateRole(
-        "newrole",
-        "oldrole",
-        {
-          PasswordArn: "arn:aws:secretsmanager:region:account:secret:name",
-        },
-        {}
-      )
-
-      expect(Array.isArray(sql)).toBe(true)
-      expect(sql[0]).toContain("CREATE USER IF NOT EXISTS")
-      expect(sql[1]).toContain("DROP USER IF EXISTS")
-      expect(sql[2]).toContain("FLUSH PRIVILEGES")
-    })
-
-    it("should generate correct SQL for deleting a role", async () => {
-      const sql = await engine.deleteRole("testrole", { DatabaseName: "testdb" })
-      expect(Array.isArray(sql)).toBe(true)
-      expect(sql[0]).toContain("REVOKE ALL PRIVILEGES")
-      expect(sql[1]).toContain("DROP USER IF EXISTS")
-    })
-
-    it("should generate SQL to revoke privileges on old database when database is changed", async () => {
-      // Mock getPassword implementation
-      jest.spyOn(engine as any, "getPassword").mockResolvedValue("test-password")
-
-      const oldProps = {
-        DatabaseName: "olddb",
-        PasswordArn: "arn:aws:secretsmanager:region:account:secret:name",
-      }
-
-      const newProps = {
-        DatabaseName: "newdb",
-        PasswordArn: "arn:aws:secretsmanager:region:account:secret:name",
-      }
-
-      const sql = await engine.updateRole("testrole", "testrole", newProps, oldProps)
-
-      expect(Array.isArray(sql)).toBe(true)
-
-      // Check for revoke statement for the old database
-      const revokeStatement = sql.find(
-        (statement) =>
-          statement.includes("REVOKE ALL PRIVILEGES") && statement.includes("`olddb`")
-      )
-      expect(revokeStatement).toBeDefined()
-
-      // Check for grant statement for the new database
-      const grantStatement = sql.find(
-        (statement) =>
-          statement.includes("GRANT ALL PRIVILEGES") && statement.includes("`newdb`")
-      )
-      expect(grantStatement).toBeDefined()
-    })
-
-    describe("IAM Authentication", () => {
-      it("should create user with IAM authentication", async () => {
-        const props = {
-          EnableIamAuth: true,
-          DatabaseName: "testdb",
-        }
-
-        const sql = await engine.createRole("iamuser", props)
-
-        expect(Array.isArray(sql)).toBe(true)
-        expect(sql[0]).toContain(
-          "CREATE USER IF NOT EXISTS 'iamuser'@'%' IDENTIFIED WITH AWSAuthenticationPlugin as 'RDS'"
-        )
-        expect(sql[1]).toContain("GRANT ALL PRIVILEGES ON `testdb`.* TO 'iamuser'@'%'")
-        expect(sql[2]).toBe("FLUSH PRIVILEGES")
-      })
-
-      it("should create user without IAM authentication", async () => {
-        jest.spyOn(engine as any, "getPassword").mockResolvedValue("test-password")
-
-        const props = {
-          EnableIamAuth: false,
-          PasswordArn: "arn:aws:secretsmanager:region:account:secret:name",
-          DatabaseName: "testdb",
-        }
-
-        const sql = await engine.createRole("passworduser", props)
-
-        expect(Array.isArray(sql)).toBe(true)
-        expect(sql[0]).toContain(
-          "CREATE USER IF NOT EXISTS 'passworduser'@'%' IDENTIFIED BY 'test-password'"
-        )
-        expect(sql[1]).toContain(
-          "GRANT ALL PRIVILEGES ON `testdb`.* TO 'passworduser'@'%'"
-        )
-        expect(sql[2]).toBe("FLUSH PRIVILEGES")
-      })
-
-      it("should switch from password to IAM authentication", async () => {
-        const oldProps = {
-          EnableIamAuth: false,
-          PasswordArn: "arn:aws:secretsmanager:region:account:secret:name",
-        }
-
-        const newProps = {
-          EnableIamAuth: true,
-          DatabaseName: "testdb",
-        }
-
-        const sql = await engine.updateRole(
-          "switchuser",
-          "switchuser",
-          newProps,
-          oldProps
-        )
-
-        expect(Array.isArray(sql)).toBe(true)
-        expect(sql[0]).toContain("DROP USER IF EXISTS 'switchuser'@'%'")
-        expect(sql[1]).toContain(
-          "CREATE USER 'switchuser'@'%' IDENTIFIED WITH AWSAuthenticationPlugin as 'RDS'"
-        )
-        expect(sql[2]).toContain("GRANT ALL PRIVILEGES ON `testdb`.* TO 'switchuser'@'%'")
-        expect(sql[3]).toBe("FLUSH PRIVILEGES")
-      })
-
-      it("should switch from IAM to password authentication", async () => {
-        jest.spyOn(engine as any, "getPassword").mockResolvedValue("new-password")
-
-        const oldProps = {
-          EnableIamAuth: true,
-        }
-
-        const newProps = {
-          EnableIamAuth: false,
-          PasswordArn: "arn:aws:secretsmanager:region:account:secret:name",
-          DatabaseName: "testdb",
-        }
-
-        const sql = await engine.updateRole(
-          "switchuser",
-          "switchuser",
-          newProps,
-          oldProps
-        )
-
-        expect(Array.isArray(sql)).toBe(true)
-        expect(sql[0]).toContain("DROP USER IF EXISTS 'switchuser'@'%'")
-        expect(sql[1]).toContain(
-          "CREATE USER 'switchuser'@'%' IDENTIFIED BY 'new-password'"
-        )
-        expect(sql[2]).toContain("GRANT ALL PRIVILEGES ON `testdb`.* TO 'switchuser'@'%'")
-        expect(sql[3]).toBe("FLUSH PRIVILEGES")
-      })
-    })
-  })
-
-  describe("Schema", () => {
-    it("should throw an error when trying to create a schema", () => {
-      expect(() => engine.createSchema("testschema", {})).toThrow("not supported")
-    })
-
-    it("should throw an error when trying to update a schema", () => {
-      expect(() => engine.updateSchema("newschema", "oldschema", {})).toThrow(
-        "not supported"
-      )
-    })
-
-    it("should throw an error when trying to delete a schema", () => {
-      expect(() => engine.deleteSchema("testschema", {})).toThrow("not supported")
-    })
-  })
-
-  describe("SQL", () => {
-    it("should pass through SQL statements for create", () => {
-      const statement = "SELECT * FROM users"
-      const sql = engine.createSql("test", { Statement: statement })
-      expect(sql).toBe(statement)
-    })
-
-    it("should pass through SQL statements for update", () => {
-      const statement = "UPDATE users SET name = 'test'"
-      const sql = engine.updateSql("test", "old", { Statement: statement })
-      expect(sql).toBe(statement)
-    })
-
-    it("should pass through rollback SQL for delete", () => {
-      const rollback = "DROP TABLE users"
-      const sql = engine.deleteSql("test", { Rollback: rollback })
-      expect(sql).toBe(rollback)
-    })
-  })
-})

package/lambda/engine.mysql.ts

@@ -1,256 +0,0 @@
-import * as fs from "fs"
-import { AbstractEngine, EngineConnectionConfig } from "./engine.abstract"
-import {
-  EngineDatabaseProperties,
-  EngineRoleProperties,
-  EngineSchemaProperties,
-  EngineSqlProperties,
-  EngineIamGrantProperties,
-} from "./types"
-
-export class MysqlEngine extends AbstractEngine {
-  createDatabase(resourceId: string, props: EngineDatabaseProperties): string[] {
-    const sql = [`CREATE DATABASE IF NOT EXISTS \`${resourceId}\``]
-
-    if (props.Owner) {
-      sql.push(`GRANT ALL PRIVILEGES ON \`${resourceId}\`.* TO '${props.Owner}'@'%'`)
-      sql.push("FLUSH PRIVILEGES")
-    }
-
-    return sql
-  }
-
-  updateDatabase(): string[] {
-    throw new Error("Renaming database is not supported in MySQL.")
-  }
-
-  deleteDatabase(resourceId: string, _masterUser: string): string[] {
-    return [`DROP DATABASE IF EXISTS \`${resourceId}\``]
-  }
-
-  async createRole(resourceId: string, props: EngineRoleProperties): Promise<string[]> {
-    const sql: string[] = []
-
-    if (props.EnableIamAuth) {
-      // Create user for IAM authentication
-      sql.push(
-        `CREATE USER IF NOT EXISTS '${resourceId}'@'%' IDENTIFIED WITH AWSAuthenticationPlugin as 'RDS'`
-      )
-    } else {
-      // Create user with password authentication
-      if (!props.PasswordArn) throw new Error("No PasswordArn provided")
-      const password = await this.getPassword(props.PasswordArn)
-      if (!password) throw `Cannot parse password from ${props.PasswordArn}`
-
-      sql.push(
-        `CREATE USER IF NOT EXISTS '${resourceId}'@'%' IDENTIFIED BY '${password}'`
-      )
-    }
-
-    if (props.DatabaseName) {
-      sql.push(
-        `GRANT ALL PRIVILEGES ON \`${props.DatabaseName}\`.* TO '${resourceId}'@'%'`
-      )
-    }
-
-    sql.push("FLUSH PRIVILEGES")
-    return sql
-  }
-
-  async updateRole(
-    resourceId: string,
-    oldResourceId: string,
-    props: EngineRoleProperties,
-    oldProps: EngineRoleProperties
-  ): Promise<string[]> {
-    const sql: string[] = []
-
-    if (oldResourceId !== resourceId) {
-      // MySQL doesn't allow renaming users directly, we need to create a new one and drop the old one
-      if (props.EnableIamAuth) {
-        // Create new user with IAM auth
-        sql.push(
-          `CREATE USER IF NOT EXISTS '${resourceId}'@'%' IDENTIFIED WITH AWSAuthenticationPlugin as 'RDS'`
-        )
-      } else if (props?.PasswordArn) {
-        // Create new user with password auth
-        const password = await this.getPassword(props.PasswordArn)
-        if (!password) throw `Cannot parse password from ${props.PasswordArn}`
-
-        sql.push(
-          `CREATE USER IF NOT EXISTS '${resourceId}'@'%' IDENTIFIED BY '${password}'`
-        )
-      } else {
-        // If no password is provided, create user with a random password then expire it
-        sql.push(`CREATE USER IF NOT EXISTS '${resourceId}'@'%' IDENTIFIED BY UUID()`)
-        sql.push(`ALTER USER '${resourceId}'@'%' PASSWORD EXPIRE`)
-      }
-
-      // Drop the old user
-      sql.push(`DROP USER IF EXISTS '${oldResourceId}'@'%'`)
-    } else {
-      // Handle authentication method changes for existing user
-      if (props?.EnableIamAuth && !oldProps?.EnableIamAuth) {
-        // Switching from password to IAM auth - need to recreate user
-        sql.push(`DROP USER IF EXISTS '${resourceId}'@'%'`)
-        sql.push(
-          `CREATE USER '${resourceId}'@'%' IDENTIFIED WITH AWSAuthenticationPlugin as 'RDS'`
-        )
-      } else if (!props?.EnableIamAuth && oldProps?.EnableIamAuth) {
-        // Switching from IAM to password auth - need to recreate user
-        sql.push(`DROP USER IF EXISTS '${resourceId}'@'%'`)
-        if (props?.PasswordArn) {
-          const password = await this.getPassword(props.PasswordArn)
-          if (!password) throw `Cannot parse password from ${props.PasswordArn}`
-          sql.push(`CREATE USER '${resourceId}'@'%' IDENTIFIED BY '${password}'`)
-        }
-      } else if (!props?.EnableIamAuth && props?.PasswordArn) {
-        // Just update the password for password auth
-        const password = await this.getPassword(props.PasswordArn)
-        if (!password) throw `Cannot parse password from ${props.PasswordArn}`
-        sql.push(`ALTER USER '${resourceId}'@'%' IDENTIFIED BY '${password}'`)
-      }
-    }
-
-    // Check if database name has changed
-    if (
-      oldProps?.DatabaseName &&
-      props?.DatabaseName &&
-      oldProps.DatabaseName !== props.DatabaseName
-    ) {
-      // Revoke from old database
-      sql.push(
-        `REVOKE ALL PRIVILEGES ON \`${oldProps.DatabaseName}\`.* FROM '${resourceId}'@'%'`
-      )
-    }
-
-    if (props?.DatabaseName) {
-      sql.push(
-        `GRANT ALL PRIVILEGES ON \`${props.DatabaseName}\`.* TO '${resourceId}'@'%'`
-      )
-    }
-
-    if (sql.length > 0) {
-      sql.push("FLUSH PRIVILEGES")
-    }
-
-    return sql
-  }
-
-  async deleteRole(resourceId: string, props: EngineRoleProperties): Promise<string[]> {
-    const sql: string[] = []
-
-    if (props?.DatabaseName) {
-      sql.push(
-        `REVOKE ALL PRIVILEGES ON \`${props.DatabaseName}\`.* FROM '${resourceId}'@'%'`
-      )
-    }
-
-    sql.push(`DROP USER IF EXISTS '${resourceId}'@'%'`)
-    sql.push("FLUSH PRIVILEGES")
-
-    return sql
-  }
-
-  createSchema(_resourceId: string, _props: EngineSchemaProperties): string[] {
-    throw new Error("Schemas are not supported in MySQL/MariaDB")
-  }
-
-  updateSchema(
-    _resourceId: string,
-    _oldResourceId: string,
-    _props: EngineSchemaProperties
-  ): string[] {
-    throw new Error("Schemas are not supported in MySQL/MariaDB")
-  }
-
-  deleteSchema(_resourceId: string, _props: EngineSchemaProperties): string[] {
-    throw new Error("Schemas are not supported in MySQL/MariaDB")
-  }
-
-  createSql(_resourceId: string, props: EngineSqlProperties): string {
-    return props?.Statement || ""
-  }
-
-  updateSql(
-    _resourceId: string,
-    _oldResourceId: string,
-    props: EngineSqlProperties
-  ): string {
-    return props?.Statement || ""
-  }
-
-  deleteSql(_resourceId: string, props: EngineSqlProperties): string {
-    return props?.Rollback || ""
-  }
-
-  createIamGrant(
-    _resourceId: string,
-    _props: EngineIamGrantProperties
-  ): string | string[] {
-    throw new Error("IAM grants are only supported with DSQL clusters")
-  }
-
-  updateIamGrant(
-    _resourceId: string,
-    _oldResourceId: string,
-    _props: EngineIamGrantProperties,
-    _oldProps: EngineIamGrantProperties
-  ): string | string[] {
-    throw new Error("IAM grants are only supported with DSQL clusters")
-  }
-
-  deleteIamGrant(
-    _resourceId: string,
-    _props: EngineIamGrantProperties
-  ): string | string[] {
-    throw new Error("IAM grants are only supported with DSQL clusters")
-  }
-
-  async executeSQL(sql: string | string[], config: EngineConnectionConfig): Promise<any> {
-    // Dynamic import to avoid bundling issues
-    const { createConnection } = await import("mysql2/promise")
-
-    const isSslEnabled = process.env.SSL ? JSON.parse(process.env.SSL) : true
-
-    const sslOptions = isSslEnabled
-      ? {
-          ssl: {
-            ca: fs.readFileSync(`${process.env.LAMBDA_TASK_ROOT}/global-bundle.pem`),
-            rejectUnauthorized: true,
-          },
-        }
-      : {}
-
-    const connectionConfig = {
-      host: config.host,
-      port: config.port,
-      user: config.user,
-      password: config.password,
-      database: config.database,
-      connectTimeout: 30000,
-      multipleStatements: true,
-      ...sslOptions,
-    }
-
-    this.log(
-      `Connecting to MySQL/MariaDB host ${connectionConfig.host}:${
-        connectionConfig.port
-      }${isSslEnabled ? " using a secure connection" : ""}, database ${
-        connectionConfig.database
-      } as ${connectionConfig.user}`
-    )
-    this.log("Executing SQL", sql)
-
-    const connection = await createConnection(connectionConfig)
-    try {
-      if (typeof sql === "string") {
-        return await connection.query(sql)
-      } else if (sql) {
-        return await Promise.all(sql.map((statement) => connection.query(statement)))
-      }
-    } finally {
-      await connection.end()
-    }
-  }
-}

package/lambda/engine.postgresql.test.ts

@@ -1,151 +0,0 @@
-import { PostgresqlEngine } from "./engine.postgresql"
-
-describe("PostgreSQL Engine", () => {
-  let engine: PostgresqlEngine
-
-  beforeEach(() => {
-    engine = new PostgresqlEngine()
-  })
-
-  describe("Role", () => {
-    it("should generate SQL to revoke privileges on old database when database is changed", async () => {
-      // Mock getPassword implementation
-      jest.spyOn(engine as any, "getPassword").mockResolvedValue("test-password")
-
-      const oldProps = {
-        DatabaseName: "olddb",
-        PasswordArn: "arn:aws:secretsmanager:region:account:secret:name",
-      }
-
-      const newProps = {
-        DatabaseName: "newdb",
-        PasswordArn: "arn:aws:secretsmanager:region:account:secret:name",
-      }
-
-      const sql = await engine.updateRole("testrole", "testrole", newProps, oldProps)
-
-      expect(Array.isArray(sql)).toBe(true)
-
-      // Check for transaction start
-      expect(sql[0]).toBe("start transaction")
-
-      // Find the revoke statement for the old database
-      const revokeStatement = sql.find(
-        (statement) =>
-          statement.includes("revoke connect on database") && statement.includes("olddb")
-      )
-      expect(revokeStatement).toBeDefined()
-
-      // Check for grant statement for the new database
-      const grantStatement = sql.find(
-        (statement) =>
-          statement.includes("grant connect on database") && statement.includes("newdb")
-      )
-      expect(grantStatement).toBeDefined()
-
-      // Check for transaction commit
-      expect(sql[sql.length - 1]).toBe("commit")
-    })
-
-    describe("IAM Authentication", () => {
-      it("should create role with IAM authentication", async () => {
-        const props = {
-          EnableIamAuth: true,
-          DatabaseName: "testdb",
-        }
-
-        const sql = await engine.createRole("iamrole", props)
-
-        expect(Array.isArray(sql)).toBe(true)
-        expect(sql[0]).toBe("start transaction")
-        expect(sql).toContain("create role iamrole with login")
-        expect(sql).toContain("grant rds_iam to iamrole")
-        expect(sql[sql.length - 1]).toBe("commit")
-      })
-
-      it("should create role without IAM authentication", async () => {
-        jest.spyOn(engine as any, "getPassword").mockResolvedValue("test-password")
-
-        const props = {
-          EnableIamAuth: false,
-          PasswordArn: "arn:aws:secretsmanager:region:account:secret:name",
-          DatabaseName: "testdb",
-        }
-
-        const sql = await engine.createRole("passwordrole", props)
-
-        expect(Array.isArray(sql)).toBe(true)
-        expect(sql[0]).toBe("start transaction")
-        expect(sql).toContain(
-          "create role passwordrole with login password 'test-password'"
-        )
-        expect(sql[sql.length - 1]).toBe("commit")
-      })
-
-      it("should switch from password to IAM authentication", async () => {
-        const oldProps = {
-          EnableIamAuth: false,
-          PasswordArn: "arn:aws:secretsmanager:region:account:secret:name",
-        }
-
-        const newProps = {
-          EnableIamAuth: true,
-        }
-
-        const sql = await engine.updateRole(
-          "switchrole",
-          "switchrole",
-          newProps,
-          oldProps
-        )
-
-        expect(Array.isArray(sql)).toBe(true)
-        expect(sql[0]).toBe("start transaction")
-        expect(sql).toContain("grant rds_iam to switchrole")
-        expect(sql[sql.length - 1]).toBe("commit")
-      })
-
-      it("should switch from IAM to password authentication", async () => {
-        jest.spyOn(engine as any, "getPassword").mockResolvedValue("new-password")
-
-        const oldProps = {
-          EnableIamAuth: true,
-        }
-
-        const newProps = {
-          EnableIamAuth: false,
-          PasswordArn: "arn:aws:secretsmanager:region:account:secret:name",
-        }
-
-        const sql = await engine.updateRole(
-          "switchrole",
-          "switchrole",
-          newProps,
-          oldProps
-        )
-
-        expect(Array.isArray(sql)).toBe(true)
-        expect(sql[0]).toBe("start transaction")
-        expect(sql).toContain("revoke rds_iam from switchrole")
-        expect(sql).toContain("alter role switchrole with password 'new-password'")
-        expect(sql[sql.length - 1]).toBe("commit")
-      })
-    })
-  })
-
-  // Add basic tests for other PostgreSQL functionality
-  describe("Database", () => {
-    it("should generate correct SQL for creating a database", () => {
-      const sql = engine.createDatabase("testdb", {})
-      expect(sql).toContain("create database testdb")
-    })
-  })
-
-  describe("SQL", () => {
-    it("should pass through SQL statements", () => {
-      const statement = "SELECT * FROM users"
-      const sql = engine.createSql("test", { Statement: statement })
-      expect(sql).toBe(statement)
-    })
-  })
-})