cdk-rds-sql 7.3.1 → 7.3.2

package/lambda/engine.postgresql.ts

@@ -1,329 +0,0 @@
-import * as fs from "fs"
-import { ConnectionOptions } from "tls"
-import { format as pgFormat } from "node-pg-format"
-import { Client, ClientConfig } from "pg"
-import { AbstractEngine, EngineConnectionConfig } from "./engine.abstract"
-import {
-  EngineDatabaseProperties,
-  EngineRoleProperties,
-  EngineSchemaProperties,
-  EngineSqlProperties,
-} from "./types"
-
-export class PostgresqlEngine extends AbstractEngine {
-  createDatabase(resourceId: string, props: EngineDatabaseProperties): string | string[] {
-    const owner = props?.Owner
-    if (owner) {
-      return [
-        pgFormat("create database %I", resourceId),
-        pgFormat("alter database %I owner to %I", resourceId, owner),
-      ]
-    } else {
-      return pgFormat("create database %I", resourceId)
-    }
-  }
-
-  updateDatabase(
-    resourceId: string,
-    oldResourceId: string,
-    props: EngineDatabaseProperties
-  ): string[] {
-    const statements: string[] = []
-    if (resourceId !== oldResourceId) {
-      if (props?.MasterOwner) {
-        statements.push(
-          pgFormat("alter database %I owner to %I", oldResourceId, props.MasterOwner)
-        )
-      }
-      statements.push(
-        pgFormat("alter database %I rename to %I", oldResourceId, resourceId)
-      )
-    }
-    const owner = props?.Owner
-    if (owner) {
-      statements.push(pgFormat("alter database %I owner to %I", resourceId, props.Owner))
-    }
-    return statements
-  }
-
-  deleteDatabase(resourceId: string, masterUser: string): string[] {
-    return [
-      pgFormat(
-        "select pg_terminate_backend(pg_stat_activity.pid) from pg_stat_activity where datname = %L",
-        resourceId
-      ),
-      pgFormat(
-        "DO $$BEGIN\nIF EXISTS (select from pg_database WHERE datname = '%s') THEN alter database %I owner to %I; END IF;\nEND$$;",
-        resourceId,
-        resourceId,
-        masterUser
-      ),
-      pgFormat("drop database if exists %I", resourceId),
-    ]
-  }
-
-  async createRole(resourceId: string, props: EngineRoleProperties): Promise<string[]> {
-    const sql = ["start transaction"]
-
-    if (props?.EnableIamAuth) {
-      // Create role for IAM authentication
-      sql.push(pgFormat("create role %I with login", resourceId))
-      sql.push(pgFormat("grant rds_iam to %I", resourceId))
-    } else {
-      // Create role with password authentication
-      if (!props?.PasswordArn) throw "No PasswordArn provided"
-      const password = await this.getPassword(props.PasswordArn)
-      if (!password) {
-        throw `Cannot parse password from ${props.PasswordArn}`
-      }
-      sql.push(pgFormat("create role %I with login password %L", resourceId, password))
-    }
-
-    if (props?.DatabaseName) {
-      sql.push(
-        pgFormat(
-          `DO $$
-BEGIN
-  IF EXISTS (select from pg_database where datname = '%s' and datistemplate = false) THEN
-    grant connect on database %I to %I;
-  END IF;
-END$$;`,
-          props.DatabaseName,
-          props.DatabaseName,
-          resourceId
-        )
-      )
-    }
-
-    sql.push("commit")
-    return sql
-  }
-
-  async updateRole(
-    resourceId: string,
-    oldResourceId: string,
-    props: EngineRoleProperties,
-    oldProps: EngineRoleProperties
-  ): Promise<string[]> {
-    const sql = ["start transaction"]
-
-    if (oldResourceId !== resourceId) {
-      sql.push(pgFormat("alter role %I rename to %I", oldResourceId, resourceId))
-    }
-
-    // Handle authentication method changes
-    if (props?.EnableIamAuth && !oldProps?.EnableIamAuth) {
-      // Switching from password to IAM auth
-      sql.push(pgFormat("grant rds_iam to %I", resourceId))
-    } else if (!props?.EnableIamAuth && oldProps?.EnableIamAuth) {
-      // Switching from IAM to password auth
-      sql.push(pgFormat("revoke rds_iam from %I", resourceId))
-      if (props?.PasswordArn) {
-        const password = await this.getPassword(props.PasswordArn)
-        if (!password) {
-          throw `Cannot parse password from ${props.PasswordArn}`
-        }
-        sql.push(pgFormat("alter role %I with password %L", resourceId, password))
-      }
-    } else if (!props?.EnableIamAuth && props?.PasswordArn) {
-      // Update password for password auth
-      const password = await this.getPassword(props.PasswordArn)
-      if (!password) {
-        throw `Cannot parse password from ${props.PasswordArn}`
-      }
-      sql.push(pgFormat("alter role %I with password %L", resourceId, password))
-    }
-
-    // Check if database name has changed
-    if (
-      oldProps?.DatabaseName &&
-      props?.DatabaseName &&
-      oldProps.DatabaseName !== props.DatabaseName
-    ) {
-      // Revoke from old database
-      sql.push(
-        pgFormat(
-          `DO $$
-BEGIN
-  IF EXISTS (select from pg_database where datname = '%s' and datistemplate = false) THEN
-    revoke connect on database %I from %I;
-  END IF;
-END$$;`,
-          oldProps.DatabaseName,
-          oldProps.DatabaseName,
-          resourceId
-        )
-      )
-    }
-
-    if (props?.DatabaseName) {
-      sql.push(
-        pgFormat(
-          `DO $$
-BEGIN
-  IF EXISTS (select from pg_database where datname = '%s' and datistemplate = false) THEN
-    grant connect on database %I to %I;
-  END IF;
-END$$;`,
-          props.DatabaseName,
-          props.DatabaseName,
-          resourceId
-        )
-      )
-    }
-
-    sql.push("commit")
-    return sql
-  }
-
-  async deleteRole(resourceId: string, props: EngineRoleProperties): Promise<string[]> {
-    return [
-      "start transaction",
-      pgFormat(
-        `DO $$
-BEGIN
-  IF EXISTS (select from pg_catalog.pg_roles WHERE rolname = '%s') AND EXISTS (select from pg_database WHERE datname = '%s') THEN
-    revoke all privileges on database %I from %I;
-  END IF;
-END$$;`,
-        resourceId,
-        props?.DatabaseName,
-        props?.DatabaseName,
-        resourceId
-      ),
-      pgFormat("drop role if exists %I", resourceId),
-      "commit",
-    ]
-  }
-
-  createSchema(resourceId: string, props: EngineSchemaProperties): string[] {
-    const sql: string[] = [pgFormat("create schema if not exists %I", resourceId)]
-    if (props?.RoleName) {
-      this.grantRoleForSchema(resourceId, props.RoleName).forEach((stmt) =>
-        sql.push(stmt)
-      )
-    }
-    return sql
-  }
-
-  updateSchema(
-    resourceId: string,
-    oldResourceId: string,
-    props: EngineSchemaProperties
-  ): string[] {
-    const sql: string[] = []
-    if (props?.RoleName) {
-      this.revokeRoleFromSchema(oldResourceId, props.RoleName).forEach((stmt) =>
-        sql.push(stmt)
-      )
-    }
-    sql.push(pgFormat("alter schema %I rename to %I", oldResourceId, resourceId))
-    if (props?.RoleName) {
-      this.grantRoleForSchema(resourceId, props.RoleName).forEach((stmt) =>
-        sql.push(stmt)
-      )
-    }
-    return sql
-  }
-
-  deleteSchema(resourceId: string, props: EngineSchemaProperties): string[] {
-    const sql: string[] = []
-    if (props?.RoleName) {
-      this.revokeRoleFromSchema(resourceId, props.RoleName).forEach((stmt) =>
-        sql.push(stmt)
-      )
-    }
-    sql.push(pgFormat("drop schema if exists %I cascade", resourceId))
-    return sql
-  }
-
-  createSql(_resourceId: string, props: EngineSqlProperties): string {
-    return props?.Statement || ""
-  }
-
-  updateSql(
-    _resourceId: string,
-    _oldResourceId: string,
-    props: EngineSqlProperties
-  ): string {
-    return props?.Statement || ""
-  }
-
-  deleteSql(_resourceId: string, props: EngineSqlProperties): string {
-    return props?.Rollback || ""
-  }
-
-  private grantRoleForSchema(schema: string, roleName: string): string[] {
-    return [
-      pgFormat("GRANT USAGE ON SCHEMA %I TO %I", schema, roleName),
-      pgFormat("GRANT CREATE ON SCHEMA %I TO %I", schema, roleName),
-    ]
-  }
-
-  private revokeRoleFromSchema(schema: string, roleName: string): string[] {
-    return [
-      pgFormat("REVOKE CREATE ON SCHEMA %I FROM %I", schema, roleName),
-      pgFormat("REVOKE ALL ON SCHEMA %I FROM %I", schema, roleName),
-    ]
-  }
-
-  createIamGrant(_roleName: string, _iamArn: string): string | string[] {
-    throw new Error("IAM grants are only supported with DSQL clusters")
-  }
-
-  updateIamGrant(
-    _roleName: string,
-    _oldRoleName: string,
-    _iamArn: string,
-    _oldIamArn: string
-  ): string | string[] {
-    throw new Error("IAM grants are only supported with DSQL clusters")
-  }
-
-  deleteIamGrant(_roleName: string, _iamArn: string): string | string[] {
-    throw new Error("IAM grants are only supported with DSQL clusters")
-  }
-
-  async executeSQL(sql: string | string[], config: EngineConnectionConfig): Promise<any> {
-    const isSslEnabled = process.env.SSL ? JSON.parse(process.env.SSL) : true
-    const ssl: ConnectionOptions | false = isSslEnabled
-      ? {
-          ca: fs.readFileSync(`${process.env.LAMBDA_TASK_ROOT}/global-bundle.pem`),
-          rejectUnauthorized: true,
-        }
-      : false
-
-    const params: ClientConfig = {
-      host: config.host,
-      port: config.port,
-      user: config.user,
-      password: config.password,
-      database: config.database,
-      connectionTimeoutMillis: Number(process.env.CONNECTION_TIMEOUT) ?? 30000,
-      ssl,
-    }
-
-    this.log(
-      `Connecting to PostgreSQL host ${params.host}:${params.port}${
-        ssl ? " using a secure connection" : ""
-      }, database ${params.database} as ${params.user}`
-    )
-    this.log("Executing SQL", sql)
-
-    const pg_client = new Client(params)
-    await pg_client.connect()
-    try {
-      if (typeof sql === "string") {
-        await pg_client.query(sql)
-      } else if (sql) {
-        await Promise.all(
-          sql.map((statement) => {
-            return pg_client.query(statement)
-          })
-        )
-      }
-    } finally {
-      await pg_client.end()
-    }
-  }
-}

package/lambda/handler.mysql.test.ts

@@ -1,349 +0,0 @@
-import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager"
-import { createConnection } from "mysql2/promise"
-import { GenericContainer, StartedTestContainer } from "testcontainers"
-import { handler } from "./handler"
-import { createRequest, updateRequest, deleteRequest } from "./util"
-
-jest.mock("@aws-sdk/client-secrets-manager")
-const SecretsManagerClientMock = SecretsManagerClient as jest.MockedClass<
-  typeof SecretsManagerClient
->
-
-const DB_PORT = 3306
-const DB_MASTER_USERNAME = "root"
-const DB_MASTER_PASSWORD = "masterpwd"
-const DB_DEFAULT_DB = "dummy"
-
-let mysqlContainer: StartedTestContainer
-let mysqlHost: string
-let mysqlPort: number
-
-beforeAll(async () => {
-  process.env.LOGGER = "true"
-  process.env.SSL = "false"
-  process.env.CONNECTION_TIMEOUT = "5000"
-  mysqlContainer = await new GenericContainer("mysql:8")
-    .withExposedPorts(DB_PORT)
-    .withEnvironment({
-      MYSQL_ROOT_PASSWORD: DB_MASTER_PASSWORD,
-      MYSQL_DATABASE: DB_DEFAULT_DB,
-      MYSQL_INITDB_SKIP_TZINFO: "true",
-    })
-    .start()
-  mysqlHost = mysqlContainer.getHost()
-  mysqlPort = mysqlContainer.getMappedPort(DB_PORT)
-
-  // Set up the mock after we have the host and port values
-  SecretsManagerClientMock.prototype.send.mockImplementation(() => {
-    return {
-      SecretString: JSON.stringify({
-        host: mysqlHost,
-        port: mysqlPort,
-        username: DB_MASTER_USERNAME,
-        password: DB_MASTER_PASSWORD,
-        dbname: DB_DEFAULT_DB,
-        engine: "mysql",
-        dbClusterIdentifier: "dummy",
-      }),
-    }
-  })
-}, 60000)
-
-afterAll(async () => {
-  if (mysqlContainer) {
-    await mysqlContainer.stop()
-  }
-})
-
-beforeEach(async () => {
-  jest.clearAllMocks()
-
-  // Clean up databases and users created by tests
-  const connection = await newConnection()
-
-  try {
-    // Drop all databases except system ones and default
-    const [databases] = await connection.query(
-      "SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA WHERE SCHEMA_NAME NOT IN ('information_schema', 'mysql', 'performance_schema', 'sys', ?)",
-      [DB_DEFAULT_DB]
-    )
-
-    for (const db of databases) {
-      await connection.query(`DROP DATABASE IF EXISTS \`${db.SCHEMA_NAME}\``)
-    }
-
-    // Drop all users except system ones
-    const [users] = await connection.query(
-      "SELECT User FROM mysql.user WHERE User NOT IN ('mysql.sys', 'mysql.session', 'mysql.infoschema', 'root')"
-    )
-
-    for (const user of users) {
-      await connection.query(`DROP USER IF EXISTS '${user.User}'@'%'`)
-    }
-  } finally {
-    await connection.end()
-  }
-})
-
-// Helper functions for MySQL tests
-async function databaseExists(connection: any, dbName: string): Promise<boolean> {
-  const [rows] = await connection.query(
-    "SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA WHERE SCHEMA_NAME = ?",
-    [dbName]
-  )
-  return rows.length > 0
-}
-
-async function userExists(connection: any, username: string): Promise<boolean> {
-  const [rows] = await connection.query("SELECT User FROM mysql.user WHERE User = ?", [
-    username,
-  ])
-  return rows.length > 0
-}
-
-async function tableExists(
-  connection: any,
-  dbName: string,
-  tableName: string
-): Promise<boolean> {
-  const [rows] = await connection.query(
-    "SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA = ? AND TABLE_NAME = ?",
-    [dbName, tableName]
-  )
-  return rows.length > 0
-}
-
-async function rowCount(connection: any, tableName: string): Promise<number> {
-  const [rows] = await connection.query(`SELECT COUNT(*) as count FROM ${tableName}`)
-  return rows[0].count
-}
-
-async function newConnection(config?: any): Promise<any> {
-  const conn = await createConnection({
-    host: mysqlHost,
-    port: mysqlPort,
-    database: config && config.database ? config.database : DB_DEFAULT_DB,
-    user: config && config.user ? config.user : DB_MASTER_USERNAME,
-    password: config && config.password ? config.password : DB_MASTER_PASSWORD,
-  })
-  return conn
-}
-
-test("database", async () => {
-  const oldDatabaseName = "mydb"
-  const newDatabaseName = "mydb2"
-  const create = createRequest("database", oldDatabaseName)
-  await handler(create)
-  expect(SecretsManagerClientMock.prototype.send).toHaveBeenCalledTimes(1)
-  const connection = await newConnection()
-  try {
-    expect(await databaseExists(connection, oldDatabaseName)).toEqual(true)
-
-    const update = updateRequest("database", oldDatabaseName, newDatabaseName)
-    await expect(handler(update)).rejects.toThrow(
-      "Renaming database is not supported in MySQL."
-    )
-
-    const remove = deleteRequest("database", oldDatabaseName)
-    await handler(remove)
-    expect(await databaseExists(connection, newDatabaseName)).toEqual(false)
-  } finally {
-    await connection.end()
-  }
-})
-
-test("database with owner", async () => {
-  const databaseName = "mydb"
-  const userName = "example"
-
-  // First create user
-  const create_role = createRequest("role", userName, {
-    PasswordArn: "arn:aws:secretsmanager:us-east-1:123456789:secret:dummy",
-  })
-  await handler(create_role)
-
-  // Then create database with owner
-  const create_db = createRequest("database", databaseName, { Owner: userName })
-  await handler(create_db)
-
-  const connection = await newConnection()
-  try {
-    expect(await databaseExists(connection, databaseName)).toEqual(true)
-
-    // Create a table in the new database
-    const create_table = createRequest("sql", "", {
-      DatabaseName: databaseName,
-      Statement: "CREATE TABLE t(i INT)",
-    })
-    await handler(create_table)
-
-    // Verify we can login as owner and access the table
-    const userConn = await newConnection({
-      user: userName,
-      database: databaseName,
-    })
-
-    try {
-      expect(await tableExists(userConn, databaseName, "t")).toEqual(true)
-      // Test we can insert data
-      await userConn.query("INSERT INTO t VALUES (1), (2), (3)")
-      expect(await rowCount(userConn, "t")).toEqual(3)
-    } finally {
-      await userConn.end()
-    }
-
-    // Test database rename
-    const oldDatabaseName = databaseName
-    const newDatabaseName = "mydb2"
-
-    const update = updateRequest("database", oldDatabaseName, newDatabaseName, {
-      Owner: userName,
-    })
-    await expect(handler(update)).rejects.toThrow(
-      "Renaming database is not supported in MySQL."
-    )
-  } finally {
-    await connection.end()
-  }
-})
-
-describe("User creation", () => {
-  it("can create a user", async () => {
-    const oldRoleName = "testuser"
-    const newRoleName = "testuser2"
-
-    // Create role. We must specify a database as in mysql you cannot
-    // connect without a database.
-    const create = createRequest("role", oldRoleName, {
-      PasswordArn: "arn:aws:secretsmanager:us-east-1:123456789:secret:dummy",
-      DatabaseName: DB_DEFAULT_DB,
-    })
-    await handler(create)
-    expect(SecretsManagerClientMock.prototype.send).toHaveBeenCalledTimes(2)
-
-    const connection = await newConnection()
-    try {
-      expect(await userExists(connection, oldRoleName)).toEqual(true)
-
-      // Attempt to connect as this user
-      const userConn = await newConnection({
-        user: oldRoleName,
-      })
-      await userConn.end()
-
-      // Update role - rename
-      const update = updateRequest("role", oldRoleName, newRoleName, {
-        PasswordArn: "arn:aws:secretsmanager:us-east-1:123456789:secret:dummy",
-      })
-      await handler(update)
-
-      expect(await userExists(connection, oldRoleName)).toEqual(false)
-      expect(await userExists(connection, newRoleName)).toEqual(true)
-
-      // Delete role
-      const remove = deleteRequest("role", newRoleName)
-      await handler(remove)
-      expect(await userExists(connection, newRoleName)).toEqual(false)
-    } finally {
-      await connection.end()
-    }
-  })
-
-  it("can change a user's password", async () => {
-    const userName = "pwduser"
-
-    // Create user
-    const create = createRequest("role", userName, {
-      PasswordArn: "arn:aws:secretsmanager:us-east-1:123456789:secret:dummy",
-      DatabaseName: DB_DEFAULT_DB,
-    })
-    await handler(create)
-    expect(SecretsManagerClientMock.prototype.send).toHaveBeenCalledTimes(2)
-
-    const connection = await newConnection()
-    try {
-      expect(await userExists(connection, userName)).toEqual(true)
-
-      // Test we can connect with the initial password
-      const userConn = await newConnection({
-        user: userName,
-      })
-      await userConn.end()
-
-      // Update role - change password
-      const update = updateRequest("role", userName, userName, {
-        PasswordArn: "arn:aws:secretsmanager:us-east-1:123456789:secret:dummy",
-      })
-      await handler(update)
-
-      // Password changed but should still be able to connect
-      const userConn2 = await newConnection({
-        user: userName,
-      })
-      await userConn2.end()
-    } finally {
-      await connection.end()
-    }
-  })
-})
-
-test("sql execution", async () => {
-  const databaseName = "sqltest"
-
-  // Create database
-  const create_db = createRequest("database", databaseName)
-  await handler(create_db)
-
-  // Execute SQL to create table
-  const create_table = createRequest("sql", "", {
-    DatabaseName: databaseName,
-    Statement: "CREATE TABLE test_table (id INT, name VARCHAR(50))",
-  })
-  await handler(create_table)
-
-  // Execute multiple SQL statements
-  const create_multiple_tables = createRequest("sql", "", {
-    DatabaseName: databaseName,
-    Statement: "CREATE TABLE t1 (id INT); CREATE TABLE t2 (id INT);",
-  })
-  await handler(create_multiple_tables)
-
-  const connection = await newConnection({ database: databaseName })
-  try {
-    expect(await tableExists(connection, databaseName, "test_table")).toEqual(true)
-
-    // Execute SQL to insert data
-    const insert_data = createRequest("sql", "", {
-      DatabaseName: databaseName,
-      Statement: "INSERT INTO test_table VALUES (1, 'Test 1'), (2, 'Test 2')",
-    })
-    await handler(insert_data)
-
-    expect(await rowCount(connection, "test_table")).toEqual(2)
-
-    // Execute SQL with rollback for deletion test
-    const update_sql = updateRequest("sql", "dummy", "dummy", {
-      DatabaseName: databaseName,
-      Statement: "UPDATE test_table SET name = 'Updated' WHERE id = 1",
-      Rollback: "UPDATE test_table SET name = 'Test 1' WHERE id = 1",
-    })
-    await handler(update_sql)
-
-    // Verify update happened
-    const [rows] = await connection.query("SELECT name FROM test_table WHERE id = 1")
-    expect(rows[0].name).toEqual("Updated")
-
-    // Test rollback on delete
-    const delete_sql = deleteRequest("sql", "dummy", {
-      DatabaseName: databaseName,
-      Rollback: "UPDATE test_table SET name = 'Rollback test' WHERE id = 1",
-    })
-    await handler(delete_sql)
-
-    // Verify rollback executed
-    const [updated] = await connection.query("SELECT name FROM test_table WHERE id = 1")
-    expect(updated[0].name).toEqual("Rollback test")
-  } finally {
-    await connection.end()
-  }
-})