cloudmason2 1.4.0 → 1.6.0

package/commands/helpers/mime.js

@@ -0,0 +1,36 @@
+const path = require('path');
+
+const TYPES = {
+    '.html': 'text/html',
+    '.css': 'text/css',
+    '.js': 'application/javascript',
+    '.mjs': 'application/javascript',
+    '.json': 'application/json',
+    '.txt': 'text/plain',
+    '.md': 'text/markdown',
+    '.csv': 'text/csv',
+    '.xml': 'application/xml',
+    '.yaml': 'text/yaml',
+    '.yml': 'text/yaml',
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif',
+    '.svg': 'image/svg+xml',
+    '.webp': 'image/webp',
+    '.ico': 'image/x-icon',
+    '.woff': 'font/woff',
+    '.woff2': 'font/woff2',
+    '.ttf': 'font/ttf',
+    '.otf': 'font/otf',
+    '.mp4': 'video/mp4',
+    '.webm': 'video/webm',
+    '.pdf': 'application/pdf',
+    '.zip': 'application/zip',
+    '.gz': 'application/gzip'
+};
+
+// Content type from a file path or s3 key
+exports.contentType = function(p){
+    return TYPES[path.extname(p).toLowerCase()] || 'application/octet-stream';
+}

package/commands/index.html

@@ -227,6 +227,7 @@ class MasonApp extends ELMNT
             background: #ffffff;
         }
         .head:hover { background: #e8e8e8; }
+        .name { text-transform: uppercase; letter-spacing: 0.5px; }
         .count { margin-left: auto; font-size: 12px; font-weight: 400; color: #525252; }
         .chev { transition: transform 0.15s; color: #525252; }
         .open .chev { transform: rotate(180deg); }

package/commands/new_app.js

@@ -105,6 +105,25 @@ function createLocalMarketplace(){
     console.log(`Created ${destDir}`);
 }
 
+// Trust policy allowing GitHub Actions OIDC assumption from one repo.
+// Shared with update-listing's -repo trust update
+exports.githubTrustPolicy = function(oidcArn, repo){
+    return {
+        Version: "2012-10-17",
+        Statement: [
+            {
+                Effect: "Allow",
+                Principal: { Federated: oidcArn },
+                Action: "sts:AssumeRoleWithWebIdentity",
+                Condition: {
+                    StringEquals: { "token.actions.githubusercontent.com:aud": "sts.amazonaws.com" },
+                    StringLike: { "token.actions.githubusercontent.com:sub": `repo:${repo}:*` }
+                }
+            }
+        ]
+    };
+}
+
 // Create a role GitHub Actions can assume via OIDC from the given repo.
 // Permissions cover update-listing, update-app, launch, and publish - not new-app
 async function ensureGithubRole(repo, bucket, appPrefix, appName, productId){
@@ -124,20 +143,7 @@ async function ensureGithubRole(repo, bucket, appPrefix, appName, productId){
     }
 
     // Trust: only GitHub Actions workflows from this repo
-    const trustPolicy = {
-        Version: "2012-10-17",
-        Statement: [
-            {
-                Effect: "Allow",
-                Principal: { Federated: oidcArn },
-                Action: "sts:AssumeRoleWithWebIdentity",
-                Condition: {
-                    StringEquals: { "token.actions.githubusercontent.com:aud": "sts.amazonaws.com" },
-                    StringLike: { "token.actions.githubusercontent.com:sub": `repo:${repo}:*` }
-                }
-            }
-        ]
-    };
+    const trustPolicy = exports.githubTrustPolicy(oidcArn, repo);
     const created = await iam.send(new CreateRoleCommand({
         RoleName: roleName,
         AssumeRolePolicyDocument: JSON.stringify(trustPolicy),

package/commands/publish.js

@@ -3,6 +3,7 @@ const { S3Client, PutObjectCommand, GetObjectCommand } = require("@aws-sdk/clien
 const { SSMClient, GetParameterCommand } = require("@aws-sdk/client-ssm");
 const OrgConfig = require('./helpers/org_config');
 const Apps = require('./helpers/apps');
+const Mime = require('./helpers/mime');
 
 // The Marketplace Catalog API is only available in us-east-1
 const CATALOG_REGION = 'us-east-1';
@@ -53,7 +54,7 @@ exports.main = async function(args){
     const amiAlias = `resolve:ssm:/aws/service/marketplace/${manifest.productId}/${fullVersion}`;
     const upgradeText = buildUpgradeTemplate(stackText, amiAlias);
     const upgradeKey = `${appPrefix}/versions/${vFolder}/upgrade.yaml`;
-    await s3.send(new PutObjectCommand({ Bucket: bucket, Key: upgradeKey, Body: upgradeText }));
+    await s3.send(new PutObjectCommand({ Bucket: bucket, Key: upgradeKey, Body: upgradeText, ContentType: Mime.contentType(upgradeKey) }));
     console.log(`Uploaded upgrade template s3://${bucket}/${upgradeKey}`);
 
     // --- III START CHANGE SET ---

package/commands/update_app.js

@@ -5,6 +5,7 @@ const { S3Client, PutObjectCommand, GetObjectCommand } = require("@aws-sdk/clien
 const { EC2Client, DescribeRegionsCommand, DescribeImagesCommand, DeregisterImageCommand, DeleteSnapshotCommand } = require("@aws-sdk/client-ec2");
 const OrgConfig = require('./helpers/org_config');
 const Apps = require('./helpers/apps');
+const Mime = require('./helpers/mime');
 const { buildAMI } = require('./ssh_build');
 
 exports.main = async function(args){
@@ -93,7 +94,7 @@ exports.main = async function(args){
             console.log('No AmiId parameter found in stack. Template unchanged');
         }
     }
-    await s3.send(new PutObjectCommand({ Bucket: bucket, Key: stackKey, Body: finalStack }));
+    await s3.send(new PutObjectCommand({ Bucket: bucket, Key: stackKey, Body: finalStack, ContentType: Mime.contentType(stackKey) }));
     console.log(`Uploaded s3://${bucket}/${stackKey}`);
 
     // --- V UPDATE MANIFEST ---
@@ -162,7 +163,8 @@ async function uploadFile(s3, bucket, key, localPath){
     await s3.send(new PutObjectCommand({
         Bucket: bucket,
         Key: key,
-        Body: fs.createReadStream(localPath)
+        Body: fs.createReadStream(localPath),
+        ContentType: Mime.contentType(key)
     }));
 }
 

package/commands/update_assets.js

@@ -3,14 +3,7 @@ const path = require('path');
 const { S3Client, PutObjectCommand } = require("@aws-sdk/client-s3");
 const OrgConfig = require('./helpers/org_config');
 const Apps = require('./helpers/apps');
-
-const CONTENT_TYPES = {
-    '.html': 'text/html', '.css': 'text/css', '.js': 'application/javascript',
-    '.json': 'application/json', '.txt': 'text/plain', '.md': 'text/markdown',
-    '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg', '.gif': 'image/gif',
-    '.svg': 'image/svg+xml', '.ico': 'image/x-icon', '.csv': 'text/csv',
-    '.yaml': 'text/yaml', '.yml': 'text/yaml', '.zip': 'application/zip', '.pdf': 'application/pdf'
-};
+const Mime = require('./helpers/mime');
 
 // update-assets: upload a file or folder to the app's cdn folder
 exports.main = async function(args){
@@ -45,7 +38,7 @@ exports.main = async function(args){
             Bucket: bucket,
             Key: key,
             Body: fs.createReadStream(f),
-            ContentType: CONTENT_TYPES[path.extname(f).toLowerCase()] || 'application/octet-stream'
+            ContentType: Mime.contentType(f)
         }));
         console.log(`Uploaded s3://${bucket}/${key}`);
         uploaded += 1;

package/commands/update_listing.js

@@ -1,8 +1,12 @@
 const fs = require('fs');
 const path = require('path');
 const { S3Client, PutObjectCommand } = require("@aws-sdk/client-s3");
+const { IAMClient, GetRoleCommand, UpdateAssumeRolePolicyCommand } = require("@aws-sdk/client-iam");
+const { STSClient, GetCallerIdentityCommand } = require("@aws-sdk/client-sts");
 const OrgConfig = require('./helpers/org_config');
 const Apps = require('./helpers/apps');
+const Mime = require('./helpers/mime');
+const { githubTrustPolicy } = require('./new_app');
 
 // Marketplace listing text files stored as top-level manifest attributes.
 // Names match the keys the AWS Marketplace Catalog API expects
@@ -26,25 +30,32 @@ exports.main = async function(args){
     if (!app){ throw new Error('No app named ' + args.app + '. Run new-app') }
     const { appPrefix, manifest } = app;
 
-    if (!args.assets && !args.pid && !args.ec2){
-        console.log('Nothing to update. Pass -assets, -pid, or -ec2');
+    if (!args.assets && !args.pid && !args.ec2 && !args.repo){
+        console.log('Nothing to update. Pass -assets, -pid, -ec2, or -repo');
         return true;
     }
 
     // Apply all manifest updates in one download/update/upload pass
-    if (args.assets){
-        await applyAssets(s3, bucket, appPrefix, cfg.region, args.assets, manifest);
-    }
-    if (args.pid){
-        manifest.productId = args.pid;
-        console.log('Set productId');
+    if (args.assets || args.pid || args.ec2){
+        if (args.assets){
+            await applyAssets(s3, bucket, appPrefix, cfg.region, args.assets, manifest);
+        }
+        if (args.pid){
+            manifest.productId = args.pid;
+            console.log('Set productId');
+        }
+        if (args.ec2){
+            manifest.RecommendedInstanceType = args.ec2;
+            console.log('Set RecommendedInstanceType');
+        }
+        await putManifest(s3, bucket, appPrefix, manifest);
+        console.log('Updated manifest');
     }
-    if (args.ec2){
-        manifest.RecommendedInstanceType = args.ec2;
-        console.log('Set RecommendedInstanceType');
+
+    // Replace the CI role trust policy with one for the updated repo
+    if (args.repo){
+        await updateRepoTrust(appName, args.repo);
     }
-    await putManifest(s3, bucket, appPrefix, manifest);
-    console.log('Updated manifest');
     return true;
 }
 
@@ -107,13 +118,35 @@ async function applyAssets(s3, bucket, appPrefix, region, assetsPath, manifest){
             Bucket: bucket,
             Key: key,
             Body: fs.createReadStream(imgPath),
-            ContentType: 'image/png'
+            ContentType: Mime.contentType(img.file)
         }));
         manifest[img.attr] = `https://${bucket}.s3.${region}.amazonaws.com/${key}`;
         console.log(`Uploaded ${img.file}: ${manifest[img.attr]}`);
     }
 }
 
+async function updateRepoTrust(appName, repo){
+    if (!/^[\w.-]+\/[\w.-]+$/.test(repo)){ throw new Error('Invalid repo. Use org/repo format') }
+    const roleName = `mason-gha-${appName}`;
+    const iam = new IAMClient({ region: 'us-east-1' });
+    const sts = new STSClient({ region: 'us-east-1' });
+
+    try {
+        await iam.send(new GetRoleCommand({ RoleName: roleName }));
+    } catch (e){
+        if (/NoSuchEntity/.test(e)){ throw new Error(`No CI role ${roleName} found. Run new-app with -repo first`) }
+        throw e;
+    }
+
+    const accountId = (await sts.send(new GetCallerIdentityCommand({}))).Account;
+    const oidcArn = `arn:aws:iam::${accountId}:oidc-provider/token.actions.githubusercontent.com`;
+    await iam.send(new UpdateAssumeRolePolicyCommand({
+        RoleName: roleName,
+        PolicyDocument: JSON.stringify(githubTrustPolicy(oidcArn, repo))
+    }));
+    console.log(`Updated ${roleName} trust policy to repo ${repo}`);
+}
+
 async function putManifest(s3, bucket, appPrefix, manifest){
     await s3.send(new PutObjectCommand({
         Bucket: bucket,

package/main.js

@@ -39,7 +39,8 @@ const Commands = {
             {n: 'app', desc: 'Name of existing app', pattern: `^[A-Za-z]{2,20}$`, r: true},
             {n: 'assets', desc: 'Path to folder with application assets', r: false},
             {n: 'pid', desc: 'AWS Product ID', r: false},
-            {n: 'ec2', desc: 'Instance type (default r8g.medium)', r: false}
+            {n: 'ec2', desc: 'Instance type (default r8g.medium)', r: false},
+            {n: 'repo', desc: 'GitHub repo (org/repo). Replaces the CI role trust policy with this repo', r: false}
         ]
     },
     'update-assets': {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudmason2",
-  "version": "1.4.0",
+  "version": "1.6.0",
   "description": "",
   "main": "main.js",
   "files": [