effortless-aws 0.33.0 → 0.34.0

package/dist/{chunk-HGSMOO4A.js → chunk-6HFS224S.js}

@@ -233,9 +233,6 @@ var createTableClient = (tableName, options) => {
   };
 };
 
-// src/handlers/auth.ts
-import * as crypto from "crypto";
-
 // src/handlers/handler-options.ts
 var toSeconds = (d) => {
   if (typeof d === "number") return d;
@@ -250,10 +247,35 @@ var toSeconds = (d) => {
 };
 
 // src/handlers/auth.ts
+import * as crypto from "crypto";
+var cfBase64Encode = (buffer) => buffer.toString("base64").replace(/\+/g, "-").replace(/=/g, "_").replace(/\//g, "~");
+var signCfCookies = (policy, config) => {
+  const ttlSeconds = toSeconds(policy.ttl);
+  const expireTime = Math.floor(Date.now() / 1e3) + ttlSeconds;
+  const resource = config.domain === "*" ? `https://*${policy.path}` : `https://${config.domain}${policy.path}`;
+  const policyJson = JSON.stringify({
+    Statement: [{
+      Resource: resource,
+      Condition: {
+        DateLessThan: { "AWS:EpochTime": expireTime }
+      }
+    }]
+  });
+  const policyBase64 = cfBase64Encode(Buffer.from(policyJson, "utf-8"));
+  const signature = cfBase64Encode(
+    crypto.sign("sha1", Buffer.from(policyJson, "utf-8"), config.privateKey)
+  );
+  const cookieAttrs = `; Secure; SameSite=Lax; Path=/; Max-Age=${ttlSeconds}`;
+  return [
+    `CloudFront-Policy=${policyBase64}${cookieAttrs}`,
+    `CloudFront-Signature=${signature}${cookieAttrs}`,
+    `CloudFront-Key-Pair-Id=${config.keyPairId}${cookieAttrs}`
+  ];
+};
 var AUTH_COOKIE_NAME = "__eff_session";
-var createAuthRuntime = (secret, defaultExpiresIn, apiTokenVerify, apiTokenHeader, apiTokenCacheTtlSeconds) => {
+var createAuthRuntime = (secret, defaultExpiresIn, apiTokenVerify, apiTokenHeader, apiTokenCacheTtlSeconds, cfSigningConfig) => {
   const tokenCache = apiTokenCacheTtlSeconds ? /* @__PURE__ */ new Map() : void 0;
-  const sign = (payload) => crypto.createHmac("sha256", secret).update(payload).digest("base64url");
+  const sign2 = (payload) => crypto.createHmac("sha256", secret).update(payload).digest("base64url");
   const cookieBase = `${AUTH_COOKIE_NAME}=`;
   const cookieAttrs = "; HttpOnly; Secure; SameSite=Lax; Path=/";
   const decodeSession = (cookieValue) => {
@@ -262,7 +284,7 @@ var createAuthRuntime = (secret, defaultExpiresIn, apiTokenVerify, apiTokenHeade
     if (dot === -1) return void 0;
     const payload = cookieValue.slice(0, dot);
     const sig = cookieValue.slice(dot + 1);
-    if (sign(payload) !== sig) return void 0;
+    if (sign2(payload) !== sig) return void 0;
     try {
       const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf-8"));
       if (parsed.exp <= Math.floor(Date.now() / 1e3)) return void 0;
@@ -284,13 +306,16 @@ var createAuthRuntime = (secret, defaultExpiresIn, apiTokenVerify, apiTokenHeade
       const seconds = options?.expiresIn ? toSeconds(options.expiresIn) : defaultExpiresIn;
       const exp = Math.floor(Date.now() / 1e3) + seconds;
       const payload = Buffer.from(JSON.stringify({ exp, ...data }), "utf-8").toString("base64url");
-      const sig = sign(payload);
+      const sig = sign2(payload);
+      const sessionCookie = `${cookieBase}${payload}.${sig}${cookieAttrs}; Max-Age=${seconds}`;
+      const cfCookies = options?.cdnPolicy && cfSigningConfig ? signCfCookies(options.cdnPolicy, cfSigningConfig) : void 0;
       return {
         status: 200,
         body: { ok: true },
         headers: {
-          "set-cookie": `${cookieBase}${payload}.${sig}${cookieAttrs}; Max-Age=${seconds}`
-        }
+          "set-cookie": sessionCookie
+        },
+        ...cfCookies ? { cookies: [sessionCookie, ...cfCookies] } : {}
       };
     },
     clearSession() {
@@ -327,34 +352,91 @@ var createAuthRuntime = (secret, defaultExpiresIn, apiTokenVerify, apiTokenHeade
 
 // src/runtime/bucket-client.ts
 import { S3 } from "@aws-sdk/client-s3";
-var createBucketClient = (bucketName) => {
-  let client2 = null;
-  const getClient2 = () => client2 ??= new S3({});
+var createBucketMethods = (getClient2, bucketName) => ({
+  bucketName,
+  async put(key, body, options) {
+    await getClient2().putObject({
+      Bucket: bucketName,
+      Key: key,
+      Body: typeof body === "string" ? Buffer.from(body) : body,
+      ...options?.contentType ? { ContentType: options.contentType } : {}
+    });
+  },
+  async get(key) {
+    try {
+      const result = await getClient2().getObject({
+        Bucket: bucketName,
+        Key: key
+      });
+      const chunks = [];
+      const stream = result.Body;
+      for await (const chunk of stream) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+      }
+      return {
+        body: Buffer.concat(chunks),
+        contentType: result.ContentType
+      };
+    } catch (error) {
+      if (error instanceof Error && (error.name === "NoSuchKey" || error.$metadata?.httpStatusCode === 404)) {
+        return void 0;
+      }
+      throw error;
+    }
+  },
+  async delete(key) {
+    await getClient2().deleteObject({
+      Bucket: bucketName,
+      Key: key
+    });
+  },
+  async list(prefix) {
+    const items = [];
+    let continuationToken;
+    do {
+      const result = await getClient2().listObjectsV2({
+        Bucket: bucketName,
+        ...prefix ? { Prefix: prefix } : {},
+        ...continuationToken ? { ContinuationToken: continuationToken } : {}
+      });
+      for (const obj of result.Contents ?? []) {
+        if (obj.Key) {
+          items.push({
+            key: obj.Key,
+            size: obj.Size ?? 0,
+            lastModified: obj.LastModified
+          });
+        }
+      }
+      continuationToken = result.IsTruncated ? result.NextContinuationToken : void 0;
+    } while (continuationToken);
+    return items;
+  }
+});
+var createEntityClient = (getClient2, bucketName, entityName, cacheSeconds) => {
+  const entityKey = (id) => `${entityName}/${id}.json`;
   return {
-    bucketName,
-    async put(key, body, options) {
+    async put(id, data) {
       await getClient2().putObject({
         Bucket: bucketName,
-        Key: key,
-        Body: typeof body === "string" ? Buffer.from(body) : body,
-        ...options?.contentType ? { ContentType: options.contentType } : {}
+        Key: entityKey(id),
+        Body: JSON.stringify(data),
+        ContentType: "application/json",
+        ...cacheSeconds != null ? { CacheControl: `public, max-age=${cacheSeconds}` } : {}
       });
     },
-    async get(key) {
+    async get(id) {
       try {
         const result = await getClient2().getObject({
           Bucket: bucketName,
-          Key: key
+          Key: entityKey(id)
         });
         const chunks = [];
         const stream = result.Body;
         for await (const chunk of stream) {
           chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
         }
-        return {
-          body: Buffer.concat(chunks),
-          contentType: result.ContentType
-        };
+        return JSON.parse(Buffer.concat(chunks).toString("utf-8"));
       } catch (error) {
         if (error instanceof Error && (error.name === "NoSuchKey" || error.$metadata?.httpStatusCode === 404)) {
           return void 0;
@@ -362,28 +444,37 @@ var createBucketClient = (bucketName) => {
         throw error;
       }
     },
-    async delete(key) {
+    async delete(id) {
       await getClient2().deleteObject({
         Bucket: bucketName,
-        Key: key
+        Key: entityKey(id)
       });
     },
-    async list(prefix) {
+    async list() {
       const items = [];
       let continuationToken;
+      const prefix = `${entityName}/`;
       do {
         const result = await getClient2().listObjectsV2({
           Bucket: bucketName,
-          ...prefix ? { Prefix: prefix } : {},
+          Prefix: prefix,
           ...continuationToken ? { ContinuationToken: continuationToken } : {}
         });
         for (const obj of result.Contents ?? []) {
-          if (obj.Key) {
-            items.push({
-              key: obj.Key,
-              size: obj.Size ?? 0,
-              lastModified: obj.LastModified
+          if (!obj.Key || !obj.Key.endsWith(".json")) continue;
+          const id = obj.Key.slice(prefix.length, -".json".length);
+          try {
+            const getResult = await getClient2().getObject({
+              Bucket: bucketName,
+              Key: obj.Key
             });
+            const chunks = [];
+            const stream = getResult.Body;
+            for await (const chunk of stream) {
+              chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+            }
+            items.push({ id, data: JSON.parse(Buffer.concat(chunks).toString("utf-8")) });
+          } catch {
           }
         }
         continuationToken = result.IsTruncated ? result.NextContinuationToken : void 0;
@@ -392,6 +483,21 @@ var createBucketClient = (bucketName) => {
     }
   };
 };
+var createBucketClient = (bucketName) => {
+  let client2 = null;
+  const getClient2 = () => client2 ??= new S3({});
+  return createBucketMethods(getClient2, bucketName);
+};
+var createBucketClientWithEntities = (bucketName, entitiesConfig) => {
+  let client2 = null;
+  const getClient2 = () => client2 ??= new S3({});
+  const base = createBucketMethods(getClient2, bucketName);
+  const result = { ...base };
+  for (const [entityName, config] of Object.entries(entitiesConfig)) {
+    result[entityName] = createEntityClient(getClient2, bucketName, entityName, config.cacheSeconds);
+  }
+  return result;
+};
 
 // src/runtime/handler-utils.ts
 import { readFileSync } from "fs";
@@ -566,7 +672,17 @@ var DEP_FACTORIES = {
     const tagField = depHandler?.__spec?.tagField;
     return createTableClient(name, tagField ? { tagField } : void 0);
   },
-  bucket: (name) => createBucketClient(name),
+  bucket: (name, depHandler) => {
+    const entities = depHandler?.__spec?.entities;
+    if (entities && Object.keys(entities).length > 0) {
+      const config = {};
+      for (const [entityName, entityOpts] of Object.entries(entities)) {
+        config[entityName] = entityOpts.cache ? { cacheSeconds: toSeconds(entityOpts.cache) } : {};
+      }
+      return createBucketClientWithEntities(name, config);
+    }
+    return createBucketClient(name);
+  },
   mailer: () => createEmailClient(),
   queue: (name) => createQueueClient(name),
   worker: (name) => createWorkerClient(name)
@@ -630,6 +746,25 @@ var createHandlerRuntime = (handler, handlerType, logLevel = "info", extraSetupA
     resolvedParams = await buildParams(handler.config);
     return resolvedParams;
   };
+  let resolvedCfSigningConfig = null;
+  const getCfSigningConfig = async () => {
+    if (resolvedCfSigningConfig !== null) return resolvedCfSigningConfig;
+    const cfSigningKeySsmPath = process.env.EFF_CF_SIGNING_KEY;
+    const cfKeyPairId = process.env.EFF_CF_KEY_PAIR_ID;
+    const cfDomain = process.env.EFF_CF_DOMAIN;
+    if (!cfSigningKeySsmPath || !cfKeyPairId || !cfDomain) {
+      resolvedCfSigningConfig = void 0;
+      return void 0;
+    }
+    const values = await getParameters([cfSigningKeySsmPath]);
+    const privateKey = values.get(cfSigningKeySsmPath);
+    if (!privateKey) {
+      resolvedCfSigningConfig = void 0;
+      return void 0;
+    }
+    resolvedCfSigningConfig = { privateKey, keyPairId: cfKeyPairId, domain: cfDomain };
+    return resolvedCfSigningConfig;
+  };
   const getAuthRuntime = async (setupCtx) => {
     if (resolvedAuthRuntime !== null) return resolvedAuthRuntime;
     const authOpts = setupCtx && typeof setupCtx === "object" && "auth" in setupCtx ? setupCtx.auth : void 0;
@@ -644,12 +779,14 @@ var createHandlerRuntime = (handler, handlerType, logLevel = "info", extraSetupA
     const cacheTtlSeconds = apiToken?.cacheTtl ? toSeconds(apiToken.cacheTtl) : void 0;
     const rawVerify = apiToken?.verify;
     const wrappedVerify = rawVerify ? (args) => rawVerify(args.value) : void 0;
+    const cfSigningConfig = await getCfSigningConfig();
     resolvedAuthRuntime = createAuthRuntime(
       secret,
       defaultExpires,
       wrappedVerify,
       apiToken?.header,
-      cacheTtlSeconds
+      cacheTtlSeconds,
+      cfSigningConfig
     );
     return resolvedAuthRuntime;
   };
@@ -733,8 +870,10 @@ var createHandlerRuntime = (handler, handlerType, logLevel = "info", extraSetupA
 
 export {
   createTableClient,
+  toSeconds,
   AUTH_COOKIE_NAME,
   createBucketClient,
+  createBucketClientWithEntities,
   buildDeps,
   buildParams,
   createHandlerRuntime