quidproquo-actionprocessor-awslambda 0.1.2 → 0.1.3

package/lib/commonjs/logic/federatedModuleStore/loadFederatedStory.js

@@ -0,0 +1,295 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadFederatedStory = exports.resetFederatedModuleStoreCache = void 0;
+const quidproquo_config_aws_1 = require("quidproquo-config-aws");
+const quidproquoCore = __importStar(require("quidproquo-core"));
+const quidproquo_core_1 = require("quidproquo-core");
+const quidproquoWebserver = __importStar(require("quidproquo-webserver"));
+const fs = __importStar(require("fs"));
+const module_1 = require("module");
+const path = __importStar(require("path"));
+const url_1 = require("url");
+const client_s3_1 = require("@aws-sdk/client-s3");
+const runtime_1 = require("@module-federation/enhanced/runtime");
+const createAwsClient_1 = require("../createAwsClient");
+const FederatedModuleLoadError_1 = require("./FederatedModuleLoadError");
+const sharedPackages_1 = require("./sharedPackages");
+// How long a resolved state is served before the manifest is re-checked for a new
+// version. Overridable per service (defineFederatedModuleStore recheckMs -> this env).
+// Lower = faster pickup of new publishes at the cost of one small S3 GET per container
+// per interval. The re-check runs in the BACKGROUND so it never blocks a request.
+const DEFAULT_RECHECK_MS = 60000;
+const getRecheckMs = () => {
+    const raw = process.env.federatedCodeStoreRecheckMs;
+    const parsed = raw ? parseInt(raw, 10) : NaN;
+    return Number.isFinite(parsed) && parsed >= 0 ? parsed : DEFAULT_RECHECK_MS;
+};
+let resolvedState;
+let recheckAfter = 0;
+let inflightResolve;
+let hostInitialised = false;
+// Test seam - forces the next call to re-resolve the store from env.
+const resetFederatedModuleStoreCache = () => {
+    resolvedState = undefined;
+    recheckAfter = 0;
+    inflightResolve = undefined;
+};
+exports.resetFederatedModuleStoreCache = resetFederatedModuleStoreCache;
+// ── Transport ────────────────────────────────────────────────────────────────
+// Returns a function that reads a path RELATIVE to the store (e.g. 'manifest.json'
+// or '<hash>/remoteEntry.js'). Two backends: s3:// for real deploys, file:// for
+// local/dev and tests. The store URL already includes the per-service prefix, so
+// callers pass only the in-service relative path.
+const getFileFetcher = (storeUrl, qpqConfig) => {
+    if (storeUrl.startsWith('s3://')) {
+        const url = new URL(storeUrl);
+        const bucketName = url.host;
+        const keyPrefix = url.pathname.replace(/^\/|\/$/g, '');
+        const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
+        // Pin the owner so a same-name bucket in another account can't be squatted to
+        // serve code we'd then require() with the service role's credentials.
+        const expectedBucketOwner = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployAccountId(qpqConfig);
+        const s3Client = (0, createAwsClient_1.createAwsClient)(client_s3_1.S3Client, { region });
+        return (relativePath) => __awaiter(void 0, void 0, void 0, function* () {
+            var _a;
+            const response = yield s3Client.send(new client_s3_1.GetObjectCommand({
+                Bucket: bucketName,
+                Key: keyPrefix ? `${keyPrefix}/${relativePath}` : relativePath,
+                ExpectedBucketOwner: expectedBucketOwner,
+            }));
+            const bytes = yield ((_a = response.Body) === null || _a === void 0 ? void 0 : _a.transformToByteArray());
+            if (!bytes) {
+                throw new FederatedModuleLoadError_1.FederatedModuleLoadError(FederatedModuleLoadError_1.FederatedModuleLoadErrorCode.containerLoadFailed, `empty response reading [${relativePath}]`);
+            }
+            return Buffer.from(bytes);
+        });
+    }
+    if (storeUrl.startsWith('file://')) {
+        const baseDirectory = (0, url_1.fileURLToPath)(storeUrl.endsWith('/') ? storeUrl : `${storeUrl}/`);
+        return (relativePath) => __awaiter(void 0, void 0, void 0, function* () { return fs.promises.readFile(path.join(baseDirectory, relativePath)); });
+    }
+    throw new FederatedModuleLoadError_1.FederatedModuleLoadError(FederatedModuleLoadError_1.FederatedModuleLoadErrorCode.unsupportedStoreUrl, `unsupported federated code store url [${storeUrl}]`);
+};
+// "Nothing published yet" is a legitimate not-found: the manifest key is absent
+// (NoSuchKey/NotFound) or the store bucket isn't created yet, which happens normally
+// when a lambda cold-starts between deploy phases (NoSuchBucket). We do NOT include
+// AccessDenied: a permission failure is a real misconfiguration and must surface (as a
+// warning, and be retried) rather than masquerade as 'not published'.
+const isManifestNotFoundError = (error) => {
+    const name = (error === null || error === void 0 ? void 0 : error.name) || '';
+    const code = (error === null || error === void 0 ? void 0 : error.code) || '';
+    return ['NoSuchKey', 'NotFound', 'NoSuchBucket'].includes(name) || code === 'ENOENT';
+};
+// ── Module-federation shared scope ───────────────────────────────────────────
+// The host provides the framework packages to the container's share scope so remote
+// story code resolves the SAME module instances as the bundled runtime. The package
+// list is shared with the remote build so the two can't drift (see sharedPackages).
+const SHARED_LIBS = {
+    'quidproquo-core': quidproquoCore,
+    'quidproquo-webserver': quidproquoWebserver,
+};
+const getHostSharedModules = () => Object.fromEntries(sharedPackages_1.FEDERATED_SHARED_PACKAGE_NAMES.map((name) => [
+    name,
+    {
+        version: '0.0.0',
+        lib: () => SHARED_LIBS[name],
+        shareConfig: { singleton: true, requiredVersion: false },
+    },
+]));
+const ensureHostInitialised = () => {
+    if (hostInitialised) {
+        return;
+    }
+    (0, runtime_1.init)({
+        name: 'qpq_federated_host',
+        remotes: [],
+        shared: getHostSharedModules(),
+    });
+    hostInitialised = true;
+};
+// ── Version loading ──────────────────────────────────────────────────────────
+// Downloads a manifest's files (atomically) and registers the container with the MF
+// runtime under a HASH-UNIQUE remote name, so loadRemote can't serve a previous
+// version's module from its cache when the hash changes. Returns the runtime name.
+// This is the step that actually puts a new version's code into effect.
+const loadStoreVersion = (getFile, manifest) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a, _b;
+    const cacheRoot = process.env.federatedCodeStoreCacheDir || '/tmp/qpq-federated-code';
+    const versionDirectory = path.join(cacheRoot, manifest.containerName, manifest.hash);
+    yield fs.promises.mkdir(versionDirectory, { recursive: true });
+    yield Promise.all(manifest.files.map((file) => __awaiter(void 0, void 0, void 0, function* () {
+        const localPath = path.join(versionDirectory, file);
+        // Files are immutable under their hash dir AND only ever appear via the atomic
+        // rename below, so an existing file is always complete and valid - this is what
+        // lets a re-check of an unchanged version skip re-downloading.
+        if (fs.existsSync(localPath)) {
+            return;
+        }
+        const data = yield getFile(`${manifest.hash}/${file}`);
+        yield fs.promises.mkdir(path.dirname(localPath), { recursive: true });
+        // Write to a temp name then rename: rename is atomic on the same filesystem, so a
+        // crash/timeout mid-write never leaves a truncated file that a later invocation
+        // would trust via the existsSync check above.
+        const tempPath = `${localPath}.${process.pid}.tmp`;
+        yield fs.promises.writeFile(tempPath, data);
+        yield fs.promises.rename(tempPath, localPath);
+    })));
+    const entryPath = path.join(versionDirectory, manifest.entry);
+    const containerRequire = (0, module_1.createRequire)(entryPath);
+    const containerModule = containerRequire(entryPath);
+    const container = (_b = (_a = containerModule[manifest.containerName]) !== null && _a !== void 0 ? _a : containerModule.default) !== null && _b !== void 0 ? _b : containerModule;
+    if (typeof (container === null || container === void 0 ? void 0 : container.get) !== 'function' || typeof (container === null || container === void 0 ? void 0 : container.init) !== 'function') {
+        throw new FederatedModuleLoadError_1.FederatedModuleLoadError(FederatedModuleLoadError_1.FederatedModuleLoadErrorCode.containerLoadFailed, `[${manifest.entry}] does not export a module federation container named [${manifest.containerName}]`);
+    }
+    // entryGlobalName is the container's real (build-time) library name; the registered
+    // remote name is hash-unique so each version is a distinct loadRemote key.
+    globalThis[manifest.containerName] = container;
+    ensureHostInitialised();
+    const runtimeName = `${manifest.containerName}__${manifest.hash}`;
+    (0, runtime_1.registerRemotes)([
+        {
+            name: runtimeName,
+            entry: entryPath,
+            type: 'global',
+            entryGlobalName: manifest.containerName,
+        },
+    ]);
+    return runtimeName;
+});
+// ── Probe & resolve (the caching state machine) ──────────────────────────────
+// Reads the manifest and decides the current state. If the hash is unchanged from what
+// we already loaded, keeps the existing container (no re-sync). Not-found -> unavailable.
+const probeStore = (qpqConfig, storeUrl, current) => __awaiter(void 0, void 0, void 0, function* () {
+    const getFile = getFileFetcher(storeUrl, qpqConfig);
+    let manifest;
+    try {
+        manifest = JSON.parse((yield getFile('manifest.json')).toString('utf8'));
+    }
+    catch (error) {
+        if (isManifestNotFoundError(error)) {
+            console.log(`federated code store [${storeUrl}] has no manifest - using bundled modules`);
+            return { available: false };
+        }
+        throw error;
+    }
+    if (!(manifest === null || manifest === void 0 ? void 0 : manifest.containerName) ||
+        !(manifest === null || manifest === void 0 ? void 0 : manifest.hash) ||
+        !(manifest === null || manifest === void 0 ? void 0 : manifest.entry) ||
+        !Array.isArray(manifest === null || manifest === void 0 ? void 0 : manifest.files) ||
+        typeof (manifest === null || manifest === void 0 ? void 0 : manifest.exposes) !== 'object' ||
+        manifest.exposes === null) {
+        throw new FederatedModuleLoadError_1.FederatedModuleLoadError(FederatedModuleLoadError_1.FederatedModuleLoadErrorCode.manifestInvalid, `invalid manifest in federated code store [${storeUrl}]`);
+    }
+    if ((current === null || current === void 0 ? void 0 : current.available) && current.manifest.hash === manifest.hash) {
+        return current;
+    }
+    const runtimeName = yield loadStoreVersion(getFile, manifest);
+    return { available: true, manifest, runtimeName };
+});
+// Resolves the store, re-checking the manifest after the recheck interval. The re-check
+// runs in the background: a stale-but-usable state is served immediately so a request
+// never blocks on S3; only the very first resolve (no state yet) awaits.
+const resolveStore = (qpqConfig, storeUrl) => {
+    if (resolvedState && Date.now() < recheckAfter) {
+        return Promise.resolve(resolvedState);
+    }
+    if (!inflightResolve) {
+        inflightResolve = probeStore(qpqConfig, storeUrl, resolvedState)
+            .then((state) => {
+            resolvedState = state;
+            recheckAfter = Date.now() + getRecheckMs();
+            return state;
+        })
+            .catch((error) => {
+            // Back off and keep serving whatever we had (or unavailable). Surfaced as a
+            // warning so real errors (e.g. AccessDenied) are visible, not silent.
+            console.warn('federated code store check failed - keeping current modules', error);
+            recheckAfter = Date.now() + getRecheckMs();
+            resolvedState = resolvedState !== null && resolvedState !== void 0 ? resolvedState : { available: false };
+            return resolvedState;
+        })
+            .finally(() => {
+            inflightResolve = undefined;
+        });
+    }
+    // Serve the stale state instantly while the refresh happens; only block if we have
+    // nothing yet.
+    return resolvedState ? Promise.resolve(resolvedState) : inflightResolve;
+};
+// ── Public entry ─────────────────────────────────────────────────────────────
+// Called by dynamicModuleLoader for every story load. Returns the story function, or
+// undefined to signal "use the bundled module" (no store, nothing published, runtime
+// not exposed, or any error - availability always wins over federation).
+const loadFederatedStory = (qpqConfig, qpqFunctionRuntime) => __awaiter(void 0, void 0, void 0, function* () {
+    const storeUrl = process.env.federatedCodeStoreUrl;
+    if (!storeUrl) {
+        return undefined;
+    }
+    try {
+        const storeState = yield resolveStore(qpqConfig, storeUrl);
+        if (!storeState.available) {
+            return undefined;
+        }
+        const federatedKey = (0, quidproquo_core_1.getFederatedKeyFromQpqFunctionRuntime)(qpqFunctionRuntime);
+        const exposePath = storeState.manifest.exposes[federatedKey];
+        if (!exposePath) {
+            console.warn(`federated code store has no module for [${federatedKey}] - using the bundled module`);
+            return undefined;
+        }
+        const remoteModule = yield (0, runtime_1.loadRemote)(`${storeState.runtimeName}/${exposePath}`);
+        const storyName = quidproquo_core_1.qpqCoreUtils.getStoryNameFromQpqFunctionRuntime(qpqFunctionRuntime);
+        const story = remoteModule === null || remoteModule === void 0 ? void 0 : remoteModule[storyName];
+        if (!story) {
+            throw new FederatedModuleLoadError_1.FederatedModuleLoadError(FederatedModuleLoadError_1.FederatedModuleLoadErrorCode.storyNotExported, `story [${storyName}] is not exported from federated module [${exposePath}]`);
+        }
+        return story;
+    }
+    catch (error) {
+        // Availability first: a broken store must never take the service down
+        console.warn('federated module load failed - using the bundled module', error);
+        return undefined;
+    }
+});
+exports.loadFederatedStory = loadFederatedStory;

package/lib/commonjs/logic/federatedModuleStore/sharedPackages.d.ts

@@ -0,0 +1 @@
+export declare const FEDERATED_SHARED_PACKAGE_NAMES: readonly ["quidproquo-core", "quidproquo-webserver"];

package/lib/commonjs/logic/federatedModuleStore/sharedPackages.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FEDERATED_SHARED_PACKAGE_NAMES = void 0;
+// The framework packages the lambda host provides to the module-federation share
+// scope, so a federated remote resolves the SAME module instances as the host
+// (instanceof checks and module-level state stay coherent). Single source of truth
+// for BOTH the host runtime (loadFederatedStory getHostSharedModules) and the
+// remote build (quidproquo-deploy-webpack getWebpackConfigForQpqRemote) — the two
+// lists must never drift, or the remote would silently bundle its own copy.
+exports.FEDERATED_SHARED_PACKAGE_NAMES = ['quidproquo-core', 'quidproquo-webserver'];

package/lib/commonjs/logic/index.d.ts

@@ -1 +1,2 @@
 export * from './cognito';
+export * from './federatedModuleStore';

package/lib/commonjs/logic/index.js

@@ -15,3 +15,4 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./cognito"), exports);
+__exportStar(require("./federatedModuleStore"), exports);

package/lib/esm/awsNamingUtils.d.ts

@@ -17,7 +17,9 @@ export declare const getCFExportNameApiKeyIdFromConfig: (apiKeyName: string, qpq
 export declare const getCFExportNameSnsTopicArnFromConfig: (eventBusName: string, qpqConfig: QPQConfig, applicationOverride?: string) => string;
 export declare const getCFExportNameDistributionIdArnFromConfig: (webEntryName: string, qpqConfig: QPQConfig, serviceOverride?: string, applicationOverride?: string) => string;
 export declare const getCFExportNameWebsocketApiIdFromConfig: (websocketApiName: string, qpqConfig: QPQConfig) => string;
+export declare const getWebsocketApiIdSsmParameterName: (websocketApiName: string, qpqConfig: QPQConfig) => string;
 export declare const getEventBusSnsTopicArn: (eventBusName: string, qpqConfig: QPQConfig, module: string, environment: string, application: string, feature?: string) => string;
+export declare const getAccountStackName: () => string;
 export declare const getBaseStackName: (qpqConfig: QPQConfig) => string;
 export declare const getInfStackName: (qpqConfig: QPQConfig) => string;
 export declare const getWebStackName: (qpqConfig: QPQConfig) => string;

package/lib/esm/awsNamingUtils.js

@@ -131,6 +131,19 @@ export const getCFExportNameWebsocketApiIdFromConfig = (websocketApiName, qpqCon
     const resourceName = websocketApiConfig.owner?.resourceNameOverride || websocketApiName;
     return getQpqRuntimeResourceName(resourceName, application, service, environment, feature, 'websocket-api-id-export');
 };
+// SSM parameter holding a websocket api's AWS-generated id, written by the owning service's
+// inf stack. Referencing services resolve it at deploy time to build exact execute-api
+// grants (deploy the owning inf stack first - same owner-publishes/others-read pattern as
+// the domain certificate arn parameter).
+export const getWebsocketApiIdSsmParameterName = (websocketApiName, qpqConfig) => {
+    const websocketApiConfig = qpqWebServerUtils.getWebsocketEntryByApiName(websocketApiName, qpqConfig);
+    const application = websocketApiConfig.owner?.application || qpqCoreUtils.getApplicationName(qpqConfig);
+    const service = websocketApiConfig.owner?.module || qpqCoreUtils.getApplicationModuleName(qpqConfig);
+    const environment = websocketApiConfig.owner?.environment || qpqCoreUtils.getApplicationModuleEnvironment(qpqConfig);
+    const feature = websocketApiConfig.owner?.feature || qpqCoreUtils.getApplicationModuleFeature(qpqConfig);
+    const resourceName = websocketApiConfig.owner?.resourceNameOverride || websocketApiName;
+    return `/qpq/websocket/api-id/${getConfigRuntimeResourceName(resourceName, application, service, environment, feature)}`;
+};
 export const getEventBusSnsTopicArn = (eventBusName, qpqConfig, module, environment, application, feature) => {
     const topicName = getConfigRuntimeResourceName(eventBusName, application, module, environment, feature);
     const accountInfo = getAwsServiceAccountInfoByDeploymentInfo(qpqConfig, module, environment, feature, application);
@@ -138,6 +151,13 @@ export const getEventBusSnsTopicArn = (eventBusName, qpqConfig, module, environm
     const region = accountInfo.awsRegion;
     return `arn:aws:sns:${region}:${awsAccountId}:${topicName}`;
 };
+// The account stack owns account-level resources (cloud trail, budgets, security services)
+// so they never share an app's lifecycle. The name is deliberately static: stack names are
+// already namespaced per account+region, and the resources it holds meter/audit the whole
+// account - an app/environment segment would only fake a separation that doesn't exist.
+// Everything in one account converges on this one stack, so exactly ONE repo/config must
+// own it, and actor (feature) deploys must not deploy it.
+export const getAccountStackName = () => 'qpq-account';
 export const getBaseStackName = (qpqConfig) => {
     const appName = qpqCoreUtils.getApplicationName(qpqConfig);
     const moduleName = qpqCoreUtils.getApplicationModuleName(qpqConfig);

package/lib/esm/getActionProcessor/core/apiKeyValidation/getApiKeyValidationValidateActionProcessor.js

@@ -1,9 +1,10 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
-import { actionResult, qpqCoreUtils } from 'quidproquo-core';
+import { actionResult } from 'quidproquo-core';
 import { ApiKeyValidationActionType } from 'quidproquo-webserver';
 import { timingSafeEqual } from 'crypto';
-import { getConfigRuntimeResourceName } from '../../../awsNamingUtils';
-import { getApiKeys } from '../../../logic/apiGateway/getApiKeys';
+import { getCFExportNameApiKeyIdFromConfig } from '../../../awsNamingUtils';
+import { getApiKeyValue } from '../../../logic/apiGateway/getApiKeyValue';
+import { getExportedValue } from '../../../logic/cloudformation/getExportedValue';
 // Constant-time string equality. `timingSafeEqual` throws on length mismatch,
 // so guard the length check — the length itself isn't secret for API keys.
 const safeEqual = (a, b) => {
@@ -16,17 +17,20 @@ const safeEqual = (a, b) => {
 };
 const getProcessApiKeyValidationValidate = (qpqConfig) => {
     const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
-    const application = qpqCoreUtils.getApplicationName(qpqConfig);
-    const service = qpqCoreUtils.getApplicationModuleName(qpqConfig);
-    const environment = qpqCoreUtils.getApplicationModuleEnvironment(qpqConfig);
-    const feature = qpqCoreUtils.getApplicationModuleFeature(qpqConfig);
     return async ({ apiKeyValue, apiKeyReferences }) => {
-        const realApiKeys = await getApiKeys(region, ...apiKeyReferences.map((apiKey) => {
-            const apiKeyApplication = apiKey.applicationName || application;
-            const apiKeyService = apiKey.serviceName || service;
-            return getConfigRuntimeResourceName(apiKey.name, apiKeyApplication, apiKeyService, environment, feature);
+        // Fetch each referenced key individually (id via CFN export, then GetApiKey) rather than
+        // listing every key in the account - keeps the IAM grant per-key instead of /apikeys-wide.
+        const realApiKeyValues = await Promise.all(apiKeyReferences.map(async (apiKeyReference) => {
+            try {
+                const apiKeyId = await getExportedValue(getCFExportNameApiKeyIdFromConfig(apiKeyReference.name, qpqConfig, apiKeyReference.serviceName, apiKeyReference.applicationName), region);
+                return await getApiKeyValue(region, apiKeyId);
+            }
+            catch {
+                // An unresolvable reference behaves like the old list-and-filter miss - no match
+                return undefined;
+            }
         }));
-        const matched = realApiKeys.some((apiKey) => safeEqual(apiKey.value, apiKeyValue));
+        const matched = realApiKeyValues.some((realApiKeyValue) => safeEqual(realApiKeyValue, apiKeyValue));
         return actionResult(matched);
     };
 };

package/lib/esm/getActionProcessor/core/event/apiGatwayEvent/api/getEventGetRecordsActionProcessor.js

@@ -1,8 +1,9 @@
 import { actionResult, EventActionType, qpqCoreUtils, } from 'quidproquo-core';
-import { qpqWebServerUtils } from 'quidproquo-webserver';
-import { parseMultipartFormData } from '../../utils/parseMultipartFormData';
+import { FileUploadErrorTypeEnum, qpqWebServerUtils } from 'quidproquo-webserver';
+import { FileUploadValidationError, parseMultipartFormData } from '../../utils/parseMultipartFormData';
 const getProcessGetRecords = (qpqConfig) => {
     const serviceName = qpqCoreUtils.getApplicationModuleName(qpqConfig);
+    const fileUploadSettings = qpqWebServerUtils.getFileUploadSettings(qpqConfig);
     return async ({ eventParams: [apiGatewayEvent, context] }) => {
         // Initialize `path` by removing the service name prefix from `apiGatewayEvent.path`.
         // This adjustment is necessary because the API gateway routes requests to services based on
@@ -26,7 +27,17 @@ const getProcessGetRecords = (qpqConfig) => {
         };
         // Transform the body if its a multipart/form-data
         if ((qpqWebServerUtils.getHeaderValue('Content-Type', apiGatewayEvent.headers) || '').startsWith('multipart/form-data') && apiGatewayEvent.body) {
-            internalEventRecord.files = await parseMultipartFormData(apiGatewayEvent);
+            try {
+                internalEventRecord.files = await parseMultipartFormData(apiGatewayEvent, fileUploadSettings);
+            }
+            catch (error) {
+                // Stamp the failure on the record so the auto-respond step returns the matching
+                // 4xx before the route story runs - throwing here would fail the whole event as a 5xx
+                internalEventRecord.fileUploadError =
+                    error instanceof FileUploadValidationError
+                        ? { errorType: error.errorType, message: error.message }
+                        : { errorType: FileUploadErrorTypeEnum.malformed, message: 'Unable to parse multipart/form-data body' };
+            }
         }
         return actionResult([internalEventRecord]);
     };

package/lib/esm/getActionProcessor/core/event/utils/parseMultipartFormData.d.ts

@@ -1,3 +1,9 @@
 import { QPQBinaryData } from 'quidproquo-core';
+import { FileUploadErrorTypeEnum, FileUploadSettings } from 'quidproquo-webserver';
 import { APIGatewayEvent } from 'aws-lambda';
-export declare const parseMultipartFormData: (event: APIGatewayEvent) => Promise<QPQBinaryData[]>;
+export declare class FileUploadValidationError extends Error {
+    readonly errorType: FileUploadErrorTypeEnum;
+    constructor(errorType: FileUploadErrorTypeEnum, message: string);
+}
+export declare const sanitizeFilename: (filename?: string) => string;
+export declare const parseMultipartFormData: (event: APIGatewayEvent, fileUploadSettings: FileUploadSettings) => Promise<QPQBinaryData[]>;

package/lib/esm/getActionProcessor/core/event/utils/parseMultipartFormData.js

@@ -1,38 +1,106 @@
+import { FileUploadErrorTypeEnum } from 'quidproquo-webserver';
 import Busboy from 'busboy';
-export const parseMultipartFormData = (event) => new Promise((resolve, reject) => {
+export class FileUploadValidationError extends Error {
+    errorType;
+    constructor(errorType, message) {
+        super(message);
+        this.errorType = errorType;
+        this.name = 'FileUploadValidationError';
+    }
+}
+// Reduce a client-supplied filename to a bare, path-traversal-safe name.
+export const sanitizeFilename = (filename) => {
+    const baseName = (filename || '')
+        .split(/[/\\]/)
+        .filter((segment) => segment.length > 0)
+        .pop();
+    // eslint-disable-next-line no-control-regex
+    const cleaned = (baseName || '').replace(/[\x00-\x1f]/g, '');
+    if (!cleaned || cleaned === '.' || cleaned === '..') {
+        return 'unnamed';
+    }
+    return cleaned;
+};
+const isMimeTypeAllowed = (mimeType, allowedMimeTypes) => {
+    if (!allowedMimeTypes) {
+        return true;
+    }
+    const normalizedMimeType = (mimeType || '').toLowerCase();
+    return allowedMimeTypes.some((allowed) => {
+        const normalizedAllowed = allowed.toLowerCase();
+        return normalizedAllowed.endsWith('/*')
+            ? normalizedMimeType.startsWith(normalizedAllowed.slice(0, -1))
+            : normalizedMimeType === normalizedAllowed;
+    });
+};
+export const parseMultipartFormData = (event, fileUploadSettings) => new Promise((resolve, reject) => {
     const busboy = Busboy({
         headers: {
             'content-type': event.headers['content-type'] || event.headers['Content-Type'],
         },
+        limits: {
+            fileSize: fileUploadSettings.maxFileSizeBytes,
+            files: fileUploadSettings.maxFileCount,
+            fields: fileUploadSettings.maxFieldCount,
+            fieldSize: fileUploadSettings.maxFieldSizeBytes,
+        },
     });
     const result = {
         files: [],
         fields: {},
     };
+    let settled = false;
+    const rejectOnce = (error) => {
+        if (!settled) {
+            settled = true;
+            reject(error);
+        }
+    };
     busboy.on('file', (name, file, info) => {
-        let fileBuffer = Buffer.alloc(0);
+        const filename = sanitizeFilename(info.filename);
+        if (!isMimeTypeAllowed(info.mimeType, fileUploadSettings.allowedMimeTypes)) {
+            rejectOnce(new FileUploadValidationError(FileUploadErrorTypeEnum.disallowedMimeType, `File "${filename}" has disallowed content type "${info.mimeType}"`));
+            file.resume();
+            return;
+        }
+        const chunks = [];
         file.on('data', (data) => {
-            fileBuffer = Buffer.concat([fileBuffer, data]); // Concatenate the new data to the existing buffer
+            chunks.push(data);
+        });
+        // Emitted when the stream is truncated at limits.fileSize - a silently truncated upload must fail, not succeed
+        file.on('limit', () => {
+            rejectOnce(new FileUploadValidationError(FileUploadErrorTypeEnum.fileTooLarge, `File "${filename}" exceeds the maximum file size of ${fileUploadSettings.maxFileSizeBytes} bytes`));
         });
         file.on('end', () => {
-            if (fileBuffer.length > 0) {
+            const content = Buffer.concat(chunks);
+            if (!settled && content.length > 0) {
                 result.files.push({
-                    filename: info.filename,
+                    filename,
                     contentType: info.mimeType,
                     encoding: info.encoding,
                     name: name,
-                    content: fileBuffer,
+                    content,
                 });
             }
         });
     });
+    busboy.on('filesLimit', () => {
+        rejectOnce(new FileUploadValidationError(FileUploadErrorTypeEnum.tooManyFiles, `Upload exceeds the maximum of ${fileUploadSettings.maxFileCount} files`));
+    });
+    busboy.on('fieldsLimit', () => {
+        rejectOnce(new FileUploadValidationError(FileUploadErrorTypeEnum.tooManyFields, `Upload exceeds the maximum of ${fileUploadSettings.maxFieldCount} fields`));
+    });
     busboy.on('field', (name, value) => {
         result.fields[name] = value;
     });
     busboy.on('error', (error) => {
-        reject(error);
+        rejectOnce(error);
     });
     busboy.on('finish', () => {
+        if (settled) {
+            return;
+        }
+        settled = true;
         const qpqBinaryFiles = result.files.map((f) => ({
             filename: f.filename,
             mimetype: f.contentType,

package/lib/esm/getActionProcessor/core/index.d.ts

@@ -6,6 +6,7 @@ export * from './eventBus';
 export * from './file';
 export * from './graphDatabase';
 export * from './keyValueStore';
+export * from './metric';
 export * from './queue';
 export * from './system';
 export * from './userDirectory';

package/lib/esm/getActionProcessor/core/index.js

@@ -6,6 +6,7 @@ export * from './eventBus';
 export * from './file';
 export * from './graphDatabase';
 export * from './keyValueStore';
+export * from './metric';
 export * from './queue';
 export * from './system';
 export * from './userDirectory';
@@ -18,6 +19,7 @@ import { getEventBusActionProcessor } from './eventBus';
 import { getFileActionProcessor } from './file';
 import { getGraphDatabaseActionProcessor } from './graphDatabase';
 import { getKeyValueStoreActionProcessor } from './keyValueStore';
+import { getMetricActionProcessor } from './metric';
 import { getQueueActionProcessor } from './queue';
 import { getSystemActionProcessor } from './system';
 import { getUserDirectoryActionProcessor } from './userDirectory';
@@ -26,6 +28,7 @@ export const getCoreActionProcessor = async (qpqConfig, dynamicModuleLoader) =>
     ...(await getApiKeyValidationActionProcessor(qpqConfig, dynamicModuleLoader)),
     ...(await getFileActionProcessor(qpqConfig, dynamicModuleLoader)),
     ...(await getKeyValueStoreActionProcessor(qpqConfig, dynamicModuleLoader)),
+    ...(await getMetricActionProcessor(qpqConfig, dynamicModuleLoader)),
     ...(await getQueueActionProcessor(qpqConfig, dynamicModuleLoader)),
     ...(await getUserDirectoryActionProcessor(qpqConfig, dynamicModuleLoader)),
     ...(await getEventBusActionProcessor(qpqConfig, dynamicModuleLoader)),

package/lib/esm/getActionProcessor/core/metric/getMetricPutActionProcessor.d.ts

@@ -0,0 +1,2 @@
+import { ActionProcessorListResolver } from 'quidproquo-core';
+export declare const getMetricPutActionProcessor: ActionProcessorListResolver;