rastack 0.0.35 → 0.0.36

package/src/deploy/config.ts

@@ -252,29 +252,137 @@ export function templateUrl(cfg: DeployConfig): string | null {
   return `https://${cfg.templatesBucket}.s3.${cfg.region}.amazonaws.com/app.yaml`;
 }
 
+/** The in-repo CloudFormation templates `rastack init` deploys from. */
+export const APP_TEMPLATE_FILE = "deploy/cloudformation/app.yaml";
+export const BOOTSTRAP_TEMPLATE_FILE = "deploy/cloudformation/bootstrap.yaml";
+
+/**
+ * The argv (after `aws`) for an `aws cloudformation deploy`. `init` feeds this to
+ * `execFileSync` (no shell), and the printed command string is just this joined
+ * with spaces — so what is shown is exactly what runs.
+ */
+function cfnDeployArgs(
+  template: { file?: string; url?: string },
+  stackName: string,
+  region: string,
+  params: StackParameter[],
+): string[] {
+  const t = template.url
+    ? ["--template-url", template.url]
+    : ["--template-file", template.file!];
+  return [
+    "cloudformation",
+    "deploy",
+    ...t,
+    "--stack-name",
+    stackName,
+    "--capabilities",
+    "CAPABILITY_NAMED_IAM",
+    "--region",
+    region,
+    "--parameter-overrides",
+    ...params.map((p) => `${p.key}=${p.value}`),
+  ];
+}
+
+/**
+ * Render an argv as a single-line command string. Deliberately ONE line: a
+ * backslash-continued command pasted into Windows PowerShell breaks — there `\`
+ * is not a line-continuation, so every `--flag` is parsed as its own statement
+ * (`Missing expression after unary operator '--'`). A single line pastes cleanly
+ * into bash, zsh and PowerShell alike.
+ */
+function awsCommand(args: string[]): string {
+  return `aws ${args.join(" ")}`;
+}
+
+/** The argv that creates the app's infrastructure (app.yaml). */
+export function deployStackArgs(cfg: DeployConfig): string[] {
+  const src = templateUrl(cfg);
+  return cfnDeployArgs(
+    src ? { url: src } : { file: APP_TEMPLATE_FILE },
+    cfg.stackName,
+    cfg.region,
+    stackParameters(cfg),
+  );
+}
+
 /**
  * The one-time `aws cloudformation deploy` command that creates the app's
- * infrastructure. Launched from the hosted template URL when the templates
- * bucket is known, else from the in-repo `deploy/cloudformation/app.yaml`.
+ * infrastructure (app.yaml). Launched from the hosted template URL when the
+ * templates bucket is known, else from the in-repo `app.yaml`. `rastack init`
+ * runs this for you; it is also printed by `--print` so it can be run by hand.
  */
 export function deployStackCommand(cfg: DeployConfig): string {
-  const src = templateUrl(cfg);
-  const templateArg = src
-    ? `--template-url ${src}`
-    : "--template-file deploy/cloudformation/app.yaml";
-  const overrides = stackParameters(cfg)
-    .map((p) => `${p.key}=${p.value}`)
-    .join(" ");
-  return [
-    "aws cloudformation deploy",
-    templateArg,
-    `--stack-name ${cfg.stackName}`,
-    "--capabilities CAPABILITY_NAMED_IAM",
-    `--region ${cfg.region}`,
-    `--parameter-overrides ${overrides}`,
-  ].join(" \\\n  ");
+  return awsCommand(deployStackArgs(cfg));
 }
 
+/**
+ * The tier-0 bootstrap stack (bootstrap.yaml) — the S3 buckets that hold the
+ * Lambda placeholder + hosted templates, and the GitHub OIDC provider. One per
+ * account **and region**; its name is derived from the prefix so `init` can find
+ * it (and its `ArtifactsBucket`) without extra config.
+ */
+export function bootstrapStackName(cfg: DeployConfig): string {
+  return `${cfg.namePrefix}-bootstrap`;
+}
+
+/**
+ * `--parameter-overrides` for bootstrap.yaml. `reuseOidc` re-runs against an
+ * account that already has a GitHub OIDC provider (AWS allows only one per URL):
+ * the template then derives the existing provider's ARN itself.
+ */
+export function bootstrapStackParameters(
+  cfg: DeployConfig,
+  reuseOidc = false,
+): StackParameter[] {
+  const params: StackParameter[] = [
+    { key: "NamePrefix", value: cfg.namePrefix },
+    { key: "GitHubOwner", value: cfg.github.owner },
+    { key: "PublisherRepo", value: cfg.github.repo },
+    { key: "PublisherBranch", value: cfg.github.branch },
+  ];
+  if (reuseOidc) params.push({ key: "CreateOIDCProvider", value: "false" });
+  return params;
+}
+
+/** The argv that creates the bootstrap stack (bootstrap.yaml). */
+export function bootstrapStackArgs(
+  cfg: DeployConfig,
+  reuseOidc = false,
+): string[] {
+  return cfnDeployArgs(
+    { file: BOOTSTRAP_TEMPLATE_FILE },
+    bootstrapStackName(cfg),
+    cfg.region,
+    bootstrapStackParameters(cfg, reuseOidc),
+  );
+}
+
+/** The one-time `aws cloudformation deploy` command that creates the bootstrap stack. */
+export function bootstrapStackCommand(
+  cfg: DeployConfig,
+  reuseOidc = false,
+): string {
+  return awsCommand(bootstrapStackArgs(cfg, reuseOidc));
+}
+
+/** Stack Output keys `init` reads back off the bootstrap stack. */
+export const BOOTSTRAP_ARTIFACTS_OUTPUT = "ArtifactsBucketName";
+export const BOOTSTRAP_TEMPLATES_OUTPUT = "TemplatesBucketName";
+
+/** app.yaml stack Output key → the `DeployOutputs` field it populates. */
+export const APP_STACK_OUTPUTS: { key: string; field: keyof DeployOutputs }[] =
+  [
+    { key: "FunctionName", field: "functionName" },
+    { key: "ApiUrl", field: "apiUrl" },
+    { key: "DeployRoleArn", field: "deployRoleArn" },
+    { key: "UserPoolId", field: "userPoolId" },
+    { key: "UserPoolClientId", field: "userPoolClientId" },
+    { key: "JwksUrl", field: "jwksUrl" },
+    { key: "WarehouseBucketName", field: "warehouseBucket" },
+  ];
+
 /** GitHub repo Variable to wire (name + resolved value, if known from outputs). */
 export interface RepoVariable {
   name: string;

package/src/deploy/index.ts

@@ -8,3 +8,4 @@
 export * from "./config";
 export * from "./ci";
 export * from "./workflows";
+export * from "./zip";

package/src/deploy/io.ts

@@ -4,12 +4,14 @@
  * IO boundary they wrap.
  */
 
-import { execSync } from "child_process";
+import { execFileSync, execSync } from "child_process";
 import * as fs from "fs";
+import * as os from "os";
 import * as path from "path";
 import * as readline from "readline";
 import { CONFIG_PATH } from "./workflows";
 import { DeployConfig, PartialDeployConfig, normalizeConfig } from "./config";
+import { zipStore } from "./zip";
 
 /** Absolute path to the deploy config for a project root. */
 export function configPath(cwd = process.cwd()): string {
@@ -57,6 +59,91 @@ export function canPrompt(nonInteractive: boolean): boolean {
   return !nonInteractive && Boolean(process.stdin.isTTY);
 }
 
+// ── AWS CLI boundary ─────────────────────────────────────────────────────────
+// `init` shells out to the developer's own AWS CLI (execFileSync — no shell, so
+// no injection surface) to stand the infrastructure up. Read helpers capture
+// output and return null on failure; mutating helpers stream to the console and
+// throw so the caller can report which step failed.
+
+/** Capture `aws <args>` stdout, or null when the CLI is absent / the call fails. */
+export function awsCapture(args: string[], cwd = process.cwd()): string | null {
+  try {
+    const out = execFileSync("aws", args, {
+      cwd,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    return out.toString().trim();
+  } catch {
+    return null;
+  }
+}
+
+/** Run `aws <args>` streaming output; throws on a non-zero exit. */
+export function awsRun(args: string[], cwd = process.cwd()): void {
+  // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+  execFileSync("aws", args, { cwd, stdio: "inherit" });
+}
+
+/** True when the AWS CLI is on PATH. */
+export function awsAvailable(): boolean {
+  return awsCapture(["--version"]) !== null;
+}
+
+/**
+ * A single Output value of a CloudFormation stack, or null when the stack does
+ * not exist or the key is unset. `describe-stacks` prints `None` for a missing
+ * key with `--output text`, which we normalize to null.
+ */
+export function stackOutput(
+  stackName: string,
+  key: string,
+  region: string,
+): string | null {
+  const val = awsCapture([
+    "cloudformation",
+    "describe-stacks",
+    "--stack-name",
+    stackName,
+    "--region",
+    region,
+    "--query",
+    `Stacks[0].Outputs[?OutputKey=='${key}'].OutputValue`,
+    "--output",
+    "text",
+  ]);
+  if (!val || val === "None") return null;
+  return val;
+}
+
+/**
+ * Package the in-repo Lambda placeholder and upload it to the bootstrap
+ * artifacts bucket at `placeholders/bootstrap.zip` — the object app.yaml's
+ * function is *created from*. Idempotent (the zip is deterministic); safe to run
+ * on every `init`. Returns false when the placeholder file is missing.
+ */
+export function uploadPlaceholder(
+  artifactsBucket: string,
+  region: string,
+  cwd = process.cwd(),
+): boolean {
+  const src = path.join(cwd, "deploy/cloudformation/placeholder/bootstrap");
+  if (!fs.existsSync(src)) return false;
+  const zip = zipStore([
+    { name: "bootstrap", data: fs.readFileSync(src), mode: 0o755 },
+  ]);
+  const tmp = path.join(os.tmpdir(), "rastack-placeholder-bootstrap.zip");
+  fs.writeFileSync(tmp, zip);
+  awsRun([
+    "s3",
+    "cp",
+    tmp,
+    `s3://${artifactsBucket}/placeholders/bootstrap.zip`,
+    "--region",
+    region,
+  ]);
+  return true;
+}
+
 /**
  * Ask a single question with a default, echoed as `label [default]: `. Returns
  * the trimmed answer, or the default on an empty line.

package/src/deploy/zip.ts

@@ -0,0 +1,109 @@
+/**
+ * A tiny, dependency-free ZIP writer used by `rastack init` to package the Lambda
+ * placeholder bundle (`placeholders/bootstrap.zip`) before uploading it to the
+ * bootstrap artifacts bucket.
+ *
+ * Why hand-roll it: `init` runs on the developer's machine — including Windows
+ * PowerShell, which has no `zip` binary — so shelling out to `zip` is not
+ * portable. Entries are STORED (no compression); the placeholder is ~1 KB, so
+ * compression buys nothing and STORE keeps this pure and trivial to verify. The
+ * one detail that matters for Lambda is the Unix executable bit on `bootstrap`,
+ * which is carried in the central-directory external attributes.
+ */
+
+/** A file to place in the archive. `mode` defaults to `0o644` (or `0o755` via helper). */
+export interface ZipEntry {
+  name: string;
+  data: Buffer;
+  mode?: number;
+}
+
+const CRC_TABLE = (() => {
+  const table = new Int32Array(256);
+  for (let n = 0; n < 256; n++) {
+    let c = n;
+    for (let k = 0; k < 8; k++) c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+    table[n] = c;
+  }
+  return table;
+})();
+
+function crc32(buf: Buffer): number {
+  let c = 0xffffffff;
+  for (let i = 0; i < buf.length; i++)
+    c = CRC_TABLE[(c ^ buf[i]) & 0xff] ^ (c >>> 8);
+  return (c ^ 0xffffffff) >>> 0;
+}
+
+// Fixed 1980-01-01 00:00 DOS timestamp — deterministic output (no wall-clock).
+const DOS_TIME = 0;
+const DOS_DATE = 0x0021;
+
+/**
+ * Build a ZIP archive from `entries` and return its bytes. Deterministic: the
+ * same inputs always produce the same buffer (a fixed DOS timestamp, no
+ * compression), so the placeholder upload is idempotent.
+ */
+export function zipStore(entries: ZipEntry[]): Buffer {
+  const locals: Buffer[] = [];
+  const centrals: Buffer[] = [];
+  let offset = 0;
+
+  for (const entry of entries) {
+    const name = Buffer.from(entry.name, "utf-8");
+    const crc = crc32(entry.data);
+    const size = entry.data.length;
+    const mode = entry.mode ?? 0o644;
+
+    const local = Buffer.alloc(30);
+    local.writeUInt32LE(0x04034b50, 0); // local file header signature
+    local.writeUInt16LE(20, 4); // version needed
+    local.writeUInt16LE(0, 6); // flags
+    local.writeUInt16LE(0, 8); // method: STORE
+    local.writeUInt16LE(DOS_TIME, 10);
+    local.writeUInt16LE(DOS_DATE, 12);
+    local.writeUInt32LE(crc, 14);
+    local.writeUInt32LE(size, 18); // compressed size
+    local.writeUInt32LE(size, 22); // uncompressed size
+    local.writeUInt16LE(name.length, 26);
+    local.writeUInt16LE(0, 28); // extra length
+    locals.push(local, name, entry.data);
+
+    const central = Buffer.alloc(46);
+    central.writeUInt32LE(0x02014b50, 0); // central directory signature
+    central.writeUInt16LE((3 << 8) | 20, 4); // version made by: Unix host
+    central.writeUInt16LE(20, 6); // version needed
+    central.writeUInt16LE(0, 8); // flags
+    central.writeUInt16LE(0, 10); // method: STORE
+    central.writeUInt16LE(DOS_TIME, 12);
+    central.writeUInt16LE(DOS_DATE, 14);
+    central.writeUInt32LE(crc, 16);
+    central.writeUInt32LE(size, 20);
+    central.writeUInt32LE(size, 24);
+    central.writeUInt16LE(name.length, 28);
+    central.writeUInt16LE(0, 30); // extra length
+    central.writeUInt16LE(0, 32); // comment length
+    central.writeUInt16LE(0, 34); // disk number
+    central.writeUInt16LE(0, 36); // internal attributes
+    central.writeUInt32LE((mode & 0xffff) << 16, 38); // external attrs: Unix mode
+    central.writeUInt32LE(offset, 42); // local header offset
+    centrals.push(central, name);
+
+    offset += local.length + name.length + entry.data.length;
+  }
+
+  const localBytes = Buffer.concat(locals);
+  const centralBytes = Buffer.concat(centrals);
+
+  const eocd = Buffer.alloc(22);
+  eocd.writeUInt32LE(0x06054b50, 0); // end of central directory signature
+  eocd.writeUInt16LE(0, 4); // disk number
+  eocd.writeUInt16LE(0, 6); // central dir start disk
+  eocd.writeUInt16LE(entries.length, 8); // entries on this disk
+  eocd.writeUInt16LE(entries.length, 10); // total entries
+  eocd.writeUInt32LE(centralBytes.length, 12); // central dir size
+  eocd.writeUInt32LE(localBytes.length, 16); // central dir offset
+  eocd.writeUInt16LE(0, 20); // comment length
+
+  return Buffer.concat([localBytes, centralBytes, eocd]);
+}

package/src/rastack-ci.ts

@@ -116,7 +116,7 @@ function main(argv: string[]): void {
   const cfg = loadConfig();
   if (!cfg) {
     console.error(
-      "  ✗ no .rastack/deploy.json found. Run `rastack init` (or `rastack deploy`) first.",
+      "  ✗ no .rastack/deploy.json found. Run `rastack init` first.",
     );
     process.exit(1);
     return;