rastack 0.0.58 → 0.0.60

package/test/deploy.spec.ts

@@ -1,571 +0,0 @@
-import yaml from "js-yaml";
-import {
-  DeployConfig,
-  buildSteps,
-  checkSteps,
-  ciPlan,
-  deployStackArgs,
-  deployStackCommand,
-  deploySteps,
-  bootstrapStackArgs,
-  bootstrapStackCommand,
-  bootstrapStackName,
-  bootstrapStackParameters,
-  cognitoAdvancedSecuritySupported,
-  APP_STACK_OUTPUTS,
-  ghVariableSetArgs,
-  lambdaEnv,
-  mergeConfig,
-  normalizeConfig,
-  parseGitHubRemote,
-  repoVariables,
-  scaffoldFiles,
-  stackParameters,
-  validateConfig,
-  validateBootstrapConfig,
-  zipStore,
-  renderCiWorkflow,
-  renderDeployWorkflow,
-  CI_WORKFLOW_PATH,
-  CONFIG_PATH,
-  DEPLOY_WORKFLOW_PATH,
-} from "../src/deploy";
-
-/** A complete, valid config to build variations off. */
-function base(overrides: Partial<DeployConfig> = {}): DeployConfig {
-  return normalizeConfig({
-    app: "airline",
-    github: {
-      owner: "theserverkid",
-      repo: "reactapistack-demo",
-      branch: "master",
-    },
-    ...overrides,
-  });
-}
-
-describe("deploy config — normalize", () => {
-  it("fills defaults and derives the stack name from prefix + app", () => {
-    const cfg = base();
-    expect(cfg.namePrefix).toBe("rastack");
-    expect(cfg.region).toBe("af-south-1");
-    expect(cfg.stackName).toBe("rastack-airline");
-    expect(cfg.namespace).toBe("production");
-    expect(cfg.lambda).toEqual({
-      bin: "bootstrap",
-      arch: "arm64",
-      features: "lambda",
-    });
-    expect(cfg.resourcesDir).toBe("resources");
-    expect(cfg.outDir).toBe(".rastack");
-    expect(cfg.tokenUse).toBe("access");
-  });
-
-  it("honours an explicit stack name and prefix", () => {
-    const cfg = base({ namePrefix: "acme", stackName: "custom-stack" });
-    expect(cfg.stackName).toBe("custom-stack");
-  });
-
-  it("re-derives the stack name off a custom prefix when none is given", () => {
-    const cfg = normalizeConfig({
-      app: "airline",
-      namePrefix: "acme",
-      github: { owner: "o", repo: "r" },
-    });
-    expect(cfg.stackName).toBe("acme-airline");
-    expect(cfg.github.branch).toBe("master"); // branch default
-  });
-
-  it("drops empty optional buckets to undefined", () => {
-    const cfg = normalizeConfig({
-      app: "a",
-      templatesBucket: "  ",
-      github: {},
-    });
-    expect(cfg.templatesBucket).toBeUndefined();
-    expect(cfg.artifactsBucket).toBeUndefined();
-  });
-});
-
-describe("deploy config — merge", () => {
-  it("deep-merges nested github/lambda without dropping siblings", () => {
-    const cfg = mergeConfig(base(), {
-      github: { branch: "dev" },
-      lambda: { arch: "x86_64" },
-    });
-    expect(cfg.github.owner).toBe("theserverkid");
-    expect(cfg.github.branch).toBe("dev");
-    expect(cfg.lambda.arch).toBe("x86_64");
-    expect(cfg.lambda.bin).toBe("bootstrap");
-  });
-
-  it("merges stack outputs", () => {
-    const cfg = mergeConfig(base(), { outputs: { functionName: "fn-1" } });
-    const cfg2 = mergeConfig(cfg, { outputs: { apiUrl: "https://x" } });
-    expect(cfg2.outputs).toEqual({ functionName: "fn-1", apiUrl: "https://x" });
-  });
-});
-
-describe("deploy config — validate", () => {
-  it("passes a well-formed config", () => {
-    expect(validateConfig(base())).toEqual([]);
-  });
-
-  it("rejects a bad app slug (Cognito [a-z0-9] rule)", () => {
-    expect(validateConfig(base({ app: "My-App" })).join("\n")).toMatch(
-      /app "My-App"/,
-    );
-    expect(validateConfig(base({ app: "" })).join("\n")).toMatch(
-      /app is required/,
-    );
-  });
-
-  it("rejects a malformed region", () => {
-    expect(validateConfig(base({ region: "not-a-region" })).join()).toMatch(
-      /region/,
-    );
-  });
-
-  it("requires github owner + repo", () => {
-    const errs = validateConfig(normalizeConfig({ app: "a", github: {} }));
-    expect(errs.join("\n")).toMatch(/github.owner is required/);
-    expect(errs.join("\n")).toMatch(/github.repo is required/);
-  });
-
-  it("rejects an unknown lambda arch", () => {
-    const cfg = {
-      ...base(),
-      lambda: { ...base().lambda, arch: "riscv" as never },
-    };
-    expect(validateConfig(cfg).join()).toMatch(/lambda.arch/);
-  });
-});
-
-describe("parseGitHubRemote", () => {
-  it("parses ssh, https, and https+.git forms", () => {
-    expect(
-      parseGitHubRemote("git@github.com:theserverkid/reactapistack.git"),
-    ).toEqual({
-      owner: "theserverkid",
-      repo: "reactapistack",
-    });
-    expect(
-      parseGitHubRemote("https://github.com/theserverkid/reactapistack"),
-    ).toEqual({
-      owner: "theserverkid",
-      repo: "reactapistack",
-    });
-    expect(
-      parseGitHubRemote("https://github.com/theserverkid/reactapistack.git/"),
-    ).toEqual({
-      owner: "theserverkid",
-      repo: "reactapistack",
-    });
-  });
-
-  it("returns null for non-GitHub remotes", () => {
-    expect(parseGitHubRemote("git@gitlab.com:o/r.git")).toBeNull();
-    expect(parseGitHubRemote("not a url")).toBeNull();
-  });
-});
-
-describe("stack parameters + launch command", () => {
-  it("emits the app.yaml parameters in template order", () => {
-    // A region WITH Cognito advanced security, so AdvancedSecurity is left off.
-    const params = stackParameters(
-      base({ region: "us-east-1", artifactsBucket: "art-bucket" }),
-    );
-    expect(params.map((p) => p.key)).toEqual([
-      "AppName",
-      "NamePrefix",
-      "GitHubOwner",
-      "GitHubRepo",
-      "GitHubBranch",
-      "IcebergNamespace",
-      "ArtifactsBucket",
-    ]);
-  });
-
-  it("omits ArtifactsBucket when unset (it has no template default)", () => {
-    expect(
-      stackParameters(base({ region: "us-east-1" })).map((p) => p.key),
-    ).not.toContain("ArtifactsBucket");
-  });
-
-  it("forces AdvancedSecurity=OFF only in regions lacking Cognito ASF", () => {
-    // af-south-1 (the repo default) has no threat protection — a User Pool with
-    // a UserPoolAddOns block is undeployable, so the override must be emitted.
-    expect(cognitoAdvancedSecuritySupported("af-south-1")).toBe(false);
-    expect(cognitoAdvancedSecuritySupported("us-east-1")).toBe(true);
-
-    const capeTown = stackParameters(base({ region: "af-south-1" }));
-    expect(capeTown.find((p) => p.key === "AdvancedSecurity")?.value).toBe(
-      "OFF",
-    );
-
-    const virginia = stackParameters(base({ region: "us-east-1" }));
-    expect(virginia.map((p) => p.key)).not.toContain("AdvancedSecurity");
-  });
-
-  it("always launches from the in-repo --template-file (deploy takes no URL)", () => {
-    // `aws cloudformation deploy` accepts ONLY `--template-file`; `--template-url`
-    // is exclusive to create-stack/update-stack and makes deploy reject the
-    // command. Even with a known templates bucket, the local file is used.
-    const hosted = deployStackCommand(
-      base({ templatesBucket: "tpl", artifactsBucket: "art" }),
-    );
-    expect(hosted).toContain("--template-file deploy/cloudformation/app.yaml");
-    expect(hosted).not.toContain("--template-url");
-    expect(hosted).toContain("--stack-name rastack-airline");
-    expect(hosted).toContain("ArtifactsBucket=art");
-
-    const local = deployStackCommand(base());
-    expect(local).toContain("--template-file deploy/cloudformation/app.yaml");
-    expect(local).not.toContain("--template-url");
-  });
-
-  it("emits ONE line (PowerShell-safe — no backslash continuations)", () => {
-    // A `\`-continued command is bash-only; pasted into PowerShell each `--flag`
-    // becomes its own statement and errors. Keep it to a single line.
-    const cmd = deployStackCommand(base({ artifactsBucket: "art" }));
-    expect(cmd).not.toContain("\\");
-    expect(cmd.split("\n")).toHaveLength(1);
-    expect(cmd.startsWith("aws cloudformation deploy ")).toBe(true);
-  });
-
-  it("deployStackArgs is the argv the printed command joins", () => {
-    const cfg = base({ artifactsBucket: "art" });
-    expect(`aws ${deployStackArgs(cfg).join(" ")}`).toBe(
-      deployStackCommand(cfg),
-    );
-    expect(deployStackArgs(cfg).slice(0, 2)).toEqual([
-      "cloudformation",
-      "deploy",
-    ]);
-  });
-
-  it("accepts a template-file override (the package-resolved path)", () => {
-    // `init` runs in a consumer repo that carries no framework IaC, so it passes
-    // the path the template was resolved to inside the `rastack` package.
-    const cfg = base({ artifactsBucket: "art" });
-    const abs = "/opt/rastack/dist/templates/cloudformation/app.yaml";
-    expect(deployStackArgs(cfg, abs)).toContain(abs);
-    expect(deployStackCommand(cfg, abs)).toContain(`--template-file ${abs}`);
-    // Default is unchanged when no override is given.
-    expect(deployStackCommand(cfg)).toContain(
-      "--template-file deploy/cloudformation/app.yaml",
-    );
-  });
-});
-
-describe("bootstrap stack", () => {
-  it("derives the bootstrap stack name from the prefix", () => {
-    expect(bootstrapStackName(base())).toBe("rastack-bootstrap");
-    expect(bootstrapStackName(base({ namePrefix: "acme" }))).toBe(
-      "acme-bootstrap",
-    );
-  });
-
-  it("passes the publisher repo coordinates as parameters", () => {
-    const params = bootstrapStackParameters(base());
-    const map = Object.fromEntries(params.map((p) => [p.key, p.value]));
-    expect(map.NamePrefix).toBe("rastack");
-    expect(map.GitHubOwner).toBe("theserverkid");
-    expect(map.PublisherRepo).toBe("reactapistack-demo");
-    expect(map.PublisherBranch).toBe("master");
-    expect(map.CreateOIDCProvider).toBeUndefined();
-  });
-
-  it("adds CreateOIDCProvider=false when reusing an existing provider", () => {
-    const params = bootstrapStackParameters(base(), true);
-    expect(params.find((p) => p.key === "CreateOIDCProvider")!.value).toBe(
-      "false",
-    );
-  });
-
-  it("builds a single-line command from the bootstrap template", () => {
-    const cmd = bootstrapStackCommand(base());
-    expect(cmd).not.toContain("\\");
-    expect(cmd.split("\n")).toHaveLength(1);
-    expect(cmd).toContain(
-      "--template-file deploy/cloudformation/bootstrap.yaml",
-    );
-    expect(cmd).toContain("--stack-name rastack-bootstrap");
-    expect(`aws ${bootstrapStackArgs(base()).join(" ")}`).toBe(cmd);
-  });
-
-  it("accepts a template-file override (the package-resolved path)", () => {
-    const abs = "/opt/rastack/dist/templates/cloudformation/bootstrap.yaml";
-    expect(bootstrapStackArgs(base(), false, abs)).toContain(abs);
-    expect(bootstrapStackCommand(base(), true, abs)).toContain(
-      `--template-file ${abs}`,
-    );
-    // Reuse-OIDC + override compose without disturbing the default path.
-    expect(bootstrapStackArgs(base(), true, abs)).toContain(
-      "CreateOIDCProvider=false",
-    );
-    expect(bootstrapStackCommand(base())).toContain(
-      "--template-file deploy/cloudformation/bootstrap.yaml",
-    );
-  });
-
-  it("validates only the account-level fields, not the per-app ones", () => {
-    // A config with no `app` is fine for bootstrap — it never touches app.yaml.
-    const cfg = normalizeConfig({
-      github: { owner: "theserverkid", repo: "reactapistack-demo" },
-    });
-    expect(validateConfig(cfg)).toContain(
-      "app is required (a short slug, e.g. `airline`).",
-    );
-    expect(validateBootstrapConfig(cfg)).toEqual([]);
-  });
-
-  it("still flags a bad prefix, region, or GitHub coordinates", () => {
-    expect(
-      validateBootstrapConfig(base({ namePrefix: "Bad_Prefix" })),
-    ).toContainEqual(expect.stringContaining("namePrefix"));
-    expect(
-      validateBootstrapConfig(base({ region: "not-a-region" })),
-    ).toContainEqual(expect.stringContaining("region"));
-    expect(
-      validateBootstrapConfig(
-        normalizeConfig({ app: "airline", github: { repo: "demo" } }),
-      ),
-    ).toContain("github.owner is required.");
-  });
-});
-
-describe("app stack outputs map", () => {
-  it("maps each stack Output key to a DeployOutputs field", () => {
-    const keys = APP_STACK_OUTPUTS.map((o) => o.key);
-    expect(keys).toContain("FunctionName");
-    expect(keys).toContain("ApiUrl");
-    expect(keys).toContain("DeployRoleArn");
-    expect(APP_STACK_OUTPUTS.find((o) => o.key === "FunctionName")!.field).toBe(
-      "functionName",
-    );
-  });
-});
-
-describe("zipStore — placeholder packaging", () => {
-  it("produces a valid, deterministic STORE archive", () => {
-    const data = Buffer.from("#!/bin/sh\necho placeholder\n");
-    const a = zipStore([{ name: "bootstrap", data, mode: 0o755 }]);
-    const b = zipStore([{ name: "bootstrap", data, mode: 0o755 }]);
-    // Deterministic (fixed DOS timestamp) → idempotent uploads.
-    expect(a.equals(b)).toBe(true);
-    // Local file header + End-of-central-directory signatures.
-    expect(a.readUInt32LE(0)).toBe(0x04034b50);
-    expect(a.readUInt32LE(a.length - 22)).toBe(0x06054b50);
-    // One entry recorded in the EOCD.
-    expect(a.readUInt16LE(a.length - 12)).toBe(1);
-    // STORE method → the file bytes appear verbatim after the header + name.
-    expect(a.includes(data)).toBe(true);
-  });
-});
-
-describe("repo variables + lambda env", () => {
-  it("resolves repo Variables from stack outputs when present", () => {
-    const cfg = base({ outputs: { deployRoleArn: "arn:aws:iam::1:role/x" } });
-    const vars = repoVariables(cfg);
-    expect(vars.find((v) => v.name === "AWS_DEPLOY_ROLE_ARN")!.value).toBe(
-      "arn:aws:iam::1:role/x",
-    );
-    expect(vars.find((v) => v.name === "AWS_REGION")!.value).toBe("af-south-1");
-  });
-
-  it("builds the `gh variable set` argv init wires the pipeline with", () => {
-    const cfg = base({ outputs: { deployRoleArn: "arn:aws:iam::1:role/x" } });
-    const roleVar = repoVariables(cfg).find(
-      (v) => v.name === "AWS_DEPLOY_ROLE_ARN",
-    )!;
-    expect(ghVariableSetArgs(cfg, roleVar.name, roleVar.value)).toEqual([
-      "variable",
-      "set",
-      "AWS_DEPLOY_ROLE_ARN",
-      "--repo",
-      "theserverkid/reactapistack-demo",
-      "--body",
-      "arn:aws:iam::1:role/x",
-    ]);
-    // Region variable targets the same repo with the region value.
-    expect(ghVariableSetArgs(cfg, "AWS_REGION", cfg.region)).toEqual([
-      "variable",
-      "set",
-      "AWS_REGION",
-      "--repo",
-      "theserverkid/reactapistack-demo",
-      "--body",
-      "af-south-1",
-    ]);
-  });
-
-  it("fills the RASTACK_* env, using outputs where available", () => {
-    const cfg = base({
-      outputs: {
-        warehouseBucket: "wh-bucket",
-        userPoolId: "eu_x",
-        userPoolClientId: "cli",
-      },
-    });
-    const env = Object.fromEntries(lambdaEnv(cfg).map((e) => [e.key, e.value]));
-    expect(env.RASTACK_WAREHOUSE).toBe("s3://wh-bucket/warehouse");
-    expect(env.RASTACK_ISSUER).toBe(
-      "https://cognito-idp.af-south-1.amazonaws.com/eu_x",
-    );
-    expect(env.RASTACK_AUDIENCE).toBe("cli");
-    expect(env.RASTACK_TOKEN_USE).toBe("access");
-  });
-});
-
-describe("ci plan — check", () => {
-  it("validates then compiles in-process, honouring the resources dir + bin", () => {
-    const steps = checkSteps(base({ resourcesDir: "res" }), "npx rastack");
-    expect(steps.map((s) => s.run)).toEqual([
-      "npx rastack check res",
-      "compile res .rastack (in-process)",
-    ]);
-    // The compile step runs in-process (no shell command), so the CLI can drop
-    // the standalone `compile` command entirely.
-    expect(steps[1].action).toBe("compile");
-    expect(ciPlan("check", base(), { bin: "rastack" })).toEqual(
-      checkSteps(base(), "rastack"),
-    );
-  });
-});
-
-describe("ci plan — build", () => {
-  it("uses --arm64 and bakes the JWKS from the stack output when unresolved", () => {
-    const steps = buildSteps(base());
-    const cross = steps.find((s) => s.name.startsWith("Cross-build"))!;
-    expect(cross.run).toContain("--arm64");
-    expect(cross.cwd).toBe("rust");
-    const bake = steps.find((s) => s.name.startsWith("Bake"))!;
-    expect(bake.run).toContain("describe-stacks");
-    expect(bake.run).toContain("OutputKey=='JwksUrl'");
-  });
-
-  it("uses --x86-64 for an x86 build and a literal JWKS when wired", () => {
-    const cfg = base({
-      lambda: { ...base().lambda, arch: "x86_64" },
-      outputs: { jwksUrl: "https://jwks" },
-    });
-    const steps = buildSteps(cfg);
-    expect(steps.find((s) => s.name.startsWith("Cross-build"))!.run).toContain(
-      "--x86-64",
-    );
-    const bake = steps.find((s) => s.name.startsWith("Bake"))!;
-    expect(bake.run).toContain('"https://jwks"');
-    expect(bake.run).not.toContain("describe-stacks");
-  });
-
-  it("stages the compiled manifest + openapi next to the binary", () => {
-    const steps = buildSteps(base());
-    const zip = steps.find((s) => s.name.startsWith("Assemble"))!;
-    expect(zip.run).toContain("rust/target/lambda/bootstrap/bootstrap.zip");
-    expect(zip.run).toContain("schema.rastack.json");
-    expect(zip.run).toContain("openapi.json");
-    expect(zip.run).toContain("jwks.json");
-  });
-});
-
-describe("ci plan — deploy", () => {
-  it("builds then ships, resolving the function name live when unwired", () => {
-    const steps = deploySteps(base());
-    const ship = steps.find((s) => s.name.startsWith("Ship"))!;
-    expect(ship.run).toContain("aws lambda update-function-code");
-    expect(ship.run).toContain("OutputKey=='FunctionName'");
-    expect(ship.run).toContain(
-      "fileb://rust/target/lambda/bootstrap/bootstrap.zip",
-    );
-    // build steps are included
-    expect(steps.some((s) => s.name.startsWith("Cross-build"))).toBe(true);
-  });
-
-  it("skips the build with skipBuild and uses the wired function name", () => {
-    const cfg = base({ outputs: { functionName: "airline-api" } });
-    const steps = deploySteps(cfg, { skipBuild: true });
-    expect(steps.some((s) => s.name.startsWith("Cross-build"))).toBe(false);
-    const ship = steps.find((s) => s.name.startsWith("Ship"))!;
-    expect(ship.run).toContain("--function-name airline-api");
-    expect(ship.run).not.toContain("describe-stacks");
-  });
-
-  it("ciPlan dispatches each phase", () => {
-    expect(ciPlan("build", base())).toEqual(buildSteps(base()));
-    expect(ciPlan("deploy", base())).toEqual(deploySteps(base()));
-  });
-});
-
-describe("workflow templates", () => {
-  it("renders valid YAML that pins the deploy branch", () => {
-    const ci = renderCiWorkflow(
-      base({ github: { owner: "o", repo: "r", branch: "main" } }),
-    );
-    const doc = yaml.load(ci) as any;
-    expect(doc.name).toBe("CI");
-    // `on:` parses to the boolean-ish key `true` in YAML 1.1 — assert via the raw text.
-    expect(ci).toContain("branches: [main]");
-    expect(ci).toContain("run: rastack ci check");
-  });
-
-  it("deploy workflow keeps the GitHub expressions intact and runs one line", () => {
-    const wf = renderDeployWorkflow(base());
-    const doc = yaml.load(wf) as any;
-    expect(doc.permissions["id-token"]).toBe("write");
-    expect(wf).toContain("${{ vars.AWS_DEPLOY_ROLE_ARN }}");
-    expect(wf).toContain("aws-actions/configure-aws-credentials@v4");
-    expect(wf).toContain("run: rastack ci deploy");
-  });
-
-  it("names the deploy job after the target architecture", () => {
-    expect(renderDeployWorkflow(base())).toContain("(arm64)");
-    expect(
-      renderDeployWorkflow(
-        base({ lambda: { ...base().lambda, arch: "x86_64" } }),
-      ),
-    ).toContain("(x86_64)");
-  });
-});
-
-describe("scaffold", () => {
-  it("writes the config + both workflows by default", () => {
-    const files = scaffoldFiles(base());
-    expect(files.map((f) => f.path).sort()).toEqual(
-      [CONFIG_PATH, CI_WORKFLOW_PATH, DEPLOY_WORKFLOW_PATH].sort(),
-    );
-    // the config file round-trips through normalize
-    const cfgFile = files.find((f) => f.path === CONFIG_PATH)!;
-    expect(normalizeConfig(JSON.parse(cfgFile.content))).toEqual(base());
-  });
-
-  it("omits the workflows with noWorkflows", () => {
-    const files = scaffoldFiles(base(), { noWorkflows: true });
-    expect(files.map((f) => f.path)).toEqual([CONFIG_PATH]);
-  });
-});
-
-describe("resolveDeployAsset — bundled template resolution", () => {
-  // eslint-disable-next-line @typescript-eslint/no-var-requires
-  const { resolveDeployAsset } = require("../src/deploy/io");
-  const path = require("path");
-
-  it("resolves the framework templates to an existing file", () => {
-    for (const name of ["app.yaml", "bootstrap.yaml"]) {
-      const resolved = resolveDeployAsset(name);
-      expect(resolved).not.toBeNull();
-      expect(path.isAbsolute(resolved)).toBe(true);
-      expect(resolved.endsWith(name)).toBe(true);
-    }
-  });
-
-  it("resolves the Lambda placeholder bundle", () => {
-    const resolved = resolveDeployAsset(path.join("placeholder", "bootstrap"));
-    expect(resolved).not.toBeNull();
-    expect(resolved.endsWith(path.join("placeholder", "bootstrap"))).toBe(true);
-  });
-
-  it("returns null for an asset that does not exist", () => {
-    expect(resolveDeployAsset("does-not-exist.yaml")).toBeNull();
-  });
-});