rastack 0.0.62 → 0.0.64

package/dist/templates/cloudformation/app.yaml

@@ -34,7 +34,44 @@ Parameters:
   GitHubBranch:
     Type: String
     Default: master
-    Description: Branch of GitHubRepo allowed to deploy.
+    Description: Branch of GitHubRepo allowed to deploy (used when GitHubEnvironment is blank).
+
+  GitHubEnvironment:
+    Type: String
+    Default: ""
+    Description: >
+      GitHub Actions **Environment** (e.g. development / production) this stack's
+      deploy role trusts. When set, the OIDC trust is scoped to
+      `…:environment:<name>` — the subject a job that declares `environment:` gets
+      — instead of a branch ref, so the dev and prod deploys can share a branch
+      set yet only assume their own environment's role. Blank keeps the legacy
+      branch-ref trust (`…:ref:refs/heads/<GitHubBranch>`). `rastack init` sets it
+      to development / production for the dev / prod stacks.
+
+  CallbackUrls:
+    Type: CommaDelimitedList
+    Default: "http://localhost:4321"
+    Description: >
+      Allowed OAuth redirect (callback) URLs for the Hosted UI app client. The
+      local `rastack dev` origin is the default so a developer can sign in against
+      this environment's real Cognito pool while developing; add your deployed
+      frontend origin(s) too.
+
+  LogoutUrls:
+    Type: CommaDelimitedList
+    Default: "http://localhost:4321"
+    Description: Allowed sign-out redirect URLs for the Hosted UI app client.
+
+  ExternalApiUpstream:
+    Type: String
+    Default: ""
+    Description: >
+      Base URL (no trailing slash) the **external-API proxy** forwards to —
+      typically a UAT or prod backend. When set, the stack adds a
+      Cognito-authorized `ANY /proxy/{proxy+}` route to the HTTP API that forwards
+      to `<upstream>/{proxy}`, so a locally-running app (signed in against this
+      pool) reaches external APIs only through the proxy, never directly. Blank
+      omits the proxy route + authorizer entirely.
 
   ArtifactsBucket:
     Type: String
@@ -87,6 +124,10 @@ Conditions:
   DeriveOIDCArn: !Equals [!Ref OIDCProviderArn, ""]
   ShouldTrailDataEvents: !Equals [!Ref EnableDataEventTrail, "true"]
   UseAdvancedSecurity: !Not [!Equals [!Ref AdvancedSecurity, "OFF"]]
+  # Scope the deploy-role trust to a GitHub Actions Environment when one is given.
+  TrustEnvironment: !Not [!Equals [!Ref GitHubEnvironment, ""]]
+  # Provision the external-API proxy route only when an upstream is configured.
+  HasProxy: !Not [!Equals [!Ref ExternalApiUpstream, ""]]
 
 Resources:
 
@@ -290,6 +331,20 @@ Resources:
         - ALLOW_USER_SRP_AUTH
         - ALLOW_REFRESH_TOKEN_AUTH
       PreventUserExistenceErrors: ENABLED
+      # Hosted UI (OAuth 2.0 Authorization Code + PKCE) — the flow rastack/auth's
+      # <CognitoAuthProvider> drives. Enabling it here lets a locally-running app
+      # (`rastack dev`) sign in against this environment's real Cognito pool.
+      SupportedIdentityProviders:
+        - COGNITO
+      AllowedOAuthFlowsUserPoolClient: true
+      AllowedOAuthFlows:
+        - code
+      AllowedOAuthScopes:
+        - openid
+        - email
+        - profile
+      CallbackURLs: !Ref CallbackUrls
+      LogoutURLs: !Ref LogoutUrls
       TokenValidityUnits:
         AccessToken: minutes
         IdToken: minutes
@@ -299,6 +354,15 @@ Resources:
       RefreshTokenValidity: 30
       EnableTokenRevocation: true
 
+  # Hosted UI domain — the browser sign-in surface. Prefix is globally unique via
+  # the account id. Both the deployed frontend and local `rastack dev` redirect
+  # here to authenticate against this environment's pool.
+  UserPoolDomain:
+    Type: AWS::Cognito::UserPoolDomain
+    Properties:
+      Domain: !Sub "${NamePrefix}-${AppName}-${AWS::AccountId}"
+      UserPoolId: !Ref UserPool
+
   IdentityPool:
     Type: AWS::Cognito::IdentityPool
     Properties:
@@ -494,6 +558,49 @@ Resources:
       Principal: apigateway.amazonaws.com
       SourceArn: !Sub "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${HttpApi}/*/*"
 
+  # -- External-API proxy (optional) --------------------------------------------
+  # When ExternalApiUpstream is set, a Cognito-authorized `ANY /proxy/{proxy+}`
+  # route forwards to `<upstream>/{proxy}`. HTTP API prefers the more specific
+  # route, so `/proxy/*` goes here and everything else still hits the Rust Lambda
+  # via `$default`. The JWT authorizer means only callers holding a valid token
+  # from THIS environment's pool can use the proxy — so a local dev app signs in
+  # against the dev pool, then reaches UAT/prod externals only through here.
+  ProxyJwtAuthorizer:
+    Type: AWS::ApiGatewayV2::Authorizer
+    Condition: HasProxy
+    Properties:
+      ApiId: !Ref HttpApi
+      AuthorizerType: JWT
+      Name: !Sub "${NamePrefix}-${AppName}-cognito"
+      IdentitySource:
+        - "$request.header.Authorization"
+      JwtConfiguration:
+        Audience:
+          - !Ref UserPoolClient
+        Issuer: !Sub "https://cognito-idp.${AWS::Region}.amazonaws.com/${UserPool}"
+
+  ProxyIntegration:
+    Type: AWS::ApiGatewayV2::Integration
+    Condition: HasProxy
+    Properties:
+      ApiId: !Ref HttpApi
+      IntegrationType: HTTP_PROXY
+      IntegrationMethod: ANY
+      # `{proxy}` is the greedy path variable captured by the route; the caller's
+      # Authorization header is forwarded so the upstream can authorize too.
+      IntegrationUri: !Sub "${ExternalApiUpstream}/{proxy}"
+      PayloadFormatVersion: "1.0"
+
+  ProxyRoute:
+    Type: AWS::ApiGatewayV2::Route
+    Condition: HasProxy
+    Properties:
+      ApiId: !Ref HttpApi
+      RouteKey: "ANY /proxy/{proxy+}"
+      Target: !Sub "integrations/${ProxyIntegration}"
+      AuthorizationType: JWT
+      AuthorizerId: !Ref ProxyJwtAuthorizer
+
   # -- Deploy role (GitHub OIDC) — code only ------------------------------------
   # CI assumes this to ship compiled code. It can UpdateFunctionCode on THIS one
   # function and read this app's SSM params — nothing else — with an explicit
@@ -518,7 +625,13 @@ Resources:
               StringEquals:
                 token.actions.githubusercontent.com:aud: sts.amazonaws.com
               StringLike:
-                token.actions.githubusercontent.com:sub: !Sub "repo:${GitHubOwner}/${GitHubRepo}:ref:refs/heads/${GitHubBranch}"
+                # An environment-gated GitHub job's OIDC subject is
+                # `repo:O/R:environment:<env>`, not `…:ref:refs/heads/<branch>`,
+                # so the trust must match the environment when one is set.
+                token.actions.githubusercontent.com:sub: !If
+                  - TrustEnvironment
+                  - !Sub "repo:${GitHubOwner}/${GitHubRepo}:environment:${GitHubEnvironment}"
+                  - !Sub "repo:${GitHubOwner}/${GitHubRepo}:ref:refs/heads/${GitHubBranch}"
       Policies:
         - PolicyName: update-function-code-only
           PolicyDocument:
@@ -602,6 +715,14 @@ Resources:
       Type: String
       Value: !Sub "https://cognito-idp.${AWS::Region}.amazonaws.com/${UserPool}/.well-known/jwks.json"
 
+  ParamHostedUiUrl:
+    Type: AWS::SSM::Parameter
+    DependsOn: UserPoolDomain
+    Properties:
+      Name: !Sub "/rastack/${AppName}/hosted-ui-url"
+      Type: String
+      Value: !Sub "https://${NamePrefix}-${AppName}-${AWS::AccountId}.auth.${AWS::Region}.amazoncognito.com"
+
 Outputs:
   ApiUrl:
     Description: Base URL of the deployed API (set as the frontend's remote base).
@@ -627,9 +748,19 @@ Outputs:
   JwksUrl:
     Description: JWKS to bake into the Lambda bundle at build time.
     Value: !Sub "https://cognito-idp.${AWS::Region}.amazonaws.com/${UserPool}/.well-known/jwks.json"
+  UserPoolDomain:
+    Description: Cognito Hosted UI domain prefix (scheme-less).
+    Value: !Ref UserPoolDomain
+  HostedUiUrl:
+    Description: Cognito Hosted UI base URL — browser sign-in / `rastack dev` auth.
+    Value: !Sub "https://${NamePrefix}-${AppName}-${AWS::AccountId}.auth.${AWS::Region}.amazoncognito.com"
   WarehouseBucketName:
     Description: S3 Iceberg warehouse — the system of record.
     Value: !Ref WarehouseBucket
   AuditLogBucketName:
     Description: S3 access logs + CloudTrail data events for the warehouse.
     Value: !Ref AuditLogBucket
+  ProxyUrl:
+    Condition: HasProxy
+    Description: Base URL of the Cognito-authorized external-API proxy (when enabled).
+    Value: !Sub "https://${HttpApi}.execute-api.${AWS::Region}.amazonaws.com/proxy"

package/dist/wasm/rastack_wasm.js

@@ -375,7 +375,7 @@ function __wbg_get_imports() {
             return ret;
         },
         __wbindgen_cast_0000000000000001: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 88, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 90, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
             const ret = makeMutClosure(arg0, arg1, wasm_bindgen_ac0f9960a408a037___convert__closures_____invoke___wasm_bindgen_ac0f9960a408a037___JsValue__core_9b3796e30d99ddb7___result__Result_____wasm_bindgen_ac0f9960a408a037___JsError___true_);
             return ret;
         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rastack",
-  "version": "0.0.62",
+  "version": "0.0.64",
   "description": "",
   "main": "runtime.ts",
   "types": "runtime.ts",

package/provider/provider.tsx

@@ -170,6 +170,11 @@ export function RAStackProvider({
         const existing = await persistence.load();
         if (existing) {
           await engine.importWarehouse(existing);
+        } else if (config.seedWarehouse) {
+          // Seed from a bundled warehouse blob (exportWarehouse format) rather
+          // than loose Iceberg files.
+          const seed = await config.seedWarehouse();
+          if (seed) await engine.importWarehouse(seed);
         } else {
           const base = config.warehouseBaseUrl ?? "/data/warehouse/";
           const resources = manifestResources(manifest);
@@ -208,6 +213,24 @@ export function RAStackProvider({
       }, 400);
       persistRef.current = persist;
 
+      // Persist at the *engine* level, not just in the axios adapter. Consumers
+      // that talk to the engine directly (the admin console calls
+      // `engine.handle("DELETE", …)` straight, bypassing the generated hooks /
+      // axios seam) must still have their writes saved to IndexedDB — otherwise
+      // every reload re-seeds from the committed warehouse and silently
+      // resurrects deleted rows. Wrapping `handle` here makes persistence fire
+      // for both paths (the adapter's `onWrite` below then coalesces into the
+      // same debounce, so an app-hook write persists exactly once).
+      const MUTATING = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+      const rawHandle = engine.handle.bind(engine);
+      engine.handle = ((method: string, path: string, query?: any, body?: any) =>
+        Promise.resolve(rawHandle(method, path, query, body)).then((res: any) => {
+          if (MUTATING.has(String(method).toUpperCase()) && res && res.status < 300) {
+            persist();
+          }
+          return res;
+        })) as typeof engine.handle;
+
       engineRef.current = engine;
       configureApi({
         baseURL: "",

package/provider/types.ts

@@ -152,6 +152,15 @@ export interface RAStackProviderConfig {
   fileSource?: import("../cache").WarehouseFileSource;
   /** `s3` mode: how to load/save the warehouse blob from object storage. */
   warehouse?: WarehouseSource;
+  /**
+   * Seed `local` mode from a **bundled warehouse blob** — the format
+   * `exportWarehouse()` produces and `importWarehouse()` consumes — instead of
+   * walking loose Iceberg files under `warehouseBaseUrl`. Use this when the app
+   * commits a single warehouse blob asset (e.g. bundled JSON) rather than a
+   * directory of parquet files. Takes precedence over `warehouseBaseUrl` /
+   * `fileSource` seeding, and is ignored once a persisted local copy exists.
+   */
+  seedWarehouse?: () => Uint8Array | null | Promise<Uint8Array | null>;
   /**
    * Override how the WASM module is loaded. Supply this from app code (where
    * your bundler can resolve the generated bundle) if the default loader can't

package/src/compile/analyze.ts

@@ -179,7 +179,17 @@ function analyzeField(
     const app = literalTypeProp(fieldType, "__app", checker, initializer);
     const model = literalTypeProp(fieldType, "__model", checker, initializer);
     if (app && model) {
-      return { name, type: "fk", relation: { app, model } };
+      const fk: FieldModel = { name, type: "fk", relation: { app, model } };
+      // `s.ref(() => X, { null: true })` — a nullable relation (a shared secret
+      // with no project, an unassigned task). The options object is the ref
+      // call's second argument, read the same way scalar constraints are.
+      if (ts.isCallExpression(initializer)) {
+        const opts = literalToValue(initializer.arguments[1]);
+        if (opts && typeof opts === "object" && opts.null === true) {
+          fk.null = true;
+        }
+      }
+      return fk;
     }
     return undefined;
   }

package/src/define/index.ts

@@ -66,6 +66,9 @@ export interface Ref<App extends string, Model extends string> {
   readonly __model: Model;
   /** The authored `() => Resource` thunk — carried at runtime. */
   readonly target?: () => ResourceType<App, Model, any>;
+  /** Optional FK constraints — `null: true` makes the relation nullable
+   * (e.g. a shared secret with no project, or an unassigned task). */
+  readonly options?: { null?: boolean };
 }
 
 export interface StringOptions {
@@ -153,8 +156,9 @@ export const s = {
    */
   ref<A extends string, M extends string>(
     thunk: () => ResourceType<A, M, any>,
+    options?: { null?: boolean },
   ): Ref<A, M> {
-    return { __rastackRef: true, target: thunk } as Ref<A, M>;
+    return { __rastackRef: true, target: thunk, options } as Ref<A, M>;
   },
 };
 

package/src/define/manifest.ts

@@ -121,11 +121,17 @@ function runtimeField(
         `manifestFromResources: ${res.app}.${res.model}.${name} is an s.ref(...) whose target thunk did not return a resource() value`,
       );
     }
-    return {
+    const fk: FieldModel = {
       name,
       type: "fk",
       relation: { app: target.app, model: target.model },
     };
+    // A nullable FK (`s.ref(() => X, { null: true })`) — e.g. a shared secret
+    // with no project — so the engine allows and stores a null relation.
+    if ((field.options as { null?: boolean } | undefined)?.null === true) {
+      fk.null = true;
+    }
+    return fk;
   }
 
   if (typeof field.__rastackScalar !== "string") return undefined;

package/src/deploy/ci.ts

@@ -16,7 +16,12 @@
  * the same plan works before and after they are wired into the config.
  */
 
-import { DeployConfig } from "./config";
+import {
+  DeployConfig,
+  DeployOutputs,
+  EnvName,
+  resolveEnvironment,
+} from "./config";
 
 export type CiPhase = "check" | "build" | "deploy";
 
@@ -55,27 +60,47 @@ export interface CiPlanOptions {
   bin?: string;
   /** Skip the build steps in `deploy` (code already built this job). */
   skipBuild?: boolean;
-  /** Override the function name (else from cfg.outputs, else resolved live). */
+  /** Override the function name (else from the env's outputs, else resolved live). */
   functionName?: string;
-  /** Override the JWKS URL (else from cfg.outputs, else resolved live). */
+  /** Override the JWKS URL (else from the env's outputs, else resolved live). */
   jwksUrl?: string;
+  /**
+   * Which environment (dev/prod) to build+ship. When set, the stack name,
+   * outputs, and app label come from that environment — so `rastack ci deploy
+   * --env dev` targets the dev stack (dev's Cognito JWKS, dev's function). When
+   * unset the legacy single-stack fields (`cfg.stackName` / `cfg.outputs`) apply.
+   */
+  env?: EnvName;
+}
+
+/** The stack name + outputs + app label the plan targets, honouring `opts.env`. */
+function ciTarget(
+  cfg: DeployConfig,
+  opts: CiPlanOptions,
+): { stackName: string; outputs?: DeployOutputs; app: string } {
+  if (opts.env) {
+    const e = resolveEnvironment(cfg, opts.env);
+    return { stackName: e.stackName, outputs: e.outputs, app: e.appName };
+  }
+  return { stackName: cfg.stackName, outputs: cfg.outputs, app: cfg.app };
 }
 
 /**
- * A stack Output value: the literal from `cfg.outputs` if wired, else a shell
- * command substitution that resolves it live from CloudFormation. Keeping the
- * fallback inline (rather than a separate step) means the plan is a flat list of
- * self-contained commands that read correctly in any order.
+ * A stack Output value: the literal if wired, else a shell command substitution
+ * that resolves it live from CloudFormation. Keeping the fallback inline (rather
+ * than a separate step) means the plan is a flat list of self-contained commands
+ * that read correctly in any order.
  */
 function stackOutput(
-  cfg: DeployConfig,
+  stackName: string,
+  region: string,
   outputKey: string,
   literal?: string,
 ): string {
   if (literal) return literal;
   return (
-    `$(aws cloudformation describe-stacks --stack-name ${cfg.stackName} ` +
-    `--region ${cfg.region} ` +
+    `$(aws cloudformation describe-stacks --stack-name ${stackName} ` +
+    `--region ${region} ` +
     `--query "Stacks[0].Outputs[?OutputKey=='${outputKey}'].OutputValue" ` +
     `--output text)`
   );
@@ -107,11 +132,13 @@ export function buildSteps(
   opts: CiPlanOptions = {},
 ): CiStep[] {
   const stage = stageDir(cfg);
+  const target = ciTarget(cfg, opts);
   const archFlag = cfg.lambda.arch === "arm64" ? "--arm64" : "--x86-64";
   const jwks = stackOutput(
-    cfg,
+    target.stackName,
+    cfg.region,
     "JwksUrl",
-    opts.jwksUrl ?? cfg.outputs?.jwksUrl,
+    opts.jwksUrl ?? target.outputs?.jwksUrl,
   );
   return [
     compileStep(cfg),
@@ -146,12 +173,19 @@ export function deploySteps(
 ): CiStep[] {
   const stage = stageDir(cfg);
   const zip = `${stage}/bootstrap.zip`;
+  const target = ciTarget(cfg, opts);
   const fn = stackOutput(
-    cfg,
+    target.stackName,
+    cfg.region,
     "FunctionName",
-    opts.functionName ?? cfg.outputs?.functionName,
+    opts.functionName ?? target.outputs?.functionName,
+  );
+  const apiUrl = stackOutput(
+    target.stackName,
+    cfg.region,
+    "ApiUrl",
+    target.outputs?.apiUrl,
   );
-  const apiUrl = stackOutput(cfg, "ApiUrl", cfg.outputs?.apiUrl);
   const steps: CiStep[] = opts.skipBuild ? [] : buildSteps(cfg, opts);
   steps.push(
     {
@@ -167,7 +201,7 @@ export function deploySteps(
     },
     {
       name: "Report the API URL",
-      run: `echo "Deployed ${cfg.app} → ${apiUrl}"`,
+      run: `echo "Deployed ${target.app} → ${apiUrl}"`,
     },
   );
   return steps;