serverless-ircd 0.8.0 → 0.10.0

package/apps/aws-stack/tests/stack.test.ts

@@ -3,7 +3,7 @@
  *
  * These are the primary red→green tests for the infrastructure stack:
  * they assert the exact CloudFormation shape that `cdk synth` must
- * produce — six DynamoDB tables with the PLAN §4 schema, a single
+ * produce — five DynamoDB tables with the PLAN §4 schema, a single
  * Node 24 Lambda wired to all three WebSocket routes, the API Gateway
  * v2 WebSocket API, the two stack outputs, and a least-privilege guard
  * that no IAM policy grants `Resource: '*'` or `Action: '*'`.
@@ -18,28 +18,14 @@ import { App, type Stack } from 'aws-cdk-lib';
 import { Template } from 'aws-cdk-lib/assertions';
 import { describe, expect, it } from 'vitest';
 import { IrcAwsStack } from '../src/aws-stack.js';
+import type { StaticSiteProps } from '../src/static-site.js';
 
 /** All five table names that must exist in the stack (PLAN §4). */
-const TABLE_NAMES = ['Accounts', 'ChannelMembers', 'ChannelMeta', 'Connections', 'Nicks'] as const;
+const TABLE_NAMES = ['ChannelMembers', 'ChannelMeta', 'Connections', 'Nicks', 'Services'] as const;
 
-/** Default environment name assumed when the prop is omitted. */
-const DEFAULT_ENV = 'staging';
-
-/**
- * Capitalises the first character of an environment name so it composes
- * cleanly with the PascalCase logical table ids (`staging` → `Staging`).
- */
-function prefixedTableName(environmentName: string, logicalId: string): string {
-  return `${environmentName.charAt(0).toUpperCase()}${environmentName.slice(1)}${logicalId}`;
-}
-
-function makeTemplate(environmentName?: string): { app: App; stack: Stack; template: Template } {
+function makeTemplate(): { app: App; stack: Stack; template: Template } {
   const app = new App();
-  const stack = new IrcAwsStack(
-    app,
-    'TestStack',
-    environmentName !== undefined ? { environmentName } : undefined,
-  );
+  const stack = new IrcAwsStack(app, 'TestStack');
   const template = Template.fromStack(stack);
   return { app, stack, template };
 }
@@ -79,15 +65,15 @@ function findRuleTargetingLambda(
 }
 
 describe('IrcAwsStack — DynamoDB tables', () => {
-  it('creates exactly six DynamoDB tables', () => {
+  it('creates exactly five DynamoDB tables', () => {
     const { template } = makeTemplate();
-    template.resourceCountIs('AWS::DynamoDB::Table', 6);
+    template.resourceCountIs('AWS::DynamoDB::Table', 5);
   });
 
   it.each(TABLE_NAMES)('creates the %s table', (tableName) => {
     const { template } = makeTemplate();
     template.hasResourceProperties('AWS::DynamoDB::Table', {
-      TableName: prefixedTableName(DEFAULT_ENV, tableName),
+      TableName: tableName,
     });
   });
 
@@ -101,7 +87,7 @@ describe('IrcAwsStack — DynamoDB tables', () => {
   it('enables TTL on the Connections table via the idleSince attribute', () => {
     const { template } = makeTemplate();
     template.hasResourceProperties('AWS::DynamoDB::Table', {
-      TableName: prefixedTableName(DEFAULT_ENV, 'Connections'),
+      TableName: 'Connections',
       TimeToLiveSpecification: {
         AttributeName: 'idleSince',
         Enabled: true,
@@ -112,7 +98,7 @@ describe('IrcAwsStack — DynamoDB tables', () => {
   it('keys the Connections table by connectionId (String)', () => {
     const { template } = makeTemplate();
     template.hasResourceProperties('AWS::DynamoDB::Table', {
-      TableName: prefixedTableName(DEFAULT_ENV, 'Connections'),
+      TableName: 'Connections',
       AttributeDefinitions: [{ AttributeName: 'connectionId', AttributeType: 'S' }],
       KeySchema: [{ AttributeName: 'connectionId', KeyType: 'HASH' }],
     });
@@ -121,7 +107,7 @@ describe('IrcAwsStack — DynamoDB tables', () => {
   it('keys the ChannelMembers table by channelName (PK) + connectionId (SK)', () => {
     const { template } = makeTemplate();
     template.hasResourceProperties('AWS::DynamoDB::Table', {
-      TableName: prefixedTableName(DEFAULT_ENV, 'ChannelMembers'),
+      TableName: 'ChannelMembers',
       AttributeDefinitions: [
         { AttributeName: 'channelName', AttributeType: 'S' },
         { AttributeName: 'connectionId', AttributeType: 'S' },
@@ -136,7 +122,7 @@ describe('IrcAwsStack — DynamoDB tables', () => {
   it('keys the ChannelMeta table by channelName (String)', () => {
     const { template } = makeTemplate();
     template.hasResourceProperties('AWS::DynamoDB::Table', {
-      TableName: prefixedTableName(DEFAULT_ENV, 'ChannelMeta'),
+      TableName: 'ChannelMeta',
       AttributeDefinitions: [{ AttributeName: 'channelName', AttributeType: 'S' }],
       KeySchema: [{ AttributeName: 'channelName', KeyType: 'HASH' }],
     });
@@ -145,25 +131,16 @@ describe('IrcAwsStack — DynamoDB tables', () => {
   it('keys the Nicks table by nickLower (String)', () => {
     const { template } = makeTemplate();
     template.hasResourceProperties('AWS::DynamoDB::Table', {
-      TableName: prefixedTableName(DEFAULT_ENV, 'Nicks'),
+      TableName: 'Nicks',
       AttributeDefinitions: [{ AttributeName: 'nickLower', AttributeType: 'S' }],
       KeySchema: [{ AttributeName: 'nickLower', KeyType: 'HASH' }],
     });
   });
 
-  it('keys the Accounts table by account (String)', () => {
-    const { template } = makeTemplate();
-    template.hasResourceProperties('AWS::DynamoDB::Table', {
-      TableName: prefixedTableName(DEFAULT_ENV, 'Accounts'),
-      AttributeDefinitions: [{ AttributeName: 'account', AttributeType: 'S' }],
-      KeySchema: [{ AttributeName: 'account', KeyType: 'HASH' }],
-    });
-  });
-
   it('keys the Services table by composite pk/sk (String/String)', () => {
     const { template } = makeTemplate();
     template.hasResourceProperties('AWS::DynamoDB::Table', {
-      TableName: prefixedTableName(DEFAULT_ENV, 'Services'),
+      TableName: 'Services',
       AttributeDefinitions: [
         { AttributeName: 'pk', AttributeType: 'S' },
         { AttributeName: 'sk', AttributeType: 'S' },
@@ -287,12 +264,20 @@ describe('IrcAwsStack — API Gateway logging', () => {
     ]);
   });
 
-  it('wires the stage execution logging level to the parameter (Ref) with data tracing on', () => {
+  it('wires the stage execution logging level to the parameter (Ref) with full-frame body tracing OFF by default', () => {
+    // Regression guard: `dataTraceEnabled` MUST default to `false`. For a
+    // WebSocket IRC endpoint, APIGW execution-log body tracing writes the
+    // full payload of every frame — including `PASS <password>`,
+    // `AUTHENTICATE <base64-SASL-PLAIN>`, `JOIN #chan <channel-key>`, and
+    // every `PRIVMSG`/`NOTICE` — to the APIGW CloudWatch log group. Anyone
+    // with `logs:GetLogEvents` recovers IRC credentials verbatim. The
+    // default is therefore safe-by-default; re-enabling requires an
+    // explicit, double-opt-in escape hatch (see the guard tests below).
     const { template } = makeTemplate();
     template.hasResourceProperties('AWS::ApiGatewayV2::Stage', {
       DefaultRouteSettings: {
         LoggingLevel: { Ref: 'ApiGatewayLoggingLevel' },
-        DataTraceEnabled: true,
+        DataTraceEnabled: false,
       },
     });
   });
@@ -403,6 +388,54 @@ describe('IrcAwsStack — API Gateway logging', () => {
   });
 });
 
+describe('IrcAwsStack — `dataTraceEnabled` credential-leak guard', () => {
+  /**
+   * Since the staging/prod split was collapsed (every synth is effectively a
+   * prod synth), `dataTraceEnabled` defaults to `false` and the ONLY way to
+   * re-enable it is the explicit `allowDataTrace` + `iUnderstandThisLeaksCredentials`
+   * double opt-in. Enabling without the confirmation REFUSES synthesis with a
+   * loud error naming the IRC credentials it would leak.
+   */
+  it('refuses synth when allowDataTrace=true is set WITHOUT the leak acknowledgement', () => {
+    const app = new App();
+    expect(() => new IrcAwsStack(app, 'TestStack', { allowDataTrace: true })).toThrow(
+      /DataTraceEnabled|dataTraceEnabled|leak|credential/i,
+    );
+  });
+
+  it('still refuses synth when allowDataTrace=true is set but the acknowledgement is explicitly false', () => {
+    // Belt-and-braces: an explicit `false` confirmation is identical to
+    // omitting it — the guard must not be bypassable by passing the prop.
+    const app = new App();
+    expect(
+      () =>
+        new IrcAwsStack(app, 'TestStack', {
+          allowDataTrace: true,
+          iUnderstandThisLeaksCredentials: false,
+        }),
+    ).toThrow(/DataTraceEnabled|dataTraceEnabled|leak|credential/i);
+  });
+
+  it('permits dataTraceEnabled ONLY when allowDataTrace AND the leak acknowledgement are BOTH true', () => {
+    // The documented dev escape hatch: a sandbox operator who has read the
+    // warning can force-enable full-frame tracing by supplying the
+    // two-step opt-in. This is the ONLY path that produces
+    // DataTraceEnabled=true, and it is deliberately awkward to set.
+    const app = new App();
+    const stack = new IrcAwsStack(app, 'TestStack', {
+      allowDataTrace: true,
+      iUnderstandThisLeaksCredentials: true,
+    });
+    const template = Template.fromStack(stack);
+    template.hasResourceProperties('AWS::ApiGatewayV2::Stage', {
+      DefaultRouteSettings: {
+        LoggingLevel: { Ref: 'ApiGatewayLoggingLevel' },
+        DataTraceEnabled: true,
+      },
+    });
+  });
+});
+
 describe('IrcAwsStack — Lambda', () => {
   it('creates exactly three Lambda functions (handler + sweeper + pingChecker)', () => {
     const { template } = makeTemplate();
@@ -438,7 +471,7 @@ describe('IrcAwsStack — gone-connection sweeper', () => {
     // Both Lambda roles must scope their DynamoDB actions to the concrete
     // table ARNs — the least-privilege suite below also asserts no '*'.
     const tables = template.findResources('AWS::DynamoDB::Table');
-    expect(Object.keys(tables)).toHaveLength(6);
+    expect(Object.keys(tables)).toHaveLength(5);
   });
 });
 
@@ -637,73 +670,44 @@ describe('IrcAwsStack — least-privilege IAM', () => {
   });
 });
 
-describe('IrcAwsStack — environmentName prop (env isolation)', () => {
-  it('prefixes the Connections table name with the production environment', () => {
-    const { template } = makeTemplate('production');
-    template.hasResourceProperties('AWS::DynamoDB::Table', {
-      TableName: 'ProductionConnections',
-    });
-  });
-
-  it('prefixes the Connections table name with the staging environment', () => {
-    const { template } = makeTemplate('staging');
+describe('IrcAwsStack — single deploy target (no env prefixing)', () => {
+  it('uses the bare logical id as the Connections table name (no env prefix)', () => {
+    const { template } = makeTemplate();
     template.hasResourceProperties('AWS::DynamoDB::Table', {
-      TableName: 'StagingConnections',
+      TableName: 'Connections',
     });
   });
 
-  it('defaults to the staging prefix when the prop is omitted', () => {
+  it('uses the bare logical id as the Services table name (no env prefix)', () => {
     const { template } = makeTemplate();
     template.hasResourceProperties('AWS::DynamoDB::Table', {
-      TableName: prefixedTableName(DEFAULT_ENV, 'Connections'),
+      TableName: 'Services',
     });
   });
 
-  it('injects the prefixed physical table name into every Lambda env var', () => {
-    const { template } = makeTemplate('production');
+  it('injects the bare logical table name into every Lambda env var', () => {
+    const { template } = makeTemplate();
     const fns = template.findResources('AWS::Lambda::Function') as Record<
       string,
       { Properties?: { Environment?: { Variables?: Record<string, string> } } }
     >;
-    // Every Lambda must carry CONNECTIONS_TABLE pointing at the production-prefixed name.
-    const withPrefixed = Object.values(fns).filter(
-      (fn) => fn.Properties?.Environment?.Variables?.CONNECTIONS_TABLE === 'ProductionConnections',
+    // Every Lambda must carry CONNECTIONS_TABLE pointing at the bare name.
+    const withBare = Object.values(fns).filter(
+      (fn) => fn.Properties?.Environment?.Variables?.CONNECTIONS_TABLE === 'Connections',
     );
-    expect(withPrefixed).toHaveLength(3);
+    expect(withBare).toHaveLength(3);
   });
 
-  it('produces non-colliding table names for staging vs production', () => {
-    const stagingTables = Object.keys(
-      makeTemplate('staging').template.findResources('AWS::DynamoDB::Table'),
-    );
-    const prodTables = Object.keys(
-      makeTemplate('production').template.findResources('AWS::DynamoDB::Table'),
-    );
-    const stagingNames = new Set(
-      Object.values(
-        makeTemplate('staging').template.findResources('AWS::DynamoDB::Table') as Record<
-          string,
-          { Properties: { TableName: string } }
-        >,
-      ).map((t) => t.Properties.TableName),
-    );
-    const prodNames = Object.values(
-      makeTemplate('production').template.findResources('AWS::DynamoDB::Table') as Record<
-        string,
-        { Properties: { TableName: string } }
-      >,
-    ).map((t) => t.Properties.TableName);
-    expect(stagingTables).toHaveLength(6);
-    expect(prodTables).toHaveLength(6);
-    expect(prodNames.every((n) => !stagingNames.has(n))).toBe(true);
-  });
-
-  it('includes the environment suffix in the CloudFormation stack name', () => {
-    const app = new App();
-    const stack = new IrcAwsStack(app, 'IrcAwsStack-production', {
-      environmentName: 'production',
-    });
-    expect(stack.stackName).toBe('IrcAwsStack-production');
+  it('produces a fixed set of bare table names (no Staging* / Production* prefixes)', () => {
+    const { template } = makeTemplate();
+    const tables = template.findResources('AWS::DynamoDB::Table') as Record<
+      string,
+      { Properties: { TableName: string } }
+    >;
+    const names = Object.values(tables).map((t) => t.Properties.TableName);
+    expect(names).toHaveLength(5);
+    // No name may carry a capitalized environment prefix.
+    expect(names.every((n) => !/^(Staging|Production)/.test(n))).toBe(true);
   });
 });
 
@@ -853,6 +857,82 @@ describe('IrcAwsStack — server identity CloudFormation parameters', () => {
   });
 });
 
+describe('IrcAwsStack — `$connect` Origin allowlist (CSWSH defence)', () => {
+  /** Finds a Lambda function resource by its logical-id prefix (e.g. `IrcHandler`). */
+  function findFunction(
+    template: Template,
+    idPrefix: string,
+  ): {
+    Properties?: { Environment?: { Variables?: Record<string, unknown> } };
+  } {
+    const fns = template.findResources('AWS::Lambda::Function') as Record<
+      string,
+      { Properties?: { Environment?: { Variables?: Record<string, unknown> } } }
+    >;
+    const found = Object.entries(fns).find(([id]) => id.startsWith(idPrefix));
+    if (!found) {
+      throw new Error(`No Lambda with logical id starting with "${idPrefix}"`);
+    }
+    return found[1];
+  }
+
+  it('does NOT inject WEB_ORIGINS on the handler when the prop is omitted (defence opt-in)', () => {
+    // The CSWSH defence is opt-in: existing AWS deployments without a
+    // web frontend must be unchanged on upgrade, so the env var is
+    // omitted entirely (not set to '') when the prop is absent. The
+    // handler's parser then returns an empty set and the `$connect`
+    // Origin check is skipped.
+    const app = new App();
+    const stack = new IrcAwsStack(app, 'TestStack');
+    const template = Template.fromStack(stack);
+    expect(
+      findFunction(template, 'IrcHandler').Properties?.Environment?.Variables?.WEB_ORIGINS,
+    ).toBeUndefined();
+  });
+
+  it('does NOT inject WEB_ORIGINS when the prop is an empty string', () => {
+    const app = new App();
+    const stack = new IrcAwsStack(app, 'TestStack', { webOrigins: '' });
+    const template = Template.fromStack(stack);
+    expect(
+      findFunction(template, 'IrcHandler').Properties?.Environment?.Variables?.WEB_ORIGINS,
+    ).toBeUndefined();
+  });
+
+  it('injects WEB_ORIGINS on the wss handler when the prop is set', () => {
+    const app = new App();
+    const stack = new IrcAwsStack(app, 'TestStack', {
+      webOrigins: 'https://app.example.com, https://staging.app.example.com',
+    });
+    const template = Template.fromStack(stack);
+    expect(
+      findFunction(template, 'IrcHandler').Properties?.Environment?.Variables?.WEB_ORIGINS,
+    ).toBe('https://app.example.com, https://staging.app.example.com');
+  });
+
+  it('does NOT inject WEB_ORIGINS on the sweeper (never runs `$connect`)', () => {
+    const app = new App();
+    const stack = new IrcAwsStack(app, 'TestStack', {
+      webOrigins: 'https://app.example.com',
+    });
+    const template = Template.fromStack(stack);
+    expect(
+      findFunction(template, 'IrcSweeper').Properties?.Environment?.Variables?.WEB_ORIGINS,
+    ).toBeUndefined();
+  });
+
+  it('does NOT inject WEB_ORIGINS on the ping checker (never runs `$connect`)', () => {
+    const app = new App();
+    const stack = new IrcAwsStack(app, 'TestStack', {
+      webOrigins: 'https://app.example.com',
+    });
+    const template = Template.fromStack(stack);
+    expect(
+      findFunction(template, 'IrcPingChecker').Properties?.Environment?.Variables?.WEB_ORIGINS,
+    ).toBeUndefined();
+  });
+});
+
 describe('IrcAwsStack — TCP+TLS NLB adapter', () => {
   /** Makes a template WITH the tcpTlsDomainName prop (enables the NLB path). */
   function makeTcpTemplate(domainName = 'irc.example.com'): {
@@ -862,7 +942,6 @@ describe('IrcAwsStack — TCP+TLS NLB adapter', () => {
   } {
     const app = new App();
     const stack = new IrcAwsStack(app, 'TestStack', {
-      environmentName: 'staging',
       tcpTlsDomainName: domainName,
     });
     const template = Template.fromStack(stack);
@@ -947,3 +1026,99 @@ describe('IrcAwsStack — TCP+TLS NLB adapter', () => {
     });
   });
 });
+
+describe('IrcAwsStack — web client hosting (StaticSite)', () => {
+  /** Makes a template WITH the webSite prop (enables the StaticSite path). */
+  function makeWebTemplate(webSite: StaticSiteProps = {}): {
+    app: App;
+    stack: Stack;
+    template: Template;
+  } {
+    const app = new App();
+    const stack = new IrcAwsStack(app, 'TestStack', { webSite });
+    const template = Template.fromStack(stack);
+    return { app, stack, template };
+  }
+
+  describe('when webSite is omitted (default)', () => {
+    it('creates no S3 origin bucket for the web client', () => {
+      const { template } = makeTemplate();
+      template.resourceCountIs('AWS::S3::Bucket', 0);
+    });
+
+    it('creates no CloudFront distribution', () => {
+      const { template } = makeTemplate();
+      template.resourceCountIs('AWS::CloudFront::Distribution', 0);
+    });
+
+    it('creates no Origin Access Control', () => {
+      const { template } = makeTemplate();
+      template.resourceCountIs('AWS::CloudFront::OriginAccessControl', 0);
+    });
+  });
+
+  describe('when webSite is provided', () => {
+    it('creates an S3 origin bucket', () => {
+      const { template } = makeWebTemplate();
+      template.resourceCountIs('AWS::S3::Bucket', 1);
+    });
+
+    it('creates a CloudFront distribution with an S3 origin + OAC', () => {
+      const { template } = makeWebTemplate();
+      template.resourceCountIs('AWS::CloudFront::Distribution', 1);
+      template.resourceCountIs('AWS::CloudFront::OriginAccessControl', 1);
+    });
+
+    it('still creates the wss WebSocket API (both paths coexist)', () => {
+      const { template } = makeWebTemplate();
+      template.hasResourceProperties('AWS::ApiGatewayV2::Api', {
+        ProtocolType: 'WEBSOCKET',
+      });
+    });
+
+    it('emits a WebsiteURL output with a stable logical id naming the distribution domain', () => {
+      const { template } = makeWebTemplate();
+      const outputs = (template.toJSON().Outputs ?? {}) as Record<string, { Value?: unknown }>;
+      expect(outputs.WebsiteURL, 'expected a WebsiteURL output with a stable key').toBeDefined();
+      const distIds = Object.keys(template.findResources('AWS::CloudFront::Distribution'));
+      expect(distIds).toHaveLength(1);
+      const getAtt = (outputs.WebsiteURL?.Value as { 'Fn::GetAtt'?: unknown[] })?.['Fn::GetAtt'];
+      expect(getAtt, 'expected WebsiteURL.Value to Fn::GetAtt the distribution DomainName').toEqual(
+        [distIds[0], 'DomainName'],
+      );
+    });
+
+    // The AWS web deploy pipeline (`scripts/deploy-web-aws.mjs`) reads these
+    // outputs to drive `s3 sync <bucket>` and `cloudfront create-invalidation
+    // --distribution-id <id>`. They MUST be exposed at the parent-stack level
+    // with stable logical IDs (no CDK hashing, since the CfnOutput constructs
+    // live at the stack root alongside `ConnectUrl` / `ManagementUrl`) — the
+    // script queries them by exact key via `describe-stacks --query`.
+    it('emits a WebsiteBucketName output Ref-ing the S3 origin bucket', () => {
+      const { template } = makeWebTemplate();
+      const outputs = (template.toJSON().Outputs ?? {}) as Record<string, { Value?: unknown }>;
+      const bucketIds = Object.keys(template.findResources('AWS::S3::Bucket'));
+      expect(bucketIds).toHaveLength(1);
+      expect(outputs.WebsiteBucketName, 'expected a WebsiteBucketName output').toBeDefined();
+      const ref = (outputs.WebsiteBucketName?.Value as { Ref?: unknown })?.Ref;
+      expect(ref, 'expected WebsiteBucketName.Value to be a { Ref: <bucket-logical-id> }').toBe(
+        bucketIds[0],
+      );
+    });
+
+    it('emits a WebsiteDistributionId output Ref-ing the CloudFront distribution', () => {
+      const { template } = makeWebTemplate();
+      const outputs = (template.toJSON().Outputs ?? {}) as Record<string, { Value?: unknown }>;
+      const distIds = Object.keys(template.findResources('AWS::CloudFront::Distribution'));
+      expect(distIds).toHaveLength(1);
+      expect(
+        outputs.WebsiteDistributionId,
+        'expected a WebsiteDistributionId output',
+      ).toBeDefined();
+      const ref = (outputs.WebsiteDistributionId?.Value as { Ref?: unknown })?.Ref;
+      expect(ref, 'expected WebsiteDistributionId.Value to be a { Ref: <dist-logical-id> }').toBe(
+        distIds[0],
+      );
+    });
+  });
+});