sst 1.16.0 → 2.0.0-rc.0

package/src/constructs/util/functionUrlCors.ts

@@ -1,96 +0,0 @@
-import { HttpMethod, FunctionUrlCorsOptions } from "aws-cdk-lib/aws-lambda";
-import { Duration, toCdkDuration } from "./duration.js";
-
-export interface CorsProps {
-  /**
-   * Specifies whether credentials are included in the CORS request.
-   * @default false
-   */
-  allowCredentials?: boolean;
-  /**
-   * The collection of allowed headers.
-   * @default Allow all headers.
-   *
-   * @example
-   * ```js
-   * // Allow all headers
-   * allowHeaders: ["*"]
-   *
-   * // Allow specific headers
-   * allowHeaders: ["Accept", "Content-Type", "Authorization"]
-   * ```
-   */
-  allowHeaders?: string[];
-  /**
-   * The collection of allowed HTTP methods.
-   * @default Allow all methods.
-   *
-   * @example
-   * ```js
-   * // Allow all methods
-   * allowMethods: ["*"]
-   *
-   * // Allow specific methods
-   * allowMethods: ["GET", "POST"]
-   * ```
-   */
-  allowMethods?: (keyof Omit<typeof HttpMethod, "ALL"> | "*")[];
-  /**
-   * The collection of allowed origins.
-   * @default Allow all origins.
-   *
-   * @example
-   * ```js
-   * // Allow all origins
-   * allowOrigins: ["*"]
-   *
-   * // Allow specific origins. Note that the url protocol, ie. "https://", is required.
-   * allowOrigins: ["https://domain.com"]
-   * ```
-   */
-  allowOrigins?: string[];
-  /**
-   * The collection of exposed headers.
-   * @default No expose headers are allowed.
-   */
-  exposeHeaders?: string[];
-  /**
-   * Specify how long the results of a preflight response can be cached
-   * @default No caching
-   *
-   * @example
-   * ```js
-   * maxAge: "1 day"
-   * ```
-   */
-  maxAge?: Duration;
-}
-
-export function buildCorsConfig(
-  cors?: boolean | CorsProps
-): FunctionUrlCorsOptions | undefined {
-  // Handle cors: false
-  if (cors === false) {
-    return;
-  }
-
-  // Handle cors: true | undefined
-  if (cors === undefined || cors === true) {
-    cors = {} as CorsProps;
-  }
-
-  // Handle cors: CorsProps
-  return {
-    allowCredentials: cors.allowCredentials,
-    allowedHeaders: cors.allowHeaders || ["*"],
-    allowedMethods: (cors.allowMethods || ["*"]).map(
-      (method) =>
-        method === "*"
-          ? HttpMethod.ALL
-          : HttpMethod[method as keyof typeof HttpMethod]
-    ),
-    allowedOrigins: cors.allowOrigins || ["*"],
-    exposedHeaders: cors.exposeHeaders,
-    maxAge: cors.maxAge && toCdkDuration(cors.maxAge),
-  };
-}

package/src/constructs/util/permission.ts

@@ -1,299 +0,0 @@
-/* eslint-disable @typescript-eslint/ban-ts-comment*/
-
-import { Construct, IConstruct } from "constructs";
-import * as iam from "aws-cdk-lib/aws-iam";
-import { getChildLogger } from "@serverless-stack/core";
-import {
-  Api,
-  Job,
-  RDS,
-  Table,
-  Topic,
-  Queue,
-  Bucket,
-  EventBus,
-  Function,
-  AppSyncApi,
-  WebSocketApi,
-  KinesisStream,
-  ApiGatewayV1Api,
-  Stack,
-} from "../index.js";
-import { isCDKConstruct, isCDKConstructOf } from "../Construct.js";
-
-const logger = getChildLogger("resources");
-
-export type Permissions = "*" | Permission[];
-type SupportedPermissions =
-  | "execute-api"
-  | "appsync"
-  | "dynamodb"
-  | "sns"
-  | "sqs"
-  | "events"
-  | "kinesis"
-  | "s3"
-  | "rds-data"
-  | "secretsmanager"
-  | "lambda"
-  | "ssm";
-type Permission =
-  | SupportedPermissions
-  | Omit<string, SupportedPermissions>
-  | IConstruct
-  | [IConstruct, string]
-  | iam.PolicyStatement;
-type StatementsAndGrants = {
-  statements: iam.PolicyStatement[];
-  grants: [IConstruct, string][];
-}
-
-export function attachPermissionsToRole(
-  role: iam.Role,
-  permissions: Permissions
-): void {
-  const { statements, grants } = permissionsToStatementsAndGrants(permissions);
-  statements.forEach((statement) => role.addToPolicy(statement));
-  grants.forEach(grant => {
-    const construct = grant[0] as Construct;
-    const methodName = grant[1] as keyof Construct;
-    (construct[methodName] as { (construct: Construct): void })(role);
-  });
-}
-
-export function attachPermissionsToPolicy(
-  policy: iam.Policy,
-  permissions: Permissions
-): void {
-  const { statements, grants } = permissionsToStatementsAndGrants(permissions);
-  statements.forEach((statement) => policy.addStatements(statement));
-  grants.forEach(grant => {
-    throw new Error(`Cannot attach the "${grant[1]}" permission to an IAM policy.`);
-  });
-}
-
-function permissionsToStatementsAndGrants(permissions: Permissions): StatementsAndGrants {
-  // Four patterns
-  //
-  // attachPermissions("*");
-  // attachPermissions([ 'sns', 'sqs' ]);
-  // attachPermissions([ event, queue ]);
-  // attachPermissions([
-  //   [ event.snsTopic, 'grantPublish' ],
-  //   [ queue.sqsQueue, 'grantSendMessages' ],
-  // ]);
-  // attachPermissions([
-  //   new iam.PolicyStatement({
-  //     actions: ["s3:*"],
-  //     effect: iam.Effect.ALLOW,
-  //     resources: [
-  //       bucket.bucketArn + "/private/${cognito-identity.amazonaws.com:sub}/*",
-  //     ],
-  //   })
-  // ]);
-
-  ////////////////////////////////////
-  // Case: 'admin' permissions => '*'
-  ////////////////////////////////////
-  if (permissions === "*") {
-    return {
-      statements: [buildPolicyStatement(permissions, ["*"])],
-      grants: [],
-    };
-  }
-
-  if (!Array.isArray(permissions)) {
-    throw new Error(
-      `The specified permissions are not supported. They are expected to be "*" or an array.`
-    );
-  }
-
-  // Handle array of permissions
-  const statements: iam.PolicyStatement[] = [];
-  const grants: [IConstruct, string][] = [];
-  permissions.forEach((permission: Permission) => {
-    ////////////////////////////////////
-    // Case: string ie. 's3' or 's3:*'
-    ////////////////////////////////////
-    if (typeof permission === "string") {
-      const perm =
-        permission.indexOf(":") === -1 ? `${permission}:*` : permission;
-      statements.push(buildPolicyStatement(perm, ["*"]));
-    }
-    ////////////////////////////////////
-    // Case: iam.PolicyStatement
-    ////////////////////////////////////
-    else if (
-      isCDKConstructOf(
-        permission as Construct,
-        "aws-cdk-lib.aws_iam.PolicyStatement"
-      )
-    ) {
-      statements.push(permission as iam.PolicyStatement);
-    }
-    ////////////////////////////////////
-    // Case: SST construct
-    ////////////////////////////////////
-    else if (permission instanceof Api) {
-      const httpApi = permission.cdk.httpApi;
-      const { account, region } = Stack.of(httpApi);
-      statements.push(
-        buildPolicyStatement("execute-api:Invoke", [
-          `arn:aws:execute-api:${region}:${account}:${httpApi.httpApiId}/*`,
-        ])
-      );
-    } else if (permission instanceof ApiGatewayV1Api) {
-      const restApi = permission.cdk.restApi;
-      const { account, region } = Stack.of(restApi);
-      statements.push(
-        buildPolicyStatement("execute-api:Invoke", [
-          `arn:aws:execute-api:${region}:${account}:${restApi.restApiId}/*`,
-        ])
-      );
-    } else if (permission instanceof WebSocketApi) {
-      const webSocketApi = permission.cdk.webSocketApi;
-      const { account, region } = Stack.of(webSocketApi);
-      statements.push(
-        buildPolicyStatement("execute-api:Invoke", [
-          `arn:aws:execute-api:${region}:${account}:${webSocketApi.apiId}/*`,
-        ])
-      );
-      statements.push(
-        buildPolicyStatement("execute-api:ManageConnections", [
-          permission._connectionsArn,
-        ])
-      );
-    } else if (permission instanceof AppSyncApi) {
-      const graphqlApi = permission.cdk.graphqlApi;
-      const { account, region } = Stack.of(graphqlApi);
-      statements.push(
-        buildPolicyStatement("appsync:GraphQL", [
-          `arn:aws:appsync:${region}:${account}:apis/${graphqlApi.apiId}/*`,
-        ])
-      );
-    } else if (permission instanceof Table) {
-      const tableArn = permission.cdk.table.tableArn;
-      statements.push(buildPolicyStatement("dynamodb:*", [tableArn, `${tableArn}/*`]));
-    } else if (permission instanceof Topic) {
-      statements.push(buildPolicyStatement("sns:*", [permission.cdk.topic.topicArn]));
-    } else if (permission instanceof Queue) {
-      statements.push(buildPolicyStatement("sqs:*", [permission.cdk.queue.queueArn]));
-    } else if (permission instanceof EventBus) {
-      statements.push(
-        buildPolicyStatement("events:*", [permission.cdk.eventBus.eventBusArn])
-      );
-    } else if (permission instanceof KinesisStream) {
-      statements.push(
-        buildPolicyStatement("kinesis:*", [permission.cdk.stream.streamArn])
-      );
-    } else if (permission instanceof Bucket) {
-      const bucketArn = permission.cdk.bucket.bucketArn;
-      statements.push(buildPolicyStatement("s3:*", [bucketArn, `${bucketArn}/*`]));
-    } else if (permission instanceof RDS) {
-      statements.push(buildPolicyStatement("rds-data:*", [permission.clusterArn]));
-      if (permission.cdk.cluster.secret) {
-        statements.push(
-          buildPolicyStatement(
-            ["secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret"],
-            [permission.cdk.cluster.secret.secretArn]
-          )
-        );
-      }
-    } else if (permission instanceof Function) {
-      statements.push(buildPolicyStatement("lambda:*", [permission.functionArn]));
-    } else if (permission instanceof Job) {
-      statements.push(buildPolicyStatement("lambda:*", [permission._jobInvoker.functionArn]));
-    }
-    ////////////////////////////////////
-    // Case: CDK constructs
-    ////////////////////////////////////
-    else if ((permission as any).tableArn && (permission as any).tableName) {
-      // @ts-expect-error We do not want to import the cdk modules, just cast to any
-      const tableArn = permission.tableArn;
-      statements.push(buildPolicyStatement("dynamodb:*", [tableArn, `${tableArn}/*`]));
-    } else if ((permission as any).topicArn && (permission as any).topicName) {
-      // @ts-expect-error We do not want to import the cdk modules, just cast to any
-      statements.push(buildPolicyStatement("sns:*", [permission.topicArn]));
-    } else if ((permission as any).queueArn && (permission as any).queueName) {
-      // @ts-expect-error We do not want to import the cdk modules, just cast to any
-      statements.push(buildPolicyStatement("sqs:*", [permission.queueArn]));
-    } else if (
-      (permission as any).eventBusArn &&
-      (permission as any).eventBusName
-    ) {
-      // @ts-expect-error We do not want to import the cdk modules, just cast to any
-      statements.push(buildPolicyStatement("events:*", [permission.eventBusArn]));
-    } else if (
-      (permission as any).streamArn &&
-      (permission as any).streamName
-    ) {
-      // @ts-expect-error We do not want to import the cdk modules, just cast to any
-      statements.push(buildPolicyStatement("kinesis:*", [permission.streamArn]));
-    } else if (
-      (permission as any).deliveryStreamArn &&
-      (permission as any).deliveryStreamName
-    ) {
-      statements.push(
-        buildPolicyStatement("firehose:*", [(permission as any).deliveryStreamArn])
-      );
-    } else if (
-      (permission as any).bucketArn &&
-      (permission as any).bucketName
-    ) {
-      // @ts-expect-error We do not want to import the cdk modules, just cast to any
-      const bucketArn = permission.bucketArn;
-      statements.push(buildPolicyStatement("s3:*", [bucketArn, `${bucketArn}/*`]));
-    } else if ((permission as any).clusterArn) {
-      // For ServerlessCluster, we need to grant:
-      // - permisssions to access the Data API;
-      // - permisssions to access the Secret Manager (required by Data API).
-      // No need to grant the permissions for IAM database authentication
-      statements.push(
-        buildPolicyStatement("rds-data:*", [(permission as any).clusterArn])
-      );
-      const secret = (permission as any).secret;
-      if (secret) {
-        statements.push(
-          buildPolicyStatement(
-            ["secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret"],
-            [secret.secretArn]
-          )
-        );
-      }
-    }
-    ////////////////////////////////////
-    // Case: grant method
-    ////////////////////////////////////
-    else if (
-      Array.isArray(permission) &&
-      permission.length === 2 &&
-      isCDKConstruct(permission[0]) &&
-      typeof permission[1] === "string"
-    ) {
-      const construct = permission[0] as Construct;
-      const methodName = permission[1] as keyof Construct;
-      if (typeof construct[methodName] !== "function")
-        throw new Error(
-          `The specified grant method is incorrect.
-          Check the available methods that prefixed with grants on the Construct`
-        );
-      grants.push(permission);
-    } else {
-      logger.debug("permission object", permission);
-      throw new Error(`The specified permissions are not supported.`);
-    }
-  });
-
-  return { statements, grants }
-}
-
-function buildPolicyStatement(
-  actions: string | string[],
-  resources: string[]
-): iam.PolicyStatement {
-  return new iam.PolicyStatement({
-    effect: iam.Effect.ALLOW,
-    actions: typeof actions === "string" ? [actions] : actions,
-    resources,
-  });
-}

package/src/constructs/util/python/bundling.ts

@@ -1,174 +0,0 @@
-/**
- * This file is copied from https://github.com/aws/aws-cdk/blob/master/packages/@aws-cdk/aws-lambda-python/lib/bundling.ts
- */
-import fs from "fs";
-import url from "url";
-import path from "path";
-import * as cdk from "aws-cdk-lib";
-import * as lambda from "aws-cdk-lib/aws-lambda";
-const __dirname = path.dirname(url.fileURLToPath(import.meta.url));
-
-/**
- * Dependency files to exclude from the asset hash.
- */
-export const DEPENDENCY_EXCLUDES = ["*.pyc"];
-
-/**
- * The location in the image that the bundler image caches dependencies.
- */
-export const BUNDLER_DEPENDENCIES_CACHE = "/var/dependencies";
-
-/**
- * Options for bundling
- */
-export interface BundlingOptions {
-  /**
-   * Entry path
-   */
-  readonly entry: string;
-
-  /**
-   * The runtime of the lambda function
-   */
-  readonly runtime: lambda.Runtime;
-
-  /**
-   * Output path suffix ('python' for a layer, '.' otherwise)
-   */
-  readonly outputPathSuffix: string;
-
-  /**
-   * Determines how asset hash is calculated. Assets will get rebuild and
-   * uploaded only if their hash has changed.
-   *
-   * If asset hash is set to `SOURCE` (default), then only changes to the source
-   * directory will cause the asset to rebuild. This means, for example, that in
-   * order to pick up a new dependency version, a change must be made to the
-   * source tree. Ideally, this can be implemented by including a dependency
-   * lockfile in your source tree or using fixed dependencies.
-   *
-   * If the asset hash is set to `OUTPUT`, the hash is calculated after
-   * bundling. This means that any change in the output will cause the asset to
-   * be invalidated and uploaded. Bear in mind that `pip` adds timestamps to
-   * dependencies it installs, which implies that in this mode Python bundles
-   * will _always_ get rebuild and uploaded. Normally this is an anti-pattern
-   * since build
-   *
-   * @default AssetHashType.SOURCE By default, hash is calculated based on the
-   * contents of the source directory. If `assetHash` is also specified, the
-   * default is `CUSTOM`. This means that only updates to the source will cause
-   * the asset to rebuild.
-   */
-  readonly assetHashType?: cdk.AssetHashType;
-
-  /**
-   * Specify a custom hash for this asset. If `assetHashType` is set it must
-   * be set to `AssetHashType.CUSTOM`. For consistency, this custom hash will
-   * be SHA256 hashed and encoded as hex. The resulting hash will be the asset
-   * hash.
-   *
-   * NOTE: the hash is used in order to identify a specific revision of the asset, and
-   * used for optimizing and caching deployment activities related to this asset such as
-   * packaging, uploading to Amazon S3, etc. If you chose to customize the hash, you will
-   * need to make sure it is updated every time the asset changes, or otherwise it is
-   * possible that some deployments will not be invalidated.
-   *
-   * @default - based on `assetHashType`
-   */
-  readonly assetHash?: string;
-
-  readonly installCommands?: string[];
-}
-
-/**
- * Produce bundled Lambda asset code
- */
-export function bundle(options: BundlingOptions): lambda.AssetCode {
-  const { entry, runtime, outputPathSuffix, installCommands } = options;
-
-  const stagedir = cdk.FileSystem.mkdtemp("python-bundling-");
-  const hasDeps = stageDependencies(entry, stagedir);
-  const hasInstallCommands = stageInstallCommands(
-    installCommands || [],
-    stagedir
-  );
-
-  const depsCommand = chain([
-    hasDeps || hasInstallCommands
-      ? `rsync -r ${BUNDLER_DEPENDENCIES_CACHE}/. ${cdk.AssetStaging.BUNDLING_OUTPUT_DIR}/${outputPathSuffix}`
-      : "",
-    `rsync -r . ${cdk.AssetStaging.BUNDLING_OUTPUT_DIR}/${outputPathSuffix}`,
-  ]);
-
-  // Determine which dockerfile to use. When dependencies are present, we use a
-  // Dockerfile that can create a cacheable layer. We can't use this Dockerfile
-  // if there aren't dependencies or the Dockerfile will complain about missing
-  // sources.
-  const dockerfile = hasInstallCommands
-    ? "Dockerfile.custom"
-    : hasDeps
-    ? "Dockerfile.dependencies"
-    : "Dockerfile";
-
-  // copy Dockerfile to workdir
-  fs.copyFileSync(
-    path.join(__dirname, "../../../assets/python", dockerfile),
-    path.join(stagedir, dockerfile)
-  );
-
-  const image = cdk.DockerImage.fromBuild(stagedir, {
-    buildArgs: {
-      IMAGE: runtime.bundlingImage.image,
-    },
-    file: dockerfile,
-  });
-
-  return lambda.Code.fromAsset(entry, {
-    assetHashType: options.assetHashType,
-    assetHash: options.assetHash,
-    exclude: DEPENDENCY_EXCLUDES,
-    bundling: {
-      image,
-      command: ["bash", "-c", depsCommand],
-    },
-  });
-}
-
-/**
- * Checks to see if the `entry` directory contains a type of dependency that
- * we know how to install.
- */
-export function stageDependencies(entry: string, stagedir: string): boolean {
-  const prefixes = ["Pipfile", "pyproject", "poetry", "requirements.txt"];
-
-  let found = false;
-  for (const file of fs.readdirSync(entry)) {
-    for (const prefix of prefixes) {
-      if (file.startsWith(prefix)) {
-        fs.copyFileSync(path.join(entry, file), path.join(stagedir, file));
-        found = true;
-      }
-    }
-  }
-
-  return found;
-}
-
-function stageInstallCommands(
-  installCommands: string[],
-  stagedir: string
-): boolean {
-  let found = false;
-  if (installCommands.length > 0) {
-    const filePath = path.join(stagedir, "sst-deps-install-command.sh");
-    fs.writeFileSync(filePath, installCommands.join(" && "));
-    fs.chmodSync(filePath, "755");
-    found = true;
-  }
-
-  return found;
-}
-
-function chain(commands: string[]): string {
-  return commands.filter((c) => !!c).join(" && ");
-}

package/src/constructs/util/size.ts

@@ -1,13 +0,0 @@
-import * as cdk from "aws-cdk-lib";
-export type Size = `${number} ${"MB" | "GB"}`;
-
-export function toCdkSize(size: Size): cdk.Size {
-  const [count, unit] = size.split(" ");
-  const countNum = parseInt(count);
-  if (unit === "MB") {
-    return cdk.Size.mebibytes(countNum);
-  } else if (unit === "GB") {
-    return cdk.Size.gibibytes(countNum);
-  }
-  throw new Error(`Invalid size ${size}`);
-}

package/src/constructs/util/warning.ts

@@ -1,20 +0,0 @@
-import { createAppContext } from "../context.js";
-
-const WARNINGS = {
-  "config.deprecated": `WARNING: The "config" prop is deprecated, and will be removed in SST v2. Pass Parameters and Secrets in through the "bind" prop. Read more about how to upgrade here — https://docs.serverless-stack.com/upgrade-guide#upgrade-to-v116`,
-  "permissions.noConstructs": `WARNING: Passing SST constructs into "permissions" is deprecated, and will be removed in SST v2. Pass them into the "bind" prop. Read more about how to upgrade here — https://docs.serverless-stack.com/upgrade-guide#upgrade-to-v116`
-};
-
-export const useWarning = createAppContext(() => {
-  const set = new Set<keyof typeof WARNINGS>();
-  return {
-    add(message: keyof typeof WARNINGS) {
-      set.add(message);
-    },
-    print() {
-      for (const key of set) {
-        console.warn(WARNINGS[key]);
-      }
-    }
-  };
-});

package/src/context/context.ts

@@ -1,79 +0,0 @@
-export const Context = {
-  create,
-  reset,
-  memo,
-};
-
-const state = {
-  requestID: "",
-  contexts: new Map<any, ContextInfo>(),
-  tracking: [] as any[],
-};
-
-interface ContextInfo {
-  value: any;
-  dependants: Set<any>;
-}
-
-function create<C>(cb?: () => C) {
-  const id = Symbol();
-  return {
-    use() {
-      let result = state.contexts.get(id);
-
-      if (!result) {
-        if (!cb) throw new Error(`"${String(id)}" context must be provided.`);
-        state.tracking.push(id);
-        const value = cb();
-        state.tracking.pop();
-        result = {
-          value,
-          dependants: new Set(),
-        };
-        state.contexts.set(id, result);
-      }
-      const last = state.tracking[state.tracking.length - 1];
-      // Use is being called within another context booting up so mark it as a dependent
-      if (last) result!.dependants.add(last);
-      return result!.value as C;
-    },
-    provide(value: C) {
-      // If a new request has started, automatically clear all contexts
-      const requestID = (global as any)[
-        Symbol.for("aws.lambda.runtime.requestId")
-      ];
-      if (state.requestID !== requestID) {
-        state.requestID = requestID;
-        reset();
-      }
-
-      // If the context is already set, we need to reset its dependants
-      resetDependencies(id);
-
-      state.contexts.set(id, {
-        value,
-        dependants: new Set(),
-      });
-    },
-  };
-}
-
-function reset() {
-  state.contexts.clear();
-}
-
-function resetDependencies(id: any) {
-  const info = state.contexts.get(id);
-  if (!info) return;
-  for (const dependantID of info.dependants) {
-    resetDependencies(dependantID);
-    state.contexts.delete(dependantID);
-  }
-}
-
-export function memo<C>(cb: () => C) {
-  const ctx = create(cb);
-  return ctx.use;
-}
-
-5;