sst 2.0.0-rc.9 → 2.0.0

package/constructs/StaticSite.js

@@ -7,22 +7,23 @@ import { Construct } from "constructs";
 import { Token, Duration, CfnOutput, RemovalPolicy, CustomResource, } from "aws-cdk-lib";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import * as s3Assets from "aws-cdk-lib/aws-s3-assets";
-import * as acm from "aws-cdk-lib/aws-certificatemanager";
 import * as iam from "aws-cdk-lib/aws-iam";
 import * as lambda from "aws-cdk-lib/aws-lambda";
 import * as route53 from "aws-cdk-lib/aws-route53";
-import * as route53Patterns from "aws-cdk-lib/aws-route53-patterns";
 import * as route53Targets from "aws-cdk-lib/aws-route53-targets";
 import * as cloudfront from "aws-cdk-lib/aws-cloudfront";
 import * as cfOrigins from "aws-cdk-lib/aws-cloudfront-origins";
 import { AwsCliLayer } from "aws-cdk-lib/lambda-layer-awscli";
 import { Stack } from "./Stack.js";
 import { getBuildCmdEnvironment, buildErrorResponsesFor404ErrorPage, buildErrorResponsesForRedirectToIndex, } from "./BaseSite.js";
+import { HttpsRedirect } from "./cdk/website-redirect.js";
+import { DnsValidatedCertificate } from "./cdk/dns-validated-certificate.js";
 import { isCDKConstruct } from "./Construct.js";
 import { ENVIRONMENT_PLACEHOLDER, getParameterPath, } from "./util/functionBinding.js";
 import { gray } from "colorette";
-import { useProject } from "../app.js";
+import { useProject } from "../project.js";
 import { SiteEnv } from "../site-env.js";
+import { VisibleError } from "../error.js";
 const __dirname = path.dirname(url.fileURLToPath(import.meta.url));
 /////////////////////
 // Construct
@@ -44,49 +45,53 @@ const __dirname = path.dirname(url.fileURLToPath(import.meta.url));
  */
 export class StaticSite extends Construct {
     id;
-    cdk;
     props;
-    isPlaceholder;
-    assets;
-    filenamesAsset;
-    awsCliLayer;
+    doNotDeploy;
+    bucket;
+    distribution;
+    hostedZone;
+    certificate;
     constructor(scope, id, props) {
-        super(scope, props.cdk?.id || id);
+        super(scope, props?.cdk?.id || id);
+        const app = scope.node.root;
         this.id = id;
-        const root = scope.node.root;
-        // Local development or skip build => stub asset
-        this.isPlaceholder =
-            (root.local || root.skipBuild) && !props.disablePlaceholder;
-        const fileSizeLimit = root.isRunningSSTTest()
-            ? // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore: "sstTestFileSizeLimitOverride" not exposed in props
-                props.sstTestFileSizeLimitOverride || 200
-            : 200;
-        this.props = props;
-        this.cdk = {};
-        this.awsCliLayer = new AwsCliLayer(this, "AwsCliLayer");
-        this.registerSiteEnvironment();
-        // Validate input
+        this.props = {
+            path: ".",
+            waitForInvalidation: false,
+            ...props,
+        };
+        this.doNotDeploy = (app.local || app.skipBuild) && !this.props.dev?.deploy;
         this.validateCustomDomainSettings();
-        // Generate Vite types
+        this.registerSiteEnvironment();
         this.generateViteTypes();
+        if (this.doNotDeploy) {
+            // @ts-ignore
+            this.bucket = this.distribution = null;
+            return;
+        }
+        const cliLayer = new AwsCliLayer(this, "AwsCliLayer");
         // Build app
+        const fileSizeLimit = app.isRunningSSTTest()
+            ? // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+                // @ts-ignore: "sstTestFileSizeLimitOverride" not exposed in props
+                this.props.sstTestFileSizeLimitOverride || 200
+            : 200;
         this.buildApp();
-        this.assets = this.bundleAssets(fileSizeLimit);
-        this.filenamesAsset = this.bundleFilenamesAsset();
+        const assets = this.bundleAssets(fileSizeLimit);
+        const filenamesAsset = this.bundleFilenamesAsset();
         // Create Bucket
-        this.cdk.bucket = this.createS3Bucket();
+        this.bucket = this.createS3Bucket();
         // Create Custom Domain
-        this.cdk.hostedZone = this.lookupHostedZone();
-        this.cdk.certificate = this.createCertificate();
+        this.hostedZone = this.lookupHostedZone();
+        this.certificate = this.createCertificate();
         // Create S3 Deployment
-        const s3deployCR = this.createS3Deployment();
+        const s3deployCR = this.createS3Deployment(cliLayer, assets, filenamesAsset);
         // Create CloudFront
-        this.cdk.distribution = this.createCfDistribution();
-        this.cdk.distribution.node.addDependency(s3deployCR);
+        this.distribution = this.createCfDistribution();
+        this.distribution.node.addDependency(s3deployCR);
         // Invalidate CloudFront
-        const invalidationCR = this.createCloudFrontInvalidation();
-        invalidationCR.node.addDependency(this.cdk.distribution);
+        const invalidationCR = this.createCloudFrontInvalidation(cliLayer, assets);
+        invalidationCR.node.addDependency(this.distribution);
         // Connect Custom Domain to CloudFront Distribution
         this.createRoute53Records();
     }
@@ -94,12 +99,18 @@ export class StaticSite extends Construct {
      * The CloudFront URL of the website.
      */
     get url() {
-        return `https://${this.cdk.distribution.distributionDomainName}`;
+        if (this.doNotDeploy) {
+            return;
+        }
+        return `https://${this.distribution.distributionDomainName}`;
     }
     /**
      * If the custom domain is enabled, this is the URL of the website with the custom domain.
      */
     get customDomainUrl() {
+        if (this.doNotDeploy) {
+            return;
+        }
         const { customDomain } = this.props;
         if (!customDomain) {
             return;
@@ -112,34 +123,23 @@ export class StaticSite extends Construct {
         }
     }
     /**
-     * The ARN of the internally created S3 Bucket.
-     */
-    get bucketArn() {
-        return this.cdk.bucket.bucketArn;
-    }
-    /**
-     * The name of the internally created S3 Bucket.
+     * The internally created CDK resources.
      */
-    get bucketName() {
-        return this.cdk.bucket.bucketName;
-    }
-    /**
-     * The ID of the internally created CloudFront Distribution.
-     */
-    get distributionId() {
-        return this.cdk.distribution.distributionId;
-    }
-    /**
-     * The domain name of the internally created CloudFront Distribution.
-     */
-    get distributionDomain() {
-        return this.cdk.distribution.distributionDomainName;
+    get cdk() {
+        if (this.doNotDeploy) {
+            throw new VisibleError(`Cannot access CDK resources for the "${this.node.id}" site in dev mode`);
+        }
+        return {
+            bucket: this.bucket,
+            distribution: this.distribution,
+            hostedZone: this.hostedZone,
+            certificate: this.certificate,
+        };
     }
     getConstructMetadata() {
         return {
             type: "StaticSite",
             data: {
-                distributionId: this.cdk.distribution.distributionId,
                 customDomainUrl: this.customDomainUrl,
             },
         };
@@ -155,13 +155,13 @@ export class StaticSite extends Construct {
                     // depend on the Site. B/c often the site depends on the Api, causing
                     // a CloudFormation circular dependency if the Api and the Site belong
                     // to different stacks.
-                    environment: ENVIRONMENT_PLACEHOLDER,
+                    environment: this.doNotDeploy ? "" : ENVIRONMENT_PLACEHOLDER,
                     parameter: this.customDomainUrl || this.url,
                 },
             },
             permissions: {
                 "ssm:GetParameters": [
-                    `arn:aws:ssm:${app.region}:${app.account}:parameter${getParameterPath(this, "url")}`,
+                    `arn:${Stack.of(this).partition}:ssm:${app.region}:${app.account}:parameter${getParameterPath(this, "url")}`,
                 ],
             },
         };
@@ -195,9 +195,6 @@ interface ImportMeta {
         fs.writeFileSync(filePath, content);
     }
     buildApp() {
-        if (this.isPlaceholder) {
-            return;
-        }
         const { path: sitePath, buildCommand } = this.props;
         // validate site path exists
         if (!fs.existsSync(sitePath)) {
@@ -222,13 +219,6 @@ interface ImportMeta {
         }
     }
     bundleAssets(fileSizeLimit) {
-        if (this.isPlaceholder) {
-            return [
-                new s3Assets.Asset(this, "Asset", {
-                    path: path.resolve(__dirname, "../support/static-site-stub"),
-                }),
-            ];
-        }
         const { path: sitePath } = this.props;
         const buildOutput = this.props.buildOutput || ".";
         // validate buildOutput exists
@@ -237,7 +227,7 @@ interface ImportMeta {
             throw new Error(`No build output found at "${siteOutputPath}" for the "${this.node.id}" StaticSite.`);
         }
         // create zip files
-        const script = path.join(__dirname, "../support/base-site-archiver.cjs");
+        const script = path.join(__dirname, "../support/base-site-archiver.mjs");
         const zipPath = path.resolve(path.join(useProject().paths.artifacts, `StaticSite-${this.node.id}-${this.node.addr}`));
         // clear zip path to ensure no partX.zip remain from previous build
         fs.rmSync(zipPath, {
@@ -268,9 +258,6 @@ interface ImportMeta {
         return assets;
     }
     bundleFilenamesAsset() {
-        if (this.isPlaceholder) {
-            return;
-        }
         if (this.props.purgeFiles === false) {
             return;
         }
@@ -307,7 +294,7 @@ interface ImportMeta {
             });
         }
     }
-    createS3Deployment() {
+    createS3Deployment(cliLayer, assets, filenamesAsset) {
         const fileOptions = this.props.fileOptions || [
             {
                 exclude: "*",
@@ -323,18 +310,18 @@ interface ImportMeta {
         // Create a Lambda function that will be doing the uploading
         const uploader = new lambda.Function(this, "S3Uploader", {
             code: lambda.Code.fromAsset(path.join(__dirname, "../support/base-site-custom-resource")),
-            layers: [this.awsCliLayer],
+            layers: [cliLayer],
             runtime: lambda.Runtime.PYTHON_3_7,
             handler: "s3-upload.handler",
             timeout: Duration.minutes(15),
             memorySize: 1024,
         });
-        this.cdk.bucket.grantReadWrite(uploader);
-        this.assets.forEach((asset) => asset.grantRead(uploader));
+        this.bucket.grantReadWrite(uploader);
+        assets.forEach((asset) => asset.grantRead(uploader));
         // Create the custom resource function
         const handler = new lambda.Function(this, "S3Handler", {
             code: lambda.Code.fromAsset(path.join(__dirname, "../support/base-site-custom-resource")),
-            layers: [this.awsCliLayer],
+            layers: [cliLayer],
             runtime: lambda.Runtime.PYTHON_3_7,
             handler: "s3-handler.handler",
             timeout: Duration.minutes(15),
@@ -343,22 +330,22 @@ interface ImportMeta {
                 UPLOADER_FUNCTION_NAME: uploader.functionName,
             },
         });
-        this.cdk.bucket.grantReadWrite(handler);
-        this.filenamesAsset?.grantRead(handler);
+        this.bucket.grantReadWrite(handler);
+        filenamesAsset?.grantRead(handler);
         uploader.grantInvoke(handler);
         // Create custom resource
         return new CustomResource(this, "S3Deployment", {
             serviceToken: handler.functionArn,
             resourceType: "Custom::SSTBucketDeployment",
             properties: {
-                Sources: this.assets.map((asset) => ({
+                Sources: assets.map((asset) => ({
                     BucketName: asset.s3BucketName,
                     ObjectKey: asset.s3ObjectKey,
                 })),
-                DestinationBucketName: this.cdk.bucket.bucketName,
-                Filenames: this.filenamesAsset && {
-                    BucketName: this.filenamesAsset.s3BucketName,
-                    ObjectKey: this.filenamesAsset.s3ObjectKey,
+                DestinationBucketName: this.bucket.bucketName,
+                Filenames: filenamesAsset && {
+                    BucketName: filenamesAsset.s3BucketName,
+                    ObjectKey: filenamesAsset.s3ObjectKey,
                 },
                 FileOptions: (fileOptions || []).map(({ exclude, include, cacheControl }) => {
                     if (typeof exclude === "string") {
@@ -411,17 +398,9 @@ interface ImportMeta {
             }
         }
         // Build errorResponses
-        let errorResponses;
-        // case: sst start => showing stub site, and redirect all routes to the index page
-        if (this.isPlaceholder) {
-            errorResponses = buildErrorResponsesForRedirectToIndex(indexPage);
-        }
-        else {
-            errorResponses =
-                errorPage === "redirect_to_index_page" || errorPage === undefined
-                    ? buildErrorResponsesForRedirectToIndex(indexPage)
-                    : buildErrorResponsesFor404ErrorPage(errorPage);
-        }
+        const errorResponses = errorPage === "redirect_to_index_page" || errorPage === undefined
+            ? buildErrorResponsesForRedirectToIndex(indexPage)
+            : buildErrorResponsesFor404ErrorPage(errorPage);
         // Create CloudFront distribution
         return new cloudfront.Distribution(this, "Distribution", {
             // these values can be overwritten by cfDistributionProps
@@ -430,19 +409,19 @@ interface ImportMeta {
             ...cdk?.distribution,
             // these values can NOT be overwritten by cfDistributionProps
             domainNames,
-            certificate: this.cdk.certificate,
+            certificate: this.certificate,
             defaultBehavior: {
-                origin: new cfOrigins.S3Origin(this.cdk.bucket),
+                origin: new cfOrigins.S3Origin(this.bucket),
                 viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
                 ...cdk?.distribution?.defaultBehavior,
             },
         });
     }
-    createCloudFrontInvalidation() {
+    createCloudFrontInvalidation(cliLayer, assets) {
         // Create a Lambda function that will be doing the invalidation
         const invalidator = new lambda.Function(this, "CloudFrontInvalidator", {
             code: lambda.Code.fromAsset(path.join(__dirname, "../support/base-site-custom-resource")),
-            layers: [this.awsCliLayer],
+            layers: [cliLayer],
             runtime: lambda.Runtime.PYTHON_3_7,
             handler: "cf-invalidate.handler",
             timeout: Duration.minutes(15),
@@ -460,22 +439,17 @@ interface ImportMeta {
         // Need the AssetHash field so the CR gets updated on each deploy
         const assetsHash = crypto
             .createHash("md5")
-            .update(this.assets.map(({ assetHash }) => assetHash).join(""))
+            .update(assets.map(({ assetHash }) => assetHash).join(""))
             .digest("hex");
         // Create custom resource
-        const waitForInvalidation = this.isPlaceholder
-            ? false
-            : this.props.waitForInvalidation === false
-                ? false
-                : true;
         return new CustomResource(this, "CloudFrontInvalidation", {
             serviceToken: invalidator.functionArn,
             resourceType: "Custom::SSTCloudFrontInvalidation",
             properties: {
                 AssetsHash: assetsHash,
-                DistributionId: this.cdk.distribution.distributionId,
+                DistributionId: this.distribution.distributionId,
                 DistributionPaths: ["/*"],
-                WaitForInvalidation: waitForInvalidation,
+                WaitForInvalidation: this.props.waitForInvalidation,
             },
         });
     }
@@ -543,11 +517,11 @@ interface ImportMeta {
         }
         let acmCertificate;
         // HostedZone is set for Route 53 domains
-        if (this.cdk.hostedZone) {
+        if (this.hostedZone) {
             if (typeof customDomain === "string") {
-                acmCertificate = new acm.DnsValidatedCertificate(this, "Certificate", {
+                acmCertificate = new DnsValidatedCertificate(this, "Certificate", {
                     domainName: customDomain,
-                    hostedZone: this.cdk.hostedZone,
+                    hostedZone: this.hostedZone,
                     region: "us-east-1",
                 });
             }
@@ -555,9 +529,9 @@ interface ImportMeta {
                 acmCertificate = customDomain.cdk.certificate;
             }
             else {
-                acmCertificate = new acm.DnsValidatedCertificate(this, "Certificate", {
+                acmCertificate = new DnsValidatedCertificate(this, "Certificate", {
                     domainName: customDomain.domainName,
-                    hostedZone: this.cdk.hostedZone,
+                    hostedZone: this.hostedZone,
                     region: "us-east-1",
                 });
             }
@@ -572,7 +546,7 @@ interface ImportMeta {
     }
     createRoute53Records() {
         const { customDomain } = this.props;
-        if (!customDomain || !this.cdk.hostedZone) {
+        if (!customDomain || !this.hostedZone) {
             return;
         }
         let recordName;
@@ -587,15 +561,15 @@ interface ImportMeta {
         // Create DNS record
         const recordProps = {
             recordName,
-            zone: this.cdk.hostedZone,
-            target: route53.RecordTarget.fromAlias(new route53Targets.CloudFrontTarget(this.cdk.distribution)),
+            zone: this.hostedZone,
+            target: route53.RecordTarget.fromAlias(new route53Targets.CloudFrontTarget(this.distribution)),
         };
         new route53.ARecord(this, "AliasRecord", recordProps);
         new route53.AaaaRecord(this, "AliasRecordAAAA", recordProps);
         // Create Alias redirect record
         if (domainAlias) {
-            new route53Patterns.HttpsRedirect(this, "Redirect", {
-                zone: this.cdk.hostedZone,
+            new HttpsRedirect(this, "Redirect", {
+                zone: this.hostedZone,
                 recordNames: [domainAlias],
                 targetDomain: recordName,
             });

package/constructs/Table.d.ts

@@ -80,7 +80,7 @@ export interface TableGlobalIndexProps {
         index?: Omit<dynamodb.GlobalSecondaryIndexProps, "indexName" | "partitionKey" | "sortKey">;
     };
 }
-declare type TableFieldType = Lowercase<keyof typeof dynamodb.AttributeType>;
+type TableFieldType = Lowercase<keyof typeof dynamodb.AttributeType>;
 export interface TableProps {
     /**
      * An object defining the fields of the table. Key is the name of the field and the value is the type.

package/constructs/Table.js

@@ -269,7 +269,7 @@ export class Table extends Construct {
         return {
             clientPackage: "table",
             variables: {
-                "tableName": {
+                tableName: {
                     environment: this.tableName,
                     parameter: this.tableName,
                 },
@@ -368,11 +368,11 @@ export class Table extends Construct {
         fn.addEventSource(eventSource);
         // set filter pattern
         if (filters && filters.length > 0) {
-            const cfnEventSource = fn.node.children.find(c => c instanceof lambda.EventSourceMapping)?.node.defaultChild;
+            const cfnEventSource = fn.node.children.find((c) => c instanceof lambda.EventSourceMapping)?.node.defaultChild;
             cfnEventSource.addPropertyOverride("FilterCriteria", {
-                Filters: filters.map(filter => ({
+                Filters: filters.map((filter) => ({
                     Pattern: JSON.stringify(filter),
-                }))
+                })),
             });
         }
         // attach permissions

package/constructs/Topic.js

@@ -197,7 +197,7 @@ export class Topic extends Construct {
         return {
             clientPackage: "topic",
             variables: {
-                "topicArn": {
+                topicArn: {
                     environment: this.topicArn,
                     parameter: this.topicArn,
                 },

package/constructs/cdk/certificate-base.d.ts

@@ -0,0 +1,18 @@
+import { Metric, MetricOptions } from "aws-cdk-lib/aws-cloudwatch";
+import { Resource } from "aws-cdk-lib";
+import { ICertificate } from "aws-cdk-lib/aws-certificatemanager";
+/**
+ * Shared implementation details of ICertificate implementations.
+ *
+ * @internal
+ */
+export declare abstract class CertificateBase extends Resource implements ICertificate {
+    abstract readonly certificateArn: string;
+    /**
+     * If the certificate is provisionned in a different region than the
+     * containing stack, this should be the region in which the certificate lives
+     * so we can correctly create `Metric` instances.
+     */
+    protected readonly region?: string;
+    metricDaysToExpiry(props?: MetricOptions): Metric;
+}

package/constructs/cdk/certificate-base.js

@@ -0,0 +1,26 @@
+import { Metric, Stats } from "aws-cdk-lib/aws-cloudwatch";
+import { Duration, Resource } from "aws-cdk-lib";
+/**
+ * Shared implementation details of ICertificate implementations.
+ *
+ * @internal
+ */
+export class CertificateBase extends Resource {
+    /**
+     * If the certificate is provisionned in a different region than the
+     * containing stack, this should be the region in which the certificate lives
+     * so we can correctly create `Metric` instances.
+     */
+    region;
+    metricDaysToExpiry(props) {
+        return new Metric({
+            period: Duration.days(1),
+            ...props,
+            dimensionsMap: { CertificateArn: this.certificateArn },
+            metricName: "DaysToExpiry",
+            namespace: "AWS/CertificateManager",
+            region: this.region,
+            statistic: Stats.MINIMUM,
+        });
+    }
+}

package/constructs/cdk/dns-validated-certificate.d.ts

@@ -0,0 +1,77 @@
+import { Construct } from "constructs";
+import { ITaggable, TagManager, RemovalPolicy } from "aws-cdk-lib";
+import { CertificateProps, ICertificate } from "aws-cdk-lib/aws-certificatemanager";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as route53 from "aws-cdk-lib/aws-route53";
+import { CertificateBase } from "./certificate-base.js";
+/**
+ * Properties to create a DNS validated certificate managed by AWS Certificate Manager
+ *
+ */
+export interface DnsValidatedCertificateProps extends CertificateProps {
+    /**
+     * Route 53 Hosted Zone used to perform DNS validation of the request.  The zone
+     * must be authoritative for the domain name specified in the Certificate Request.
+     */
+    readonly hostedZone: route53.IHostedZone;
+    /**
+     * AWS region that will host the certificate. This is needed especially
+     * for certificates used for CloudFront distributions, which require the region
+     * to be us-east-1.
+     *
+     * @default the region the stack is deployed in.
+     */
+    readonly region?: string;
+    /**
+     * An endpoint of Route53 service, which is not necessary as AWS SDK could figure
+     * out the right endpoints for most regions, but for some regions such as those in
+     * aws-cn partition, the default endpoint is not working now, hence the right endpoint
+     * need to be specified through this prop.
+     *
+     * Route53 is not been officially launched in China, it is only available for AWS
+     * internal accounts now. To make DnsValidatedCertificate work for internal accounts
+     * now, a special endpoint needs to be provided.
+     *
+     * @default - The AWS SDK will determine the Route53 endpoint to use based on region
+     */
+    readonly route53Endpoint?: string;
+    /**
+     * Role to use for the custom resource that creates the validated certificate
+     *
+     * @default - A new role will be created
+     */
+    readonly customResourceRole?: iam.IRole;
+    /**
+     * When set to true, when the DnsValidatedCertificate is deleted,
+     * the associated Route53 validation records are removed.
+     *
+     * CAUTION: If multiple certificates share the same domains (and same validation records),
+     * this can cause the other certificates to fail renewal and/or not validate.
+     * Not recommended for production use.
+     *
+     * @default false
+     */
+    readonly cleanupRoute53Records?: boolean;
+}
+/**
+ * A certificate managed by AWS Certificate Manager.  Will be automatically
+ * validated using DNS validation against the specified Route 53 hosted zone.
+ *
+ * @resource AWS::CertificateManager::Certificate
+ */
+export declare class DnsValidatedCertificate extends CertificateBase implements ICertificate, ITaggable {
+    readonly certificateArn: string;
+    /**
+     * Resource Tags.
+     * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-certificatemanager-certificate.html#cfn-certificatemanager-certificate-tags
+     */
+    readonly tags: TagManager;
+    protected readonly region?: string;
+    private normalizedZoneName;
+    private hostedZoneId;
+    private domainName;
+    private _removalPolicy?;
+    constructor(scope: Construct, id: string, props: DnsValidatedCertificateProps);
+    applyRemovalPolicy(policy: RemovalPolicy): void;
+    private validateDnsValidatedCertificate;
+}