sst 2.10.4 → 2.11.1

package/cli/commands/bind.d.ts

@@ -12,6 +12,10 @@ export declare const bind: (program: Program) => import("yargs").Argv<{
     role: string | undefined;
 } & {
     future: boolean | undefined;
+} & {
+    site: boolean | undefined;
+} & {
+    script: boolean | undefined;
 } & {
     command: (string | number)[] | undefined;
 }>;

package/cli/commands/bind.js

@@ -1,12 +1,23 @@
 import path from "path";
 import { VisibleError } from "../../error.js";
-class OutdatedMetadataError extends Error {
+class MetadataNotFoundError extends Error {
+}
+class MetadataOutdatedError extends Error {
 }
 export const bind = (program) => program
     .command(["bind <command..>", "env <command..>"], "Bind your app's resources to a command", (yargs) => yargs
+    .option("site", {
+    type: "boolean",
+    describe: "Run in site mode",
+})
+    .option("script", {
+    type: "boolean",
+    describe: "Run in script mode",
+})
     .array("command")
-    .example(`sst bind "vitest run"`, "Bind your resources to your tests")
-    .example(`sst bind "tsx scripts/myscript.ts"`, "Bind your resources to a script"), async (args) => {
+    .example(`sst bind vitest run`, "Bind resources to your tests")
+    .example(`sst bind next dev`, "Bind resources to your site")
+    .example(`sst bind --script next build`, "Bind resources to your site before deployment"), async (args) => {
     const { spawn } = await import("child_process");
     const kill = await import("tree-kill");
     const { useProject } = await import("../../project.js");
@@ -22,6 +33,7 @@ export const bind = (program) => program
     const project = useProject();
     const command = args.command?.join(" ");
     const isSite = await isRunningInSite();
+    const mode = args.site ? "site" : args.script ? "script" : "auto";
     let p;
     let timer;
     let siteConfigCache;
@@ -30,22 +42,12 @@ export const bind = (program) => program
         throw new VisibleError(`Command is required, e.g. sst bind ${isSite ? "next dev" : "vitest run"}`);
     }
     // Bind script
-    if (!isSite) {
+    if (args.script || (!isSite && !args.site)) {
         Logger.debug("Running in script mode.");
         return await bindScript();
     }
     // Bind site
-    try {
-        await bindSite("init");
-    }
-    catch (e) {
-        // Bind script (fallback)
-        if (e instanceof OutdatedMetadataError) {
-            Colors.line(Colors.warning("Warning: This was deployed with an old version of SST. Run `sst dev` or `sst deploy` to update."));
-            return await bindScript();
-        }
-        throw e;
-    }
+    await bindSite("init");
     bus.subscribe("stacks.metadata.updated", () => bindSite("metadata_updated"));
     bus.subscribe("stacks.metadata.deleted", () => bindSite("metadata_updated"));
     bus.subscribe("config.secret.updated", (payload) => {
@@ -93,7 +95,25 @@ export const bind = (program) => program
     }
     async function bindSite(reason) {
         // Get metadata
-        const siteMetadata = await getSiteMetadataUntilAvailable();
+        let siteMetadata;
+        try {
+            siteMetadata = await getSiteMetadata();
+        }
+        catch (e) {
+            // unhandled error
+            if (!(e instanceof MetadataOutdatedError) &&
+                !(e instanceof MetadataNotFoundError)) {
+                throw e;
+            }
+            // ignore error if previously failed to fetch metadata
+            if (reason !== "init")
+                return;
+            // run in script mode
+            Colors.line(Colors.warning(e instanceof MetadataOutdatedError
+                ? "Warning: This was deployed with an old version of SST. Run `sst dev` or `sst deploy` to update."
+                : "Warning: The site has not been deployed. Some resources might not be available."));
+            return await bindScript();
+        }
         const siteConfig = await parseSiteMetadata(siteMetadata);
         // Handle rebind due to metadata updated
         if (reason === "metadata_updated") {
@@ -103,57 +123,26 @@ export const bind = (program) => program
         }
         siteConfigCache = siteConfig;
         // Assume function's role credentials
-        if (siteConfig.role) {
-            const credentials = await assumeSsrRole(siteConfig.role);
-            if (credentials) {
-                // refresh crecentials 1 minute before expiration
-                const expireAt = credentials.Expiration.getTime() - 60000;
-                clearTimeout(timer);
-                timer = setTimeout(() => {
-                    Colors.line(`\n`, `Your AWS session is about to expire. Creating a new session and restarting \`${command}\`...`);
-                    bindSite("iam_expired");
-                }, expireAt - Date.now());
-                await runCommand({
-                    ...siteConfig.envs,
-                    AWS_ACCESS_KEY_ID: credentials.AccessKeyId,
-                    AWS_SECRET_ACCESS_KEY: credentials.SecretAccessKey,
-                    AWS_SESSION_TOKEN: credentials.SessionToken,
-                });
-                return;
-            }
-        }
         // Fallback to use local IAM credentials
+        const credentials = (siteConfig.role &&
+            (await getLiveIamCredentials(siteConfig.role))) ||
+            (await getLocalIamCredentials());
         await runCommand({
             ...siteConfig.envs,
-            ...(await localIamCredentials()),
+            ...credentials,
         });
     }
     async function bindScript() {
         const { Config } = await import("../../config.js");
         await runCommand({
             ...(await Config.env()),
-            ...(await localIamCredentials()),
+            ...(await getLocalIamCredentials()),
         });
     }
-    async function getSiteMetadataUntilAvailable() {
-        const { createSpinner } = await import("../spinner.js");
-        const spinner = createSpinner({});
-        while (true) {
-            const data = await getSiteMetadata();
-            // Handle site metadata not found
-            if (!data) {
-                spinner.start("Make sure `sst dev` is running...");
-                await new Promise((resolve) => setTimeout(resolve, 1000));
-                continue;
-            }
-            spinner.isSpinning && spinner.stop().clear();
-            return data;
-        }
-    }
     async function getSiteMetadata() {
         const { metadata } = await import("../../stacks/metadata.js");
         const metadataData = await metadata();
-        return Object.values(metadataData)
+        const data = Object.values(metadataData)
             .flat()
             .filter((c) => [
             "StaticSite",
@@ -170,10 +159,14 @@ export const bind = (program) => program
             if (!c.data.path ||
                 (isSsr && !c.data.server) ||
                 (!isSsr && !c.data.environment)) {
-                throw new OutdatedMetadataError();
+                throw new MetadataOutdatedError();
             }
             return (path.resolve(project.paths.root, c.data.path) === process.cwd());
         });
+        if (!data) {
+            throw new MetadataNotFoundError();
+        }
+        return data;
     }
     async function parseSiteMetadata(metadata) {
         const { LambdaClient, GetFunctionCommand } = await import("@aws-sdk/client-lambda");
@@ -194,40 +187,24 @@ export const bind = (program) => program
             secrets: metadata.data.secrets,
         };
     }
-    async function assumeSsrRole(roleArn) {
-        const { STSClient, AssumeRoleCommand } = await import("@aws-sdk/client-sts");
-        const { useAWSClient } = await import("../../credentials.js");
-        const sts = useAWSClient(STSClient);
-        const assumeRole = async (duration) => {
-            const { Credentials: credentials } = await sts.send(new AssumeRoleCommand({
-                RoleArn: roleArn,
-                RoleSessionName: "dev-session",
-                DurationSeconds: duration,
-            }));
-            return credentials;
+    async function getLiveIamCredentials(roleArn) {
+        const credentials = await assumeSsrRole(roleArn);
+        if (!credentials)
+            return;
+        // refresh crecentials 1 minute before expiration
+        const expireAt = credentials.Expiration.getTime() - 60000;
+        clearTimeout(timer);
+        timer = setTimeout(() => {
+            Colors.line(`\n`, `Your AWS session is about to expire. Creating a new session and restarting \`${command}\`...`);
+            bindSite("iam_expired");
+        }, expireAt - Date.now());
+        return {
+            AWS_ACCESS_KEY_ID: credentials.AccessKeyId,
+            AWS_SECRET_ACCESS_KEY: credentials.SecretAccessKey,
+            AWS_SESSION_TOKEN: credentials.SessionToken,
         };
-        // Assue role with max duration first. This can fail if chaining roles, or if
-        // the role has a max duration set. If it fails, assume role with 1 hour duration.
-        let err;
-        try {
-            return await assumeRole(43200);
-        }
-        catch (e) {
-            err = e;
-        }
-        if (err.name === "ValidationError" &&
-            err.message.startsWith("The requested DurationSeconds exceeds")) {
-            try {
-                return await assumeRole(3600);
-            }
-            catch (e) {
-                err = e;
-            }
-        }
-        Colors.line("Using local IAM credentials since `sst dev` is not running.");
-        Logger.debug(`Failed to assume ${roleArn}.`, err);
     }
-    async function localIamCredentials() {
+    async function getLocalIamCredentials() {
         const { useAWSCredentials } = await import("../../credentials.js");
         const credentials = await useAWSCredentials();
         return {
@@ -269,5 +246,38 @@ export const bind = (program) => program
         return (Object.keys(envs1).length === Object.keys(envs2).length &&
             Object.keys(envs1).every((key) => envs1[key] === envs2[key]));
     }
+    async function assumeSsrRole(roleArn) {
+        const { STSClient, AssumeRoleCommand } = await import("@aws-sdk/client-sts");
+        const { useAWSClient } = await import("../../credentials.js");
+        const sts = useAWSClient(STSClient);
+        const assumeRole = async (duration) => {
+            const { Credentials: credentials } = await sts.send(new AssumeRoleCommand({
+                RoleArn: roleArn,
+                RoleSessionName: "dev-session",
+                DurationSeconds: duration,
+            }));
+            return credentials;
+        };
+        // Assue role with max duration first. This can fail if chaining roles, or if
+        // the role has a max duration set. If it fails, assume role with 1 hour duration.
+        let err;
+        try {
+            return await assumeRole(43200);
+        }
+        catch (e) {
+            err = e;
+        }
+        if (err.name === "ValidationError" &&
+            err.message.startsWith("The requested DurationSeconds exceeds")) {
+            try {
+                return await assumeRole(3600);
+            }
+            catch (e) {
+                err = e;
+            }
+        }
+        Colors.line("Using local IAM credentials since `sst dev` is not running.");
+        Logger.debug(`Failed to assume ${roleArn}.`, err);
+    }
 })
     .strict(false);

package/cli/commands/secrets/list.d.ts

@@ -14,4 +14,6 @@ export declare const list: (program: Program) => import("yargs").Argv<{
     future: boolean | undefined;
 } & {
     format: string | undefined;
+} & {
+    fallback: boolean | undefined;
 }>;

package/cli/commands/secrets/list.js

@@ -1,11 +1,19 @@
-export const list = (program) => program.command("list [format]", "Fetch all the secrets", (yargs) => yargs.positional("format", {
+export const list = (program) => program.command("list [format]", "Fetch all the secrets", (yargs) => yargs
+    .positional("format", {
     type: "string",
     choices: ["table", "env", "json"],
-}), async (args) => {
+})
+    .boolean("fallback"), async (args) => {
     const { Config } = await import("../../../config.js");
     const { gray } = await import("colorette");
     const { Colors } = await import("../../colors.js");
-    const secrets = await Config.secrets();
+    const configSecrets = await Config.secrets();
+    const secrets = !args.fallback
+        ? configSecrets
+        : Object.entries(configSecrets).reduce((carry, [key, value]) => ({
+            ...carry,
+            ...(!value.value && !!value.fallback ? { [key]: value } : {}),
+        }), {});
     if (Object.entries(secrets).length === 0) {
         Colors.line("No secrets set");
         return;
@@ -20,7 +28,7 @@ export const list = (program) => program.command("list [format]", "Fetch all the
             break;
         case "env":
             for (const [key, value] of Object.entries(secrets)) {
-                console.log(`${key}=${value.value || value.fallback}`);
+                console.log(`${key}=${value.value || `${value.fallback} #fallback`}`);
             }
             break;
         case "table":
@@ -42,7 +50,8 @@ export const list = (program) => program.command("list [format]", "Fetch all the
                 const value = secrets[key].value
                     ? secrets[key].value
                     : `${secrets[key].fallback} ${gray("(fallback)")}`;
-                console.log(`│ ${key.padEnd(keyLen)} │ ${value.padEnd(valueLen)} │`);
+                const colourPadding = secrets[key].value ? 0 : gray("").length;
+                console.log(`│ ${key.padEnd(keyLen)} │ ${value.padEnd(valueLen + colourPadding)} │`);
             });
             console.log("└".padEnd(keyLen + 3, "─") +
                 "┴" +

package/constructs/NextjsSite.js

@@ -29,7 +29,7 @@ const __dirname = url.fileURLToPath(new URL(".", import.meta.url));
 export class NextjsSite extends SsrSite {
     constructor(scope, id, props) {
         super(scope, id, {
-            buildCommand: "npx --yes open-next@1.3.x build",
+            buildCommand: "npx --yes open-next@^1.3 build",
             ...props,
         });
         this.createWarmer();

package/node/future/auth/adapter/google.d.ts

@@ -1,7 +1,15 @@
 import { OidcBasicConfig } from "./oidc.js";
-type GoogleConfig = OidcBasicConfig & {
+import { OauthBasicConfig } from "./oauth.js";
+type GooglePrompt = "none" | "consent" | "select_account";
+type GoogleAccessType = "offline" | "online";
+type GoogleConfig = (OauthBasicConfig & {
+    mode: "oauth";
+    prompt?: GooglePrompt;
+    accessType?: GoogleAccessType;
+}) | (OidcBasicConfig & {
     mode: "oidc";
-};
+    prompt?: GooglePrompt;
+});
 export declare function GoogleAdapter(config: GoogleConfig): () => Promise<{
     type: "success";
     properties: {

package/node/future/auth/adapter/google.js

@@ -1,7 +1,19 @@
 import { Issuer } from "openid-client";
 import { OidcAdapter } from "./oidc.js";
+import { OauthAdapter } from "./oauth.js";
 const issuer = await Issuer.discover("https://accounts.google.com");
 export function GoogleAdapter(config) {
+    /* @__PURE__ */
+    if (config.mode === "oauth") {
+        return OauthAdapter({
+            issuer,
+            ...config,
+            params: {
+                ...(config.accessType && { access_type: config.accessType }),
+                ...config.params,
+            },
+        });
+    }
     return OidcAdapter({
         issuer,
         scope: "openid email profile",

package/node/future/auth/adapter/microsoft.d.ts

@@ -1,6 +1,7 @@
 import { OidcBasicConfig } from "./oidc.js";
 type MicrosoftConfig = OidcBasicConfig & {
     mode: "oidc";
+    prompt?: "login" | "none" | "consent" | "select_account";
 };
 export declare function MicrosoftAdapter(config: MicrosoftConfig): () => Promise<{
     type: "success";

package/node/future/auth/adapter/oauth.d.ts

@@ -12,7 +12,14 @@ export interface OauthBasicConfig {
      * Various scopes requested for the access token
      */
     scope: string;
+    /**
+     * Determines whether users will be prompted for reauthentication and consent
+     */
     prompt?: string;
+    /**
+     * Additional parameters to be passed to the authorization endpoint
+     */
+    params?: Record<string, string>;
 }
 export interface OauthConfig extends OauthBasicConfig {
     issuer: Issuer;

package/node/future/auth/adapter/oauth.js

@@ -22,6 +22,7 @@ export const OauthAdapter =
                 code_challenge_method: "S256",
                 state,
                 prompt: config.prompt,
+                ...config.params,
             });
             useResponse().cookies({
                 auth_code_verifier: code_verifier,

package/node/future/auth/adapter/oidc.d.ts

@@ -4,6 +4,10 @@ export interface OidcBasicConfig {
      * The clientID provided by the third party oauth service
      */
     clientID: string;
+    /**
+     * Determines whether users will be prompted for reauthentication and consent
+     */
+    prompt?: string;
 }
 export interface OidcConfig extends OidcBasicConfig {
     issuer: Issuer;

package/node/future/auth/adapter/oidc.js

@@ -17,6 +17,7 @@ export const OidcAdapter = /* @__PURE__ */ (config) => {
                 response_mode: "form_post",
                 nonce,
                 state,
+                prompt: config.prompt,
             });
             useResponse().cookies({
                 auth_nonce: nonce,

package/package.json

@@ -1,7 +1,7 @@
 {
   "sideEffects": false,
   "name": "sst",
-  "version": "2.10.4",
+  "version": "2.11.1",
   "bin": {
     "sst": "cli/sst.js"
   },