sst 2.11.17 → 2.12.0

package/bootstrap.js

@@ -127,6 +127,11 @@ export async function bootstrapSST() {
         synthesizer: new DefaultStackSynthesizer({
             qualifier: cdk?.qualifier,
             fileAssetsBucketName: cdk?.fileAssetsBucketName,
+            deployRoleArn: cdk?.deployRoleArn,
+            fileAssetPublishingRoleArn: cdk?.fileAssetPublishingRoleArn,
+            imageAssetPublishingRoleArn: cdk?.imageAssetPublishingRoleArn,
+            cloudFormationExecutionRole: cdk?.cloudFormationExecutionRole,
+            lookupRoleArn: cdk?.lookupRoleArn,
         }),
     });
     // Add tags to stack

package/constructs/Stack.js

@@ -210,6 +210,11 @@ export class Stack extends CDKStack {
         return new DefaultStackSynthesizer({
             qualifier: config.cdk?.qualifier,
             fileAssetsBucketName: config.cdk?.fileAssetsBucketName,
+            deployRoleArn: config.cdk?.deployRoleArn,
+            fileAssetPublishingRoleArn: config.cdk?.fileAssetPublishingRoleArn,
+            imageAssetPublishingRoleArn: config.cdk?.imageAssetPublishingRoleArn,
+            cloudFormationExecutionRole: config.cdk?.cloudFormationExecutionRole,
+            lookupRoleArn: config.cdk?.lookupRoleArn,
         });
     }
     // eslint-disable-next-line @typescript-eslint/no-explicit-any

package/node/future/auth/adapter/link.d.ts

@@ -1,11 +1,13 @@
 import { APIGatewayProxyStructuredResultV2 } from "aws-lambda";
 export declare function LinkAdapter(config: {
     onLink: (link: string, claims: Record<string, any>) => Promise<APIGatewayProxyStructuredResultV2>;
-    onError: (error: any) => Promise<APIGatewayProxyStructuredResultV2>;
 }): () => Promise<{
     type: "step";
     properties: APIGatewayProxyStructuredResultV2;
 } | {
     type: "success";
     properties: any;
+} | {
+    type: "error";
+    properties?: undefined;
 }>;

package/node/future/auth/adapter/link.js

@@ -2,16 +2,16 @@ import { createSigner, createVerifier } from "fast-jwt";
 import { Config } from "../../../config/index.js";
 import { useDomainName, usePathParam, useQueryParam, useQueryParams, } from "../../../api/index.js";
 export function LinkAdapter(config) {
-    // @ts-expect-error
-    const key = Config[process.env.AUTH_ID + "PrivateKey"];
-    // @ts-expect-error
-    const publicKey = Config[process.env.AUTH_ID + "PublicKey"];
-    const signer = createSigner({
-        expiresIn: 1000 * 60 * 10,
-        key,
-        algorithm: "RS512",
-    });
     return async function () {
+        // @ts-expect-error
+        const key = Config[process.env.AUTH_ID + "PrivateKey"];
+        // @ts-expect-error
+        const publicKey = Config[process.env.AUTH_ID + "PublicKey"];
+        const signer = createSigner({
+            expiresIn: 1000 * 60 * 10,
+            key,
+            algorithm: "RS512",
+        });
         const callback = "https://" + useDomainName() + "/callback";
         const step = usePathParam("step");
         if (step === "authorize") {
@@ -38,13 +38,10 @@ export function LinkAdapter(config) {
                     properties: jwt,
                 };
             }
-            catch (ex) {
-                return {
-                    type: "step",
-                    properties: await config.onError(ex),
-                };
-            }
+            catch (ex) { }
         }
-        throw new Error("Invalid auth request");
+        return {
+            type: "error",
+        };
     };
 }

package/node/future/auth/handler.d.ts

@@ -2,6 +2,25 @@ import { APIGatewayProxyEventV2, APIGatewayProxyStructuredResultV2 } from "aws-l
 import { Adapter } from "./adapter/adapter.js";
 import { SignerOptions } from "fast-jwt";
 import { SessionValue } from "./session.js";
+declare const onSuccessResponse: {
+    session(input: SessionCreateInput): {
+        type: "session";
+        properties: SessionCreateInput;
+    };
+    http(input: APIGatewayProxyStructuredResultV2): {
+        type: "http";
+        properties: APIGatewayProxyStructuredResultV2;
+    };
+    provider(provider: string): {
+        type: "http";
+        properties: {
+            statusCode: number;
+            headers: {
+                Location: string;
+            };
+        };
+    };
+};
 export declare function AuthHandler<Providers extends Record<string, Adapter<any>>, Result = {
     [key in keyof Providers]: {
         provider: key;
@@ -12,7 +31,8 @@ export declare function AuthHandler<Providers extends Record<string, Adapter<any
     providers: Providers;
     clients: () => Promise<Record<string, string>>;
     onAuthorize?: (event: APIGatewayProxyEventV2) => Promise<void | keyof Providers>;
-    onSuccess: (input: Result) => Promise<SessionCreateInput>;
+    onSuccess: (input: Result, response: typeof onSuccessResponse) => Promise<ReturnType<(typeof onSuccessResponse)[keyof typeof onSuccessResponse]>>;
     onError: () => Promise<APIGatewayProxyStructuredResultV2>;
 }): (event: APIGatewayProxyEventV2, context: import("aws-lambda").Context) => Promise<APIGatewayProxyStructuredResultV2>;
 export type SessionCreateInput = SessionValue & Partial<SignerOptions>;
+export {};

package/node/future/auth/handler.js

@@ -1,6 +1,37 @@
 import { createSigner, createVerifier } from "fast-jwt";
 import { ApiHandler, useCookie, useCookies, useFormValue, usePathParam, useQueryParam, useQueryParams, useResponse, } from "../../api/index.js";
 import { Config } from "../../config/index.js";
+const onSuccessResponse = {
+    session(input) {
+        return {
+            type: "session",
+            properties: input,
+        };
+    },
+    http(input) {
+        return {
+            type: "http",
+            properties: input,
+        };
+    },
+    provider(provider) {
+        return {
+            type: "http",
+            properties: {
+                statusCode: 302,
+                headers: {
+                    Location: "/authorize?" +
+                        new URLSearchParams({
+                            provider,
+                            response_type: useCookie("response_type"),
+                            client_id: useCookie("client_id"),
+                            redirect_uri: useCookie("redirect_uri"),
+                        }).toString(),
+                },
+            },
+        };
+    },
+};
 export function AuthHandler(input) {
     return ApiHandler(async (evt) => {
         const step = usePathParam("step");
@@ -13,6 +44,9 @@ export function AuthHandler(input) {
                 },
                 body: `
           <html>
+          <head>
+            <link rel="icon" href="data:,">
+          </head>
             <body>
             <table>
               <tr>${Object.keys(clients).map((client) => `<td>${client}</td>`)}</tr>
@@ -30,6 +64,11 @@ export function AuthHandler(input) {
         `,
             };
         }
+        if (step === "favicon.ico") {
+            return {
+                statusCode: 404,
+            };
+        }
         if (step === "token") {
             if (useFormValue("grant_type") !== "authorization_code") {
                 return {
@@ -139,70 +178,77 @@ export function AuthHandler(input) {
             return result.properties;
         }
         if (result.type === "success") {
-            const { type, properties, ...rest } = await input.onSuccess({
+            const onSuccess = await input.onSuccess({
                 provider,
                 ...result.properties,
-            });
-            // @ts-expect-error
-            const priv = Config[process.env.AUTH_ID + "PrivateKey"];
-            const signer = createSigner({
-                ...rest,
-                key: priv,
-                algorithm: "RS512",
-            });
-            const token = signer({
-                type,
-                properties,
-            });
-            useResponse().cookie({
-                key: "sst_auth_token",
-                value: token,
-                maxAge: 10 * 365 * 24 * 60 * 60,
-                secure: true,
-                sameSite: "None",
-                httpOnly: true,
-            });
-            const { client_id, response_type, redirect_uri, state } = {
-                ...useCookies(),
-                ...useQueryParams(),
-            };
-            if (response_type === "token") {
-                const location = new URL(redirect_uri);
-                location.hash = `access_token=${token}&state=${state || ""}`;
-                return {
-                    statusCode: 302,
-                    headers: {
-                        Location: location.href,
-                    },
-                };
-            }
-            if (response_type === "code") {
-                // This allows the code to be reused within a 30 second window
-                // The code should be single use but we're making this tradeoff to remain stateless
-                // In the future can store this in a dynamo table to ensure single use
-                const code = createSigner({
-                    expiresIn: 1000 * 60 * 5,
+            }, onSuccessResponse);
+            console.log("onSuccess", onSuccess);
+            if (onSuccess.type === "session") {
+                const { type, properties, ...rest } = onSuccess.properties;
+                // @ts-expect-error
+                const priv = Config[process.env.AUTH_ID + "PrivateKey"];
+                const signer = createSigner({
+                    ...rest,
                     key: priv,
                     algorithm: "RS512",
-                })({
-                    client_id,
-                    redirect_uri,
-                    token: token,
                 });
-                const location = new URL(redirect_uri);
-                location.searchParams.set("code", code);
-                location.searchParams.set("state", state || "");
+                const token = signer({
+                    type,
+                    properties,
+                });
+                useResponse().cookie({
+                    key: "sst_auth_token",
+                    value: token,
+                    maxAge: 10 * 365 * 24 * 60 * 60,
+                    secure: true,
+                    sameSite: "None",
+                    httpOnly: true,
+                });
+                const { client_id, response_type, redirect_uri, state } = {
+                    ...useCookies(),
+                    ...useQueryParams(),
+                };
+                if (response_type === "token") {
+                    const location = new URL(redirect_uri);
+                    location.hash = `access_token=${token}&state=${state || ""}`;
+                    return {
+                        statusCode: 302,
+                        headers: {
+                            Location: location.href,
+                        },
+                    };
+                }
+                if (response_type === "code") {
+                    // This allows the code to be reused within a 30 second window
+                    // The code should be single use but we're making this tradeoff to remain stateless
+                    // In the future can store this in a dynamo table to ensure single use
+                    const code = createSigner({
+                        expiresIn: 1000 * 60 * 5,
+                        key: priv,
+                        algorithm: "RS512",
+                    })({
+                        client_id,
+                        redirect_uri,
+                        token: token,
+                    });
+                    const location = new URL(redirect_uri);
+                    location.searchParams.set("code", code);
+                    location.searchParams.set("state", state || "");
+                    return {
+                        statusCode: 302,
+                        headers: {
+                            Location: location.href,
+                        },
+                    };
+                }
                 return {
-                    statusCode: 302,
-                    headers: {
-                        Location: location.href,
-                    },
+                    statusCode: 400,
+                    body: `Unsupported response_type: ${response_type}`,
                 };
             }
-            return {
-                statusCode: 400,
-                body: `Unsupported response_type: ${response_type}`,
-            };
+            if (onSuccess.type === "http") {
+                return onSuccess.properties;
+            }
         }
         if (result.type === "error") {
             return input.onError();

package/package.json

@@ -1,7 +1,7 @@
 {
   "sideEffects": false,
   "name": "sst",
-  "version": "2.11.17",
+  "version": "2.12.0",
   "bin": {
     "sst": "cli/sst.js"
   },

package/project.d.ts

@@ -24,6 +24,11 @@ export interface ConfigOptions {
         fileAssetsBucketName?: string;
         customPermissionsBoundary?: string;
         publicAccessBlockConfiguration?: boolean;
+        deployRoleArn?: string;
+        fileAssetPublishingRoleArn?: string;
+        imageAssetPublishingRoleArn?: string;
+        cloudFormationExecutionRole?: string;
+        lookupRoleArn?: string;
     };
 }
 declare const DEFAULTS: {

package/sst.mjs

@@ -284,6 +284,7 @@ async function load(input, shallow) {
               let contents = await fs3.readFile(args.path).then((x) => x.toString());
               const ast = babel.parse(contents, {
                 sourceType: "module",
+                filename: "sst.config.ts",
                 plugins: [ts]
               });
               babel.traverse(ast, {
@@ -5310,7 +5311,12 @@ async function bootstrapSST() {
     },
     synthesizer: new DefaultStackSynthesizer({
       qualifier: cdk?.qualifier,
-      fileAssetsBucketName: cdk?.fileAssetsBucketName
+      fileAssetsBucketName: cdk?.fileAssetsBucketName,
+      deployRoleArn: cdk?.deployRoleArn,
+      fileAssetPublishingRoleArn: cdk?.fileAssetPublishingRoleArn,
+      imageAssetPublishingRoleArn: cdk?.imageAssetPublishingRoleArn,
+      cloudFormationExecutionRole: cdk?.cloudFormationExecutionRole,
+      lookupRoleArn: cdk?.lookupRoleArn
     })
   });
   for (const [key, value] of Object.entries(bootstrap2?.tags || {})) {

package/stacks/build.js

@@ -51,6 +51,7 @@ export async function load(input, shallow) {
                                 .then((x) => x.toString());
                             const ast = babel.parse(contents, {
                                 sourceType: "module",
+                                filename: "sst.config.ts",
                                 plugins: [ts],
                             });
                             babel.traverse(ast, {