sst 2.21.7 → 2.21.8

package/bootstrap.js

@@ -5,7 +5,7 @@ import { spawn } from "child_process";
 import { DescribeStacksCommand, CloudFormationClient, } from "@aws-sdk/client-cloudformation";
 import { App, DefaultStackSynthesizer, Duration, CfnOutput, Tags, Stack, RemovalPolicy, } from "aws-cdk-lib/core";
 import { Function, Runtime, Code } from "aws-cdk-lib/aws-lambda";
-import { PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { ManagedPolicy, PermissionsBoundary, PolicyStatement, } from "aws-cdk-lib/aws-iam";
 import { Rule } from "aws-cdk-lib/aws-events";
 import { LambdaFunction } from "aws-cdk-lib/aws-events-targets";
 import { BlockPublicAccess, Bucket, BucketEncryption, } from "aws-cdk-lib/aws-s3";
@@ -215,6 +215,11 @@ export async function bootstrapSST() {
         },
     });
     rule.addTarget(new LambdaFunction(fn));
+    // Create permissions boundary
+    if (cdk?.customPermissionsBoundary) {
+        const boundaryPolicy = ManagedPolicy.fromManagedPolicyName(stack, "PermissionBoundaryPolicy", cdk.customPermissionsBoundary);
+        PermissionsBoundary.of(stack).apply(boundaryPolicy);
+    }
     // Create stack outputs to store bootstrap stack info
     new CfnOutput(stack, OUTPUT_VERSION, { value: LATEST_VERSION });
     new CfnOutput(stack, OUTPUT_BUCKET, { value: bucket.bucketName });

package/cli/local/server.js

@@ -104,11 +104,38 @@ export async function useLocalServer(opts) {
     const wss = new WebSocketServer({ noServer: true });
     const wss2 = new WebSocketServer({ noServer: true });
     const sockets = new Set();
+    let buffer = [
+        {
+            type: "cli.dev",
+            properties: {
+                stage: project.config.stage,
+                app: project.config.name,
+            },
+        },
+    ];
+    function publish(type, properties) {
+        const msg = {
+            type,
+            properties,
+        };
+        buffer.push(msg);
+        const json = JSON.stringify(msg);
+        [...sockets.values()].map((s) => s.send(json));
+    }
     wss2.on("connection", (socket, req) => {
         sockets.add(socket);
+        for (const msg of buffer) {
+            socket.send(JSON.stringify(msg));
+        }
         socket.on("close", () => {
             sockets.delete(socket);
         });
+        socket.on("message", (data) => {
+            const parsed = JSON.parse(data.toString());
+            if (parsed.type === "log.cleared") {
+                buffer = buffer.filter((msg) => msg.properties?.functionID !== parsed.properties?.functionID);
+            }
+        });
     });
     wss.on("connection", (socket, req) => {
         if (req.headers.origin?.endsWith("localhost:3000"))
@@ -179,13 +206,6 @@ export async function useLocalServer(opts) {
             cb(func);
         });
     }
-    function publish(type, properties) {
-        const msg = JSON.stringify({
-            type,
-            properties,
-        });
-        [...sockets.values()].map((s) => s.send(msg));
-    }
     bus.subscribe("function.invoked", async (evt) => {
         publish("function.invoked", evt.properties);
         updateFunction(evt.properties.functionID, (draft) => {

package/constructs/RemixSite.js

@@ -72,9 +72,11 @@ export class RemixSite extends SsrSite {
         // appropriate Lambda@Edge handler. We will utilise an internal asset
         // template to create this wrapper within the "core server build" output
         // directory.
+        // Ensure build directory exists
+        const buildPath = path.join(this.props.path, "build");
+        fs.mkdirSync(buildPath, { recursive: true });
         // Copy the server lambda handler
-        const handler = path.join(this.props.path, "build", "server.js");
-        fs.copyFileSync(path.resolve(__dirname, `../support/remix-site-function/${wrapperFile}`), handler);
+        fs.copyFileSync(path.resolve(__dirname, `../support/remix-site-function/${wrapperFile}`), path.join(buildPath, "server.js"));
         // Copy the Remix polyfil to the server build directory
         //
         // Note: We need to ensure that the polyfills are injected above other code that
@@ -82,10 +84,10 @@ export class RemixSite extends SsrSite {
         // doesn't appear to guarantee this, we therefore leverage ESBUild's
         // `inject` option to ensure that the polyfills are injected at the top of
         // the bundle.
-        const polyfillDest = path.join(this.props.path, "build/polyfill.js");
+        const polyfillDest = path.join(buildPath, "polyfill.js");
         fs.copyFileSync(path.resolve(__dirname, "../support/remix-site-function/polyfill.js"), polyfillDest);
         return {
-            handler: path.join(this.props.path, "build", "server.handler"),
+            handler: path.join(buildPath, "server.handler"),
             esbuild: { inject: [polyfillDest] },
         };
     }

package/constructs/util/permission.js

@@ -195,6 +195,9 @@ function permissionsToStatementsAndGrants(permissions) {
             if (secret) {
                 statements.push(buildPolicyStatement(["secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret"], [secret.secretArn]));
             }
+            if (secret?.encryptionKey) {
+                statements.push(buildPolicyStatement(["kms:Decrypt"], [secret.encryptionKey.keyArn]));
+            }
         }
         ////////////////////////////////////
         // Case: grant method

package/package.json

@@ -1,7 +1,7 @@
 {
   "sideEffects": false,
   "name": "sst",
-  "version": "2.21.7",
+  "version": "2.21.8",
   "bin": {
     "sst": "cli/sst.js"
   },

package/sst.mjs

@@ -6661,7 +6661,11 @@ import {
   RemovalPolicy
 } from "aws-cdk-lib/core";
 import { Function, Runtime as Runtime2, Code } from "aws-cdk-lib/aws-lambda";
-import { PolicyStatement } from "aws-cdk-lib/aws-iam";
+import {
+  ManagedPolicy,
+  PermissionsBoundary,
+  PolicyStatement
+} from "aws-cdk-lib/aws-iam";
 import { Rule } from "aws-cdk-lib/aws-events";
 import { LambdaFunction } from "aws-cdk-lib/aws-events-targets";
 import {
@@ -6815,6 +6819,14 @@ async function bootstrapSST() {
     }
   });
   rule.addTarget(new LambdaFunction(fn));
+  if (cdk?.customPermissionsBoundary) {
+    const boundaryPolicy = ManagedPolicy.fromManagedPolicyName(
+      stack,
+      "PermissionBoundaryPolicy",
+      cdk.customPermissionsBoundary
+    );
+    PermissionsBoundary.of(stack).apply(boundaryPolicy);
+  }
   new CfnOutput(stack, OUTPUT_VERSION, { value: LATEST_VERSION });
   new CfnOutput(stack, OUTPUT_BUCKET, { value: bucket.bucketName });
   const asm = app.synth();
@@ -7085,11 +7097,40 @@ async function useLocalServer(opts) {
   const wss = new WebSocketServer({ noServer: true });
   const wss2 = new WebSocketServer({ noServer: true });
   const sockets = /* @__PURE__ */ new Set();
+  let buffer = [
+    {
+      type: "cli.dev",
+      properties: {
+        stage: project.config.stage,
+        app: project.config.name
+      }
+    }
+  ];
+  function publish(type, properties) {
+    const msg = {
+      type,
+      properties
+    };
+    buffer.push(msg);
+    const json = JSON.stringify(msg);
+    [...sockets.values()].map((s) => s.send(json));
+  }
   wss2.on("connection", (socket, req) => {
     sockets.add(socket);
+    for (const msg of buffer) {
+      socket.send(JSON.stringify(msg));
+    }
     socket.on("close", () => {
       sockets.delete(socket);
     });
+    socket.on("message", (data2) => {
+      const parsed = JSON.parse(data2.toString());
+      if (parsed.type === "log.cleared") {
+        buffer = buffer.filter(
+          (msg) => msg.properties?.functionID !== parsed.properties?.functionID
+        );
+      }
+    });
   });
   wss.on("connection", (socket, req) => {
     if (req.headers.origin?.endsWith("localhost:3000"))
@@ -7160,13 +7201,6 @@ async function useLocalServer(opts) {
       cb(func);
     });
   }
-  function publish(type, properties) {
-    const msg = JSON.stringify({
-      type,
-      properties
-    });
-    [...sockets.values()].map((s) => s.send(msg));
-  }
   bus.subscribe("function.invoked", async (evt) => {
     publish("function.invoked", evt.properties);
     updateFunction(evt.properties.functionID, (draft) => {