wirejs-deploy-amplify-basic 0.0.147-payments → 0.0.148-payments

package/amplify-backend-assets/backend.ts

@@ -80,6 +80,30 @@ const bucket = new Bucket(backend.stack, 'data', {
 });
 bucket.grantReadWrite(backend.api.resources.lambda);
 
+function isRealtimeService(resource: any): resource is {
+  type: 'RealtimeService';
+  options: { namespace: string; };
+} {
+  return resource.type === 'RealtimeService';
+}
+
+let realtime: RealtimeService | undefined;
+if (generated.some(isRealtimeService)) {
+  const realtimeStack = new NestedStack(backend.stack, 'realtime', {
+    description: 'Realtime service for distributed resources',
+  });
+  realtime = new RealtimeService(realtimeStack, 'realtime', {
+    appId: APP_ID!,
+    branchId: BRANCH_ID,
+    publisher: backend.api,
+    bucket: bucket.bucketName,
+    namespaces: generated
+      .filter(isRealtimeService)
+      .map(r => r.options.namespace),
+  });
+  bucket.grantReadWrite(realtime.authHandler);
+}
+
 /**
  * DDB Tables
  */
@@ -141,53 +165,32 @@ for (const resource of generated) {
       }
     );
 
-    table.grantReadWriteData(backend.api.resources.lambda);
-
-    // indexes created by custom resource and require explicit
-    // permissions to be added to the lambda role (apparently).
-    backend.api.resources.lambda.addToRolePolicy(new PolicyStatement({
-      actions: [
-        "dynamodb:Query",
-        "dynamodb:Scan",
-        "dynamodb:GetItem",
-        "dynamodb:BatchGetItem",
-      ],
-      resources: [
-        table.tableArn,
-        `${table.tableArn}/index/*`,
-      ],
-    }))
+    const lambdasNeedingAccess = [
+      backend.api.resources.lambda
+    ];
+    if (realtime) lambdasNeedingAccess.push(realtime.authHandler);
+
+    for (const lambda of lambdasNeedingAccess) {
+      table.grantReadWriteData(lambda);
+
+      // indexes created by custom resource and require explicit
+      // permissions to be added to the lambda role (apparently).
+      lambda.addToRolePolicy(new PolicyStatement({
+        actions: [
+          "dynamodb:Query",
+          "dynamodb:Scan",
+          "dynamodb:GetItem",
+          "dynamodb:BatchGetItem",
+        ],
+        resources: [
+          table.tableArn,
+          `${table.tableArn}/index/*`,
+        ],
+      }));
+    }
   }
 }
 
-function isRealtimeService(resource: any): resource is {
-  type: 'RealtimeService';
-  options: { namespace: string; };
-} {
-  return resource.type === 'RealtimeService';
-}
-
-if (generated.some(isRealtimeService)) {
-  const realtimeStack = new NestedStack(backend.stack, 'realtime', {
-    description: 'Realtime service for distributed resources',
-  });
-  const realtime = new RealtimeService(realtimeStack, 'realtime', {
-    appId: APP_ID!,
-    branchId: BRANCH_ID,
-    publisher: backend.api,
-    bucket: bucket.bucketName,
-    namespaces: generated
-      .filter(isRealtimeService)
-      .map(r => r.options.namespace),
-  });
-  // TODO: is there a better way to ensure we grant access specifically
-  // to what `Secret` uses to store its creds without creating N places to
-  // map this?
-  // Longer term: Secrets will be stored either in DDB, parameter store, something
-  // else that is more appropriate than S3.
-  bucket.grantReadWrite(realtime.authHandler);
-}
-
 /**
  * Lambda environment vars
  */

package/amplify-hosting-assets/compute/default/package.json

@@ -3,6 +3,6 @@
 	"dependencies": {
 		"jsdom": "^25.0.1",
 		"wirejs-dom": "^1.0.42",
-		"wirejs-resources": "^0.1.115-payments"
+		"wirejs-resources": "^0.1.116-payments"
 	}
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "wirejs-deploy-amplify-basic",
-	"version": "0.0.147-payments",
+	"version": "0.0.148-payments",
 	"type": "module",
 	"main": "./dist/index.js",
 	"types": "./dist/index.d.ts",
@@ -42,7 +42,7 @@
 		"recursive-copy": "^2.0.14",
 		"rimraf": "^6.0.1",
 		"wirejs-dom": "^1.0.42",
-		"wirejs-resources": "^0.1.115-payments"
+		"wirejs-resources": "^0.1.116-payments"
 	},
 	"devDependencies": {
 		"@aws-amplify/backend": "^1.14.0",