wirejs-deploy-amplify-basic 0.0.98-realtime → 0.0.99-realtime

package/amplify-backend-assets/backend.ts

@@ -141,6 +141,7 @@ if (generated.some(isRealtimeService)) {
     appId: APP_ID!,
     branchId: BRANCH_ID,
     publisher: backend.api,
+    bucket: bucket.bucketName,
     namespaces: generated
       .filter(isRealtimeService)
       .map(r => r.options.namespace),

package/amplify-backend-assets/constructs/realtime-service/authorizer-lambda.ts

@@ -22,12 +22,15 @@ type AuthorizationResult = {
 	ttlOverride?: number;
 };
 
-let secrets: Record<string, Promise<string> | undefined> = {};
+let secret: Promise<string> | undefined = undefined;
 async function getSecret(ns: string): Promise<any> {
-	if (!secrets[ns]) {
-		secrets[ns] = new Promise(async (resolve, reject) => {
+	if (!secret) {
+		secret = new Promise(async (resolve, reject) => {
 			try {
-				const secret = new Secret(ns, process.env.SECRET_ID!)
+				const secret = new Secret(
+					process.env.SECRET_SCOPE!,
+					process.env.SECRET_ID!
+				)
 				resolve(await secret.read());
 			} catch (error) {
 				console.error('Error reading secret:', error);
@@ -35,7 +38,7 @@ async function getSecret(ns: string): Promise<any> {
 			}
 		});
 	}
-	return secrets[ns];
+	return secret;
 }
 
 export const handler = async (event: AuthorizationRequest): Promise<AuthorizationResult> => {

package/amplify-backend-assets/constructs/realtime-service/index.ts

@@ -24,6 +24,7 @@ export class RealtimeService extends Construct {
 				lambda: IFunction;
 			}
 		};
+		bucket: string; // needed for `Secret`, which currently uses the common S3 bucket
 		namespaces: string[];
 	}) {
 		super(scope, id);
@@ -38,9 +39,11 @@ export class RealtimeService extends Construct {
 			entry: path.join(__dirname, 'authorizer-lambda.ts'),
 			timeout: Duration.seconds(30),
 			environment: {
-				// must match wirejs-deploy-amplify-basic/wirejs-resources-overrides/services/realtime.ts:SECRET_ID
-				// TODO: find a common place to define this, or just pass it through
-				// in `addResource()`. (Redundant across `RealtimeService` instances.)
+				// global storage bucket currently used by `Secret` resource
+				BUCKET: props.bucket,
+
+				// NOTE: These MUST equal those defined in RealtimeService resource.
+				SECRET_SCOPE: 'wirejs-global',
 				SECRET_ID: 'realtime-secret',
 			}
 		});

package/amplify-hosting-assets/compute/default/package.json

@@ -3,6 +3,6 @@
 	"dependencies": {
 		"jsdom": "^25.0.1",
 		"wirejs-dom": "^1.0.41",
-		"wirejs-resources": "^0.1.66-realtime"
+		"wirejs-resources": "^0.1.67-realtime"
 	}
 }

package/dist/client/index.js

@@ -56,7 +56,7 @@ async function callApi(INTERNAL_API_URL, method, ...args) {
     if (typeof value === 'object' && value.__wjstype === 'realtime') {
         return {
             subscribe(subscriber) {
-                rt.subscribe(value.url, value.channel, value.token, subscriber);
+                rt.subscribe(value.url, value.channel, value.token, value.authHost, subscriber);
                 return () => {
                     rt.unsubscribe(value.url, value.channel, subscriber);
                 };

package/dist/client/realtime.d.ts

@@ -7,5 +7,5 @@ export type ChannelEvent<T = any> = {
     id: string;
     event: any;
 };
-export declare function subscribe(url: string, channel: string, token: string, subscriber: Subscriber): void;
+export declare function subscribe(url: string, channel: string, token: string, authHost: string, subscriber: Subscriber): void;
 export declare function unsubscribe(url: string, channel: string, subscriber: Subscriber): void;

package/dist/client/realtime.js

@@ -33,11 +33,11 @@ function getAuthProtocol(authorization) {
     const header = getBase64URLEncoded(authorization);
     return `header-${header}`;
 }
-export function subscribe(url, channel, token, subscriber) {
+export function subscribe(url, channel, token, authHost, subscriber) {
     const fullChannelName = `${url}#${channel}`;
     const authorization = {
         Authorization: token,
-        host: new URL(url).host,
+        host: authHost,
     };
     if (!connections.has(url)) {
         const ws = new WebSocket(url, [

package/dist/services/realtime.d.ts

@@ -1,5 +1,6 @@
 import { Resource } from 'wirejs-resources';
-export declare const SECRET_ID = "realtime-secret";
+export declare const REALTIME_SECRET_SCOPE = "wirejs-global";
+export declare const REALTIME_SECRET_ID = "realtime-secret";
 export declare class RealtimeService<T = any> extends Resource {
     #private;
     constructor(scope: Resource | string, id: string);

package/dist/services/realtime.js

@@ -5,17 +5,28 @@ import { HttpRequest } from '@aws-sdk/protocol-http';
 import { defaultProvider } from '@aws-sdk/credential-provider-node';
 import { Sha256 } from '@aws-crypto/sha256-js';
 import { addResource } from '../resource-collector.js';
-export const SECRET_ID = 'realtime-secret';
+export const REALTIME_SECRET_SCOPE = 'wirejs-global';
+export const REALTIME_SECRET_ID = 'realtime-secret';
+let secret = undefined;
+function createSecret() {
+    if (!secret) {
+        secret = new Secret(REALTIME_SECRET_SCOPE, REALTIME_SECRET_ID);
+    }
+    return secret;
+}
 export class RealtimeService extends Resource {
     #secret;
     #namespace;
     constructor(scope, id) {
         super(scope, id);
-        this.#secret = new Secret(this, SECRET_ID);
+        this.#secret = createSecret();
         this.#namespace = this.absoluteId
             .replace(/[^a-zA-Z0-9]/g, '-')
             .slice(0, 50);
-        addResource('RealtimeService', { namespace: this.#namespace });
+        addResource('RealtimeService', {
+            absoluteId: this.absoluteId,
+            namespace: this.#namespace,
+        });
     }
     /**
      * Ensures channel name will be supported by known, major cloud provers using
@@ -105,7 +116,8 @@ export class RealtimeService extends Resource {
             __wjstype: 'realtime',
             url: this.address,
             channel: `${this.#namespace}/${channel}`,
-            token: jwt
+            token: jwt,
+            authHost: process.env.REALTIME_HTTP_DOMAIN,
         };
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "wirejs-deploy-amplify-basic",
-	"version": "0.0.98-realtime",
+	"version": "0.0.99-realtime",
 	"type": "module",
 	"main": "./dist/index.js",
 	"types": "./dist/index.d.ts",
@@ -41,7 +41,7 @@
 		"recursive-copy": "^2.0.14",
 		"rimraf": "^6.0.1",
 		"wirejs-dom": "^1.0.41",
-		"wirejs-resources": "^0.1.66-realtime"
+		"wirejs-resources": "^0.1.67-realtime"
 	},
 	"devDependencies": {
 		"@aws-amplify/backend": "^1.14.0",