magic-pocket-cli 0.2.2__tar.gz → 0.3.0__tar.gz

{magic_pocket_cli-0.2.2 → magic_pocket_cli-0.3.0}/PKG-INFO

@@ -1,13 +1,13 @@
 Metadata-Version: 2.4
 Name: magic-pocket-cli
-Version: 0.2.2
+Version: 0.3.0
 Summary: CLI and deploy tools for magic-pocket.
 Requires-Python: >=3.10
 Requires-Dist: awscrt>=0.19.0
 Requires-Dist: click>=8.1.7
 Requires-Dist: deepdiff>=6.7.1
 Requires-Dist: jinja2>=3.1.3
-Requires-Dist: magic-pocket>=0.2.2
+Requires-Dist: magic-pocket>=0.3.0
 Requires-Dist: pathspec>=1.0.4
 Requires-Dist: python-on-whales>=0.68.0
 Requires-Dist: pyyaml>=6.0.1

{magic_pocket_cli-0.2.2 → magic_pocket_cli-0.3.0}/pocket_cli/mediator.py

@@ -109,7 +109,7 @@ class Mediator:
             return self._generate_rsa_pem()
         elif spec.type == "cloudfront_signing_key":
             return self._generate_rsa_pem()
-        elif spec.type == "spa_token_secret":
+        elif spec.type in ("spa_token_secret", "origin_verify_secret"):
             return secrets.token_hex(32)
         else:
             raise RuntimeError("Unknown secret type: %s" % spec.type)

{magic_pocket_cli-0.2.2 → magic_pocket_cli-0.3.0}/pocket_cli/resources/aws/cloudformation.py

@@ -358,8 +358,10 @@ class CloudFrontStack(Stack):
         self,
         context: CloudFrontContext,
         token_secret_value: str = "",
+        origin_verify_secret_value: str = "",
     ):
         self._token_secret_value = token_secret_value
+        self._origin_verify_secret_value = origin_verify_secret_value
         super().__init__(context)
 
     def get_client(self):
@@ -544,6 +546,7 @@ class CloudFrontStack(Stack):
             deploy_hash_function_codes=deploy_hash_function_codes,
             api_host_function_code=api_host_function_code,
             has_token_kvs=self._has_token_kvs,
+            origin_verify_secret=self._origin_verify_secret_value,
             **context_data,
         )
         return "\n".join(

{magic_pocket_cli-0.2.2 → magic_pocket_cli-0.3.0}/pocket_cli/resources/cloudfront.py

@@ -49,6 +49,7 @@ class CloudFront:
         self.s3_client = boto3.client("s3", region_name=context.s3_region)
         self.cf_client = boto3.client("cloudfront")
         self._token_secret_value: str = ""
+        self._origin_verify_secret_value: str = ""
 
     @property
     def description(self):
@@ -71,7 +72,9 @@ class CloudFront:
     @property
     def stack(self):
         return CloudFrontStack(
-            self.context, token_secret_value=self._token_secret_value
+            self.context,
+            token_secret_value=self._token_secret_value,
+            origin_verify_secret_value=self._origin_verify_secret_value,
         )
 
     def create(self, mediator: Mediator | None = None):
@@ -79,6 +82,7 @@ class CloudFront:
 
     def update(self, mediator: Mediator | None = None):
         self._prepare_token_secret(mediator)
+        self._prepare_origin_verify_secret(mediator)
         self._ensure_redirect_from()
         if not self.stack.exists:
             self.stack.create()
@@ -136,6 +140,33 @@ class CloudFront:
                 % self.context.token_secret
             )
 
+    def _prepare_origin_verify_secret(self, mediator: Mediator | None):
+        """enable_origin_verify 時に origin verify secret の値を store から読む。
+
+        値は CFn テンプレートの OriginCustomHeaders に焼き込まれる
+        (token_secret の post-deploy KVS とは異なり、distribution config の一部
+        なので create/update 時点で必要)。managed secret なので AwsContainer
+        deploy 時に既に生成済み (get_resources は AwsContainer → CloudFront 順)。
+        """
+        from pocket.context import ORIGIN_VERIFY_SECRET_KEY
+
+        if not self.context.enable_origin_verify:
+            return
+        if not mediator:
+            return
+        ac = mediator.context.awscontainer
+        if not ac or not ac.secrets:
+            return
+        secrets = ac.secrets.pocket_store.secrets
+        value = secrets.get(ORIGIN_VERIFY_SECRET_KEY)
+        if isinstance(value, str):
+            self._origin_verify_secret_value = value
+        else:
+            echo.warning(
+                "origin verify secret '%s' が managed secrets に見つかりません"
+                % ORIGIN_VERIFY_SECRET_KEY
+            )
+
     def _write_token_secret_to_kvs(self):
         if not self._token_secret_value:
             return

magic_pocket_cli-0.3.0/pocket_cli/templates/cloudformation/cf_function_api_host.js

@@ -0,0 +1,9 @@
+function handler(event) {
+    var request = event.request;
+    request.headers['x-forwarded-host'] = { value: request.headers.host.value };
+    // event.viewer.ip は CloudFront が TCP 接続から取得する viewer IP で詐称不可。
+    // viewer が同名 header を送っても上書きするため、origin は真の client IP を
+    // 信頼できる。OriginVerifyMiddleware が REMOTE_ADDR に正規化する。
+    request.headers['x-pocket-viewer-ip'] = { value: event.viewer.ip };
+    return request;
+}

{magic_pocket_cli-0.2.2 → magic_pocket_cli-0.3.0}/pocket_cli/templates/cloudformation/cloudfront.yaml

@@ -129,6 +129,14 @@ Resources:
             CustomOriginConfig:
               OriginProtocolPolicy: https-only
               HTTPSPort: 443
+            # {% if origin_verify_secret %}
+            # CloudFront → origin にのみ付与する secret header。viewer が同名 header
+            # を送っても CloudFront が上書きするため詐称不可。origin (API GW / Lambda)
+            # 直叩きを検出するために OriginVerifyMiddleware が同値を検証する。
+            OriginCustomHeaders:
+              - HeaderName: "X-Pocket-Origin-Verify"
+                HeaderValue: "{{ origin_verify_secret }}"
+            # {% endif %}
           # {% endfor %}
           # {% if managed_asset_files %}
           - Id: "{{ resource_prefix }}pocket-managed"

{magic_pocket_cli-0.2.2 → magic_pocket_cli-0.3.0}/pyproject.toml

@@ -1,10 +1,10 @@
 [project]
 name = "magic-pocket-cli"
-version = "0.2.2"
+version = "0.3.0"
 description = "CLI and deploy tools for magic-pocket."
 requires-python = ">=3.10"
 dependencies = [
-    "magic-pocket>=0.2.2",
+    "magic-pocket>=0.3.0",
     "click>=8.1.7",
     "jinja2>=3.1.3",
     "python-on-whales>=0.68.0",

magic_pocket_cli-0.2.2/pocket_cli/templates/cloudformation/cf_function_api_host.js

@@ -1,5 +0,0 @@
-function handler(event) {
-    var request = event.request;
-    request.headers['x-forwarded-host'] = { value: request.headers.host.value };
-    return request;
-}