magic-pocket-cli 0.2.2__tar.gz → 0.4.0__tar.gz

{magic_pocket_cli-0.2.2 → magic_pocket_cli-0.4.0}/PKG-INFO

@@ -1,13 +1,13 @@
 Metadata-Version: 2.4
 Name: magic-pocket-cli
-Version: 0.2.2
+Version: 0.4.0
 Summary: CLI and deploy tools for magic-pocket.
 Requires-Python: >=3.10
 Requires-Dist: awscrt>=0.19.0
 Requires-Dist: click>=8.1.7
 Requires-Dist: deepdiff>=6.7.1
 Requires-Dist: jinja2>=3.1.3
-Requires-Dist: magic-pocket>=0.2.2
+Requires-Dist: magic-pocket>=0.4.0
 Requires-Dist: pathspec>=1.0.4
 Requires-Dist: python-on-whales>=0.68.0
 Requires-Dist: pyyaml>=6.0.1

{magic_pocket_cli-0.2.2 → magic_pocket_cli-0.4.0}/pocket_cli/mediator.py

@@ -60,6 +60,7 @@ class Mediator:
     def ensure_pocket_managed_secrets(self):
         self.create_pocket_managed_secrets(exists="ignore")
         self._cleanup_orphaned_secrets()
+        self.verify_user_stored_secrets()
         if self.context.awscontainer and self.context.awscontainer.secrets:
             sc = self.context.awscontainer.secrets
             if hasattr(sc, "pocket_store"):
@@ -69,6 +70,53 @@ class Mediator:
             if hasattr(sc, "allowed_ssm_resources"):
                 del sc.allowed_ssm_resources
 
+    def verify_user_stored_secrets(self):
+        """type 付き user secret (stored mode) が deploy 前に provision 済みか検証する。
+
+        computed (managed) と違い pocket は値を生成しないため、未 provision でも
+        deploy は通り runtime まで遅延して落ちる。それを避けるため deploy 時に store を
+        引いて存在を確認し、無ければ正準名を示して止める。管理 API は叩かない。
+        """
+        if self.context.awscontainer is None:
+            return
+        if (sc := self.context.awscontainer.secrets) is None:
+            return
+        missing: list[str] = []
+        for key, spec in sc.user.items():
+            # type 付き = stored mode のみ対象。name は from_settings で導出済み。
+            if spec.type is None or spec.name is None:
+                continue
+            store = spec.store or sc.store
+            if not self._stored_secret_exists(spec.name, store, sc.region):
+                missing.append(
+                    "  - %s (type=%s, store=%s): %s"
+                    % (key, spec.type, store, spec.name)
+                )
+        if missing:
+            raise RuntimeError(
+                "stored mode の user secret が見つかりません。"
+                "deploy 前に下記の secret を provision してください "
+                "(値は接続 URL):\n" + "\n".join(missing)
+            )
+
+    def _stored_secret_exists(self, name: str, store: str, region: str) -> bool:
+        import boto3
+        from botocore.exceptions import ClientError
+
+        try:
+            if store == "ssm":
+                boto3.client("ssm", region_name=region).get_parameter(Name=name)
+            else:
+                boto3.client("secretsmanager", region_name=region).describe_secret(
+                    SecretId=name
+                )
+            return True
+        except ClientError as e:
+            code = e.response.get("Error", {}).get("Code", "")
+            if code in ("ParameterNotFound", "ResourceNotFoundException"):
+                return False
+            raise
+
     def _cleanup_orphaned_secrets(self):
         """SSM/SM にあるが managed 定義にないシークレットを削除する"""
         if self.context.awscontainer is None:
@@ -109,7 +157,7 @@ class Mediator:
             return self._generate_rsa_pem()
         elif spec.type == "cloudfront_signing_key":
             return self._generate_rsa_pem()
-        elif spec.type == "spa_token_secret":
+        elif spec.type in ("spa_token_secret", "origin_verify_secret"):
             return secrets.token_hex(32)
         else:
             raise RuntimeError("Unknown secret type: %s" % spec.type)

{magic_pocket_cli-0.2.2 → magic_pocket_cli-0.4.0}/pocket_cli/resources/aws/cloudformation.py

@@ -358,8 +358,10 @@ class CloudFrontStack(Stack):
         self,
         context: CloudFrontContext,
         token_secret_value: str = "",
+        origin_verify_secret_value: str = "",
     ):
         self._token_secret_value = token_secret_value
+        self._origin_verify_secret_value = origin_verify_secret_value
         super().__init__(context)
 
     def get_client(self):
@@ -544,6 +546,7 @@ class CloudFrontStack(Stack):
             deploy_hash_function_codes=deploy_hash_function_codes,
             api_host_function_code=api_host_function_code,
             has_token_kvs=self._has_token_kvs,
+            origin_verify_secret=self._origin_verify_secret_value,
             **context_data,
         )
         return "\n".join(

{magic_pocket_cli-0.2.2 → magic_pocket_cli-0.4.0}/pocket_cli/resources/cloudfront.py

@@ -49,6 +49,7 @@ class CloudFront:
         self.s3_client = boto3.client("s3", region_name=context.s3_region)
         self.cf_client = boto3.client("cloudfront")
         self._token_secret_value: str = ""
+        self._origin_verify_secret_value: str = ""
 
     @property
     def description(self):
@@ -71,7 +72,9 @@ class CloudFront:
     @property
     def stack(self):
         return CloudFrontStack(
-            self.context, token_secret_value=self._token_secret_value
+            self.context,
+            token_secret_value=self._token_secret_value,
+            origin_verify_secret_value=self._origin_verify_secret_value,
         )
 
     def create(self, mediator: Mediator | None = None):
@@ -79,6 +82,7 @@ class CloudFront:
 
     def update(self, mediator: Mediator | None = None):
         self._prepare_token_secret(mediator)
+        self._prepare_origin_verify_secret(mediator)
         self._ensure_redirect_from()
         if not self.stack.exists:
             self.stack.create()
@@ -136,6 +140,33 @@ class CloudFront:
                 % self.context.token_secret
             )
 
+    def _prepare_origin_verify_secret(self, mediator: Mediator | None):
+        """enable_origin_verify 時に origin verify secret の値を store から読む。
+
+        値は CFn テンプレートの OriginCustomHeaders に焼き込まれる
+        (token_secret の post-deploy KVS とは異なり、distribution config の一部
+        なので create/update 時点で必要)。managed secret なので AwsContainer
+        deploy 時に既に生成済み (get_resources は AwsContainer → CloudFront 順)。
+        """
+        from pocket.context import ORIGIN_VERIFY_SECRET_KEY
+
+        if not self.context.enable_origin_verify:
+            return
+        if not mediator:
+            return
+        ac = mediator.context.awscontainer
+        if not ac or not ac.secrets:
+            return
+        secrets = ac.secrets.pocket_store.secrets
+        value = secrets.get(ORIGIN_VERIFY_SECRET_KEY)
+        if isinstance(value, str):
+            self._origin_verify_secret_value = value
+        else:
+            echo.warning(
+                "origin verify secret '%s' が managed secrets に見つかりません"
+                % ORIGIN_VERIFY_SECRET_KEY
+            )
+
     def _write_token_secret_to_kvs(self):
         if not self._token_secret_value:
             return

magic_pocket_cli-0.4.0/pocket_cli/templates/cloudformation/cf_function_api_host.js

@@ -0,0 +1,9 @@
+function handler(event) {
+    var request = event.request;
+    request.headers['x-forwarded-host'] = { value: request.headers.host.value };
+    // event.viewer.ip は CloudFront が TCP 接続から取得する viewer IP で詐称不可。
+    // viewer が同名 header を送っても上書きするため、origin は真の client IP を
+    // 信頼できる。OriginVerifyMiddleware が REMOTE_ADDR に正規化する。
+    request.headers['x-pocket-viewer-ip'] = { value: event.viewer.ip };
+    return request;
+}

{magic_pocket_cli-0.2.2 → magic_pocket_cli-0.4.0}/pocket_cli/templates/cloudformation/cloudfront.yaml

@@ -129,6 +129,14 @@ Resources:
             CustomOriginConfig:
               OriginProtocolPolicy: https-only
               HTTPSPort: 443
+            # {% if origin_verify_secret %}
+            # CloudFront → origin にのみ付与する secret header。viewer が同名 header
+            # を送っても CloudFront が上書きするため詐称不可。origin (API GW / Lambda)
+            # 直叩きを検出するために OriginVerifyMiddleware が同値を検証する。
+            OriginCustomHeaders:
+              - HeaderName: "X-Pocket-Origin-Verify"
+                HeaderValue: "{{ origin_verify_secret }}"
+            # {% endif %}
           # {% endfor %}
           # {% if managed_asset_files %}
           - Id: "{{ resource_prefix }}pocket-managed"

{magic_pocket_cli-0.2.2 → magic_pocket_cli-0.4.0}/pyproject.toml

@@ -1,10 +1,10 @@
 [project]
 name = "magic-pocket-cli"
-version = "0.2.2"
+version = "0.4.0"
 description = "CLI and deploy tools for magic-pocket."
 requires-python = ">=3.10"
 dependencies = [
-    "magic-pocket>=0.2.2",
+    "magic-pocket>=0.4.0",
     "click>=8.1.7",
     "jinja2>=3.1.3",
     "python-on-whales>=0.68.0",

magic_pocket_cli-0.2.2/pocket_cli/templates/cloudformation/cf_function_api_host.js

@@ -1,5 +0,0 @@
-function handler(event) {
-    var request = event.request;
-    request.headers['x-forwarded-host'] = { value: request.headers.host.value };
-    return request;
-}