magic-pocket-cli 0.40.0__tar.gz → 0.41.0__tar.gz

{magic_pocket_cli-0.40.0 → magic_pocket_cli-0.41.0}/PKG-INFO

@@ -1,13 +1,13 @@
 Metadata-Version: 2.5
 Name: magic-pocket-cli
-Version: 0.40.0
+Version: 0.41.0
 Summary: CLI and deploy tools for magic-pocket.
 Requires-Python: >=3.10
 Requires-Dist: awscrt>=0.19.0
 Requires-Dist: click>=8.1.7
 Requires-Dist: deepdiff>=6.7.1
 Requires-Dist: jinja2>=3.1.3
-Requires-Dist: magic-pocket<0.41,>=0.40.0
+Requires-Dist: magic-pocket<0.42,>=0.41.0
 Requires-Dist: pathspec>=1.0.4
 Requires-Dist: python-on-whales>=0.68.0
 Requires-Dist: pyyaml>=6.0.1

{magic_pocket_cli-0.40.0 → magic_pocket_cli-0.41.0}/pocket_cli/cli/deploy_cli.py

@@ -12,6 +12,7 @@ from pocket_cli.mediator import Mediator
 from pocket_cli.resources.aws.builders.context_check import (
     resummarize_world_read_warnings,
 )
+from pocket_cli.resources.aws.stage_roles import verify_stage_roles
 from pocket_cli.resources.aws.state import StateStore, create_state_store
 from pocket_cli.resources.backup import Backup
 from pocket_cli.resources.cloudfront import CloudFront
@@ -230,6 +231,8 @@ def _deploy_pipeline(context: Context, *, openpath=None, skip_frontend=False):
     deploy_hash_message = deploy_hash_report(context)
     if deploy_hash_message:
         echo.info(deploy_hash_message)
+    # [iam] external_roles: 事前に作られた role を、何かを変更する前に検査する
+    verify_stage_roles(context)
     # CodeBuildがソースアップロードにstate bucketを必要とするため、先に作成
     state_store = _create_state_store(context)
     state_store.ensure_bucket()

{magic_pocket_cli-0.40.0 → magic_pocket_cli-0.41.0}/pocket_cli/cli/destroy_cli.py

@@ -45,6 +45,7 @@ def _create_codebuild_builder(context: Context) -> CodeBuildBuilder | None:
         resource_prefix=resource_prefix,
         state_bucket=f"{resource_prefix}state",
         permissions_boundary=permissions_boundary,
+        external_roles=context.external_roles,
     )
 
 

magic_pocket_cli-0.41.0/pocket_cli/cli/permissions_cli.py

@@ -0,0 +1,96 @@
+"""`pocket permissions` サブコマンド群。
+
+- `list`: `pocket.toml` の構成から deploy に必要な AWS IAM Action を出力する。
+  外部の IAM Role プロビジョニング処理が GitHub Actions デプロイ用 IAM Role を
+  作る際の inline policy 生成に使用することを想定。
+- `roles`: pocket の Lambda / scheduler / CodeBuild / AWS Backup が使う IAM role
+  の定義を出力する。`[iam] external_roles = true` で role を事前に作る用途。
+"""
+
+from __future__ import annotations
+
+import json
+
+import boto3
+import click
+
+from pocket.context import Context
+from pocket.permissions import compute_actions
+from pocket.settings import Settings
+from pocket_cli.resources.aws.stage_roles import stage_role_specs
+
+
+@click.group()
+def permissions():
+    """IAM 権限関連のサブコマンド。"""
+
+
+@permissions.command("list")
+@click.option("--stage", envvar="POCKET_DEPLOY_STAGE", prompt=True)
+@click.option(
+    "--format",
+    "format_",
+    type=click.Choice(["text", "json"]),
+    default="text",
+    show_default=True,
+    help='出力形式。text: 1 行 1 Action / json: {"actions": [...]}',
+)
+def list_(stage: str, format_: str):
+    """pocket.toml から必要な AWS Action 一覧を出力する。
+
+    docs/permissions/aws.md のテーブルに基づき、`[cloudfront]` / `[rds]` /
+    `[ses]` などの設定有無に応じて必要 Action を組み立てる。粒度は
+    ワイルドカード中心 (`cloudformation:*` 等)。
+    """
+    settings = Settings.from_toml(stage=stage)
+    actions = compute_actions(settings)
+    if format_ == "json":
+        click.echo(json.dumps({"actions": actions}, indent=2))
+    else:
+        for action in actions:
+            click.echo(action)
+
+
+@permissions.command("roles")
+@click.option("--stage", envvar="POCKET_DEPLOY_STAGE", prompt=True)
+@click.option(
+    "--account-id",
+    help="role の ARN と policy に埋め込む AWS account ID。省略時は"
+    " sts:GetCallerIdentity で取得する。",
+)
+def roles(stage: str, account_id: str | None):
+    """pocket が使う IAM role の定義を JSON で出力する。
+
+    role ごとに名前・ARN・信頼ポリシー・managed policy・inline policy を出す。
+    policy 中の CloudFormation 変数 (${AWS::Region} 等) は展開済みなので、
+    そのまま IAM の CreateRole / PutRolePolicy に渡せる。`[iam] external_roles
+    = true` の stage では、deploy がこの定義と実際の role を突き合わせる。
+    """
+    context = Context.from_toml(stage=stage)
+    if not context.general:
+        raise click.ClickException("[general] が見つかりません")
+    region = context.general.region
+    account = (
+        account_id
+        or (boto3.client("sts", region_name=region).get_caller_identity()["Account"])
+    )
+    specs = stage_role_specs(context, account_id=account)
+    output = {
+        "stage": stage,
+        "region": region,
+        "account_id": account,
+        "external_roles": context.external_roles,
+        "roles": [
+            {
+                "name": spec.name,
+                "arn": f"arn:aws:iam::{account}:role/{spec.name}",
+                "assume_role_policy": spec.assume_role_policy,
+                "managed_policy_arns": spec.managed_policy_arns,
+                "inline_policies": spec.resolved_inline_policies(
+                    region=region, account_id=account
+                ),
+            }
+            for spec in specs
+        ],
+    }
+    click.echo(json.dumps(output, indent=2, ensure_ascii=False))

{magic_pocket_cli-0.40.0 → magic_pocket_cli-0.41.0}/pocket_cli/resources/aws/builders/__init__.py

@@ -27,6 +27,7 @@ def create_builder(
     resource_prefix: str,
     state_bucket: str,
     permissions_boundary: str | None = None,
+    external_roles: bool = False,
 ) -> Builder:
     backend = build_context.backend
 
@@ -44,6 +45,7 @@ def create_builder(
             state_bucket=state_bucket,
             compute_type=build_context.compute_type,
             permissions_boundary=permissions_boundary,
+            external_roles=external_roles,
         )
 
     if backend == "depot":

{magic_pocket_cli-0.40.0 → magic_pocket_cli-0.41.0}/pocket_cli/resources/aws/builders/codebuild.py

@@ -50,6 +50,7 @@ class CodeBuildBuilder:
         state_bucket: str,
         compute_type: str = "BUILD_GENERAL1_MEDIUM",
         permissions_boundary: str | None = None,
+        external_roles: bool = False,
     ) -> None:
         self.region = region
         self.resource_prefix = resource_prefix
@@ -58,6 +59,8 @@ class CodeBuildBuilder:
         self.permissions_boundary = (
             os.environ.get("CODEBUILD_PERMISSIONS_BOUNDARY") or permissions_boundary
         )
+        # [iam] external_roles。role は利用者が事前に作り、pocket は作成も削除もしない
+        self.external_roles = external_roles
 
         self.codebuild = boto3.client("codebuild", region_name=region)
         self.iam = boto3.client("iam", region_name=region)
@@ -91,7 +94,8 @@ class CodeBuildBuilder:
         role_arn = self._ensure_role(account_id)
         self._ensure_project(platform, role_arn)
         # project の serviceRole を新ロールへ付け替えた後なので、旧名ロールは孤児
-        self._delete_role(self._legacy_role_name)
+        if not self.external_roles:
+            self._delete_role(self._legacy_role_name)
         self._upload_source(dockerfile_path)
 
         build_id = self._start_build(
@@ -106,26 +110,29 @@ class CodeBuildBuilder:
         print("CodeBuild ビルド完了")
 
     def delete(self) -> None:
-        """CodeBuildプロジェクトとIAMロールを削除"""
+        """CodeBuildプロジェクトとIAMロールを削除 (external_roles の role は残す)"""
         self._delete_project()
+        if self.external_roles:
+            return
         self._delete_role(self._role_name)
         self._delete_role(self._legacy_role_name)
 
     # --- IAM ロール ---
 
-    def _ensure_role(self, account_id: str) -> str:
-        return iam_roles.ensure_role(
-            self.iam,
-            iam_roles.codebuild_role(
-                name=self._role_name,
-                region=self.region,
-                account_id=account_id,
-                state_bucket=self.state_bucket,
-                project_name=self._project_name,
-                permissions_boundary=self.permissions_boundary,
-            ),
+    def role_spec(self, account_id: str) -> iam_roles.RoleSpec:
+        return iam_roles.codebuild_role(
+            name=self._role_name,
+            region=self.region,
+            account_id=account_id,
+            state_bucket=self.state_bucket,
+            project_name=self._project_name,
+            permissions_boundary=self.permissions_boundary,
+            external=self.external_roles,
         )
 
+    def _ensure_role(self, account_id: str) -> str:
+        return iam_roles.ensure_role(self.iam, self.role_spec(account_id))
+
     def _delete_role(self, role_name: str) -> None:
         iam_roles.delete_role(self.iam, role_name)
 

{magic_pocket_cli-0.40.0 → magic_pocket_cli-0.41.0}/pocket_cli/resources/aws/cloudformation.py

@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+import json
+import re
 import time
 from functools import cached_property
 from typing import TYPE_CHECKING, Any
@@ -436,6 +438,12 @@ class CloudFrontKeysStack(Stack):
         )
 
 
+# deploy_hash route の URL で hash とみなすセグメントの形 (git の short / full hash)。
+DEPLOY_HASH_PATTERN = "[0-9a-f]{7,40}"
+# strip Function が URI から外した hash を載せるリクエストヘッダ (キャッシュキー用)。
+DEPLOY_HASH_HEADER = "x-pocket-deploy-hash"
+
+
 class CloudFrontStack(Stack):
     context: CloudFrontContext
     template_filename = "cloudfront"
@@ -627,25 +635,67 @@ class CloudFrontStack(Stack):
         return self._reindent(code, 8)
 
     def _build_deploy_hash_function_codes(self) -> dict[str, str]:
-        """deploy_hash route 用の hash prefix strip Function コードを生成する"""
+        """deploy_hash route 用の hash prefix strip Function コードを生成する
+
+        route の prefix 直下の 1 セグメントが git hash の形 (`DEPLOY_HASH_PATTERN`)
+        なら、値を問わず外す。現在の hash だけを外すと、Lambda (新 hash の URL を出す)
+        とこの Function の切り替えがずれる間、および旧 hash の HTML を開いたままの
+        端末で、存在しないキーを読んで 403 になる (KN1670)。S3 のキーは hash に依存
+        しないので、どの hash の URL でも同じオブジェクトを返せる。
+
+        `DEPLOY_HASH` を git hash の形でない値で上書きしている場合だけ、その値も外す
+        (この場合は deploy のたびに Function が更新される)。
+
+        CloudFront のキャッシュキーは viewer-request で書き換えた後の URI になるため、
+        外した hash は `DEPLOY_HASH_HEADER` に載せ、テンプレート側の CachePolicy で
+        キャッシュキーに含める。こうしないと全 hash の URL が 1 つの edge キャッシュを
+        共有し、deploy しても中身の変わったファイルが古いまま返る。
+        """
         codes: dict[str, str] = {}
         deploy_hash = self.context.deploy_hash
         if not deploy_hash:
             return codes
+        segment_condition = "/^%s$/.test(segment)" % DEPLOY_HASH_PATTERN
+        if not re.fullmatch(DEPLOY_HASH_PATTERN, deploy_hash):
+            segment_condition += " || segment === %s" % json.dumps(deploy_hash)
+        env = Environment(
+            loader=PackageLoader("pocket_cli"),
+            autoescape=select_autoescape(),
+        )
+        template = env.get_template("cloudformation/cf_function_deploy_hash_strip.js")
         for route in self.context.routes:
             if not route.is_deploy_hash:
                 continue
-            code = (
-                "function handler(event) {\n"
-                "    var request = event.request;\n"
-                '    request.uri = request.uri.replace("/%s/", "/");\n'
-                "    return request;\n"
-                "}" % deploy_hash
+            code = template.render(
+                prefix=route.path_pattern.rstrip("*").rstrip("/") + "/",
+                hash_header=DEPLOY_HASH_HEADER,
+                segment_condition=segment_condition,
             )
             code = self._inject_viewer_preludes(code)
             codes[route.yaml_key] = self._reindent(code, 8)
         return codes
 
+    def _build_cache_control_function_codes(self) -> dict[str, str]:
+        """versioning route の cache-control を付ける viewer-response Function コード。
+
+        ResponseHeadersPolicy はステータスを問わずヘッダを付けるため、存在しない
+        キーへの 403 にも immutable が付き、ブラウザがエラーを max-age の間保存して
+        しまう (KN1670)。
+        成功応答 (2xx / 304) だけに付ける。
+        """
+        env = Environment(
+            loader=PackageLoader("pocket_cli"),
+            autoescape=select_autoescape(),
+        )
+        template = env.get_template("cloudformation/cf_function_cache_control.js")
+        codes: dict[str, str] = {}
+        for route in self.context.routes:
+            if not route.versioning:
+                continue
+            code = template.render(max_age=route.versioned_max_age)
+            codes[route.yaml_key] = self._reindent(code, 8)
+        return codes
+
     @staticmethod
     def _spa_fallback_uri(route) -> str:
         """SPA fallback の書き換え先 URI を組み立てる。
@@ -704,6 +754,7 @@ class CloudFrontStack(Stack):
         waf_acl_arn = self._resolve_waf_arn()
         function_codes = self._build_function_codes()
         deploy_hash_function_codes = self._build_deploy_hash_function_codes()
+        cache_control_function_codes = self._build_cache_control_function_codes()
         api_host_function_code = ""
         if self.context.has_lambda_route:
             api_host_function_code = self._generate_api_host_function()
@@ -726,6 +777,8 @@ class CloudFrontStack(Stack):
             waf_acl_arn=waf_acl_arn,
             function_codes=function_codes,
             deploy_hash_function_codes=deploy_hash_function_codes,
+            cache_control_function_codes=cache_control_function_codes,
+            deploy_hash_header=DEPLOY_HASH_HEADER,
             api_host_function_code=api_host_function_code,
             host_redirect_function_code=host_redirect_function_code,
             basic_auth_function_code=basic_auth_function_code,
@@ -761,9 +814,7 @@ class ContainerStack(Stack):
                 "rds_security_group_id": self._rds_context.security_group_id,
                 "rds_secret_store": "sm",
                 "rds_secret_arn": self._rds_context.secret_arn,
-                "rds_kms_key_id": None,
                 "rds_ssm_param_name": None,
-                "rds_ssm_param_arn": None,
                 "rds_endpoint": None,
                 "rds_port": None,
                 "rds_dbname": None,
@@ -784,30 +835,23 @@ class ContainerStack(Stack):
                 **base,
                 "rds_secret_store": "ssm",
                 "rds_secret_arn": None,
-                "rds_kms_key_id": None,
                 "rds_ssm_param_name": ssm_param_name,
-                "rds_ssm_param_arn": (
-                    "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/"
-                    + ssm_param_name
-                ),
             }
         return {
             **base,
             "rds_secret_store": "sm",
             "rds_secret_arn": rds.master_user_secret_arn,
-            "rds_kms_key_id": rds.master_user_secret_kms_key_id,
             "rds_ssm_param_name": None,
-            "rds_ssm_param_arn": None,
         }
 
-    def _resolve_dsql(self) -> tuple[str | None, str | None, str | None]:
-        """DSQL のエンドポイント、リージョン、ARN を動的に取得"""
+    def _resolve_dsql(self) -> tuple[str | None, str | None]:
+        """DSQL のエンドポイントとリージョンを動的に取得"""
         if self._dsql_context is None:
-            return None, None, None
+            return None, None
         from pocket_cli.resources.dsql import Dsql
 
         dsql = Dsql(self._dsql_context)
-        return dsql.endpoint, self._dsql_context.region, dsql.arn
+        return dsql.endpoint, self._dsql_context.region
 
     @property
     def name(self):
@@ -841,10 +885,31 @@ class ContainerStack(Stack):
                 break
         return count
 
+    @property
+    def lambda_role(self) -> iam_roles.RoleSpec:
+        return iam_roles.lambda_role(
+            self.context, rds=self._rds_context, dsql=self._dsql_context
+        )
+
+    @property
+    def scheduler_role(self) -> iam_roles.RoleSpec | None:
+        if not (self._scheduler_context and self._scheduler_context.has_schedules):
+            return None
+        return iam_roles.scheduler_role(
+            self._scheduler_context,
+            permissions_boundary=self.context.permissions_boundary,
+            external=self.context.external_roles,
+        )
+
+    @property
+    def role_specs(self) -> list[iam_roles.RoleSpec]:
+        """この stack の Lambda が使う role (external_roles では事前作成が要る)。"""
+        return [r for r in (self.lambda_role, self.scheduler_role) if r]
+
     @property
     def yaml(self) -> str:
         rds_info = self._resolve_rds()
-        dsql_endpoint, dsql_region, dsql_cluster_arn = self._resolve_dsql()
+        dsql_endpoint, dsql_region = self._resolve_dsql()
         context_dump = self.context.model_dump()
 
         # 外部 VPC: zones を動的取得
@@ -859,37 +924,21 @@ class ContainerStack(Stack):
             rds_security_group_id=rds_info.get("rds_security_group_id"),
             rds_secret_store=rds_info.get("rds_secret_store"),
             rds_secret_arn=rds_info.get("rds_secret_arn"),
-            rds_kms_key_id=rds_info.get("rds_kms_key_id"),
             rds_ssm_param_name=rds_info.get("rds_ssm_param_name"),
-            rds_ssm_param_arn=rds_info.get("rds_ssm_param_arn"),
             rds_endpoint=rds_info.get("rds_endpoint"),
             rds_port=rds_info.get("rds_port"),
             rds_dbname=rds_info.get("rds_dbname"),
             use_rds=bool(rds_info),
             dsql_endpoint=dsql_endpoint,
             dsql_region=dsql_region,
-            dsql_cluster_arn=dsql_cluster_arn,
             use_dsql=dsql_endpoint is not None,
             scheduler=(
                 self._scheduler_context.model_dump()
                 if self._scheduler_context
                 else None
             ),
-            lambda_role=iam_roles.lambda_role(
-                self.context,
-                rds_secret_arn=rds_info.get("rds_secret_arn"),
-                rds_kms_key_id=rds_info.get("rds_kms_key_id"),
-                rds_ssm_param_arn=rds_info.get("rds_ssm_param_arn"),
-                dsql_cluster_arn=dsql_cluster_arn if dsql_endpoint else None,
-            ),
-            scheduler_role=(
-                iam_roles.scheduler_role(
-                    self._scheduler_context,
-                    permissions_boundary=self.context.permissions_boundary,
-                )
-                if self._scheduler_context
-                else None
-            ),
+            lambda_role=self.lambda_role,
+            scheduler_role=self.scheduler_role,
         )