Zakaria
a86bee443b
CI / checks (pull_request) Successful in 26m17s
Distributions were linked under localhost.floci.io, another project's domain. Every .localhost name resolves to the machine itself, so the brand-neutral <id>.cloudfront.localhost reaches the runtime with no DNS or hosts entry.
302 lines
14 KiB
TypeScript
302 lines
14 KiB
TypeScript
import {
|
|
CreateDistributionCommand,
|
|
CreateInvalidationCommand,
|
|
DeleteDistributionCommand,
|
|
GetDistributionCommand,
|
|
GetDistributionConfigCommand,
|
|
ListDistributionsCommand,
|
|
ListInvalidationsCommand,
|
|
UpdateDistributionCommand,
|
|
type CacheBehavior,
|
|
type CloudFrontClient,
|
|
type DefaultCacheBehavior,
|
|
type Distribution,
|
|
type DistributionConfig,
|
|
type DistributionSummary,
|
|
type Origin,
|
|
} from '@aws-sdk/client-cloudfront'
|
|
import {HeadBucketCommand, type S3Client} from '@aws-sdk/client-s3'
|
|
import {
|
|
CDN_ALLOWED_METHODS,
|
|
CDN_BUCKET_PATTERN,
|
|
CDN_ORIGIN_DOMAIN_PATTERN,
|
|
CDN_ORIGIN_PROTOCOLS,
|
|
CDN_ORIGIN_TYPES,
|
|
CDN_VIEWER_PROTOCOLS,
|
|
awsCdnSchema,
|
|
} from '../cloud-spi/cdnSchema'
|
|
import {ConflictError, NotFoundError, ValidationError} from '../cloud-spi/errors'
|
|
import type {CloudResource, CloudServiceAdapter, CreateResourceInput, DistributionInvalidation, ResourceQuery, ServiceSchema} from '../cloud-spi/types'
|
|
|
|
/** AWS managed cache and origin request policies, which CloudFront and the runtime both know by ID. */
|
|
const CACHING_OPTIMIZED = '658327ea-f89d-4fab-a63d-7e88639e58f6'
|
|
const CACHING_DISABLED = '4135ea2d-6df8-44a3-9df3-4b5a84be39ad'
|
|
const ALL_VIEWER_EXCEPT_HOST_HEADER = 'b689b0a8-53d0-40ab-baf2-68738e2966ac'
|
|
const READ_METHODS = ['GET', 'HEAD']
|
|
const ALL_METHODS = ['GET', 'HEAD', 'OPTIONS', 'PUT', 'POST', 'PATCH', 'DELETE']
|
|
/** CloudFront's limit on paths in one invalidation that are not wildcards. */
|
|
const MAX_INVALIDATION_PATHS = 3000
|
|
const RECENT_INVALIDATIONS = 5
|
|
|
|
/**
|
|
* Talks to CloudFront distributions, verified against Floci core (community, `latest`).
|
|
*
|
|
* Notes from probing the runtime:
|
|
* - A distribution is `Deployed` as soon as it is created or updated; AWS takes minutes.
|
|
* - `DeleteDistribution` refuses an enabled distribution with `DistributionNotDisabled`
|
|
* (409), as on AWS, so delete disables it first.
|
|
* - A missing distribution is `NoSuchDistribution` with HTTP 404.
|
|
* - Viewer requests reach a distribution at `{id}.cloudfront.localhost` on the runtime's
|
|
* port. Browsers and curl resolve every `.localhost` name to the machine itself (RFC 6761),
|
|
* so no DNS or hosts-file entry is needed.
|
|
*/
|
|
export class AwsCdnAdapter implements CloudServiceAdapter {
|
|
readonly cloud = 'aws' as const
|
|
readonly service = 'cdn' as const
|
|
|
|
constructor(
|
|
private readonly cloudfront: CloudFrontClient,
|
|
private readonly s3: S3Client,
|
|
private readonly endpoint = process.env.FLOCI_ENDPOINT ?? 'http://localhost:4566',
|
|
) {}
|
|
|
|
schema(): ServiceSchema {
|
|
return awsCdnSchema()
|
|
}
|
|
|
|
async list(query: ResourceQuery = {}): Promise<CloudResource[]> {
|
|
const summaries: DistributionSummary[] = []
|
|
let marker: string | undefined
|
|
do {
|
|
const res = await this.cloudfront.send(new ListDistributionsCommand({...(marker ? {Marker: marker} : {})}))
|
|
summaries.push(...(res.DistributionList?.Items ?? []))
|
|
marker = res.DistributionList?.IsTruncated ? res.DistributionList.NextMarker : undefined
|
|
} while (marker)
|
|
|
|
const search = query.search?.trim().toLowerCase()
|
|
return summaries.map((summary) => this.toResource(summary, summary.Enabled ?? false, summary.Comment, summary.Origins?.Items))
|
|
.filter((resource) => !search || [resource.id, resource.name, ...stringList(resource.metadata.originDomains)].some((value) => value.toLowerCase().includes(search)))
|
|
}
|
|
|
|
async get(id: string): Promise<CloudResource | null> {
|
|
let distribution: Distribution | undefined
|
|
try {
|
|
distribution = (await this.cloudfront.send(new GetDistributionCommand({Id: id}))).Distribution
|
|
} catch (error) {
|
|
if (errorName(error) === 'NoSuchDistribution') return null
|
|
throw error
|
|
}
|
|
if (!distribution) return null
|
|
const config = distribution.DistributionConfig
|
|
const invalidations = await this.recentInvalidations(id)
|
|
const resource = this.toResource(distribution, config?.Enabled ?? false, config?.Comment, config?.Origins?.Items)
|
|
resource.metadata = {
|
|
...resource.metadata,
|
|
defaultRootObject: config?.DefaultRootObject || null,
|
|
aliases: config?.Aliases?.Items ?? [],
|
|
behaviors: behaviorsOf(config),
|
|
invalidations,
|
|
}
|
|
return resource
|
|
}
|
|
|
|
async create(input: CreateResourceInput): Promise<CloudResource> {
|
|
const values = input.values
|
|
const originType = oneOf(values.originType ?? 's3', CDN_ORIGIN_TYPES, 'originType')
|
|
const viewerProtocol = oneOf(values.viewerProtocol || 'allow-all', CDN_VIEWER_PROTOCOLS, 'viewerProtocol')
|
|
const methods = oneOf(values.allowedMethods || 'read', CDN_ALLOWED_METHODS, 'allowedMethods')
|
|
const comment = text(values.comment)
|
|
if (comment.length > 128) throw new ValidationError('comment must be at most 128 characters')
|
|
const defaultRootObject = text(values.defaultRootObject).replace(/^\/+/, '')
|
|
|
|
const origin = originType === 's3' ? await this.s3Origin(text(values.bucket)) : customOrigin(values)
|
|
const allowed = methods === 'all' ? ALL_METHODS : READ_METHODS
|
|
const behavior: DefaultCacheBehavior = {
|
|
TargetOriginId: origin.Id,
|
|
ViewerProtocolPolicy: viewerProtocol,
|
|
AllowedMethods: {Quantity: allowed.length, Items: allowed as never, CachedMethods: {Quantity: 2, Items: ['GET', 'HEAD']}},
|
|
Compress: true,
|
|
// A website is cached; an API, which sees every method, is not, and gets the viewer's request.
|
|
CachePolicyId: methods === 'all' ? CACHING_DISABLED : CACHING_OPTIMIZED,
|
|
...(methods === 'all' && originType === 'custom' ? {OriginRequestPolicyId: ALL_VIEWER_EXCEPT_HOST_HEADER} : {}),
|
|
}
|
|
const res = await this.cloudfront.send(new CreateDistributionCommand({
|
|
DistributionConfig: {
|
|
CallerReference: crypto.randomUUID(),
|
|
Comment: comment,
|
|
Enabled: true,
|
|
DefaultRootObject: defaultRootObject || undefined,
|
|
Origins: {Quantity: 1, Items: [origin]},
|
|
DefaultCacheBehavior: behavior,
|
|
},
|
|
}))
|
|
if (!res.Distribution) throw new ValidationError('CloudFront did not return the new distribution')
|
|
const config = res.Distribution.DistributionConfig
|
|
return this.toResource(res.Distribution, config?.Enabled ?? true, config?.Comment, config?.Origins?.Items)
|
|
}
|
|
|
|
/** CloudFront deletes only a disabled distribution, so an enabled one is disabled first. */
|
|
async delete(id: string): Promise<void> {
|
|
let etag = (await this.cloudfront.send(new GetDistributionCommand({Id: id}))).ETag
|
|
const current = await this.cloudfront.send(new GetDistributionConfigCommand({Id: id}))
|
|
if (current.DistributionConfig?.Enabled) {
|
|
const disabled = await this.cloudfront.send(new UpdateDistributionCommand({
|
|
Id: id,
|
|
IfMatch: current.ETag,
|
|
DistributionConfig: {...current.DistributionConfig, Enabled: false},
|
|
}))
|
|
if (disabled.Distribution?.Status !== 'Deployed') {
|
|
throw new ConflictError('The distribution is now disabled. CloudFront deletes it once the change is deployed: try again when its status is Deployed')
|
|
}
|
|
etag = disabled.ETag
|
|
}
|
|
try {
|
|
await this.cloudfront.send(new DeleteDistributionCommand({Id: id, IfMatch: etag}))
|
|
} catch (error) {
|
|
if (errorName(error) === 'DistributionNotDisabled') {
|
|
throw new ConflictError('CloudFront is still disabling the distribution: try again when its status is Deployed')
|
|
}
|
|
throw error
|
|
}
|
|
}
|
|
|
|
async setDistributionEnabled(id: string, enabled: boolean): Promise<CloudResource> {
|
|
if (typeof enabled !== 'boolean') throw new ValidationError('enabled must be true or false')
|
|
const current = await this.cloudfront.send(new GetDistributionConfigCommand({Id: id}))
|
|
if (!current.DistributionConfig) throw new NotFoundError(`Distribution ${id} was not found`)
|
|
if (current.DistributionConfig.Enabled !== enabled) {
|
|
await this.cloudfront.send(new UpdateDistributionCommand({
|
|
Id: id,
|
|
IfMatch: current.ETag,
|
|
DistributionConfig: {...current.DistributionConfig, Enabled: enabled},
|
|
}))
|
|
}
|
|
const resource = await this.get(id)
|
|
if (!resource) throw new NotFoundError(`Distribution ${id} was not found`)
|
|
return resource
|
|
}
|
|
|
|
async createDistributionInvalidation(id: string, paths: string[]): Promise<DistributionInvalidation> {
|
|
if (!Array.isArray(paths)) throw new ValidationError('paths must be a list')
|
|
const items = [...new Set(paths.map((path) => String(path).trim()).filter(Boolean))]
|
|
if (items.length === 0) throw new ValidationError('Add at least one path, such as /* or /index.html')
|
|
if (items.length > MAX_INVALIDATION_PATHS) throw new ValidationError(`An invalidation holds at most ${MAX_INVALIDATION_PATHS} paths`)
|
|
const invalid = items.find((path) => !path.startsWith('/'))
|
|
if (invalid) throw new ValidationError(`${invalid} must start with /`)
|
|
const res = await this.cloudfront.send(new CreateInvalidationCommand({
|
|
DistributionId: id,
|
|
InvalidationBatch: {CallerReference: crypto.randomUUID(), Paths: {Quantity: items.length, Items: items}},
|
|
}))
|
|
return {
|
|
id: res.Invalidation?.Id ?? '',
|
|
status: res.Invalidation?.Status ?? 'InProgress',
|
|
createdAt: res.Invalidation?.CreateTime?.toISOString() ?? null,
|
|
paths: res.Invalidation?.InvalidationBatch?.Paths?.Items ?? items,
|
|
}
|
|
}
|
|
|
|
private async s3Origin(bucket: string): Promise<Origin> {
|
|
if (!new RegExp(CDN_BUCKET_PATTERN).test(bucket)) throw new ValidationError('bucket must be the name of an existing S3 bucket')
|
|
try {
|
|
await this.s3.send(new HeadBucketCommand({Bucket: bucket}))
|
|
} catch (error) {
|
|
if (['NotFound', 'NoSuchBucket'].includes(errorName(error))) throw new ValidationError(`There is no S3 bucket named ${bucket}`)
|
|
throw error
|
|
}
|
|
return {Id: `s3-${bucket}`, DomainName: `${bucket}.s3.amazonaws.com`, S3OriginConfig: {OriginAccessIdentity: ''}}
|
|
}
|
|
|
|
private async recentInvalidations(id: string): Promise<DistributionInvalidation[]> {
|
|
const res = await this.cloudfront.send(new ListInvalidationsCommand({DistributionId: id, MaxItems: RECENT_INVALIDATIONS}))
|
|
return (res.InvalidationList?.Items ?? []).map((invalidation) => ({
|
|
id: invalidation.Id ?? '',
|
|
status: invalidation.Status ?? '',
|
|
createdAt: invalidation.CreateTime?.toISOString() ?? null,
|
|
paths: [],
|
|
}))
|
|
}
|
|
|
|
private toResource(distribution: Pick<Distribution, 'Id' | 'DomainName' | 'Status' | 'LastModifiedTime' | 'ARN'>, enabled: boolean, comment: string | undefined, origins: Origin[] | undefined): CloudResource {
|
|
const id = distribution.Id ?? ''
|
|
return {
|
|
id,
|
|
name: distribution.DomainName ?? id,
|
|
cloud: 'aws',
|
|
service: 'cdn',
|
|
type: 'distribution',
|
|
region: null,
|
|
createdAt: distribution.LastModifiedTime?.toISOString() ?? null,
|
|
status: distribution.Status ?? null,
|
|
metadata: {
|
|
arn: distribution.ARN ?? null,
|
|
domainName: distribution.DomainName ?? null,
|
|
viewerUrl: this.viewerUrl(id),
|
|
enabled,
|
|
comment: comment || null,
|
|
originDomains: (origins ?? []).map((origin) => origin.DomainName ?? ''),
|
|
origins: (origins ?? []).map((origin) => ({
|
|
id: origin.Id ?? '',
|
|
domainName: origin.DomainName ?? '',
|
|
kind: origin.S3OriginConfig ? 's3' : 'custom',
|
|
protocol: origin.CustomOriginConfig?.OriginProtocolPolicy ?? null,
|
|
})),
|
|
},
|
|
}
|
|
}
|
|
|
|
/** Where a browser on this machine reaches the distribution through the runtime. */
|
|
private viewerUrl(id: string): string {
|
|
const port = new URL(this.endpoint).port || '4566'
|
|
return `http://${id.toLowerCase()}.cloudfront.localhost:${port}/`
|
|
}
|
|
}
|
|
|
|
function customOrigin(values: Record<string, unknown>): Origin {
|
|
const domain = text(values.originDomain).toLowerCase()
|
|
if (!new RegExp(CDN_ORIGIN_DOMAIN_PATTERN).test(domain)) throw new ValidationError('originDomain must be a host name such as api.example.com')
|
|
const protocol = oneOf(values.originProtocol || 'https-only', CDN_ORIGIN_PROTOCOLS, 'originProtocol')
|
|
const port = text(values.originPort)
|
|
const portNumber = port ? Number(port) : null
|
|
if (portNumber !== null && (!Number.isInteger(portNumber) || portNumber < 1 || portNumber > 65535)) throw new ValidationError('originPort must be between 1 and 65535')
|
|
return {
|
|
Id: `custom-${domain}`,
|
|
DomainName: domain,
|
|
CustomOriginConfig: {
|
|
HTTPPort: portNumber ?? 80,
|
|
HTTPSPort: portNumber ?? 443,
|
|
OriginProtocolPolicy: protocol,
|
|
OriginSslProtocols: {Quantity: 1, Items: ['TLSv1.2']},
|
|
},
|
|
}
|
|
}
|
|
|
|
function behaviorsOf(config: DistributionConfig | undefined) {
|
|
const describe = (behavior: DefaultCacheBehavior | CacheBehavior, pathPattern: string) => ({
|
|
pathPattern,
|
|
originId: behavior.TargetOriginId ?? '',
|
|
viewerProtocol: behavior.ViewerProtocolPolicy ?? '',
|
|
methods: behavior.AllowedMethods?.Items ?? READ_METHODS,
|
|
})
|
|
return [
|
|
...(config?.CacheBehaviors?.Items ?? []).map((behavior) => describe(behavior, behavior.PathPattern ?? '')),
|
|
...(config?.DefaultCacheBehavior ? [describe(config.DefaultCacheBehavior, 'Default (*)')] : []),
|
|
]
|
|
}
|
|
|
|
function oneOf<T extends string>(value: unknown, allowed: readonly T[], field: string): T {
|
|
if (typeof value === 'string' && (allowed as readonly string[]).includes(value)) return value as T
|
|
throw new ValidationError(`${field} must be one of ${allowed.join(', ')}`)
|
|
}
|
|
|
|
function text(value: unknown): string {
|
|
return typeof value === 'string' ? value.trim() : ''
|
|
}
|
|
|
|
function stringList(value: unknown): string[] {
|
|
return Array.isArray(value) ? value.filter((entry): entry is string => typeof entry === 'string') : []
|
|
}
|
|
|
|
function errorName(error: unknown): string {
|
|
return (error as {name?: string} | null)?.name ?? ''
|
|
}
|