sst.aws.Nextjs: use new resource.enc system for links

sst · Oct 15, 2024 · 7eefd24 · 7eefd24
1 parent 88572b0
commit 7eefd24
Show file tree

Hide file tree

Showing 8 changed files with 112 additions and 77 deletions.
diff --git a/.github/workflows/binary.yml b/.github/workflows/binary.yml
@@ -1,8 +1,8 @@
 name: binary
 
 on:
+  workflow_dispatch:
   push:
-    workflow_dispatch:
     tags:
       - "*"
 
@@ -33,7 +33,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: ">=1.21.0"
+          go-version: ">=1.23.2"
 
       - name: Go Mod
         run: go mod download

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -1,8 +1,8 @@
 name: build
 
 on:
+  workflow_dispatch:
   push:
-    workflow_dispatch:
     branches:
       - dev
 
@@ -33,7 +33,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: ">=1.21.0"
+          go-version: ">=1.23.2"
 
       - name: Go Mod
         run: go mod download

diff --git a/go.mod b/go.mod
@@ -1,6 +1,6 @@
 module github.com/sst/ion
 
-go 1.21.3
+go 1.23.2
 
 require (
 	github.com/Masterminds/semver/v3 v3.2.1

diff --git a/pkg/runtime/runtime.go b/pkg/runtime/runtime.go
@@ -32,6 +32,7 @@ type BuildInput struct {
 	Dev           bool                       `json:"dev"`
 	FunctionID    string                     `json:"functionID"`
 	Handler       string                     `json:"handler"`
+	Bundle        string                     `json:"bundle"`
 	Runtime       string                     `json:"runtime"`
 	Properties    json.RawMessage            `json:"properties"`
 	Links         map[string]json.RawMessage `json:"links"`
@@ -97,16 +98,31 @@ func (c *Collection) Build(ctx context.Context, input *BuildInput) (*BuildOutput
 		return nil, fmt.Errorf("Runtime not found: %v", input.Runtime)
 	}
 	out := input.Out()
-	if err := os.RemoveAll(out); err != nil {
-		return nil, err
-	}
-	if err := os.MkdirAll(out, 0755); err != nil {
-		return nil, err
+	var result *BuildOutput
+
+	if input.Bundle != "" {
+		out = input.Bundle
+		result = &BuildOutput{
+			Handler: input.Handler,
+			Errors:  []string{},
+		}
 	}
-	result, err := runtime.Build(ctx, input)
-	if err != nil {
-		return nil, err
+
+	if input.Bundle == "" {
+		err := os.RemoveAll(out)
+		if err != nil {
+			return nil, err
+		}
+		err = os.MkdirAll(out, 0755)
+		if err != nil {
+			return nil, err
+		}
+		result, err = runtime.Build(ctx, input)
+		if err != nil {
+			return nil, err
+		}
 	}
+
 	result.Out = out
 
 	if len(input.CopyFiles) > 0 {

diff --git a/platform/src/components/aws/function.ts b/platform/src/components/aws/function.ts
@@ -1311,10 +1311,8 @@ export class Function extends Component implements Link.Linkable {
           name: $app.name,
           stage: $app.stage,
         });
-        if (!bundle) {
-          result.SST_KEY = key;
-          result.SST_KEY_FILE = "resource.enc";
-        }
+        result.SST_KEY = key;
+        result.SST_KEY_FILE = "resource.enc";
         if (dev) {
           result.SST_REGION = process.env.SST_AWS_REGION!;
           result.SST_FUNCTION_ID = name;
@@ -1487,13 +1485,6 @@ export class Function extends Component implements Link.Linkable {
           };
         }
 
-        if (args.bundle) {
-          return {
-            bundle: output(args.bundle),
-            handler: output(args.handler),
-          };
-        }
-
         const buildResult = buildInput.apply(async (input) => {
           const result = await rpc.call<{
             handler: string;
@@ -1537,20 +1528,8 @@ export class Function extends Component implements Link.Linkable {
           }
 
           const hasUserInjections = injections.length > 0;
-          // already injected via esbuild when bundle is undefined
-          const hasLinkInjections = args.bundle && linkData.length > 0;
 
-          if (!hasUserInjections && !hasLinkInjections) return { handler };
-
-          const linkInjection = hasLinkInjections
-            ? linkData
-                .map((item) => [
-                  `process.env["SST_RESOURCE_${item.name}"] = ${JSON.stringify(
-                    JSON.stringify(item.properties),
-                  )};\n`,
-                ])
-                .join("")
-            : "";
+          if (!hasUserInjections) return { handler };
 
           const parsed = path.posix.parse(handler);
           const handlerDir = parsed.dir;
@@ -1570,6 +1549,18 @@ export class Function extends Component implements Link.Linkable {
               `Could not find handler file "${handler}" for function "${name}"`,
             );
 
+          const split = injections.reduce(
+            (acc, item) => {
+              if (item.startsWith("outer:")) {
+                acc.outer.push(item.substring("outer:".length));
+                return acc;
+              }
+              acc.inner.push(item);
+              return acc;
+            },
+            { outer: [] as string[], inner: [] as string[] },
+          );
+
           return {
             handler: path.posix.join(
               handlerDir,
@@ -1579,17 +1570,17 @@ export class Function extends Component implements Link.Linkable {
               name: path.posix.join(handlerDir, `${newHandlerFileName}.mjs`),
               content: streaming
                 ? [
-                    linkInjection,
+                    ...split.outer,
                     `export const ${newHandlerFunction} = awslambda.streamifyResponse(async (event, responseStream, context) => {`,
-                    ...injections,
+                    ...split.inner,
                     `  const { ${oldHandlerFunction}: rawHandler} = await import("./${oldHandlerFileName}${newHandlerFileExt}");`,
                     `  return rawHandler(event, responseStream, context);`,
                     `});`,
                   ].join("\n")
                 : [
-                    linkInjection,
+                    ...split.outer,
                     `export const ${newHandlerFunction} = async (event, context) => {`,
-                    ...injections,
+                    ...split.inner,
                     `  const { ${oldHandlerFunction}: rawHandler} = await import("./${oldHandlerFileName}${newHandlerFileExt}");`,
                     `  return rawHandler(event, context);`,
                     `};`,

diff --git a/platform/src/components/aws/nextjs.ts b/platform/src/components/aws/nextjs.ts
@@ -596,9 +596,9 @@ export class Nextjs extends Component implements Link.Linkable {
           if (buildCommand) return buildCommand;
           const version = openNextVersion ?? DEFAULT_OPEN_NEXT_VERSION;
           const packageName = getOpenNextPackage(version);
-          
+
           return `npx --yes ${packageName}@${version} build`;
-        }
+        },
       );
     }
 
@@ -789,41 +789,60 @@ export class Nextjs extends Component implements Link.Linkable {
               },
               ...(revalidationQueueArn
                 ? [
-                  {
-                    actions: [
-                      "sqs:SendMessage",
-                      "sqs:GetQueueAttributes",
-                      "sqs:GetQueueUrl",
-                    ],
-                    resources: [revalidationQueueArn],
-                  },
-                ]
+                    {
+                      actions: [
+                        "sqs:SendMessage",
+                        "sqs:GetQueueAttributes",
+                        "sqs:GetQueueUrl",
+                      ],
+                      resources: [revalidationQueueArn],
+                    },
+                  ]
                 : []),
               ...(revalidationTableArn
                 ? [
-                  {
-                    actions: [
-                      "dynamodb:BatchGetItem",
-                      "dynamodb:GetRecords",
-                      "dynamodb:GetShardIterator",
-                      "dynamodb:Query",
-                      "dynamodb:GetItem",
-                      "dynamodb:Scan",
-                      "dynamodb:ConditionCheckItem",
-                      "dynamodb:BatchWriteItem",
-                      "dynamodb:PutItem",
-                      "dynamodb:UpdateItem",
-                      "dynamodb:DeleteItem",
-                      "dynamodb:DescribeTable",
-                    ],
-                    resources: [
-                      revalidationTableArn,
-                      `${revalidationTableArn}/*`,
-                    ],
-                  },
-                ]
+                    {
+                      actions: [
+                        "dynamodb:BatchGetItem",
+                        "dynamodb:GetRecords",
+                        "dynamodb:GetShardIterator",
+                        "dynamodb:Query",
+                        "dynamodb:GetItem",
+                        "dynamodb:Scan",
+                        "dynamodb:ConditionCheckItem",
+                        "dynamodb:BatchWriteItem",
+                        "dynamodb:PutItem",
+                        "dynamodb:UpdateItem",
+                        "dynamodb:DeleteItem",
+                        "dynamodb:DescribeTable",
+                      ],
+                      resources: [
+                        revalidationTableArn,
+                        `${revalidationTableArn}/*`,
+                      ],
+                    },
+                  ]
                 : []),
             ],
+            injections: [
+              [
+                `outer:if (process.env.SST_KEY_FILE) {`,
+                `  const { readFileSync } = await import("fs")`,
+                `  const { createDecipheriv } = await import("crypto")`,
+                `  const key = Buffer.from(process.env.SST_KEY, "base64");`,
+                `  const encryptedData = readFileSync(process.env.SST_KEY_FILE);`,
+                `  const nonce = Buffer.alloc(12, 0);`,
+                `  const decipher = createDecipheriv("aes-256-gcm", key, nonce);`,
+                `  const authTag = encryptedData.slice(-16);`,
+                `  const actualCiphertext = encryptedData.slice(0, -16);`,
+                `  decipher.setAuthTag(authTag);`,
+                `  let decrypted = decipher.update(actualCiphertext);`,
+                `  decrypted = Buffer.concat([decrypted, decipher.final()]);`,
+                `  const decryptedData = JSON.parse(decrypted.toString());`,
+                `  globalThis.SST_KEY_FILE_DATA = decryptedData;`,
+                `}`,
+              ].join("\n"),
+            ],
           };
 
           return validatePlan({

diff --git a/platform/src/components/aws/ssr-site.ts b/platform/src/components/aws/ssr-site.ts
@@ -750,9 +750,12 @@ export function createServersAndDistribution(
               ...(permissions ?? []),
               ...(props.function.permissions ?? []),
             ]),
-            injections: args.warm
-              ? [useServerFunctionWarmingInjection(props.function.streaming)]
-              : [],
+            injections: [
+              ...(args.warm
+                ? [useServerFunctionWarmingInjection(props.function.streaming)]
+                : []),
+              ...(props.function.injections || []),
+            ],
             link: output(args.link).apply((link) => [
               ...(props.function.link ?? []),
               ...(link ?? []),

diff --git a/sdk/js/src/resource.ts b/sdk/js/src/resource.ts
@@ -25,7 +25,8 @@ for (const [key, value] of Object.entries(environment)) {
   }
 }
 
-if (env.SST_KEY_FILE && env.SST_KEY) {
+// @ts-expect-error
+if (env.SST_KEY_FILE && env.SST_KEY && !globalThis.SST_KEY_FILE_DATA) {
   const key = Buffer.from(env.SST_KEY, "base64");
   const encryptedData = readFileSync(env.SST_KEY_FILE);
   const nonce = Buffer.alloc(12, 0);
@@ -39,6 +40,11 @@ if (env.SST_KEY_FILE && env.SST_KEY) {
   Object.assign(raw, decryptedData);
 }
 
+// @ts-expect-error
+if (globalThis.SST_KEY_FILE_DATA) {
+  // @ts-expect-error
+  Object.assign(raw, globalThis.SST_KEY_FILE_DATA);
+}
 export function fromCloudflareEnv(input: any) {
   for (let [key, value] of Object.entries(input)) {
     if (typeof value === "string") {