feat: #400 Rplt 400 dns records (#11521)

* feat: initial idea setup

* feat: added migrations for missing columns

* fix: remove verifyName column

* feat: added deployment service dns endpoints

* feat: started adding dns frontend components

* feat: added call for dns verify

* fix: resolved annoying 'bucket already exists' issue

* feat: commiting this so I don't lose it

* feat: experimenting with dns creationst status

* feat: added steps for dns setup frontend

* feat: added eventbridge cross account trigger

* feat: added poc for cross region and account event bridge setup

* feat: added ui for custom dns

* feat: added fetch methods for dns info

* feat: added poc for managing dns

* fix: corrected tests for pipeline funcs

* feat: design changes on dns frontend

* feat: navigate dns record setup

* fix: remove unused var

* feat: updated snapshots

* feat: added dns provider tests

* feat: correct error message display

* fix: remove comment blocks

* chore: linting

* feat: added tests for dns controller

* feat: updated ts-definitions

* fix: omit unwanted types

* feat: missing snapshots

* feat: updated vite-pwa package

* fix: improve complexity

* feat: remove wildcard from certificate

* feat: updated regex for reapit domains

Author: bashleigh

.yarn/cache/@aws-cdk-cloud-assembly-schema-npm-38.0.1-469647254b-fff5afc74d.zip

@@ -30,6 +30,7 @@ import * as cdk from 'aws-cdk-lib'
 import { ResolveProductionS3BucketPermissionsCustomResource } from './resolve-production-S3-bucket-permissions-custom-resource'
 import { ResolveProductionOACCustomResource } from './resolve-production-OAC-custom-resource'
 import { ResolveProductionS3BucketPoliciesCustomResource } from './resolve-production-S3-bucket-policies-custom-resource'
+import { DnsCertificateUpdate } from './dns-certificate-update'
 
 export const databaseName = 'deployment_service'
 
@@ -134,7 +135,12 @@ export const createStack = async () => {
     },
     appEvents: {
       handler: createFileLoc('sqs', 'handle'),
-      policies: [...policies.commonBackendPolicies, policies.cloudFrontPolicy, policies.route53Policy],
+      policies: [
+        ...policies.commonBackendPolicies,
+        policies.cloudFrontPolicy,
+        policies.route53Policy,
+        policies.certificatePolicy,
+      ],
       queues: [queues[QueueNames.APP_EVENTS]],
       entrypoint: 'bundle/sqs.zip',
     },
@@ -250,6 +256,13 @@ export const createStack = async () => {
     }
   }
 
+  new DnsCertificateUpdate(stack, 'dns-certificate', {
+    vpc,
+    usercodeStack,
+    environmentVars: env,
+    policies: [...policies.commonBackendPolicies, policies.certificatePolicy, policies.cloudFrontPolicy],
+  })
+
   /**
    * NOTE: In order to make a successful deployment, migrations must be removed for the first deloy
    * thereafter, the migration script can be added

.yarn/cache/@aws-sdk-client-acm-npm-3.670.0-dc1a401053-ac1e86739c.zip

@@ -14,6 +14,7 @@ export enum PolicyNames {
   secretManagerPolicy = 'secretManagerPolicy',
   S3BucketPolicy = 'S3BucketPolicy',
   originAccessControlPolicy = 'originAccessControlPolicy',
+  certificatePolicy = 'certificatePolicy',
 }
 
 type namedPolicyType = {
@@ -172,6 +173,12 @@ export const createPolicies = ({
     resources: ['*'],
   })
 
+  const certificatePolicy = new PolicyStatement({
+    actions: ['acm:RequestCertificate', 'acm:AddTagsToCertificate', 'acm:DescribeCertificate', 'acm:DeleteCertificate'],
+    effect: Effect.ALLOW,
+    resources: ['*'],
+  })
+
   // create a policy that allows the lambda to do what it needs to do in the usercode stack
   const usercodePolicy = new Policy(usercodeStack, 'UsercodePolicy')
   usercodePolicy.addStatements(
@@ -182,6 +189,7 @@ export const createPolicies = ({
     codebuildExecPolicy,
     parameterStorePolicy,
     originAccessControlPolicy,
+    certificatePolicy,
   )
   const usercodeStackRoleName = `${usercodeStack.stackName}-UsercodeStackRole`
   // create a role that lambdas can assume in the usercode stack, with the policy we just created
@@ -203,6 +211,7 @@ export const createPolicies = ({
     actions: ['sts:AssumeRole'],
   })
 
+  // TODO remove
   const lambdaInvoke = new PolicyStatement({
     effect: Effect.ALLOW,
     resources: [
@@ -231,5 +240,6 @@ export const createPolicies = ({
     secretManagerPolicy,
     S3BucketPolicy,
     usercodeStackRoleArn,
+    certificatePolicy,
   }
 }

.yarn/cache/@aws-sdk-client-sso-npm-3.670.0-6239db1c59-09a1e83565.zip

@@ -0,0 +1,78 @@
+import { PolicyStatement } from '@reapit/ts-scripts/src/cdk'
+import { aws_ec2, aws_events, aws_events_targets, aws_iam, aws_lambda, Duration, Stack } from 'aws-cdk-lib'
+import { Construct } from 'constructs'
+
+interface DnsCertificateUpdateOptionsInterface {
+  usercodeStack: Stack
+  vpc: aws_ec2.Vpc
+  environmentVars: { [s: string]: string }
+  policies: PolicyStatement[]
+}
+
+export class DnsCertificateUpdate extends Construct {
+  constructor(
+    paasEuWest2Stack: Stack,
+    id: string,
+    { usercodeStack: usercodeEuWest2Stack, vpc, environmentVars, policies }: DnsCertificateUpdateOptionsInterface,
+  ) {
+    super(paasEuWest2Stack, id)
+
+    const userCodeUsEast1Stack = new Stack(usercodeEuWest2Stack, 'event-bus-us-east-1-usercode-stack', {
+      env: { account: usercodeEuWest2Stack.account, region: 'us-east-1' },
+    })
+
+    const eventBusUsEast1 = aws_events.EventBus.fromEventBusName(
+      userCodeUsEast1Stack,
+      `${id}-lookup-default-bus`,
+      'default',
+    )
+
+    const paasEventBridgeEuWest2 = new aws_events.EventBus(paasEuWest2Stack, `${id}-paas-event-bridge-acm`, {
+      eventBusName: 'acm-bus',
+    })
+
+    new aws_events.Rule(userCodeUsEast1Stack, `${id}-cross-account-rule`, {
+      targets: [new aws_events_targets.EventBus(paasEventBridgeEuWest2)],
+      eventBus: eventBusUsEast1,
+      eventPattern: {
+        source: ['aws.acm'],
+      },
+    })
+
+    paasEventBridgeEuWest2.addToResourcePolicy(
+      new aws_iam.PolicyStatement({
+        sid: 'AllowTrustedAccountToPutEvents',
+        effect: aws_iam.Effect.ALLOW,
+        actions: ['events:PutEvents'],
+        resources: [paasEventBridgeEuWest2.eventBusArn],
+        principals: [new aws_iam.AccountPrincipal(userCodeUsEast1Stack.account)],
+      }),
+    )
+
+    const certificateUpdateLambda = new aws_lambda.Function(paasEuWest2Stack, `${id}-eventbridge-update-lambda`, {
+      runtime: aws_lambda.Runtime.NODEJS_18_X,
+      handler: 'packages/deployment-service/dist/dns-eventbridge.handle',
+      // code: aws_lambda.Code.fromInline(`
+      //   exports.handler = async (event) => {
+      //     console.log('Event received:', JSON.stringify(event));
+      //     return { statusCode: 200, body: 'Event processed' };
+      //   };
+      // `),
+      vpc,
+      code: aws_lambda.Code.fromAsset('bundle/dns-eventbridge.zip'),
+      timeout: Duration.seconds(30),
+      memorySize: 512,
+      environment: environmentVars,
+    })
+
+    policies.forEach((policy) => certificateUpdateLambda.addToRolePolicy(policy))
+
+    new aws_events.Rule(paasEuWest2Stack, `${id}-test-trigger-rule`, {
+      targets: [new aws_events_targets.LambdaFunction(certificateUpdateLambda)],
+      eventBus: paasEventBridgeEuWest2,
+      eventPattern: {
+        source: ['aws.acm'],
+      },
+    })
+  }
+}

.yarn/cache/@aws-sdk-client-sso-oidc-npm-3.670.0-764aaf8b08-77b4ebc196.zip

@@ -0,0 +1,21 @@
+import { MigrationInterface, QueryRunner } from 'typeorm'
+
+export class AddDomainFields1729084248683 implements MigrationInterface {
+  name = 'AddDomainFields1729084248683'
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query('ALTER TABLE `pipelines` ADD `verifyDnsValue` varchar(255) NULL')
+    await queryRunner.query('ALTER TABLE `pipelines` ADD `verifyDnsName` varchar(255) NULL')
+    await queryRunner.query('ALTER TABLE `pipelines` ADD `customDomain` varchar(255) NULL')
+    await queryRunner.query('ALTER TABLE `pipelines` ADD `domainVerified` tinyint NOT NULL')
+    await queryRunner.query('ALTER TABLE `pipelines` ADD `certificateArn` varchar(255) NULL')
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query('ALTER TABLE `pipelines` DROP COLUMN `verifyDnsValue`')
+    await queryRunner.query('ALTER TABLE `pipelines` DROP COLUMN `verifyDnsName`')
+    await queryRunner.query('ALTER TABLE `pipelines` DROP COLUMN `customDomain`')
+    await queryRunner.query('ALTER TABLE `pipelines` DROP COLUMN `domainVerified`')
+    await queryRunner.query('ALTER TABLE `pipelines` DROP COLUMN `certificateArn`')
+  }
+}

.yarn/cache/@aws-sdk-client-sts-npm-3.670.0-24db3935e6-a292ef0649.zip

@@ -0,0 +1,15 @@
+import { MigrationInterface, QueryRunner } from 'typeorm'
+
+export class AddDomainStatusField1732024866737 implements MigrationInterface {
+  name = 'AddDomainStatusField1732024866737'
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      'ALTER TABLE `pipelines` ADD `certificateStatus` varchar(255) NOT NULL DEFAULT "unverified"',
+    )
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query('ALTER TABLE `pipelines` DROP COLUMN `certificateStatus`')
+  }
+}

.yarn/cache/@aws-sdk-credential-provider-ini-npm-3.670.0-ac33082e72-7c08d972f9.zip

@@ -19,6 +19,8 @@ import { pipelineBitbucketRelation1654693666828 } from './1654693666828-pipeline
 import { pipelineRepositoryNullable1655394853865 } from './1655394853865-pipelineRepositoryNullable'
 import { githubRepository1697724871099 } from './1697724871099-github-repository'
 import { githubRepositoryDeveloperId1698161392543 } from './1698161392543-github-repository-developerId'
+import { AddDomainFields1729084248683 } from './1729084248683-AddDomainFields'
+import { AddDomainStatusField1732024866737 } from './1732024866737-AddDomainStatusField'
 
 export default [
   pipelines1625758770110,
@@ -42,4 +44,6 @@ export default [
   pipelineRepositoryNullable1655394853865,
   githubRepository1697724871099,
   githubRepositoryDeveloperId1698161392543,
+  AddDomainFields1729084248683,
+  AddDomainStatusField1732024866737,
 ]

.yarn/cache/@aws-sdk-credential-provider-node-npm-3.670.0-daa727f5e0-55e3e2c0d7.zip

@@ -1,6 +1,7 @@
 {
   "name": "deployment-service",
   "dependencies": {
+    "@aws-sdk/client-acm": "^3.670.0",
     "@aws-sdk/client-cloudfront": "^3.675.0",
     "@aws-sdk/client-rds": "^3.709.0",
     "@aws-sdk/client-route-53": "^3.675.0",
@@ -13,8 +14,8 @@
     "@nestjs/passport": "^11.0.4",
     "@nestjs/platform-express": "^11.0.5",
     "@nestjs/typeorm": "^8.1.4",
-    "@octokit/app": "^14.1.0",
-    "@reapit/foundations-ts-definitions": "^1.5.9",
+    "@octokit/app": "^14.0.2",
+    "@reapit/foundations-ts-definitions": "^2.1.20",
     "@reapit/utils-authorizer": "workspace:^",
     "@reapit/utils-nest": "workspace:packages/utils-nest",
     "@reapit/utils-node": "workspace:^",

.yarn/cache/@aws-sdk-credential-provider-sso-npm-3.670.0-0c7519b89c-c37edb44fd.zip

@@ -15,6 +15,7 @@ import { AwsModule } from './aws'
 import { CodeBuildModule } from './codebuild'
 import { APP_INTERCEPTOR } from '@nestjs/core'
 import { CorsHeaderInterceptor, AuthModule } from '@reapit/utils-nest'
+import { DnsModule } from './dns'
 
 process.env = {
   ...process.env,
@@ -52,6 +53,7 @@ process.env = {
     BitbucketModule,
     AwsModule,
     CodeBuildModule,
+    DnsModule,
   ],
   providers: [
     CorsHeaderInterceptor,

.yarn/cache/@aws-sdk-util-user-agent-browser-npm-3.670.0-c0fb3b320d-07d429db22.zip

@@ -5,6 +5,7 @@ import { Module } from '@nestjs/common'
 import { ConfigModule, ConfigService } from '@nestjs/config'
 import { CodeBuild, Credentials, S3, SSM, SQS } from 'aws-sdk'
 import { Route53Client } from '@aws-sdk/client-route-53'
+import { ACMClient } from '@aws-sdk/client-acm'
 
 export const ROLE_CREDENTIALS = 'ROLE_CREDENTIALS'
 
@@ -63,7 +64,16 @@ export const ROLE_CREDENTIALS = 'ROLE_CREDENTIALS'
       provide: SQS,
       useFactory: () => new SQS({ apiVersion: '2012-11-05', endpoint: process.env.SQS_ENDPOINT }),
     },
+    {
+      provide: ACMClient,
+      useFactory: (credentials) =>
+        new ACMClient({
+          region: 'us-east-1',
+          credentials,
+        }),
+      inject: [ROLE_CREDENTIALS],
+    },
   ],
-  exports: [S3, CodeBuild, SSM, ROLE_CREDENTIALS, CloudFrontClient, Route53Client, SQS],
+  exports: [S3, CodeBuild, SSM, ROLE_CREDENTIALS, CloudFrontClient, Route53Client, SQS, ACMClient],
 })
 export class AwsModule {}

.yarn/cache/@babel-compat-data-npm-7.25.7-81c45097d1-8fdc451e0e.zip

@@ -0,0 +1,36 @@
+import { NestFactory } from '@nestjs/core'
+import { AppModule } from './app-module'
+import { EventBridgeHandler } from 'aws-lambda'
+import { INestMicroservice } from '@nestjs/common'
+import { DnsEventBridgeProvider } from './dns/dns.eventbridge.provider'
+
+let app: INestMicroservice
+
+export type CertificateDetail = {
+  CertificateType: string
+  CommonName: string
+  DomainValidationMethod: string
+  Action: string
+  DaysToExpiry: number
+  CertificateCreatedDate: string
+  CertificateExpirationDate: string
+  InUse: false
+  Exported: false
+}
+
+const initApp = async (): Promise<INestMicroservice> => {
+  const app = await NestFactory.createMicroservice<INestMicroservice>(AppModule)
+  await app.init()
+
+  return app
+}
+
+export const handle: EventBridgeHandler<'ACM Certificate Available', CertificateDetail, any> = async (event) => {
+  app = app || (await initApp())
+
+  console.log('event', JSON.stringify(event))
+
+  const dnsEventBridgeProvider = app.get<DnsEventBridgeProvider>(DnsEventBridgeProvider)
+
+  await dnsEventBridgeProvider.handle(event)
+}

.yarn/cache/@babel-helper-annotate-as-pure-npm-7.22.5-f38dc8aa1c-53da330f18.zip

@@ -0,0 +1,69 @@
+import {
+  ACMClient,
+  CertificateDetail,
+  DescribeCertificateCommand,
+  RequestCertificateCommand,
+  ResourceNotFoundException,
+} from '@aws-sdk/client-acm'
+import { PipelineEntity } from './../entities/pipeline.entity'
+import { Inject } from '@nestjs/common'
+
+export class CertificateProvider {
+  constructor(
+    @Inject(ACMClient)
+    private readonly client: ACMClient,
+  ) {}
+
+  async createCertificate(pipeline: PipelineEntity): Promise<string> {
+    const result = await this.client.send(
+      new RequestCertificateCommand({
+        DomainName: pipeline.customDomain,
+        ValidationMethod: 'DNS',
+        SubjectAlternativeNames: [
+          // `www.${pipeline.customDomain}`, // if www is required?
+          pipeline.customDomain as string,
+        ],
+        DomainValidationOptions: [
+          {
+            DomainName: pipeline.customDomain,
+            ValidationDomain: pipeline.customDomain,
+          },
+        ],
+        Options: {
+          CertificateTransparencyLoggingPreference: 'ENABLED',
+        },
+        Tags: [
+          {
+            Key: 'pipelineId',
+            Value: pipeline.id,
+          },
+          {
+            Key: 'onwer',
+            Value: 'IaaS',
+          },
+        ],
+      }),
+    )
+
+    return result.CertificateArn as string
+  }
+
+  async obtainCertificate(pipeline: PipelineEntity): Promise<CertificateDetail | undefined> {
+    if (!pipeline.certificateArn) return undefined
+
+    try {
+      const certificate = await this.client.send(
+        new DescribeCertificateCommand({
+          CertificateArn: pipeline.certificateArn,
+        }),
+      )
+
+      return certificate.Certificate
+    } catch (error: any) {
+      if (error instanceof ResourceNotFoundException) {
+        console.error(error.message)
+        return undefined
+      }
+    }
+  }
+}