Merge branch 'main' of github.com:acm-uiuc/core into siglead-management

Author: Tarash Agarwal

Makefile

@@ -59,6 +59,8 @@ build: src/ cloudformation/ docs/
 	cp -r src/api/resources/ dist/api/resources
 	rm -rf dist/lambda/sqs
 	sam build --template-file cloudformation/main.yml
+	mkdir -p .aws-sam/build/AppApiLambdaFunction/node_modules/aws-crt/
+	cp -r node_modules/aws-crt/dist .aws-sam/build/AppApiLambdaFunction/node_modules/aws-crt
 
 local:
 	VITE_BUILD_HASH=$(GIT_HASH) yarn run dev
@@ -80,7 +82,7 @@ deploy_dev: check_account_dev build
 invalidate_cloudfront:
 	@echo "Creating CloudFront invalidation..."
 	$(eval DISTRIBUTION_ID := $(shell aws cloudformation describe-stacks --stack-name $(application_key) --query "Stacks[0].Outputs[?OutputKey=='CloudfrontDistributionId'].OutputValue" --output text))
-	$(eval DISTRIBUTION_ID_2 := $(shell aws cloudformation describe-stacks --stack-name $(application_key) --query "Stacks[0].Outputs[?OutputKey=='CloudfrontSecondaryDistributionId'].OutputValue" --output text))
+	$(eval DISTRIBUTION_ID_2 := $(shell aws cloudformation describe-stacks --stack-name $(application_key) --query "Stacks[0].Outputs[?OutputKey=='CloudfrontIcalDistributionId'].OutputValue" --output text))
 	$(eval INVALIDATION_ID := $(shell aws cloudfront create-invalidation --distribution-id $(DISTRIBUTION_ID) --paths "/*" --query 'Invalidation.Id' --output text --no-cli-page))
 	$(eval INVALIDATION_ID_2 := $(shell aws cloudfront create-invalidation --distribution-id $(DISTRIBUTION_ID_2) --paths "/*" --query 'Invalidation.Id' --output text --no-cli-page))
 	@echo "Waiting on job $(INVALIDATION_ID)..."

README.md

@@ -7,4 +7,4 @@ This repository is split into multiple parts:
 ## Getting Started
 You will need node>=22 installed, as well as the AWS CLI and the AWS SAM CLI. The best way to work with all of this is to open the environment in a container within your IDE (VS Code should prompt you to do so: use "Clone in Container" for best performance). This container will have all needed software installed.
 
-Then, run `make install` to install all packages, and `make local` to start the UI and API servers! The UI will be accessible on `http://localhost:5173/` and the API on `http://localhost:8080/`.
+Then, run `make install` to install all packages, and `make local` to start the UI and API servers! The UI will be accessible on `http://localhost:5173/` and the API on `http://localhost:8080/`.

cloudformation/iam.yml

@@ -15,6 +15,8 @@ Parameters:
     Type: String
   SqsQueueArn:
     Type: String
+  LinkryKvArn:
+    Type: String
 
 Conditions:
   IsDev: !Equals [!Ref RunEnvironment, "dev"]
@@ -74,12 +76,14 @@ Resources:
               - Fn::Sub: arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/infra-core-api-membership-external
               - Fn::Sub: arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/infra-core-api-room-requests
               - Fn::Sub: arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/infra-core-api-room-requests-status
+              - Fn::Sub: arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/infra-core-api-linkry
               # Index accesses
               - Fn::Sub: arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/infra-core-api-stripe-links/index/*
               - Fn::Sub: arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/infra-core-api-events/index/*
               - Fn::Sub: arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/infra-merchstore-purchase-history/index/*
               - Fn::Sub: arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/infra-core-api-room-requests/index/*
               - Fn::Sub: arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/infra-core-api-room-requests-status/index/*
+              - Fn::Sub: arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/infra-core-api-linkry/index/*
 
           - Sid: DynamoDBCacheAccess
             Effect: Allow
@@ -112,6 +116,12 @@ Resources:
             Resource:
               - Fn::Sub: arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/infra-core-api-stripe-links/stream/*
               - Fn::Sub: arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/infra-core-api-events/stream/*
+          - Sid: CloudfrontKvStreamAccess
+            Effect: Allow
+            Action:
+              - cloudfront-keyvaluestore:*
+            Resource:
+              - !Ref LinkryKvArn
 
   # API Lambda IAM Role
   ApiLambdaIAMRole:
@@ -176,6 +186,7 @@ Resources:
                 Effect: Allow
                 Resource:
                   - Fn::Sub: arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:infra-core-api-entra*
+                  - Fn::Sub: arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:infra-core-api-ro-entra*
 
   # SQS Lambda IAM Role
   SqsLambdaIAMRole:

cloudformation/main.yml

@@ -87,6 +87,7 @@ Resources:
         LambdaFunctionName: !Sub ${ApplicationPrefix}-lambda
         SesEmailDomain: !FindInMap [General, !Ref RunEnvironment, SesDomain]
         SqsQueueArn: !GetAtt AppSQSQueues.Outputs.MainQueueArn
+        LinkryKvArn: !GetAtt LinkryRecordsCloudfrontStore.Arn
 
   AppLogGroups:
     Type: AWS::Serverless::Application
@@ -125,26 +126,6 @@ Resources:
           !FindInMap [ApiGwConfig, !Ref RunEnvironment, HostedZoneId]
         CloudfrontDomain: !GetAtt [AppIcalCloudfrontDistribution, DomainName]
 
-  LinkryDomainProxy:
-    Type: AWS::Serverless::Application
-    Properties:
-      Location: ./custom-domain.yml
-      Parameters:
-        RunEnvironment: !Ref RunEnvironment
-        RecordName: go
-        GWBaseDomainName: !FindInMap
-          - ApiGwConfig
-          - !Ref RunEnvironment
-          - EnvDomainName
-        GWCertArn: !FindInMap
-          - ApiGwConfig
-          - !Ref RunEnvironment
-          - EnvCertificateArn
-        GWApiId: !Ref AppApiGateway
-        GWHostedZoneId:
-          !FindInMap [ApiGwConfig, !Ref RunEnvironment, HostedZoneId]
-        CloudfrontDomain: !GetAtt [AppIcalCloudfrontDistribution, DomainName]
-
   CoreUrlProd:
     Type: AWS::Serverless::Application
     Properties:
@@ -184,6 +165,8 @@ Resources:
         Variables:
           RunEnvironment: !Ref RunEnvironment
           EntraRoleArn: !GetAtt AppSecurityRoles.Outputs.EntraFunctionRoleArn
+          LinkryKvArn: !GetAtt LinkryRecordsCloudfrontStore.Arn
+          AWS_CRT_NODEJS_BINARY_RELATIVE_PATH: node_modules/aws-crt/dist/bin/linux-arm64-glibc/aws-crt-nodejs.node
       VpcConfig:
         Ipv6AllowedForDualStack: !If [ShouldAttachVpc, True, !Ref AWS::NoValue]
         SecurityGroupIds:
@@ -483,6 +466,34 @@ Resources:
           Projection:
             ProjectionType: "ALL"
 
+  LinkryRecordsTable:
+    Type: "AWS::DynamoDB::Table"
+    Properties:
+      BillingMode: "PAY_PER_REQUEST"
+      TableName: "infra-core-api-linkry"
+      DeletionProtectionEnabled: !If [IsProd, true, false] # TODO: remove this
+      PointInTimeRecoverySpecification:
+        PointInTimeRecoveryEnabled: !If [IsProd, true, false]
+      AttributeDefinitions:
+        - AttributeName: "slug"
+          AttributeType: "S"
+        - AttributeName: "access"
+          AttributeType: "S"
+      KeySchema:
+        - AttributeName: "slug"
+          KeyType: "HASH"
+        - AttributeName: "access"
+          KeyType: "RANGE"
+      GlobalSecondaryIndexes:
+        - IndexName: "AccessIndex"
+          KeySchema:
+            - AttributeName: "access"
+              KeyType: "HASH"
+            - AttributeName: "slug"
+              KeyType: "RANGE"
+          Projection:
+            ProjectionType: "ALL"
+
   CacheRecordsTable:
     Type: "AWS::DynamoDB::Table"
     DeletionPolicy: "Retain"
@@ -831,13 +842,6 @@ Resources:
               OriginProtocolPolicy: https-only
         Enabled: true
         Aliases:
-          - !Join
-            - ""
-            - - "go."
-              - !FindInMap
-                - ApiGwConfig
-                - !Ref RunEnvironment
-                - EnvDomainName
           - !Join
             - ""
             - - "ical."
@@ -875,6 +879,105 @@ Resources:
         HttpVersion: http2
         PriceClass: PriceClass_100
 
+  LinkryRecordsCloudfrontStore:
+    Type: AWS::CloudFront::KeyValueStore
+    Properties:
+      Name: infra-core-api-cloudfront-linkry-kv
+
+  LinkryRecordsCloudfrontFunction:
+    Type: 'AWS::CloudFront::Function'
+    Properties:
+      Name: infra-core-api-cloudfront-linkry-redir
+      FunctionConfig:
+        Comment: 'Linkry Redirect Cloudfront Function'
+        Runtime: 'cloudfront-js-2.0'
+        KeyValueStoreAssociations:
+          - KeyValueStoreARN: !Sub '${LinkryRecordsCloudfrontStore.Arn}'
+      FunctionCode: !Sub |
+        import cf from 'cloudfront';
+        const kvsId = '${LinkryRecordsCloudfrontStore.Id}';
+        const kvs = cf.kvs(kvsId);
+
+        async function handler(event) {
+          const request = event.request;
+          const path = request.uri.replace(/^\/+/, '');
+          let redirectUrl = "https://acm.illinois.edu/404";
+          try {
+            const value = await kvs.get(path);
+            if (value) {
+              redirectUrl = value;
+            }
+          } catch (err) {
+            console.log('KVS key lookup failed');
+          }
+          var response = {
+            statusCode: 302,
+            statusDescription: 'Found',
+            headers: {
+              'location': { value: redirectUrl }
+            }
+          };
+          return response;
+        }
+      AutoPublish: true
+
+  AppLinkryCloudfrontDistribution:
+    Type: AWS::CloudFront::Distribution
+    Properties:
+      DistributionConfig:
+        Enabled: true
+        DefaultCacheBehavior:
+          ViewerProtocolPolicy: redirect-to-https
+          TargetOriginId: dummyOrigin
+          ForwardedValues:
+            QueryString: false
+            Cookies:
+              Forward: none
+          FunctionAssociations:
+            - EventType: viewer-request
+              FunctionARN: !GetAtt LinkryRecordsCloudfrontFunction.FunctionARN
+        Origins:
+          - Id: dummyOrigin
+            DomainName: example.com
+            CustomOriginConfig:
+              OriginProtocolPolicy: https-only
+        Aliases:
+          - !Join
+            - ""
+            - - "go."
+              - !FindInMap
+                - ApiGwConfig
+                - !Ref RunEnvironment
+                - EnvDomainName
+        ViewerCertificate:
+          AcmCertificateArn: !FindInMap
+            - ApiGwConfig
+            - !Ref RunEnvironment
+            - EnvCertificateArn
+          MinimumProtocolVersion: TLSv1.2_2021
+          SslSupportMethod: sni-only
+        HttpVersion: http2
+        PriceClass: PriceClass_100
+
+  LinkryDomainProxy:
+    Type: AWS::Serverless::Application
+    Properties:
+      Location: ./custom-domain.yml
+      Parameters:
+        RunEnvironment: !Ref RunEnvironment
+        RecordName: go
+        GWBaseDomainName: !FindInMap
+          - ApiGwConfig
+          - !Ref RunEnvironment
+          - EnvDomainName
+        GWCertArn: !FindInMap
+          - ApiGwConfig
+          - !Ref RunEnvironment
+          - EnvCertificateArn
+        GWApiId: !Ref AppApiGateway
+        GWHostedZoneId:
+          !FindInMap [ApiGwConfig, !Ref RunEnvironment, HostedZoneId]
+        CloudfrontDomain: !GetAtt [AppLinkryCloudfrontDistribution, DomainName]
 
 Outputs:
   DomainName:
@@ -902,7 +1005,7 @@ Outputs:
     Description: Cloudfront Distribution ID
     Value: !GetAtt AppFrontendCloudfrontDistribution.Id
 
-  CloudfrontSecondaryDistributionId:
+  CloudfrontIcalDistributionId:
     Description: Cloudfront Distribution ID
     Value: !GetAtt AppIcalCloudfrontDistribution.Id