sspa

#!/usr/bin/env bash

abspath="$(cd "${0%/*}" 2>/dev/null; echo "$PWD"/"${0##*/}")"
root_dir=`dirname $abspath`
app_name=learnjs
code_bucket=${app_name}/_code_bundles
profile=admin

function check_python() {
  if ! which python > /dev/null; then
    echo "Can't find Python. You need Python 2.7 or later to use this."
    exit 1
  fi
}

function check_aws() {
  if ! which aws > /dev/null; then
    echo "Can't find AWS CLI. Install 'awscli' using pip."
    exit 1
  fi
  if ! aws configure list --profile $profile > /dev/null; then
    echo "Run \`aws configure --profile $profile\` to create it"
    exit 1
  fi
}

function check_node_deps() {
  if ! which npm > /dev/null; then
    echo "This action requires Node.js and NPM."
    exit 1
  fi
}

function dev_server() {
  cd public
  exec python -m SimpleHTTPServer 9292
}

function create_s3_bucket() {
  local bucket_name=$1
  local bucket_uri="s3://${bucket_name}"
  local bucket_path=conf/s3/${bucket_name}
  # The s3 command doesn't output JSON :-/
  if [[ ! -e ${bucket_path}/endpoint.txt ]]; then
    aws --profile $profile s3 mb $bucket_uri && mkdir -p ${bucket_path}
    local region=$(aws --profile $profile configure get region)
    local endpoint="http://${1}.s3-website-${region}.amazonaws.com"
    echo "$endpoint" > ${bucket_path}/endpoint.txt
    echo "Website endpoint is: $endpoint"
  fi
}

function webify_bucket() {
  local bucket_name=$1
  local bucket_uri="s3://${bucket_name}"
  aws --profile $profile s3 website \
    --index-document index.html \
    --error-document error.html \
    $bucket_uri
}

function deploy_s3_bucket() {
  local bucket_name=$1
  if [[ -d ${1} ]]; then
    bucket_name=$(basename $bucket_name)
  fi
  local bucket_uri="s3://${1}"
  aws --profile $profile s3 sync public/ $bucket_uri --acl public-read
}

function generate_assume_role_policy() {
  local identity_pool_arn=$1
cat <<DOC
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Federated": "cognito-identity.amazonaws.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "cognito-identity.amazonaws.com:aud": "${identity_pool_arn}"
        },
        "ForAnyValue:StringLike": {
          "cognito-identity.amazonaws.com:amr": "authenticated"
        }
      }
    }
  ]
}
DOC
}

function generate_table_policy() {
  local table_arn=$1
cat <<DOC
{
  "Version": "2012-10-17",
  "Statement": [{
      "Effect": "Allow",
      "Action": [
        "dynamodb:BatchGetItem",
        "dynamodb:BatchWriteItem",
        "dynamodb:DeleteItem",
        "dynamodb:GetItem",
        "dynamodb:PutItem",
        "dynamodb:Query",
        "dynamodb:UpdateItem"
      ],
      "Resource": ["${table_arn}"],
      "Condition": {
        "ForAllValues:StringEquals": {
          "dynamodb:LeadingKeys": ["\${cognito-identity.amazonaws.com:sub}"]}
    }
  }]
}
DOC
}

function create_cognito_auth_role() {
  local identity_pool_dir=$1
  local pool_id=$(support/jsed.py ${identity_pool_dir}/pool_info.json 'IdentityPoolId')
  local pool_name=$(support/jsed.py ${identity_pool_dir}/pool_info.json 'IdentityPoolName')
  generate_assume_role_policy ${pool_id} > ${identity_pool_dir}/assume_role_policy.json
  if [[ ! -s ${identity_pool_dir}/role_info.json ]]; then
    local role_name="${pool_name}_cognito_authenticated"
    echo "Creaing role: $role_name"
    # Might be able to use the create_iam_role function for this
    aws --profile $profile iam create-role \
      --role-name "$role_name" \
      --assume-role-policy-document "file://${identity_pool_dir}/assume_role_policy.json" \
      > ${identity_pool_dir}/role_info.json
  fi
}


function create_identity_pool() {
  local identity_pool_dir=${1%/}
  if [[ ! -e ${identity_pool_dir}/config.json ]]; then
    echo "Can't find pool config file ${identity_pool_dir}/config.json"
    exit 1
  fi

  local identity_pool_name=$(basename $identity_pool_dir)
  if [[ ! -s ${identity_pool_dir}/pool_info.json ]]; then
    echo "Creating identity pool: $identity_pool_name"
    aws --profile $profile cognito-identity create-identity-pool \
      --identity-pool-name $identity_pool_name \
      --cli-input-json "file://${identity_pool_dir}/config.json" \
      > ${identity_pool_dir}/pool_info.json
  fi
  create_cognito_auth_role ${identity_pool_dir}

  local pool_id=$(support/jsed.py ${identity_pool_dir}/pool_info.json 'IdentityPoolId')
  local role_arn=$(support/jsed.py ${identity_pool_dir}/role_info.json 'Role.Arn')
  echo "Updating identity pool roles"
  aws --profile $profile cognito-identity set-identity-pool-roles \
    --identity-pool-id ${pool_id} \
    --roles authenticated=${role_arn}
}

function create_table() {
  local table_dir=${1%/}
  local table_name=$(basename $table_dir)
  local role_name="${2}_cognito_authenticated"
  if [[ ! -s ${table_dir}/table_info.json ]]; then
    aws --profile $profile dynamodb create-table \
      --table-name $table_name \
      --cli-input-json "file://${table_dir}/config.json" \
      > ${table_dir}/table_info.json
  fi

  local table_arn=$(support/jsed.py ${table_dir}/table_info.json 'TableDescription.TableArn')
  generate_table_policy ${table_arn} > ${table_dir}/role_policy.json
  aws --profile $profile iam put-role-policy \
    --policy-document file://${table_dir}/role_policy.json \
    --role-name ${role_name} \
    --policy-name ${table_name}_table_access
}

function build_bundle() {
  check_node_deps
  pushd services
  rm archive.zip
  npm install || exit 1
  mkdir -p dist
  cp -r node_modules dist/
  cp -r lib/* dist/
  cd dist
  zip -r archive.zip *
  mv archive.zip ..
  cd ..
  rm -rf dist
  popd
}

function deploy_bundle {
  for fn in `ls conf/lambda/functions`; do
    aws lambda update-function-code \
      --function-name $fn \
      --zip-file "fileb://services/archive.zip" > conf/lambda/functions/$fn/info.json
  done
}

function test_services() {
  check_node_deps
  cd services
  if [[ ! -x node_modules/.bin/jasmine ]]; then
    npm install || exit 1
  fi
  export PATH=node_modules/.bin:${PATH}
  NODE_PATH=./lib jasmine
  cd ..
}

function create_iam_role() {
  local role_name="${app_name}_lambda_exec"
  local role_dir=conf/iam/roles/${role_name}
  local policy_document=$2
  mkdir -p $role_dir
  if [[ ! -e ${role_dir}/info.json ]]; then
    aws --profile $profile iam create-role \
      --role-name "$role_name" \
      --assume-role-policy-document "${policy_document}" \
      > ${role_dir}/info.json
  fi
}

function create_lambda_service() {
  local service_dir=${1%/}
  local function_name=$(basename $service_dir)
  create_iam_role lambda_exec "file://conf/iam/policies/lambda_trust.json"
  local role_arn=$(support/jsed.py conf/iam/roles/learnjs_lambda_exec/info.json 'Role.Arn')
  if [[ ! -e ${service_dir}/info.json ]]; then
    aws lambda create-function \
      --function-name ${function_name} \
      --role ${role_arn} \
      --zip-file "fileb://services/archive.zip" \
      --handler "index.${function_name}" \
      --cli-input-json "file://${service_dir}/config.json" \
      > ${service_dir}/info.json
  fi
}

function help() {
  echo "#################################################"
  echo "# Serverless Single Page Apps - The Bash Helper #"
  echo "#################################################"
  echo 
  echo "Usage: sspa <action> [arguments...]"
  echo 
  echo "Where <action> is one of:"
  echo "    server"
  echo "    create_bucket <bucket name>"
  echo "    deploy_bucket <bucket dir>"
  echo "    create_pool <config dir>"
  echo "    create_table <config dir> <pool name>"
  echo "    test"
  echo "    build_bundle"
  echo "    deploy_bundle"
  echo "    create_service <config file>"
  #echo "    create_gateway <config_file> <service> - Attach an API Gateway to a service"
  echo 
}

action=${1:-"help"}

cd $root_dir

check_python
check_aws

case "$action" in
  server)
    dev_server
    ;;

  test)
    test_services
    ;;

  build_bundle)
    build_bundle
    ;;

  deploy_bundle)
    build_bundle
    deploy_bundle
    ;;

  create_bucket)
    if [[ $# -eq 2 ]]; then
      create_s3_bucket ${2}
      webify_bucket ${2}
    else
      echo "Please specify a bucket name"
      exit 1
    fi
    ;;

  deploy_bucket)
    if [[ $# -eq 2 ]]; then
      deploy_s3_bucket ${2}
    else
      echo "Please specify an S3 bucket name"
      exit 1
    fi
    ;;

  create_pool)
    if [[ $# -eq 2 ]]; then
      create_identity_pool ${2}
    else
      echo "Please specify a Cognito identity pool configuration directory" 
      exit 1
    fi
    ;;

  create_table)
    if [[ $# -eq 3 ]]; then
      create_table ${2} ${3}
    else
      echo "Please specify a DynamoDB table configuration directory and identity pool name" 
      exit 1
    fi
    ;;

  create_service)
    if [[ $# -eq 2 ]]; then
      build_bundle
      create_lambda_service ${2}
    else
      echo "Please specify a Lambda config directory" 
      exit 1
    fi
    ;;

  *)
    help
    ;;
esac