Add UI (local debug only)

.gitignore

@@ -36,6 +36,7 @@ terraform.rc
 .validate
 .apply
 plan.tfplan
+terraform/environment/*/output.json
 
 graphql/node_modules
 graphql/mutation/*/appsync.js
@@ -44,3 +45,9 @@ graphql/coverage/
 
 appsync/node_modules
 appsync/.graphqlconfig.yml
+
+ui/node_modules
+ui/config/*
+!ui/config/.emptyDir
+ui/public/*
+!ui/public/.emptyDir

Makefile

@@ -12,6 +12,7 @@ all: $(TERRAFOM_VALIDATE)
 
 include graphql/graphql.mk
 include appsync/appsync.mk
+include ui/ui.mk
 
 .PHONY: terraform-format
 terraform-format: $(addprefix terraform-format-environment-,$(TERRAFORM_ENVIRONMENTS)) $(addprefix terraform-format-module-,$(TERRAFORM_MODULES))
@@ -64,3 +65,5 @@ clean:
 	rm -f graphql/query/*/appsync.js
 	rm -rf graphql/node_modules
 	rm -rf appsync/node_modules
+	rm -f ui/config/*
+	rm -f ui/public/*

README.md

@@ -99,3 +99,6 @@ deployment, you will need to create an S3 bucket for the state, in the same way
 as you did for the real deployment.
 
 Development environments will not use Jumpcloud, but instead use Cognito.
+
+You can run the UI without pushing to the S3 bucket by running `make ui-local`.
+This may still perform a terraform apply.

appsync/appsync.mk

@@ -1,16 +1,19 @@
-appsync/graphql.ts: graphql/schema.graphql
+appsync/graphql.ts: graphql/schema.graphql appsync/node_modules
 	if [ -z "$(IN_PIPELINE)" ] ; then \
 		docker run --rm --user $$(id -u):$$(id -g) -v $(PWD):/app -w /app/appsync --entrypoint ./node_modules/.bin/graphql-code-generator node:20 --config codegen.ts ; \
 	else \
 		echo Not re-auto-generating types file in pipeline ; \
 	fi
 
-appsync/make-schema.js: appsync/make-schema.ts
+appsync/make-schema.js: appsync/make-schema.ts appsync/node_modules
 	cd appsync ; esbuild make-schema.ts --bundle --format=esm --platform=node --target=esnext --sourcemap=inline --sources-content=false > make-schema.js
 
-appsync/schema.ts: graphql/schema.graphql appsync/make-schema.js
+appsync/schema.ts: graphql/schema.graphql appsync/make-schema.js appsync/node_modules
 	if [ -z "$(IN_PIPELINE)" ] ; then \
 		docker run --rm -i --user $$(id -u):$$(id -g) -v $(PWD):/app -w /app/appsync node:20 ./make-schema.js < $< > $@ ; \
 	else \
 		echo Not re-auto-generating types file in pipeline ; \
 	fi
+
+appsync/node_modules:
+	cd appsync ; npm install

terraform/environment/wildsea-dev/output.tf

@@ -0,0 +1,23 @@
+output "cognito_identity_pool_id" {
+  value = module.wildsea.cognito_identity_pool_id
+}
+
+output "cognito_user_pool_id" {
+  value = module.wildsea.cognito_user_pool_id
+}
+
+output "cognito_web_client_id" {
+  value = module.wildsea.cognito_web_client_id
+}
+
+output "graphql_uri" {
+  value = module.wildsea.graphql_uri
+}
+
+output "region" {
+  value = module.wildsea.region
+}
+
+output "cognito_login_domain" {
+  value = module.wildsea.cognito_login_domain
+}

terraform/module/iac-roles/policy.tf

@@ -180,6 +180,7 @@ data "aws_iam_policy_document" "rw" {
       "cognito-idp:TagResource",
       "cognito-idp:UntagResource",
       "cognito-idp:Delete*",
+      "cognito-idp:Update*",
     ]
     resources = [
       "arn:${data.aws_partition.current.id}:cognito-idp:${data.aws_region.current.id}:${data.aws_caller_identity.current.account_id}:userpool/*",
@@ -404,6 +405,7 @@ data "aws_iam_policy_document" "rw_boundary" {
       "cognito-idp:Describe*",
       "cognito-idp:Get*",
       "cognito-idp:Delete*",
+      "cognito-idp:Update*",
     ]
     resources = [
       "arn:${data.aws_partition.current.id}:cognito-idp:${data.aws_region.current.id}:${data.aws_caller_identity.current.account_id}:userpool/*",

terraform/module/wildsea/cognito.tf

@@ -30,8 +30,8 @@ resource "aws_cognito_user_pool_client" "cognito" {
   generate_secret                      = false
   explicit_auth_flows                  = ["ALLOW_REFRESH_TOKEN_AUTH", "ALLOW_USER_PASSWORD_AUTH", "ALLOW_USER_SRP_AUTH"]
   allowed_oauth_flows_user_pool_client = true
-  callback_urls                        = ["https://TODO"]
-  logout_urls                          = ["https://TODO"]
+  callback_urls                        = ["http://localhost:5173/", "https://${aws_cloudfront_distribution.cdn.domain_name}/"]
+  logout_urls                          = ["http://localhost:5173/", "https://${aws_cloudfront_distribution.cdn.domain_name}/"]
   allowed_oauth_flows                  = ["code", "implicit"]
   allowed_oauth_scopes                 = ["openid"]
   supported_identity_providers         = [var.saml_metadata_url == "" ? "COGNITO" : aws_cognito_identity_provider.idp[0].provider_name]

terraform/module/wildsea/output.tf

@@ -0,0 +1,23 @@
+output "cognito_identity_pool_id" {
+  value = aws_cognito_identity_pool.cognito.id
+}
+
+output "cognito_user_pool_id" {
+  value = aws_cognito_user_pool.cognito.id
+}
+
+output "cognito_web_client_id" {
+  value = aws_cognito_user_pool_client.cognito.id
+}
+
+output "graphql_uri" {
+  value = aws_appsync_graphql_api.graphql.uris["GRAPHQL"]
+}
+
+output "region" {
+  value = data.aws_region.current.name
+}
+
+output "cognito_login_domain" {
+  value = "${aws_cognito_user_pool_domain.cognito.domain}.auth.${data.aws_region.current.name}.amazoncognito.com"
+}

ui/index.html

@@ -0,0 +1,16 @@
+<!doctype html>
+<html lang="en">
+    <head>
+        <meta charset="UTF-8">
+        <link rel="icon" type="image/webp" href="/favicon.webp">
+        <title>Wildsea</title>
+    </head>
+    <body>
+        <div class="controls">
+            <button id="login-button">Log In</button>
+            <button id="logout-button">Log Out</button>
+        </div>
+        <div id="app"></div>
+        <script type="module" src="/src/main.ts"></script>
+    </body>
+</html>