⭐ feat(infra): Migrate to serverless Lambda architecture#291
⭐ feat(infra): Migrate to serverless Lambda architecture#291wanjohiryan merged 2 commits intomainfrom
Conversation
WalkthroughThe changes migrate the API and authentication infrastructure from container-based services to serverless AWS Lambda functions, update type declarations to reflect this shift, and add AWS WAF rate limiting for the API. Related scripts and exports are updated or removed, and resource allocations for supporting services are simplified. Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant CloudFront
participant WAF
participant LambdaAPI
participant LambdaAuth
Client->>CloudFront: HTTP Request (API/Auth)
CloudFront->>WAF: Forward request
WAF-->>CloudFront: Allow or Block (rate limit)
alt API Route
CloudFront->>LambdaAPI: Invoke Lambda handler
LambdaAPI-->>CloudFront: Response
else Auth Route
CloudFront->>LambdaAuth: Invoke Lambda handler
LambdaAuth-->>CloudFront: Response
end
CloudFront-->>Client: Return response
Poem
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
infra/realtime.ts (1)
1-1: Remove commented import or clarify the intention.The auth import is commented out rather than removed entirely. If auth is no longer needed, remove the line completely. If there's uncertainty, please clarify the intention.
-// import { auth } from "./auth";infra/api.ts (1)
8-26: Lambda function configuration is well-structured.The function setup with VPC integration and linked resources is appropriate. However, consider enabling streaming in development for better dev/prod parity.
- streaming: !$dev, + streaming: true, // Enable for dev/prod parity
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (8)
infra/api.ts(2 hunks)infra/auth.ts(1 hunks)infra/realtime.ts(1 hunks)infra/zero.ts(2 hunks)packages/functions/package.json(0 hunks)packages/functions/src/api/index.ts(3 hunks)packages/functions/src/auth/index.ts(2 hunks)sst-env.d.ts(1 hunks)
💤 Files with no reviewable changes (1)
- packages/functions/package.json
🧰 Additional context used
🧬 Code Graph Analysis (2)
infra/api.ts (1)
infra/dns.ts (1)
domain(1-5)
infra/realtime.ts (1)
infra/postgres.ts (1)
postgres(3-36)
🔇 Additional comments (16)
infra/zero.ts (3)
8-8: LGTM: Connection string explicitly includes port.The explicit port inclusion in the connection string template improves clarity and reduces potential connection issues.
44-46: Verify the resource reduction impact on replication performance.The resource allocation has been significantly reduced to 0.5 vCPU and 1 GB memory with spot capacity. For a replication manager handling real-time data synchronization, this reduction could impact performance and availability.
Consider the following concerns:
- Spot instances can be terminated, potentially disrupting replication
- Reduced CPU/memory may cause bottlenecks during high-load periods
- Zero replication typically requires consistent performance for data consistency
Please verify that these reduced resources are sufficient for your replication workload, especially during peak usage periods.
128-130: Verify the resource reduction impact on zero service performance.Similar to the replication manager, the main zero service now uses significantly reduced resources (0.5 vCPU, 1 GB memory, spot capacity). This could impact the performance of the zero synchronization service.
Please ensure these resource constraints are adequate for your zero service workload, particularly given the service handles real-time synchronization with up to 4 instances in the scaling configuration.
infra/realtime.ts (1)
6-6:Details
✅ Verification successful
Verify realtime authorization still functions without auth link.
The
authmodule has been removed from the authorizer's link array, leaving onlypostgres. Please ensure that the realtime authorizer can still properly authenticate users without the auth service dependency.
🏁 Script executed:
#!/bin/bash # Description: Check how the realtime authorizer handles authentication without the auth link # Find the authorizer handler implementation ast-grep --pattern 'export $_ handler($_) { $$$ }' # Look for auth-related imports and usage in the authorizer rg -A 10 "authorizer\.handler" rg -A 5 "auth.*import\|import.*auth"Length of output: 259
🏁 Script executed:
#!/bin/bash set -e # Locate authorizer implementation files echo "Authorizer files in packages/functions/src/realtime/:" find packages/functions/src/realtime -maxdepth 1 -type f -print # Print the first 50 lines of each authorizer file to inspect imports and logic for file in packages/functions/src/realtime/authorizer*; do echo -e "\n==== $file ====" sed -n '1,50p' "$file" done # Search for any auth-related imports within those files echo -e "\nAuth-related import lines:" rg -n "import.*auth" packages/functions/src/realtime/authorizer* # Search for any usage of 'auth' or 'verify' keywords in those files echo -e "\nAuth-related usage lines:" rg -n "auth|verify" packages/functions/src/realtime/authorizer*Length of output: 2271
No changes needed: auth link removal is safe
We’ve confirmed that the realtime authorizer in
packages/functions/src/realtime/authorizer.ts:
- Imports and uses
Resource.Auth.urlat build time (issuer is a static string, not injected via environment).- Calls
client.verify(subjects, token)over HTTPS to fetch JWKs and validate tokens.- Requires no env vars or direct VPC link to the Auth construct.
Linking only
[postgres]still gives the function VPC/NAT for outbound requests, so dropping the Auth link does not break authentication.packages/functions/src/auth/index.ts (2)
4-4: LGTM: Proper import for Lambda handler conversion.The addition of the
handleimport fromhono/aws-lambdais correct for converting the service to a Lambda function.
159-159: LGTM: Clean conversion to Lambda handler.The export change from a server configuration object to a single Lambda handler using
handle(app)is the correct approach for migrating from a containerized service to AWS Lambda. This properly wraps the Hono app for Lambda execution.sst-env.d.ts (3)
10-12: LGTM: Type definitions align with Router migration.The Api resource type change from
sst.aws.Servicetosst.aws.Routerwith the removal of theserviceproperty correctly reflects the infrastructure migration to a router-based API.
13-17: LGTM: New function resource type definition.The addition of the
ApiFnresource withsst.aws.Functiontype properly represents the new serverless function replacing the previous service-based API.
19-19: LGTM: Auth type updated for managed service.The Auth resource type change from
sst.aws.Servicetosst.aws.Authcorrectly reflects the migration to a managed authentication service.packages/functions/src/api/index.ts (3)
2-2: Lambda handler imports look good.The Hono framework integration with AWS Lambda handlers is properly set up.
Also applies to: 13-13
30-30: Realtime route removal aligns with Lambda limitations.The removal of the
/realtimeroute is appropriate since AWS Lambda doesn't support persistent WebSocket connections directly. If realtime functionality is still needed, consider using AWS API Gateway WebSocket APIs or a separate service.
96-98: Handler export configured correctly for Lambda.The conditional use of
streamHandlevshandlebased onSST_LIVEis a good approach. Just ensure that the behavior differences between streaming and non-streaming modes are well-tested.infra/auth.ts (2)
7-32: Auth service migration to managed construct looks good.The migration from containerized service to
sst.aws.Authsignificantly simplifies the infrastructure while maintaining all necessary functionality. The VPC integration and linked resources are properly configured.
25-25:Details
✅ Verification successful
Verify the auth handler exists at the specified path.
Ensure that the handler file exists and exports a proper Lambda handler function.
🏁 Script executed:
#!/bin/bash # Description: Verify the auth handler file exists and has proper exports # Check if the handler file exists fd -t f "index.ts" packages/functions/src/auth/ # Verify the handler export ast-grep --pattern 'export const handler = $_' packages/functions/src/auth/Length of output: 368
Auth handler path and export confirmed
The file
packages/functions/src/auth/index.tsexists and correctly exportshandler(export const handler = handle(app);). No further action is needed.infra/api.ts (2)
28-29: WAF configuration and CloudFront integration look correct.The WAF is properly configured with CloudFront scope and custom rate limit response. The use of us-east-1 provider is required for CloudFront WAF integration.
Also applies to: 30-89
91-111: Router configuration with WAF attachment is properly implemented.The transform hook correctly attaches the WAF to the CloudFront distribution. This ensures API protection at the edge.
|
@coderabbitai give me 5 suitable PR titles for this PR, use our title format please |
|
Tip For best results, initiate chat on the files or code changes. @wanjohiryan Here are 5 suitable PR titles following your format:
Each title captures a different aspect of your changes:
All follow your |
wanjohiryan
changed the title
1 participant
Description
Summary by CodeRabbit
New Features
Improvements
Bug Fixes
Other