Flightdeck

04 · THE SOURCE ITSELF

Eighteen things I found reading my own code back.

Each of these is a claim about the source and carries the file and line to check it against. I have not guessed at what AWS does with any of it; where the reading depends on a service behaviour I have left the behaviour out and quoted the code instead.

1. 01

   The first thing it does is rewrite your AWS config

   Before the menu appears, updateProfileInConfig reads ~/.aws/config, matches the profile block with new RegExp(`\\[profile ${AWS_PROFILE}\\][\\s\\S]*?(?=\\[|$)`, 'g') and writes the whole file back. Anything of yours that the regex swallowed is gone.

   src/aws/login.ts:45

2. 02

   The role is always the widest one

   Login has a narrower default parameter, and runCLI calls Login('AdministratorAccess'), so the role written into the profile is administrator every time.

   src/index.ts:59

3. 03

   Every yes/no question is pre-answered yes

   All thirteen confirmations go through one function: confirm({ message: query, default: true }). Inquirer renders that as (Y/n) and a bare Enter answers yes.

   src/helpers/command-line-inputs.ts:14

4. 04

   The DynamoDB copy runs twice

   amplifyCopyDatabase performs the whole transfer at line 22. The command then recomputes both suffixes and calls DynamodbTransfer again at line 42 with no await, so the second pass runs outside the try/catch.

   src/commands/copy-env-db.ts:42

5. 05

   A log line says deleted where the code writes the word null

   clearEmptyIndexes sets a missing or empty index attribute to the literal string 'null' and then logs "Deleted empty index attribute …". Nothing is deleted and the destination now holds the four characters n-u-l-l.

   src/helpers/dynamodb-transfer.ts:60

6. 06

   The suffix is discovered rather than configured

   GetBackendEnvironment gives the stack name, DescribeStackResources finds the API resource, the physical id is regex-stripped back to a stack name, DescribeStacks reads GraphQLAPIIdOutput and the env parameter, and the suffix comes back as `-${graphqlId}-${envName}`. Every table whose name ends with that string is in scope.

   src/helpers/amplify-get-env-dynamodb-suffix.ts:56

7. 07

   The environment name is truncated and never padded

   The name is built as region code plus environment short code plus the cleaned customer name, then cut with .slice(0, 10). A comment says "If the name is shorter than 2 characters, pad it with x" and the padding was never written.

   src/helpers/amplify-create-environment-name.ts:23

8. 08

   The app list is only ever one page

   Both fetchers send ListAppsCommand({}) and never follow nextToken, while listAllApps in the same codebase does paginate. Whichever apps fell off the first page do not exist as far as these commands are concerned.

   src/helpers/amplify-fetch-region-apps.ts:8

9. 09

   A secret string is cached under itself

   SecureString encrypts the Bitbucket credential pair with AES-256-GCM and PBKDF2 at 100,000 iterations, then caches the instance in a Map keyed by the plaintext, so the plaintext stays resident for the life of the process.

   src/helpers/secure-request.ts:20

10. 10

    An HTTP error page parses as a token response

    secureHttpsRequest resolves on the response body without ever reading the status code and sets no timeout.

    src/helpers/secure-request.ts:78

11. 11

    Three calls are never awaited

    The user migration, the second database transfer and the third-party redirect-URI POST are all fired without await, so each one escapes the try/catch that was written to contain it.

    src/commands/copy-amplify-users.ts:24

12. 12

    Two functions disagree about one string

    AmplifyWaitForJob only ends its loop on COMPLETED or FAILED and its caller only proceeds on SUCCEED (src/commands/create-new-app.ts:346), so the database clone at the end of Create New Amplify App cannot be reached.

    src/helpers/amplify-wait-for-job.ts:35

13. 13

    The compiled binary reads its config from the source folder

    Config paths are built with path.join(path.resolve(), 'src/config/…'), so dist/index.js looks for src/config relative to whatever directory you happen to be standing in.

    src/helpers/read-json-file.ts:3

14. 14

    Two filenames are misspelled and imported that way

    The files are called ampify-create-env-with-branch.ts and amplify-clone-envrionment.ts, and both are imported under those spellings, so both work.

    src/helpers/

15. 15

    There is no history and no tests

    npm test is echo "Error: no test specified" && exit 1. There is no .git directory, no README and no documentation, and all 46 source files carry the same modification timestamp. It does type-check clean under strict.

    package.json

16. 16

    Two entry points nothing imports

    There is a HeadlessCreateDevelopmentEnvironment and a second copy of CloneEnvironment with the prompts stripped out, and nothing in the repository imports either of them. The first also passes region.code where every other call site passes region.awsRegion.

    src/headless/

17. 17

    One dependency is never used and one used dependency is never declared

    zx is a declared dependency and is imported nowhere. @aws-sdk/credential-provider-sso is imported by the client provider and is not in the dependency list, so it resolves only as a transitive install.

    package.json

18. 18

    A client that is built and never called

    The provider builds six AWS clients and caches them per ClassName-region, and getSecretsManagerClient is defined but called from nowhere.

    src/aws/aws-client-provider.ts:52