refactor(cloudformation): move the single-service types to provisioners

src/main/java/io/github/hectorvent/floci/services/cloudformation/provisioners/CdkMetadataCfnProvisioner.java

@@ -0,0 +1,27 @@
+package io.github.hectorvent.floci.services.cloudformation.provisioners;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import io.github.hectorvent.floci.services.cloudformation.model.StackResource;
+import jakarta.enterprise.context.ApplicationScoped;
+
+import java.util.Set;
+import java.util.UUID;
+
+/**
+ * Provisions {@code AWS::CDK::Metadata}, the analytics marker the CDK toolchain adds to synthesized
+ * templates. It backs no service, so provisioning is just a physical id: without one the stack
+ * would still succeed via the stub path, but with a fake ARN attribute the real type never has.
+ */
+@ApplicationScoped
+public class CdkMetadataCfnProvisioner implements CfnResourceProvisioner {
+
+    @Override
+    public Set<String> resourceTypes() {
+        return Set.of("AWS::CDK::Metadata");
+    }
+
+    @Override
+    public void provision(StackResource r, JsonNode props, ProvisionContext ctx) {
+        r.setPhysicalId("cdk-metadata-" + UUID.randomUUID().toString().substring(0, 8));
+    }
+}

src/main/java/io/github/hectorvent/floci/services/cloudformation/provisioners/EcrCfnProvisioner.java

@@ -0,0 +1,98 @@
+package io.github.hectorvent.floci.services.cloudformation.provisioners;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import io.github.hectorvent.floci.core.common.AwsException;
+import io.github.hectorvent.floci.services.cloudformation.model.StackResource;
+import io.github.hectorvent.floci.services.ecr.EcrService;
+import io.github.hectorvent.floci.services.ecr.model.Repository;
+import jakarta.enterprise.context.ApplicationScoped;
+
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+/** Provisions {@code AWS::ECR::Repository}. */
+@ApplicationScoped
+public class EcrCfnProvisioner implements CfnResourceProvisioner {
+
+    private static final int REPOSITORY_NAME_MAX_LENGTH = 256;
+
+    private final EcrService ecrService;
+
+    public EcrCfnProvisioner(EcrService ecrService) {
+        this.ecrService = ecrService;
+    }
+
+    @Override
+    public Set<String> resourceTypes() {
+        return Set.of("AWS::ECR::Repository");
+    }
+
+    @Override
+    public void provision(StackResource r, JsonNode props, ProvisionContext ctx) {
+        String repoName = ctx.resolveOptional(props, "RepositoryName");
+        if (repoName == null || repoName.isBlank()) {
+            repoName = ctx.generatePhysicalName(r.getLogicalId(), REPOSITORY_NAME_MAX_LENGTH, true);
+        }
+        // CDK bootstrap requires lower-case repository names; CFN-generated suffixes can include
+        // upper-case characters. Normalize to satisfy the AWS ECR repository name pattern.
+        repoName = repoName.toLowerCase();
+
+        String mutability = ctx.resolveOptional(props, "ImageTagMutability");
+        Map<String, String> tags = parseCfnTags(props != null ? props.get("Tags") : null, ctx);
+
+        Repository repo;
+        try {
+            repo = ecrService.createRepository(repoName, null, mutability, null, null, null, tags, ctx.region());
+        } catch (AwsException e) {
+            if ("RepositoryAlreadyExistsException".equals(e.getErrorCode())) {
+                repo = ecrService.describeRepositories(List.of(repoName), null, ctx.region()).get(0);
+            } else {
+                throw e;
+            }
+        }
+
+        // Lifecycle policy can be inlined as `LifecyclePolicy.LifecyclePolicyText`
+        if (props != null && props.has("LifecyclePolicy")) {
+            JsonNode lp = ctx.engine().resolveNode(props.get("LifecyclePolicy"));
+            String policyText = lp.path("LifecyclePolicyText").asText(null);
+            if (policyText != null && !policyText.isEmpty()) {
+                ecrService.putLifecyclePolicy(repoName, null, policyText, ctx.region());
+            }
+        }
+        if (props != null && props.has("RepositoryPolicyText")) {
+            JsonNode pol = ctx.engine().resolveNode(props.get("RepositoryPolicyText"));
+            String policyText = pol.isTextual() ? pol.asText() : pol.toString();
+            if (policyText != null && !policyText.isEmpty()) {
+                ecrService.setRepositoryPolicy(repoName, null, policyText, ctx.region());
+            }
+        }
+
+        r.setPhysicalId(repoName);
+        r.getAttributes().put("Arn", repo.getRepositoryArn());
+        r.getAttributes().put("RepositoryUri", repo.getRepositoryUri());
+    }
+
+    @Override
+    public void delete(String resourceType, String physicalId, String region) {
+        ecrService.deleteRepository(physicalId, null, true, region);
+    }
+
+    /** See {@code KmsCfnProvisioner#parseCfnTags} for why this is copied rather than shared. */
+    private Map<String, String> parseCfnTags(JsonNode tagsNode, ProvisionContext ctx) {
+        Map<String, String> out = new HashMap<>();
+        if (tagsNode == null || tagsNode.isNull() || !tagsNode.isArray()) {
+            return out;
+        }
+        for (JsonNode entry : tagsNode) {
+            JsonNode resolved = ctx.engine().resolveNode(entry);
+            String key = resolved.path("Key").asText(null);
+            String value = resolved.path("Value").asText("");
+            if (key != null) {
+                out.put(key, value);
+            }
+        }
+        return out;
+    }
+}

src/main/java/io/github/hectorvent/floci/services/cloudformation/provisioners/FirehoseCfnProvisioner.java

@@ -0,0 +1,97 @@
+package io.github.hectorvent.floci.services.cloudformation.provisioners;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import io.github.hectorvent.floci.services.cloudformation.model.StackResource;
+import io.github.hectorvent.floci.services.firehose.FirehoseService;
+import io.github.hectorvent.floci.services.firehose.model.DeliveryStreamDescription;
+import jakarta.enterprise.context.ApplicationScoped;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+
+/** Provisions {@code AWS::KinesisFirehose::DeliveryStream}. */
+@ApplicationScoped
+public class FirehoseCfnProvisioner implements CfnResourceProvisioner {
+
+    private static final int DELIVERY_STREAM_NAME_MAX_LENGTH = 64;
+    private static final int DEFAULT_BUFFER_SIZE_MB = 5;
+    private static final int DEFAULT_BUFFER_INTERVAL_SECONDS = 300;
+
+    private final FirehoseService firehoseService;
+
+    public FirehoseCfnProvisioner(FirehoseService firehoseService) {
+        this.firehoseService = firehoseService;
+    }
+
+    @Override
+    public Set<String> resourceTypes() {
+        return Set.of("AWS::KinesisFirehose::DeliveryStream");
+    }
+
+    @Override
+    public void provision(StackResource r, JsonNode props, ProvisionContext ctx) {
+        String name = ctx.resolveOptional(props, "DeliveryStreamName");
+        if (name == null || name.isBlank()) {
+            name = ctx.generatePhysicalName(r.getLogicalId(), DELIVERY_STREAM_NAME_MAX_LENGTH, false);
+        }
+
+        DeliveryStreamDescription.S3Destination s3 = null;
+        JsonNode s3Node = props != null && props.has("ExtendedS3DestinationConfiguration")
+                ? props.get("ExtendedS3DestinationConfiguration")
+                : (props != null ? props.get("S3DestinationConfiguration") : null);
+        if (s3Node != null && !s3Node.isNull()) {
+            s3 = new DeliveryStreamDescription.S3Destination();
+
+            s3.setCompressionFormat(
+                blankToNull(ctx.engine().resolve(s3Node.path("CompressionFormat")))
+            );
+            s3.setBucketArn(blankToNull(ctx.engine().resolve(s3Node.path("BucketARN"))));
+            s3.setPrefix(blankToNull(ctx.engine().resolve(s3Node.path("Prefix"))));
+            if (s3Node.has("BufferingHints")) {
+                JsonNode hints = s3Node.get("BufferingHints");
+                var bufferingHints = new DeliveryStreamDescription.BufferingHints();
+                bufferingHints.setSizeInMBs(parseIntProp(hints, "SizeInMBs", ctx, DEFAULT_BUFFER_SIZE_MB));
+                bufferingHints.setIntervalInSeconds(
+                        parseIntProp(hints, "IntervalInSeconds", ctx, DEFAULT_BUFFER_INTERVAL_SECONDS));
+                s3.setBufferingHints(bufferingHints);
+            }
+        }
+
+        List<DeliveryStreamDescription.Tag> tags = new ArrayList<>();
+        if (props != null && props.has("Tags") && props.get("Tags").isArray()) {
+            for (JsonNode tag : props.get("Tags")) {
+                String key = ctx.engine().resolve(tag.path("Key"));
+                if (!key.isEmpty()) {
+                    tags.add(new DeliveryStreamDescription.Tag(key, ctx.engine().resolve(tag.path("Value"))));
+                }
+            }
+        }
+
+        String arn = firehoseService.createDeliveryStream(name, s3, tags);
+        // Ref returns the delivery stream name; Fn::GetAtt Arn returns the stream ARN.
+        r.setPhysicalId(name);
+        r.getAttributes().put("Arn", arn);
+    }
+
+    @Override
+    public void delete(String resourceType, String physicalId, String region) {
+        firehoseService.deleteDeliveryStream(physicalId);
+    }
+
+    private static String blankToNull(String value) {
+        return value == null || value.isBlank() ? null : value;
+    }
+
+    private int parseIntProp(JsonNode props, String name, ProvisionContext ctx, int fallback) {
+        String value = ctx.resolveOptional(props, name);
+        if (value == null || value.isBlank()) {
+            return fallback;
+        }
+        try {
+            return Integer.parseInt(value.trim());
+        } catch (NumberFormatException e) {
+            return fallback;
+        }
+    }
+}

src/main/java/io/github/hectorvent/floci/services/cloudformation/provisioners/KmsCfnProvisioner.java

@@ -0,0 +1,91 @@
+package io.github.hectorvent.floci.services.cloudformation.provisioners;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import io.github.hectorvent.floci.services.cloudformation.model.StackResource;
+import io.github.hectorvent.floci.services.kms.KmsService;
+import jakarta.enterprise.context.ApplicationScoped;
+
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Set;
+import java.util.UUID;
+
+/** Provisions {@code AWS::KMS::Key} and {@code AWS::KMS::Alias}. */
+@ApplicationScoped
+public class KmsCfnProvisioner implements CfnResourceProvisioner {
+
+    private static final String KEY = "AWS::KMS::Key";
+    private static final String ALIAS = "AWS::KMS::Alias";
+
+    private final KmsService kmsService;
+
+    public KmsCfnProvisioner(KmsService kmsService) {
+        this.kmsService = kmsService;
+    }
+
+    @Override
+    public Set<String> resourceTypes() {
+        return Set.of(KEY, ALIAS);
+    }
+
+    @Override
+    public void provision(StackResource r, JsonNode props, ProvisionContext ctx) {
+        switch (r.getResourceType()) {
+            case KEY -> provisionKey(r, props, ctx);
+            case ALIAS -> provisionAlias(r, props, ctx);
+            default -> throw new IllegalStateException(
+                    "KmsCfnProvisioner cannot provision " + r.getResourceType());
+        }
+    }
+
+    private void provisionKey(StackResource r, JsonNode props, ProvisionContext ctx) {
+        String description = ctx.resolveOptional(props, "Description");
+        Map<String, String> tags = parseCfnTags(props != null ? props.get("Tags") : null, ctx);
+        var key = kmsService.createKey(description, null, tags, ctx.region());
+        r.setPhysicalId(key.getKeyId());
+        r.getAttributes().put("Arn", key.getArn());
+        r.getAttributes().put("KeyId", key.getKeyId());
+    }
+
+    private void provisionAlias(StackResource r, JsonNode props, ProvisionContext ctx) {
+        String aliasName = ctx.resolveOptional(props, "AliasName");
+        String targetKeyId = ctx.resolveOptional(props, "TargetKeyId");
+        if (aliasName != null && targetKeyId != null) {
+            kmsService.createAlias(aliasName, targetKeyId, ctx.region());
+        }
+        r.setPhysicalId(aliasName != null
+                ? aliasName
+                : "alias/cfn-" + UUID.randomUUID().toString().substring(0, 8));
+    }
+
+    @Override
+    public void delete(String resourceType, String physicalId, String region) {
+        // A KMS key cannot be deleted immediately, only scheduled, so a stack delete leaves it.
+        if (ALIAS.equals(resourceType)) {
+            kmsService.deleteAlias(physicalId, region);
+        }
+    }
+
+    /**
+     * Copied from {@code CloudFormationResourceProvisioner} rather than delegating to
+     * {@link ProvisionContext#resolveTags}, which is not equivalent: it skips a blank key this
+     * keeps, orders entries by insertion rather than hash, and resolves the whole property so an
+     * {@code Fn::If} around the list works. Adopting it here is a behaviour change and belongs in
+     * its own PR; this copy dies when the monolith's last caller migrates.
+     */
+    private Map<String, String> parseCfnTags(JsonNode tagsNode, ProvisionContext ctx) {
+        Map<String, String> out = new HashMap<>();
+        if (tagsNode == null || tagsNode.isNull() || !tagsNode.isArray()) {
+            return out;
+        }
+        for (JsonNode entry : tagsNode) {
+            JsonNode resolved = ctx.engine().resolveNode(entry);
+            String key = resolved.path("Key").asText(null);
+            String value = resolved.path("Value").asText("");
+            if (key != null) {
+                out.put(key, value);
+            }
+        }
+        return out;
+    }
+}