fix(certificatemanager): remove bundled lambda devdependencies

packages/@aws-cdk/aws-certificatemanager/.npmignore

@@ -13,4 +13,7 @@ dist
 # Include .jsii
 !.jsii
 
-*.snk
+*.snk
+
+# Don't pack node_modules directories of the lambdas in there. They should only be dev dependencies.
+lambda-packages/dns_validated_certificate_handler/node_modules

packages/@aws-cdk/aws-certificatemanager/package.json

@@ -81,4 +81,4 @@
  "engines": {
  "node": ">= 8.10.0"
  }
-}
+}

tools/pkglint/lib/packagejson.ts

@@ -49,6 +49,10 @@ export interface Report {
  * Class representing a package.json file and the issues we found with it
  */
 export class PackageJson {
+ public static fromDirectory(dir: string) {
+ return new PackageJson(path.join(dir, 'package.json'));
+ }
+
  public readonly json: { [key: string]: any };
  public readonly packageRoot: string;
  public readonly packageName: string;

tools/pkglint/lib/rules.ts

@@ -4,7 +4,7 @@ import path = require('path');
 import semver = require('semver');
 import { LICENSE, NOTICE } from './licensing';
 import { PackageJson, ValidationRule } from './packagejson';
-import { deepGet, deepSet, expectDevDependency, expectJSON, fileShouldBe, fileShouldContain, monoRepoVersion } from './util';
+import { deepGet, deepSet, expectDevDependency, expectJSON, fileShouldBe, fileShouldContain, findInnerPackages, monoRepoVersion } from './util';
 
 /**
  * Verify that the package name matches the directory name
@@ -750,6 +750,36 @@ export class JestCoverageTarget extends ValidationRule {
  }
 }
 
+/**
+ * Packages inside JSII packages (typically used for embedding Lambda handles)
+ * must only have dev dependencies and their node_modules must have been
+ * blacklisted for publishing
+ *
+ * We might loosen this at some point but we'll have to bundle all runtime dependencies
+ * and we don't have good transitive license checks.
+ */
+export class PackageInJsiiPackageNoRuntimeDeps extends ValidationRule {
+ public name = 'lambda-packages-no-runtime-deps';
+
+ public validate(pkg: PackageJson) {
+ if (!isJSII(pkg)) { return; }
+
+ for (const inner of findInnerPackages(pkg.packageRoot)) {
+ const innerPkg = PackageJson.fromDirectory(inner);
+
+ if (Object.keys(innerPkg.dependencies).length > 0) {
+ pkg.report({
+ ruleName: `${this.name}:1`,
+ message: `NPM Package '${innerPkg.packageName}' inside jsii package can only have devDepencencies`
+ });
+ }
+
+ const nodeModulesRelPath = path.relative(pkg.packageRoot, innerPkg.packageRoot) + '/node_modules';
+ fileShouldContain(`${this.name}:2`, pkg, '.npmignore', nodeModulesRelPath);
+ }
+ }
+}
+
 /**
  * Determine whether this is a JSII package
  *

tools/pkglint/lib/util.ts

@@ -133,19 +133,37 @@ export function monoRepoVersion() {
  return lernaJson.version;
 }
 
-function findLernaJSON() {
- let dir = process.cwd();
+export function findUpward(dir: string, pred: (x: string) => boolean): string | undefined {
  while (true) {
- const fullPath = path.join(dir, 'lerna.json');
- if (fs.existsSync(fullPath)) {
- return fullPath;
- }
+ if (pred(dir)) { return dir; }
 
  const parent = path.dirname(dir);
  if (parent === dir) {
- throw new Error('Could not find lerna.json');
+ return undefined;
  }
 
  dir = parent;
  }
 }
+
+function findLernaJSON() {
+ const ret = findUpward(process.cwd(), d => fs.existsSync(path.join(d, 'lerna.json')));
+ if (!ret) {
+ throw new Error('Could not find lerna.json');
+ }
+ return path.join(ret, 'lerna.json');
+}
+
+export function* findInnerPackages(dir: string): IterableIterator<string> {
+ for (const fname of fs.readdirSync(dir, { encoding: 'utf8' })) {
+ const stat = fs.statSync(path.join(dir, fname));
+ if (!stat.isDirectory()) { continue; }
+ if (fname === 'node_modules') { continue; }
+
+ if (fs.existsSync(path.join(dir, fname, 'package.json'))) {
+ yield path.join(dir, fname);
+ }
+
+ yield* findInnerPackages(path.join(dir, fname));
+ }
+}