ac5bd78d5a
- workspace-mcp: add proxy.py (port 8080) that reads X-Actor-Id header,
fetches per-user Google credentials from Secrets Manager, writes creds
file, sets USER_GOOGLE_EMAIL, proxies to workspace-mcp on port 8081
- workspace-mcp: update bootstrap to start workspace-mcp on 8081 + proxy on 8080
- workspace-mcp: update Dockerfile to include proxy.py
- oauth-handler Lambda: new Lambda with /oauth/start + /oauth/callback
routes; exchanges Google auth code, stores tokens in Secrets Manager
at agent-claw/google-credentials/{actor_id_safe}, updates DynamoDB
- CDK: add OAuthHandler Lambda + GET /oauth/start + /oauth/callback routes
- CDK: remove shared google-workspace-credentials secret; add per-user
secret IAM grants (agent-claw/google-credentials/*) for workspace-mcp
role, runtime1 role, and oauth-handler role
- CDK: output OAuthStartUrl + OAuthRedirectUri
- agent-runner: pass google_email in user_profile payload
- main.py: pass actor_id as X-Actor-Id header in workspace-mcp MCP calls;
skip workspace-mcp if user has no google_email; add connect_google_account
tool that generates OAuth URL for the current user
- main.py: include google_email in user_context for system prompt
- agentcore.json: add OAUTH_START_URL env var for agent runtime
314 lines
18 KiB
JavaScript
314 lines
18 KiB
JavaScript
"use strict";
|
|
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
if (k2 === undefined) k2 = k;
|
|
var desc = Object.getOwnPropertyDescriptor(m, k);
|
|
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
|
desc = { enumerable: true, get: function() { return m[k]; } };
|
|
}
|
|
Object.defineProperty(o, k2, desc);
|
|
}) : (function(o, m, k, k2) {
|
|
if (k2 === undefined) k2 = k;
|
|
o[k2] = m[k];
|
|
}));
|
|
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
|
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
}) : function(o, v) {
|
|
o["default"] = v;
|
|
});
|
|
var __importStar = (this && this.__importStar) || (function () {
|
|
var ownKeys = function(o) {
|
|
ownKeys = Object.getOwnPropertyNames || function (o) {
|
|
var ar = [];
|
|
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
|
|
return ar;
|
|
};
|
|
return ownKeys(o);
|
|
};
|
|
return function (mod) {
|
|
if (mod && mod.__esModule) return mod;
|
|
var result = {};
|
|
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
|
|
__setModuleDefault(result, mod);
|
|
return result;
|
|
};
|
|
})();
|
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
exports.AgentClawStack = void 0;
|
|
const cdk = __importStar(require("aws-cdk-lib"));
|
|
const s3 = __importStar(require("aws-cdk-lib/aws-s3"));
|
|
const s3deploy = __importStar(require("aws-cdk-lib/aws-s3-deployment"));
|
|
const dynamodb = __importStar(require("aws-cdk-lib/aws-dynamodb"));
|
|
const sqs = __importStar(require("aws-cdk-lib/aws-sqs"));
|
|
const lambda = __importStar(require("aws-cdk-lib/aws-lambda"));
|
|
const apigatewayv2 = __importStar(require("aws-cdk-lib/aws-apigatewayv2"));
|
|
const apigatewayv2integrations = __importStar(require("aws-cdk-lib/aws-apigatewayv2-integrations"));
|
|
const iam = __importStar(require("aws-cdk-lib/aws-iam"));
|
|
const secretsmanager = __importStar(require("aws-cdk-lib/aws-secretsmanager"));
|
|
const aws_lambda_event_sources_1 = require("aws-cdk-lib/aws-lambda-event-sources");
|
|
const path = __importStar(require("path"));
|
|
class AgentClawStack extends cdk.Stack {
|
|
constructor(scope, id, props) {
|
|
super(scope, id, props);
|
|
// ── Context parameters ─────────────────────────────────────────────────
|
|
const telegramBotTokenSecretArn = this.node.tryGetContext('telegramBotTokenSecretArn');
|
|
const braveApiKeySecretArn = this.node.tryGetContext('braveApiKeySecretArn');
|
|
const existingWorkspaceBucketName = this.node.tryGetContext('workspaceBucketName');
|
|
const runtime1Arn = this.node.tryGetContext('runtime1Arn');
|
|
if (!telegramBotTokenSecretArn) {
|
|
throw new Error('Context param required: telegramBotTokenSecretArn');
|
|
}
|
|
if (!braveApiKeySecretArn) {
|
|
throw new Error('Context param required: braveApiKeySecretArn');
|
|
}
|
|
// ── Secrets (reference existing) ───────────────────────────────────────
|
|
const botTokenSecret = secretsmanager.Secret.fromSecretCompleteArn(this, 'TelegramBotToken', telegramBotTokenSecretArn);
|
|
const braveApiKeySecret = secretsmanager.Secret.fromSecretCompleteArn(this, 'BraveApiKey', braveApiKeySecretArn);
|
|
// ── S3 workspace bucket ────────────────────────────────────────────────
|
|
const workspaceBucket = existingWorkspaceBucketName
|
|
? s3.Bucket.fromBucketName(this, 'WorkspaceBucket', existingWorkspaceBucketName)
|
|
: new s3.Bucket(this, 'WorkspaceBucket', {
|
|
bucketName: `agent-claw-workspace-${this.account}`,
|
|
removalPolicy: cdk.RemovalPolicy.RETAIN,
|
|
versioned: false,
|
|
encryption: s3.BucketEncryption.S3_MANAGED,
|
|
});
|
|
// Seed workspace files on deploy (only if bucket was created by us)
|
|
if (!existingWorkspaceBucketName) {
|
|
new s3deploy.BucketDeployment(this, 'WorkspaceFiles', {
|
|
sources: [s3deploy.Source.asset(path.join(__dirname, '../../workspace'))],
|
|
destinationBucket: workspaceBucket,
|
|
});
|
|
}
|
|
// ── DynamoDB session store ─────────────────────────────────────────────
|
|
const sessionTable = new dynamodb.Table(this, 'SessionStore', {
|
|
tableName: 'agent-claw-sessions',
|
|
partitionKey: { name: 'actor_id', type: dynamodb.AttributeType.STRING },
|
|
billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
|
|
timeToLiveAttribute: 'ttl',
|
|
removalPolicy: cdk.RemovalPolicy.RETAIN,
|
|
});
|
|
// ── DynamoDB user registry ─────────────────────────────────────────────
|
|
const usersTable = new dynamodb.Table(this, 'UsersTable', {
|
|
tableName: 'agent-claw-users',
|
|
partitionKey: { name: 'actor_id', type: dynamodb.AttributeType.STRING },
|
|
billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
|
|
removalPolicy: cdk.RemovalPolicy.RETAIN,
|
|
});
|
|
// ── SQS FIFO message queue ─────────────────────────────────────────────
|
|
const messageQueue = new sqs.Queue(this, 'MessageQueue', {
|
|
queueName: 'agent-claw-messages.fifo',
|
|
fifo: true,
|
|
contentBasedDeduplication: false,
|
|
visibilityTimeout: cdk.Duration.seconds(900),
|
|
receiveMessageWaitTime: cdk.Duration.seconds(20),
|
|
});
|
|
// ── Lambda: tg-ingest ─────────────────────────────────────────────────
|
|
const tgIngestFn = new lambda.Function(this, 'TgIngest', {
|
|
functionName: 'agent-claw-tg-ingest',
|
|
runtime: lambda.Runtime.PYTHON_3_12,
|
|
handler: 'handler.handler',
|
|
code: lambda.Code.fromAsset(path.join(__dirname, '../../src/lambdas/tg-ingest')),
|
|
timeout: cdk.Duration.seconds(10),
|
|
memorySize: 128,
|
|
environment: {
|
|
MESSAGE_QUEUE_URL: messageQueue.queueUrl,
|
|
TELEGRAM_BOT_TOKEN_SECRET_ARN: telegramBotTokenSecretArn,
|
|
TELEGRAM_WEBHOOK_SECRET: '', // set via SSM or direct env after deploy
|
|
},
|
|
});
|
|
messageQueue.grantSendMessages(tgIngestFn);
|
|
botTokenSecret.grantRead(tgIngestFn);
|
|
// ── Lambda: agent-runner ───────────────────────────────────────────────
|
|
const agentRunnerFn = new lambda.Function(this, 'AgentRunner', {
|
|
functionName: 'agent-claw-agent-runner',
|
|
runtime: lambda.Runtime.PYTHON_3_12,
|
|
handler: 'handler.handler',
|
|
code: lambda.Code.fromAsset(path.join(__dirname, '../../src/lambdas/agent-runner')),
|
|
timeout: cdk.Duration.seconds(900),
|
|
memorySize: 256,
|
|
environment: {
|
|
SESSION_TABLE_NAME: sessionTable.tableName,
|
|
WORKSPACE_BUCKET_NAME: workspaceBucket.bucketName,
|
|
TELEGRAM_BOT_TOKEN_SECRET_ARN: telegramBotTokenSecretArn,
|
|
BRAVE_API_KEY_SECRET_ARN: braveApiKeySecretArn,
|
|
RUNTIME_1_ARN: runtime1Arn ?? 'PLACEHOLDER_SET_AFTER_RUNTIME_DEPLOY',
|
|
AWS_REGION_NAME: 'us-east-1',
|
|
},
|
|
});
|
|
sessionTable.grantReadWriteData(agentRunnerFn);
|
|
usersTable.grantReadWriteData(agentRunnerFn);
|
|
agentRunnerFn.addEnvironment('USERS_TABLE_NAME', usersTable.tableName);
|
|
workspaceBucket.grantRead(agentRunnerFn);
|
|
botTokenSecret.grantRead(agentRunnerFn);
|
|
braveApiKeySecret.grantRead(agentRunnerFn);
|
|
messageQueue.grantConsumeMessages(agentRunnerFn);
|
|
// AgentCore invoke permission
|
|
agentRunnerFn.addToRolePolicy(new iam.PolicyStatement({
|
|
actions: ['bedrock-agentcore:InvokeAgentRuntime'],
|
|
resources: ['*'],
|
|
}));
|
|
// SQS event source
|
|
agentRunnerFn.addEventSource(new aws_lambda_event_sources_1.SqsEventSource(messageQueue, {
|
|
batchSize: 10,
|
|
enabled: true,
|
|
}));
|
|
// ── API Gateway HTTP ───────────────────────────────────────────────────
|
|
const httpApi = new apigatewayv2.HttpApi(this, 'WebhookApi', {
|
|
apiName: 'agent-claw-webhook',
|
|
});
|
|
httpApi.addRoutes({
|
|
path: '/telegram',
|
|
methods: [apigatewayv2.HttpMethod.POST],
|
|
integration: new apigatewayv2integrations.HttpLambdaIntegration('TgIngestIntegration', tgIngestFn),
|
|
});
|
|
// ── AgentCore Runtime 1 ────────────────────────────────────────────────
|
|
// NOTE: AgentCore CDK L2 constructs are in preview. Using CfnResource.
|
|
// The runtime1Arn output below needs to be fed back as context param
|
|
// on subsequent deploys so agent-runner can invoke it.
|
|
// IAM execution role for Runtime 1
|
|
const runtime1Role = new iam.Role(this, 'Runtime1Role', {
|
|
assumedBy: new iam.ServicePrincipal('bedrock-agentcore.amazonaws.com'),
|
|
description: 'Execution role for agent-claw Runtime 1 (main assistant)',
|
|
});
|
|
runtime1Role.addToPolicy(new iam.PolicyStatement({
|
|
actions: [
|
|
'bedrock:InvokeModel',
|
|
'bedrock:InvokeModelWithResponseStream',
|
|
],
|
|
resources: ['*'],
|
|
}));
|
|
workspaceBucket.grantRead(runtime1Role);
|
|
botTokenSecret.grantRead(runtime1Role);
|
|
braveApiKeySecret.grantRead(runtime1Role);
|
|
// Google secret grants added after workspace_mcp section below
|
|
runtime1Role.addToPolicy(new iam.PolicyStatement({
|
|
actions: [
|
|
'bedrock-agentcore:CreateEvent',
|
|
'bedrock-agentcore:ListEvents',
|
|
'bedrock-agentcore:RetrieveMemoryRecords',
|
|
],
|
|
resources: ['*'],
|
|
}));
|
|
// AgentCore Runtime 1 resource (CfnResource — L2 in preview)
|
|
// CodeZip: packages src/runtime-1/ as a zip and uploads to S3
|
|
// TODO: Replace with L2 construct when aws-cdk-lib includes it stable
|
|
// For now, the runtime ARN must be created manually or via CLI after first synth
|
|
// and fed back as context param runtime1Arn.
|
|
// ── Google Workspace MCP ──────────────────────────────────────────────
|
|
const googleOAuthClientSecret = secretsmanager.Secret.fromSecretNameV2(this, 'GoogleOAuthClient', 'agent-claw/google-oauth-client');
|
|
// workspace-mcp Lambda execution role (import existing — created during initial setup)
|
|
const _workspaceMcpRole = iam.Role.fromRoleName(this, 'WorkspaceMcpRole', 'agent-claw-workspace-mcp-role');
|
|
googleOAuthClientSecret.grantRead(_workspaceMcpRole);
|
|
// Grant workspace-mcp role read access to all per-user Google credential secrets
|
|
_workspaceMcpRole.addToPrincipalPolicy?.(new iam.PolicyStatement({
|
|
sid: 'PerUserGoogleCredentialsRead',
|
|
actions: ['secretsmanager:GetSecretValue'],
|
|
resources: [`arn:aws:secretsmanager:${this.region}:${this.account}:secret:agent-claw/google-credentials/*`],
|
|
}));
|
|
// workspace-mcp Lambda — import existing (created with zip + layer, no Docker)
|
|
const workspaceMcpFn = lambda.Function.fromFunctionName(this, 'WorkspaceMcp', 'agent-claw-workspace-mcp');
|
|
// Function URL — AWS_IAM auth (already created, reference for policy attachment)
|
|
const workspaceMcpFunctionUrl = 'https://25hugrzw4uwtueeg77jsmft6lq0wunmd.lambda-url.us-east-1.on.aws';
|
|
const workspaceMcpMcpUrl = workspaceMcpFunctionUrl + '/mcp';
|
|
// AgentCore execution role — grant InvokeFunctionUrl identity policy
|
|
runtime1Role.addToPolicy(new iam.PolicyStatement({
|
|
sid: 'WorkspaceMcpInvoke',
|
|
actions: ['lambda:InvokeFunctionUrl'],
|
|
resources: [workspaceMcpFn.functionArn],
|
|
conditions: { StringEquals: { 'lambda:FunctionUrlAuthType': 'AWS_IAM' } },
|
|
}));
|
|
// Grant AgentCore execution role read access to Google OAuth client + per-user credentials
|
|
googleOAuthClientSecret.grantRead(runtime1Role);
|
|
runtime1Role.addToPolicy(new iam.PolicyStatement({
|
|
sid: 'PerUserGoogleCredentialsReadRuntime',
|
|
actions: ['secretsmanager:GetSecretValue'],
|
|
resources: [`arn:aws:secretsmanager:${this.region}:${this.account}:secret:agent-claw/google-credentials/*`],
|
|
}));
|
|
// Pass workspace_mcp MCP URL to agent-runner (informational)
|
|
agentRunnerFn.addEnvironment('WORKSPACE_MCP_URL', workspaceMcpMcpUrl);
|
|
// ── OAuth Handler Lambda ───────────────────────────────────────────────
|
|
const oauthHandlerFn = new lambda.Function(this, 'OAuthHandler', {
|
|
functionName: 'agent-claw-oauth-handler',
|
|
runtime: lambda.Runtime.PYTHON_3_12,
|
|
handler: 'handler.handler',
|
|
code: lambda.Code.fromAsset(path.join(__dirname, '../../src/lambdas/oauth-handler')),
|
|
timeout: cdk.Duration.seconds(30),
|
|
memorySize: 128,
|
|
environment: {
|
|
GOOGLE_OAUTH_CLIENT_SECRET_ARN: googleOAuthClientSecret.secretArn,
|
|
USERS_TABLE_NAME: usersTable.tableName,
|
|
// OAUTH_REDIRECT_URI set after API GW URL is known — injected via addEnvironment below
|
|
OAUTH_REDIRECT_URI: 'PLACEHOLDER',
|
|
},
|
|
});
|
|
googleOAuthClientSecret.grantRead(oauthHandlerFn);
|
|
usersTable.grantReadWriteData(oauthHandlerFn);
|
|
// Grant OAuth handler write access to per-user credential secrets
|
|
oauthHandlerFn.addToRolePolicy(new iam.PolicyStatement({
|
|
sid: 'PerUserGoogleCredentialsWrite',
|
|
actions: [
|
|
'secretsmanager:CreateSecret',
|
|
'secretsmanager:PutSecretValue',
|
|
'secretsmanager:GetSecretValue',
|
|
],
|
|
resources: [`arn:aws:secretsmanager:${this.region}:${this.account}:secret:agent-claw/google-credentials/*`],
|
|
}));
|
|
// Add OAuth routes to existing HTTP API
|
|
httpApi.addRoutes({
|
|
path: '/oauth/start',
|
|
methods: [apigatewayv2.HttpMethod.GET],
|
|
integration: new apigatewayv2integrations.HttpLambdaIntegration('OAuthStartIntegration', oauthHandlerFn),
|
|
});
|
|
httpApi.addRoutes({
|
|
path: '/oauth/callback',
|
|
methods: [apigatewayv2.HttpMethod.GET],
|
|
integration: new apigatewayv2integrations.HttpLambdaIntegration('OAuthCallbackIntegration', oauthHandlerFn),
|
|
});
|
|
// Set OAUTH_REDIRECT_URI now that we have the API URL
|
|
const oauthRedirectUri = `${httpApi.url}oauth/callback`;
|
|
oauthHandlerFn.addEnvironment('OAUTH_REDIRECT_URI', oauthRedirectUri);
|
|
// Pass OAuth start URL to AgentCore runtime so agent can generate connect links
|
|
const oauthStartUrl = `${httpApi.url}oauth/start`;
|
|
// NOTE: AgentCore runtime env vars are set in agentcore.json / agentcore deploy, not CDK.
|
|
// Output the URL so it can be manually set in agentcore.json OAUTH_START_URL.
|
|
// ── Outputs ────────────────────────────────────────────────────────────
|
|
new cdk.CfnOutput(this, 'WorkspaceMcpFunctionUrl', {
|
|
value: workspaceMcpFunctionUrl,
|
|
description: 'workspace-mcp Lambda Function URL (MCP endpoint for Gmail/Calendar)',
|
|
});
|
|
new cdk.CfnOutput(this, 'OAuthStartUrl', {
|
|
value: oauthStartUrl,
|
|
description: 'Google OAuth start URL — set as OAUTH_START_URL in agentcore.json',
|
|
});
|
|
new cdk.CfnOutput(this, 'OAuthRedirectUri', {
|
|
value: oauthRedirectUri,
|
|
description: 'Google OAuth redirect URI — register in Google Cloud Console',
|
|
});
|
|
new cdk.CfnOutput(this, 'WebhookUrl', {
|
|
value: `${httpApi.url}telegram`,
|
|
description: 'Register this URL with Telegram BotFather as webhook endpoint',
|
|
});
|
|
new cdk.CfnOutput(this, 'WorkspaceBucketName', {
|
|
value: workspaceBucket.bucketName,
|
|
description: 'S3 bucket containing agent workspace files',
|
|
});
|
|
new cdk.CfnOutput(this, 'SessionTableName', {
|
|
value: sessionTable.tableName,
|
|
description: 'DynamoDB table for session mapping',
|
|
});
|
|
new cdk.CfnOutput(this, 'UsersTableName', {
|
|
value: usersTable.tableName,
|
|
description: 'DynamoDB user registry table',
|
|
});
|
|
new cdk.CfnOutput(this, 'MessageQueueUrl', {
|
|
value: messageQueue.queueUrl,
|
|
description: 'SQS FIFO queue for incoming messages',
|
|
});
|
|
new cdk.CfnOutput(this, 'Runtime1RoleArn', {
|
|
value: runtime1Role.roleArn,
|
|
description: 'IAM execution role ARN for AgentCore Runtime 1',
|
|
});
|
|
}
|
|
}
|
|
exports.AgentClawStack = AgentClawStack;
|