fix(lambda): close the remaining contract validation gaps

Follow-up to #7216, from review on the release PR. Every bound added here is
one the AWS Lambda API reference documents; findings that asked for undocumented
limits were left alone.

Code source selection had two holes. `hasS3` required both S3 fields, so a
partial pair alongside `imageUri` read as "image only" and the stray S3 field
still went to AWS; and an `imageUri` with no `packageType` was accepted even
though the package type then defaults to Zip. Both now fail at the boundary,
naming the field to change, and the zip-only `s3ObjectVersion` and
`sourceKmsKeyArn` count as S3 fields for the exclusivity check.

The VPC guard only checked that both lists were supplied, so supplying both
with one empty passed and produced a partial update. Both must now be empty
(detach) or both populated (attach).

Documented bounds added:

- alias names: 1-128 and the documented pattern, which excludes all-digit names
- descriptions: 256 characters
- layer names: 140 characters and the name-or-ARN pattern
- optional `functionName` on the event source mapping operations: 1-256
- `RemovePermission` statement IDs: 1-100 and its own pattern, which allows a
  dot where `AddPermission` does not

Also rejects values that are structurally meaningless rather than merely
out of range: empty tag keys, empty Kafka bootstrap servers, more than one
weighted routing entry, and an event source mapping that supplies both an
event source ARN and self-managed Kafka bootstrap servers.

Author: waleedlatif1

apps/sim/lib/api/contracts/tools/aws/lambda-create-alias.ts

@@ -16,9 +16,16 @@ const CreateAliasSchema = z.object({
     .string()
     .min(1, 'functionName is required')
     .max(256, 'functionName cannot exceed 256 characters'),
-  aliasName: z.string().min(1, 'aliasName is required'),
+  aliasName: z
+    .string()
+    .min(1, 'aliasName is required')
+    .max(128, 'aliasName cannot exceed 128 characters')
+    .regex(
+      /^(?![0-9]+$)[a-zA-Z0-9-_]+$/,
+      'aliasName may only contain letters, numbers, hyphens, and underscores, and cannot be all digits'
+    ),
   aliasFunctionVersion: z.string().min(1, 'aliasFunctionVersion is required'),
-  description: z.string().optional(),
+  description: z.string().max(256, 'description cannot exceed 256 characters').optional(),
   additionalVersionWeights: z
     .record(
       z.string().regex(/^[0-9]+$/, 'routing keys must be published version numbers'),
@@ -27,6 +34,10 @@ const CreateAliasSchema = z.object({
         .min(0, 'a routing weight cannot be negative')
         .max(1, 'a routing weight cannot exceed 1')
     )
+    .refine(
+      (weights) => Object.keys(weights).length <= 1,
+      'additionalVersionWeights routes to a single second version, so it accepts at most one entry'
+    )
     .optional(),
 })
 

apps/sim/lib/api/contracts/tools/aws/lambda-create-event-source-mapping.ts

@@ -54,16 +54,26 @@ const CreateEventSourceMappingSchema = z
     documentDbFullDocument: z.enum(['UpdateLookup', 'Default']).optional(),
     amazonManagedKafkaConsumerGroupId: z.string().optional(),
     selfManagedKafkaConsumerGroupId: z.string().optional(),
-    selfManagedKafkaBootstrapServers: z.array(z.string()).optional(),
+    selfManagedKafkaBootstrapServers: z
+      .array(z.string().min(1, 'a bootstrap server cannot be empty'))
+      .optional(),
   })
   .superRefine((value, ctx) => {
-    if (!value.eventSourceArn && !value.selfManagedKafkaBootstrapServers?.length) {
+    const hasBootstrapServers = Boolean(value.selfManagedKafkaBootstrapServers?.length)
+    if (!value.eventSourceArn && !hasBootstrapServers) {
       ctx.addIssue({
         code: 'custom',
         path: ['eventSourceArn'],
         message:
           'An event source is required: provide eventSourceArn, or selfManagedKafkaBootstrapServers for a self-managed Kafka cluster',
       })
+    } else if (value.eventSourceArn && hasBootstrapServers) {
+      ctx.addIssue({
+        code: 'custom',
+        path: ['selfManagedKafkaBootstrapServers'],
+        message:
+          'A mapping has one event source: provide eventSourceArn, or selfManagedKafkaBootstrapServers, not both',
+      })
     }
     if (value.startingPosition === 'AT_TIMESTAMP' && !value.startingPositionTimestamp) {
       ctx.addIssue({

apps/sim/lib/api/contracts/tools/aws/lambda-create-function.ts

@@ -26,7 +26,7 @@ const CreateFunctionSchema = z
     s3ObjectVersion: z.string().optional(),
     imageUri: z.string().optional(),
     sourceKmsKeyArn: z.string().optional(),
-    description: z.string().optional(),
+    description: z.string().max(256, 'description cannot exceed 256 characters').optional(),
     functionTimeout: z.number().int().min(1).max(900).optional(),
     memorySize: z.number().int().min(128).max(32768).optional(),
     ephemeralStorageSize: z.number().int().min(512).max(10240).optional(),
@@ -48,36 +48,41 @@ const CreateFunctionSchema = z
     logGroup: z.string().optional(),
   })
   .superRefine((value, ctx) => {
+    const hasAnyZipField = Boolean(
+      value.s3Bucket || value.s3Key || value.s3ObjectVersion || value.sourceKmsKeyArn
+    )
     const hasS3 = Boolean(value.s3Bucket && value.s3Key)
-    if (!hasS3 && !value.imageUri) {
+    if (value.imageUri && hasAnyZipField) {
       ctx.addIssue({
         code: 'custom',
-        path: ['s3Bucket'],
+        path: ['imageUri'],
         message:
-          'A code source is required: provide s3Bucket and s3Key for a .zip package, or imageUri for a container image',
+          'Provide either a .zip package (s3Bucket, s3Key, s3ObjectVersion, sourceKmsKeyArn) or imageUri, not both',
       })
       return
     }
-    if (hasS3 && value.imageUri) {
+    if (!value.imageUri && !hasS3) {
       ctx.addIssue({
         code: 'custom',
-        path: ['imageUri'],
-        message: 'Provide either an S3 package or imageUri, not both',
+        path: hasAnyZipField ? ['s3Key'] : ['s3Bucket'],
+        message: hasAnyZipField
+          ? 's3Bucket and s3Key must be provided together for a .zip package'
+          : 'A code source is required: provide s3Bucket and s3Key for a .zip package, or imageUri for a container image',
       })
       return
     }
-    if (value.packageType === 'Image' && hasS3) {
+    if (value.imageUri && value.packageType !== 'Image') {
       ctx.addIssue({
         code: 'custom',
-        path: ['imageUri'],
-        message: 'packageType Image requires imageUri, not an S3 package',
+        path: ['packageType'],
+        message: 'packageType must be Image when imageUri is set',
       })
     }
-    if (value.packageType === 'Zip' && value.imageUri) {
+    if (hasS3 && value.packageType === 'Image') {
       ctx.addIssue({
         code: 'custom',
-        path: ['s3Bucket'],
-        message: 'packageType Zip requires an S3 package, not imageUri',
+        path: ['imageUri'],
+        message: 'packageType Image requires imageUri, not an S3 package',
       })
     }
     if (hasS3) {
@@ -96,15 +101,26 @@ const CreateFunctionSchema = z
         })
       }
     }
-    const hasSubnets = value.vpcSubnetIds !== undefined
-    const hasSecurityGroups = value.vpcSecurityGroupIds !== undefined
-    if (hasSubnets !== hasSecurityGroups) {
+    const subnetIds = value.vpcSubnetIds
+    const securityGroupIds = value.vpcSecurityGroupIds
+    if ((subnetIds === undefined) !== (securityGroupIds === undefined)) {
       ctx.addIssue({
         code: 'custom',
-        path: [hasSubnets ? 'vpcSecurityGroupIds' : 'vpcSubnetIds'],
+        path: [subnetIds === undefined ? 'vpcSubnetIds' : 'vpcSecurityGroupIds'],
         message:
           'vpcSubnetIds and vpcSecurityGroupIds must be supplied together: send both lists to attach a VPC, or both empty to detach',
       })
+    } else if (
+      subnetIds !== undefined &&
+      securityGroupIds !== undefined &&
+      (subnetIds.length === 0) !== (securityGroupIds.length === 0)
+    ) {
+      ctx.addIssue({
+        code: 'custom',
+        path: [subnetIds.length === 0 ? 'vpcSubnetIds' : 'vpcSecurityGroupIds'],
+        message:
+          'vpcSubnetIds and vpcSecurityGroupIds must both be empty to detach, or both be populated to attach',
+      })
     }
   })
 

apps/sim/lib/api/contracts/tools/aws/lambda-delete-alias.ts

@@ -16,7 +16,14 @@ const DeleteAliasSchema = z.object({
     .string()
     .min(1, 'functionName is required')
     .max(256, 'functionName cannot exceed 256 characters'),
-  aliasName: z.string().min(1, 'aliasName is required'),
+  aliasName: z
+    .string()
+    .min(1, 'aliasName is required')
+    .max(128, 'aliasName cannot exceed 128 characters')
+    .regex(
+      /^(?![0-9]+$)[a-zA-Z0-9-_]+$/,
+      'aliasName may only contain letters, numbers, hyphens, and underscores, and cannot be all digits'
+    ),
 })
 
 const DeleteAliasResponseSchema = lambdaMessageResponseSchema

apps/sim/lib/api/contracts/tools/aws/lambda-get-alias.ts

@@ -16,7 +16,14 @@ const GetAliasSchema = z.object({
     .string()
     .min(1, 'functionName is required')
     .max(256, 'functionName cannot exceed 256 characters'),
-  aliasName: z.string().min(1, 'aliasName is required'),
+  aliasName: z
+    .string()
+    .min(1, 'aliasName is required')
+    .max(128, 'aliasName cannot exceed 128 characters')
+    .regex(
+      /^(?![0-9]+$)[a-zA-Z0-9-_]+$/,
+      'aliasName may only contain letters, numbers, hyphens, and underscores, and cannot be all digits'
+    ),
 })
 
 const GetAliasResponseSchema = z.object({

apps/sim/lib/api/contracts/tools/aws/lambda-get-layer-version.ts

@@ -12,7 +12,14 @@ import { defineRouteContract } from '@/lib/api/contracts/types'
 
 const GetLayerVersionSchema = z.object({
   ...lambdaConnectionFields,
-  layerName: z.string().min(1, 'layerName is required'),
+  layerName: z
+    .string()
+    .min(1, 'layerName is required')
+    .max(140, 'layerName cannot exceed 140 characters')
+    .regex(
+      /^(arn:[a-zA-Z0-9-]+:lambda:[a-zA-Z0-9-]+:d{12}:layer:[a-zA-Z0-9-_]+)$|^[a-zA-Z0-9-_]+$/,
+      'layerName must be a layer name or a layer ARN'
+    ),
   versionNumber: z.number().int().min(1, 'versionNumber must be at least 1'),
 })
 

apps/sim/lib/api/contracts/tools/aws/lambda-list-event-source-mappings.ts

@@ -14,7 +14,11 @@ import { defineRouteContract } from '@/lib/api/contracts/types'
 const ListEventSourceMappingsSchema = z.object({
   ...lambdaConnectionFields,
   ...lambdaPaginationFields,
-  functionName: z.string().optional(),
+  functionName: z
+    .string()
+    .min(1, 'functionName cannot be empty')
+    .max(256, 'functionName cannot exceed 256 characters')
+    .optional(),
   eventSourceArn: z.string().optional(),
 })
 

apps/sim/lib/api/contracts/tools/aws/lambda-list-layer-versions.ts

@@ -14,7 +14,14 @@ import { defineRouteContract } from '@/lib/api/contracts/types'
 const ListLayerVersionsSchema = z.object({
   ...lambdaConnectionFields,
   ...lambdaSmallPaginationFields,
-  layerName: z.string().min(1, 'layerName is required'),
+  layerName: z
+    .string()
+    .min(1, 'layerName is required')
+    .max(140, 'layerName cannot exceed 140 characters')
+    .regex(
+      /^(arn:[a-zA-Z0-9-]+:lambda:[a-zA-Z0-9-]+:d{12}:layer:[a-zA-Z0-9-_]+)$|^[a-zA-Z0-9-_]+$/,
+      'layerName must be a layer name or a layer ARN'
+    ),
   compatibleRuntime: z.string().optional(),
   compatibleArchitecture: z.enum(['x86_64', 'arm64']).optional(),
 })

apps/sim/lib/api/contracts/tools/aws/lambda-publish-version.ts

@@ -17,7 +17,7 @@ const PublishVersionSchema = z.object({
     .min(1, 'functionName is required')
     .max(256, 'functionName cannot exceed 256 characters'),
   codeSha256: z.string().optional(),
-  description: z.string().optional(),
+  description: z.string().max(256, 'description cannot exceed 256 characters').optional(),
   revisionId: z.string().optional(),
 })
 

apps/sim/lib/api/contracts/tools/aws/lambda-remove-permission.ts

@@ -16,7 +16,14 @@ const RemovePermissionSchema = z.object({
     .string()
     .min(1, 'functionName is required')
     .max(256, 'functionName cannot exceed 256 characters'),
-  statementId: z.string().min(1, 'statementId is required'),
+  statementId: z
+    .string()
+    .min(1, 'statementId is required')
+    .max(100, 'statementId cannot exceed 100 characters')
+    .regex(
+      /^[a-zA-Z0-9-_.]+$/,
+      'statementId may only contain letters, numbers, hyphens, underscores, and dots'
+    ),
   qualifier: z
     .string()
     .min(1, 'qualifier cannot be empty')