entrypoint.sh

#!/bin/bash -l

set -eo pipefail

# Constants
DEFAULT_AWS_REGION="us-east-1"
MAX_PATHS_PER_INVALIDATION=3000
MAX_PATH_LENGTH=255

# Logging functions
log_info() {
    echo "[INFO] $(date '+%Y-%m-%d %H:%M:%S') - $1"
}

log_error() {
    echo "[ERROR] $(date '+%Y-%m-%d %H:%M:%S') - $1" >&2
}

log_debug() {
    if [ "$DEBUG" = "1" ]; then
        echo "[DEBUG] $(date '+%Y-%m-%d %H:%M:%S') - $1"
    fi
}

# Validation functions
validate_distribution_id() {
    local distribution="$1"
    if [[ -z "$distribution" ]]; then
        log_error "DISTRIBUTION is not set"
        return 1
    fi
    
    # CloudFront distribution IDs are typically 14 characters and start with E
    if [[ ! "$distribution" =~ ^E[A-Z0-9]{13}$ ]]; then
        log_error "Invalid CloudFront distribution ID format: $distribution"
        return 1
    fi
    
    return 0
}

validate_aws_region() {
    local region="$1"
    if [[ -z "$region" ]]; then
        log_error "AWS_REGION is not set"
        return 1
    fi
    
    # Basic AWS region validation
    if [[ ! "$region" =~ ^[a-z]{2}-[a-z]+-[0-9]+$ ]]; then
        log_error "Invalid AWS region format: $region"
        return 1
    fi
    
    return 0
}

validate_paths() {
    local paths="$1"
    if [[ -z "$paths" ]]; then
        log_error "PATHS is empty"
        return 1
    fi
    
    # Check for maximum paths limit
    local path_count=$(echo "$paths" | wc -w)
    if [[ $path_count -gt $MAX_PATHS_PER_INVALIDATION ]]; then
        log_error "Too many paths ($path_count). Maximum allowed is $MAX_PATHS_PER_INVALIDATION"
        return 1
    fi
    
    # Validate each path
    while IFS= read -r -d ' ' path; do
        if [[ -n "$path" ]]; then
            # Check path length
            if [[ ${#path} -gt $MAX_PATH_LENGTH ]]; then
                log_error "Path too long: $path (max $MAX_PATH_LENGTH characters)"
                return 1
            fi
            
            # Check path format
            if [[ ! "$path" =~ ^/.* ]]; then
                log_error "Invalid path format (must start with /): $path"
                return 1
            fi
        fi
    done <<< "$paths "
    
    return 0
}

validate_aws_credentials() {
    if [[ -z "$AWS_ACCESS_KEY_ID" ]]; then
        log_error "AWS_ACCESS_KEY_ID is not set"
        return 1
    fi
    
    if [[ -z "$AWS_SECRET_ACCESS_KEY" ]]; then
        log_error "AWS_SECRET_ACCESS_KEY is not set"
        return 1
    fi
    
    return 0
}

# Main validation
log_info "Starting CloudFront invalidation validation"

err=0

# Validate required parameters
if ! validate_distribution_id "$DISTRIBUTION"; then
    err=1
fi

if [[ -z "$PATHS" && -z "$PATHS_FROM" ]]; then
    log_error "Either PATHS or PATHS_FROM must be set"
    err=1
fi

if ! validate_aws_region "${AWS_REGION:-$DEFAULT_AWS_REGION}"; then
    err=1
fi

if ! validate_aws_credentials; then
    err=1
fi

if [ $err -eq 1 ]; then
    log_error "Validation failed. Exiting."
    exit 1
fi

log_info "Validation completed successfully"

# Set AWS region if not provided
if [[ -z "$AWS_REGION" ]]; then
    AWS_REGION="$DEFAULT_AWS_REGION"
    log_info "Using default AWS region: $AWS_REGION"
fi

# Enable debug output if requested
if [ "$DEBUG" = "1" ]; then
    log_debug "Enabling debug output (set -x)"
    set -x
fi

# Ensure we have jq-1.6
log_debug "Checking jq installation"
jq="jq"
if [[ ! -x "$(command -v $jq)" || "$($jq --version)" != "jq-1.6" ]]; then
    log_info "Installing jq-1.6"
    if [[ $(uname) == "Darwin" ]]; then
        jqbin="jq-osx-amd64"
    elif [[ $(uname) == "Linux" ]]; then
        jqbin="jq-linux64"
    else
        log_error "Unsupported operating system: $(uname)"
        exit 1
    fi
    
    if [[ -n "$jqbin" ]]; then
        jq="/usr/local/bin/jq16"
        wget -nv -O $jq "https://github.com/stedolan/jq/releases/download/jq-1.6/$jqbin"
        chmod 755 $jq
        log_info "jq-1.6 installed successfully"
    fi
fi

# Handle paths from file
if [[ -n "$PATHS_FROM" ]]; then
    log_info "Reading PATHS from $PATHS_FROM"
    if [[ ! -f $PATHS_FROM ]]; then
        log_info "PATHS file not found. Nothing to do. Exiting."
        exit 0
    fi
    
    PATHS=$(cat $PATHS_FROM | tr '\n' ' ')
    log_debug "PATHS=$PATHS"
    
    if [[ -z "$PATHS" ]]; then
        log_info "PATHS is empty. Nothing to do. Exiting."
        exit 0
    fi
fi

# Validate paths after loading from file
if ! validate_paths "$PATHS"; then
    log_error "Path validation failed"
    exit 1
fi

log_info "Processing invalidation for distribution: $DISTRIBUTION"

# Handle multiple space-separated paths, particularly containing wildcards.
# i.e., if PATHS="/* /foo"
IFS=' ' read -r -a PATHS_ARR <<<"$PATHS"
echo -n "${PATHS}" >"${RUNNER_TEMP}/paths.txt"
JSON_PATHS=$($jq --null-input --compact-output --monochrome-output --rawfile inarr "${RUNNER_TEMP}/paths.txt" '$inarr | rtrimstr(" ") | rtrimstr("\n") | split(" ")')
LEN="${#PATHS_ARR[@]}"
CR="$(date +"%s")$RANDOM"

log_debug "Creating invalidation batch with $LEN paths"

cat <<-EOF >"${RUNNER_TEMP}/invalidation-batch.json"
{ "InvalidationBatch": { "Paths": { "Quantity": ${LEN}, "Items": ${JSON_PATHS} }, "CallerReference": "${CR}" } }
EOF

if [ "$DEBUG" = "1" ]; then
    log_debug "Wrote ${RUNNER_TEMP}/invalidation-batch.json"
    cat "${RUNNER_TEMP}/invalidation-batch.json"
fi

# Support v1.x of the awscli which does not have this flag
[[ "$(aws --version)" =~ "cli/2" ]] && pagerflag="--no-cli-pager"

log_info "Submitting CloudFront invalidation request"

# Execute the invalidation
if aws $pagerflag \
  cloudfront create-invalidation \
  --distribution-id "$DISTRIBUTION" \
  --cli-input-json "file://${RUNNER_TEMP}/invalidation-batch.json"; then
    log_info "CloudFront invalidation submitted successfully"
else
    log_error "CloudFront invalidation failed"
    exit 1
fi