feat(edge-optimize): source CloudFront control-plane from tokowaka-client

[ABHA61]

Warning

DO NOT MERGE — review only.

• Depends on feat(tokowaka-client): add CloudFront Optimize-at-Edge control-plane spacecat-shared#1722 (the shared-client half). That PR
  must merge and publish a new client version first.
• The @adobe/spacecat-shared-tokowaka-client dependency currently points at
  an unpublished gist test build (1.19.1) so CI can resolve the migrated
  client now. Before this can merge, bump it to the published version.

What

Removes the local CloudFront "Optimize at Edge" control-plane and sources it
from @adobe/spacecat-shared-tokowaka-client instead.

Why

The control-plane has been moved into the shared client (adobe/spacecat-shared#1722)
so it can be reused and the llmo controller stays thin.

Changes

• Deleted src/support/edge-optimize.js (1722 LOC) and
  src/support/edge-optimize-edge-code.js — moved to the client verbatim.
• Deleted test/support/edge-optimize.test.js — coverage moved to the
  client (100%).
• src/controllers/llmo/llmo.js — imports the 12 control-plane functions +
  calculateForwardedHost from the client; no behavioural change.
• test/controllers/llmo/llmo.test.js — adapted mocks to the client module.
• package.json / package-lock.json — dependency repointed to the gist test
  build (temporary, see warning above).

Net

−3900 / +40 in source; behaviour unchanged. 537 llmo controller tests pass;
lint clean; the migrated import graph bundles cleanly.

🤖 Generated with Claude Code

[MysticatBot]

Mysticat review failed: Claude CLI crashed (exit 1): stderr= stdout={"type":"result","subtype":"error_max_budget_usd","duration_ms":8,"duration_api_ms":1556945,"is_error":true,"num_turns":1,"stop_reason":null,"session_id":"40b42d9e-c031-4e6f-9e75-5ef5cde0a34a","total_cost_usd":10.474445650000005,"usage":{"input_tokens":0,"cache_creation_input_tokens":0,"cache_read_i

[ABHA61]

Status update on the review feedback (code at 5c398f46):

Fixed

• Route namespace — all 16 wizard endpoints moved under /sites/{siteId}/llmo/onboarding/cloudfront/*.
• Internal errors → 500 — wizard handlers' catch blocks now return internalServerError (generic client message, full error logged server-side); up-front validation still returns 400.
• lambdaVersionArn validation — enforced with ^arn:aws:lambda:us-east-1:\d{12}:function:[A-Za-z0-9_-]+:\d+$ and the ARN account segment must equal the request accountId.
• Duplicated credential checks — centralised into parseEoCredentials(...).
• POST-for-reads rationale — documented in the OpenAPI descriptions ("read-only").
• Error sanitisation — unexpected errors return a generic message; raw AWS details (ARNs/account ids) are logged server-side only.

Not required (by design)

• externalId not bound to site/session — confused-deputy protection is provided by a per-session, randomly generated externalId created at connector-role setup and reused for the assume; a new session generates a new id, so there is no static secret to bind. Can add an explicit server-side site↔externalId record if you'd prefer defence-in-depth.
• resolveEoTarget error-as-value — kept intentionally; the { error } Response is returned immediately by the caller, so it doesn't actually interleave with the try/catch flow.

Pending before merge (intentional)

• Gist dependency — temporary dev bridge while feat(tokowaka-client): add CloudFront Optimize-at-Edge control-plane spacecat-shared#1722 is in review (this PR is marked DO-NOT-MERGE). Will be re-pinned to the published @adobe/spacecat-shared-tokowaka-client version once A11y autotifx slack trigger #1722 merges.

Deferred (optional follow-up)

• Split the ~3200-line llmo.js — planned as a follow-up to extract the CloudFront wizard into src/controllers/llmo/llmo-cloudfront.js (parallel to llmo-cloudflare.js); kept out of this PR to limit churn.
• Full HOF/middleware for the gate/validate/assume boilerplate — partially done via parseEoCredentials; a thin wrapper can follow.
• js-yaml lazy import — minor; can switch the permissions endpoint to a dynamic import.

[MysticatBot]

Hey @ABHA61,

⚠ Degraded review - no spec document was found for this change (searched the PR links, the touched repos' docs, the architecture/guidelines docs, and linked Jira). This review covers code-level quality but could not validate the change against an agreed design, so confidence is reduced. Add a spec link (PR template section 4) and re-request review for a full-confidence pass.

Verdict: Request changes - error handling gap missed from last round, plus unsanitized code-generation input needs defense-in-depth.
Complexity: HIGH - large diff; API surface + dependency change + cross-account AWS operations.
Changes: Extracts the CloudFront "Optimize at Edge" control-plane into a dedicated controller sourced from the shared tokowaka client, adding 16 wizard endpoints (14 files).
Note: Recommend a human read before merge - this change adds a new API surface (docs/openapi/llmo-api.yaml) with cross-account AWS operations. The bot review is a complement to, not a replacement for, a human read here.

Note: CI build is pending. The PR is explicitly marked DO NOT MERGE pending adobe/spacecat-shared#1722 and the gist dependency replacement.

Must fix before merge

1. [Important] connect outer catch returns 400 with raw error message (inconsistent with all other handlers) - src/controllers/llmo/llmo-cloudfront.js:226 (details inline)
2. [Important] targetedPaths passed unsanitized to CloudFront Function code-generation - src/controllers/llmo/llmo-cloudfront.js:497 (details inline)

Non-blocking (3): minor issues and suggestions

• nit: getPermissions inner catch returns badRequest for an S3 read failure (server-side problem, should be internalServerError) - src/controllers/llmo/llmo-cloudfront.js:770
• nit: No format validation on distributionId - CloudFront IDs match ^[A-Z0-9]{12,14}$; adding a regex in parseEoCredentials would reject garbage early - src/controllers/llmo/llmo-cloudfront.js:181
• suggestion: Add a test case that passes an actual targetedPaths array to createRoutingFunction and verifies it is forwarded to the downstream function (currently only the null case is tested) - test/controllers/llmo/llmo-cloudfront.test.js:1001

Previously flagged, now resolved

• Controller extracted into dedicated llmo-cloudfront.js (968 lines vs prior 3200-line monolith)
• Catch blocks return internalServerError with generic messages (except connect, see finding 1)
• lambdaVersionArn validated with regex + account-ID cross-check
• Routes moved under /sites/{siteId}/llmo/cdn-onboard/cloudfront/* namespace
• Credential checks centralized in parseEoCredentials

---

_{Skill: pr-review | Model: us.anthropic.claude-opus-4-6-v1[1m] | Duration: 3m 12s | Cost: $7.34 | Commit: e29e782e3a56b26674e3452d68164da785e11024
If this code review was useful, please react with 👍. Otherwise, react with 👎.}

[MysticatBot]

issue (blocking): The outer catch in connect returns badRequest(cleanupHeaderValue(error.message)) while every other handler returns internalServerError(...) with a generic message. This leaks internal error details (DynamoDB table names, connection info) and returns 400 (implying client fault) for server-side failures.

This was supposedly addressed from the prior review (finding: broad catch-all returns 400) but this one handler was missed.

Fix:

} catch (error) {
  log.error(`Failed to connect edge optimize role for site ${siteId}:`, error);
  return internalServerError('Failed to connect the edge optimize role, please try again');
}

[MysticatBot]

issue (blocking): targetedPaths is validated only as "is it an array or null" and then forwarded directly to createEdgeOptimizeRoutingFunction. If the downstream function interpolates these values into CloudFront Function code (JavaScript executed at the CDN edge), a caller could inject arbitrary code.

Even if the shared client validates, defense in depth is warranted for inputs that flow into code generation.

Fix: Add boundary validation before passing downstream:

if (targetedPaths !== null) {
  if (targetedPaths.length > 50) {
    return badRequest('targetedPaths must not exceed 50 entries');
  }
  if (!targetedPaths.every((p) => typeof p === 'string' && p.length > 0 && p.length <= 256
    && /^[a-zA-Z0-9/_.*-]+$/.test(p))) {
    return badRequest('Each targetedPaths entry must be a non-empty path pattern (max 256 chars, alphanumeric/slashes/wildcards only)');
  }
}

[ABHA61]

Agree this is useful defense-in-depth, but we are not taking it as a current release blocker. The FE wizard does not expose arbitrary targeted paths today, and the shared code serializes the array into generated Function code rather than concatenating raw path text. I added this to the CloudFront punch list as a P1 follow-up: add controller-level targetedPaths limits before passing downstream (max entries, max length, accepted path characters).

[ABHA61]

Review feedback update (latest pushed code 9b974316)

Fixed

• Route namespace: all CloudFront wizard routes and OpenAPI paths are now under /sites/{siteId}/llmo/cdn-onboard/cloudfront/*, aligned with the existing Cloudflare convention.
• connect outer catch: now logs the real error server-side and returns internalServerError("Failed to connect the edge optimize role, please try again") instead of returning 400 with the raw error message.
• Shared-client refresh: api-service now consumes the rebuilt shared tarball and imports the AWS-style shared aliases.

Deferred / asking for next release

• rest pending items seems p1 to me, Can we take this in the next release .

Focused verification after rebase: llmo-cloudfront.test.js = 165 passing; eslint on the CloudFront controller/test files passed.