Make Cloudfront private in CDK code, add key-pair for auth

.github/workflows/deploy-fdr-dev.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+      - dd/write-to-s3
     paths:
       - "fern/apis/fdr/**"
       - "fern/fern.config.json"
@@ -26,6 +27,7 @@ env:
   FERNIE_SLACK_APP_TOKEN: ${{ secrets.FERNIE_SLACK_APP_TOKEN }}
   GITHUB_TOKEN: ${{ secrets.FERN_GITHUB_TOKEN }}
   NPM_TOKEN: ${{ secrets.FERN_NPM_TOKEN }}
+  CLOUDFRONT_KEY_GROUP_ID: ${{ secrets.CLOUDFRONT_KEY_GROUP_ID }}
 
 jobs:
   sdk:
@@ -45,6 +47,7 @@ jobs:
       ALGOLIA_SEARCH_INDEX: ${{ secrets.ALGOLIA_SEARCH_INDEX }}
       ALGOLIA_SEARCH_V2_DOMAINS: "workato,rohin-bhargava-staging,monite,humanloop,cohere,buildwithfern.com/learn"
       ALGOLIA_SEARCH_API_KEY: ${{ secrets.ALGOLIA_SEARCH_API_KEY }}
+      CLOUDFRONT_KEY_GROUP_ID: ${{ secrets.CLOUDFRONT_KEY_GROUP_ID }}
       APPLICATION_ENVIRONMENT: dev
     steps:
       - uses: actions/checkout@v4
@@ -85,6 +88,7 @@ jobs:
           VERSION="${git_version}" pnpm --filter=@fern-platform/fdr-deploy deploy:dev
         env:
           DATABASE_URL: ${{ secrets.DEV_POSTGRES_URL }}/fdr?schema=public&connection_limit=6&pool_timeout=30
+          CLOUDFRONT_KEY_GROUP_ID: ${{ secrets.CLOUDFRONT_KEY_GROUP_ID }}
 
   smoke-test:
     needs: deploy_dev

packages/fern-docs/bundle/package.json

@@ -28,6 +28,7 @@
     "@ai-sdk/openai": "^1.0.8",
     "@algolia/client-search": "^5.15.0",
     "@aws-sdk/client-s3": "^3.685.0",
+    "@aws-sdk/cloudfront-signer": "^3.723.0",
     "@aws-sdk/s3-request-presigner": "^3.685.0",
     "@fern-api/fdr-sdk": "workspace:*",
     "@fern-api/ui-core-utils": "workspace:*",

packages/fern-docs/bundle/src/server/loadDocsDefinitionFromS3.ts

@@ -1,3 +1,4 @@
+import { getSignedUrl } from "@aws-sdk/cloudfront-signer";
 import { FdrAPI } from "@fern-api/fdr-sdk";
 
 export async function loadDocsDefinitionFromS3({
@@ -8,12 +9,15 @@ export async function loadDocsDefinitionFromS3({
   docsDefinitionUrl: string;
 }): Promise<FdrAPI.docs.v2.read.LoadDocsForUrlResponse | undefined> {
   try {
-    console.log("fetching docs definition:");
     const cleanDomain = domain.replace(/^https?:\/\//, "");
     const dbDocsDefUrl = `${docsDefinitionUrl}/${cleanDomain}.json`;
-    console.log("dbDocsDefUrl", dbDocsDefUrl);
-
-    const response = await fetch(dbDocsDefUrl);
+    const signedUrl = getSignedUrl({
+      url: dbDocsDefUrl,
+      privateKey: process.env.CLOUDFRONT_PRIVATE_KEY || "",
+      keyPairId: process.env.CLOUDFRONT_KEY_PAIR_ID || "",
+      dateLessThan: new Date(Date.now() + 1000 * 60 * 60 * 24 * 30).toString(),
+    });
+    const response = await fetch(signedUrl);
     if (response.ok) {
       const json = await response.json();
       return json as FdrAPI.docs.v2.read.LoadDocsForUrlResponse;

packages/fern-docs/bundle/turbo.json

@@ -3,6 +3,9 @@
   "extends": ["//"],
   "globalEnv": ["FERN_ENVIRONMENT", "APPLICATION_ENVIRONMENT"],
   "tasks": {
+    "build": {
+      "env": ["CLOUDFRONT_PRIVATE_KEY", "CLOUDFRONT_KEY_PAIR_ID"]
+    },
     "docs:build": {
       "outputs": [".next/**", "!.next/cache/**"],
       "inputs": ["$TURBO_DEFAULT$", ".env*"]

packages/fern-docs/ui/turbo.json

@@ -10,7 +10,9 @@
         "NEXT_DEPLOYMENT_ID",
         "NEXT_PUBLIC_FDR_ORIGIN",
         "NEXT_PUBLIC_VERCEL_ENV",
-        "NEXT_PUBLIC_DOCS_DEFINITION_S3_URL"
+        "NEXT_PUBLIC_DOCS_DEFINITION_S3_URL",
+        "CLOUDFRONT_PRIVATE_KEY",
+        "CLOUDFRONT_KEY_GROUP_ID"
       ],
       "inputs": ["$TURBO_DEFAULT$"]
     }