fix(eventbridge): AWS-conformant InputTransformer from CloudFormation and PutTargets

[lruizctaima]

Summary

EventBridge InputTransformer did not behave like real AWS, and was reachable inconsistently between the two ways a rule target can be created.

• Wrong substitution output. The invoker substituted <var> placeholders by naive string replacement using the value's text (asText()), so a JSON template with an unquoted placeholder produced invalid JSON — e.g. {"eventName":<eventName>} yielded {"eventName":site.created} instead of {"eventName":"site.created"}.
• CloudFormation dropped the transformer. The native PutTargets API parsed InputTransformer, but the CloudFormation AWS::Events::Rule provider did not carry it over — so a rule deployed via CFN/CDK silently lost its transform.

This makes InputTransformer AWS-conformant and reachable identically from both entry points (authoritative reference: https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-transform-target-input.html):

• One shared InputTransformer.fromJson(JsonNode) parser is now used by both the native PutTargets handler and the CloudFormation provider — parity by construction.
• The substitution engine is rewritten to be quote-context-aware: a placeholder in a JSON value position is replaced by the value's JSON representation (strings auto-quoted/escaped, objects/arrays/numbers/bools as-is, missing path → empty); a placeholder inside a quoted string ("<v>" or "…<v>…") is replaced by the raw escaped value between the author's quotes. InputPath behavior is unchanged.
• The CloudFormation AWS::Events::Rule provider now carries the target's InputTransformer via that shared parser.

Type of change

• Bug fix (fix:)
• New feature (feat:)
• Breaking change (feat!: or fix!:)
• Docs / chore

AWS Compatibility

Incorrect behavior fixed:

• Value-position placeholders were substituted with the unquoted text of string values, producing invalid JSON payloads. Real AWS inserts the JSON representation, so string values are quoted and escaped.
• AWS::Events::Rule targets created via CloudFormation lost their InputTransformer entirely; real CloudFormation preserves it, and the target receives the transformed input.

Substitution semantics now follow the AWS doc: string → quoted/escaped, object/array → JSON as-is, number/bool → literal, missing JSONPath → empty string; placeholders written inside quotes interpolate the raw value.

Verification: RestAssured integration tests exercise the real wire protocol — JSON 1.1 (X-Amz-Target) for EventBridge, Query for CloudFormation/SQS. Both a CloudFormation AWS::Events::Rule with an InputTransformer target and a native PutTargets target are driven through PutEvents and asserted to deliver the identical transformed body to an SQS queue, proving CFN ↔ native parity end to end.

Checklist

• ./mvnw test passes locally
• New or updated integration test added
• Commit messages follow Conventional Commits

Tests: unit coverage for the substitution rules in EventBridgeInvokerTest, a parser unit test (InputTransformerTest), and two integration tests proving parity (EventBridgeInputTransformerIntegrationTest for native PutTargets, plus a new CloudFormationIntegrationTest case for the CFN rule). Regression across EventBridge*, CloudFormationIntegrationTest, and InputTransformerTest: 288/288 green.

Notes for the reviewer

• The engine is a single-pass scanner tracking whether the cursor is inside a double-quoted string (toggling on unescaped "). Value position → JSON representation; in-string → raw escaped value. Unknown <...> (not in InputPathsMap) is left literal.
• extractJsonPath / applyInputPath (the InputPath feature) are deliberately left behaviour-identical; they now delegate to a shared extractNode but return exactly the same strings, and their existing tests are unchanged.
• Out of scope (deferred follow-ups): reserved AWS variables (<aws.events.rule-arn>, <aws.events.event.json>, …) — unknown placeholders are left literal for now; JSONPath array indices ($.detail.items[0].id); and other CFN target fields (RoleArn, DeadLetterConfig) which are still not carried by the provider.
• Independent of PR feat(cloudformation): support AWS::Events::EventBus and EventBusPolicy #1794 (custom event bus CloudFormation support); this branch is based on main and does not depend on it.

[greptile-apps]

Greptile Summary

This PR fixes two related bugs in EventBridge InputTransformer handling to match real AWS behaviour. The substitution engine is rewritten to be quote-context-aware (value-position placeholders receive the JSON representation; in-string placeholders receive the raw escaped value), and the CloudFormation AWS::Events::Rule provisioner now carries InputTransformer through to the target via a new shared InputTransformer.fromJson() factory.

• Shared parser: InputTransformer.fromJson(JsonNode) is now the single parsing path for both the native PutTargets handler and the CloudFormation provisioner, eliminating the divergence by construction.
• Correct substitution: the single-pass scanner in applyInputTransformer tracks inString state via unescaped " characters in the template, routing each placeholder to either jsonValue() (string auto-quoted) or rawValue() (JSON-escaped bare value) as AWS specifies.
• End-to-end parity tests: two integration tests — one for native PutTargets and one for a CFN stack — assert identical transformed delivery to an SQS queue, and six unit tests cover the engine's substitution branches exhaustively.

Confidence Score: 5/5

• Safe to merge. The changes are narrowly scoped to the InputTransformer evaluation path and the one-line CFN provisioner fix, both of which are fully covered by new unit and integration tests.
• The substitution engine is correct for all documented AWS cases (value-position quoting, in-string raw interpolation, missing-path empty, unknown-var literal passthrough). The shared parser eliminates the former CFN/native divergence, and both paths are exercised end-to-end. No existing behaviour outside the InputTransformer path is touched.
• No files require special attention.

Important Files Changed

Filename	Overview
src/main/java/io/github/hectorvent/floci/services/eventbridge/EventBridgeInvoker.java	Core substitution engine rewritten: new quote-context-aware scanner in applyInputTransformer, extractNode extracted from extractJsonPath to share node extraction with transformer evaluation. Logic is correct for the common cases; toPointer's dot-to-slash conversion is a pre-existing limitation documented as out of scope.
src/main/java/io/github/hectorvent/floci/services/eventbridge/model/InputTransformer.java	Added fromJson(JsonNode) factory method to centralise InputTransformer parsing. Handles null, MissingNode, and non-object nodes correctly, returning null for each; existing constructors and field defaults are unchanged.
src/main/java/io/github/hectorvent/floci/services/eventbridge/EventBridgeHandler.java	Inline InputTransformer parsing replaced with InputTransformer.fromJson(). Net reduction of 9 lines; behaviour is equivalent.
src/main/java/io/github/hectorvent/floci/services/cloudformation/CloudFormationResourceProvisioner.java	Single-line fix in the existing AWS::Events::Rule provisioning block: sets InputTransformer on the target via the shared factory, closing the CFN silent-drop bug. The change is narrowly scoped to the existing target-building code path.
src/test/java/io/github/hectorvent/floci/services/eventbridge/EventBridgeInvokerTest.java	Six new unit tests cover value-position string quoting, object/number/bool passthrough, missing-path empty substitution, in-string interpolation, quoted-whole-token raw replacement, and unknown-variable literal passthrough. Good coverage of the engine's branching logic.
src/test/java/io/github/hectorvent/floci/services/cloudformation/CloudFormationIntegrationTest.java	New test case createStack_eventBridgeRuleWithInputTransformer_deliversTransformedBodyToSqs covers the full CFN stack creation → PutEvents → SQS delivery path, verifying CFN/native parity and that the transformer survives provisioning (ListTargetsByRule assertion).

Sequence Diagram

sequenceDiagram
    participant Client
    participant EventBridgeHandler
    participant CloudFormationProvisioner
    participant InputTransformer
    participant EventBridgeInvoker
    participant Target

    Note over Client,Target: Native PutTargets path
    Client->>EventBridgeHandler: PutTargets (JSON 1.1)
    EventBridgeHandler->>InputTransformer: fromJson(t.path("InputTransformer"))
    InputTransformer-->>EventBridgeHandler: "InputTransformer | null"
    EventBridgeHandler->>Target: setInputTransformer(...)

    Note over Client,Target: CloudFormation AWS::Events::Rule path
    Client->>CloudFormationProvisioner: CreateStack (Query)
    CloudFormationProvisioner->>InputTransformer: fromJson(resolved.path("InputTransformer"))
    InputTransformer-->>CloudFormationProvisioner: "InputTransformer | null"
    CloudFormationProvisioner->>Target: setInputTransformer(...)

    Note over Client,Target: PutEvents invocation (both paths)
    Client->>EventBridgeInvoker: invokeTarget(target, eventJson, region)
    EventBridgeInvoker->>EventBridgeInvoker: applyInputTransformer(transformer, eventJson)
    loop For each InputPathsMap entry
        EventBridgeInvoker->>EventBridgeInvoker: extractNode(jsonPath, eventJson)
    end
    Note right of EventBridgeInvoker: Single-pass scan:<br/>value pos → jsonValue()<br/>in-string pos → rawValue()
    EventBridgeInvoker-->>Target: transformed payload → SQS/Lambda/SNS/…

Loading

_{Reviews (3): Last reviewed commit: "Merge remote-tracking branch 'origin/mai..." | Re-trigger Greptile}

[lruizctaima]

#1794 (comment)

[abanna]

The string-context vs value-context split is the part most implementations get wrong, and doing it with an inString scan plus isEscaped is a nice touch — quoting <key> inside a JSON string really does mean something different from using it as a bare value.

One conformance gap for a PR aiming at "AWS-conformant": only names present in InputPathsMap are substituted, but AWS also defines five predefined variables that never appear in that map:

<aws.events.event>            the event, minus detail
<aws.events.event.json>       the full event as JSON
<aws.events.rule-arn>
<aws.events.rule-name>
<aws.events.ingestion-time>

Because resolved.containsKey(name) is false for all of them, they fall through to out.append(c) and survive verbatim into the target payload. For a very common CDK/Terraform-shaped template:

{"rule": "<aws.events.rule-name>", "detail": <aws.events.event.json>}

the target receives the literal text <aws.events.rule-name> — and worse, "detail": <aws.events.event.json> isn't valid JSON at all, so anything parsing the payload fails rather than getting a wrong-but-parseable value. Silent literal passthrough makes that hard to trace back to the transformer.

The substitution loop is already the right place for it — seeding resolved before the InputPathsMap entries would cover it:

Map<String, JsonNode> resolved = new LinkedHashMap<>();
JsonNode event = objectMapper.readTree(eventJson);
resolved.put("aws.events.event.json", event);
resolved.put("aws.events.event", withoutDetail(event));
resolved.put("aws.events.rule-name", TextNode.valueOf(ruleName));
resolved.put("aws.events.rule-arn", TextNode.valueOf(ruleArn));
resolved.put("aws.events.ingestion-time", TextNode.valueOf(Instant.now().toString()));
// InputPathsMap entries last — AWS rejects these names in the map, so caller keys can't shadow them

The rule name and ARN aren't currently threaded into invokeTarget, so that part needs a signature change — reasonable as a follow-up if you'd rather keep this PR to the parsing fix. But <aws.events.event.json> needs nothing extra and is the one most likely to be hit.

If any of these are deliberately out of scope, the docs deviation list would be a good place to say so — right now nothing signals that they silently pass through.

[hectorvent]

Thank you for this, and sorry it waited so long for a human reply. The core fix holds up against the reference behaviour (value-position placeholders get JSON, in-string get the raw escaped value, missing path becomes empty string), one shared InputTransformer.fromJson for both entry points is the right call, and the member names match the model (https://github.com/boto/botocore/blob/develop/botocore/data/events/2015-10-07/service-2.json).

(blocking) The plain string template case: applyInputTransformer_insideString_interpolatesRaw pins the author's outer quotes into the delivered payload, while my reading of the reference is that AWS strips them, so the SQS body would be alice did site.created. Pre-existing behaviour, but the new test locks it in. Could you confirm the quotes against real AWS, or loosen that assertion?

(follow-up, separate PR) AWS rejects an InputTemplate with a placeholder neither in InputPathsMap nor a reserved aws.events.* variable; this leaves it literal.

Also please untick "New feature" and add Closes #N if there is an issue. One blocker, the rest is ready.

[pgermosen]

@lruizctaima — this needs a down-merge before it can go in, and I want to save you some time on it, because the obvious way to resolve these conflicts produces code that does not compile.

First, the part that matters: the work is still needed and still correct. The branch has been sitting a while, so I checked main directly rather than assume:

• EventBridgeInvoker.applyInputTransformer on main is still result.replace("<" + key + ">", value) with no quote awareness — the naive substitution your PR replaces.
• CloudFormationResourceProvisioner still builds new Target(targetId, targetArn, input, inputPath) and never carries the transformer.

Neither has been fixed by anything that landed in the meantime. Nothing here is redundant.

The merge, and the trap in it

The branch is 190 commits behind main, with three conflicting files:

File	Conflict hunks
CloudFormationResourceProvisioner.java	1 — two imports
EventBridgeInvokerTest.java	1
CloudFormationIntegrationTest.java	7

The instinct on conflicts like these is "both sides are additions, keep both, drop the markers". That breaks the build here. I tried it first so you would not have to:

CloudFormationIntegrationTest.java:[9130,30] ';' expected
EventBridgeInvokerTest.java:[451,60] ';' expected

Git has interleaved two different test methods that happen to open the same way — main's createStack_withEventBus_createsRealBusAndResolvesRefAndGetAtt and your createStack_eventBridgeRuleWithInputTransformer_deliversTransformedBodyToSqs, both declaring a TargetQueue SQS resource. Deleting the markers splices them together mid-method.

The actual resolution is simple. Your changes to all three conflicted files are pure additions — 2+ 0-, 84+ 0-, 49+ 0- — each a single hunk at the end of the file. So for the two test files, take main's version wholesale and append your block before the closing class brace:

git checkout origin/main -- <test file>
# then re-add your test method at the end

For CloudFormationResourceProvisioner.java the conflict is only between two imports — keep both. main has since added SqsParameters and BatchParameters handling around the line you touch, and your target.setInputTransformer(...) sits alongside it without interfering.

I verified the resolved result

Rather than send you off on a guess, I resolved it that way locally against current main and ran it:

• compiles clean
• 749 tests green across services.cloudformation.** and services.eventbridge.**
• your new CFN test and main's event-bus test pass together, so the two features genuinely coexist

I also confirmed both of your fixes are pinned by your own tests, by reverting each one:

Reverted	Failure
substitution → main's naive replace	expected: <{"e":"site.created"}> but was: <{"e":site.created}>
the CFN setInputTransformer line	createStack_eventBridgeRuleWithInputTransformer_deliversTransformedBodyToSqs

That first message is the bug itself — invalid JSON — which is a good sign for the test.

Your CI is from 16 July, so it will need a fresh run after the down-merge regardless.

One question, not blocking

jsonValue returns "" for a missing or null path, so a value-position placeholder whose JSONPath does not match renders {"e":} — not valid JSON. Your description states "missing path → empty" deliberately, and it matches what main already did, so this is preserved rather than introduced by you.

Do you happen to know what real AWS emits there? If it quotes an empty string, or drops the member, that would be worth matching. Entirely fine as a follow-up either way — I mention it only because you clearly checked the other substitution rules against the documentation and this is the one corner the doc is quiet about.

The engine reads well, incidentally — the single-pass scanner with the inString toggle and the escaped-quote check is the right shape for this, and leaving unknown placeholders literal is the correct call given reserved variables like <aws.events.rule-arn> are explicitly out of scope.

Push the down-merge whenever suits and I will re-review promptly. Thank you for your patience on this one — the delay is on the queue, not on you.

[pgermosen]

Downmerged main to resolve the conflict (was DIRTY/CONFLICTING) — CI green on the merged tree.

[hectorvent]

🎉 This PR is included in version 2.0.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀