himari-aws 0.1.0 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (42) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +15 -0
  3. data/README.md +127 -14
  4. data/Rakefile +2 -0
  5. data/lambda/Dockerfile +40 -0
  6. data/lambda/Gemfile +35 -0
  7. data/lambda/Gemfile.lock +374 -0
  8. data/lambda/README.md +42 -0
  9. data/lambda/entrypoint.rb +5 -0
  10. data/lambda/terraform/README.md +92 -0
  11. data/lambda/terraform/functions/aws.tf +2 -0
  12. data/lambda/terraform/functions/dynamodb.tf +18 -0
  13. data/lambda/terraform/functions/lambda_rack.tf +66 -0
  14. data/lambda/terraform/functions/lambda_secrets_rotation.tf +33 -0
  15. data/lambda/terraform/functions/outputs.tf +19 -0
  16. data/lambda/terraform/functions/variables.tf +65 -0
  17. data/lambda/terraform/functions/versions.tf +7 -0
  18. data/lambda/terraform/iam/aws.tf +2 -0
  19. data/lambda/terraform/iam/outputs.tf +7 -0
  20. data/lambda/terraform/iam/role.tf +77 -0
  21. data/lambda/terraform/iam/variables.tf +44 -0
  22. data/lambda/terraform/iam/versions.tf +8 -0
  23. data/lambda/terraform/image/aws.tf +1 -0
  24. data/lambda/terraform/image/copy.tf +45 -0
  25. data/lambda/terraform/image/ecr.tf +42 -0
  26. data/lambda/terraform/image/outputs.tf +9 -0
  27. data/lambda/terraform/image/variables.tf +20 -0
  28. data/lambda/terraform/image/versions.tf +9 -0
  29. data/lambda/terraform/signing_key/aws.tf +1 -0
  30. data/lambda/terraform/signing_key/outputs.tf +3 -0
  31. data/lambda/terraform/signing_key/secret.tf +18 -0
  32. data/lambda/terraform/signing_key/variables.tf +24 -0
  33. data/lambda/terraform/signing_key/versions.tf +7 -0
  34. data/lib/himari/aws/dynamodb_storage.rb +41 -16
  35. data/lib/himari/aws/lambda_handler.rb +76 -0
  36. data/lib/himari/aws/secretsmanager_signing_key_provider.rb +8 -5
  37. data/lib/himari/aws/secretsmanager_signing_key_rotation_handler.rb +36 -9
  38. data/lib/himari/aws/version.rb +1 -1
  39. data/lib/himari-aws.rb +2 -0
  40. metadata +49 -10
  41. data/Gemfile +0 -12
  42. data/Gemfile.lock +0 -171
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: eb42481e34029c9e1ae8c3594dd64995f423a53818cbc867a0fd2c65c64c3ff1
4
- data.tar.gz: 55e743a182643484f59544428a9384661a161d4a5657895bd9bed70714c19024
3
+ metadata.gz: 85a23ea8f8d589be0168080f22f979e78d26113119166ba0a99936448b74ed7c
4
+ data.tar.gz: 1837996eac719023197e7e56544c77b2b4d93426e6942cf60e37053bf007d2c5
5
5
  SHA512:
6
- metadata.gz: fc863a5752789f4b83b030c5bb44fc6de47d52acdc44225baf74d97e04f4c2de6ff3b3e1a4fb03bde80b377c956bd70137c8dc0d2cdb2c2e33238d107644c4c1
7
- data.tar.gz: d5093ed3e72bae790f76b9709443b37bf97be5686b53b676cb35fc1d01568685c93d228a1c9825157480328439d6c638e8846afb746a522f9a24320fe61239d8
6
+ metadata.gz: 6e74908b3c34af13b018436918b6a83f87d4180d28505348c9aba6e25024ddcab1cc323df5c151c2e45aa3ec00afb4d40b2fb2c7c6a9b6bc77193010a0d757ae
7
+ data.tar.gz: 2b5bcd9303a70d87b51c80ef9dead217844d13ec68b942941088aa3ba6e9398bd09419d102321600efa9e311c11ae596e23e404988bd8763e30d8c802cf9166b
data/CHANGELOG.md ADDED
@@ -0,0 +1,15 @@
1
+ ## [0.3.0] - 2026-06-03
2
+
3
+ ### Enhancements
4
+
5
+ - Lambda image: copy the prebuilt image with skopeo instead of docker (gains an `architecture` input), with Terraform AWS provider v6 compatibility and a `role_name` output [#18](https://github.com/sorah/himari/pull/18)
6
+ - DynamoDB storage: compare-and-swap writes backing refresh-token rotation [#14](https://github.com/sorah/himari/pull/14)
7
+ - Lambda image: bundle `omniauth-entra-id` and `omniauth-okta`, depend explicitly on `aws-sdk-ssm` and `aws-sdk-secretsmanager`, and make `rack-cors` available.
8
+
9
+ ### Changes
10
+
11
+ - Lambda image: Ruby 4.0, build on dnf, and rolled dependencies (including `apigatewayv2_rack` 0.5.0).
12
+
13
+ ## [0.2.0] - 2023-03-22
14
+
15
+ - Initial release: `Himari::Aws::DynamodbStorage`, Secrets Manager signing key provider and rotation handler, prebuilt Lambda container image, and Terraform modules.
data/README.md CHANGED
@@ -1,24 +1,137 @@
1
- # Himari::Aws
1
+ # himari-aws: AWS related plugins for Himari
2
2
 
3
- TODO: Delete this and the text below, and describe your gem
3
+ - DynamoDB storage backend
4
+ - Secrets Manager automatic rotation Lambda function for signing keys
5
+ - Secrets Manager signing key provider
6
+ - Lambda container image to host Himari itself (TODO)
4
7
 
5
- Welcome to your new gem! In this directory, you'll find the files you need to be able to package up your Ruby library into a gem. Put your Ruby code in the file `lib/himari/aws`. To experiment with that code, run `bin/console` for an interactive prompt.
8
+ ## Deploy on Lambda with Terraform
6
9
 
7
- ## Installation
8
-
9
- TODO: Replace `UPDATE_WITH_YOUR_GEM_NAME_PRIOR_TO_RELEASE_TO_RUBYGEMS_ORG` with your gem name right after releasing it to RubyGems.org. Please do not do it earlier due to security reasons. Alternatively, replace this section with instructions to install your gem from git if you don't plan to release to RubyGems.org.
10
-
11
- Install the gem and add to the application's Gemfile by executing:
10
+ - See [./lambda/terraform/](./lambda/terraform/) for quick deployment using Terraform modules.
12
11
 
13
- $ bundle add UPDATE_WITH_YOUR_GEM_NAME_PRIOR_TO_RELEASE_TO_RUBYGEMS_ORG
14
-
15
- If bundler is not being used to manage dependencies, install the gem by executing:
12
+ ## Installation
16
13
 
17
- $ gem install UPDATE_WITH_YOUR_GEM_NAME_PRIOR_TO_RELEASE_TO_RUBYGEMS_ORG
14
+ ```ruby
15
+ gem 'himari'
16
+ gem 'himari-aws'
17
+ gem 'nokogiri'
18
+ ```
19
+
20
+ ### IAM policy
21
+
22
+ ```json
23
+ {
24
+ "Version": "2012-10-17",
25
+ "Statement": [
26
+ {
27
+ "Effect": "Allow",
28
+ "Action": [
29
+ "dynamodb:DeleteItem",
30
+ "dynamodb:Query",
31
+ "dynamodb:UpdateItem"
32
+ ],
33
+ "Resource": "arn:aws:dynamodb:[REGION]:[ACCOUNTID]:table/himari_*"
34
+ },
35
+ {
36
+ "Effect": "Allow",
37
+ "Action": [
38
+ "secretsmanager:DescribeSecret",
39
+ "secretsmanager:GetSecretValue",
40
+ "secretsmanager:PutSecretValue",
41
+ "secretsmanager:UpdateSecretVersionStage"
42
+ ],
43
+ "Resource": "arn:aws:secretsmanager:[REGION]:[ACCOUNTID]:secret:himari_*"
44
+ }
45
+ ]
46
+ }
47
+ ```
18
48
 
19
49
  ## Usage
20
50
 
21
- TODO: Write usage instructions here
51
+ ### Secrets Manager Rotation Handler
52
+
53
+ 1. Deploy [./lib/himari/aws/secretsmanager_signing_key_rotation_handler.rb](./lib/himari/aws/secretsmanager_signing_key_rotation_handler.rb) as a Lambda function. This file works standalone.
54
+
55
+ - Refer to the [./lambda](./lambda) for prebuilt container image
56
+
57
+ 2. Grant secrets manager a `lambda:InvokeFunction` to the function.
58
+ 3. Create a secrets manager secret and set up rotation.
59
+
60
+ You can tag a secret with `HimariKey` key and the following value to customize key types:
61
+
62
+ - RSA 2048-bit: `kty=rsa,len=2048`
63
+ - RSA 4096-bit: `kty=rsa,len=4096`
64
+ - EC P-256: `kty=ec,len=256`
65
+
66
+ _you may also specify in base64'd json_
67
+
68
+ ### config.ru
69
+
70
+ ```ruby
71
+ # config.ru
72
+ require 'himari'
73
+ require 'himari/aws'
74
+ require 'json'
75
+ require 'omniauth'
76
+ require 'open-uri'
77
+ require 'rack/session/cookie'
78
+
79
+ use(Rack::Session::Cookie,
80
+ path: '/',
81
+ expire_after: 3600,
82
+ secure: true,
83
+ secret: ENV.fetch('SECRET_KEY_BASE'),
84
+ )
85
+
86
+ use OmniAuth::Builder do
87
+ provider :developer, fields: %i(login), uid_field: :login
88
+ end
89
+
90
+ use(Himari::Middlewares::Config,
91
+ issuer: 'https://idp.example.net',
92
+ providers: [
93
+ { name: :github, button: 'Log in with GitHub' },
94
+ ],
95
+ storage: Himari::Aws::DynamodbStorage.new(table_name: 'himari'),
96
+ )
97
+
98
+ # Signing key from Secrets Manager. For rotation deployment, read
99
+ use(Himari::Aws::SecretsmanagerSigningKeyProvider,
100
+ secret_id: 'arn:aws:secretsmanager:ap-northeast-1:...:secret:himari-xxx',
101
+ group: nil,
102
+ kid_prefix: 'asm1',
103
+ )
104
+
105
+ # Add clients as many as you need
106
+ use(Himari::Middlewares::Client,
107
+ name: 'awsalb',
108
+ id: '...',
109
+ secret_hash: '...', # sha384 hexdigest of secret
110
+ # secret: '...' # or in cleartext
111
+ redirect_uris: %w(https://app.example.net/oauth2/idpresponse),
112
+ )
113
+
114
+ use(Himari::Middlewares::ClaimsRule, name: 'developer-initialize') do |context, decision|
115
+ next decision.skip!("provider not in scope") unless context.provider == 'developer'
116
+ decision.initialize_claims!(
117
+ sub: "dev_#{Digest::SHA256.hexdigest(context.auth[:uid])}",
118
+ name: context.auth[:info][:login],
119
+ preferred_username: context.auth[:info][:login],
120
+ )
121
+ decision.continue!
122
+ end
123
+
124
+ use(Himari::Middlewares::AuthenticationRule, name: 'always-allow') do |context, decision|
125
+ next decision.skip!("provider not in scope") unless context.provider == 'developer'
126
+ decision.allow!
127
+ end
128
+
129
+ use(Himari::Middlewares::AuthorizationRule, name: 'always-allow') do |context, decision|
130
+ decision.allow!
131
+ end
132
+
133
+ run Himari::App
134
+ ```
22
135
 
23
136
  ## Development
24
137
 
@@ -28,7 +141,7 @@ To install this gem onto your local machine, run `bundle exec rake install`. To
28
141
 
29
142
  ## Contributing
30
143
 
31
- Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/himari-aws.
144
+ Bug reports and pull requests are welcome on GitHub at https://github.com/sorah/himari.
32
145
 
33
146
  ## License
34
147
 
data/Rakefile CHANGED
@@ -5,4 +5,6 @@ require "rspec/core/rake_task"
5
5
 
6
6
  RSpec::Core::RakeTask.new(:spec)
7
7
 
8
+ Bundler::GemHelper.tag_prefix = "himari-aws/"
9
+
8
10
  task default: :spec
data/lambda/Dockerfile ADDED
@@ -0,0 +1,40 @@
1
+ # context must be repository root
2
+ FROM public.ecr.aws/lambda/ruby:4.0 as builder
3
+ RUN --mount=type=cache,target=/var/cache/dnf dnf update -y && dnf install -y gcc gcc-c++ make
4
+
5
+ COPY ./himari/himari.gemspec ${LAMBDA_TASK_ROOT}/app/himari/himari.gemspec
6
+ COPY ./himari/lib/himari/version.rb ${LAMBDA_TASK_ROOT}/app/himari/lib/himari/version.rb
7
+
8
+ COPY ./himari-aws/himari-aws.gemspec ${LAMBDA_TASK_ROOT}/app/himari-aws/himari-aws.gemspec
9
+ COPY ./himari-aws/lib/himari/aws/version.rb ${LAMBDA_TASK_ROOT}/app/himari-aws/lib/himari/aws/version.rb
10
+
11
+ COPY ./omniauth-himari/omniauth-himari.gemspec ${LAMBDA_TASK_ROOT}/app/omniauth-himari/omniauth-himari.gemspec
12
+ COPY ./omniauth-himari/lib/omniauth-himari/version.rb ${LAMBDA_TASK_ROOT}/app/omniauth-himari/lib/omniauth-himari/version.rb
13
+
14
+ COPY ./himari-aws/lambda/Gemfile* ${LAMBDA_TASK_ROOT}/app/himari-aws/lambda/
15
+ WORKDIR ${LAMBDA_TASK_ROOT}/app
16
+
17
+ ENV LANG=C.UTF-8
18
+ ENV BUNDLE_GEMFILE ${LAMBDA_TASK_ROOT}/app/himari-aws/lambda/Gemfile
19
+ ENV BUNDLE_PATH ${LAMBDA_TASK_ROOT}/vendor/bundle
20
+ ENV BUNDLE_DEPLOYMENT 1
21
+ ENV BUNDLE_JOBS 16
22
+ ENV HIMARI_LAMBDA_IMAGE 1
23
+ RUN bundle install
24
+
25
+ COPY . ${LAMBDA_TASK_ROOT}/app
26
+
27
+ FROM public.ecr.aws/lambda/ruby:4.0
28
+
29
+ COPY --from=builder ${LAMBDA_TASK_ROOT}/vendor ${LAMBDA_TASK_ROOT}/vendor
30
+ COPY . ${LAMBDA_TASK_ROOT}/app
31
+
32
+ COPY ./himari-aws/lambda/entrypoint.rb ${LAMBDA_TASK_ROOT}/himari_lambda_entrypoint.rb
33
+
34
+ WORKDIR ${LAMBDA_TASK_ROOT}/app
35
+ ENV LANG=C.UTF-8
36
+ ENV BUNDLE_GEMFILE ${LAMBDA_TASK_ROOT}/app/himari-aws/lambda/Gemfile
37
+ ENV BUNDLE_PATH ${LAMBDA_TASK_ROOT}/vendor/bundle
38
+ ENV BUNDLE_DEPLOYMENT 1
39
+ ENV HIMARI_LAMBDA_IMAGE 1
40
+ CMD [ "himari_lambda_entrypoint.Himari::Aws::LambdaHandler.rack_handler" ]
data/lambda/Gemfile ADDED
@@ -0,0 +1,35 @@
1
+ # frozen_string_literal: true
2
+
3
+ source 'https://rubygems.org'
4
+
5
+ root = File.join('..', '..')
6
+
7
+ gem 'himari', path: File.join(root, 'himari')
8
+ gem 'himari-aws', path: File.join(root, 'himari-aws')
9
+ gem 'omniauth-himari', path: File.join(root, 'omniauth-himari')
10
+
11
+ gem 'aws-sdk-secretsmanager'
12
+ gem 'aws-sdk-ssm' # paraemeter store
13
+ gem 'nokogiri'
14
+ # gem 'apigatewayv2_rack', git: 'https://github.com/sorah/apigatewayv2_rack'
15
+ gem 'apigatewayv2_rack', '>= 0.5.0'
16
+
17
+ # contribs
18
+ gem 'secure_headers'
19
+ gem 'rack-cors'
20
+
21
+ gem 'omniauth-oauth2'
22
+ gem 'omniauth-saml'
23
+ # gem 'omniauth-twitter'
24
+ gem 'omniauth-github'
25
+ gem 'omniauth-auth0'
26
+ gem 'omniauth-entra-id'
27
+ gem 'omniauth-okta'
28
+ # gem 'omniauth-shibboleth'
29
+ gem 'omniauth-gitlab'
30
+ # gem 'omniauth-kerberos'
31
+ gem 'omniauth-google-oauth2'
32
+ gem 'omniauth-discord'
33
+ gem 'omniauth-apple'
34
+ # gem 'omniauth-ldap' # omniauth < 2
35
+ # gem 'omniauth-slack'# omniauth-oauth2 version constraints does not match with omniauth-github
@@ -0,0 +1,374 @@
1
+ PATH
2
+ remote: ../../himari
3
+ specs:
4
+ himari (0.6.0)
5
+ addressable
6
+ concurrent-ruby
7
+ httpx
8
+ omniauth (>= 2.0)
9
+ openid_connect
10
+ rack-oauth2
11
+ rack-protection
12
+ sinatra (>= 3.0)
13
+
14
+ PATH
15
+ remote: ../../omniauth-himari
16
+ specs:
17
+ omniauth-himari (0.3.0)
18
+ faraday
19
+ jwt
20
+ oauth2
21
+ omniauth
22
+ omniauth-oauth2
23
+
24
+ PATH
25
+ remote: ..
26
+ specs:
27
+ himari-aws (0.3.0)
28
+ apigatewayv2_rack
29
+ aws-sdk-dynamodb
30
+ aws-sdk-secretsmanager
31
+ himari
32
+
33
+ GEM
34
+ remote: https://rubygems.org/
35
+ specs:
36
+ activemodel (8.1.3)
37
+ activesupport (= 8.1.3)
38
+ activesupport (8.1.3)
39
+ base64
40
+ bigdecimal
41
+ concurrent-ruby (~> 1.0, >= 1.3.1)
42
+ connection_pool (>= 2.2.5)
43
+ drb
44
+ i18n (>= 1.6, < 2)
45
+ json
46
+ logger (>= 1.4.2)
47
+ minitest (>= 5.1)
48
+ securerandom (>= 0.3)
49
+ tzinfo (~> 2.0, >= 2.0.5)
50
+ uri (>= 0.13.1)
51
+ addressable (2.9.0)
52
+ public_suffix (>= 2.0.2, < 8.0)
53
+ aes_key_wrap (1.1.0)
54
+ apigatewayv2_rack (0.5.0)
55
+ base64
56
+ rack
57
+ stringio
58
+ attr_required (1.0.2)
59
+ auth-sanitizer (0.1.4)
60
+ version_gem (~> 1.1, >= 1.1.9)
61
+ aws-eventstream (1.4.0)
62
+ aws-partitions (1.1257.0)
63
+ aws-sdk-core (3.251.0)
64
+ aws-eventstream (~> 1, >= 1.3.0)
65
+ aws-partitions (~> 1, >= 1.992.0)
66
+ aws-sigv4 (~> 1.9)
67
+ base64
68
+ bigdecimal
69
+ jmespath (~> 1, >= 1.6.1)
70
+ logger
71
+ aws-sdk-dynamodb (1.168.0)
72
+ aws-sdk-core (~> 3, >= 3.248.0)
73
+ aws-sigv4 (~> 1.5)
74
+ aws-sdk-secretsmanager (1.133.0)
75
+ aws-sdk-core (~> 3, >= 3.248.0)
76
+ aws-sigv4 (~> 1.5)
77
+ aws-sdk-ssm (1.216.0)
78
+ aws-sdk-core (~> 3, >= 3.248.0)
79
+ aws-sigv4 (~> 1.5)
80
+ aws-sigv4 (1.12.1)
81
+ aws-eventstream (~> 1, >= 1.0.2)
82
+ base64 (0.3.0)
83
+ bigdecimal (4.1.2)
84
+ bindata (2.5.1)
85
+ cgi (0.5.1)
86
+ concurrent-ruby (1.3.6)
87
+ connection_pool (3.0.2)
88
+ date (3.5.1)
89
+ drb (2.2.3)
90
+ faraday (2.14.2)
91
+ faraday-net_http (>= 2.0, < 3.5)
92
+ json
93
+ logger
94
+ faraday-follow_redirects (0.5.0)
95
+ faraday (>= 1, < 3)
96
+ faraday-net_http (3.4.4)
97
+ net-http (~> 0.5)
98
+ hashie (5.1.0)
99
+ logger
100
+ http-2 (1.1.3)
101
+ httpx (1.7.8)
102
+ http-2 (>= 1.1.3)
103
+ i18n (1.14.8)
104
+ concurrent-ruby (~> 1.0)
105
+ jmespath (1.6.2)
106
+ json (2.19.8)
107
+ json-jwt (1.17.1)
108
+ activesupport (>= 4.2)
109
+ aes_key_wrap
110
+ base64
111
+ bindata
112
+ faraday (~> 2.0)
113
+ faraday-follow_redirects
114
+ jwt (2.10.3)
115
+ base64
116
+ logger (1.7.0)
117
+ mail (2.9.0)
118
+ logger
119
+ mini_mime (>= 0.1.1)
120
+ net-imap
121
+ net-pop
122
+ net-smtp
123
+ mini_mime (1.1.5)
124
+ mini_portile2 (2.8.9)
125
+ minitest (6.0.6)
126
+ drb (~> 2.0)
127
+ prism (~> 1.5)
128
+ multi_xml (0.9.1)
129
+ bigdecimal (>= 3.1, < 5)
130
+ mustermann (3.1.1)
131
+ net-http (0.9.1)
132
+ uri (>= 0.11.1)
133
+ net-imap (0.6.4)
134
+ date
135
+ net-protocol
136
+ net-pop (0.1.2)
137
+ net-protocol
138
+ net-protocol (0.2.2)
139
+ timeout
140
+ net-smtp (0.5.1)
141
+ net-protocol
142
+ nokogiri (1.19.3)
143
+ mini_portile2 (~> 2.8.2)
144
+ racc (~> 1.4)
145
+ oauth2 (2.0.20)
146
+ auth-sanitizer (~> 0.1, >= 0.1.3)
147
+ faraday (>= 0.17.3, < 4.0)
148
+ jwt (>= 1.0, < 4.0)
149
+ logger (~> 1.2)
150
+ multi_xml (~> 0.5)
151
+ rack (>= 1.2, < 4)
152
+ snaky_hash (~> 2.0, >= 2.0.4)
153
+ version_gem (~> 1.1, >= 1.1.9)
154
+ omniauth (2.1.4)
155
+ hashie (>= 3.4.6)
156
+ logger
157
+ rack (>= 2.2.3)
158
+ rack-protection
159
+ omniauth-apple (1.4.0)
160
+ json-jwt
161
+ omniauth-oauth2
162
+ omniauth-auth0 (3.2.0)
163
+ jwt (~> 2)
164
+ omniauth (~> 2)
165
+ omniauth-oauth2 (~> 1)
166
+ omniauth-discord (1.2.0)
167
+ omniauth-oauth2 (~> 1.6)
168
+ omniauth-entra-id (3.1.1)
169
+ jwt (>= 2.9.2)
170
+ omniauth-oauth2 (~> 1.8)
171
+ omniauth-github (2.0.1)
172
+ omniauth (~> 2.0)
173
+ omniauth-oauth2 (~> 1.8)
174
+ omniauth-gitlab (4.1.0)
175
+ omniauth (~> 2.0)
176
+ omniauth-oauth2 (~> 1.8.0)
177
+ omniauth-google-oauth2 (1.2.2)
178
+ jwt (>= 2.9.2)
179
+ oauth2 (~> 2.0)
180
+ omniauth (~> 2.0)
181
+ omniauth-oauth2 (~> 1.8)
182
+ omniauth-oauth2 (1.8.0)
183
+ oauth2 (>= 1.4, < 3)
184
+ omniauth (~> 2.0)
185
+ omniauth-okta (2.0.0)
186
+ omniauth (~> 2.0)
187
+ omniauth-oauth2 (~> 1.7, >= 1.7.1)
188
+ omniauth-saml (2.2.5)
189
+ omniauth (~> 2.1)
190
+ ruby-saml (~> 1.18)
191
+ openid_connect (2.5.0)
192
+ activemodel
193
+ attr_required (>= 1.0.0)
194
+ faraday (~> 2.0)
195
+ faraday-follow_redirects
196
+ json-jwt (>= 1.16)
197
+ mail
198
+ rack-oauth2 (~> 2.2)
199
+ swd (~> 2.0)
200
+ tzinfo
201
+ validate_url
202
+ webfinger (~> 2.0)
203
+ prism (1.9.0)
204
+ public_suffix (7.0.5)
205
+ racc (1.8.1)
206
+ rack (3.2.6)
207
+ rack-cors (3.0.0)
208
+ logger
209
+ rack (>= 3.0.14)
210
+ rack-oauth2 (2.3.0)
211
+ activesupport
212
+ attr_required
213
+ faraday (~> 2.0)
214
+ faraday-follow_redirects
215
+ json-jwt (>= 1.11.0)
216
+ rack (>= 2.1.0)
217
+ rack-protection (4.2.1)
218
+ base64 (>= 0.1.0)
219
+ logger (>= 1.6.0)
220
+ rack (>= 3.0.0, < 4)
221
+ rack-session (2.1.2)
222
+ base64 (>= 0.1.0)
223
+ rack (>= 3.0.0)
224
+ rexml (3.4.4)
225
+ ruby-saml (1.18.1)
226
+ nokogiri (>= 1.13.10)
227
+ rexml
228
+ secure_headers (7.2.0)
229
+ cgi (>= 0.1)
230
+ securerandom (0.4.1)
231
+ sinatra (4.2.1)
232
+ logger (>= 1.6.0)
233
+ mustermann (~> 3.0)
234
+ rack (>= 3.0.0, < 4)
235
+ rack-protection (= 4.2.1)
236
+ rack-session (>= 2.0.0, < 3)
237
+ tilt (~> 2.0)
238
+ snaky_hash (2.0.4)
239
+ hashie (>= 0.1.0, < 6)
240
+ version_gem (>= 1.1.8, < 3)
241
+ stringio (3.2.0)
242
+ swd (2.0.3)
243
+ activesupport (>= 3)
244
+ attr_required (>= 0.0.5)
245
+ faraday (~> 2.0)
246
+ faraday-follow_redirects
247
+ tilt (2.7.0)
248
+ timeout (0.6.1)
249
+ tzinfo (2.0.6)
250
+ concurrent-ruby (~> 1.0)
251
+ uri (1.1.1)
252
+ validate_url (1.0.15)
253
+ activemodel (>= 3.0.0)
254
+ public_suffix
255
+ version_gem (1.1.10)
256
+ webfinger (2.1.3)
257
+ activesupport
258
+ faraday (~> 2.0)
259
+ faraday-follow_redirects
260
+
261
+ PLATFORMS
262
+ ruby
263
+
264
+ DEPENDENCIES
265
+ apigatewayv2_rack (>= 0.5.0)
266
+ aws-sdk-secretsmanager
267
+ aws-sdk-ssm
268
+ himari!
269
+ himari-aws!
270
+ nokogiri
271
+ omniauth-apple
272
+ omniauth-auth0
273
+ omniauth-discord
274
+ omniauth-entra-id
275
+ omniauth-github
276
+ omniauth-gitlab
277
+ omniauth-google-oauth2
278
+ omniauth-himari!
279
+ omniauth-oauth2
280
+ omniauth-okta
281
+ omniauth-saml
282
+ rack-cors
283
+ secure_headers
284
+
285
+ CHECKSUMS
286
+ activemodel (8.1.3) sha256=90c05cbe4cef3649b8f79f13016191ea94c4525ce4a5c0fb7ef909c4b91c8219
287
+ activesupport (8.1.3) sha256=21a5e0dfbd4c3ddd9e1317ec6a4d782fa226e7867dc70b0743acda81a1dca20e
288
+ addressable (2.9.0) sha256=7fdf6ac3660f7f4e867a0838be3f6cf722ace541dd97767fa42bc6cfa980c7af
289
+ aes_key_wrap (1.1.0) sha256=b935f4756b37375895db45669e79dfcdc0f7901e12d4e08974d5540c8e0776a5
290
+ apigatewayv2_rack (0.5.0) sha256=30fb327ddacfeb0490657052791cea327ef852348ca32c21fa412161bfe492b2
291
+ attr_required (1.0.2) sha256=f0ebfc56b35e874f4d0ae799066dbc1f81efefe2364ca3803dc9ea6a4de6cb99
292
+ auth-sanitizer (0.1.4) sha256=ded72221d4d3a7c91e34e8a87b21e6a42cbf7829697f140dcf49d542422faedc
293
+ aws-eventstream (1.4.0) sha256=116bf85c436200d1060811e6f5d2d40c88f65448f2125bc77ffce5121e6e183b
294
+ aws-partitions (1.1257.0) sha256=03c531f40fdd979a9ae2aae70140c60e59000e6f62a60b3d6171b78cdded960c
295
+ aws-sdk-core (3.251.0) sha256=ef8186cb5509147e590310da58fab4c5b0901eba0e85a72955abdf772e425c87
296
+ aws-sdk-dynamodb (1.168.0) sha256=9bd479a23c6ab006130c7c1ebf5f9dd4c05d90ce03255f69ca8d04748fef0aec
297
+ aws-sdk-secretsmanager (1.133.0) sha256=467d64d44aa5206fa45d9fc9d5b90290ed7aa9101ed18393caf9b8fbe5c277dc
298
+ aws-sdk-ssm (1.216.0) sha256=7d03b033d183025ae5a4b473766d215fc0fca6a2978b347a16f2a3cdff49b62c
299
+ aws-sigv4 (1.12.1) sha256=6973ff95cb0fd0dc58ba26e90e9510a2219525d07620c8babeb70ef831826c00
300
+ base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b
301
+ bigdecimal (4.1.2) sha256=53d217666027eab4280346fba98e7d5b66baaae1b9c3c1c0ffe89d48188a3fbd
302
+ bindata (2.5.1) sha256=53186a1ec2da943d4cb413583d680644eb810aacbf8902497aac8f191fad9e58
303
+ bundler (4.0.12) sha256=7f8b757d28dfb636e7b24fba2344ac6dd13b5b24f4b46d62573d483f211825ac
304
+ cgi (0.5.1) sha256=e93fcafc69b8a934fe1e6146121fa35430efa8b4a4047c4893764067036f18e9
305
+ concurrent-ruby (1.3.6) sha256=6b56837e1e7e5292f9864f34b69c5a2cbc75c0cf5338f1ce9903d10fa762d5ab
306
+ connection_pool (3.0.2) sha256=33fff5ba71a12d2aa26cb72b1db8bba2a1a01823559fb01d29eb74c286e62e0a
307
+ date (3.5.1) sha256=750d06384d7b9c15d562c76291407d89e368dda4d4fff957eb94962d325a0dc0
308
+ drb (2.2.3) sha256=0b00d6fdb50995fe4a45dea13663493c841112e4068656854646f418fda13373
309
+ faraday (2.14.2) sha256=73ccb9994a9e8648f010e32eca2ae82e41c57860aa10932cda29418b9e0223ad
310
+ faraday-follow_redirects (0.5.0) sha256=5cde93c894b30943a5d2b93c2fe9284216a6b756f7af406a1e55f211d97d10ad
311
+ faraday-net_http (3.4.4) sha256=0e78af151747ed1b00f33e25973b4bc220d7f16c00c39676817c8b12331eb588
312
+ hashie (5.1.0) sha256=c266471896f323c446ea8207f8ffac985d2718df0a0ba98651a3057096ca3870
313
+ himari (0.6.0)
314
+ himari-aws (0.3.0)
315
+ http-2 (1.1.3) sha256=1b2f379d35a11dbae94f8a1a52c053d8c161eb4a0c98b5d1605ff1b2bf171c9c
316
+ httpx (1.7.8) sha256=6d769465ed608287a272ba0e4700fc22cee6f0335d80bd5c2effaf7fb7bd2a3a
317
+ i18n (1.14.8) sha256=285778639134865c5e0f6269e0b818256017e8cde89993fdfcbfb64d088824a5
318
+ jmespath (1.6.2) sha256=238d774a58723d6c090494c8879b5e9918c19485f7e840f2c1c7532cf84ebcb1
319
+ json (2.19.8) sha256=6354310fd76ef69b87d5bd1f38b40d730613baf90b6803d2d0a48f618d32dfaa
320
+ json-jwt (1.17.1) sha256=5e1ced0f7b206b4c567efee19e6503c1426a819749132926cda579ec013d1f46
321
+ jwt (2.10.3) sha256=e4d9352fbc7309b1a7448c7dd713dfe4d8c47077af80759cdbed8f878ea0b484
322
+ logger (1.7.0) sha256=196edec7cc44b66cfb40f9755ce11b392f21f7967696af15d274dde7edff0203
323
+ mail (2.9.0) sha256=6fa6673ecd71c60c2d996260f9ee3dd387d4673b8169b502134659ece6d34941
324
+ mini_mime (1.1.5) sha256=8681b7e2e4215f2a159f9400b5816d85e9d8c6c6b491e96a12797e798f8bccef
325
+ mini_portile2 (2.8.9) sha256=0cd7c7f824e010c072e33f68bc02d85a00aeb6fce05bb4819c03dfd3c140c289
326
+ minitest (6.0.6) sha256=153ea36d1d987a62942382b61075745042a2b3123b1cd48f4c3675af9cc7d6f1
327
+ multi_xml (0.9.1) sha256=7ce766b59c17241ed62976caeae1fae9b2431b263398c35396239a68c4a64e57
328
+ mustermann (3.1.1) sha256=4c6170c7234d5499c345562ba7c7dfe73e1754286dcc1abb053064d66a127198
329
+ net-http (0.9.1) sha256=25ba0b67c63e89df626ed8fac771d0ad24ad151a858af2cc8e6a716ca4336996
330
+ net-imap (0.6.4) sha256=9a5598c67a3022c284d98430ef1d4948e7dbdb62596f61081ea8ca933270a02b
331
+ net-pop (0.1.2) sha256=848b4e982013c15b2f0382792268763b748cce91c9e91e36b0f27ed26420dff3
332
+ net-protocol (0.2.2) sha256=aa73e0cba6a125369de9837b8d8ef82a61849360eba0521900e2c3713aa162a8
333
+ net-smtp (0.5.1) sha256=ed96a0af63c524fceb4b29b0d352195c30d82dd916a42f03c62a3a70e5b70736
334
+ nokogiri (1.19.3) sha256=78312cbac32a40c812780d9678221b79d51288eec00054c1a8d15f7ce05960e8
335
+ oauth2 (2.0.20) sha256=790c6316346da12f9dcaf27a67530f802950af05d35c3874918da84f2deae674
336
+ omniauth (2.1.4) sha256=42a05b0496f0d22e1dd85d42aaf602f064e36bb47a6826a27ab55e5ba608763c
337
+ omniauth-apple (1.4.0) sha256=f449ce4c206e784536cbaf64b7c36072ac5e7c73103b1a01ba3c1d9454bf6e24
338
+ omniauth-auth0 (3.2.0) sha256=9241a8ce3ead46070f101f8f5170f09d7c2c3841321734d7a4852d954815db9c
339
+ omniauth-discord (1.2.0) sha256=e6e92649a645862ccb29ce3d5f2f876de9e26198722b9d05f9f6d4f3805d5c70
340
+ omniauth-entra-id (3.1.1) sha256=16622979423891352f916709f0698401e692e60bb41d4dbf5f7a17d98fee27ef
341
+ omniauth-github (2.0.1) sha256=8ff8e70ac6d6db9d52485eef52cfa894938c941496e66b52b5e2773ade3ccad4
342
+ omniauth-gitlab (4.1.0) sha256=543f1fa710488220b382bd683a3f314f5b29c36de85ad746f356f37795959613
343
+ omniauth-google-oauth2 (1.2.2) sha256=74c3f3d0221c048f938846092fb15a1f15237526f50a7c93d9793f9a4ff1be11
344
+ omniauth-himari (0.3.0)
345
+ omniauth-oauth2 (1.8.0) sha256=b2f8e9559cc7e2d4efba57607691d6d2b634b879fc5b5b6ccfefa3da85089e78
346
+ omniauth-okta (2.0.0) sha256=6425fd3140c3130bc8793a536f8200bfc154faac69fe6661d03959d841639655
347
+ omniauth-saml (2.2.5) sha256=552ad464564d711f0dfd169e0ad801de809cf3ac71c4bc9094f152d5a0d7ab59
348
+ openid_connect (2.5.0) sha256=659aff8edce0907798e3f6837e5f27ae2937ae8735216f3e900ab8daa29e39c4
349
+ prism (1.9.0) sha256=7b530c6a9f92c24300014919c9dcbc055bf4cdf51ec30aed099b06cd6674ef85
350
+ public_suffix (7.0.5) sha256=1a8bb08f1bbea19228d3bed6e5ed908d1cb4f7c2726d18bd9cadf60bc676f623
351
+ racc (1.8.1) sha256=4a7f6929691dbec8b5209a0b373bc2614882b55fc5d2e447a21aaa691303d62f
352
+ rack (3.2.6) sha256=5ed78e1f73b2e25679bec7d45ee2d4483cc4146eb1be0264fc4d94cb5ef212c2
353
+ rack-cors (3.0.0) sha256=7b95be61db39606906b61b83bd7203fa802b0ceaaad8fcb2fef39e097bf53f68
354
+ rack-oauth2 (2.3.0) sha256=43e02cf73f13886a0a06499603caeec58aeba6eae1fefc4977c9678b7652c632
355
+ rack-protection (4.2.1) sha256=cf6e2842df8c55f5e4d1a4be015e603e19e9bc3a7178bae58949ccbb58558bac
356
+ rack-session (2.1.2) sha256=595434f8c0c3473ae7d7ac56ecda6cc6dfd9d37c0b2b5255330aa1576967ffe8
357
+ rexml (3.4.4) sha256=19e0a2c3425dfbf2d4fc1189747bdb2f849b6c5e74180401b15734bc97b5d142
358
+ ruby-saml (1.18.1) sha256=1b0e7a44aef150b4197955f5e015d593672e242cfdc5d06aa7554ec2350b9107
359
+ secure_headers (7.2.0) sha256=713b3d20af12b8c6633d97e276b286f1520e57be0d84b00f3bf43d22a1b70f83
360
+ securerandom (0.4.1) sha256=cc5193d414a4341b6e225f0cb4446aceca8e50d5e1888743fac16987638ea0b1
361
+ sinatra (4.2.1) sha256=b7aeb9b11d046b552972ade834f1f9be98b185fa8444480688e3627625377080
362
+ snaky_hash (2.0.4) sha256=2b12758c57defa6796341a1620f84b1a23737421d8d7e2575d0550b53cc4fece
363
+ stringio (3.2.0) sha256=c37cb2e58b4ffbd33fe5cd948c05934af997b36e0b6ca6fdf43afa234cf222e1
364
+ swd (2.0.3) sha256=4cdbe2a4246c19f093fce22e967ec3ebdd4657d37673672e621bf0c7eb770655
365
+ tilt (2.7.0) sha256=0d5b9ba69f6a36490c64b0eee9f6e9aad517e20dcc848800a06eb116f08c6ab3
366
+ timeout (0.6.1) sha256=78f57368a7e7bbadec56971f78a3f5ecbcfb59b7fcbb0a3ed6ddc08a5094accb
367
+ tzinfo (2.0.6) sha256=8daf828cc77bcf7d63b0e3bdb6caa47e2272dcfaf4fbfe46f8c3a9df087a829b
368
+ uri (1.1.1) sha256=379fa58d27ffb1387eaada68c749d1426738bd0f654d812fcc07e7568f5c57c6
369
+ validate_url (1.0.15) sha256=72fe164c0713d63a9970bd6700bea948babbfbdcec392f2342b6704042f57451
370
+ version_gem (1.1.10) sha256=d0575dc9f2949b2db9497051f96e5c36d7c6c2f2e81afd1a73cacccd4690e506
371
+ webfinger (2.1.3) sha256=567a52bde77fb38ca6b67e55db755f988766ec4651c1d24916a65aa70540695c
372
+
373
+ BUNDLED WITH
374
+ 4.0.12
data/lambda/README.md ADDED
@@ -0,0 +1,42 @@
1
+ # Himari Lambda Container Image
2
+
3
+ ## Deploy
4
+
5
+ - See [./terraform/](./terraform/) for quick deployment using Terraform modules.
6
+
7
+ ## Image
8
+
9
+ ### Prebuilt image
10
+
11
+ - https://gallery.ecr.aws/sorah/himari-lambda
12
+ - `public.ecr.aws/sorah/himari-lambda`
13
+
14
+ Images are tagged with commit SHA.
15
+
16
+ ### Build an image
17
+
18
+ Run the following at the repository root:
19
+
20
+ ```
21
+ docker build -f himari-aws/lambda/Dockerfile .
22
+ ```
23
+
24
+ ### Usage
25
+
26
+ The same container image supports multiple handlers:
27
+
28
+ #### Rack app for API Gateway v2, Function URL, ALB target
29
+
30
+ - Handler: `himari_lambda_entrypoint.Himari::Aws::LambdaHandler.rack_handler`
31
+
32
+ Served through [apigatewayv2_rack](https://github.com/sorah/apigatewayv2_rack).
33
+
34
+ This handler reads `config.ru` from:
35
+
36
+ - `${LAMBDA_TASK_ROOT}/config.ru` in a container image
37
+ - DynamoDB Table item (pk=`rack`, sk=`rack:${HIMARI_RACK_DIGEST}`, file=config.ru content) on table `$HIMARI_RACK_DYNAMODB_TABLE`
38
+ - where HIMARI_RACK_DIGEST must be [base64'd sha256 hash](https://developer.hashicorp.com/terraform/language/functions/base64sha256) of `file` attribute
39
+
40
+ #### Secrets Manager automatic rotation handler
41
+
42
+ - Handler: `himari_lambda_entrypoint.Himari::Aws::LambdaHandler.secrets_rotation_handler`