himari-aws 0.2.0 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (22) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +15 -0
  3. data/README.md +1 -1
  4. data/lambda/Dockerfile +10 -3
  5. data/lambda/Gemfile +17 -6
  6. data/lambda/Gemfile.lock +258 -93
  7. data/lambda/entrypoint.rb +2 -0
  8. data/lambda/terraform/README.md +4 -1
  9. data/lambda/terraform/iam/outputs.tf +4 -0
  10. data/lambda/terraform/iam/variables.tf +1 -1
  11. data/lambda/terraform/iam/versions.tf +2 -1
  12. data/lambda/terraform/image/copy.tf +33 -5
  13. data/lambda/terraform/image/variables.tf +11 -0
  14. data/lambda/terraform/image/versions.tf +3 -1
  15. data/lib/himari/aws/dynamodb_storage.rb +41 -16
  16. data/lib/himari/aws/lambda_handler.rb +9 -5
  17. data/lib/himari/aws/secretsmanager_signing_key_provider.rb +8 -5
  18. data/lib/himari/aws/secretsmanager_signing_key_rotation_handler.rb +13 -8
  19. data/lib/himari/aws/version.rb +1 -1
  20. data/lib/himari-aws.rb +2 -0
  21. metadata +6 -10
  22. data/lambda/terraform/image/copy.sh +0 -5
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 2cc2ae7b20fd4a41872281249587bacae7170a411651458cfab901afc08a9bfe
4
- data.tar.gz: dc2cd99bad600b636b817c1534b5ea8c17e59bb49a9bf667b4ee7f0d41f17acd
3
+ metadata.gz: 85a23ea8f8d589be0168080f22f979e78d26113119166ba0a99936448b74ed7c
4
+ data.tar.gz: 1837996eac719023197e7e56544c77b2b4d93426e6942cf60e37053bf007d2c5
5
5
  SHA512:
6
- metadata.gz: 5f0fdb41114958bf5330173fd12de1db680f77ef8719d84e0fc1724ea9bb0311c8d7d63363111ec9490ee4a39227d91acff8224f601a5ae055e1199a239a7f64
7
- data.tar.gz: 2ee76e5b556d477ee37d51a92a5a4fb03d8c751c5e877d295c46970bb073cfb6bf6b7f4a70611b4ade5890caec4e15f42a98a6d94fb81a02553df6cf2815a8ff
6
+ metadata.gz: 6e74908b3c34af13b018436918b6a83f87d4180d28505348c9aba6e25024ddcab1cc323df5c151c2e45aa3ec00afb4d40b2fb2c7c6a9b6bc77193010a0d757ae
7
+ data.tar.gz: 2b5bcd9303a70d87b51c80ef9dead217844d13ec68b942941088aa3ba6e9398bd09419d102321600efa9e311c11ae596e23e404988bd8763e30d8c802cf9166b
data/CHANGELOG.md ADDED
@@ -0,0 +1,15 @@
1
+ ## [0.3.0] - 2026-06-03
2
+
3
+ ### Enhancements
4
+
5
+ - Lambda image: copy the prebuilt image with skopeo instead of docker (gains an `architecture` input), with Terraform AWS provider v6 compatibility and a `role_name` output [#18](https://github.com/sorah/himari/pull/18)
6
+ - DynamoDB storage: compare-and-swap writes backing refresh-token rotation [#14](https://github.com/sorah/himari/pull/14)
7
+ - Lambda image: bundle `omniauth-entra-id` and `omniauth-okta`, depend explicitly on `aws-sdk-ssm` and `aws-sdk-secretsmanager`, and make `rack-cors` available.
8
+
9
+ ### Changes
10
+
11
+ - Lambda image: Ruby 4.0, build on dnf, and rolled dependencies (including `apigatewayv2_rack` 0.5.0).
12
+
13
+ ## [0.2.0] - 2023-03-22
14
+
15
+ - Initial release: `Himari::Aws::DynamodbStorage`, Secrets Manager signing key provider and rotation handler, prebuilt Lambda container image, and Terraform modules.
data/README.md CHANGED
@@ -50,7 +50,7 @@ gem 'nokogiri'
50
50
 
51
51
  ### Secrets Manager Rotation Handler
52
52
 
53
- 1. Deploy [./lib/himari/aws/secretsmanager_signing_key_rotation_handler.rb]() as a Lambda function. This file works standalone.
53
+ 1. Deploy [./lib/himari/aws/secretsmanager_signing_key_rotation_handler.rb](./lib/himari/aws/secretsmanager_signing_key_rotation_handler.rb) as a Lambda function. This file works standalone.
54
54
 
55
55
  - Refer to the [./lambda](./lambda) for prebuilt container image
56
56
 
data/lambda/Dockerfile CHANGED
@@ -1,14 +1,20 @@
1
1
  # context must be repository root
2
- FROM public.ecr.aws/lambda/ruby:2.7 as builder
3
- RUN yum install -y gcc gcc-c++ make pkg-config git
2
+ FROM public.ecr.aws/lambda/ruby:4.0 as builder
3
+ RUN --mount=type=cache,target=/var/cache/dnf dnf update -y && dnf install -y gcc gcc-c++ make
4
4
 
5
5
  COPY ./himari/himari.gemspec ${LAMBDA_TASK_ROOT}/app/himari/himari.gemspec
6
6
  COPY ./himari/lib/himari/version.rb ${LAMBDA_TASK_ROOT}/app/himari/lib/himari/version.rb
7
+
7
8
  COPY ./himari-aws/himari-aws.gemspec ${LAMBDA_TASK_ROOT}/app/himari-aws/himari-aws.gemspec
8
9
  COPY ./himari-aws/lib/himari/aws/version.rb ${LAMBDA_TASK_ROOT}/app/himari-aws/lib/himari/aws/version.rb
10
+
11
+ COPY ./omniauth-himari/omniauth-himari.gemspec ${LAMBDA_TASK_ROOT}/app/omniauth-himari/omniauth-himari.gemspec
12
+ COPY ./omniauth-himari/lib/omniauth-himari/version.rb ${LAMBDA_TASK_ROOT}/app/omniauth-himari/lib/omniauth-himari/version.rb
13
+
9
14
  COPY ./himari-aws/lambda/Gemfile* ${LAMBDA_TASK_ROOT}/app/himari-aws/lambda/
10
15
  WORKDIR ${LAMBDA_TASK_ROOT}/app
11
16
 
17
+ ENV LANG=C.UTF-8
12
18
  ENV BUNDLE_GEMFILE ${LAMBDA_TASK_ROOT}/app/himari-aws/lambda/Gemfile
13
19
  ENV BUNDLE_PATH ${LAMBDA_TASK_ROOT}/vendor/bundle
14
20
  ENV BUNDLE_DEPLOYMENT 1
@@ -18,7 +24,7 @@ RUN bundle install
18
24
 
19
25
  COPY . ${LAMBDA_TASK_ROOT}/app
20
26
 
21
- FROM public.ecr.aws/lambda/ruby:2.7
27
+ FROM public.ecr.aws/lambda/ruby:4.0
22
28
 
23
29
  COPY --from=builder ${LAMBDA_TASK_ROOT}/vendor ${LAMBDA_TASK_ROOT}/vendor
24
30
  COPY . ${LAMBDA_TASK_ROOT}/app
@@ -26,6 +32,7 @@ COPY . ${LAMBDA_TASK_ROOT}/app
26
32
  COPY ./himari-aws/lambda/entrypoint.rb ${LAMBDA_TASK_ROOT}/himari_lambda_entrypoint.rb
27
33
 
28
34
  WORKDIR ${LAMBDA_TASK_ROOT}/app
35
+ ENV LANG=C.UTF-8
29
36
  ENV BUNDLE_GEMFILE ${LAMBDA_TASK_ROOT}/app/himari-aws/lambda/Gemfile
30
37
  ENV BUNDLE_PATH ${LAMBDA_TASK_ROOT}/vendor/bundle
31
38
  ENV BUNDLE_DEPLOYMENT 1
data/lambda/Gemfile CHANGED
@@ -1,24 +1,35 @@
1
+ # frozen_string_literal: true
2
+
1
3
  source 'https://rubygems.org'
2
4
 
3
5
  root = File.join('..', '..')
4
6
 
5
7
  gem 'himari', path: File.join(root, 'himari')
6
8
  gem 'himari-aws', path: File.join(root, 'himari-aws')
9
+ gem 'omniauth-himari', path: File.join(root, 'omniauth-himari')
10
+
11
+ gem 'aws-sdk-secretsmanager'
12
+ gem 'aws-sdk-ssm' # paraemeter store
7
13
  gem 'nokogiri'
8
- #gem 'apigatewayv2_rack', git: 'https://github.com/sorah/apigatewayv2_rack'
9
- gem 'apigatewayv2_rack', '>= 0.1.3'
14
+ # gem 'apigatewayv2_rack', git: 'https://github.com/sorah/apigatewayv2_rack'
15
+ gem 'apigatewayv2_rack', '>= 0.5.0'
10
16
 
11
17
  # contribs
18
+ gem 'secure_headers'
19
+ gem 'rack-cors'
20
+
12
21
  gem 'omniauth-oauth2'
13
22
  gem 'omniauth-saml'
14
- #gem 'omniauth-twitter'
23
+ # gem 'omniauth-twitter'
15
24
  gem 'omniauth-github'
16
25
  gem 'omniauth-auth0'
17
- #gem 'omniauth-shibboleth'
26
+ gem 'omniauth-entra-id'
27
+ gem 'omniauth-okta'
28
+ # gem 'omniauth-shibboleth'
18
29
  gem 'omniauth-gitlab'
19
- #gem 'omniauth-kerberos'
30
+ # gem 'omniauth-kerberos'
20
31
  gem 'omniauth-google-oauth2'
21
32
  gem 'omniauth-discord'
22
33
  gem 'omniauth-apple'
23
34
  # gem 'omniauth-ldap' # omniauth < 2
24
- #gem 'omniauth-slack'# omniauth-oauth2 version constraints does not match with omniauth-github
35
+ # gem 'omniauth-slack'# omniauth-oauth2 version constraints does not match with omniauth-github
data/lambda/Gemfile.lock CHANGED
@@ -1,18 +1,30 @@
1
1
  PATH
2
2
  remote: ../../himari
3
3
  specs:
4
- himari (0.2.0)
4
+ himari (0.6.0)
5
5
  addressable
6
+ concurrent-ruby
7
+ httpx
6
8
  omniauth (>= 2.0)
7
9
  openid_connect
8
10
  rack-oauth2
9
11
  rack-protection
10
12
  sinatra (>= 3.0)
11
13
 
14
+ PATH
15
+ remote: ../../omniauth-himari
16
+ specs:
17
+ omniauth-himari (0.3.0)
18
+ faraday
19
+ jwt
20
+ oauth2
21
+ omniauth
22
+ omniauth-oauth2
23
+
12
24
  PATH
13
25
  remote: ..
14
26
  specs:
15
- himari-aws (0.2.0)
27
+ himari-aws (0.3.0)
16
28
  apigatewayv2_rack
17
29
  aws-sdk-dynamodb
18
30
  aws-sdk-secretsmanager
@@ -21,169 +33,227 @@ PATH
21
33
  GEM
22
34
  remote: https://rubygems.org/
23
35
  specs:
24
- activemodel (7.0.4.3)
25
- activesupport (= 7.0.4.3)
26
- activesupport (7.0.4.3)
27
- concurrent-ruby (~> 1.0, >= 1.0.2)
36
+ activemodel (8.1.3)
37
+ activesupport (= 8.1.3)
38
+ activesupport (8.1.3)
39
+ base64
40
+ bigdecimal
41
+ concurrent-ruby (~> 1.0, >= 1.3.1)
42
+ connection_pool (>= 2.2.5)
43
+ drb
28
44
  i18n (>= 1.6, < 2)
45
+ json
46
+ logger (>= 1.4.2)
29
47
  minitest (>= 5.1)
30
- tzinfo (~> 2.0)
31
- addressable (2.8.1)
32
- public_suffix (>= 2.0.2, < 6.0)
48
+ securerandom (>= 0.3)
49
+ tzinfo (~> 2.0, >= 2.0.5)
50
+ uri (>= 0.13.1)
51
+ addressable (2.9.0)
52
+ public_suffix (>= 2.0.2, < 8.0)
33
53
  aes_key_wrap (1.1.0)
34
- apigatewayv2_rack (0.1.3)
54
+ apigatewayv2_rack (0.5.0)
55
+ base64
35
56
  rack
36
- attr_required (1.0.1)
37
- aws-eventstream (1.2.0)
38
- aws-partitions (1.732.0)
39
- aws-sdk-core (3.170.1)
40
- aws-eventstream (~> 1, >= 1.0.2)
41
- aws-partitions (~> 1, >= 1.651.0)
42
- aws-sigv4 (~> 1.5)
57
+ stringio
58
+ attr_required (1.0.2)
59
+ auth-sanitizer (0.1.4)
60
+ version_gem (~> 1.1, >= 1.1.9)
61
+ aws-eventstream (1.4.0)
62
+ aws-partitions (1.1257.0)
63
+ aws-sdk-core (3.251.0)
64
+ aws-eventstream (~> 1, >= 1.3.0)
65
+ aws-partitions (~> 1, >= 1.992.0)
66
+ aws-sigv4 (~> 1.9)
67
+ base64
68
+ bigdecimal
43
69
  jmespath (~> 1, >= 1.6.1)
44
- aws-sdk-dynamodb (1.83.0)
45
- aws-sdk-core (~> 3, >= 3.165.0)
46
- aws-sigv4 (~> 1.1)
47
- aws-sdk-secretsmanager (1.73.0)
48
- aws-sdk-core (~> 3, >= 3.165.0)
49
- aws-sigv4 (~> 1.1)
50
- aws-sigv4 (1.5.2)
70
+ logger
71
+ aws-sdk-dynamodb (1.168.0)
72
+ aws-sdk-core (~> 3, >= 3.248.0)
73
+ aws-sigv4 (~> 1.5)
74
+ aws-sdk-secretsmanager (1.133.0)
75
+ aws-sdk-core (~> 3, >= 3.248.0)
76
+ aws-sigv4 (~> 1.5)
77
+ aws-sdk-ssm (1.216.0)
78
+ aws-sdk-core (~> 3, >= 3.248.0)
79
+ aws-sigv4 (~> 1.5)
80
+ aws-sigv4 (1.12.1)
51
81
  aws-eventstream (~> 1, >= 1.0.2)
52
- bindata (2.4.15)
53
- concurrent-ruby (1.2.2)
54
- date (3.3.3)
55
- faraday (2.7.4)
56
- faraday-net_http (>= 2.0, < 3.1)
57
- ruby2_keywords (>= 0.0.4)
58
- faraday-follow_redirects (0.3.0)
82
+ base64 (0.3.0)
83
+ bigdecimal (4.1.2)
84
+ bindata (2.5.1)
85
+ cgi (0.5.1)
86
+ concurrent-ruby (1.3.6)
87
+ connection_pool (3.0.2)
88
+ date (3.5.1)
89
+ drb (2.2.3)
90
+ faraday (2.14.2)
91
+ faraday-net_http (>= 2.0, < 3.5)
92
+ json
93
+ logger
94
+ faraday-follow_redirects (0.5.0)
59
95
  faraday (>= 1, < 3)
60
- faraday-net_http (3.0.2)
61
- hashie (5.0.0)
62
- i18n (1.12.0)
96
+ faraday-net_http (3.4.4)
97
+ net-http (~> 0.5)
98
+ hashie (5.1.0)
99
+ logger
100
+ http-2 (1.1.3)
101
+ httpx (1.7.8)
102
+ http-2 (>= 1.1.3)
103
+ i18n (1.14.8)
63
104
  concurrent-ruby (~> 1.0)
64
105
  jmespath (1.6.2)
65
- json-jwt (1.16.3)
106
+ json (2.19.8)
107
+ json-jwt (1.17.1)
66
108
  activesupport (>= 4.2)
67
109
  aes_key_wrap
110
+ base64
68
111
  bindata
69
112
  faraday (~> 2.0)
70
113
  faraday-follow_redirects
71
- jwt (2.7.0)
72
- mail (2.8.1)
114
+ jwt (2.10.3)
115
+ base64
116
+ logger (1.7.0)
117
+ mail (2.9.0)
118
+ logger
73
119
  mini_mime (>= 0.1.1)
74
120
  net-imap
75
121
  net-pop
76
122
  net-smtp
77
- mini_mime (1.1.2)
78
- mini_portile2 (2.8.1)
79
- minitest (5.18.0)
80
- multi_xml (0.6.0)
81
- mustermann (3.0.0)
82
- ruby2_keywords (~> 0.0.1)
83
- net-imap (0.3.4)
123
+ mini_mime (1.1.5)
124
+ mini_portile2 (2.8.9)
125
+ minitest (6.0.6)
126
+ drb (~> 2.0)
127
+ prism (~> 1.5)
128
+ multi_xml (0.9.1)
129
+ bigdecimal (>= 3.1, < 5)
130
+ mustermann (3.1.1)
131
+ net-http (0.9.1)
132
+ uri (>= 0.11.1)
133
+ net-imap (0.6.4)
84
134
  date
85
135
  net-protocol
86
136
  net-pop (0.1.2)
87
137
  net-protocol
88
- net-protocol (0.2.1)
138
+ net-protocol (0.2.2)
89
139
  timeout
90
- net-smtp (0.3.3)
140
+ net-smtp (0.5.1)
91
141
  net-protocol
92
- nokogiri (1.14.2)
93
- mini_portile2 (~> 2.8.0)
142
+ nokogiri (1.19.3)
143
+ mini_portile2 (~> 2.8.2)
94
144
  racc (~> 1.4)
95
- oauth2 (2.0.9)
96
- faraday (>= 0.17.3, < 3.0)
97
- jwt (>= 1.0, < 3.0)
145
+ oauth2 (2.0.20)
146
+ auth-sanitizer (~> 0.1, >= 0.1.3)
147
+ faraday (>= 0.17.3, < 4.0)
148
+ jwt (>= 1.0, < 4.0)
149
+ logger (~> 1.2)
98
150
  multi_xml (~> 0.5)
99
151
  rack (>= 1.2, < 4)
100
- snaky_hash (~> 2.0)
101
- version_gem (~> 1.1)
102
- omniauth (2.1.1)
152
+ snaky_hash (~> 2.0, >= 2.0.4)
153
+ version_gem (~> 1.1, >= 1.1.9)
154
+ omniauth (2.1.4)
103
155
  hashie (>= 3.4.6)
156
+ logger
104
157
  rack (>= 2.2.3)
105
158
  rack-protection
106
- omniauth-apple (1.3.0)
159
+ omniauth-apple (1.4.0)
107
160
  json-jwt
108
161
  omniauth-oauth2
109
- omniauth-auth0 (3.1.0)
162
+ omniauth-auth0 (3.2.0)
163
+ jwt (~> 2)
110
164
  omniauth (~> 2)
111
165
  omniauth-oauth2 (~> 1)
112
- omniauth-discord (1.0.0)
113
- omniauth
114
- omniauth-oauth2
166
+ omniauth-discord (1.2.0)
167
+ omniauth-oauth2 (~> 1.6)
168
+ omniauth-entra-id (3.1.1)
169
+ jwt (>= 2.9.2)
170
+ omniauth-oauth2 (~> 1.8)
115
171
  omniauth-github (2.0.1)
116
172
  omniauth (~> 2.0)
117
173
  omniauth-oauth2 (~> 1.8)
118
174
  omniauth-gitlab (4.1.0)
119
175
  omniauth (~> 2.0)
120
176
  omniauth-oauth2 (~> 1.8.0)
121
- omniauth-google-oauth2 (1.1.1)
122
- jwt (>= 2.0)
123
- oauth2 (~> 2.0.6)
177
+ omniauth-google-oauth2 (1.2.2)
178
+ jwt (>= 2.9.2)
179
+ oauth2 (~> 2.0)
124
180
  omniauth (~> 2.0)
125
- omniauth-oauth2 (~> 1.8.0)
181
+ omniauth-oauth2 (~> 1.8)
126
182
  omniauth-oauth2 (1.8.0)
127
183
  oauth2 (>= 1.4, < 3)
128
184
  omniauth (~> 2.0)
129
- omniauth-saml (2.1.0)
185
+ omniauth-okta (2.0.0)
130
186
  omniauth (~> 2.0)
131
- ruby-saml (~> 1.12)
132
- openid_connect (2.2.0)
187
+ omniauth-oauth2 (~> 1.7, >= 1.7.1)
188
+ omniauth-saml (2.2.5)
189
+ omniauth (~> 2.1)
190
+ ruby-saml (~> 1.18)
191
+ openid_connect (2.5.0)
133
192
  activemodel
134
193
  attr_required (>= 1.0.0)
135
194
  faraday (~> 2.0)
136
195
  faraday-follow_redirects
137
196
  json-jwt (>= 1.16)
138
- net-smtp
197
+ mail
139
198
  rack-oauth2 (~> 2.2)
140
199
  swd (~> 2.0)
141
200
  tzinfo
142
- validate_email
143
201
  validate_url
144
202
  webfinger (~> 2.0)
145
- public_suffix (5.0.1)
146
- racc (1.6.2)
147
- rack (2.2.6.4)
148
- rack-oauth2 (2.2.0)
203
+ prism (1.9.0)
204
+ public_suffix (7.0.5)
205
+ racc (1.8.1)
206
+ rack (3.2.6)
207
+ rack-cors (3.0.0)
208
+ logger
209
+ rack (>= 3.0.14)
210
+ rack-oauth2 (2.3.0)
149
211
  activesupport
150
212
  attr_required
151
213
  faraday (~> 2.0)
152
214
  faraday-follow_redirects
153
215
  json-jwt (>= 1.11.0)
154
216
  rack (>= 2.1.0)
155
- rack-protection (3.0.5)
156
- rack
157
- rexml (3.2.5)
158
- ruby-saml (1.15.0)
217
+ rack-protection (4.2.1)
218
+ base64 (>= 0.1.0)
219
+ logger (>= 1.6.0)
220
+ rack (>= 3.0.0, < 4)
221
+ rack-session (2.1.2)
222
+ base64 (>= 0.1.0)
223
+ rack (>= 3.0.0)
224
+ rexml (3.4.4)
225
+ ruby-saml (1.18.1)
159
226
  nokogiri (>= 1.13.10)
160
227
  rexml
161
- ruby2_keywords (0.0.5)
162
- sinatra (3.0.5)
228
+ secure_headers (7.2.0)
229
+ cgi (>= 0.1)
230
+ securerandom (0.4.1)
231
+ sinatra (4.2.1)
232
+ logger (>= 1.6.0)
163
233
  mustermann (~> 3.0)
164
- rack (~> 2.2, >= 2.2.4)
165
- rack-protection (= 3.0.5)
234
+ rack (>= 3.0.0, < 4)
235
+ rack-protection (= 4.2.1)
236
+ rack-session (>= 2.0.0, < 3)
166
237
  tilt (~> 2.0)
167
- snaky_hash (2.0.1)
168
- hashie
169
- version_gem (~> 1.1, >= 1.1.1)
170
- swd (2.0.2)
238
+ snaky_hash (2.0.4)
239
+ hashie (>= 0.1.0, < 6)
240
+ version_gem (>= 1.1.8, < 3)
241
+ stringio (3.2.0)
242
+ swd (2.0.3)
171
243
  activesupport (>= 3)
172
244
  attr_required (>= 0.0.5)
173
245
  faraday (~> 2.0)
174
246
  faraday-follow_redirects
175
- tilt (2.1.0)
176
- timeout (0.3.2)
247
+ tilt (2.7.0)
248
+ timeout (0.6.1)
177
249
  tzinfo (2.0.6)
178
250
  concurrent-ruby (~> 1.0)
179
- validate_email (0.1.6)
180
- activemodel (>= 3.0)
181
- mail (>= 2.2.5)
251
+ uri (1.1.1)
182
252
  validate_url (1.0.15)
183
253
  activemodel (>= 3.0.0)
184
254
  public_suffix
185
- version_gem (1.1.2)
186
- webfinger (2.1.2)
255
+ version_gem (1.1.10)
256
+ webfinger (2.1.3)
187
257
  activesupport
188
258
  faraday (~> 2.0)
189
259
  faraday-follow_redirects
@@ -192,18 +262,113 @@ PLATFORMS
192
262
  ruby
193
263
 
194
264
  DEPENDENCIES
195
- apigatewayv2_rack (>= 0.1.3)
265
+ apigatewayv2_rack (>= 0.5.0)
266
+ aws-sdk-secretsmanager
267
+ aws-sdk-ssm
196
268
  himari!
197
269
  himari-aws!
198
270
  nokogiri
199
271
  omniauth-apple
200
272
  omniauth-auth0
201
273
  omniauth-discord
274
+ omniauth-entra-id
202
275
  omniauth-github
203
276
  omniauth-gitlab
204
277
  omniauth-google-oauth2
278
+ omniauth-himari!
205
279
  omniauth-oauth2
280
+ omniauth-okta
206
281
  omniauth-saml
282
+ rack-cors
283
+ secure_headers
284
+
285
+ CHECKSUMS
286
+ activemodel (8.1.3) sha256=90c05cbe4cef3649b8f79f13016191ea94c4525ce4a5c0fb7ef909c4b91c8219
287
+ activesupport (8.1.3) sha256=21a5e0dfbd4c3ddd9e1317ec6a4d782fa226e7867dc70b0743acda81a1dca20e
288
+ addressable (2.9.0) sha256=7fdf6ac3660f7f4e867a0838be3f6cf722ace541dd97767fa42bc6cfa980c7af
289
+ aes_key_wrap (1.1.0) sha256=b935f4756b37375895db45669e79dfcdc0f7901e12d4e08974d5540c8e0776a5
290
+ apigatewayv2_rack (0.5.0) sha256=30fb327ddacfeb0490657052791cea327ef852348ca32c21fa412161bfe492b2
291
+ attr_required (1.0.2) sha256=f0ebfc56b35e874f4d0ae799066dbc1f81efefe2364ca3803dc9ea6a4de6cb99
292
+ auth-sanitizer (0.1.4) sha256=ded72221d4d3a7c91e34e8a87b21e6a42cbf7829697f140dcf49d542422faedc
293
+ aws-eventstream (1.4.0) sha256=116bf85c436200d1060811e6f5d2d40c88f65448f2125bc77ffce5121e6e183b
294
+ aws-partitions (1.1257.0) sha256=03c531f40fdd979a9ae2aae70140c60e59000e6f62a60b3d6171b78cdded960c
295
+ aws-sdk-core (3.251.0) sha256=ef8186cb5509147e590310da58fab4c5b0901eba0e85a72955abdf772e425c87
296
+ aws-sdk-dynamodb (1.168.0) sha256=9bd479a23c6ab006130c7c1ebf5f9dd4c05d90ce03255f69ca8d04748fef0aec
297
+ aws-sdk-secretsmanager (1.133.0) sha256=467d64d44aa5206fa45d9fc9d5b90290ed7aa9101ed18393caf9b8fbe5c277dc
298
+ aws-sdk-ssm (1.216.0) sha256=7d03b033d183025ae5a4b473766d215fc0fca6a2978b347a16f2a3cdff49b62c
299
+ aws-sigv4 (1.12.1) sha256=6973ff95cb0fd0dc58ba26e90e9510a2219525d07620c8babeb70ef831826c00
300
+ base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b
301
+ bigdecimal (4.1.2) sha256=53d217666027eab4280346fba98e7d5b66baaae1b9c3c1c0ffe89d48188a3fbd
302
+ bindata (2.5.1) sha256=53186a1ec2da943d4cb413583d680644eb810aacbf8902497aac8f191fad9e58
303
+ bundler (4.0.12) sha256=7f8b757d28dfb636e7b24fba2344ac6dd13b5b24f4b46d62573d483f211825ac
304
+ cgi (0.5.1) sha256=e93fcafc69b8a934fe1e6146121fa35430efa8b4a4047c4893764067036f18e9
305
+ concurrent-ruby (1.3.6) sha256=6b56837e1e7e5292f9864f34b69c5a2cbc75c0cf5338f1ce9903d10fa762d5ab
306
+ connection_pool (3.0.2) sha256=33fff5ba71a12d2aa26cb72b1db8bba2a1a01823559fb01d29eb74c286e62e0a
307
+ date (3.5.1) sha256=750d06384d7b9c15d562c76291407d89e368dda4d4fff957eb94962d325a0dc0
308
+ drb (2.2.3) sha256=0b00d6fdb50995fe4a45dea13663493c841112e4068656854646f418fda13373
309
+ faraday (2.14.2) sha256=73ccb9994a9e8648f010e32eca2ae82e41c57860aa10932cda29418b9e0223ad
310
+ faraday-follow_redirects (0.5.0) sha256=5cde93c894b30943a5d2b93c2fe9284216a6b756f7af406a1e55f211d97d10ad
311
+ faraday-net_http (3.4.4) sha256=0e78af151747ed1b00f33e25973b4bc220d7f16c00c39676817c8b12331eb588
312
+ hashie (5.1.0) sha256=c266471896f323c446ea8207f8ffac985d2718df0a0ba98651a3057096ca3870
313
+ himari (0.6.0)
314
+ himari-aws (0.3.0)
315
+ http-2 (1.1.3) sha256=1b2f379d35a11dbae94f8a1a52c053d8c161eb4a0c98b5d1605ff1b2bf171c9c
316
+ httpx (1.7.8) sha256=6d769465ed608287a272ba0e4700fc22cee6f0335d80bd5c2effaf7fb7bd2a3a
317
+ i18n (1.14.8) sha256=285778639134865c5e0f6269e0b818256017e8cde89993fdfcbfb64d088824a5
318
+ jmespath (1.6.2) sha256=238d774a58723d6c090494c8879b5e9918c19485f7e840f2c1c7532cf84ebcb1
319
+ json (2.19.8) sha256=6354310fd76ef69b87d5bd1f38b40d730613baf90b6803d2d0a48f618d32dfaa
320
+ json-jwt (1.17.1) sha256=5e1ced0f7b206b4c567efee19e6503c1426a819749132926cda579ec013d1f46
321
+ jwt (2.10.3) sha256=e4d9352fbc7309b1a7448c7dd713dfe4d8c47077af80759cdbed8f878ea0b484
322
+ logger (1.7.0) sha256=196edec7cc44b66cfb40f9755ce11b392f21f7967696af15d274dde7edff0203
323
+ mail (2.9.0) sha256=6fa6673ecd71c60c2d996260f9ee3dd387d4673b8169b502134659ece6d34941
324
+ mini_mime (1.1.5) sha256=8681b7e2e4215f2a159f9400b5816d85e9d8c6c6b491e96a12797e798f8bccef
325
+ mini_portile2 (2.8.9) sha256=0cd7c7f824e010c072e33f68bc02d85a00aeb6fce05bb4819c03dfd3c140c289
326
+ minitest (6.0.6) sha256=153ea36d1d987a62942382b61075745042a2b3123b1cd48f4c3675af9cc7d6f1
327
+ multi_xml (0.9.1) sha256=7ce766b59c17241ed62976caeae1fae9b2431b263398c35396239a68c4a64e57
328
+ mustermann (3.1.1) sha256=4c6170c7234d5499c345562ba7c7dfe73e1754286dcc1abb053064d66a127198
329
+ net-http (0.9.1) sha256=25ba0b67c63e89df626ed8fac771d0ad24ad151a858af2cc8e6a716ca4336996
330
+ net-imap (0.6.4) sha256=9a5598c67a3022c284d98430ef1d4948e7dbdb62596f61081ea8ca933270a02b
331
+ net-pop (0.1.2) sha256=848b4e982013c15b2f0382792268763b748cce91c9e91e36b0f27ed26420dff3
332
+ net-protocol (0.2.2) sha256=aa73e0cba6a125369de9837b8d8ef82a61849360eba0521900e2c3713aa162a8
333
+ net-smtp (0.5.1) sha256=ed96a0af63c524fceb4b29b0d352195c30d82dd916a42f03c62a3a70e5b70736
334
+ nokogiri (1.19.3) sha256=78312cbac32a40c812780d9678221b79d51288eec00054c1a8d15f7ce05960e8
335
+ oauth2 (2.0.20) sha256=790c6316346da12f9dcaf27a67530f802950af05d35c3874918da84f2deae674
336
+ omniauth (2.1.4) sha256=42a05b0496f0d22e1dd85d42aaf602f064e36bb47a6826a27ab55e5ba608763c
337
+ omniauth-apple (1.4.0) sha256=f449ce4c206e784536cbaf64b7c36072ac5e7c73103b1a01ba3c1d9454bf6e24
338
+ omniauth-auth0 (3.2.0) sha256=9241a8ce3ead46070f101f8f5170f09d7c2c3841321734d7a4852d954815db9c
339
+ omniauth-discord (1.2.0) sha256=e6e92649a645862ccb29ce3d5f2f876de9e26198722b9d05f9f6d4f3805d5c70
340
+ omniauth-entra-id (3.1.1) sha256=16622979423891352f916709f0698401e692e60bb41d4dbf5f7a17d98fee27ef
341
+ omniauth-github (2.0.1) sha256=8ff8e70ac6d6db9d52485eef52cfa894938c941496e66b52b5e2773ade3ccad4
342
+ omniauth-gitlab (4.1.0) sha256=543f1fa710488220b382bd683a3f314f5b29c36de85ad746f356f37795959613
343
+ omniauth-google-oauth2 (1.2.2) sha256=74c3f3d0221c048f938846092fb15a1f15237526f50a7c93d9793f9a4ff1be11
344
+ omniauth-himari (0.3.0)
345
+ omniauth-oauth2 (1.8.0) sha256=b2f8e9559cc7e2d4efba57607691d6d2b634b879fc5b5b6ccfefa3da85089e78
346
+ omniauth-okta (2.0.0) sha256=6425fd3140c3130bc8793a536f8200bfc154faac69fe6661d03959d841639655
347
+ omniauth-saml (2.2.5) sha256=552ad464564d711f0dfd169e0ad801de809cf3ac71c4bc9094f152d5a0d7ab59
348
+ openid_connect (2.5.0) sha256=659aff8edce0907798e3f6837e5f27ae2937ae8735216f3e900ab8daa29e39c4
349
+ prism (1.9.0) sha256=7b530c6a9f92c24300014919c9dcbc055bf4cdf51ec30aed099b06cd6674ef85
350
+ public_suffix (7.0.5) sha256=1a8bb08f1bbea19228d3bed6e5ed908d1cb4f7c2726d18bd9cadf60bc676f623
351
+ racc (1.8.1) sha256=4a7f6929691dbec8b5209a0b373bc2614882b55fc5d2e447a21aaa691303d62f
352
+ rack (3.2.6) sha256=5ed78e1f73b2e25679bec7d45ee2d4483cc4146eb1be0264fc4d94cb5ef212c2
353
+ rack-cors (3.0.0) sha256=7b95be61db39606906b61b83bd7203fa802b0ceaaad8fcb2fef39e097bf53f68
354
+ rack-oauth2 (2.3.0) sha256=43e02cf73f13886a0a06499603caeec58aeba6eae1fefc4977c9678b7652c632
355
+ rack-protection (4.2.1) sha256=cf6e2842df8c55f5e4d1a4be015e603e19e9bc3a7178bae58949ccbb58558bac
356
+ rack-session (2.1.2) sha256=595434f8c0c3473ae7d7ac56ecda6cc6dfd9d37c0b2b5255330aa1576967ffe8
357
+ rexml (3.4.4) sha256=19e0a2c3425dfbf2d4fc1189747bdb2f849b6c5e74180401b15734bc97b5d142
358
+ ruby-saml (1.18.1) sha256=1b0e7a44aef150b4197955f5e015d593672e242cfdc5d06aa7554ec2350b9107
359
+ secure_headers (7.2.0) sha256=713b3d20af12b8c6633d97e276b286f1520e57be0d84b00f3bf43d22a1b70f83
360
+ securerandom (0.4.1) sha256=cc5193d414a4341b6e225f0cb4446aceca8e50d5e1888743fac16987638ea0b1
361
+ sinatra (4.2.1) sha256=b7aeb9b11d046b552972ade834f1f9be98b185fa8444480688e3627625377080
362
+ snaky_hash (2.0.4) sha256=2b12758c57defa6796341a1620f84b1a23737421d8d7e2575d0550b53cc4fece
363
+ stringio (3.2.0) sha256=c37cb2e58b4ffbd33fe5cd948c05934af997b36e0b6ca6fdf43afa234cf222e1
364
+ swd (2.0.3) sha256=4cdbe2a4246c19f093fce22e967ec3ebdd4657d37673672e621bf0c7eb770655
365
+ tilt (2.7.0) sha256=0d5b9ba69f6a36490c64b0eee9f6e9aad517e20dcc848800a06eb116f08c6ab3
366
+ timeout (0.6.1) sha256=78f57368a7e7bbadec56971f78a3f5ecbcfb59b7fcbb0a3ed6ddc08a5094accb
367
+ tzinfo (2.0.6) sha256=8daf828cc77bcf7d63b0e3bdb6caa47e2272dcfaf4fbfe46f8c3a9df087a829b
368
+ uri (1.1.1) sha256=379fa58d27ffb1387eaada68c749d1426738bd0f654d812fcc07e7568f5c57c6
369
+ validate_url (1.0.15) sha256=72fe164c0713d63a9970bd6700bea948babbfbdcec392f2342b6704042f57451
370
+ version_gem (1.1.10) sha256=d0575dc9f2949b2db9497051f96e5c36d7c6c2f2e81afd1a73cacccd4690e506
371
+ webfinger (2.1.3) sha256=567a52bde77fb38ca6b67e55db755f988766ec4651c1d24916a65aa70540695c
207
372
 
208
373
  BUNDLED WITH
209
- 2.3.21
374
+ 4.0.12
data/lambda/entrypoint.rb CHANGED
@@ -1,3 +1,5 @@
1
+ # frozen_string_literal: true
2
+
1
3
  # BUNDLE_GEMFILE is defined at Dockerfile
2
4
  require 'bundler/setup'
3
5
  require 'himari/aws/lambda_handler'
data/lambda/terraform/README.md CHANGED
@@ -36,10 +36,13 @@ module "himari_image" {
36
36
 
37
37
  repository_name = "himari-lambda"
38
38
  source_image_tag = "" # Replace with image tag
39
+ architecture = "x86_64" # or arm64; must match the Lambda architecture
39
40
  }
40
41
  ```
41
42
 
42
- - Uses null_resource with `docker` command to perform pull, retag and push to ECR private locally
43
+ - Uses null_resource with `skopeo` command to copy the image to ECR private locally (requires `skopeo` on the machine running Terraform)
44
+ - `architecture` selects which platform to copy out of the multi-arch source image (defaults to `x86_64`); set it to match the `architecture` you pass to the functions module
45
+ - Requires Terraform >= 1.10 and AWS provider >= 5.83 (ephemeral resource for ECR credentials)
43
46
  - Prebuilt image tag is based on git commit SHA: https://github.com/sorah/himari/commits/main
44
47
 
45
48
  ## functions
data/lambda/terraform/iam/outputs.tf CHANGED
@@ -1,3 +1,7 @@
1
1
  output "role_arn" {
2
2
  value = aws_iam_role.role.arn
3
3
  }
4
+
5
+ output "role_name" {
6
+ value = aws_iam_role.role.name
7
+ }
data/lambda/terraform/iam/variables.tf CHANGED
@@ -40,5 +40,5 @@ variable "secrets_rotation_function_arn" {
40
40
  }
41
41
 
42
42
  locals {
43
- dynamodb_table_arn = coalesce(var.dynamodb_table_arn, var.dynamodb_table_name != null ? "arn:aws:dynamodb:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:table/${var.dynamodb_table_name}" : null)
43
+ dynamodb_table_arn = coalesce(var.dynamodb_table_arn, var.dynamodb_table_name != null ? "arn:aws:dynamodb:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:table/${var.dynamodb_table_name}" : null)
44
44
  }
data/lambda/terraform/iam/versions.tf CHANGED
@@ -1,7 +1,8 @@
1
1
  terraform {
2
2
  required_providers {
3
3
  aws = {
4
- source = "hashicorp/aws"
4
+ source = "hashicorp/aws"
5
+ version = ">= 6.0"
5
6
  }
6
7
  }
7
8
  }
data/lambda/terraform/image/copy.tf CHANGED
@@ -1,17 +1,45 @@
1
+ ephemeral "aws_ecr_authorization_token" "repo" {}
2
+
3
+ locals {
4
+ # Map Lambda's architecture notation to the source image's OS/arch so skopeo
5
+ # picks the matching image out of the multi-arch index deterministically,
6
+ # regardless of the host running Terraform.
7
+ skopeo_platform = {
8
+ x86_64 = { os = "linux", arch = "amd64" }
9
+ arm64 = { os = "linux", arch = "arm64" }
10
+ }[var.architecture]
11
+ }
12
+
1
13
  resource "null_resource" "copy-image" {
2
14
  triggers = {
3
- region = data.aws_region.current.name
15
+ region = data.aws_region.current.region
4
16
  repository_url = aws_ecr_repository.repo.repository_url
5
17
  source_image_tag = var.source_image_tag
18
+ architecture = var.architecture
6
19
  }
20
+
7
21
  provisioner "local-exec" {
8
- command = "cd ${path.module} && ./copy.sh"
9
- environment = {
10
- AWS_REGION = data.aws_region.current.name
11
- AWS_DEFAULT_REGION = data.aws_region.current.name
22
+ interpreter = ["/bin/bash", "-c"]
23
+ # public.ecr.aws is pulled anonymously; only the destination ECR needs credentials.
24
+ # The password is fed over stdin into a temporary authfile rather than passed as a
25
+ # command-line argument, so it never appears in the process argument list.
26
+ command = <<-EOT
27
+ set -euo pipefail
28
+ authfile="$(mktemp)"
29
+ trap 'rm -f "$authfile"' EXIT
30
+ # skopeo login reads the authfile before merging the new credential into it,
31
+ # so seed it with an empty JSON object; mktemp's 0-byte file is invalid JSON.
32
+ printf '{}' > "$authfile"
33
+ printf '%s' "$DEST_PASSWORD" | skopeo login --username AWS --password-stdin --authfile "$authfile" "$${REPOSITORY_URL%%/*}"
34
+ skopeo copy --authfile "$authfile" --override-os "$OVERRIDE_OS" --override-arch "$OVERRIDE_ARCH" "docker://public.ecr.aws/sorah/himari-lambda:$SOURCE_IMAGE_TAG" "docker://$REPOSITORY_URL:$SOURCE_IMAGE_TAG"
35
+ EOT
12
36
 
37
+ environment = {
38
+ DEST_PASSWORD = ephemeral.aws_ecr_authorization_token.repo.password
13
39
  REPOSITORY_URL = aws_ecr_repository.repo.repository_url
14
40
  SOURCE_IMAGE_TAG = var.source_image_tag
41
+ OVERRIDE_OS = local.skopeo_platform.os
42
+ OVERRIDE_ARCH = local.skopeo_platform.arch
15
43
  }
16
44
  }
17
45
  }
data/lambda/terraform/image/variables.tf CHANGED
@@ -7,3 +7,14 @@ variable "source_image_tag" {
7
7
  type = string
8
8
  description = "Image tag for public.ecr.aws/sorah/himari-lambda. You can use Git commit hash on https://github.com/sorah/himari"
9
9
  }
10
+
11
+ variable "architecture" {
12
+ type = string
13
+ default = "x86_64"
14
+ description = "Lambda CPU architecture to copy from the multi-arch source image (x86_64 or arm64)"
15
+
16
+ validation {
17
+ condition = contains(["x86_64", "arm64"], var.architecture)
18
+ error_message = "architecture must be one of: x86_64, arm64."
19
+ }
20
+ }
data/lambda/terraform/image/versions.tf CHANGED
@@ -1,7 +1,9 @@
1
1
  terraform {
2
+ required_version = ">= 1.10"
2
3
  required_providers {
3
4
  aws = {
4
- source = "hashicorp/aws"
5
+ source = "hashicorp/aws"
6
+ version = ">= 6.0"
5
7
  }
6
8
  }
7
9
  }
data/lib/himari/aws/dynamodb_storage.rb CHANGED
@@ -1,3 +1,5 @@
1
+ # frozen_string_literal: true
2
+
1
3
  require 'himari/storages/base'
2
4
  require 'aws-sdk-dynamodb'
3
5
 
@@ -8,34 +10,55 @@ module Himari
8
10
 
9
11
  # @param client [Aws::DynamoDB::Client]
10
12
  # @param table_name [String] name of DynamoDB table with hash=pk/range=sk key.
11
- def initialize(client: ::Aws::DynamoDB::Client.new, table_name:)
13
+ # @param consistent_read [Boolean] use consitent read when querying. default to true.
14
+ def initialize(client: ::Aws::DynamoDB::Client.new, table_name:, consistent_read: true)
12
15
  @client = client
13
16
  @table_name = table_name
17
+ @consistent_read = consistent_read
14
18
  end
15
19
 
16
20
  attr_reader :client, :table_name
17
21
 
18
- private def write(kind, key, content, overwrite: false)
22
+ def consistent_read?; !!@consistent_read; end
23
+
24
+ private def write(kind, key, content, overwrite: false, if_version: nil)
19
25
  pk = "storage:#{kind}:#{key}"
20
- payload = {
26
+ # version and updated_at are mirrored to top-level attributes (besides living inside
27
+ # content_json) so the refresh-token compare-and-swap can reference them in a condition.
28
+ attrs = {
21
29
  content_json: JSON.pretty_generate(content),
22
- ttl: content[:ttl] || content[:expiry],
23
- }
30
+ version: content[:version],
31
+ updated_at: content[:updated_at],
32
+ }.compact
33
+ ttl = content[:ttl] || content[:expiry]
34
+ attrs[:ttl] = ttl if ttl
35
+
36
+ update_expression = +"SET #{attrs.keys.map { |k| "##{k} = :#{k}" }.join(", ")}"
37
+ update_expression << "\nREMOVE #ttl" unless attrs.key?(:ttl)
38
+
39
+ expression_attribute_names = attrs.keys.to_h { |k| ["##{k}", k.to_s] }
40
+ expression_attribute_names['#ttl'] = 'ttl' unless attrs.key?(:ttl)
41
+ expression_attribute_values = attrs.transform_keys { ":#{_1}" }
42
+
43
+ condition_expression =
44
+ if if_version
45
+ expression_attribute_names['#version'] = 'version'
46
+ expression_attribute_values[':expected_version'] = if_version
47
+ 'attribute_exists(pk) AND #version = :expected_version'
48
+ elsif !overwrite
49
+ 'attribute_not_exists(pk)'
50
+ end
51
+
24
52
  @client.update_item(
25
53
  table_name: @table_name,
26
54
  key: {
27
55
  'pk' => pk,
28
56
  'sk' => pk,
29
57
  },
30
- # #{payload.each_key.map { |k| "##{k} = :#{k}" }.join(', ')}
31
- update_expression: <<~EOS,
32
- SET
33
- #content_json = :content_json
34
- #{payload[:ttl] ? ", #ttl = :ttl" : "REMOVE #ttl"}
35
- EOS
36
- condition_expression: overwrite ? nil : 'attribute_not_exists(pk)',
37
- expression_attribute_names: payload.each_key.map { |k| ["##{k}", k] }.to_h,
38
- expression_attribute_values: payload.transform_keys { ":#{_1}" },
58
+ update_expression: update_expression,
59
+ condition_expression: condition_expression,
60
+ expression_attribute_names: expression_attribute_names,
61
+ expression_attribute_values: expression_attribute_values,
39
62
  )
40
63
  nil
41
64
  rescue ::Aws::DynamoDB::Errors::ConditionalCheckFailedException
@@ -50,9 +73,11 @@ module Himari
50
73
  limit: 1,
51
74
  key_condition_expression: 'pk = :pk AND sk = :sk',
52
75
  expression_attribute_values: {":pk" => pk, ":sk" => pk},
76
+ consistent_read: consistent_read?,
53
77
  ).items.first
54
78
 
55
- return nil unless item
79
+ return unless item
80
+
56
81
  JSON.parse(item.fetch('content_json'), symbolize_names: true)
57
82
  end
58
83
 
@@ -60,7 +85,7 @@ module Himari
60
85
  pk = "storage:#{kind}:#{key}"
61
86
  @client.delete_item(
62
87
  table_name: @table_name,
63
- key: {'pk' => pk, 'sk' => pk}
88
+ key: {'pk' => pk, 'sk' => pk},
64
89
  )
65
90
  nil
66
91
  end
data/lib/himari/aws/lambda_handler.rb CHANGED
@@ -1,3 +1,5 @@
1
+ # frozen_string_literal: true
2
+
1
3
  require 'himari'
2
4
  require 'himari/aws/secretsmanager_signing_key_rotation_handler'
3
5
 
@@ -11,19 +13,20 @@ module Himari
11
13
  module Aws
12
14
  module LambdaHandler
13
15
  def self.app
14
- @app ||= make_app()
16
+ @app ||= make_app
15
17
  end
16
18
 
17
19
  def self.config_ru
18
20
  a = Time.now
19
21
  retval = config_ru_from_task_root || config_ru_from_dynamodb
20
22
  b = Time.now
21
- $stdout.puts(JSON.generate(config_ru: {ts: b, elapsed_time: b-a}))
23
+ $stdout.puts(JSON.generate(config_ru: {ts: b, elapsed_time: b - a}))
22
24
  retval
23
25
  end
24
26
 
25
27
  def self.config_ru_from_task_root
26
- return nil unless ENV['LAMBDA_TASK_ROOT']
28
+ return unless ENV['LAMBDA_TASK_ROOT']
29
+
27
30
  File.read(File.join(ENV['LAMBDA_TASK_ROOT'], 'config.ru'))
28
31
  rescue Errno::ENOENT, Errno::EPERM
29
32
  nil
@@ -32,9 +35,10 @@ module Himari
32
35
  def self.config_ru_from_dynamodb
33
36
  dgst = ENV.fetch('HIMARI_RACK_DIGEST')
34
37
  table_name = ENV.fetch('HIMARI_RACK_DYNAMODB_TABLE')
35
- pk, sk = "rack", "rack:#{dgst}"
38
+ pk = "rack"
39
+ sk = "rack:#{dgst}"
36
40
 
37
- ddb = ::Aws::DynamoDB::Client.new()
41
+ ddb = ::Aws::DynamoDB::Client.new
38
42
  item = ddb.query(
39
43
  table_name: table_name,
40
44
  select: 'ALL_ATTRIBUTES',
data/lib/himari/aws/secretsmanager_signing_key_provider.rb CHANGED
@@ -1,3 +1,5 @@
1
+ # frozen_string_literal: true
2
+
1
3
  require 'aws-sdk-secretsmanager'
2
4
  require 'himari/signing_key'
3
5
  require 'himari/middlewares/signing_key'
@@ -26,10 +28,12 @@ module Himari
26
28
 
27
29
  def collect(id: nil, active: nil, group: nil, **_remainder)
28
30
  return [] if group && group != @group
31
+
29
32
  case
30
33
  when id
31
34
  return [] unless id.start_with?("#{@kid_prefix}_")
32
- version_id = id[(@kid_prefix.size+1)..-1] || ''
35
+
36
+ version_id = id[(@kid_prefix.size + 1)..-1] || ''
33
37
  [secret_value_to_signing_key(@client.get_secret_value(secret_id: @secret_id, version_id: version_id))].compact
34
38
 
35
39
  when active
@@ -50,10 +54,10 @@ module Himari
50
54
  JSON.parse(value.secret_string)
51
55
  rescue JSON::ParserError
52
56
  warn "JSON::ParserError while parsing #{value.arn} #{value.version_id}"
53
- return nil
57
+ return
54
58
  end
55
-
56
- return nil unless json['kind'] == 'himari.signing_key'
59
+
60
+ return unless json['kind'] == 'himari.signing_key'
57
61
 
58
62
  pkey = case json.fetch('kty')
59
63
  when 'rsa'
@@ -76,4 +80,3 @@ module Himari
76
80
  end
77
81
  end
78
82
  end
79
-
data/lib/himari/aws/secretsmanager_signing_key_rotation_handler.rb CHANGED
@@ -1,3 +1,5 @@
1
+ # frozen_string_literal: true
2
+
1
3
  # https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_how.html
2
4
  require 'openssl'
3
5
  require 'json'
@@ -11,7 +13,7 @@ module Himari
11
13
  RotationRequest = Struct.new(:step, :id, :token, :secret, keyword_init: true)
12
14
 
13
15
  def self.handler(event:, context:)
14
- @secretsmanager ||= ::Aws::SecretsManager::Client.new()
16
+ @secretsmanager ||= ::Aws::SecretsManager::Client.new
15
17
 
16
18
  secret = prerequisite_check!(event)
17
19
 
@@ -40,10 +42,12 @@ module Himari
40
42
  def self.prerequisite_check!(event)
41
43
  secret = @secretsmanager.describe_secret(secret_id: event.fetch('SecretId'))
42
44
  raise "secret #{secret.arn.inspect} have not enabled rotation" unless secret.rotation_enabled
45
+
43
46
  stages = secret.version_ids_to_stages[event.fetch('ClientRequestToken')]
44
- raise "Secret version #{event.fetch('ClientRequestToken').inspect} has no stage for secret #{secret.arn.inspect}" unless stages
45
- raise "Secret version #{event.fetch('ClientRequestToken').inspect} is on AWSCURRENT for secret #{secret.arn.inspect}" if stages.include?('AWSCURRENT') && !stages.include?('AWSPENDING')
46
- raise "Secret version #{event.fetch('ClientRequestToken').inspect} is not on AWSPENDING for secret #{secret.arn.inspect}" unless stages.include?('AWSPENDING')
47
+ raise "Secret version #{event.fetch("ClientRequestToken").inspect} has no stage for secret #{secret.arn.inspect}" unless stages
48
+ raise "Secret version #{event.fetch("ClientRequestToken").inspect} is on AWSCURRENT for secret #{secret.arn.inspect}" if stages.include?('AWSCURRENT') && !stages.include?('AWSPENDING')
49
+ raise "Secret version #{event.fetch("ClientRequestToken").inspect} is not on AWSPENDING for secret #{secret.arn.inspect}" unless stages.include?('AWSPENDING')
50
+
47
51
  secret
48
52
  end
49
53
 
@@ -81,9 +85,9 @@ module Himari
81
85
  JSON.pretty_generate({kind: 'himari.signing_key', kty: 'rsa', rsa: {pem: rsa.to_pem}})
82
86
  when 'ec'
83
87
  curve = case param.fetch(:len, 256).to_i
84
- when 256; 'prime256v1'
85
- when 384; 'secp384r1'
86
- when 521; 'secp521r1'
88
+ when 256 then 'prime256v1'
89
+ when 384 then 'secp384r1'
90
+ when 521 then 'secp521r1'
87
91
  else
88
92
  raise ArgumentError, "unknown len: #{param.inspect}"
89
93
  end
@@ -110,6 +114,7 @@ module Himari
110
114
  begin
111
115
  return JSON.parse(str, symbolize_names: true)
112
116
  rescue JSON::ParserError
117
+ # fall through to raise below
113
118
  end
114
119
 
115
120
  raise "cannot parse keygen param #{str.inspect}"
@@ -126,7 +131,7 @@ module Himari
126
131
  end
127
132
 
128
133
  def self.finish_secret(req)
129
- current_version = req.secret.version_ids_to_stages.find { |k,v| v.include?('AWSCURRENT') }.first
134
+ current_version = req.secret.version_ids_to_stages.find { |_k, v| v.include?('AWSCURRENT') }.first
130
135
  if current_version == req.token
131
136
  puts "finishSecret: #{current_version} on #{req.id} is on AWSCURRENT, do nothing"
132
137
  return
data/lib/himari/aws/version.rb CHANGED
@@ -2,6 +2,6 @@
2
2
 
3
3
  module Himari
4
4
  module Aws
5
- VERSION = "0.2.0"
5
+ VERSION = "0.3.0"
6
6
  end
7
7
  end
data/lib/himari-aws.rb CHANGED
@@ -1 +1,3 @@
1
+ # frozen_string_literal: true
2
+
1
3
  require 'himari/aws'
metadata CHANGED
@@ -1,14 +1,13 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: himari-aws
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.2.0
4
+ version: 0.3.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Sorah Fukumori
8
- autorequire:
9
8
  bindir: exe
10
9
  cert_chain: []
11
- date: 2023-03-21 00:00:00.000000000 Z
10
+ date: 1980-01-02 00:00:00.000000000 Z
12
11
  dependencies:
13
12
  - !ruby/object:Gem::Dependency
14
13
  name: himari
@@ -25,7 +24,7 @@ dependencies:
25
24
  - !ruby/object:Gem::Version
26
25
  version: '0'
27
26
  - !ruby/object:Gem::Dependency
28
- name: aws-sdk-secretsmanager
27
+ name: apigatewayv2_rack
29
28
  requirement: !ruby/object:Gem::Requirement
30
29
  requirements:
31
30
  - - ">="
@@ -53,7 +52,7 @@ dependencies:
53
52
  - !ruby/object:Gem::Version
54
53
  version: '0'
55
54
  - !ruby/object:Gem::Dependency
56
- name: apigatewayv2_rack
55
+ name: aws-sdk-secretsmanager
57
56
  requirement: !ruby/object:Gem::Requirement
58
57
  requirements:
59
58
  - - ">="
@@ -66,7 +65,6 @@ dependencies:
66
65
  - - ">="
67
66
  - !ruby/object:Gem::Version
68
67
  version: '0'
69
- description:
70
68
  email:
71
69
  - her@sorah.jp
72
70
  executables: []
@@ -74,6 +72,7 @@ extensions: []
74
72
  extra_rdoc_files: []
75
73
  files:
76
74
  - ".rspec"
75
+ - CHANGELOG.md
77
76
  - LICENSE.txt
78
77
  - README.md
79
78
  - Rakefile
@@ -96,7 +95,6 @@ files:
96
95
  - lambda/terraform/iam/variables.tf
97
96
  - lambda/terraform/iam/versions.tf
98
97
  - lambda/terraform/image/aws.tf
99
- - lambda/terraform/image/copy.sh
100
98
  - lambda/terraform/image/copy.tf
101
99
  - lambda/terraform/image/ecr.tf
102
100
  - lambda/terraform/image/outputs.tf
@@ -121,7 +119,6 @@ licenses:
121
119
  metadata:
122
120
  homepage_uri: https://github.com/sorah/himari
123
121
  source_code_uri: https://github.com/sorah/himari
124
- post_install_message:
125
122
  rdoc_options: []
126
123
  require_paths:
127
124
  - lib
@@ -136,8 +133,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
136
133
  - !ruby/object:Gem::Version
137
134
  version: '0'
138
135
  requirements: []
139
- rubygems_version: 3.1.6
140
- signing_key:
136
+ rubygems_version: 4.0.10
141
137
  specification_version: 4
142
138
  summary: AWS related plugins for Himari
143
139
  test_files: []
data/lambda/terraform/image/copy.sh DELETED
@@ -1,5 +0,0 @@
1
- #!/bin/bash -xe
2
- aws ecr get-login-password | docker login --username AWS --password-stdin "${REPOSITORY_URL}"
3
- docker pull "public.ecr.aws/sorah/himari-lambda:${SOURCE_IMAGE_TAG}"
4
- docker tag "public.ecr.aws/sorah/himari-lambda:${SOURCE_IMAGE_TAG}" "${REPOSITORY_URL}:${SOURCE_IMAGE_TAG}"
5
- docker push "${REPOSITORY_URL}:${SOURCE_IMAGE_TAG}"