@aws-amplify/api-graphql 4.4.0 → 4.4.1-events.619318.0

package/src/Providers/AWSWebSocketProvider/appsyncUrl.ts

@@ -0,0 +1,151 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { RequestOptions } from '@aws-amplify/data-schema/runtime';
+import {
+	AmplifyUrl,
+	AmplifyUrlSearchParams,
+} from '@aws-amplify/core/internals/utils';
+
+import { AWSAppSyncRealTimeProviderOptions } from '../AWSAppSyncRealTimeProvider';
+
+const protocol = 'wss://';
+const standardDomainPattern =
+	/^https:\/\/\w{26}\.appsync-api\.\w{2}(?:(?:-\w{2,})+)-\d\.amazonaws.com(?:\.cn)?\/graphql$/i;
+const eventDomainPattern =
+	/^https:\/\/\w{26}\.ddpg-api\.\w{2}(?:(?:-\w{2,})+)-\d\.amazonaws.com(?:\.cn)?\/event$/i;
+const customDomainPath = '/realtime';
+
+export const isCustomDomain = (url: string): boolean => {
+	return url.match(standardDomainPattern) === null;
+};
+
+const isEventDomain = (url: string): boolean =>
+	url.match(eventDomainPattern) !== null;
+
+export const getRealtimeEndpointUrl = (
+	appSyncGraphqlEndpoint: string | undefined,
+): URL => {
+	let realtimeEndpoint = appSyncGraphqlEndpoint ?? '';
+
+	if (isEventDomain(realtimeEndpoint)) {
+		realtimeEndpoint = realtimeEndpoint
+			.concat(customDomainPath)
+			.replace('ddpg-api', 'grt-gamma');
+	} else if (isCustomDomain(realtimeEndpoint)) {
+		realtimeEndpoint = realtimeEndpoint.concat(customDomainPath);
+	} else {
+		realtimeEndpoint = realtimeEndpoint
+			.replace('appsync-api', 'appsync-realtime-api')
+			.replace('gogi-beta', 'grt-beta')
+			.replace('ddpg-api', 'grt-gamma');
+	}
+
+	realtimeEndpoint = realtimeEndpoint
+		.replace('https://', protocol)
+		.replace('http://', protocol);
+
+	return new AmplifyUrl(realtimeEndpoint);
+};
+
+/**
+ * Strips out `Authorization` header if present
+ */
+const extractNonAuthHeaders = (
+	headers?: AWSAppSyncRealTimeProviderOptions['additionalCustomHeaders'],
+): Record<string, string> => {
+	if (!headers) {
+		return {};
+	}
+
+	if ('Authorization' in headers) {
+		const { Authorization: _, ...nonAuthHeaders } = headers;
+
+		return nonAuthHeaders;
+	}
+
+	return headers;
+};
+
+/**
+ *
+ * @param headers - http headers
+ * @returns uri-encoded query parameters derived from custom headers
+ */
+export const queryParamsFromCustomHeaders = (
+	headers?: AWSAppSyncRealTimeProviderOptions['additionalCustomHeaders'],
+): URLSearchParams => {
+	const nonAuthHeaders = extractNonAuthHeaders(headers);
+
+	const params = new AmplifyUrlSearchParams();
+
+	Object.entries(nonAuthHeaders).forEach(([k, v]) => {
+		params.append(k, v);
+	});
+
+	return params;
+};
+
+/**
+ * Normalizes AppSync realtime endpoint URL
+ *
+ * @param appSyncGraphqlEndpoint - AppSync endpointUri from config
+ * @param urlParams - URLSearchParams
+ * @returns fully resolved string realtime endpoint URL
+ */
+export const realtimeUrlWithQueryString = (
+	appSyncGraphqlEndpoint: string | undefined,
+	urlParams: URLSearchParams,
+): string => {
+	const realtimeEndpointUrl = getRealtimeEndpointUrl(appSyncGraphqlEndpoint);
+
+	// preserves any query params a customer might manually set in the configuration
+	const existingParams = new AmplifyUrlSearchParams(realtimeEndpointUrl.search);
+
+	for (const [k, v] of urlParams.entries()) {
+		existingParams.append(k, v);
+	}
+
+	realtimeEndpointUrl.search = existingParams.toString();
+
+	return realtimeEndpointUrl.toString();
+};
+
+// TODO: move to separate file?
+export const additionalHeadersFromOptions = async (
+	options: AWSAppSyncRealTimeProviderOptions,
+) => {
+	const {
+		appSyncGraphqlEndpoint,
+		query,
+		libraryConfigHeaders = () => ({}),
+		additionalHeaders = {},
+		authToken,
+	} = options;
+
+	let additionalCustomHeaders = {};
+	const _libraryConfigHeaders = await libraryConfigHeaders();
+
+	if (typeof additionalHeaders === 'function') {
+		const requestOptions: RequestOptions = {
+			url: appSyncGraphqlEndpoint || '',
+			queryString: query || '',
+		};
+		additionalCustomHeaders = await additionalHeaders(requestOptions);
+	} else {
+		additionalCustomHeaders = additionalHeaders;
+	}
+
+	// if an authorization header is set, have the explicit, operation-level authToken take precedence
+	if (authToken) {
+		additionalCustomHeaders = {
+			...additionalCustomHeaders,
+			Authorization: authToken,
+		};
+	}
+
+	return {
+		additionalCustomHeaders,
+		libraryConfigHeaders: _libraryConfigHeaders,
+	};
+};

package/src/Providers/AWSWebSocketProvider/authHeaders.ts

@@ -0,0 +1,146 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { ConsoleLogger, fetchAuthSession } from '@aws-amplify/core';
+import { signRequest } from '@aws-amplify/core/internals/aws-client-utils';
+import { AmplifyUrl } from '@aws-amplify/core/internals/utils';
+
+import { AWS_APPSYNC_REALTIME_HEADERS } from '../constants';
+import { AWSAppSyncRealTimeProviderOptions } from '../AWSAppSyncRealTimeProvider';
+
+const logger = new ConsoleLogger('AWSAppSyncRealTimeProvider Auth');
+
+type AWSAppSyncRealTimeAuthInput =
+	Partial<AWSAppSyncRealTimeProviderOptions> & {
+		canonicalUri: string;
+		payload: string;
+		host?: string | undefined;
+	};
+
+const awsAuthTokenHeader = async ({ host }: AWSAppSyncRealTimeAuthInput) => {
+	const session = await fetchAuthSession();
+
+	return {
+		Authorization: session?.tokens?.accessToken?.toString(),
+		host,
+	};
+};
+
+const awsRealTimeApiKeyHeader = async ({
+	apiKey,
+	host,
+}: AWSAppSyncRealTimeAuthInput) => {
+	const dt = new Date();
+	const dtStr = dt.toISOString().replace(/[:-]|\.\d{3}/g, '');
+
+	return {
+		host,
+		'x-amz-date': dtStr,
+		'x-api-key': apiKey,
+	};
+};
+
+const awsRealTimeIAMHeader = async ({
+	payload,
+	canonicalUri,
+	appSyncGraphqlEndpoint,
+	region,
+}: AWSAppSyncRealTimeAuthInput) => {
+	const endpointInfo = {
+		region,
+		service: 'appsync',
+	};
+
+	const creds = (await fetchAuthSession()).credentials;
+
+	const request = {
+		url: `${appSyncGraphqlEndpoint}${canonicalUri}`,
+		data: payload,
+		method: 'POST',
+		headers: { ...AWS_APPSYNC_REALTIME_HEADERS },
+	};
+
+	const signedParams = signRequest(
+		{
+			headers: request.headers,
+			method: request.method,
+			url: new AmplifyUrl(request.url),
+			body: request.data,
+		},
+		{
+			credentials: creds!,
+			signingRegion: endpointInfo.region!,
+			signingService: endpointInfo.service,
+		},
+	);
+
+	return signedParams.headers;
+};
+
+const customAuthHeader = async ({
+	host,
+	additionalCustomHeaders,
+}: AWSAppSyncRealTimeAuthInput) => {
+	/**
+	 * If `additionalHeaders` was provided to the subscription as a function,
+	 * the headers that are returned by that function will already have been
+	 * provided before this function is called.
+	 */
+	if (!additionalCustomHeaders?.Authorization) {
+		throw new Error('No auth token specified');
+	}
+
+	return {
+		Authorization: additionalCustomHeaders.Authorization,
+		host,
+	};
+};
+
+export const awsRealTimeHeaderBasedAuth = async ({
+	apiKey,
+	authenticationType,
+	canonicalUri,
+	appSyncGraphqlEndpoint,
+	region,
+	additionalCustomHeaders,
+	payload,
+}: AWSAppSyncRealTimeAuthInput): Promise<
+	Record<string, string | undefined> | undefined
+> => {
+	const headerHandler = {
+		apiKey: awsRealTimeApiKeyHeader,
+		iam: awsRealTimeIAMHeader,
+		oidc: awsAuthTokenHeader,
+		userPool: awsAuthTokenHeader,
+		lambda: customAuthHeader,
+		none: customAuthHeader,
+	} as const;
+
+	if (!authenticationType || !headerHandler[authenticationType]) {
+		logger.debug(`Authentication type ${authenticationType} not supported`);
+
+		return undefined;
+	} else {
+		const handler = headerHandler[authenticationType];
+
+		const host = appSyncGraphqlEndpoint
+			? new AmplifyUrl(appSyncGraphqlEndpoint).host
+			: undefined;
+
+		const resolvedApiKey = authenticationType === 'apiKey' ? apiKey : undefined;
+
+		logger.debug(`Authenticating with ${JSON.stringify(authenticationType)}`);
+
+		const result = await handler({
+			payload,
+			canonicalUri,
+			appSyncGraphqlEndpoint,
+			apiKey: resolvedApiKey,
+			region,
+			host,
+			additionalCustomHeaders,
+		});
+
+		return result;
+	}
+};