@aws/nx-plugin 0.119.0 → 0.121.0

package/src/trpc/backend/__snapshots__/generator.spec.ts.snap

@@ -747,7 +747,7 @@ export class TestApi<
 "
 `;
 
-exports[`trpc backend generator > should generate with no auth for a REST API > apps/test-api/src/client/index.ts 1`] = `
+exports[`trpc backend generator > should generate with custom auth for a REST API > apps/test-api/src/client/index.ts 1`] = `
 "import { createTRPCClient, httpLink, HTTPLinkOptions } from '@trpc/client';
 import { AppRouter } from '../router.js';
 
@@ -766,12 +766,12 @@ export const createTestApiClient = (config: TestApiClientConfig) => {
 "
 `;
 
-exports[`trpc backend generator > should generate with no auth for a REST API > packages/common/constructs/src/app/apis/index.ts 1`] = `
+exports[`trpc backend generator > should generate with custom auth for a REST API > packages/common/constructs/src/app/apis/index.ts 1`] = `
 "export * from './test-api.js';
 "
 `;
 
-exports[`trpc backend generator > should generate with no auth for a REST API > packages/common/constructs/src/app/apis/test-api.ts 1`] = `
+exports[`trpc backend generator > should generate with custom auth for a REST API > packages/common/constructs/src/app/apis/test-api.ts 1`] = `
 "import { Construct } from 'constructs';
 import * as url from 'url';
 import { Distribution } from 'aws-cdk-lib/aws-cloudfront';
@@ -787,6 +787,7 @@ import {
   AuthorizationType,
   LambdaIntegration,
   ResponseTransferMode,
+  TokenAuthorizer,
 } from 'aws-cdk-lib/aws-apigateway';
 import { Aspects, Duration } from 'aws-cdk-lib';
 import {
@@ -885,17 +886,39 @@ export class TestApi<
     id: string,
     props: TestApiProps<TIntegrations>,
   ) {
+    const authorizerFunction = new Function(
+      scope,
+      'TestApiAuthorizerFunction',
+      {
+        runtime: Runtime.NODEJS_LATEST,
+        handler: 'index.handler',
+        code: Code.fromAsset(
+          url.fileURLToPath(
+            new URL(
+              '../../../../../../dist/apps/test-api/bundle/authorizer',
+              import.meta.url,
+            ),
+          ),
+        ),
+        timeout: Duration.seconds(10),
+        tracing: Tracing.ACTIVE,
+      },
+    );
+
     super(scope, id, {
       apiName: 'TestApi',
       defaultMethodOptions: {
-        authorizationType: AuthorizationType.NONE,
+        authorizationType: AuthorizationType.CUSTOM,
+        authorizer: new TokenAuthorizer(scope, 'TestApiTokenAuthorizer', {
+          handler: authorizerFunction,
+        }),
       },
       deployOptions: {
         tracingEnabled: true,
       },
       policy: new PolicyDocument({
         statements: [
-          // Allow all callers to invoke the API in the resource policy
+          // Allow all callers to invoke the API in the resource policy, since auth is handled by the Lambda Authorizer
           new PolicyStatement({
             effect: Effect.ALLOW,
             principals: [new AnyPrincipal()],
@@ -950,7 +973,7 @@ export class TestApi<
 "
 `;
 
-exports[`trpc backend generator > should generate with no auth for an HTTP API > apps/test-api/src/client/index.ts 1`] = `
+exports[`trpc backend generator > should generate with custom auth for an HTTP API > apps/test-api/src/client/index.ts 1`] = `
 "import { createTRPCClient, httpLink, HTTPLinkOptions } from '@trpc/client';
 import { AppRouter } from '../router.js';
 
@@ -969,12 +992,12 @@ export const createTestApiClient = (config: TestApiClientConfig) => {
 "
 `;
 
-exports[`trpc backend generator > should generate with no auth for an HTTP API > packages/common/constructs/src/app/apis/index.ts 1`] = `
+exports[`trpc backend generator > should generate with custom auth for an HTTP API > packages/common/constructs/src/app/apis/index.ts 1`] = `
 "export * from './test-api.js';
 "
 `;
 
-exports[`trpc backend generator > should generate with no auth for an HTTP API > packages/common/constructs/src/app/apis/test-api.ts 1`] = `
+exports[`trpc backend generator > should generate with custom auth for an HTTP API > packages/common/constructs/src/app/apis/test-api.ts 1`] = `
 "import { Construct } from 'constructs';
 import * as url from 'url';
 import { Distribution } from 'aws-cdk-lib/aws-cloudfront';
@@ -987,11 +1010,11 @@ import {
 } from 'aws-cdk-lib/aws-lambda';
 import { Duration } from 'aws-cdk-lib';
 import { RuntimeConfig } from '../../core/runtime-config.js';
+import { CorsHttpMethod, CfnApi } from 'aws-cdk-lib/aws-apigatewayv2';
 import {
-  CorsHttpMethod,
-  CfnApi,
-  HttpNoneAuthorizer,
-} from 'aws-cdk-lib/aws-apigatewayv2';
+  HttpLambdaAuthorizer,
+  HttpLambdaResponseType,
+} from 'aws-cdk-lib/aws-apigatewayv2-authorizers';
 import { HttpLambdaIntegration } from 'aws-cdk-lib/aws-apigatewayv2-integrations';
 import {
   ApiIntegrations,
@@ -1076,6 +1099,25 @@ export class TestApi<
     id: string,
     props: TestApiProps<TIntegrations>,
   ) {
+    const authorizerFunction = new Function(
+      scope,
+      'TestApiAuthorizerFunction',
+      {
+        runtime: Runtime.NODEJS_LATEST,
+        handler: 'index.handler',
+        code: Code.fromAsset(
+          url.fileURLToPath(
+            new URL(
+              '../../../../../../dist/apps/test-api/bundle/authorizer',
+              import.meta.url,
+            ),
+          ),
+        ),
+        timeout: Duration.seconds(10),
+        tracing: Tracing.ACTIVE,
+      },
+    );
+
     super(scope, id, {
       apiName: 'TestApi',
       corsPreflight: {
@@ -1089,7 +1131,13 @@ export class TestApi<
           'x-amz-security-token',
         ],
       },
-      defaultAuthorizer: new HttpNoneAuthorizer(),
+      defaultAuthorizer: new HttpLambdaAuthorizer(
+        'TestApiLambdaAuthorizer',
+        authorizerFunction,
+        {
+          responseTypes: [HttpLambdaResponseType.SIMPLE],
+        },
+      ),
       operations: routerToOperations(appRouter),
       ...props,
     });
@@ -3572,7 +3620,7 @@ output "api_log_group_arn" {
 }
 `;
 
-exports[`trpc backend generator > terraform iacProvider > should generate terraform files for HTTP API with IAM auth and snapshot them > terraform-http-iam-files 1`] = `
+exports[`trpc backend generator > terraform iacProvider > should generate terraform files for HTTP API with Custom auth and snapshot them > terraform-http-custom-files 1`] = `
 {
   "http-api.tf": "# Core HTTP API Gateway module
 # This module creates the API Gateway HTTP API, stage, and logging resources
@@ -4038,6 +4086,100 @@ resource "aws_cloudwatch_log_group" "lambda_logs" {
 }
 
 
+# Custom Lambda Authorizer
+resource "aws_lambda_function" "authorizer_lambda" {
+  #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
+  #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for authorizer
+  #checkov:skip=CKV_AWS_272:Code signing not required for this use case
+  #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
+  #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
+  s3_bucket         = aws_s3_object.authorizer_zip.bucket
+  s3_key            = aws_s3_object.authorizer_zip.key
+  s3_object_version = aws_s3_object.authorizer_zip.version_id
+  function_name    = "TestApiAuthorizer-\${random_string.suffix.result}"
+  role            = aws_iam_role.authorizer_execution_role.arn
+  handler         = "index.handler"
+  runtime         = "nodejs22.x"
+  timeout         = 10
+  memory_size     = 128
+
+  source_code_hash = data.archive_file.authorizer_zip.output_base64sha256
+
+  tracing_config {
+    mode = "Active"
+  }
+
+  tags = var.tags
+}
+
+resource "aws_iam_role" "authorizer_execution_role" {
+  name = "TestApiAuthorizer-role-\${random_string.suffix.result}"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = "sts:AssumeRole"
+        Effect = "Allow"
+        Principal = {
+          Service = "lambda.amazonaws.com"
+        }
+      }
+    ]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_iam_role_policy_attachment" "authorizer_basic_execution" {
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+  role       = aws_iam_role.authorizer_execution_role.name
+}
+
+resource "aws_iam_role_policy_attachment" "authorizer_xray_execution" {
+  policy_arn = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
+  role       = aws_iam_role.authorizer_execution_role.name
+}
+
+resource "aws_cloudwatch_log_group" "authorizer_logs" {
+  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
+  #checkov:skip=CKV_AWS_338:Log retention set to forever
+  #checkov:skip=CKV_AWS_66:Log retention set to forever
+  name = "/aws/lambda/TestApiAuthorizer-\${random_string.suffix.result}"
+  tags = var.tags
+}
+
+data "archive_file" "authorizer_zip" {
+  type        = "zip"
+  source_dir  = "\${path.module}/../../../../../../../dist/apps/test-api/bundle/authorizer"
+  output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/apis/test-api/authorizer.zip"
+}
+
+resource "aws_s3_object" "authorizer_zip" {
+  bucket      = var.asset_bucket_name
+  key         = "apis/test-api/authorizer-\${data.archive_file.authorizer_zip.output_sha256}.zip"
+  source      = data.archive_file.authorizer_zip.output_path
+  source_hash = data.archive_file.authorizer_zip.output_base64sha256
+  etag        = data.archive_file.authorizer_zip.output_md5
+}
+
+resource "aws_apigatewayv2_authorizer" "custom_authorizer" {
+  api_id                            = module.http_api.api_id
+  authorizer_type                   = "REQUEST"
+  authorizer_uri                    = aws_lambda_function.authorizer_lambda.invoke_arn
+  authorizer_payload_format_version = "2.0"
+  authorizer_result_ttl_in_seconds  = 0
+  enable_simple_responses           = true
+  name                              = "TestApiAuthorizer-\${random_string.suffix.result}"
+}
+
+resource "aws_lambda_permission" "authorizer_invoke" {
+  statement_id  = "AllowAPIGatewayInvokeAuthorizer"
+  action        = "lambda:InvokeFunction"
+  function_name = aws_lambda_function.authorizer_lambda.function_name
+  principal     = "apigateway.amazonaws.com"
+  source_arn    = "\${module.http_api.api_execution_arn}/authorizers/\${aws_apigatewayv2_authorizer.custom_authorizer.id}"
+}
 
 # Lambda integration for HTTP API
 resource "aws_apigatewayv2_integration" "lambda_integration" {
@@ -4061,9 +4203,10 @@ resource "aws_apigatewayv2_route" "proxy_routes" {
   route_key = "\${each.key} /{proxy+}"
   target    = "integrations/\${aws_apigatewayv2_integration.lambda_integration.id}"
 
-  authorization_type = "AWS_IAM"
+  authorization_type = "CUSTOM"
+  authorizer_id      = aws_apigatewayv2_authorizer.custom_authorizer.id
 
-  depends_on = [aws_apigatewayv2_integration.lambda_integration]
+  depends_on = [aws_apigatewayv2_integration.lambda_integration, aws_apigatewayv2_authorizer.custom_authorizer]
 }
 
 # Add API url to runtime config
@@ -4202,7 +4345,7 @@ output "api_log_group_arn" {
 }
 `;
 
-exports[`trpc backend generator > terraform iacProvider > should generate terraform files for HTTP API with None auth and snapshot them > terraform-http-none-files 1`] = `
+exports[`trpc backend generator > terraform iacProvider > should generate terraform files for HTTP API with IAM auth and snapshot them > terraform-http-iam-files 1`] = `
 {
   "http-api.tf": "# Core HTTP API Gateway module
 # This module creates the API Gateway HTTP API, stage, and logging resources
@@ -4691,9 +4834,7 @@ resource "aws_apigatewayv2_route" "proxy_routes" {
   route_key = "\${each.key} /{proxy+}"
   target    = "integrations/\${aws_apigatewayv2_integration.lambda_integration.id}"
 
-  # Note: you may wish to suppress the checkov rule CKV_AWS_309 if you are absolutely sure you
-  # need a public API without authentication
-  authorization_type = "NONE"
+  authorization_type = "AWS_IAM"
 
   depends_on = [aws_apigatewayv2_integration.lambda_integration]
 }
@@ -6896,6 +7037,98 @@ resource "aws_cloudwatch_log_group" "lambda_logs" {
 }
 
 
+# Custom Lambda Authorizer
+resource "aws_lambda_function" "authorizer_lambda" {
+  #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
+  #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for authorizer
+  #checkov:skip=CKV_AWS_272:Code signing not required for this use case
+  #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
+  #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
+  s3_bucket         = aws_s3_object.authorizer_zip.bucket
+  s3_key            = aws_s3_object.authorizer_zip.key
+  s3_object_version = aws_s3_object.authorizer_zip.version_id
+  function_name    = "TestApiAuthorizer-\${random_string.suffix.result}"
+  role            = aws_iam_role.authorizer_execution_role.arn
+  handler         = "index.handler"
+  runtime         = "nodejs22.x"
+  timeout         = 10
+  memory_size     = 128
+
+  source_code_hash = data.archive_file.authorizer_zip.output_base64sha256
+
+  tracing_config {
+    mode = "Active"
+  }
+
+  tags = var.tags
+}
+
+resource "aws_iam_role" "authorizer_execution_role" {
+  name = "TestApiAuthorizer-role-\${random_string.suffix.result}"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = "sts:AssumeRole"
+        Effect = "Allow"
+        Principal = {
+          Service = "lambda.amazonaws.com"
+        }
+      }
+    ]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_iam_role_policy_attachment" "authorizer_basic_execution" {
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+  role       = aws_iam_role.authorizer_execution_role.name
+}
+
+resource "aws_iam_role_policy_attachment" "authorizer_xray_execution" {
+  policy_arn = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
+  role       = aws_iam_role.authorizer_execution_role.name
+}
+
+resource "aws_cloudwatch_log_group" "authorizer_logs" {
+  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
+  #checkov:skip=CKV_AWS_338:Log retention set to forever
+  #checkov:skip=CKV_AWS_66:Log retention set to forever
+  name = "/aws/lambda/TestApiAuthorizer-\${random_string.suffix.result}"
+  tags = var.tags
+}
+
+data "archive_file" "authorizer_zip" {
+  type        = "zip"
+  source_dir  = "\${path.module}/../../../../../../../dist/apps/test-api/bundle/authorizer"
+  output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/apis/test-api/authorizer.zip"
+}
+
+resource "aws_s3_object" "authorizer_zip" {
+  bucket      = var.asset_bucket_name
+  key         = "apis/test-api/authorizer-\${data.archive_file.authorizer_zip.output_sha256}.zip"
+  source      = data.archive_file.authorizer_zip.output_path
+  source_hash = data.archive_file.authorizer_zip.output_base64sha256
+  etag        = data.archive_file.authorizer_zip.output_md5
+}
+
+resource "aws_api_gateway_authorizer" "custom_authorizer" {
+  name                   = "TestApiAuthorizer-\${random_string.suffix.result}"
+  rest_api_id           = module.rest_api.api_id
+  type                  = "TOKEN"
+  authorizer_uri        = aws_lambda_function.authorizer_lambda.invoke_arn
+  identity_source       = "method.request.header.Authorization"
+}
+
+resource "aws_lambda_permission" "authorizer_invoke" {
+  statement_id  = "AllowAPIGatewayInvokeAuthorizer"
+  action        = "lambda:InvokeFunction"
+  function_name = aws_lambda_function.authorizer_lambda.function_name
+  principal     = "apigateway.amazonaws.com"
+  source_arn    = "\${module.rest_api.api_execution_arn}/authorizers/\${aws_api_gateway_authorizer.custom_authorizer.id}"
+}
 
 # Create proxy resource (captures all paths)
 resource "aws_api_gateway_resource" "proxy_resource" {
@@ -6925,15 +7158,14 @@ resource "aws_api_gateway_method" "proxy_method" {
   resource_id   = aws_api_gateway_resource.proxy_resource.id
   http_method   = "ANY"
 
-  # Note: you may wish to suppress the checkov rule CKV_AWS_59 if you are absolutely sure you
-  # need a public API without authentication
-  authorization = "NONE"
+  authorization = "CUSTOM"
+  authorizer_id = aws_api_gateway_authorizer.custom_authorizer.id
 
   request_parameters = {
     "method.request.path.proxy" = true
   }
 
-  depends_on = []
+  depends_on = [aws_api_gateway_authorizer.custom_authorizer]
 }
 
 # OPTIONS method for CORS preflight
@@ -7011,6 +7243,7 @@ resource "aws_api_gateway_deployment" "api_deployment" {
     aws_api_gateway_integration.options_integration,
     aws_api_gateway_method_response.options_response,
     aws_api_gateway_integration_response.options_integration_response,
+    aws_api_gateway_authorizer.custom_authorizer,
   ]
 }
 
@@ -7039,7 +7272,7 @@ resource "aws_api_gateway_rest_api_policy" "api_policy" {
     Version = "2012-10-17"
     Statement = [
       {
-        # Allow all callers to invoke the API in the resource policy
+        # Allow all callers to invoke the API in the resource policy, since auth is handled by the Lambda Authorizer
         Effect = "Allow"
         Principal = "*"
         Action   = "execute-api:Invoke"

package/src/trpc/backend/generator.js

@@ -69,6 +69,9 @@ async function tsTrpcApiGenerator(tree, options) {
             projectAlias: enhancedOptions.backendProjectAlias,
             bundleOutputDir: (0, devkit_1.joinPathFragments)('dist', backendRoot, 'bundle'),
             integrationPattern: getIntegrationPattern(options),
+            ...(options.auth === 'Custom' && {
+                authorizerBundleOutputDir: (0, devkit_1.joinPathFragments)('dist', backendRoot, 'bundle', 'authorizer'),
+            }),
         },
         auth: options.auth,
         iacProvider,
@@ -102,6 +105,13 @@ async function tsTrpcApiGenerator(tree, options) {
         targetFilePath: 'src/handler.ts',
         external: [/@aws-sdk\/.*/], // lambda runtime provides aws sdk
     });
+    if (options.auth === 'Custom') {
+        await (0, bundle_1.addTypeScriptBundleTarget)(tree, projectConfig, {
+            targetFilePath: 'src/authorizer.ts',
+            bundleOutputDir: 'authorizer',
+            external: [/@aws-sdk\/.*/],
+        });
+    }
     (0, nx_1.addDependencyToTargetIfNotPresent)(projectConfig, 'build', 'bundle');
     projectConfig.targets = (0, object_1.sortObjectKeys)(projectConfig.targets);
     (0, devkit_1.updateProjectConfiguration)(tree, projectConfig.name, projectConfig);
@@ -109,6 +119,12 @@ async function tsTrpcApiGenerator(tree, options) {
         overwriteStrategy: devkit_1.OverwriteStrategy.Overwrite,
     });
     tree.delete((0, devkit_1.joinPathFragments)(backendRoot, 'src', 'lib'));
+    if (options.auth === 'Custom') {
+        const authorizerType = options.computeType === 'ServerlessApiGatewayHttpApi' ? 'http' : 'rest';
+        (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, '..', '..', 'utils', 'api-constructs', 'files', 'cdk', 'authorizer', authorizerType), (0, devkit_1.joinPathFragments)(backendRoot, 'src'), {}, {
+            overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+        });
+    }
     // Remove streaming schema helper for HTTP APIs (API Gateway HTTP API doesn't support streaming)
     if (options.computeType !== 'ServerlessApiGatewayRestApi') {
         tree.delete((0, devkit_1.joinPathFragments)(backendRoot, 'src', 'schema', 'z-async-iterable.ts'));
@@ -125,6 +141,9 @@ async function tsTrpcApiGenerator(tree, options) {
         '@trpc/client',
         'aws4fetch',
         '@aws-sdk/credential-providers',
+        ...(options.auth === 'Custom'
+            ? ['@middy/core', '@aws-lambda-powertools/parser']
+            : []),
     ]), (0, versions_1.withVersions)(['@types/aws-lambda', 'tsx', 'cors', '@types/cors']));
     tree.delete((0, devkit_1.joinPathFragments)(backendRoot, 'package.json'));
     (0, nx_1.addGeneratorMetadata)(tree, backendName, exports.TRPC_BACKEND_GENERATOR_INFO);

package/src/trpc/backend/generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"generator.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/trpc/backend/generator.ts"],"names":[],"mappings":";;;AA6CA,gDAkJC;;AA/LD;;;GAGG;AACH,uCAQoB;AAEpB,qEAA0E;AAC1E,+EAAwD;AACxD,qDAAwE;AACxE,mDAAoD;AACpD,6CAA2D;AAC3D,+CAA0D;AAC1D,yDAA2E;AAC3E,+CAAoD;AACpD,uCAMwB;AACxB,iDAAsE;AACtE,8EAA+E;AAC/E,2CAA8C;AAC9C,yCAAqD;AACrD,sDAAsE;AAEzD,QAAA,2BAA2B,GACtC,IAAA,qBAAgB,EAAC,UAAU,CAAC,CAAC;AAE/B,MAAM,mCAAmC,GAAG,IAAI,GAAG,CAAC;IAClD,uCAAuC;IACvC,qCAAqC;IACrC,uCAAuC;IACvC,qCAAqC;CACtC,CAAC,CAAC;AAEI,KAAK,UAAU,kBAAkB,CACtC,IAAU,EACV,OAAiC;IAEjC,uDAAuD,CAAC,OAAO,CAAC,CAAC;IAEjE,MAAM,WAAW,GAAG,MAAM,IAAA,wBAAkB,EAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAExE,MAAM,IAAA,6CAAyB,EAAC,IAAI,EAAE;QACpC,WAAW;KACZ,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,IAAA,6BAAiB,EAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,gBAAgB,GAAG,IAAA,iBAAS,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,gBAAgB,GAAG,IAAA,mBAAW,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnD,MAAM,WAAW,GAAG,gBAAgB,CAAC;IACrC,MAAM,kBAAkB,GAAG,GAAG,YAAY,GAAG,WAAW,EAAE,CAAC;IAE3D,MAAM,IAAA,mBAAkB,EAAC,IAAI,EAAE;QAC7B,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,IAAA,wCAAmC,EACvD,IAAI,EACJ,kBAAkB,CACnB,CAAC;IACF,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC;IAEvC,MAAM,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;IAEnD,MAAM,eAAe,GAAG;QACtB,kBAAkB;QAClB,mBAAmB,EAAE,IAAA,wBAAY,EAAC,kBAAkB,CAAC;QACrD,gBAAgB;QAChB,gBAAgB;QAChB,WAAW;QACX,SAAS,EAAE,IAAA,8CAAgC,GAAE,CAAC,IAAI;QAClD,mBAAmB,EAAE,sBAAsB,CAAC,OAAO,CAAC;QACpD,IAAI;QACJ,GAAG,OAAO;KACX,CAAC;IAEF,MAAM,IAAA,mCAAkB,EAAC,IAAI,EAAE;QAC7B,cAAc,EAAE,kBAAkB;QAClC,gBAAgB;QAChB,gBAAgB;QAChB,aAAa,EACX,OAAO,CAAC,WAAW,KAAK,6BAA6B,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QACzE,OAAO,EAAE;YACP,IAAI,EAAE,MAAM;YACZ,YAAY,EAAE,eAAe,CAAC,mBAAmB;YACjD,eAAe,EAAE,IAAA,0BAAiB,EAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC;YACjE,kBAAkB,EAAE,qBAAqB,CAAC,OAAO,CAAC;SACnD;QACD,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,WAAW;KACZ,CAAC,CAAC;IAEH,aAAa,CAAC,QAAQ,GAAG;QACvB,GAAG,aAAa,CAAC,QAAQ;QACzB,OAAO,EAAE,OAAO,CAAC,IAAI;QACrB,OAAO,EAAE,MAAM;QACf,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,kBAAkB,EAAE,qBAAqB,CAAC,OAAO,CAAC;KACxC,CAAC;IAEb,aAAa,CAAC,OAAO,CAAC,KAAK,GAAG;QAC5B,QAAQ,EAAE,iBAAiB;QAC3B,OAAO,EAAE;YACP,QAAQ,EAAE,CAAC,iCAAiC,CAAC;YAC7C,GAAG,EAAE,eAAe;SACrB;QACD,UAAU,EAAE,IAAI;KACjB,CAAC;IAEF,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG;QACrC,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK;QAC9B,OAAO,EAAE;YACP,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACtC,GAAG,EAAE;gBACH,WAAW,EAAE,MAAM;aACpB;SACF;KACF,CAAC;IAEF,MAAM,IAAA,kCAAyB,EAAC,IAAI,EAAE,aAAa,EAAE;QACnD,cAAc,EAAE,gBAAgB;QAChC,QAAQ,EAAE,CAAC,cAAc,CAAC,EAAE,kCAAkC;KAC/D,CAAC,CAAC;IAEH,IAAA,sCAAiC,EAAC,aAAa,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEpE,aAAa,CAAC,OAAO,GAAG,IAAA,uBAAc,EAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAE9D,IAAA,mCAA0B,EAAC,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAEpE,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,CAAC,EACrC,WAAW,EACX,eAAe,EACf;QACE,iBAAiB,EAAE,0BAAiB,CAAC,SAAS;KAC/C,CACF,CAAC;IAEF,IAAI,CAAC,MAAM,CAAC,IAAA,0BAAiB,EAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAE1D,gGAAgG;IAChG,IAAI,OAAO,CAAC,WAAW,KAAK,6BAA6B,EAAE,CAAC;QAC1D,IAAI,CAAC,MAAM,CACT,IAAA,0BAAiB,EAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CACvE,CAAC;IACJ,CAAC;IAED,IAAA,qCAA4B,EAC1B,IAAI,EACJ,IAAA,uBAAY,EAAC;QACX,mBAAmB;QACnB,KAAK;QACL,+BAA+B;QAC/B,gCAAgC;QAChC,mCAAmC;QACnC,+BAA+B;QAC/B,+BAA+B;QAC/B,cAAc;QACd,cAAc;QACd,WAAW;QACX,+BAA+B;KAChC,CAAC,EACF,IAAA,uBAAY,EAAC,CAAC,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAClE,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,IAAA,0BAAiB,EAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;IAE5D,IAAA,yBAAoB,EAAC,IAAI,EAAE,WAAW,EAAE,mCAA2B,CAAC,CAAC;IAErE,MAAM,IAAA,yCAA+B,EAAC,IAAI,EAAE,CAAC,mCAA2B,CAAC,CAAC,CAAC;IAE3E,MAAM,IAAA,6BAAoB,EAAC,IAAI,CAAC,CAAC;IACjC,OAAO,GAAG,EAAE;QACV,IAAA,4BAAmB,EAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,uDAAuD,GAAG,CAC9D,OAAiC,EACjC,EAAE;IACF,MAAM,kBAAkB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,GAAG,OAAO,CAAC,WAAW,KAAK,kBAAkB,EAAE,CAAC;IAEpE,IAAI,CAAC,mCAAmC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,4DAA4D,OAAO,CAAC,WAAW,MAAM,kBAAkB,GAAG,CAC3G,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAC5B,OAAiC,EACV,EAAE;IACzB,OAAO,OAAO,CAAC,kBAAkB,IAAI,UAAU,CAAC;AAClD,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAAC,OAAiC,EAAU,EAAE;IAC3E,IAAI,OAAO,CAAC,WAAW,KAAK,6BAA6B,EAAE,CAAC;QAC1D,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,OAAO,yCAAyC,CAAC;IACnD,CAAC;SAAM,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,yCAAyC,CAAC;IACnD,CAAC;IACD,OAAO,wBAAwB,CAAC;AAClC,CAAC,CAAC;AAEF,kBAAe,kBAAkB,CAAC"}
+{"version":3,"file":"generator.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/trpc/backend/generator.ts"],"names":[],"mappings":";;;AA6CA,gDA6LC;;AA1OD;;;GAGG;AACH,uCAQoB;AAEpB,qEAA0E;AAC1E,+EAAwD;AACxD,qDAAwE;AACxE,mDAAoD;AACpD,6CAA2D;AAC3D,+CAA0D;AAC1D,yDAA2E;AAC3E,+CAAoD;AACpD,uCAMwB;AACxB,iDAAsE;AACtE,8EAA+E;AAC/E,2CAA8C;AAC9C,yCAAqD;AACrD,sDAAsE;AAEzD,QAAA,2BAA2B,GACtC,IAAA,qBAAgB,EAAC,UAAU,CAAC,CAAC;AAE/B,MAAM,mCAAmC,GAAG,IAAI,GAAG,CAAC;IAClD,uCAAuC;IACvC,qCAAqC;IACrC,uCAAuC;IACvC,qCAAqC;CACtC,CAAC,CAAC;AAEI,KAAK,UAAU,kBAAkB,CACtC,IAAU,EACV,OAAiC;IAEjC,uDAAuD,CAAC,OAAO,CAAC,CAAC;IAEjE,MAAM,WAAW,GAAG,MAAM,IAAA,wBAAkB,EAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAExE,MAAM,IAAA,6CAAyB,EAAC,IAAI,EAAE;QACpC,WAAW;KACZ,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,IAAA,6BAAiB,EAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,gBAAgB,GAAG,IAAA,iBAAS,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,gBAAgB,GAAG,IAAA,mBAAW,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnD,MAAM,WAAW,GAAG,gBAAgB,CAAC;IACrC,MAAM,kBAAkB,GAAG,GAAG,YAAY,GAAG,WAAW,EAAE,CAAC;IAE3D,MAAM,IAAA,mBAAkB,EAAC,IAAI,EAAE;QAC7B,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,IAAA,wCAAmC,EACvD,IAAI,EACJ,kBAAkB,CACnB,CAAC;IACF,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC;IAEvC,MAAM,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;IAEnD,MAAM,eAAe,GAAG;QACtB,kBAAkB;QAClB,mBAAmB,EAAE,IAAA,wBAAY,EAAC,kBAAkB,CAAC;QACrD,gBAAgB;QAChB,gBAAgB;QAChB,WAAW;QACX,SAAS,EAAE,IAAA,8CAAgC,GAAE,CAAC,IAAI;QAClD,mBAAmB,EAAE,sBAAsB,CAAC,OAAO,CAAC;QACpD,IAAI;QACJ,GAAG,OAAO;KACX,CAAC;IAEF,MAAM,IAAA,mCAAkB,EAAC,IAAI,EAAE;QAC7B,cAAc,EAAE,kBAAkB;QAClC,gBAAgB;QAChB,gBAAgB;QAChB,aAAa,EACX,OAAO,CAAC,WAAW,KAAK,6BAA6B,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QACzE,OAAO,EAAE;YACP,IAAI,EAAE,MAAM;YACZ,YAAY,EAAE,eAAe,CAAC,mBAAmB;YACjD,eAAe,EAAE,IAAA,0BAAiB,EAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC;YACjE,kBAAkB,EAAE,qBAAqB,CAAC,OAAO,CAAC;YAClD,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI;gBAC/B,yBAAyB,EAAE,IAAA,0BAAiB,EAC1C,MAAM,EACN,WAAW,EACX,QAAQ,EACR,YAAY,CACb;aACF,CAAC;SACH;QACD,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,WAAW;KACZ,CAAC,CAAC;IAEH,aAAa,CAAC,QAAQ,GAAG;QACvB,GAAG,aAAa,CAAC,QAAQ;QACzB,OAAO,EAAE,OAAO,CAAC,IAAI;QACrB,OAAO,EAAE,MAAM;QACf,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,kBAAkB,EAAE,qBAAqB,CAAC,OAAO,CAAC;KACxC,CAAC;IAEb,aAAa,CAAC,OAAO,CAAC,KAAK,GAAG;QAC5B,QAAQ,EAAE,iBAAiB;QAC3B,OAAO,EAAE;YACP,QAAQ,EAAE,CAAC,iCAAiC,CAAC;YAC7C,GAAG,EAAE,eAAe;SACrB;QACD,UAAU,EAAE,IAAI;KACjB,CAAC;IAEF,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG;QACrC,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK;QAC9B,OAAO,EAAE;YACP,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACtC,GAAG,EAAE;gBACH,WAAW,EAAE,MAAM;aACpB;SACF;KACF,CAAC;IAEF,MAAM,IAAA,kCAAyB,EAAC,IAAI,EAAE,aAAa,EAAE;QACnD,cAAc,EAAE,gBAAgB;QAChC,QAAQ,EAAE,CAAC,cAAc,CAAC,EAAE,kCAAkC;KAC/D,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAA,kCAAyB,EAAC,IAAI,EAAE,aAAa,EAAE;YACnD,cAAc,EAAE,mBAAmB;YACnC,eAAe,EAAE,YAAY;YAC7B,QAAQ,EAAE,CAAC,cAAc,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,IAAA,sCAAiC,EAAC,aAAa,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEpE,aAAa,CAAC,OAAO,GAAG,IAAA,uBAAc,EAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAE9D,IAAA,mCAA0B,EAAC,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAEpE,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,CAAC,EACrC,WAAW,EACX,eAAe,EACf;QACE,iBAAiB,EAAE,0BAAiB,CAAC,SAAS;KAC/C,CACF,CAAC;IAEF,IAAI,CAAC,MAAM,CAAC,IAAA,0BAAiB,EAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAE1D,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,cAAc,GAClB,OAAO,CAAC,WAAW,KAAK,6BAA6B,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1E,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EACf,SAAS,EACT,IAAI,EACJ,IAAI,EACJ,OAAO,EACP,gBAAgB,EAChB,OAAO,EACP,KAAK,EACL,YAAY,EACZ,cAAc,CACf,EACD,IAAA,0BAAiB,EAAC,WAAW,EAAE,KAAK,CAAC,EACrC,EAAE,EACF;YACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;SAClD,CACF,CAAC;IACJ,CAAC;IAED,gGAAgG;IAChG,IAAI,OAAO,CAAC,WAAW,KAAK,6BAA6B,EAAE,CAAC;QAC1D,IAAI,CAAC,MAAM,CACT,IAAA,0BAAiB,EAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CACvE,CAAC;IACJ,CAAC;IAED,IAAA,qCAA4B,EAC1B,IAAI,EACJ,IAAA,uBAAY,EAAC;QACX,mBAAmB;QACnB,KAAK;QACL,+BAA+B;QAC/B,gCAAgC;QAChC,mCAAmC;QACnC,+BAA+B;QAC/B,+BAA+B;QAC/B,cAAc;QACd,cAAc;QACd,WAAW;QACX,+BAA+B;QAC/B,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ;YAC3B,CAAC,CAAE,CAAC,aAAa,EAAE,+BAA+B,CAAW;YAC7D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,EACF,IAAA,uBAAY,EAAC,CAAC,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAClE,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,IAAA,0BAAiB,EAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;IAE5D,IAAA,yBAAoB,EAAC,IAAI,EAAE,WAAW,EAAE,mCAA2B,CAAC,CAAC;IAErE,MAAM,IAAA,yCAA+B,EAAC,IAAI,EAAE,CAAC,mCAA2B,CAAC,CAAC,CAAC;IAE3E,MAAM,IAAA,6BAAoB,EAAC,IAAI,CAAC,CAAC;IACjC,OAAO,GAAG,EAAE;QACV,IAAA,4BAAmB,EAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,uDAAuD,GAAG,CAC9D,OAAiC,EACjC,EAAE;IACF,MAAM,kBAAkB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,GAAG,OAAO,CAAC,WAAW,KAAK,kBAAkB,EAAE,CAAC;IAEpE,IAAI,CAAC,mCAAmC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,4DAA4D,OAAO,CAAC,WAAW,MAAM,kBAAkB,GAAG,CAC3G,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAC5B,OAAiC,EACV,EAAE;IACzB,OAAO,OAAO,CAAC,kBAAkB,IAAI,UAAU,CAAC;AAClD,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAAC,OAAiC,EAAU,EAAE;IAC3E,IAAI,OAAO,CAAC,WAAW,KAAK,6BAA6B,EAAE,CAAC;QAC1D,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,OAAO,yCAAyC,CAAC;IACnD,CAAC;SAAM,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,yCAAyC,CAAC;IACnD,CAAC;IACD,OAAO,wBAAwB,CAAC;AAClC,CAAC,CAAC;AAEF,kBAAe,kBAAkB,CAAC"}

package/src/trpc/backend/schema.d.ts

@@ -10,7 +10,7 @@ export interface TsTrpcApiGeneratorSchema {
   name: string;
   computeType: 'ServerlessApiGatewayRestApi' | 'ServerlessApiGatewayHttpApi';
   integrationPattern?: 'isolated' | 'shared';
-  auth: 'IAM' | 'Cognito' | 'None';
+  auth: 'IAM' | 'Cognito' | 'Custom';
   directory?: TsProjectGeneratorSchema['directory'];
   subDirectory?: TsProjectGeneratorSchema['subDirectory'];
   iacProvider: IacProviderOption;

package/src/trpc/backend/schema.json

@@ -45,9 +45,9 @@
     },
     "auth": {
       "type": "string",
-      "description": "The method used to authenticate with your API. Choose between IAM (default), Cognito or None.",
+      "description": "The method used to authenticate with your API. Choose between IAM (default), Cognito or Custom.",
       "default": "IAM",
-      "enum": ["IAM", "Cognito", "None"],
+      "enum": ["IAM", "Cognito", "Custom"],
       "x-prompt": "How would you like users to authenticate with your API?",
       "x-priority": "important"
     },

package/src/trpc/react/__snapshots__/generator.spec.ts.snap

@@ -77,7 +77,7 @@ export default TestApiClientProvider;
 "
 `;
 
-exports[`trpc react generator > REST API (ServerlessApiGatewayRestApi) > should generate REST API client provider with splitLink for IAM auth > TestApiClientProvider-REST-IAM.tsx 1`] = `
+exports[`trpc react generator > REST API (ServerlessApiGatewayRestApi) > should generate REST API client provider with splitLink for Custom auth > TestApiClientProvider-REST-Custom.tsx 1`] = `
 "import { AppRouter } from 'backend';
 import { useQueryClient } from '@tanstack/react-query';
 import { createTRPCOptionsProxy } from '@trpc/tanstack-react-query';
@@ -91,7 +91,6 @@ import {
   splitLink,
 } from '@trpc/client';
 import { EventSourcePolyfill } from 'event-source-polyfill';
-import { useSigV4 } from '../hooks/useSigV4';
 
 export interface TestApiTRPCContextValue {
   optionsProxy: ReturnType<typeof createTRPCOptionsProxy<AppRouter>>;
@@ -106,7 +105,6 @@ export const TestApiClientProvider: FC<PropsWithChildren> = ({ children }) => {
   const queryClient = useQueryClient();
   const runtimeConfig = useRuntimeConfig();
   const apiUrl = runtimeConfig.apis.TestApi;
-  const sigv4Client = useSigV4();
 
   const container = useMemo<TestApiTRPCContextValue>(() => {
     const client = createTRPCClient<AppRouter>({
@@ -117,22 +115,14 @@ export const TestApiClientProvider: FC<PropsWithChildren> = ({ children }) => {
             url: apiUrl,
             EventSource: EventSourcePolyfill,
             eventSourceOptions: async ({ op }) => {
-              const url =
-                \`\${apiUrl.replace(/\\/$/, '')}/\${op.path}\` +
-                (op.input !== undefined
-                  ? \`?input=\${encodeURIComponent(JSON.stringify(op.input))}\`
-                  : '');
-              const signed = await sigv4Client.sign(url, { method: 'GET' });
-              const headers: Record<string, string> = {};
-              signed.headers.forEach((v, k) => {
-                headers[k] = v;
-              });
-              return { headers };
+              // TODO: Add headers required by your custom authorizer
+              return { headers: {} };
             },
           }),
           false: httpLink({
             url: apiUrl,
-            fetch: sigv4Client.fetch,
+            // TODO: Add headers required by your custom authorizer
+            headers: {},
           }),
         }),
       ],
@@ -144,7 +134,7 @@ export const TestApiClientProvider: FC<PropsWithChildren> = ({ children }) => {
     });
 
     return { optionsProxy, client };
-  }, [apiUrl, queryClient, sigv4Client]);
+  }, [apiUrl, queryClient]);
 
   return (
     <TestApiTRPCContext.Provider value={container}>
@@ -157,7 +147,7 @@ export default TestApiClientProvider;
 "
 `;
 
-exports[`trpc react generator > REST API (ServerlessApiGatewayRestApi) > should generate REST API client provider with splitLink for None auth > TestApiClientProvider-REST-None.tsx 1`] = `
+exports[`trpc react generator > REST API (ServerlessApiGatewayRestApi) > should generate REST API client provider with splitLink for IAM auth > TestApiClientProvider-REST-IAM.tsx 1`] = `
 "import { AppRouter } from 'backend';
 import { useQueryClient } from '@tanstack/react-query';
 import { createTRPCOptionsProxy } from '@trpc/tanstack-react-query';
@@ -170,6 +160,8 @@ import {
   httpSubscriptionLink,
   splitLink,
 } from '@trpc/client';
+import { EventSourcePolyfill } from 'event-source-polyfill';
+import { useSigV4 } from '../hooks/useSigV4';
 
 export interface TestApiTRPCContextValue {
   optionsProxy: ReturnType<typeof createTRPCOptionsProxy<AppRouter>>;
@@ -184,6 +176,7 @@ export const TestApiClientProvider: FC<PropsWithChildren> = ({ children }) => {
   const queryClient = useQueryClient();
   const runtimeConfig = useRuntimeConfig();
   const apiUrl = runtimeConfig.apis.TestApi;
+  const sigv4Client = useSigV4();
 
   const container = useMemo<TestApiTRPCContextValue>(() => {
     const client = createTRPCClient<AppRouter>({
@@ -192,9 +185,24 @@ export const TestApiClientProvider: FC<PropsWithChildren> = ({ children }) => {
           condition: (op) => op.type === 'subscription',
           true: httpSubscriptionLink({
             url: apiUrl,
+            EventSource: EventSourcePolyfill,
+            eventSourceOptions: async ({ op }) => {
+              const url =
+                \`\${apiUrl.replace(/\\/$/, '')}/\${op.path}\` +
+                (op.input !== undefined
+                  ? \`?input=\${encodeURIComponent(JSON.stringify(op.input))}\`
+                  : '');
+              const signed = await sigv4Client.sign(url, { method: 'GET' });
+              const headers: Record<string, string> = {};
+              signed.headers.forEach((v, k) => {
+                headers[k] = v;
+              });
+              return { headers };
+            },
           }),
           false: httpLink({
             url: apiUrl,
+            fetch: sigv4Client.fetch,
           }),
         }),
       ],
@@ -206,7 +214,7 @@ export const TestApiClientProvider: FC<PropsWithChildren> = ({ children }) => {
     });
 
     return { optionsProxy, client };
-  }, [apiUrl, queryClient]);
+  }, [apiUrl, queryClient, sigv4Client]);
 
   return (
     <TestApiTRPCContext.Provider value={container}>
@@ -249,6 +257,8 @@ export const TestApiClientProvider: FC<PropsWithChildren> = ({ children }) => {
   const container = useMemo<TestApiTRPCContextValue>(() => {
     const linkOptions: HTTPLinkOptions<any> = {
       url: apiUrl,
+      // TODO: Add headers required by your custom authorizer
+      headers: {},
     };
 
     const client = createTRPCClient<AppRouter>({