@camstack/addon-export-alexa 1.2.133 → 1.2.135

package/lambda-template/secrets.js

@@ -1,5 +1,6 @@
 /**
- * Skill credentials, read where they live: AWS Secrets Manager (D753).
+ * Skill credentials, read where they live: SSM Parameter Store SecureString
+ * parameters, decrypted with the AWS-managed `aws/ssm` key (D753, D761).
  *
  * Two credential pairs exist, and they authenticate DIFFERENT parties:
  *
@@ -11,30 +12,32 @@
  *          Account Linking page. Authenticates AMAZON to this Lambda's
  *          `/token` route. Amazon holds a copy; nothing else needs one.
  *
- * Each secret is a JSON string `{"clientId": "...", "clientSecret": "..."}`.
+ * Each parameter's value is a JSON string
+ * `{"clientId": "...", "clientSecret": "..."}`.
  * `skill` may also carry `previousClientSecret`, accepted on `/token` while a
  * rotation is in flight (change Amazon's copy, then drop the previous one).
  *
  * Resolution, per pair:
- *   1. `<KIND>_SECRET_ID` set   → Secrets Manager, cached for `ttlMs`.
- *   2. otherwise                → the legacy plain env vars
- *                                 (`LWA_CLIENT_ID`/`LWA_CLIENT_SECRET`,
- *                                 `SKILL_CLIENT_ID`/`SKILL_CLIENT_SECRET`), so
- *                                 this code can be deployed before the secrets
- *                                 exist and the cut-over has no downtime.
+ *   1. `<KIND>_PARAM` set   → that SSM parameter (read with decryption),
+ *                             cached for `ttlMs`.
+ *   2. otherwise            → the legacy plain env vars
+ *                             (`LWA_CLIENT_ID`/`LWA_CLIENT_SECRET`,
+ *                             `SKILL_CLIENT_ID`/`SKILL_CLIENT_SECRET`), so this
+ *                             code can be deployed before the parameters exist
+ *                             and the cut-over has no downtime.
  *
  * The cache is what makes a rotation cheap: a new value is picked up within
  * `ttlMs`, and immediately when LWA answers `invalid_client` (the caller calls
- * `invalidate`). Error messages name the secret id, never a value.
+ * `invalidate`). Error messages name the parameter, never a value.
  */
 'use strict'
 
 const DEFAULT_SECRET_TTL_MS = 5 * 60 * 1000
 
 const KINDS = {
-  lwa: { secretIdVar: 'LWA_SECRET_ID', idVar: 'LWA_CLIENT_ID', secretVar: 'LWA_CLIENT_SECRET' },
+  lwa: { paramVar: 'LWA_PARAM', idVar: 'LWA_CLIENT_ID', secretVar: 'LWA_CLIENT_SECRET' },
   skill: {
-    secretIdVar: 'SKILL_SECRET_ID',
+    paramVar: 'SKILL_PARAM',
     idVar: 'SKILL_CLIENT_ID',
     secretVar: 'SKILL_CLIENT_SECRET',
   },
@@ -43,7 +46,7 @@ const KINDS = {
 /**
  * @param {object} opts
  * @param {Record<string, string|undefined>} opts.env
- * @param {(secretId: string) => Promise<string>} opts.fetchSecretString
+ * @param {(name: string) => Promise<string>} opts.readParameter  decrypted value
  * @param {() => number} [opts.now]
  * @param {number} [opts.ttlMs]
  */
@@ -55,12 +58,12 @@ function createSecretSource(opts) {
 
   async function load(kind) {
     const spec = KINDS[kind]
-    const secretId = env[spec.secretIdVar]
-    if (secretId) {
+    const paramName = env[spec.paramVar]
+    if (paramName) {
       const hit = cache.get(kind)
       if (hit && now() - hit.at < ttlMs) return hit.value
-      const raw = await opts.fetchSecretString(secretId)
-      const value = parseCredentialSecret(raw, secretId)
+      const raw = await opts.readParameter(paramName)
+      const value = parseCredentialParameter(raw, paramName)
       cache.set(kind, { value, at: now() })
       return value
     }
@@ -79,12 +82,12 @@ function createSecretSource(opts) {
   }
 }
 
-function parseCredentialSecret(raw, secretId) {
+function parseCredentialParameter(raw, paramName) {
   let obj
   try {
     obj = JSON.parse(raw)
   } catch {
-    throw new Error(`secret ${secretId} is not a JSON object`)
+    throw new Error(`parameter ${paramName} is not a JSON object`)
   }
   if (
     !obj ||
@@ -93,13 +96,13 @@ function parseCredentialSecret(raw, secretId) {
     typeof obj.clientSecret !== 'string' ||
     obj.clientSecret.length === 0
   ) {
-    throw new Error(`secret ${secretId} must be {"clientId": "...", "clientSecret": "..."}`)
+    throw new Error(`parameter ${paramName} must be {"clientId": "...", "clientSecret": "..."}`)
   }
-  const out = { clientId: obj.clientId, clientSecret: obj.clientSecret, source: 'secrets-manager' }
+  const out = { clientId: obj.clientId, clientSecret: obj.clientSecret, source: 'ssm' }
   if (typeof obj.previousClientSecret === 'string' && obj.previousClientSecret.length > 0) {
     out.previousClientSecret = obj.previousClientSecret
   }
   return out
 }
 
-module.exports = { createSecretSource, parseCredentialSecret, DEFAULT_SECRET_TTL_MS }
+module.exports = { createSecretSource, parseCredentialParameter, DEFAULT_SECRET_TTL_MS }

package/lambda-template/util.js

@@ -94,20 +94,71 @@ function jsonResponse(statusCode, body) {
   }
 }
 
-function errorEnvelope(header, type, message) {
+/**
+ * `Alexa.ErrorResponse` for a directive. Amazon requires the directive's
+ * `correlationToken` and the target `endpoint` on it (alexa-errorresponse);
+ * both are copied when the directive carried them.
+ */
+function errorEnvelope(header, type, message, endpoint) {
+  const endpointId =
+    endpoint && typeof endpoint.endpointId === 'string' ? endpoint.endpointId : null
   return {
     event: {
       header: {
         namespace: 'Alexa',
         name: 'ErrorResponse',
         messageId: header.messageId,
+        ...(typeof header.correlationToken === 'string'
+          ? { correlationToken: header.correlationToken }
+          : {}),
         payloadVersion: '3',
       },
+      ...(endpointId !== null ? { endpoint: { endpointId } } : {}),
       payload: { type, message },
     },
   }
 }
 
+/** AcceptGrant's own error: `Alexa.Authorization/ErrorResponse` (alexa-authorization). */
+function acceptGrantErrorEnvelope(header, message) {
+  return {
+    event: {
+      header: {
+        namespace: 'Alexa.Authorization',
+        name: 'ErrorResponse',
+        messageId: header.messageId,
+        payloadVersion: '3',
+      },
+      payload: { type: 'ACCEPT_GRANT_FAILED', message },
+    },
+  }
+}
+
+/**
+ * Fill in what an `Alexa.ErrorResponse` from a hub may lack — a hub running an
+ * older addon omits `correlationToken` and `endpoint`. Any other body is
+ * returned as it is.
+ */
+function completeErrorResponse(body, directive) {
+  const ev = body && body.event
+  if (!ev || !ev.header || ev.header.name !== 'ErrorResponse' || ev.header.namespace !== 'Alexa') {
+    return body
+  }
+  const header = { ...ev.header }
+  if (
+    header.correlationToken === undefined &&
+    typeof directive.header.correlationToken === 'string'
+  ) {
+    header.correlationToken = directive.header.correlationToken
+  }
+  const endpointId =
+    directive.endpoint && typeof directive.endpoint.endpointId === 'string'
+      ? directive.endpoint.endpointId
+      : null
+  const endpoint = ev.endpoint || (endpointId !== null ? { endpointId } : undefined)
+  return { ...body, event: { ...ev, header, ...(endpoint ? { endpoint } : {}) } }
+}
+
 function describe(err) {
   if (err instanceof Error) return err.message
   return String(err)
@@ -124,5 +175,7 @@ module.exports = {
   resolveBrokerPublicUrl,
   jsonResponse,
   errorEnvelope,
+  acceptGrantErrorEnvelope,
+  completeErrorResponse,
   describe,
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-export-alexa",
-  "version": "1.2.133",
+  "version": "1.2.135",
   "description": "Alexa Smart Home Skill export — hub-side OAuth provider + directive handler. The companion AWS Lambda forwards Alexa directives to this addon's /addon/export-alexa/directive endpoint.",
   "keywords": [
     "camstack",