@exabugs/dynamodb-client 1.5.0 → 1.5.2

package/CHANGELOG.md

@@ -7,6 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.5.2] - 2026-10-04
+
+### Security
+
+- **IAM認証バイパスの脆弱性を修正**: `authHandler.ts`が`x-amz-date`/`x-amz-content-sha256`等のヘッダーの「見た目」だけでIAM認証とみなし、実際の署名検証を行っていなかった問題を修正
+  - Function URLをAWS_IAM認証で保護した専用エイリアス（`iam`）を新設し、サーバー間呼び出しはそちらを使う
+  - 認証判定は`event.requestContext.authorizer.iam`（AWSが検証済みの場合にのみ付与され、クライアントから偽装不可）の有無に変更
+  - 既存のNONE認証Function URLからはIAM認証の分岐を削除し、Cognito JWTのみを受け付ける
+  - 詳細は`docs/adr/0001-fix-iam-auth-bypass.md`参照
+- **Cognito JWTのaud検証が無効だった問題を修正**: `COGNITO_CLIENT_ID`環境変数が未設定のため`aud`クレームの検証が常にスキップされていた。新規`cognito_client_id`Terraform変数を追加し配線
+
+### Added
+
+- `terraform/main.tf`: `aws_lambda_alias.iam`（AWS_IAM認証用エイリアス）、`aws_lambda_function_url.records_iam`を追加
+- `terraform/outputs.tf`: `iam_function_url`・`iam_alias_arn`を追加
+- `terraform/variables.tf`: `cognito_client_id`（オプション）を追加
+
 ## [1.5.0] - 2026-08-23
 
 ### Added

package/dist/server/handler.cjs

@@ -1,5 +1,5 @@
-// @exabugs/dynamodb-client v1.5.0
-// Built: 2026-08-22T23:11:31.236Z
+// @exabugs/dynamodb-client v1.5.2
+// Built: 2026-10-04T07:52:04.926Z
 "use strict";
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -30657,6 +30657,9 @@ async function executeInQuery(resource, targetIds, sort, requestId) {
   };
 }
 async function executeAllRecordsQuery(resource, sort, perPage, nextToken, parsedFilters, requestId) {
+  if (parsedFilters.length > 0) {
+    return executeAllRecordsQueryFullScan(resource, sort, perPage, nextToken, parsedFilters, requestId);
+  }
   const dbClient2 = getDBClient();
   const tableName = getTableName();
   const costTracker = new CostTracker();
@@ -30723,6 +30726,84 @@ async function executeAllRecordsQuery(resource, sort, perPage, nextToken, parsed
     consumedCapacity: costTracker.getAggregated()
   };
 }
+async function executeAllRecordsQueryFullScan(resource, sort, perPage, nextToken, parsedFilters, requestId) {
+  const dbClient2 = getDBClient();
+  const tableName = getTableName();
+  const costTracker = new CostTracker();
+  const offset = nextToken ? decodeOffsetToken(nextToken) ?? 0 : 0;
+  logger6.debug("Executing full scan query (ID sort)", {
+    requestId,
+    resource,
+    offset
+  });
+  const allRecords = [];
+  let exclusiveStartKey;
+  let previousKeySignature;
+  const MAX_ITERATIONS = 1e4;
+  let iterations = 0;
+  do {
+    if (++iterations > MAX_ITERATIONS) {
+      logger6.error("executeAllRecordsQueryFullScan: \u6700\u5927\u53CD\u5FA9\u56DE\u6570\u3092\u8D85\u904E\u3057\u305F\u305F\u3081\u4E2D\u65AD", {
+        requestId,
+        resource,
+        iterations
+      });
+      break;
+    }
+    const queryResult = await executeDynamoDBOperation(
+      () => dbClient2.send(
+        new import_lib_dynamodb2.QueryCommand({
+          TableName: tableName,
+          KeyConditionExpression: "PK = :pk AND begins_with(SK, :skPrefix)",
+          ExpressionAttributeValues: {
+            ":pk": resource,
+            ":skPrefix": "id#"
+          },
+          ScanIndexForward: sort.order === "ASC",
+          Limit: 1e3,
+          // 大きめの Limit でループ回数を最小化
+          ExclusiveStartKey: exclusiveStartKey,
+          ConsistentRead: true,
+          ReturnConsumedCapacity: "TOTAL"
+        })
+      ),
+      "Query"
+    );
+    costTracker.add(queryResult.ConsumedCapacity);
+    allRecords.push(...queryResult.Items || []);
+    const nextKey = queryResult.LastEvaluatedKey;
+    const nextKeySignature = nextKey ? `${nextKey.PK}#${nextKey.SK}` : void 0;
+    if (nextKeySignature && nextKeySignature === previousKeySignature) {
+      logger6.error("executeAllRecordsQueryFullScan: \u540C\u4E00\u306ELastEvaluatedKey\u304C\u8FD4\u5374\u3055\u308C\u305F\u305F\u3081\u4E2D\u65AD", {
+        requestId,
+        resource,
+        iterations
+      });
+      break;
+    }
+    previousKeySignature = nextKeySignature;
+    exclusiveStartKey = nextKey;
+  } while (exclusiveStartKey);
+  let items = allRecords.map((item) => extractCleanRecord(item));
+  items = items.filter((record) => matchesAllFilters(record, parsedFilters));
+  const page = items.slice(offset, offset + perPage);
+  const hasNextPage = offset + perPage < items.length;
+  const nextTokenValue = hasNextPage ? encodeOffsetToken(offset + perPage) : void 0;
+  logger6.info("ID full scan query succeeded", {
+    requestId,
+    resource,
+    totalMatched: items.length,
+    offset,
+    returned: page.length,
+    hasNextPage
+  });
+  return {
+    items: page,
+    pageInfo: { hasNextPage, hasPreviousPage: offset > 0 },
+    ...nextTokenValue && { nextToken: nextTokenValue },
+    consumedCapacity: costTracker.getAggregated()
+  };
+}
 var import_lib_dynamodb2, logger6;
 var init_idQuery = __esm({
   "src/server/operations/find/idQuery.ts"() {
@@ -30741,6 +30822,7 @@ var init_idQuery = __esm({
     __name(executeSpecificIdQuery, "executeSpecificIdQuery");
     __name(executeInQuery, "executeInQuery");
     __name(executeAllRecordsQuery, "executeAllRecordsQuery");
+    __name(executeAllRecordsQueryFullScan, "executeAllRecordsQueryFullScan");
   }
 });
 
@@ -30906,6 +30988,19 @@ async function executeShadowQuery(resource, normalizedParams, requestId) {
     );
   }
   const optimizableFilter = findOptimizableFilter(sort.field, parsedFilters);
+  const isKeyConditionOptimized = optimizableFilter !== void 0 && KEY_CONDITION_OPERATORS.has(optimizableFilter.parsed.operator);
+  const residualFilters = parsedFilters.filter(
+    (f4) => !(isKeyConditionOptimized && f4 === optimizableFilter)
+  );
+  if (residualFilters.length > 0) {
+    logger8.debug("Residual filters detected, falling back to full scan", {
+      requestId,
+      resource,
+      sortField: sort.field,
+      residualFilterFields: residualFilters.map((f4) => f4.parsed.field)
+    });
+    return executeFullScanQuery(resource, normalizedParams, costTracker, requestId);
+  }
   logger8.debug("Executing shadow query", {
     requestId,
     resource,
@@ -30918,7 +31013,7 @@ async function executeShadowQuery(resource, normalizedParams, requestId) {
     sort,
     perPage,
     nextToken,
-    optimizableFilter,
+    isKeyConditionOptimized ? optimizableFilter : void 0,
     costTracker,
     requestId
   );
@@ -30986,38 +31081,13 @@ async function executeFilterFirstQuery(resource, normalizedParams, filterCandida
     sortField: sort.field,
     offset
   });
-  const allShadowItems = [];
-  let lastKey;
-  do {
-    const result = await executeShadowRecordQuery(
-      resource,
-      filterSort,
-      1e3,
-      // 大きめの Limit でループ回数を最小化
-      lastKey ? encodeNextToken(lastKey.PK, lastKey.SK) : void 0,
-      filterCandidate,
-      costTracker,
-      requestId
-    );
-    allShadowItems.push(...result.Items || []);
-    lastKey = result.LastEvaluatedKey;
-  } while (lastKey);
-  const allIds = Array.from(new Set(extractRecordIds(allShadowItems)));
-  if (allIds.length === 0) {
-    return {
-      items: [],
-      pageInfo: { hasNextPage: false, hasPreviousPage: offset > 0 },
-      consumedCapacity: costTracker.getAggregated()
-    };
-  }
-  const mainRecords = await fetchMainRecords(resource, allIds, costTracker, requestId);
-  const recordMap = new Map(
-    mainRecords.map((item) => {
-      const data2 = item.data;
-      return [data2.id, extractCleanRecord(item)];
-    })
+  let items = await fetchAllRecordsViaShadowIndex(
+    resource,
+    filterSort,
+    filterCandidate,
+    costTracker,
+    requestId
   );
-  let items = allIds.map((id) => recordMap.get(id)).filter((r4) => r4 !== void 0);
   if (remainingFilters.length > 0) {
     items = items.filter((r4) => matchesAllFilters(r4, remainingFilters));
   }
@@ -31042,6 +31112,91 @@ async function executeFilterFirstQuery(resource, normalizedParams, filterCandida
     consumedCapacity: costTracker.getAggregated()
   };
 }
+async function executeFullScanQuery(resource, normalizedParams, costTracker, requestId) {
+  const { sort, pagination, parsedFilters } = normalizedParams;
+  const { perPage, nextToken } = pagination;
+  const offset = nextToken ? decodeOffsetToken(nextToken) ?? 0 : 0;
+  logger8.debug("Executing full scan query", {
+    requestId,
+    resource,
+    sortField: sort.field,
+    offset
+  });
+  let items = await fetchAllRecordsViaShadowIndex(resource, sort, void 0, costTracker, requestId);
+  if (parsedFilters.length > 0) {
+    items = items.filter((r4) => matchesAllFilters(r4, parsedFilters));
+  }
+  const page = items.slice(offset, offset + perPage);
+  const hasNextPage = offset + perPage < items.length;
+  const nextTokenValue = hasNextPage ? encodeOffsetToken(offset + perPage) : void 0;
+  logger8.info("Full scan query succeeded", {
+    requestId,
+    resource,
+    sortField: sort.field,
+    totalMatched: items.length,
+    offset,
+    returned: page.length,
+    hasNextPage
+  });
+  return {
+    items: page,
+    pageInfo: { hasNextPage, hasPreviousPage: offset > 0 },
+    ...nextTokenValue && { nextToken: nextTokenValue },
+    consumedCapacity: costTracker.getAggregated()
+  };
+}
+async function fetchAllRecordsViaShadowIndex(resource, indexSort, indexFilter, costTracker, requestId) {
+  const allShadowItems = [];
+  let lastKey;
+  let previousKeySignature;
+  const MAX_ITERATIONS = 1e4;
+  let iterations = 0;
+  do {
+    if (++iterations > MAX_ITERATIONS) {
+      logger8.error("fetchAllRecordsViaShadowIndex: \u6700\u5927\u53CD\u5FA9\u56DE\u6570\u3092\u8D85\u904E\u3057\u305F\u305F\u3081\u4E2D\u65AD", {
+        requestId,
+        resource,
+        iterations
+      });
+      break;
+    }
+    const result = await executeShadowRecordQuery(
+      resource,
+      indexSort,
+      1e3,
+      // 大きめの Limit でループ回数を最小化
+      lastKey ? encodeNextToken(lastKey.PK, lastKey.SK) : void 0,
+      indexFilter,
+      costTracker,
+      requestId
+    );
+    allShadowItems.push(...result.Items || []);
+    const nextKey = result.LastEvaluatedKey;
+    const nextKeySignature = nextKey ? `${nextKey.PK}#${nextKey.SK}` : void 0;
+    if (nextKeySignature && nextKeySignature === previousKeySignature) {
+      logger8.error("fetchAllRecordsViaShadowIndex: \u540C\u4E00\u306ELastEvaluatedKey\u304C\u8FD4\u5374\u3055\u308C\u305F\u305F\u3081\u4E2D\u65AD", {
+        requestId,
+        resource,
+        iterations
+      });
+      break;
+    }
+    previousKeySignature = nextKeySignature;
+    lastKey = nextKey;
+  } while (lastKey);
+  const allIds = Array.from(new Set(extractRecordIds(allShadowItems)));
+  if (allIds.length === 0) {
+    return [];
+  }
+  const mainRecords = await fetchMainRecords(resource, allIds, costTracker, requestId);
+  const recordMap = new Map(
+    mainRecords.map((item) => {
+      const data2 = item.data;
+      return [data2.id, extractCleanRecord(item)];
+    })
+  );
+  return allIds.map((id) => recordMap.get(id)).filter((r4) => r4 !== void 0);
+}
 function selectFilterFirstCandidate(parsedFilters, sortField, schema, perPage) {
   const eqFilters = parsedFilters.filter(
     (f4) => f4.parsed.operator === "$eq" && f4.parsed.field !== sortField
@@ -31238,7 +31393,7 @@ async function fetchMainRecords(resource, recordIds, costTracker, requestId) {
   });
   return allRecords;
 }
-var import_lib_dynamodb4, logger8;
+var import_lib_dynamodb4, logger8, KEY_CONDITION_OPERATORS;
 var init_shadowQuery = __esm({
   "src/server/operations/find/shadowQuery.ts"() {
     "use strict";
@@ -31253,8 +31408,11 @@ var init_shadowQuery = __esm({
       service: "shadow-query",
       level: process.env.LOG_LEVEL || "info"
     });
+    KEY_CONDITION_OPERATORS = /* @__PURE__ */ new Set(["$eq", "$gt", "$gte", "$lt", "$lte", "$starts"]);
     __name(executeShadowQuery, "executeShadowQuery");
     __name(executeFilterFirstQuery, "executeFilterFirstQuery");
+    __name(executeFullScanQuery, "executeFullScanQuery");
+    __name(fetchAllRecordsViaShadowIndex, "fetchAllRecordsViaShadowIndex");
     __name(selectFilterFirstCandidate, "selectFilterFirstCandidate");
     __name(sortInMemory, "sortInMemory");
     __name(executeShadowRecordQuery, "executeShadowRecordQuery");
@@ -34335,30 +34493,21 @@ var logger22 = createLogger({
   level: process.env.LOG_LEVEL || "info"
 });
 async function handleAuthentication(event, requestId) {
-  const authHeader = event.headers.authorization || event.headers.Authorization;
-  const hasAmzDate = event.headers["x-amz-date"] || event.headers["X-Amz-Date"];
-  const hasAmzContentSha = event.headers["x-amz-content-sha256"] || event.headers["X-Amz-Content-Sha256"];
-  const hasAwsSigV4Auth = authHeader?.startsWith("AWS4-HMAC-SHA256");
-  logger22.debug("Authentication check", {
-    requestId,
-    hasAuthHeader: !!authHeader,
-    hasAmzDate: !!hasAmzDate,
-    hasAmzContentSha: !!hasAmzContentSha,
-    hasAwsSigV4Auth: !!hasAwsSigV4Auth,
-    authHeaderPrefix: authHeader?.substring(0, 20)
-  });
-  const isIAMAuth = hasAwsSigV4Auth || !!(hasAmzDate && hasAmzContentSha);
-  if (isIAMAuth) {
-    await handleIAMAuthentication(event, requestId);
-  } else {
-    await handleCognitoAuthentication(authHeader, requestId);
+  const iam = event.requestContext.authorizer?.iam;
+  if (iam) {
+    handleIAMAuthentication(iam, requestId);
+    return;
   }
+  const authHeader = event.headers.authorization || event.headers.Authorization;
+  await handleCognitoAuthentication(authHeader, requestId);
 }
 __name(handleAuthentication, "handleAuthentication");
-async function handleIAMAuthentication(event, requestId) {
+function handleIAMAuthentication(iam, requestId) {
   logger22.info("IAM authenticated request", {
     requestId,
-    sourceIp: event.requestContext.http.sourceIp
+    userArn: iam.userArn,
+    accountId: iam.accountId,
+    callerId: iam.callerId
   });
 }
 __name(handleIAMAuthentication, "handleIAMAuthentication");
@@ -34559,7 +34708,7 @@ async function handler(event) {
       return createCorsResponse(HTTP_STATUS.OK);
     }
     if (event.requestContext.http.method === "GET" && event.requestContext.http.path === "/version") {
-      const version = "1.5.0";
+      const version = "1.5.2";
       return createSuccessResponse({ version, timestamp: (/* @__PURE__ */ new Date()).toISOString() }, requestId);
     }
     if (event.requestContext.http.method !== "POST") {