@exabugs/dynamodb-client 1.5.1 → 1.5.2

package/CHANGELOG.md

@@ -7,6 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.5.2] - 2026-10-04
+
+### Security
+
+- **IAM認証バイパスの脆弱性を修正**: `authHandler.ts`が`x-amz-date`/`x-amz-content-sha256`等のヘッダーの「見た目」だけでIAM認証とみなし、実際の署名検証を行っていなかった問題を修正
+  - Function URLをAWS_IAM認証で保護した専用エイリアス（`iam`）を新設し、サーバー間呼び出しはそちらを使う
+  - 認証判定は`event.requestContext.authorizer.iam`（AWSが検証済みの場合にのみ付与され、クライアントから偽装不可）の有無に変更
+  - 既存のNONE認証Function URLからはIAM認証の分岐を削除し、Cognito JWTのみを受け付ける
+  - 詳細は`docs/adr/0001-fix-iam-auth-bypass.md`参照
+- **Cognito JWTのaud検証が無効だった問題を修正**: `COGNITO_CLIENT_ID`環境変数が未設定のため`aud`クレームの検証が常にスキップされていた。新規`cognito_client_id`Terraform変数を追加し配線
+
+### Added
+
+- `terraform/main.tf`: `aws_lambda_alias.iam`（AWS_IAM認証用エイリアス）、`aws_lambda_function_url.records_iam`を追加
+- `terraform/outputs.tf`: `iam_function_url`・`iam_alias_arn`を追加
+- `terraform/variables.tf`: `cognito_client_id`（オプション）を追加
+
 ## [1.5.0] - 2026-08-23
 
 ### Added

package/dist/server/handler.cjs

@@ -1,5 +1,5 @@
-// @exabugs/dynamodb-client v1.5.1
-// Built: 2026-09-27T04:40:22.568Z
+// @exabugs/dynamodb-client v1.5.2
+// Built: 2026-10-04T07:52:04.926Z
 "use strict";
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -34493,30 +34493,21 @@ var logger22 = createLogger({
   level: process.env.LOG_LEVEL || "info"
 });
 async function handleAuthentication(event, requestId) {
-  const authHeader = event.headers.authorization || event.headers.Authorization;
-  const hasAmzDate = event.headers["x-amz-date"] || event.headers["X-Amz-Date"];
-  const hasAmzContentSha = event.headers["x-amz-content-sha256"] || event.headers["X-Amz-Content-Sha256"];
-  const hasAwsSigV4Auth = authHeader?.startsWith("AWS4-HMAC-SHA256");
-  logger22.debug("Authentication check", {
-    requestId,
-    hasAuthHeader: !!authHeader,
-    hasAmzDate: !!hasAmzDate,
-    hasAmzContentSha: !!hasAmzContentSha,
-    hasAwsSigV4Auth: !!hasAwsSigV4Auth,
-    authHeaderPrefix: authHeader?.substring(0, 20)
-  });
-  const isIAMAuth = hasAwsSigV4Auth || !!(hasAmzDate && hasAmzContentSha);
-  if (isIAMAuth) {
-    await handleIAMAuthentication(event, requestId);
-  } else {
-    await handleCognitoAuthentication(authHeader, requestId);
+  const iam = event.requestContext.authorizer?.iam;
+  if (iam) {
+    handleIAMAuthentication(iam, requestId);
+    return;
   }
+  const authHeader = event.headers.authorization || event.headers.Authorization;
+  await handleCognitoAuthentication(authHeader, requestId);
 }
 __name(handleAuthentication, "handleAuthentication");
-async function handleIAMAuthentication(event, requestId) {
+function handleIAMAuthentication(iam, requestId) {
   logger22.info("IAM authenticated request", {
     requestId,
-    sourceIp: event.requestContext.http.sourceIp
+    userArn: iam.userArn,
+    accountId: iam.accountId,
+    callerId: iam.callerId
   });
 }
 __name(handleIAMAuthentication, "handleIAMAuthentication");
@@ -34717,7 +34708,7 @@ async function handler(event) {
       return createCorsResponse(HTTP_STATUS.OK);
     }
     if (event.requestContext.http.method === "GET" && event.requestContext.http.path === "/version") {
-      const version = "1.5.1";
+      const version = "1.5.2";
       return createSuccessResponse({ version, timestamp: (/* @__PURE__ */ new Date()).toISOString() }, requestId);
     }
     if (event.requestContext.http.method !== "POST") {