@exabugs/dynamodb-client 1.5.1 → 1.5.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (56) hide show
  1. package/CHANGELOG.md +32 -0
  2. package/dist/server/handler.cjs +10866 -6882
  3. package/dist/server/handler.cjs.map +4 -4
  4. package/dist/server/media/magicBytes.d.ts +25 -0
  5. package/dist/server/media/magicBytes.d.ts.map +1 -0
  6. package/dist/server/media/magicBytes.js +50 -0
  7. package/dist/server/media/magicBytes.js.map +1 -0
  8. package/dist/server/media/media-handler.d.ts +13 -0
  9. package/dist/server/media/media-handler.d.ts.map +1 -0
  10. package/dist/server/media/media-handler.js +143 -0
  11. package/dist/server/media/media-handler.js.map +1 -0
  12. package/dist/server/media/presign.d.ts +9 -0
  13. package/dist/server/media/presign.d.ts.map +1 -0
  14. package/dist/server/media/presign.js +73 -0
  15. package/dist/server/media/presign.js.map +1 -0
  16. package/dist/server/media/process-handler-dlq.d.ts +16 -0
  17. package/dist/server/media/process-handler-dlq.d.ts.map +1 -0
  18. package/dist/server/media/process-handler-dlq.js +52 -0
  19. package/dist/server/media/process-handler-dlq.js.map +1 -0
  20. package/dist/server/media/process-handler.d.ts +12 -0
  21. package/dist/server/media/process-handler.d.ts.map +1 -0
  22. package/dist/server/media/process-handler.js +138 -0
  23. package/dist/server/media/process-handler.js.map +1 -0
  24. package/dist/server/media/sign.d.ts +11 -0
  25. package/dist/server/media/sign.d.ts.map +1 -0
  26. package/dist/server/media/sign.js +49 -0
  27. package/dist/server/media/sign.js.map +1 -0
  28. package/dist/server/media/ssmParams.d.ts +29 -0
  29. package/dist/server/media/ssmParams.d.ts.map +1 -0
  30. package/dist/server/media/ssmParams.js +74 -0
  31. package/dist/server/media/ssmParams.js.map +1 -0
  32. package/dist/server/media/types.d.ts +109 -0
  33. package/dist/server/media/types.d.ts.map +1 -0
  34. package/dist/server/media/types.js +2 -0
  35. package/dist/server/media/types.js.map +1 -0
  36. package/dist/server/media-handler.cjs +57450 -0
  37. package/dist/server/media-handler.cjs.map +7 -0
  38. package/dist/server/media-process-handler-dlq.cjs +36195 -0
  39. package/dist/server/media-process-handler-dlq.cjs.map +7 -0
  40. package/dist/server/media-process-handler.cjs +60568 -0
  41. package/dist/server/media-process-handler.cjs.map +7 -0
  42. package/dist/server/utils/authHandler.d.ts +40 -1
  43. package/dist/server/utils/authHandler.d.ts.map +1 -1
  44. package/dist/server/utils/authHandler.js +14 -33
  45. package/dist/server/utils/authHandler.js.map +1 -1
  46. package/dist/sharp-layer.zip +0 -0
  47. package/package.json +34 -3
  48. package/terraform/main.tf +36 -2
  49. package/terraform/media/README.md +64 -0
  50. package/terraform/media/main.tf +718 -0
  51. package/terraform/media/outputs.tf +66 -0
  52. package/terraform/media/variables.tf +84 -0
  53. package/terraform/modules/parameter-store/main.tf +26 -1
  54. package/terraform/modules/parameter-store/variables.tf +7 -1
  55. package/terraform/outputs.tf +10 -0
  56. package/terraform/variables.tf +6 -0
package/CHANGELOG.md CHANGED
@@ -7,6 +7,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
7
7
 
8
8
  ## [Unreleased]
9
9
 
10
+ ## [1.5.3] - 2026-10-04
11
+
12
+ ### Fixed
13
+
14
+ - `terraform/modules/parameter-store`: 新規SSM Parameter `infra/dynamodb-client-api-iam-url`（AWS_IAM認証URL）を追加。既存の`infra/dynamodb-client-api-url`（NONE認証URL）は1.5.2でIAM認証の分岐を削除済みのため、IAM署名クライアント（`@exabugs/dynamodb-client/client/iam`）を使う呼び出し元・運用スクリプトは新しいパラメータを参照すること
15
+
16
+ ### Docs
17
+
18
+ - `docs/adr/0001-fix-iam-auth-bypass.md`: 被害調査（90日分ログに悪用痕跡なし）が、prd環境の`LOG_LEVEL=warn`設定により実際には検証になっていなかった点を訂正。検証用サンドボックスが削除されずus-east-1に残存していた点も訂正
19
+
20
+ ### Added（実験的・未統合）
21
+
22
+ - `src/server/media/`: ファイルアップロード・処理（EXIF除去・リサイズ）・CloudFront署名付きURL配信機能を追加（presign・sign・process-handler・process-handler-dlq・media-handler・ssmParams・magicBytes）。`terraform/media/`・`scripts/build-sharp-layer.sh`も追加
23
+ - **設計レビューの結果、現状の設計には実装前に解決すべき既知の欠落がある**（S3メタデータキーの契約未定義、管理画面向けpresign/sign発行の担い手不在、presigned POSTの再利用に対する不変性保証の欠如、リサイズのサイズ設計の不整合など）。詳細は`docs/media-design.md`・`docs/adr/0002-media-design.md`を参照。**いずれのアプリにもまだ統合されていない。設計改訂が完了するまで本番導入は推奨しない**
24
+
25
+ ## [1.5.2] - 2026-10-04
26
+
27
+ ### Security
28
+
29
+ - **IAM認証バイパスの脆弱性を修正**: `authHandler.ts`が`x-amz-date`/`x-amz-content-sha256`等のヘッダーの「見た目」だけでIAM認証とみなし、実際の署名検証を行っていなかった問題を修正
30
+ - Function URLをAWS_IAM認証で保護した専用エイリアス（`iam`）を新設し、サーバー間呼び出しはそちらを使う
31
+ - 認証判定は`event.requestContext.authorizer.iam`（AWSが検証済みの場合にのみ付与され、クライアントから偽装不可）の有無に変更
32
+ - 既存のNONE認証Function URLからはIAM認証の分岐を削除し、Cognito JWTのみを受け付ける
33
+ - 詳細は`docs/adr/0001-fix-iam-auth-bypass.md`参照
34
+ - **Cognito JWTのaud検証が無効だった問題を修正**: `COGNITO_CLIENT_ID`環境変数が未設定のため`aud`クレームの検証が常にスキップされていた。新規`cognito_client_id`Terraform変数を追加し配線
35
+
36
+ ### Added
37
+
38
+ - `terraform/main.tf`: `aws_lambda_alias.iam`（AWS_IAM認証用エイリアス）、`aws_lambda_function_url.records_iam`を追加
39
+ - `terraform/outputs.tf`: `iam_function_url`・`iam_alias_arn`を追加
40
+ - `terraform/variables.tf`: `cognito_client_id`（オプション）を追加
41
+
10
42
  ## [1.5.0] - 2026-08-23
11
43
 
12
44
  ### Added