@exabugs/dynamodb-client 1.6.1 → 1.6.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (16) hide show
  1. package/CHANGELOG.md +16 -0
  2. package/README.md +1 -0
  3. package/dist/server/handler.cjs +10 -5
  4. package/dist/server/handler.cjs.map +2 -2
  5. package/dist/server/media-handler.cjs +2 -2
  6. package/dist/server/media-process-handler-dlq.cjs +2 -2
  7. package/dist/server/media-process-handler.cjs +2 -2
  8. package/dist/server/utils/auth.d.ts.map +1 -1
  9. package/dist/server/utils/auth.js +8 -0
  10. package/dist/server/utils/auth.js.map +1 -1
  11. package/dist/server/utils/authHandler.js +1 -1
  12. package/dist/server/utils/authHandler.js.map +1 -1
  13. package/dist/sharp-layer.zip +0 -0
  14. package/package.json +1 -1
  15. package/terraform/README.md +5 -0
  16. package/terraform/variables.tf +1 -1
package/dist/server/media-handler.cjs CHANGED
@@ -1,5 +1,5 @@
1
- // @exabugs/dynamodb-client v1.6.1
2
- // Built: 2026-10-11T12:45:55.244Z
1
+ // @exabugs/dynamodb-client v1.6.2
2
+ // Built: 2026-10-11T14:15:49.129Z
3
3
  "use strict";
4
4
  var __create = Object.create;
5
5
  var __defProp = Object.defineProperty;
package/dist/server/media-process-handler-dlq.cjs CHANGED
@@ -1,5 +1,5 @@
1
- // @exabugs/dynamodb-client v1.6.1
2
- // Built: 2026-10-11T12:45:55.244Z
1
+ // @exabugs/dynamodb-client v1.6.2
2
+ // Built: 2026-10-11T14:15:49.129Z
3
3
  "use strict";
4
4
  var __create = Object.create;
5
5
  var __defProp = Object.defineProperty;
package/dist/server/media-process-handler.cjs CHANGED
@@ -1,5 +1,5 @@
1
- // @exabugs/dynamodb-client v1.6.1
2
- // Built: 2026-10-11T12:45:55.244Z
1
+ // @exabugs/dynamodb-client v1.6.2
2
+ // Built: 2026-10-11T14:15:49.129Z
3
3
  "use strict";
4
4
  var __create = Object.create;
5
5
  var __defProp = Object.defineProperty;
package/dist/server/utils/auth.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/server/utils/auth.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAMlE;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,iBAAiB,CAAC;AA+B3C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,UAAU,CAAC,CAyCrB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAY7E;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,UAAU,CAAC,CAGrB"}
1
+ {"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/server/utils/auth.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAMlE;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,iBAAiB,CAAC;AA2C3C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,UAAU,CAAC,CAyCrB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAY7E;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,UAAU,CAAC,CAGrB"}
package/dist/server/utils/auth.js CHANGED
@@ -24,6 +24,14 @@ let verifierInstance = null;
24
24
  function getVerifier(userPoolId, clientId) {
25
25
  if (!verifierInstance) {
26
26
  logger.debug('Creating JWT verifier instance', { userPoolId, clientId });
27
+ if (!clientId) {
28
+ // aud を検証しないと、同じユーザープールの別アプリクライアントが発行したトークンも通る。
29
+ // 挙動は変えず（破壊的変更にしない）、気づけるように警告する。コールドスタートごとに1回。
30
+ logger.warn('COGNITO_CLIENT_ID is not set: JWT audience (aud) verification is DISABLED. ' +
31
+ 'Tokens issued to ANY app client of this user pool are accepted. ' +
32
+ 'Set cognito_client_id (Terraform) / COGNITO_CLIENT_ID in production. ' +
33
+ 'See docs/AUTHORIZATION.md', { userPoolId });
34
+ }
27
35
  verifierInstance = CognitoJwtVerifier.create({
28
36
  userPoolId,
29
37
  tokenUse: 'id', // ID トークンを検証
package/dist/server/utils/auth.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/server/utils/auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGpD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEzD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAQ3D;;;;;GAKG;AACH,IAAI,gBAAgB,GAAwD,IAAI,CAAC;AAEjF;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,UAAkB,EAAE,QAAiB;IACxD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEzE,gBAAgB,GAAG,kBAAkB,CAAC,MAAM,CAAC;YAC3C,UAAU;YACV,QAAQ,EAAE,IAAI,EAAE,aAAa;YAC7B,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,4CAA4C;SACzE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAa,EACb,UAAkB,EAClB,QAAiB;IAEjB,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAE9D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAEnD,mCAAmC;QACnC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE7C,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;YAC9C,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,SAAS;SAC5B,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE;YACtC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;QAEH,cAAc;QACd,IAAI,OAAO,GAAG,yBAAyB,CAAC;QACxC,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtC,OAAO,GAAG,mBAAmB,CAAC;YAChC,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACvD,OAAO,GAAG,yBAAyB,CAAC;YACtC,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACpD,OAAO,GAAG,sBAAsB,CAAC;YACnC,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACtD,OAAO,GAAG,wBAAwB,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE;YAC3B,aAAa,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SACtE,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAA8B;IACnE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CAAC,gEAAgE,CAAC,CAAC;IACxF,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAA8B,EAC9B,UAAkB,EAClB,QAAiB;IAEjB,MAAM,KAAK,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACjD,OAAO,MAAM,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AACtD,CAAC"}
1
+ {"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/server/utils/auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGpD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEzD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAQ3D;;;;;GAKG;AACH,IAAI,gBAAgB,GAAwD,IAAI,CAAC;AAEjF;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,UAAkB,EAAE,QAAiB;IACxD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEzE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,gDAAgD;YAChD,+CAA+C;YAC/C,MAAM,CAAC,IAAI,CACT,6EAA6E;gBAC3E,kEAAkE;gBAClE,uEAAuE;gBACvE,2BAA2B,EAC7B,EAAE,UAAU,EAAE,CACf,CAAC;QACJ,CAAC;QAED,gBAAgB,GAAG,kBAAkB,CAAC,MAAM,CAAC;YAC3C,UAAU;YACV,QAAQ,EAAE,IAAI,EAAE,aAAa;YAC7B,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,4CAA4C;SACzE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAa,EACb,UAAkB,EAClB,QAAiB;IAEjB,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAE9D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAEnD,mCAAmC;QACnC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE7C,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;YAC9C,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,SAAS;SAC5B,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE;YACtC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;QAEH,cAAc;QACd,IAAI,OAAO,GAAG,yBAAyB,CAAC;QACxC,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtC,OAAO,GAAG,mBAAmB,CAAC;YAChC,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACvD,OAAO,GAAG,yBAAyB,CAAC;YACtC,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACpD,OAAO,GAAG,sBAAsB,CAAC;YACnC,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACtD,OAAO,GAAG,wBAAwB,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE;YAC3B,aAAa,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SACtE,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAA8B;IACnE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CAAC,gEAAgE,CAAC,CAAC;IACxF,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAA8B,EAC9B,UAAkB,EAClB,QAAiB;IAEjB,MAAM,KAAK,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACjD,OAAO,MAAM,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AACtD,CAAC"}
package/dist/server/utils/authHandler.js CHANGED
@@ -55,10 +55,10 @@ async function handleCognitoAuthentication(authHeader, requestId) {
55
55
  throw new Error('COGNITO_USER_POOL_ID environment variable is required');
56
56
  }
57
57
  const jwtPayload = await verifyAuthHeader(authHeader, userPoolId, clientId);
58
+ // メールアドレスは個人情報のためログに出さない（追跡は sub で足りる）
58
59
  logger.debug('Cognito JWT verified', {
59
60
  requestId,
60
61
  sub: jwtPayload.sub,
61
- email: jwtPayload.email,
62
62
  });
63
63
  // TODO: テナント境界の実装
64
64
  // jwtPayload.subをレコードのuserIdフィールドと照合する
package/dist/server/utils/authHandler.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"authHandler.js","sourceRoot":"","sources":["../../../src/server/utils/authHandler.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C;;GAEG;AACH,MAAM,MAAM,GAAG,YAAY,CAAC;IAC1B,OAAO,EAAE,cAAc;IACvB,KAAK,EAAG,OAAO,CAAC,GAAG,CAAC,SAAiD,IAAI,MAAM;CAChF,CAAC,CAAC;AA4BH;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAmB,EACnB,SAAiB;IAEjB,MAAM,GAAG,GAAG,KAAK,CAAC,cAAc,CAAC,UAAU,EAAE,GAAG,CAAC;IAEjD,IAAI,GAAG,EAAE,CAAC;QACR,4DAA4D;QAC5D,uBAAuB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IAED,4CAA4C;IAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;IAC9E,MAAM,2BAA2B,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,GAAyB,EAAE,SAAiB;IAC3E,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;QACvC,SAAS;QACT,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;KACvB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,2BAA2B,CACxC,UAA8B,EAC9B,SAAiB;IAEjB,6BAA6B;IAC7B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,QAAQ;IAExD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IAE5E,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE;QACnC,SAAS;QACT,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,KAAK,EAAE,UAAU,CAAC,KAAK;KACxB,CAAC,CAAC;IAEH,kBAAkB;IAClB,uCAAuC;AACzC,CAAC"}
1
+ {"version":3,"file":"authHandler.js","sourceRoot":"","sources":["../../../src/server/utils/authHandler.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C;;GAEG;AACH,MAAM,MAAM,GAAG,YAAY,CAAC;IAC1B,OAAO,EAAE,cAAc;IACvB,KAAK,EAAG,OAAO,CAAC,GAAG,CAAC,SAAiD,IAAI,MAAM;CAChF,CAAC,CAAC;AA4BH;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAmB,EACnB,SAAiB;IAEjB,MAAM,GAAG,GAAG,KAAK,CAAC,cAAc,CAAC,UAAU,EAAE,GAAG,CAAC;IAEjD,IAAI,GAAG,EAAE,CAAC;QACR,4DAA4D;QAC5D,uBAAuB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IAED,4CAA4C;IAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;IAC9E,MAAM,2BAA2B,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,GAAyB,EAAE,SAAiB;IAC3E,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;QACvC,SAAS;QACT,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;KACvB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,2BAA2B,CACxC,UAA8B,EAC9B,SAAiB;IAEjB,6BAA6B;IAC7B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,QAAQ;IAExD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IAE5E,uCAAuC;IACvC,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE;QACnC,SAAS;QACT,GAAG,EAAE,UAAU,CAAC,GAAG;KACpB,CAAC,CAAC;IAEH,kBAAkB;IAClB,uCAAuC;AACzC,CAAC"}
package/dist/sharp-layer.zip CHANGED
Binary file
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@exabugs/dynamodb-client",
3
- "version": "1.6.1",
3
+ "version": "1.6.2",
4
4
  "description": "DynamoDB Single-Table Client SDK with MongoDB-like API, Shadow Records, and Lambda implementation for serverless applications",
5
5
  "author": "exabugs",
6
6
  "license": "MIT",
package/terraform/README.md CHANGED
@@ -61,6 +61,11 @@ module "lambda_records" {
61
61
  }
62
62
  ```
63
63
 
64
+ ## 注意
65
+
66
+ - **認可**: この Lambda は JWT の有効性しか検証しない。ユーザープールは管理者専用にし、`cognito_client_id` を必ず指定すること。詳細は [docs/AUTHORIZATION.md](../docs/AUTHORIZATION.md)
67
+ - **pnpm で `node_modules` 経由の参照をしている場合**: `node_modules/@exabugs/dynamodb-client` は版付きのパス（`.pnpm/@exabugs+dynamodb-client@<版>_…`）へのシンボリックリンク。Terraform は解決後の実パスを `.terraform/modules` に記録するため、**パッケージの版を上げた後は `.terraform/modules` を削除してから `terraform init` する**こと。しないと、古い版のコードで `plan` が走る
68
+
64
69
  ## 入力変数
65
70
 
66
71
  ### 必須変数
package/terraform/variables.tf CHANGED
@@ -31,7 +31,7 @@ variable "cognito_user_pool_id" {
31
31
  }
32
32
 
33
33
  variable "cognito_client_id" {
34
- description = "Cognito App Client ID（JWTのaud検証に使用。未指定の場合はaud検証をスキップする）"
34
+ description = "Cognito App Client ID（JWTのaud検証に使用）。本番では必ず指定すること。未指定だと aud を検証せず、同じユーザープールの別アプリクライアントが発行したトークンも通る（Lambda が起動時に警告ログを出す）。docs/AUTHORIZATION.md を参照"
35
35
  type = string
36
36
  default = null
37
37
  }