@openhi/constructs 0.0.145 → 0.0.147
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/index.d.mts +7 -2
- package/lib/index.d.ts +7 -2
- package/lib/index.js +12 -3
- package/lib/index.js.map +1 -1
- package/lib/index.mjs +12 -3
- package/lib/index.mjs.map +1 -1
- package/lib/pre-token-generation.handler.js +33 -22
- package/lib/pre-token-generation.handler.js.map +1 -1
- package/lib/pre-token-generation.handler.mjs +33 -22
- package/lib/pre-token-generation.handler.mjs.map +1 -1
- package/lib/rest-api-lambda.handler.js +3209 -762
- package/lib/rest-api-lambda.handler.js.map +1 -1
- package/lib/rest-api-lambda.handler.mjs +3209 -762
- package/lib/rest-api-lambda.handler.mjs.map +1 -1
- package/package.json +3 -3
package/lib/index.mjs
CHANGED
|
@@ -3631,16 +3631,25 @@ var _OpenHiAuthService = class _OpenHiAuthService extends OpenHiService {
|
|
|
3631
3631
|
}
|
|
3632
3632
|
/**
|
|
3633
3633
|
* Grants the Pre Token Generation Lambda read-only access on the data
|
|
3634
|
-
* store table and its GSIs. The Lambda
|
|
3634
|
+
* store table and its GSIs. The Lambda needs:
|
|
3635
3635
|
* - `Query` on GSI2 to resolve a User by Cognito `sub`
|
|
3636
|
-
* - `GetItem` on the base table for direct User reads
|
|
3636
|
+
* - `GetItem` on the base table for direct User reads (canonical row hydration
|
|
3637
|
+
* after the GSI2 hit, per #1175)
|
|
3638
|
+
* - `BatchGetItem` on the base table for ElectroDB `batchGetWithRetry`
|
|
3639
|
+
* hydration used by `listMembershipsOperation` and
|
|
3640
|
+
* `listRoleAssignmentsOperation` when resolving the
|
|
3641
|
+
* `ohi_organization_roles` / `ohi_platform_roles` claims
|
|
3637
3642
|
*
|
|
3638
3643
|
* No write or scan access: a User missing `currentTenant`/`currentWorkspace`
|
|
3639
3644
|
* falls into the absent-claims path; repair belongs in a separate backfill.
|
|
3640
3645
|
*/
|
|
3641
3646
|
grantPreTokenGenerationPermissions() {
|
|
3642
3647
|
const dataStoreTable = this.dataStoreTable();
|
|
3643
|
-
const dynamoActions = [
|
|
3648
|
+
const dynamoActions = [
|
|
3649
|
+
"dynamodb:GetItem",
|
|
3650
|
+
"dynamodb:Query",
|
|
3651
|
+
"dynamodb:BatchGetItem"
|
|
3652
|
+
];
|
|
3644
3653
|
dataStoreTable.grant(this.preTokenGenerationLambda, ...dynamoActions);
|
|
3645
3654
|
this.preTokenGenerationLambda.addToRolePolicy(
|
|
3646
3655
|
new PolicyStatement7({
|