@webiny/api-event-handler-aws 0.0.0-unstable.0d717d18dd

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) Webiny
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,11 @@
+# @webiny/api-event-handler-aws
+
+> [!NOTE]
+> This package is part of the [Webiny](https://www.webiny.com) monorepo.
+> It’s **included in every Webiny project by default** and is not meant to be used as a standalone package.
+
+📘 **Documentation:** [https://www.webiny.com/docs](https://www.webiny.com/docs)
+
+---
+
+_This README file is automatically generated during the publish process._

package/createWebinyApiHandler.d.ts

@@ -0,0 +1,41 @@
+/**
+ * DI-native Webiny API handler for the AWS Lambda transport — storage-agnostic BASE.
+ *
+ * The ROOT container wires the AWS transport (API Gateway HTTP + auth/tenant loaders, background-task
+ * and WebSocket Lambda invocations, DynamoDB, Cognito, storage). The per-request feature stack is the
+ * transport-AGNOSTIC `registerApiRequestStack` from `@webiny/api-event-handler-core`, with the two
+ * AWS-specific interleave points supplied as hooks (real-time WebSockets transport + scheduler
+ * transport). The storage variant is injected via `registerRootStorage` / `registerRequestStorage`
+ * by a thin variant package (`@webiny/api-event-handler-aws-ddb`, `-aws-ddb-os`). Keeping the wiring
+ * in real packages (not an app template) is what makes it unit/integration testable.
+ */
+import type { Container } from "@webiny/di";
+import { getDocumentClient } from "@webiny/aws-sdk/client-dynamodb/index.js";
+import { registerExtensions } from "@webiny/handler";
+export interface RegisterRootStorageContext {
+    documentClient: ReturnType<typeof getDocumentClient>;
+}
+export interface CreateWebinyApiHandlerConfig {
+    /**
+     * Project-defined extensions, applied at register() time. This is the one project-specific
+     * input; everything else is standard AWS/env wiring owned by this package.
+     */
+    extensions: () => Parameters<typeof registerExtensions>[1];
+    /**
+     * DynamoDB document client. Defaults to the standard AWS client (`getDocumentClient()`).
+     * Injectable so integration tests can point the handler at a local (dynalite) DynamoDB.
+     */
+    documentClient?: ReturnType<typeof getDocumentClient>;
+    /**
+     * Register the storage-variant features in the ROOT container: the CMS storage operations, the
+     * DDB storage registries, and (for the OpenSearch variant) the OpenSearch core. Supplied by the
+     * variant package.
+     */
+    registerRootStorage: (container: Container, ctx: RegisterRootStorageContext) => void | Promise<void>;
+    /**
+     * Register any request-phase storage features that must run BEFORE `HeadlessCmsFeature` builds
+     * its storage — e.g. `DbRegistryFeature` for the DDB+ES variant. Optional (DDB-only needs none).
+     */
+    registerRequestStorage?: (container: Container) => void | Promise<void>;
+}
+export declare function createWebinyApiHandler(config: CreateWebinyApiHandlerConfig): (event: any, context?: import("aws-lambda").Context) => Promise<any>;

package/createWebinyApiHandler.js

@@ -0,0 +1,56 @@
+import { getDocumentClient } from "@webiny/aws-sdk/client-dynamodb/index.js";
+import { ApiGatewayFeature, BackgroundTaskEventType, EventBridgeEventType, WebSocketEventType, createLambdaHandler } from "@webiny/event-handler-aws";
+import { BackgroundTasksAwsFeature } from "@webiny/background-tasks-aws";
+import { DynamoDBCoreFeature } from "@webiny/db-dynamodb";
+import { registerApiRequestStack } from "@webiny/api-event-handler-core";
+import { WebsocketsAwsFeature } from "@webiny/api-websockets-aws";
+import { SchedulerAwsFeature } from "@webiny/api-scheduler-aws";
+import { FileManagerS3Feature } from "@webiny/api-file-manager-s3";
+import { WebSocketLambdaHandler } from "@webiny/api-websockets";
+import { CognitoIdpFeature } from "@webiny/cognito/api/features/CognitoIdp/feature.js";
+import { BulkActionsEventBridgeLambdaHandlerFeature } from "@webiny/api-headless-cms-bulk-actions-aws";
+import { ApiGatewayIdentityLoaderDecorator } from "./handlers/ApiGatewayIdentityLoaderDecorator.js";
+import { ApiGatewayTenantLoaderDecorator } from "./handlers/ApiGatewayTenantLoaderDecorator.js";
+function createWebinyApiHandler(config) {
+    const documentClient = config.documentClient ?? getDocumentClient();
+    return createLambdaHandler({
+        root: async (container)=>{
+            ApiGatewayFeature.register(container);
+            container.registerDecorator(ApiGatewayIdentityLoaderDecorator);
+            container.registerDecorator(ApiGatewayTenantLoaderDecorator);
+            container.register(BackgroundTaskEventType);
+            BackgroundTasksAwsFeature.register(container);
+            container.register(EventBridgeEventType);
+            BulkActionsEventBridgeLambdaHandlerFeature.register(container);
+            container.register(WebSocketEventType);
+            container.register(WebSocketLambdaHandler);
+            DynamoDBCoreFeature.register(container, {
+                documentClient
+            });
+            CognitoIdpFeature.register(container);
+            await config.registerRootStorage(container, {
+                documentClient
+            });
+        },
+        request: async (container)=>{
+            await registerApiRequestStack(container, {
+                extensions: config.extensions,
+                registerRequestStorage: config.registerRequestStorage,
+                transports: {
+                    realtime: (c)=>{
+                        WebsocketsAwsFeature.register(c);
+                    },
+                    scheduler: (c)=>{
+                        SchedulerAwsFeature.register(c);
+                    },
+                    fileManager: (c)=>{
+                        FileManagerS3Feature.register(c, {});
+                    }
+                }
+            });
+        }
+    });
+}
+export { createWebinyApiHandler };
+
+//# sourceMappingURL=createWebinyApiHandler.js.map

package/createWebinyApiHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createWebinyApiHandler.js","sources":["../src/createWebinyApiHandler.ts"],"sourcesContent":["/**\n * DI-native Webiny API handler for the AWS Lambda transport — storage-agnostic BASE.\n *\n * The ROOT container wires the AWS transport (API Gateway HTTP + auth/tenant loaders, background-task\n * and WebSocket Lambda invocations, DynamoDB, Cognito, storage). The per-request feature stack is the\n * transport-AGNOSTIC `registerApiRequestStack` from `@webiny/api-event-handler-core`, with the two\n * AWS-specific interleave points supplied as hooks (real-time WebSockets transport + scheduler\n * transport). The storage variant is injected via `registerRootStorage` / `registerRequestStorage`\n * by a thin variant package (`@webiny/api-event-handler-aws-ddb`, `-aws-ddb-os`). Keeping the wiring\n * in real packages (not an app template) is what makes it unit/integration testable.\n */\nimport type { Container } from \"@webiny/di\";\nimport { getDocumentClient } from \"@webiny/aws-sdk/client-dynamodb/index.js\";\nimport {\n    createLambdaHandler,\n    ApiGatewayFeature,\n    BackgroundTaskEventType,\n    EventBridgeEventType,\n    WebSocketEventType\n} from \"@webiny/event-handler-aws\";\nimport { BackgroundTasksAwsFeature } from \"@webiny/background-tasks-aws\";\nimport { registerExtensions } from \"@webiny/handler\";\nimport { DynamoDBCoreFeature } from \"@webiny/db-dynamodb\";\nimport { registerApiRequestStack } from \"@webiny/api-event-handler-core\";\nimport { WebsocketsAwsFeature } from \"@webiny/api-websockets-aws\";\nimport { SchedulerAwsFeature } from \"@webiny/api-scheduler-aws\";\nimport { FileManagerS3Feature } from \"@webiny/api-file-manager-s3\";\nimport { WebSocketLambdaHandler } from \"@webiny/api-websockets\";\n// CognitoIdpFeature must be in the root container so the request auth step\n// (ApiGatewayIdentityLoaderDecorator → RequestIdentityLoader) sees CognitoIdentityProvider\n// when it is first instantiated. Extensions register in the child/request container — too late.\nimport { CognitoIdpFeature } from \"@webiny/cognito/api/features/CognitoIdp/feature.js\";\nimport { BulkActionsEventBridgeLambdaHandlerFeature } from \"@webiny/api-headless-cms-bulk-actions-aws\";\nimport { ApiGatewayIdentityLoaderDecorator } from \"~/handlers/ApiGatewayIdentityLoaderDecorator.js\";\nimport { ApiGatewayTenantLoaderDecorator } from \"~/handlers/ApiGatewayTenantLoaderDecorator.js\";\n\nexport interface RegisterRootStorageContext {\n    documentClient: ReturnType<typeof getDocumentClient>;\n}\n\nexport interface CreateWebinyApiHandlerConfig {\n    /**\n     * Project-defined extensions, applied at register() time. This is the one project-specific\n     * input; everything else is standard AWS/env wiring owned by this package.\n     */\n    extensions: () => Parameters<typeof registerExtensions>[1];\n    /**\n     * DynamoDB document client. Defaults to the standard AWS client (`getDocumentClient()`).\n     * Injectable so integration tests can point the handler at a local (dynalite) DynamoDB.\n     */\n    documentClient?: ReturnType<typeof getDocumentClient>;\n    /**\n     * Register the storage-variant features in the ROOT container: the CMS storage operations, the\n     * DDB storage registries, and (for the OpenSearch variant) the OpenSearch core. Supplied by the\n     * variant package.\n     */\n    registerRootStorage: (\n        container: Container,\n        ctx: RegisterRootStorageContext\n    ) => void | Promise<void>;\n    /**\n     * Register any request-phase storage features that must run BEFORE `HeadlessCmsFeature` builds\n     * its storage — e.g. `DbRegistryFeature` for the DDB+ES variant. Optional (DDB-only needs none).\n     */\n    registerRequestStorage?: (container: Container) => void | Promise<void>;\n}\n\nexport function createWebinyApiHandler(config: CreateWebinyApiHandlerConfig) {\n    const documentClient = config.documentClient ?? getDocumentClient();\n\n    return createLambdaHandler({\n        root: async container => {\n            // ── Transport ──────────────────────────────────────────────\n            // ApiGatewayFeature registers the HTTP transport (event type + router + HttpFeature).\n            ApiGatewayFeature.register(container);\n\n            // ── Tenant + auth (extract → shared load) ──────────────────\n            // These decorators depend on api-core (RequestTenantLoader/RequestIdentityLoader), so\n            // they live in this composition layer, not event-handler-aws. registerDecorator applies\n            // LATER registrations as the OUTER wrapper (whose execute() runs first). TENANT must be\n            // established before IDENTITY: API-key authentication resolves the key by tenant partition\n            // (ApiKeysRepository reads TenantContext.getTenant()), so identity establishment depends on\n            // the tenant. The reverse is not true — RequestTenantLoader has no identity dependency. So\n            // register identity first (inner) and tenant last (outer) → tenant runs, then identity,\n            // then the router.\n            container.registerDecorator(ApiGatewayIdentityLoaderDecorator);\n            container.registerDecorator(ApiGatewayTenantLoaderDecorator);\n\n            // Background task invocations (Step Functions → Lambda directly). BackgroundTasksAwsFeature\n            // registers the Lambda handler + StepFunctionService (the AWS dispatch transport).\n            container.register(BackgroundTaskEventType);\n            BackgroundTasksAwsFeature.register(container);\n\n            // EventBridge invocations (e.g. scheduled empty-trash-bin). Without the event type the\n            // dispatcher can't match an EventBridge-shaped event; without the handler the container\n            // can't resolve EventBridgeEventHandler.\n            container.register(EventBridgeEventType);\n            BulkActionsEventBridgeLambdaHandlerFeature.register(container);\n\n            // WebSocket invocations (API Gateway WebSocket → this Lambda: $connect/$disconnect/$default).\n            // Without the event type + handler, the DI dispatcher can't match a WS event (\"No event type\n            // matched\") so $connect fails and no connection is ever registered → no server→client push.\n            container.register(WebSocketEventType);\n            container.register(WebSocketLambdaHandler);\n\n            // ── Database ───────────────────────────────────────────────\n            DynamoDBCoreFeature.register(container, {\n                documentClient\n            });\n\n            // ── Identity providers ─────────────────────────────────────\n            // Must be in root so the request auth step can authenticate\n            // requests before the GraphQL engine runs.\n            CognitoIdpFeature.register(container);\n\n            // ── Storage (variant-specific: CMS storage ops, DDB registries, OpenSearch core) ──\n            await config.registerRootStorage(container, { documentClient });\n        },\n\n        request: async container => {\n            // The per-request feature stack is transport-agnostic (shared with the server transport).\n            // The AWS-specific interleave points are supplied as the `transports` adapters.\n            await registerApiRequestStack(container, {\n                extensions: config.extensions,\n                registerRequestStorage: config.registerRequestStorage,\n                transports: {\n                    // Real AWS WebSocket transport (API Gateway Management API), registered right after\n                    // WebsocketsFeature so it overrides the NullWebsocketsTransport.\n                    realtime: c => {\n                        WebsocketsAwsFeature.register(c);\n                    },\n                    // Scheduler transport: the scheduler-aws extension (EventBridge Scheduler).\n                    scheduler: c => {\n                        SchedulerAwsFeature.register(c);\n                    },\n                    // File-manager storage transport: S3 (asset delivery + S3 file operations + schema).\n                    fileManager: c => {\n                        FileManagerS3Feature.register(c, {});\n                    }\n                }\n            });\n        }\n    });\n}\n"],"names":["createWebinyApiHandler","config","documentClient","getDocumentClient","createLambdaHandler","container","ApiGatewayFeature","ApiGatewayIdentityLoaderDecorator","ApiGatewayTenantLoaderDecorator","BackgroundTaskEventType","BackgroundTasksAwsFeature","EventBridgeEventType","BulkActionsEventBridgeLambdaHandlerFeature","WebSocketEventType","WebSocketLambdaHandler","DynamoDBCoreFeature","CognitoIdpFeature","registerApiRequestStack","c","WebsocketsAwsFeature","SchedulerAwsFeature","FileManagerS3Feature"],"mappings":";;;;;;;;;;;;;AAmEO,SAASA,uBAAuBC,MAAoC;IACvE,MAAMC,iBAAiBD,OAAO,cAAc,IAAIE;IAEhD,OAAOC,oBAAoB;QACvB,MAAM,OAAMC;YAGRC,kBAAkB,QAAQ,CAACD;YAW3BA,UAAU,iBAAiB,CAACE;YAC5BF,UAAU,iBAAiB,CAACG;YAI5BH,UAAU,QAAQ,CAACI;YACnBC,0BAA0B,QAAQ,CAACL;YAKnCA,UAAU,QAAQ,CAACM;YACnBC,2CAA2C,QAAQ,CAACP;YAKpDA,UAAU,QAAQ,CAACQ;YACnBR,UAAU,QAAQ,CAACS;YAGnBC,oBAAoB,QAAQ,CAACV,WAAW;gBACpCH;YACJ;YAKAc,kBAAkB,QAAQ,CAACX;YAG3B,MAAMJ,OAAO,mBAAmB,CAACI,WAAW;gBAAEH;YAAe;QACjE;QAEA,SAAS,OAAMG;YAGX,MAAMY,wBAAwBZ,WAAW;gBACrC,YAAYJ,OAAO,UAAU;gBAC7B,wBAAwBA,OAAO,sBAAsB;gBACrD,YAAY;oBAGR,UAAUiB,CAAAA;wBACNC,qBAAqB,QAAQ,CAACD;oBAClC;oBAEA,WAAWA,CAAAA;wBACPE,oBAAoB,QAAQ,CAACF;oBACjC;oBAEA,aAAaA,CAAAA;wBACTG,qBAAqB,QAAQ,CAACH,GAAG,CAAC;oBACtC;gBACJ;YACJ;QACJ;IACJ;AACJ"}

package/handlers/ApiGatewayIdentityLoaderDecorator.d.ts

@@ -0,0 +1,26 @@
+import type { APIGatewayProxyEvent } from "@webiny/aws-sdk/types/index.js";
+import { ApiGatewayEventHandler } from "@webiny/event-handler-aws";
+import { RawAuthToken } from "@webiny/api-core/features/requestContext/index.js";
+import type { IRequestIdentityLoader } from "@webiny/api-core/features/requestContext/abstractions.js";
+import type { EventContext, NextFunction } from "@webiny/event-handler-core";
+/**
+ * EXTRACT (transport-specific): reads the auth token from an API Gateway event — bearer
+ * `Authorization` header preferred, then the `wby-id-token` cookie — into RawAuthToken, then invokes
+ * the shared LOAD step (RequestIdentityLoader) which authenticates it and sets IdentityContext.
+ *
+ * A missing token leaves RawAuthToken null → the loader authenticates as anonymous.
+ * Registered BEFORE ApiGatewayTenantLoaderDecorator so identity is established before tenant
+ * (see ApiGatewayFeature).
+ */
+declare class ApiGatewayIdentityLoaderDecoratorImpl implements ApiGatewayEventHandler.Interface {
+    private rawAuthToken;
+    private identityLoader;
+    private decoratee;
+    constructor(rawAuthToken: RawAuthToken.Interface, identityLoader: IRequestIdentityLoader, decoratee: ApiGatewayEventHandler.Interface);
+    execute(ctx: EventContext<APIGatewayProxyEvent>, next: NextFunction): Promise<any>;
+    private extractToken;
+}
+export declare const ApiGatewayIdentityLoaderDecorator: typeof ApiGatewayIdentityLoaderDecoratorImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/event-handler-aws").IApiGatewayEventHandler>;
+};
+export {};

package/handlers/ApiGatewayIdentityLoaderDecorator.js

@@ -0,0 +1,39 @@
+import { ApiGatewayEventHandler } from "@webiny/event-handler-aws";
+import { RawAuthToken, RequestIdentityLoader } from "@webiny/api-core/features/requestContext/index.js";
+function parseCookieHeader(cookieHeader) {
+    return cookieHeader.split(";").reduce((acc, pair)=>{
+        const idx = pair.indexOf("=");
+        if (idx > 0) acc[pair.slice(0, idx).trim()] = decodeURIComponent(pair.slice(idx + 1).trim());
+        return acc;
+    }, {});
+}
+class ApiGatewayIdentityLoaderDecoratorImpl {
+    constructor(rawAuthToken, identityLoader, decoratee){
+        this.rawAuthToken = rawAuthToken;
+        this.identityLoader = identityLoader;
+        this.decoratee = decoratee;
+    }
+    async execute(ctx, next) {
+        this.rawAuthToken.set(this.extractToken(ctx.event));
+        await this.identityLoader.establish();
+        return this.decoratee.execute(ctx, next);
+    }
+    extractToken(event) {
+        const headers = event?.headers;
+        if (!headers) return null;
+        const bearer = (headers["authorization"] ?? headers["Authorization"] ?? "").replace(/^Bearer\s+/i, "");
+        if (bearer) return bearer;
+        const cookieHeader = headers["cookie"] ?? headers["Cookie"] ?? "";
+        return parseCookieHeader(cookieHeader)["wby-id-token"] ?? null;
+    }
+}
+const ApiGatewayIdentityLoaderDecorator = ApiGatewayEventHandler.createDecorator({
+    decorator: ApiGatewayIdentityLoaderDecoratorImpl,
+    dependencies: [
+        RawAuthToken,
+        RequestIdentityLoader
+    ]
+});
+export { ApiGatewayIdentityLoaderDecorator };
+
+//# sourceMappingURL=ApiGatewayIdentityLoaderDecorator.js.map

package/handlers/ApiGatewayIdentityLoaderDecorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers/ApiGatewayIdentityLoaderDecorator.js","sources":["../../src/handlers/ApiGatewayIdentityLoaderDecorator.ts"],"sourcesContent":["import type { APIGatewayProxyEvent } from \"@webiny/aws-sdk/types/index.js\";\nimport { ApiGatewayEventHandler } from \"@webiny/event-handler-aws\";\nimport {\n    RawAuthToken,\n    RequestIdentityLoader\n} from \"@webiny/api-core/features/requestContext/index.js\";\nimport type { IRequestIdentityLoader } from \"@webiny/api-core/features/requestContext/abstractions.js\";\nimport type { EventContext, NextFunction } from \"@webiny/event-handler-core\";\n\nfunction parseCookieHeader(cookieHeader: string): Record<string, string> {\n    return cookieHeader.split(\";\").reduce<Record<string, string>>((acc, pair) => {\n        const idx = pair.indexOf(\"=\");\n        if (idx > 0) {\n            acc[pair.slice(0, idx).trim()] = decodeURIComponent(pair.slice(idx + 1).trim());\n        }\n        return acc;\n    }, {});\n}\n\n/**\n * EXTRACT (transport-specific): reads the auth token from an API Gateway event — bearer\n * `Authorization` header preferred, then the `wby-id-token` cookie — into RawAuthToken, then invokes\n * the shared LOAD step (RequestIdentityLoader) which authenticates it and sets IdentityContext.\n *\n * A missing token leaves RawAuthToken null → the loader authenticates as anonymous.\n * Registered BEFORE ApiGatewayTenantLoaderDecorator so identity is established before tenant\n * (see ApiGatewayFeature).\n */\nclass ApiGatewayIdentityLoaderDecoratorImpl implements ApiGatewayEventHandler.Interface {\n    constructor(\n        private rawAuthToken: RawAuthToken.Interface,\n        private identityLoader: IRequestIdentityLoader,\n        private decoratee: ApiGatewayEventHandler.Interface\n    ) {}\n\n    async execute(ctx: EventContext<APIGatewayProxyEvent>, next: NextFunction): Promise<any> {\n        this.rawAuthToken.set(this.extractToken(ctx.event));\n        await this.identityLoader.establish();\n        return this.decoratee.execute(ctx, next);\n    }\n\n    private extractToken(event: APIGatewayProxyEvent): string | null {\n        const headers = event?.headers;\n        if (!headers) {\n            return null;\n        }\n        const bearer = (headers[\"authorization\"] ?? headers[\"Authorization\"] ?? \"\").replace(\n            /^Bearer\\s+/i,\n            \"\"\n        );\n        if (bearer) {\n            return bearer;\n        }\n        const cookieHeader = headers[\"cookie\"] ?? headers[\"Cookie\"] ?? \"\";\n        return parseCookieHeader(cookieHeader)[\"wby-id-token\"] ?? null;\n    }\n}\n\nexport const ApiGatewayIdentityLoaderDecorator = ApiGatewayEventHandler.createDecorator({\n    decorator: ApiGatewayIdentityLoaderDecoratorImpl,\n    dependencies: [RawAuthToken, RequestIdentityLoader]\n});\n"],"names":["parseCookieHeader","cookieHeader","acc","pair","idx","decodeURIComponent","ApiGatewayIdentityLoaderDecoratorImpl","rawAuthToken","identityLoader","decoratee","ctx","next","event","headers","bearer","ApiGatewayIdentityLoaderDecorator","ApiGatewayEventHandler","RawAuthToken","RequestIdentityLoader"],"mappings":";;AASA,SAASA,kBAAkBC,YAAoB;IAC3C,OAAOA,aAAa,KAAK,CAAC,KAAK,MAAM,CAAyB,CAACC,KAAKC;QAChE,MAAMC,MAAMD,KAAK,OAAO,CAAC;QACzB,IAAIC,MAAM,GACNF,GAAG,CAACC,KAAK,KAAK,CAAC,GAAGC,KAAK,IAAI,GAAG,GAAGC,mBAAmBF,KAAK,KAAK,CAACC,MAAM,GAAG,IAAI;QAEhF,OAAOF;IACX,GAAG,CAAC;AACR;AAWA,MAAMI;IACF,YACYC,YAAoC,EACpCC,cAAsC,EACtCC,SAA2C,CACrD;aAHUF,YAAY,GAAZA;aACAC,cAAc,GAAdA;aACAC,SAAS,GAATA;IACT;IAEH,MAAM,QAAQC,GAAuC,EAAEC,IAAkB,EAAgB;QACrF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAACD,IAAI,KAAK;QACjD,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS;QACnC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAACA,KAAKC;IACvC;IAEQ,aAAaC,KAA2B,EAAiB;QAC7D,MAAMC,UAAUD,OAAO;QACvB,IAAI,CAACC,SACD,OAAO;QAEX,MAAMC,SAAUD,AAAAA,CAAAA,OAAO,CAAC,gBAAgB,IAAIA,OAAO,CAAC,gBAAgB,IAAI,EAAC,EAAG,OAAO,CAC/E,eACA;QAEJ,IAAIC,QACA,OAAOA;QAEX,MAAMb,eAAeY,OAAO,CAAC,SAAS,IAAIA,OAAO,CAAC,SAAS,IAAI;QAC/D,OAAOb,kBAAkBC,aAAa,CAAC,eAAe,IAAI;IAC9D;AACJ;AAEO,MAAMc,oCAAoCC,uBAAuB,eAAe,CAAC;IACpF,WAAWV;IACX,cAAc;QAACW;QAAcC;KAAsB;AACvD"}

package/handlers/ApiGatewayTenantLoaderDecorator.d.ts

@@ -0,0 +1,24 @@
+import type { APIGatewayProxyEvent } from "@webiny/aws-sdk/types/index.js";
+import { ApiGatewayEventHandler } from "@webiny/event-handler-aws";
+import { RawTenantId } from "@webiny/api-core/features/requestContext/index.js";
+import type { IRequestTenantLoader } from "@webiny/api-core/features/requestContext/abstractions.js";
+import type { EventContext, NextFunction } from "@webiny/event-handler-core";
+/**
+ * EXTRACT (transport-specific): reads the tenant id from the `x-tenant` header of an API Gateway
+ * event into RawTenantId, then invokes the shared LOAD step (RequestTenantLoader) which
+ * resolves the Tenant and sets TenantContext. A missing header leaves RawTenantId null → the
+ * loader defaults to the "root" tenant.
+ *
+ * Registered AFTER ApiGatewayIdentityLoaderDecorator (see ApiGatewayFeature).
+ */
+declare class ApiGatewayTenantLoaderDecoratorImpl implements ApiGatewayEventHandler.Interface {
+    private rawTenantId;
+    private tenantLoader;
+    private decoratee;
+    constructor(rawTenantId: RawTenantId.Interface, tenantLoader: IRequestTenantLoader, decoratee: ApiGatewayEventHandler.Interface);
+    execute(ctx: EventContext<APIGatewayProxyEvent>, next: NextFunction): Promise<any>;
+}
+export declare const ApiGatewayTenantLoaderDecorator: typeof ApiGatewayTenantLoaderDecoratorImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/event-handler-aws").IApiGatewayEventHandler>;
+};
+export {};

package/handlers/ApiGatewayTenantLoaderDecorator.js

@@ -0,0 +1,25 @@
+import { ApiGatewayEventHandler } from "@webiny/event-handler-aws";
+import { RawTenantId, RequestTenantLoader } from "@webiny/api-core/features/requestContext/index.js";
+class ApiGatewayTenantLoaderDecoratorImpl {
+    constructor(rawTenantId, tenantLoader, decoratee){
+        this.rawTenantId = rawTenantId;
+        this.tenantLoader = tenantLoader;
+        this.decoratee = decoratee;
+    }
+    async execute(ctx, next) {
+        const headers = ctx.event?.headers;
+        this.rawTenantId.set(headers ? headers["x-tenant"] ?? headers["X-Tenant"] ?? null : null);
+        await this.tenantLoader.establish();
+        return this.decoratee.execute(ctx, next);
+    }
+}
+const ApiGatewayTenantLoaderDecorator = ApiGatewayEventHandler.createDecorator({
+    decorator: ApiGatewayTenantLoaderDecoratorImpl,
+    dependencies: [
+        RawTenantId,
+        RequestTenantLoader
+    ]
+});
+export { ApiGatewayTenantLoaderDecorator };
+
+//# sourceMappingURL=ApiGatewayTenantLoaderDecorator.js.map

package/handlers/ApiGatewayTenantLoaderDecorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers/ApiGatewayTenantLoaderDecorator.js","sources":["../../src/handlers/ApiGatewayTenantLoaderDecorator.ts"],"sourcesContent":["import type { APIGatewayProxyEvent } from \"@webiny/aws-sdk/types/index.js\";\nimport { ApiGatewayEventHandler } from \"@webiny/event-handler-aws\";\nimport {\n    RawTenantId,\n    RequestTenantLoader\n} from \"@webiny/api-core/features/requestContext/index.js\";\nimport type { IRequestTenantLoader } from \"@webiny/api-core/features/requestContext/abstractions.js\";\nimport type { EventContext, NextFunction } from \"@webiny/event-handler-core\";\n\n/**\n * EXTRACT (transport-specific): reads the tenant id from the `x-tenant` header of an API Gateway\n * event into RawTenantId, then invokes the shared LOAD step (RequestTenantLoader) which\n * resolves the Tenant and sets TenantContext. A missing header leaves RawTenantId null → the\n * loader defaults to the \"root\" tenant.\n *\n * Registered AFTER ApiGatewayIdentityLoaderDecorator (see ApiGatewayFeature).\n */\nclass ApiGatewayTenantLoaderDecoratorImpl implements ApiGatewayEventHandler.Interface {\n    constructor(\n        private rawTenantId: RawTenantId.Interface,\n        private tenantLoader: IRequestTenantLoader,\n        private decoratee: ApiGatewayEventHandler.Interface\n    ) {}\n\n    async execute(ctx: EventContext<APIGatewayProxyEvent>, next: NextFunction): Promise<any> {\n        const headers = ctx.event?.headers;\n        this.rawTenantId.set(headers ? (headers[\"x-tenant\"] ?? headers[\"X-Tenant\"] ?? null) : null);\n        await this.tenantLoader.establish();\n        return this.decoratee.execute(ctx, next);\n    }\n}\n\nexport const ApiGatewayTenantLoaderDecorator = ApiGatewayEventHandler.createDecorator({\n    decorator: ApiGatewayTenantLoaderDecoratorImpl,\n    dependencies: [RawTenantId, RequestTenantLoader]\n});\n"],"names":["ApiGatewayTenantLoaderDecoratorImpl","rawTenantId","tenantLoader","decoratee","ctx","next","headers","ApiGatewayTenantLoaderDecorator","ApiGatewayEventHandler","RawTenantId","RequestTenantLoader"],"mappings":";;AAiBA,MAAMA;IACF,YACYC,WAAkC,EAClCC,YAAkC,EAClCC,SAA2C,CACrD;aAHUF,WAAW,GAAXA;aACAC,YAAY,GAAZA;aACAC,SAAS,GAATA;IACT;IAEH,MAAM,QAAQC,GAAuC,EAAEC,IAAkB,EAAgB;QACrF,MAAMC,UAAUF,IAAI,KAAK,EAAE;QAC3B,IAAI,CAAC,WAAW,CAAC,GAAG,CAACE,UAAWA,OAAO,CAAC,WAAW,IAAIA,OAAO,CAAC,WAAW,IAAI,OAAQ;QACtF,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS;QACjC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAACF,KAAKC;IACvC;AACJ;AAEO,MAAME,kCAAkCC,uBAAuB,eAAe,CAAC;IAClF,WAAWR;IACX,cAAc;QAACS;QAAaC;KAAoB;AACpD"}

package/handlers/S3TenantLoaderDecorator.d.ts

@@ -0,0 +1,22 @@
+import type { S3Event } from "@webiny/aws-sdk/types/index.js";
+import { S3EventHandler } from "@webiny/event-handler-aws";
+import { RawTenantId } from "@webiny/api-core/features/requestContext/index.js";
+import type { IRequestTenantLoader } from "@webiny/api-core/features/requestContext/abstractions.js";
+import type { EventContext, NextFunction } from "@webiny/event-handler-core";
+/**
+ * EXTRACT (transport-specific): reads the tenant id from an S3 event's bucket name (convention
+ * "<tenant>-…" → "<tenant>") into RawTenantId, then invokes the shared LOAD step
+ * (RequestTenantLoader). Mirrors the API Gateway tenant decorator — same shared load, different
+ * extract. S3 events carry no user identity, so no auth token is extracted.
+ */
+declare class S3TenantLoaderDecoratorImpl implements S3EventHandler.Interface {
+    private rawTenantId;
+    private tenantLoader;
+    private decoratee;
+    constructor(rawTenantId: RawTenantId.Interface, tenantLoader: IRequestTenantLoader, decoratee: S3EventHandler.Interface);
+    execute(ctx: EventContext<S3Event>, next: NextFunction): Promise<any>;
+}
+export declare const S3TenantLoaderDecorator: typeof S3TenantLoaderDecoratorImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/event-handler-aws").IS3EventHandler>;
+};
+export {};

package/handlers/S3TenantLoaderDecorator.js

@@ -0,0 +1,25 @@
+import { S3EventHandler } from "@webiny/event-handler-aws";
+import { RawTenantId, RequestTenantLoader } from "@webiny/api-core/features/requestContext/index.js";
+class S3TenantLoaderDecoratorImpl {
+    constructor(rawTenantId, tenantLoader, decoratee){
+        this.rawTenantId = rawTenantId;
+        this.tenantLoader = tenantLoader;
+        this.decoratee = decoratee;
+    }
+    async execute(ctx, next) {
+        const bucket = ctx.event?.Records?.[0]?.s3?.bucket?.name;
+        this.rawTenantId.set(bucket ? bucket.split("-")[0] ?? null : null);
+        await this.tenantLoader.establish();
+        return this.decoratee.execute(ctx, next);
+    }
+}
+const S3TenantLoaderDecorator = S3EventHandler.createDecorator({
+    decorator: S3TenantLoaderDecoratorImpl,
+    dependencies: [
+        RawTenantId,
+        RequestTenantLoader
+    ]
+});
+export { S3TenantLoaderDecorator };
+
+//# sourceMappingURL=S3TenantLoaderDecorator.js.map

package/handlers/S3TenantLoaderDecorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers/S3TenantLoaderDecorator.js","sources":["../../src/handlers/S3TenantLoaderDecorator.ts"],"sourcesContent":["import type { S3Event } from \"@webiny/aws-sdk/types/index.js\";\nimport { S3EventHandler } from \"@webiny/event-handler-aws\";\nimport {\n    RawTenantId,\n    RequestTenantLoader\n} from \"@webiny/api-core/features/requestContext/index.js\";\nimport type { IRequestTenantLoader } from \"@webiny/api-core/features/requestContext/abstractions.js\";\nimport type { EventContext, NextFunction } from \"@webiny/event-handler-core\";\n\n/**\n * EXTRACT (transport-specific): reads the tenant id from an S3 event's bucket name (convention\n * \"<tenant>-…\" → \"<tenant>\") into RawTenantId, then invokes the shared LOAD step\n * (RequestTenantLoader). Mirrors the API Gateway tenant decorator — same shared load, different\n * extract. S3 events carry no user identity, so no auth token is extracted.\n */\nclass S3TenantLoaderDecoratorImpl implements S3EventHandler.Interface {\n    constructor(\n        private rawTenantId: RawTenantId.Interface,\n        private tenantLoader: IRequestTenantLoader,\n        private decoratee: S3EventHandler.Interface\n    ) {}\n\n    async execute(ctx: EventContext<S3Event>, next: NextFunction): Promise<any> {\n        const bucket = ctx.event?.Records?.[0]?.s3?.bucket?.name;\n        this.rawTenantId.set(bucket ? (bucket.split(\"-\")[0] ?? null) : null);\n        await this.tenantLoader.establish();\n        return this.decoratee.execute(ctx, next);\n    }\n}\n\nexport const S3TenantLoaderDecorator = S3EventHandler.createDecorator({\n    decorator: S3TenantLoaderDecoratorImpl,\n    dependencies: [RawTenantId, RequestTenantLoader]\n});\n"],"names":["S3TenantLoaderDecoratorImpl","rawTenantId","tenantLoader","decoratee","ctx","next","bucket","S3TenantLoaderDecorator","S3EventHandler","RawTenantId","RequestTenantLoader"],"mappings":";;AAeA,MAAMA;IACF,YACYC,WAAkC,EAClCC,YAAkC,EAClCC,SAAmC,CAC7C;aAHUF,WAAW,GAAXA;aACAC,YAAY,GAAZA;aACAC,SAAS,GAATA;IACT;IAEH,MAAM,QAAQC,GAA0B,EAAEC,IAAkB,EAAgB;QACxE,MAAMC,SAASF,IAAI,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,QAAQ;QACpD,IAAI,CAAC,WAAW,CAAC,GAAG,CAACE,SAAUA,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,OAAQ;QAC/D,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS;QACjC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAACF,KAAKC;IACvC;AACJ;AAEO,MAAME,0BAA0BC,eAAe,eAAe,CAAC;IAClE,WAAWR;IACX,cAAc;QAACS;QAAaC;KAAoB;AACpD"}

package/handlers/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./ApiGatewayIdentityLoaderDecorator.js";
+export * from "./ApiGatewayTenantLoaderDecorator.js";
+export * from "./S3TenantLoaderDecorator.js";

package/handlers/index.js

@@ -0,0 +1,3 @@
+export * from "./ApiGatewayIdentityLoaderDecorator.js";
+export * from "./ApiGatewayTenantLoaderDecorator.js";
+export * from "./S3TenantLoaderDecorator.js";

package/index.d.ts

@@ -0,0 +1,3 @@
+export { createWebinyApiHandler } from "./createWebinyApiHandler.js";
+export type { CreateWebinyApiHandlerConfig, RegisterRootStorageContext } from "./createWebinyApiHandler.js";
+export * from "./handlers/index.js";

package/index.js

@@ -0,0 +1,2 @@
+export * from "./handlers/index.js";
+export { createWebinyApiHandler } from "./createWebinyApiHandler.js";

package/package.json

@@ -0,0 +1,52 @@
+{
+	"name": "@webiny/api-event-handler-aws",
+	"version": "0.0.0-unstable.0d717d18dd",
+	"type": "module",
+	"main": "index.js",
+	"exports": {
+		".": "./index.js",
+		"./*": "./*"
+	},
+	"types": "index.d.ts",
+	"description": "Composition layer: assembles the Webiny API handler for the AWS Lambda transport.",
+	"repository": {
+		"type": "git",
+		"url": "https://github.com/webiny/webiny-js.git"
+	},
+	"contributors": [
+		"Webiny Team"
+	],
+	"license": "MIT",
+	"dependencies": {
+		"@webiny/api-core": "0.0.0-unstable.0d717d18dd",
+		"@webiny/api-event-handler-core": "0.0.0-unstable.0d717d18dd",
+		"@webiny/api-file-manager-s3": "0.0.0-unstable.0d717d18dd",
+		"@webiny/api-headless-cms-bulk-actions-aws": "0.0.0-unstable.0d717d18dd",
+		"@webiny/api-scheduler-aws": "0.0.0-unstable.0d717d18dd",
+		"@webiny/api-websockets": "0.0.0-unstable.0d717d18dd",
+		"@webiny/api-websockets-aws": "0.0.0-unstable.0d717d18dd",
+		"@webiny/aws-sdk": "0.0.0-unstable.0d717d18dd",
+		"@webiny/background-tasks-aws": "0.0.0-unstable.0d717d18dd",
+		"@webiny/cognito": "0.0.0-unstable.0d717d18dd",
+		"@webiny/db-dynamodb": "0.0.0-unstable.0d717d18dd",
+		"@webiny/event-handler-aws": "0.0.0-unstable.0d717d18dd",
+		"@webiny/event-handler-core": "0.0.0-unstable.0d717d18dd",
+		"@webiny/handler": "0.0.0-unstable.0d717d18dd"
+	},
+	"peerDependencies": {
+		"@webiny/di": ">=0.2.3"
+	},
+	"devDependencies": {
+		"@webiny/build-tools": "0.0.0-unstable.0d717d18dd",
+		"@webiny/di": "1.0.2",
+		"rimraf": "6.1.3",
+		"typescript": "7.0.2",
+		"vitest": "4.1.10"
+	},
+	"publishConfig": {
+		"access": "public"
+	},
+	"webiny": {
+		"publishFrom": "dist"
+	}
+}