aws-classify-server 0.1.8 → 0.2.0

package/lib/esm/ClassifyServerless.d.ts

@@ -1,6 +1,16 @@
 import { ClassDef } from "./ClassDef";
-import { APIGatewayProxyEvent, Context } from "aws-lambda";
+import type { RequestContext } from "aws-classify-common";
+import { HttpEvent, ServerAuthenticationOptions } from "./Authentication";
+import { Context } from "aws-lambda";
 export declare class ClassifyServerless {
+    private authentication;
+    private readonly contexts;
+    private readonly activeContexts;
+    private readonly responseContexts;
+    constructor();
+    configureAuthentication(options: ServerAuthenticationOptions): void;
+    get authenticationEnabled(): boolean;
+    getRequestContext(response?: object): RequestContext | undefined;
     logLevel: Partial<typeof EndPointsLogging>;
     classDefs: Map<any, ClassDef<any, any>>;
     requests: Map<any, any>;
@@ -9,8 +19,9 @@ export declare class ClassifyServerless {
     setExpirationMinutes(minutes: number): void;
     setLogger(log: (_message: string) => void): void;
     setLogLevel(logLevel: Partial<typeof EndPointsLogging>): void;
-    registerResponse<T>(responseClass: new () => T, authorizer?: (_endPoint: T, _method: string, _args: IArguments) => Promise<boolean>): void;
-    dispatch(ev: APIGatewayProxyEvent, context: Context, classes?: {}): Promise<string>;
+    registerResponse<T>(responseClass: new () => T, authorizer?: (_endPoint: T, _method: string, _args: IArguments, _context?: RequestContext) => Promise<boolean>): void;
+    dispatch(ev: HttpEvent, context: Context, classes?: {}, entry?: 'protected' | 'public'): Promise<string>;
+    private dispatchRequest;
     registerRequest<T>(requestClass: new () => T, classes?: any): new () => T;
     getSessionId<T>(responseObj: T): any;
     getUserId<T>(responseObj: T): any;
@@ -24,7 +35,7 @@ export declare class ClassifyServerless {
     deleteSessions(): Promise<void>;
 }
 export declare function getSessionData(sessionId: string, interfaceName?: string): Promise<Record<string, any> | undefined>;
-export declare function saveSessionData(sessionId: string, interfaceName?: string, sessionData?: string, connectionId?: string, userId?: string, expirationMinutes?: number): Promise<string>;
+export declare function saveSessionData(sessionId: string, interfaceName?: string, sessionData?: string, connectionId?: string, userId?: string, expirationMinutes?: number, authOwner?: string): Promise<string>;
 export declare const EndPointsLogging: {
     create: boolean;
     connect: boolean;

package/lib/esm/ClassifyServerless.js

@@ -8,19 +8,40 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 import { deserialize, serialize } from "js-freeze-dry";
-import { DynamoDBDocument } from "@aws-sdk/lib-dynamodb";
-import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
+import { sessionStore as ddbDocClient } from "./SessionStore";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { validatePublicSuffix } from "aws-classify-common";
+import { requestContext } from "./Authentication";
+import { ownedSession, sessionOwner, issueConnectionCredential } from "./AuthenticatedSessions";
 import { ApiGatewayManagementApiClient, PostToConnectionCommand } from "@aws-sdk/client-apigatewaymanagementapi";
-const ddbClient = new DynamoDBClient({ region: process.env.DD_REGION, endpoint: process.env.DD_ENDPOINT });
-const ddbDocClient = DynamoDBDocument.from(ddbClient);
 const updateDebounceInterval = 1000 * 60 * 10; // Don't update session unless 10 minutes have passed or data changed
 export class ClassifyServerless {
     constructor() {
+        this.contexts = new AsyncLocalStorage();
+        this.activeContexts = new Set();
+        this.responseContexts = new WeakMap();
         this.logLevel = {};
         this.classDefs = new Map();
         this.requests = new Map();
         this.expirationMinutes = 60 * 24;
         this.log = msg => console.log(msg);
+        if (process.env.AWS_CLASSIFY_AUTHENTICATION === 'true')
+            this.configureAuthentication({ publicSuffix: process.env.AWS_CLASSIFY_PUBLIC_SUFFIX || '' });
+    }
+    configureAuthentication(options) {
+        var _a;
+        validatePublicSuffix(options.publicSuffix);
+        const seconds = (_a = options.connectionCredentialSeconds) !== null && _a !== void 0 ? _a : 60;
+        if (!Number.isInteger(seconds) || seconds < 1 || seconds > 300)
+            throw new Error('connectionCredentialSeconds must be 1–300');
+        this.authentication = Object.freeze(Object.assign(Object.assign({}, options), { connectionCredentialSeconds: seconds }));
+    }
+    get authenticationEnabled() { return !!this.authentication; }
+    getRequestContext(response) {
+        const current = this.contexts.getStore();
+        if (!current || !this.activeContexts.has(current))
+            return undefined;
+        return response ? (this.responseContexts.get(response) === current ? current : undefined) : current;
     }
     setExpirationMinutes(minutes) {
         this.expirationMinutes = minutes;
@@ -45,14 +66,37 @@ export class ClassifyServerless {
         this.classDefs.set(interfaceName, { serverClass: responseClass, clientClass, authorizer });
         responseClass.__interfaceName__ = interfaceName;
     }
-    dispatch(ev, context, classes = {}) {
+    dispatch(ev, context, classes = {}, entry = 'protected') {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (entry === 'public' && !this.authentication)
+                throw new Error('Public dispatch requires authentication configuration');
+            const trusted = requestContext(ev, this.authentication ? entry : 'legacy', this.authentication);
+            this.activeContexts.add(trusted);
+            try {
+                return yield this.contexts.run(trusted, () => this.dispatchRequest(ev, context, classes, trusted));
+            }
+            finally {
+                this.activeContexts.delete(trusted);
+            }
+        });
+    }
+    dispatchRequest(ev, context, classes, trusted) {
         return __awaiter(this, void 0, void 0, function* () {
             const request = deserialize(ev.body, classes);
+            if (!request || typeof request.interfaceName !== 'string' || typeof request.methodName !== 'string' || !Array.isArray(request.args) || typeof request.sessionId !== 'string')
+                throw new Error('Malformed dispatch request');
             const logName = `${request.interfaceName}.${request.methodName}`;
             let sessionId = request.sessionId; //  May be empty
             // Pseudo interface/method to request socket access and return a session id to use in connect
-            // session id will be passed in sec-websocket-protocol on connect request
+            // Legacy mode passes the session id; authenticated mode issues a separate credential.
             if (logName === '$WebSocket.$authorize') {
+                if (this.authentication) {
+                    if (trusted.dispatch !== 'protected')
+                        throw new Error('Socket authorization requires protected dispatch');
+                    const session = yield ownedSession(sessionId, sessionOwner(trusted), this.expirationMinutes);
+                    const data = yield issueConnectionCredential(session, this.authentication.connectionCredentialSeconds, process.env.IS_OFFLINE ? 'ws://localhost:3001' : `wss://${process.env.APIG_ENDPOINT}`);
+                    return serialize({ data, sessionId: session.sessionId, exception: undefined, cargo: undefined }, classes);
+                }
                 const socketResult = yield getSessionData(sessionId, "");
                 if (!socketResult) {
                     sessionId = context.awsRequestId;
@@ -73,15 +117,19 @@ export class ClassifyServerless {
             const classDef = this.classDefs.get(request.interfaceName);
             if (!classDef)
                 throw new Error(`No Response defined for ${request.interfaceName}`);
-            if (!classDef.clientClass.prototype[request.methodName])
+            if (request.methodName === 'constructor' || !Object.prototype.hasOwnProperty.call(classDef.clientClass.prototype, request.methodName) || typeof classDef.clientClass.prototype[request.methodName] !== 'function')
                 throw new Error(`${request.methodName} not found in ${request.interfaceName} client request class`);
+            if (this.authentication && request.methodName.endsWith(this.authentication.publicSuffix) !== (trusted.dispatch === 'public'))
+                throw new Error('Member is not permitted on this dispatch endpoint');
             // If authorizer passed in make sure request is authorized
-            if (!classDef.authorizer || (yield classDef.authorizer(request.interfaceName, request.methodName, request.args))) {
+            if (!classDef.authorizer || (yield (this.authentication ? classDef.authorizer(request.interfaceName, request.methodName, request.args, trusted) : classDef.authorizer(request.interfaceName, request.methodName, request.args)))) {
                 // Instantiate the class
                 const obj = new classDef.serverClass();
                 // Retrieve session data from DynamoDB base on sessionId in request
                 let orignalSessionData = "";
-                const result = yield getSessionData(sessionId, request.interfaceName);
+                const result = this.authentication ? yield ownedSession(sessionId, sessionOwner(trusted), this.expirationMinutes) : yield getSessionData(sessionId, request.interfaceName);
+                if (this.authentication)
+                    sessionId = result.sessionId;
                 if (!result)
                     sessionId = context.awsRequestId;
                 else {
@@ -91,6 +139,7 @@ export class ClassifyServerless {
                         Object.assign(obj, orignalSessionData);
                     }
                 }
+                this.responseContexts.set(obj, trusted);
                 obj.__sessionId__ = sessionId;
                 obj.__connectionId__ = result === null || result === void 0 ? void 0 : result.connectionId;
                 // Call the class method and catch any exceptions it might throw to pass back
@@ -111,7 +160,7 @@ export class ClassifyServerless {
                 }
                 const updatedSessionData = serialize(obj, classes);
                 if (!result || updatedSessionData !== orignalSessionData || (Date.now() > (result.updated + updateDebounceInterval)))
-                    sessionId = yield saveSessionData(sessionId, request.interfaceName, updatedSessionData, undefined, obj.__userId__, this.expirationMinutes);
+                    sessionId = yield saveSessionData(sessionId, request.interfaceName, updatedSessionData, undefined, obj.__userId__, this.expirationMinutes, this.authentication ? sessionOwner(trusted) : undefined);
                 // Formulate response
                 const lambdaResponse = {
                     data: fnResponse,
@@ -146,7 +195,13 @@ export class ClassifyServerless {
                     try {
                         // Build request
                         const sessionId = this['__sessionId__'];
-                        const connectionId = this['__connectionId__'];
+                        let connectionId = this['__connectionId__'];
+                        if (expressServer.authentication && sessionId) {
+                            const live = yield getSessionData(sessionId);
+                            if (!(live === null || live === void 0 ? void 0 : live.authOwner) || live.authOwner === 'public' || !(live.expires > Math.floor(Date.now() / 1000)))
+                                throw new Error('Invalid authenticated notification session');
+                            connectionId = live.connectionId;
+                        }
                         if (!sessionId)
                             throw new Error(`You must instantiate ${interfaceName} using the ClassifyServerless.createRequest`);
                         if (!connectionId)
@@ -213,6 +268,8 @@ export class ClassifyServerless {
             const result = yield getSessionData(sessionId);
             if (!result)
                 throw new Error(`ClassifyResponse.createRequestForSession: invalid session id`);
+            if (this.authentication && (!result.authOwner || result.authOwner === 'public' || !(result.expires > Math.floor(Date.now() / 1000))))
+                throw new Error('Invalid authenticated notification session');
             if (!result.connectionId)
                 throw new Error(`WebSocket handshake not established for session`);
             // Create request
@@ -230,6 +287,8 @@ export class ClassifyServerless {
             const result = yield getSessionData(sessionId, interfaceName);
             if (!result)
                 throw new Error(`ClassifyResponse.createResponse: invalid session id for interface ${interfaceName}`);
+            if (this.authentication && (!result.authOwner || result.authOwner === 'public' || !(result.expires > Math.floor(Date.now() / 1000))))
+                throw new Error('Invalid authenticated notification session');
             const sessionData = result[`interface_${interfaceName}`];
             // Instantiate the class
             const obj = (new responseClass());
@@ -246,7 +305,7 @@ export class ClassifyServerless {
             if (updatedSessionData !== sessionData || (Date.now() > (result.updated + updateDebounceInterval))) {
                 if (this.logLevel.calls)
                     this.log(`saving session data for ${interfaceName} with sessionId=${sessionId} connectionId= ${obj.__connectionId__} sessionData=${updatedSessionData}`);
-                yield saveSessionData(sessionId, interfaceName, updatedSessionData, undefined, undefined, this.expirationMinutes);
+                yield saveSessionData(sessionId, interfaceName, updatedSessionData, undefined, undefined, this.expirationMinutes, this.authentication ? result.authOwner : undefined);
             }
             return ret;
         });
@@ -263,7 +322,7 @@ export class ClassifyServerless {
                     },
                     ProjectionExpression: `sessionId`
                 });
-                return data.Items ? data.Items.map(i => i.sessionId) : [];
+                return data.Items ? data.Items.filter(i => !this.authentication || !i.sessionId.startsWith('connection#')).map(i => i.sessionId) : [];
             }
             return [];
         });
@@ -274,7 +333,7 @@ export class ClassifyServerless {
                 TableName: `classifySessionStore.${process.env.DOMAIN}`,
                 ProjectionExpression: `sessionId`
             });
-            return data.Items ? data.Items.map(i => i.sessionId) : [];
+            return data.Items ? data.Items.filter(i => !this.authentication || !i.sessionId.startsWith('connection#')).map(i => i.sessionId) : [];
         });
     }
     deleteSessionsForUserId(userId) {
@@ -322,14 +381,14 @@ export function getSessionData(sessionId, interfaceName = "") {
                 TableName: `classifySessionStore.${process.env.DOMAIN}`,
                 Key: { sessionId },
                 ConsistentRead: true,
-                ProjectionExpression: `interface_${interfaceName}, connectionId, userId, updated, expires`
+                ProjectionExpression: `interface_${interfaceName}, connectionId, userId, updated, expires, authOwner`
             });
             return data.Item;
         }
         return undefined;
     });
 }
-export function saveSessionData(sessionId, interfaceName, sessionData, connectionId, userId, expirationMinutes) {
+export function saveSessionData(sessionId, interfaceName, sessionData, connectionId, userId, expirationMinutes, authOwner) {
     return __awaiter(this, void 0, void 0, function* () {
         const updateExpressionComponents = ['updated = :time'];
         const expressionAttributeValues = { ':time': new Date().getTime() };
@@ -352,12 +411,7 @@ export function saveSessionData(sessionId, interfaceName, sessionData, connectio
             expressionAttributeValues[':userId'] = userId;
         }
         // First try and out data only if the session id exists
-        yield ddbDocClient.update({
-            TableName: `classifySessionStore.${process.env.DOMAIN}`,
-            Key: { sessionId },
-            UpdateExpression: `set ${updateExpressionComponents.join(", ")}`,
-            ExpressionAttributeValues: expressionAttributeValues
-        });
+        yield ddbDocClient.update(Object.assign({ TableName: `classifySessionStore.${process.env.DOMAIN}`, Key: { sessionId }, UpdateExpression: `set ${updateExpressionComponents.join(", ")}`, ExpressionAttributeValues: Object.assign(Object.assign({}, expressionAttributeValues), (authOwner ? { ':owner': authOwner, ':now': Math.floor(Date.now() / 1000) } : {})) }, (authOwner ? { ConditionExpression: 'authOwner = :owner AND expires > :now' } : {})));
         return sessionId;
     });
 }

package/lib/esm/SessionStore.d.ts

@@ -0,0 +1,3 @@
+import { DynamoDBDocument } from '@aws-sdk/lib-dynamodb';
+export declare const sessionStore: DynamoDBDocument;
+export declare const sessionTable: () => string;

package/lib/esm/SessionStore.js

@@ -0,0 +1,4 @@
+import { DynamoDBDocument } from '@aws-sdk/lib-dynamodb';
+import { DynamoDBClient } from '@aws-sdk/client-dynamodb';
+export const sessionStore = DynamoDBDocument.from(new DynamoDBClient({ region: process.env.DD_REGION, endpoint: process.env.DD_ENDPOINT }));
+export const sessionTable = () => `classifySessionStore.${process.env.DOMAIN}`;

package/lib/esm/aws-classify-common/EndPointsLogging.d.ts

@@ -1,8 +1 @@
-export declare const EndPointsLogging: {
-    create: boolean;
-    connect: boolean;
-    exceptions: boolean;
-    calls: boolean;
-    requests: boolean;
-    data: boolean;
-};
+export { EndPointsLogging } from "aws-classify-common";

package/lib/esm/aws-classify-common/EndPointsLogging.js

@@ -1,8 +1 @@
-export const EndPointsLogging = {
-    create: true,
-    connect: true,
-    exceptions: true,
-    calls: true,
-    requests: false,
-    data: false,
-};
+export { EndPointsLogging } from "aws-classify-common";

package/lib/esm/aws-classify-common/LambdaRequest.d.ts

@@ -1,6 +1 @@
-export interface LambdaRequest {
-    interfaceName: string;
-    methodName: string;
-    args: any;
-    sessionId: string;
-}
+export type { LambdaRequest } from "aws-classify-common";

package/lib/esm/aws-classify-common/LambdaResponse.d.ts

@@ -1,6 +1 @@
-export interface LambdaResponse {
-    data: any;
-    cargo: any;
-    exception: string | undefined;
-    sessionId: string;
-}
+export type { LambdaResponse } from "aws-classify-common";

package/lib/esm/aws-classify-common/index.d.ts

@@ -1,4 +1 @@
-export type { LambdaRequest } from './LambdaRequest';
-export type { LambdaResponse } from './LambdaResponse';
-export { EndPointsLogging } from './EndPointsLogging';
-export declare const reqBody: () => never;
+export * from "aws-classify-common";

package/lib/esm/aws-classify-common/index.js

@@ -1,2 +1,2 @@
-export { EndPointsLogging } from './EndPointsLogging';
-export const reqBody = () => { throw new Error('Request class not registered'); };
+// Preserve the existing package subpath while sharing the common definitions.
+export * from "aws-classify-common";

package/lib/esm/dispatch.d.ts

@@ -1,7 +1,9 @@
+import { HttpEvent } from './Authentication';
 import { APIGatewayProxyEvent, Context } from 'aws-lambda';
 import { ClassifyServerless } from "./index";
 import { APIGatewayProxyStructuredResultV2 } from "aws-lambda/trigger/api-gateway-proxy";
 export declare const classifyServerless: ClassifyServerless;
-export declare const responseHandler: (event: APIGatewayProxyEvent, context: Context) => Promise<APIGatewayProxyStructuredResultV2>;
+export declare const responseHandler: (event: HttpEvent, context: Context) => Promise<APIGatewayProxyStructuredResultV2>;
+export declare const publicResponseHandler: (event: HttpEvent, context: Context) => Promise<APIGatewayProxyStructuredResultV2>;
 export declare const webSocketConnect: (event: APIGatewayProxyEvent, _context: Context) => Promise<APIGatewayProxyStructuredResultV2>;
-export declare const webSocketDisconnect: (_event: APIGatewayProxyEvent, _context: Context) => Promise<APIGatewayProxyStructuredResultV2>;
+export declare const webSocketDisconnect: (event: APIGatewayProxyEvent, _context: Context) => Promise<APIGatewayProxyStructuredResultV2>;

package/lib/esm/dispatch.js

@@ -7,23 +7,26 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
+import { attachAuthenticatedSocket, detachAuthenticatedSocket } from './AuthenticatedSessions';
 import { ClassifyServerless } from "./index";
 import { serialize } from "js-freeze-dry";
 import { getSessionData, saveSessionData } from "./ClassifyServerless";
 export const classifyServerless = new ClassifyServerless();
-export const responseHandler = (event, context) => __awaiter(void 0, void 0, void 0, function* () {
+const httpHandler = (event, context, entry) => __awaiter(void 0, void 0, void 0, function* () {
     try {
         //console.log(`dispatching`);
         return {
             statusCode: 200,
-            body: (yield classifyServerless.dispatch(event, context)) || "",
+            headers: { 'Cache-Control': 'no-store' },
+            body: (yield classifyServerless.dispatch(event, context, {}, entry)) || "",
         };
     }
     catch (err) {
         //console.log(`request.body = ${event.body}`);
-        console.log(`error = ${err.message} ${err.stack}`);
+        console.log('Dispatch failed');
         return {
             statusCode: 200,
+            headers: { 'Cache-Control': 'no-store' },
             body: serialize({
                 data: undefined,
                 exception: `Internal Server Error (${err}) - see log at ${new Date()}`,
@@ -33,11 +36,22 @@ export const responseHandler = (event, context) => __awaiter(void 0, void 0, voi
         };
     }
 });
+export const responseHandler = (event, context) => httpHandler(event, context, 'protected');
+export const publicResponseHandler = (event, context) => httpHandler(event, context, 'public');
 export const webSocketConnect = (event, _context) => __awaiter(void 0, void 0, void 0, function* () {
     //console.log('connecting');
-    const sessionId = event.headers['Sec-WebSocket-Protocol'] || "";
+    const sessionId = event.headers['Sec-WebSocket-Protocol'] || event.headers['sec-websocket-protocol'] || "";
     const connectId = event.requestContext.connectionId;
     //console.log(JSON.stringify(event));
+    if (classifyServerless.authenticationEnabled) {
+        try {
+            yield attachAuthenticatedSocket(sessionId, connectId || '');
+            return { statusCode: 200, headers: { 'Sec-WebSocket-Protocol': sessionId }, body: '' };
+        }
+        catch (_a) {
+            return { statusCode: 403, body: 'Connection refused' };
+        }
+    }
     const result = yield getSessionData(sessionId); // Make sure session id passed in is valid
     if (result) {
         // Save connection id
@@ -54,14 +68,16 @@ export const webSocketConnect = (event, _context) => __awaiter(void 0, void 0, v
         };
     }
     else {
-        console.log(`invalid sessionId - webSocketConnect sessionId=${sessionId} connectId=${connectId}`);
+        console.log('Invalid socket session');
         return {
             statusCode: 500,
             body: 'Opps'
         };
     }
 });
-export const webSocketDisconnect = (_event, _context) => __awaiter(void 0, void 0, void 0, function* () {
+export const webSocketDisconnect = (event, _context) => __awaiter(void 0, void 0, void 0, function* () {
+    if (classifyServerless.authenticationEnabled && event.requestContext.connectionId)
+        yield detachAuthenticatedSocket(event.requestContext.connectionId);
     //console.log('Disconnect ' + JSON.stringify(event));
     //console.log(`webSocketDisconnect sessionId=${sessionId} connectId=${connectId}`);
     return {

package/lib/esm/index.d.ts

@@ -1,3 +1,5 @@
 export { ClassifyServerless } from './ClassifyServerless';
 export { ClassifyResponse } from './ClassifyResponse';
-export { classifyServerless, webSocketConnect, webSocketDisconnect, responseHandler } from './dispatch';
+export { classifyServerless, webSocketConnect, webSocketDisconnect, responseHandler, publicResponseHandler } from './dispatch';
+export type { ServerAuthenticationOptions, HttpEvent } from './Authentication';
+export type { RequestContext, AuthenticatedIdentity } from 'aws-classify-common';

package/lib/esm/index.js

@@ -1,3 +1,3 @@
 export { ClassifyServerless } from './ClassifyServerless';
 export { ClassifyResponse } from './ClassifyResponse';
-export { classifyServerless, webSocketConnect, webSocketDisconnect, responseHandler } from './dispatch';
+export { classifyServerless, webSocketConnect, webSocketDisconnect, responseHandler, publicResponseHandler } from './dispatch';

package/package.json

@@ -1,36 +1,43 @@
 {
   "name": "aws-classify-server",
-  "version": "0.1.8",
+  "version": "0.2.0",
   "main": "./lib/cjs/index.js",
   "module": "./lib/esm/index.js",
   "types": "./lib/esm/index.d.ts",
   "files": [
-    "/lib", "yml"
+    "/lib",
+    "yml"
   ],
   "description": "Typescript Interface to Lambda and Websockets",
   "scripts": {
-    "prepare": "cd tests && cd client && npm run test && cd .. && cd .. && npm run build",
+    "prepare": "npm run build",
     "build": "npm run build:esm && npm run build:cjs",
     "build:esm": "tsc",
     "build:cjs": "tsc --module commonjs --outDir lib/cjs"
   },
-  "repository": "https://github.com/selsamman/aws-classify",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/selsamman/aws-classify.git",
+    "directory": "aws-classify-server"
+  },
   "author": "Sam Elsamman",
   "license": "MIT",
   "devDependencies": {
     "@types/aws-lambda": "^8.10.103",
     "@types/node": "^18.8.3",
-    "@typescript-eslint/eslint-plugin": "^5.36.2",
-    "@typescript-eslint/parser": "^5.36.2",
-    "aws-lambda": "^1.0.7",
-    "eslint": "8.22.0",
-    "typescript": "^4.8.2"
+    "@typescript-eslint/eslint-plugin": "^8.71.0",
+    "@typescript-eslint/parser": "^8.71.0",
+    "eslint": "^8.57.1",
+    "typescript": "^4.9.5"
   },
   "dependencies": {
-    "@aws-sdk/client-apigatewaymanagementapi": "^3.180.0",
-    "@aws-sdk/client-dynamodb": "^3.168.0",
-    "@aws-sdk/lib-dynamodb": "^3.168.0",
-    "aws-classify-common": "0.1.0",
+    "@aws-sdk/client-apigatewaymanagementapi": "^3.1146.0",
+    "@aws-sdk/client-dynamodb": "^3.1146.0",
+    "@aws-sdk/lib-dynamodb": "^3.1146.0",
+    "aws-classify-common": "0.2.0",
     "js-freeze-dry": "^1.1.4"
+  },
+  "engines": {
+    "node": ">=20.0.0"
   }
 }

package/yml/authentication-config.js

@@ -0,0 +1,18 @@
+// Serverless v3/v4 file resolver. Loaded only by the authenticated functions include.
+const {validatePublicSuffix} = require('aws-classify-common');
+module.exports = async ({resolveVariable}) => {
+    const config = await resolveVariable('self:custom.awsClassify, null');
+    if (!config || !config.authorizer || typeof config.authorizer.name !== 'string' || !config.authorizer.name.trim())
+        throw new Error('awsClassify authentication requires an authorizer object with a nonempty name');
+    const definitions = await resolveVariable('self:provider.httpApi.authorizers, null');
+    if (!definitions || !Object.prototype.hasOwnProperty.call(definitions, config.authorizer.name))
+        throw new Error('awsClassify authorizer must be defined in provider.httpApi.authorizers');
+    const scopes = config.authorizer.scopes;
+    if (scopes !== undefined && (!Array.isArray(scopes) || !scopes.every(scope => typeof scope === 'string' && scope.length && !/\s/.test(scope))))
+        throw new Error('awsClassify authorizer scopes must be an array of nonempty scope names');
+    const publicSuffix = validatePublicSuffix(config.publicSuffix);
+    const logging = await resolveVariable('self:provider.logs.websocket, null');
+    if (logging && (logging === true || logging.fullExecutionData !== false))
+        throw new Error('Authenticated WebSocket logging requires fullExecutionData: false to protect connection credentials');
+    return {authorizer: config.authorizer, publicSuffix};
+};

package/yml/functions-authenticated.yml

@@ -0,0 +1,34 @@
+responseHandler:
+  environment:
+    AWS_CLASSIFY_AUTHENTICATION: 'true'
+    AWS_CLASSIFY_PUBLIC_SUFFIX: ${file(${self:custom.yml}/authentication-config.js):publicSuffix}
+  handler: ${self:custom.directories.responseHandlers}.responseHandler
+  events:
+    - httpApi:
+        path: /api/dispatch
+        method: ANY
+        authorizer: ${file(${self:custom.yml}/authentication-config.js):authorizer}
+connectHandler:
+  environment:
+    AWS_CLASSIFY_AUTHENTICATION: 'true'
+    AWS_CLASSIFY_PUBLIC_SUFFIX: ${file(${self:custom.yml}/authentication-config.js):publicSuffix}
+  handler: ${self:custom.directories.responseHandlers}.webSocketConnect
+  events:
+    - websocket: $connect
+disconnectHandler:
+  environment:
+    AWS_CLASSIFY_AUTHENTICATION: 'true'
+    AWS_CLASSIFY_PUBLIC_SUFFIX: ${file(${self:custom.yml}/authentication-config.js):publicSuffix}
+  handler: ${self:custom.directories.responseHandlers}.webSocketDisconnect
+  events:
+    - websocket: $disconnect
+publicResponseHandler:
+  name: ${self:service}-${sls:stage}-public
+  environment:
+    AWS_CLASSIFY_AUTHENTICATION: 'true'
+    AWS_CLASSIFY_PUBLIC_SUFFIX: ${file(${self:custom.yml}/authentication-config.js):publicSuffix}
+  handler: ${self:custom.directories.responseHandlers}.publicResponseHandler
+  events:
+    - httpApi:
+        path: /api/dispatch/public
+        method: ANY

package/yml/provider-iam.yml

@@ -5,4 +5,5 @@ Action:
   - dynamodb:GetItem
   - dynamodb:PutItem
   - dynamodb:UpdateItem
+  - dynamodb:DeleteItem
 Resource: "*"

package/yml/resources-custom-website.yml

@@ -50,6 +50,11 @@ Resources:
           # https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-origin-request-policies.html
           OriginRequestPolicyId: 88a5eaf4-2fd4-4709-b370-b4c650ea3fcf
           ViewerProtocolPolicy: redirect-to-https
+        CustomErrorResponses:
+          - ErrorCachingMinTTL: 1
+            ErrorCode: 403
+            ResponseCode: 200
+            ResponsePagePath: "/"
   S3Bucket:
     Type: AWS::S3::Bucket
     Properties:

package/yml/resources-website-authenticated.yml

@@ -0,0 +1,69 @@
+Resources:
+  CloudFrontOriginAccessIdentity:
+    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
+    Properties:
+      CloudFrontOriginAccessIdentityConfig:
+        Comment: !Join ["-", ["access-identity", !GetAtt S3Bucket.DomainName]]
+  CloudFrontDistribution:
+    Type: AWS::CloudFront::Distribution
+    DependsOn:
+      - S3Bucket
+    Properties:
+      DistributionConfig:
+        PriceClass: PriceClass_All
+        ViewerCertificate:
+          CloudFrontDefaultCertificate: true
+        Enabled: true
+        HttpVersion: http2
+        DefaultRootObject: index.html
+        Origins:
+          - Id: api
+            DomainName: !Join [".", [!Ref HttpApi, "execute-api", !Ref AWS::Region, "amazonaws.com"]]
+            CustomOriginConfig:
+              OriginProtocolPolicy: https-only
+          - Id: static
+            DomainName: !GetAtt S3Bucket.RegionalDomainName
+            S3OriginConfig:
+              OriginAccessIdentity: !Join ["", ["origin-access-identity/cloudfront/", !Ref CloudFrontOriginAccessIdentity]]
+        CacheBehaviors:
+          - PathPattern: api/*
+            TargetOriginId: api
+            # Managed-CachingDisabled and AllViewerExceptHostHeader preserve Authorization.
+            CachePolicyId: 4135ea2d-6df8-44a3-9df3-4b5a84be39ad
+            OriginRequestPolicyId: b689b0a8-53d0-40ab-baf2-68738e2966ac
+            ViewerProtocolPolicy: redirect-to-https
+            AllowedMethods: [GET, HEAD, OPTIONS, PATCH, POST, PUT, DELETE]
+        DefaultCacheBehavior:
+          TargetOriginId: static
+          # 'Managed-CachingOptimized'
+          # https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html
+          CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6
+          # 'Managed-CORS-S3Origin'
+          # https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-origin-request-policies.html
+          OriginRequestPolicyId: 88a5eaf4-2fd4-4709-b370-b4c650ea3fcf
+          ViewerProtocolPolicy: redirect-to-https
+        CustomErrorResponses:
+          - ErrorCachingMinTTL: 1
+            ErrorCode: 403
+  S3Bucket:
+    Type: AWS::S3::Bucket
+    Properties:
+      BucketName: ${self:custom.bucketName}
+  S3BucketPolicy:
+    Type: AWS::S3::BucketPolicy
+    Properties:
+      Bucket: !Ref S3Bucket
+      PolicyDocument:
+        Statement:
+          - Effect: Allow
+            Action: "s3:GetObject"
+            Resource: !Join ["", [!GetAtt S3Bucket.Arn, "/*"]]
+            Principal:
+              CanonicalUser: !GetAtt CloudFrontOriginAccessIdentity.S3CanonicalUserId
+Outputs:
+  CloudFrontId:
+    Description: CloudFront Id
+    Value: !Ref CloudFrontDistribution
+  WebsiteUrl:
+    Description: Cloudfront URL
+    Value: !GetAtt CloudFrontDistribution.DomainName

package/yml/resources-website.yml

@@ -46,6 +46,11 @@ Resources:
           # https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-origin-request-policies.html
           OriginRequestPolicyId: 88a5eaf4-2fd4-4709-b370-b4c650ea3fcf
           ViewerProtocolPolicy: redirect-to-https
+        CustomErrorResponses:
+          - ErrorCachingMinTTL: 1
+            ErrorCode: 403
+            ResponseCode: 200
+            ResponsePagePath: "/"
   S3Bucket:
     Type: AWS::S3::Bucket
     Properties: