aws-classify-server 0.1.9 → 0.2.2

package/lib/cjs/ClassifyServerless.js

@@ -11,19 +11,39 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EndPointsLogging = exports.saveSessionData = exports.getSessionData = exports.ClassifyServerless = void 0;
 const js_freeze_dry_1 = require("js-freeze-dry");
-const lib_dynamodb_1 = require("@aws-sdk/lib-dynamodb");
-const client_dynamodb_1 = require("@aws-sdk/client-dynamodb");
+const SessionStore_1 = require("./SessionStore");
+const node_async_hooks_1 = require("node:async_hooks");
+const aws_classify_common_1 = require("aws-classify-common");
+const Authentication_1 = require("./Authentication");
+const AuthenticatedSessions_1 = require("./AuthenticatedSessions");
 const client_apigatewaymanagementapi_1 = require("@aws-sdk/client-apigatewaymanagementapi");
-const ddbClient = new client_dynamodb_1.DynamoDBClient({ region: process.env.DD_REGION, endpoint: process.env.DD_ENDPOINT });
-const ddbDocClient = lib_dynamodb_1.DynamoDBDocument.from(ddbClient);
 const updateDebounceInterval = 1000 * 60 * 10; // Don't update session unless 10 minutes have passed or data changed
 class ClassifyServerless {
     constructor() {
+        this.contexts = new node_async_hooks_1.AsyncLocalStorage();
+        this.activeContexts = new Set();
+        this.responseContexts = new WeakMap();
         this.logLevel = {};
         this.classDefs = new Map();
         this.requests = new Map();
         this.expirationMinutes = 60 * 24;
         this.log = msg => console.log(msg);
+        if (process.env.AWS_CLASSIFY_AUTHENTICATION === 'true')
+            this.configureAuthentication({});
+    }
+    configureAuthentication(options) {
+        var _a;
+        const seconds = (_a = options.connectionCredentialSeconds) !== null && _a !== void 0 ? _a : 60;
+        if (!Number.isInteger(seconds) || seconds < 1 || seconds > 300)
+            throw new Error('connectionCredentialSeconds must be 1–300');
+        this.authentication = Object.freeze(Object.assign(Object.assign({}, options), { connectionCredentialSeconds: seconds }));
+    }
+    get authenticationEnabled() { return !!this.authentication; }
+    getRequestContext(response) {
+        const current = this.contexts.getStore();
+        if (!current || !this.activeContexts.has(current))
+            return undefined;
+        return response ? (this.responseContexts.get(response) === current ? current : undefined) : current;
     }
     setExpirationMinutes(minutes) {
         this.expirationMinutes = minutes;
@@ -34,7 +54,7 @@ class ClassifyServerless {
     setLogLevel(logLevel) {
         this.logLevel = logLevel;
     }
-    registerResponse(responseClass, authorizer) {
+    registerResponse(responseClass, authorizer, options) {
         // Find ultimate base class
         let clientClass = responseClass;
         while (Object.getPrototypeOf(clientClass).prototype)
@@ -45,17 +65,47 @@ class ClassifyServerless {
         const interfaceName = clientClass['interfaceName'];
         if (!interfaceName)
             throw ('ClassifyServerless.registerResponse: Request must have interfaceName as a static property');
-        this.classDefs.set(interfaceName, { serverClass: responseClass, clientClass, authorizer });
+        const methods = Object.getOwnPropertyNames(clientClass.prototype).filter(method => method !== 'constructor' && typeof clientClass.prototype[method] === 'function');
+        const decorated = methods.filter(method => (0, aws_classify_common_1.isPublicEndpoint)(clientClass.prototype[method]));
+        if ((options === null || options === void 0 ? void 0 : options.publicMethods) !== undefined && decorated.length)
+            throw new Error('Use either @Public() or publicMethods, not both');
+        const publicMethods = (options === null || options === void 0 ? void 0 : options.publicMethods) === undefined ? decorated : [...options.publicMethods];
+        if (!publicMethods.every(method => typeof method === 'string' && methods.includes(method)) || new Set(publicMethods).size !== publicMethods.length)
+            throw new Error('publicMethods must be unique request-class method names');
+        this.classDefs.set(interfaceName, { serverClass: responseClass, clientClass, authorizer, publicMethods: new Set(publicMethods) });
         responseClass.__interfaceName__ = interfaceName;
     }
-    dispatch(ev, context, classes = {}) {
+    dispatch(ev, context, classes = {}, entry = 'protected') {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (entry === 'public' && !this.authentication)
+                throw new Error('Public dispatch requires authentication configuration');
+            const trusted = (0, Authentication_1.requestContext)(ev, this.authentication ? entry : 'legacy', this.authentication);
+            this.activeContexts.add(trusted);
+            try {
+                return yield this.contexts.run(trusted, () => this.dispatchRequest(ev, context, classes, trusted));
+            }
+            finally {
+                this.activeContexts.delete(trusted);
+            }
+        });
+    }
+    dispatchRequest(ev, context, classes, trusted) {
         return __awaiter(this, void 0, void 0, function* () {
             const request = (0, js_freeze_dry_1.deserialize)(ev.body, classes);
+            if (!request || typeof request.interfaceName !== 'string' || typeof request.methodName !== 'string' || !Array.isArray(request.args) || typeof request.sessionId !== 'string')
+                throw new Error('Malformed dispatch request');
             const logName = `${request.interfaceName}.${request.methodName}`;
             let sessionId = request.sessionId; //  May be empty
             // Pseudo interface/method to request socket access and return a session id to use in connect
-            // session id will be passed in sec-websocket-protocol on connect request
+            // Legacy mode passes the session id; authenticated mode issues a separate credential.
             if (logName === '$WebSocket.$authorize') {
+                if (this.authentication) {
+                    if (trusted.dispatch !== 'protected')
+                        throw new Error('Socket authorization requires protected dispatch');
+                    const session = yield (0, AuthenticatedSessions_1.ownedSession)(sessionId, (0, AuthenticatedSessions_1.sessionOwner)(trusted), this.expirationMinutes);
+                    const data = yield (0, AuthenticatedSessions_1.issueConnectionCredential)(session, this.authentication.connectionCredentialSeconds, process.env.IS_OFFLINE ? 'ws://localhost:3001' : `wss://${process.env.APIG_ENDPOINT}`);
+                    return (0, js_freeze_dry_1.serialize)({ data, sessionId: session.sessionId, exception: undefined, cargo: undefined }, classes);
+                }
                 const socketResult = yield getSessionData(sessionId, "");
                 if (!socketResult) {
                     sessionId = context.awsRequestId;
@@ -76,15 +126,19 @@ class ClassifyServerless {
             const classDef = this.classDefs.get(request.interfaceName);
             if (!classDef)
                 throw new Error(`No Response defined for ${request.interfaceName}`);
-            if (!classDef.clientClass.prototype[request.methodName])
+            if (request.methodName === 'constructor' || !Object.prototype.hasOwnProperty.call(classDef.clientClass.prototype, request.methodName) || typeof classDef.clientClass.prototype[request.methodName] !== 'function')
                 throw new Error(`${request.methodName} not found in ${request.interfaceName} client request class`);
+            if (this.authentication && classDef.publicMethods.has(request.methodName) !== (trusted.dispatch === 'public'))
+                throw new Error('Member is not permitted on this dispatch endpoint');
             // If authorizer passed in make sure request is authorized
-            if (!classDef.authorizer || (yield classDef.authorizer(request.interfaceName, request.methodName, request.args))) {
+            if (!classDef.authorizer || (yield (this.authentication ? classDef.authorizer(request.interfaceName, request.methodName, request.args, trusted) : classDef.authorizer(request.interfaceName, request.methodName, request.args)))) {
                 // Instantiate the class
                 const obj = new classDef.serverClass();
                 // Retrieve session data from DynamoDB base on sessionId in request
                 let orignalSessionData = "";
-                const result = yield getSessionData(sessionId, request.interfaceName);
+                const result = this.authentication ? yield (0, AuthenticatedSessions_1.ownedSession)(sessionId, (0, AuthenticatedSessions_1.sessionOwner)(trusted), this.expirationMinutes) : yield getSessionData(sessionId, request.interfaceName);
+                if (this.authentication)
+                    sessionId = result.sessionId;
                 if (!result)
                     sessionId = context.awsRequestId;
                 else {
@@ -94,6 +148,7 @@ class ClassifyServerless {
                         Object.assign(obj, orignalSessionData);
                     }
                 }
+                this.responseContexts.set(obj, trusted);
                 obj.__sessionId__ = sessionId;
                 obj.__connectionId__ = result === null || result === void 0 ? void 0 : result.connectionId;
                 // Call the class method and catch any exceptions it might throw to pass back
@@ -114,7 +169,7 @@ class ClassifyServerless {
                 }
                 const updatedSessionData = (0, js_freeze_dry_1.serialize)(obj, classes);
                 if (!result || updatedSessionData !== orignalSessionData || (Date.now() > (result.updated + updateDebounceInterval)))
-                    sessionId = yield saveSessionData(sessionId, request.interfaceName, updatedSessionData, undefined, obj.__userId__, this.expirationMinutes);
+                    sessionId = yield saveSessionData(sessionId, request.interfaceName, updatedSessionData, undefined, obj.__userId__, this.expirationMinutes, this.authentication ? (0, AuthenticatedSessions_1.sessionOwner)(trusted) : undefined);
                 // Formulate response
                 const lambdaResponse = {
                     data: fnResponse,
@@ -149,7 +204,13 @@ class ClassifyServerless {
                     try {
                         // Build request
                         const sessionId = this['__sessionId__'];
-                        const connectionId = this['__connectionId__'];
+                        let connectionId = this['__connectionId__'];
+                        if (expressServer.authentication && sessionId) {
+                            const live = yield getSessionData(sessionId);
+                            if (!(live === null || live === void 0 ? void 0 : live.authOwner) || live.authOwner === 'public' || !(live.expires > Math.floor(Date.now() / 1000)))
+                                throw new Error('Invalid authenticated notification session');
+                            connectionId = live.connectionId;
+                        }
                         if (!sessionId)
                             throw new Error(`You must instantiate ${interfaceName} using the ClassifyServerless.createRequest`);
                         if (!connectionId)
@@ -216,6 +277,8 @@ class ClassifyServerless {
             const result = yield getSessionData(sessionId);
             if (!result)
                 throw new Error(`ClassifyResponse.createRequestForSession: invalid session id`);
+            if (this.authentication && (!result.authOwner || result.authOwner === 'public' || !(result.expires > Math.floor(Date.now() / 1000))))
+                throw new Error('Invalid authenticated notification session');
             if (!result.connectionId)
                 throw new Error(`WebSocket handshake not established for session`);
             // Create request
@@ -233,6 +296,8 @@ class ClassifyServerless {
             const result = yield getSessionData(sessionId, interfaceName);
             if (!result)
                 throw new Error(`ClassifyResponse.createResponse: invalid session id for interface ${interfaceName}`);
+            if (this.authentication && (!result.authOwner || result.authOwner === 'public' || !(result.expires > Math.floor(Date.now() / 1000))))
+                throw new Error('Invalid authenticated notification session');
             const sessionData = result[`interface_${interfaceName}`];
             // Instantiate the class
             const obj = (new responseClass());
@@ -249,7 +314,7 @@ class ClassifyServerless {
             if (updatedSessionData !== sessionData || (Date.now() > (result.updated + updateDebounceInterval))) {
                 if (this.logLevel.calls)
                     this.log(`saving session data for ${interfaceName} with sessionId=${sessionId} connectionId= ${obj.__connectionId__} sessionData=${updatedSessionData}`);
-                yield saveSessionData(sessionId, interfaceName, updatedSessionData, undefined, undefined, this.expirationMinutes);
+                yield saveSessionData(sessionId, interfaceName, updatedSessionData, undefined, undefined, this.expirationMinutes, this.authentication ? result.authOwner : undefined);
             }
             return ret;
         });
@@ -257,7 +322,7 @@ class ClassifyServerless {
     getSessionsForUserId(userId) {
         return __awaiter(this, void 0, void 0, function* () {
             if (userId) {
-                const data = yield ddbDocClient.query({
+                const data = yield SessionStore_1.sessionStore.query({
                     TableName: `classifySessionStore.${process.env.DOMAIN}`,
                     KeyConditionExpression: 'userId = :userId',
                     IndexName: 'userId',
@@ -266,24 +331,24 @@ class ClassifyServerless {
                     },
                     ProjectionExpression: `sessionId`
                 });
-                return data.Items ? data.Items.map(i => i.sessionId) : [];
+                return data.Items ? data.Items.filter(i => !this.authentication || !i.sessionId.startsWith('connection#')).map(i => i.sessionId) : [];
             }
             return [];
         });
     }
     getSessions() {
         return __awaiter(this, void 0, void 0, function* () {
-            const data = yield ddbDocClient.scan({
+            const data = yield SessionStore_1.sessionStore.scan({
                 TableName: `classifySessionStore.${process.env.DOMAIN}`,
                 ProjectionExpression: `sessionId`
             });
-            return data.Items ? data.Items.map(i => i.sessionId) : [];
+            return data.Items ? data.Items.filter(i => !this.authentication || !i.sessionId.startsWith('connection#')).map(i => i.sessionId) : [];
         });
     }
     deleteSessionsForUserId(userId) {
         return __awaiter(this, void 0, void 0, function* () {
             if (userId) {
-                const data = yield ddbDocClient.query({
+                const data = yield SessionStore_1.sessionStore.query({
                     TableName: `classifySessionStore.${process.env.DOMAIN}`,
                     KeyConditionExpression: 'userId = :userId',
                     IndexName: 'userId',
@@ -299,7 +364,7 @@ class ClassifyServerless {
     }
     deleteSessions() {
         return __awaiter(this, void 0, void 0, function* () {
-            const data = yield ddbDocClient.scan({
+            const data = yield SessionStore_1.sessionStore.scan({
                 TableName: `classifySessionStore.${process.env.DOMAIN}`,
                 ProjectionExpression: `sessionId`
             });
@@ -312,7 +377,7 @@ exports.ClassifyServerless = ClassifyServerless;
 function deleteSessionByKeys(keys) {
     return __awaiter(this, void 0, void 0, function* () {
         for (let ix = 0; ix < keys.length; ++ix) {
-            yield ddbDocClient.delete({
+            yield SessionStore_1.sessionStore.delete({
                 TableName: `classifySessionStore.${process.env.DOMAIN}`,
                 Key: { sessionId: keys[ix] }
             });
@@ -322,11 +387,11 @@ function deleteSessionByKeys(keys) {
 function getSessionData(sessionId, interfaceName = "") {
     return __awaiter(this, void 0, void 0, function* () {
         if (sessionId) {
-            const data = yield ddbDocClient.get({
+            const data = yield SessionStore_1.sessionStore.get({
                 TableName: `classifySessionStore.${process.env.DOMAIN}`,
                 Key: { sessionId },
                 ConsistentRead: true,
-                ProjectionExpression: `interface_${interfaceName}, connectionId, userId, updated, expires`
+                ProjectionExpression: `interface_${interfaceName}, connectionId, userId, updated, expires, authOwner`
             });
             return data.Item;
         }
@@ -334,7 +399,7 @@ function getSessionData(sessionId, interfaceName = "") {
     });
 }
 exports.getSessionData = getSessionData;
-function saveSessionData(sessionId, interfaceName, sessionData, connectionId, userId, expirationMinutes) {
+function saveSessionData(sessionId, interfaceName, sessionData, connectionId, userId, expirationMinutes, authOwner) {
     return __awaiter(this, void 0, void 0, function* () {
         const updateExpressionComponents = ['updated = :time'];
         const expressionAttributeValues = { ':time': new Date().getTime() };
@@ -357,12 +422,7 @@ function saveSessionData(sessionId, interfaceName, sessionData, connectionId, us
             expressionAttributeValues[':userId'] = userId;
         }
         // First try and out data only if the session id exists
-        yield ddbDocClient.update({
-            TableName: `classifySessionStore.${process.env.DOMAIN}`,
-            Key: { sessionId },
-            UpdateExpression: `set ${updateExpressionComponents.join(", ")}`,
-            ExpressionAttributeValues: expressionAttributeValues
-        });
+        yield SessionStore_1.sessionStore.update(Object.assign({ TableName: `classifySessionStore.${process.env.DOMAIN}`, Key: { sessionId }, UpdateExpression: `set ${updateExpressionComponents.join(", ")}`, ExpressionAttributeValues: Object.assign(Object.assign({}, expressionAttributeValues), (authOwner ? { ':owner': authOwner, ':now': Math.floor(Date.now() / 1000) } : {})) }, (authOwner ? { ConditionExpression: 'authOwner = :owner AND expires > :now' } : {})));
         return sessionId;
     });
 }

package/lib/cjs/SessionStore.d.ts

@@ -0,0 +1,3 @@
+import { DynamoDBDocument } from '@aws-sdk/lib-dynamodb';
+export declare const sessionStore: DynamoDBDocument;
+export declare const sessionTable: () => string;

package/lib/cjs/SessionStore.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sessionTable = exports.sessionStore = void 0;
+const lib_dynamodb_1 = require("@aws-sdk/lib-dynamodb");
+const client_dynamodb_1 = require("@aws-sdk/client-dynamodb");
+exports.sessionStore = lib_dynamodb_1.DynamoDBDocument.from(new client_dynamodb_1.DynamoDBClient({ region: process.env.DD_REGION, endpoint: process.env.DD_ENDPOINT }));
+const sessionTable = () => `classifySessionStore.${process.env.DOMAIN}`;
+exports.sessionTable = sessionTable;

package/lib/cjs/aws-classify-common/EndPointsLogging.d.ts

@@ -1,8 +1 @@
-export declare const EndPointsLogging: {
-    create: boolean;
-    connect: boolean;
-    exceptions: boolean;
-    calls: boolean;
-    requests: boolean;
-    data: boolean;
-};
+export { EndPointsLogging } from "aws-classify-common";

package/lib/cjs/aws-classify-common/EndPointsLogging.js

@@ -1,11 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EndPointsLogging = void 0;
-exports.EndPointsLogging = {
-    create: true,
-    connect: true,
-    exceptions: true,
-    calls: true,
-    requests: false,
-    data: false,
-};
+var aws_classify_common_1 = require("aws-classify-common");
+Object.defineProperty(exports, "EndPointsLogging", { enumerable: true, get: function () { return aws_classify_common_1.EndPointsLogging; } });

package/lib/cjs/aws-classify-common/LambdaRequest.d.ts

@@ -1,6 +1 @@
-export interface LambdaRequest {
-    interfaceName: string;
-    methodName: string;
-    args: any;
-    sessionId: string;
-}
+export type { LambdaRequest } from "aws-classify-common";

package/lib/cjs/aws-classify-common/LambdaResponse.d.ts

@@ -1,6 +1 @@
-export interface LambdaResponse {
-    data: any;
-    cargo: any;
-    exception: string | undefined;
-    sessionId: string;
-}
+export type { LambdaResponse } from "aws-classify-common";

package/lib/cjs/aws-classify-common/index.d.ts

@@ -1,4 +1 @@
-export type { LambdaRequest } from './LambdaRequest';
-export type { LambdaResponse } from './LambdaResponse';
-export { EndPointsLogging } from './EndPointsLogging';
-export declare const reqBody: () => never;
+export * from "aws-classify-common";

package/lib/cjs/aws-classify-common/index.js

@@ -1,7 +1,18 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.reqBody = exports.EndPointsLogging = void 0;
-var EndPointsLogging_1 = require("./EndPointsLogging");
-Object.defineProperty(exports, "EndPointsLogging", { enumerable: true, get: function () { return EndPointsLogging_1.EndPointsLogging; } });
-const reqBody = () => { throw new Error('Request class not registered'); };
-exports.reqBody = reqBody;
+// Preserve the existing package subpath while sharing the common definitions.
+__exportStar(require("aws-classify-common"), exports);

package/lib/cjs/dispatch.d.ts

@@ -1,7 +1,9 @@
+import { HttpEvent } from './Authentication';
 import { APIGatewayProxyEvent, Context } from 'aws-lambda';
 import { ClassifyServerless } from "./index";
 import { APIGatewayProxyStructuredResultV2 } from "aws-lambda/trigger/api-gateway-proxy";
 export declare const classifyServerless: ClassifyServerless;
-export declare const responseHandler: (event: APIGatewayProxyEvent, context: Context) => Promise<APIGatewayProxyStructuredResultV2>;
+export declare const responseHandler: (event: HttpEvent, context: Context) => Promise<APIGatewayProxyStructuredResultV2>;
+export declare const publicResponseHandler: (event: HttpEvent, context: Context) => Promise<APIGatewayProxyStructuredResultV2>;
 export declare const webSocketConnect: (event: APIGatewayProxyEvent, _context: Context) => Promise<APIGatewayProxyStructuredResultV2>;
-export declare const webSocketDisconnect: (_event: APIGatewayProxyEvent, _context: Context) => Promise<APIGatewayProxyStructuredResultV2>;
+export declare const webSocketDisconnect: (event: APIGatewayProxyEvent, _context: Context) => Promise<APIGatewayProxyStructuredResultV2>;

package/lib/cjs/dispatch.js

@@ -9,39 +9,57 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.webSocketDisconnect = exports.webSocketConnect = exports.responseHandler = exports.classifyServerless = void 0;
+exports.webSocketDisconnect = exports.webSocketConnect = exports.publicResponseHandler = exports.responseHandler = exports.classifyServerless = void 0;
+const AuthenticatedSessions_1 = require("./AuthenticatedSessions");
 const index_1 = require("./index");
 const js_freeze_dry_1 = require("js-freeze-dry");
 const ClassifyServerless_1 = require("./ClassifyServerless");
 exports.classifyServerless = new index_1.ClassifyServerless();
-const responseHandler = (event, context) => __awaiter(void 0, void 0, void 0, function* () {
+const httpHandler = (event, context, entry) => __awaiter(void 0, void 0, void 0, function* () {
     try {
         //console.log(`dispatching`);
         return {
             statusCode: 200,
-            body: (yield exports.classifyServerless.dispatch(event, context)) || "",
+            headers: { 'Cache-Control': 'no-store' },
+            body: (yield exports.classifyServerless.dispatch(event, context, {}, entry)) || "",
         };
     }
     catch (err) {
         //console.log(`request.body = ${event.body}`);
-        console.log(`error = ${err.message} ${err.stack}`);
+        // Do not reflect parse, database, or framework errors to an untrusted caller.
+        // Operators still receive the original error in Lambda's logs.
+        console.error('Dispatch failed', err);
         return {
             statusCode: 200,
+            headers: { 'Cache-Control': 'no-store' },
             body: (0, js_freeze_dry_1.serialize)({
                 data: undefined,
-                exception: `Internal Server Error (${err}) - see log at ${new Date()}`,
+                // Keep the existing serialized-error / HTTP-200 contract for clients.
+                exception: 'Internal Server Error',
                 cargo: undefined,
                 sessionId: undefined
             })
         };
     }
 });
+const responseHandler = (event, context) => httpHandler(event, context, 'protected');
 exports.responseHandler = responseHandler;
+const publicResponseHandler = (event, context) => httpHandler(event, context, 'public');
+exports.publicResponseHandler = publicResponseHandler;
 const webSocketConnect = (event, _context) => __awaiter(void 0, void 0, void 0, function* () {
     //console.log('connecting');
-    const sessionId = event.headers['Sec-WebSocket-Protocol'] || "";
+    const sessionId = event.headers['Sec-WebSocket-Protocol'] || event.headers['sec-websocket-protocol'] || "";
     const connectId = event.requestContext.connectionId;
     //console.log(JSON.stringify(event));
+    if (exports.classifyServerless.authenticationEnabled) {
+        try {
+            yield (0, AuthenticatedSessions_1.attachAuthenticatedSocket)(sessionId, connectId || '');
+            return { statusCode: 200, headers: { 'Sec-WebSocket-Protocol': sessionId }, body: '' };
+        }
+        catch (_a) {
+            return { statusCode: 403, body: 'Connection refused' };
+        }
+    }
     const result = yield (0, ClassifyServerless_1.getSessionData)(sessionId); // Make sure session id passed in is valid
     if (result) {
         // Save connection id
@@ -58,7 +76,7 @@ const webSocketConnect = (event, _context) => __awaiter(void 0, void 0, void 0,
         };
     }
     else {
-        console.log(`invalid sessionId - webSocketConnect sessionId=${sessionId} connectId=${connectId}`);
+        console.log('Invalid socket session');
         return {
             statusCode: 500,
             body: 'Opps'
@@ -66,7 +84,9 @@ const webSocketConnect = (event, _context) => __awaiter(void 0, void 0, void 0,
     }
 });
 exports.webSocketConnect = webSocketConnect;
-const webSocketDisconnect = (_event, _context) => __awaiter(void 0, void 0, void 0, function* () {
+const webSocketDisconnect = (event, _context) => __awaiter(void 0, void 0, void 0, function* () {
+    if (exports.classifyServerless.authenticationEnabled && event.requestContext.connectionId)
+        yield (0, AuthenticatedSessions_1.detachAuthenticatedSocket)(event.requestContext.connectionId);
     //console.log('Disconnect ' + JSON.stringify(event));
     //console.log(`webSocketDisconnect sessionId=${sessionId} connectId=${connectId}`);
     return {

package/lib/cjs/index.d.ts

@@ -1,3 +1,5 @@
 export { ClassifyServerless } from './ClassifyServerless';
 export { ClassifyResponse } from './ClassifyResponse';
-export { classifyServerless, webSocketConnect, webSocketDisconnect, responseHandler } from './dispatch';
+export { classifyServerless, webSocketConnect, webSocketDisconnect, responseHandler, publicResponseHandler } from './dispatch';
+export type { ServerAuthenticationOptions, HttpEvent } from './Authentication';
+export type { RequestContext, AuthenticatedIdentity } from 'aws-classify-common';

package/lib/cjs/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.responseHandler = exports.webSocketDisconnect = exports.webSocketConnect = exports.classifyServerless = exports.ClassifyResponse = exports.ClassifyServerless = void 0;
+exports.publicResponseHandler = exports.responseHandler = exports.webSocketDisconnect = exports.webSocketConnect = exports.classifyServerless = exports.ClassifyResponse = exports.ClassifyServerless = void 0;
 var ClassifyServerless_1 = require("./ClassifyServerless");
 Object.defineProperty(exports, "ClassifyServerless", { enumerable: true, get: function () { return ClassifyServerless_1.ClassifyServerless; } });
 var ClassifyResponse_1 = require("./ClassifyResponse");
@@ -10,3 +10,4 @@ Object.defineProperty(exports, "classifyServerless", { enumerable: true, get: fu
 Object.defineProperty(exports, "webSocketConnect", { enumerable: true, get: function () { return dispatch_1.webSocketConnect; } });
 Object.defineProperty(exports, "webSocketDisconnect", { enumerable: true, get: function () { return dispatch_1.webSocketDisconnect; } });
 Object.defineProperty(exports, "responseHandler", { enumerable: true, get: function () { return dispatch_1.responseHandler; } });
+Object.defineProperty(exports, "publicResponseHandler", { enumerable: true, get: function () { return dispatch_1.publicResponseHandler; } });

package/lib/esm/AuthenticatedSessions.d.ts

@@ -0,0 +1,6 @@
+import type { RequestContext, SocketAuthorization } from 'aws-classify-common';
+export declare function sessionOwner(context: RequestContext): string;
+export declare function ownedSession(sessionId: string, owner: string, minutes: number): Promise<any>;
+export declare function issueConnectionCredential(session: any, seconds: number, url: string): Promise<SocketAuthorization>;
+export declare function attachAuthenticatedSocket(credential: string, connectionId: string): Promise<void>;
+export declare function detachAuthenticatedSocket(connectionId: string): Promise<void>;

package/lib/esm/AuthenticatedSessions.js

@@ -0,0 +1,85 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import { sessionStore as db, sessionTable } from './SessionStore';
+const now = () => Math.floor(Date.now() / 1000);
+export function sessionOwner(context) {
+    if (context.dispatch === 'public')
+        return 'public';
+    if (!context.identity) {
+        if (context.offline)
+            return 'offline-unvalidated';
+        throw new Error('Validated identity required');
+    }
+    return JSON.stringify([context.identity.issuer, context.identity.subject]);
+}
+export function ownedSession(sessionId, owner, minutes) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (sessionId) {
+            const result = yield db.get({ TableName: sessionTable(), Key: { sessionId }, ConsistentRead: true });
+            if (!result.Item || !(result.Item.expires > now()) || result.Item.authOwner !== owner)
+                throw new Error('Session is not owned by this caller or has expired');
+            return result.Item;
+        }
+        const item = { sessionId: randomUUID(), authOwner: owner, updated: Date.now(), expires: now() + Math.floor(minutes * 60) };
+        yield db.put({ TableName: sessionTable(), Item: item, ConditionExpression: 'attribute_not_exists(sessionId)' });
+        return item;
+    });
+}
+export function issueConnectionCredential(session, seconds, url) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (session.authOwner === 'public')
+            throw new Error('Public sessions cannot attach sockets');
+        const credential = `ac1.${Buffer.from(session.sessionId).toString('base64url')}.${randomBytes(32).toString('base64url')}`;
+        const expiresAt = Math.min(now() + seconds, session.expires);
+        yield db.update({ TableName: sessionTable(), Key: { sessionId: session.sessionId },
+            UpdateExpression: 'SET credentialHash = :hash, credentialExpires = :expiry',
+            ConditionExpression: 'authOwner = :owner AND expires > :now',
+            ExpressionAttributeValues: { ':hash': createHash('sha256').update(credential).digest('hex'), ':expiry': expiresAt, ':owner': session.authOwner, ':now': now() } });
+        return { url, credential, expiresAt };
+    });
+}
+export function attachAuthenticatedSocket(credential, connectionId) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (!/^ac1\.[A-Za-z0-9_-]{48}\.[A-Za-z0-9_-]{43}$/.test(credential) || !connectionId)
+            throw new Error('Invalid connection credential');
+        const sessionId = Buffer.from(credential.split('.')[1], 'base64url').toString();
+        if (!/^[a-f0-9-]{36}$/.test(sessionId))
+            throw new Error('Invalid connection credential');
+        const result = yield db.get({ TableName: sessionTable(), Key: { sessionId }, ConsistentRead: true });
+        const session = result.Item;
+        if (!(session === null || session === void 0 ? void 0 : session.authOwner) || session.authOwner === 'public')
+            throw new Error('Invalid connection credential');
+        // Consumption and connection recording succeed together. A replay or concurrent loser fails the condition.
+        yield db.transactWrite({ TransactItems: [
+                { Update: { TableName: sessionTable(), Key: { sessionId },
+                        UpdateExpression: 'SET connectionId = :connection REMOVE credentialHash, credentialExpires',
+                        ConditionExpression: 'authOwner = :owner AND credentialHash = :hash AND credentialExpires > :now AND expires > :now',
+                        ExpressionAttributeValues: { ':connection': connectionId, ':owner': session.authOwner, ':hash': createHash('sha256').update(credential).digest('hex'), ':now': now() } } },
+                { Put: { TableName: sessionTable(), Item: { sessionId: `connection#${connectionId}`, targetSessionId: sessionId, expires: session.expires }, ConditionExpression: 'attribute_not_exists(sessionId)' } }
+            ] });
+    });
+}
+export function detachAuthenticatedSocket(connectionId) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const key = { sessionId: `connection#${connectionId}` };
+        const mapping = (yield db.get({ TableName: sessionTable(), Key: key, ConsistentRead: true })).Item;
+        if (!mapping)
+            return;
+        try {
+            yield db.update({ TableName: sessionTable(), Key: { sessionId: mapping.targetSessionId }, UpdateExpression: 'REMOVE connectionId', ConditionExpression: 'connectionId = :connection', ExpressionAttributeValues: { ':connection': connectionId } });
+        }
+        catch (error) {
+            if (error.name !== 'ConditionalCheckFailedException')
+                throw error;
+        }
+        yield db.delete({ TableName: sessionTable(), Key: key });
+    });
+}

package/lib/esm/Authentication.d.ts

@@ -0,0 +1,10 @@
+import type { APIGatewayProxyEvent, APIGatewayProxyEventV2 } from 'aws-lambda';
+import type { AuthenticatedIdentity, RequestContext } from 'aws-classify-common';
+export type HttpEvent = APIGatewayProxyEvent | APIGatewayProxyEventV2;
+export interface ServerAuthenticationOptions {
+    connectionCredentialSeconds?: number;
+    /** Adapt ONLY the trusted requestContext.authorizer emitted by a configured Gateway authorizer. */
+    identityAdapter?: (authorizer: unknown) => AuthenticatedIdentity | undefined;
+}
+export declare function jwtIdentity(authorizer: any): AuthenticatedIdentity | undefined;
+export declare function requestContext(event: HttpEvent, mode: RequestContext['dispatch'], options?: ServerAuthenticationOptions): RequestContext;

package/lib/esm/Authentication.js

@@ -0,0 +1,32 @@
+export function jwtIdentity(authorizer) {
+    var _a, _b;
+    const jwt = authorizer === null || authorizer === void 0 ? void 0 : authorizer.jwt;
+    if (!jwt || typeof ((_a = jwt.claims) === null || _a === void 0 ? void 0 : _a.sub) !== 'string' || !jwt.claims.sub || typeof ((_b = jwt.claims) === null || _b === void 0 ? void 0 : _b.iss) !== 'string' || !jwt.claims.iss)
+        return undefined;
+    return { subject: jwt.claims.sub, issuer: jwt.claims.iss, scopes: jwt.scopes || [], claims: jwt.claims };
+}
+function freeze(value) {
+    if (value && typeof value === 'object') {
+        for (const child of Object.values(value))
+            freeze(child);
+        Object.freeze(value);
+    }
+    return value;
+}
+export function requestContext(event, mode, options) {
+    var _a;
+    let identity;
+    const offline = process.env.IS_OFFLINE === 'true';
+    if (mode === 'protected') {
+        identity = offline ? undefined : ((options === null || options === void 0 ? void 0 : options.identityAdapter) || jwtIdentity)((_a = event.requestContext) === null || _a === void 0 ? void 0 : _a.authorizer);
+        if (!identity && !offline)
+            throw new Error('Validated identity required');
+        if (identity) {
+            if (typeof identity.subject !== 'string' || !identity.subject || typeof identity.issuer !== 'string' || !identity.issuer || !identity.claims || typeof identity.claims !== 'object' || Array.isArray(identity.claims) || !Array.isArray(identity.scopes) || !identity.scopes.every(scope => typeof scope === 'string'))
+                throw new Error('Invalid authorizer identity');
+            // Copy and deeply freeze to avoid changing the Gateway event or trusting mutable grants.
+            identity = freeze(JSON.parse(JSON.stringify(identity)));
+        }
+    }
+    return Object.freeze({ dispatch: mode, identity, offline, hasScope: (scope) => (identity === null || identity === void 0 ? void 0 : identity.scopes.includes(scope)) || false });
+}