aws-classify-server 0.2.0 → 0.2.2

package/lib/cjs/Authentication.d.ts

@@ -2,7 +2,6 @@ import type { APIGatewayProxyEvent, APIGatewayProxyEventV2 } from 'aws-lambda';
 import type { AuthenticatedIdentity, RequestContext } from 'aws-classify-common';
 export type HttpEvent = APIGatewayProxyEvent | APIGatewayProxyEventV2;
 export interface ServerAuthenticationOptions {
-    publicSuffix: string;
     connectionCredentialSeconds?: number;
     /** Adapt ONLY the trusted requestContext.authorizer emitted by a configured Gateway authorizer. */
     identityAdapter?: (authorizer: unknown) => AuthenticatedIdentity | undefined;

package/lib/cjs/ClassDef.d.ts

@@ -3,5 +3,6 @@ import { ClassifyResponse } from "./ClassifyResponse";
 export interface ClassDef<ServerClass extends ClassifyResponse, ClientClass> {
     serverClass: new () => ServerClass;
     clientClass: new () => ClientClass;
+    publicMethods: ReadonlySet<string>;
     authorizer: ((endPoint: ServerClass, method: string, args: IArguments, context?: RequestContext) => Promise<boolean>) | undefined;
 }

package/lib/cjs/ClassifyServerless.d.ts

@@ -19,7 +19,9 @@ export declare class ClassifyServerless {
     setExpirationMinutes(minutes: number): void;
     setLogger(log: (_message: string) => void): void;
     setLogLevel(logLevel: Partial<typeof EndPointsLogging>): void;
-    registerResponse<T>(responseClass: new () => T, authorizer?: (_endPoint: T, _method: string, _args: IArguments, _context?: RequestContext) => Promise<boolean>): void;
+    registerResponse<T>(responseClass: new () => T, authorizer?: (_endPoint: T, _method: string, _args: IArguments, _context?: RequestContext) => Promise<boolean>, options?: {
+        publicMethods?: readonly string[];
+    }): void;
     dispatch(ev: HttpEvent, context: Context, classes?: {}, entry?: 'protected' | 'public'): Promise<string>;
     private dispatchRequest;
     registerRequest<T>(requestClass: new () => T, classes?: any): new () => T;

package/lib/cjs/ClassifyServerless.js

@@ -29,11 +29,10 @@ class ClassifyServerless {
         this.expirationMinutes = 60 * 24;
         this.log = msg => console.log(msg);
         if (process.env.AWS_CLASSIFY_AUTHENTICATION === 'true')
-            this.configureAuthentication({ publicSuffix: process.env.AWS_CLASSIFY_PUBLIC_SUFFIX || '' });
+            this.configureAuthentication({});
     }
     configureAuthentication(options) {
         var _a;
-        (0, aws_classify_common_1.validatePublicSuffix)(options.publicSuffix);
         const seconds = (_a = options.connectionCredentialSeconds) !== null && _a !== void 0 ? _a : 60;
         if (!Number.isInteger(seconds) || seconds < 1 || seconds > 300)
             throw new Error('connectionCredentialSeconds must be 1–300');
@@ -55,7 +54,7 @@ class ClassifyServerless {
     setLogLevel(logLevel) {
         this.logLevel = logLevel;
     }
-    registerResponse(responseClass, authorizer) {
+    registerResponse(responseClass, authorizer, options) {
         // Find ultimate base class
         let clientClass = responseClass;
         while (Object.getPrototypeOf(clientClass).prototype)
@@ -66,7 +65,14 @@ class ClassifyServerless {
         const interfaceName = clientClass['interfaceName'];
         if (!interfaceName)
             throw ('ClassifyServerless.registerResponse: Request must have interfaceName as a static property');
-        this.classDefs.set(interfaceName, { serverClass: responseClass, clientClass, authorizer });
+        const methods = Object.getOwnPropertyNames(clientClass.prototype).filter(method => method !== 'constructor' && typeof clientClass.prototype[method] === 'function');
+        const decorated = methods.filter(method => (0, aws_classify_common_1.isPublicEndpoint)(clientClass.prototype[method]));
+        if ((options === null || options === void 0 ? void 0 : options.publicMethods) !== undefined && decorated.length)
+            throw new Error('Use either @Public() or publicMethods, not both');
+        const publicMethods = (options === null || options === void 0 ? void 0 : options.publicMethods) === undefined ? decorated : [...options.publicMethods];
+        if (!publicMethods.every(method => typeof method === 'string' && methods.includes(method)) || new Set(publicMethods).size !== publicMethods.length)
+            throw new Error('publicMethods must be unique request-class method names');
+        this.classDefs.set(interfaceName, { serverClass: responseClass, clientClass, authorizer, publicMethods: new Set(publicMethods) });
         responseClass.__interfaceName__ = interfaceName;
     }
     dispatch(ev, context, classes = {}, entry = 'protected') {
@@ -122,7 +128,7 @@ class ClassifyServerless {
                 throw new Error(`No Response defined for ${request.interfaceName}`);
             if (request.methodName === 'constructor' || !Object.prototype.hasOwnProperty.call(classDef.clientClass.prototype, request.methodName) || typeof classDef.clientClass.prototype[request.methodName] !== 'function')
                 throw new Error(`${request.methodName} not found in ${request.interfaceName} client request class`);
-            if (this.authentication && request.methodName.endsWith(this.authentication.publicSuffix) !== (trusted.dispatch === 'public'))
+            if (this.authentication && classDef.publicMethods.has(request.methodName) !== (trusted.dispatch === 'public'))
                 throw new Error('Member is not permitted on this dispatch endpoint');
             // If authorizer passed in make sure request is authorized
             if (!classDef.authorizer || (yield (this.authentication ? classDef.authorizer(request.interfaceName, request.methodName, request.args, trusted) : classDef.authorizer(request.interfaceName, request.methodName, request.args)))) {

package/lib/cjs/dispatch.js

@@ -26,13 +26,16 @@ const httpHandler = (event, context, entry) => __awaiter(void 0, void 0, void 0,
     }
     catch (err) {
         //console.log(`request.body = ${event.body}`);
-        console.log('Dispatch failed');
+        // Do not reflect parse, database, or framework errors to an untrusted caller.
+        // Operators still receive the original error in Lambda's logs.
+        console.error('Dispatch failed', err);
         return {
             statusCode: 200,
             headers: { 'Cache-Control': 'no-store' },
             body: (0, js_freeze_dry_1.serialize)({
                 data: undefined,
-                exception: `Internal Server Error (${err}) - see log at ${new Date()}`,
+                // Keep the existing serialized-error / HTTP-200 contract for clients.
+                exception: 'Internal Server Error',
                 cargo: undefined,
                 sessionId: undefined
             })

package/lib/esm/Authentication.d.ts

@@ -2,7 +2,6 @@ import type { APIGatewayProxyEvent, APIGatewayProxyEventV2 } from 'aws-lambda';
 import type { AuthenticatedIdentity, RequestContext } from 'aws-classify-common';
 export type HttpEvent = APIGatewayProxyEvent | APIGatewayProxyEventV2;
 export interface ServerAuthenticationOptions {
-    publicSuffix: string;
     connectionCredentialSeconds?: number;
     /** Adapt ONLY the trusted requestContext.authorizer emitted by a configured Gateway authorizer. */
     identityAdapter?: (authorizer: unknown) => AuthenticatedIdentity | undefined;

package/lib/esm/ClassDef.d.ts

@@ -3,5 +3,6 @@ import { ClassifyResponse } from "./ClassifyResponse";
 export interface ClassDef<ServerClass extends ClassifyResponse, ClientClass> {
     serverClass: new () => ServerClass;
     clientClass: new () => ClientClass;
+    publicMethods: ReadonlySet<string>;
     authorizer: ((endPoint: ServerClass, method: string, args: IArguments, context?: RequestContext) => Promise<boolean>) | undefined;
 }

package/lib/esm/ClassifyServerless.d.ts

@@ -19,7 +19,9 @@ export declare class ClassifyServerless {
     setExpirationMinutes(minutes: number): void;
     setLogger(log: (_message: string) => void): void;
     setLogLevel(logLevel: Partial<typeof EndPointsLogging>): void;
-    registerResponse<T>(responseClass: new () => T, authorizer?: (_endPoint: T, _method: string, _args: IArguments, _context?: RequestContext) => Promise<boolean>): void;
+    registerResponse<T>(responseClass: new () => T, authorizer?: (_endPoint: T, _method: string, _args: IArguments, _context?: RequestContext) => Promise<boolean>, options?: {
+        publicMethods?: readonly string[];
+    }): void;
     dispatch(ev: HttpEvent, context: Context, classes?: {}, entry?: 'protected' | 'public'): Promise<string>;
     private dispatchRequest;
     registerRequest<T>(requestClass: new () => T, classes?: any): new () => T;

package/lib/esm/ClassifyServerless.js

@@ -10,7 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 import { deserialize, serialize } from "js-freeze-dry";
 import { sessionStore as ddbDocClient } from "./SessionStore";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { validatePublicSuffix } from "aws-classify-common";
+import { isPublicEndpoint } from "aws-classify-common";
 import { requestContext } from "./Authentication";
 import { ownedSession, sessionOwner, issueConnectionCredential } from "./AuthenticatedSessions";
 import { ApiGatewayManagementApiClient, PostToConnectionCommand } from "@aws-sdk/client-apigatewaymanagementapi";
@@ -26,11 +26,10 @@ export class ClassifyServerless {
         this.expirationMinutes = 60 * 24;
         this.log = msg => console.log(msg);
         if (process.env.AWS_CLASSIFY_AUTHENTICATION === 'true')
-            this.configureAuthentication({ publicSuffix: process.env.AWS_CLASSIFY_PUBLIC_SUFFIX || '' });
+            this.configureAuthentication({});
     }
     configureAuthentication(options) {
         var _a;
-        validatePublicSuffix(options.publicSuffix);
         const seconds = (_a = options.connectionCredentialSeconds) !== null && _a !== void 0 ? _a : 60;
         if (!Number.isInteger(seconds) || seconds < 1 || seconds > 300)
             throw new Error('connectionCredentialSeconds must be 1–300');
@@ -52,7 +51,7 @@ export class ClassifyServerless {
     setLogLevel(logLevel) {
         this.logLevel = logLevel;
     }
-    registerResponse(responseClass, authorizer) {
+    registerResponse(responseClass, authorizer, options) {
         // Find ultimate base class
         let clientClass = responseClass;
         while (Object.getPrototypeOf(clientClass).prototype)
@@ -63,7 +62,14 @@ export class ClassifyServerless {
         const interfaceName = clientClass['interfaceName'];
         if (!interfaceName)
             throw ('ClassifyServerless.registerResponse: Request must have interfaceName as a static property');
-        this.classDefs.set(interfaceName, { serverClass: responseClass, clientClass, authorizer });
+        const methods = Object.getOwnPropertyNames(clientClass.prototype).filter(method => method !== 'constructor' && typeof clientClass.prototype[method] === 'function');
+        const decorated = methods.filter(method => isPublicEndpoint(clientClass.prototype[method]));
+        if ((options === null || options === void 0 ? void 0 : options.publicMethods) !== undefined && decorated.length)
+            throw new Error('Use either @Public() or publicMethods, not both');
+        const publicMethods = (options === null || options === void 0 ? void 0 : options.publicMethods) === undefined ? decorated : [...options.publicMethods];
+        if (!publicMethods.every(method => typeof method === 'string' && methods.includes(method)) || new Set(publicMethods).size !== publicMethods.length)
+            throw new Error('publicMethods must be unique request-class method names');
+        this.classDefs.set(interfaceName, { serverClass: responseClass, clientClass, authorizer, publicMethods: new Set(publicMethods) });
         responseClass.__interfaceName__ = interfaceName;
     }
     dispatch(ev, context, classes = {}, entry = 'protected') {
@@ -119,7 +125,7 @@ export class ClassifyServerless {
                 throw new Error(`No Response defined for ${request.interfaceName}`);
             if (request.methodName === 'constructor' || !Object.prototype.hasOwnProperty.call(classDef.clientClass.prototype, request.methodName) || typeof classDef.clientClass.prototype[request.methodName] !== 'function')
                 throw new Error(`${request.methodName} not found in ${request.interfaceName} client request class`);
-            if (this.authentication && request.methodName.endsWith(this.authentication.publicSuffix) !== (trusted.dispatch === 'public'))
+            if (this.authentication && classDef.publicMethods.has(request.methodName) !== (trusted.dispatch === 'public'))
                 throw new Error('Member is not permitted on this dispatch endpoint');
             // If authorizer passed in make sure request is authorized
             if (!classDef.authorizer || (yield (this.authentication ? classDef.authorizer(request.interfaceName, request.methodName, request.args, trusted) : classDef.authorizer(request.interfaceName, request.methodName, request.args)))) {

package/lib/esm/dispatch.js

@@ -23,13 +23,16 @@ const httpHandler = (event, context, entry) => __awaiter(void 0, void 0, void 0,
     }
     catch (err) {
         //console.log(`request.body = ${event.body}`);
-        console.log('Dispatch failed');
+        // Do not reflect parse, database, or framework errors to an untrusted caller.
+        // Operators still receive the original error in Lambda's logs.
+        console.error('Dispatch failed', err);
         return {
             statusCode: 200,
             headers: { 'Cache-Control': 'no-store' },
             body: serialize({
                 data: undefined,
-                exception: `Internal Server Error (${err}) - see log at ${new Date()}`,
+                // Keep the existing serialized-error / HTTP-200 contract for clients.
+                exception: 'Internal Server Error',
                 cargo: undefined,
                 sessionId: undefined
             })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aws-classify-server",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "main": "./lib/cjs/index.js",
   "module": "./lib/esm/index.js",
   "types": "./lib/esm/index.d.ts",
@@ -34,7 +34,7 @@
     "@aws-sdk/client-apigatewaymanagementapi": "^3.1146.0",
     "@aws-sdk/client-dynamodb": "^3.1146.0",
     "@aws-sdk/lib-dynamodb": "^3.1146.0",
-    "aws-classify-common": "0.2.0",
+    "aws-classify-common": "0.2.2",
     "js-freeze-dry": "^1.1.4"
   },
   "engines": {

package/yml/authentication-config.js

@@ -1,5 +1,4 @@
 // Serverless v3/v4 file resolver. Loaded only by the authenticated functions include.
-const {validatePublicSuffix} = require('aws-classify-common');
 module.exports = async ({resolveVariable}) => {
     const config = await resolveVariable('self:custom.awsClassify, null');
     if (!config || !config.authorizer || typeof config.authorizer.name !== 'string' || !config.authorizer.name.trim())
@@ -10,9 +9,8 @@ module.exports = async ({resolveVariable}) => {
     const scopes = config.authorizer.scopes;
     if (scopes !== undefined && (!Array.isArray(scopes) || !scopes.every(scope => typeof scope === 'string' && scope.length && !/\s/.test(scope))))
         throw new Error('awsClassify authorizer scopes must be an array of nonempty scope names');
-    const publicSuffix = validatePublicSuffix(config.publicSuffix);
     const logging = await resolveVariable('self:provider.logs.websocket, null');
     if (logging && (logging === true || logging.fullExecutionData !== false))
         throw new Error('Authenticated WebSocket logging requires fullExecutionData: false to protect connection credentials');
-    return {authorizer: config.authorizer, publicSuffix};
+    return {authorizer: config.authorizer};
 };

package/yml/functions-authenticated.yml

@@ -1,7 +1,6 @@
 responseHandler:
   environment:
     AWS_CLASSIFY_AUTHENTICATION: 'true'
-    AWS_CLASSIFY_PUBLIC_SUFFIX: ${file(${self:custom.yml}/authentication-config.js):publicSuffix}
   handler: ${self:custom.directories.responseHandlers}.responseHandler
   events:
     - httpApi:
@@ -11,14 +10,12 @@ responseHandler:
 connectHandler:
   environment:
     AWS_CLASSIFY_AUTHENTICATION: 'true'
-    AWS_CLASSIFY_PUBLIC_SUFFIX: ${file(${self:custom.yml}/authentication-config.js):publicSuffix}
   handler: ${self:custom.directories.responseHandlers}.webSocketConnect
   events:
     - websocket: $connect
 disconnectHandler:
   environment:
     AWS_CLASSIFY_AUTHENTICATION: 'true'
-    AWS_CLASSIFY_PUBLIC_SUFFIX: ${file(${self:custom.yml}/authentication-config.js):publicSuffix}
   handler: ${self:custom.directories.responseHandlers}.webSocketDisconnect
   events:
     - websocket: $disconnect
@@ -26,7 +23,6 @@ publicResponseHandler:
   name: ${self:service}-${sls:stage}-public
   environment:
     AWS_CLASSIFY_AUTHENTICATION: 'true'
-    AWS_CLASSIFY_PUBLIC_SUFFIX: ${file(${self:custom.yml}/authentication-config.js):publicSuffix}
   handler: ${self:custom.directories.responseHandlers}.publicResponseHandler
   events:
     - httpApi:

package/yml/provider-iam.yml

@@ -6,4 +6,6 @@ Action:
   - dynamodb:PutItem
   - dynamodb:UpdateItem
   - dynamodb:DeleteItem
-Resource: "*"
+Resource:
+  - !GetAtt AWSClassifySessionTable.Arn
+  - !Join ["", [!GetAtt AWSClassifySessionTable.Arn, "/index/*"]]

package/yml/resources-custom-website.yml

@@ -84,9 +84,12 @@ Resources:
                 - CloudFrontDistribution
                 - DomainName
 Outputs:
+  ContentBucket:
+    Description: Content bucket
+    Value: !Ref S3Bucket
   CloudFrontId:
     Description: CloudFront Id
     Value: !Ref CloudFrontDistribution
   WebsiteUrl:
     Description: Cloudfront URL
-    Value: !GetAtt CloudFrontDistribution.DomainName
+    Value: !GetAtt CloudFrontDistribution.DomainName

package/yml/resources-website-authenticated.yml

@@ -61,9 +61,12 @@ Resources:
             Principal:
               CanonicalUser: !GetAtt CloudFrontOriginAccessIdentity.S3CanonicalUserId
 Outputs:
+  ContentBucket:
+    Description: Content bucket
+    Value: !Ref S3Bucket
   CloudFrontId:
     Description: CloudFront Id
     Value: !Ref CloudFrontDistribution
   WebsiteUrl:
     Description: Cloudfront URL
-    Value: !GetAtt CloudFrontDistribution.DomainName
+    Value: !GetAtt CloudFrontDistribution.DomainName

package/yml/resources-website.yml

@@ -67,9 +67,12 @@ Resources:
             Principal:
               CanonicalUser: !GetAtt CloudFrontOriginAccessIdentity.S3CanonicalUserId
 Outputs:
+  ContentBucket:
+    Description: Content bucket
+    Value: !Ref S3Bucket
   CloudFrontId:
     Description: CloudFront Id
     Value: !Ref CloudFrontDistribution
   WebsiteUrl:
     Description: Cloudfront URL
-    Value: !GetAtt CloudFrontDistribution.DomainName
+    Value: !GetAtt CloudFrontDistribution.DomainName