quidproquo-actionprocessor-awslambda 0.0.231 → 0.0.232

package/lib/commonjs/getActionProcessor/core/event/apiGatwayEvent/api/getEventGetStorySessionActionProcessor.js

@@ -11,9 +11,31 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getEventGetStorySessionActionProcessor = void 0;
 const quidproquo_core_1 = require("quidproquo-core");
+const quidproquo_webserver_1 = require("quidproquo-webserver");
+const cognito_1 = require("../../../../../logic/cognito");
 const getProcessGetStorySession = (qpqConfig) => {
-    return ({ qpqEventRecord, eventParams }) => __awaiter(void 0, void 0, void 0, function* () {
-        return (0, quidproquo_core_1.actionResult)(void 0);
+    return ({ matchStoryResult, qpqEventRecord }, session) => __awaiter(void 0, void 0, void 0, function* () {
+        var _a, _b;
+        const accessToken = quidproquo_webserver_1.qpqWebServerUtils.getAccessTokenFromHeaders(qpqEventRecord.headers);
+        if (!accessToken) {
+            return (0, quidproquo_core_1.actionResult)(void 0);
+        }
+        // if this endpoint has no auth settings, BUT we do have an access token
+        // then we want to just attempt to extract info for logs, but we will say that its
+        // wasValid = false
+        if (!((_b = (_a = matchStoryResult.config) === null || _a === void 0 ? void 0 : _a.routeAuthSettings) === null || _b === void 0 ? void 0 : _b.userDirectoryName)) {
+            // If this endpoint is unauthenticated, then we will just decode it, and say it wasnt valid, for logs
+            const info = quidproquo_webserver_1.qpqWebServerUtils.decodeJWT(accessToken);
+            return (0, quidproquo_core_1.actionResult)(Object.assign(Object.assign({}, session), { decodedAccessToken: {
+                    exp: (info === null || info === void 0 ? void 0 : info.exp) || 0,
+                    userDirectory: '',
+                    userId: (info === null || info === void 0 ? void 0 : info.sub) || (info === null || info === void 0 ? void 0 : info.id) || (info === null || info === void 0 ? void 0 : info.userId) || (info === null || info === void 0 ? void 0 : info.username) || '',
+                    username: (info === null || info === void 0 ? void 0 : info.username) || (info === null || info === void 0 ? void 0 : info.userId) || (info === null || info === void 0 ? void 0 : info.sub) || (info === null || info === void 0 ? void 0 : info.id) || '',
+                    wasValid: false,
+                } }));
+        }
+        const decodedAccessToken = yield (0, cognito_1.decodeAccessToken)(matchStoryResult.config.routeAuthSettings.userDirectoryName, qpqConfig, accessToken, true);
+        return (0, quidproquo_core_1.actionResult)(Object.assign(Object.assign({}, session), { decodedAccessToken }));
     });
 };
 const getEventGetStorySessionActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {

package/lib/commonjs/getActionProcessor/core/event/apiGatwayEvent/api/getEventMatchStoryActionProcessor.js

@@ -30,12 +30,13 @@ const getProcessMatchStory = (qpqConfig) => {
         if (!matchedRoute) {
             return (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.ErrorTypeEnum.NotFound, `route not found [${qpqEventRecord.path}] - [${quidproquo_webserver_1.qpqWebServerUtils.getHeaderValue('user-agent', qpqEventRecord.headers)}]`);
         }
-        return (0, quidproquo_core_1.actionResult)({
+        const matchResult = {
             runtime: matchedRoute.route.runtime,
             runtimeOptions: matchedRoute.match.params || {},
             // TODO: Make this aware of the API that we are eventing
             config: quidproquo_webserver_1.qpqWebServerUtils.mergeAllRouteOptions('api', matchedRoute.route, qpqConfig),
-        });
+        };
+        return (0, quidproquo_core_1.actionResult)(matchResult);
     });
 };
 const getEventMatchStoryActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {

package/lib/commonjs/getActionProcessor/core/event/apiGatwayEvent/api/types.d.ts

@@ -1,8 +1,8 @@
-import { HTTPEvent, HTTPEventResponse } from 'quidproquo-webserver';
+import { HTTPEvent, HTTPEventResponse, RouteOptions } from 'quidproquo-webserver';
 import { APIGatewayEvent, Context, APIGatewayProxyResult } from 'aws-lambda';
 import { MatchStoryResult } from 'quidproquo-core';
 export type EventInput = [APIGatewayEvent, Context];
 export type EventOutput = APIGatewayProxyResult;
 export type InternalEventRecord = HTTPEvent;
 export type InternalEventOutput = HTTPEventResponse;
-export type MatchResult = MatchStoryResult<any, any>;
+export type MatchResult = MatchStoryResult<Record<string, string>, RouteOptions>;

package/lib/commonjs/getActionProcessor/core/system/getSystemExecuteStoryActionProcessor.js

@@ -28,7 +28,7 @@ const getProcessExecuteStory = (qpqConfig) => {
         const resolveStory = (0, quidproquo_core_1.createRuntime)(qpqConfig, {
             context: ((_a = payload.storySession) === null || _a === void 0 ? void 0 : _a.context) || session.context,
             depth: (((_b = payload.storySession) === null || _b === void 0 ? void 0 : _b.depth) || session.depth || 0) + 1,
-            accessToken: ((_c = payload.storySession) === null || _c === void 0 ? void 0 : _c.accessToken) || session.accessToken,
+            decodedAccessToken: ((_c = payload.storySession) === null || _c === void 0 ? void 0 : _c.decodedAccessToken) || session.decodedAccessToken,
             correlation: ((_d = payload.storySession) === null || _d === void 0 ? void 0 : _d.correlation) || session.correlation,
         }, () => __awaiter(void 0, void 0, void 0, function* () { return actionProcessors; }), exports.getDateNow, logger, 
         // TODO: Share this logic.

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectoryDecodeAccessTokenActionProcessor.js

@@ -20,12 +20,9 @@ const getProcessDecodeAccessToken = (qpqConfig) => {
         const userPoolId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolIdFromConfig)(userDirectoryName, qpqConfig), region);
         const authInfo = yield (0, decodeValidJwt_1.decodeValidJwt)(userPoolId, region, ignoreExpiration, accessToken);
         if (!authInfo || !(authInfo === null || authInfo === void 0 ? void 0 : authInfo.username)) {
-            return (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.ErrorTypeEnum.Unauthorized, 'Invalid accessToken');
+            return (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.ErrorTypeEnum.Unauthorized, 'Invalid access token');
         }
-        return (0, quidproquo_core_1.actionResult)({
-            userId: authInfo.userId,
-            username: authInfo.username,
-        });
+        return (0, quidproquo_core_1.actionResult)(Object.assign(Object.assign({}, authInfo), { userDirectory: userDirectoryName }));
     });
 };
 const getUserDirectoryDecodeAccessTokenActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectoryReadAccessTokenActionProcessor.js

@@ -11,21 +11,20 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getUserDirectoryReadAccessTokenActionProcessor = void 0;
 const quidproquo_core_1 = require("quidproquo-core");
-const awsNamingUtils_1 = require("../../../awsNamingUtils");
-const getExportedValue_1 = require("../../../logic/cloudformation/getExportedValue");
-const decodeValidJwt_1 = require("../../../logic/cognito/decodeValidJwt");
+const decodeAccessToken_1 = require("../../../logic/cognito/decodeAccessToken");
 const getProcessReadAccessToken = (qpqConfig) => {
-    return ({ userDirectoryName, ignoreExpiration }, session) => __awaiter(void 0, void 0, void 0, function* () {
-        const region = quidproquo_core_1.qpqCoreUtils.getApplicationModuleDeployRegion(qpqConfig);
-        const userPoolId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolIdFromConfig)(userDirectoryName, qpqConfig), region);
-        const authInfo = yield (0, decodeValidJwt_1.decodeValidJwt)(userPoolId, region, ignoreExpiration, session.accessToken);
-        if (!authInfo || !(authInfo === null || authInfo === void 0 ? void 0 : authInfo.username)) {
+    return ({ userDirectoryName, ignoreExpiration }, { decodedAccessToken, accessToken }) => __awaiter(void 0, void 0, void 0, function* () {
+        if (decodedAccessToken) {
+            if (!ignoreExpiration && decodedAccessToken.exp < Math.floor(Date.now() / 1000)) {
+                return (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.ErrorTypeEnum.Invalid, 'Access has expired');
+            }
+            return (0, quidproquo_core_1.actionResult)(decodedAccessToken);
+        }
+        const decodedAuthToken = yield (0, decodeAccessToken_1.decodeAccessToken)(userDirectoryName, qpqConfig, accessToken, ignoreExpiration);
+        if (!decodedAuthToken || !decodedAuthToken.username) {
             return (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.ErrorTypeEnum.Unauthorized, 'Invalid accessToken');
         }
-        return (0, quidproquo_core_1.actionResult)({
-            userId: authInfo.userId,
-            username: authInfo.username,
-        });
+        return (0, quidproquo_core_1.actionResult)(decodedAuthToken);
     });
 };
 const getUserDirectoryReadAccessTokenActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectoryRefreshTokenActionProcessor.js

@@ -14,17 +14,15 @@ const quidproquo_core_1 = require("quidproquo-core");
 const awsNamingUtils_1 = require("../../../awsNamingUtils");
 const refreshToken_1 = require("../../../logic/cognito/refreshToken");
 const getExportedValue_1 = require("../../../logic/cloudformation/getExportedValue");
-const decodeValidJwt_1 = require("../../../logic/cognito/decodeValidJwt");
 const getProcessRefreshToken = (qpqConfig) => {
     return ({ userDirectoryName, refreshToken }, session) => __awaiter(void 0, void 0, void 0, function* () {
         const region = quidproquo_core_1.qpqCoreUtils.getApplicationModuleDeployRegion(qpqConfig);
         const userPoolId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolIdFromConfig)(userDirectoryName, qpqConfig), region);
         const userPoolClientId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolClientIdFromConfig)(userDirectoryName, qpqConfig), region);
-        const authInfo = yield (0, decodeValidJwt_1.decodeValidJwt)(userPoolId, region, true, session.accessToken);
-        if (!authInfo || !(authInfo === null || authInfo === void 0 ? void 0 : authInfo.username)) {
+        if (!session.decodedAccessToken || !session.decodedAccessToken.username) {
             return (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.ErrorTypeEnum.Unauthorized, 'Invalid accessToken');
         }
-        const authResponse = yield (0, refreshToken_1.refreshToken)(userPoolId, userPoolClientId, quidproquo_core_1.qpqCoreUtils.getApplicationModuleDeployRegion(qpqConfig), authInfo === null || authInfo === void 0 ? void 0 : authInfo.username, refreshToken);
+        const authResponse = yield (0, refreshToken_1.refreshToken)(userPoolId, userPoolClientId, quidproquo_core_1.qpqCoreUtils.getApplicationModuleDeployRegion(qpqConfig), session.decodedAccessToken.username, refreshToken);
         return (0, quidproquo_core_1.actionResult)(authResponse);
     });
 };

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectorySetAccessTokenActionProcessor.js

@@ -11,12 +11,15 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getUserDirectorySetAccessTokenActionProcessor = void 0;
 const quidproquo_core_1 = require("quidproquo-core");
+const cognito_1 = require("../../../logic/cognito");
 const getProcessSetAccessToken = (qpqConfig) => {
-    return ({ accessToken }, session, aps, logger, updateSession) => __awaiter(void 0, void 0, void 0, function* () {
+    return ({ accessToken, userDirectoryName }, session, apl, logger, updateSession) => __awaiter(void 0, void 0, void 0, function* () {
+        const decodedAccessToken = yield (0, cognito_1.decodeAccessToken)(userDirectoryName, qpqConfig, accessToken, false);
         updateSession({
+            decodedAccessToken: decodedAccessToken,
             accessToken,
         });
-        return (0, quidproquo_core_1.actionResult)(void 0);
+        return (0, quidproquo_core_1.actionResult)(decodedAccessToken);
     });
 };
 const getUserDirectorySetAccessTokenActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {

package/lib/commonjs/index.d.ts

@@ -5,5 +5,6 @@ export * from './runtimeConfig/QPQAWSResourceMap';
 export * from './logic/parametersManager/getParameter';
 export * from './logic/parametersManager/getParameters';
 export * from './logic/cache/memoFunc';
+export * from './logic';
 export * from './lambdaHandlers';
 export * from './getLambdaEntries';

package/lib/commonjs/index.js

@@ -31,8 +31,10 @@ __exportStar(require("./getActionProcessor"), exports);
 exports.awsLambdaUtils = __importStar(require("./awsLambdaUtils"));
 exports.awsNamingUtils = __importStar(require("./awsNamingUtils"));
 __exportStar(require("./runtimeConfig/QPQAWSResourceMap"), exports);
+// TODO EXPORT THIS BETTER..
 __exportStar(require("./logic/parametersManager/getParameter"), exports);
 __exportStar(require("./logic/parametersManager/getParameters"), exports);
 __exportStar(require("./logic/cache/memoFunc"), exports);
+__exportStar(require("./logic"), exports);
 __exportStar(require("./lambdaHandlers"), exports);
 __exportStar(require("./getLambdaEntries"), exports);

package/lib/commonjs/lambdaHandlers/getApiGatewayEventHandler.js

@@ -2,16 +2,13 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getApiGatewayEventHandler = void 0;
 const quidproquo_core_1 = require("quidproquo-core");
-const quidproquo_webserver_1 = require("quidproquo-webserver");
 const getActionProcessor_1 = require("../getActionProcessor");
 const getQpqLambdaRuntimeForEvent_1 = require("./helpers/getQpqLambdaRuntimeForEvent");
 const getApiGatewayEventHandler = (dynamicModuleLoader, qpqConfig) => (0, getQpqLambdaRuntimeForEvent_1.getQpqLambdaRuntimeForEvent)(quidproquo_core_1.QpqRuntimeType.API, (event) => {
     console.log('event', JSON.stringify(event, null, 2));
     console.log(event);
-    const accessToken = quidproquo_webserver_1.qpqWebServerUtils.getAccessTokenFromHeaders(event.headers);
     return {
         depth: 0,
-        accessToken: accessToken,
         context: {},
     };
 }, getActionProcessor_1.getApiGatewayApiEventEventProcessor, dynamicModuleLoader, qpqConfig);

package/lib/commonjs/logic/cognito/decodeAccessToken.d.ts

@@ -0,0 +1,2 @@
+import { DecodedAccessToken, QPQConfig } from 'quidproquo-core';
+export declare const decodeAccessToken: (userDirectoryName: string, qpqConfig: QPQConfig, accessToken?: string, ignoreExpiration?: boolean) => Promise<DecodedAccessToken>;

package/lib/commonjs/logic/cognito/decodeAccessToken.js

@@ -0,0 +1,28 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeAccessToken = void 0;
+const quidproquo_core_1 = require("quidproquo-core");
+const awsNamingUtils_1 = require("../../awsNamingUtils");
+const getExportedValue_1 = require("../cloudformation/getExportedValue");
+const decodeValidJwt_1 = require("./decodeValidJwt");
+const decodeAccessToken = (userDirectoryName, qpqConfig, accessToken, ignoreExpiration = false) => __awaiter(void 0, void 0, void 0, function* () {
+    const region = quidproquo_core_1.qpqCoreUtils.getApplicationModuleDeployRegion(qpqConfig);
+    const userPoolId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolIdFromConfig)(userDirectoryName, qpqConfig), region);
+    const decodedAuthToken = yield (0, decodeValidJwt_1.decodeValidJwt)(userPoolId, region, ignoreExpiration, accessToken);
+    if (!decodedAuthToken || !(decodedAuthToken === null || decodedAuthToken === void 0 ? void 0 : decodedAuthToken.username)) {
+        throw new Error('Unable to decode access token');
+    }
+    const wasValid = !ignoreExpiration || decodedAuthToken.exp > Math.floor(Date.now() / 1000);
+    const decodedAccesToken = Object.assign(Object.assign({}, decodedAuthToken), { wasValid, userDirectory: userDirectoryName });
+    return decodedAccesToken;
+});
+exports.decodeAccessToken = decodeAccessToken;

package/lib/commonjs/logic/cognito/decodeValidJwt.d.ts

@@ -1,5 +1,2 @@
-export type AuthInfo = {
-    userId: string;
-    username: string;
-};
-export declare const decodeValidJwt: (userPoolId: string, region: string, ignoreExpiration: boolean, accessToken?: string) => Promise<AuthInfo | null>;
+import { DecodedAccessToken } from 'quidproquo-core';
+export declare const decodeValidJwt: (userPoolId: string, region: string, ignoreExpiration: boolean, accessToken?: string) => Promise<Omit<DecodedAccessToken, 'userDirectory'> | null>;

package/lib/commonjs/logic/cognito/decodeValidJwt.js

@@ -33,10 +33,13 @@ const decodeValidJwt = (userPoolId, region, ignoreExpiration, accessToken) => __
             algorithms: ['RS256'],
             ignoreExpiration,
         });
-        return {
+        const decodedAccessToken = {
             userId: payload.sub,
             username: payload.username,
+            exp: payload.exp,
+            wasValid: true,
         };
+        return decodedAccessToken;
     }
     catch (e) {
         console.log('Failed to decode jwt token', e);

package/lib/commonjs/logic/cognito/index.d.ts

@@ -0,0 +1,2 @@
+export * from './decodeValidJwt';
+export * from './decodeAccessToken';

package/lib/commonjs/logic/cognito/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./decodeValidJwt"), exports);
+__exportStar(require("./decodeAccessToken"), exports);

package/lib/commonjs/logic/index.d.ts

@@ -0,0 +1 @@
+export * from './cognito';

package/lib/commonjs/logic/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./cognito"), exports);

package/lib/esm/getActionProcessor/core/event/apiGatwayEvent/api/getEventGetStorySessionActionProcessor.js

@@ -1,7 +1,34 @@
 import { EventActionType, actionResult, } from 'quidproquo-core';
+import { qpqWebServerUtils } from 'quidproquo-webserver';
+import { decodeAccessToken } from '../../../../../logic/cognito';
 const getProcessGetStorySession = (qpqConfig) => {
-    return async ({ qpqEventRecord, eventParams }) => {
-        return actionResult(void 0);
+    return async ({ matchStoryResult, qpqEventRecord }, session) => {
+        const accessToken = qpqWebServerUtils.getAccessTokenFromHeaders(qpqEventRecord.headers);
+        if (!accessToken) {
+            return actionResult(void 0);
+        }
+        // if this endpoint has no auth settings, BUT we do have an access token
+        // then we want to just attempt to extract info for logs, but we will say that its
+        // wasValid = false
+        if (!matchStoryResult.config?.routeAuthSettings?.userDirectoryName) {
+            // If this endpoint is unauthenticated, then we will just decode it, and say it wasnt valid, for logs
+            const info = qpqWebServerUtils.decodeJWT(accessToken);
+            return actionResult({
+                ...session,
+                decodedAccessToken: {
+                    exp: info?.exp || 0,
+                    userDirectory: '',
+                    userId: info?.sub || info?.id || info?.userId || info?.username || '',
+                    username: info?.username || info?.userId || info?.sub || info?.id || '',
+                    wasValid: false,
+                },
+            });
+        }
+        const decodedAccessToken = await decodeAccessToken(matchStoryResult.config.routeAuthSettings.userDirectoryName, qpqConfig, accessToken, true);
+        return actionResult({
+            ...session,
+            decodedAccessToken,
+        });
     };
 };
 export const getEventGetStorySessionActionProcessor = async (qpqConfig) => ({

package/lib/esm/getActionProcessor/core/event/apiGatwayEvent/api/getEventMatchStoryActionProcessor.js

@@ -18,12 +18,13 @@ const getProcessMatchStory = (qpqConfig) => {
         if (!matchedRoute) {
             return actionResultError(ErrorTypeEnum.NotFound, `route not found [${qpqEventRecord.path}] - [${qpqWebServerUtils.getHeaderValue('user-agent', qpqEventRecord.headers)}]`);
         }
-        return actionResult({
+        const matchResult = {
             runtime: matchedRoute.route.runtime,
             runtimeOptions: matchedRoute.match.params || {},
             // TODO: Make this aware of the API that we are eventing
             config: qpqWebServerUtils.mergeAllRouteOptions('api', matchedRoute.route, qpqConfig),
-        });
+        };
+        return actionResult(matchResult);
     };
 };
 export const getEventMatchStoryActionProcessor = async (qpqConfig) => ({

package/lib/esm/getActionProcessor/core/event/apiGatwayEvent/api/types.d.ts

@@ -1,8 +1,8 @@
-import { HTTPEvent, HTTPEventResponse } from 'quidproquo-webserver';
+import { HTTPEvent, HTTPEventResponse, RouteOptions } from 'quidproquo-webserver';
 import { APIGatewayEvent, Context, APIGatewayProxyResult } from 'aws-lambda';
 import { MatchStoryResult } from 'quidproquo-core';
 export type EventInput = [APIGatewayEvent, Context];
 export type EventOutput = APIGatewayProxyResult;
 export type InternalEventRecord = HTTPEvent;
 export type InternalEventOutput = HTTPEventResponse;
-export type MatchResult = MatchStoryResult<any, any>;
+export type MatchResult = MatchStoryResult<Record<string, string>, RouteOptions>;

package/lib/esm/getActionProcessor/core/system/getSystemExecuteStoryActionProcessor.js

@@ -14,7 +14,7 @@ const getProcessExecuteStory = (qpqConfig) => {
         const resolveStory = createRuntime(qpqConfig, {
             context: payload.storySession?.context || session.context,
             depth: (payload.storySession?.depth || session.depth || 0) + 1,
-            accessToken: payload.storySession?.accessToken || session.accessToken,
+            decodedAccessToken: payload.storySession?.decodedAccessToken || session.decodedAccessToken,
             correlation: payload.storySession?.correlation || session.correlation,
         }, async () => actionProcessors, getDateNow, logger, 
         // TODO: Share this logic.

package/lib/esm/getActionProcessor/core/userDirectory/getUserDirectoryDecodeAccessTokenActionProcessor.js

@@ -8,11 +8,11 @@ const getProcessDecodeAccessToken = (qpqConfig) => {
         const userPoolId = await getExportedValue(getCFExportNameUserPoolIdFromConfig(userDirectoryName, qpqConfig), region);
         const authInfo = await decodeValidJwt(userPoolId, region, ignoreExpiration, accessToken);
         if (!authInfo || !authInfo?.username) {
-            return actionResultError(ErrorTypeEnum.Unauthorized, 'Invalid accessToken');
+            return actionResultError(ErrorTypeEnum.Unauthorized, 'Invalid access token');
         }
         return actionResult({
-            userId: authInfo.userId,
-            username: authInfo.username,
+            ...authInfo,
+            userDirectory: userDirectoryName,
         });
     };
 };

package/lib/esm/getActionProcessor/core/userDirectory/getUserDirectoryReadAccessTokenActionProcessor.js

@@ -1,19 +1,18 @@
-import { actionResult, qpqCoreUtils, UserDirectoryActionType, actionResultError, ErrorTypeEnum, } from 'quidproquo-core';
-import { getCFExportNameUserPoolIdFromConfig } from '../../../awsNamingUtils';
-import { getExportedValue } from '../../../logic/cloudformation/getExportedValue';
-import { decodeValidJwt } from '../../../logic/cognito/decodeValidJwt';
+import { actionResult, UserDirectoryActionType, actionResultError, ErrorTypeEnum, } from 'quidproquo-core';
+import { decodeAccessToken } from '../../../logic/cognito/decodeAccessToken';
 const getProcessReadAccessToken = (qpqConfig) => {
-    return async ({ userDirectoryName, ignoreExpiration }, session) => {
-        const region = qpqCoreUtils.getApplicationModuleDeployRegion(qpqConfig);
-        const userPoolId = await getExportedValue(getCFExportNameUserPoolIdFromConfig(userDirectoryName, qpqConfig), region);
-        const authInfo = await decodeValidJwt(userPoolId, region, ignoreExpiration, session.accessToken);
-        if (!authInfo || !authInfo?.username) {
+    return async ({ userDirectoryName, ignoreExpiration }, { decodedAccessToken, accessToken }) => {
+        if (decodedAccessToken) {
+            if (!ignoreExpiration && decodedAccessToken.exp < Math.floor(Date.now() / 1000)) {
+                return actionResultError(ErrorTypeEnum.Invalid, 'Access has expired');
+            }
+            return actionResult(decodedAccessToken);
+        }
+        const decodedAuthToken = await decodeAccessToken(userDirectoryName, qpqConfig, accessToken, ignoreExpiration);
+        if (!decodedAuthToken || !decodedAuthToken.username) {
             return actionResultError(ErrorTypeEnum.Unauthorized, 'Invalid accessToken');
         }
-        return actionResult({
-            userId: authInfo.userId,
-            username: authInfo.username,
-        });
+        return actionResult(decodedAuthToken);
     };
 };
 export const getUserDirectoryReadAccessTokenActionProcessor = async (qpqConfig) => ({

package/lib/esm/getActionProcessor/core/userDirectory/getUserDirectoryRefreshTokenActionProcessor.js

@@ -2,17 +2,15 @@ import { actionResult, qpqCoreUtils, UserDirectoryActionType, actionResultError,
 import { getCFExportNameUserPoolIdFromConfig, getCFExportNameUserPoolClientIdFromConfig } from '../../../awsNamingUtils';
 import { refreshToken as cognitoRefreshToken } from '../../../logic/cognito/refreshToken';
 import { getExportedValue } from '../../../logic/cloudformation/getExportedValue';
-import { decodeValidJwt } from '../../../logic/cognito/decodeValidJwt';
 const getProcessRefreshToken = (qpqConfig) => {
     return async ({ userDirectoryName, refreshToken }, session) => {
         const region = qpqCoreUtils.getApplicationModuleDeployRegion(qpqConfig);
         const userPoolId = await getExportedValue(getCFExportNameUserPoolIdFromConfig(userDirectoryName, qpqConfig), region);
         const userPoolClientId = await getExportedValue(getCFExportNameUserPoolClientIdFromConfig(userDirectoryName, qpqConfig), region);
-        const authInfo = await decodeValidJwt(userPoolId, region, true, session.accessToken);
-        if (!authInfo || !authInfo?.username) {
+        if (!session.decodedAccessToken || !session.decodedAccessToken.username) {
             return actionResultError(ErrorTypeEnum.Unauthorized, 'Invalid accessToken');
         }
-        const authResponse = await cognitoRefreshToken(userPoolId, userPoolClientId, qpqCoreUtils.getApplicationModuleDeployRegion(qpqConfig), authInfo?.username, refreshToken);
+        const authResponse = await cognitoRefreshToken(userPoolId, userPoolClientId, qpqCoreUtils.getApplicationModuleDeployRegion(qpqConfig), session.decodedAccessToken.username, refreshToken);
         return actionResult(authResponse);
     };
 };

package/lib/esm/getActionProcessor/core/userDirectory/getUserDirectorySetAccessTokenActionProcessor.js

@@ -1,10 +1,13 @@
 import { actionResult, UserDirectoryActionType, } from 'quidproquo-core';
+import { decodeAccessToken } from '../../../logic/cognito';
 const getProcessSetAccessToken = (qpqConfig) => {
-    return async ({ accessToken }, session, aps, logger, updateSession) => {
+    return async ({ accessToken, userDirectoryName }, session, apl, logger, updateSession) => {
+        const decodedAccessToken = await decodeAccessToken(userDirectoryName, qpqConfig, accessToken, false);
         updateSession({
+            decodedAccessToken: decodedAccessToken,
             accessToken,
         });
-        return actionResult(void 0);
+        return actionResult(decodedAccessToken);
     };
 };
 export const getUserDirectorySetAccessTokenActionProcessor = async (qpqConfig) => ({

package/lib/esm/index.d.ts

@@ -5,5 +5,6 @@ export * from './runtimeConfig/QPQAWSResourceMap';
 export * from './logic/parametersManager/getParameter';
 export * from './logic/parametersManager/getParameters';
 export * from './logic/cache/memoFunc';
+export * from './logic';
 export * from './lambdaHandlers';
 export * from './getLambdaEntries';

package/lib/esm/index.js

@@ -2,8 +2,10 @@ export * from './getActionProcessor';
 export * as awsLambdaUtils from './awsLambdaUtils';
 export * as awsNamingUtils from './awsNamingUtils';
 export * from './runtimeConfig/QPQAWSResourceMap';
+// TODO EXPORT THIS BETTER..
 export * from './logic/parametersManager/getParameter';
 export * from './logic/parametersManager/getParameters';
 export * from './logic/cache/memoFunc';
+export * from './logic';
 export * from './lambdaHandlers';
 export * from './getLambdaEntries';

package/lib/esm/lambdaHandlers/getApiGatewayEventHandler.js

@@ -1,14 +1,11 @@
 import { QpqRuntimeType } from 'quidproquo-core';
-import { qpqWebServerUtils } from 'quidproquo-webserver';
 import { getApiGatewayApiEventEventProcessor } from '../getActionProcessor';
 import { getQpqLambdaRuntimeForEvent } from './helpers/getQpqLambdaRuntimeForEvent';
 export const getApiGatewayEventHandler = (dynamicModuleLoader, qpqConfig) => getQpqLambdaRuntimeForEvent(QpqRuntimeType.API, (event) => {
     console.log('event', JSON.stringify(event, null, 2));
     console.log(event);
-    const accessToken = qpqWebServerUtils.getAccessTokenFromHeaders(event.headers);
     return {
         depth: 0,
-        accessToken: accessToken,
         context: {},
     };
 }, getApiGatewayApiEventEventProcessor, dynamicModuleLoader, qpqConfig);

package/lib/esm/logic/cognito/decodeAccessToken.d.ts

@@ -0,0 +1,2 @@
+import { DecodedAccessToken, QPQConfig } from 'quidproquo-core';
+export declare const decodeAccessToken: (userDirectoryName: string, qpqConfig: QPQConfig, accessToken?: string, ignoreExpiration?: boolean) => Promise<DecodedAccessToken>;

package/lib/esm/logic/cognito/decodeAccessToken.js

@@ -0,0 +1,19 @@
+import { qpqCoreUtils } from 'quidproquo-core';
+import { getCFExportNameUserPoolIdFromConfig } from '../../awsNamingUtils';
+import { getExportedValue } from '../cloudformation/getExportedValue';
+import { decodeValidJwt } from './decodeValidJwt';
+export const decodeAccessToken = async (userDirectoryName, qpqConfig, accessToken, ignoreExpiration = false) => {
+    const region = qpqCoreUtils.getApplicationModuleDeployRegion(qpqConfig);
+    const userPoolId = await getExportedValue(getCFExportNameUserPoolIdFromConfig(userDirectoryName, qpqConfig), region);
+    const decodedAuthToken = await decodeValidJwt(userPoolId, region, ignoreExpiration, accessToken);
+    if (!decodedAuthToken || !decodedAuthToken?.username) {
+        throw new Error('Unable to decode access token');
+    }
+    const wasValid = !ignoreExpiration || decodedAuthToken.exp > Math.floor(Date.now() / 1000);
+    const decodedAccesToken = {
+        ...decodedAuthToken,
+        wasValid,
+        userDirectory: userDirectoryName,
+    };
+    return decodedAccesToken;
+};

package/lib/esm/logic/cognito/decodeValidJwt.d.ts

@@ -1,5 +1,2 @@
-export type AuthInfo = {
-    userId: string;
-    username: string;
-};
-export declare const decodeValidJwt: (userPoolId: string, region: string, ignoreExpiration: boolean, accessToken?: string) => Promise<AuthInfo | null>;
+import { DecodedAccessToken } from 'quidproquo-core';
+export declare const decodeValidJwt: (userPoolId: string, region: string, ignoreExpiration: boolean, accessToken?: string) => Promise<Omit<DecodedAccessToken, 'userDirectory'> | null>;

package/lib/esm/logic/cognito/decodeValidJwt.js

@@ -18,10 +18,13 @@ export const decodeValidJwt = async (userPoolId, region, ignoreExpiration, acces
             algorithms: ['RS256'],
             ignoreExpiration,
         });
-        return {
+        const decodedAccessToken = {
             userId: payload.sub,
             username: payload.username,
+            exp: payload.exp,
+            wasValid: true,
         };
+        return decodedAccessToken;
     }
     catch (e) {
         console.log('Failed to decode jwt token', e);

package/lib/esm/logic/cognito/index.d.ts

@@ -0,0 +1,2 @@
+export * from './decodeValidJwt';
+export * from './decodeAccessToken';

package/lib/esm/logic/cognito/index.js

@@ -0,0 +1,2 @@
+export * from './decodeValidJwt';
+export * from './decodeAccessToken';

package/lib/esm/logic/index.d.ts

@@ -0,0 +1 @@
+export * from './cognito';

package/lib/esm/logic/index.js

@@ -0,0 +1 @@
+export * from './cognito';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "quidproquo-actionprocessor-awslambda",
-  "version": "0.0.231",
+  "version": "0.0.232",
   "description": "",
   "main": "./lib/commonjs/index.js",
   "module": "./lib/esm/index.js",
@@ -52,9 +52,9 @@
     "lodash": "^4.17.21",
     "node-cache": "^5.1.2",
     "node-match-path": "^0.6.3",
-    "quidproquo-config-aws": "0.0.231",
-    "quidproquo-core": "0.0.231",
-    "quidproquo-webserver": "0.0.231"
+    "quidproquo-config-aws": "0.0.232",
+    "quidproquo-core": "0.0.232",
+    "quidproquo-webserver": "0.0.232"
   },
   "devDependencies": {
     "@types/aws-lambda": "^8.10.109",
@@ -62,7 +62,7 @@
     "@types/jsonwebtoken": "^9.0.2",
     "@types/lodash": "^4.14.194",
     "@types/node": "^18.11.9",
-    "quidproquo-tsconfig": "0.0.231",
+    "quidproquo-tsconfig": "0.0.232",
     "typescript": "^4.9.3"
   }
 }