serverless-event-orchestrator 1.2.3 → 1.2.4

package/dist/identity/extractor.d.ts

@@ -1,8 +1,4 @@
 import { IdentityContext } from '../types/routes.js';
-/**
- * Extracts identity context from API Gateway authorizer claims
- * Supports Cognito User Pools and custom authorizers
- */
 /**
  * Extracts identity information from the event's authorizer context
  * @param event - Raw API Gateway event

package/dist/identity/extractor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extractor.d.ts","sourceRoot":"","sources":["../../src/identity/extractor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD;;;GAGG;AAEH;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,GAAG,GAAG,eAAe,GAAG,SAAS,CAcvE;AAcD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAMhF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,EAAE,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAKzG;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,CAInG;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAIrG"}
+{"version":3,"file":"extractor.d.ts","sourceRoot":"","sources":["../../src/identity/extractor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAoDrD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,GAAG,GAAG,eAAe,GAAG,SAAS,CAevE;AAcD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAMhF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,EAAE,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAKzG;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,CAInG;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAIrG"}

package/dist/identity/extractor.js

@@ -7,22 +7,63 @@ exports.hasAnyGroup = hasAnyGroup;
 exports.hasAllGroups = hasAllGroups;
 /**
  * Extracts identity context from API Gateway authorizer claims
- * Supports Cognito User Pools and custom authorizers
+ * Supports multiple API Gateway formats:
+ * - REST API with Cognito User Pool Authorizer
+ * - HTTP API with JWT Authorizer
+ * - REST API with Custom Lambda Authorizer
+ * - HTTP API with Lambda Authorizer
  */
+/**
+ * Extracts claims from the authorizer context, handling multiple API Gateway formats
+ * @param authorizer - The authorizer object from requestContext
+ * @returns Claims object or undefined
+ */
+function extractClaims(authorizer) {
+    if (!authorizer)
+        return undefined;
+    // 1. REST API with Cognito User Pool Authorizer: authorizer.claims
+    if (authorizer.claims && typeof authorizer.claims === 'object') {
+        return authorizer.claims;
+    }
+    // 2. HTTP API with JWT Authorizer: authorizer.jwt.claims
+    if (authorizer.jwt?.claims && typeof authorizer.jwt.claims === 'object') {
+        return authorizer.jwt.claims;
+    }
+    // 3. HTTP API with Lambda Authorizer: authorizer.lambda
+    if (authorizer.lambda && typeof authorizer.lambda === 'object') {
+        return authorizer.lambda;
+    }
+    // 4. REST API with Custom Lambda Authorizer: claims directly in authorizer
+    // Check if authorizer has identity-like properties (sub, userId, email, etc.)
+    if (hasIdentityProperties(authorizer)) {
+        return authorizer;
+    }
+    return undefined;
+}
+/**
+ * Checks if an object has identity-like properties
+ */
+function hasIdentityProperties(obj) {
+    if (!obj || typeof obj !== 'object')
+        return false;
+    const identityKeys = ['sub', 'userId', 'user_id', 'email', 'cognito:username', 'iss', 'aud'];
+    return identityKeys.some(key => key in obj);
+}
 /**
  * Extracts identity information from the event's authorizer context
  * @param event - Raw API Gateway event
  * @returns Identity context or undefined if not authenticated
  */
 function extractIdentity(event) {
-    const claims = event?.requestContext?.authorizer?.claims;
+    const authorizer = event?.requestContext?.authorizer;
+    const claims = extractClaims(authorizer);
     if (!claims) {
         return undefined;
     }
     return {
-        userId: claims.sub || claims['cognito:username'],
+        userId: claims.sub || claims['cognito:username'] || claims.userId || claims.user_id,
         email: claims.email,
-        groups: parseGroups(claims['cognito:groups']),
+        groups: parseGroups(claims['cognito:groups'] || claims.groups),
         issuer: claims.iss,
         claims,
     };

package/dist/identity/extractor.js.map

@@ -1 +1 @@
-{"version":3,"file":"extractor.js","sourceRoot":"","sources":["../../src/identity/extractor.ts"],"names":[],"mappings":";;AAYA,0CAcC;AAmBD,8CAMC;AAQD,wCAKC;AAQD,kCAIC;AAQD,oCAIC;AAtFD;;;GAGG;AAEH;;;;GAIG;AACH,SAAgB,eAAe,CAAC,KAAU;IACxC,MAAM,MAAM,GAAG,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,CAAC;IAEzD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,kBAAkB,CAAC;QAChD,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC7C,MAAM,EAAE,MAAM,CAAC,GAAG;QAClB,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,MAAqC;IACxD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAEzC,6DAA6D;IAC7D,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,MAA0B;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,6CAA6C;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,QAAqC,EAAE,kBAA0B;IAC9F,IAAI,CAAC,QAAQ,EAAE,MAAM;QAAE,OAAO,KAAK,CAAC;IAEpC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5D,OAAO,gBAAgB,KAAK,kBAAkB,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,WAAW,CAAC,QAAqC,EAAE,aAAuB;IACxF,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpE,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,QAAqC,EAAE,cAAwB;IAC1F,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpE,OAAO,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACzE,CAAC"}
+{"version":3,"file":"extractor.js","sourceRoot":"","sources":["../../src/identity/extractor.ts"],"names":[],"mappings":";;AAyDA,0CAeC;AAmBD,8CAMC;AAQD,wCAKC;AAQD,kCAIC;AAQD,oCAIC;AApID;;;;;;;GAOG;AAEH;;;;GAIG;AACH,SAAS,aAAa,CAAC,UAAe;IACpC,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAElC,mEAAmE;IACnE,IAAI,UAAU,CAAC,MAAM,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/D,OAAO,UAAU,CAAC,MAAM,CAAC;IAC3B,CAAC;IAED,yDAAyD;IACzD,IAAI,UAAU,CAAC,GAAG,EAAE,MAAM,IAAI,OAAO,UAAU,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxE,OAAO,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,wDAAwD;IACxD,IAAI,UAAU,CAAC,MAAM,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/D,OAAO,UAAU,CAAC,MAAM,CAAC;IAC3B,CAAC;IAED,2EAA2E;IAC3E,8EAA8E;IAC9E,IAAI,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC;QACtC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAAC,GAAQ;IACrC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7F,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,KAAU;IACxC,MAAM,UAAU,GAAG,KAAK,EAAE,cAAc,EAAE,UAAU,CAAC;IACrD,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAEzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,kBAAkB,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO;QACnF,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC;QAC9D,MAAM,EAAE,MAAM,CAAC,GAAG;QAClB,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,MAAqC;IACxD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAEzC,6DAA6D;IAC7D,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,MAA0B;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,6CAA6C;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,QAAqC,EAAE,kBAA0B;IAC9F,IAAI,CAAC,QAAQ,EAAE,MAAM;QAAE,OAAO,KAAK,CAAC;IAEpC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5D,OAAO,gBAAgB,KAAK,kBAAkB,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,WAAW,CAAC,QAAqC,EAAE,aAAuB;IACxF,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpE,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,QAAqC,EAAE,cAAwB;IAC1F,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpE,OAAO,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACzE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "serverless-event-orchestrator",
-  "version": "1.2.3",
+  "version": "1.2.4",
   "description": "A lightweight, type-safe event dispatcher and middleware orchestrator for AWS Lambda. Designed for hexagonal architectures with support for segmented routing (public, private, backoffice), Cognito User Pool validation, and built-in infrastructure middlewares.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/identity/extractor.ts

@@ -2,25 +2,71 @@ import { IdentityContext } from '../types/routes.js';
 
 /**
  * Extracts identity context from API Gateway authorizer claims
- * Supports Cognito User Pools and custom authorizers
+ * Supports multiple API Gateway formats:
+ * - REST API with Cognito User Pool Authorizer
+ * - HTTP API with JWT Authorizer
+ * - REST API with Custom Lambda Authorizer
+ * - HTTP API with Lambda Authorizer
  */
 
+/**
+ * Extracts claims from the authorizer context, handling multiple API Gateway formats
+ * @param authorizer - The authorizer object from requestContext
+ * @returns Claims object or undefined
+ */
+function extractClaims(authorizer: any): Record<string, any> | undefined {
+  if (!authorizer) return undefined;
+
+  // 1. REST API with Cognito User Pool Authorizer: authorizer.claims
+  if (authorizer.claims && typeof authorizer.claims === 'object') {
+    return authorizer.claims;
+  }
+
+  // 2. HTTP API with JWT Authorizer: authorizer.jwt.claims
+  if (authorizer.jwt?.claims && typeof authorizer.jwt.claims === 'object') {
+    return authorizer.jwt.claims;
+  }
+
+  // 3. HTTP API with Lambda Authorizer: authorizer.lambda
+  if (authorizer.lambda && typeof authorizer.lambda === 'object') {
+    return authorizer.lambda;
+  }
+
+  // 4. REST API with Custom Lambda Authorizer: claims directly in authorizer
+  // Check if authorizer has identity-like properties (sub, userId, email, etc.)
+  if (hasIdentityProperties(authorizer)) {
+    return authorizer;
+  }
+
+  return undefined;
+}
+
+/**
+ * Checks if an object has identity-like properties
+ */
+function hasIdentityProperties(obj: any): boolean {
+  if (!obj || typeof obj !== 'object') return false;
+  const identityKeys = ['sub', 'userId', 'user_id', 'email', 'cognito:username', 'iss', 'aud'];
+  return identityKeys.some(key => key in obj);
+}
+
 /**
  * Extracts identity information from the event's authorizer context
  * @param event - Raw API Gateway event
  * @returns Identity context or undefined if not authenticated
  */
 export function extractIdentity(event: any): IdentityContext | undefined {
-  const claims = event?.requestContext?.authorizer?.claims;
+  const authorizer = event?.requestContext?.authorizer;
+  const claims = extractClaims(authorizer);
   
   if (!claims) {
     return undefined;
   }
   
   return {
-    userId: claims.sub || claims['cognito:username'],
+    userId: claims.sub || claims['cognito:username'] || claims.userId || claims.user_id,
     email: claims.email,
-    groups: parseGroups(claims['cognito:groups']),
+    groups: parseGroups(claims['cognito:groups'] || claims.groups),
     issuer: claims.iss,
     claims,
   };

package/tests/identity.test.ts

@@ -73,6 +73,100 @@ describe('extractIdentity', () => {
     const identity = extractIdentity(event);
     expect(identity?.groups).toEqual(['Admin', 'User']);
   });
+
+  // HTTP API with JWT Authorizer tests
+  it('should extract identity from HTTP API JWT Authorizer format', () => {
+    const event = {
+      requestContext: {
+        authorizer: {
+          jwt: {
+            claims: {
+              sub: 'user-456',
+              email: 'jwt@example.com',
+              iss: 'https://cognito-idp.us-east-1.amazonaws.com/us-east-1_JWT123'
+            }
+          }
+        }
+      }
+    };
+
+    const identity = extractIdentity(event);
+
+    expect(identity).toEqual({
+      userId: 'user-456',
+      email: 'jwt@example.com',
+      groups: [],
+      issuer: 'https://cognito-idp.us-east-1.amazonaws.com/us-east-1_JWT123',
+      claims: event.requestContext.authorizer.jwt.claims
+    });
+  });
+
+  // HTTP API with Lambda Authorizer tests
+  it('should extract identity from HTTP API Lambda Authorizer format', () => {
+    const event = {
+      requestContext: {
+        authorizer: {
+          lambda: {
+            userId: 'lambda-user-789',
+            email: 'lambda@example.com',
+            groups: ['Premium', 'Verified']
+          }
+        }
+      }
+    };
+
+    const identity = extractIdentity(event);
+
+    expect(identity?.userId).toBe('lambda-user-789');
+    expect(identity?.email).toBe('lambda@example.com');
+    expect(identity?.groups).toEqual(['Premium', 'Verified']);
+  });
+
+  // REST API with Custom Lambda Authorizer (flat structure)
+  it('should extract identity from custom Lambda Authorizer with flat structure', () => {
+    const event = {
+      requestContext: {
+        authorizer: {
+          sub: 'custom-user-101',
+          email: 'custom@example.com',
+          iss: 'https://custom-issuer.com'
+        }
+      }
+    };
+
+    const identity = extractIdentity(event);
+
+    expect(identity?.userId).toBe('custom-user-101');
+    expect(identity?.email).toBe('custom@example.com');
+    expect(identity?.issuer).toBe('https://custom-issuer.com');
+  });
+
+  it('should handle userId fallback from user_id in custom authorizer', () => {
+    const event = {
+      requestContext: {
+        authorizer: {
+          user_id: 'underscore-user',
+          email: 'test@example.com'
+        }
+      }
+    };
+
+    const identity = extractIdentity(event);
+    expect(identity?.userId).toBe('underscore-user');
+  });
+
+  it('should return undefined when authorizer has no identity properties', () => {
+    const event = {
+      requestContext: {
+        authorizer: {
+          principalId: 'some-principal',
+          integrationLatency: 123
+        }
+      }
+    };
+
+    expect(extractIdentity(event)).toBeUndefined();
+  });
 });
 
 describe('extractUserPoolId', () => {