serverless-offline 11.3.0 → 11.5.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "dedicatedTo": "Blue, a great migrating bird.",
   "name": "serverless-offline",
-  "version": "11.3.0",
+  "version": "11.5.0",
   "description": "Emulate AWS λ and API Gateway locally when developing your Serverless project",
   "license": "MIT",
   "exports": {
@@ -82,7 +82,7 @@
     ]
   },
   "dependencies": {
-    "@aws-sdk/client-lambda": "^3.204.0",
+    "@aws-sdk/client-lambda": "^3.210.0",
     "@hapi/boom": "^10.0.0",
     "@hapi/h2o2": "^10.0.0",
     "@hapi/hapi": "^21.0.0",
@@ -93,13 +93,13 @@
     "fs-extra": "^10.1.0",
     "is-wsl": "^2.2.0",
     "java-invoke-local": "0.0.6",
-    "jose": "^4.10.4",
+    "jose": "^4.11.0",
     "js-string-escape": "^1.0.1",
     "jsonpath-plus": "^7.2.0",
     "jsonschema": "^1.4.1",
     "jszip": "^3.10.1",
     "luxon": "^3.1.0",
-    "node-fetch": "^3.2.10",
+    "node-fetch": "^3.3.0",
     "node-schedule": "^2.1.0",
     "object.hasown": "^1.1.2",
     "p-memoize": "^7.1.1",
@@ -116,7 +116,7 @@
     "eslint-plugin-import": "^2.25.4",
     "eslint-plugin-prettier": "^4.2.1",
     "git-list-updated": "^1.2.1",
-    "husky": "^8.0.1",
+    "husky": "^8.0.2",
     "lint-staged": "^13.0.3",
     "mocha": "^10.1.0",
     "nyc": "^15.1.0",

package/src/config/supportedRuntimes.js

@@ -18,6 +18,7 @@ export const supportedNodejs = new Set([
   'nodejs12.x',
   'nodejs14.x',
   'nodejs16.x',
+  'nodejs18.x',
 ])
 
 // PROVIDED
@@ -49,5 +50,6 @@ export const supportedRuntimes = new Set([
 export const unsupportedDockerRuntimes = new Set([
   'nodejs14.x',
   'nodejs16.x',
+  'nodejs18.x',
   'python3.9',
 ])

package/src/events/http/createAuthScheme.js

@@ -11,239 +11,287 @@ import {
   parseQueryStringParameters,
 } from '../../utils/index.js'
 
+const IDENTITY_SOURCE_TYPE_HEADER = 'header'
+const IDENTITY_SOURCE_TYPE_QUERYSTRING = 'querystring'
+
 export default function createAuthScheme(authorizerOptions, provider, lambda) {
   const authFunName = authorizerOptions.name
-  let identityHeader = 'authorization'
+  let identitySourceField = 'authorization'
+  let identitySourceType = IDENTITY_SOURCE_TYPE_HEADER
 
-  if (
-    authorizerOptions.type !== 'request' ||
-    authorizerOptions.identitySource
-  ) {
-    const identitySourceMatch =
-      /^(method.|\$)request.header.((?:\w+-?)+\w+)$/.exec(
-        authorizerOptions.identitySource,
-      )
-
-    if (!identitySourceMatch || identitySourceMatch.length !== 3) {
-      throw new Error(
-        `Serverless Offline only supports retrieving tokens from headers (λ: ${authFunName})`,
-      )
-    }
+  const finalizeAuthScheme = () => {
+    return () => ({
+      async authenticate(request, h) {
+        log.notice()
+        log.notice(
+          `Running Authorization function for ${request.method} ${request.path} (λ: ${authFunName})`,
+        )
 
-    identityHeader = identitySourceMatch[2].toLowerCase()
-  }
+        const { rawHeaders, url } = request.raw.req
+
+        // Get path params
+        // aws doesn't auto decode path params - hapi does
+        const pathParams = { ...request.params }
 
-  // Create Auth Scheme
-  return () => ({
-    async authenticate(request, h) {
-      log.notice()
-      log.notice(
-        `Running Authorization function for ${request.method} ${request.path} (λ: ${authFunName})`,
-      )
-
-      const { rawHeaders, url } = request.raw.req
-
-      // Get path params
-      // aws doesn't auto decode path params - hapi does
-      const pathParams = { ...request.params }
-
-      const accountId = 'random-account-id'
-      const apiId = 'random-api-id'
-      const requestId = 'random-request-id'
-
-      const httpMethod = request.method.toUpperCase()
-      const resourcePath = request.route.path.replace(
-        new RegExp(`^/${provider.stage}`),
-        '',
-      )
-
-      let event = {
-        enhancedAuthContext: {},
-        headers: parseHeaders(rawHeaders),
-        requestContext: {
-          accountId,
-          apiId,
-          domainName: `${apiId}.execute-api.us-east-1.amazonaws.com`,
-          domainPrefix: apiId,
-          requestId,
-          stage: provider.stage,
-        },
-        version: authorizerOptions.payloadVersion,
-      }
-
-      const protocol = `${request.server.info.protocol.toUpperCase()}/${
-        request.raw.req.httpVersion
-      }`
-      const currentDate = new Date()
-      const resourceId = `${httpMethod} ${resourcePath}`
-      const methodArn = `arn:aws:execute-api:${provider.region}:${accountId}:${apiId}/${provider.stage}/${httpMethod}${resourcePath}`
-
-      const authorization = request.raw.req.headers[identityHeader]
-
-      const identityValidationExpression = new RegExp(
-        authorizerOptions.identityValidationExpression,
-      )
-      const matchedAuthorization =
-        identityValidationExpression.test(authorization)
-      const finalAuthorization = matchedAuthorization ? authorization : ''
-
-      log.debug(`Retrieved ${identityHeader} header "${finalAuthorization}"`)
-
-      if (authorizerOptions.payloadVersion === '1.0') {
-        event = {
-          ...event,
-          authorizationToken: finalAuthorization,
-          httpMethod: request.method.toUpperCase(),
-          identitySource: finalAuthorization,
-          methodArn,
-          multiValueHeaders: parseMultiValueHeaders(rawHeaders),
-          multiValueQueryStringParameters:
-            parseMultiValueQueryStringParameters(url),
-          path: request.path,
-          pathParameters: nullIfEmpty(pathParams),
-          queryStringParameters: parseQueryStringParameters(url),
+        const accountId = 'random-account-id'
+        const apiId = 'random-api-id'
+        const requestId = 'random-request-id'
+
+        const httpMethod = request.method.toUpperCase()
+        const resourcePath = request.route.path.replace(
+          new RegExp(`^/${provider.stage}`),
+          '',
+        )
+
+        let event = {
+          enhancedAuthContext: {},
+          headers: parseHeaders(rawHeaders),
           requestContext: {
-            extendedRequestId: requestId,
-            httpMethod,
-            path: request.path,
-            protocol,
-            requestTime: currentDate.toString(),
-            requestTimeEpoch: currentDate.getTime(),
-            resourceId,
-            resourcePath,
+            accountId,
+            apiId,
+            domainName: `${apiId}.execute-api.us-east-1.amazonaws.com`,
+            domainPrefix: apiId,
+            requestId,
             stage: provider.stage,
           },
-          resource: resourcePath,
+          version: authorizerOptions.payloadVersion,
         }
-      }
-
-      if (authorizerOptions.payloadVersion === '2.0') {
-        event = {
-          ...event,
-          identitySource: [finalAuthorization],
-          rawPath: request.path,
-          rawQueryString: getRawQueryParams(url),
-          requestContext: {
-            http: {
-              method: httpMethod,
-              path: resourcePath,
+
+        const protocol = `${request.server.info.protocol.toUpperCase()}/${
+          request.raw.req.httpVersion
+        }`
+        const currentDate = new Date()
+        const resourceId = `${httpMethod} ${resourcePath}`
+        const methodArn = `arn:aws:execute-api:${provider.region}:${accountId}:${apiId}/${provider.stage}/${httpMethod}${resourcePath}`
+
+        let authorization
+        if (identitySourceType === IDENTITY_SOURCE_TYPE_HEADER) {
+          const headers = request.raw.req.headers ?? {}
+          authorization = headers[identitySourceField]
+        } else if (identitySourceType === IDENTITY_SOURCE_TYPE_QUERYSTRING) {
+          const queryStringParameters = parseQueryStringParameters(url) ?? {}
+          authorization = queryStringParameters[identitySourceField]
+        } else {
+          throw new Error(
+            `No Authorization source has been specified. This should never happen. (λ: ${authFunName})`,
+          )
+        }
+
+        if (authorization === undefined) {
+          throw new Error(
+            `Identity Source is null for ${identitySourceType} ${identitySourceField} (λ: ${authFunName})`,
+          )
+        }
+
+        const identityValidationExpression = new RegExp(
+          authorizerOptions.identityValidationExpression,
+        )
+        const matchedAuthorization =
+          identityValidationExpression.test(authorization)
+        const finalAuthorization = matchedAuthorization ? authorization : ''
+
+        log.debug(
+          `Retrieved ${identitySourceField} ${identitySourceType} "${finalAuthorization}"`,
+        )
+
+        if (authorizerOptions.payloadVersion === '1.0') {
+          event = {
+            ...event,
+            authorizationToken: finalAuthorization,
+            httpMethod: request.method.toUpperCase(),
+            identitySource: finalAuthorization,
+            methodArn,
+            multiValueHeaders: parseMultiValueHeaders(rawHeaders),
+            multiValueQueryStringParameters:
+              parseMultiValueQueryStringParameters(url),
+            path: request.path,
+            pathParameters: nullIfEmpty(pathParams),
+            queryStringParameters: parseQueryStringParameters(url),
+            requestContext: {
+              extendedRequestId: requestId,
+              httpMethod,
+              path: request.path,
               protocol,
+              requestTime: currentDate.toString(),
+              requestTimeEpoch: currentDate.getTime(),
+              resourceId,
+              resourcePath,
+              stage: provider.stage,
             },
-            routeKey: resourceId,
-            time: currentDate.toString(),
-            timeEpoch: currentDate.getTime(),
-          },
-          routeArn: methodArn,
-          routeKey: resourceId,
+            resource: resourcePath,
+          }
         }
-      }
-
-      //   methodArn is the ARN of the function we are running we are authorizing access to (or not)
-      //   Account ID and API ID are not simulated
-      if (authorizerOptions.type === 'request') {
-        event = {
-          ...event,
-          type: 'REQUEST',
+
+        if (authorizerOptions.payloadVersion === '2.0') {
+          event = {
+            ...event,
+            identitySource: [finalAuthorization],
+            rawPath: request.path,
+            rawQueryString: getRawQueryParams(url),
+            requestContext: {
+              http: {
+                method: httpMethod,
+                path: resourcePath,
+                protocol,
+              },
+              routeKey: resourceId,
+              time: currentDate.toString(),
+              timeEpoch: currentDate.getTime(),
+            },
+            routeArn: methodArn,
+            routeKey: resourceId,
+          }
         }
-      } else {
-        // This is safe since type: 'TOKEN' cannot have payload format 2.0
-        event = {
-          ...event,
-          type: 'TOKEN',
+
+        //   methodArn is the ARN of the function we are running we are authorizing access to (or not)
+        //   Account ID and API ID are not simulated
+        if (authorizerOptions.type === 'request') {
+          event = {
+            ...event,
+            type: 'REQUEST',
+          }
+        } else {
+          // This is safe since type: 'TOKEN' cannot have payload format 2.0
+          event = {
+            ...event,
+            type: 'TOKEN',
+          }
         }
-      }
 
-      const lambdaFunction = lambda.get(authFunName)
-      lambdaFunction.setEvent(event)
+        const lambdaFunction = lambda.get(authFunName)
+        lambdaFunction.setEvent(event)
+
+        try {
+          const result = await lambdaFunction.runHandler()
+
+          if (authorizerOptions.enableSimpleResponses) {
+            if (result.isAuthorized) {
+              const authorizer = {
+                integrationLatency: '42',
+                ...result.context,
+              }
+              return h.authenticated({
+                credentials: {
+                  authorizer,
+                  context: result.context || {},
+                },
+              })
+            }
+            return Boom.forbidden(
+              'User is not authorized to access this resource',
+            )
+          }
+
+          if (result === 'Unauthorized')
+            return Boom.unauthorized('Unauthorized')
 
-      try {
-        const result = await lambdaFunction.runHandler()
+          // Validate that the policy document has the principalId set
+          if (!result.principalId) {
+            log.notice(
+              `Authorization response did not include a principalId: (λ: ${authFunName})`,
+            )
 
-        if (authorizerOptions.enableSimpleResponses) {
-          if (result.isAuthorized) {
-            const authorizer = {
-              integrationLatency: '42',
-              ...result.context,
-            }
-            return h.authenticated({
-              credentials: {
-                authorizer,
-                context: result.context || {},
-              },
-            })
+            return Boom.forbidden('No principalId set on the Response')
           }
-          return Boom.forbidden(
-            'User is not authorized to access this resource',
-          )
-        }
 
-        if (result === 'Unauthorized') return Boom.unauthorized('Unauthorized')
+          if (
+            !authCanExecuteResource(
+              result.policyDocument,
+              event.methodArn || event.routeArn,
+            )
+          ) {
+            log.notice(
+              `Authorization response didn't authorize user to access resource: (λ: ${authFunName})`,
+            )
+
+            return Boom.forbidden(
+              'User is not authorized to access this resource',
+            )
+          }
+
+          // validate the resulting context, ensuring that all
+          // values are either string, number, or boolean types
+          if (result.context) {
+            const validationResult = authValidateContext(
+              result.context,
+              authFunName,
+            )
+
+            if (validationResult instanceof Error) {
+              return validationResult
+            }
+
+            result.context = validationResult
+          }
 
-        // Validate that the policy document has the principalId set
-        if (!result.principalId) {
           log.notice(
-            `Authorization response did not include a principalId: (λ: ${authFunName})`,
+            `Authorization function returned a successful response: (λ: ${authFunName})`,
           )
 
-          return Boom.forbidden('No principalId set on the Response')
-        }
+          const authorizer = {
+            integrationLatency: '42',
+            principalId: result.principalId,
+            ...result.context,
+          }
 
-        if (
-          !authCanExecuteResource(
-            result.policyDocument,
-            event.methodArn || event.routeArn,
-          )
-        ) {
+          // Set the credentials for the rest of the pipeline
+          return h.authenticated({
+            credentials: {
+              authorizer,
+              context: result.context,
+              principalId: result.principalId,
+              usageIdentifierKey: result.usageIdentifierKey,
+            },
+          })
+        } catch {
           log.notice(
-            `Authorization response didn't authorize user to access resource: (λ: ${authFunName})`,
+            `Authorization function returned an error response: (λ: ${authFunName})`,
           )
 
-          return Boom.forbidden(
-            'User is not authorized to access this resource',
-          )
+          return Boom.unauthorized('Unauthorized')
         }
+      },
+    })
+  }
 
-        // validate the resulting context, ensuring that all
-        // values are either string, number, or boolean types
-        if (result.context) {
-          const validationResult = authValidateContext(
-            result.context,
-            authFunName,
-          )
-
-          if (validationResult instanceof Error) {
-            return validationResult
-          }
+  const checkForIdentitySourceMatch = (exp, expectedLength) => {
+    const identitySourceMatch = exp.exec(authorizerOptions.identitySource)
 
-          result.context = validationResult
-        }
+    if (!identitySourceMatch || identitySourceMatch.length !== expectedLength) {
+      return undefined
+    }
+    return identitySourceMatch[expectedLength - 1]
+  }
 
-        log.notice(
-          `Authorization function returned a successful response: (λ: ${authFunName})`,
-        )
+  if (
+    authorizerOptions.type !== 'request' ||
+    authorizerOptions.identitySource
+  ) {
+    const headerRegExp = /^(method.|\$)request.header.((?:\w+-?)+\w+)$/
+    const queryStringRegExp =
+      /^(method.|\$)request.querystring.((?:\w+-?)+\w+)$/
+
+    const identityHeaderResult = checkForIdentitySourceMatch(headerRegExp, 3)
+    if (identityHeaderResult !== undefined) {
+      identitySourceField = identityHeaderResult.toLowerCase()
+      identitySourceType = IDENTITY_SOURCE_TYPE_HEADER
+      return finalizeAuthScheme()
+    }
 
-        const authorizer = {
-          integrationLatency: '42',
-          principalId: result.principalId,
-          ...result.context,
-        }
+    const identityQueryStringResult = checkForIdentitySourceMatch(
+      queryStringRegExp,
+      3,
+    )
+    if (identityQueryStringResult !== undefined) {
+      identitySourceField = identityQueryStringResult
+      identitySourceType = IDENTITY_SOURCE_TYPE_QUERYSTRING
+      return finalizeAuthScheme()
+    }
 
-        // Set the credentials for the rest of the pipeline
-        return h.authenticated({
-          credentials: {
-            authorizer,
-            context: result.context,
-            principalId: result.principalId,
-            usageIdentifierKey: result.usageIdentifierKey,
-          },
-        })
-      } catch {
-        log.notice(
-          `Authorization function returned an error response: (λ: ${authFunName})`,
-        )
+    throw new Error(
+      `Serverless Offline only supports retrieving tokens from headers and querystring parameters (λ: ${authFunName})`,
+    )
+  }
 
-        return Boom.unauthorized('Unauthorized')
-      }
-    },
-  })
+  return finalizeAuthScheme()
 }