serverless-offline 8.3.1 → 8.6.0

package/dist/events/websocket/WebSocketClients.js

@@ -17,6 +17,10 @@ var _index2 = require("../../config/index.js");
 
 var _index3 = require("../../utils/index.js");
 
+var _authFunctionNameExtractor = _interopRequireDefault(require("../authFunctionNameExtractor.js"));
+
+var _authCanExecuteResource = _interopRequireDefault(require("../authCanExecuteResource.js"));
+
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
 function _classPrivateFieldLooseBase(receiver, privateKey) { if (!Object.prototype.hasOwnProperty.call(receiver, privateKey)) { throw new TypeError("attempted to use private field on non-instance"); } return receiver; }
@@ -36,8 +40,14 @@ var _lambda = /*#__PURE__*/_classPrivateFieldLooseKey("lambda");
 
 var _options = /*#__PURE__*/_classPrivateFieldLooseKey("options");
 
+var _serverless = /*#__PURE__*/_classPrivateFieldLooseKey("serverless");
+
 var _webSocketRoutes = /*#__PURE__*/_classPrivateFieldLooseKey("webSocketRoutes");
 
+var _webSocketAuthorizers = /*#__PURE__*/_classPrivateFieldLooseKey("webSocketAuthorizers");
+
+var _webSocketAuthorizersCache = /*#__PURE__*/_classPrivateFieldLooseKey("webSocketAuthorizersCache");
+
 var _websocketsApiRouteSelectionExpression = /*#__PURE__*/_classPrivateFieldLooseKey("websocketsApiRouteSelectionExpression");
 
 var _idleTimeouts = /*#__PURE__*/_classPrivateFieldLooseKey("idleTimeouts");
@@ -58,10 +68,22 @@ class WebSocketClients {
       writable: true,
       value: null
     });
+    Object.defineProperty(this, _serverless, {
+      writable: true,
+      value: null
+    });
     Object.defineProperty(this, _webSocketRoutes, {
       writable: true,
       value: new Map()
     });
+    Object.defineProperty(this, _webSocketAuthorizers, {
+      writable: true,
+      value: new Map()
+    });
+    Object.defineProperty(this, _webSocketAuthorizersCache, {
+      writable: true,
+      value: new Map()
+    });
     Object.defineProperty(this, _websocketsApiRouteSelectionExpression, {
       writable: true,
       value: null
@@ -76,6 +98,7 @@ class WebSocketClients {
     });
     _classPrivateFieldLooseBase(this, _lambda)[_lambda] = lambda;
     _classPrivateFieldLooseBase(this, _options)[_options] = options;
+    _classPrivateFieldLooseBase(this, _serverless)[_serverless] = serverless;
     _classPrivateFieldLooseBase(this, _websocketsApiRouteSelectionExpression)[_websocketsApiRouteSelectionExpression] = serverless.service.provider.websocketsApiRouteSelectionExpression || _index2.DEFAULT_WEBSOCKETS_API_ROUTE_SELECTION_EXPRESSION;
 
     if (v3Utils) {
@@ -160,14 +183,147 @@ class WebSocketClients {
     clearTimeout(timeoutId);
   }
 
-  async _processEvent(websocketClient, connectionId, route, event) {
-    let functionKey = _classPrivateFieldLooseBase(this, _webSocketRoutes)[_webSocketRoutes].get(route);
+  async verifyClient(connectionId, request) {
+    const routeName = '$connect';
+
+    const route = _classPrivateFieldLooseBase(this, _webSocketRoutes)[_webSocketRoutes].get(routeName);
+
+    if (!route) {
+      return {
+        verified: false,
+        statusCode: 502
+      };
+    }
+
+    const connectEvent = new _index.WebSocketConnectEvent(connectionId, request, _classPrivateFieldLooseBase(this, _options)[_options]).create();
+
+    const authFunName = _classPrivateFieldLooseBase(this, _webSocketAuthorizers)[_webSocketAuthorizers].get(routeName);
+
+    if (authFunName) {
+      const authorizerFunction = _classPrivateFieldLooseBase(this, _lambda)[_lambda].get(authFunName);
+
+      const authorizeEvent = new _index.WebSocketAuthorizerEvent(connectionId, request, _classPrivateFieldLooseBase(this, _serverless)[_serverless].service.provider, _classPrivateFieldLooseBase(this, _options)[_options]).create();
+      authorizerFunction.setEvent(authorizeEvent);
+
+      if (this.log) {
+        this.log.notice();
+        this.log.notice(`Running Authorization function for ${routeName} (λ: ${authFunName})`);
+      } else {
+        console.log(''); // Just to make things a little pretty
+
+        (0, _serverlessLog.default)(`Running Authorization function for ${routeName} (λ: ${authFunName})`);
+      }
+
+      try {
+        const result = await authorizerFunction.runHandler();
+        if (result === 'Unauthorized') return {
+          verified: false,
+          statusCode: 401
+        };
+        const policy = result; // Validate that the policy document has the principalId set
+
+        if (!policy.principalId) {
+          if (this.log) {
+            this.log.notice(`Authorization response did not include a principalId: (λ: ${authFunName})`);
+          } else {
+            (0, _serverlessLog.default)(`Authorization response did not include a principalId: (λ: ${authFunName})`);
+          }
+
+          return {
+            verified: false,
+            statusCode: 403
+          };
+        }
+
+        if (!(0, _authCanExecuteResource.default)(policy.policyDocument, authorizeEvent.methodArn)) {
+          if (this.log) {
+            this.log.notice(`Authorization response didn't authorize user to access resource: (λ: ${authFunName})`);
+          } else {
+            (0, _serverlessLog.default)(`Authorization response didn't authorize user to access resource: (λ: ${authFunName})`);
+          }
+
+          return {
+            verified: false,
+            statusCode: 403
+          };
+        }
+
+        if (this.log) {
+          this.log.notice(`Authorization function returned a successful response: (λ: ${authFunName})`);
+        } else {
+          (0, _serverlessLog.default)(`Authorization function returned a successful response: (λ: ${authFunName})`);
+        }
+
+        _classPrivateFieldLooseBase(this, _webSocketAuthorizersCache)[_webSocketAuthorizersCache].set(connectionId, {
+          identity: {
+            apiKey: policy.usageIdentifierKey,
+            sourceIp: authorizeEvent.requestContext.sourceIp,
+            userAgent: authorizeEvent.headers['user-agent'] || ''
+          },
+          authorizer: {
+            integrationLatency: '42',
+            principalId: policy.principalId,
+            ...policy.context
+          }
+        });
+      } catch (err) {
+        if (this.log) {
+          this.log.debug(`Error in route handler '${routeName}' authorizer`, err);
+        } else {
+          (0, _debugLog.default)(`Error in route handler '${routeName}' authorizer`, err);
+        }
+
+        return {
+          verified: false,
+          statusCode: 500
+        };
+      }
+    }
+
+    const authorizerData = _classPrivateFieldLooseBase(this, _webSocketAuthorizersCache)[_webSocketAuthorizersCache].get(connectionId);
+
+    if (authorizerData) {
+      connectEvent.identity = authorizerData.identity;
+      connectEvent.authorizer = authorizerData.authorizer;
+    }
+
+    const lambdaFunction = _classPrivateFieldLooseBase(this, _lambda)[_lambda].get(route.functionKey);
+
+    lambdaFunction.setEvent(connectEvent);
+
+    try {
+      const {
+        statusCode
+      } = await lambdaFunction.runHandler();
+      const verified = statusCode >= 200 && statusCode < 300;
+      return {
+        verified,
+        statusCode
+      };
+    } catch (err) {
+      _classPrivateFieldLooseBase(this, _webSocketAuthorizersCache)[_webSocketAuthorizersCache].delete(connectionId);
+
+      if (this.log) {
+        this.log.debug(`Error in route handler '${route.functionKey}'`, err);
+      } else {
+        (0, _debugLog.default)(`Error in route handler '${route.functionKey}'`, err);
+      }
+
+      return {
+        verified: false,
+        statusCode: 502
+      };
+    }
+  }
+
+  async _processEvent(websocketClient, connectionId, routeKey, event) {
+    let route = _classPrivateFieldLooseBase(this, _webSocketRoutes)[_webSocketRoutes].get(routeKey);
 
-    if (!functionKey && route !== '$connect' && route !== '$disconnect') {
-      functionKey = _classPrivateFieldLooseBase(this, _webSocketRoutes)[_webSocketRoutes].get('$default');
+    if (!route && routeKey !== '$disconnect') {
+      route = _classPrivateFieldLooseBase(this, _webSocketRoutes)[_webSocketRoutes].get('$default');
     }
 
-    if (!functionKey) {
+    if (!route) {
       return;
     }
 
@@ -178,27 +334,30 @@ class WebSocketClients {
           message: 'Internal server error',
           requestId: '1234567890'
         }));
-      } // mimic AWS behaviour (close connection) when the $connect route handler throws
-
-
-      if (route === '$connect') {
-        websocketClient.close();
       }
 
       if (this.log) {
-        this.log.debug(`Error in route handler '${functionKey}'`, err);
+        this.log.debug(`Error in route handler '${route.functionKey}'`, err);
       } else {
-        (0, _debugLog.default)(`Error in route handler '${functionKey}'`, err);
+        (0, _debugLog.default)(`Error in route handler '${route.functionKey}'`, err);
       }
     };
 
-    const lambdaFunction = _classPrivateFieldLooseBase(this, _lambda)[_lambda].get(functionKey);
+    const lambdaFunction = _classPrivateFieldLooseBase(this, _lambda)[_lambda].get(route.functionKey);
 
-    lambdaFunction.setEvent(event); // let result
+    lambdaFunction.setEvent(event);
 
     try {
-      /* result = */
-      await lambdaFunction.runHandler(); // TODO what to do with "result"?
+      const {
+        body
+      } = await lambdaFunction.runHandler();
+
+      if (body && routeKey !== '$disconnect' && route.definition.routeResponseSelectionExpression === '$default') {
+        // https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-route-response-selection-expressions
+        // TODO: Once API gateway supports RouteResponses, this will need to change to support that functionality
+        // For now, send body back to the client
+        this.send(connectionId, body);
+      }
     } catch (err) {
       if (this.log) {
         this.log.error(err);
@@ -230,13 +389,9 @@ class WebSocketClients {
     return route || _index2.DEFAULT_WEBSOCKETS_ROUTE;
   }
 
-  addClient(webSocketClient, request, connectionId) {
+  addClient(webSocketClient, connectionId) {
     this._addWebSocketClient(webSocketClient, connectionId);
 
-    const connectEvent = new _index.WebSocketConnectEvent(connectionId, request, _classPrivateFieldLooseBase(this, _options)[_options]).create();
-
-    this._processEvent(webSocketClient, connectionId, '$connect', connectEvent);
-
     webSocketClient.on('close', () => {
       if (this.log) {
         this.log.debug(`disconnect:${connectionId}`);
@@ -252,7 +407,14 @@ class WebSocketClients {
 
       this._clearIdleTimeout(webSocketClient);
 
-      this._processEvent(webSocketClient, connectionId, '$disconnect', disconnectEvent);
+      const authorizerData = _classPrivateFieldLooseBase(this, _webSocketAuthorizersCache)[_webSocketAuthorizersCache].get(connectionId);
+
+      if (authorizerData) {
+        disconnectEvent.identity = authorizerData.identity;
+        disconnectEvent.authorizer = authorizerData.authorizer;
+      }
+
+      this._processEvent(webSocketClient, connectionId, '$disconnect', disconnectEvent).finally(() => _classPrivateFieldLooseBase(this, _webSocketAuthorizersCache)[_webSocketAuthorizersCache].delete(connectionId));
     });
     webSocketClient.on('message', message => {
       if (this.log) {
@@ -271,20 +433,91 @@ class WebSocketClients {
 
       const event = new _index.WebSocketEvent(connectionId, route, message).create();
 
+      const authorizerData = _classPrivateFieldLooseBase(this, _webSocketAuthorizersCache)[_webSocketAuthorizersCache].get(connectionId);
+
+      if (authorizerData) {
+        event.identity = authorizerData.identity;
+        event.authorizer = authorizerData.authorizer;
+      }
+
       this._onWebSocketUsed(connectionId);
 
       this._processEvent(webSocketClient, connectionId, route, event);
     });
   }
 
-  addRoute(functionKey, route) {
+  _extractAuthFunctionName(endpoint) {
+    if (typeof endpoint.authorizer === 'object' && endpoint.authorizer.type && endpoint.authorizer.type.toUpperCase() === 'TOKEN') {
+      if (this.log) {
+        this.log.debug(`Websockets does not support the TOKEN authorization type`);
+      } else {
+        (0, _debugLog.default)(`WARNING: Websockets does not support the TOKEN authorization type`);
+      }
+
+      return null;
+    }
+
+    const result = (0, _authFunctionNameExtractor.default)(endpoint, null, this);
+    return result.unsupportedAuth ? null : result.authorizerName;
+  }
+
+  _configureAuthorization(endpoint, functionKey) {
+    if (!endpoint.authorizer) {
+      return;
+    }
+
+    if (endpoint.route === '$connect') {
+      const authFunctionName = this._extractAuthFunctionName(endpoint);
+
+      if (!authFunctionName) {
+        return;
+      }
+
+      if (this.log) {
+        this.log.notice(`Configuring Authorization: ${functionKey} ${authFunctionName}`);
+      } else {
+        (0, _serverlessLog.default)(`Configuring Authorization: ${functionKey} ${authFunctionName}`);
+      }
+
+      const authFunction = _classPrivateFieldLooseBase(this, _serverless)[_serverless].service.getFunction(authFunctionName);
+
+      if (!authFunction) {
+        if (this.log) {
+          this.log.error(`Authorization function ${authFunctionName} does not exist`);
+        } else {
+          (0, _serverlessLog.default)(`WARNING: Authorization function ${authFunctionName} does not exist`);
+        }
+
+        return;
+      }
+
+      _classPrivateFieldLooseBase(this, _webSocketAuthorizers)[_webSocketAuthorizers].set(endpoint.route, authFunctionName);
+
+      return;
+    }
+
+    if (this.log) {
+      this.log.notice(`Configuring Authorization is supported only on $connect route`);
+    } else {
+      (0, _serverlessLog.default)(`Configuring Authorization is supported only on $connect route`);
+    }
+  }
+
+  addRoute(functionKey, definition) {
     // set the route name
-    _classPrivateFieldLooseBase(this, _webSocketRoutes)[_webSocketRoutes].set(route, functionKey);
+    _classPrivateFieldLooseBase(this, _webSocketRoutes)[_webSocketRoutes].set(definition.route, {
+      functionKey,
+      definition
+    });
+
+    if (!_classPrivateFieldLooseBase(this, _options)[_options].noAuth) {
+      this._configureAuthorization(definition, functionKey);
+    }
 
     if (this.log) {
-      this.log.notice(`route '${route}'`);
+      this.log.notice(`route '${definition}'`);
     } else {
-      (0, _serverlessLog.default)(`route '${route}'`);
+      (0, _serverlessLog.default)(`route '${definition}'`);
     }
   }
 

package/dist/events/websocket/WebSocketServer.js

@@ -25,6 +25,8 @@ var _options = /*#__PURE__*/_classPrivateFieldLooseKey("options");
 
 var _webSocketClients = /*#__PURE__*/_classPrivateFieldLooseKey("webSocketClients");
 
+var _connectionIds = /*#__PURE__*/_classPrivateFieldLooseKey("connectionIds");
+
 class WebSocketServer {
   constructor(options, webSocketClients, sharedServer, v3Utils) {
     Object.defineProperty(this, _options, {
@@ -35,6 +37,10 @@ class WebSocketServer {
       writable: true,
       value: null
     });
+    Object.defineProperty(this, _connectionIds, {
+      writable: true,
+      value: new Map()
+    });
     _classPrivateFieldLooseBase(this, _options)[_options] = options;
     _classPrivateFieldLooseBase(this, _webSocketClients)[_webSocketClients] = webSocketClients;
 
@@ -46,7 +52,42 @@ class WebSocketServer {
     }
 
     const server = new _ws.Server({
-      server: sharedServer
+      server: sharedServer,
+      verifyClient: ({
+        req
+      }, cb) => {
+        const connectionId = (0, _index.createUniqueId)();
+        const {
+          headers
+        } = req;
+        const key = headers['sec-websocket-key'];
+
+        if (this.log) {
+          this.log.debug(`verifyClient:${key} ${connectionId}`);
+        } else {
+          (0, _debugLog.default)(`verifyClient:${key} ${connectionId}`);
+        } // Use the websocket key to coorelate connection IDs
+
+
+        _classPrivateFieldLooseBase(this, _connectionIds)[_connectionIds][key] = connectionId;
+
+        _classPrivateFieldLooseBase(this, _webSocketClients)[_webSocketClients].verifyClient(connectionId, req).then(({
+          verified,
+          statusCode
+        }) => {
+          try {
+            if (!verified) {
+              cb(false, statusCode);
+              return;
+            }
+
+            cb(true);
+          } catch (e) {
+            (0, _debugLog.default)(`Error verifying`, e);
+            cb(false);
+          }
+        });
+      }
     });
     server.on('connection', (webSocketClient, request) => {
       if (this.log) {
@@ -55,7 +96,12 @@ class WebSocketServer {
         console.log('received connection');
       }
 
-      const connectionId = (0, _index.createUniqueId)();
+      const {
+        headers
+      } = request;
+      const key = headers['sec-websocket-key'];
+
+      const connectionId = _classPrivateFieldLooseBase(this, _connectionIds)[_connectionIds][key];
 
       if (this.log) {
         this.log.debug(`connect:${connectionId}`);
@@ -63,7 +109,7 @@ class WebSocketServer {
         (0, _debugLog.default)(`connect:${connectionId}`);
       }
 
-      _classPrivateFieldLooseBase(this, _webSocketClients)[_webSocketClients].addClient(webSocketClient, request, connectionId);
+      _classPrivateFieldLooseBase(this, _webSocketClients)[_webSocketClients].addClient(webSocketClient, connectionId);
     });
   }
 
@@ -85,7 +131,7 @@ class WebSocketServer {
   stop() {}
 
   addRoute(functionKey, webSocketEvent) {
-    _classPrivateFieldLooseBase(this, _webSocketClients)[_webSocketClients].addRoute(functionKey, webSocketEvent.route); // serverlessLog(`route '${route}'`)
+    _classPrivateFieldLooseBase(this, _webSocketClients)[_webSocketClients].addRoute(functionKey, webSocketEvent); // serverlessLog(`route '${route}'`)
 
   }
 

package/dist/events/websocket/lambda-events/WebSocketAuthorizerEvent.js

@@ -0,0 +1,99 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.default = void 0;
+
+var _WebSocketRequestContext = _interopRequireDefault(require("./WebSocketRequestContext.js"));
+
+var _index = require("../../../utils/index.js");
+
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+
+function _classPrivateFieldLooseBase(receiver, privateKey) { if (!Object.prototype.hasOwnProperty.call(receiver, privateKey)) { throw new TypeError("attempted to use private field on non-instance"); } return receiver; }
+
+var id = 0;
+
+function _classPrivateFieldLooseKey(name) { return "__private_" + id++ + "_" + name; }
+
+var _connectionId = /*#__PURE__*/_classPrivateFieldLooseKey("connectionId");
+
+var _httpsProtocol = /*#__PURE__*/_classPrivateFieldLooseKey("httpsProtocol");
+
+var _rawHeaders = /*#__PURE__*/_classPrivateFieldLooseKey("rawHeaders");
+
+var _url = /*#__PURE__*/_classPrivateFieldLooseKey("url");
+
+var _websocketPort = /*#__PURE__*/_classPrivateFieldLooseKey("websocketPort");
+
+var _provider = /*#__PURE__*/_classPrivateFieldLooseKey("provider");
+
+class WebSocketAuthorizerEvent {
+  constructor(connectionId, request, provider, options) {
+    Object.defineProperty(this, _connectionId, {
+      writable: true,
+      value: null
+    });
+    Object.defineProperty(this, _httpsProtocol, {
+      writable: true,
+      value: null
+    });
+    Object.defineProperty(this, _rawHeaders, {
+      writable: true,
+      value: null
+    });
+    Object.defineProperty(this, _url, {
+      writable: true,
+      value: null
+    });
+    Object.defineProperty(this, _websocketPort, {
+      writable: true,
+      value: null
+    });
+    Object.defineProperty(this, _provider, {
+      writable: true,
+      value: null
+    });
+    const {
+      httpsProtocol,
+      websocketPort
+    } = options;
+    const {
+      rawHeaders,
+      url
+    } = request;
+    _classPrivateFieldLooseBase(this, _connectionId)[_connectionId] = connectionId;
+    _classPrivateFieldLooseBase(this, _httpsProtocol)[_httpsProtocol] = httpsProtocol;
+    _classPrivateFieldLooseBase(this, _rawHeaders)[_rawHeaders] = rawHeaders;
+    _classPrivateFieldLooseBase(this, _url)[_url] = url;
+    _classPrivateFieldLooseBase(this, _websocketPort)[_websocketPort] = websocketPort;
+    _classPrivateFieldLooseBase(this, _provider)[_provider] = provider;
+  }
+
+  create() {
+    const headers = (0, _index.parseHeaders)(_classPrivateFieldLooseBase(this, _rawHeaders)[_rawHeaders]);
+    const multiValueHeaders = (0, _index.parseMultiValueHeaders)(_classPrivateFieldLooseBase(this, _rawHeaders)[_rawHeaders]);
+    const multiValueQueryStringParameters = (0, _index.parseMultiValueQueryStringParameters)(_classPrivateFieldLooseBase(this, _url)[_url]);
+    const queryStringParameters = (0, _index.parseQueryStringParameters)(_classPrivateFieldLooseBase(this, _url)[_url]);
+    const requestContext = new _WebSocketRequestContext.default('CONNECT', '$connect', _classPrivateFieldLooseBase(this, _connectionId)[_connectionId]).create();
+    return {
+      type: 'REQUEST',
+      methodArn: `arn:aws:execute-api:${_classPrivateFieldLooseBase(this, _provider)[_provider].region}:${requestContext.accountId}:${requestContext.apiId}/${requestContext.stage}/${requestContext.routeKey}`,
+      headers,
+      multiValueHeaders,
+      // NOTE: multiValueQueryStringParameters and queryStringParameters
+      // properties are only defined if they have values
+      ...(multiValueQueryStringParameters && {
+        multiValueQueryStringParameters
+      }),
+      ...(queryStringParameters && {
+        queryStringParameters
+      }),
+      requestContext
+    };
+  }
+
+}
+
+exports.default = WebSocketAuthorizerEvent;

package/dist/events/websocket/lambda-events/index.js

@@ -3,6 +3,12 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
+Object.defineProperty(exports, "WebSocketAuthorizerEvent", {
+  enumerable: true,
+  get: function () {
+    return _WebSocketAuthorizerEvent.default;
+  }
+});
 Object.defineProperty(exports, "WebSocketConnectEvent", {
   enumerable: true,
   get: function () {
@@ -28,4 +34,6 @@ var _WebSocketDisconnectEvent = _interopRequireDefault(require("./WebSocketDisco
 
 var _WebSocketEvent = _interopRequireDefault(require("./WebSocketEvent.js"));
 
+var _WebSocketAuthorizerEvent = _interopRequireDefault(require("./WebSocketAuthorizerEvent.js"));
+
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }

package/dist/lambda/LambdaFunction.js

@@ -177,7 +177,7 @@ class LambdaFunction {
       name,
       package: functionPackage = {}
     } = functionDefinition;
-    const [handlerPath, handlerName] = (0, _index3.splitHandlerPathAndName)(handler);
+    const [handlerPath, handlerName, handlerModuleNesting] = (0, _index3.splitHandlerPathAndName)(handler);
     const memorySize = functionDefinition.memorySize || provider.memorySize || _index2.DEFAULT_LAMBDA_MEMORY_SIZE;
     const runtime = functionDefinition.runtime || provider.runtime || _index2.DEFAULT_LAMBDA_RUNTIME;
     const timeout = (functionDefinition.timeout || provider.timeout || _index2.DEFAULT_LAMBDA_TIMEOUT) * 1000; // this._executionTimeout = null
@@ -212,6 +212,7 @@ class LambdaFunction {
       functionKey,
       handler,
       handlerName,
+      handlerModuleNesting,
       codeDir: _classPrivateFieldLooseBase(this, _codeDir)[_codeDir],
       handlerPath: (0, _path.resolve)(_classPrivateFieldLooseBase(this, _codeDir)[_codeDir], handlerPath),
       runtime,
@@ -269,7 +270,7 @@ class LambdaFunction {
       LAMBDA_RUNTIME_DIR: '/var/runtime',
       LAMBDA_TASK_ROOT: '/var/task',
       LANG: 'en_US.UTF-8',
-      LD_LIBRARY_PATH: '/usr/local/lib64/node-v4.3.x/lib:/lib64:/usr/lib64:/var/runtime:/var/runtime/lib:/var/task:/var/task/lib',
+      LD_LIBRARY_PATH: '/usr/local/lib64/node-v4.3.x/lib:/lib64:/usr/lib64:/var/runtime:/var/runtime/lib:/var/task:/var/task/lib:/opt/lib',
       NODE_PATH: '/var/runtime:/var/task:/var/runtime/node_modules'
     };
   }

package/dist/lambda/handler-runner/HandlerRunner.js

@@ -75,6 +75,7 @@ class HandlerRunner {
       functionKey,
       handlerName,
       handlerPath,
+      handlerModuleNesting,
       runtime,
       timeout
     } = _classPrivateFieldLooseBase(this, _funOptions)[_funOptions];
@@ -141,7 +142,14 @@ class HandlerRunner {
       const {
         default: InProcessRunner
       } = await Promise.resolve().then(() => _interopRequireWildcard(require('./in-process-runner/index.js')));
-      return new InProcessRunner(functionKey, handlerPath, handlerName, _classPrivateFieldLooseBase(this, _env)[_env], timeout, allowCache);
+      return new InProcessRunner(functionKey, handlerPath, handlerName, handlerModuleNesting, _classPrivateFieldLooseBase(this, _env)[_env], timeout, allowCache);
+    }
+
+    if (_index.supportedGo.has(runtime)) {
+      const {
+        default: GoRunner
+      } = await Promise.resolve().then(() => _interopRequireWildcard(require('./go-runner/index.js')));
+      return new GoRunner(_classPrivateFieldLooseBase(this, _funOptions)[_funOptions], _classPrivateFieldLooseBase(this, _env)[_env], this.v3Utils);
     }
 
     if (_index.supportedPython.has(runtime)) {

package/dist/lambda/handler-runner/child-process-runner/ChildProcessRunner.js

@@ -27,6 +27,8 @@ var _handlerName = /*#__PURE__*/_classPrivateFieldLooseKey("handlerName");
 
 var _handlerPath = /*#__PURE__*/_classPrivateFieldLooseKey("handlerPath");
 
+var _handlerModuleNesting = /*#__PURE__*/_classPrivateFieldLooseKey("handlerModuleNesting");
+
 var _timeout = /*#__PURE__*/_classPrivateFieldLooseKey("timeout");
 
 var _allowCache = /*#__PURE__*/_classPrivateFieldLooseKey("allowCache");
@@ -49,6 +51,10 @@ class ChildProcessRunner {
       writable: true,
       value: null
     });
+    Object.defineProperty(this, _handlerModuleNesting, {
+      writable: true,
+      value: null
+    });
     Object.defineProperty(this, _timeout, {
       writable: true,
       value: null
@@ -61,6 +67,7 @@ class ChildProcessRunner {
       functionKey,
       handlerName,
       handlerPath,
+      handlerModuleNesting,
       timeout
     } = funOptions;
 
@@ -75,6 +82,7 @@ class ChildProcessRunner {
     _classPrivateFieldLooseBase(this, _functionKey)[_functionKey] = functionKey;
     _classPrivateFieldLooseBase(this, _handlerName)[_handlerName] = handlerName;
     _classPrivateFieldLooseBase(this, _handlerPath)[_handlerPath] = handlerPath;
+    _classPrivateFieldLooseBase(this, _handlerModuleNesting)[_handlerModuleNesting] = handlerModuleNesting;
     _classPrivateFieldLooseBase(this, _timeout)[_timeout] = timeout;
     _classPrivateFieldLooseBase(this, _allowCache)[_allowCache] = allowCache;
   } // no-op
@@ -84,7 +92,7 @@ class ChildProcessRunner {
   cleanup() {}
 
   async run(event, context) {
-    const childProcess = (0, _execa.node)(childProcessHelperPath, [_classPrivateFieldLooseBase(this, _functionKey)[_functionKey], _classPrivateFieldLooseBase(this, _handlerName)[_handlerName], _classPrivateFieldLooseBase(this, _handlerPath)[_handlerPath]], {
+    const childProcess = (0, _execa.node)(childProcessHelperPath, [_classPrivateFieldLooseBase(this, _functionKey)[_functionKey], _classPrivateFieldLooseBase(this, _handlerName)[_handlerName], _classPrivateFieldLooseBase(this, _handlerPath)[_handlerPath], _classPrivateFieldLooseBase(this, _handlerModuleNesting)[_handlerModuleNesting]], {
       env: _classPrivateFieldLooseBase(this, _env)[_env],
       stdio: 'inherit'
     });