serverless-offline 8.6.0 → 8.7.0

package/dist/events/http/authValidateContext.js

@@ -0,0 +1,48 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.default = authValidateContext;
+
+var _boom = _interopRequireDefault(require("@hapi/boom"));
+
+var _serverlessLog = _interopRequireDefault(require("../../serverlessLog.js"));
+
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+
+function internalServerError(message) {
+  const errorType = 'AuthorizerConfigurationException';
+
+  const error = _boom.default.internal();
+
+  error.output.payload.message = message;
+  error.output.payload.error = errorType;
+  error.output.headers['x-amzn-ErrorType'] = errorType;
+  return error;
+}
+
+function isValidContext(context) {
+  return Object.values(context).every(i => typeof i === 'string' || typeof i === 'boolean' || typeof i === 'number');
+}
+
+function transform(context) {
+  Object.keys(context).forEach(i => {
+    context[i] = context[i].toString();
+  });
+  return context;
+}
+
+function authValidateContext(context, authFunName) {
+  if (typeof context !== 'object') {
+    return internalServerError('Authorizer response context must be an object');
+  }
+
+  if (!isValidContext(context)) {
+    const error = 'Authorizer response context values must be of type string, number, or boolean';
+    (0, _serverlessLog.default)(`Detected invalid value types returned in authorizer context: (λ: ${authFunName}). ${error}. ` + 'More info: https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-lambda-authorizer-output.html');
+    return internalServerError(error);
+  }
+
+  return transform(context);
+}

package/dist/events/http/createAuthScheme.js

@@ -9,6 +9,8 @@ var _boom = _interopRequireDefault(require("@hapi/boom"));
 
 var _authCanExecuteResource = _interopRequireDefault(require("../authCanExecuteResource.js"));
 
+var _authValidateContext = _interopRequireDefault(require("./authValidateContext.js"));
+
 var _debugLog = _interopRequireDefault(require("../../debugLog.js"));
 
 var _serverlessLog = _interopRequireDefault(require("../../serverlessLog.js"));
@@ -113,11 +115,9 @@ function createAuthScheme(authorizerOptions, provider, lambda, {
 
       try {
         const result = await lambdaFunction.runHandler();
-        if (result === 'Unauthorized') return _boom.default.unauthorized('Unauthorized'); // return processResponse(null, result)
-
-        const policy = result; // Validate that the policy document has the principalId set
+        if (result === 'Unauthorized') return _boom.default.unauthorized('Unauthorized'); // Validate that the policy document has the principalId set
 
-        if (!policy.principalId) {
+        if (!result.principalId) {
           if (log) {
             log.notice(`Authorization response did not include a principalId: (λ: ${authFunName})`);
           } else {
@@ -127,7 +127,7 @@ function createAuthScheme(authorizerOptions, provider, lambda, {
           return _boom.default.forbidden('No principalId set on the Response');
         }
 
-        if (!(0, _authCanExecuteResource.default)(policy.policyDocument, event.methodArn)) {
+        if (!(0, _authCanExecuteResource.default)(result.policyDocument, event.methodArn)) {
           if (log) {
             log.notice(`Authorization response didn't authorize user to access resource: (λ: ${authFunName})`);
           } else {
@@ -135,6 +135,18 @@ function createAuthScheme(authorizerOptions, provider, lambda, {
           }
 
           return _boom.default.forbidden('User is not authorized to access this resource');
+        } // validate the resulting context, ensuring that all
+        // values are either string, number, or boolean types
+
+
+        if (result.context) {
+          const validationResult = (0, _authValidateContext.default)(result.context, authFunName);
+
+          if (validationResult instanceof Error) {
+            return validationResult;
+          }
+
+          result.context = validationResult;
         }
 
         if (log) {
@@ -145,17 +157,16 @@ function createAuthScheme(authorizerOptions, provider, lambda, {
 
         const authorizer = {
           integrationLatency: '42',
-          principalId: policy.principalId,
-          ...policy.context
+          principalId: result.principalId,
+          ...result.context
         }; // Set the credentials for the rest of the pipeline
-        // return resolve(
 
         return h.authenticated({
           credentials: {
             authorizer,
-            context: policy.context,
-            principalId: policy.principalId,
-            usageIdentifierKey: policy.usageIdentifierKey
+            context: result.context,
+            principalId: result.principalId,
+            usageIdentifierKey: result.usageIdentifierKey
           }
         });
       } catch (err) {

package/dist/events/http/lambda-events/LambdaIntegrationEvent.js

@@ -17,6 +17,10 @@ var id = 0;
 
 function _classPrivateFieldLooseKey(name) { return "__private_" + id++ + "_" + name; }
 
+const {
+  parse
+} = JSON;
+
 var _path = /*#__PURE__*/_classPrivateFieldLooseKey("path");
 
 var _request = /*#__PURE__*/_classPrivateFieldLooseKey("request");
@@ -51,6 +55,26 @@ class LambdaIntegrationEvent {
   }
 
   create() {
+    if (process.env.AUTHORIZER) {
+      try {
+        const authorizerContext = parse(process.env.AUTHORIZER);
+
+        if (authorizerContext) {
+          _classPrivateFieldLooseBase(this, _request)[_request].auth = { ..._classPrivateFieldLooseBase(this, _request)[_request].auth,
+            credentials: {
+              authorizer: authorizerContext
+            }
+          };
+        }
+      } catch (error) {
+        if (this.log) {
+          this.log.error('Could not parse process.env.AUTHORIZER, make sure it is correct JSON');
+        } else {
+          console.error('Serverless-offline: Could not parse process.env.AUTHORIZER, make sure it is correct JSON.');
+        }
+      }
+    }
+
     const velocityContext = new _VelocityContext.default(_classPrivateFieldLooseBase(this, _request)[_request], _classPrivateFieldLooseBase(this, _stage)[_stage], _classPrivateFieldLooseBase(this, _request)[_request].payload || {}, _classPrivateFieldLooseBase(this, _path)[_path]).getContext();
     const event = (0, _renderVelocityTemplateObject.default)(_classPrivateFieldLooseBase(this, _requestTemplate)[_requestTemplate], velocityContext, this.v3Utils);
     return event;

package/package.json

@@ -1,7 +1,7 @@
 {
   "dedicatedTo": "Blue, a great migrating bird.",
   "name": "serverless-offline",
-  "version": "8.6.0",
+  "version": "8.7.0",
   "description": "Emulate AWS λ and API Gateway locally when developing your Serverless project",
   "license": "MIT",
   "main": "dist/main.js",