serverless-offline 8.8.1 → 9.1.1

package/src/events/authCanExecuteResource.js

@@ -0,0 +1,35 @@
+import authMatchPolicyResource from './authMatchPolicyResource.js'
+
+const { isArray } = Array
+
+function checkStatementsAgainstResource(Statement, resource, effect) {
+  return Statement.some((statement) => {
+    const resourceArray = isArray(statement.Resource)
+      ? statement.Resource
+      : [statement.Resource]
+
+    return (
+      statement.Effect.toLowerCase() === effect.toLowerCase() &&
+      resourceArray.some((policyResource) =>
+        authMatchPolicyResource(policyResource, resource),
+      )
+    )
+  })
+}
+
+export default function authCanExecuteResource(policy, resource) {
+  const { Statement } = policy
+
+  // check for explicit deny
+  const denyStatementFound = checkStatementsAgainstResource(
+    Statement,
+    resource,
+    'Deny',
+  )
+
+  if (denyStatementFound) {
+    return false
+  }
+
+  return checkStatementsAgainstResource(Statement, resource, 'Allow')
+}

package/src/events/authFunctionNameExtractor.js

@@ -0,0 +1,75 @@
+import { log } from '@serverless/utils/log.js'
+
+function buildFailureResult(warningMessage) {
+  log.warning(warningMessage)
+
+  return {
+    unsupportedAuth: true,
+  }
+}
+
+function buildSuccessResult(authorizerName) {
+  return {
+    authorizerName,
+  }
+}
+
+function handleStringAuthorizer(authorizerString) {
+  if (authorizerString.toUpperCase() === 'AWS_IAM') {
+    return buildFailureResult(
+      'Serverless Offline does not support the AWS_IAM authorization type',
+    )
+  }
+
+  return buildSuccessResult(authorizerString)
+}
+
+function handleObjectAuthorizer(authorizerObject) {
+  const { arn, authorizerId, name, type } = authorizerObject
+
+  if (type && type.toUpperCase() === 'AWS_IAM') {
+    return buildFailureResult(
+      'Serverless Offline does not support the AWS_IAM authorization type',
+    )
+  }
+
+  if (arn) {
+    return buildFailureResult(
+      `Serverless Offline does not support non local authorizers (arn): ${arn}`,
+    )
+  }
+
+  if (authorizerId) {
+    return buildFailureResult(
+      `Serverless Offline does not support non local authorizers (authorizerId): ${authorizerId}`,
+    )
+  }
+
+  if (!name) {
+    return buildFailureResult(
+      'Serverless Offline supports local authorizers but authorizer name is missing',
+    )
+  }
+
+  return buildSuccessResult(name)
+}
+
+export default function authFunctionNameExtractor(endpoint) {
+  const { authorizer } = endpoint
+
+  if (!authorizer) {
+    return buildSuccessResult(null)
+  }
+
+  if (typeof authorizer === 'string') {
+    return handleStringAuthorizer(authorizer)
+  }
+
+  if (typeof authorizer === 'object') {
+    return handleObjectAuthorizer(authorizer)
+  }
+
+  return buildFailureResult(
+    'Serverless Offline supports only local authorizers defined as string or object',
+  )
+}

package/src/events/authMatchPolicyResource.js

@@ -0,0 +1,71 @@
+function parseResource(resource) {
+  const [, region, accountId, restApiId, path] = resource.match(
+    /arn:aws:execute-api:(.*?):(.*?):(.*?)\/(.*)/,
+  )
+
+  return {
+    accountId,
+    path,
+    region,
+    restApiId,
+  }
+}
+
+export default function authMatchPolicyResource(policyResource, resource) {
+  // resource and policyResource are ARNs
+  if (policyResource === resource) {
+    return true
+  }
+
+  if (policyResource === '*') {
+    return true
+  }
+
+  if (policyResource === 'arn:aws:execute-api:**') {
+    // better fix for #523
+    return true
+  }
+
+  if (policyResource === 'arn:aws:execute-api:*:*:*') {
+    return true
+  }
+
+  if (policyResource.includes('*') || policyResource.includes('?')) {
+    // Policy contains a wildcard resource
+
+    const parsedPolicyResource = parseResource(policyResource)
+    const parsedResource = parseResource(resource)
+
+    if (
+      parsedPolicyResource.region !== '*' &&
+      parsedPolicyResource.region !== parsedResource.region
+    ) {
+      return false
+    }
+
+    if (
+      parsedPolicyResource.accountId !== '*' &&
+      parsedPolicyResource.accountId !== parsedResource.accountId
+    ) {
+      return false
+    }
+
+    if (
+      parsedPolicyResource.restApiId !== '*' &&
+      parsedPolicyResource.restApiId !== parsedResource.restApiId
+    ) {
+      return false
+    }
+
+    // The path contains stage, method and the path
+    // for the requested resource and the resource defined in the policy
+    // Need to create a regex replacing ? with one character and * with any number of characters
+    const regExp = new RegExp(
+      parsedPolicyResource.path.replace(/\*/g, '.*').replace(/\?/g, '.'),
+    )
+
+    return regExp.test(parsedResource.path)
+  }
+
+  return false
+}

package/src/events/authValidateContext.js

@@ -0,0 +1,51 @@
+import Boom from '@hapi/boom'
+import { log } from '@serverless/utils/log.js'
+
+const { entries, fromEntries, values } = Object
+
+function internalServerError(message) {
+  const errorType = 'AuthorizerConfigurationException'
+
+  const error = Boom.internal()
+
+  error.output.headers['x-amzn-ErrorType'] = errorType
+  error.output.payload.error = errorType
+  error.output.payload.message = message
+
+  return error
+}
+
+function isValidContext(context) {
+  return values(context).every(
+    (value) =>
+      typeof value === 'boolean' ||
+      typeof value === 'number' ||
+      typeof value === 'string',
+  )
+}
+
+function transform(context) {
+  return fromEntries(
+    entries(context).map(([key, value]) => [key, String(value)]),
+  )
+}
+
+export default function authValidateContext(context, authFunName) {
+  if (typeof context !== 'object') {
+    return internalServerError('Authorizer response context must be an object')
+  }
+
+  if (!isValidContext(context)) {
+    const error =
+      'Authorizer response context values must be of type string, number, or boolean'
+
+    log.notice(
+      `Detected invalid value types returned in authorizer context: (λ: ${authFunName}). ${error}. ` +
+        'More info: https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-lambda-authorizer-output.html',
+    )
+
+    return internalServerError(error)
+  }
+
+  return transform(context)
+}

package/src/events/http/Endpoint.js

@@ -0,0 +1,135 @@
+import { existsSync, readFileSync } from 'node:fs'
+import { dirname, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { log } from '@serverless/utils/log.js'
+import OfflineEndpoint from './OfflineEndpoint.js'
+
+const { entries } = Object
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+
+// velocity template defaults
+const defaultRequestTemplate = readFileSync(
+  resolve(__dirname, './templates/offline-default.req.vm'),
+  'utf8',
+)
+const defaultResponseTemplate = readFileSync(
+  resolve(__dirname, './templates/offline-default.res.vm'),
+  'utf8',
+)
+
+function getResponseContentType(fep) {
+  if (fep.response && fep.response.headers['Content-Type']) {
+    return fep.response.headers['Content-Type'].replace(/'/gm, '')
+  }
+
+  return 'application/json'
+}
+
+export default class Endpoint {
+  #handlerPath = null
+
+  #http = null
+
+  constructor(handlerPath, http) {
+    this.#handlerPath = handlerPath
+    this.#http = http
+  }
+
+  // determine whether we have function level overrides for velocity templates
+  // if not we will use defaults
+  #setVmTemplates(fullEndpoint) {
+    // determine requestTemplate
+    // first check if requestTemplate is set through serverless
+    const fep = fullEndpoint
+
+    try {
+      // determine request template override
+      const reqFilename = `${this.#handlerPath}.req.vm`
+
+      // check if serverless framework populates the object itself
+      if (
+        typeof this.#http.request === 'object' &&
+        typeof this.#http.request.template === 'object'
+      ) {
+        const templatesConfig = this.#http.request.template
+
+        entries(templatesConfig).forEach(([key, value]) => {
+          fep.requestTemplates[key] = value
+        })
+      }
+      // load request template if exists if not use default from serverless offline
+      else if (existsSync(reqFilename)) {
+        fep.requestTemplates['application/json'] = readFileSync(
+          reqFilename,
+          'utf8',
+        )
+      } else {
+        fep.requestTemplates['application/json'] = defaultRequestTemplate
+      }
+
+      // determine response template
+      const resFilename = `${this.#handlerPath}.res.vm`
+
+      fep.responseContentType = getResponseContentType(fep)
+      log.debug('Response Content-Type ', fep.responseContentType)
+
+      // load response template from http response template, or load file if exists other use default
+      if (fep.response && fep.response.template) {
+        fep.responses.default.responseTemplates[fep.responseContentType] =
+          fep.response.template
+      } else if (existsSync(resFilename)) {
+        fep.responses.default.responseTemplates[fep.responseContentType] =
+          readFileSync(resFilename, 'utf8')
+      } else {
+        fep.responses.default.responseTemplates[fep.responseContentType] =
+          defaultResponseTemplate
+      }
+    } catch (err) {
+      log.debug(`Error: ${err}`)
+    }
+
+    return fep
+  }
+
+  // loosely based on:
+  // https://github.com/serverless/serverless/blob/v1.59.2/lib/plugins/aws/package/compile/events/apiGateway/lib/validate.js#L380
+  #getIntegration(http) {
+    const { integration, async: isAsync } = http
+    if (integration) {
+      const normalizedIntegration = integration.toUpperCase().replace('-', '_')
+      if (normalizedIntegration === 'LAMBDA') {
+        return 'AWS'
+      }
+      if (normalizedIntegration === 'LAMBDA_PROXY') {
+        return 'AWS_PROXY'
+      }
+      return normalizedIntegration
+    }
+
+    if (isAsync) {
+      return 'AWS'
+    }
+
+    return 'AWS_PROXY'
+  }
+
+  // return fully generated Endpoint
+  generate() {
+    const offlineEndpoint = new OfflineEndpoint()
+
+    const fullEndpoint = {
+      ...offlineEndpoint,
+      ...this.#http,
+    }
+
+    fullEndpoint.integration = this.#getIntegration(this.#http)
+
+    if (fullEndpoint.integration === 'AWS') {
+      // determine request and response templates or use defaults
+      return this.#setVmTemplates(fullEndpoint)
+    }
+
+    return fullEndpoint
+  }
+}

package/src/events/http/Http.js

@@ -0,0 +1,50 @@
+import HttpEventDefinition from './HttpEventDefinition.js'
+import HttpServer from './HttpServer.js'
+
+export default class Http {
+  #httpServer = null
+
+  constructor(serverless, options, lambda) {
+    this.#httpServer = new HttpServer(serverless, options, lambda)
+  }
+
+  start() {
+    return this.#httpServer.start()
+  }
+
+  // stops the server
+  stop(timeout) {
+    return this.#httpServer.stop(timeout)
+  }
+
+  #createEvent(functionKey, rawHttpEventDefinition, handler) {
+    const httpEvent = new HttpEventDefinition(rawHttpEventDefinition)
+
+    this.#httpServer.createRoutes(functionKey, httpEvent, handler)
+  }
+
+  create(events) {
+    events.forEach(({ functionKey, handler, http }) => {
+      this.#createEvent(functionKey, http, handler)
+    })
+
+    this.#httpServer.writeRoutesTerminal()
+  }
+
+  createResourceRoutes() {
+    this.#httpServer.createResourceRoutes()
+  }
+
+  create404Route() {
+    this.#httpServer.create404Route()
+  }
+
+  registerPlugins() {
+    return this.#httpServer.registerPlugins()
+  }
+
+  // TEMP FIXME quick fix to expose gateway server for testing, look for better solution
+  getServer() {
+    return this.#httpServer.getServer()
+  }
+}

package/src/events/http/HttpEventDefinition.js

@@ -0,0 +1,20 @@
+const { assign } = Object
+
+export default class HttpEventDefinition {
+  constructor(rawHttpEventDefinition) {
+    let method
+    let path
+    let rest
+
+    if (typeof rawHttpEventDefinition === 'string') {
+      ;[method, path] = rawHttpEventDefinition.split(' ')
+    } else {
+      ;({ method, path, ...rest } = rawHttpEventDefinition)
+    }
+
+    this.method = method
+    this.path = path
+
+    assign(this, rest)
+  }
+}