sst 2.1.16 → 2.1.18

package/constructs/future/Auth.js

@@ -0,0 +1,116 @@
+import { Effect, Policy, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { Construct } from "constructs";
+import { Api } from "../Api.js";
+import { Stack } from "../Stack.js";
+import { Secret } from "../Secret.js";
+import { getParameterPath, } from "../util/functionBinding.js";
+import { CustomResource } from "aws-cdk-lib";
+/**
+ * SST Auth is a lightweight authentication solution for your applications. With a simple set of configuration you can deploy a function attached to your API that can handle various authentication flows.  *
+ * @example
+ * ```
+ * import { Auth } from "@serverless-stack/resources"
+ *
+ * new Auth(stack, "auth", {
+ *   authenticator: "functions/authenticator.handler"
+ * })
+ */
+export class Auth extends Construct {
+    id;
+    authenticator;
+    api;
+    publicKey;
+    privateKey;
+    constructor(scope, id, props) {
+        super(scope, props.cdk?.id || id);
+        if (!props.authenticator ||
+            "defaults" in props ||
+            "login" in props ||
+            "triggers" in props ||
+            "identityPoolFederation" in props ||
+            "cdk" in props) {
+            throw new Error(`It looks like you may be passing in Cognito props to the Auth construct. The Auth construct was renamed to Cognito in version 1.10.0`);
+        }
+        this.id = id;
+        const stack = Stack.of(scope);
+        this.authenticator = props.authenticator;
+        this.api = new Api(this, id + "-api", {
+            routes: {
+                "ANY /{step}": {
+                    function: this.authenticator,
+                },
+                "ANY /": {
+                    function: this.authenticator,
+                },
+            },
+            customDomain: props.customDomain,
+        });
+        this.publicKey = new Secret(this, id + "PublicKey");
+        this.privateKey = new Secret(this, id + "PrivateKey");
+        const fn = this.api.getFunction("ANY /{step}");
+        fn.bind([this.publicKey, this.privateKey]);
+        const app = this.node.root;
+        fn.addEnvironment("AUTH_ID", id);
+        fn.attachPermissions([
+            new PolicyStatement({
+                actions: ["ssm:GetParameters"],
+                effect: Effect.ALLOW,
+                resources: [
+                    `arn:${Stack.of(this).partition}:ssm:${app.region}:${app.account}:parameter${getParameterPath(this.publicKey, "value")}`,
+                    `arn:${Stack.of(this).partition}:ssm:${app.region}:${app.account}:parameter${getParameterPath(this.privateKey, "value")}`,
+                ],
+            }),
+        ]);
+        const policy = new Policy(this, "CloudFrontInvalidatorPolicy", {
+            statements: [
+                new PolicyStatement({
+                    actions: [
+                        "ssm:GetParameter",
+                        "ssm:PutParameter",
+                        "ssm:DeleteParameter",
+                    ],
+                    resources: [
+                        `arn:${stack.partition}:ssm:${stack.region}:${stack.account}:parameter/*`,
+                    ],
+                }),
+            ],
+        });
+        stack.customResourceHandler.role?.attachInlinePolicy(policy);
+        const resource = new CustomResource(this, "StackMetadata", {
+            serviceToken: stack.customResourceHandler.functionArn,
+            resourceType: "Custom::AuthKeys",
+            properties: {
+                publicPath: getParameterPath(this.publicKey, "value"),
+                privatePath: getParameterPath(this.privateKey, "value"),
+            },
+        });
+        resource.node.addDependency(policy);
+    }
+    get url() {
+        return this.api.customDomainUrl || this.api.url;
+    }
+    /** @internal */
+    getConstructMetadata() {
+        return {
+            type: "Auth",
+            data: {},
+        };
+    }
+    /** @internal */
+    getFunctionBinding() {
+        return {
+            clientPackage: "future/auth",
+            variables: {
+                publicKey: {
+                    type: "secret_reference",
+                    secret: this.publicKey,
+                },
+                url: {
+                    type: "plain",
+                    value: this.url,
+                },
+            },
+            permissions: {},
+        };
+    }
+}

package/constructs/future/index.d.ts

@@ -0,0 +1 @@
+export * from "./Auth.js";

package/constructs/future/index.js

@@ -0,0 +1 @@
+export * from "./Auth.js";

package/context/handler.d.ts

@@ -2,7 +2,7 @@ import { APIGatewayProxyEventV2, APIGatewayProxyStructuredResultV2, Context as L
 export interface Handlers {
     api: {
         event: APIGatewayProxyEventV2;
-        response: APIGatewayProxyStructuredResultV2;
+        response: APIGatewayProxyStructuredResultV2 | void;
     };
     sqs: {
         event: SQSEvent;

package/node/api/index.d.ts

@@ -2,6 +2,7 @@
 /// <reference types="node/url.js" />
 /// <reference types=".pnpm/@types+node@17.0.45/node_modules/@types/node/url.js" />
 import { Handler } from "../../context/handler.js";
+import { APIGatewayProxyStructuredResultV2 } from "aws-lambda";
 export interface ApiResources {
 }
 export interface AppSyncApiResources {
@@ -23,19 +24,41 @@ export declare const WebSocketApi: WebSocketApiResources;
  * })
  * ```
  */
-export declare function ApiHandler(cb: Parameters<typeof Handler<"api">>[1]): (event: import("aws-lambda").APIGatewayProxyEventV2, context: import("aws-lambda").Context) => Promise<import("aws-lambda").APIGatewayProxyStructuredResultV2>;
-export declare const useCookies: () => any;
-export declare function useCookie(name: string): any;
+export declare function ApiHandler(cb: Parameters<typeof Handler<"api">>[1]): (event: import("aws-lambda").APIGatewayProxyEventV2, context: import("aws-lambda").Context) => Promise<APIGatewayProxyStructuredResultV2>;
+export declare const useCookies: () => {
+    [k: string]: string;
+};
+export declare function useCookie(name: string): string | undefined;
 export declare const useBody: () => string | undefined;
 export declare const useJsonBody: () => any;
 export declare const useFormData: () => import("url").URLSearchParams | undefined;
 export declare const usePath: () => string[];
+interface CookieOptions {
+    expires?: Date;
+    maxAge?: number;
+    domain?: string;
+    path?: string;
+    secure?: boolean;
+    httpOnly?: boolean;
+    sameSite?: "Strict" | "Lax" | "None";
+}
+export declare const useResponse: () => {
+    cookies(values: Record<string, string>, options: CookieOptions): any;
+    cookie(input: {
+        key: string;
+        value: string;
+    } & CookieOptions): any;
+    status(code: number): any;
+    header(key: string, value: string): any;
+    serialize(input: APIGatewayProxyStructuredResultV2): APIGatewayProxyStructuredResultV2;
+};
 export declare function useDomainName(): string;
 export declare function useMethod(): string;
 export declare function useHeaders(): import("aws-lambda").APIGatewayProxyEventHeaders;
 export declare function useHeader(key: string): string | undefined;
 export declare function useFormValue(name: string): string | null | undefined;
 export declare function useQueryParams(): import("aws-lambda").APIGatewayProxyEventQueryStringParameters;
-export declare function useQueryParam(name: string): string | undefined;
+export declare function useQueryParam<T = string>(name: string): T | undefined;
 export declare function usePathParams(): import("aws-lambda").APIGatewayProxyEventPathParameters;
 export declare function usePathParam(name: string): string | undefined;
+export {};

package/node/api/index.js

@@ -19,12 +19,16 @@ Object.assign(WebSocketApi, getVariables("WebSocketApi"));
  * ```
  */
 export function ApiHandler(cb) {
-    return Handler("api", cb);
+    return Handler("api", async (evt, ctx) => {
+        const result = await cb(evt, ctx);
+        const serialized = useResponse().serialize(result || {});
+        return serialized;
+    });
 }
 export const useCookies = /* @__PURE__ */ Context.memo(() => {
     const evt = useEvent("api");
     const cookies = evt.cookies || [];
-    return Object.fromEntries(cookies.map((c) => c.split("=")));
+    return Object.fromEntries(cookies.map((c) => c.split("=")).map(([k, v]) => [k, decodeURIComponent(v)]));
 });
 export function useCookie(name) {
     const cookies = useCookies();
@@ -56,6 +60,64 @@ export const usePath = /* @__PURE__ */ Context.memo(() => {
     const evt = useEvent("api");
     return evt.rawPath.split("/").filter(Boolean);
 });
+export const useResponse = /* @__PURE__ */ Context.memo(() => {
+    const response = {
+        headers: {},
+        cookies: [],
+    };
+    const result = {
+        cookies(values, options) {
+            for (const [key, value] of Object.entries(values)) {
+                result.cookie({
+                    key,
+                    value,
+                    ...options,
+                });
+            }
+            return result;
+        },
+        cookie(input) {
+            const value = encodeURIComponent(input.value);
+            const parts = [input.key + "=" + value];
+            if (input.domain)
+                parts.push("Domain=" + input.domain);
+            if (input.path)
+                parts.push("Path=" + input.path);
+            if (input.expires)
+                parts.push("Expires=" + input.expires.toUTCString());
+            if (input.maxAge)
+                parts.push("Max-Age=" + input.maxAge);
+            if (input.httpOnly)
+                parts.push("HttpOnly");
+            if (input.secure)
+                parts.push("Secure");
+            if (input.sameSite)
+                parts.push("SameSite=" + input.sameSite);
+            response.cookies.push(parts.join("; "));
+            return result;
+        },
+        status(code) {
+            response.statusCode = code;
+            return result;
+        },
+        header(key, value) {
+            response.headers[key] = value;
+            return result;
+        },
+        serialize(input) {
+            return {
+                ...response,
+                ...input,
+                cookies: [...(input.cookies || []), ...response.cookies],
+                headers: {
+                    ...response.headers,
+                    ...input.headers,
+                },
+            };
+        },
+    };
+    return result;
+});
 export function useDomainName() {
     const evt = useEvent("api");
     return evt.requestContext.domainName;

package/node/auth/index.d.ts

@@ -8,3 +8,6 @@ export * from "./adapter/github.js";
 export * from "./adapter/oidc.js";
 export * from "./adapter/oauth.js";
 export * from "./adapter/link.js";
+export interface AuthResources {
+}
+export declare const Auth: AuthResources;

package/node/auth/index.js

@@ -8,3 +8,6 @@ export * from "./adapter/github.js";
 export * from "./adapter/oidc.js";
 export * from "./adapter/oauth.js";
 export * from "./adapter/link.js";
+import { createProxy, getVariables } from "../util/index.js";
+export const Auth = createProxy("Auth");
+Object.assign(Auth, await getVariables("Auth"));

package/node/future/auth/adapter/adapter.d.ts

@@ -0,0 +1,10 @@
+import { APIGatewayProxyEventV2, APIGatewayProxyStructuredResultV2 } from "aws-lambda";
+export type Adapter<T = any> = (evt: APIGatewayProxyEventV2) => Promise<{
+    type: "step";
+    properties: APIGatewayProxyStructuredResultV2;
+} | {
+    type: "success";
+    properties: T;
+} | {
+    type: "error";
+}>;

package/node/future/auth/adapter/adapter.js

@@ -0,0 +1 @@
+export {};

package/node/future/auth/adapter/github.d.ts

@@ -0,0 +1,16 @@
+import { OauthBasicConfig } from "./oauth.js";
+export declare const GithubAdapter: (config: OauthBasicConfig) => () => Promise<{
+    type: "success";
+    properties: {
+        tokenset: import("openid-client").TokenSet;
+        client: import("openid-client").BaseClient;
+    };
+} | {
+    type: "step";
+    properties: {
+        statusCode: number;
+        headers: {
+            location: string;
+        };
+    };
+}>;

package/node/future/auth/adapter/github.js

@@ -0,0 +1,22 @@
+import { Issuer } from "openid-client";
+import { OauthAdapter } from "./oauth.js";
+import { OidcAdapter } from "./oidc.js";
+const issuer = new Issuer({
+    issuer: "https://github.com",
+    authorization_endpoint: "https://github.com/login/oauth/authorize",
+    token_endpoint: "https://github.com/login/oauth/access_token",
+});
+export const GithubAdapter = 
+/* @__PURE__ */
+(config) => {
+    if (config.clientSecret) {
+        return OauthAdapter({
+            issuer,
+            ...config,
+        });
+    }
+    return OidcAdapter({
+        issuer,
+        ...config,
+    });
+};

package/node/future/auth/adapter/google.d.ts

@@ -0,0 +1,20 @@
+import { OidcBasicConfig } from "./oidc.js";
+type GoogleConfig = OidcBasicConfig & {
+    mode: "oidc";
+};
+export declare function GoogleAdapter(config: GoogleConfig): () => Promise<{
+    type: "success";
+    properties: {
+        tokenset: import("openid-client").TokenSet;
+        client: import("openid-client").BaseClient;
+    };
+} | {
+    type: "step";
+    properties: {
+        statusCode: number;
+        headers: {
+            location: string;
+        };
+    };
+}>;
+export {};

package/node/future/auth/adapter/google.js

@@ -0,0 +1,10 @@
+import { Issuer } from "openid-client";
+import { OidcAdapter } from "./oidc.js";
+const issuer = await Issuer.discover("https://accounts.google.com");
+export function GoogleAdapter(config) {
+    return OidcAdapter({
+        issuer,
+        scope: "openid email profile",
+        ...config,
+    });
+}

package/node/future/auth/adapter/link.d.ts

@@ -0,0 +1,11 @@
+import { APIGatewayProxyStructuredResultV2 } from "aws-lambda";
+export declare function LinkAdapter(config: {
+    onLink: (link: string, claims: Record<string, any>) => Promise<APIGatewayProxyStructuredResultV2>;
+    onError: () => Promise<APIGatewayProxyStructuredResultV2>;
+}): () => Promise<{
+    type: "step";
+    properties: APIGatewayProxyStructuredResultV2;
+} | {
+    type: "success";
+    properties: any;
+}>;

package/node/future/auth/adapter/link.js

@@ -0,0 +1,48 @@
+import { createSigner, createVerifier } from "fast-jwt";
+import { Config } from "../../../config/index.js";
+import { useDomainName, usePathParam, useQueryParam, useQueryParams, } from "../../../api/index.js";
+export function LinkAdapter(config) {
+    // @ts-expect-error
+    const key = Config[process.env.AUTH_ID + "PrivateKey"];
+    const signer = createSigner({
+        expiresIn: 1000 * 60 * 10,
+        key,
+        algorithm: "RS512",
+    });
+    return async function () {
+        const callback = "https://" + useDomainName() + "/callback";
+        const step = usePathParam("step");
+        if (step === "authorize") {
+            const url = new URL(callback);
+            const claims = useQueryParams();
+            url.searchParams.append("token", signer(claims));
+            return {
+                type: "step",
+                properties: await config.onLink(url.toString(), claims),
+            };
+        }
+        if (step === "callback") {
+            const token = useQueryParam("token");
+            if (!token)
+                throw new Error("Missing token parameter");
+            try {
+                const verifier = createVerifier({
+                    algorithms: ["RS512"],
+                    key,
+                });
+                const jwt = verifier(token);
+                return {
+                    type: "success",
+                    properties: jwt,
+                };
+            }
+            catch {
+                return {
+                    type: "step",
+                    properties: await config.onError(),
+                };
+            }
+        }
+        throw new Error("Invalid auth request");
+    };
+}

package/node/future/auth/adapter/oauth.d.ts

@@ -0,0 +1,34 @@
+import { BaseClient, Issuer, TokenSet } from "openid-client";
+export interface OauthBasicConfig {
+    /**
+     * The clientID provided by the third party oauth service
+     */
+    clientID: string;
+    /**
+     * The clientSecret provided by the third party oauth service
+     */
+    clientSecret: string;
+    /**
+     * Various scopes requested for the access token
+     */
+    scope: string;
+    prompt?: string;
+}
+export interface OauthConfig extends OauthBasicConfig {
+    issuer: Issuer;
+}
+export declare const OauthAdapter: (config: OauthConfig) => () => Promise<{
+    type: "success";
+    properties: {
+        tokenset: TokenSet;
+        client: BaseClient;
+    };
+} | {
+    type: "step";
+    properties: {
+        statusCode: number;
+        headers: {
+            location: string;
+        };
+    };
+}>;

package/node/future/auth/adapter/oauth.js

@@ -0,0 +1,66 @@
+import { generators } from "openid-client";
+import { useCookie, useDomainName, usePathParam, useQueryParams, useResponse, } from "../../../api/index.js";
+export const OauthAdapter = 
+/* @__PURE__ */
+(config) => {
+    return async function () {
+        const step = usePathParam("step");
+        const callback = "https://" + useDomainName() + "/callback";
+        const client = new config.issuer.Client({
+            client_id: config.clientID,
+            client_secret: config.clientSecret,
+            redirect_uris: [callback],
+            response_types: ["code"],
+        });
+        if (step === "authorize") {
+            const code_verifier = generators.codeVerifier();
+            const state = generators.state();
+            const code_challenge = generators.codeChallenge(code_verifier);
+            const url = client.authorizationUrl({
+                scope: config.scope,
+                code_challenge: code_challenge,
+                code_challenge_method: "S256",
+                state,
+                prompt: config.prompt,
+            });
+            useResponse().cookies({
+                auth_code_verifier: code_verifier,
+                auth_state: state,
+            }, {
+                httpOnly: true,
+                secure: true,
+                maxAge: 60 * 10,
+                sameSite: "None",
+            });
+            return {
+                type: "step",
+                properties: {
+                    statusCode: 302,
+                    headers: {
+                        location: url,
+                    },
+                },
+            };
+        }
+        if (step === "callback") {
+            const params = useQueryParams();
+            const code_verifier = useCookie("auth_code_verifier");
+            const state = useCookie("auth_state");
+            const tokenset = await client[config.issuer.metadata.userinfo_endpoint
+                ? "callback"
+                : "oauthCallback"](callback, params, {
+                code_verifier,
+                state,
+            });
+            const x = {
+                type: "success",
+                properties: {
+                    tokenset,
+                    client,
+                },
+            };
+            return x;
+        }
+        throw new Error("Invalid auth request");
+    };
+};

package/node/future/auth/adapter/oidc.d.ts

@@ -0,0 +1,26 @@
+import { Issuer } from "openid-client";
+export interface OidcBasicConfig {
+    /**
+     * The clientID provided by the third party oauth service
+     */
+    clientID: string;
+}
+export interface OidcConfig extends OidcBasicConfig {
+    issuer: Issuer;
+    scope: string;
+}
+export declare const OidcAdapter: (config: OidcConfig) => () => Promise<{
+    type: "success";
+    properties: {
+        tokenset: import("openid-client").TokenSet;
+        client: import("openid-client").BaseClient;
+    };
+} | {
+    type: "step";
+    properties: {
+        statusCode: number;
+        headers: {
+            location: string;
+        };
+    };
+}>;

package/node/future/auth/adapter/oidc.js

@@ -0,0 +1,62 @@
+import { generators } from "openid-client";
+import { useCookie, useDomainName, useFormData, usePathParam, useResponse, } from "../../../api/index.js";
+export const OidcAdapter = /* @__PURE__ */ (config) => {
+    return async function () {
+        const step = usePathParam("step");
+        const callback = "https://" + useDomainName() + "/callback";
+        const client = new config.issuer.Client({
+            client_id: config.clientID,
+            redirect_uris: [callback],
+            response_types: ["id_token"],
+        });
+        if (step === "authorize") {
+            const nonce = generators.nonce();
+            const state = generators.state();
+            const url = client.authorizationUrl({
+                scope: config.scope,
+                response_mode: "form_post",
+                nonce,
+                state,
+            });
+            useResponse().cookies({
+                auth_nonce: nonce,
+                auth_state: state,
+            }, {
+                httpOnly: true,
+                secure: true,
+                maxAge: 60 * 10,
+                sameSite: "None",
+            });
+            return {
+                type: "step",
+                properties: {
+                    statusCode: 302,
+                    headers: {
+                        location: url,
+                    },
+                },
+            };
+        }
+        if (step === "callback") {
+            const form = useFormData();
+            if (!form)
+                throw new Error("Missing body");
+            const params = Object.fromEntries(form.entries());
+            const nonce = useCookie("auth_nonce");
+            const state = useCookie("auth_state");
+            const tokenset = await client.callback(callback, params, {
+                nonce,
+                state,
+            });
+            const x = {
+                type: "success",
+                properties: {
+                    tokenset,
+                    client,
+                },
+            };
+            return x;
+        }
+        throw new Error("Invalid auth request");
+    };
+};

package/node/future/auth/handler.d.ts

@@ -0,0 +1,18 @@
+import { APIGatewayProxyEventV2, APIGatewayProxyStructuredResultV2 } from "aws-lambda";
+import { Adapter } from "./adapter/adapter.js";
+import { SignerOptions } from "fast-jwt";
+import { SessionValue } from "./session.js";
+export declare function AuthHandler<Providers extends Record<string, Adapter<any>>, Result = {
+    [key in keyof Providers]: {
+        provider: key;
+    } & Extract<Awaited<ReturnType<Providers[key]>>, {
+        type: "success";
+    }>["properties"];
+}[keyof Providers]>(input: {
+    providers: Providers;
+    clients: () => Promise<Record<string, string>>;
+    onAuthorize?: (event: APIGatewayProxyEventV2) => Promise<void | keyof Providers>;
+    onSuccess: (input: Result) => Promise<SessionCreateInput>;
+    onError: () => Promise<APIGatewayProxyStructuredResultV2>;
+}): (event: APIGatewayProxyEventV2, context: import("aws-lambda").Context) => Promise<APIGatewayProxyStructuredResultV2>;
+export type SessionCreateInput = SessionValue & Partial<SignerOptions>;