lambda-api-decorators-cdk 0.2.3__tar.gz → 0.4.0__tar.gz

lambda_api_decorators_cdk-0.4.0/.github/workflows/tests.yml

@@ -0,0 +1,36 @@
+name: Tests
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install package and test dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install --editable . pytest tomli
+
+      - name: Verify package import
+        run: python -c "import lambda_api_decorators_cdk"
+
+      - name: Run tests
+        run: pytest -q

{lambda_api_decorators_cdk-0.2.3 → lambda_api_decorators_cdk-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lambda-api-decorators-cdk
-Version: 0.2.3
+Version: 0.4.0
 Summary: AWS CDK integration for Lambda API Decorators. Generate AWS Lambda and API Gateway infrastructure from decorated Python handlers.
 Author: Mateo Marcos, Emanuel Arguinarena, Lucas Picchi
 License: MIT License
@@ -34,11 +34,12 @@ Classifier: Framework :: AWS CDK :: 2
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: Software Development :: Build Tools
 Classifier: License :: OSI Approved :: MIT License
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
-Requires-Python: >=3.9
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: aws-cdk.aws-lambda-python-alpha

{lambda_api_decorators_cdk-0.2.3 → lambda_api_decorators_cdk-0.4.0}/pyproject.toml

@@ -27,7 +27,7 @@ description = "AWS CDK integration for Lambda API Decorators. Generate AWS Lambd
 readme = "README.md"
 
 # https://packaging.python.org/guides/distributing-packages-using-setuptools/#python-requires
-requires-python = ">=3.9"
+requires-python = ">=3.10"
 
 
 # https://packaging.python.org/en/latest/specifications/core-metadata/#license
@@ -54,10 +54,11 @@ classifiers = [
   'Topic :: Software Development :: Libraries :: Python Modules',
   'Topic :: Software Development :: Build Tools',
   'License :: OSI Approved :: MIT License',
-  'Programming Language :: Python :: 3.9',
   'Programming Language :: Python :: 3.10',
   'Programming Language :: Python :: 3.11',
-  'Programming Language :: Python :: 3.12'
+  'Programming Language :: Python :: 3.12',
+  'Programming Language :: Python :: 3.13',
+  'Programming Language :: Python :: 3.14'
 ]
 
 # For an analysis of this field vs pip's requirements files see:

{lambda_api_decorators_cdk-0.2.3 → lambda_api_decorators_cdk-0.4.0}/src/lambda_api_decorators_cdk/ast_helper.py

@@ -256,6 +256,8 @@ def _validate_permission(invocation):
 
 
 def _parse_invocation(decorator):
+    if isinstance(decorator, ast.Name) and decorator.id == "public":
+        return DecoratorInvocation(name="public", args=(), kwargs=())
     if not isinstance(decorator, ast.Call) or not isinstance(decorator.func, ast.Name):
         return None
     name = decorator.func.id
@@ -275,6 +277,12 @@ def _parse_invocation(decorator):
         _validate_grant(invocation, "bucket_name")
     elif name == "permission":
         invocation = _validate_permission(invocation)
+    elif name == "authorizer":
+        if len(invocation.args) != 1 or invocation.kwargs:
+            raise ValueError("authorizer requires exactly one positional key")
+        _require_non_empty_string(invocation.args[0], name, "key")
+    elif name == "public":
+        raise ValueError("public must be used as a bare decorator")
     return invocation
 
 
@@ -301,6 +309,19 @@ def get_file_nodes(parsed_tree, id, directory):
                     is_lambda_http = True
                     paths.append((path, invocation.name))
 
+            auth_invocations = [
+                invocation for invocation in decorator_invocations
+                if invocation.name in ("authorizer", "public")
+            ]
+            if len(auth_invocations) > 1:
+                raise ValueError(
+                    "Conflicting or repeated authentication decorators are not allowed"
+                )
+            if len(paths) > 1 and auth_invocations:
+                raise ValueError(
+                    "Authentication on a handler with multiple routes is ambiguous"
+                )
+
             #ast.FunctionDef ends. If the Function had an HTTP Decorator it means it's a lambda function
             if is_lambda_http: 
                 for key,value in paths:

{lambda_api_decorators_cdk-0.2.3 → lambda_api_decorators_cdk-0.4.0}/src/lambda_api_decorators_cdk/lambda_api_config.py

@@ -27,6 +27,8 @@ class LambdaApiConfig:
         environment: Optional[Mapping[str, str]] = None,
         dynamodb_tables: Optional[Mapping[str, dynamodb.ITable]] = None,
         s3_buckets: Optional[Mapping[str, s3.IBucket]] = None,
+        authorizers: Optional[Mapping[str, object]] = None,
+        default_authorizer: Optional[str] = None,
     ) -> None:
         self._default_runtime = runtime
         self._default_timeout = timeout
@@ -49,10 +51,15 @@ class LambdaApiConfig:
 
         self._dynamodb_tables = {}
         self._s3_buckets = {}
+        self._authorizers = {}
         for key, table in (dynamodb_tables or {}).items():
             self.add_dynamodb_table(key, table)
         for key, bucket in (s3_buckets or {}).items():
             self.add_s3_bucket(key, bucket)
+        for key, authorizer in (authorizers or {}).items():
+            self.add_authorizer(key, authorizer)
+        self._default_authorizer = None
+        self.set_default_authorizer(default_authorizer)
 
     def set_default_runtime(self, runtime: Optional[lambda_.Runtime]) -> None:
         self._default_runtime = runtime
@@ -117,6 +124,35 @@ class LambdaApiConfig:
     def add_s3_bucket(self, key: str, bucket: s3.IBucket) -> None:
         self._add_resource(key, bucket, self._s3_buckets, "S3 bucket")
 
+    def add_authorizer(self, key: str, authorizer: object) -> None:
+        if not isinstance(key, str):
+            raise TypeError("Authorizer registry keys must be strings")
+        if not key.strip():
+            raise ValueError("Authorizer registry keys must not be empty or whitespace")
+        interfaces = getattr(authorizer, "__jsii_ifaces__", ()) if authorizer is not None else ()
+        supported = {
+            "aws_cdk.aws_apigateway.IAuthorizer",
+            "aws_cdk.aws_apigatewayv2.IHttpRouteAuthorizer",
+        }
+        if not any(f"{interface.__module__}.{interface.__name__}" in supported
+                   for interface in interfaces):
+            raise TypeError("Authorizer must be a CDK authorizer object")
+        if key in self._authorizers:
+            raise ValueError(f"Authorizer key {key!r} is already registered")
+        self._authorizers[key] = authorizer
+
+    def set_default_authorizer(self, key: Optional[str]) -> None:
+        if key is None:
+            self._default_authorizer = None
+            return
+        if not isinstance(key, str):
+            raise TypeError("Default authorizer key must be a string or None")
+        if not key.strip():
+            raise ValueError("Default authorizer key must not be empty or whitespace")
+        if key not in self._authorizers:
+            raise KeyError(f"Authorizer key {key!r} is not registered")
+        self._default_authorizer = key
+
     @staticmethod
     def _add_resource(key: str, resource, registry: dict, resource_type: str) -> None:
         if not isinstance(key, str):
@@ -148,4 +184,6 @@ class LambdaApiConfig:
             custom_vpcs=dict(self._custom_vpcs),
             dynamodb_tables=dict(self._dynamodb_tables),
             s3_buckets=dict(self._s3_buckets),
+            authorizers=dict(self._authorizers),
+            default_authorizer=self._default_authorizer,
         )

{lambda_api_decorators_cdk-0.2.3 → lambda_api_decorators_cdk-0.4.0}/src/lambda_api_decorators_cdk/resource_builder.py

@@ -8,13 +8,16 @@ from aws_cdk import (
     aws_apigatewayv2_integrations as integrations,
     aws_lambda as lambda_,
     aws_s3 as s3,
-    aws_lambda_python_alpha as _lambda_python)
+    aws_lambda_python_alpha as _lambda_python,
+    Annotations)
 import hashlib
+import inspect
 import os
 from pathlib import Path
 from lambda_api_decorators_cdk import ast_helper
 from lambda_api_decorators_cdk.source_layout import SourceLayout
 from typing import Optional, List, Dict
+from constructs import Construct
 
 class ResourceBuilder():
     '''
@@ -42,10 +45,12 @@ class ResourceBuilder():
                 custom_vpcs = None, ####TODO
                 dynamodb_tables: Optional[Dict[str, dynamodb.ITable]] = None,
                 s3_buckets: Optional[Dict[str, s3.IBucket]] = None,
+                authorizers: Optional[Dict[str, object]] = None,
+                default_authorizer: Optional[str] = None,
                 ) -> 'ResourceBuilder':
     
         '''
-        Creates base instance of a Resource Builder. By default, there are no predetermined custom, common nor default settings with the exception of the following custom runtimes: python3.8, python3.9, python.10, python.11, python.12.
+        Creates base instance of a Resource Builder. By default, there are no predetermined custom, common nor default settings with the exception of the following custom runtimes: python3.8, python3.9, python3.10, python3.11, python3.12, python3.13, python3.14.
         You can optionally specify arguments (Keep in mind some of them are constructs of the aws_cdk toolkit) such as:
         @param default_runtime
         @param default_timeout
@@ -83,6 +88,8 @@ class ResourceBuilder():
         self.custom_vpcs = custom_vpcs if custom_vpcs is not None else {}
         self.dynamodb_tables = dynamodb_tables if dynamodb_tables is not None else {}
         self.s3_buckets = s3_buckets if s3_buckets is not None else {}
+        self.authorizers = authorizers if authorizers is not None else {}
+        self.default_authorizer = default_authorizer
         self._physical_dynamodb_tables = {}
         self._physical_s3_buckets = {}
 
@@ -91,6 +98,8 @@ class ResourceBuilder():
         self.custom_runtimes.update({'python3.10':lambda_.Runtime.PYTHON_3_10})
         self.custom_runtimes.update({'python3.11':lambda_.Runtime.PYTHON_3_11})
         self.custom_runtimes.update({'python3.12':lambda_.Runtime.PYTHON_3_12})
+        self.custom_runtimes.update({'python3.13':lambda_.Runtime.PYTHON_3_13})
+        self.custom_runtimes.update({'python3.14':lambda_.Runtime.PYTHON_3_14})
 
 
     #Setters
@@ -236,6 +245,7 @@ class ResourceBuilder():
         if print_tree:
             ast_helper.dump_tree(graph)
         self._prepare_layers(construct, graph, layer_sources)
+        self._emit_authorization_diagnostics(construct, graph)
         self.build_from_graph(
             construct, graph, api_resource, lambda_root, source_layout)
 
@@ -257,6 +267,7 @@ class ResourceBuilder():
         if print_tree:
             ast_helper.dump_tree(graph)
         self._prepare_layers(construct, graph, layer_sources)
+        self._emit_authorization_diagnostics(construct, graph)
         self.build_http_from_graph(
             construct, graph, http_api, lambda_root, source_layout)
 
@@ -493,6 +504,114 @@ class ResourceBuilder():
                 decorators[invocation.name] = value
         return decorators
 
+    @staticmethod
+    def _auth_override(method: ast_helper.Method):
+        """Return inherit, public, or an explicit logical authorizer key."""
+        for invocation in method.get_decorator_invocations():
+            if invocation.name == "public":
+                return ("public", None)
+            if invocation.name == "authorizer":
+                return ("authorizer", invocation.args[0])
+        return ("inherit", None)
+
+    def _effective_authorizer_key(self, method: ast_helper.Method):
+        state, key = self._auth_override(method)
+        if state == "public":
+            return None
+        return key if state == "authorizer" else self.default_authorizer
+
+    @staticmethod
+    def _implements_interface(authorizer, interface) -> bool:
+        return interface in getattr(authorizer, "__jsii_ifaces__", ())
+
+    def _resolve_authorizer(self, method: ast_helper.Method, family: str):
+        key = self._effective_authorizer_key(method)
+        if key is None:
+            return None
+        try:
+            authorizer = self.authorizers[key]
+        except KeyError:
+            raise KeyError(f"Authorizer key {key!r} is not registered") from None
+        interface = (
+            apigateway.IAuthorizer
+            if family == "REST"
+            else apigateway2.IHttpRouteAuthorizer
+        )
+        if not self._implements_interface(authorizer, interface):
+            raise TypeError(
+                f"Authorizer key {key!r} is not compatible with {family} APIs"
+            )
+        return authorizer
+
+    def _rest_method_options(self, method: ast_helper.Method):
+        authorizer = self._resolve_authorizer(method, "REST")
+        if authorizer is None:
+            return {
+                "authorizer": None,
+                "authorization_type": apigateway.AuthorizationType.NONE,
+            }
+        return {
+            "authorizer": authorizer,
+            "authorization_type": authorizer.authorization_type,
+        }
+
+    def _add_rest_method(self, resource, method, integration):
+        options = self._rest_method_options(method)
+        parameters = inspect.signature(resource.add_method).parameters.values()
+        accepts_options = any(
+            parameter.kind is inspect.Parameter.VAR_KEYWORD
+            or parameter.name == "authorization_type"
+            for parameter in parameters
+        )
+        if accepts_options:
+            return resource.add_method(method.get_method(), integration, **options)
+        # Preserve compatibility with narrow direct-builder test doubles and
+        # existing callers that expose only the historical two-argument shape.
+        return resource.add_method(method.get_method(), integration)
+
+    def _http_route_authorizer(self, method: ast_helper.Method):
+        authorizer = self._resolve_authorizer(method, "HTTP")
+        return authorizer if authorizer is not None else apigateway2.HttpNoneAuthorizer()
+
+    def _emit_authorization_diagnostics(self, construct, graph):
+        if not isinstance(construct, Construct):
+            return
+        if self.default_authorizer is None:
+            Annotations.of(construct).add_warning_v2(
+                "LAD_AUTH_PUBLIC_DEFAULT",
+                "LAD_AUTH_PUBLIC_DEFAULT: Routes without explicit authorization are public because no "
+                "default authorizer is configured.",
+            )
+
+        deviations = []
+
+        def visit(resource):
+            for method in resource.get_methods():
+                state, key = self._auth_override(method)
+                if self.default_authorizer is None:
+                    if state == "authorizer":
+                        deviations.append((resource.get_path(), method.get_method(), key))
+                elif state == "public":
+                    deviations.append((resource.get_path(), method.get_method(), "PUBLIC"))
+                elif state == "authorizer" and key != self.default_authorizer:
+                    deviations.append((resource.get_path(), method.get_method(), key))
+            for child in resource.get_connections():
+                visit(child)
+
+        visit(graph)
+        if not deviations:
+            return
+        deviations.sort(key=lambda item: (item[0], item[1]))
+        if self.default_authorizer is None:
+            heading = "Default authorizer: PUBLIC\n\nProtected routes:"
+        else:
+            heading = f"Default authorizer: {self.default_authorizer}\n\nOverrides:"
+        details = "\n".join(
+            f"    {method} {path}    {value}"
+            for path, method, value in deviations
+        )
+        Annotations.of(construct).add_info(f"{heading}\n{details}")
+
     @staticmethod
     def _physical_resource_id(resource_type: str, physical_name: str) -> str:
         """Create a stable, collision-safe construct ID for an imported resource."""
@@ -734,7 +853,8 @@ class ResourceBuilder():
             for method in graph.get_methods():
                 lbda = self._build_discovered_lambda(
                     construct, method, lambda_root, source_layout)
-                new_resource.add_method(method.get_method(), apigateway.LambdaIntegration(lbda))
+                self._add_rest_method(
+                    new_resource, method, apigateway.LambdaIntegration(lbda))
         else:
             #We can get a skip from /something to /something/one/two/method, so resources with no methods "one" and "two" should be created
             new_api_resources = path[len(api_resource.path):].lstrip('/').split('/')
@@ -746,7 +866,8 @@ class ResourceBuilder():
             for method in graph.get_methods():
                 lbda = self._build_discovered_lambda(
                     construct, method, lambda_root, source_layout)
-                new_resource.add_method(method.get_method(), apigateway.LambdaIntegration(lbda))
+                self._add_rest_method(
+                    new_resource, method, apigateway.LambdaIntegration(lbda))
 
         for node in graph.get_connections():
             self.build_from_graph(
@@ -776,7 +897,8 @@ class ResourceBuilder():
                 http_api.add_routes(
                     path='/',
                     methods=[method_mapping[method.get_method()]],
-                    integration= api_lbda_integration
+                    integration=api_lbda_integration,
+                    authorizer=self._http_route_authorizer(method),
                 )
         else:
             for method in graph.get_methods():
@@ -786,7 +908,8 @@ class ResourceBuilder():
                 http_api.add_routes(
                     path=path,
                     methods=[method_mapping[method.get_method()]],
-                    integration= api_lbda_integration
+                    integration=api_lbda_integration,
+                    authorizer=self._http_route_authorizer(method),
                 )
 
         for node in graph.get_connections():

{lambda_api_decorators_cdk-0.2.3 → lambda_api_decorators_cdk-0.4.0}/src/lambda_api_decorators_cdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lambda-api-decorators-cdk
-Version: 0.2.3
+Version: 0.4.0
 Summary: AWS CDK integration for Lambda API Decorators. Generate AWS Lambda and API Gateway infrastructure from decorated Python handlers.
 Author: Mateo Marcos, Emanuel Arguinarena, Lucas Picchi
 License: MIT License
@@ -34,11 +34,12 @@ Classifier: Framework :: AWS CDK :: 2
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: Software Development :: Build Tools
 Classifier: License :: OSI Approved :: MIT License
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
-Requires-Python: >=3.9
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: aws-cdk.aws-lambda-python-alpha

{lambda_api_decorators_cdk-0.2.3 → lambda_api_decorators_cdk-0.4.0}/src/lambda_api_decorators_cdk.egg-info/SOURCES.txt

@@ -4,6 +4,7 @@ LICENSE
 README.md
 pyproject.toml
 .github/workflows/release.yml
+.github/workflows/tests.yml
 src/lambda_api_decorators_cdk/__init__.py
 src/lambda_api_decorators_cdk/api_type.py
 src/lambda_api_decorators_cdk/ast_helper.py
@@ -21,6 +22,13 @@ src/lambda_api_decorators_cdk.egg-info/top_level.txt
 tests/conftest.py
 tests/test_ast_decorator_invocations.py
 tests/test_ast_helper.py
+tests/test_auth_ast.py
+tests/test_authorization_diagnostics.py
+tests/test_authorization_http.py
+tests/test_authorization_lambda_api.py
+tests/test_authorization_resolution.py
+tests/test_authorization_rest.py
+tests/test_authorizer_config.py
 tests/test_http_builder.py
 tests/test_lambda_api.py
 tests/test_lambda_api_config.py
@@ -29,6 +37,7 @@ tests/test_layer_autodiscovery.py
 tests/test_packaging_current.py
 tests/test_permission_resolution.py
 tests/test_public_api.py
+tests/test_python_compatibility.py
 tests/test_resource_builder_options.py
 tests/test_resource_builder_state.py
 tests/test_resource_graph.py

{lambda_api_decorators_cdk-0.2.3 → lambda_api_decorators_cdk-0.4.0}/src/lambda_api_decorators_cdk.egg-info/scm_file_list.json

@@ -1,6 +1,7 @@
 {
   "files": [
     ".github/workflows/release.yml",
+    ".github/workflows/tests.yml",
     ".gitignore",
     "AGENTS.md",
     "LICENSE",
@@ -16,6 +17,13 @@
     "tests/conftest.py",
     "tests/test_ast_decorator_invocations.py",
     "tests/test_ast_helper.py",
+    "tests/test_auth_ast.py",
+    "tests/test_authorization_diagnostics.py",
+    "tests/test_authorization_http.py",
+    "tests/test_authorization_lambda_api.py",
+    "tests/test_authorization_resolution.py",
+    "tests/test_authorization_rest.py",
+    "tests/test_authorizer_config.py",
     "tests/test_http_builder.py",
     "tests/test_lambda_api.py",
     "tests/test_lambda_api_config.py",
@@ -24,6 +32,7 @@
     "tests/test_packaging_current.py",
     "tests/test_permission_resolution.py",
     "tests/test_public_api.py",
+    "tests/test_python_compatibility.py",
     "tests/test_resource_builder_options.py",
     "tests/test_resource_builder_state.py",
     "tests/test_resource_graph.py",

lambda_api_decorators_cdk-0.4.0/src/lambda_api_decorators_cdk.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "0.4.0",
+  "distance": 0,
+  "node": "g3fbca58ba36e8115f2c66ea9a95a34bebba16615",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-09-15"
+}

lambda_api_decorators_cdk-0.4.0/tests/test_auth_ast.py

@@ -0,0 +1,122 @@
+import ast
+
+import pytest
+
+from conftest import decorator_invocations
+from lambda_api_decorators_cdk.ast_helper import get_file_nodes
+
+
+def parse_methods(source):
+    resources = get_file_nodes(ast.parse(source), "handler.py", "lambdas")
+    return [method for resource in resources for method in resource.get_methods()]
+
+
+def parse_method(source):
+    return parse_methods(source)[0]
+
+
+def test_authorizer_invocation_is_captured_losslessly():
+    method = parse_method(
+        '@GET("/admin")\n@authorizer(" users ")\ndef handler(event, context): pass\n'
+    )
+    assert decorator_invocations(method) == [
+        ("GET", ("/admin",), ()),
+        ("authorizer", (" users ",), ()),
+    ]
+
+
+@pytest.mark.parametrize(
+    "decorator",
+    [
+        "authorizer()",
+        'authorizer("users", "extra")',
+        'authorizer(key="users")',
+        "authorizer(123)",
+        'authorizer("")',
+        'authorizer("   ")',
+        "authorizer(AUTHORIZER_KEY)",
+        "authorizer(get_key())",
+        'authorizer(f"{tenant}-users")',
+    ],
+)
+def test_invalid_authorizer_syntax_fails_during_source_interpretation(decorator):
+    with pytest.raises((TypeError, ValueError), match="(?i)authorizer"):
+        parse_method(
+            f'@GET("/admin")\n@{decorator}\ndef handler(event, context): pass\n'
+        )
+
+
+def test_bare_public_is_captured_and_called_public_is_rejected():
+    method = parse_method(
+        '@GET("/health")\n@public\ndef handler(event, context): pass\n'
+    )
+    assert decorator_invocations(method) == [
+        ("GET", ("/health",), ()),
+        ("public", (), ()),
+    ]
+    with pytest.raises((TypeError, ValueError), match="(?i)public"):
+        parse_method(
+            '@GET("/health")\n@public()\ndef handler(event, context): pass\n'
+        )
+
+
+@pytest.mark.parametrize(
+    "decorators,expected",
+    [
+        (
+            '@GET("/admin")\n@authorizer("admins")',
+            [("GET", ("/admin",), ()), ("authorizer", ("admins",), ())],
+        ),
+        (
+            '@authorizer("admins")\n@GET("/admin")',
+            [("authorizer", ("admins",), ()), ("GET", ("/admin",), ())],
+        ),
+        (
+            '@GET("/health")\n@public',
+            [("GET", ("/health",), ()), ("public", (), ())],
+        ),
+        (
+            '@public\n@GET("/health")',
+            [("public", (), ()), ("GET", ("/health",), ())],
+        ),
+    ],
+)
+def test_auth_metadata_preserves_top_to_bottom_lexical_order(decorators, expected):
+    method = parse_method(f"{decorators}\ndef handler(event, context): pass\n")
+    assert decorator_invocations(method) == expected
+
+
+@pytest.mark.parametrize(
+    "decorators",
+    [
+        '@public\n@authorizer("users")',
+        '@authorizer("users")\n@public',
+        "@public\n@public",
+        '@authorizer("users")\n@authorizer("users")',
+        '@authorizer("users")\n@authorizer("admins")',
+    ],
+)
+def test_aggregate_auth_conflicts_are_rejected(decorators):
+    with pytest.raises(ValueError, match="(?i)(auth|public|conflict|repeat)"):
+        parse_method(
+            f'@GET("/")\n{decorators}\ndef handler(event, context): pass\n'
+        )
+
+
+@pytest.mark.parametrize("auth", ['@authorizer("users")', "@public"])
+def test_auth_on_multi_route_handler_is_rejected_as_ambiguous(auth):
+    with pytest.raises(ValueError, match="(?i)(ambiguous|multiple|route|auth)"):
+        parse_methods(
+            f'@GET("/a")\n@POST("/b")\n{auth}\n'
+            "def handler(event, context): pass\n"
+        )
+
+
+def test_multi_route_handler_without_auth_remains_supported():
+    methods = parse_methods(
+        '@GET("/a")\n@POST("/b")\ndef handler(event, context): pass\n'
+    )
+    assert [(method.get_method(), method.get_path_to_file()) for method in methods] == [
+        ("GET", "lambdas"),
+        ("POST", "lambdas"),
+    ]