-
Notifications
You must be signed in to change notification settings - Fork 0
/
authorizer.js
78 lines (72 loc) · 2.16 KB
/
authorizer.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
const aws = require('aws-sdk');
const UsersTableName = process.env.dynamodb_table_name;
const UsersIndexName = process.env.dynamodb_index_name;
const dynamoDB = new aws.DynamoDB.DocumentClient();
function generatePolicy(principalId, effect, userId) {
const policy = {
principalId,
policyDocument: {
Version: '2012-10-17',
Statement: [{
Action: 'execute-api:Invoke',
Effect: effect,
Resource: '*'
}]
},
context: {
user_id: userId
}
};
return policy;
}
async function validateToken(userToken) {
const token = userToken.split('Bearer ')[1];
const params = {
TableName: UsersTableName,
IndexName: UsersIndexName,
KeyConditionExpression: '#token = :token',
ExpressionAttributeNames: {
'#token': 'bearer_token'
},
ExpressionAttributeValues: {
':token': token
}
};
const data = await dynamoDB.query(params).promise();
return data.Items[0];
}
async function validateTokenStaging(userToken) {
const token = userToken.split('Bearer ')[1];
const params = {
TableName: `Dev_${UsersTableName}`,
IndexName: UsersIndexName,
KeyConditionExpression: '#token = :token',
ExpressionAttributeNames: {
'#token': 'bearer_token'
},
ExpressionAttributeValues: {
':token': token
}
};
const data = await dynamoDB.query(params).promise();
return data.Items[0];
}
exports.handler = async (event) => {
if (event.methodArn && event.methodArn.includes('staging')) {
const userToken = event.authorizationToken;
const user = await validateTokenStaging(userToken);
if (user && user.user_verifications.email) {
return generatePolicy('user', 'Allow', user.user_id);
} else { // eslint-disable-line no-else-return
return generatePolicy('user', 'Deny', null);
}
} else { // eslint-disable-line no-else-return
const userToken = event.authorizationToken;
const user = await validateToken(userToken);
if (user && user.user_verifications.email) {
return generatePolicy('user', 'Allow', user.user_id);
} else { // eslint-disable-line no-else-return
return generatePolicy('user', 'Deny', null);
}
}
};