Class: Foobara::AWS::Handler

Inherits:
Object
  • Object
show all
Defined in:
lib/foobara/aws/handler.rb

Overview

Adapts an API Gateway v2 payload to what a Rack connector wants, and the authorizer's verified claims to the caller.

Constant Summary collapse

CLAIMS_PATH =

The claims a REQUEST authorizer returned, in SIMPLE format. API Gateway forwards only strings, so everything here is a string.

%w[requestContext authorizer lambda].freeze

Instance Method Summary collapse

Constructor Details

#initialize(connector, viewer: nil, dev_identity: false) ⇒ Handler

viewer receives the claims hash (empty for an anonymous caller on a public command) and returns whatever the application wants as its caller — a Struct, a model, anything. Return nil for "nobody".

dev_identity enables the X-Dev-Sub / X-Dev-Name escape hatch for local work. It defaults to OFF and must stay off in a deployed unit: those headers are unauthenticated, so honouring them would let any caller name themselves — including on the commands the authorizer just gated, and on the public-but-viewer-aware ones it lets through anonymously.



68
69
70
71
72
 
# File 'lib/foobara/aws/handler.rb', line 68

def initialize(connector, viewer: nil, dev_identity: false)
  @connector = connector
  @viewer = viewer
  @dev_identity = dev_identity
end

Instance Method Details

#call(event, _context = nil) ⇒ Object

Identity is established BEFORE the connector runs and cleared after, whatever happens — a leaked caller would be served to whoever reuses this execution environment next, which is the worst possible bug to have.



77
78
79
80
81
82
83
84
 
# File 'lib/foobara/aws/handler.rb', line 77

def call(event, _context = nil)
  env = rack_env(event)
  AWS.current_caller = identify(event, env)

  respond(@connector.call(env))
ensure
  AWS.current_caller = nil
end

#identify(event, env = nil) ⇒ Object

What the authorizer verified, or the dev headers when explicitly allowed. Public so an application can reuse it for its own middleware.



88
89
90
91
92
93
94
95
 
# File 'lib/foobara/aws/handler.rb', line 88

def identify(event, env = nil)
  claims = event.dig(*CLAIMS_PATH) || {}
  claims = dev_identity(env || rack_env(event)) || {} if claims.empty? && @dev_identity
  return nil if claims.empty?

  builder = @viewer || AWS.caller_builder
  builder ? builder.call(claims) : claims
end