Bbao modulized msal

.gitignore

@@ -3,3 +3,5 @@ dist
 .npmrc
 *.swp
 .DS_Store
+yarn.lock
+package-lock.json

auth-policy.js

@@ -289,7 +289,7 @@ AuthPolicy.prototype = (function() {
      * @method build
      * @return {Object} The policy object that can be serialized to JSON.
      */
-    build: function() {
+    build: function(context = {}) {
       if ((!this.allowMethods || this.allowMethods.length === 0) &&
         (!this.denyMethods || this.denyMethods.length === 0)) {
         throw new Error("No statements defined for the policy");
@@ -306,6 +306,10 @@ AuthPolicy.prototype = (function() {
 
       policy.policyDocument = doc;
 
+      // context which can be passed to the backend
+      // see https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-lambda-authorizer-output.html
+      policy.context = context;
+
       return policy;
     }
   };

index.js

@@ -1,80 +1,49 @@
 /******************************************************/
 // Okta lambda authorizer for Amazon API Gateway
 
-require('dotenv').config();
+require("dotenv").config();
 
-const OktaJwtVerifier = require('@okta/jwt-verifier');
+const VerifyToken = require("./verify-token.js");
 
-/******************************************************/
-
-const oktaJwtVerifier = new OktaJwtVerifier({
-  issuer: process.env.ISSUER, // required
-  clientId: process.env.CLIENT_ID, // required
-  assertClaims: {
-    aud: process.env.AUDIENCE
-  }
-});
-
-const AuthPolicy = require('./auth-policy');
-
-/******************************************************/
-
-exports.handler = function(event, context) {
-
-  var arr = event.authorizationToken.split(" ");
+const AuthPolicy = require("./auth-policy");
 
-  var access_token = arr[1];
 
-  oktaJwtVerifier.verifyAccessToken(access_token)
-  .then(jwt => {
-    // the token is valid (per definition of 'valid' above)
-    console.log(jwt.claims);
 
-    var claims = jwt.claims;
+const allowAccess = (event, email) => {
+  var apiOptions = {};
+  const arnParts = event.methodArn.split(":");
+  const apiGatewayArnPart = arnParts[5].split("/");
+  const awsAccountId = arnParts[4];
+  apiOptions.region = arnParts[3];
+  apiOptions.restApiId = apiGatewayArnPart[0];
+  apiOptions.stage = apiGatewayArnPart[1];
+  const method = apiGatewayArnPart[2];
+  var resource = "/"; // root resource
 
-    console.log('request principal: ' + claims);
-
-    var apiOptions = {};
-    const arnParts = event.methodArn.split(':');
-    const apiGatewayArnPart = arnParts[5].split('/');
-    const awsAccountId = arnParts[4];
-    apiOptions.region = arnParts[3];
-    apiOptions.restApiId = apiGatewayArnPart[0];
-    apiOptions.stage = apiGatewayArnPart[1];
-    const method = apiGatewayArnPart[2];
-    var resource = '/'; // root resource
+  if (apiGatewayArnPart[3]) {
+    resource += apiGatewayArnPart[3];
+  }
 
-    if (apiGatewayArnPart[3]) {
-      resource += apiGatewayArnPart[3];
-    }
+  const policy = new AuthPolicy(
+    VerifyToken.transpileToComEmail(email),
+    awsAccountId,
+    apiOptions
+  );
 
-    var policy = new AuthPolicy(claims.sub, awsAccountId, apiOptions);
+  /*
+    removed scp check, see commit log for details
+  */
 
-    /*
-      example scope based authorization
+  policy.allowAllMethods();
 
-      to allow full access:
-        policy.allowAllMethods()
-    */
+  return policy;
+};
 
-    if (claims.scp.includes('api:read')) {
-      policy.allowMethod(AuthPolicy.HttpVerb.GET, "*");
-    }
-    else if (claims.scp.includes('api:write')) {
-      policy.allowMethod(AuthPolicy.HttpVerb.POST, "*");
-      policy.allowMethod(AuthPolicy.HttpVerb.PUT, "*");
-      policy.allowMethod(AuthPolicy.HttpVerb.PATCH, "*");
-      policy.allowMethod(AuthPolicy.HttpVerb.DELETE, "*");
-    }
+exports.handler = function (event, context) {
+  const arr = event.authorizationToken.split(" ");
 
-    policy.allowMethod(AuthPolicy.HttpVerb.HEAD, "*");
-    policy.allowMethod(AuthPolicy.HttpVerb.OPTIONS, "*");
+  const accessToken = arr[1];
 
-    return context.succeed(policy.build());
-  })
-  .catch(err => {
+  return VerifyToken.verifyAccessToken(accessToken, event, context, allowAccess);
+};
 
-    console.log(err)
-    return context.fail('Unauthorized');
-  });
-}