feat(data-classes): AppSync Lambda authorizer event

[michaelbrewer]

Issue #, if available:

• Related to https://github.com/awslabs/aws-lambda-powertools-python/issues/543

Description of changes:

Change:

• Add test fixtures for request and response
• Add Request event source
• Add correlation_id APPSYNC_AUTHORIZER
• Add Response helper
• Add docs

Example usage:

from typing import Dict

from aws_lambda_powertools.logging import correlation_paths
from aws_lambda_powertools.logging.logger import Logger
from aws_lambda_powertools.utilities.data_classes.appsync_authorizer_event import (
    AppSyncAuthorizerEvent,
    AppSyncAuthorizerResponse,
)
from aws_lambda_powertools.utilities.data_classes.event_source import event_source

logger = Logger()


def get_user_by_token(token: str):
    """Look a user by token"""


@logger.inject_lambda_context(correlation_id_path=correlation_paths.APPSYNC_AUTHORIZER)
@event_source(data_class=AppSyncAuthorizerEvent)
def lambda_handler(event: AppSyncAuthorizerEvent, context) -> Dict:
    user = get_user_by_token(event.authorization_token)

    if not user:
        # No user found, return not authorized
        return AppSyncAuthorizerResponse().to_dict()

    return AppSyncAuthorizerResponse(
        authorize=True,
        resolver_context={"id": user.id},
        # Only allow admins to delete events
        deny_fields=None if user.is_admin else ["Mutation.deleteEvent"],
    ).asdict()

Checklist

• Meet tenets criteria
• Update tests
• Update docs
• PR title follows conventional commit semantics

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[codecov-commenter]

Codecov Report

Merging #610 (18c09aa) into develop (f7cd398) will increase coverage by 0.00%.
The diff coverage is 100.00%.

@@           Coverage Diff            @@
##           develop     #610   +/-   ##
========================================
  Coverage    99.95%   99.95%           
========================================
  Files          113      114    +1     
  Lines         4535     4579   +44     
  Branches       246      249    +3     
========================================
+ Hits          4533     4577   +44     
  Partials         2        2           

Impacted Files	Coverage Δ
aws_lambda_powertools/logging/correlation_paths.py	100.00% <100.00%> (ø)
...utilities/data_classes/appsync_authorizer_event.py	100.00% <100.00%> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update f7cd398...18c09aa. Read the comment docs.

[michaelbrewer]

@heitorlessa - i am not sure if fluent apis is a thing in Python? Maybe just optionals?

[gwlester]

How does this tie in with

app.resolve(event, context)

[michaelbrewer]

How does this tie in with

app.resolve(event, context)

--

@gwlester - this applies to AppSync only. API gateway use case would be based on how this is implemented.

[heitorlessa]

Looks good! Some minor changes. Should we have a method to ease adding a fully qualified field name?

Because we're mimicking the data classes, I think we can set some good defaults, correct the constructor, and simply get rid of self._data.

If we do add a method to add a fully qualified field, we can make a nice experience in the AppSync Handler since we would know both API ID and Region to construct the ARN while also making it standalone ;)

    def __init__(
        self,
        authorize: bool = False,
        max_age: int = 300,
        resolver_context: Optional[Dict[str, Any]] = None,
        deny_fields: Optional[List[str]] = None,
    ):
        self.authorize = authorize
    	self.max_age = max_age
        self.resolver_context = resolver_context or {}
        self.deny_fields = deny_fields or []
        
   def to_dict(self) -> dict:
       """Return the response as dict"""
       return {
           "isAuthorized": self.authorize,
           "resolverContext": json.dumps(self.resolver_context),
           "ttlOverride": self.max_age,
           "deniedFields": self.deny_fields
       }