feat(data-classes): authorizer for http api and rest api

[michaelbrewer]

Issue #, if available:

• Add Support for API Gateway Lambda authorizer powertools-lambda#33

Description of changes:

Changes / TODO

• http api request payload v2.0
• http api simple response builder (payload v2.0 only)
• method / route arn parser and buildinger
• client cert support for rest api and http api
• rest api request payment / http api payload v1.0
• rest api auth policy builder / http api auth policy builder
• Basic docs

Examples

Rest api example for a request type event and build iam policy with context info:

from aws_lambda_powertools.utilities.data_classes import event_source
from aws_lambda_powertools.utilities.data_classes.api_gateway_authorizer_event import (
    APIGatewayAuthorizerRequestEvent,
    APIGatewayAuthorizerResponse,
    HttpVerb,
)


def get_user_by_token(token):
    return {}


@event_source(data_class=APIGatewayAuthorizerRequestEvent)
def handler(event: APIGatewayAuthorizerRequestEvent, context):
    user = get_user_by_token(event.get_header_value("Authorization"))

    arn = event.parsed_arn
    builder = APIGatewayAuthorizerResponse("user", arn.region, arn.aws_account_id, arn.api_id, arn.stage)
    if user is None:
        # No user was found, so we return not authorized
        builder.deny_all_methods()
        return builder.asdict()

    # Found the user and setting the details in the context
    builder.context = user

    # Conditional IAM Policy
    if user.get("isAdmin", False):
        builder.allow_all_methods()
    else:
        builder.allow_method(HttpVerb.GET, "/user-profile")

    return builder.asdict()

Rest api with a token request event and a simple allow all or deny all

from aws_lambda_powertools.utilities.data_classes import event_source
from aws_lambda_powertools.utilities.data_classes.api_gateway_authorizer_event import (
    APIGatewayAuthorizerTokenEvent,
    APIGatewayAuthorizerResponse,
)


@event_source(data_class=APIGatewayAuthorizerTokenEvent)
def handler(event: APIGatewayAuthorizerTokenEvent, context):
    arn = event.parsed_arn
    builder = APIGatewayAuthorizerResponse("user", arn.region, arn.aws_account_id, arn.api_id, arn.stage)
    if event.authorization_token == "42":
        builder.allow_all_methods()
    else:
        builder.deny_all_methods()
    return builder.asdict()

Http api payload version 2 example of a http api authorizer checks it the Authorization header is "foo"

NOTE: The use of .asdict()

from aws_lambda_powertools.utilities.data_classes import event_source
from aws_lambda_powertools.utilities.data_classes.api_gateway_authorizer_event import (
    APIGatewayAuthorizerEventV2,
    APIGatewayAuthorizerResponseV2,
)


@event_source(data_class=APIGatewayAuthorizerEventV2)
def handler(event: APIGatewayAuthorizerEventV2, context):
    is_authorized = event.get_header_value("Authorization") == "foo"
    return APIGatewayAuthorizerResponseV2(authorize=is_authorized).asdict()

Http api payload version 2 A more complicated example getting the user details by an authorization header and setting the context

from aws_lambda_powertools.utilities.data_classes import event_source
from aws_lambda_powertools.utilities.data_classes.api_gateway_authorizer_event import (
    APIGatewayAuthorizerEventV2,
    APIGatewayAuthorizerResponseV2,
)


def get_user_by_token(token):
    ...


@event_source(data_class=APIGatewayAuthorizerEventV2)
def handler(event: APIGatewayAuthorizerEventV2, context):
    user = get_user_by_token(event.get_header_value("Authorization"))

    if user is None:
        # No user was found, so we return not authorized
        return APIGatewayAuthorizerResponseV2().asdict()

    # Found the user and setting the details in the context
    return APIGatewayAuthorizerResponseV2(authorize=True, context=user).asdict()

Checklist

• Meet tenets criteria
• Update tests
• Update docs
• PR title follows conventional commit semantics

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[codecov-commenter]

Codecov Report

Merging #620 (97c17c9) into develop (16563bb) will increase coverage by 0.00%.
The diff coverage is 100.00%.

@@            Coverage Diff            @@
##           develop     #620    +/-   ##
=========================================
  Coverage    99.95%   99.95%            
=========================================
  Files          114      115     +1     
  Lines         4599     4828   +229     
  Branches       254      265    +11     
=========================================
+ Hits          4597     4826   +229     
  Partials         2        2            

Impacted Files	Coverage Δ
...ities/data_classes/api_gateway_authorizer_event.py	100.00% <100.00%> (ø)
.../utilities/data_classes/api_gateway_proxy_event.py	100.00% <100.00%> (ø)
...lambda_powertools/utilities/data_classes/common.py	100.00% <100.00%> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 16563bb...97c17c9. Read the comment docs.

[michaelbrewer]

@heitorlessa - do you know of any other sources for documentation on http api authorizers payload v2

[heitorlessa]

@sthulb could you have a look at the ARN Parser as it's the only area I'm in doubt, please? Nvm, it's the actual API GW ARN generated by API GW, that piece is stable

[heitorlessa]

One minor suggested change on Authorizer Response class name for v2, and could you create a new section for HTTP API authorizers in the data class docs?

That will make it faster to release it tomorrow, pretty plz ;)

[michaelbrewer]

@heitorlessa Done and added in a policy builder based on the blueprint.

[heitorlessa]

Thanks a lot for making the other improvements. Two tiny changes to improve UX and we're good to go!

[heitorlessa]

ooooh shiny!

[heitorlessa]

Thank you so much Mike! I'm merging as-is, and fixing some typos and the allow/deny_all_routes to take a method param w/ ALL by default.