Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Refactor WebSocket Authorizer into universal one #53

Merged
merged 2 commits into from
Apr 7, 2024
Merged

Refactor WebSocket Authorizer into universal one #53

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
13d5f93
refactor authorizer to be a universal one
fogfish Mar 23, 2024
3f48639
align CDK constuct for all brokers
fogfish Apr 7, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
147 changes: 132 additions & 15 deletions broker/websocket/awscdk.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,10 @@ import (
"github.com/aws/aws-cdk-go/awscdk/v2/awsapigatewayv2"
authorizers "github.com/aws/aws-cdk-go/awscdk/v2/awsapigatewayv2authorizers"
integrations "github.com/aws/aws-cdk-go/awscdk/v2/awsapigatewayv2integrations"
"github.com/aws/aws-cdk-go/awscdk/v2/awscertificatemanager"
"github.com/aws/aws-cdk-go/awscdk/v2/awslambda"
"github.com/aws/aws-cdk-go/awscdk/v2/awsroute53"
"github.com/aws/aws-cdk-go/awscdk/v2/awsroute53targets"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/constructs-go/constructs/v10"
"github.com/aws/jsii-runtime-go"
Expand Down Expand Up @@ -91,6 +94,8 @@ type Broker struct {
constructs.Construct
Gateway awsapigatewayv2.WebSocketApi
Authorizer awsapigatewayv2.IWebSocketRouteAuthorizer
domain awsapigatewayv2.DomainName
dns awsroute53.ARecord
acc int
}

Expand All @@ -100,19 +105,28 @@ func NewBroker(scope constructs.Construct, id *string, props *BrokerProps) *Brok
return broker
}

func (broker *Broker) NewAuthorizerApiKey(access, secret string) awsapigatewayv2.IWebSocketRouteAuthorizer {
type AuthorizerApiKeyProps struct {
Access string
Secret string
}

func (broker *Broker) NewAuthorizerApiKey(props *AuthorizerApiKeyProps) awsapigatewayv2.IWebSocketRouteAuthorizer {
if broker.Gateway != nil {
panic("Authorizer MUST be defined before the gateway is instantiated.")
}

if props.Access == "" || props.Secret == "" {
panic("Authorizer MUST define access and secret api keys")
}

handler := scud.NewFunctionGo(broker.Construct, jsii.String("Authorizer"),
&scud.FunctionGoProps{
SourceCodePackage: "github.com/fogfish/swarm",
SourceCodeLambda: "broker/websocket/lambda/authkey",
SourceCodeLambda: "broker/websocket/lambda/auth",
FunctionProps: &awslambda.FunctionProps{
Environment: &map[string]*string{
"CONFIG_SWARM_WS_AUTHORIZER_ACCESS": jsii.String(secret),
"CONFIG_SWARM_WS_AUTHORIZER_SECRET": jsii.String(secret),
"CONFIG_SWARM_WS_AUTHORIZER_ACCESS": jsii.String(props.Access),
"CONFIG_SWARM_WS_AUTHORIZER_SECRET": jsii.String(props.Secret),
},
},
},
Expand All @@ -129,27 +143,84 @@ func (broker *Broker) NewAuthorizerApiKey(access, secret string) awsapigatewayv2
return broker.Authorizer
}

func (broker *Broker) NewAuthorizerJWT(issuer, audience string) awsapigatewayv2.IWebSocketRouteAuthorizer {
type AuthorizerJwtProps struct {
Issuer string
Audience string
}

func (broker *Broker) NewAuthorizerJwt(props *AuthorizerJwtProps) awsapigatewayv2.IWebSocketRouteAuthorizer {
if broker.Gateway != nil {
panic("Authorizer MUST be defined before the gateway is instantiated.")
}

if !strings.HasPrefix(props.Issuer, "https://") {
panic("Issuer URL MUST start with https://")
}

if !strings.HasSuffix(props.Issuer, "/") {
props.Issuer += "/"
}

handler := scud.NewFunctionGo(broker.Construct, jsii.String("Authorizer"),
&scud.FunctionGoProps{
SourceCodePackage: "github.com/fogfish/swarm",
SourceCodeLambda: "broker/websocket/lambda/auth",
FunctionProps: &awslambda.FunctionProps{
Environment: &map[string]*string{
"CONFIG_SWARM_WS_AUTHORIZER_ISS": jsii.String(props.Issuer),
"CONFIG_SWARM_WS_AUTHORIZER_AUD": jsii.String(props.Audience),
},
},
},
)

broker.Authorizer = authorizers.NewWebSocketLambdaAuthorizer(
jsii.String("default"),
handler,
&authorizers.WebSocketLambdaAuthorizerProps{
IdentitySource: jsii.Strings("route.request.querystring.token"),
},
)

return broker.Authorizer
}

type AuthorizerUniversalProps struct {
AuthorizerApiKey *AuthorizerApiKeyProps
AuthorizerJwt *AuthorizerJwtProps
}

func (broker *Broker) NewAuthorizerUniversal(props *AuthorizerUniversalProps) awsapigatewayv2.IWebSocketRouteAuthorizer {
if broker.Gateway != nil {
panic("Authorizer MUST be defined before the gateway is instantiated.")
}

if !strings.HasPrefix(issuer, "https://") {
if props.AuthorizerApiKey == nil || props.AuthorizerJwt == nil {
panic("Universal Authorizer requires definition of all members")
}

if props.AuthorizerApiKey.Access == "" || props.AuthorizerApiKey.Secret == "" {
panic("Authorizer MUST define access and secret api keys")
}

if !strings.HasPrefix(props.AuthorizerJwt.Issuer, "https://") {
panic("Issuer URL MUST start with https://")
}

if !strings.HasSuffix(issuer, "/") {
issuer += "/"
if !strings.HasSuffix(props.AuthorizerJwt.Issuer, "/") {
props.AuthorizerJwt.Issuer += "/"
}

handler := scud.NewFunctionGo(broker.Construct, jsii.String("Authorizer"),
&scud.FunctionGoProps{
SourceCodePackage: "github.com/fogfish/swarm",
SourceCodeLambda: "broker/websocket/lambda/authjwt",
SourceCodeLambda: "broker/websocket/lambda/auth",
FunctionProps: &awslambda.FunctionProps{
Environment: &map[string]*string{
"CONFIG_SWARM_WS_AUTHORIZER_ISS": jsii.String(issuer),
"CONFIG_SWARM_WS_AUTHORIZER_AUD": jsii.String(audience),
"CONFIG_SWARM_WS_AUTHORIZER_ACCESS": jsii.String(props.AuthorizerApiKey.Access),
"CONFIG_SWARM_WS_AUTHORIZER_SECRET": jsii.String(props.AuthorizerApiKey.Secret),
"CONFIG_SWARM_WS_AUTHORIZER_ISS": jsii.String(props.AuthorizerJwt.Issuer),
"CONFIG_SWARM_WS_AUTHORIZER_AUD": jsii.String(props.AuthorizerJwt.Audience),
},
},
},
Expand All @@ -169,6 +240,8 @@ func (broker *Broker) NewAuthorizerJWT(issuer, audience string) awsapigatewayv2.
type WebSocketApiProps struct {
*awsapigatewayv2.WebSocketApiProps
Throttle *awsapigatewayv2.ThrottleSettings
Host *string
TlsArn *string
}

func (broker *Broker) NewGateway(props *WebSocketApiProps) awsapigatewayv2.WebSocketApi {
Expand Down Expand Up @@ -196,18 +269,62 @@ func (broker *Broker) NewGateway(props *WebSocketApiProps) awsapigatewayv2.WebSo

broker.Gateway = awsapigatewayv2.NewWebSocketApi(broker.Construct, jsii.String("Gateway"), props.WebSocketApiProps)

var domain *awsapigatewayv2.DomainMappingOptions
if props.Host != nil && props.TlsArn != nil {
broker.domain = awsapigatewayv2.NewDomainName(broker.Construct, jsii.String("DomainName"),
&awsapigatewayv2.DomainNameProps{
EndpointType: awsapigatewayv2.EndpointType_REGIONAL,
DomainName: props.Host,
Certificate: awscertificatemanager.Certificate_FromCertificateArn(broker.Construct, jsii.String("X509"), props.TlsArn),
},
)

domain = &awsapigatewayv2.DomainMappingOptions{
DomainName: broker.domain,
}
}

awsapigatewayv2.NewWebSocketStage(broker.Construct, jsii.String("Stage"),
&awsapigatewayv2.WebSocketStageProps{
AutoDeploy: jsii.Bool(true),
StageName: jsii.String(stage),
Throttle: props.Throttle,
WebSocketApi: broker.Gateway,
AutoDeploy: jsii.Bool(true),
StageName: jsii.String(stage),
Throttle: props.Throttle,
WebSocketApi: broker.Gateway,
DomainMapping: domain,
},
)

if props.Host != nil && props.TlsArn != nil {
broker.createRoute53(*props.Host)
}

return broker.Gateway
}

func (broker *Broker) createRoute53(host string) {
domain := strings.Join(strings.Split(host, ".")[1:], ".")
zone := awsroute53.HostedZone_FromLookup(broker.Construct, jsii.String("HZone"),
&awsroute53.HostedZoneProviderProps{
DomainName: jsii.String(domain),
},
)

broker.dns = awsroute53.NewARecord(broker.Construct, jsii.String("ARecord"),
&awsroute53.ARecordProps{
RecordName: jsii.String(host),
Target: awsroute53.RecordTarget_FromAlias(
awsroute53targets.NewApiGatewayv2DomainProperties(
broker.domain.RegionalDomainName(),
broker.domain.RegionalHostedZoneId(),
),
),
Ttl: awscdk.Duration_Seconds(jsii.Number(60)),
Zone: zone,
},
)

}

func (broker *Broker) NewSink(props *SinkProps) *Sink {
if broker.Gateway == nil {
panic("Gatewaye is not defined.")
Expand Down
Loading
Loading