Skip to content

Commit

Permalink
feat(apigatewayv2-authorizers): http api - allow multiple user pool c…
Browse files Browse the repository at this point in the history
…lients per HttpUserPoolAuthorizer (#16903)

closes #15431

BREAKING CHANGE: `userPoolClient` property in `UserPoolAuthorizerProps`
is now renamed to `userPoolClients`.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
  • Loading branch information
tmokmss authored Nov 6, 2021
1 parent 9f9fe8a commit 747eb7c
Show file tree
Hide file tree
Showing 4 changed files with 49 additions and 9 deletions.
2 changes: 1 addition & 1 deletion packages/@aws-cdk/aws-apigatewayv2-authorizers/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -150,7 +150,7 @@ const userPoolClient = userPool.addClient('UserPoolClient');

const authorizer = new HttpUserPoolAuthorizer({
userPool,
userPoolClient,
userPoolClients: [userPoolClient],
});

const api = new HttpApi(stack, 'HttpApi');
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,9 @@ import { Stack, Token } from '@aws-cdk/core';
*/
export interface UserPoolAuthorizerProps {
/**
* The user pool client that should be used to authorize requests with the user pool.
* The user pool clients that should be used to authorize requests with the user pool.
*/
readonly userPoolClient: IUserPoolClient;
readonly userPoolClients: IUserPoolClient[];

/**
* The associated user pool
Expand All @@ -33,7 +33,7 @@ export interface UserPoolAuthorizerProps {
*
* @default ['$request.header.Authorization']
*/
readonly identitySource?: string[],
readonly identitySource?: string[];
}

/**
Expand All @@ -56,7 +56,7 @@ export class HttpUserPoolAuthorizer implements IHttpRouteAuthorizer {
identitySource: this.props.identitySource ?? ['$request.header.Authorization'],
type: HttpAuthorizerType.JWT,
authorizerName: this.props.authorizerName,
jwtAudience: [this.props.userPoolClient.userPoolClientId],
jwtAudience: this.props.userPoolClients.map((c) => c.userPoolClientId),
jwtIssuer: `https://cognito-idp.${region}.amazonaws.com/${this.props.userPool.userPoolId}`,
});
}
Expand All @@ -66,4 +66,4 @@ export class HttpUserPoolAuthorizer implements IHttpRouteAuthorizer {
authorizationType: 'JWT',
};
}
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ const userPoolClient = userPool.addClient('my-client');

const authorizer = new HttpUserPoolAuthorizer({
userPool,
userPoolClient,
userPoolClients: [userPoolClient],
});

const handler = new lambda.Function(stack, 'lambda', {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ describe('HttpUserPoolAuthorizer', () => {
const userPoolClient = userPool.addClient('UserPoolClient');
const authorizer = new HttpUserPoolAuthorizer({
userPool,
userPoolClient,
userPoolClients: [userPoolClient],
});

// WHEN
Expand Down Expand Up @@ -52,7 +52,7 @@ describe('HttpUserPoolAuthorizer', () => {
const userPoolClient = userPool.addClient('UserPoolClient');
const authorizer = new HttpUserPoolAuthorizer({
userPool,
userPoolClient,
userPoolClients: [userPoolClient],
});

// WHEN
Expand All @@ -70,6 +70,46 @@ describe('HttpUserPoolAuthorizer', () => {
// THEN
Template.fromStack(stack).resourceCountIs('AWS::ApiGatewayV2::Authorizer', 1);
});

test('multiple userPoolClients are attached', () => {
// GIVEN
const stack = new Stack();
const api = new HttpApi(stack, 'HttpApi');
const userPool = new UserPool(stack, 'UserPool');
const userPoolClient1 = userPool.addClient('UserPoolClient1');
const userPoolClient2 = userPool.addClient('UserPoolClient2');
const authorizer = new HttpUserPoolAuthorizer({
userPool,
userPoolClients: [userPoolClient1, userPoolClient2],
});

// WHEN
api.addRoutes({
integration: new DummyRouteIntegration(),
path: '/books',
authorizer,
});

// THEN
Template.fromStack(stack).hasResourceProperties('AWS::ApiGatewayV2::Authorizer', {
AuthorizerType: 'JWT',
IdentitySource: ['$request.header.Authorization'],
JwtConfiguration: {
Audience: [stack.resolve(userPoolClient1.userPoolClientId), stack.resolve(userPoolClient2.userPoolClientId)],
Issuer: {
'Fn::Join': [
'',
[
'https://cognito-idp.',
{ Ref: 'AWS::Region' },
'.amazonaws.com/',
stack.resolve(userPool.userPoolId),
],
],
},
},
});
});
});

class DummyRouteIntegration implements IHttpRouteIntegration {
Expand Down

0 comments on commit 747eb7c

Please sign in to comment.