template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Parameters:
  Module:
    Type: String
    Default: user-api
  Project:
    Type: String
    Default: ast
  Env:
    Type: String
    Default: dev
  JwtSsmParameterName:
    Type: String
    Default: jwt-secret

Globals:
  Function:
    Runtime: nodejs14.x
    CodeUri: src/
    Timeout: 30
    MemorySize: 128
    Architectures:
      - x86_64
    Environment:
      Variables:
        PROJECT: !Ref Project
        ENV: !Ref Env
        USER_TABLE: !Ref UserTable
        UNIQUE_CONSTRAINT_TABLE: !Ref UserUniqueConstraintTable

Resources:
  UserApi:
    Type: AWS::Serverless::HttpApi
    Properties:
      StageName: !Ref Env
      CorsConfiguration:
        AllowMethods:
          - OPTIONS
          - GET
          - POST
          - PUT
          - DELETE
        AllowHeaders:
          - Authorization
          - Content-Type
          - X-Forwarded-For
          - x-api-key
        AllowOrigins:
          - '*'
        MaxAge: 600
        AllowCredentials: false
      Auth:
        DefaultAuthorizer: LambdaRequestAuthorizer
        Authorizers:
          LambdaRequestAuthorizer:
            FunctionArn: !GetAtt AuthFunction.Arn
            FunctionInvokeRole: !GetAtt AuthFunctionInvokeRole.Arn
            AuthorizerPayloadFormatVersion: 2.0
            EnableSimpleResponses: true

  AuthFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${Project}-${Env}-${Module}-auth
      Handler: handlers/auth.authHandler
      Policies:
        - AWSLambdaBasicExecutionRole
        - SSMParameterReadPolicy:
            ParameterName: !Sub '${Project}/${Env}/jwt-secret'

  AuthFunctionInvokeRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - apigateway.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Policies:
        - PolicyName: InvokeLambdaPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - 'lambda:InvokeFunction'
                Resource: '*'

  UserSignInFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${Project}-${Env}-${Module}-userSignIn
      Handler: handlers/auth.userSignInHandler
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref UserTable
        - SSMParameterReadPolicy:
            ParameterName: !Sub '${Project}/${Env}/jwt-secret'
      Events:
        UserSignIn:
          Type: HttpApi
          Properties:
            Path: /user/sign-in
            Method: POST
            ApiId: !Ref UserApi
            PayloadFormatVersion: '2.0'
            Auth:
              Authorizer: NONE

  UserSignUpFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${Project}-${Env}-${Module}-userSignUp
      Handler: handlers/auth.userSignUpHandler
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref UserTable
        - DynamoDBCrudPolicy:
            TableName: !Ref UserUniqueConstraintTable
      Events:
        UserSignUp:
          Type: HttpApi
          Properties:
            Path: /user/sign-up
            Method: POST
            ApiId: !Ref UserApi
            PayloadFormatVersion: '2.0'
            Auth:
              Authorizer: NONE

  GetUserFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${Project}-${Env}-${Module}-getUser
      Handler: handlers/user-get-item.getUserHandler
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref UserTable
      Events:
        GetUser:
          Type: HttpApi
          Properties:
            Path: /user
            Method: GET
            ApiId: !Ref UserApi
            PayloadFormatVersion: '2.0'

  UpdateUserFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${Project}-${Env}-${Module}-updateUser
      Handler: handlers/user-put-item.updateUserHandler
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref UserTable
        - DynamoDBCrudPolicy:
            TableName: !Ref UserUniqueConstraintTable
      Events:
        UpdateUser:
          Type: HttpApi
          Properties:
            Path: /user
            Method: PUT
            ApiId: !Ref UserApi
            PayloadFormatVersion: '2.0'

  DeleteUserFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${Project}-${Env}-${Module}-deleteUser
      Handler: handlers/user-delete-item.deleteUserHandler
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref UserTable
        - DynamoDBCrudPolicy:
            TableName: !Ref UserUniqueConstraintTable
      Events:
        DeleteUser:
          Type: HttpApi
          Properties:
            Path: /user
            Method: DELETE
            ApiId: !Ref UserApi
            PayloadFormatVersion: '2.0'

  UserTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: !Sub ${Project}-${Env}-${Module}-user-table
      KeySchema:
        - AttributeName: userId
          KeyType: HASH
      AttributeDefinitions:
        - AttributeName: userId
          AttributeType: S
        - AttributeName: username
          AttributeType: S
      GlobalSecondaryIndexes:
        - IndexName: UsernameIndex
          KeySchema:
            - AttributeName: username
              KeyType: HASH
          Projection:
            ProjectionType: ALL
      BillingMode: PAY_PER_REQUEST

  UserUniqueConstraintTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: !Sub ${Project}-${Env}-${Module}-user-uc-table
      KeySchema:
        - AttributeName: constraintKey
          KeyType: HASH
      AttributeDefinitions:
        - AttributeName: constraintKey
          AttributeType: S
      BillingMode: PAY_PER_REQUEST

Outputs:
  UserApi:
    Description: API Gateway endpoint URL for Prod stage for get map function
    Value:
      Fn::Sub: https://${UserApi}.execute-api.${AWS::Region}.amazonaws.com/${Env}/

  JwtAuthenticatorFunctionArn:
    Description: JWT Authenticator
    Value: !GetAtt AuthFunction.Arn

  JwtAuthenticatorFunctionInvokeRoleArn:
    Description: JWT Authenticator Invoke Role
    Value: !GetAtt AuthFunctionInvokeRole.Arn