template.yaml

---
AWSTemplateFormatVersion: 2010-09-09

Transform: AWS::Serverless-2016-10-31

Description: An authentication lambda function for the Cimpress Mass Customization Platform.

Metadata:
  AWS::ServerlessRepo::Application:
    Name: platform-authorizer
    Description: A Lambda Authorizer that can perform authentication for services on the Cimpress Mass Customization Platform.
    Author: Christopher Osborn
    SpdxLicenseId: Apache-2.0
    LicenseUrl: ./LICENSE
    ReadmeUrl: ./README.md
    Labels:
    - auth0
    - oauth2
    - cimpress
    - authentication
    - lambda
    - authorizer
    HomePageUrl: https://github.com/Cimpress-MCP/Platform-Authorizer
    SemanticVersion: 4.1.0
    SourceCodeUrl: https://github.com/Cimpress-MCP/Platform-Authorizer

Parameters:
  Audience:
    Description: >-
      The audience which the service behind this authorizer allows, authenticationally.
    Type: String
    Default: https://api.cimpress.io/
  Issuers:
    Description: The sources of tokens and the issuers of claims.
    Type: List<String>
    AllowedPattern: '^(https:\/\/.+?)(,\1)*$'
    ConstraintDescription: Issuers must be a comma-delimited collection of HTTPS URLs.
    Default: https://cimpress.auth0.com/,https://oauth.cimpress.io/
  KmsKeyArn:
    Type: String
    Description: The KMS key used to encrypt the application.
    Default: ''

Conditions:
  KmsKeyArnExists: !Not [ !Equals [ '', !Ref KmsKeyArn ] ]

Resources:
  EnvironmentVariablesDecryptionPolicy:
    Type: AWS::IAM::Policy
    Condition: KmsKeyArnExists
    Properties:
      PolicyName: DecryptEnvironmentVariables
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          Effect: Allow
          Action: kms:Decrypt
          Resource: !Ref KmsKeyArn
          Condition:
            StringEquals:
              kms:ViaService: !Sub lambda.${AWS::Region}.${AWS::URLSuffix}
            ArnEquals:
              kms:EncryptionContext:aws:lambda:FunctionArn: !GetAtt Authorizer.Arn
      Roles: # note(cosborn) Attach in this direction to break circular dependency.
      - !Ref AuthorizerRole
  Authorizer:
    Type: AWS::Serverless::Function
    Properties:
      Architectures:
      - arm64
      Handler: index.default
      Runtime: nodejs20.x
      CodeUri: ./src
      Tracing: Active
      Description: An API Gateway Lambda Authorizer.
      KmsKeyArn: !If [ KmsKeyArnExists, !Ref KmsKeyArn, !Ref AWS::NoValue ]
      Environment:
        Variables:
          AUDIENCE: !Ref Audience
          ISSUERS: !Join [ ',', !Ref Issuers ]
    Metadata:
      BuildMethod: esbuild
      BuildProperties:
        Format: esm
        OutExtension:
        - .js=.mjs
        UseNpmCi: True

Outputs:
  AuthorizerArn:
    Description: The ARN of the authorizer Function to be applied to API Gateway endpoints.
    Value: !GetAtt Authorizer.Arn