serverless.yml

service:
  name: colonies

frameworkVersion: '>=1.44.1 <2.0.0'

plugins:
  - serverless-webpack
  - serverless-iam-roles-per-function
  - serverless-pseudo-parameters
  # - serverless-domain-manager
  - serverless-plugin-custom-domain
  # - serverless-cloudformation-sub-variables

custom:
  domain: "colonies-api.andrhamm.com"
  serverless-iam-roles-per-function:
    defaultInherit: true
  # customDomain:
  #   domainName: colonies-api.andrhamm.com
  #   stage: ${self:provider.stage}
  #   basePath: ''
  #   certificateName: '*.andrhamm.com'
  #   createRoute53Record: true
  #   endpointType: 'regional'
  webpack:
    webpackConfig: ./webpack.config.js
    includeModules:
      forceExclude:
        - aws-sdk
  dynamodb_table_name_games: ${self:service.name}-${self:provider.stage}-games-3
  dynamodb_index_name_games_id: gameId
  dynamodb_index_name_games_opponent: opponent
  dynamodb_table_name_users: ${self:service.name}-${self:provider.stage}-users
  # dynamodb_index_name_games_room: ${self:custom.dynamodb_table_name_games}-by-room
  arn_prefix_lambda_function: arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:${self:service.name}-${self:provider.stage}
  arn_api_gateway_connections:
    Fn::Join:
      - "/"
      - - Fn::Join: [":", ["arn:aws:execute-api", {"Ref":"AWS::Region"}, {"Ref":"AWS::AccountId"}, {"Ref": "WebsocketsApi"}]]
        - ${self:provider.stage}
        - "*"
        - "@connections"
        - "*"
  cognito_user_pool_arn:
    Fn::Join:
      - ''
      - - 'arn:aws:cognito-idp:'
        - ${self:provider.region}
        - ':'
        - Ref: AWS::AccountId
        - ':userpool/'
        - Ref: CognitoUserPool

provider:
  name: aws
  runtime: nodejs8.10
  stage: ${opt:stage, 'dev'}
  profile: ${opt:profile, 'tremorlab'}
  region: us-east-1
  logs:
    restApi: true
    # websocket: true
  websocketsApiRouteSelectionExpression: $request.body.action
  environment:
    # NOTE: this is useful for local invocations and has no affect in deployed environments
    AWS_PROFILE: ${self:provider.profile}
    API_BASE:
      Fn::Join:
        - ""
        - - Ref: ApiGatewayRestApi
          - ".execute-api.${self:provider.region}."
          - Ref: AWS::URLSuffix
          - "/${self:provider.stage}"
    WSS_BASE:
      Fn::Join:
        - ""
        - - Ref: WebsocketsApi
          - ".execute-api.${self:provider.region}."
          - Ref: AWS::URLSuffix
          - "/${self:provider.stage}"
    ENCRYPTION_KEY: ${file(./secrets.${self:provider.stage}.yml):encryptionKey}
    SIGNING_KEY: ${file(./secrets.${self:provider.stage}.yml):signingKey}
    FUNCTION_SHIELD_TOKEN: ${file(./secrets.${self:provider.stage}.yml):functionShieldToken}
    DYNAMODB_PARTITION_COUNT_GAMES: 4
    DYNAMODB_TABLE_NAME_GAMES: ${self:custom.dynamodb_table_name_games}
    DYNAMODB_INDEX_NAME_GAMES_ID: ${self:custom.dynamodb_index_name_games_id}
    DYNAMODB_INDEX_NAME_GAMES_OPPONENT: ${self:custom.dynamodb_index_name_games_opponent}
    DYNAMODB_TABLE_NAME_USERS: ${self:custom.dynamodb_table_name_users}
    COGNITO_USER_POOL_ID: !Ref CognitoUserPool
    SES_EMAIL_DOMAIN: ${self:custom.domain}
  iamRoleStatements:
    - Effect: Allow
      Action:
        - cognito-idp:ListUsers
        - cognito-idp:AdminGetUser
      Resource:
        - ${self:custom.cognito_user_pool_arn}
package:
  individually: true
  exclude:
    - secrets.*.yml

functions:
  getWebsocketConnectToken:
    handler: handlers/websockets-auth.getToken
    description: Retreive a token that can be used to authenticate the websocket connection
    events:
      - http:
          path: token
          method: get
          cors: ${file(api/cors.yml)}
          authorizer: aws_iam
  websocketDefault:
    handler: handlers/websockets.routeDefault
    events:
      - websocket: $default
    iamRoleStatements:
      - Effect: Allow
        Action:
          - execute-api:ManageConnections
          - execute-api:Invoke
        Resource:
          - ${self:custom.arn_api_gateway_connections}
      - Effect: Allow
        Action:
          - dynamodb:BatchGetItem
        Resource:
          - Fn::GetAtt: [ UsersDynamoDbTable, Arn ]
  websocketDisconnect:
    handler: handlers/websockets.routeDisconnect
    events:
      - websocket: $disconnect
    iamRoleStatements:
      - Effect: Allow
        Action:
          - execute-api:ManageConnections
          - execute-api:Invoke
        Resource:
          - ${self:custom.arn_api_gateway_connections}
      - Effect: Allow
        Action:
          - dynamodb:GetItem
          - dynamodb:UpdateItem
          - dynamodb:DeleteItem
        Resource:
          - Fn::GetAtt: [ UsersDynamoDbTable, Arn ]
  websocketConnect:
    handler: handlers/websockets.routeConnect
    events:
      - websocket:
          route: $connect
          authorizer:
            name: websocketAuth
            identitySource:
              - 'route.request.querystring.token'
    iamRoleStatements:
      - Effect: Allow
        Action:
          - execute-api:ManageConnections
          - execute-api:Invoke
        Resource:
          - ${self:custom.arn_api_gateway_connections}
      - Effect: Allow
        Action:
          - dynamodb:PutItem
          - dynamodb:UpdateItem
        Resource:
          - Fn::GetAtt: [ UsersDynamoDbTable, Arn ]
  websocketAuth:
    handler: handlers/websockets-auth.handler

  # test:
  #   handler: handlers/test.post
  #   events:
  #     - http:
  #         path: test
  #         method: post

  # TODO: player username lookup endpoint, predictive search
  #
  gameCreate:
    handler: handlers/game.post
    description: Create a new game
    events:
      - http:
          path: games
          method: post
          cors: ${file(api/cors.yml)}
          authorizer: aws_iam
          request:
            schema:
              application/json: ${file(api/game-create.json)}
    iamRoleStatements:
      - Effect: Allow
        Action:
          - dynamodb:PutItem
        Resource:
          - Fn::GetAtt: [ GamesDynamoDbTable, Arn ]
      - Effect: Allow
        Action:
          - dynamodb:UpdateItem
        Resource:
          - Fn::GetAtt: [ UsersDynamoDbTable, Arn ]

  gameRead:
    handler: handlers/game.get
    description: Retreive a game by ID or encrypted key
    events:
      - http:
          path: games/{idOrEncryptedKey}
          method: get
          cors: ${file(api/cors.yml)}
          authorizer: aws_iam
    iamRoleStatements:
      - Effect: Allow
        Action:
          - dynamodb:GetItem
          - dynamodb:Query
        Resource:
          - Fn::GetAtt: [ GamesDynamoDbTable, Arn ]
          - Fn::Join:
            - ""
            - - Fn::GetAtt: [ GamesDynamoDbTable, Arn ]
              - "/index/${self:custom.dynamodb_index_name_games_id}"

  gameList:
    handler: handlers/game.list
    description: Retreive all recent games
    events:
      - http:
          path: games
          method: get
          cors: ${file(api/cors.yml)}
          authorizer: aws_iam
    iamRoleStatements:
      - Effect: Allow
        Action:
          - dynamodb:Query
          - dynamodb:GetItem
        Resource:
          - Fn::GetAtt: [ GamesDynamoDbTable, Arn ]
          - Fn::Join:
            - ""
            - - Fn::GetAtt: [ GamesDynamoDbTable, Arn ]
              - "/index/${self:custom.dynamodb_index_name_games_opponent}"

  turnCreate:
    handler: handlers/turn.post
    description: Submit a new turn for a game
    events:
      - http:
          path: games/{idOrEncryptedKey}/turn
          method: post
          cors: ${file(api/cors.yml)}
          authorizer: aws_iam
          request:
            schema:
              application/json: ${file(api/turn-create.json)}
    iamRoleStatements:
      - Effect: Allow
        Action:
          - dynamodb:GetItem
          - dynamodb:UpdateItem
        Resource:
          - Fn::GetAtt: [ GamesDynamoDbTable, Arn ]

  wsTurnCompleted:
    description: Sends websocket events when a turn has completed
    handler: handlers/ws-turn-completed.handler
    events:
      - stream:
          type: dynamodb
          arn:
            Fn::GetAtt: [ GamesDynamoDbTable, StreamArn ]
          batchSize: 100
    iamRoleStatements:
      - Effect: Allow
        Action:
          - execute-api:ManageConnections
          - execute-api:Invoke
        Resource:
          - ${self:custom.arn_api_gateway_connections}
      - Effect: Allow
        Action:
          - dynamodb:BatchGetItem
        Resource:
          - Fn::GetAtt: [ UsersDynamoDbTable, Arn ]

  wsChatReceived:
    description: Writes chat messages to DynamoDB
    handler: handlers/ws-chat-received.handler
    events:
      - websocket:
          route: sendGameChat
          request:
            schema:
              application/json: ${file(api/game-create.json)}
    iamRoleStatements:
      - Effect: Allow
        Action:
          - execute-api:ManageConnections
          # - execute-api:Invoke
        Resource:
          - ${self:custom.arn_api_gateway_connections}
      - Effect: Allow
        Action:
          - dynamodb:UpdateItem
          - dynamodb:GetItem
        Resource:
          - Fn::GetAtt: [ GamesDynamoDbTable, Arn ]
      - Effect: Allow
        Action:
          - dynamodb:GetItem
          - dynamodb:BatchGetItem
        Resource:
          - Fn::GetAtt: [ UsersDynamoDbTable, Arn ]

resources:
  Resources:
    UsersDynamoDbTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: ${self:custom.dynamodb_table_name_users}
        BillingMode: PAY_PER_REQUEST
        # StreamSpecification:
        #   StreamViewType: NEW_AND_OLD_IMAGES
        AttributeDefinitions:
          - AttributeName: partitionKey
            AttributeType: S
        KeySchema:
          # user exmaple: u:b6971e08-5c31-41b0-b061-482b41c98460
          # connection exmaple: c:dFiR-fGeoAMCIUw=
          - AttributeName: partitionKey
            KeyType: HASH
    GamesDynamoDbTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: ${self:custom.dynamodb_table_name_games}
        BillingMode: PAY_PER_REQUEST
        StreamSpecification:
          StreamViewType: NEW_AND_OLD_IMAGES
        AttributeDefinitions:
          - AttributeName: partitionKey
            AttributeType: S
          - AttributeName: sortKey
            AttributeType: S
          - AttributeName: opponentPartitionKey
            AttributeType: S
          - AttributeName: opponentSortKey
            AttributeType: S
          - AttributeName: id
            AttributeType: S
        KeySchema:
          # `${player1Guid}`
          # exmaple: b6971e08-5c31-41b0-b061-482b41c98460
          - AttributeName: partitionKey
            KeyType: HASH
          # `${[player2Guid, gameStartTimeMs].join(':')}`
          - AttributeName: sortKey
            KeyType: RANGE
        GlobalSecondaryIndexes:
          - IndexName: ${self:custom.dynamodb_index_name_games_id}
            # TODO: Make this the primary table key
            KeySchema:
              - AttributeName: id
                KeyType: HASH
            Projection:
              ProjectionType: INCLUDE
              NonKeyAttributes:
                - key
          - IndexName: ${self:custom.dynamodb_index_name_games_opponent}
            KeySchema:
              # `${player2Guid}`
              # exmaple: f5df8afe-b6bd-4498-a26c-bb5c1d587cc8
              - AttributeName: opponentPartitionKey
                KeyType: HASH
              # `${[player1Guid, gameStartTimeMs].join(':')}`
              - AttributeName: opponentSortKey
                KeyType: RANGE
            Projection:
              ProjectionType: INCLUDE
              NonKeyAttributes:
                - id
                - key
                - turn
                - firstPlayer
                - players
                - createdAt
                - updatedAt
                - completedAt
    CognitoUserPool:
      Type: AWS::Cognito::UserPool
      Properties:
        UserPoolName: hiddenColoniesUserPool
        MfaConfiguration: OFF
        AutoVerifiedAttributes:
          - email
        Schema:
          - Name: name
            AttributeDataType: String
            Mutable: true
            Required: true
          - Name: email
            AttributeDataType: String
            Mutable: false
            Required: true
        Policies:
          PasswordPolicy:
            MinimumLength: 6
            RequireLowercase: false
            RequireNumbers: false
            RequireSymbols: false
            RequireUppercase: false
    CognitoUserPoolClient:
      Type: AWS::Cognito::UserPoolClient
      Properties:
        ClientName: hiddenColoniesUserPoolClient
        GenerateSecret: false
        UserPoolId:
          Ref: CognitoUserPool
    CognitoIdentityPool:
      Type: AWS::Cognito::IdentityPool
      Properties:
        IdentityPoolName: hiddenColoniesUserIdentityPool
        AllowUnauthenticatedIdentities: false
        CognitoIdentityProviders:
          - ClientId:
              Ref: CognitoUserPoolClient
            ProviderName:
              Fn::GetAtt: [CognitoUserPool, ProviderName]
    CognitoIdentityPoolRoles:
      Type: AWS::Cognito::IdentityPoolRoleAttachment
      Properties:
        IdentityPoolId:
          Ref: CognitoIdentityPool
        Roles:
          authenticated:
            Fn::GetAtt: [CognitoAuthRole, Arn]
          unauthenticated:
            Fn::GetAtt: [CognitoUnauthRole, Arn]
    CognitoAuthRole:
      Type: AWS::IAM::Role
      Properties:
        RoleName: appAuthRole
        Path: /
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: "Allow"
              Principal:
                Federated: "cognito-identity.amazonaws.com"
              Action:
                - "sts:AssumeRoleWithWebIdentity"
              Condition:
                StringEquals:
                  "cognito-identity.amazonaws.com:aud":
                    Ref: CognitoIdentityPool
                "ForAnyValue:StringLike":
                  "cognito-identity.amazonaws.com:amr": authenticated
        Policies:
          - PolicyName: "CognitoAuthorizedPolicy"
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: "Allow"
                  Action:
                    - "cognito-sync:*"
                    - "cognito-identity:*"
                    - "mobileanalytics:PutEvents"
                  Resource: "*"
                - Effect: "Allow"
                  Action:
                    - "execute-api:Invoke"
                  Resource:
                    Fn::Join:
                      - ''
                      -
                        - 'arn:aws:execute-api:'
                        - Ref: AWS::Region
                        - ':'
                        - Ref: AWS::AccountId
                        - ':'
                        - Ref: ApiGatewayRestApi
                        - '/*'
    CognitoUnauthRole:
      Type: AWS::IAM::Role
      Properties:
        RoleName: appUnauthRole
        Path: /
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: "Allow"
              Principal:
                Federated: "cognito-identity.amazonaws.com"
              Action:
                - "sts:AssumeRoleWithWebIdentity"
              Condition:
                StringEquals:
                  "cognito-identity.amazonaws.com:aud":
                    Ref: CognitoIdentityPool
                "ForAnyValue:StringLike":
                  "cognito-identity.amazonaws.com:amr": unauthenticated
        Policies:
          - PolicyName: "CognitoUnauthorizedPolicy"
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: "Allow"
                  Action:
                    - "cognito-sync:*"
                    - "cognito-identity:*"
                    # - "mobileanalytics:PutEvents"
                  Resource: "*"
    # CognitoAuthorizer:
    #   DependsOn:
    #     - ApiGatewayRestApi
    #   Type: AWS::ApiGateway::Authorizer
    #   Properties:
    #     AuthorizerResultTtlInSeconds: 300
    #     IdentitySource: method.request.header.Authorization
    #     RestApiId:
    #       Ref: ApiGatewayRestApi
    #     Type: COGNITO_USER_POOLS
    #     Name: Authorizer
    #     ProviderARNs:
    #       - Fn::Join:
    #         - ''
    #         - - 'arn:aws:cognito-idp:'
    #           - ${self:provider.region}
    #           - ':'
    #           - Ref: AWS::AccountId
    #           - ':userpool/'
    #           - Ref: CognitoUserPool
    GatewayResponseDefault4XX:
      Type: 'AWS::ApiGateway::GatewayResponse'
      Properties:
        ResponseParameters:
           gatewayresponse.header.Access-Control-Allow-Origin: "'*'"
           gatewayresponse.header.Access-Control-Allow-Headers: "'*'"
        ResponseType: DEFAULT_4XX
        RestApiId:
          Ref: 'ApiGatewayRestApi'
    GatewayResponseDefault5XX:
      Type: 'AWS::ApiGateway::GatewayResponse'
      Properties:
        ResponseParameters:
           gatewayresponse.header.Access-Control-Allow-Origin: "'*'"
           gatewayresponse.header.Access-Control-Allow-Headers: "'*'"
        ResponseType: DEFAULT_5XX
        RestApiId:
          Ref: 'ApiGatewayRestApi'