Skip to content

Commit ec8f96b

Browse files
rittnejebmoffattBryan Moffatt
authored
redefine IoT Core custom authorizer request and response structs (#401)
* redefine IoT Core custom authorizer request and response structs as per spec * make IAM policy structs reusable * gofmt * restore deleted structs, add deprecation notices Co-authored-by: Bryan Moffatt <bmoffatt@users.noreply.github.com> Co-authored-by: Bryan Moffatt <bmoff2292@gmail.com>
1 parent 908421f commit ec8f96b

File tree

7 files changed

+120
-56
lines changed

7 files changed

+120
-56
lines changed

‎events/apigw.go

+6-13
Original file line numberDiff line numberDiff line change
@@ -336,21 +336,14 @@ type APIGatewayV2CustomAuthorizerSimpleResponse struct {
336336
Context map[string]interface{} `json:"context,omitempty"`
337337
}
338338

339+
// APIGatewayCustomAuthorizerPolicy represents an IAM policy.
340+
//
341+
// Note: This type exists for backwards compatibility.
342+
// should reference IAMPolicyDocument directly instead.
343+
type APIGatewayCustomAuthorizerPolicy IAMPolicyDocument
344+
339345
type APIGatewayV2CustomAuthorizerIAMPolicyResponse struct {
340346
PrincipalID string `json:"principalId"`
341347
PolicyDocument APIGatewayCustomAuthorizerPolicy `json:"policyDocument"`
342348
Context map[string]interface{} `json:"context,omitempty"`
343349
}
344-
345-
// APIGatewayCustomAuthorizerPolicy represents an IAM policy
346-
type APIGatewayCustomAuthorizerPolicy struct {
347-
Version string
348-
Statement []IAMPolicyStatement
349-
}
350-
351-
// IAMPolicyStatement represents one statement from IAM policy with action, effect and resource
352-
type IAMPolicyStatement struct {
353-
Action []string
354-
Effect string
355-
Resource []string
356-
}

‎events/iam.go

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
package events
2+
3+
// IAMPolicyDocument represents an IAM policy document.
4+
type IAMPolicyDocument struct {
5+
Version string
6+
Statement []IAMPolicyStatement
7+
}
8+
9+
// IAMPolicyStatement represents one statement from IAM policy with action, effect and resource.
10+
type IAMPolicyStatement struct {
11+
Action []string
12+
Effect string
13+
Resource []string
14+
}

‎events/iot.go

+30-18
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,46 @@
11
package events
22

3-
// IoTCustomAuthorizerRequest contains data coming in to a custom IoT device gateway authorizer function.
4-
type IoTCustomAuthorizerRequest struct {
5-
HTTPContext *IoTHTTPContext `json:"httpContext,omitempty"`
6-
MQTTContext *IoTMQTTContext `json:"mqttContext,omitempty"`
7-
TLSContext *IoTTLSContext `json:"tlsContext,omitempty"`
8-
AuthorizationToken string `json:"token"`
9-
TokenSignature string `json:"tokenSignature"`
3+
// IoTCoreCustomAuthorizerRequest represents the request to an IoT Core custom authorizer.
4+
// See https://docs.aws.amazon.com/iot/latest/developerguide/config-custom-auth.html
5+
type IoTCoreCustomAuthorizerRequest struct {
6+
Token string `json:"token"`
7+
SignatureVerified bool `json:"signatureVerified"`
8+
Protocols []string `json:"protocols"`
9+
ProtocolData *IoTCoreProtocolData `json:"protocolData,omitempty"`
10+
ConnectionMetadata *IoTCoreConnectionMetadata `json:"connectionMetadata,omitempty"`
1011
}
1112

12-
type IoTHTTPContext struct {
13+
type IoTCoreProtocolData struct {
14+
TLS *IoTCoreTLSContext `json:"tls,omitempty"`
15+
HTTP *IoTCoreHTTPContext `json:"http,omitempty"`
16+
MQTT *IoTCoreMQTTContext `json:"mqtt,omitempty"`
17+
}
18+
19+
type IoTCoreTLSContext struct {
20+
ServerName string `json:"serverName"`
21+
}
22+
23+
type IoTCoreHTTPContext struct {
1324
Headers map[string]string `json:"headers,omitempty"`
1425
QueryString string `json:"queryString"`
1526
}
1627

17-
type IoTMQTTContext struct {
28+
type IoTCoreMQTTContext struct {
1829
ClientID string `json:"clientId"`
1930
Password []byte `json:"password"`
2031
Username string `json:"username"`
2132
}
2233

23-
type IoTTLSContext struct {
24-
ServerName string `json:"serverName"`
34+
type IoTCoreConnectionMetadata struct {
35+
ID string `json:"id"`
2536
}
2637

27-
// IoTCustomAuthorizerResponse represents the expected format of an IoT device gateway authorization response.
28-
type IoTCustomAuthorizerResponse struct {
29-
IsAuthenticated bool `json:"isAuthenticated"`
30-
PrincipalID string `json:"principalId"`
31-
DisconnectAfterInSeconds int32 `json:"disconnectAfterInSeconds"`
32-
RefreshAfterInSeconds int32 `json:"refreshAfterInSeconds"`
33-
PolicyDocuments []string `json:"policyDocuments"`
38+
// IoTCoreCustomAuthorizerResponse represents the response from an IoT Core custom authorizer.
39+
// See https://docs.aws.amazon.com/iot/latest/developerguide/config-custom-auth.html
40+
type IoTCoreCustomAuthorizerResponse struct {
41+
IsAuthenticated bool `json:"isAuthenticated"`
42+
PrincipalID string `json:"principalId"`
43+
DisconnectAfterInSeconds uint32 `json:"disconnectAfterInSeconds"`
44+
RefreshAfterInSeconds uint32 `json:"refreshAfterInSeconds"`
45+
PolicyDocuments []*IAMPolicyDocument `json:"policyDocuments"`
3446
}

‎events/iot_deprecated.go

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
package events
2+
3+
// IoTCustomAuthorizerRequest contains data coming in to a custom IoT device gateway authorizer function.
4+
// Deprecated: Use IoTCoreCustomAuthorizerRequest instead. IoTCustomAuthorizerRequest does not correctly model the request schema
5+
type IoTCustomAuthorizerRequest struct {
6+
HTTPContext *IoTHTTPContext `json:"httpContext,omitempty"`
7+
MQTTContext *IoTMQTTContext `json:"mqttContext,omitempty"`
8+
TLSContext *IoTTLSContext `json:"tlsContext,omitempty"`
9+
AuthorizationToken string `json:"token"`
10+
TokenSignature string `json:"tokenSignature"`
11+
}
12+
13+
// Deprecated: Use IoTCoreHTTPContext
14+
type IoTHTTPContext IoTCoreHTTPContext
15+
16+
// Deprecated: Use IoTCoreMQTTContext
17+
type IoTMQTTContext IoTCoreMQTTContext
18+
19+
// Deprecated: Use IotCoreTLSContext
20+
type IoTTLSContext IoTCoreTLSContext
21+
22+
// IoTCustomAuthorizerResponse represents the expected format of an IoT device gateway authorization response.
23+
// Deprecated: Use IoTCoreCustomAuthorizerResponse. IoTCustomAuthorizerResponse does not correctly model the response schema.
24+
type IoTCustomAuthorizerResponse struct {
25+
IsAuthenticated bool `json:"isAuthenticated"`
26+
PrincipalID string `json:"principalId"`
27+
DisconnectAfterInSeconds int32 `json:"disconnectAfterInSeconds"`
28+
RefreshAfterInSeconds int32 `json:"refreshAfterInSeconds"`
29+
PolicyDocuments []string `json:"policyDocuments"`
30+
}

‎events/iot_test.go

+8-8
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ import (
88
"github.com/aws/aws-lambda-go/events/test"
99
)
1010

11-
func TestIoTCustomAuthorizerRequestMarshaling(t *testing.T) {
11+
func TestIoTCoreCustomAuthorizerRequestMarshaling(t *testing.T) {
1212

1313
// read json from file
1414
inputJSON, err := ioutil.ReadFile("./testdata/iot-custom-auth-request.json")
@@ -17,7 +17,7 @@ func TestIoTCustomAuthorizerRequestMarshaling(t *testing.T) {
1717
}
1818

1919
// de-serialize into Go object
20-
var inputEvent IoTCustomAuthorizerRequest
20+
var inputEvent IoTCoreCustomAuthorizerRequest
2121
if err := json.Unmarshal(inputJSON, &inputEvent); err != nil {
2222
t.Errorf("could not unmarshal event. details: %v", err)
2323
}
@@ -31,11 +31,11 @@ func TestIoTCustomAuthorizerRequestMarshaling(t *testing.T) {
3131
test.AssertJsonsEqual(t, inputJSON, outputJSON)
3232
}
3333

34-
func TestIoTCustomAuthorizerRequestMalformedJson(t *testing.T) {
35-
test.TestMalformedJson(t, IoTCustomAuthorizerRequest{})
34+
func TestIoTCoreCustomAuthorizerRequestMalformedJson(t *testing.T) {
35+
test.TestMalformedJson(t, IoTCoreCustomAuthorizerRequest{})
3636
}
3737

38-
func TestIoTCustomAuthorizerResponseMarshaling(t *testing.T) {
38+
func TestIoTCoreCustomAuthorizerResponseMarshaling(t *testing.T) {
3939

4040
// read json from file
4141
inputJSON, err := ioutil.ReadFile("./testdata/iot-custom-auth-response.json")
@@ -44,7 +44,7 @@ func TestIoTCustomAuthorizerResponseMarshaling(t *testing.T) {
4444
}
4545

4646
// de-serialize into Go object
47-
var inputEvent IoTCustomAuthorizerResponse
47+
var inputEvent IoTCoreCustomAuthorizerResponse
4848
if err := json.Unmarshal(inputJSON, &inputEvent); err != nil {
4949
t.Errorf("could not unmarshal event. details: %v", err)
5050
}
@@ -58,6 +58,6 @@ func TestIoTCustomAuthorizerResponseMarshaling(t *testing.T) {
5858
test.AssertJsonsEqual(t, inputJSON, outputJSON)
5959
}
6060

61-
func TestIoTCustomAuthorizerResponseMalformedJson(t *testing.T) {
62-
test.TestMalformedJson(t, IoTCustomAuthorizerResponse{})
61+
func TestIoTCoreCustomAuthorizerResponseMalformedJson(t *testing.T) {
62+
test.TestMalformedJson(t, IoTCoreCustomAuthorizerResponse{})
6363
}

‎events/testdata/iot-custom-auth-request.json

+21-15
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,24 @@
11
{
2-
"httpContext": {
3-
"headers": {
4-
"Accept-Language" : "en"
2+
"token" :"aToken",
3+
"signatureVerified": true,
4+
"protocols": ["tls", "http", "mqtt"],
5+
"protocolData": {
6+
"tls" : {
7+
"serverName": "serverName"
58
},
6-
"queryString": "abc"
7-
},
8-
"mqttContext": {
9-
"clientId": "someclient",
10-
"password": "aslkfjwoeiuwekrujwlrueowieurowieurowiuerwleuroiwueroiwueroiuweoriuweoriuwoeiruwoeiur",
11-
"username": "thebestuser"
12-
},
13-
"tlsContext": {
14-
"serverName": "server.stuff.com"
9+
"http": {
10+
"headers": {
11+
"X-Request-ID": "abc123"
12+
},
13+
"queryString": "?foo=bar"
14+
},
15+
"mqtt": {
16+
"username": "myUserName",
17+
"password": "bXlQYXNzd29yZA==",
18+
"clientId": "myClientId"
19+
}
1520
},
16-
"token": "someToken",
17-
"tokenSignature": "somelongtokensignature"
18-
}
21+
"connectionMetadata": {
22+
"id": "e56f08c3-c559-490f-aa9f-7e8427d0f57b"
23+
}
24+
}

‎events/testdata/iot-custom-auth-response.json

+11-2
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,15 @@
44
"disconnectAfterInSeconds": 86400,
55
"refreshAfterInSeconds": 300,
66
"policyDocuments": [
7-
"{ \"Version\": \"2012-10-17\", \"Statement\": [ { \"Action\": [\"iot:Subscribe\"], \"Effect\": \"Allow\", \"Resource\": [\"*\"] } ] }"
7+
{
8+
"Version": "2012-10-17",
9+
"Statement": [
10+
{
11+
"Action": ["iot:Publish"],
12+
"Effect": "Allow",
13+
"Resource": ["arn:aws:iot:us-east-1:<your_aws_account_id>:topic/customauthtesting"]
14+
}
15+
]
16+
}
817
]
9-
}
18+
}

0 commit comments

Comments
 (0)