CCM-11220: fix download authorizer cis2 (#568)

Author: alexnuttall

lambdas/download-authorizer/src/__tests__/index.test.ts

@@ -61,14 +61,18 @@ function makeEvent(
 describe('download authorizer handler', () => {
   test('returns request, when request is valid', async () => {
     const subject = 'F3FE88F4-4E9E-41EB-BF1E-DC299911968B';
+    const userName = 'CIS2_555555555555';
 
     lambdaCognitoAuthorizer.authorize.mockResolvedValue({
       success: true,
       subject,
     });
 
     const uri = `/${subject}/template-id/proof1.pdf`;
-    const cookie = `CognitoIdentityServiceProvider.${userPoolClientId}.${subject}.accessToken=jwt`;
+    const cookie = [
+      `CognitoIdentityServiceProvider.${userPoolClientId}.${userName}.accessToken=jwt`,
+      `CognitoIdentityServiceProvider.${userPoolClientId}.LastAuthUser=${userName}`,
+    ].join('; ');
 
     const event = mock<CloudFrontRequestEvent>(makeEvent(uri, cookie));
 
@@ -86,10 +90,35 @@ describe('download authorizer handler', () => {
     );
   });
 
+  test('returns denial if no access token is available for the LastAuthUser', async () => {
+    const subject = 'F3FE88F4-4E9E-41EB-BF1E-DC299911968B';
+    const userName = 'CIS2_555555555555';
+
+    lambdaCognitoAuthorizer.authorize.mockResolvedValue({
+      success: true,
+      subject,
+    });
+
+    const uri = `/${subject}/template-id/proof1.pdf`;
+    const cookie = [
+      `CognitoIdentityServiceProvider.${userPoolClientId}.anotheruser.accessToken=jwt`,
+      `CognitoIdentityServiceProvider.${userPoolClientId}.LastAuthUser=${userName}`,
+    ].join('; ');
+
+    const event = mock<CloudFrontRequestEvent>(makeEvent(uri, cookie));
+
+    const res = await handler(event);
+
+    expect(res).toEqual(denial);
+    expect(mockLogger.warn).toHaveBeenCalledWith('Cookie is missing');
+
+    expect(lambdaCognitoAuthorizer.authorize).not.toHaveBeenCalled();
+  });
+
   test('returns denial if cognito configuration is not present in custom headers', async () => {
     const uri = '/subject/template-id/proof1.pdf';
     const cookie =
-      'CognitoIdentityServiceProvider.user-pool-client-id.subject.accessToken=jwt';
+      'CognitoIdentityServiceProvider.pool.username.accessToken=jwt; CognitoIdentityServiceProvider.pool.LastAuthUser=username;';
 
     const event = mock<CloudFrontRequestEvent>(
       makeEvent(uri, cookie, {
@@ -122,7 +151,12 @@ describe('download authorizer handler', () => {
 
   test('returns denial if authorization fails', async () => {
     const uri = '/subject/template-id/proof1.pdf';
-    const cookie = `CognitoIdentityServiceProvider.${userPoolClientId}.subject.accessToken=jwt`;
+    const userName = 'CIS2-int_555555555555';
+
+    const cookie = [
+      `CognitoIdentityServiceProvider.${userPoolClientId}.${userName}.accessToken=jwt`,
+      `CognitoIdentityServiceProvider.${userPoolClientId}.LastAuthUser=${userName}`,
+    ].join('; ');
 
     lambdaCognitoAuthorizer.authorize.mockResolvedValue({
       success: false,
@@ -151,6 +185,6 @@ describe('parseRequest', () => {
       makeEvent('/subject/file.txt', undefined).Records[0].cf.request
     );
 
-    expect(parseRequest(request).authorizationToken).toBe(undefined);
+    expect(parseRequest(request).accessToken).toBe(undefined);
   });
 });

lambdas/download-authorizer/src/index.ts

@@ -21,35 +21,34 @@ export function parseRequest(request: CloudFrontRequest) {
   const userPoolId = customHeaders?.['x-user-pool-id']?.[0]?.value;
   const userPoolClientId = customHeaders?.['x-user-pool-client-id']?.[0]?.value;
 
-  const accessTokenKey = `CognitoIdentityServiceProvider.${userPoolClientId}.${ownerPathComponent}.accessToken`;
-
   const cookies = parseCookie(request.headers.cookie?.[0]?.value ?? '');
-  const authorizationToken = cookies[accessTokenKey];
+
+  const poolScope = `CognitoIdentityServiceProvider.${userPoolClientId}`;
+
+  const lastAuthUser = cookies[`${poolScope}.LastAuthUser`];
+
+  const accessToken = cookies[`${poolScope}.${lastAuthUser}.accessToken`];
 
   return {
     userPoolId,
     userPoolClientId,
-    authorizationToken,
+    accessToken,
     ownerPathComponent,
   };
 }
 
 export const handler = async (event: CloudFrontRequestEvent) => {
   const { request } = event.Records[0].cf;
 
-  const {
-    userPoolId,
-    userPoolClientId,
-    authorizationToken,
-    ownerPathComponent,
-  } = parseRequest(request);
+  const { userPoolId, userPoolClientId, accessToken, ownerPathComponent } =
+    parseRequest(request);
 
   if (!userPoolId || !userPoolClientId) {
     logger.error('Lambda misconfiguration');
     return denial;
   }
 
-  if (!authorizationToken) {
+  if (!accessToken) {
     logger.warn('Cookie is missing');
     return denial;
   }
@@ -59,7 +58,7 @@ export const handler = async (event: CloudFrontRequestEvent) => {
   const authResult = await authorizer.authorize(
     userPoolId,
     userPoolClientId,
-    authorizationToken,
+    accessToken,
     ownerPathComponent
   );