Skip to content

Commit d02fd86

Browse files
giuseppe-gangemienrimon15
giuseppe-gangemi
and
enrimon15
authored
feat: Add user id to auth token (#877)
* feat: add method to retrieve userId from Auth Token # Conflicts: # src/oneid/oneid-lambda-client-registration/src/main/java/it/pagopa/oneid/web/controller/ClientRegistrationController.java * refactor: remove userId from ClientRegistrationDTO and update methods impacted * refactor: change clientManager APIs to use userId retrieved from Authorization Bearer Token * refactor: update FE to use new APIs paths * refactor: adjust GET api to accept also userId as path param * refactor(admin panel): restore user id path param for get client api * feat(admin panel): remove userId from register-client api body * refactor(admin panel): adapt get, delete and update idp user api without userId path param * feat(admin panel): remove userId from create idp user api body * infra: add pyjwt_layer for client_manager * infra: correct layer field * fix: correct path * chore: handle conflicts after rebase --------- Co-authored-by: Enrico Monte <38566410+enrimon15@users.noreply.github.com>
1 parent 64be513 commit d02fd86

File tree

28 files changed

+366
-299
lines changed

28 files changed

+366
-299
lines changed

‎src/infra/api/oi-admin.tpl.json‎

Lines changed: 58 additions & 108 deletions
Original file line numberDiff line numberDiff line change
@@ -334,7 +334,7 @@
334334
{
335335
"in": "path",
336336
"name": "client_id",
337-
"description": "the user_id of the cognito user",
337+
"description": "the unique client_id of the client",
338338
"required": true,
339339
"schema": {
340340
"type": "string"
@@ -391,21 +391,6 @@
391391
}
392392
},
393393
"summary": "Client refresh secret endpoint",
394-
"requestBody": {
395-
"content": {
396-
"application/json": {
397-
"schema": {
398-
"userId": {
399-
"type": "string",
400-
"description": "The userId of the user who is requesting the client secret refresh. This is required to ensure that only authorized users can refresh the client secret.",
401-
"example": "fake-user-id"
402-
}
403-
}
404-
}
405-
},
406-
"description": "Request body",
407-
"required": true
408-
},
409394
"responses": {
410395
"200": {
411396
"description": "Client secret refreshed successfully.",
@@ -450,7 +435,9 @@
450435
]
451436
}
452437
},
453-
%{ if strcontains(server_url, "dev") || strcontains(server_url, "uat")
438+
%{ if strcontains(server_url,
439+
"dev") || strcontains(server_url,
440+
"uat")
454441
}
455442
"/client-manager/client-users": {
456443
"post": {
@@ -546,30 +533,31 @@
546533
"${authorizer}": []
547534
}
548535
]
549-
}
550-
},
551-
"/client-manager/client-users/{user_id}/{username}": {
552-
"patch": {
536+
},
537+
"get": {
553538
"tags": [
554539
"Admin Client Manager APIs"
555540
],
556-
"description": "This endpoint updates samlAttribrutes for a user in the Internal IDP",
557-
"operationId": "Patch_admin_client_manager_client_users",
541+
"description": "This endpoint expose backend function for Client Onboarding Portal.",
542+
"operationId": "Get_admin_client_manager_client_users",
558543
"parameters": [
559544
{
560-
"in": "path",
561-
"name": "user_id",
562-
"description": "user_id that is associated to the currently logged in user",
563-
"required": true,
545+
"in": "query",
546+
"name": "limit",
547+
"description": "Limit the number of results returned, max 1000",
548+
"required": false,
564549
"schema": {
565-
"type": "string"
550+
"type": "integer",
551+
"default": 10,
552+
"minimum": 1,
553+
"maximum": 1000
566554
}
567555
},
568556
{
569-
"in": "path",
570-
"name": "username",
571-
"description": "username of the test user that is being updated",
572-
"required": true,
557+
"in": "query",
558+
"name": "last_evaluated_key",
559+
"description": "Last evaluated key for pagination",
560+
"required": false,
573561
"schema": {
574562
"type": "string"
575563
}
@@ -601,10 +589,6 @@
601589
"statusCode": "403",
602590
"responseParameters": {}
603591
},
604-
"404": {
605-
"statusCode": "404",
606-
"responseParameters": {}
607-
},
608592
"405": {
609593
"statusCode": "405",
610594
"responseParameters": {}
@@ -620,20 +604,9 @@
620604
}
621605
},
622606
"summary": "Client Onboarding portal backend",
623-
"requestBody": {
624-
"content": {
625-
"application/json": {
626-
"schema": {
627-
"$ref": "#/components/schemas/ClientUserUpdate"
628-
}
629-
}
630-
},
631-
"description": "Request body",
632-
"required": true
633-
},
634607
"responses": {
635608
"200": {
636-
"$ref": "#/components/responses/responseOkNoContentJson"
609+
"$ref": "#/components/responses/responseOkUsersJson"
637610
},
638611
"400": {
639612
"$ref": "#/components/responses/invalidParameters"
@@ -644,9 +617,6 @@
644617
"403": {
645618
"$ref": "#/components/responses/forbidden"
646619
},
647-
"404": {
648-
"$ref": "#/components/responses/notFound"
649-
},
650620
"405": {
651621
"$ref": "#/components/responses/methodNotAllowed"
652622
},
@@ -662,23 +632,16 @@
662632
"${authorizer}": []
663633
}
664634
]
665-
},
666-
"delete": {
635+
}
636+
},
637+
"/client-manager/client-users/{username}": {
638+
"patch": {
667639
"tags": [
668640
"Admin Client Manager APIs"
669641
],
670-
"description": "This endpoint deletes a user in the Internal IDP",
671-
"operationId": "Delete_admin_client_manager_client_users",
642+
"description": "This endpoint updates samlAttribrutes for a user in the Internal IDP",
643+
"operationId": "Patch_admin_client_manager_client_users",
672644
"parameters": [
673-
{
674-
"in": "path",
675-
"name": "user_id",
676-
"description": "user_id that is associated to the currently logged in user",
677-
"required": true,
678-
"schema": {
679-
"type": "string"
680-
}
681-
},
682645
{
683646
"in": "path",
684647
"name": "username",
@@ -697,8 +660,8 @@
697660
"httpMethod": "POST",
698661
"uri": "arn:aws:apigateway:${aws_region}:lambda:path/2015-03-31/functions/${client_manager_lambda_arn}/invocations",
699662
"responses": {
700-
"204": {
701-
"statusCode": "204",
663+
"200": {
664+
"statusCode": "200",
702665
"responseParameters": {
703666
"method.response.header.content-type": "'application/json'"
704667
}
@@ -715,6 +678,10 @@
715678
"statusCode": "403",
716679
"responseParameters": {}
717680
},
681+
"404": {
682+
"statusCode": "404",
683+
"responseParameters": {}
684+
},
718685
"405": {
719686
"statusCode": "405",
720687
"responseParameters": {}
@@ -730,8 +697,19 @@
730697
}
731698
},
732699
"summary": "Client Onboarding portal backend",
700+
"requestBody": {
701+
"content": {
702+
"application/json": {
703+
"schema": {
704+
"$ref": "#/components/schemas/ClientUserUpdate"
705+
}
706+
}
707+
},
708+
"description": "Request body",
709+
"required": true
710+
},
733711
"responses": {
734-
"204": {
712+
"200": {
735713
"$ref": "#/components/responses/responseOkNoContentJson"
736714
},
737715
"400": {
@@ -743,6 +721,9 @@
743721
"403": {
744722
"$ref": "#/components/responses/forbidden"
745723
},
724+
"404": {
725+
"$ref": "#/components/responses/notFound"
726+
},
746727
"405": {
747728
"$ref": "#/components/responses/methodNotAllowed"
748729
},
@@ -758,45 +739,22 @@
758739
"${authorizer}": []
759740
}
760741
]
761-
}
762-
},
763-
"/client-manager/client-users/{user_id}": {
764-
"get": {
742+
},
743+
"delete": {
765744
"tags": [
766745
"Admin Client Manager APIs"
767746
],
768-
"description": "This endpoint expose backend function for Client Onboarding Portal.",
769-
"operationId": "Get_admin_client_manager_client_users",
747+
"description": "This endpoint deletes a user in the Internal IDP",
748+
"operationId": "Delete_admin_client_manager_client_users",
770749
"parameters": [
771750
{
772751
"in": "path",
773-
"name": "user_id",
774-
"description": "user_id that is associated to the currently logged in user",
752+
"name": "username",
753+
"description": "username of the test user that is being updated",
775754
"required": true,
776755
"schema": {
777756
"type": "string"
778757
}
779-
},
780-
{
781-
"in": "query",
782-
"name": "limit",
783-
"description": "Limit the number of results returned, max 1000",
784-
"required": false,
785-
"schema": {
786-
"type": "integer",
787-
"default": 10,
788-
"minimum": 1,
789-
"maximum": 1000
790-
}
791-
},
792-
{
793-
"in": "query",
794-
"name": "last_evaluated_key",
795-
"description": "Last evaluated key for pagination",
796-
"required": false,
797-
"schema": {
798-
"type": "string"
799-
}
800758
}
801759
],
802760
"x-amazon-apigateway-integration": {
@@ -807,8 +765,8 @@
807765
"httpMethod": "POST",
808766
"uri": "arn:aws:apigateway:${aws_region}:lambda:path/2015-03-31/functions/${client_manager_lambda_arn}/invocations",
809767
"responses": {
810-
"200": {
811-
"statusCode": "200",
768+
"204": {
769+
"statusCode": "204",
812770
"responseParameters": {
813771
"method.response.header.content-type": "'application/json'"
814772
}
@@ -841,8 +799,8 @@
841799
},
842800
"summary": "Client Onboarding portal backend",
843801
"responses": {
844-
"200": {
845-
"$ref": "#/components/responses/responseOkUsersJson"
802+
"204": {
803+
"$ref": "#/components/responses/responseOkNoContentJson"
846804
},
847805
"400": {
848806
"$ref": "#/components/responses/invalidParameters"
@@ -1564,10 +1522,6 @@
15641522
"ClientRegistration": {
15651523
"type": "object",
15661524
"properties": {
1567-
"userId": {
1568-
"type": "string",
1569-
"description": "The userId of the cognito user"
1570-
},
15711525
"redirectUris": {
15721526
"type": "array",
15731527
"items": {
@@ -2025,10 +1979,6 @@
20251979
"$ref": "#/components/schemas/SamlAttributes"
20261980
}
20271981
}
2028-
},
2029-
"user_id": {
2030-
"type": "string",
2031-
"description": "The user_id that is associated to the currently logged in user"
20321982
}
20331983
}
20341984
},

‎src/infra/modules/backend/lambda.tf‎

Lines changed: 35 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -895,6 +895,39 @@ data "aws_iam_policy_document" "invalidate_cache_lambda" {
895895

896896
# Lambda client manager
897897

898+
resource "null_resource" "install_client_manager_dependencies" {
899+
provisioner "local-exec" {
900+
command = <<EOT
901+
mkdir -p ${path.module}/../../dist/python
902+
pip install \
903+
--platform manylinux2014_x86_64 \
904+
--target=${path.module}/../../dist/python \
905+
--implementation cp \
906+
--only-binary=:all: --upgrade \
907+
-r ../../../oneid/oneid-lambda-client-manager/requirements.txt
908+
EOT
909+
}
910+
911+
triggers = {
912+
always_run = "${timestamp()}"
913+
}
914+
}
915+
916+
data "archive_file" "pyjwt_layer" {
917+
type = "zip"
918+
source_dir = "${path.module}/../../dist/"
919+
output_path = "${path.module}/../../dist/python.zip"
920+
depends_on = [null_resource.install_client_manager_dependencies]
921+
}
922+
923+
resource "aws_lambda_layer_version" "pyjwt_layer" {
924+
layer_name = "pyjwt-layer"
925+
description = "Lambda layer with PyJWT"
926+
compatible_runtimes = ["python3.12"]
927+
filename = data.archive_file.pyjwt_layer.output_path
928+
source_code_hash = data.archive_file.pyjwt_layer.output_base64sha256
929+
}
930+
898931
module "client_manager_lambda" {
899932
source = "terraform-aws-modules/lambda/aws"
900933
version = "7.4.0"
@@ -907,7 +940,6 @@ module "client_manager_lambda" {
907940
local_existing_package = var.client_manager_lambda.filename
908941
ignore_source_code_hash = true
909942

910-
911943
attach_policy_json = true
912944
policy_json = data.aws_iam_policy_document.client_manager_lambda.json
913945

@@ -919,7 +951,8 @@ module "client_manager_lambda" {
919951

920952
# lambda powertools layer
921953
layers = [
922-
"arn:aws:lambda:${var.aws_region}:017000801446:layer:AWSLambdaPowertoolsPythonV3-python312-x86_64:11"
954+
"arn:aws:lambda:${var.aws_region}:017000801446:layer:AWSLambdaPowertoolsPythonV3-python312-x86_64:11",
955+
aws_lambda_layer_version.pyjwt_layer.arn
923956
]
924957

925958
memory_size = 256

0 commit comments

Comments
 (0)