Merge pull request #29 from erezrokah/fix/s3_authorization

Fix: S3 integration ignores authorization settings

Author: theburningmonk

lib/package/s3/compileMethodsToS3.js

@@ -14,7 +14,9 @@ module.exports = {
           Properties: {
             HttpMethod: event.http.method.toUpperCase(),
             RequestParameters: {},
-            AuthorizationType: 'NONE',
+            AuthorizationType: event.http.auth.authorizationType,
+            AuthorizationScopes: event.http.auth.authorizationScopes,
+            AuthorizerId: event.http.auth.authorizerId,
             ApiKeyRequired: Boolean(event.http.private),
             ResourceId: resourceId,
             RestApiId: this.provider.getApiGatewayRestApiId()

lib/package/s3/compileMethodsToS3.test.js

@@ -11,7 +11,6 @@ const template = {
   Type: 'AWS::ApiGateway::Method',
   Properties: {
     RequestParameters: {},
-    AuthorizationType: 'NONE',
     ApiKeyRequired: false,
     ResourceId: { Ref: 'ApiGatewayResourceS3' },
     RestApiId: { Ref: 'ApiGatewayRestApi' },
@@ -102,6 +101,9 @@ describe('#compileMethodsToS3()', () => {
     const diff = {
       Properties: {
         HttpMethod: method,
+        AuthorizationType: http.auth.authorizationType,
+        AuthorizationScopes: http.auth.authorizationScopes,
+        AuthorizerId: http.auth.authorizerId,
         RequestParameters: requestParams,
         Integration: {
           IntegrationHttpMethod: intMethod,
@@ -146,7 +148,8 @@ describe('#compileMethodsToS3()', () => {
         Ref: 'MyBucket'
       },
       action: 'GetObject',
-      key
+      key,
+      auth: { authorizationType: 'NONE' }
     }
 
     const requestParams = {}
@@ -210,7 +213,8 @@ describe('#compileMethodsToS3()', () => {
         Ref: 'MyBucket'
       },
       action: 'PutObject',
-      key
+      key,
+      auth: { authorizationType: 'NONE' }
     }
 
     const requestParams = {
@@ -278,7 +282,8 @@ describe('#compileMethodsToS3()', () => {
         Ref: 'MyBucket'
       },
       action: 'DeleteObject',
-      key
+      key,
+      auth: { authorizationType: 'NONE' }
     }
 
     const requestParams = {}
@@ -362,7 +367,8 @@ describe('#compileMethodsToS3()', () => {
                 'X-Amz-User-Agent'
               ],
               allowCredentials: false
-            }
+            },
+            auth: { authorizationType: 'NONE' }
           }
         }
       ]
@@ -386,6 +392,8 @@ describe('#compileMethodsToS3()', () => {
             'method.request.path.key': true
           },
           AuthorizationType: 'NONE',
+          AuthorizationScopes: undefined,
+          AuthorizerId: undefined,
           ApiKeyRequired: false,
           ResourceId: { Ref: 'ApiGatewayResourceS3' },
           RestApiId: { Ref: 'ApiGatewayRestApi' },
@@ -463,4 +471,70 @@ describe('#compileMethodsToS3()', () => {
       }
     })
   })
+
+  const testAuthorization = (auth) => {
+    const http = {
+      path: 's3',
+      method: 'get',
+      bucket: {
+        Ref: 'MyBucket'
+      },
+      action: 'GetObject',
+      key: { pathParam: 'key' },
+      auth
+    }
+
+    const requestParams = { 'method.request.path.key': true }
+
+    const intRequestParams = {
+      'integration.request.path.object': 'method.request.path.key',
+      'integration.request.path.bucket': {
+        'Fn::Sub': [
+          "'${bucket}'",
+          {
+            bucket: {
+              Ref: 'MyBucket'
+            }
+          }
+        ]
+      }
+    }
+
+    const responseParams = {
+      'method.response.header.content-type': true,
+      'method.response.header.Content-Type': true
+    }
+
+    const intResponseParams = {
+      'method.response.header.content-type': 'integration.response.header.content-type',
+      'method.response.header.Content-Type': 'integration.response.header.Content-Type'
+    }
+
+    testSingleProxy({
+      http,
+      logicalId: 'ApiGatewayMethods3Get',
+      method: 'GET',
+      intMethod: 'GET',
+      requestParams,
+      intRequestParams,
+      responseParams,
+      intResponseParams
+    })
+  }
+
+  it('should create corresponding resources with "NONE" authorization type', () => {
+    testAuthorization({ authorizationType: 'NONE' })
+  })
+
+  it('should create corresponding resources with "CUSTOM" authorization type', () => {
+    testAuthorization({ authorizationType: 'CUSTOM', authorizerId: { Ref: 'AuthorizerLogicalId' } })
+  })
+
+  it('should create corresponding resources with "AWS_IAM" authorization type', () => {
+    testAuthorization({ authorizationType: 'AWS_IAM' })
+  })
+
+  it('should create corresponding resources with "AWS_IAM" authorization type', () => {
+    testAuthorization({ authorizationType: 'COGNITO_USER_POOLS', authorizationScopes: ['admin'] })
+  })
 })