dherault / dherault/serverless-offline
Authorization fails when having pathParameters and set one of them fixed when building the policy
- Dominant language
- JavaScript
- Stars
- 5.3k
- Forks
- 811
- Avg merge
- 2d 4h
- Merged PRs (30d)
- 3
Description
## Bug Report
I don't complete know if it's a bug, wrong usage or "feature" but it has to do with #1043 which is closed with actually no comment and a related PR (#1283) which addresses the issue is also closed for being old and without tests.
**Current Behavior**
We're unable to authorise when using path parameters and limiting resource access in a policy because when we're building the policy we use a defined value instead of a wildcard which fails when the check of matching policy resource is done.
When a user is calling the path `base/pathParam1/pathParam2/pathParam3` we create a custom policy in the custom authorizer where we set `pathParam1` to a defined value for that user and `pathParam1` and `pathParam2` are defined in a wildcard, e.g. `GET/base/*/fixedUserValue/*`. Before the change of #980 it worked because the `authMatchPolicyResource` would receive the translated path where all path parameters are replaced and the `regExp.test` succeeds.
So basically before #980 the behaviour was to check resource`arn:aws:execute-api:us-east-1:random-account-id:random-api-id/dev/GET/pathParam1/pathParam2/pathParam3` against policyResource `arn:aws:execute-api:us-east-1:random-account-id:random-api-id/dev/GET/base/*/pathParam2/*`.
After the change the resource has changed to `arn:aws:execute-api:us-east-1:random-account-id:random-api-id/dev/GET/base/{param1}/{param2}/{param3}` which clearly fails.
**Sample Code**
- file: serverless.yml
```yaml
service: my-service
plugins:
- serverless-offline
provider:
runtime: nodejs16.x
stage: dev
functions:
api-authorizer:
name: api-authorizer
handler: app/functions/api-authorizer.handler
testing-endpoint:
name: testing-endpoint
handler: app/handlers/SomeHandler.handler
events:
- http:
path: "base/{param1}/{param2}/{param3}"
method: get
request:
parameters:
paths:
param1: true
param2: true
param3: true
authorizer:
name: api-authorizer
```
- file: api-authorizer.ts
```ts
export class ApiAuthorizer {
public async authorize(event, context) {
// some auth stuff
const principalId = 'principal123';
const policyDocument = {
Statement: [
{
Action: 'execute-api:Invoke',
Effect: 'Allow',
Resource: 'arn:aws:execute-api:us-east-1:random-account-id:random-api-id/dev/GET/base/*/fixedUserValue/*',
},
],
Version: '2012-10-17',
}
return {
context, principalId, policyDocument
}
}
}
```
**Expected behavior/code**
Successful authorization ` Authorization function returned a successful response`.
I can reproduce above behaviour in the integration test suite.
We're running the same custom authorizer on production which hasn't got the issue.
**Environment**
- `serverless` version: 3.22
- `serverless-offline` version: v8.8.1
- `node.js` version: v16
- `OS`: MacOs
Contributor guide
Research direction
Start with the integration test suite, reproducing the path-parameter authorizer case from serverless.yml and api-authorizer.ts. Trace authMatchPolicyResource and compare the resource values before and after #980. Done means the fixed path-parameter policy authorizes successfully and the integration suite includes a regression test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js, typescript
- Domain
- api, authorization, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100