serverless.yml

service: git-lfs-s3

plugins:
  - serverless-esbuild
  - serverless-iam-roles-per-function

provider:
  architecture: arm64
  name: aws
  runtime: nodejs20.x

package:
  individually: true

custom:
  esbuild:
    bundle: true
    minify: true
    sourcemap: true

functions:
  batch:
    handler: src/batch/batch.handler
    iamRoleStatements:
      - Action:
          - s3:ListBucket
        Effect: "Allow"
        Resource:
          Fn::GetAtt:
            - StorageBucket
            - Arn
      - Action:
          - s3:GetObject
          - s3:PutObject
        Effect: "Allow"
        Resource:
          Fn::Join:
            - ""
            - - Fn::GetAtt:
                  - StorageBucket
                  - Arn
              - "/*"
    environment:
      BUCKET_NAME:
        Ref: StorageBucket
    events:
      - http:
          path: objects/batch
          method: post
          integration: lambda-proxy
          authorizer: &authorizer
            name: authorizer
            resultTtlInSeconds: 0
            identitySource: method.request.header.Authorization
            type: request
  locks:
    handler: src/locks/locks.handler
    iamRoleStatements:
      - Action:
          - dynamodb:DeleteItem
          - dynamodb:GetItem
          - dynamodb:PutItem
          - dynamodb:Query
          - dynamodb:Scan
        Effect: "Allow"
        Resource:
          Fn::GetAtt:
            - LockTable
            - Arn
      - Action:
          - dynamodb:Query
        Effect: "Allow"
        Resource:
          Fn::Join:
            - ""
            - - Fn::GetAtt:
                  - LockTable
                  - Arn
              - /index/*
    environment:
      TABLE_NAME:
        Ref: LockTable
      ID_INDEX_NAME: &idindexname IdIndex
    events:
      - http:
          path: locks/{proxy+}
          method: post
          integration: lambda-proxy
          authorizer: *authorizer
      - http:
          path: locks
          method: get  # list locks
          integration: lambda-proxy
          authorizer: *authorizer
      - http:
          path: locks
          method: post  # create lock
          integration: lambda-proxy
          authorizer: *authorizer
  authorizer:
    handler: src/authorizer/authorizer.handler
    environment:
      USER_POOL_ID:
        Ref: UserPool
      USER_POOL_CLIENT_ID:
        Ref: UserPoolClient
    iamRoleStatements:
      - Action:
          - cognito-idp:AdminInitiateAuth
        Effect: "Allow"
        Resource:
          Fn::GetAtt:
            - UserPool
            - Arn

resources:
  Outputs:
    UserPoolId:
      Description: Id of the Cognito User Pool
      Value:
        Ref: UserPool
  Resources:
    GatewayResponse:
      Type: AWS::ApiGateway::GatewayResponse
      Properties:
        ResponseParameters:
          gatewayresponse.header.WWW-Authenticate: "'Basic'"
        ResponseType: UNAUTHORIZED
        RestApiId:
          Ref: ApiGatewayRestApi
        StatusCode: '401'
    StorageBucket:
      Type: AWS::S3::Bucket
      DeletionPolicy: Retain
    LockTable:
      Type: AWS::DynamoDB::Table
      DeletionPolicy: Retain
      Properties:
        AttributeDefinitions:
          - AttributeName: path
            AttributeType: S
          - AttributeName: id
            AttributeType: S
        BillingMode: PAY_PER_REQUEST
        GlobalSecondaryIndexes:
          - IndexName: *idindexname
            KeySchema:
              - AttributeName: id
                KeyType: HASH
            Projection:
              ProjectionType: ALL
        KeySchema:
          - AttributeName: path
            KeyType: HASH
    UserPool:
      Type: AWS::Cognito::UserPool
      Properties: 
        AdminCreateUserConfig:
          AllowAdminCreateUserOnly: true
        UserPoolName: "${self:service}-${opt:stage}"
        UserPoolTags:
          STAGE: "${opt:stage}"
    UserPoolClient:
      Type: AWS::Cognito::UserPoolClient
      Properties: 
        ClientName: "${self:service}-${opt:stage}"
        ExplicitAuthFlows: 
          - ADMIN_NO_SRP_AUTH
        GenerateSecret: false
        SupportedIdentityProviders: 
          - COGNITO
        UserPoolId:
          Ref: UserPool