From 2bbc00a328d3493d5f4cad02c63f2aeeaff3f5b0 Mon Sep 17 00:00:00 2001
From: "localstack-platform[bot]"
 <301951621+localstack-platform[bot]@users.noreply.github.com>
Date: Tue, 27 Oct 2026 19:53:49 +0000
Subject: [PATCH 1/2] Add GET /whoami route and pass token in authorizer
 context

Added a GET /whoami route to the SAM template and a whoami handler in src/handler.js returning principalId. Updated the authorizer in src/authorizer.js to include token details in context, and added assertions in test.sh for /whoami.

Co-authored-by: harsh <harsh@localstack.cloud>
---
 src/authorizer.js | 14 ++++++++------
 src/handler.js    | 10 ++++++++++
 template.yaml     | 14 ++++++++++++++
 test.sh           | 12 ++++++++++--
 4 files changed, 42 insertions(+), 8 deletions(-)

diff --git a/src/authorizer.js b/src/authorizer.js
index c8780c7..12f93a4 100644
--- a/src/authorizer.js
+++ b/src/authorizer.js
@@ -10,21 +10,21 @@ module.exports.auth = (event, context, callback) => {
     var token = event.authorizationToken;
     switch (token) {
         case 'allow':
-            callback(null, generatePolicy('user', 'Allow', event.methodArn));
+            callback(null, generatePolicy('user', 'Allow', event.methodArn, token));
             break;
         case 'deny':
-            callback(null, generatePolicy('user', 'Deny', event.methodArn));
+            callback(null, generatePolicy('user', 'Deny', event.methodArn, token));
             break;
         case 'unauthorized':
-            callback("Unauthorized", generatePolicy('user', 'Deny', event.methodArn));   // Return a 401 Unauthorized response
+            callback("Unauthorized", generatePolicy('user', 'Deny', event.methodArn, token));   // Return a 401 Unauthorized response
             break;
         default:
-            callback("Error: Invalid token",  generatePolicy('user', 'Deny', event.methodArn)); // Return a 500 Invalid token response
+            callback("Error: Invalid token",  generatePolicy('user', 'Deny', event.methodArn, token)); // Return a 500 Invalid token response
     }
 };
 
 // Help function to generate an IAM policy
-var generatePolicy = function(principalId, effect, resource) {
+var generatePolicy = function(principalId, effect, resource, token) {
     var authResponse = {};
 
     authResponse.principalId = principalId;
@@ -44,7 +44,9 @@ var generatePolicy = function(principalId, effect, resource) {
     authResponse.context = {
         "stringKey": "stringval",
         "numberKey": 123,
-        "booleanKey": true
+        "booleanKey": true,
+        "token": token,
+        "tokenName": token
     };
     return authResponse;
 }
\ No newline at end of file
diff --git a/src/handler.js b/src/handler.js
index 8777eeb..43bbb5f 100644
--- a/src/handler.js
+++ b/src/handler.js
@@ -6,3 +6,13 @@ module.exports.hello = (event, context, callback) => {
 		}
 		callback(null, response);
 };
+
+module.exports.whoami = (event, context, callback) => {
+		const principalId = event.requestContext && event.requestContext.authorizer && event.requestContext.authorizer.principalId;
+		const response = {
+				"statusCode": 200,
+				"headers": {},
+				"body": principalId || ''
+		}
+		callback(null, response);
+};
diff --git a/template.yaml b/template.yaml
index 5cd22e5..7648413 100644
--- a/template.yaml
+++ b/template.yaml
@@ -26,6 +26,20 @@ Resources:
             Path: /
             Method: get
 
+  WhoAmIFunction:
+    Type: AWS::Serverless::Function
+    Properties:
+      CodeUri: ./src
+      Handler: handler.whoami
+      Runtime: nodejs20.x
+      Events:
+        GetWhoAmI:
+          Type: Api
+          Properties:
+            RestApiId: !Ref MyApi
+            Path: /whoami
+            Method: get
+
   MyAuthFunction:
     Type: AWS::Serverless::Function
     Properties:
diff --git a/test.sh b/test.sh
index 68ccf68..37dec7c 100755
--- a/test.sh
+++ b/test.sh
@@ -12,9 +12,16 @@ echo "API: $URL"
 failed=0
 # expect <description> <status> <body substring> [curl args...]
 expect() {
-  local description=$1 status=$2 substring=$3 response actual
+  local description=$1 status=$2 substring=$3 target_url=$URL response actual
   shift 3
-  response=$(curl -sk -m 30 -w '\n%{http_code}' "$URL" "$@")
+  if [[ "${1:-}" == http* ]]; then
+    target_url=$1
+    shift
+  elif [[ "${1:-}" == /* ]]; then
+    target_url="${URL%/}$1"
+    shift
+  fi
+  response=$(curl -sk -m 30 -w '\n%{http_code}' "$target_url" "$@")
   actual=${response##*$'\n'}
   response=${response%$'\n'*}
   if [ "$actual" = "$status" ] && [[ "$response" == *"$substring"* ]]; then
@@ -30,6 +37,7 @@ expect "token 'deny'" 403 "explicit deny" -H "Authorization: deny"
 expect "token 'unauthorized'" 401 "Unauthorized" -H "Authorization: unauthorized"
 expect "any other token" 500 "" -H "Authorization: none"
 expect "no token" 401 "Unauthorized"
+expect "whoami token 'allow'" 200 "user" "${URL}whoami" -H "Authorization: allow"
 
 if [ "$failed" != 0 ]; then
   echo "Test failed"

From 9948e7c0c70cd7400fb8a2267b9f661f0ba24cdf Mon Sep 17 00:00:00 2001
From: "localstack-platform[bot]"
 <301951621+localstack-platform[bot]@users.noreply.github.com>
Date: Tue, 27 Oct 2026 19:56:38 +0000
Subject: [PATCH 2/2] Remove duplicate token key from authorizer context

Removed the duplicate token property from authResponse.context in src/authorizer.js, retaining only the tokenName key in the authorizer context.

Co-authored-by: harsh <harsh@localstack.cloud>
---
 src/authorizer.js | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/authorizer.js b/src/authorizer.js
index 12f93a4..4e57e64 100644
--- a/src/authorizer.js
+++ b/src/authorizer.js
@@ -45,7 +45,6 @@ var generatePolicy = function(principalId, effect, resource, token) {
         "stringKey": "stringval",
         "numberKey": 123,
         "booleanKey": true,
-        "token": token,
         "tokenName": token
     };
     return authResponse;