Add GET /whoami route and pass token in authorizer context

src/authorizer.js

@@ -10,21 +10,21 @@ module.exports.auth = (event, context, callback) => {
     var token = event.authorizationToken;
     switch (token) {
         case 'allow':
-            callback(null, generatePolicy('user', 'Allow', event.methodArn));
+            callback(null, generatePolicy('user', 'Allow', event.methodArn, token));
             break;
         case 'deny':
-            callback(null, generatePolicy('user', 'Deny', event.methodArn));
+            callback(null, generatePolicy('user', 'Deny', event.methodArn, token));
             break;
         case 'unauthorized':
-            callback("Unauthorized", generatePolicy('user', 'Deny', event.methodArn));   // Return a 401 Unauthorized response
+            callback("Unauthorized", generatePolicy('user', 'Deny', event.methodArn, token));   // Return a 401 Unauthorized response
             break;
         default:
-            callback("Error: Invalid token",  generatePolicy('user', 'Deny', event.methodArn)); // Return a 500 Invalid token response
+            callback("Error: Invalid token",  generatePolicy('user', 'Deny', event.methodArn, token)); // Return a 500 Invalid token response
     }
 };
 
 // Help function to generate an IAM policy
-var generatePolicy = function(principalId, effect, resource) {
+var generatePolicy = function(principalId, effect, resource, token) {
     var authResponse = {};
 
     authResponse.principalId = principalId;
@@ -44,7 +44,8 @@ var generatePolicy = function(principalId, effect, resource) {
     authResponse.context = {
         "stringKey": "stringval",
         "numberKey": 123,
-        "booleanKey": true
+        "booleanKey": true,
+        "tokenName": token
     };
     return authResponse;
 }

src/handler.js

@@ -6,3 +6,13 @@ module.exports.hello = (event, context, callback) => {
 		}
 		callback(null, response);
 };
+
+module.exports.whoami = (event, context, callback) => {
+		const principalId = event.requestContext && event.requestContext.authorizer && event.requestContext.authorizer.principalId;
+		const response = {
+				"statusCode": 200,
+				"headers": {},
+				"body": principalId || ''
+		}
+		callback(null, response);
+};

template.yaml

@@ -26,6 +26,20 @@ Resources:
             Path: /
             Method: get
 
+  WhoAmIFunction:
+    Type: AWS::Serverless::Function
+    Properties:
+      CodeUri: ./src
+      Handler: handler.whoami
+      Runtime: nodejs20.x
+      Events:
+        GetWhoAmI:
+          Type: Api
+          Properties:
+            RestApiId: !Ref MyApi
+            Path: /whoami
+            Method: get
+
   MyAuthFunction:
     Type: AWS::Serverless::Function
     Properties:

test.sh

@@ -12,9 +12,16 @@ echo "API: $URL"
 failed=0
 # expect <description> <status> <body substring> [curl args...]
 expect() {
-  local description=$1 status=$2 substring=$3 response actual
+  local description=$1 status=$2 substring=$3 target_url=$URL response actual
   shift 3
-  response=$(curl -sk -m 30 -w '\n%{http_code}' "$URL" "$@")
+  if [[ "${1:-}" == http* ]]; then
+    target_url=$1
+    shift
+  elif [[ "${1:-}" == /* ]]; then
+    target_url="${URL%/}$1"
+    shift
+  fi
+  response=$(curl -sk -m 30 -w '\n%{http_code}' "$target_url" "$@")
   actual=${response##*$'\n'}
   response=${response%$'\n'*}
   if [ "$actual" = "$status" ] && [[ "$response" == *"$substring"* ]]; then
@@ -30,6 +37,7 @@ expect "token 'deny'" 403 "explicit deny" -H "Authorization: deny"
 expect "token 'unauthorized'" 401 "Unauthorized" -H "Authorization: unauthorized"
 expect "any other token" 500 "" -H "Authorization: none"
 expect "no token" 401 "Unauthorized"
+expect "whoami token 'allow'" 200 "user" "${URL}whoami" -H "Authorization: allow"
 
 if [ "$failed" != 0 ]; then
   echo "Test failed"