serverless.yml

# NOTE: update this with your service name
service: ppp-service

frameworkVersion: ^3.22.0
# Use the serverless-webpack plugin to transpile ES6
plugins:
  - serverless-webpack
  - serverless-offline
custom:
  # Our stage is based on what is passed in when running serverless
  # commands. Or fallsback to what we have set in the provider section.
  stage: ${opt:stage, self:provider.stage}
  # Set the table name here so we can use it while testing locally
  profileTableName: ${self:custom.stage}-ppp-profile
  messageTableName: ${self:custom.stage}-ppp-message
  chatTableName: ${self:custom.stage}-ppp-chat
  appTableName: ${self:custom.stage}-ppp-app
  uniqueAppDomainTableName: ${self:custom.stage}-ppp-unique-app-domain
  oauthTableName: ${self:custom.stage}-ppp-oauth
  scopeTableName: ${self:custom.stage}-ppp-scope
  userPoolName: ${self:custom.stage}-ppp-service
  userPoolClientName: ${self:custom.stage}-ppp-service
  identityPoolName: ${self:custom.stage}-ppp-service
  # Set our DynamoDB throughput for prod and all other non-prod stages.
  tableThroughputs:
    prod: 5
    default: 1
  tableThroughput: ${self:custom.tableThroughputs.${self:custom.stage}, self:custom.tableThroughputs.default}
  # Load our webpack config
  webpack:
    webpackConfig: ./webpack.config.js
    includeModules: true
  # Load our secret environment variables based on the current stage.
  # Fallback to default if it is not in prod.
  # environment: ${env:} #${file(env.yml):${self:custom.stage}, file(env.yml):default}

provider:
  name: aws
  runtime: nodejs16.x
  stage: dev
  region: us-east-1
  apiGateway:
    # apiKeys:
    #   - ${self:custom.stage}-ppp-service-trada
    usagePlan:
      quota:
        limit: 1000
        period: DAY
      throttle:
        burstLimit: 200
        rateLimit: 100

  environment:
    profileTableName: ${self:custom.profileTableName}
    messageTableName: ${self:custom.messageTableName}
    chatTableName: ${self:custom.chatTableName}
    appTableName: ${self:custom.appTableName}
    uniqueAppDomainTableName: ${self:custom.uniqueAppDomainTableName}
    oauthTableName: ${self:custom.oauthTableName}
    scopeTableName: ${self:custom.scopeTableName}
    twilioAccountSid: ${env:twilioAccountSid}
    twilioAuthToken: ${env:twilioAuthToken}
    # msgPrefix: ${self:custom.environment.msgPrefix}
    sendGridKey: ${env:sendGridKey}
    openIdSignaturePrivateKeyParamName: ${env.openIdSignaturePrivateKeyParamName}
    openIdIssuingAuthority: ${env.openIdIssuingAuthority}
    userPoolName: ${self:custom.userPoolName}
    identityPoolName: ${self:custom.identityPoolName}
    userPoolClientName: ${self:custom.userPoolClientName}
    eosHistoryEndpoint: ${env:eosHistoryEndpoint}
    eosHttpEndpoint: ${env:eosHttpEndpoint}
    authContract: ${env:authContract}
    authVerifier: ${env:authVerifier}
    authRetries: ${env:authRetries}
    startAuthTimeout: ${env:startAuthTimeout}
    minAuthTimeout: ${env:minAuthTimeout}
    chainId: ${env:chainId}
    authCodeMinutesTTL: ${env:authCodeMinutesTTL}
    accessTokenMinutesTTL: ${env:accessTokenMinutesTTL}
    refreshTokenMinutesTTL: ${env:refreshTokenMinutesTTL}
    sentryDsn: ${env:sentryDsn}

  iam:
    role: 
      statements:
        - Effect: Allow
          Action:
            - dynamodb:DescribeTable
            - dynamodb:Query
            - dynamodb:Scan
            - dynamodb:DeleteItem
            - dynamodb:GetItem
            - dynamodb:PutItem
            - dynamodb:UpdateItem
            - dynamodb:BatchGetItem
            - dynamodb:BatchWriteItem
            - dynamodb:TransactWrite
            - dynamodb:TransactGet
            - dynamodb:ListStreams
          Resource:
            - "Fn::GetAtt": [ ProfileTable, Arn ]
            - "Fn::GetAtt": [ MessageTable, Arn ]
            - "Fn::GetAtt": [ ChatTable, Arn ]
            - "Fn::GetAtt": [ AppTable, Arn ]
            - "Fn::GetAtt": [ UniqueAppDomainTable, Arn ]
            - "Fn::GetAtt": [ OauthTable, Arn ]
            - "Fn::GetAtt": [ ScopeTable, Arn ]
        - Effect: Allow
          Action:
            - dynamodb:Query
          Resource: 
            - { "Fn::Join": [ "/", [ 
                { "Fn::GetAtt": ["ProfileTable", "Arn" ] }, "index", "*" 
              ]]}
            - { "Fn::Join": [ "/", [ 
                { "Fn::GetAtt": ["MessageTable", "Arn" ] }, "index", "*" 
              ]]}
            - { "Fn::Join": [ "/", [ 
                { "Fn::GetAtt": ["ChatTable", "Arn" ] }, "index", "*" 
              ]]}
            - { "Fn::Join": [ "/", [ 
                { "Fn::GetAtt": ["AppTable", "Arn" ] }, "index", "*" 
              ]]}
            - { "Fn::Join": [ "/", [ 
                { "Fn::GetAtt": ["UniqueAppDomainTable", "Arn" ] }, "index", "*" 
              ]]}
            - { "Fn::Join": [ "/", [ 
                { "Fn::GetAtt": ["OauthTable", "Arn" ] }, "index", "*" 
              ]]}
            - { "Fn::Join": [ "/", [ 
                { "Fn::GetAtt": ["ScopeTable", "Arn" ] }, "index", "*" 
              ]]}
        - Effect: Allow
          Action:
            - secretsmanager:Describe*
            - secretsmanager:Get*
            - secretsmanager:List
          Resource: "*"
        - Effect: Allow
          Action:
            - cognito-idp:ListUsers
          Resource: "*"
        - Effect: Allow
          Action:
            - ssm:GetParameter
          Resource: "*"
      

functions:
  oauth-authorizer:
      handler: oauth-authorizer.main
  register:
    handler: register.main
    events:
      - http:
          path: register
          method: post
          authorizer: aws_iam
          cors: true

  send-msg:
    handler: send-msg.main
    events:
      - http:
          path: send-msg
          method: post
          authorizer: aws_iam
          cors: true

  #send-msg-prv:
   # handler: send-msg.main
    #events:
     # - http:
      #    path: send-msg-prv
       #   method: post
        #  private: true
         # cors: true
    
  get-profiles:
    handler: get-profiles.main
    events:
      - http:
          path: get-profiles
          method: post
          cors: true

  get-messages:
    handler: get-messages.main
    events:
      - http:
          path: get-messages
          method: post
          authorizer: aws_iam
          cors: true  

  verify-sms:
    handler: verify-otp.sms
    events:
      - http:
          path: verify-sms
          method: post
          authorizer: aws_iam
          cors: true  

  verify-email:
    handler: verify-otp.email
    events:
      - http:
          path: verify-email
          method: post
          authorizer: aws_iam
          cors: true
          
  get-profile:
    handler: get-profile.main
    events:
      - http:
          path: get-profile
          method: post
          authorizer: aws_iam
          cors: true
  get-profile-oauth:
    handler: get-profile.main
    events:
      - http:
          path: get-profile-oauth
          method: post
          authorizer:
            type: request 
            name: oauth-authorizer
          cors: true
      - http:
          path: get-profile-oauth
          method: get
          authorizer:
            name: oauth-authorizer
            type: request
          cors: true
  get-chats:
    handler: get-chats.main
    events:
      - http:
          path: get-chats
          method: post
          authorizer: aws_iam
          cors: true
  register-app:
    handler: register-app.main
    events:
      - http:
          path: register-app
          method: post
          authorizer: aws_iam
          cors: true
  delete-app:
    handler: delete-app.main
    events:
      - http:
          path: delete-app
          method: post
          authorizer: aws_iam
          cors: true
  get-apps:
    handler: get-apps.main
    events:
      - http:
          path: get-apps
          method: post
          authorizer: aws_iam
          cors: true
  get-my-apps:
    handler: get-my-apps.main
    events:
      - http:
          path: get-my-apps
          method: post
          authorizer: aws_iam
          cors: true
  get-authorized-apps:
    handler: get-authorized-apps.main
    events:
      - http:
          path: get-authorized-apps
          method: post
          authorizer: aws_iam
          cors: true
  revoke-access:
    handler: revoke-access.main
    events:
      - http:
          path: revoke-access
          method: post
          authorizer: aws_iam
          cors: true
  update-app-oauth-status:
    handler: update-app-oauth-status.main
    events:
      - http:
          path: update-app-oauth-status
          method: post
          authorizer: aws_iam
          cors: true
  search-profiles:
    handler: search-profiles.main
    events:
      - http:
          path: search-profiles
          method: post
          authorizer: aws_iam
          cors: true
  oauth-auth-context:
    handler: get-authorization-request-context.main
    events:
      - http:
          path: oauth-auth-context
          method: get
          cors: true
  oauth-auth-code:
    handler: get-authorization-code.main
    events:
      - http:
          path: oauth-auth-code
          method: post
          authorizer: aws_iam
          cors: true
  oauth-token:
    handler: get-access-token.main
    events:
      - http:
          path: oauth-token
          method: post
          cors: true
  pre-sign-up:
    handler: pre-sign-up.main
    events:
      - cognitoUserPool:
          pool: PPPServicePool
          trigger: PreSignUp
  create-auth-challenge:
    handler: create-auth-challenge.main
    events:
      - cognitoUserPool:
          pool: PPPServicePool
          trigger: CreateAuthChallenge
  verify-auth-challenge:
    handler: verify-auth-challenge.main
    events:
      - cognitoUserPool:
          pool: PPPServicePool
          trigger: VerifyAuthChallengeResponse
  define-auth-challenge:
    handler: define-auth-challenge.main
    events:
      - cognitoUserPool:
          pool: PPPServicePool
          trigger: DefineAuthChallenge
  profile-handle-app-updates:
    handler: profile-handle-app-updates.main
    events:
      - stream:
          type: dynamodb
          batchSize: 1
          startingPosition: LATEST
          arn:
            Fn::GetAtt:
              - AppTable
              - StreamArn
  oauth-handle-app-updates:
    handler: oauth-handle-app-updates.main
    events:
      - stream:
          type: dynamodb
          batchSize: 1
          startingPosition: LATEST
          arn:
            Fn::GetAtt:
              - AppTable
              - StreamArn
  handle-profile-updates:
    handler: handle-profile-updates.main
    events:
      - stream:
          type: dynamodb
          batchSize: 1
          startingPosition: LATEST
          arn:
            Fn::GetAtt:
              - ProfileTable
              - StreamArn
          
resources:
  # Congnito User Pool
  - ${file(resources/cognito-user-pool.yml)}
  # Congnito Identity Pool
  - ${file(resources/cognito-identity-pool.yml)}
  # API Gateway Errors
  - ${file(resources/api-gateway-errors.yml)}
  # DynamoDB
  - ${file(resources/profile-table.yml)}
  - ${file(resources/message-table.yml)}
  - ${file(resources/app-table.yml)}
  - ${file(resources/unique-app-domain-table.yml)}
  - ${file(resources/chat-table.yml)}
  - ${file(resources/oauth-table.yml)}
  - ${file(resources/scope-table.yml)}
  # S3 Bucket
  - ${file(resources/s3-bucket.yml)}