serverless.yml

org: photonadmin # Corresponds to the serverless.com account used for monitoring
app: photonranch

service: photonranch-projects

package:
  patterns:
    - '!venv/**'
    - '!node_modules/**'

plugins:
  - serverless-python-requirements
  - serverless-dynamodb-pitr
  - serverless-domain-manager

custom:

  # define the name for the projects dynamodb table
  projectsTable: projects-${self:provider.stage}

  # Enable point-in-time-recovery
  pitr:
    - tableName: ${self:custom.projectsTable}
      enabled: true

  # This is the 'variable' for the customDomain.basePath value, based on the stage.
  # Run as `sls deploy --stage <stage_name>`
  stage:
    prod: projects
    dev: dev
    test: test 

  # Since lambda runs on a linux instance, we need to zip the requirements in a linux docker container.
  pythonRequirements:
    dockerizePip: non-linux
    useDownloadCache: false 
    useStaticCache: false

  customDomain:
    domainName: 'projects.photonranch.org'
    basePath: ${self:custom.stage.${self:provider.stage}}
    stage: ${self:provider.stage}
    createRoute53Record: true

provider:
  name: aws
  stage: ${opt:stage, "test"}
  runtime: python3.9
  region: us-east-1
  environment: 
    PROJECTS_TABLE: ${self:custom.projectsTable}
    AUTH0_CLIENT_ID: ${file(./secrets.json):AUTH0_CLIENT_ID}
    AUTH0_CLIENT_PUBLIC_KEY: ${file(./public_key)}
    STAGE: ${self:provider.stage}
  iam:
    role:
      statements:
      - Effect: Allow 
        Action: 
          - "dynamodb:PutItem"
          - "dynamodb:GetItem"
          - "dynamodb:UpdateItem"
          - "dynamodb:DeleteItem"
          - "dynamodb:Scan"
          - "dynamodb:Query"
        Resource:
          - "arn:aws:dynamodb:${self:provider.region}:*:table/${self:provider.environment.PROJECTS_TABLE}*"

resources: # CloudFormation template syntax from here on.
  Resources:

    # Configure API gateway "Gateway Responses" to work with CORS restrictions
    GatewayResponseDefault4XX:
      Type: 'AWS::ApiGateway::GatewayResponse'
      Properties:
        ResponseParameters:
          gatewayresponse.header.Access-Control-Allow-Origin: "'*'"
          gatewayresponse.header.Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'"
          gatewayresponse.header.Access-Control-Allow-Methods: "'GET,POST,OPTIONS'"
        ResponseType: DEFAULT_4XX
        RestApiId:
          Ref: 'ApiGatewayRestApi'
    GatewayResponseDefault5XX:
      Type: 'AWS::ApiGateway::GatewayResponse'
      Properties:
        ResponseParameters:
          gatewayresponse.header.Access-Control-Allow-Origin: "'*'"
          gatewayresponse.header.Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'"
          gatewayresponse.header.Access-Control-Allow-Methods: "'GET,POST,OPTIONS'"
        ResponseType: DEFAULT_4XX
        RestApiId:
          Ref: 'ApiGatewayRestApi'
    GatewayResponse:
      Type: 'AWS::ApiGateway::GatewayResponse'
      Properties:
        ResponseParameters:
          gatewayresponse.header.Access-Control-Allow-Origin: "'*'"
          gatewayresponse.header.Access-Control-Allow-Headers: "'*'"
        ResponseType: EXPIRED_TOKEN
        RestApiId:
          Ref: 'ApiGatewayRestApi'
        StatusCode: '401'
    AuthFailureGatewayResponse:
      Type: 'AWS::ApiGateway::GatewayResponse'
      Properties:
        ResponseParameters:
          gatewayresponse.header.Access-Control-Allow-Origin: "'*'"
          gatewayresponse.header.Access-Control-Allow-Headers: "'*'"
        ResponseType: UNAUTHORIZED
        RestApiId:
          Ref: 'ApiGatewayRestApi'
        StatusCode: '401'

    # Define the dynamodb table we use to store projects

    projectsTable: 
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: ${self:custom.projectsTable}
        AttributeDefinitions:
          - AttributeName: project_name
            AttributeType: S
          - AttributeName: user_id
            AttributeType: S
          - AttributeName: created_at
            AttributeType: S
          #- AttributeName: site
            #AttributeType: S
          #- AttributeName: creator_id
            #AttributeType: S
        KeySchema:
          - AttributeName: project_name
            KeyType: HASH
          - AttributeName: created_at
            KeyType: RANGE
        GlobalSecondaryIndexes:
          - IndexName: userid-createdat-index
            KeySchema:
              - AttributeName: user_id
                KeyType: HASH
              - AttributeName: created_at
                KeyType: RANGE
            Projection:
              ProjectionType: ALL
            ProvisionedThroughput:
              ReadCapacityUnits: 1
              WriteCapacityUnits: 1
        ProvisionedThroughput:
          ReadCapacityUnits: 1
          WriteCapacityUnits: 1

functions:
  authorizerFunc: 
    handler: authorizer.auth
  addNewProject:
    handler: handler.addNewProject
    events:
      - http:
          path: new-project
          method: post
          #authorizer:
            #name: authorizerFunc
            #resultTtlInSeconds: 0 # Don't cache the policy or other tasks will fail!
          cors: true
  modifyProject:
    handler: handler.modify_project_handler
    events:
      - http:
          path: modify-project
          method: post
          cors: true
  getProject:
    handler: handler.get_project_handler
    events:
      - http:
          path: get-project
          method: post
          #authorizer:
            #name: authorizerFunc
            #resultTtlInSeconds: 0 # Don't cache the policy or other tasks will fail!
          cors: true
  addProjectData:
    handler: handler.addProjectData
    events:
      - http:
          path: add-project-data
          method: post
          cors: true
  addProjectEvent:
    handler: handler.addProjectEvent
    events:
      - http:
          path: add-project-event
          method: post
          cors: true
  deleteProject:
    handler: handler.deleteProject
    events:
      - http:
          path: delete-project
          method: post
          authorizer:
            name: authorizerFunc
            resultTtlInSeconds: 0 # Don't cache the policy or other tasks will fail!
          cors: true
  deleteSchedulerProjects:
    handler: handler.deleteSchedulerProjects
    events:
      - http:
          path: delete-scheduler-projects
          method: post
          cors: true
  getAllProjects:
    handler: handler.getAllProjects
    events:
      - http:
          path: get-all-projects
          method: post
          cors: true
  getUserProjects:
    handler: handler.getUserProjects
    events:
      - http:
          path: get-user-projects
          method: post
          #authorizer:
            #name: authorizerFunc
            #resultTtlInSeconds: 0 # Don't cache the policy or other tasks will fail!
          cors: true