Aws alb schema

lib/plugins/aws/package/compile/events/alb/index.js

@@ -7,6 +7,12 @@ const compileTargetGroups = require('./lib/targetGroups');
 const compileListenerRules = require('./lib/listenerRules');
 const compilePermissions = require('./lib/permissions');
 
+function arrayOrSingleSchema(schema) {
+  return {
+    oneOf: [schema, { type: 'array', items: schema }],
+  };
+}
+
 class AwsCompileAlbEvents {
   constructor(serverless, options) {
     this.serverless = serverless;
@@ -28,8 +34,80 @@ class AwsCompileAlbEvents {
       },
     };
 
-    // TODO: Complete schema, see https://github.com/serverless/serverless/issues/8020
-    this.serverless.configSchemaHandler.defineFunctionEvent('aws', 'alb', { type: 'object' });
+    this.serverless.configSchemaHandler.defineFunctionEvent('aws', 'alb', {
+      type: 'object',
+      properties: {
+        authorizer: arrayOrSingleSchema({ type: 'string' }),
+        conditions: {
+          type: 'object',
+          properties: {
+            header: {
+              type: 'object',
+              properties: {
+                name: { type: 'string', maxLength: 40 },
+                values: { type: 'array', items: { type: 'string', maxLength: 128 } },
+              },
+              additionalProperties: false,
+              required: ['name', 'values'],
+            },
+            host: arrayOrSingleSchema({
+              type: 'string',
+              pattern: '^[A-Za-z0-9*?.-]+$',
+              maxLength: 128,
+            }),
+            ip: arrayOrSingleSchema({
+              oneOf: [
+                { type: 'string', format: 'ipv4' },
+                { type: 'string', format: 'ipv6' },
+              ],
+            }),
+            method: arrayOrSingleSchema({ type: 'string', pattern: '^[A-Z_-]+$', maxLength: 40 }),
+            path: arrayOrSingleSchema({
+              type: 'string',
+              pattern: '^([A-Za-z0-9*?_.$/~"\'@:+-]|&)+$',
+              maxLength: 128,
+            }),
+            query: {
+              type: 'object',
+              additionalProperties: { type: 'string', maxLength: 128 },
+              propertyNames: { type: 'string', maxLength: 128 },
+            },
+          },
+          required: ['path'],
+          additionalProperties: false,
+        },
+        healthCheck: {
+          oneOf: [
+            { type: 'boolean' },
+            {
+              type: 'object',
+              properties: {
+                healthyThresholdCount: { type: 'integer', minimum: 2, maximum: 10 },
+                intervalSeconds: { type: 'integer', minimum: 5, maximum: 300 },
+                matcher: {
+                  type: 'object',
+                  properties: {
+                    httpCode: { type: 'string', pattern: '^d{3}(-d{3})?(,d{3}(-d{3})?)*$' }, // eslint-disable-line no-useless-escape
+                  },
+                  additionalProperties: false,
+                },
+                path: { type: 'string', minLength: 1, maxLength: 1024 },
+                timeoutSeconds: { type: 'integer', minimum: 2, maximum: 120 },
+                unhealthyThresholdCount: { type: 'integer', minimum: 2, maximum: 10 },
+              },
+              additionalProperties: false,
+            },
+          ],
+        },
+        listenerArn: {
+          oneOf: [{ $ref: '#/definitions/awsAlbListenerArn' }, { $ref: '#/definitions/awsCfRef' }],
+        },
+        multiValueHeaders: { type: 'boolean' },
+        priority: { type: 'integer', minimum: 1, maximum: 50000 },
+      },
+      required: ['listenerArn', 'priority', 'conditions'],
+      additionalProperties: false,
+    });
   }
 }
 

lib/plugins/aws/package/compile/events/alb/index.test.js

@@ -93,7 +93,7 @@ describe('AwsCompileAlbEvents', () => {
               {
                 type: 'cognito',
                 userPoolClientId: 'userPoolClientId',
-                userPoolArn: 'userPoolArn',
+                userPoolArn: 'arn:userPoolArn',
                 userPoolDomain: 'userPoolDomain',
                 scope: 'openid',
                 sessionCookieName: 'sessionCookie',
@@ -127,7 +127,7 @@ describe('AwsCompileAlbEvents', () => {
     const baseAuthenticateCognitoConfig = (override = {}) =>
       Object.assign(
         {
-          UserPoolArn: 'userPoolArn',
+          UserPoolArn: 'arn:userPoolArn',
           UserPoolClientId: 'userPoolClientId',
           UserPoolDomain: 'userPoolDomain',
           OnUnauthenticatedRequest: 'deny',

lib/plugins/aws/package/compile/events/alb/lib/validate.js

@@ -2,28 +2,18 @@
 
 const _ = require('lodash');
 
-// eslint-disable-next-line max-len
-const CIDR_IPV6_PATTERN = /^s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:)))(%.+)?s*(\/([0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))$/;
-const CIDR_IPV4_PATTERN = /^([0-9]{1,3}\.){3}[0-9]{1,3}(\/([0-9]|[1-2][0-9]|3[0-2]))$/;
-// see https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-elb-application
-const ALB_LISTENER_PATTERN = /^arn:aws[\w-]*:elasticloadbalancing:.+:listener\/app\/[\w-]+\/([\w-]+)\/([\w-]+)$/;
-
 module.exports = {
+  // see https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-elb-application
+  ALB_LISTENER_REGEXP: new RegExp(
+    '^arn:aws[\\w-]*:elasticloadbalancing:.+:listener\\/app\\/[\\w-]+\\/([\\w-]+)\\/([\\w-]+)$'
+  ),
+
   validate() {
     const authorizers = {};
     const albAuthConfig = this.serverless.service.provider.alb;
     if (albAuthConfig) {
       for (const [name, auth] of Object.entries(albAuthConfig.authorizers)) {
-        switch (auth.type) {
-          case 'cognito':
-          case 'oidc':
-            authorizers[name] = this.validateAlbAuth(auth);
-            break;
-          default:
-            throw new this.serverless.classes.Error(
-              `Authorizer type "${auth.type}" not supported. Only "cognito" and "oidc" are supported`
-            );
-        }
+        authorizers[name] = this.validateAlbAuth(auth);
       }
     }
 
@@ -58,13 +48,13 @@ module.exports = {
               albObj.conditions.method = [].concat(event.alb.conditions.method);
             }
             if (event.alb.conditions.header) {
-              albObj.conditions.header = this.validateHeaderCondition(event, functionName);
+              albObj.conditions.header = event.alb.conditions.header;
             }
             if (event.alb.conditions.query) {
-              albObj.conditions.query = this.validateQueryCondition(event, functionName);
+              albObj.conditions.query = event.alb.conditions.query;
             }
             if (event.alb.conditions.ip) {
-              albObj.conditions.ip = this.validateIpCondition(event, functionName);
+              albObj.conditions.ip = [].concat(event.alb.conditions.ip);
             }
             if (event.alb.multiValueHeaders) {
               albObj.multiValueHeaders = event.alb.multiValueHeaders;
@@ -89,21 +79,13 @@ module.exports = {
   },
 
   validateListenerArn(listenerArn, functionName) {
-    if (!listenerArn) {
-      throw new this.serverless.classes.Error(
-        `listenerArn is missing in function "${functionName}".`
-      );
-    }
     // If the ARN is a ref, use the logical ID instead of the ALB ID
     if (_.isObject(listenerArn)) {
       if (listenerArn.Ref) {
         return { albId: listenerArn.Ref, listenerId: listenerArn.Ref };
       }
-      throw new this.serverless.classes.Error(
-        `Invalid ALB listenerArn in function "${functionName}".`
-      );
     }
-    const matches = listenerArn.match(ALB_LISTENER_PATTERN);
+    const matches = listenerArn.match(this.ALB_LISTENER_REGEXP);
     if (!matches) {
       throw new this.serverless.classes.Error(
         `Invalid ALB listenerArn in function "${functionName}".`
@@ -112,53 +94,6 @@ module.exports = {
     return { albId: matches[1], listenerId: matches[2] };
   },
 
-  validateHeaderCondition(event, functionName) {
-    const messageTitle = `Invalid ALB event "header" condition in function "${functionName}".`;
-    if (
-      !_.isObject(event.alb.conditions.header) ||
-      !event.alb.conditions.header.name ||
-      !event.alb.conditions.header.values
-    ) {
-      const errorMessage = [
-        messageTitle,
-        ' You must provide an object with "name" and "values" properties.',
-      ].join('');
-      throw new this.serverless.classes.Error(errorMessage);
-    }
-    if (!Array.isArray(event.alb.conditions.header.values)) {
-      const errorMessage = [messageTitle, ' Property "values" must be an array.'].join('');
-      throw new this.serverless.classes.Error(errorMessage);
-    }
-    return event.alb.conditions.header;
-  },
-
-  validateQueryCondition(event, functionName) {
-    if (!_.isObject(event.alb.conditions.query)) {
-      const errorMessage = [
-        `Invalid ALB event "query" condition in function "${functionName}".`,
-        ' You must provide an object.',
-      ].join('');
-      throw new this.serverless.classes.Error(errorMessage);
-    }
-    return event.alb.conditions.query;
-  },
-
-  validateIpCondition(event, functionName) {
-    const cidrBlocks = [].concat(event.alb.conditions.ip);
-    const allValuesAreCidr = cidrBlocks.every(
-      cidr => CIDR_IPV4_PATTERN.test(cidr) || CIDR_IPV6_PATTERN.test(cidr)
-    );
-
-    if (!allValuesAreCidr) {
-      const errorMessage = [
-        `Invalid ALB event "ip" condition in function "${functionName}".`,
-        ' You must provide values in a valid IPv4 or IPv6 CIDR format.',
-      ].join('');
-      throw new this.serverless.classes.Error(errorMessage);
-    }
-    return cidrBlocks;
-  },
-
   validatePriorities(albEvents) {
     let comparator;
     let duplicates;