Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
ownerAuthorizationExpressions = ownerAuthorizationExpressions.concat(
comment(`Authorization rule: { allow: ${rule.allow}, ownerField: "${ownerAttribute}", identityClaim: "${identityAttribute}" }`),
set(ref(allowedOwnersVariable), ref(`${variableToCheck}.${ownerAttribute}`)),
isUser
? // tslint:disable-next-line
set(
ref('identityValue'),
raw(
`$util.defaultIfNull($ctx.identity.claims.get("${rawUsername}"), $util.defaultIfNull($ctx.identity.claims.get("${identityAttribute}"), "${NONE_VALUE}"))`
)
)
: set(ref('identityValue'), raw(`$util.defaultIfNull($ctx.identity.claims.get("${identityAttribute}"), "${NONE_VALUE}")`)),
iff(
raw(`$util.isList($${allowedOwnersVariable})`),
forEach(ref('allowedOwner'), ref(allowedOwnersVariable), [
iff(raw(`$allowedOwner == $identityValue`), set(ref(variableToSet), raw('true'))),
])
),
iff(
raw(`$util.isString($${allowedOwnersVariable})`),
iff(raw(`$${allowedOwnersVariable} == $identityValue`), set(ref(variableToSet), raw('true')))
)
);
ruleNumber++;
}
return block('Owner Authorization Checks', [set(ref(variableToSet), defaultValue), ...ownerAuthorizationExpressions]);
}
set(ref(allowedOwnersVariable), raw(`$util.defaultIfNull($${variableToCheck}.${ownerAttribute}, null)`)),
isUsern ?
// tslint:disable-next-line
set(ref('identityValue'), raw(`$util.defaultIfNull($ctx.identity.claims.get("${rawUsername}"), $util.defaultIfNull($ctx.identity.claims.get("${identityAttribute}"), "${NONE_VALUE}"))`)) :
set(ref('identityValue'), raw(`$util.defaultIfNull($ctx.identity.claims.get("${identityAttribute}"), "${NONE_VALUE}")`)),
// If a list of owners check for at least one.
iff(
raw(`$util.isList($${allowedOwnersVariable})`),
forEach(ref('allowedOwner'), ref(allowedOwnersVariable), [
iff(
raw(`$allowedOwner == $identityValue`),
set(ref(variableToSet), raw('true'))),
])
),
// If a single owner check for at least one.
iff(
raw(`$util.isString($${allowedOwnersVariable})`),
iff(
raw(`$${allowedOwnersVariable} == $identityValue`),
set(ref(variableToSet), raw('true'))),
)
)
// If the owner field is not a list and the user does not
// provide a value for the owner, set the owner automatically.
if (!ownerFieldIsList) {
ownershipAuthorizationExpressions.push(
// If the owner is not provided set it automatically.
// If the user explicitly provides null this will be false and we leave it null.
iff(
and([
raw(`$util.isNull($${allowedOwnersVariable})`),
parens(raw(`! $${variableToCheck}.containsKey("${ownerAttribute}")`)),
const ownerFieldIsList = fieldIsList(ownerAttribute)
const allowedOwnersVariable = `allowedOwners${ruleNumber}`
ownershipAuthorizationExpressions = ownershipAuthorizationExpressions.concat(
formatComment ?
comment(formatComment(rule)) :
comment(`Authorization rule: { allow: ${rule.allow}, ownerField: "${ownerAttribute}", identityField: "${identityAttribute}" }`),
set(ref(allowedOwnersVariable), raw(`$util.defaultIfNull($${variableToCheck}.${ownerAttribute}, null)`)),
isUsern ?
// tslint:disable-next-line
set(ref('identityValue'), raw(`$util.defaultIfNull($ctx.identity.claims.get("${rawUsername}"), $util.defaultIfNull($ctx.identity.claims.get("${identityAttribute}"), "${NONE_VALUE}"))`)) :
set(ref('identityValue'), raw(`$util.defaultIfNull($ctx.identity.claims.get("${identityAttribute}"), "${NONE_VALUE}")`)),
// If a list of owners check for at least one.
iff(
raw(`$util.isList($${allowedOwnersVariable})`),
forEach(ref('allowedOwner'), ref(allowedOwnersVariable), [
iff(
raw(`$allowedOwner == $identityValue`),
set(ref(variableToSet), raw('true'))),
])
),
// If a single owner check for at least one.
iff(
raw(`$util.isString($${allowedOwnersVariable})`),
iff(
raw(`$${allowedOwnersVariable} == $identityValue`),
set(ref(variableToSet), raw('true'))),
)
)
// If the owner field is not a list and the user does not
// provide a value for the owner, set the owner automatically.
if (!ownerFieldIsList) {
ownershipAuthorizationExpressions.push(
)}" })`
),
])
),
iff(
raw(`!$util.isNull($ctx.args.${argName}) && !$util.isNull($ctx.args.${argName}.eq)`),
compoundExpression([
set(ref(`${queryExprReference}.expression`), raw(`"$${queryExprReference}.expression AND #sortKey = :sortKey"`)),
qref(`$${queryExprReference}.expressionNames.put("#sortKey", "${_sortKeyName}")`),
// TODO: Handle N & B.
qref(
`$${queryExprReference}.expressionValues.put(":sortKey", { "${attributeType}": "${prefixValue(`$ctx.args.${argName}.eq`)}" })`
),
])
),
iff(
raw(`!$util.isNull($ctx.args.${argName}) && !$util.isNull($ctx.args.${argName}.lt)`),
compoundExpression([
set(ref(`${queryExprReference}.expression`), raw(`"$${queryExprReference}.expression AND #sortKey < :sortKey"`)),
qref(`$${queryExprReference}.expressionNames.put("#sortKey", "${_sortKeyName}")`),
// TODO: Handle N & B.
qref(
`$${queryExprReference}.expressionValues.put(":sortKey", { "${attributeType}": "${prefixValue(`$ctx.args.${argName}.lt`)}" })`
),
])
),
iff(
raw(`!$util.isNull($ctx.args.${argName}) && !$util.isNull($ctx.args.${argName}.le)`),
compoundExpression([
set(ref(`${queryExprReference}.expression`), raw(`"$${queryExprReference}.expression AND #sortKey <= :sortKey"`)),
qref(`$${queryExprReference}.expressionNames.put("#sortKey", "${_sortKeyName}")`),
// TODO: Handle N & B.
obj({
expression: str(""),
expressionNames: obj({}),
expressionValues: obj({})
})
),
set(ref('totalAuthExpression'), str('')),
comment('Add dynamic group auth conditions if they exist'),
iff(
ref('groupAuthExpressions'),
forEach(ref('authExpr'), ref('groupAuthExpressions'), [
set(ref('totalAuthExpression'), str(`$totalAuthExpression $authExpr`)),
iff(ref('foreach.hasNext'), set(ref('totalAuthExpression'), str(`$totalAuthExpression OR`)))
])
),
iff(
ref('groupAuthExpressionNames'),
raw(`$util.qr($${ResourceConstants.SNIPPETS.AuthCondition}.expressionNames.putAll($groupAuthExpressionNames))`)),
iff(
ref('groupAuthExpressionValues'),
raw(`$util.qr($${ResourceConstants.SNIPPETS.AuthCondition}.expressionValues.putAll($groupAuthExpressionValues))`)),
comment('Add owner auth conditions if they exist'),
iff(
raw(`$totalAuthExpression != "" && $ownerAuthExpressions && $ownerAuthExpressions.size() > 0`),
set(ref('totalAuthExpression'), str(`$totalAuthExpression OR`))
),
iff(
ref('ownerAuthExpressions'),
forEach(ref('authExpr'), ref('ownerAuthExpressions'), [
set(ref('totalAuthExpression'), str(`$totalAuthExpression $authExpr`)),
iff(ref('foreach.hasNext'), set(ref('totalAuthExpression'), str(`$totalAuthExpression OR`)))
})
),
str('_doc')
]),
list([]))
})
])
),
ResponseMappingTemplate: print(
compoundExpression([
set(ref('items'), list([])),
forEach(
ref('entry'),
ref('context.result.hits.hits'),
[
iff(
raw('!$foreach.hasNext'),
set(ref('nextToken'), str('$entry.sort.get(0)'))
),
qref('$items.add($entry.get("_source"))')
]
),
toJson(obj({
"items": ref('items'),
"total": ref('ctx.result.hits.total'),
"nextToken": ref('nextToken')
}))
])
)
}).dependsOn([
ResourceConstants.RESOURCES.ElasticsearchDataSourceLogicalID
])
public setUserGroups(customGroup?: string): Expression {
if (customGroup) {
return compoundExpression([
set(ref('userGroups'), raw(`$util.defaultIfNull($ctx.identity.claims.get("${customGroup}"), [])`)),
iff(
raw('$util.isString($userGroups)'),
ifElse(
raw('$util.isList($util.parseJson($userGroups))'),
set(ref('userGroups'), raw('$util.parseJson($userGroups)')),
set(ref('userGroups'), raw('[$userGroups]'))
)
),
]);
}
return set(ref('userGroups'), raw(`$util.defaultIfNull($ctx.identity.claims.get("${DEFAULT_GROUP_CLAIM}"), [])`));
}
public throwIfSubscriptionUnauthorized(): Expression {
const ifUnauthThrow = iff(
not(
parens(
or([
equals(ref(ResourceConstants.SNIPPETS.IsStaticGroupAuthorizedVariable), raw('true')),
equals(ref(ResourceConstants.SNIPPETS.IsOwnerAuthorizedVariable), raw('true')),
])
)
),
raw('$util.unauthorized()')
);
return block('Throw if unauthorized', [ifUnauthThrow]);
}
function setupHashKeyExpression(hashKeyName: string, hashKeyAttributeType: string, queryExprReference: string) {
return iff(
raw(`!$util.isNull($ctx.args.${hashKeyName})`),
compoundExpression([
set(ref(`${queryExprReference}.expression`), str(`#${hashKeyName} = :${hashKeyName}`)),
set(ref(`${queryExprReference}.expressionNames`), obj({ [`#${hashKeyName}`]: str(hashKeyName) })),
set(
ref(`${queryExprReference}.expressionValues`),
obj({ [`:${hashKeyName}`]: obj({ [hashKeyAttributeType]: str(`$ctx.args.${hashKeyName}`) }) })
),
])
);
}