service: heisenberg-authorizers
package:
  excludeDevDependencies: true
  individually: true
  exclude:
    - database/**
    - docker/**
    - openapi/**
    - .serverless/**
    - serverless/**
    - src/**
    - tests/**
    - .env
    - .env.example
    - env.yml.example
    - "*.env.yml"
    - .gitlab-ci.yml
    - .gitignore
    - README.md
    - node_modules/**
    - tests/**

plugins:
  - serverless-jetpack

app:  heisenberg-authorizers

provider:
  name: aws
  runtime: nodejs14.x
  stage: dev
  region: eu-west-1
  deploymentBucket:
    name: heisenberg-serverless-deployments-${self:custom.stage}


custom:
  # General
  stage: "${opt:stage, self:provider.stage}"
  region: ${opt:region, self:provider.region}
  accountId: ${file(./serverless/helpers/account-id.js):getAccountId}
  # Layer
  authorizeLayer: arn:aws:lambda:${self:custom.region}:${self:custom.accountId}:layer:authorize-${self:custom.stage}:${file(${self:custom.stage}.env.yml):layer-versions.AUTHORIZE}
  
functions:
  SuperAdminAuthorize:
    handler: src/authorizers/super-admin-authorizer/handler.handle
    name: super-admin-authorize-${self:custom.stage}
    memorySize: 128
    timeout: 6
    environment: ${file(${self:custom.stage}.env.yml):admin-cognito-lambda}
    role: AuthorizerRole
    layers:
      - ${self:custom.authorizeLayer}
    package:  
      include:
        - src/authorizers/super-admin-authorizer/**

  PrescriptionAuthorize:
    handler: src/authorizers/prescription-authorizer/handler.handle
    name: prescription-authorize-${self:custom.stage}
    memorySize: 128
    timeout: 6
    environment: ${file(${self:custom.stage}.env.yml):admin-cognito-lambda}
    role: AuthorizerRole
    layers:
      - ${self:custom.authorizeLayer}
    package:  
      include:
        - src/authorizers/prescription-authorizer/**

  FulfilmentAuthorize:
    handler: src/authorizers/fulfilment-authorizer/handler.handle
    name: fulfilment-authorize-${self:custom.stage}
    memorySize: 128
    timeout: 6
    environment: ${file(${self:custom.stage}.env.yml):admin-cognito-lambda}
    role: AuthorizerRole
    layers:
      - ${self:custom.authorizeLayer}
    package:  
      include:
        - src/authorizers/fulfilment-authorizer/**

  PackagingAuthorize:
    handler: src/authorizers/packaging-authorizer/handler.handle
    name: packaging-authorize-${self:custom.stage}
    memorySize: 128
    timeout: 6
    environment: ${file(${self:custom.stage}.env.yml):admin-cognito-lambda}
    role: AuthorizerRole
    layers:
      - ${self:custom.authorizeLayer}
    package:  
      include:
        - src/authorizers/packaging-authorizer/**

  CustomerAuthorize:
    handler: src/authorizers/customer-authorizer/handler.handle
    name: customer-authorize-${self:custom.stage}
    memorySize: 128
    timeout: 6
    environment: ${file(${self:custom.stage}.env.yml):admin-cognito-lambda}
    role: AuthorizerRole
    layers:
      - ${self:custom.authorizeLayer}
    package:  
      include:
        - src/authorizers/customer-authorizer/**

  InternalAuthorize:
    handler: src/authorizers/internal-authorizer/handler.handle
    name: internal-authorize-${self:custom.stage}
    memorySize: 128
    timeout: 6
    environment: ${file(${self:custom.stage}.env.yml):admin-cognito-lambda}
    role: AuthorizerRole
    layers:
      - ${self:custom.authorizeLayer}
    package:  
      include:
        - src/authorizers/internal-authorizer/**

  
resources:
  Outputs:
    SuperAdminAuthorizeFunctionQualifiedArn:
      Export:
        Name: SuperAdminAuthorizeARN-${self:custom.stage}
      Value:
        !GetAtt SuperAdminAuthorizeLambdaFunction.Arn
    PrescriptionAuthorizeFunctionQualifiedArn:
      Export:
        Name: PrescriptionAuthorizeARN-${self:custom.stage}
      Value:
        !GetAtt PrescriptionAuthorizeLambdaFunction.Arn
    FulfilmentAuthorizeFunctionQualifiedArn:
      Export:
        Name: FulfilmentAuthorizeARN-${self:custom.stage}
      Value:
        !GetAtt FulfilmentAuthorizeLambdaFunction.Arn
    PackagingAuthorizeFunctionQualifiedArn:
      Export:
        Name: PackagingAuthorizeARN-${self:custom.stage}
      Value:
        !GetAtt PackagingAuthorizeLambdaFunction.Arn
    CustomerAuthorizeFunctionQualifiedArn:
      Export:
        Name: CustomerAuthorizeARN-${self:custom.stage}
      Value:
        !GetAtt CustomerAuthorizeLambdaFunction.Arn
    InternalAuthorizeFunctionQualifiedArn:
      Export:
        Name: InternalAuthorizeARN-${self:custom.stage}
      Value:
        !GetAtt InternalAuthorizeLambdaFunction.Arn

  Resources:
    AuthorizerRole:
      Type: AWS::IAM::Role
      Properties:
        RoleName: ${self:service}-AuthorizerRole-${self:custom.stage}
        ManagedPolicyArns:
          - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action: sts:AssumeRole
    
    # Policies
    GetUserPolicy:
      Type: AWS::IAM::Policy
      Properties:
        PolicyName: ${self:service}-GetUser-${self:custom.stage}
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - cognito-idp:GetUser
              Resource:
                - {"Fn::ImportValue": "${self:custom.stage}AdminUserPool::ARN"}
        Roles:
          - Ref: AuthorizerRole
    
    ListUsersInGroupPolicy:
      Type: AWS::IAM::Policy
      Properties:
        PolicyName: ${self:service}-ListUsersInGroup-${self:custom.stage}
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - cognito-idp:ListUsersInGroup
              Resource:
                - {"Fn::ImportValue": "${self:custom.stage}AdminUserPool::ARN"}
        Roles:
          - Ref: AuthorizerRole

    