feat: Implement Authentication and Authorization in all TODO endpoints

starter/backend/serverless.yml

@@ -18,27 +18,29 @@ provider:
 
 functions:
 
-  #Auth:
-  #  handler: src/lambda/auth/auth0Authorizer.handler
+  Auth:
+    handler: src/lambda/auth/auth0Authorizer.handler
 
   GetTodos:
     handler: src/lambda/http/getTodos.handler
     events:
       - http:
           method: get
+          authorizer: Auth
           path: todos
           cors: true
     iamRoleStatements:
       - Effect: Allow
         Action:
-          - dynamodb:Scan
+          - dynamodb:Query
         Resource: arn:aws:dynamodb:${self:provider.region}:*:table/${self:provider.environment.TODOS_TABLE}
 
   CreateTodo:
     handler: src/lambda/http/createTodo.handler
     events:
       - http:
           method: post
+          authorizer: Auth
           path: todos
           cors: true
     iamRoleStatements:
@@ -52,6 +54,7 @@ functions:
     events:
       - http:
           method: patch
+          authorizer: Auth
           path: todos/{todoId}
           cors: true
     iamRoleStatements:
@@ -65,6 +68,7 @@ functions:
     events:
       - http:
           method: delete
+          authorizer: Auth
           path: todos/{todoId}
           cors: true
     iamRoleStatements:

starter/backend/src/lambda/auth/auth0Authorizer.mjs

@@ -4,7 +4,7 @@ import { createLogger } from '../../utils/logger.mjs'
 
 const logger = createLogger('auth')
 
-const jwksUrl = 'https://test-endpoint.auth0.com/.well-known/jwks.json'
+const jwksUrl = 'https://dev-eftbk57y7yyraxsa.us.auth0.com/.well-known/jwks.json'
 
 export async function handler(event) {
   try {
@@ -43,11 +43,22 @@ export async function handler(event) {
 }
 
 async function verifyToken(authHeader) {
+
   const token = getToken(authHeader)
   const jwt = jsonwebtoken.decode(token, { complete: true })
 
-  // TODO: Implement token verification
-  return undefined;
+  const response = await Axios.get(jwksUrl)
+  const keys = response.data.keys
+  const signingKeys = keys.find(key => key.kid === jwt.header.kid)
+
+  if(!signingKeys) {
+    throw new Error('No certification was found in jwks url')
+  }
+
+  const pemData = signingKeys.x5c[0]
+  const cert = `-----BEGIN CERTIFICATE-----\n${pemData}\n-----END CERTIFICATE-----`
+
+  return jsonwebtoken.verify(token, cert, { algorithms: ['RS256'] })
 }
 
 function getToken(authHeader) {