provider:
  httpApi:
    authorizers:
      authorizer:
        type: request
        identitySource: "$request.header.Authorization"
        functionName: authorizer
        enableSimpleResponses: true

functions:
  authorizer:
    handler: auth/jwt-authorizer.handler

import jwt from 'jsonwebtoken';

export const handler = async (event) => {
  try {
    const token = event.headers.authorization.split(' ')[1];
    if (!token) {
      return { isAuthorized: false };
    }
    const decoded = jwt.verify(token, process.env.JWT_SECRET);
    return {
      isAuthorized: true,
      context: { email: decoded.email }
    };
  } catch (error) {
    return { isAuthorized: false };
  }
};

SigninLambdaRole:
  Type: AWS::IAM::Role
  Properties:
    RoleName: zero-trust-confidential-files-api-signin-lambda-role-${self:provider.stage}
    AssumeRolePolicyDocument:
      Version: "2012-10-17"
      Statement:
        - Effect: Allow
          Principal:
            Service:
              - lambda.amazonaws.com
          Action: sts:AssumeRole
    Policies:
      - PolicyName: SigninLambdaPolicy
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - dynamodb:GetItem
              Resource:
                - arn:aws:dynamodb:${aws:region}:${aws:accountId}:table/Users-${self:provider.stage}
            - Effect: Allow
              Action:
                - dynamodb:PutItem
              Resource:
                - arn:aws:dynamodb:${aws:region}:${aws:accountId}:table/MfaCodes-${self:provider.stage}