Module.yml

# LambdaSharp (λ#)
# Copyright (C) 2018-2020
# lambdasharp.net
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

Module: LambdaSharp.Chat
Description: LambdaSharp Serverless Chat App
Pragmas:
  - Overrides:
      Module::WebSocket.RouteSelectionExpression: $request.body.Action
      Module::WebSocket::StageName: socket
Using:
  - Module: LambdaSharp.S3.IO@lambdasharp
Items:

  # Blazor WebAssembly App
  - App: BlazorWebSocket
    Api:
      # NOTE (2020-08-13, bjorg): cannot use `!Sub "https://${WebsiteCloudFront.DomainName}"` because it introduces a circular dependency
      CorsOrigin: "*"
    Bucket:
      CloudFrontOriginAccessIdentity: !Ref WebsiteCloudFrontIdentity
    Client:
      ApiUrl: !Sub "https://${WebsiteCloudFront.DomainName}/${BlazorWebSocket::Api.Outputs.RootPath}"
    AppSettings:
      Cognito:
        ClientId: !Ref Authorization::ClientId
        RedirectUri: !Ref WebsiteLoginUrl
        UserPoolUri: !Ref Authorization::UserPoolUri

  # Connection Table
  - Resource: DataTable
    Scope: all
    Type: AWS::DynamoDB::Table
    Allow: ReadWrite
    Properties:
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: PK
          AttributeType: S

        - AttributeName: SK
          AttributeType: S

        - AttributeName: GS1PK
          AttributeType: S

        - AttributeName: GS1SK
          AttributeType: S

      KeySchema:
        - AttributeName: PK
          KeyType: HASH

        - AttributeName: SK
          KeyType: RANGE

      GlobalSecondaryIndexes:
        - IndexName: GS1
          KeySchema:
            - AttributeName: GS1PK
              KeyType: HASH

            - AttributeName: GS1SK
              KeyType: RANGE

          Projection:
            ProjectionType: ALL

  # Function for handling web-socket requests
  - Function: ChatFunction
    Description: Handle web-socket messages
    Memory: 256
    Timeout: 30
    Sources:
      - WebSocket: $connect
        Invoke: OpenConnection
        AuthorizationType: CUSTOM
        AuthorizerId: !Ref Authorization::JwtAuthorizer

      - WebSocket: $disconnect
        Invoke: CloseConnection

      - WebSocket: hello
        Invoke : Hello

      - WebSocket: send
        Invoke: SendMessage

      - WebSocket: rename
        Invoke : RenameUser

  # Function for sending response to web-sockets
  - Function: NotifyFunction
    Description: Notify all web-sockets
    Memory: 256
    Timeout: 30
    Sources:
      - Sqs: NotifyQueue

  - Resource: NotifyQueue
    Scope: all
    Type: AWS::SQS::Queue
    Allow: Send,Receive

  # Create CloudFront distribution mapped to S3 bucket and WebSocket APIGateway
  - Resource: WebsiteCloudFront
    Description: CloudFront distribution for https:// web access to the S3 bucket
    Type: AWS::CloudFront::Distribution
    Scope: InvalidateCloudFrontFunction
    Properties:
      DistributionConfig:
        Comment: !Sub "CloudFront Distribution for LambdaSharp.Chat app (${AWS::StackName})"
        Enabled: true
        HttpVersion: http2
        CustomErrorResponses:
          - ErrorCode: 403
            ResponseCode: 200
            ResponsePagePath: /index.html
        DefaultRootObject: index.html
        PriceClass: PriceClass_100
        Origins:
          - Id: S3Origin
            DomainName: !GetAtt BlazorWebSocket::Bucket.Outputs.DomainName
            S3OriginConfig:
              OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${WebsiteCloudFrontIdentity}"

          - Id: WebSocket
            DomainName: !Ref Module::WebSocket::DomainName
            CustomOriginConfig:
              HTTPSPort: 443
              OriginProtocolPolicy: https-only

          - Id: AppApi
            DomainName: !GetAtt BlazorWebSocket::Api.Outputs.DomainName
            OriginPath: !GetAtt  BlazorWebSocket::Api.Outputs.CloudFrontOriginPath
            CustomOriginConfig:
              HTTPSPort: 443
              OriginProtocolPolicy: https-only

        DefaultCacheBehavior:
          AllowedMethods: [ GET, HEAD ]
          Compress: true
          DefaultTTL: 2592000 # 30 days
          TargetOriginId: S3Origin
          ForwardedValues:
            QueryString: true
            Cookies:
              Forward: none
          ViewerProtocolPolicy: redirect-to-https

        CacheBehaviors:
          - TargetOriginId: WebSocket
            PathPattern: !Ref Module::WebSocket::StageName
            AllowedMethods: [ GET, HEAD ]
            ForwardedValues:
              QueryString: true
              Headers:
                - Authorization
            ViewerProtocolPolicy: https-only

          - TargetOriginId: AppApi
            PathPattern: !GetAtt BlazorWebSocket::Api.Outputs.CloudFrontPathPattern
            AllowedMethods: [ GET, HEAD, OPTIONS, PUT, PATCH, POST, DELETE  ]
            ForwardedValues:
              QueryString: false
              Headers:
                - X-Api-Key
            ViewerProtocolPolicy: https-only

  - Resource: WebsiteCloudFrontPermissions
    Allow: cloudfront:CreateInvalidation
    Value: !Sub "arn:aws:cloudfront::${AWS::AccountId}:distribution/${WebsiteCloudFront}"

  - Resource: WebsiteCloudFrontIdentity
    Description: CloudFront Origin Identity for authenticating distribution with the S3 bucket
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: !Sub "CloudFront Identity used by ${Module::Id}"

  - Function: InvalidateCloudFrontFunction
    Description: Invoked by S3 when files change in the website bucket so they can be invalidated in the CloudFront cache
    Memory: 256
    Timeout: 60
    Sources:
      - S3: !GetAtt BlazorWebSocket::Bucket.Outputs.Arn
        Events:
          - s3:ObjectCreated:*
          - s3:ObjectRemoved:*

  # Cognito User Pool Information
  - Variable: WebsiteLoginUrl

    # TODO: don't use hardcoded values! this information should come from the Blazor app
    Value: !Sub "https://${WebsiteCloudFront.DomainName}/login"

  - Group: Authorization
    Items: !Include Authorization.yml

  # Initialize DataTable with minimal records
  - Function: Finalizer
    Description: Initialize DynamoDB table with default rows
    Memory: 256
    Timeout: 30

  # Export website url
  - Variable: WebsiteUrl
    Description: Website URL
    Scope: public
    Value: !Sub "https://${WebsiteCloudFront.DomainName}/"