fix(appsync): strongly type expires prop in apiKeyConfig

packages/@aws-cdk/aws-appsync/lib/graphqlapi.ts

@@ -1,3 +1,4 @@
+import { readFileSync } from 'fs';
 import { IUserPool } from '@aws-cdk/aws-cognito';
 import { ITable } from '@aws-cdk/aws-dynamodb';
 import {
@@ -6,8 +7,7 @@ import {
   ServicePrincipal,
 } from '@aws-cdk/aws-iam';
 import { IFunction } from '@aws-cdk/aws-lambda';
-import { Construct, Duration, IResolvable } from '@aws-cdk/core';
-import { readFileSync } from 'fs';
+import { Construct, Duration, Expires, IResolvable } from '@aws-cdk/core';
 import {
   CfnApiKey,
   CfnGraphQLApi,
@@ -118,12 +118,13 @@ export interface ApiKeyConfig {
   readonly description?: string;
 
   /**
-   * The time from creation time after which the API key expires, using RFC3339 representation.
+   * The time from creation time after which the API key expires.
    * It must be a minimum of 1 day and a maximum of 365 days from date of creation.
    * Rounded down to the nearest hour.
-   * @default - 7 days from creation time
+   *
+   * @default - 7 days rounded down to nearest hour
    */
-  readonly expires?: string;
+  readonly expires?: Expires;
 }
 
 /**
@@ -350,7 +351,7 @@ export class GraphQLApi extends Construct {
           name: 'DefaultAPIKey',
           description: 'Default API Key created by CDK',
         };
-      this.createAPIKey(apiKeyConfig);
+      this._apiKey = this.createAPIKey(apiKeyConfig);
     }
 
     let definition;
@@ -518,23 +519,20 @@ export class GraphQLApi extends Construct {
     };
   }
 
-  private createAPIKey(config: ApiKeyConfig) {
-    let expires: number | undefined;
-    if (config.expires) {
-      expires = new Date(config.expires).valueOf();
-      const days = (d: number) =>
-        Date.now() + Duration.days(d).toMilliseconds();
-      if (expires < days(1) || expires > days(365)) {
-        throw Error('API key expiration must be between 1 and 365 days.');
-      }
-      expires = Math.round(expires / 1000);
+  private createAPIKey(config: ApiKeyConfig): string {
+    if (config.expires &&
+      (config.expires?.date < Expires.after(Duration.days(1)).date
+        || config.expires?.date > Expires.after(Duration.days(365)).date)) {
+      throw Error('API key expiration must be between 1 and 365 days.');
     }
+    const getEpoch = (d: Expires) => { return Math.floor( d.date.getTime() / 86400000) * 86400; };
+    const expires = config.expires ? getEpoch(config.expires) : undefined;
     const key = new CfnApiKey(this, `${config.name || 'DefaultAPIKey'}ApiKey`, {
       expires,
       description: config.description || 'Default API Key created by CDK',
       apiId: this.apiId,
     });
-    this._apiKey = key.attrApiKey;
+    return key.attrApiKey;
   }
 
   private formatAdditionalAuthorizationModes(

packages/@aws-cdk/aws-appsync/test/appsync-auth.test.ts

@@ -0,0 +1,97 @@
+import { join } from 'path';
+import '@aws-cdk/assert/jest';
+import * as cdk from '@aws-cdk/core';
+import * as appsync from '../lib';
+
+let stack: cdk.Stack;
+beforeEach(() => {
+  // GIVEN
+  stack = new cdk.Stack();
+});
+
+const getEpoch = (d: cdk.Expires) => { return Math.floor( d.date.getTime()/ 86400000) * 86400; };
+
+describe('AuthorizationType ApiKey', () => {
+
+  test('apiKeyConfig creates default description and no expire field', () => {
+    // WHEN
+    new appsync.GraphQLApi(stack, 'API', {
+      name: 'apiKeyUnitTest',
+      schemaDefinitionFile: join(__dirname, 'appsync.auth.graphql'),
+      authorizationConfig: {
+        defaultAuthorization: {
+          authorizationType: appsync.AuthorizationType.API_KEY,
+        },
+      },
+    });
+
+    // THEN
+    expect(stack).toHaveResource('AWS::AppSync::ApiKey', {
+      ApiId: { 'Fn::GetAtt': ['API62EA1CFF', 'ApiId' ] },
+      Description: 'Default API Key created by CDK',
+    });
+  });
+
+  test('apiKeyConfig creates default description and valid expiration date', () => {
+    const expirationDate: number = getEpoch(cdk.Expires.after(cdk.Duration.days(10)));
+
+    // WHEN
+    new appsync.GraphQLApi(stack, 'API', {
+      name: 'apiKeyUnitTest',
+      schemaDefinitionFile: join(__dirname, 'appsync.auth.graphql'),
+      authorizationConfig: {
+        defaultAuthorization: {
+          authorizationType: appsync.AuthorizationType.API_KEY,
+          apiKeyConfig: {
+            expires: cdk.Expires.after(cdk.Duration.days(10)),
+          },
+        },
+      },
+    });
+
+    // THEN
+    expect(stack).toHaveResourceLike('AWS::AppSync::ApiKey', {
+      ApiId: { 'Fn::GetAtt': ['API62EA1CFF', 'ApiId' ] },
+      Description: 'Default API Key created by CDK',
+      Expires: expirationDate,
+    });
+  });
+
+  test('apiKeyConfig fails if expire argument less than a day', () => {
+    // WHEN
+    const when = () => { new appsync.GraphQLApi(stack, 'API', {
+      name: 'apiKeyUnitTest',
+      schemaDefinitionFile: join(__dirname, 'appsync.auth.graphql'),
+      authorizationConfig: {
+        defaultAuthorization: {
+          authorizationType: appsync.AuthorizationType.API_KEY,
+          apiKeyConfig: {
+            expires: cdk.Expires.after(cdk.Duration.hours(1)),
+          },
+        },
+      },
+    }); };
+
+    // THEN
+    expect(when).toThrowError('API key expiration must be between 1 and 365 days.');
+  });
+
+  test('apiKeyConfig fails if expire argument greater than 365 day', () => {
+    // WHEN
+    const when = () => {new appsync.GraphQLApi(stack, 'API', {
+      name: 'apiKeyUnitTest',
+      schemaDefinitionFile: join(__dirname, 'appsync.auth.graphql'),
+      authorizationConfig: {
+        defaultAuthorization: {
+          authorizationType: appsync.AuthorizationType.API_KEY,
+          apiKeyConfig: {
+            expires: cdk.Expires.after(cdk.Duration.days(366)),
+          },
+        },
+      },
+    }); };
+
+    // THEN
+    expect(when).toThrowError('API key expiration must be between 1 and 365 days.');
+  });
+});

packages/@aws-cdk/aws-appsync/test/appsync.auth.graphql

@@ -0,0 +1,12 @@
+type test {
+  id: Int!
+  version: String!
+}
+
+type Query {
+  getTests: [ test! ]
+}
+
+type Mutation {
+  addTest(version: String!): test!
+}

packages/@aws-cdk/aws-appsync/test/integ.auth-apikey.expected.json

@@ -0,0 +1,185 @@
+{
+  "Resources": {
+    "ApiF70053CD": {
+      "Type": "AWS::AppSync::GraphQLApi",
+      "Properties": {
+        "AuthenticationType": "API_KEY",
+        "Name": "Integ_Test_APIKey"
+      }
+    },
+    "ApiDefaultAPIKeyApiKey74F5313B": {
+      "Type": "AWS::AppSync::ApiKey",
+      "Properties": {
+        "ApiId": {
+          "Fn::GetAtt": [
+            "ApiF70053CD",
+            "ApiId"
+          ]
+        },
+        "Description": "Default API Key created by CDK",
+        "Expires": 1626566400
+      }
+    },
+    "ApiSchema510EECD7": {
+      "Type": "AWS::AppSync::GraphQLSchema",
+      "Properties": {
+        "ApiId": {
+          "Fn::GetAtt": [
+            "ApiF70053CD",
+            "ApiId"
+          ]
+        },
+        "Definition": "type test {\n  id: Int!\n  version: String!\n}\n\ntype Query {\n  getTests: [ test! ]\n}\n\ntype Mutation {\n  addTest(version: String!): test!\n}"
+      }
+    },
+    "ApitestDataSourceDSServiceRoleE543E310": {
+      "Type": "AWS::IAM::Role",
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Action": "sts:AssumeRole",
+              "Effect": "Allow",
+              "Principal": {
+                "Service": "appsync.amazonaws.com"
+              }
+            }
+          ],
+          "Version": "2012-10-17"
+        }
+      }
+    },
+    "ApitestDataSourceDSServiceRoleDefaultPolicy53D2252C": {
+      "Type": "AWS::IAM::Policy",
+      "Properties": {
+        "PolicyDocument": {
+          "Statement": [
+            {
+              "Action": [
+                "dynamodb:BatchGetItem",
+                "dynamodb:GetRecords",
+                "dynamodb:GetShardIterator",
+                "dynamodb:Query",
+                "dynamodb:GetItem",
+                "dynamodb:Scan",
+                "dynamodb:BatchWriteItem",
+                "dynamodb:PutItem",
+                "dynamodb:UpdateItem",
+                "dynamodb:DeleteItem"
+              ],
+              "Effect": "Allow",
+              "Resource": [
+                {
+                  "Fn::GetAtt": [
+                    "TestTable5769773A",
+                    "Arn"
+                  ]
+                },
+                {
+                  "Ref": "AWS::NoValue"
+                }
+              ]
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "PolicyName": "ApitestDataSourceDSServiceRoleDefaultPolicy53D2252C",
+        "Roles": [
+          {
+            "Ref": "ApitestDataSourceDSServiceRoleE543E310"
+          }
+        ]
+      }
+    },
+    "ApitestDataSourceDS776EA507": {
+      "Type": "AWS::AppSync::DataSource",
+      "Properties": {
+        "ApiId": {
+          "Fn::GetAtt": [
+            "ApiF70053CD",
+            "ApiId"
+          ]
+        },
+        "Name": "testDataSource",
+        "Type": "AMAZON_DYNAMODB",
+        "Description": "Table for Tests\"",
+        "DynamoDBConfig": {
+          "AwsRegion": {
+            "Ref": "AWS::Region"
+          },
+          "TableName": {
+            "Ref": "TestTable5769773A"
+          }
+        },
+        "ServiceRoleArn": {
+          "Fn::GetAtt": [
+            "ApitestDataSourceDSServiceRoleE543E310",
+            "Arn"
+          ]
+        }
+      }
+    },
+    "ApitestDataSourceDSQuerygetTestsResolver61ED88B6": {
+      "Type": "AWS::AppSync::Resolver",
+      "Properties": {
+        "ApiId": {
+          "Fn::GetAtt": [
+            "ApiF70053CD",
+            "ApiId"
+          ]
+        },
+        "FieldName": "getTests",
+        "TypeName": "Query",
+        "DataSourceName": "testDataSource",
+        "Kind": "UNIT",
+        "RequestMappingTemplate": "{\"version\" : \"2017-02-28\", \"operation\" : \"Scan\"}",
+        "ResponseMappingTemplate": "$util.toJson($ctx.result.items)"
+      },
+      "DependsOn": [
+        "ApiSchema510EECD7",
+        "ApitestDataSourceDS776EA507"
+      ]
+    },
+    "ApitestDataSourceDSMutationaddTestResolver0D3A4591": {
+      "Type": "AWS::AppSync::Resolver",
+      "Properties": {
+        "ApiId": {
+          "Fn::GetAtt": [
+            "ApiF70053CD",
+            "ApiId"
+          ]
+        },
+        "FieldName": "addTest",
+        "TypeName": "Mutation",
+        "DataSourceName": "testDataSource",
+        "Kind": "UNIT",
+        "RequestMappingTemplate": "\n      #set($input = $ctx.args.test)\n      \n      {\n        \"version\": \"2017-02-28\",\n        \"operation\": \"PutItem\",\n        \"key\" : {\n      \"id\" : $util.dynamodb.toDynamoDBJson($util.autoId())\n    },\n        \"attributeValues\": $util.dynamodb.toMapValuesJson($input)\n      }",
+        "ResponseMappingTemplate": "$util.toJson($ctx.result)"
+      },
+      "DependsOn": [
+        "ApiSchema510EECD7",
+        "ApitestDataSourceDS776EA507"
+      ]
+    },
+    "TestTable5769773A": {
+      "Type": "AWS::DynamoDB::Table",
+      "Properties": {
+        "KeySchema": [
+          {
+            "AttributeName": "id",
+            "KeyType": "HASH"
+          }
+        ],
+        "AttributeDefinitions": [
+          {
+            "AttributeName": "id",
+            "AttributeType": "S"
+          }
+        ],
+        "BillingMode": "PAY_PER_REQUEST"
+      },
+      "UpdateReplacePolicy": "Delete",
+      "DeletionPolicy": "Delete"
+    }
+  }
+}