Add authorizationscopes

[klmz]

Issue #, if available:
#652

Description of changes:
This adds support for authorisation scopes to the SAM spec. It is a small hanges to the swagger translator that add authorization scopes per method.

Description of how you validated changes:
I have added an e2e test in the from of an example yaml file (api_with_auth_with_scopes.yaml) with all usage options. I also added swagger specific tests to test_swagger.py.

Checklist:

• Write/update tests
• make pr passes
• Update documentation
• Add swagger test

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[klmz]

Ok. I must admit that I don't know how. But I'm guessing it had something to do with linting. Once I made sure make pr passed the test worked on python 2 as well. Sorry for the noise, still have to write some test though. I will do this somewhere this week!

[codecov-io]

Codecov Report

Merging #917 into develop will increase coverage by 0.08%.
The diff coverage is 90%.

@@             Coverage Diff             @@
##           develop     #917      +/-   ##
===========================================
+ Coverage     94.5%   94.58%   +0.08%     
===========================================
  Files           72       78       +6     
  Lines         3746     4269     +523     
  Branches       742      850     +108     
===========================================
+ Hits          3540     4038     +498     
- Misses         104      111       +7     
- Partials       102      120      +18

Impacted Files	Coverage Δ
samtranslator/model/api/api_generator.py	95.22% <ø> (ø)	⬆️
samtranslator/model/eventsources/push.py	90.51% <0%> (+0.67%)	⬆️
samtranslator/model/apigateway.py	97.9% <100%> (+0.01%)	⬆️
samtranslator/swagger/swagger.py	92.77% <100%> (+0.2%)	⬆️
samtranslator/model/sam_resources.py	95.08% <0%> (-0.57%)	⬇️
samtranslator/plugins/api/implicit_api_plugin.py	98.23% <0%> (-0.39%)	⬇️
samtranslator/model/naming.py	100% <0%> (ø)	⬆️
samtranslator/sdk/resource.py	100% <0%> (ø)	⬆️
samtranslator/translator/verify_logical_id.py	100% <0%> (ø)	⬆️
...ator/plugins/api/default_definition_body_plugin.py	100% <0%> (ø)	⬆️
... and 10 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update b56a09d...b8943c6. Read the comment docs.

[fyayc-ale]

@keetonian, sorry to ping you, would be possible to merge this? We are using a lambda to achieve the same and this will reduce errors on our side by a lot!

[klmz]

@keetonian, sorry to ping you, would be possible to merge this? We are using a lambda to achieve the same and this will reduce errors on our side by a lot!

Depends on how much you need this but you can pull this branch and run the transformation manually as described here: Dev guide

If you ever worked with python and virtualenv you can have it done in minutes.

[keetonian]

@fyayc-ale @klmz Will review today. Thank you for pinging me.

[brettstack]

@klmz thanks! Looks like it's missing AuthorizationScopes at the Api level? This should set scopes on all methods which use this authorizer (and can be overridden at the method level)

[klmz]

@brettstack I didn't do that because I tried to stay as close to the cloudformation spec. A default scope doesn't make a whole lot of sense to me. If it is default you can just as well leave the scope out I guess? Although I guess there are use cases where it could make sense. If you want most endpoints to be with a scope and just a couple without scopes. Or if you use the same token with different api's or something like that? Would like to hear you thoughts on this.
Actually, would also like your thoughts on my assumption of staying close to the CF spec. Is that something you strive for? Maybe this is more of general discussion for somewhere else 😅.

That being said, I guess there is some use for it so I expect to have some time to add the api level scopes this week.

[brettstack]

Yes it's the scenario where you want most endpoints to have a certain configuration and you override the outliers.

[eterjoost]

Lol. That was much more complex than I anticipated. I think I got the behavior down, but I need to write tests still and then check if I can refactor it a bit to make it more clear. I expect to have some time to finish this on Thursday!

[brettstack]

Thanks @eterjoost we'll review when it's all ready. 👍

[brettstack]

Looking good! Could you submit an example or update the existing Cognito example?

[klmz]

I need some help with fixing the tests. Some tests are now failing, but it is very hard to see why in the output. Am I doing something wrong? Or is this how it works? Maybe there is a better way of using the tests instead of just running them all?

[klmz]

It is an issue with the china and us-gov region. The output doesn't match the expected output, but I can't see what is different.

[keetonian]

@klmz ok, we can look at it, thanks for bringing it up!

[ghost]

Hi All,

This is a hugely important pull request and is great work by @klmz. Having the ability to use scopes within a SAM template is the only way to implement access tokens in an enterprise scenario.

Can someone have a look, help @klmz to get to the end goal or provide some input to how we could fix this?

Thanks in advance,

Mike

[leantorres73]

+1, This is a very important feature for implementing access_token and client_credentials grant type.

[louism517]

+1 - the client_credentials flow actually requires a scope for authentication.

[MohammedAlSafwanOld]

Any progress on this issue?!

[keetonian]

@leantorres73 @louism517 I'm not familiar with those features, could you provide some more information about them?

@Michael1d I resolved the merge conflicts locally, but had a couple of questions regarding this feature and the overall scope. Could you give some more information about access tokens and how you use/would like to use them?

[ghost]

Hi @keetonian,

Apologies for not get back to you sooner. In my scenario, I have API's that have many potential "clients" - think an SPA, an analytics ETL process, a B2B customer etc. I have created Cognito Application Clients that represent those use cases, assigning a single scope to each one. Therefore, I have the requirement to add one or more scopes selectively to serverless functions deployed by SAM. I hope that makes sense.

On the standard CF AWS::ApiGateway::Method, there is a property for AuthorizationScopes and the same functionality is required here with a AWS::Serverless::Function in SAM. I also like the idea of being able to set default scopes on a AWS::Serverless::Api as discussed in here as well.

Please let me know if you have any other questions or clarifications.

[keetonian]

Just pushed up a few changes to fully support this feature.

[praneetap]

typo

[praneetap]

Can you add a test with openapi to make sure the auth scopes get transformed into openapi correctly? Also try deploying it end to end.

[keetonian]

Scopes match the Swagger/OpenApi spec: https://swagger.io/docs/specification/authentication/

[keetonian]

No APIGW extensions for scopes, they use the same implementation: https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-swagger-extensions-authorizer.html

[keetonian]

Implementation/deployment verified for scopes changes.