serverless.yml

service: devagram
frameworkVersion: "3"

custom:
  userPoolId: !Ref CognitoUserPool
  userPoolClientId: !Ref CognitoUserPoolClient
  userTableName: "users-table-${self:provider.stage}"
  avatarBucket: "${self:service}-${self:provider.stage}-avatars"
  postTableName: "posts-table-${self:provider.stage}"
  postBucket: "${self:service}-${self:provider.stage}-posts"
  apigwBinary:
    types:
      - "multipart/form-data"

provider:
  name: aws
  runtime: nodejs14.x
  stage: ${opt:stage, 'dev'}
  region: ${opt:region, 'us-east-1'}
  environment:
    USER_POOL_ID: ${self:custom.userPoolId}
    USER_POOL_CLIENT_ID: ${self:custom.userPoolClientId}
    USER_TABLE: ${self:custom.userTableName}
    AVATAR_BUCKET: ${self:custom.avatarBucket}
    POST_TABLE: ${self:custom.postTableName}
    POST_BUCKET: ${self:custom.postBucket}
    LOG_LEVEL: ${param:level, 'info'}
  iam:
    role:
      statements:
        - Effect: Allow
          Action:
            - dynamodb:*
          Resource:
            - "*"
  httpApi:
    authorizers:
      serviceAuthorizer:
        identitySource: $request.header.Authorization
        issuerUrl:
          Fn::Join:
            - ""
            - - "https://cognito-idp."
              - "${self:provider.region}"
              - ".amazonaws.com/"
              - Ref: CognitoUserPool
        audience:
          - Ref: CognitoUserPoolClient

plugins:
  - serverless-plugin-typescript
  - serverless-apigw-binary

functions:
  register:
    handler: src/functions/auth.register
    events:
      - http:
          path: register
          method: post
          cors: true
  confirmEmail:
    handler: src/functions/auth.confirmEmail
    events:
      - http:
          path: confirmEmail
          method: post
          cors: true
  forgotPassword:
    handler: src/functions/auth.forgotPassword
    events:
      - http:
          path: forgotPassword
          method: post
          cors: true
  changePassword:
    handler: src/functions/auth.changePassword
    events:
      - http:
          path: changePassword
          method: post
          cors: true
  login:
    handler: src/functions/login.handler
    events:
      - http:
          path: login
          method: post
          cors: true
  me:
    handler: src/functions/user.me
    events:
      - httpApi:
          path: /me
          method: get
          authorizer: serviceAuthorizer
  update-user:
    handler: src/functions/user.update
    events:
      - httpApi:
          path: /user
          method: put
          authorizer: serviceAuthorizer
  create-post:
    handler: src/functions/post.create
    events:
      - httpApi:
          path: /post
          method: post
          authorizer: serviceAuthorizer
  toggle-like:
    handler: src/functions/post.toggleLike
    events:
      - httpApi:
          path: /like/{postId}
          method: put
          authorizer: serviceAuthorizer
  post-comment:
    handler: src/functions/post.postComment
    events:
      - httpApi:
          path: /comment/{postId}
          method: put
          authorizer: serviceAuthorizer
  get-post:
    handler: src/functions/post.get
    events:
      - httpApi:
          path: /post/{postId}
          method: get
          authorizer: serviceAuthorizer
  get-user-by-id:
    handler: src/functions/user.getById
    events:
      - httpApi:
          path: /user/{userId}
          method: get
          authorizer: serviceAuthorizer
  search-user:
    handler: src/functions/user.search
    events:
      - httpApi:
          path: /user/search/{filter}
          method: get
          authorizer: serviceAuthorizer
  toggle-follow:
    handler: src/functions/follow.toggle
    events:
      - httpApi:
          path: /follow/{followId}
          method: put
          authorizer: serviceAuthorizer
  my-feed:
    handler: src/functions/feed.byId
    events:
      - httpApi:
          path: /feed/user
          method: get
          authorizer: serviceAuthorizer
  feed-by-id:
    handler: src/functions/feed.byId
    events:
      - httpApi:
          path: /feed/user/{userId}
          method: get
          authorizer: serviceAuthorizer
  home-feed:
    handler: src/functions/feed.home
    events:
      - httpApi:
          path: /feed
          method: get
          authorizer: serviceAuthorizer

resources:
  Resources:
    CognitoUserPool:
      Type: AWS::Cognito::UserPool
      Properties:
        UserPoolName: ${self:service}-${self:provider.stage}-user-pool
        AdminCreateUserConfig:
          AllowAdminCreateUserOnly: false
        UsernameAttributes:
          - email
        AutoVerifiedAttributes:
          - email
        EmailVerificationMessage: "Seu código de verificação para o cadastro Devagram é: {####}"
        EmailVerificationSubject: "Código de verificação Devagram"
        Policies:
          PasswordPolicy:
            MinimumLength: 8
            RequireLowercase: true
            RequireNumbers: true
            RequireSymbols: true
            RequireUppercase: true
    CognitoUserPoolClient:
      Type: AWS::Cognito::UserPoolClient
      Properties:
        ClientName: ${self:service}-${self:provider.stage}-user-pool-client
        UserPoolId: !Ref CognitoUserPool
        AllowedOAuthFlows:
          - implicit
        AllowedOAuthFlowsUserPoolClient: true
        AllowedOAuthScopes:
          - email
          - openid
        CallbackURLs:
          - https://www.arthurwerle.com.br
        LogoutURLs:
          - https://www.arthurwerle.com.br
        ExplicitAuthFlows:
          - ALLOW_CUSTOM_AUTH
          - ALLOW_USER_SRP_AUTH
          - ALLOW_REFRESH_TOKEN_AUTH
        SupportedIdentityProviders:
          - COGNITO
        ReadAttributes:
          - email
        WriteAttributes:
          - email
    CognitoUserPoolDomain:
      Type: AWS::Cognito::UserPoolDomain
      Properties:
        UserPoolId: !Ref CognitoUserPool
        Domain: ${self:service}-${self:provider.stage}-domain-arthurwerle
    AvatarsBucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: ${self:custom.avatarBucket}
        AccessControl: Private
    AvatarsBucketPolicy:
      Type: AWS::S3::BucketPolicy
      Properties:
        Bucket: !Ref AvatarsBucket
        PolicyDocument:
          Statement:
            - Effect: Allow
              Principal: "*"
              Action:
                - s3:GetObject
                - s3:PutObject
                - s3:DeleteObject
              Resource:
                Fn::Join:
                  - ""
                  - - "arn:aws:s3:::"
                    - !Ref AvatarsBucket
                    - "/*"
    PostsBucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: ${self:custom.postBucket}
        AccessControl: Private
    PostsBucketPolicy:
      Type: AWS::S3::BucketPolicy
      Properties:
        Bucket: !Ref PostsBucket
        PolicyDocument:
          Statement:
            - Effect: Allow
              Principal: "*"
              Action:
                - s3:GetObject
                - s3:PutObject
                - s3:DeleteObject
              Resource:
                Fn::Join:
                  - ""
                  - - "arn:aws:s3:::"
                    - !Ref PostsBucket
                    - "/*"