MMT-4199: Create CRUD api for staged metadata

bin/deploy-bamboo.sh

@@ -76,6 +76,7 @@ dockerRun() {
         -e "AWS_SECRET_ACCESS_KEY=$bamboo_AWS_SECRET_ACCESS_KEY" \
         -e "AWS_SESSION_TOKEN=$bamboo_AWS_SESSION_TOKEN" \
         -e "COLLECTION_TEMPLATES_BUCKET_NAME=${bamboo_COLLECTION_TEMPLATES_BUCKET_NAME}" \
+        -e "STAGING_CONCEPTS_BUCKET_NAME=${bamboo_STAGING_CONCEPTS_BUCKET_NAME}" \
         -e "COOKIE_DOMAIN=$bamboo_COOKIE_DOMAIN" \
         -e "DISPLAY_PROD_WARNING=$bamboo_DISPLAY_PROD_WARNING" \
         -e "EDL_CLIENT_ID=$bamboo_EDL_CLIENT_ID" \
@@ -86,9 +87,13 @@ dockerRun() {
         -e "LOG_DESTINATION_ARN=$bamboo_LOG_DESTINATION_ARN" \
         -e "MMT_HOST=$bamboo_MMT_HOST" \
         -e "NODE_ENV=production" \
+        -e "PRODUCTION_API_HOST=$bamboo_PRODUCTION_API_HOST" \
+        -e "PRODUCTION_MMT_HOST=$bamboo_PRODUCTION_MMT_HOST" \
+        -e "PRODUCTION_STAGING_API_KEY=$bamboo_PRODUCTION_STAGING_API_KEY" \
         -e "NODE_OPTIONS=--max_old_space_size=4096" \
         -e "SITE_BUCKET=${bamboo_SITE_BUCKET}" \
         -e "STAGE_NAME=$bamboo_STAGE_NAME" \
+        -e "STAGING_API_KEY=$bamboo_STAGING_API_KEY" \
         -e "SUBNET_ID_A=$bamboo_SUBNET_ID_A" \
         -e "SUBNET_ID_B=$bamboo_SUBNET_ID_B" \
         -e "SUBNET_ID_C=$bamboo_SUBNET_ID_C" \

cdk/mmt/lib/mmt-authorizers.ts

@@ -8,6 +8,9 @@ import { application } from '@edsc/cdk-utils'
 export interface MmtAuthorizersProps {
   apiGatewayRestApi: cdk.aws_apigateway.CfnRestApi;
   defaultLambdaConfig: application.NodeJsFunctionProps;
+  // Shared secret for the machine-to-machine concept routes. Injected only into
+  // `stagingApiKeyAuthorizer`, not the shared Lambda environment.
+  stagingApiKey: string;
 }
 
 /**
@@ -17,52 +20,93 @@ export interface MmtAuthorizersProps {
 export class MmtAuthorizers extends Construct {
   public readonly edlAuthorizer: apigateway.CfnAuthorizer
 
+  public readonly stagingApiKeyAuthorizer: apigateway.CfnAuthorizer
+
   constructor(scope: cdk.Stack, id: string, props: MmtAuthorizersProps) {
     super(scope, id)
 
-    const { apiGatewayRestApi, defaultLambdaConfig } = props
+    const { apiGatewayRestApi, defaultLambdaConfig, stagingApiKey } = props
     const functionNamePrefix = scope.stackName
 
-    const edlAuthorizerNestedStack = new cdk.NestedStack(scope, 'EdlAuthorizerNestedStack')
-    const { lambdaFunction: edlAuthorizerLambda } = new application.NodeJsFunction(edlAuthorizerNestedStack, 'EdlAuthorizerLambda', {
-      ...defaultLambdaConfig,
-      entry: '../../serverless/src/edlAuthorizer/handler.js',
-      functionName: 'edlAuthorizer',
-      functionNamePrefix
-    })
+    // Creates a REQUEST authorizer backed by a serverless handler, plus the
+    // API Gateway invoke permission for its Lambda.
+    const makeRequestAuthorizer = (
+      nestedStackId: string,
+      lambdaId: string,
+      authorizerId: string,
+      functionName: string,
+      entry: string,
+      identitySource: string,
+      extraEnvironment: { [key: string]: string } = {}
+    ) => {
+      const nestedStack = new cdk.NestedStack(scope, nestedStackId)
+
+      const { lambdaFunction } = new application.NodeJsFunction(nestedStack, lambdaId, {
+        ...defaultLambdaConfig,
+        entry,
+        environment: {
+          ...defaultLambdaConfig.environment,
+          ...extraEnvironment
+        },
+        functionName,
+        functionNamePrefix
+      })
+
+      new lambda.CfnPermission(scope, `${lambdaId}PermissionApiGateway`, {
+        functionName: lambdaFunction.functionName,
+        action: 'lambda:InvokeFunction',
+        principal: 'apigateway.amazonaws.com',
+        sourceArn: [
+          'arn:',
+          scope.partition,
+          ':execute-api:',
+          scope.region,
+          ':',
+          scope.account,
+          ':',
+          apiGatewayRestApi.ref,
+          '/*/*'
+        ].join('')
+      })
+
+      return new apigateway.CfnAuthorizer(nestedStack, authorizerId, {
+        authorizerResultTtlInSeconds: 0,
+        authorizerUri: cdk.Fn.join('', [
+          'arn:',
+          cdk.Aws.PARTITION,
+          ':apigateway:',
+          cdk.Aws.REGION,
+          ':lambda:path/2015-03-31/functions/',
+          lambdaFunction.functionArn,
+          '/invocations'
+        ]),
+        identitySource,
+        name: functionName,
+        restApiId: apiGatewayRestApi.ref,
+        type: 'REQUEST'
+      })
+    }
 
-    new lambda.CfnPermission(scope, 'EdlAuthorizerLambdaPermissionApiGateway', {
-      functionName: edlAuthorizerLambda.functionName,
-      action: 'lambda:InvokeFunction',
-      principal: 'apigateway.amazonaws.com',
-      sourceArn: [
-        'arn:',
-        scope.partition,
-        ':execute-api:',
-        scope.region,
-        ':',
-        scope.account,
-        ':',
-        apiGatewayRestApi.ref,
-        '/*/*'
-      ].join('')
-    })
+    this.edlAuthorizer = makeRequestAuthorizer(
+      'EdlAuthorizerNestedStack',
+      'EdlAuthorizerLambda',
+      'EdlAuthorizer',
+      'edlAuthorizer',
+      '../../serverless/src/edlAuthorizer/handler.js',
+      'method.request.header.Authorization'
+    )
 
-    this.edlAuthorizer = new apigateway.CfnAuthorizer(edlAuthorizerNestedStack, 'EdlAuthorizer', {
-      authorizerResultTtlInSeconds: 0,
-      authorizerUri: cdk.Fn.join('', [
-        'arn:',
-        cdk.Aws.PARTITION,
-        ':apigateway:',
-        cdk.Aws.REGION,
-        ':lambda:path/2015-03-31/functions/',
-        edlAuthorizerLambda.functionArn,
-        '/invocations'
-      ]),
-      identitySource: 'method.request.header.Authorization',
-      name: 'edlAuthorizer',
-      restApiId: apiGatewayRestApi.ref,
-      type: 'REQUEST'
-    })
+    // API-key authorizer for the machine-to-machine "staging concepts" routes.
+    // The caller (the MMT UAT forwarding Lambda) authenticates with a shared
+    // secret in the Staging-Api-Key header.
+    this.stagingApiKeyAuthorizer = makeRequestAuthorizer(
+      'StagingApiKeyAuthorizerNestedStack',
+      'StagingApiKeyAuthorizerLambda',
+      'StagingApiKeyAuthorizer',
+      'stagingApiKeyAuthorizer',
+      '../../serverless/src/stagingApiKeyAuthorizer/handler.js',
+      'method.request.header.Staging-Api-Key',
+      { STAGING_API_KEY: stagingApiKey }
+    )
   }
 }

cdk/mmt/lib/mmt-functions.ts

@@ -12,6 +12,7 @@ export interface MmtFunctionsProps {
   apiGatewayRestApi: cdk.aws_apigateway.CfnRestApi;
   authorizers: {
     edlAuthorizer: apigateway.CfnAuthorizer;
+    stagingApiKeyAuthorizer: apigateway.CfnAuthorizer;
   };
   // MMT keeps explicit CORS config so API Gateway OPTIONS responses can control:
   // - allowOrigin: which browser origin can call the API
@@ -26,7 +27,17 @@ export interface MmtFunctionsProps {
     allowHeaders: string[];
   };
   defaultLambdaConfig: application.NodeJsFunctionProps;
+  // UAT-only config for the `stageConceptForProduction` forwarding Lambda.
+  // Injected only into that handler, not the shared Lambda environment.
+  productionForwardingConfig: {
+    PRODUCTION_API_HOST: string;
+    PRODUCTION_MMT_HOST: string;
+    PRODUCTION_STAGING_API_KEY: string;
+  };
   s3LambdaRole: iam.IRole;
+  // Shared secret re-checked in `createOrUpdateConcept`. Injected only into that
+  // handler, not the shared Lambda environment.
+  stagingApiKey: string;
 }
 
 /**
@@ -43,7 +54,9 @@ export class MmtFunctions extends Construct {
       authorizers,
       corsConfig,
       defaultLambdaConfig,
-      s3LambdaRole
+      productionForwardingConfig,
+      s3LambdaRole,
+      stagingApiKey
     } = props
 
     const functionNamePrefix = scope.stackName
@@ -250,5 +263,102 @@ export class MmtFunctions extends Construct {
       functionNamePrefix,
       role: s3LambdaRole
     })
+
+    // getConcepts - GET /staged/{conceptType}
+    new application.NodeJsFunction(new cdk.NestedStack(scope, 'GetConceptsNestedStack'), 'GetConceptsLambda', {
+      ...defaultLambdaConfig,
+      api: {
+        apiGatewayDeployment,
+        apiGatewayResource: resources.stagedConceptTypeResource,
+        apiGatewayRestApi,
+        authorizer: authorizers.edlAuthorizer,
+        methods: ['GET'],
+        parentPath: 'staged',
+        path: '{conceptType}'
+      },
+      entry: '../../serverless/src/getConcepts/handler.js',
+      functionName: 'getConcepts',
+      functionNamePrefix,
+      role: s3LambdaRole
+    })
+
+    // getConcept - GET /staged/{conceptType}/{recordId}
+    new application.NodeJsFunction(new cdk.NestedStack(scope, 'GetConceptNestedStack'), 'GetConceptLambda', {
+      ...defaultLambdaConfig,
+      api: {
+        apiGatewayDeployment,
+        apiGatewayResource: resources.stagedConceptTypeRecordIdResource,
+        apiGatewayRestApi,
+        authorizer: authorizers.edlAuthorizer,
+        methods: ['GET'],
+        parentPath: 'stagedConceptTypeVar',
+        path: '{recordId}'
+      },
+      entry: '../../serverless/src/getConcept/handler.js',
+      functionName: 'getConcept',
+      functionNamePrefix,
+      role: s3LambdaRole
+    })
+
+    // createOrUpdateConcept - PUT /staged/{conceptType}
+    new application.NodeJsFunction(new cdk.NestedStack(scope, 'CreateOrUpdateConceptNestedStack'), 'CreateOrUpdateConceptLambda', {
+      ...defaultLambdaConfig,
+      api: {
+        apiGatewayDeployment,
+        apiGatewayResource: resources.stagedConceptTypeResource,
+        apiGatewayRestApi,
+        authorizer: authorizers.stagingApiKeyAuthorizer,
+        methods: ['PUT'],
+        parentPath: 'staged',
+        path: '{conceptType}'
+      },
+      entry: '../../serverless/src/createOrUpdateConcept/handler.js',
+      environment: {
+        ...defaultLambdaConfig.environment,
+        STAGING_API_KEY: stagingApiKey
+      },
+      functionName: 'createOrUpdateConcept',
+      functionNamePrefix,
+      role: s3LambdaRole
+    })
+
+    // deleteConcept - DELETE /staged/{conceptType}/{recordId}
+    new application.NodeJsFunction(new cdk.NestedStack(scope, 'DeleteConceptNestedStack'), 'DeleteConceptLambda', {
+      ...defaultLambdaConfig,
+      api: {
+        apiGatewayDeployment,
+        apiGatewayResource: resources.stagedConceptTypeRecordIdResource,
+        apiGatewayRestApi,
+        authorizer: authorizers.edlAuthorizer,
+        methods: ['DELETE'],
+        parentPath: 'stagedConceptTypeVar',
+        path: '{recordId}'
+      },
+      entry: '../../serverless/src/deleteConcept/handler.js',
+      functionName: 'deleteConcept',
+      functionNamePrefix,
+      role: s3LambdaRole
+    })
+
+    // stageConceptForProduction - POST /providers/{providerId}/{conceptType}/stage-for-production
+    new application.NodeJsFunction(new cdk.NestedStack(scope, 'StageConceptForProductionNestedStack'), 'StageConceptForProductionLambda', {
+      ...defaultLambdaConfig,
+      api: {
+        apiGatewayDeployment,
+        apiGatewayResource: resources.providersConceptTypeStageForProductionResource,
+        apiGatewayRestApi,
+        authorizer: authorizers.edlAuthorizer,
+        methods: ['POST'],
+        parentPath: 'providersProviderIdVarConceptTypeVar',
+        path: 'stage-for-production'
+      },
+      entry: '../../serverless/src/stageConceptForProduction/handler.js',
+      environment: {
+        ...defaultLambdaConfig.environment,
+        ...productionForwardingConfig
+      },
+      functionName: 'stageConceptForProduction',
+      functionNamePrefix
+    })
   }
 }

cdk/mmt/lib/mmt-shared-api-gateway-resources.ts

@@ -25,6 +25,10 @@ export class MmtApiResources extends Construct {
   public readonly errorLoggerResource: apigateway.CfnResource
   public readonly gkrKeywordRecommendationsResource: apigateway.CfnResource
   public readonly gkrSendFeedbackResource: apigateway.CfnResource
+  public readonly providersConceptTypeResource: apigateway.CfnResource
+  public readonly providersConceptTypeStageForProductionResource: apigateway.CfnResource
+  public readonly stagedConceptTypeResource: apigateway.CfnResource
+  public readonly stagedConceptTypeRecordIdResource: apigateway.CfnResource
   public readonly providersTemplatesResource: apigateway.CfnResource
   public readonly providersTemplatesIdResource: apigateway.CfnResource
   public readonly templatesResource: apigateway.CfnResource
@@ -118,6 +122,42 @@ export class MmtApiResources extends Construct {
     })
     this.providersTemplatesIdResource = providersTemplatesIdResource
 
+    // `/providers/{providerId}/{conceptType}` now exists only as the parent of
+    // the `stage-for-production` action route. The S3-backed concept routes
+    // (create/list/get/delete) live under `/staged/...` instead.
+    const providersConceptTypeResource = new apigateway.CfnResource(scope, 'ApiGatewayResourceProvidersProviderIdVarConceptTypeVar', {
+      parentId: providerIdResource.ref,
+      pathPart: '{conceptType}',
+      restApiId: apiGatewayRestApi.ref
+    })
+    this.providersConceptTypeResource = providersConceptTypeResource
+
+    const providersConceptTypeStageForProductionResource = new apigateway.CfnResource(scope, 'ApiGatewayResourceProvidersProviderIdVarConceptTypeVarStageForProduction', {
+      parentId: providersConceptTypeResource.ref,
+      pathPart: 'stage-for-production',
+      restApiId: apiGatewayRestApi.ref
+    })
+    this.providersConceptTypeStageForProductionResource = providersConceptTypeStageForProductionResource
+
+    // Staged concepts are opaque promotion artifacts keyed by a generated
+    // `recordId`; they carry no provider/native identity, so they route under a
+    // dedicated `/staged/{conceptType}` tree rather than under `/providers`.
+    const stagedResource = makeRootResource('Staged', 'staged')
+
+    const stagedConceptTypeResource = new apigateway.CfnResource(scope, 'ApiGatewayResourceStagedConceptTypeVar', {
+      parentId: stagedResource.ref,
+      pathPart: '{conceptType}',
+      restApiId: apiGatewayRestApi.ref
+    })
+    this.stagedConceptTypeResource = stagedConceptTypeResource
+
+    const stagedConceptTypeRecordIdResource = new apigateway.CfnResource(scope, 'ApiGatewayResourceStagedConceptTypeVarRecordIdVar', {
+      parentId: stagedConceptTypeResource.ref,
+      pathPart: '{recordId}',
+      restApiId: apiGatewayRestApi.ref
+    })
+    this.stagedConceptTypeRecordIdResource = stagedConceptTypeRecordIdResource
+
     const templatesResource = new apigateway.CfnResource(scope, 'ApiGatewayResourceTemplates', {
       parentId: apiGatewayRestApi.attrRootResourceId,
       pathPart: 'templates',
@@ -140,5 +180,15 @@ export class MmtApiResources extends Construct {
     addOptions('TemplatesIdVar', templatesIdResource, ['GET'])
 
     addOptions('Templates', templatesResource, ['GET'])
+
+    addOptions('ProvidersProviderIdVarConceptTypeVarStageForProduction', providersConceptTypeStageForProductionResource, ['POST'])
+
+    // PUT (createOrUpdateConcept) is deliberately omitted: it is a
+    // machine-to-machine route behind `stagingApiKeyAuthorizer`, called only by
+    // the UAT forwarding Lambda (server-to-server, no CORS preflight). Leaving
+    // PUT out of the CORS allow-list makes a browser preflight for it fail.
+    addOptions('StagedConceptTypeVar', stagedConceptTypeResource, ['GET'])
+
+    addOptions('StagedConceptTypeVarRecordIdVar', stagedConceptTypeRecordIdResource, ['GET', 'DELETE'])
   }
 }