AWS Lambda handler for Grant

var grant = require('grant').aws({
  config: {/*Grant configuration*/}, session: {secret: 'grant'}
})

exports.handler = async (event) => {
  var {redirect, response} = await grant(event)
  return redirect || {
    statusCode: 200,
    headers: {'content-type': 'application/json'},
    body: JSON.stringify(response)
  }
}

Also available for Azure, Google Cloud, Vercel

The config key expects your Grant configuration.

You have to specify the absolute path prefix that includes your stage name:

{
  "defaults": {
    "origin": "https://[id].execute-api.[region].amazonaws.com",
    "prefix": "/[stage]/connect"
  },
  "google": {}
}

You login by navigating to:

https://[id].execute-api.[region].amazonaws.com/[stage]/connect/google

The redirect URL of your OAuth app have to be set to:

https://[id].execute-api.[region].amazonaws.com/[stage]/connect/google/callback

And locally:

http://localhost:3000/[stage]/connect/google
http://localhost:3000/[stage]/connect/google/callback

The session key expects your session configuration:

• The default cookie store is used unless you specify a store implementation!
• Using the default cookie store may leak private data!
• Implementing an external session store is recommended for production deployments!

Example session store implementation using Firebase:

var request = require('request-compose').client

var path = process.env.FIREBASE_PATH
var auth = process.env.FIREBASE_AUTH

module.exports = {
  get: async (sid) => {
    var {body} = await request({
      method: 'GET', url: `${path}/${sid}.json`, qs: {auth},
    })
    return body
  },
  set: async (sid, json) => {
    await request({
      method: 'PATCH', url: `${path}/${sid}.json`, qs: {auth}, json,
    })
  },
  remove: async (sid) => {
    await request({
      method: 'DELETE', url: `${path}/${sid}.json`, qs: {auth},
    })
  },
}

The AWS Lambda handler for Grant accepts:

The AWS Lambda handler for Grant returns:

Different AWS API Gateway types and session store types were used for example purposes only.

All variables at the top of the Makefile with value set to ... have to be configured:

• profile - AWS_PROFILE to use for managing AWS resources, not used for local development

• firebase_path - Firebase path of your database, required for transport-session and dynamic-state examples

https://[project].firebaseio.com/[prefix]

• firebase_auth - Firebase auth key of your database, required for transport-session and dynamic-state examples

{
  "rules": {
    ".read": "auth == '[key]'",
    ".write": "auth == '[key]'"
  }
}

All variables can be passed as arguments to make as well:

make plan example=transport-querystring ...

# build example locally
make build-dev
# run example locally
make run-dev

# build Grant lambda for deployment
make build-grant
# build callback lambda for transport-querystring and transport-session examples
make build-callback
# execute only once
make init
# plan before every deployment
make plan
# apply plan for deployment
make apply
# cleanup resources
make destroy