template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Wei app cloudformation stack

Parameters:
  StageParameter:
    Type: String
    Default: prod
    AllowedValues:
      - prod
      - dev
    Description: Stage name
  WeiAppPictureStorageBucketName:
    Type: String
    Default: wei-app-picture-storage
  SESMailAddressArn:
    Type: String

# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
  Function:
    Timeout: 5
    Runtime: python3.12
    Handler: app.lambda_handler
    Architectures:
      - arm64
    Environment:
      Variables:
        USER_TABLE: !Ref WeiAppUsers
        CHALLENGES_TABLE: !Ref WeiAppChallenges
        TEAMS_TABLE: !Ref WeiAppTeams
        CACHE_TIME: 120

Resources:
  WeiAppApi:
    Type: AWS::Serverless::Api
    Properties:
      Name: wei_app_api
      StageName: !Ref StageParameter
      EndpointConfiguration:
        Type: REGIONAL
      Auth:
        Authorizers:
          CognitoAuthorizer:
            UserPoolArn: !GetAtt WeiAppUserPool.Arn
      Cors:
        AllowMethods: "'GET,PUT,POST,DELETE,OPTIONS'"
        AllowHeaders: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'"
        AllowOrigin: "'*'"
      GatewayResponses:
        DEFAULT_4XX:
          ResponseParameters:
            Headers:
              Access-Control-Allow-Origin: "'*'"
              Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'"
              Access-Control-Allow-Methods: "'GET,PUT,POST,DELETE,OPTIONS'"
        DEFAULT_5XX:
          ResponseParameters:
            Headers:
              Access-Control-Allow-Origin: "'*'"
              Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'"
              Access-Control-Allow-Methods: "'GET,PUT,POST,DELETE,OPTIONS'"
      Models:
        CreateChallengeModel:
          type: object
          required: [ name, description, points, start, end ]
          properties:
            challenge:
              type: string
            name:
              type: string
            description:
              type: string
            picture_id:
              type: string
            points:
              type: integer
            start:
              type: integer
            end:
              type: integer
            max_count:
              type: integer
        UpdateChallengeModel:
          type: object
          properties:
            challenge:
              type: string
            name:
              type: string
            description:
              type: string
            picture_id:
              type: string
            points:
              type: integer
            start:
              type: integer
            end:
              type: integer
            max_count:
              type: integer
        CreateTeamModel:
          type: object
          required: [ display_name, picture_id ]
          properties:
            display_name:
              type: string
            picture_id:
              type: string
        UpdateTeamModel:
          type: object
          properties:
            display_name:
              type: string
            picture_id:
              type: string
        AcceptJoinTeamModel:
          type: object
          required: [ username ]
          properties:
            username:
              type: string
        AcceptRequestChallengeModel:
          type: object
          required: [ challenge ]
          properties:
            challenge:
              type: string
        UpdateSelfModel:
          type: object
          properties:
            show:
              type: boolean
            display_name:
              type: string
            picture_id:
              type: string
        RequestPictureIDModel:
          type: object
          required: [ usage ]
          properties:
            usage:
              type: string

  #
  # COGNITO
  #

  WeiAppUserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      UserPoolName: wei_app_user_pool
      AliasAttributes:
        - email
        - preferred_username
      AutoVerifiedAttributes:
        - email
      UsernameConfiguration:
        CaseSensitive: True
      Policies:
        PasswordPolicy:
          MinimumLength: 8
          RequireLowercase: False
          RequireNumbers: False
          RequireSymbols: False
          RequireUppercase: False
      Schema:
        - Name: email
          Required: True
          Mutable: False
      #        - Name: preferred_username
      VerificationMessageTemplate:
        DefaultEmailOption: CONFIRM_WITH_LINK
        EmailMessageByLink: "Hello, voici {##ton lien de vérification##} ! Bienvenue au WEI !"
        EmailSubjectByLink: "WEI - Vérification de votre adresse email"
      EmailConfiguration:
        EmailSendingAccount: DEVELOPER
        SourceArn: !Ref SESMailAddressArn
      LambdaConfig:
        PostConfirmation: !GetAtt PostConfirmSignUpFunction.Arn
        PreSignUp: !GetAtt PreSignUpFunction.Arn

  WeiAppUserPoolAdminGroup:
    Type: AWS::Cognito::UserPoolGroup
    Properties:
      Description: Admin group
      GroupName: Admin
      UserPoolId: !Ref WeiAppUserPool

  OnCognitoPostConfirmationSignUpPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !GetAtt PostConfirmSignUpFunction.Arn
      Principal: cognito-idp.amazonaws.com
      SourceArn: !Sub arn:aws:cognito-idp:${AWS::Region}:${AWS::AccountId}:userpool/${WeiAppUserPool}

  OnCognitoPreSignUpPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !GetAtt PreSignUpFunction.Arn
      Principal: cognito-idp.amazonaws.com
      SourceArn: !Sub arn:aws:cognito-idp:${AWS::Region}:${AWS::AccountId}:userpool/${WeiAppUserPool}

  WeiAppUserPoolDomain:
    Type: AWS::Cognito::UserPoolDomain
    Properties:
      UserPoolId: !Ref WeiAppUserPool
      Domain: !Sub ${StageParameter}-wei-app-upd

  WeiAppUserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      ClientName: wei_app_user_pool_client
      GenerateSecret: False
      UserPoolId: !Ref WeiAppUserPool
      ExplicitAuthFlows:
        - ALLOW_USER_PASSWORD_AUTH
        - ALLOW_REFRESH_TOKEN_AUTH
        - ALLOW_CUSTOM_AUTH

  #  WeiAppUserPoolAdminGroup:
  #    Type: AWS::Cognito::UserPoolGroup
  #    Properties:
  #      Description: Admin group
  #      GroupName: Admin
  #      UserPoolId: !Ref WeiAppUserPool
  #
  #  WeiAppUserPoolManagerGroup:
  #    Type: AWS::Cognito::UserPoolGroup
  #    Properties:
  #      Description: Manager group
  #      GroupName: Manager
  #      UserPoolId: !Ref WeiAppUserPool
  #
  #  WeiAppUserPoolPlayerGroup:
  #    Type: AWS::Cognito::UserPoolGroup
  #    Properties:
  #      Description: Player group
  #      GroupName: Player
  #      UserPoolId: !Ref WeiAppUserPool

  #
  # DB
  #

  WeiAppUsers:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: wei_app_db_users
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: username
          AttributeType: S
      KeySchema:
        - AttributeName: username
          KeyType: HASH

  WeiAppTeams:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: wei_app_db_teams
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: team
          AttributeType: S
      KeySchema:
        - AttributeName: team
          KeyType: HASH

  WeiAppChallenges:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: wei_app_db_challenges
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: challenge
          AttributeType: S
      KeySchema:
        - AttributeName: challenge
          KeyType: HASH

  #
  # STUFF
  #

  AllowAllRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
                - apigateway.amazonaws.com
                - dynamodb.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Policies:
        - PolicyName: AllowAllPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: '*'
                Resource: '*'

  WeiAppPictureStorage:
    Type: AWS::S3::Bucket
    DependsOn: WeiAppS3CallFunctionPermission
    Properties:
      BucketName: !Ref WeiAppPictureStorageBucketName
      PublicAccessBlockConfiguration:
        BlockPublicAcls: False
        BlockPublicPolicy: False
        IgnorePublicAcls: False
        RestrictPublicBuckets: False
      NotificationConfiguration:
        LambdaConfigurations:
          - Event: 's3:ObjectCreated:*'
            Function: !GetAtt ResizePictureFunction.Arn
            Filter:
              S3Key:
                Rules:
                  - Name: prefix
                    Value: 'unprocessed'
      CorsConfiguration:
        CorsRules:
          - AllowedOrigins:
              - '*'
            AllowedMethods:
              - GET
              - PUT
              - POST
              - DELETE
              - HEAD
            AllowedHeaders:
              - '*'
            MaxAge: 3000

  WeiAppS3CallFunctionPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: 'lambda:InvokeFunction'
      FunctionName: !Ref ResizePictureFunction
      Principal: s3.amazonaws.com
      SourceAccount: !Ref "AWS::AccountId"
      SourceArn: !Sub "arn:aws:s3:::${WeiAppPictureStorageBucketName}"

  WeiAppS3PublicPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref WeiAppPictureStorage
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: PublicReadForGetBucketObjects
            Effect: Allow
            Principal: '*'
            Action: 's3:GetObject'
            Resource: !Sub 'arn:aws:s3:::${WeiAppPictureStorageBucketName}/*'

  #
  # FUNCTIONS
  #

  HelloWorldFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: wei_app_lambda_hello_world
      CodeUri: hello_world/
      Role: !GetAtt AllowAllRole.Arn
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /
            Method: get
            RestApiId: !Ref WeiAppApi

  ResetPasswordFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: wei_app_lambda_reset_password
      CodeUri: reset_password/
      Role: !GetAtt AllowAllRole.Arn
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /reset_password
            Method: POST
            RestApiId: !Ref WeiAppApi

  ResetPasswordSendCodeFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: wei_app_lambda_reset_password_code_send
      CodeUri: reset_password_code_send/
      Role: !GetAtt AllowAllRole.Arn
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /reset_password_code_send
            Method: POST
            RestApiId: !Ref WeiAppApi

  GetAllUsersFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: wei_app_lambda_get_all_users
      CodeUri: get_all_users/
      Role: !GetAtt AllowAllRole.Arn
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /users
            Method: get
            RestApiId: !Ref WeiAppApi

  GetUserFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: wei_app_lambda_get_user
      CodeUri: get_user/
      Role: !GetAtt AllowAllRole.Arn
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /users/{username}
            Method: get
            RestApiId: !Ref WeiAppApi

  GetSelfFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: wei_app_lambda_get_self
      CodeUri: get_self/
      Role: !GetAtt AllowAllRole.Arn
      Layers:
        - !Ref DependenciesLayer
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /users/me
            Method: get
            RestApiId: !Ref WeiAppApi
            Auth:
              Authorizer: CognitoAuthorizer

  UpdateSelfFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: wei_app_lambda_update_self
      CodeUri: update_self/
      Role: !GetAtt AllowAllRole.Arn
      Layers:
        - !Ref DependenciesLayer
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /users/me
            Method: post
            RestApiId: !Ref WeiAppApi
            Auth:
              Authorizer: CognitoAuthorizer
            RequestModel:
              Model: UpdateSelfModel
              ValidateBody: true

  CreateChallengeFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: wei_app_lambda_create_challenge
      CodeUri: create_challenge/
      Role: !GetAtt AllowAllRole.Arn
      Layers:
        - !Ref DependenciesLayer
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /challenges/{challenge}
            Method: put
            RestApiId: !Ref WeiAppApi
            Auth:
              Authorizer: CognitoAuthorizer
            RequestModel:
              Model: CreateChallengeModel
              ValidateBody: true

  UpdateChallengeFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: wei_app_lambda_update_challenge
      CodeUri: update_challenge/
      Role: !GetAtt AllowAllRole.Arn
      Layers:
        - !Ref DependenciesLayer
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /challenges/{challenge}
            Method: post
            RestApiId: !Ref WeiAppApi
            Auth:
              Authorizer: CognitoAuthorizer
            RequestModel:
              Model: UpdateChallengeModel
              ValidateBody: true

  RequestChallengeFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: wei_app_lambda_request_challenge
      CodeUri: request_challenge/
      Role: !GetAtt AllowAllRole.Arn
      Layers:
        - !Ref DependenciesLayer
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /challenges/{challenge}/request
            Method: post
            RestApiId: !Ref WeiAppApi
            Auth:
              Authorizer: CognitoAuthorizer

  AcceptRequestChallengeFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: wei_app_lambda_accept_request_challenge
      CodeUri: accept_request_challenge/
      Role: !GetAtt AllowAllRole.Arn
      Layers:
        - !Ref DependenciesLayer
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /users/{username}/accept
            Method: post
            RestApiId: !Ref WeiAppApi
            Auth:
              Authorizer: CognitoAuthorizer
            RequestModel:
              Model: AcceptRequestChallengeModel
              ValidateBody: true

  GetChallengeFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: wei_app_lambda_get_challenge
      CodeUri: get_challenge/
      Role: !GetAtt AllowAllRole.Arn
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /challenges/{challenge}
            Method: get
            RestApiId: !Ref WeiAppApi

  AddTodoChallengeFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: wei_app_lambda_todo_challenge
      CodeUri: todo_challenge/
      Role: !GetAtt AllowAllRole.Arn
      Layers:
        - !Ref DependenciesLayer
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /challenges/{challenge}/todo
            Method: post
            RestApiId: !Ref WeiAppApi

  RemoveTodoChallengeFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: wei_app_lambda_remove_todo_challenge
      CodeUri: remove_todo_challenge/
      Role: !GetAtt AllowAllRole.Arn
      Layers:
        - !Ref DependenciesLayer
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /challenges/{challenge}/todo
            Method: delete
            RestApiId: !Ref WeiAppApi

  GetAllChallengesFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: wei_app_lambda_get_all_challenges
      CodeUri: get_all_challenges/
      Role: !GetAtt AllowAllRole.Arn
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /challenges
            Method: get
            RestApiId: !Ref WeiAppApi

  CreateTeamFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: wei_app_lambda_create_team
      CodeUri: create_team/
      Role: !GetAtt AllowAllRole.Arn
      Layers:
        - !Ref DependenciesLayer
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /teams/{team}
            Method: put
            RestApiId: !Ref WeiAppApi
            Auth:
              Authorizer: CognitoAuthorizer
            RequestModel:
              Model: CreateTeamModel
              ValidateBody: true

  UpdateTeamFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: wei_app_lambda_update_team
      CodeUri: update_team/
      Role: !GetAtt AllowAllRole.Arn
      Layers:
        - !Ref DependenciesLayer
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /teams/{team}
            Method: post
            RestApiId: !Ref WeiAppApi
            Auth:
              Authorizer: CognitoAuthorizer
            RequestModel:
              Model: UpdateTeamModel
              ValidateBody: true

  JoinTeamFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: wei_app_lambda_join_team
      CodeUri: join_team/
      Role: !GetAtt AllowAllRole.Arn
      Layers:
        - !Ref DependenciesLayer
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /teams/{team}/join
            Method: post
            RestApiId: !Ref WeiAppApi
            Auth:
              Authorizer: CognitoAuthorizer

  LeaveTeamFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: wei_app_lambda_leave_team
      CodeUri: leave_team/
      Role: !GetAtt AllowAllRole.Arn
      Layers:
        - !Ref DependenciesLayer
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /teams/leave
            Method: post
            RestApiId: !Ref WeiAppApi
            Auth:
              Authorizer: CognitoAuthorizer

  AcceptJoinTeamFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: wei_app_lambda_accept_join_team
      CodeUri: accept_join_team/
      Role: !GetAtt AllowAllRole.Arn
      Layers:
        - !Ref DependenciesLayer
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /teams/{team}/accept
            Method: post
            RestApiId: !Ref WeiAppApi
            Auth:
              Authorizer: CognitoAuthorizer
            RequestModel:
              Model: AcceptJoinTeamModel
              ValidateBody: true

  GetTeamFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: wei_app_lambda_get_team
      CodeUri: get_team/
      Role: !GetAtt AllowAllRole.Arn
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /teams/{team}
            Method: get
            RestApiId: !Ref WeiAppApi

  GetAllTeamsFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: wei_app_lambda_get_all_teams
      CodeUri: get_all_teams/
      Role: !GetAtt AllowAllRole.Arn
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /teams
            Method: get
            RestApiId: !Ref WeiAppApi

  PostConfirmSignUpFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: wei_app_lambda_post_confirm_sign_up
      CodeUri: post_confirm_sign_up/
      Role: !GetAtt AllowAllRole.Arn

  PreSignUpFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: wei_app_lambda_pre_sign_up
      CodeUri: pre_sign_up/
      Role: !GetAtt AllowAllRole.Arn

  RequestPictureIDFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: wei_app_lambda_request_picture_id
      CodeUri: request_picture_id/
      Role: !GetAtt AllowAllRole.Arn
      Environment:
        Variables:
          PICTURE_BUCKET: !Ref WeiAppPictureStorage
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /picture
            Method: post
            RestApiId: !Ref WeiAppApi
            Auth:
              Authorizer: CognitoAuthorizer
            RequestModel:
              Model: RequestPictureIDModel
              ValidateBody: true

  ResizePictureFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: wei_app_lambda_resize_picture
      CodeUri: resize_picture/
      Role: !GetAtt AllowAllRole.Arn
      MemorySize: 1024
      Timeout: 10

  DependenciesLayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      LayerName: DependenciesLayer
      ContentUri: dependencies/
      CompatibleRuntimes:
        - python3.12

Outputs:
  UserPoolClientID:
    Value: !Ref WeiAppUserPoolClient
    Description: User Pool Client ID
  ApiUrl:
    Value: !Sub https://${WeiAppApi}.execute-api.${AWS::Region}.amazonaws.com
    Description: API Endpoint URL