lockbot/serverless.yml at master · connorads/lockbot · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
service: lockbot

frameworkVersion: "4"

useDotenv: true

plugins:
  - serverless-esbuild
  - serverless-dynamodb
  - serverless-offline
provider:
  name: aws
  runtime: nodejs22.x
  environment:
    # esbuild emits source maps (custom.esbuild.sourcemap); Node only reads
    # them with this flag, giving TypeScript locations in Lambda stack traces
    NODE_OPTIONS: "--enable-source-maps"
    SLACK_SIGNING_SECRET: ${env:SLACK_SIGNING_SECRET}
    SLACK_CLIENT_ID: ${env:SLACK_CLIENT_ID}
    SLACK_CLIENT_SECRET: ${env:SLACK_CLIENT_SECRET}
    STATE_SECRET: ${env:STATE_SECRET}
    RESOURCES_TABLE_NAME: ${self:custom.resourcesTableName}
    INSTALLATIONS_TABLE_NAME: ${self:custom.installationsTableName}
    ACCESS_TOKENS_TABLE_NAME: ${self:custom.accessTokensTableName}
    SERVERLESS_STAGE: ${self:custom.stage}
    API_GATEWAY_URL:
      Fn::Join:
        - ""
        - - "https://"
          - Ref: "ApiGatewayRestApi"
          - ".execute-api.${self:custom.region}.amazonaws.com/${self:custom.stage}"
  iam:
    role:
      statements:
        - Effect: Allow
          Action:
            - dynamodb:Query
            - dynamodb:Scan
            - dynamodb:GetItem
            - dynamodb:PutItem
            - dynamodb:UpdateItem
            - dynamodb:DeleteItem
          Resource:
            - "Fn::GetAtt": [resourcesTable, Arn]
            - "Fn::GetAtt": [installationsTable, Arn]
            - "Fn::GetAtt": [accessTokensTable, Arn]

functions:
  slack-handler:
    handler: src/handlers/slack/index.handler
    events:
      - http:
          method: post
          path: /slack/events
      - http:
          method: get
          path: /slack/install
      - http:
          method: get
          path: /slack/oauth_redirect
  api-handler:
    handler: src/handlers/api/index.handler
    events:
      - http:
          method: get
          path: /api/teams/{team}/channels/{channel}/locks
      - http:
          method: post
          path: /api/teams/{team}/channels/{channel}/locks
      - http:
          method: get
          path: /api/teams/{team}/channels/{channel}/locks/{lock}
      - http:
          method: delete
          path: /api/teams/{team}/channels/{channel}/locks/{lock}
  swagger:
    handler: src/handlers/swagger/index.handler
    events:
      - http:
          method: get
          path: /api-docs
      - http:
          method: get
          path: /openapi.json
      - http:
          method: get
          path: /api-docs/openapi.json

resources:
  Resources:
    resourcesTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: ${self:custom.resourcesTableName}
        AttributeDefinitions:
          - AttributeName: Resource
            AttributeType: S
          - AttributeName: Group
            AttributeType: S
        KeySchema:
          - AttributeName: Group
            KeyType: HASH
          - AttributeName: Resource
            KeyType: RANGE
        ProvisionedThroughput:
          ReadCapacityUnits: 4
          WriteCapacityUnits: 4
    installationsTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: ${self:custom.installationsTableName}
        AttributeDefinitions:
          - AttributeName: Team
            AttributeType: S
        KeySchema:
          - AttributeName: Team
            KeyType: HASH
        ProvisionedThroughput:
          ReadCapacityUnits: 4
          WriteCapacityUnits: 2
    accessTokensTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: ${self:custom.accessTokensTableName}
        AttributeDefinitions:
          - AttributeName: Scope
            AttributeType: S
        KeySchema:
          - AttributeName: Scope
            KeyType: HASH
        ProvisionedThroughput:
          ReadCapacityUnits: 4
          WriteCapacityUnits: 2

custom:
  stage: ${sls:stage}
  esbuild:
    bundle: true
    minify: false
    sourcemap: true
    target: node22
    # bundle @aws-sdk/* rather than relying on the runtime-provided copy,
    # per AWS guidance (pinned version, faster cold start)
    exclude: []
    loader:
      ".html": text
  region: ${opt:region, self:provider.region, "eu-west-1"}
  resourcesTableName: ${self:custom.stage}-lockbot-resources
  installationsTableName: ${self:custom.stage}-lockbot-installations
  accessTokensTableName: ${self:custom.stage}-lockbot-tokens
  dynamodb:
    stages:
      - dev # https://bit.ly/35WR0TT