serverless.yml

service: communion-wallet-abstraction
configValidationMode: error

provider:
  name: aws
  deploymentMethod: direct
  runtime: nodejs14.x
  stage: ${opt:stage, 'dev'}
  region: us-east-1
  stackName: ${sls:stage}-${self:service}
  apiName: ${sls:stage}-${self:service}
  memorySize: 512
  deploymentPrefix: serverless
  versionFunctions: true
  logRetentionInDays: 30
  # http-api docs https://www.serverless.com/framework/docs/providers/aws/events/http-api
  # TODO View docs - we will want to make it only accept from our domain
  httpApi:
    cors: true
    authorizers:
      cognitoJwtAuthorizer-dev:
        type: jwt
        identitySource: $request.header.Authorization
        issuerUrl: https://cognito-idp.us-east-1.amazonaws.com/us-east-1_EXRZZF0cp
        audience:
          # TODO: Figure out the implications of this, is clientId proper?
          - 4eerlu1taf72c8r20pv2tmmvmt
      cognitoJwtAuthorizer-prod:
        type: jwt
        identitySource: $request.header.Authorization
        issuerUrl: https://cognito-idp.us-east-1.amazonaws.com/us-east-1_SeeaUyuuH
        audience:
          # TODO: Figure out the implications of this, is clientId proper?
          - 4sdv5ic4kdhhggf7chcveocimk
  iam:
    role:
      statements:
        - Effect: 'Allow'
          Action:
            - 'lambda:InvokeFunction'
          Resource:
            - '*'
        - Effect: 'Allow'
          Action:
            - 'dynamodb:*'
          Resource:
            - Fn::GetAtt: [usersTable, Arn]
            - Fn::GetAtt: [orgsTable, Arn]
            - Fn::GetAtt: [transactionsTable, Arn]
            - Fn::Join:
                [
                  '',
                  [
                    Fn::GetAtt: [transactionsTable, Arn],
                    '/index/fromToUserIndex',
                  ],
                ]

  environment:
    STAGE: ${sls:stage}
    LOG_LEVEL: verbose

plugins:
  - serverless-bundle
  - serverless-prune-plugin

custom:
  prune:
    automatic: true
    number: 5
  bundle:
    packager: yarn
    # TODO: Figure out AWS-SDK v3 exclusion. https://aws.amazon.com/blogs/developer/modular-packages-in-aws-sdk-for-javascript/
    externals:
      - crypto
      - ethers

functions:
  getSelf:
    name: getSelf-${sls:stage}
    handler: src/endpoints/api-get-self.handler
    events:
      # http-api docs https://www.serverless.com/framework/docs/providers/aws/events/http-api
      - httpApi:
          method: GET
          path: /user/self
          authorizer:
            name: cognitoJwtAuthorizer-${sls:stage}
  patchSelf:
    name: patchSelf-${sls:stage}
    handler: src/endpoints/api-patch-self.handler
    events:
      # http-api docs https://www.serverless.com/framework/docs/providers/aws/events/http-api
      - httpApi:
          method: PATCH
          path: /user/self
          authorizer:
            name: cognitoJwtAuthorizer-${sls:stage}
  getSelfTxs:
    name: getSelfTxs-${sls:stage}
    handler: src/endpoints/api-get-self-txs.handler
    events:
      # http-api docs https://www.serverless.com/framework/docs/providers/aws/events/http-api
      - httpApi:
          method: GET
          path: /user/self/txs
          authorizer:
            name: cognitoJwtAuthorizer-${sls:stage}
  postSeedSelf:
    name: postSeedSelf-${sls:stage}
    handler: src/endpoints/api-post-seed-self.handler
    timeout: 30
    events:
      # http-api docs https://www.serverless.com/framework/docs/providers/aws/events/http-api
      - httpApi:
          method: POST
          path: /user/self/seed
          authorizer:
            name: cognitoJwtAuthorizer-${sls:stage}
  postSelfTransfer:
    name: postSelfTransfer-${sls:stage}
    handler: src/endpoints/api-post-self-transfer.handler
    events:
      # http-api docs https://www.serverless.com/framework/docs/providers/aws/events/http-api
      - httpApi:
          method: post
          path: /user/self/transfer
          authorizer:
            name: cognitoJwtAuthorizer-${sls:stage}
  postSelfMultisend:
    name: postSelfMultisend-${sls:stage}
    handler: src/endpoints/api-post-self-multisend.handler
    environment:
      TWILIO_API_KEY: ${ssm:/twilio_api_key}
    events:
      # http-api docs https://www.serverless.com/framework/docs/providers/aws/events/http-api
      - httpApi:
          method: post
          path: /user/self/multisend
          authorizer:
            name: cognitoJwtAuthorizer-${sls:stage}
  getOrgById:
    name: getOrgById-${sls:stage}
    handler: src/endpoints/api-get-org-by-id.handler
    events:
      # http-api docs https://www.serverless.com/framework/docs/providers/aws/events/http-api
      - httpApi:
          method: GET
          path: /org/{orgId}
          authorizer:
            name: cognitoJwtAuthorizer-${sls:stage}
  getOrgTxsSelf:
    name: getOrgTxsSelf-${sls:stage}
    handler: src/endpoints/api-get-org-txs-self.handler
    timeout: 15
    events:
      # http-api docs https://www.serverless.com/framework/docs/providers/aws/events/http-api
      - httpApi:
          method: GET
          path: /org/{orgId}/txs/self
          authorizer:
            name: cognitoJwtAuthorizer-${sls:stage}
  postOrgRedeemSelf:
    name: postOrgRedeemSelf-${sls:stage}
    handler: src/endpoints/api-post-org-redeem-self.handler
    events:
      # http-api docs https://www.serverless.com/framework/docs/providers/aws/events/http-api
      - httpApi:
          method: POST
          path: /org/{orgId}/redeem
          authorizer:
            name: cognitoJwtAuthorizer-${sls:stage}
  postJoinOrgById:
    name: postJoinOrgById-${sls:stage}
    handler: src/endpoints/api-post-join-org-by-id.handler
    timeout: 30
    events:
      # http-api docs https://www.serverless.com/framework/docs/providers/aws/events/http-api
      - httpApi:
          method: POST
          path: /org/{orgId}/join
          authorizer:
            name: cognitoJwtAuthorizer-${sls:stage}
  postOrgMintNft:
    name: postOrgMintNft-${sls:stage}
    handler: src/endpoints/api-post-org-mint-nft.handler
    timeout: 30
    environment:
      NFT_STORAGE_API_KEY: ${ssm:/nft_storage_api_key}
      TWILIO_API_KEY: ${ssm:/twilio_api_key}
    events:
      # http-api docs https://www.serverless.com/framework/docs/providers/aws/events/http-api
      - httpApi:
          method: POST
          path: /org/{orgId}/mintNft
          authorizer:
            name: cognitoJwtAuthorizer-${sls:stage}
  postLogTxnError:
    name: postLogTxnError-${sls:stage}
    handler: src/endpoints/api-post-log-txn-error.handler
    timeout: 5
    events:
      # http-api docs https://www.serverless.com/framework/docs/providers/aws/events/http-api
      - httpApi:
          method: POST
          path: /log
          authorizer:
            name: cognitoJwtAuthorizer-${sls:stage}
  postConfirmationCreateUserWallet:
    name: postConfirmationCreateUserWallet-${sls:stage}
    handler: src/cognitoTriggers/post-confirmation-create-user-wallet.handler
    timeout: 5
    events:
      - cognitoUserPool:
          pool: communion-users-demo-${sls:stage}
          trigger: PostConfirmation
          existing: true
  newImageSeedUser:
    name: newImageSeedUser-${sls:stage}
    handler: src/dynamoTriggers/new-image-seed-user.handler
    timeout: 20
    events:
      - stream:
          type: dynamodb
          arn:
            Fn::GetAtt: [usersTable, StreamArn]
  seedUserWithCtc:
    name: seedUserWithCtc-${sls:stage}
    handler: src/lambdas/seed-user-with-ctc.handler
    timeout: 30
    environment:
      TWILIO_API_KEY: ${ssm:/twilio_api_key}

resources:
  Resources:
    usersTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: usersTable-${sls:stage}
        AttributeDefinitions:
          - AttributeName: id
            AttributeType: S
        KeySchema:
          - AttributeName: id
            KeyType: HASH
        BillingMode: PAY_PER_REQUEST
        SSESpecification:
          SSEEnabled: true
        # https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_StreamSpecification.html
        StreamSpecification:
          StreamViewType: NEW_IMAGE
    orgsTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: orgsTable-${sls:stage}
        AttributeDefinitions:
          - AttributeName: id
            AttributeType: S
        KeySchema:
          - AttributeName: id
            KeyType: HASH
        BillingMode: PAY_PER_REQUEST
        SSESpecification:
          SSEEnabled: true
    transactionsTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: transactionsTable-${sls:stage}
        AttributeDefinitions:
          - AttributeName: org_id
            AttributeType: S
          - AttributeName: to_user_id_txn_hash_urn
            AttributeType: S
          - AttributeName: from_user_to_user_txn_hash_urn
            AttributeType: S
        KeySchema:
          - AttributeName: org_id
            KeyType: HASH
          - AttributeName: to_user_id_txn_hash_urn
            KeyType: RANGE
        LocalSecondaryIndexes:
          # This will fit 10GB MAX per Partition key
          # With the current items we are looking at around 37million txns PER org
          - IndexName: fromToUserIndex
            KeySchema:
              - AttributeName: org_id
                KeyType: HASH
              - AttributeName: from_user_to_user_txn_hash_urn
                KeyType: RANGE
            Projection:
              ProjectionType: ALL
        TimeToLiveSpecification:
          AttributeName: expiration_time
          Enabled: true
        BillingMode: PAY_PER_REQUEST
        SSESpecification:
          SSEEnabled: true
    # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpool.html
    cognitoCommunionUsersDemo:
      Type: AWS::Cognito::UserPool
      Properties:
        UserPoolName: communion-users-demo-${sls:stage}
        UsernameAttributes:
          - email
        EmailConfiguration:
          EmailSendingAccount: COGNITO_DEFAULT
        AutoVerifiedAttributes:
          - email
        VerificationMessageTemplate:
          DefaultEmailOption: CONFIRM_WITH_CODE
        AccountRecoverySetting:
          RecoveryMechanisms:
            - Name: verified_email
              Priority: 1
        Schema:
          - AttributeDataType: 'String'
            Name: 'family_name'
            Mutable: true
            Required: true
          - AttributeDataType: 'String'
            Name: 'given_name'
            Mutable: true
            Required: true
          - AttributeDataType: 'String'
            Name: 'organization'
            Mutable: true
          - AttributeDataType: 'String'
            Name: 'role'
            Mutable: true
        UsernameConfiguration:
          CaseSensitive: false