Allow x-api-key for public rest api

packages/api-rest/__tests__/utils/iamAuthApplicable.test.ts

@@ -0,0 +1,73 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { HttpRequest } from '@aws-amplify/core/internals/aws-client-utils';
+import {
+	iamAuthApplicableForGraphQL,
+	iamAuthApplicableForPublic,
+} from '../../src/utils/iamAuthApplicable';
+
+describe('iamAuthApplicable', () => {
+	const url = new URL('https://url');
+	const baseRequest: HttpRequest = {
+		headers: {},
+		url: url,
+		method: 'put',
+	};
+
+	describe('iamAuthApplicableForGraphQL', () => {
+		it('should return true if there is no authorization header, no x-api-key header, and signingServiceInfo is provided', () => {
+			const signingServiceInfo = {};
+			expect(iamAuthApplicableForGraphQL(baseRequest, signingServiceInfo)).toBe(
+				true,
+			);
+		});
+
+		it('should return false if there is an authorization header', () => {
+			const request = {
+				...baseRequest,
+				headers: { authorization: 'SampleToken' },
+			};
+			const signingServiceInfo = {};
+			expect(iamAuthApplicableForGraphQL(request, signingServiceInfo)).toBe(
+				false,
+			);
+		});
+
+		it('should return false if there is an x-api-key header', () => {
+			const request = { ...baseRequest, headers: { 'x-api-key': 'key' } };
+			const signingServiceInfo = {};
+			expect(iamAuthApplicableForGraphQL(request, signingServiceInfo)).toBe(
+				false,
+			);
+		});
+
+		it('should return false if signingServiceInfo is not provided', () => {
+			expect(iamAuthApplicableForGraphQL(baseRequest)).toBe(false);
+		});
+	});
+
+	describe('iamAuthApplicableForPublic', () => {
+		it('should return true if there is no authorization header and signingServiceInfo is provided', () => {
+			const signingServiceInfo = {};
+			expect(iamAuthApplicableForPublic(baseRequest, signingServiceInfo)).toBe(
+				true,
+			);
+		});
+
+		it('should return false if there is an authorization header', () => {
+			const request = {
+				...baseRequest,
+				headers: { authorization: 'SampleToken' },
+			};
+			const signingServiceInfo = {};
+			expect(iamAuthApplicableForPublic(request, signingServiceInfo)).toBe(
+				false,
+			);
+		});
+
+		it('should return false if signingServiceInfo is not provided', () => {
+			expect(iamAuthApplicableForPublic(baseRequest)).toBe(false);
+		});
+	});
+});

packages/api-rest/src/apis/common/handler.ts

@@ -21,6 +21,7 @@ import {
 } from '../../utils';
 import { resolveHeaders } from '../../utils/resolveHeaders';
 import { RestApiResponse } from '../../types';
+import { iamAuthApplicableForGraphQL } from '../../utils/iamAuthApplicable';
 
 type HandlerOptions = Omit<HttpRequest, 'body' | 'headers'> & {
 	body?: DocumentType | FormData;
@@ -47,6 +48,10 @@ export const transferHandler = async (
 	amplify: AmplifyClassV6,
 	options: HandlerOptions & { abortSignal: AbortSignal },
 	signingServiceInfo?: SigningServiceInfo,
+	iamAuthApplicable: (
+		{ headers }: HttpRequest,
+		signingServiceInfo?: SigningServiceInfo,
+	) => boolean = iamAuthApplicableForGraphQL,
 ): Promise<RestApiResponse> => {
 	const { url, method, headers, body, withCredentials, abortSignal } = options;
 	const resolvedBody = body
@@ -69,6 +74,7 @@ export const transferHandler = async (
 	};
 
 	const isIamAuthApplicable = iamAuthApplicable(request, signingServiceInfo);
+
 	let response: RestApiResponse;
 	const credentials = await resolveCredentials(amplify);
 	if (isIamAuthApplicable && credentials) {
@@ -97,11 +103,6 @@ export const transferHandler = async (
 	};
 };
 
-const iamAuthApplicable = (
-	{ headers }: HttpRequest,
-	signingServiceInfo?: SigningServiceInfo,
-) => !headers.authorization && !headers['x-api-key'] && !!signingServiceInfo;
-
 const resolveCredentials = async (
 	amplify: AmplifyClassV6,
 ): Promise<AWSCredentials | null> => {

packages/api-rest/src/apis/common/publicApis.ts

@@ -25,6 +25,7 @@ import {
 	parseSigningInfo,
 	resolveApiUrl,
 } from '../../utils';
+import { iamAuthApplicableForPublic } from '../../utils/iamAuthApplicable';
 
 import { transferHandler } from './handler';
 
@@ -72,6 +73,7 @@ const publicHandler = (
 				abortSignal,
 			},
 			signingServiceInfo,
+			iamAuthApplicableForPublic,
 		);
 	});
 

packages/api-rest/src/utils/iamAuthApplicable.ts

@@ -0,0 +1,19 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { HttpRequest } from '@aws-amplify/core/internals/aws-client-utils';
+
+interface SigningServiceInfo {
+	service?: string;
+	region?: string;
+}
+
+export const iamAuthApplicableForGraphQL = (
+	{ headers }: HttpRequest,
+	signingServiceInfo?: SigningServiceInfo,
+) => !headers.authorization && !headers['x-api-key'] && !!signingServiceInfo;
+
+export const iamAuthApplicableForPublic = (
+	{ headers }: HttpRequest,
+	signingServiceInfo?: SigningServiceInfo,
+) => !headers.authorization && !!signingServiceInfo;