serverless.aws.example.yml

# This is a rough example of using Okta as the authorization server as part of a SMART/FHIR deployment.
# It includes the following features:
# - standalone launch with launch parameters
# - a patient picker screen and OAuth2 scope selection and consent.
# - applicable proxies for properly handling public client authentication as well as returning launch parameters in a flexible way.
# - passthrough API endpoints for demo data, hosted by HAPI.org.

service: okta-smartfhir-auth-demo

provider:
  name: aws
  runtime: nodejs12.x
  stage: sandbox
  region: us-east-1
  
  logs:
    restApi: true

  environment:
#This variable will contain the live API URL (https://XXXXX.execute-api.us-east-1.amazonaws.com/dev)
    GATEWAY_URL:
      !Join
        - ''
        - - 'https://'
          - !Ref ApiGatewayRestApi
          - '.execute-api.'
          - ${opt:region, self:provider.region}
          - '.amazonaws.com/'
          - ${opt:stage, self:provider.stage}
          
    AUTHZ_ISSUER: https://youroktaorg.oktapreview.com/oauth2/your_authz_server_id
    AUTHZ_SERVER: your_authz_server_id
    OKTA_ORG: youroktaorg.oktapreview.com
    STATE_COOKIE_SIGNATURE_KEY: JustPutAReallyLongValueHere!
    EXPECTED_AUD_VALUE: https://yourFHIRserver.com
    
    #TODO: Get rid of.
    API_KEY: your_api_key_here
    
    PICKER_DISPLAY_NAME: Patient Picker
    PICKER_CLIENT_ID: patient_picker_client_id
    PICKER_CLIENT_SECRET: patient_picker_client_secret

    #DynamoDB Settings
    CACHE_TABLE_NAME: 'refreshTokenCache'
    CACHE_TTL_MINS: 1440
#Provide additional access to allow read/write to our refresh token cache 
  iamRoleStatements:
    - Effect: Allow
      Action:
        - dynamodb:GetItem
        - dynamodb:PutItem
      Resource: 
        Fn::GetAtt:
          - refreshTokenCache
          - Arn

#Lambda functions
functions:

##METADATA ENDPOINTS
  smart-config-endpoint:
    handler: ${self:provider.name}/metadata_endpoints.smartConfigHandler
    events:
      - http:
          path: /smart-configuration
          method: GET
          cors: true
      - http:
          path: /.well-known/smart-configuration
          method: GET
          cors: true
          
  metadata-endpoint:          
    handler: ${self:provider.name}/metadata_endpoints.metadataHandler
    events:
      - http:
          path: /metadata
          method: GET
          cors: true
     
  keys_endpoint:
    handler: ${self:provider.name}/keys.keysHandler
    events:
      - http:
          path: /keys
          method: GET
          cors: true
          
##AUTHORIZE ENDPOINTS
  smart-authorize-proxy:
    handler: ${self:provider.name}/authorize.authorizeHandler
    events:
      - http:
          path: /authorize
          method: GET

  picker-oidc-callback:
    handler: ${self:provider.name}/authorize.pickerCallbackHandler
    events:
      - http:
          path: /picker_oidc_callback
          method: GET
      
  smart-proxy-callback:
    handler: ${self:provider.name}/authorize.authorizeCallbackHandler
    events:
      - http:
          path: /smart_proxy_callback
          method: GET

##TOKEN ENDPOINT
  smart-token-proxy:
    handler: ${self:provider.name}/token.tokenHandler
    events:
      - http:
          path: /token
          method: POST
          cors: true
          
##PATIENT PICKER UI          
  patient_picker_get:
    handler: ${self:provider.name}/patient_picker.patientPickerGetHandler
    events:
      - http:
          path: /patient_authorization
          method: GET
  
  patient_picker_post:
    handler: ${self:provider.name}/patient_picker.patientPickerPostHandler          
    events:
      - http:
          path: /patient_authorization
          method: POST

##TOKEN HOOK  
  token_hook:
    handler: ${self:provider.name}/token_hook.tokenHookHandler
    events:
      - http:
          path: /tokenhook
          method: POST
 
 ##MOCK PATIENT API 
  mock_patient_service:
    handler: ${self:provider.name}/mock_patient_service.mockPatientServiceHandler
    events:
      - http:
          path: /patientMockService
          method: GET
          
#############          
#HAPI Proxies
#############
      - http:
          path: /{proxy+}
          method: ANY
          cors: true
          integration: http-proxy
          request:
            uri: http://hapi.fhir.org/baseR4/{proxy}
            parameters:
              paths:
                proxy: true      
#################
#END HAPI Proxies                
#################

# Other resources
resources:
  Resources:
    refreshTokenCache:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName:  ${self:provider.environment.CACHE_TABLE_NAME}
        AttributeDefinitions:
          - AttributeName: token_id
            AttributeType: S
        KeySchema:
          - AttributeName: token_id
            KeyType: HASH
        ProvisionedThroughput:
          ReadCapacityUnits: 1
          WriteCapacityUnits: 1
        TimeToLiveSpecification:
          AttributeName: expires
          Enabled: true