serverless.yml

service: calendly-backend
frameworkVersion: '2'

plugins:
  - serverless-appsync-plugin
  - serverless-iam-roles-per-function
  - serverless-export-env
  - serverless-plugin-include-dependencies
  - serverless-plugin-common-excludes
  - serverless-stack-output
  - serverless-lumigo

provider:
  name: aws
  runtime: nodejs12.x
  stage: ${opt:stage, 'dev'}
  region: ${opt:region, 'us-east-1'}
  lambdaHashingVersion: '20201221'
  environment:
    STAGE: ${opt:stage}
    AWS_NODEJS_CONNECTION_REUSE_ENABLED: "1"
    USERS_TABLE: !Ref UsersTable
    PINPOINT_APP: ${self:custom.pinpointAppId}
    NEW_SESSION_TEMPLATE: ${self:custom.pinpointNewSessionTemplate}

custom:
  bucket-name: ${file(./config.${opt:stage, 'dev'}.json):BUCKET_NAME} # S3 Bucket Name
  region: ${opt:region, self:provider.region}
  appSync:
    - ${file(serverless.appsync-api.yml)}
  includeDependencies:
    enableCaching: true
  pinpointAppId: !Ref PinpointApplication  
  pinpointNewSessionTemplate: !Ref NewSessionBookedPinpointTemplate
  FromEmailAddress: ${file(./config.${opt:stage, 'dev'}.json):FromEmailAddress}
  output:
    file: output-stack.yml
  lumigo:
    token: ${file(./config.${opt:stage, 'dev'}.json):LUMIGO_TOKEN}
    nodePackageManager: npm

package:
  exclude:
    - node_modules/**/aws-sdk/**
    - email-templates/**
    - __tests__/**
    - mapping-templates/**
    - '*.json'
    - '*.yml'
    - '*.graphql'
    - assets/**
    - output-stack.yml

  excludeDevDependencies: false
  individually: true

functions:
  getUserInfo:
    handler: functions/api/get-user-info.handler
    events:
      - http:
          path: user-info
          method: get
          cors: true
    environment:
      USER_LINK_TABLE: !Ref UserLinkTable
      USER_TABLE: !Ref UsersTable
    iamRoleStatements:
      - Effect: Allow
        Action: dynamodb:GetItem
        Resource: !GetAtt UserLinkTable.Arn
      - Effect: Allow
        Action: dynamodb:GetItem
        Resource: !GetAtt UsersTable.Arn

  getUserSchedule:
    handler: functions/api/get-user-schedule.handler
    events:
      - http:
          path: user-schedule
          method: get
          cors: true
    environment:
      USER_SESSION_TABLE: !Ref UserSessionTable      
    iamRoleStatements:
      - Effect: Allow
        Action: 
          - dynamodb:GetItem
          - dynamodb:Query
        Resource: !GetAtt UserSessionTable.Arn      

  createSession:
    handler: functions/api/create-session.handler
    events:
      - http:
          path: user-session
          method: post
          cors: true
    environment:
      USER_SESSION_TABLE: !Ref UserSessionTable
    iamRoleStatements:
      - Effect: Allow
        Action: dynamodb:PutItem
        Resource: !GetAtt UserSessionTable.Arn
      - Effect: Allow
        Action: dynamodb:GetItem
        Resource: !GetAtt UsersTable.Arn
      - Effect: Allow
        Action:
          - mobiletargeting:SendMessages
        Resource: '*'
          
  confirmUserSignup:
    handler: functions/cognito/confirm-user-signup.handler
    environment:
      USERS_TABLE: !Ref UsersTable      
    iamRoleStatements:
      - Effect: Allow
        Action: dynamodb:PutItem
        Resource: !GetAtt UsersTable.Arn
      - Effect: Allow
        Action: cognito-idp:AdminAddUserToGroup
        Resource: '*'
  
  userSessionStreamEvent:
    handler: functions/stream/user-session-event.handler
    events:
      - stream:
          type: dynamodb
          arn:
            Fn::GetAtt:
              - UserSessionTable
              - StreamArn 
    iamRoleStatements:
      - Effect: Allow
        Action:
          - dynamodb:Scan
          - dynamodb:Query
          - dynamodb:GetItem
          - dynamodb:DeleteItem
        Resource:
          - Fn::GetAtt:
              - UserSessionTable
              - Arn 
resources:
  Resources:
    UsersTable:
      Type: AWS::DynamoDB::Table
      Properties:
        BillingMode: PAY_PER_REQUEST
        KeySchema:
          - AttributeName: id
            KeyType: HASH
        AttributeDefinitions:
          - AttributeName: id
            AttributeType: S

    UserLinkTable:
      Type: AWS::DynamoDB::Table
      Properties:
        BillingMode: PAY_PER_REQUEST
        KeySchema:
          - AttributeName: link
            KeyType: HASH          
        AttributeDefinitions:
          - AttributeName: link
            AttributeType: S          

    UserEventTable:
      Type: AWS::DynamoDB::Table
      Properties:
        BillingMode: PAY_PER_REQUEST
        KeySchema:
          - AttributeName: id
            KeyType: HASH
          - AttributeName: shortName
            KeyType: RANGE
        AttributeDefinitions:
          - AttributeName: id
            AttributeType: S
          - AttributeName: shortName
            AttributeType: S

    UserSessionTable:
      Type: AWS::DynamoDB::Table
      Properties:
        BillingMode: PAY_PER_REQUEST
        KeySchema:
          - AttributeName: id
            KeyType: HASH
          - AttributeName: sessionTime
            KeyType: RANGE
        AttributeDefinitions:
          - AttributeName: id
            AttributeType: S
          - AttributeName: sessionTime
            AttributeType: S
        StreamSpecification:
          StreamViewType: NEW_AND_OLD_IMAGES

    #****** Cognito Configuration ******#
    CognitoUserPool:
      Type: AWS::Cognito::UserPool
      Properties:
        AutoVerifiedAttributes:
          - email
        VerificationMessageTemplate:
          DefaultEmailOption: CONFIRM_WITH_LINK
        Policies:
          PasswordPolicy:
            MinimumLength: 8
            RequireLowercase: true
            RequireNumbers: true
            RequireUppercase: true
            RequireSymbols: false
        UsernameAttributes:
          - email
        Schema:
          - AttributeDataType: String
            Name: name
            Required: false
            Mutable: true          

        LambdaConfig:
          PostConfirmation: !GetAtt ConfirmUserSignupLambdaFunction.Arn

    CognitoUserGroupNormalUsers: 
      Type: AWS::Cognito::UserPoolGroup
      Properties:
        GroupName: User
        Description: Calendly Normal Users
        Precedence: 1
        UserPoolId:
          Ref: CognitoUserPool

    UserPoolInvokeConfirmUserSignupLambdaPermission:
      Type: AWS::Lambda::Permission
      Properties:
        Action: lambda:invokeFunction
        FunctionName: !Ref ConfirmUserSignupLambdaFunction
        Principal: cognito-idp.amazonaws.com
        SourceArn: !GetAtt CognitoUserPool.Arn

    WebUserPoolClient:
      Type: AWS::Cognito::UserPoolClient
      Properties:
        UserPoolId: !Ref CognitoUserPool
        ClientName: web
        ExplicitAuthFlows:
          - ALLOW_USER_SRP_AUTH
          - ALLOW_USER_PASSWORD_AUTH
          - ALLOW_REFRESH_TOKEN_AUTH
        PreventUserExistenceErrors: LEGACY
        AllowedOAuthFlowsUserPoolClient: true
        SupportedIdentityProviders:
          - COGNITO
        CallbackURLs:
          - !Join ["", ["https://", !GetAtt CloudFrontDistro.DomainName, ""]]          
        LogoutURLs:
          - !Join ["",["https://",!GetAtt CloudFrontDistro.DomainName, ""]]
        AllowedOAuthFlows:
          - implicit
        AllowedOAuthScopes:
          - email
          - openid
          - profile        

    CalendlyCognitoDomain:
      Type: AWS::Cognito::UserPoolDomain
      Properties: 
        Domain: 'calendly-app-${self:provider.stage}'
        UserPoolId: !Ref CognitoUserPool

    #****** Pinpoint Configuration ******#
    PinpointApplication:
      Type: AWS::Pinpoint::App
      Properties:
        Name: 'calendly-app-${self:provider.stage}'

    PinpointEmailChannelFeature:
      Type: AWS::Pinpoint::EmailChannel
      Properties: 
        ApplicationId: !Ref PinpointApplication
        Enabled: True
        FromAddress: ${self:custom.FromEmailAddress}
        Identity: !Sub 'arn:aws:ses:${AWS::Region}:${AWS::AccountId}:identity/${self:custom.FromEmailAddress}'

    NewSessionBookedPinpointTemplate:
      Type: AWS::Pinpoint::EmailTemplate
      Properties:
        TemplateName: 'calendly-app-${self:provider.stage}-new-session-booked'
        Subject: 'Calendly Clone App - New Session Alert!! {{Duration}} booked by {{Name}}'
        HtmlPart: '<html> <head> <style> body{ text-align: center; } body table{ margin: 0 auto; } </style> </head> <body > <h1>New Session Booked!</h1> <table border="1" cellpadding="10"> <tr> <td>Name</td> <td>{{Name}}</td> </tr> <tr> <td>Email</td> <td>{{Email}}</td> </tr> <tr> <td>Scheduled On</td> <td>{{ScheduledOn}} for {{Duration}}</td> </tr> </table> <br><br> Note: You will receive an email reminder 10 minutes prior to your session. </body> </html>'
        # Use https://tools.knowledgewalls.com/online-multiline-to-single-line-converter
        # To convert HTML into single line and paste in the HtmlPart

    # Website Hosting S3 Bucket
    S3SiteBucket: # Host website content in this bucket
      Type: AWS::S3::Bucket
      Properties:
        BucketName: ${self:custom.bucket-name}
        WebsiteConfiguration:          
          IndexDocument: index.html
        CorsConfiguration:
          CorsRules:
            - AllowedHeaders:
                - '*'
              AllowedMethods:
                - GET
              AllowedOrigins:
                - '*'
              ExposedHeaders:
                - Date
              Id: myCORSRuleId1
              MaxAge: 3600        

    OriginAccessIdentity:
      Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
      Properties:
        CloudFrontOriginAccessIdentityConfig:
          Comment: !Sub 'OriginAccessIdentity for ${S3SiteBucket}'

    BucketPolicy: # Allow site access from CloudFront only
      DependsOn: OriginAccessIdentity
      Type: AWS::S3::BucketPolicy
      Properties:
        PolicyDocument:
          Id: OriginBucketPolicy
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                CanonicalUser: !GetAtt OriginAccessIdentity.S3CanonicalUserId
              Action: 's3:GetObject'
              Resource: !Sub 'arn:aws:s3:::${S3SiteBucket}/*'
        Bucket: !Ref S3SiteBucket
    
    CloudFrontDistro: # To serve the website via CDN
      Type: AWS::CloudFront::Distribution
      Properties:
        DistributionConfig:
          Origins:
          - DomainName: ${self:custom.bucket-name}.s3.amazonaws.com
            Id: myS3Origin
            S3OriginConfig:
              OriginAccessIdentity: !Sub 'origin-access-identity/cloudfront/${OriginAccessIdentity}'
          Enabled: 'true'
          Comment: 'Calendly Clone App Distro'
          DefaultRootObject: index.html          
          DefaultCacheBehavior:            
            AllowedMethods:
              - GET
              - HEAD
              - DELETE
              - OPTIONS
              - PATCH
              - POST
              - PUT
            CachedMethods:
              - GET
              - HEAD
              - OPTIONS
            Compress: true
            DefaultTTL: 300
            ForwardedValues:
              Headers:
                - Accept
                - Referer
                - Authorization
                - Content-Type
              QueryString: true
            MaxTTL: 300
            TargetOriginId: myS3Origin
            ViewerProtocolPolicy: https-only          
          PriceClass: 'PriceClass_100'          
          ViewerCertificate:
              CloudFrontDefaultCertificate: true

    AppSyncLoggingServiceRole:
      Type: "AWS::IAM::Role"
      Properties:
        RoleName: "calendly-appsync-logs-${self:provider.region}-${self:provider.stage}-role"
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: "Allow"
              Principal:
                Service:
                  - "appsync.amazonaws.com"
              Action:
                - "sts:AssumeRole"
        Policies:
          - PolicyName: "calendly-appsync-logs-${self:provider.region}-${self:provider.stage}-policy"
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: "Allow"
                  Action: ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"]
                  Resource: "*"

  Outputs:
    CognitoUserPoolId:
      Value: !Ref CognitoUserPool

    WebUserPoolClientId:
      Value: !Ref WebUserPoolClient

    CloudfrontDomainName:
      Value: !GetAtt CloudFrontDistro.DomainName