fix(apigatewayv2): defaultAuthorizer cannot be applied to HttpRoute

packages/@aws-cdk/aws-apigatewayv2-alpha/lib/http/api.ts

@@ -22,6 +22,20 @@ export interface IHttpApi extends IApi {
    */
   readonly httpApiId: string;
 
+  /**
+   * Default Authorizer to applied to all routes in the gateway
+   * @attribute
+   * @default - No authorizer
+   */
+  readonly defaultAuthorizer?: IHttpRouteAuthorizer;
+
+  /**
+   * Default OIDC scopes attached to all routes in the gateway, unless explicitly configured on the route.
+   * @attribute
+   * @default - no default authorization scopes
+   */
+  readonly defaultAuthorizationScopes?: string[];
+
   /**
    * Metric for the number of client-side errors captured in a given period.
    *
@@ -340,8 +354,8 @@ export class HttpApi extends HttpApiBase {
 
   private readonly _apiEndpoint: string;
 
-  private readonly defaultAuthorizer?: IHttpRouteAuthorizer;
-  private readonly defaultAuthorizationScopes?: string[];
+  public readonly defaultAuthorizer?: IHttpRouteAuthorizer;
+  public readonly defaultAuthorizationScopes?: string[];
 
   constructor(scope: Construct, id: string, props?: HttpApiProps) {
     super(scope, id);

packages/@aws-cdk/aws-apigatewayv2-alpha/lib/http/route.ts

@@ -193,7 +193,8 @@ export class HttpRoute extends Resource implements IHttpRoute {
       scope: this,
     });
 
-    this.authBindResult = props.authorizer?.bind({
+    const authorizer = props.authorizer ?? this.httpApi.defaultAuthorizer;
+    this.authBindResult = authorizer?.bind({
       route: this,
       scope: this.httpApi instanceof Construct ? this.httpApi : this, // scope under the API if it's not imported
     });
@@ -204,10 +205,10 @@ export class HttpRoute extends Resource implements IHttpRoute {
 
     let authorizationScopes = this.authBindResult?.authorizationScopes;
 
-    if (this.authBindResult && props.authorizationScopes) {
+    if (this.authBindResult && (props.authorizationScopes || this.httpApi.defaultAuthorizationScopes)) {
       authorizationScopes = Array.from(new Set([
         ...authorizationScopes ?? [],
-        ...props.authorizationScopes,
+        ...props.authorizationScopes ?? this.httpApi.defaultAuthorizationScopes ?? [],
       ]));
     }
 

packages/@aws-cdk/aws-apigatewayv2-alpha/test/http/route.test.ts

@@ -329,6 +329,96 @@ describe('HttpRoute', () => {
     });
   });
 
+  test('can create route without an authorizer when api has defaultAuthorizer', () => {
+    const stack = new Stack();
+
+    const authorizer = new DummyAuthorizer();
+    const httpApi = new HttpApi(stack, 'HttpApi', {
+      defaultAuthorizer: authorizer,
+      defaultAuthorizationScopes: ['read:books'],
+    });
+
+    const route = new HttpRoute(stack, 'HttpRoute', {
+      httpApi,
+      integration: new DummyIntegration(),
+      routeKey: HttpRouteKey.with('/books', HttpMethod.GET),
+    });
+
+    Template.fromStack(stack).hasResourceProperties('AWS::ApiGatewayV2::Integration', {
+      ApiId: stack.resolve(httpApi.apiId),
+      IntegrationType: 'HTTP_PROXY',
+      PayloadFormatVersion: '2.0',
+      IntegrationUri: 'some-uri',
+    });
+
+    Template.fromStack(stack).resourceCountIs('AWS::ApiGatewayV2::Authorizer', 1);
+    Template.fromStack(stack).hasResourceProperties('AWS::ApiGatewayV2::Route', {
+      AuthorizerId: stack.resolve(authorizer.bind({ scope: stack, route: route }).authorizerId),
+      AuthorizationType: 'JWT',
+      AuthorizationScopes: ['read:books'],
+    });
+  });
+
+  test('authorizationScopes can be applied to route without authorizer when api has defaultAuthorizer', () => {
+    const stack = new Stack();
+
+    const authorizer = new DummyAuthorizer();
+    const httpApi = new HttpApi(stack, 'HttpApi', {
+      defaultAuthorizer: authorizer,
+    });
+
+    const route = new HttpRoute(stack, 'HttpRoute', {
+      httpApi,
+      integration: new DummyIntegration(),
+      routeKey: HttpRouteKey.with('/books', HttpMethod.GET),
+      authorizationScopes: ['read:books'],
+    });
+
+    Template.fromStack(stack).hasResourceProperties('AWS::ApiGatewayV2::Integration', {
+      ApiId: stack.resolve(httpApi.apiId),
+      IntegrationType: 'HTTP_PROXY',
+      PayloadFormatVersion: '2.0',
+      IntegrationUri: 'some-uri',
+    });
+
+    Template.fromStack(stack).resourceCountIs('AWS::ApiGatewayV2::Authorizer', 1);
+    Template.fromStack(stack).hasResourceProperties('AWS::ApiGatewayV2::Route', {
+      AuthorizerId: stack.resolve(authorizer.bind({ scope: stack, route: route }).authorizerId),
+      AuthorizationType: 'JWT',
+      AuthorizationScopes: ['read:books'],
+    });
+  });
+
+  test('defaultAuthorizationScopes can be applied to route', () => {
+    const stack = new Stack();
+
+    const authorizer = new DummyAuthorizer();
+    const httpApi = new HttpApi(stack, 'HttpApi', {
+      defaultAuthorizationScopes: ['read:books'],
+    });
+
+    const route = new HttpRoute(stack, 'HttpRoute', {
+      httpApi,
+      integration: new DummyIntegration(),
+      routeKey: HttpRouteKey.with('/books', HttpMethod.GET),
+      authorizer,
+    });
+
+    Template.fromStack(stack).hasResourceProperties('AWS::ApiGatewayV2::Integration', {
+      ApiId: stack.resolve(httpApi.apiId),
+      IntegrationType: 'HTTP_PROXY',
+      PayloadFormatVersion: '2.0',
+      IntegrationUri: 'some-uri',
+    });
+
+    Template.fromStack(stack).resourceCountIs('AWS::ApiGatewayV2::Authorizer', 1);
+    Template.fromStack(stack).hasResourceProperties('AWS::ApiGatewayV2::Route', {
+      AuthorizerId: stack.resolve(authorizer.bind({ scope: stack, route: route }).authorizerId),
+      AuthorizationType: 'JWT',
+      AuthorizationScopes: ['read:books'],
+    });
+  });
+
   test('can attach additional scopes to a route with an authorizer attached', () => {
     const stack = new Stack();
     const httpApi = new HttpApi(stack, 'HttpApi');

packages/@aws-cdk/aws-apigatewayv2-authorizers-alpha/test/http/integ.user-pool.ts

@@ -1,5 +1,5 @@
 import * as path from 'path';
-import { HttpApi, HttpMethod } from '@aws-cdk/aws-apigatewayv2-alpha';
+import { HttpApi, HttpMethod, HttpRoute, HttpRouteKey } from '@aws-cdk/aws-apigatewayv2-alpha';
 import { HttpLambdaIntegration } from '@aws-cdk/aws-apigatewayv2-integrations-alpha';
 import * as cognito from 'aws-cdk-lib/aws-cognito';
 import * as lambda from 'aws-cdk-lib/aws-lambda';
@@ -16,11 +16,17 @@ import { HttpUserPoolAuthorizer } from '../../lib';
 const app = new App();
 const stack = new Stack(app, 'AuthorizerInteg');
 
-const httpApi = new HttpApi(stack, 'MyHttpApi');
-
 const userPool = new cognito.UserPool(stack, 'userpool');
+const userPoolForDefaultAuthorizer = new cognito.UserPool(stack, 'userpoolForDefaultAuthorizer');
 
 const authorizer = new HttpUserPoolAuthorizer('UserPoolAuthorizer', userPool);
+const authorizerWithDefaultAuthorizer = new HttpUserPoolAuthorizer('UserPoolAuthorizerWithDefaultAuthorizer', userPoolForDefaultAuthorizer);
+
+const httpApi = new HttpApi(stack, 'MyHttpApi');
+const httpApiWithDefaultAuthorizer = new HttpApi(stack, 'MyHttpApiWithDefaultAuthorizer', {
+  defaultAuthorizer: authorizerWithDefaultAuthorizer,
+  defaultAuthorizationScopes: ['scope1', 'scope2'],
+});
 
 const handler = new lambda.Function(stack, 'lambda', {
   runtime: lambda.Runtime.NODEJS_18_X,
@@ -34,3 +40,9 @@ httpApi.addRoutes({
   integration: new HttpLambdaIntegration('RootIntegratin', handler),
   authorizer,
 });
+
+new HttpRoute(stack, 'Route', {
+  httpApi: httpApiWithDefaultAuthorizer,
+  routeKey: HttpRouteKey.with('/v1/mything/{proxy+}', HttpMethod.ANY),
+  integration: new HttpLambdaIntegration('RootIntegration', handler),
+});