@st-graphics/premium

st-graphics-premium

Logic Flow

1. Fetch JSON on page load
   • client/premium.js > .fetchContent()
   • Pass in un-prefixed JSON ID into query string as resourceKey
   • 
2. Hit getPremiumContentUrl lambda

• SESSIONID not present in cookie
• 403
• Fallback to client/premium.js > .fetchPublicContent()
• Fetch public JSON directly from S3

1. Render login widget

2. Client initialize login flow

• Refer to: client/premium.js > .getAuthorizationUrl()
• returns url which will go into the href of login <a>
• redirect_uri in query string set to /create-session lambda endpoint
• window.location passed into state in query string
• eg. https://ds-acc-auth.sphdigital.com/amserver/oauth2/authorize?response_type=code&client_id=st_graphics&state=eyJyZWRpcmVjdF91cmwiOiJodHRwOi8vc3QtdmlzdWFscy5jb20vaW5mb2dyYXBoaWNzL2hkYi1sZWFzZS0yMDE4L2luZGV4Lmh0bWwifQ%3D%3D&redirect_uri=https%3A%2F%2Fepc9c723qd.execute-api.ap-southeast-1.amazonaws.com%2Fproduction%2Fcreate-session&scope=uid%20aologinid%20aovisitorid%20aonickname%20aoregservice

1. After login is handled by LDAP, redirect to /create-session lambda endpoint

• Expects to receive OAuth2 authorization code and state

1. New session creation

• Refer to: functions/createSession/index.js
• Exchange token - functions/createSession/authenticate.js > exchangeToken
• Fetch user info - functions/createSession/authenticate.js > fetchUserInfo
• Verify user is subscriber - functions/createSession/authenticate.js > verifyUser
• Store session in DynamoDB - functions/createSession/Session.js
• Obtain auth request origin (eg. https://graphics.straitstimes.com/interactives/2018/12/awesome-story) from state
• Redirect to request origin
• Return SESSIONID in cookie
• Any error (server, authentication etc) will be handled in a catch block and lambda exit by redirecting back to request origin. Therefore client will not see any error but login widget will continue to show. Go to Cloudwatch Log to check error

1. Redirect back. Set-cookie SESSIONID

2. Fetch JSON again on redirect back

• Refer to: client/premium.js > .fetchContent()
• Hit getPremiumContentUrl lambda
• SESSIONID present in cookie

1. Check session exist

• Refer to: functions/getPremiumContentUrl/index.js & functions/getPremiumContentUrl/authenticate.js
• Retrieve session from DynamoDB
• Renew credentials if necessary - functions/getPremiumContentUrl/authenticate.js > renewCredential
• Fetch user info - functions/getPremiumContentUrl/authenticate.js > fetchUserInfo
• Verify user is subscriber - functions/getPremiumContentUrl/authenticate.js > verifyUser
• Update session record in DynamoDB - functions/getPremiumContentUrl/Session.js

1. Prepare signed URL to fetch premium JSON

• Obtain signed URL to premium JSON from S3
• 200