Adam Moussa 75fb3280f5 Add gateway-level authorizer to admin API (INFRA-100) (#24) ... The /api/admin/* routes (GET/PUT/DELETE /api/admin/orders and GET /api/admin/summary-pdf) were AuthorizationType NONE, relying entirely on the in-handler _verify_admin Google-token + admin-email check. This adds an HTTP API Lambda authorizer that enforces the same check at the gateway, so unauthenticated requests are rejected before reaching the integration. - New admin_authorizer Lambda: validates the Authorization: Bearer Google ID token (aud + allowed Workspace domain) and the admin_emails allow-list from DynamoDB, returning the HTTP API simple response {isAuthorized}. Fails closed on missing config, unavailable client ID, bad token, or DynamoDB error. - OrderApi gains an AdminGoogleAuthorizer with result caching disabled (AuthorizerResultTtlInSeconds: 0) so expired tokens / removed admins can't be served from cache. Wired onto all four admin events; no DefaultAuthorizer, so public routes (submit-order, form-status, roster) stay NONE. - IAM role for API Gateway to invoke the authorizer; 60-day log group. - 10 unit tests for the authorizer. No client change: the admin panel already sends Authorization: Bearer <google_id_token>. The in-handler _verify_admin check stays as defense-in-depth. Cross-reviewed by GPT-4.1 (APPROVE-WITH-FIXES); both BLOCK items applied (disable authorizer caching, fail-closed on DynamoDB error).		2026-06-08 18:05:09 -04:00
..
handler.py	Add gateway-level authorizer to admin API (INFRA-100) (#24)	2026-06-08 18:05:09 -04:00
requirements.txt	Add gateway-level authorizer to admin API (INFRA-100) (#24)	2026-06-08 18:05:09 -04:00