Adam Moussa b1369bf162 Gateway token authorizer + finish CI/CD migration (INFRA-99, INFRA-2) (#32) ... * feat: add gateway token authorizer to door-unlock API (INFRA-99) All three routes (GET /unlock, /lockdown, /lockdown/status) were AuthorizationType NONE — auth relied solely on each handler checking the ?token= query param. Add a REQUEST-type HTTP API Lambda authorizer (door-unlock-api-authorizer) that validates the SAME ?token= value the Yealink XML Browser keys already send, against the existing /seahaven/door-unlock/auth-token SSM SecureString, and attach it to all three routes. Transparent to the phones: identity source is $request.querystring.token (exactly what the type-17 XML Browser keys send via GET), simple response {isAuthorized}, fail-closed, 5-min results cache. Token is cached in module scope so warm invocations skip SSM. GET is kept (not switched to POST): the Yealink type-17 XML Browser keys are GET-only and render the returned Yealink XML — they cannot issue a POST body or custom headers. POST is therefore deferred to avoid bricking the door keys. Handlers retain their own token check as defense-in-depth. Purely additive change set; no existing Lambda or integration is modified. * chore: complete CI/CD migration to GitHub Actions (INFRA-2) GitHub Actions (ci.yaml + deploy.yaml via the Sea Haven reusable workflows) is the proven deploy path. Remove the now-orphaned buildspec.yml and update the README CI/CD and architecture sections. The legacy CodePipeline was already deleted (2026-06-05); the leftover CodeBuild project seahaven-door-unlock-api-build and its IAM role seahaven-door-unlock-api-codebuild have now also been decommissioned.		2026-06-08 18:03:30 -04:00
..
authorizer-handler.ts	Gateway token authorizer + finish CI/CD migration (INFRA-99, INFRA-2) (#32)	2026-06-08 18:03:30 -04:00