template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Scanner - Lambda Durable Function triggered by S3 via EventBridge

Parameters:
  AdminEmail:
    Type: String
    Description: Email address for the initial admin user
    AllowedPattern: ^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$
    ConstraintDescription: Must be a valid email address

Globals:
  Function:
    Runtime: nodejs24.x
    Architectures:
      - arm64
    Timeout: 900
    MemorySize: 512
    Tracing: Active
  Api:
    Cors:
      AllowMethods: "'GET,POST,PUT,DELETE,OPTIONS'"
      AllowHeaders: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'"
      AllowOrigin: "'*'"
      MaxAge: "'600'"

Resources:
  # ============================================
  # NESTED STACKS
  # ============================================
  AuthStack:
    Type: AWS::Serverless::Application
    Properties:
      Location: stacks/auth.yaml
      Parameters:
        AdminEmail: !Ref AdminEmail
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete

  StorageStack:
    Type: AWS::Serverless::Application
    Properties:
      Location: stacks/storage.yaml
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete

  ServicesStack:
    Type: AWS::Serverless::Application
    Properties:
      Location: stacks/services.yaml
      Parameters:
        BucketArn: !GetAtt StorageStack.Outputs.BucketArn
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete

  SocketsStack:
    Type: AWS::Serverless::Application
    Properties:
      Location: stacks/sockets.yaml
      Parameters:
        UserPoolId: !GetAtt AuthStack.Outputs.UserPoolId
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete

  # ============================================
  # API GATEWAY
  # ============================================
  ScannerApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: prod
      Cors:
        AllowMethods: "'GET,POST,PUT,DELETE,OPTIONS'"
        AllowHeaders: "'Content-Type,Authorization'"
        AllowOrigin: "'*'"
      Auth:
        DefaultAuthorizer: CognitoAuthorizer
        AddDefaultAuthorizerToCorsPreflight: false
        Authorizers:
          CognitoAuthorizer:
            UserPoolArn: !GetAtt AuthStack.Outputs.UserPoolArn

  # ============================================
  # LAMBDA FUNCTIONS
  # ============================================
  
  # Durable function that orchestrates video scanning workflow:
  # - Triggered by S3 uploads to raw/ prefix
  # - Runs Transcribe for audio transcription
  # - Runs Rekognition for text detection in video
  # - Analyzes content with Comprehend (toxicity, sentiment, PII)
  # - Waits for human approval/rejection
  # - Generates AI summary with Bedrock
  # - Publishes real-time updates via AppSync
  ScannerFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/scanner/
      Handler: index.handler
      Description: Scanner durable function triggered by S3 events
      AutoPublishAlias: live
      LoggingConfig:
        LogFormat: JSON
        ApplicationLogLevel: INFO
      Environment:
        Variables:
          POWERTOOLS_SERVICE_NAME: scanner
          POWERTOOLS_LOG_LEVEL: INFO
          SCANNER_TABLE: !GetAtt StorageStack.Outputs.TableName
          REKOGNITION_ROLE_ARN: !GetAtt ServicesStack.Outputs.RekognitionServiceRoleArn
          REKOGNITION_SNS_TOPIC_ARN: !GetAtt ServicesStack.Outputs.RekognitionNotificationTopicArn
          BEDROCK_MODEL_ID: global.amazon.nova-2-lite-v1:0
          APPSYNC_EVENTS_API_URL: !Sub 'https://${SocketsStack.Outputs.AppSyncHttpEndpoint}/event'
      DurableConfig:
        ExecutionTimeout: 604800
        RetentionPeriodInDays: 30
      Policies:
        - S3ReadPolicy:
            BucketName: !GetAtt StorageStack.Outputs.BucketName
        - S3WritePolicy:
            BucketName: !GetAtt StorageStack.Outputs.BucketName
        - DynamoDBCrudPolicy:
            TableName: !GetAtt StorageStack.Outputs.TableName
        - Statement:
            # Transcribe - Scoped to transcription jobs in this account/region
            - Effect: Allow
              Action:
                - transcribe:StartTranscriptionJob
                - transcribe:GetTranscriptionJob
                - transcribe:TagResource
              Resource: !Sub 'arn:aws:transcribe:${AWS::Region}:${AWS::AccountId}:transcription-job/*'
            # Comprehend - Resource-level permissions not supported by AWS
            # Must use '*' as per AWS service limitations
            - Effect: Allow
              Action:
                - comprehend:DetectToxicContent
                - comprehend:DetectSentiment
                - comprehend:DetectPiiEntities
              Resource: '*'
            # Rekognition - Resource-level permissions not supported by AWS
            # Must use '*' as per AWS service limitations
            - Effect: Allow
              Action:
                - rekognition:StartTextDetection
                - rekognition:GetTextDetection
              Resource: '*'
            # IAM PassRole - Scoped to specific Rekognition service role
            - Effect: Allow
              Action:
                - iam:PassRole
              Resource: !GetAtt ServicesStack.Outputs.RekognitionServiceRoleArn
            # Bedrock - Scoped to specific Nova model
            # Need both inference profile and foundation model ARNs
            # SDK may resolve inference profile to foundation model
            - Effect: Allow
              Action:
                - bedrock:InvokeModel
              Resource:
                - arn:aws:bedrock:::foundation-model/amazon.nova-2-lite-v1:0
                - arn:aws:bedrock:::inference-profile/global.amazon.nova-2-lite-v1:0
                - arn:aws:bedrock:us-west-2:088483494489:inference-profile/global.amazon.nova-2-lite-v1:0
                - arn:aws:bedrock:us-west-2::foundation-model/amazon.nova-2-lite-v1:0
                # - !Sub 'arn:aws:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/global.amazon.nova-2-lite-v1:0'
                # - !Sub 'arn:aws:bedrock:${AWS::Region}::foundation-model/amazon.nova-2-lite-v1:0'
            # AppSync - Scoped to specific API
            - Effect: Allow
              Action:
                - appsync:EventPublish
              Resource: !Sub 'arn:aws:appsync:${AWS::Region}:${AWS::AccountId}:apis/${SocketsStack.Outputs.AppSyncApiId}/*'
      Events:
        S3ObjectCreated:
          Type: EventBridgeRule
          Properties:
            Pattern:
              source:
                - aws.s3
              detail-type:
                - Object Created
              detail:
                bucket:
                  name:
                    - !GetAtt StorageStack.Outputs.BucketName
                object:
                  key:
                    - prefix: raw/
    Metadata:
      BuildMethod: esbuild
      BuildProperties:
        Minify: false
        Target: es2022
        Sourcemap: true
        EntryPoints:
          - index.ts

  # Unified callback handler that receives completion events and sends them to durable executions:
  # - Transcribe job completions (via EventBridge)
  # - Rekognition job completions (via SNS)
  # - Human approval/rejection decisions (via API Gateway)
  # - Looks up callback tokens in DynamoDB and notifies the waiting durable function
  CallbackFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/callback/
      Handler: index.handler
      Description: Unified callback handler for Transcribe, Rekognition, and Approval events
      Environment:
        Variables:
          POWERTOOLS_SERVICE_NAME: callback
          POWERTOOLS_LOG_LEVEL: INFO
          SCANNER_TABLE: !GetAtt StorageStack.Outputs.TableName
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !GetAtt StorageStack.Outputs.TableName
        - Statement:
            - Effect: Allow
              Action:
                - lambda:SendDurableExecutionCallbackSuccess
                - lambda:SendDurableExecutionCallbackFailure
              Resource: 
                - !GetAtt ScannerFunction.Arn
                - !Sub '${ScannerFunction.Arn}:*'
      Events:
        ApprovalApi:
          Type: Api
          Properties:
            Path: /approval
            Method: POST
            RestApiId: !Ref ScannerApi
        TranscribeComplete:
          Type: EventBridgeRule
          Properties:
            Pattern:
              source:
                - aws.transcribe
              detail-type:
                - Transcribe Job State Change
              detail:
                TranscriptionJobStatus:
                  - COMPLETED
                  - FAILED
        RekognitionSNS:
          Type: SNS
          Properties:
            Topic: !GetAtt ServicesStack.Outputs.RekognitionNotificationTopicArn
    Metadata:
      BuildMethod: esbuild
      BuildProperties:
        Minify: false
        Target: es2022
        Sourcemap: true
        EntryPoints:
          - index.ts

  # API handler for all scan-related operations:
  # - GET /scans - List user's scans
  # - GET /scans/{scanId} - Get single scan details
  # - POST /scans/upload - Generate presigned URL for video upload
  # - POST /scans/{scanId}/video-url - Generate presigned URL to view video
  # - GET /admin/scans/pending - List scans awaiting approval (admin only)
  ApiScansFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/api-scans/
      Handler: index.handler
      Description: Consolidated API for all scan-related operations
      Environment:
        Variables:
          POWERTOOLS_SERVICE_NAME: api-scans
          POWERTOOLS_LOG_LEVEL: INFO
          TABLE_NAME: !GetAtt StorageStack.Outputs.TableName
          BUCKET_NAME: !GetAtt StorageStack.Outputs.BucketName
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !GetAtt StorageStack.Outputs.TableName
        - S3ReadPolicy:
            BucketName: !GetAtt StorageStack.Outputs.BucketName
        - S3WritePolicy:
            BucketName: !GetAtt StorageStack.Outputs.BucketName
      Events:
        # List user's scans
        ListScans:
          Type: Api
          Properties:
            RestApiId: !Ref ScannerApi
            Path: /scans
            Method: GET
        # Get single scan
        GetScan:
          Type: Api
          Properties:
            RestApiId: !Ref ScannerApi
            Path: /scans/{scanId}
            Method: GET
        # List pending reviews (admin)
        ListPending:
          Type: Api
          Properties:
            RestApiId: !Ref ScannerApi
            Path: /admin/scans/pending
            Method: GET
        # Generate upload presigned URL
        Upload:
          Type: Api
          Properties:
            RestApiId: !Ref ScannerApi
            Path: /scans/upload
            Method: POST
        # Generate video presigned URL
        VideoUrl:
          Type: Api
          Properties:
            RestApiId: !Ref ScannerApi
            Path: /scans/{scanId}/video-url
            Method: POST
    Metadata:
      BuildMethod: esbuild
      BuildProperties:
        Minify: false
        Target: es2022
        Sourcemap: true
        EntryPoints:
          - index.ts

  # API handler for user profile and admin user management:
  # - GET /profile - Get current user's profile
  # - PUT /profile - Update current user's profile
  # - POST /admin/users/invite - Invite new user (admin only)
  # - GET /admin/users - List all users (admin only)
  # - DELETE /admin/users/{username} - Delete user (admin only)
  # - Publishes user events to AppSync for real-time updates
  ApiUsersFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/api-users/
      Handler: index.handler
      Description: Consolidated API for user profile and admin user management
      Environment:
        Variables:
          POWERTOOLS_SERVICE_NAME: api-users
          POWERTOOLS_LOG_LEVEL: INFO
          TABLE_NAME: !GetAtt StorageStack.Outputs.TableName
          USER_POOL_ID: !GetAtt AuthStack.Outputs.UserPoolId
          APPSYNC_EVENTS_API_URL: !Sub 'https://${SocketsStack.Outputs.AppSyncHttpEndpoint}/event'
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !GetAtt StorageStack.Outputs.TableName
        - Statement:
            - Effect: Allow
              Action:
                - cognito-idp:AdminCreateUser
                - cognito-idp:ListUsers
                - cognito-idp:AdminDeleteUser
              Resource: !GetAtt AuthStack.Outputs.UserPoolArn
            - Effect: Allow
              Action:
                - appsync:EventPublish
              Resource: !Sub 'arn:aws:appsync:${AWS::Region}:${AWS::AccountId}:apis/${SocketsStack.Outputs.AppSyncApiId}/*'
      Events:
        # User profile endpoints
        GetProfile:
          Type: Api
          Properties:
            RestApiId: !Ref ScannerApi
            Path: /profile
            Method: GET
        UpdateProfile:
          Type: Api
          Properties:
            RestApiId: !Ref ScannerApi
            Path: /profile
            Method: PUT
        # Admin user management endpoints
        InviteUser:
          Type: Api
          Properties:
            RestApiId: !Ref ScannerApi
            Path: /admin/users/invite
            Method: POST
        ListUsers:
          Type: Api
          Properties:
            RestApiId: !Ref ScannerApi
            Path: /admin/users
            Method: GET
        DeleteUser:
          Type: Api
          Properties:
            RestApiId: !Ref ScannerApi
            Path: /admin/users/{username}
            Method: DELETE
    Metadata:
      BuildMethod: esbuild
      BuildProperties:
        Minify: false
        Target: es2022
        Sourcemap: true
        EntryPoints:
          - index.ts

Outputs:
  ApiEndpoint:
    Description: NUXT_PUBLIC_API_ENDPOINT
    Value: !Sub 'https://${ScannerApi}.execute-api.${AWS::Region}.amazonaws.com/prod'
  
  UserPoolId:
    Description: NUXT_PUBLIC_USER_POOL_ID
    Value: !GetAtt AuthStack.Outputs.UserPoolId
  
  UserPoolClientId:
    Description: NUXT_PUBLIC_USER_POOL_CLIENT_ID
    Value: !GetAtt AuthStack.Outputs.UserPoolClientId
  
  AppSyncHttpEndpoint:
    Description: NUXT_PUBLIC_APPSYNC_HTTP_ENDPOINT
    Value: !Sub 'https://${SocketsStack.Outputs.AppSyncHttpEndpoint}/event'
  
  AppSyncRealtimeEndpoint:
    Description: NUXT_PUBLIC_APPSYNC_REALTIME_ENDPOINT
    Value: !Sub 'wss://${SocketsStack.Outputs.AppSyncRealtimeEndpoint}/event/realtime'
  
  Region:
    Description: NUXT_PUBLIC_REGION
    Value: !Ref AWS::Region
  
  FrontendEnvFile:
    Description: Copy this to frontend/.env
    Value: !Sub |
      NUXT_PUBLIC_API_ENDPOINT=https://${ScannerApi}.execute-api.${AWS::Region}.amazonaws.com/prod
      NUXT_PUBLIC_USER_POOL_ID=${AuthStack.Outputs.UserPoolId}
      NUXT_PUBLIC_USER_POOL_CLIENT_ID=${AuthStack.Outputs.UserPoolClientId}
      NUXT_PUBLIC_APPSYNC_HTTP_ENDPOINT=https://${SocketsStack.Outputs.AppSyncHttpEndpoint}/event
      NUXT_PUBLIC_APPSYNC_REALTIME_ENDPOINT=wss://${SocketsStack.Outputs.AppSyncRealtimeEndpoint}/event/realtime
      NUXT_PUBLIC_REGION=${AWS::Region}