POC code for RSVPs

Author: devksingh4

src/api/index.ts

@@ -62,6 +62,7 @@ import { docsHtml, securitySchemes } from "./docs.js";
 import syncIdentityPlugin from "./routes/syncIdentity.js";
 import { createRedisModule } from "./redis.js";
 import userRoute from "./routes/user.js";
+import rsvpRoutes from "./routes/rsvp.js";
 /** END ROUTES */
 
 export const instanceId = randomUUID();
@@ -377,6 +378,7 @@ Otherwise, email [infra@acm.illinois.edu](mailto:infra@acm.illinois.edu) for sup
       api.register(apiKeyRoute, { prefix: "/apiKey" });
       api.register(clearSessionRoute, { prefix: "/clearSession" });
       api.register(userRoute, { prefix: "/users" });
+      api.register(rsvpRoutes, { prefix: "/rsvp" });
       if (app.runEnvironment === "dev") {
         api.register(vendingPlugin, { prefix: "/vending" });
       }

src/api/routes/rsvp.ts

@@ -0,0 +1,72 @@
+import { FastifyPluginAsync } from "fastify";
+import rateLimiter from "api/plugins/rateLimiter.js";
+import { withRoles, withTags } from "api/components/index.js";
+import { getUserOrgRoles } from "api/functions/organizations.js";
+import {
+  UnauthenticatedError,
+  UnauthorizedError,
+  ValidationError,
+} from "common/errors/index.js";
+import * as z from "zod/v4";
+import { verifyUiucAccessToken } from "api/functions/uin.js";
+import { checkPaidMembership } from "api/functions/membership.js";
+import { FastifyZodOpenApiTypeProvider } from "fastify-zod-openapi";
+
+const rsvpRoutes: FastifyPluginAsync = async (fastify, _options) => {
+  await fastify.register(rateLimiter, {
+    limit: 30,
+    duration: 30,
+    rateLimitIdentifier: "rsvp",
+  });
+  fastify.withTypeProvider<FastifyZodOpenApiTypeProvider>().post(
+    "/:orgId/event/:eventId",
+    {
+      schema: withTags(["RSVP"], {
+        summary: "Submit an RSVP for an event.",
+        params: z.object({
+          eventId: z.string().min(1).meta({
+            description: "The previously-created event ID in the events API.",
+          }),
+        }),
+        headers: z.object({
+          "x-uiuc-token": z.jwt().min(1).meta({
+            description:
+              "An access token for the user in the UIUC Entra ID tenant.",
+          }),
+        }),
+      }),
+    },
+    async (request, reply) => {
+      const accessToken = request.headers["x-uiuc-token"];
+      const verifiedData = await verifyUiucAccessToken({
+        accessToken,
+        logger: request.log,
+      });
+      const { userPrincipalName: upn, givenName, surname } = verifiedData;
+      const netId = upn.replace("@illinois.edu", "");
+      if (netId.includes("@")) {
+        request.log.error(
+          `Found UPN ${upn} which cannot be turned into NetID via simple replacement.`,
+        );
+        throw new ValidationError({
+          message: "ID token could not be parsed.",
+        });
+      }
+      const isPaidMember = await checkPaidMembership({
+        netId,
+        dynamoClient: fastify.dynamoClient,
+        redisClient: fastify.redisClient,
+        logger: request.log,
+      });
+      const entry = {
+        partitionKey: `${request.params.eventId}#${upn}`,
+        eventId: request.params.eventId,
+        userId: upn,
+        isPaidMember,
+        createdAt: "",
+      };
+    },
+  );
+};
+
+export default rsvpRoutes;

terraform/modules/dynamo/main.tf

@@ -567,3 +567,36 @@ resource "aws_dynamodb_table" "store_limits" {
     }
   }
 }
+
+resource "aws_dynamodb_table" "store_limits" {
+  region                      = "us-east-2"
+  billing_mode                = "PAY_PER_REQUEST"
+  name                        = "${var.ProjectId}-events-rsvp"
+  deletion_protection_enabled = true
+  hash_key                    = "partitionKey"
+  point_in_time_recovery {
+    enabled = true
+  }
+  attribute {
+    name = "partitionKey"
+    type = "S"
+  }
+  attribute {
+    name = "eventId"
+    type = "S"
+  }
+  global_secondary_index {
+    name            = "EventIdIndex"
+    hash_key        = "eventId"
+    projection_type = "ALL"
+  }
+  stream_enabled   = true
+  stream_view_type = "NEW_AND_OLD_IMAGES"
+  dynamic "replica" {
+    for_each = var.ReplicationRegions
+    content {
+      region_name                 = replica.value
+      deletion_protection_enabled = true
+    }
+  }
+}