index.py

"""
Smart Inventory Hub - Lambda Function
Hybrid Kro Compositions Blog Sample

This Lambda function provides a REST API for managing product inventory.
It supports CRUD operations with DynamoDB backend.

Endpoints:
- GET /products - List all products (supports filtering)
- POST /products - Create a new product
- GET /products/{id} - Get a specific product
- PUT /products/{id} - Update a product
- DELETE /products/{id} - Delete a product

Environment Variables:
- TABLE_NAME: DynamoDB table name (set by RGD)
"""

import json
import boto3
import os
from decimal import Decimal
from datetime import datetime
import uuid

# Initialize DynamoDB resource
dynamodb = boto3.resource("dynamodb")
table = dynamodb.Table(os.environ["TABLE_NAME"])


class DecimalEncoder(json.JSONEncoder):
    """Helper to convert Decimal to float for JSON serialization."""
    def default(self, obj):
        if isinstance(obj, Decimal):
            return float(obj)
        return super(DecimalEncoder, self).default(obj)


def get_user_claims(event):
    """
    Extract authenticated user claims from the API Gateway JWT authorizer.
    API Gateway validates the JWT before invoking Lambda — no need to
    re-validate here. The decoded claims are available in the event context.
    """
    authorizer = event.get("requestContext", {}).get("authorizer", {})
    jwt_claims = authorizer.get("jwt", {}).get("claims", {})
    return {
        "sub": jwt_claims.get("sub", "anonymous"),
        "email": jwt_claims.get("email", "unknown"),
        "groups": jwt_claims.get("cognito:groups", ""),
    }


def handler(event, context):
    """
    Lambda handler for Smart Inventory Hub API.
    
    JWT validation is handled by API Gateway's JWT Authorizer (Cognito).
    This function extracts user claims from the pre-validated token for
    audit logging and ownership tracking.
    
    Supports: GET /products, POST /products, GET /products/{id}, 
              PUT /products/{id}, DELETE /products/{id}
    """
    try:
        # Extract authenticated user info from JWT claims
        user = get_user_claims(event)
        print(f"Request from user: {user['email']} (sub: {user['sub']})")

        # Extract HTTP method and path
        http_method = event.get("requestContext", {}).get("http", {}).get("method", "GET")
        raw_path = event.get("requestContext", {}).get("http", {}).get("path", "/")
        
        # Remove stage from path if present (e.g., /dev/products -> /products)
        path_parts = raw_path.split("/")
        if len(path_parts) > 1 and path_parts[1] in ["dev", "staging", "prod", "$default"]:
            path = "/" + "/".join(path_parts[2:]) if len(path_parts) > 2 else "/"
        else:
            path = raw_path
        
        # GET /products - List all products with optional filters
        if http_method == "GET" and path == "/products":
            return handle_list_products(event)
        
        # POST /products - Create new product
        elif http_method == "POST" and path == "/products":
            return handle_create_product(event, user)
        
        # GET /products/{id} - Get specific product
        elif http_method == "GET" and path.startswith("/products/"):
            product_id = path.split("/")[-1]
            return handle_get_product(product_id)
        
        # PUT /products/{id} - Update product
        elif http_method == "PUT" and path.startswith("/products/"):
            product_id = path.split("/")[-1]
            return handle_update_product(product_id, event, user)
        
        # DELETE /products/{id} - Delete product
        elif http_method == "DELETE" and path.startswith("/products/"):
            product_id = path.split("/")[-1]
            return handle_delete_product(product_id, user)
        
        # Unknown route
        else:
            return error_response(404, "Not found", {"path": path, "method": http_method})
    
    except json.JSONDecodeError:
        return error_response(400, "Invalid JSON in request body")
    
    except Exception as e:
        print(f"Error: {str(e)}")
        return error_response(500, "Internal server error", {"message": str(e)})


def handle_list_products(event):
    """Handle GET /products - List all products with optional filters."""
    query_params = event.get("queryStringParameters", {}) or {}
    category = query_params.get("category")
    low_stock = query_params.get("lowStock")
    
    if category:
        # Query by category using GSI (with pagination)
        products = []
        response = table.query(
            IndexName="category-index",
            KeyConditionExpression="category = :cat",
            ExpressionAttributeValues={":cat": category}
        )
        products.extend(response.get("Items", []))
        while "LastEvaluatedKey" in response:
            response = table.query(
                IndexName="category-index",
                KeyConditionExpression="category = :cat",
                ExpressionAttributeValues={":cat": category},
                ExclusiveStartKey=response["LastEvaluatedKey"]
            )
            products.extend(response.get("Items", []))
    else:
        # Scan all products (with pagination)
        products = []
        response = table.scan()
        products.extend(response.get("Items", []))
        while "LastEvaluatedKey" in response:
            response = table.scan(ExclusiveStartKey=response["LastEvaluatedKey"])
            products.extend(response.get("Items", []))
    
    # Filter by low stock if requested
    if low_stock == "true":
        products = [p for p in products if p.get("stock", 0) <= p.get("minStock", 0)]
    
    # Calculate summary statistics
    total_value = sum(
        p.get("price", Decimal(0)) * p.get("stock", p.get("quantity", 0))
        for p in products
    )
    low_stock_count = sum(
        1 for p in products
        if p.get("stock", p.get("quantity", 0)) <= p.get("minStock", p.get("reorderLevel", 0))
    )
    
    return success_response({
        "products": products,
        "count": len(products),
        "summary": {
            "totalValue": total_value,
            "lowStockCount": low_stock_count
        }
    })


def handle_create_product(event, user):
    """Handle POST /products - Create a new product."""
    body = json.loads(event.get("body", "{}"))
    
    # Validate required fields
    required_fields = ["sku", "name", "category", "price", "stock"]
    missing_fields = [f for f in required_fields if f not in body]
    if missing_fields:
        return error_response(400, f"Missing required fields: {', '.join(missing_fields)}")
    
    # Generate ID and add metadata
    product_id = body.get("id", str(uuid.uuid4()))
    body["id"] = product_id
    body["createdAt"] = datetime.utcnow().isoformat()
    body["updatedAt"] = datetime.utcnow().isoformat()
    body["createdBy"] = user["email"]
    body["updatedBy"] = user["email"]
    body["minStock"] = body.get("minStock", 5)
    
    # Convert price to Decimal for DynamoDB
    if "price" in body:
        body["price"] = Decimal(str(body["price"]))
    
    # Convert stock to int
    if "stock" in body:
        body["stock"] = int(body["stock"])
    
    # Store product
    table.put_item(Item=body)
    
    return success_response({
        "message": "Product created successfully",
        "product": body
    }, 201)


def handle_get_product(product_id):
    """Handle GET /products/{id} - Get a specific product."""
    response = table.get_item(Key={"id": product_id})
    product = response.get("Item")
    
    if product:
        return success_response({"product": product})
    else:
        return error_response(404, "Product not found")


def handle_update_product(product_id, event, user):
    """Handle PUT /products/{id} - Update a product."""
    body = json.loads(event.get("body", "{}"))
    
    # Get existing product
    response = table.get_item(Key={"id": product_id})
    if "Item" not in response:
        return error_response(404, "Product not found")
    
    # Update product
    body["id"] = product_id
    body["updatedAt"] = datetime.utcnow().isoformat()
    body["updatedBy"] = user["email"]
    body["createdAt"] = response["Item"].get("createdAt", datetime.utcnow().isoformat())
    body["createdBy"] = response["Item"].get("createdBy", "unknown")
    
    # Convert price to Decimal for DynamoDB
    if "price" in body:
        body["price"] = Decimal(str(body["price"]))
    
    # Convert stock to int
    if "stock" in body:
        body["stock"] = int(body["stock"])
    
    table.put_item(Item=body)
    
    return success_response({
        "message": "Product updated successfully",
        "product": body
    })


def handle_delete_product(product_id, user):
    """Handle DELETE /products/{id} - Delete a product."""
    print(f"Product {product_id} deleted by {user['email']}")
    table.delete_item(Key={"id": product_id})
    
    return success_response({"message": "Product deleted successfully"})


def success_response(data, status_code=200):
    """Return a successful response."""
    return {
        "statusCode": status_code,
        "headers": {
            "Content-Type": "application/json",
            "Access-Control-Allow-Origin": "*"
        },
        "body": json.dumps(data, cls=DecimalEncoder)
    }


def error_response(status_code, message, details=None):
    """Return an error response."""
    body = {"error": message}
    if details:
        body.update(details)
    
    return {
        "statusCode": status_code,
        "headers": {"Content-Type": "application/json"},
        "body": json.dumps(body)
    }