## Request template: map HTTP body fields into a DynamoDB PutItem payload
## API route: POST /orders

{
  "TableName": "Orders",
  "Item": {
    "orderId": { "S": "$context.requestId" },
    "userId":  { "S": "$input.json('$.userId')" },
    "total":   { "N": "$input.json('$.total')" },
    "status":  { "S": "pending" },
    "createdAt": { "S": "$context.requestTimeEpoch" }
  },
  "ConditionExpression": "attribute_not_exists(orderId)"
}

## Response template: transform DynamoDB response into clean HTTP JSON
## $input.path('$') accesses the full DynamoDB response body

#if($input.path('$.ConditionalCheckFailedException') != "")
  #set($context.responseOverride.status = 409)
  { "error": "Order already exists" }
#else
  {
    "orderId": "$context.requestId",
    "status": "created"
  }
#end

## Access Authorization header (useful in custom integration auth flows)
#set($token = $input.params('Authorization'))

## Access query string parameter
#set($page = $input.params('page'))
#set($limit = $input.params('limit'))

## URL-encode a value for use in a downstream URL (e.g., EventBridge detail)
$util.urlEncode($input.json('$.callbackUrl'))

## Escape a value for safe inclusion in a JSON string
"message": "$util.escapeJavaScript($input.json('$.userInput'))"

// CDK: REST API → SQS direct integration
import { AwsIntegration, PassthroughBehavior } from 'aws-cdk-lib/aws-apigateway'
import { Queue } from 'aws-cdk-lib/aws-sqs'
import { Role, ServicePrincipal, PolicyStatement } from 'aws-cdk-lib/aws-iam'

const queue = new Queue(this, 'OrderQueue')

// IAM role for API Gateway to call SQS
const integrationRole = new Role(this, 'ApiGwSqsRole', {
  assumedBy: new ServicePrincipal('apigateway.amazonaws.com'),
})
integrationRole.addToPolicy(new PolicyStatement({
  actions: ['sqs:SendMessage'],
  resources: [queue.queueArn],
}))

const sqsIntegration = new AwsIntegration({
  service: 'sqs',
  path: `${this.account}/${queue.queueName}`,
  integrationHttpMethod: 'POST',
  options: {
    credentialsRole: integrationRole,
    passthroughBehavior: PassthroughBehavior.NEVER,
    requestParameters: {
      'integration.request.header.Content-Type': "'application/x-www-form-urlencoded'",
    },
    requestTemplates: {
      'application/json': `Action=SendMessage&MessageBody=$util.urlEncode($input.body)&MessageGroupId=$input.json('$.orderId')`,
    },
    integrationResponses: [{
      statusCode: '202',
      responseTemplates: {
        'application/json': '{ "queued": true, "requestId": "$context.requestId" }'
      }
    }]
  }
})

api.root.addResource('orders').addMethod('POST', sqsIntegration, {
  methodResponses: [{ statusCode: '202' }]
})

## Request template: API GW → DynamoDB GetItem
## Route: GET /users/{userId}

{
  "TableName": "Users",
  "Key": {
    "PK": { "S": "USER#$input.params('userId')" },
    "SK": { "S": "PROFILE" }
  }
}

## Response template: DynamoDB → HTTP JSON
## DynamoDB returns { "Item": { "name": { "S": "Alice" }, "email": { "S": "..." } } }

#set($item = $input.path('$.Item'))
{
  "userId": "$input.params('userId')",
  "name":   "$item.name.S",
  "email":  "$item.email.S"
}

## Request template: POST /events → EventBridge PutEvents
## Transforms HTTP body into EventBridge event format

{
  "Entries": [{
    "Source": "com.myapp.api",
    "DetailType": "$input.json('$.eventType')",
    "Detail": "$util.escapeJavaScript($input.body)",
    "EventBusName": "myapp-events"
  }]
}

Client connects   → $connect route → Lambda validates auth → stores connectionId in DynamoDB
Client sends msg  → $default route → Lambda processes, can push back via Management API
Server pushes msg → Lambda uses connectionId to call Management API → client receives
Client disconnects → $disconnect route → Lambda removes connectionId from DynamoDB

// DynamoDB: store connection IDs for server-initiated pushes
export const connectHandler = async (event: AWSLambda.APIGatewayProxyWebsocketEventV2) => {
  const connectionId = event.requestContext.connectionId

  await docClient.send(new PutCommand({
    TableName: process.env.CONNECTIONS_TABLE!,
    Item: {
      PK: `CONN#${connectionId}`,
      SK: 'METADATA',
      userId: event.requestContext.authorizer?.userId,
      connectedAt: new Date().toISOString(),
      ttl: Math.floor(Date.now() / 1000) + (2 * 60 * 60), // 2-hour TTL for auto-cleanup
    }
  }))
  return { statusCode: 200, body: 'Connected' }
}

// Server-initiated push: Lambda uses the Management API to push to a specific connection
export const broadcastHandler = async (event: { userId: string, message: string }) => {
  const { Items } = await docClient.send(new QueryCommand({
    TableName: process.env.CONNECTIONS_TABLE!,
    KeyConditionExpression: 'begins_with(PK, :prefix)',
    ExpressionAttributeValues: { ':prefix': 'CONN#' }
  }))

  const endpoint = `https://${process.env.API_ID}.execute-api.${process.env.REGION}.amazonaws.com/${process.env.STAGE}`
  const client = new ApiGatewayManagementApiClient({ endpoint })

  await Promise.allSettled(Items!.map(async (item) => {
    try {
      await client.send(new PostToConnectionCommand({
        ConnectionId: item.PK.replace('CONN#', ''),
        Data: Buffer.from(JSON.stringify({ message: event.message }))
      }))
    } catch (err: any) {
      if (err.statusCode === 410) {
        // GoneException: connection closed without triggering $disconnect
        await docClient.send(new DeleteCommand({
          TableName: process.env.CONNECTIONS_TABLE!,
          Key: { PK: item.PK, SK: 'METADATA' }
        }))
      }
    }
  }))
}

// REQUEST-type Lambda Authorizer event
export const requestAuthorizer = async (
  event: AWSLambda.APIGatewayRequestAuthorizerEvent
): Promise<AWSLambda.APIGatewayAuthorizerResult> => {
  const apiKey = event.headers?.['x-api-key']
  const tenantId = event.headers?.['x-tenant-id']
  const jwtToken = event.headers?.Authorization?.replace('Bearer ', '')

  if (!apiKey || !tenantId || !jwtToken) {
    throw new Error('Unauthorized')
  }

  // Multi-factor: validate JWT AND verify API key belongs to tenant
  const [jwtPayload, tenantConfig] = await Promise.all([
    verifyJwt(jwtToken),
    getTenantConfig(tenantId, apiKey) // DynamoDB lookup
  ])

  if (jwtPayload.tenantId !== tenantId) throw new Error('Unauthorized')

  return {
    principalId: jwtPayload.sub,
    policyDocument: allowPolicy(event.methodArn),
    context: { tenantId, tier: tenantConfig.tier }
  }
}

// Client Lambda calling an IAM-authorized API
import { SignatureV4 } from '@smithy/signature-v4'
import { Sha256 } from '@aws-crypto/sha256-js'

const signer = new SignatureV4({
  credentials: fromEnv(),  // Uses Lambda's execution role credentials automatically
  region: process.env.AWS_REGION!,
  service: 'execute-api',
  sha256: Sha256,
})

const url = new URL('https://abc123.execute-api.us-east-1.amazonaws.com/prod/orders')
const signed = await signer.sign({
  method: 'POST',
  hostname: url.hostname,
  path: url.pathname,
  headers: { 'Content-Type': 'application/json', host: url.hostname },
  body: JSON.stringify({ orderId: '42' }),
})

const response = await fetch(url.toString(), {
  method: signed.method,
  headers: signed.headers,
  body: signed.body,
})

// CDK: WAF WebACL with rate-based rule for API Gateway
import { CfnWebACL } from 'aws-cdk-lib/aws-wafv2'

const webAcl = new CfnWebACL(this, 'ApiWaf', {
  scope: 'REGIONAL',
  defaultAction: { allow: {} },
  rules: [
    {
      name: 'RateLimitByIP',
      priority: 1,
      action: { block: {} },
      visibilityConfig: { sampledRequestsEnabled: true, cloudWatchMetricsEnabled: true, metricName: 'RateLimit' },
      statement: {
        rateBasedStatement: {
          limit: 2000,            // 2000 requests per 5 minutes per IP
          aggregateKeyType: 'IP',
        }
      }
    },
    {
      name: 'AWSManagedRulesSQLi',
      priority: 2,
      overrideAction: { none: {} },
      visibilityConfig: { sampledRequestsEnabled: true, cloudWatchMetricsEnabled: true, metricName: 'SQLi' },
      statement: {
        managedRuleGroupStatement: {
          vendorName: 'AWS',
          name: 'AWSManagedRulesSQLiRuleSet',
        }
      }
    }
  ],
  // ... visibilityConfig
})

// Associate WAF with REST API stage
new CfnWebACLAssociation(this, 'WafAssociation', {
  resourceArn: `arn:aws:apigateway:${this.region}::/restapis/${api.restApiId}/stages/${api.deploymentStage.stageName}`,
  webAclArn: webAcl.attrArn,
})