serverless.yml

# Welcome to Serverless!
#
# This file is the main config file for your service.
# It's very minimal at this point and uses default values.
# You can always add more config options for more control.
# We've included some commented out config examples here.
# Just uncomment any of them to get that config option.
#
# For full config options, check the docs:
#    docs.serverless.com
#
# Happy Coding!

service: abstract-play
# app and org for use with dashboard.serverless.com
# app: apfront
# org: wamelen

# You can pin your service to only deploy with a specific Serverless version
# Check out our docs for more details
frameworkVersion: '3'
configValidationMode: warn

params:
  default:
    # Set true on the deploy AFTER streams are enabled on the DynamoDB table (see docs/deployment.md).
    enableGameProjectorStream: 'false'

custom:
  scheduleEnabled:
    prod: true
    dev: false

  testBotEnabled:
    dev: true
    prod: false

  recbucket:
    prod: "records.abstractplay.com"
    dev: "records.abstractplay.com"

  dumpbucket: "abstractplay-db-dump"

  websocketDomain:
    Fn::Join:
      - ""
      - - Ref: WebsocketsApi
        - ".execute-api."
        - Ref: AWS::Region
        - ".amazonaws.com"

  stageConfig:
    dev:
      profile: AbstractPlayDev
      userpool: arn:aws:cognito-idp:us-east-1:153672715141:userpool/us-east-1_2zrzbEjoU
      userpoolId: us-east-1_2zrzbEjoU
      userpoolClient: 14mpql1tmvntup4p2anm4jt782
      botpool: arn:aws:cognito-idp:us-east-1:153672715141:userpool/us-east-1_kqlqXHDJ5
      botpoolId: us-east-1_kqlqXHDJ5
      botTokenUrl: https://abstract-play-bots-dev.auth.us-east-1.amazoncognito.com/oauth2/token
      botOAuthScope: default-m2m-resource-server-dev/communicate
      sqsurl: https://sqs.us-east-1.amazonaws.com/153672715141/abstractplay-aiai-dev-aiai-queue
      wsDomain: qwmw4fb0l6.execute-api.us-east-1.amazonaws.com
      wsSqs: https://sqs.us-east-1.amazonaws.com/153672715141/abstractplay-ws-messages-dev

    prod:
      profile: AbstractPlayProd
      userpool: arn:aws:cognito-idp:us-east-1:153672715141:userpool/us-east-1_YCjgSZHJm
      userpoolId: us-east-1_YCjgSZHJm
      userpoolClient: 2isan3ctk1aabt2v6r6aptlpg
      botpool: arn:aws:cognito-idp:us-east-1:153672715141:userpool/us-east-1_nEKyig64I
      botpoolId: us-east-1_nEKyig64I
      botTokenUrl: https://botauth.abstractplay.com/oauth2/token
      botOAuthScope: default-m2m-resource-server-zssvzy/communicate
      sqsurl: https://sqs.us-east-1.amazonaws.com/153672715141/abstractplay-aiai-prod-aiai-queue
      wsDomain: qwmw4fb0l6.execute-api.us-east-1.amazonaws.com
      wsSqs: https://sqs.us-east-1.amazonaws.com/153672715141/abstractplay-ws-messages-prod

package:
  # individually: true
  excludeDevDependencies: false
  exclude:
    - node_modules/@aws-sdk/**

plugins:
  - serverless-plugin-common-excludes
  - serverless-plugin-include-dependencies

provider:
  name: aws
  runtime: nodejs24.x
  versionFunctions: false
  stage: ${opt:stage, 'dev'}
  profile: ${self:custom.stageConfig.${self:provider.stage}.profile}
  region: us-east-1
  logs:
    restApi:
      accessLogging: false
      executionLogging: true
      level: ERROR
      fullExecutionData: false
    websocket:
      accessLogging: false
      executionLogging: true
      level: ERROR
      fullExecutionData: false
  environment:
    ABSTRACT_PLAY_TABLE: abstract-play-${self:provider.stage}
    userpool: ${self:custom.stageConfig.${self:provider.stage}.userpool}
    userpoolId: ${self:custom.stageConfig.${self:provider.stage}.userpoolId}
    userpoolClient: ${self:custom.stageConfig.${self:provider.stage}.userpoolClient}
    BOTPOOL_ID: ${self:custom.stageConfig.${self:provider.stage}.botpoolId}
    SQS_URL: ${self:custom.stageConfig.${self:provider.stage}.sqsurl}
    AIAI_USERID: SkQfHAjeDxs8eeEnScuYA
    WEBSOCKET_DOMAIN: ${self:custom.stageConfig.${self:provider.stage}.wsDomain}
    WEBSOCKET_STAGE: ${self:provider.stage}
    WEBSOCKET_SQS: ${self:custom.stageConfig.${self:provider.stage}.wsSqs}
    TOTP_KEY: ${env:TOTP_KEY}
    VAPID_PRIVATE_KEY: ${env:VAPID_PRIVATE_KEY}
    VAPID_PUBLIC_KEY: ${env:VAPID_PUBLIC_KEY}
    OPENSSH_PRIVATE_KEY: ${env:OPENSSH_PRIVATE_KEY}
    BOT_OUTBOUND_QUEUE_URL:
      Ref: BotOutboundQueue
    PRESENCE_COALESCE_SQS:
      Ref: PresenceCoalesceQueue
    BOT_TOKEN_URL: ${self:custom.stageConfig.${self:provider.stage}.botTokenUrl}
    BOT_OAUTH_SCOPE: ${self:custom.stageConfig.${self:provider.stage}.botOAuthScope}
    TEST_BOT_CLIENT_ID: ${env:TEST_BOT_CLIENT_ID, ''}
    TEST_BOT_CLIENT_SECRET: ${env:TEST_BOT_CLIENT_SECRET, ''}
    API_BASE_URL:
      Fn::Join:
        - ''
        - - 'https://'
          - Ref: ApiGatewayRestApi
          - '.execute-api.'
          - Ref: AWS::Region
          - '.amazonaws.com/'
          - ${self:provider.stage}
    BOT_QUERY_URL:
      Fn::Join:
        - ''
        - - 'https://'
          - Ref: ApiGatewayRestApi
          - '.execute-api.'
          - Ref: AWS::Region
          - '.amazonaws.com/'
          - ${self:provider.stage}
          - '/botQuery'
    # TOTP_KEY: ${file(../apsecrets.yml):totp_key}
    # VAPID_PRIVATE_KEY: ${file(../apsecrets.yml):vapid_private_key}
    # VAPID_PUBLIC_KEY: ${file(../apsecrets.yml):vapid_public_key}
  iam:
    role:
      statements:
        - Effect: Allow
          Action:
            - dynamodb:Query
            - dynamodb:Scan
            - dynamodb:GetItem
            - dynamodb:PutItem
            - dynamodb:UpdateItem
            - dynamodb:DeleteItem
            - dynamodb:ExportTableToPointInTime
            - dynamodb:BatchWriteItem
            - ses:SendEmail
            - ses:SendRawEmail
            - sqs:SendMessage
          Resource: "*"
        - Effect: Allow
          Action:
            - dynamodb:GetRecords
            - dynamodb:GetShardIterator
            - dynamodb:DescribeStream
            - dynamodb:ListStreams
          Resource:
            Fn::Sub: 'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/abstract-play-${self:provider.stage}/stream/*'
        - Effect: 'Allow'
          Action:
            - 's3:ListBucket'
          Resource:
            - 'arn:aws:s3:::abstractplay-db-dump'
            - 'arn:aws:s3:::records.abstractplay.com'
        - Effect: 'Allow'
          Action:
            - 's3:GetObject'
            - 's3:PutObject'
          Resource:
            - 'arn:aws:s3:::abstractplay-db-dump/*'
            - 'arn:aws:s3:::records.abstractplay.com/*'
        - Effect: Allow
          Action:
            - cognito-idp:AdminCreateUser
            - cognito-idp:AdminDeleteUser
            - cognito-idp:CreateUserPoolClient
            - cognito-idp:DeleteUserPoolClient
            - cognito-idp:ListUserPoolClientSecrets
            - cognito-idp:AddUserPoolClientSecret
            - cognito-idp:DeleteUserPoolClientSecret
          Resource:
            - ${self:custom.stageConfig.dev.botpool}
            - ${self:custom.stageConfig.prod.botpool}

resources:
  Parameters:
    EnableGameProjectorStream:
      Type: String
      Default: ${param:enableGameProjectorStream}
      AllowedValues:
        - 'true'
        - 'false'

  Conditions:
    GameProjectorStreamEnabled:
      Fn::Equals:
        - Ref: EnableGameProjectorStream
        - 'true'

  Resources:
    # One table design
    AbstractGamesDynamoDbTable:
      Type: 'AWS::DynamoDB::Table'
      DeletionPolicy: Delete
      Properties:
        AttributeDefinitions:
          -
            AttributeName: "pk"
            AttributeType: "S"
          -
            AttributeName: "sk"
            AttributeType: "S"
        KeySchema:
          -
            AttributeName: "pk"
            KeyType: "HASH"
          -
            AttributeName: "sk"
            KeyType: "RANGE"
        BillingMode: PAY_PER_REQUEST
        StreamSpecification:
          StreamViewType: "NEW_AND_OLD_IMAGES"
        TableName: ${self:provider.environment.ABSTRACT_PLAY_TABLE}

    GatewayResponseDefault4XX:
       Type: 'AWS::ApiGateway::GatewayResponse'
       Properties:
         ResponseParameters:
           gatewayresponse.header.Access-Control-Allow-Origin: "'*'"
           gatewayresponse.header.Access-Control-Allow-Headers: "'*'"
         ResponseType: DEFAULT_4XX
         RestApiId:
           Ref: 'ApiGatewayRestApi'

    WsMessageQueue:
      Type: AWS::SQS::Queue
      Properties:
        QueueName: abstractplay-ws-messages-${self:provider.stage}
        VisibilityTimeout: 900   # match your consumer Lambda timeout
        MessageRetentionPeriod: 86400  # 1 day, adjust as needed

    PresenceCoalesceQueue:
      Type: AWS::SQS::Queue
      Properties:
        QueueName: abstractplay-presence-coalesce-${self:provider.stage}
        VisibilityTimeout: 60
        MessageRetentionPeriod: 86400

    BotOutboundQueue:
      Type: AWS::SQS::Queue
      Properties:
        QueueName: abstractplay-bot-outbound-${self:provider.stage}
        VisibilityTimeout: 60
        MessageRetentionPeriod: 86400

    GameProjectorDLQ:
      Type: AWS::SQS::Queue
      Properties:
        QueueName: abstractplay-game-projector-dlq-${self:provider.stage}
        MessageRetentionPeriod: 1209600

    GameProjectorDLQAlarm:
      Type: AWS::CloudWatch::Alarm
      Properties:
        AlarmName: abstractplay-game-projector-dlq-${self:provider.stage}
        AlarmDescription: Game projector Lambda failed and sent records to the DLQ
        Namespace: AWS/SQS
        MetricName: ApproximateNumberOfMessagesVisible
        Dimensions:
          - Name: QueueName
            Value: !GetAtt GameProjectorDLQ.QueueName
        Statistic: Sum
        Period: 300
        EvaluationPeriods: 1
        Threshold: 1
        ComparisonOperator: GreaterThanOrEqualToThreshold
        TreatMissingData: notBreaching

    GameProjectorDLQPolicy:
      Type: AWS::SQS::QueuePolicy
      Condition: GameProjectorStreamEnabled
      Properties:
        Queues:
          - Ref: GameProjectorDLQ
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service: lambda.amazonaws.com
              Action: sqs:SendMessage
              Resource: !GetAtt GameProjectorDLQ.Arn

    GameProjectorEventSourceMapping:
      Type: AWS::Lambda::EventSourceMapping
      Condition: GameProjectorStreamEnabled
      DependsOn:
        - AbstractGamesDynamoDbTable
        - GameProjectorLambdaFunction
      Properties:
        BatchSize: 25
        MaximumRetryAttempts: 3
        StartingPosition: LATEST
        EventSourceArn: !GetAtt AbstractGamesDynamoDbTable.StreamArn
        FunctionName: !Ref GameProjectorLambdaFunction
        DestinationConfig:
          OnFailure:
            Destination: !GetAtt GameProjectorDLQ.Arn

    # Apparently this is explicitly needed (which makes no sense to me, but there it is)
    ConnectLambdaPermission:
      Type: AWS::Lambda::Permission
      Properties:
        FunctionName: ${self:service}-${self:provider.stage}-connect
        Action: lambda:InvokeFunction
        Principal: apigateway.amazonaws.com
        SourceArn:
          Fn::Sub: arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${WebsocketsApi}/${self:provider.stage}/*/$connect
    DisconnectLambdaPermission:
      Type: AWS::Lambda::Permission
      Properties:
        FunctionName: ${self:service}-${self:provider.stage}-disconnect
        Action: lambda:InvokeFunction
        Principal: apigateway.amazonaws.com
        SourceArn:
          Fn::Sub: arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${WebsocketsApi}/${self:provider.stage}/*/$disconnect

    # for autodeployments
    # WebsocketsDeployment:
    #   Type: AWS::ApiGatewayV2::Deployment
    #   Properties:
    #     ApiId:
    #       Ref: WebsocketsApi
    #     Description: Force redeploy ${sls:instanceId}
    #   DependsOn:
    #     - SconnectWebsocketsRoute
    #     - SdisconnectWebsocketsRoute

    # WebsocketsDeploymentStage:
    #   Type: AWS::ApiGatewayV2::Stage
    #   Properties:
    #     StageName: ${self:provider.stage}
    #     Description: Redeploy ${sls:instanceId}   # forces stage update
    #     ApiId: !Ref WebsocketsApi
    #     DeploymentId: !Ref WebsocketsDeployment
    #     DefaultRouteSettings:
    #       DataTraceEnabled: false
    #       LoggingLevel: ERROR

  Outputs:
    DynamoDbStreamArn:
      Condition: GameProjectorStreamEnabled
      Value: !GetAtt AbstractGamesDynamoDbTable.StreamArn
      Export:
        Name: ${self:service}-${self:provider.stage}-DynamoDbStreamArn
    WsMessageQueueArn:
      Value: !GetAtt WsMessageQueue.Arn
      Export:
        Name: WsMessageQueueArn-${self:provider.stage}
    WsMessageQueueUrl:
      Value: !Ref WsMessageQueue
      Export:
        Name: WsMessageQueueUrl-${self:provider.stage}
    WebSocketApiDomainName:
      Value:
        Fn::Join:
          - ""
          - - Ref: WebsocketsApi
            - ".execute-api."
            - Ref: AWS::Region
            - ".amazonaws.com"
    WebsocketApiUrl:
      Value:
        Fn::Join:
          - ""
          - - "wss://"
            - Ref: WebsocketsApi
            - ".execute-api."
            - Ref: AWS::Region
            - ".amazonaws.com/"
            - ${self:provider.stage}
      Export:
        Name: ${self:service}-${self:provider.stage}-WebsocketApiUrl

functions:
  authQuery:
    handler: api/abstractplay.authQuery
    memorySize: 1024
    description: Abstract Play queries that need authorization.
    logRetentionInDays: 30
    events:
      - http:
          path: authQuery
          method: post
          cors: true
          integration: lambda
          authorizer:
            name: authorizer
            arn: ${self:provider.environment.userpool}
            claims:
              - email
              - 'cognito:username'
  botQuery:
    handler: api/abstractplay.botQuery
    memorySize: 1024
    description: Abstract Play queries for bots.
    logRetentionInDays: 30
    events:
      - http:
          path: botQuery
          method: post
          cors: true
          integration: lambda
          authorizer:
            name: botAuthorizer
            arn: ${self:custom.stageConfig.${self:provider.stage}.botpool}
            scopes:
              - ${self:custom.stageConfig.${self:provider.stage}.botOAuthScope}
  query:
    handler: api/abstractplay.query
    memorySize: 256
    description: Abstract Play queries that does not need authorization.
    logRetentionInDays: 30
    events:
      - http:
          path: query
          method: get
          cors: true
      - http:
          path: query
          method: post
          cors: true
  testBot:
    handler: api/testBot.handler
    memorySize: 256
    description: Dev-only reference bot — full source and docs in api/testBot.ts
    logRetentionInDays: 30
    enabled: ${self:custom.testBotEnabled.${self:provider.stage}}
    events:
      - http:
          path: testBot
          method: get
          cors: true
      - http:
          path: testBot
          method: post
          cors: true
  yourturn:
    handler: utils/yourturn.handler
    description: Sends out "your turn" notifications
    logRetentionInDays: 30
    events:
      - eventBridge:
          name: abstractplay-${self:provider.stage}-yourturn
          description: Send out "your turn" notifications
          enabled: ${self:custom.scheduleEnabled.${self:provider.stage}}
          schedule: cron(0 14,22 * * ? *)
  bot-outbound:
    handler: utils/bot-outbound.handler
    description: Contacts bot HTTPS endpoints for challenges and move notifications
    timeout: 60
    memorySize: 512
    logRetentionInDays: 30
    events:
      - sqs:
          arn:
            Fn::GetAtt:
              - BotOutboundQueue
              - Arn
          batchSize: 1

  gameProjector:
    handler: utils/game-projector.handler
    description: DynamoDB stream shadow projector for CURRENTGAMES#, COMPLETEDGAMES#, and sharded METAGAMES# counts
    timeout: 60
    memorySize: 512
    logRetentionInDays: 30
    # Stream trigger is defined in resources.GameProjectorEventSourceMapping (conditional)
    # so the table can gain StreamSpecification before StreamArn is referenced.

  # websocket functions
  # wsAuthorizer:
  #   name: wsAuthorizer
  #   handler: api/sockets/wsAuthorizer.wsAuthorizer
  #   logRetentionInDays: 7

  connect:
    handler: api/sockets/connectHandler.handler
    logRetentionInDays: 7
    timeout: 30
    events:
      - websocket:
          route: $connect
          # authorizer:
          #   name: wsAuthorizer
          #   identitySource: route.request.header.Sec-WebSocket-Protocol

  disconnect:
    handler: api/sockets/disconnectHandler.handler
    timeout: 30
    logRetentionInDays: 7
    events:
      - websocket:
          route: $disconnect

  subscribe:
    handler: api/sockets/authHandler.handler
    logRetentionInDays: 7
    timeout: 30
    events:
      - websocket:
          route: subscribe

  watchGames:
    handler: api/sockets/watchGamesHandler.handler
    logRetentionInDays: 7
    timeout: 30
    events:
      - websocket:
          route: watchGames

  syncPresence:
    handler: api/sockets/syncPresenceHandler.handler
    logRetentionInDays: 7
    timeout: 30
    events:
      - websocket:
          route: syncPresence

  presenceBroadcaster:
    handler: api/sockets/presenceBroadcaster.handler
    logRetentionInDays: 7
    timeout: 30
    events:
      - sqs:
          arn:
            Fn::GetAtt:
              - PresenceCoalesceQueue
              - Arn
          batchSize: 50
          maximumBatchingWindow: 2

  messageHandler:
    handler: api/sockets/messageHandler.handler
    logRetentionInDays: 7
    timeout: 30
    environment:
      DOMAIN_NAME: ${self:custom.websocketDomain}
      STAGE: ${self:provider.stage}
    events:
      - sqs:
          arn:
            Fn::GetAtt:
              - WsMessageQueue
              - Arn

  # scratch:
  #   handler: utils/scratch.handler
  #   description: For testing only
  #   timeout: 60