fix: HttpApi explicit AuthorizationScopes: [] is not overridden by authorizer default

samtranslator/open_api/open_api.py

@@ -313,7 +313,7 @@ def add_auth_to_method(self, path, method_name, auth, api):  # type: ignore[no-u
         :param dict api: Reference to the related Api's properties as defined in the template.
         """
         method_authorizer = auth and auth.get("Authorizer")
-        authorization_scopes = auth.get("AuthorizationScopes", [])
+        authorization_scopes = auth.get("AuthorizationScopes")
         api_auth = api and api.get("Auth")
         authorizers = api_auth and api_auth.get("Authorizers")
         if method_authorizer:
@@ -330,9 +330,6 @@ def _set_method_authorizer(self, path, method_name, authorizer_name, authorizers
             authorizers param.
         :param list authorization_scopes: list of strings that are the auth scopes for this method
         """
-        if authorization_scopes is None:
-            authorization_scopes = []
-
         for method_definition in self.iter_on_method_definitions_for_path_at_method(path, method_name):
             security_dict = {}  # type: ignore[var-annotated]
             security_dict[authorizer_name] = []
@@ -345,9 +342,9 @@ def _set_method_authorizer(self, path, method_name, authorizer_name, authorizers
                         [InvalidTemplateException(f"Type of authorizer '{authorizer_name}' must be a dictionary")]
                     )
                 method_authorization_scopes = authorizer.get("AuthorizationScopes")
-                if authorization_scopes:
+                if authorization_scopes is not None:
                     method_authorization_scopes = authorization_scopes
-                if authorizers[authorizer_name] and method_authorization_scopes:
+                if authorizers.get(authorizer_name) is not None and method_authorization_scopes is not None:
                     security_dict[authorizer_name] = method_authorization_scopes
 
             authorizer_security = [security_dict]

tests/translator/input/http_api_with_auth_with_default_scopes.yaml

@@ -0,0 +1,87 @@
+Resources:
+  MyApiWithCognitoAuth:
+    Type: AWS::Serverless::HttpApi
+    Properties:
+      Auth:
+        DefaultAuthorizer: MyDefaultCognitoAuth
+        Authorizers:
+          MyDefaultCognitoAuth:
+            JwtConfiguration:
+              Audience:
+              - audience1
+              Issuer: https://www.example.com/v1/connect/oidc/default
+            IdentitySource: $request.header.Authorization
+            AuthorizationScopes:
+            - default.write
+            - default.read
+          MyCognitoAuthWithDefaultScopes:
+            JwtConfiguration:
+              Audience:
+              - audience2
+              Issuer: https://www.example.com/v1/connect/oidc/other
+            IdentitySource: $request.header.Authorization
+            AuthorizationScopes:
+            - default.delete
+            - default.update
+
+  MyFn:
+    Type: AWS::Serverless::Function
+    Properties:
+      CodeUri: s3://bucket/key
+      Handler: index.handler
+      Runtime: nodejs12.x
+      Events:
+        CognitoAuthorizerWithDefaultScopes:
+          Type: HttpApi
+          Properties:
+            ApiId: !Ref MyApiWithCognitoAuth
+            Method: get
+            Path: /cognitoauthorizerwithdefaultscopes
+            Auth:
+              Authorizer: MyCognitoAuthWithDefaultScopes
+        CognitoDefaultScopesDefaultAuthorizer:
+          Type: HttpApi
+          Properties:
+            ApiId: !Ref MyApiWithCognitoAuth
+            Method: get
+            Path: /cognitodefaultscopesdefaultauthorizer
+        CognitoDefaultScopesWithOverwritten:
+          Type: HttpApi
+          Properties:
+            ApiId: !Ref MyApiWithCognitoAuth
+            Method: get
+            Path: /cognitodefaultscopesoverwritten
+            Auth:
+              Authorizer: MyDefaultCognitoAuth
+              AuthorizationScopes:
+              - overwritten.read
+              - overwritten.write
+        CognitoAuthorizerScopesOverwritten:
+          Type: HttpApi
+          Properties:
+            ApiId: !Ref MyApiWithCognitoAuth
+            Method: get
+            Path: /cognitoauthorizercopesoverwritten
+            Auth:
+              Authorizer: MyCognitoAuthWithDefaultScopes
+              AuthorizationScopes:
+              - overwritten.read
+              - overwritten.write
+        CognitoDefaultScopesNone:
+          Type: HttpApi
+          Properties:
+            ApiId: !Ref MyApiWithCognitoAuth
+            Method: get
+            Path: /cognitodefaultscopesnone
+            Auth:
+              Authorizer: MyDefaultCognitoAuth
+              AuthorizationScopes: []
+        CognitoDefaultAuthDefaultScopesNone:
+          Type: HttpApi
+          Properties:
+            ApiId: !Ref MyApiWithCognitoAuth
+            Method: get
+            Path: /cognitodefaultauthdefaultscopesnone
+            Auth:
+              Authorizer: MyCognitoAuthWithDefaultScopes
+              AuthorizationScopes: []