Added FromCustomAuthorizerAttribute and tests. #1466

kabaluk · 2023-03-26T17:59:04Z

PR Description: `[FromCustomAuthorizer]` Attribute Support

Summary

Adds [FromCustomAuthorizer] attribute to extract Lambda authorizer context values directly into method parameters.

Usage

[HttpApi(HttpMethod.Get, "/api/user-info")]
public IHttpResult GetUserInfo(
    [FromCustomAuthorizer(Name = "userId")] string userId,
    [FromCustomAuthorizer(Name = "email")] string email)

Supported API Types

API Type	Context Path
REST API	`RequestContext.Authorizer["key"]`
HTTP API v1	`RequestContext.Authorizer["key"]`
HTTP API v2	`RequestContext.Authorizer.Lambda["key"]`

Behavior

Key name: Uses Name property if specified, otherwise falls back to parameter name
Returns 401 Unauthorized when: authorizer context is null, key not found, or type conversion fails
Supports IHttpResult return types

Testing

Unit tests with snapshot verification
Integration tests deploy real Lambda functions to AWS and verify end-to-end flow with custom authorizers

normj

Cool PR!

Can you fix the whitespaces changes to the LambdaFunctionTemplate.tt file? The whole file is looks different.

Who should we handle the other type of authorizer properties. For example on the APIGatewayHttpApiV2ProxyRequest besides the Lambda property there is also Jwt and IAM properties. Should we make the string accessing the authorizer field have the prefix of the property.

kabaluk · 2023-03-29T23:42:53Z

Wiil do my best with the withspace.
The other types of authorizer are not custom authorizers as far as i am aware.
I would not create string prefixes.
We could create an iam authorizer attribute and a jwt authorizer attribute and those wold look on the respective locations...

kabaluk · 2023-03-30T01:08:55Z

don't seem to be able to fix the whitespace issue to save my life :(
Please review ignoring whitespace ?? Maybe?

Tried setting EOL to LF and CR, both cause problems with the generated file. The correct one seems to be CRLF .
but obviously git doens't like it :(

Please feel free to edit.

kabaluk · 2023-05-04T23:57:58Z

Would be really nice to get this avail;able. I will gladly fix the conflicts if this can be looked at again.

kabaluk · 2023-05-08T19:51:05Z

I can see you did a major refactoring in the dev branch will push again once released.

If i might be so bold, I looked at what you did.
why not take it one step further and separate each attribute into it's own file?
Talking about the APIGatewaySetupParameters.tt
Breaking that file down, using the technique you used before, would make it much easier to add new attributes in the future

Just a thought.

normj · 2023-05-09T00:55:17Z

@kabaluk I suspect adding new attributes would be done in separate files. For example if we added SQS or S3 I would put them in separate TT. One of my goals with the refactor was to make it easier to add new attributes as the previous monolithic tt file was really hard to reconcile with. HttpApi and RestApi attributes are 9X percent the same code so I didn't really want to make 2 separate tt files for each one of those. Plus I thought the parameter setup was getting pretty long so I was looking for some separation which is why I divided the parameter setup and the invoke. I suspect in SQS or S3 use cases the parameter setup wouldn't be so complicated.

Another goal I had was I wanted to generate the exact same code including whitespaces to make the PR review easier and then later I could do more specific refactoring. Otherwise the PR review would have been every line is different and that is hard to review. But going forward I could see putting each of the FromXXX in a separate tt file as well.

kabaluk · 2023-05-09T15:42:17Z

@kabaluk I suspect adding new attributes would be done in separate files. For example if we added SQS or S3 I would put them in separate TT. One of my goals with the refactor was to make it easier to add new attributes as the previous monolithic tt file was really hard to reconcile with. HttpApi and RestApi attributes are 9X percent the same code so I didn't really want to make 2 separate tt files for each one of those. Plus I thought the parameter setup was getting pretty long so I was looking for some separation which is why I divided the parameter setup and the invoke. I suspect in SQS or S3 use cases the parameter setup wouldn't be so complicated.

Another goal I had was I wanted to generate the exact same code including whitespaces to make the PR review easier and then later I could do more specific refactoring. Otherwise the PR review would have been every line is different and that is hard to review. But going forward I could see putting each of the FromXXX in a separate tt file as well.

I was talking specifically of the FromXXX attributes. Apologies, I should have been more explicit. Sounds like a great change and it would make it a lot easier to add and test more FromXXX attributes. Looking forward to have that in main so i can re add the FromCustomAuthorizer attribute.
Even started looking on how to do the FromJwt. 😄

kabaluk · 2023-05-11T21:57:13Z

Readded CustomAuthorizerAttribute..

Hope you like it :)

kabaluk · 2023-05-18T22:12:43Z

Any possibility of having this looked at again, please?

normj

I did an initial scan and it looks good. I had one comment so far. I need to test the experience end to end next. I'll try and find time to do that soon.

Libraries/src/Amazon.Lambda.Annotations.SourceGenerator/Templates/APIGatewaySetupParameters.tt

ashishdhingra · 2023-09-01T16:48:20Z

@kabaluk Please review the last review comment from @normj and see if you are able to address it.

kabaluk · 2023-09-03T17:58:04Z

@kabaluk Please review the last review comment from @normj and see if you are able to address it.

Please have a look.

GarrettBeatty · 2026-01-28T17:16:38Z

im working on rebasing this

GarrettBeatty · 2026-01-28T20:59:48Z

Libraries/src/Amazon.Lambda.Annotations.SourceGenerator/Templates/APIGatewaySetupParameters.tt

+            try
+            {
+                var __authValue_<#= parameter.Name #>__ = __request__.RequestContext.Authorizer["<#= authKey #>"];
+                <#= parameter.Name #> = (<#= parameter.Type.FullName #>)Convert.ChangeType(__authValue_<#= parameter.Name #>__?.ToString(), typeof(<#= parameter.Type.FullNameWithoutAnnotations #>));


Why We Need .ToString() for Custom Authorizer Values

The Data Flow

Authorizer Lambda returns context: When your custom authorizer runs, it returns a context dictionary:

Context = new Dictionary<string, object> { { "userId", "12345" }, { "permissions", "admin" } }

API Gateway passes this to the protected Lambda in the request payload as JSON:

{ "requestContext": { "authorizer": { "userId": "12345", "permissions": "admin" } } }

Lambda deserializes the request using the configured serializer (System.Text.Json or Newtonsoft.Json).

The Problem: Dictionary<string, object> Deserialization

The Authorizer property is typed as Dictionary<string, object>:

public class APIGatewayCustomAuthorizerContext : Dictionary<string, object>

When the serializer encounters a JSON value like "12345" and needs to deserialize it into object, it doesn't know what concrete type to use. So:

System.Text.Json wraps it in a JsonElement struct

Newtonsoft.Json wraps it in a JToken (like JValue)

so rather than having statements like

if (__authValue__ is System.Text.Json.JsonElement jsonElement) { userId = Convert.ChangeType(jsonElement.ToString(), typeof(string)); }

i just call toString which both of these serializers have.

not sure if there is a better way

@normj not sure if you have any better ideas here of it ToString is good enough

Can the values be numerics instead of strings? If so how would that work out with this approach? Or are we saying for the FromCustomerAuthorizer we only support string parameters. If so we should make sure we are enforcing that and put out diagnostic warnings if they attempt something we don't support.

so what im doing here is converting it to a string then using https://learn.microsoft.com/en-us/dotnet/api/system.convert.changetype?view=net-10.0 afterwards to convert to the parameters type.

i will add an integration test to confirm

so i added integration tests to confirm

int values work

string values work

boolean values work

double values do not work because of a limitation with api gateway not supporting it.

Copilot

Pull request overview

Copilot reviewed 28 out of 28 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Libraries/src/Amazon.Lambda.Annotations.SourceGenerator/Templates/APIGatewaySetupParameters.tt

Libraries/test/TestCustomAuthorizerApp/ProtectedFunction.cs

Libraries/test/TestCustomAuthorizerApp/AuthorizerFunction.cs

...ceGenerators.Tests/Snapshots/CustomAuthorizerHttpApiExample_HttpApiAuthorizer_Generated.g.cs

.../Snapshots/CustomAuthorizerWithIHttpResultsExample_AuthorizerWithIHttpResults_Generated.g.cs

Copilot

Pull request overview

Copilot reviewed 31 out of 31 changed files in this pull request and generated 8 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Libraries/test/Amazon.Lambda.Annotations.SourceGenerators.Tests/SourceGeneratorTests.cs

Libraries/test/TestCustomAuthorizerApp/AuthorizerFunction.cs

Libraries/test/TestCustomAuthorizerApp/ProtectedFunction.cs

Libraries/test/TestCustomAuthorizerApp/serverless.template

...ambda.Annotations.SourceGenerators.Tests/Snapshots/AuthNameFallback_GetUserId_Generated.g.cs

GarrettBeatty · 2026-02-02T19:40:20Z

https://github.com/aws/aws-lambda-dotnet/actions/runs/21604179496/job/62257446270

GarrettBeatty · 2026-02-02T19:41:51Z

Libraries/test/IntegrationTests.Helpers/CloudFormationHelper.cs

+using Amazon.CloudFormation;
+using Amazon.CloudFormation.Model;
+
+namespace IntegrationTests.Helpers


this is all existing code just moved into a common project to share between the two integration test projects

Libraries/src/Amazon.Lambda.Annotations.SourceGenerator/Templates/APIGatewaySetupParameters.tt

normj · 2026-02-02T23:55:33Z

Libraries/src/Amazon.Lambda.Annotations.SourceGenerator/Templates/APIGatewaySetupParameters.tt

+            try
+            {
+                var __authValue_<#= parameter.Name #>__ = __request__.RequestContext.Authorizer["<#= authKey #>"];
+                <#= parameter.Name #> = (<#= parameter.Type.FullName #>)Convert.ChangeType(__authValue_<#= parameter.Name #>__?.ToString(), typeof(<#= parameter.Type.FullNameWithoutAnnotations #>));


Can the values be numerics instead of strings? If so how would that work out with this approach? Or are we saying for the FromCustomerAuthorizer we only support string parameters. If so we should make sure we are enforcing that and put out diagnostic warnings if they attempt something we don't support.

Libraries/src/Amazon.Lambda.Annotations.SourceGenerator/Templates/APIGatewaySetupParameters.tt

Copilot

Pull request overview

Copilot reviewed 56 out of 56 changed files in this pull request and generated 42 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Libraries/test/TestServerlessApp.IntegrationTests/IntegrationTestContextFixture.cs

Copilot · 2026-02-04T14:56:03Z

Libraries/test/Amazon.Lambda.Annotations.SourceGenerators.Tests/SourceGeneratorTests.cs

+        {
+            var expectedTemplateContent = await ReadSnapshotContent(Path.Combine("Snapshots", "ServerlessTemplates", "authorizerHttpApi.template"));
+            var expectedRestAuthorizerGenerated = await ReadSnapshotContent(Path.Combine("Snapshots", "CustomAuthorizerHttpApiExample_HttpApiAuthorizer_Generated.g.cs"));
+


Variable name expectedRestAuthorizerGenerated is misleading in this HTTP API test (it contains the expected HttpApi generated output). Rename it to something like expectedHttpApiAuthorizerGenerated to avoid confusion and make future maintenance easier.

Copilot · 2026-02-04T14:56:04Z

Libraries/test/TestCustomAuthorizerApp/README.md

+# Response: "Hello user-12345! You are a admin in tenant 42."
+```


Minor grammar in the example response: "You are a admin" should be "You are an admin".

Copilot · 2026-02-04T14:56:04Z

Libraries/test/TestCustomAuthorizerApp.IntegrationTests/HttpApiV1Tests.cs

+    public async Task HttpApiV1UserInfo_WithValidAuth_ReturnsAuthorizerContext()
+    {
+        // Arrange
+        var request = new HttpRequestMessage(HttpMethod.Get, $"{_fixture.HttpApiUrl}/api/http-v1-user-info");


Disposable 'HttpRequestMessage' is created but not disposed.

Copilot · 2026-02-04T14:56:04Z

Libraries/test/TestCustomAuthorizerApp.IntegrationTests/HttpApiV1Tests.cs

+    public async Task HttpApiV1UserInfo_WithMissingAuthorizerContextKey_ReturnsUnauthorized()
+    {
+        // Arrange - use partial-context token that authorizes but omits expected context keys
+        var request = new HttpRequestMessage(HttpMethod.Get, $"{_fixture.HttpApiUrl}/api/http-v1-user-info");


Disposable 'HttpRequestMessage' is created but not disposed.

Copilot · 2026-02-04T14:56:13Z

...s.SourceGenerators.Tests/Snapshots/CustomAuthorizerRestExample_RestAuthorizer_Generated.g.cs

+#if NET6_0_OR_GREATER
+                __context__.Logger.LogError(e, "Failed to convert authorizer attribute 'theAuthKey', returning unauthorized.");
+#else
+                __context__.Logger.Log("Failed to convert authorizer attribute 'theAuthKey', returning unauthorized. Exception: " + e.ToString());


Redundant call to 'ToString' on a String object.

Copilot · 2026-02-04T14:56:14Z

Libraries/test/TestCustomAuthorizerApp/ProtectedFunction.cs

+                if (val is System.Text.Json.JsonElement jsonElement)
+                {
+                    context.Logger.LogLine($"  JsonElement.ValueKind: {jsonElement.ValueKind}");
+                    context.Logger.LogLine($"  JsonElement.ToString(): '{jsonElement.ToString()}'");


Redundant call to 'ToString' on a String object.

Copilot · 2026-02-04T14:56:14Z

Libraries/test/TestCustomAuthorizerApp/ProtectedFunction.cs

+        // Try to get context values if Lambda dictionary exists
+        if (request.RequestContext.Authorizer.Lambda != null)
+        {
+            var userId = request.RequestContext.Authorizer.Lambda.ContainsKey("userId") 


Inefficient use of 'ContainsKey' and indexer.

Copilot · 2026-02-04T14:56:14Z

Libraries/test/TestCustomAuthorizerApp/ProtectedFunction.cs

+            var userId = request.RequestContext.Authorizer.Lambda.ContainsKey("userId") 
+                ? request.RequestContext.Authorizer.Lambda["userId"]?.ToString() 
+                : "NOT_FOUND";
+            var tenantId = request.RequestContext.Authorizer.Lambda.ContainsKey("tenantId")


Inefficient use of 'ContainsKey' and indexer.

Copilot · 2026-02-04T14:56:14Z

Libraries/test/TestCustomAuthorizerApp/ProtectedFunction.cs

+            var tenantId = request.RequestContext.Authorizer.Lambda.ContainsKey("tenantId")
+                ? request.RequestContext.Authorizer.Lambda["tenantId"]?.ToString()
+                : "NOT_FOUND";
+            var userRole = request.RequestContext.Authorizer.Lambda.ContainsKey("userRole")


Inefficient use of 'ContainsKey' and indexer.

normj requested changes Mar 28, 2023

View reviewed changes

kabaluk requested a review from normj March 30, 2023 01:09

normj requested changes May 19, 2023

View reviewed changes

Libraries/src/Amazon.Lambda.Annotations.SourceGenerator/Templates/APIGatewaySetupParameters.tt Outdated Show resolved Hide resolved

ashishdhingra added module/aspnetcore-support p2 This is a standard priority issue feature-request A feature should be added or improved. queued labels Sep 1, 2023

kabaluk requested review from normj and philasmar September 3, 2023 20:26

GarrettBeatty changed the base branch from master to dev August 21, 2025 15:24

GarrettBeatty marked this pull request as draft January 28, 2026 16:51

Add FromCustomAuthorizer attribute with tests

48afb69

GarrettBeatty force-pushed the add-from-custom-authorizer-attribute branch from f14bd0b to 48afb69 Compare January 28, 2026 17:51

GarrettBeatty added 5 commits January 28, 2026 12:59

update readme

18b463c

add custom auth test app

5d718fa

update test app

4d0eeff

update getting value to just use tostring

35e3636

fix test

b7cb413

GarrettBeatty reviewed Jan 28, 2026

View reviewed changes

GarrettBeatty added 2 commits January 29, 2026 13:14

add IHttpResults

37dc685

update test app

20afc6c

GarrettBeatty requested a review from Copilot January 29, 2026 18:29

Copilot started reviewing on behalf of GarrettBeatty January 29, 2026 18:30 View session

Copilot AI reviewed Jan 29, 2026

View reviewed changes

add name fallback test

14352e5

GarrettBeatty requested a review from Copilot January 29, 2026 18:59

Copilot started reviewing on behalf of GarrettBeatty January 29, 2026 18:59 View session

Copilot AI reviewed Jan 29, 2026

View reviewed changes

GarrettBeatty added 4 commits January 30, 2026 15:10

Add IT tests

b2c1e28

it test updates

3d28316

it test updates

ac9d854

fix test

5869646

GarrettBeatty marked this pull request as ready for review February 2, 2026 19:40

GarrettBeatty reviewed Feb 2, 2026

View reviewed changes

remove old helpers

a46761f

normj reviewed Feb 2, 2026

View reviewed changes

GarrettBeatty added 5 commits February 3, 2026 11:39

add unit test for non string

432b057

update tests

2d6a110

logger

6cb4179

add debug logging

17a1a83

remove double test

f7680dd

GarrettBeatty requested review from Copilot and normj February 4, 2026 14:42

Copilot started reviewing on behalf of GarrettBeatty February 4, 2026 14:42 View session

Copilot AI reviewed Feb 4, 2026

View reviewed changes

GarrettBeatty added 3 commits February 4, 2026 09:58

fix test

2e8e4c8

fix count

a578285

latest template

409f92b

		# Response: "Hello user-12345! You are a admin in tenant 42."
		```

Added FromCustomAuthorizerAttribute and tests. #1466

Are you sure you want to change the base?

Added FromCustomAuthorizerAttribute and tests. #1466

Conversation

kabaluk commented Mar 26, 2023 • edited by GarrettBeatty Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Description: [FromCustomAuthorizer] Attribute Support

Summary

Usage

Supported API Types

Behavior

Testing

Uh oh!

normj left a comment

Choose a reason for hiding this comment

Uh oh!

kabaluk commented Mar 29, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kabaluk commented Mar 30, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kabaluk commented May 4, 2023

Uh oh!

kabaluk commented May 8, 2023

Uh oh!

normj commented May 9, 2023

Uh oh!

kabaluk commented May 9, 2023

Uh oh!

kabaluk commented May 11, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kabaluk commented May 18, 2023

Uh oh!

normj left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ashishdhingra commented Sep 1, 2023

Uh oh!

kabaluk commented Sep 3, 2023

Uh oh!

GarrettBeatty commented Jan 28, 2026

Uh oh!

GarrettBeatty Jan 28, 2026

Choose a reason for hiding this comment

Why We Need .ToString() for Custom Authorizer Values

The Data Flow

The Problem: Dictionary<string, object> Deserialization

Uh oh!

GarrettBeatty Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

normj Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

GarrettBeatty Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

GarrettBeatty Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

kabaluk commented Mar 26, 2023 •

edited by GarrettBeatty

Loading

PR Description: `[FromCustomAuthorizer]` Attribute Support

kabaluk commented Mar 29, 2023 •

edited

Loading

kabaluk commented Mar 30, 2023 •

edited

Loading

kabaluk commented May 11, 2023 •

edited

Loading

Why We Need `.ToString()` for Custom Authorizer Values

The Problem: `Dictionary<string, object>` Deserialization