foam-proxy

Lambda which supports authentication proxying for foam app

Tech stack

• AWS Lambda
• Terraform
• git-cliff for changelog and version bumps

Run locally

The Lambdas are standard aws-lambda-go handlers, run locally under the AWS Lambda Runtime Interface Emulator (needs Docker).

cp .env.local.example .env.local   # fill in TWITCH_CLIENT_ID/SECRET etc.
make run-local                     # starts the proxy on :9000 (leave running)

In another shell, POST an event fixture from events/:

make invoke-local                              # defaults to events/proxy-healthcheck.json
make invoke-local EVENT=events/proxy-version.json

Run a different Lambda with CMD (both targets):

make CMD=authorizer run-local
make CMD=authorizer invoke-local EVENT=events/authorizer.json

For pure logic changes the tests are the faster loop: TWITCH_CLIENT_ID=x TWITCH_CLIENT_SECRET=y go test ./...

Changelog & version

Changelog is generated from conventional commits. On push to main, the Changelog workflow updates CHANGELOG.md and commits it.

uv tool install pre-commit
uv tool install commitizen
pre-commit install
pre-commit install --hook-type commit-msg

App Review magic link keepalive

The /api/magic route serves a session token to App Store reviewers. Its blob lives in SSM and is rotated automatically by the scheduled magic-keepalive Lambda. Use scripts/setup-magic-link.sh (run -h for flags) — it only prints values, you store them.

Add (one env at a time):

scripts/setup-magic-link.sh --env <prod|staging>   # mints token, prints blob + gate key

• magic_link_blob → GitHub secret MAGIC_LINK_BLOB_<ENV> — store the raw JSON only ({"access_token":…}), no surrounding quotes. The secret is passed verbatim into SSM as TF_VAR_magic_link_blob; wrapping quotes get stored literally, break ParseMagicLink, and make /api/magic 404.
• magic_link_api_key → 1Password op://ci-cd/foam-proxy-<env>/MAGIC_LINK_API_KEY (distinct per env)
• Run Deploy <env> with reviewer_account_refresh_enabled = true (seeds SSM, serves /api/magic, starts the schedule), then verify:

MAGIC_LINK_API_KEY=<key> scripts/setup-magic-link.sh --verify --env <prod|staging>

Update: the keepalive Lambda refreshes the token on a schedule — no action needed. To rotate manually (e.g. account/scopes changed), re-run --env <env>, overwrite the GitHub secret, and re-deploy.

Remove: re-run Deploy <env> with reviewer_account_refresh_enabled = false (tears down the SSM blob + schedule, 404s the route), then:

scripts/setup-magic-link.sh --teardown

Finally delete the stored secrets (GitHub MAGIC_LINK_BLOB_*, 1Password gate keys) or the next deploy revives the route.