feat(events): AppSync Events Library

.github/workflows/release_pr.yml

@@ -9,6 +9,7 @@ on:
         options:
           - AmplifyAndroid
           - ApolloExtensions
+          - AppSyncEvents
       release_tag:
         description: 'Previous Release Tag'
         required: false

.gitignore

@@ -98,6 +98,8 @@ __pycache__/
 #amplify
 .amplify/
 amplify/
+#keep amplify gen2 backend projects
+!**/androidTest/backend/amplify/
 build/
 dist/
 node_modules/

appsync/CHANGELOG.md

@@ -0,0 +1,3 @@
+# Release 1.0.0
+
+Initial Release

appsync/README.md

@@ -0,0 +1,43 @@
+<img src="https://s3.amazonaws.com/aws-mobile-hub-images/aws-amplify-logo.png" alt="AWS Amplify" width="225">
+
+---
+
+# AWS AppSync Events for Android
+
+These libraries allow you to connect to [AWS AppSync Events](https://docs.aws.amazon.com/appsync/latest/eventapi/event-api-welcome.html).
+AWS AppSync Events lets you create secure and performant serverless WebSocket APIs that can broadcast real-time event data to millions of subscribers, without you having to manage connections or resource scaling. With this feature, you can build multi-user features such as a collaborative document editors, chat apps, and live polling systems.
+
+Learn more about AWS AppSync Events by visiting the [Developer Guide](https://docs.aws.amazon.com/appsync/latest/eventapi/event-api-welcome.html).
+
+There are two libraries available:
+
+- `aws-sdk-appsync-events`: This is a standalone library that allows developers to connect to AWS AppSync Events. It does not depend on Amplify, and instead leaves it to the application developer to supply tokens or signatures when using Owner or IAM-based authorization. This is the recommended library if your application does not already use Amplify.
+- `aws-sdk-appsync-amplify`: This library depends on `Amplify Android`, and contains some glue classes to use Amplify to implement the authorizers for `aws-sdk-appsync-events`. This additional library is recommended if your application is already using Amplify, and you want to authorize calls with AWS Cognito User Pool tokens or IAM.
+
+## Installation
+
+Add the dependency you prefer to your `build.gradle.kts` file.
+
+```kotlin
+// Standalone AWS AppSync Events library that does not require Amplify
+implementation("com.amazonaws:aws-sdk-appsync-events:1.0.0")
+
+// Allows Amplify to Authorize Events calls through UserPool tokens or IAM
+implementation("com.amazonaws:aws-sdk-appsync-amplify:1.0.0")
+```
+
+## Usage Guide
+
+See [AWS AppSync Events for Android Documentation](https://docs.amplify.aws/android/build-a-backend/data/connect-event-api/) for a complete implementation guide.
+
+## Contributing
+
+- [CONTRIBUTING.md](../CONTRIBUTING.md)
+
+## Security
+
+See [CONTRIBUTING](../CONTRIBUTING.md#security-issue-notifications) for more information.
+
+## License
+
+This project is licensed under the Apache-2.0 License.

appsync/aws-sdk-appsync-amplify/.gitignore

@@ -0,0 +1 @@
+/build

appsync/aws-sdk-appsync-amplify/api/aws-sdk-appsync-amplify.api

@@ -0,0 +1,18 @@
+public final class com/amazonaws/sdk/appsync/amplify/BuildConfig {
+	public static final field BUILD_TYPE Ljava/lang/String;
+	public static final field DEBUG Z
+	public static final field LIBRARY_PACKAGE_NAME Ljava/lang/String;
+	public static final field VERSION_NAME Ljava/lang/String;
+	public fun <init> ()V
+}
+
+public final class com/amazonaws/sdk/appsync/amplify/authorizers/AmplifyIamAuthorizer : com/amazonaws/sdk/appsync/core/AppSyncAuthorizer {
+	public fun <init> (Ljava/lang/String;)V
+	public fun getAuthorizationHeaders (Lcom/amazonaws/sdk/appsync/core/AppSyncRequest;Lkotlin/coroutines/Continuation;)Ljava/lang/Object;
+}
+
+public final class com/amazonaws/sdk/appsync/amplify/authorizers/AmplifyUserPoolAuthorizer : com/amazonaws/sdk/appsync/core/AppSyncAuthorizer {
+	public fun <init> ()V
+	public fun getAuthorizationHeaders (Lcom/amazonaws/sdk/appsync/core/AppSyncRequest;Lkotlin/coroutines/Continuation;)Ljava/lang/Object;
+}
+

appsync/aws-sdk-appsync-amplify/build.gradle.kts

@@ -0,0 +1,50 @@
+/*
+ * Copyright 2025 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License").
+ * You may not use this file except in compliance with the License.
+ * A copy of the License is located at
+ *
+ *  http://aws.amazon.com/apache2.0
+ *
+ * or in the "license" file accompanying this file. This file is distributed
+ * on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
+ * express or implied. See the License for the specific language governing
+ * permissions and limitations under the License.
+ */
+
+import java.util.Properties
+
+plugins {
+    id("com.android.library")
+    id("kotlin-android")
+}
+
+apply(from = rootProject.file("configuration/publishing.gradle"))
+
+fun readVersion() = Properties().run {
+    file("../version.properties").inputStream().use { load(it) }
+    get("VERSION_NAME").toString()
+}
+
+project.setProperty("VERSION_NAME", readVersion())
+group = properties["POM_GROUP"].toString()
+
+android {
+    namespace = "com.amazonaws.sdk.appsync.amplify"
+}
+
+dependencies {
+
+    api(project(":aws-sdk-appsync-core"))
+    api(project(":core"))
+
+    implementation(project(":aws-auth-cognito"))
+    implementation(project(":aws-core"))
+    implementation(libs.aws.signing)
+
+    testImplementation(libs.test.junit)
+    testImplementation(libs.test.mockk)
+    testImplementation(libs.test.kotlin.coroutines)
+    testImplementation(libs.test.kotest.assertions)
+}

appsync/aws-sdk-appsync-amplify/gradle.properties

@@ -0,0 +1,5 @@
+POM_GROUP=com.amazonaws
+POM_ARTIFACT_ID=aws-sdk-appsync-amplify
+POM_NAME=Amplify Extensions for AWS AppSync
+POM_DESCRIPTION=Amplify Extensions for AWS AppSync
+POM_PACKAGING=aar

appsync/aws-sdk-appsync-amplify/src/main/java/com/amazonaws/sdk/appsync/amplify/authorizers/AmplifyIamAuthorizer.kt

@@ -0,0 +1,37 @@
+/*
+ * Copyright 2025 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License").
+ * You may not use this file except in compliance with the License.
+ * A copy of the License is located at
+ *
+ *  http://aws.amazon.com/apache2.0
+ *
+ * or in the "license" file accompanying this file. This file is distributed
+ * on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
+ * express or implied. See the License for the specific language governing
+ * permissions and limitations under the License.
+ */
+package com.amazonaws.sdk.appsync.amplify.authorizers
+
+import com.amazonaws.sdk.appsync.amplify.util.AppSyncRequestSigner
+import com.amazonaws.sdk.appsync.core.AppSyncAuthorizer
+import com.amazonaws.sdk.appsync.core.AppSyncRequest
+import com.amazonaws.sdk.appsync.core.authorizers.IamAuthorizer
+import org.jetbrains.annotations.VisibleForTesting
+
+/**
+ * Authorizer implementation that provides IAM signing through Amplify & AWS Kotlin SDK (Smithy).
+ */
+class AmplifyIamAuthorizer @VisibleForTesting internal constructor(
+    private val region: String,
+    private val requestSigner: AppSyncRequestSigner
+) : AppSyncAuthorizer {
+
+    constructor(region: String) : this(region, requestSigner = AppSyncRequestSigner())
+
+    private val iamAuthorizer = IamAuthorizer { requestSigner.signAppSyncRequest(it, region) }
+
+    override suspend fun getAuthorizationHeaders(request: AppSyncRequest) =
+        iamAuthorizer.getAuthorizationHeaders(request)
+}

appsync/aws-sdk-appsync-amplify/src/main/java/com/amazonaws/sdk/appsync/amplify/authorizers/AmplifyUserPoolAuthorizer.kt

@@ -0,0 +1,55 @@
+/*
+ * Copyright 2025 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License").
+ * You may not use this file except in compliance with the License.
+ * A copy of the License is located at
+ *
+ *  http://aws.amazon.com/apache2.0
+ *
+ * or in the "license" file accompanying this file. This file is distributed
+ * on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
+ * express or implied. See the License for the specific language governing
+ * permissions and limitations under the License.
+ */
+package com.amazonaws.sdk.appsync.amplify.authorizers
+
+import com.amazonaws.sdk.appsync.core.AppSyncAuthorizer
+import com.amazonaws.sdk.appsync.core.AppSyncRequest
+import com.amazonaws.sdk.appsync.core.authorizers.AuthTokenAuthorizer
+import com.amplifyframework.auth.AuthCredentialsProvider
+import com.amplifyframework.auth.CognitoCredentialsProvider
+import kotlin.coroutines.resume
+import kotlin.coroutines.resumeWithException
+import kotlin.coroutines.suspendCoroutine
+import org.jetbrains.annotations.VisibleForTesting
+
+/**
+ * Authorizer implementation that provides Cognito User Pool tokens via Amplify Auth.
+ */
+class AmplifyUserPoolAuthorizer @VisibleForTesting internal constructor(
+    private val accessTokenProvider: AccessTokenProvider
+) : AppSyncAuthorizer {
+
+    constructor() : this(accessTokenProvider = AccessTokenProvider())
+
+    private val authTokenAuthorizer = AuthTokenAuthorizer(
+        fetchLatestAuthToken = accessTokenProvider::fetchLatestCognitoAuthToken
+    )
+
+    override suspend fun getAuthorizationHeaders(request: AppSyncRequest) =
+        authTokenAuthorizer.getAuthorizationHeaders(request)
+}
+
+internal class AccessTokenProvider(
+    private val credentialsProvider: AuthCredentialsProvider = CognitoCredentialsProvider()
+) {
+    suspend fun fetchLatestCognitoAuthToken() = credentialsProvider.getAccessToken()
+
+    private suspend fun AuthCredentialsProvider.getAccessToken() = suspendCoroutine { continuation ->
+        getAccessToken(
+            { token -> continuation.resume(token) },
+            { error -> continuation.resumeWithException(error) }
+        )
+    }
+}

appsync/aws-sdk-appsync-amplify/src/main/java/com/amazonaws/sdk/appsync/amplify/util/AppSyncRequestSigner.kt

@@ -0,0 +1,89 @@
+/*
+ * Copyright 2025 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License").
+ * You may not use this file except in compliance with the License.
+ * A copy of the License is located at
+ *
+ *  http://aws.amazon.com/apache2.0
+ *
+ * or in the "license" file accompanying this file. This file is distributed
+ * on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
+ * express or implied. See the License for the specific language governing
+ * permissions and limitations under the License.
+ */
+package com.amazonaws.sdk.appsync.amplify.util
+
+import aws.smithy.kotlin.runtime.InternalApi
+import aws.smithy.kotlin.runtime.auth.awscredentials.Credentials
+import aws.smithy.kotlin.runtime.auth.awssigning.AwsSignedBodyHeader
+import aws.smithy.kotlin.runtime.auth.awssigning.AwsSigner
+import aws.smithy.kotlin.runtime.auth.awssigning.AwsSigningConfig
+import aws.smithy.kotlin.runtime.auth.awssigning.DefaultAwsSigner
+import aws.smithy.kotlin.runtime.http.Headers
+import aws.smithy.kotlin.runtime.http.HttpBody
+import aws.smithy.kotlin.runtime.http.request.HttpRequest
+import aws.smithy.kotlin.runtime.http.toHttpBody
+import aws.smithy.kotlin.runtime.net.url.Url
+import com.amazonaws.sdk.appsync.core.AppSyncRequest
+import com.amplifyframework.auth.AuthCredentialsProvider
+import com.amplifyframework.auth.CognitoCredentialsProvider
+
+internal class AppSyncRequestSigner(
+    private val credentialsProvider: AuthCredentialsProvider = CognitoCredentialsProvider(),
+    private val awsSigner: AwsSigner = DefaultAwsSigner
+) {
+
+    suspend fun signAppSyncRequest(request: AppSyncRequest, region: String): Map<String, String> {
+        // First translate the Apollo request to a Smithy request so it can be signed
+        val smithyRequest = request.toSmithyRequest()
+
+        // Sign the Smithy request
+        val signedRequest = signRequest(
+            awsRegion = region,
+            credentials = credentialsProvider.resolve(),
+            service = "appsync",
+            request = smithyRequest
+        )
+
+        // Return the headers from the signed request
+        return signedRequest.headers.entries().associate { it.key to it.value.first() }
+    }
+
+    @OptIn(InternalApi::class)
+    private suspend fun signRequest(
+        awsRegion: String,
+        credentials: Credentials,
+        service: String,
+        request: HttpRequest
+    ): HttpRequest {
+        val signingConfig = AwsSigningConfig {
+            region = awsRegion
+            useDoubleUriEncode = true
+            this.service = service
+            this.credentials = credentials
+            signedBodyHeader = AwsSignedBodyHeader.X_AMZ_CONTENT_SHA256
+        }
+
+        // Generate the signature for the smithy request
+        return awsSigner.sign(request, signingConfig).output
+    }
+
+    private fun AppSyncRequest.toSmithyRequest() = HttpRequest(
+        method = method.toSmithyMethod(),
+        url = Url.parse(url),
+        headers = createSmithyHeaders(headers),
+        body = body?.toHttpBody() ?: HttpBody.Empty
+    )
+
+    private fun AppSyncRequest.HttpMethod.toSmithyMethod() = when (this) {
+        AppSyncRequest.HttpMethod.GET -> aws.smithy.kotlin.runtime.http.HttpMethod.GET
+        AppSyncRequest.HttpMethod.POST -> aws.smithy.kotlin.runtime.http.HttpMethod.POST
+    }
+
+    private fun createSmithyHeaders(headers: Map<String, String>) = Headers {
+        headers.forEach {
+            this.append(it.key, it.value)
+        }
+    }
+}

appsync/aws-sdk-appsync-amplify/src/test/java/com/amazonaws/sdk/appsync/amplify/authorizers/AmplifyIamAuthorizerTest.kt

@@ -0,0 +1,58 @@
+/*
+ * Copyright 2025 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License").
+ * You may not use this file except in compliance with the License.
+ * A copy of the License is located at
+ *
+ *  http://aws.amazon.com/apache2.0
+ *
+ * or in the "license" file accompanying this file. This file is distributed
+ * on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
+ * express or implied. See the License for the specific language governing
+ * permissions and limitations under the License.
+ */
+package com.amazonaws.sdk.appsync.amplify.authorizers
+
+import com.amazonaws.sdk.appsync.amplify.util.AppSyncRequestSigner
+import com.amazonaws.sdk.appsync.core.AppSyncRequest
+import io.kotest.assertions.throwables.shouldThrow
+import io.kotest.matchers.maps.shouldContainExactly
+import io.mockk.coEvery
+import io.mockk.mockk
+import kotlinx.coroutines.test.runTest
+import org.junit.Test
+
+class AmplifyIamAuthorizerTest {
+    private val region = "us-east-1"
+
+    @Test
+    fun `iam authorizer gets token from amplify`() = runTest {
+        val request = mockk<AppSyncRequest>()
+        val signer = mockk<AppSyncRequestSigner> {
+            coEvery {
+                signAppSyncRequest(request, region)
+            } returns mapOf("Authorization" to "test-signature")
+        }
+
+        val authorizer = AmplifyIamAuthorizer(region, signer)
+
+        authorizer.getAuthorizationHeaders(request) shouldContainExactly mapOf("Authorization" to "test-signature")
+    }
+
+    @Test
+    fun `iam authorizer throws if failed to fetch token from amplify`() = runTest {
+        val request = mockk<AppSyncRequest>()
+        val signer = mockk<AppSyncRequestSigner> {
+            coEvery {
+                signAppSyncRequest(request, region)
+            } throws IllegalStateException()
+        }
+
+        val authorizer = AmplifyIamAuthorizer(region, signer)
+
+        shouldThrow<IllegalStateException> {
+            authorizer.getAuthorizationHeaders(request)
+        }
+    }
+}