@aws-cdk/aws-apigatewayv2-authorizers-alpha: can't apply lambda defaultAuthorizer

[uttrasey]

Describe the bug

Hey 👋

I can't assign a defaultAuthorizer to all routes on a HttpAPI. cdk deploy runs with no problems but it's not created.

    // build a lambda - this gets created ✅
    const authLambda = new lambdaNodejs.NodejsFunction(this, 'auth-lambda', {
      entry: './src/custom-auth-lambda.ts',
      handler: 'handler',
      runtime: lambda.Runtime.NODEJS_18_X,
      environment: {
        NODE_OPTIONS: '--enable-source-maps',
      },
    });

    // Authorizer Target - this does not show up in API authorizer list ❌
    const lambdaAuthorizer = new HttpLambdaAuthorizer('MyAuthorizer', authLambda, {
      responseTypes: [HttpLambdaResponseType.SIMPLE], 
    });

    // the API - none of the subsequently deployed routes are authorized ❌
    const httpApi = new apigwv2alpha.HttpApi(this, 'my-http-api', {
      apiName: 'my-api',
      createDefaultStage: true,
      defaultDomainMapping: {
        domainName: domain,
      },
      defaultAuthorizer: lambdaAuthorizer
    });

    // Add a route... this is done in another part of the app. Route created but not auth'd ❌
    const route = new apigwv2alpha.HttpRoute(this, 'my-route', {
      httpApi: httpApi,
      routeKey: apigwv2alpha.HttpRouteKey.with('/v1/mything/{proxy+}', apigwv2alpha.HttpMethod.ANY),
      integration: new HttpAlbIntegration('my-app-private-integration', props.service.listener, {
        vpcLink: vpcLink
      })
    })

Expected Behavior

I'd expect the created route to be authorized by my lambda

Current Behavior

No authorizer either in AWS console or in practice. No authorizer listed under manage Authorizers for the API either

Reproduction Steps

See above

Possible Solution

Not sure

Additional Information/Context

{
  "devDependencies": {
    "@aws-cdk/aws-apigatewayv2-alpha": "^2.99.1-alpha.0",
    "@aws-cdk/aws-apigatewayv2-authorizers-alpha": "^2.99.1-alpha.0",
    "@aws-cdk/aws-apigatewayv2-integrations-alpha": "^2.99.1-alpha.0",
    "@types/aws-lambda": "^8.10.123",
    "@types/jest": "^29.5.4",
    "@types/node": "20.5.9",
    "aws-cdk": "2.96.2",
    "aws-cdk-lib": "2.99.1",
    "constructs": "^10.0.0",
    "jest": "^29.6.4",
    "source-map-support": "^0.5.21",
    "ts-jest": "^29.1.1",
    "ts-node": "^10.9.1",
    "typescript": "~5.2.2"
  },
  "dependencies": {
    "aws-lambda": "^1.0.7"
  }
}

CDK CLI Version

2.99.1 (build b2a895e)

Framework Version

No response

Node.js Version

18

OS

MAC

Language

TypeScript

Language Version

No response

Other information

No response

[indrora]

This is interesting:

If there is no authorizer defined in the HttpRoute props, the constructor never stops to check if the associated HttpApi has a default authorizer:

https://github.com/aws/aws-cdk/blob/b2a895ef285e5451e64c21e179172e998c479582/packages/%40aws-cdk/aws-apigatewayv2-alpha/lib/http/route.ts#L196C1-L200C1

https://github.com/aws/aws-cdk/blob/b2a895ef285e5451e64c21e179172e998c479582/packages/%40aws-cdk/aws-apigatewayv2-alpha/lib/http/route.ts#L218C1-L226C1

[rix0rrr]

Looks like defaultAuthorizer is only respected if you call httpApi.addRoutes(), not if you use new apigwv2alpha.HttpRoute().

aws-cdk/packages/@aws-cdk/aws-apigatewayv2-alpha/lib/http/api.ts

Line 462 in b2a895e

authorizer: options.authorizer ?? this.defaultAuthorizer,

Would make sense to fix, I think. This is unexpected behavior.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.