AWS API Gateway

Client -> API Gateway -> Lambda authorizer -> Fairvisor /v1/decision
                                  | allow
                                  v
                               Backend integration
                                  | reject
                                  v
                              429 to client

export const handler = async (event) => {
  const method = event.requestContext?.http?.method || event.httpMethod || "GET";
  const path = event.rawPath || event.path || "/";
  const query = event.rawQueryString ? `?${event.rawQueryString}` : "";
  const originalUri = `${path}${query}`;

  const headers = {
    "X-Original-Method": method,
    "X-Original-URI": originalUri,
  };

  const auth = event.headers?.authorization || event.headers?.Authorization;
  if (auth) headers.Authorization = auth;

  const ip = event.requestContext?.http?.sourceIp || event.requestContext?.identity?.sourceIp;
  if (ip) headers["X-Forwarded-For"] = ip;

  const res = await fetch(`${process.env.FAIRVISOR_EDGE_URL}/v1/decision`, {
    method: "POST",
    headers,
  });

  if (res.status === 429) {
    return {
      isAuthorized: false,
      context: {
        fairvisor_reason: res.headers.get("x-fairvisor-reason") || "rate_limited",
        retry_after: res.headers.get("retry-after") || "1",
      },
    };
  }

  if (!res.ok) {
    // choose route policy: fail-open or fail-closed
    return { isAuthorized: false };
  }

  return { isAuthorized: true };
};