fix: Raise correct exception when Api authorizer identity is not a dict

samtranslator/model/apigateway.py

@@ -253,13 +253,24 @@ def __init__(  # type: ignore[no-untyped-def]
     ):
         if authorization_scopes is None:
             authorization_scopes = []
+
+        self.api_logical_id = api_logical_id
+        self.name = name
+        self.user_pool_arn = user_pool_arn
+        self.function_arn = function_arn
+        self.identity = identity
+        self.function_payload_type = function_payload_type
+        self.function_invoke_role = function_invoke_role
+        self.is_aws_iam_authorizer = is_aws_iam_authorizer
+        self.authorization_scopes = authorization_scopes
+
         if function_payload_type not in ApiGatewayAuthorizer._VALID_FUNCTION_PAYLOAD_TYPES:
             raise InvalidResourceException(
                 api_logical_id,
                 f"{name} Authorizer has invalid 'FunctionPayloadType': {function_payload_type}.",
             )
 
-        if function_payload_type == "REQUEST" and self._is_missing_identity_source(identity):  # type: ignore[no-untyped-call]
+        if function_payload_type == "REQUEST" and self._is_missing_identity_source(identity):
             raise InvalidResourceException(
                 api_logical_id,
                 f"{name} Authorizer must specify Identity with at least one "
@@ -269,20 +280,17 @@ def __init__(  # type: ignore[no-untyped-def]
         if authorization_scopes is not None and not isinstance(authorization_scopes, list):
             raise InvalidResourceException(api_logical_id, "AuthorizationScopes must be a list.")
 
-        self.api_logical_id = api_logical_id
-        self.name = name
-        self.user_pool_arn = user_pool_arn
-        self.function_arn = function_arn
-        self.identity = identity
-        self.function_payload_type = function_payload_type
-        self.function_invoke_role = function_invoke_role
-        self.is_aws_iam_authorizer = is_aws_iam_authorizer
-        self.authorization_scopes = authorization_scopes
-
-    def _is_missing_identity_source(self, identity):  # type: ignore[no-untyped-def]
+    def _is_missing_identity_source(self, identity: Dict[str, Any]) -> bool:
         if not identity:
             return True
 
+        if not isinstance(identity, dict):
+            # TODO: we should have a more centralized validation approach.
+            raise InvalidResourceException(
+                self.api_logical_id,
+                f"Invalid type for {self.name} Authorizer's Identity. It must be a dictionary.",
+            )
+
         headers = identity.get("Headers")
         query_strings = identity.get("QueryStrings")
         stage_variables = identity.get("StageVariables")
@@ -291,9 +299,11 @@ def _is_missing_identity_source(self, identity):  # type: ignore[no-untyped-def]
 
         required_properties_missing = not headers and not query_strings and not stage_variables and not context
 
+        if ttl is None:
+            return required_properties_missing
         try:
             ttl_int = int(ttl)
-        # this will catch if ttl is None and not convertable to an int
+        # this will catch if and not convertable to an int
         except (TypeError, ValueError):
             # previous behavior before trying to read ttl
             return required_properties_missing

tests/translator/input/error_api_authorizer_property_indentity_with_invalid_type.yaml

@@ -47,3 +47,14 @@ Resources:
             Identity: LambdaAuthorizationIdentity
             AuthorizerPayloadFormatVersion: 1.0
         DefaultAuthorizer: MyLambdaAuthUpdated
+
+  MyRestApi:
+    Type: AWS::Serverless::Api
+    Properties:
+      StageName: Stage name
+      Auth:
+        Authorizers:
+          LambdaRequestIdentityNotObject:
+            FunctionArn: Function.Arn
+            FunctionPayloadType: REQUEST
+            Identity: This should not be a string

tests/translator/output/error_api_authorizer_property_indentity_with_invalid_type.json

@@ -1,8 +1,3 @@
 {
-  "errorMessage": "Invalid Serverless Application Specification document. Number of errors found: 1. Resource with id [MyApi] is invalid. MyLambdaAuthUpdated Lambda Authorizer property 'identity' is of invalid type.",
-  "errors": [
-    {
-      "errorMessage": "Resource with id [MyApi] is invalid. MyLambdaAuthUpdated Lambda Authorizer property 'identity' is of invalid type."
-    }
-  ]
+  "errorMessage": "Invalid Serverless Application Specification document. Number of errors found: 2. Resource with id [MyApi] is invalid. MyLambdaAuthUpdated Lambda Authorizer property 'identity' is of invalid type. Resource with id [MyRestApi] is invalid. Invalid type for LambdaRequestIdentityNotObject Authorizer's Identity. It must be a dictionary."
 }