update

docs/openapi/openapi-iam.yaml

@@ -4259,6 +4259,7 @@
               - ApiAuthorization: []
               x-amazon-apigateway-integration:
                 $ref: '#/components/x-amazon-apigateway-integrations/lambdaApi200'
+          /groups/{groupName}:
             delete:
               operationId: DeleteGroup
               summary: Delete Group

docs/openapi/openapi-jwt.yaml

@@ -4259,6 +4259,7 @@
               - ApiAuthorization: []
               x-amazon-apigateway-integration:
                 $ref: '#/components/x-amazon-apigateway-integrations/lambdaApi200'
+          /groups/{groupName}:
             delete:
               operationId: DeleteGroup
               summary: Delete Group

docs/openapi/openapi-key.yaml

@@ -4259,6 +4259,7 @@
               - ApiAuthorization: []
               x-amazon-apigateway-integration:
                 $ref: '#/components/x-amazon-apigateway-integrations/lambdaApi200'
+          /groups/{groupName}:
             delete:
               operationId: DeleteGroup
               summary: Delete Group

lambda-api-graalvm/src/main/resources/cloudformation/openapi-iam.yaml

@@ -4287,6 +4287,7 @@ Resources:
               - ApiAuthorization: []
               x-amazon-apigateway-integration:
                 $ref: "#/components/x-amazon-apigateway-integrations/lambdaApi200"
+          /groups/{groupName}:
             delete:
               operationId: DeleteGroup
               summary: Delete Group

lambda-api-graalvm/src/main/resources/cloudformation/openapi-jwt.yaml

@@ -4287,6 +4287,7 @@ Resources:
               - ApiAuthorization: []
               x-amazon-apigateway-integration:
                 $ref: "#/components/x-amazon-apigateway-integrations/lambdaApi200"
+          /groups/{groupName}:
             delete:
               operationId: DeleteGroup
               summary: Delete Group

lambda-api-graalvm/src/main/resources/cloudformation/openapi-key.yaml

@@ -4287,6 +4287,7 @@ Resources:
               - ApiAuthorization: []
               x-amazon-apigateway-integration:
                 $ref: "#/components/x-amazon-apigateway-integrations/lambdaApi200"
+          /groups/{groupName}:
             delete:
               operationId: DeleteGroup
               summary: Delete Group

lambda-api/src/main/java/com/formkiq/stacks/api/AbstractCoreRequestHandler.java

@@ -68,6 +68,7 @@
 import com.formkiq.stacks.api.handler.DocumentAttributesRequestHandler;
 import com.formkiq.stacks.api.handler.DocumentAttributesValueRequestHandler;
 import com.formkiq.stacks.api.handler.DocumentIdContentRequestHandler;
+import com.formkiq.stacks.api.handler.GroupRequestHandler;
 import com.formkiq.stacks.api.handler.GroupsUserRequestHandler;
 import com.formkiq.stacks.api.handler.PublicationsDocumentIdRequestHandler;
 import com.formkiq.stacks.api.handler.DocumentIdRequestHandler;
@@ -365,6 +366,7 @@ private static void addOnlyOfficeEndpoints() {
 
   private static void addGroupUsersEndpoints() {
     addRequestHandler(new GroupsRequestHandler());
+    addRequestHandler(new GroupRequestHandler());
     addRequestHandler(new GroupsUsersRequestHandler());
     addRequestHandler(new GroupsUserRequestHandler());
     addRequestHandler(new UsersRequestHandler());

lambda-api/src/main/java/com/formkiq/stacks/api/handler/GroupRequestHandler.java

@@ -0,0 +1,73 @@
+/**
+ * MIT License
+ * 
+ * Copyright (c) 2018 - 2020 FormKiQ
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ * 
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+package com.formkiq.stacks.api.handler;
+
+import com.amazonaws.services.lambda.runtime.LambdaLogger;
+import com.formkiq.aws.cognito.CognitoIdentityProviderService;
+import com.formkiq.aws.services.lambda.ApiAuthorization;
+import com.formkiq.aws.services.lambda.ApiGatewayRequestEvent;
+import com.formkiq.aws.services.lambda.ApiGatewayRequestEventUtil;
+import com.formkiq.aws.services.lambda.ApiGatewayRequestHandler;
+import com.formkiq.aws.services.lambda.ApiMapResponse;
+import com.formkiq.aws.services.lambda.ApiPermission;
+import com.formkiq.aws.services.lambda.ApiRequestHandlerResponse;
+import com.formkiq.module.lambdaservices.AwsServiceCache;
+
+import java.util.Map;
+import java.util.Optional;
+
+import static com.formkiq.aws.services.lambda.ApiResponseStatus.SC_OK;
+
+/** {@link ApiGatewayRequestHandler} for "/groups/{groupName}". */
+public class GroupRequestHandler implements ApiGatewayRequestHandler, ApiGatewayRequestEventUtil {
+
+  /** {@link GroupRequestHandler} URL. */
+  public static final String URL = "/groups/{groupName}";
+
+  @Override
+  public Optional<Boolean> isAuthorized(final AwsServiceCache awsServiceCache, final String method,
+      final ApiGatewayRequestEvent event, final ApiAuthorization authorization) {
+    boolean access = authorization.getPermissions().contains(ApiPermission.ADMIN);
+    return !"get".equalsIgnoreCase(method) ? Optional.of(access) : Optional.empty();
+  }
+
+  @Override
+  public String getRequestUrl() {
+    return URL;
+  }
+
+  @Override
+  public ApiRequestHandlerResponse delete(final LambdaLogger logger,
+      final ApiGatewayRequestEvent event, final ApiAuthorization authorization,
+      final AwsServiceCache awsservice) throws Exception {
+
+    String groupName = event.getPathParameters().get("groupName");
+    CognitoIdentityProviderService service =
+        awsservice.getExtension(CognitoIdentityProviderService.class);
+    service.deleteGroup(groupName);
+
+    ApiMapResponse resp = new ApiMapResponse(Map.of("message", "Group " + groupName + " deleted"));
+    return new ApiRequestHandlerResponse(SC_OK, resp);
+  }
+}

lambda-api/src/main/java/com/formkiq/stacks/api/handler/GroupsRequestHandler.java

@@ -103,20 +103,4 @@ public ApiRequestHandlerResponse post(final LambdaLogger logger,
         new ApiMapResponse(Map.of("message", "Group " + request.getGroupName() + " created"));
     return new ApiRequestHandlerResponse(SC_OK, resp);
   }
-
-  @Override
-  public ApiRequestHandlerResponse delete(final LambdaLogger logger,
-      final ApiGatewayRequestEvent event, final ApiAuthorization authorization,
-      final AwsServiceCache awsservice) throws Exception {
-
-    AddGroupRequest request = fromBodyToObject(event, AddGroupRequest.class);
-
-    CognitoIdentityProviderService service =
-        awsservice.getExtension(CognitoIdentityProviderService.class);
-    service.deleteGroup(request.getGroupName());
-
-    ApiMapResponse resp =
-        new ApiMapResponse(Map.of("message", "Group " + request.getGroupName() + " deleted"));
-    return new ApiRequestHandlerResponse(SC_OK, resp);
-  }
 }

lambda-api/src/test/java/com/formkiq/stacks/api/handler/CognitoRequestTest.java

@@ -264,4 +264,26 @@ public void testPutUserOperation01() {
           e.getResponseBody());
     }
   }
+
+  /**
+   * DELETE /groups/{groupName} only allowed by admin.
+   *
+   */
+  @Test
+  public void testDeleteGroup01() {
+    // given
+    setBearerToken("security");
+
+    // when
+    try {
+      this.userManagementApi.deleteGroup("test");
+      fail();
+    } catch (ApiException e) {
+      // then
+      assertEquals(ApiResponseStatus.SC_UNAUTHORIZED.getStatusCode(), e.getCode());
+      assertEquals(
+          "{\"message\":\"fkq access denied " + "(groups: security (DELETE,READ,WRITE))\"}",
+          e.getResponseBody());
+    }
+  }
 }