feat: test lambda invoke v3

package.json

@@ -55,6 +55,7 @@
   },
   "dependencies": {
     "@aws-sdk/client-cloudwatch-logs": "^3.347.1",
+    "@aws-sdk/client-lambda": "^3.414.0",
     "@babel/runtime": "^7.20.13",
     "@faker-js/faker": "^8.0.1",
     "@joi/date": "^2.1.0",

src/app/config/config.ts

@@ -1,3 +1,4 @@
+import { Lambda } from '@aws-sdk/client-lambda'
 import aws from 'aws-sdk'
 import convict from 'convict'
 import { SessionOptions } from 'express-session'
@@ -89,10 +90,14 @@ const s3 = new aws.S3({
   s3ForcePathStyle: isDev ? true : undefined,
 })
 
+// using aws-sdk v3
+const virusScannerLambda = new Lambda({ region: basicVars.awsConfig.region })
+
 const awsConfig: AwsConfig = {
   ...s3BucketUrlVars,
   ...basicVars.awsConfig,
   s3,
+  virusScannerLambda,
 }
 
 let dbUri: string | undefined

src/app/config/schema.ts

@@ -273,6 +273,12 @@ export const optionalVarsSchema: Schema<IOptionalVarsSchema> = {
       default: '',
       env: 'CUSTOM_CLOUDWATCH_LOG_GROUP',
     },
+    virusScannerLambdaFunctionName: {
+      doc: 'Virus scanner lambda function name',
+      format: String,
+      default: '',
+      env: 'VIRUS_SCANNER_LAMBDA_FUNCTION_NAME',
+    },
   },
   core: {
     port: {

src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts

@@ -634,6 +634,7 @@ export const handleStorageSubmission = [
   EncryptSubmissionMiddleware.validateStorageSubmissionParams,
   EncryptSubmissionMiddleware.createFormsgAndRetrieveForm,
   EncryptSubmissionMiddleware.checkNewBoundaryEnabled,
+  EncryptSubmissionMiddleware.checkAttachmentQuarantineKeys,
   EncryptSubmissionMiddleware.validateStorageSubmission,
   EncryptSubmissionMiddleware.encryptSubmission,
   submitEncryptModeForm,

src/app/modules/submission/encrypt-submission/encrypt-submission.middleware.ts

@@ -31,7 +31,10 @@ import {
   EncryptedPayloadExistsError,
   FormsgReqBodyExistsError,
 } from './encrypt-submission.errors'
-import { checkFormIsEncryptMode } from './encrypt-submission.service'
+import {
+  checkFormIsEncryptMode,
+  triggerVirusScanning,
+} from './encrypt-submission.service'
 import {
   CreateFormsgAndRetrieveFormMiddlewareHandlerRequest,
   CreateFormsgAndRetrieveFormMiddlewareHandlerType,
@@ -176,6 +179,58 @@ export const checkNewBoundaryEnabled = async (
   return next()
 }
 
+/**
+ * Guardrail to prevent virus scanner code from being run if not enabled on frontend.
+ * TODO (FRM-1232): remove this guardrail when encryption boundary is shifted.
+ */
+export const checkAttachmentQuarantineKeys = async (
+  req: StorageSubmissionMiddlewareHandlerRequest,
+  res: Parameters<StorageSubmissionMiddlewareHandlerType>[1],
+  next: NextFunction,
+) => {
+  const logMeta = {
+    action: 'checkAttachmentQuarantineKeys',
+    ...createReqMeta(req),
+  }
+
+  // Step 1: If virus scanner is not enabled, skip this middleware.
+
+  const virusScannerEnabled = req.formsg.featureFlags.includes(
+    featureFlags.encryptionBoundaryShiftVirusScanner,
+  )
+
+  if (!virusScannerEnabled) {
+    logger.warn({
+      message: 'Virus scanner is not enabled.',
+      meta: logMeta,
+    })
+
+    return next()
+  }
+
+  // // Step 2: If virus scanner is enabled, check if quarantine keys for attachments are present. Quarantine keys
+  // // should only be present if the virus scanner is enabled on the frontend.
+  // // If not, skip this middleware.
+
+  // let quarantineKeysPresent = false
+
+  // for (const response of req.body.responses) {
+  //   if (isQuarantinedAttachmentResponse(response)) quarantineKeysPresent = true
+  // }
+
+  // if (!quarantineKeysPresent) return next()
+
+  // At this point, virus scanner is enabled and quarantine keys are present. This means that both the FE and BE
+  // have virus scanning enabled.
+
+  // Step 3: Trigger lambda to scan attachments.
+  triggerVirusScanning('16ca3303-743a-4cec-ab20-3d10042d88ce')
+
+  // Step 4: Retrieve attachments from the clean bucket.
+
+  return next()
+}
+
 /**
  * Validates storage submissions to the new endpoint (/api/v3/forms/:formId/submissions/storage).
  * This uses the same validators as email mode submissions.

src/app/modules/submission/encrypt-submission/encrypt-submission.service.ts

@@ -578,3 +578,30 @@ export const getQuarantinePresignedPostData = (
     }),
   )
 }
+
+export const triggerVirusScanning = (quarantineFileKey: string) => {
+  return AwsConfig.virusScannerLambda.invoke(
+    {
+      FunctionName: AwsConfig.virusScannerLambdaFunctionName,
+      Payload: JSON.stringify({ key: quarantineFileKey }),
+    },
+    (error, data) => {
+      if (error) {
+        logger.error({
+          message: 'Error invoking lambda function',
+          meta: {
+            action: 'triggerVirusScanning',
+          },
+          error,
+        })
+      }
+      logger.info({
+        message: 'Successfully invoked lambda function',
+        meta: {
+          action: 'triggerVirusScanning',
+          data,
+        },
+      })
+    },
+  )
+}

src/app/modules/submission/submission.utils.ts

@@ -195,6 +195,18 @@ export const isAttachmentResponse = (
   )
 }
 
+/**
+ * Checks if a response is a quarantined attachment response to be processed by the virus scanner.
+ */
+export const isQuarantinedAttachmentResponse = (
+  response: ParsedClearFormFieldResponse,
+): response is ParsedClearAttachmentResponse => {
+  return (
+    response.fieldType === BasicField.Attachment &&
+    response.fileKey !== undefined
+  )
+}
+
 /**
  * Checks an array of attachments to see ensure that every
  * one of them is valid. The validity is determined by an

src/types/api/submission.ts

@@ -6,6 +6,7 @@ import { AttachmentResponse, FieldResponse } from '../../../shared/types'
 export type ParsedClearAttachmentResponse = AttachmentResponse & {
   filename: string
   content: Buffer
+  fileKey?: string
 }
 
 export type ParsedClearFormFieldResponse =

src/types/config.ts

@@ -1,3 +1,4 @@
+import { Lambda } from '@aws-sdk/client-lambda'
 import { PackageMode } from '@opengovsg/formsg-sdk/dist/types'
 import aws from 'aws-sdk'
 import { SessionOptions } from 'express-session'
@@ -39,6 +40,8 @@ export type AwsConfig = {
   virusScannerCleanS3Bucket: string
   s3: aws.S3
   endPoint: string
+  virusScannerLambda: Lambda // using aws-sdk-v3
+  virusScannerLambdaFunctionName: string
 }
 
 export type MailConfig = {
@@ -159,6 +162,7 @@ export interface IOptionalVarsSchema {
   awsConfig: {
     region: string
     customCloudWatchGroup: string
+    virusScannerLambdaFunctionName: string
   }
   mail: {
     from: string