fix(local-apigw): treat authorizer resource ARNs as literals, not regex

[devteamaegis]

What's broken

sam local start-api returns 403 for requests a Lambda authorizer explicitly allows, whenever the resource ARN contains a regex metacharacter. The everyday case is the HTTP API $default stage:

# authorizer handler
return {"principalId": "user", "policyDocument": {"Statement": [{
    "Action": "execute-api:Invoke", "Effect": "Allow",
    "Resource": "arn:aws:execute-api:us-east-1:123456789012:abc123/$default/*",
}]}}

$ sam local start-api
$ curl localhost:3000/hello
{"message":"User is not authorized to access this resource"}

It fails even when the authorizer echoes back the exact methodArn it was handed — the most common example in AWS's own docs. Deployed API Gateway allows the same request, so this is a pure local/deployed divergence.

A [ or ( in the path is worse — the request dies with re.PatternError: unterminated character set.

Why it happens

_is_resource_authorized builds a regex directly from the ARN, escaping nothing but the wildcards:

regex_method_arn = resource_arn.replace("*", ".*").replace("?", ".")
regex_method_arn += "$"

So $ becomes an end-of-string anchor, . matches any character, and [ / ( are unbalanced syntax.

The fix

re.escape() the ARN first, then translate the two IAM wildcards:

regex_method_arn = re.escape(resource_arn).replace(r"\*", ".*").replace(r"\?", ".")

* and ? keep working; everything else in the ARN is matched literally. This also stops . from over-matching — .../GET/a.c no longer authorizes .../GET/abc.

The test

test_is_resource_authorized_treats_arn_as_literal in tests/unit/local/apigw/test_lambda_authorizer.py — six cases covering $default, an echoed method ARN, [, (, literal ., and a stage that should still be denied. Five of six fail on develop:

$ pytest tests/unit/local/apigw/test_lambda_authorizer.py -k treats_arn_as_literal   # before
5 failed, 1 passed

$ pytest tests/unit/local/apigw                                                      # after
286 passed

black --check clean on both files.