fix(authType): recognise the Event API Lambda authorizer identity

[bentsku]

Problem

util.authType() answers API Key Authorization for a request authorized by a Lambda authorizer on an Event API, where AWS answers Lambda Authorization.

An Event API populates ctx.identity with {"handlerContext": {...}} — an empty object when the authorizer returned no context — where a GraphQL API uses {"resolverContext": {...}}. Both are the authorizer's output under a different name, and AWS reports the same mode for both.

The Lambda entry of IDENTITY_SCHEMAS listed resolverContext alone. A key outside a schema rules that schema out rather than being ignored, so handlerContext ruled out every mode and the lookup fell through to its default.

What this does

Adds handlerContext to the Lambda schema's keys. required stays empty, so an identity carrying no keys at all remains a Lambda identity.

mode	key set	required
Lambda Authorization	resolverContext, handlerContext	none

The other three schemas are untouched: none of them can now match an identity they did not match before, since the only newly accepted key is one they all reject.

Tests

The two new cases are local assertions rather than checkResolverValid snapshots, and the comment on the block says why: EvaluateCode validates its mock context against the GraphQL identity keys and rejects one carrying handlerContext before the resolver ever runs —

The following properties in your mock context object failed validation: ctx.identity.

Probed directly: {handlerContext: {...}}, {handlerContext: {}}, {resolverContext, handlerContext} and an invented key all fail that way, while {resolverContext: {...}} evaluates and answers Lambda Authorization. So this shape is unreachable under TEST_TARGET=AWS_CLOUD and cannot be recorded here. The expected values were read off the responses of a real Lambda-authorized Event API on AWS instead.

For the same reason there is no case for the {resolverContext, handlerContext} mixture that the widened schema now accepts: no API emits it and EvaluateCode will not answer for it, so a test would pin invented behaviour.

Verification

• Both new cases fail with API Key Authorization when the index.js change is stashed, and pass with it.
• The 15 AWS-compared snapshots in authType.test.js were re-run against live AWS (TEST_TARGET=AWS_CLOUD, no -u): all pass and the snapshot file is unchanged.
• Full suite: 414 passed, 404 snapshots passed.

Released as v0.1.8.

🤖 Generated with Claude Code