From 274a9c0868c318b155ec7a461ac2b5b120d41f2b Mon Sep 17 00:00:00 2001
From: Henry <5065089+nguyengg@users.noreply.github.com>
Date: Mon, 23 Feb 2026 09:02:20 -0800
Subject: [PATCH] Update AppSync Lambda authorisation request/response schema

See
https://docs.aws.amazon.com/appsync/latest/eventapi/configure-event-api-auth.html#aws-lambda-authorization
for documentation on the `requestHeaders` on incoming request and
`handlerContext` on the response.
---
 events/appsync.go                                 | 2 ++
 events/testdata/appsync-lambda-auth-request.json  | 3 +++
 events/testdata/appsync-lambda-auth-response.json | 4 ++++
 3 files changed, 9 insertions(+)

diff --git a/events/appsync.go b/events/appsync.go
index 37682b9e..23529922 100644
--- a/events/appsync.go
+++ b/events/appsync.go
@@ -45,6 +45,7 @@ const (
 type AppSyncLambdaAuthorizerRequest struct {
 	AuthorizationToken string                                `json:"authorizationToken"`
 	RequestContext     AppSyncLambdaAuthorizerRequestContext `json:"requestContext"`
+	RequestHeaders     map[string]string                     `json:"requestHeaders"`
 }
 
 // AppSyncLambdaAuthorizerRequestContext contains the parameters of the AppSync invocation which triggered
@@ -61,6 +62,7 @@ type AppSyncLambdaAuthorizerRequestContext struct {
 // AppSyncLambdaAuthorizerResponse represents the expected format of an authorization response to AppSync.
 type AppSyncLambdaAuthorizerResponse struct {
 	IsAuthorized    bool                   `json:"isAuthorized"`
+	HandlerContext  map[string]string      `json:"handlerContext,omitempty"`
 	ResolverContext map[string]interface{} `json:"resolverContext,omitempty"`
 	DeniedFields    []string               `json:"deniedFields,omitempty"`
 	TTLOverride     *int                   `json:"ttlOverride,omitempty"`
diff --git a/events/testdata/appsync-lambda-auth-request.json b/events/testdata/appsync-lambda-auth-request.json
index c2243376..3b7f4f2e 100644
--- a/events/testdata/appsync-lambda-auth-request.json
+++ b/events/testdata/appsync-lambda-auth-request.json
@@ -7,5 +7,8 @@
         "queryString": "mutation CreateEvent {...}\n\nquery MyQuery {...}\n",
         "operationName": "MyQuery",
         "variables": {}
+    },
+    "requestHeaders": {
+        "header": "value"
     }
 }
diff --git a/events/testdata/appsync-lambda-auth-response.json b/events/testdata/appsync-lambda-auth-response.json
index c71c8d87..66548c2a 100644
--- a/events/testdata/appsync-lambda-auth-response.json
+++ b/events/testdata/appsync-lambda-auth-response.json
@@ -1,5 +1,9 @@
 {
     "isAuthorized": true,
+    "handlerContext": {
+        "banana": "very yellow",
+        "apple": "very green"
+    },
     "resolverContext": {
         "banana": "very yellow",
         "apple": "very green"