Users aren't restricted to their own todo items about lambda-refarch-webapp

[dgomesbr]

Thanks for the report @tateexon; The DynamoDB Table today doesn't use the userid as a reference. Would also like to see that there?

This would likely go as:

• Change TodoTable from AWS::Serverless::SimpleTable to AWS::DynamoDB::Table
• Add userId to TodoTable
• Convert the CRUD/Read/etc Policies to match a fine-grained permission based on Cognito sub eg: https://gist.github.com/dgomesbr/07102fc5e94f085dcfff3fc02f93f9e8
• Change addToDo function to insert the actual userId
• Changes on:
  • AddToDo validating the current user prior to inserting (no unauthenticated inserts)
  • completeTodo and deleteToDo validating the current user equals the item user (no spoof attempt)
  • getToDo and getAllToDo to match current users
• Review the validator logic in all backend lambdas to match the new behavior if needed

Thoughts?

cc @mikeapted @sankeyraut

[tateexon]

That list looks good to me!