MuleSoft
Engineer.

def handler(event, context):
    # Every request: validate → lookup → provision/sync
    _validate_proxy_secret(event['authorizationToken'])

    marketplace_id = _extract_marketplace_id(event)
    current_tier   = _get_tier_from_headers(event)

    user = users_table.get_item(
        Key={'marketplaceId': marketplace_id}
    ).get('Item')

    if not user:
        # First request — create user on the spot
        user = _provision_user(marketplace_id, current_tier)
    elif user['tier'] != current_tier:
        # Subscription changed — sync immediately
        user = _sync_tier(user, new_tier=current_tier)

    # Downstream Lambdas receive userId + tier in context
    return _build_allow_policy(
        principal=user['internalUserId'],
        context={
            'userId': user['internalUserId'],
            'tier':   user['tier'],
        }
    )

def is_api_enabled(ssm) -> bool:
    """
    One SSM parameter. Instant global shutoff.
    No deployment. No code change.
    """
    param = ssm.get_parameter(
        Name='/pincode-api/enabled'
    )
    return param['Parameter']['Value'] == 'true'


def query_pincodes(table, user_id: str,
                   pincode: str) -> list:
    """
    Single-table multi-tenancy.
    All tenants share one table — partition key
    is internalUserId. Cross-tenant leakage is
    impossible at the DynamoDB query level.
    """
    return table.query(
        KeyConditionExpression=(
            Key('internalUserId').eq(user_id) &
            Key('pincode_officename').begins_with(
                pincode
            )
        )
    )['Items']