@aws/nx-plugin 1.0.0-rc.22 → 1.0.0-rc.24

package/src/ts/react-website/app/schema.d.js

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ export { };
+
+//# sourceMappingURL=schema.d.js.map

package/src/ts/react-website/app/schema.d.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/ts/react-website/app/schema.d.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { IacOption } from '../../../utils/iac';\nimport { UxOption } from './generator';\n\nexport type WebsiteInfraOption = 'cloudfront-s3' | 'none';\n\nexport interface TsReactWebsiteGeneratorSchema {\n  name: string;\n  directory?: string;\n  subDirectory?: string;\n  skipInstall?: boolean;\n  tanstackRouter?: boolean;\n  tailwind?: boolean;\n  ux?: UxOption;\n  infra?: WebsiteInfraOption;\n  iac: IacOption;\n}\n"],"names":[],"mappings":"AAAA;;;CAGC,GAMD,WAUC"}

package/src/ts/react-website/app/schema.json

@@ -40,7 +40,7 @@
       "description": "The preferred UX provider.",
       "enum": ["none", "cloudscape", "shadcn"],
       "x-priority": "important",
-      "default": "cloudscape",
+      "default": "shadcn",
       "x-prompt": {
         "message": "Which UX provider should we scaffold for this app?",
         "type": "list",
@@ -49,16 +49,16 @@
             "value": "none",
             "label": "None (plain React/Vite without a UI kit)"
           },
-          {
-            "value": "cloudscape",
-            "label": "Cloudscape (AWS-first components with ready-made layouts)"
-          },
           {
             "value": "shadcn",
             "label": "Shadcn (shared UI library under packages/common/shadcn)"
+          },
+          {
+            "value": "cloudscape",
+            "label": "Cloudscape (AWS-first components with ready-made layouts)"
           }
         ],
-        "default": "cloudscape"
+        "default": "shadcn"
       }
     },
     "tailwind": {

package/src/ts/react-website/cognito-auth/__snapshots__/generator.spec.ts.snap

@@ -17,8 +17,8 @@ const CognitoAuth: React.FC<PropsWithChildren> = ({ children }) => {
   const { cognitoProps } = useRuntimeConfig();
 
   if (!cognitoProps) {
-    if (import.meta.env.MODE === 'serve-local') {
-      // In serve-local mode with no cognitoProps available, we skip login
+    if (import.meta.env.MODE === 'local-dev') {
+      // In local-dev mode with no cognitoProps available, we skip login
       return <AuthProvider>{children}</AuthProvider>;
     }
     return (
@@ -90,7 +90,14 @@ exports[`cognito-auth generator > should generate files > user-identity 1`] = `
   IdentityPool,
   UserPoolAuthenticationProvider,
 } from 'aws-cdk-lib/aws-cognito-identitypool';
-import { CfnOutput, CfnResource, Duration, Lazy, Stack } from 'aws-cdk-lib';
+import {
+  CfnOutput,
+  CfnResource,
+  Duration,
+  Lazy,
+  RemovalPolicy,
+  Stack,
+} from 'aws-cdk-lib';
 import {
   AccountRecovery,
   CfnManagedLoginBranding,
@@ -98,15 +105,34 @@ import {
   FeaturePlan,
   Mfa,
   OAuthScope,
+  StandardThreatProtectionMode,
   UserPool,
   UserPoolClient,
 } from 'aws-cdk-lib/aws-cognito';
+import {
+  CfnLoggingConfiguration,
+  CfnWebACL,
+  CfnWebACLAssociation,
+} from 'aws-cdk-lib/aws-wafv2';
+import { LogGroup, RetentionDays } from 'aws-cdk-lib/aws-logs';
 import { Construct } from 'constructs';
 import { RuntimeConfig } from './runtime-config.js';
 import { Distribution } from 'aws-cdk-lib/aws-cloudfront';
 import { suppressRules } from './checkov.js';
 
 const WEB_CLIENT_ID = 'WebClient';
+
+export interface UserIdentityProps {
+  /**
+   * Whether to enable AWS WAFv2 with the default managed ruleset
+   * (AWSManagedRulesCommonRuleSet and AWSManagedRulesKnownBadInputsRuleSet)
+   * and associate it with the user pool.
+   *
+   * @default true
+   */
+  readonly enableWaf?: boolean;
+}
+
 /**
  * Creates a UserPool and Identity Pool with sane defaults configured intended for usage from a web client.
  */
@@ -117,11 +143,22 @@ export class UserIdentity extends Construct {
   public readonly userPoolClient: UserPoolClient;
   public readonly userPoolDomain: CfnUserPoolDomain;
 
-  constructor(scope: Construct, id: string) {
+  /** The WAFv2 Web ACL associated with the user pool, if WAF is enabled */
+  public readonly webAcl?: CfnWebACL;
+
+  constructor(
+    scope: Construct,
+    id: string,
+    { enableWaf = true }: UserIdentityProps = {},
+  ) {
     super(scope, id);
 
     this.region = Stack.of(this).region;
     this.userPool = this.createUserPool();
+
+    if (enableWaf) {
+      this.webAcl = this.createWebAcl(id, this.userPool);
+    }
     this.userPoolDomain = this.createUserPoolDomain(this.userPool);
     this.userPoolClient = this.createUserPoolClient(this.userPool);
     this.identityPool = this.createIdentityPool(
@@ -174,6 +211,8 @@ export class UserIdentity extends Construct {
       },
       mfa: Mfa.REQUIRED,
       featurePlan: FeaturePlan.PLUS,
+      // Audit-only logs threat assessments without blocking sign-in. Switch to FULL_FUNCTION to enforce automatic responses.
+      standardThreatProtectionMode: StandardThreatProtectionMode.AUDIT_ONLY,
       mfaSecondFactor: { sms: true, otp: true },
       signInCaseSensitive: false,
       signInAliases: { username: true, email: true },
@@ -206,6 +245,81 @@ export class UserIdentity extends Construct {
     return userPool;
   };
 
+  private createWebAcl = (id: string, userPool: UserPool) => {
+    const webAcl = new CfnWebACL(this, 'WebAcl', {
+      defaultAction: { allow: {} },
+      scope: 'REGIONAL',
+      visibilityConfig: {
+        cloudWatchMetricsEnabled: true,
+        metricName: \`\${id}WebAcl\`,
+        sampledRequestsEnabled: true,
+      },
+      rules: [
+        {
+          name: 'CRSRule',
+          priority: 0,
+          statement: {
+            managedRuleGroupStatement: {
+              name: 'AWSManagedRulesCommonRuleSet',
+              vendorName: 'AWS',
+            },
+          },
+          visibilityConfig: {
+            cloudWatchMetricsEnabled: true,
+            metricName: \`\${id}WebAcl-CRS\`,
+            sampledRequestsEnabled: true,
+          },
+          overrideAction: {
+            none: {},
+          },
+        },
+        {
+          name: 'KnownBadInputsRule',
+          priority: 1,
+          statement: {
+            managedRuleGroupStatement: {
+              name: 'AWSManagedRulesKnownBadInputsRuleSet',
+              vendorName: 'AWS',
+            },
+          },
+          visibilityConfig: {
+            cloudWatchMetricsEnabled: true,
+            metricName: \`\${id}WebAcl-KnownBadInputs\`,
+            sampledRequestsEnabled: true,
+          },
+          overrideAction: {
+            none: {},
+          },
+        },
+      ],
+    });
+
+    new CfnWebACLAssociation(this, 'WebAclAssociation', {
+      resourceArn: userPool.userPoolArn,
+      webAclArn: webAcl.attrArn,
+    });
+
+    // Send WAF request logs to CloudWatch. The log group name must start with
+    // \`aws-waf-logs-\` to satisfy the WAFv2 logging destination requirement.
+    const wafLogGroup = new LogGroup(this, 'WebAclLogs', {
+      logGroupName: \`aws-waf-logs-\${id}-\${this.node.addr.slice(-8)}\`,
+      retention: RetentionDays.ONE_MONTH,
+      removalPolicy: RemovalPolicy.DESTROY,
+    });
+    suppressRules(
+      wafLogGroup,
+      ['CKV_AWS_158'],
+      'Using default CloudWatch log encryption for WAF logs',
+    );
+
+    new CfnLoggingConfiguration(this, 'WebAclLoggingConfig', {
+      resourceArn: webAcl.attrArn,
+      logDestinationConfigs: [wafLogGroup.logGroupArn],
+    });
+
+    return webAcl;
+  };
+
   private createUserPoolDomain = (userPool: UserPool) =>
     new CfnUserPoolDomain(this, 'UserPoolDomain', {
       domain: \`test-\${Stack.of(this).account}\`,

package/src/ts/react-website/cognito-auth/__snapshots__/generator.terraform.spec.ts.snap

@@ -6,7 +6,7 @@ exports[`cognito-auth generator terraform iac > should generate terraform files
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "6.52.0"
     }
   }
 }
@@ -63,10 +63,11 @@ resource "null_resource" "add_callback_url" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3 python -c "
+      uv run --with boto3==1.43.29 python -c "
 import boto3
 import os
 import sys
+import time
 
 # Configuration
 user_pool_id = os.environ['USER_POOL_ID']
@@ -76,12 +77,24 @@ new_callback_url = os.environ['NEW_CALLBACK_URL']
 # Initialize Cognito client
 cognito = boto3.client('cognito-idp')
 
+# A freshly created user pool / client can take several minutes to become
+# visible to describe_user_pool_client, so retry on ResourceNotFoundException.
+def describe_with_retry():
+    deadline = time.time() + 5 * 60
+    while True:
+        try:
+            return cognito.describe_user_pool_client(
+                UserPoolId=user_pool_id,
+                ClientId=client_id,
+            )
+        except cognito.exceptions.ResourceNotFoundException:
+            if time.time() >= deadline:
+                raise
+            time.sleep(5)
+
 try:
     # Get current user pool client configuration
-    response = cognito.describe_user_pool_client(
-        UserPoolId=user_pool_id,
-        ClientId=client_id
-    )
+    response = describe_with_retry()
 
     client_config = response['UserPoolClient']
     current_callback_urls = client_config.get('CallbackURLs', [])
@@ -134,11 +147,18 @@ except Exception as e:
 }
 
 ",
-  "user-identity.tf": "module "identity" {
+  "user-identity.tf": "variable "enable_waf" {
+  description = "Whether to enable AWS WAFv2 with the default managed ruleset and associate it with the user pool"
+  type        = bool
+  default     = true
+}
+
+module "identity" {
   source = "./identity"
 
   user_pool_domain_prefix = "test"
   allow_signup = true
+  enable_waf = var.enable_waf
 }
 
 # Outputs

package/src/ts/react-website/cognito-auth/files/app/components/CognitoAuth/index.tsx.template

@@ -14,8 +14,8 @@ const CognitoAuth: React.FC<PropsWithChildren> = ({ children }) => {
   const { cognitoProps } = useRuntimeConfig();
 
   if (!cognitoProps) {
-    if (import.meta.env.MODE === 'serve-local') {
-      // In serve-local mode with no cognitoProps available, we skip login
+    if (import.meta.env.MODE === 'local-dev') {
+      // In local-dev mode with no cognitoProps available, we skip login
       return <AuthProvider>{children}</AuthProvider>;
     }
     return (

package/src/ts/react-website/cognito-auth/generator.js

@@ -1,92 +1,92 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.COGNITO_AUTH_GENERATOR_INFO = void 0;
-exports.tsReactWebsiteAuthGenerator = tsReactWebsiteAuthGenerator;
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */
-const devkit_1 = require("@nx/devkit");
-const fs_1 = require("fs");
-const path_1 = require("path");
-const ast_1 = require("../../../utils/ast");
-const website_1 = require("../../../utils/ast/website");
-const format_1 = require("../../../utils/format");
-const iac_1 = require("../../../utils/iac");
-const identity_constructs_1 = require("../../../utils/identity-constructs/identity-constructs");
-const metrics_1 = require("../../../utils/metrics");
-const npm_scope_1 = require("../../../utils/npm-scope");
-const nx_1 = require("../../../utils/nx");
-const paths_1 = require("../../../utils/paths");
-const shared_constructs_1 = require("../../../utils/shared-constructs");
-const versions_1 = require("../../../utils/versions");
-const generator_1 = require("../runtime-config/generator");
-const utils_1 = require("./utils");
-const readGritPattern = (name) => (0, fs_1.readFileSync)((0, path_1.join)(__dirname, 'grit', `${name}.grit`), 'utf-8').trim();
-exports.COGNITO_AUTH_GENERATOR_INFO = (0, nx_1.getGeneratorInfo)(__filename);
-async function tsReactWebsiteAuthGenerator(tree, options) {
-    const projectConfig = (0, nx_1.readProjectConfigurationUnqualified)(tree, options.project);
+ */ import { addDependenciesToPackageJson, generateFiles, installPackagesTask, joinPathFragments, OverwriteStrategy } from "@nx/devkit";
+import { readFileSync } from "fs";
+import { join } from "path";
+import { addDestructuredImport, addSingleImport, applyGritQL } from "../../../utils/ast.js";
+import { addHookResultToRouterProviderContext } from "../../../utils/ast/website.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { resolveIac } from "../../../utils/iac.js";
+import { addIdentityInfra } from "../../../utils/identity-constructs/identity-constructs.js";
+import { addGeneratorMetricsIfApplicable } from "../../../utils/metrics.js";
+import { getNpmScope } from "../../../utils/npm-scope.js";
+import { addComponentGeneratorMetadata, getGeneratorInfo, readProjectConfigurationUnqualified } from "../../../utils/nx.js";
+import { toProjectRelativePath } from "../../../utils/paths.js";
+import { sharedConstructsGenerator } from "../../../utils/shared-constructs.js";
+import { withVersions } from "../../../utils/versions.js";
+import { runtimeConfigGenerator } from "../runtime-config/generator.js";
+import { addCloudscapeAuthMenu, addNoneAuthMenu, addShadcnAuthMenu, deriveCognitoDomainPrefix } from "./utils.js";
+const readGritPattern = (name)=>readFileSync(join(import.meta.dirname, 'grit', `${name}.grit`), 'utf-8').trim();
+export const COGNITO_AUTH_GENERATOR_INFO = getGeneratorInfo(import.meta.filename);
+export async function tsReactWebsiteAuthGenerator(tree, options) {
+    const projectConfig = readProjectConfigurationUnqualified(tree, options.project);
     const srcRoot = projectConfig.sourceRoot;
-    const cognitoDomain = options.cognitoDomain && options.cognitoDomain.length > 0
-        ? options.cognitoDomain
-        : (0, utils_1.deriveCognitoDomainPrefix)((0, npm_scope_1.getNpmScope)(tree), projectConfig.name);
-    await (0, generator_1.runtimeConfigGenerator)(tree, {
-        project: options.project,
+    const cognitoDomain = options.cognitoDomain && options.cognitoDomain.length > 0 ? options.cognitoDomain : deriveCognitoDomainPrefix(getNpmScope(tree), projectConfig.name);
+    await runtimeConfigGenerator(tree, {
+        project: options.project
     });
-    const iac = await (0, iac_1.resolveIac)(tree, options.iac);
-    await (0, shared_constructs_1.sharedConstructsGenerator)(tree, {
-        iac,
+    const iac = await resolveIac(tree, options.iac);
+    await sharedConstructsGenerator(tree, {
+        iac
     });
-    await (0, identity_constructs_1.addIdentityInfra)(tree, {
+    await addIdentityInfra(tree, {
         iac,
         allowSignup: options.allowSignup,
-        cognitoDomain,
+        cognitoDomain
     });
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'app'), srcRoot, options, {
-        overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'app'), srcRoot, options, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
     });
-    (0, devkit_1.addDependenciesToPackageJson)(tree, (0, versions_1.withVersions)(['oidc-client-ts', 'react-oidc-context']), {});
-    const mainTsxPath = (0, devkit_1.joinPathFragments)(srcRoot, 'main.tsx');
-    await (0, ast_1.addSingleImport)(tree, mainTsxPath, 'CognitoAuth', './components/CognitoAuth');
-    await (0, website_1.addHookResultToRouterProviderContext)(tree, mainTsxPath, {
+    addDependenciesToPackageJson(tree, withVersions([
+        'oidc-client-ts',
+        'react-oidc-context'
+    ]), {});
+    const mainTsxPath = joinPathFragments(srcRoot, 'main.tsx');
+    await addSingleImport(tree, mainTsxPath, 'CognitoAuth', './components/CognitoAuth');
+    await addHookResultToRouterProviderContext(tree, mainTsxPath, {
         hook: 'useAuth',
         module: 'react-oidc-context',
-        contextProp: 'auth',
+        contextProp: 'auth'
     });
-    const projectConfiguration = (0, nx_1.readProjectConfigurationUnqualified)(tree, options.project);
-    const ux = (projectConfiguration.metadata?.ux ?? 'cloudscape').toLowerCase();
-    await (0, ast_1.applyGritQL)(tree, mainTsxPath, readGritPattern('cognito-auth-wrapper'));
+    const projectConfiguration = readProjectConfigurationUnqualified(tree, options.project);
+    const ux = (projectConfiguration.metadata?.ux ?? 'shadcn').toLowerCase();
+    await applyGritQL(tree, mainTsxPath, readGritPattern('cognito-auth-wrapper'));
     // Update App Layout
-    const appLayoutTsxPath = (0, devkit_1.joinPathFragments)(srcRoot, 'components', 'AppLayout', 'index.tsx');
+    const appLayoutTsxPath = joinPathFragments(srcRoot, 'components', 'AppLayout', 'index.tsx');
     if (tree.exists(appLayoutTsxPath)) {
-        await (0, ast_1.addDestructuredImport)(tree, appLayoutTsxPath, ['useAuth'], 'react-oidc-context');
-        await (0, ast_1.applyGritQL)(tree, appLayoutTsxPath, readGritPattern('app-layout-use-auth'));
+        await addDestructuredImport(tree, appLayoutTsxPath, [
+            'useAuth'
+        ], 'react-oidc-context');
+        await applyGritQL(tree, appLayoutTsxPath, readGritPattern('app-layout-use-auth'));
         // TODO: update utils if they exist by appending to the array
         // Add a top-level navigation menu that shows the signed-in user's profile and actions
-        switch (ux) {
+        switch(ux){
             case 'cloudscape':
-                await (0, utils_1.addCloudscapeAuthMenu)(tree, appLayoutTsxPath);
+                await addCloudscapeAuthMenu(tree, appLayoutTsxPath);
                 break;
             case 'shadcn':
-                await (0, utils_1.addShadcnAuthMenu)(tree, appLayoutTsxPath);
+                await addShadcnAuthMenu(tree, appLayoutTsxPath);
                 break;
             case 'none':
-                await (0, utils_1.addNoneAuthMenu)(tree, appLayoutTsxPath);
+                await addNoneAuthMenu(tree, appLayoutTsxPath);
                 break;
             default:
                 throw new Error(`Top-level navigation menu to show the signed-in user for ux "${ux}" is not implemented.`);
         }
-    }
-    else {
+    } else {
         console.info(`Skipping update to ${appLayoutTsxPath} as it does not exist.`);
     }
     // End update App Layout
-    (0, nx_1.addComponentGeneratorMetadata)(tree, options.project, exports.COGNITO_AUTH_GENERATOR_INFO, (0, paths_1.toProjectRelativePath)(projectConfig, (0, devkit_1.joinPathFragments)(srcRoot, 'components', 'CognitoAuth')));
-    await (0, metrics_1.addGeneratorMetricsIfApplicable)(tree, [exports.COGNITO_AUTH_GENERATOR_INFO]);
-    await (0, format_1.formatFilesInSubtree)(tree);
-    return () => {
-        (0, devkit_1.installPackagesTask)(tree);
+    addComponentGeneratorMetadata(tree, options.project, COGNITO_AUTH_GENERATOR_INFO, toProjectRelativePath(projectConfig, joinPathFragments(srcRoot, 'components', 'CognitoAuth')));
+    await addGeneratorMetricsIfApplicable(tree, [
+        COGNITO_AUTH_GENERATOR_INFO
+    ]);
+    await formatFilesInSubtree(tree);
+    return ()=>{
+        installPackagesTask(tree);
     };
 }
-exports.default = tsReactWebsiteAuthGenerator;
+export default tsReactWebsiteAuthGenerator;
+
 //# sourceMappingURL=generator.js.map

package/src/ts/react-website/cognito-auth/generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"generator.js","sourceRoot":"","sources":["../../../../../../../packages/nx-plugin/src/ts/react-website/cognito-auth/generator.ts"],"names":[],"mappings":";;;AAiDA,kEAmIC;AApLD;;;GAGG;AACH,uCAOoB;AACpB,2BAAkC;AAClC,+BAA4B;AAC5B,4CAI4B;AAC5B,wDAAkF;AAClF,kDAA6D;AAC7D,4CAAgD;AAChD,gGAA0F;AAC1F,oDAAyE;AACzE,wDAAuD;AACvD,0CAK2B;AAC3B,gDAA6D;AAC7D,wEAA6E;AAC7E,sDAAuD;AACvD,2DAAqE;AAErE,mCAKiB;AAEjB,MAAM,eAAe,GAAG,CAAC,IAAY,EAAU,EAAE,CAC/C,IAAA,iBAAY,EAAC,IAAA,WAAI,EAAC,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AAE3D,QAAA,2BAA2B,GACtC,IAAA,qBAAgB,EAAC,UAAU,CAAC,CAAC;AAExB,KAAK,UAAU,2BAA2B,CAC/C,IAAU,EACV,OAA0C;IAE1C,MAAM,aAAa,GAAG,IAAA,wCAAmC,EACvD,IAAI,EACJ,OAAO,CAAC,OAAO,CAChB,CAAC;IACF,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC;IAEzC,MAAM,aAAa,GACjB,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;QACvD,CAAC,CAAC,OAAO,CAAC,aAAa;QACvB,CAAC,CAAC,IAAA,iCAAyB,EAAC,IAAA,uBAAW,EAAC,IAAI,CAAC,EAAE,aAAa,CAAC,IAAK,CAAC,CAAC;IAExE,MAAM,IAAA,kCAAsB,EAAC,IAAI,EAAE;QACjC,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,IAAA,gBAAU,EAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAEhD,MAAM,IAAA,6CAAyB,EAAC,IAAI,EAAE;QACpC,GAAG;KACJ,CAAC,CAAC;IAEH,MAAM,IAAA,sCAAgB,EAAC,IAAI,EAAE;QAC3B,GAAG;QACH,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,aAAa;KACd,CAAC,CAAC;IAEH,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,EAC5C,OAAO,EACP,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,IAAA,qCAA4B,EAC1B,IAAI,EACJ,IAAA,uBAAY,EAAC,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,CAAC,EACtD,EAAE,CACH,CAAC;IAEF,MAAM,WAAW,GAAG,IAAA,0BAAiB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAE3D,MAAM,IAAA,qBAAe,EACnB,IAAI,EACJ,WAAW,EACX,aAAa,EACb,0BAA0B,CAC3B,CAAC;IAEF,MAAM,IAAA,8CAAoC,EAAC,IAAI,EAAE,WAAW,EAAE;QAC5D,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,oBAAoB;QAC5B,WAAW,EAAE,MAAM;KACpB,CAAC,CAAC;IAEH,MAAM,oBAAoB,GAAG,IAAA,wCAAmC,EAC9D,IAAI,EACJ,OAAO,CAAC,OAAO,CAChB,CAAC;IAEF,MAAM,EAAE,GAAG,CACR,oBAAoB,CAAC,QAAgB,EAAE,EAAE,IAAI,YAAY,CAC3D,CAAC,WAAW,EAAE,CAAC;IAEhB,MAAM,IAAA,iBAAW,EAAC,IAAI,EAAE,WAAW,EAAE,eAAe,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC9E,oBAAoB;IACpB,MAAM,gBAAgB,GAAG,IAAA,0BAAiB,EACxC,OAAO,EACP,YAAY,EACZ,WAAW,EACX,WAAW,CACZ,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAClC,MAAM,IAAA,2BAAqB,EACzB,IAAI,EACJ,gBAAgB,EAChB,CAAC,SAAS,CAAC,EACX,oBAAoB,CACrB,CAAC;QACF,MAAM,IAAA,iBAAW,EACf,IAAI,EACJ,gBAAgB,EAChB,eAAe,CAAC,qBAAqB,CAAC,CACvC,CAAC;QACF,6DAA6D;QAC7D,sFAAsF;QACtF,QAAQ,EAAE,EAAE,CAAC;YACX,KAAK,YAAY;gBACf,MAAM,IAAA,6BAAqB,EAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;gBACpD,MAAM;YACR,KAAK,QAAQ;gBACX,MAAM,IAAA,yBAAiB,EAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;gBAChD,MAAM;YACR,KAAK,MAAM;gBACT,MAAM,IAAA,uBAAe,EAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;gBAC9C,MAAM;YACR;gBACE,MAAM,IAAI,KAAK,CACb,gEAAgE,EAAE,uBAAuB,CAC1F,CAAC;QACN,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,CACV,sBAAsB,gBAAgB,wBAAwB,CAC/D,CAAC;IACJ,CAAC;IACD,wBAAwB;IAExB,IAAA,kCAA6B,EAC3B,IAAI,EACJ,OAAO,CAAC,OAAO,EACf,mCAA2B,EAC3B,IAAA,6BAAqB,EACnB,aAAa,EACb,IAAA,0BAAiB,EAAC,OAAO,EAAE,YAAY,EAAE,aAAa,CAAC,CACxD,CACF,CAAC;IAEF,MAAM,IAAA,yCAA+B,EAAC,IAAI,EAAE,CAAC,mCAA2B,CAAC,CAAC,CAAC;IAE3E,MAAM,IAAA,6BAAoB,EAAC,IAAI,CAAC,CAAC;IACjC,OAAO,GAAG,EAAE;QACV,IAAA,4BAAmB,EAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC;AACJ,CAAC;AACD,kBAAe,2BAA2B,CAAC"}
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/ts/react-website/cognito-auth/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  generateFiles,\n  installPackagesTask,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n} from '@nx/devkit';\nimport { readFileSync } from 'fs';\nimport { join } from 'path';\nimport {\n  addDestructuredImport,\n  addSingleImport,\n  applyGritQL,\n} from '../../../utils/ast';\nimport { addHookResultToRouterProviderContext } from '../../../utils/ast/website';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport { resolveIac } from '../../../utils/iac';\nimport { addIdentityInfra } from '../../../utils/identity-constructs/identity-constructs';\nimport { addGeneratorMetricsIfApplicable } from '../../../utils/metrics';\nimport { getNpmScope } from '../../../utils/npm-scope';\nimport {\n  addComponentGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../../utils/nx';\nimport { toProjectRelativePath } from '../../../utils/paths';\nimport { sharedConstructsGenerator } from '../../../utils/shared-constructs';\nimport { withVersions } from '../../../utils/versions';\nimport { runtimeConfigGenerator } from '../runtime-config/generator';\nimport type { TsReactWebsiteAuthGeneratorSchema } from './schema';\nimport {\n  addCloudscapeAuthMenu,\n  addNoneAuthMenu,\n  addShadcnAuthMenu,\n  deriveCognitoDomainPrefix,\n} from './utils';\n\nconst readGritPattern = (name: string): string =>\n  readFileSync(\n    join(import.meta.dirname, 'grit', `${name}.grit`),\n    'utf-8',\n  ).trim();\n\nexport const COGNITO_AUTH_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nexport async function tsReactWebsiteAuthGenerator(\n  tree: Tree,\n  options: TsReactWebsiteAuthGeneratorSchema,\n) {\n  const projectConfig = readProjectConfigurationUnqualified(\n    tree,\n    options.project,\n  );\n  const srcRoot = projectConfig.sourceRoot;\n\n  const cognitoDomain =\n    options.cognitoDomain && options.cognitoDomain.length > 0\n      ? options.cognitoDomain\n      : deriveCognitoDomainPrefix(getNpmScope(tree), projectConfig.name!);\n\n  await runtimeConfigGenerator(tree, {\n    project: options.project,\n  });\n\n  const iac = await resolveIac(tree, options.iac);\n\n  await sharedConstructsGenerator(tree, {\n    iac,\n  });\n\n  await addIdentityInfra(tree, {\n    iac,\n    allowSignup: options.allowSignup,\n    cognitoDomain,\n  });\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'app'),\n    srcRoot,\n    options,\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  addDependenciesToPackageJson(\n    tree,\n    withVersions(['oidc-client-ts', 'react-oidc-context']),\n    {},\n  );\n\n  const mainTsxPath = joinPathFragments(srcRoot, 'main.tsx');\n\n  await addSingleImport(\n    tree,\n    mainTsxPath,\n    'CognitoAuth',\n    './components/CognitoAuth',\n  );\n\n  await addHookResultToRouterProviderContext(tree, mainTsxPath, {\n    hook: 'useAuth',\n    module: 'react-oidc-context',\n    contextProp: 'auth',\n  });\n\n  const projectConfiguration = readProjectConfigurationUnqualified(\n    tree,\n    options.project,\n  );\n\n  const ux = (\n    (projectConfiguration.metadata as any)?.ux ?? 'shadcn'\n  ).toLowerCase();\n\n  await applyGritQL(tree, mainTsxPath, readGritPattern('cognito-auth-wrapper'));\n  // Update App Layout\n  const appLayoutTsxPath = joinPathFragments(\n    srcRoot,\n    'components',\n    'AppLayout',\n    'index.tsx',\n  );\n  if (tree.exists(appLayoutTsxPath)) {\n    await addDestructuredImport(\n      tree,\n      appLayoutTsxPath,\n      ['useAuth'],\n      'react-oidc-context',\n    );\n    await applyGritQL(\n      tree,\n      appLayoutTsxPath,\n      readGritPattern('app-layout-use-auth'),\n    );\n    // TODO: update utils if they exist by appending to the array\n    // Add a top-level navigation menu that shows the signed-in user's profile and actions\n    switch (ux) {\n      case 'cloudscape':\n        await addCloudscapeAuthMenu(tree, appLayoutTsxPath);\n        break;\n      case 'shadcn':\n        await addShadcnAuthMenu(tree, appLayoutTsxPath);\n        break;\n      case 'none':\n        await addNoneAuthMenu(tree, appLayoutTsxPath);\n        break;\n      default:\n        throw new Error(\n          `Top-level navigation menu to show the signed-in user for ux \"${ux}\" is not implemented.`,\n        );\n    }\n  } else {\n    console.info(\n      `Skipping update to ${appLayoutTsxPath} as it does not exist.`,\n    );\n  }\n  // End update App Layout\n\n  addComponentGeneratorMetadata(\n    tree,\n    options.project,\n    COGNITO_AUTH_GENERATOR_INFO,\n    toProjectRelativePath(\n      projectConfig,\n      joinPathFragments(srcRoot, 'components', 'CognitoAuth'),\n    ),\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [COGNITO_AUTH_GENERATOR_INFO]);\n\n  await formatFilesInSubtree(tree);\n  return () => {\n    installPackagesTask(tree);\n  };\n}\nexport default tsReactWebsiteAuthGenerator;\n"],"names":["addDependenciesToPackageJson","generateFiles","installPackagesTask","joinPathFragments","OverwriteStrategy","readFileSync","join","addDestructuredImport","addSingleImport","applyGritQL","addHookResultToRouterProviderContext","formatFilesInSubtree","resolveIac","addIdentityInfra","addGeneratorMetricsIfApplicable","getNpmScope","addComponentGeneratorMetadata","getGeneratorInfo","readProjectConfigurationUnqualified","toProjectRelativePath","sharedConstructsGenerator","withVersions","runtimeConfigGenerator","addCloudscapeAuthMenu","addNoneAuthMenu","addShadcnAuthMenu","deriveCognitoDomainPrefix","readGritPattern","name","dirname","trim","COGNITO_AUTH_GENERATOR_INFO","filename","tsReactWebsiteAuthGenerator","tree","options","projectConfig","project","srcRoot","sourceRoot","cognitoDomain","length","iac","allowSignup","overwriteStrategy","KeepExisting","mainTsxPath","hook","module","contextProp","projectConfiguration","ux","metadata","toLowerCase","appLayoutTsxPath","exists","Error","console","info"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAC5BC,aAAa,EACbC,mBAAmB,EACnBC,iBAAiB,EACjBC,iBAAiB,QAEZ,aAAa;AACpB,SAASC,YAAY,QAAQ,KAAK;AAClC,SAASC,IAAI,QAAQ,OAAO;AAC5B,SACEC,qBAAqB,EACrBC,eAAe,EACfC,WAAW,QACN,wBAAqB;AAC5B,SAASC,oCAAoC,QAAQ,gCAA6B;AAClF,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SAASC,UAAU,QAAQ,wBAAqB;AAChD,SAASC,gBAAgB,QAAQ,4DAAyD;AAC1F,SAASC,+BAA+B,QAAQ,4BAAyB;AACzE,SAASC,WAAW,QAAQ,8BAA2B;AACvD,SACEC,6BAA6B,EAC7BC,gBAAgB,EAEhBC,mCAAmC,QAC9B,uBAAoB;AAC3B,SAASC,qBAAqB,QAAQ,0BAAuB;AAC7D,SAASC,yBAAyB,QAAQ,sCAAmC;AAC7E,SAASC,YAAY,QAAQ,6BAA0B;AACvD,SAASC,sBAAsB,QAAQ,iCAA8B;AAErE,SACEC,qBAAqB,EACrBC,eAAe,EACfC,iBAAiB,EACjBC,yBAAyB,QACpB,aAAU;AAEjB,MAAMC,kBAAkB,CAACC,OACvBvB,aACEC,KAAK,YAAYuB,OAAO,EAAE,QAAQ,GAAGD,KAAK,KAAK,CAAC,GAChD,SACAE,IAAI;AAER,OAAO,MAAMC,8BAA+Cd,iBAC1D,YAAYe,QAAQ,EACpB;AAEF,OAAO,eAAeC,4BACpBC,IAAU,EACVC,OAA0C;IAE1C,MAAMC,gBAAgBlB,oCACpBgB,MACAC,QAAQE,OAAO;IAEjB,MAAMC,UAAUF,cAAcG,UAAU;IAExC,MAAMC,gBACJL,QAAQK,aAAa,IAAIL,QAAQK,aAAa,CAACC,MAAM,GAAG,IACpDN,QAAQK,aAAa,GACrBd,0BAA0BX,YAAYmB,OAAOE,cAAcR,IAAI;IAErE,MAAMN,uBAAuBY,MAAM;QACjCG,SAASF,QAAQE,OAAO;IAC1B;IAEA,MAAMK,MAAM,MAAM9B,WAAWsB,MAAMC,QAAQO,GAAG;IAE9C,MAAMtB,0BAA0Bc,MAAM;QACpCQ;IACF;IAEA,MAAM7B,iBAAiBqB,MAAM;QAC3BQ;QACAC,aAAaR,QAAQQ,WAAW;QAChCH;IACF;IAEAvC,cACEiC,MACA/B,kBAAkB,YAAY0B,OAAO,EAAE,SAAS,QAChDS,SACAH,SACA;QACES,mBAAmBxC,kBAAkByC,YAAY;IACnD;IAGF7C,6BACEkC,MACAb,aAAa;QAAC;QAAkB;KAAqB,GACrD,CAAC;IAGH,MAAMyB,cAAc3C,kBAAkBmC,SAAS;IAE/C,MAAM9B,gBACJ0B,MACAY,aACA,eACA;IAGF,MAAMpC,qCAAqCwB,MAAMY,aAAa;QAC5DC,MAAM;QACNC,QAAQ;QACRC,aAAa;IACf;IAEA,MAAMC,uBAAuBhC,oCAC3BgB,MACAC,QAAQE,OAAO;IAGjB,MAAMc,KAAK,AACT,CAAA,AAACD,qBAAqBE,QAAQ,EAAUD,MAAM,QAAO,EACrDE,WAAW;IAEb,MAAM5C,YAAYyB,MAAMY,aAAanB,gBAAgB;IACrD,oBAAoB;IACpB,MAAM2B,mBAAmBnD,kBACvBmC,SACA,cACA,aACA;IAEF,IAAIJ,KAAKqB,MAAM,CAACD,mBAAmB;QACjC,MAAM/C,sBACJ2B,MACAoB,kBACA;YAAC;SAAU,EACX;QAEF,MAAM7C,YACJyB,MACAoB,kBACA3B,gBAAgB;QAElB,6DAA6D;QAC7D,sFAAsF;QACtF,OAAQwB;YACN,KAAK;gBACH,MAAM5B,sBAAsBW,MAAMoB;gBAClC;YACF,KAAK;gBACH,MAAM7B,kBAAkBS,MAAMoB;gBAC9B;YACF,KAAK;gBACH,MAAM9B,gBAAgBU,MAAMoB;gBAC5B;YACF;gBACE,MAAM,IAAIE,MACR,CAAC,6DAA6D,EAAEL,GAAG,qBAAqB,CAAC;QAE/F;IACF,OAAO;QACLM,QAAQC,IAAI,CACV,CAAC,mBAAmB,EAAEJ,iBAAiB,sBAAsB,CAAC;IAElE;IACA,wBAAwB;IAExBtC,8BACEkB,MACAC,QAAQE,OAAO,EACfN,6BACAZ,sBACEiB,eACAjC,kBAAkBmC,SAAS,cAAc;IAI7C,MAAMxB,gCAAgCoB,MAAM;QAACH;KAA4B;IAEzE,MAAMpB,qBAAqBuB;IAC3B,OAAO;QACLhC,oBAAoBgC;IACtB;AACF;AACA,eAAeD,4BAA4B"}

package/src/ts/react-website/cognito-auth/schema.d.js

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ export { };
+
+//# sourceMappingURL=schema.d.js.map

package/src/ts/react-website/cognito-auth/schema.d.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/ts/react-website/cognito-auth/schema.d.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nimport { IacOption } from '../../../utils/iac';\n\nexport interface TsReactWebsiteAuthGeneratorSchema {\n  project: string;\n  allowSignup: boolean;\n  cognitoDomain?: string;\n  iac: IacOption;\n}\n"],"names":[],"mappings":"AAAA;;;CAGC,GAID,WAKC"}

package/src/ts/react-website/cognito-auth/utils.js

@@ -1,52 +1,54 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.deriveCognitoDomainPrefix = void 0;
-exports.addNoneAuthMenu = addNoneAuthMenu;
-exports.addCloudscapeAuthMenu = addCloudscapeAuthMenu;
-exports.addShadcnAuthMenu = addShadcnAuthMenu;
-const fs_1 = require("fs");
-const path_1 = require("path");
-const ast_1 = require("../../../utils/ast");
-const names_1 = require("../../../utils/names");
-const readGritPattern = (name) => (0, fs_1.readFileSync)((0, path_1.join)(__dirname, 'grit', `${name}.grit`), 'utf-8').trim();
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { readFileSync } from "fs";
+import { join } from "path";
+import { addDestructuredImport, applyGritQL } from "../../../utils/ast.js";
+import { kebabCase } from "../../../utils/names.js";
+const readGritPattern = (name)=>readFileSync(join(import.meta.dirname, 'grit', `${name}.grit`), 'utf-8').trim();
 // Leaves room for the IaC suffix (Terraform: `-<12-digit account>-<8-char hex>` = 22 chars) inside Cognito's 63-char limit.
 const MAX_DERIVED_DOMAIN_PREFIX_LENGTH = 41;
 // Cognito rejects domains containing these substrings ("Domain cannot contain reserved word").
-const COGNITO_DOMAIN_RESERVED_WORDS = ['aws', 'amazon', 'cognito'];
-const deriveCognitoDomainPrefix = (npmScope, projectName) => {
-    const projectWithoutScope = projectName.includes('/')
-        ? projectName.split('/').pop()
-        : projectName;
-    const kebab = (0, names_1.kebabCase)([npmScope, projectWithoutScope].filter(Boolean).join('-'));
-    const stripped = COGNITO_DOMAIN_RESERVED_WORDS.reduce((s, word) => s.replaceAll(word, ''), kebab);
-    const candidate = stripped
-        .replace(/-+/g, '-')
-        .replace(/^-|-$/g, '')
-        .slice(0, MAX_DERIVED_DOMAIN_PREFIX_LENGTH)
-        .replace(/-$/, '');
+const COGNITO_DOMAIN_RESERVED_WORDS = [
+    'aws',
+    'amazon',
+    'cognito'
+];
+export const deriveCognitoDomainPrefix = (npmScope, projectName)=>{
+    const projectWithoutScope = projectName.includes('/') ? projectName.split('/').pop() : projectName;
+    const kebab = kebabCase([
+        npmScope,
+        projectWithoutScope
+    ].filter(Boolean).join('-'));
+    const stripped = COGNITO_DOMAIN_RESERVED_WORDS.reduce((s, word)=>s.replaceAll(word, ''), kebab);
+    const candidate = stripped.replace(/-+/g, '-').replace(/^-|-$/g, '').slice(0, MAX_DERIVED_DOMAIN_PREFIX_LENGTH).replace(/-$/, '');
     if (!candidate) {
         throw new Error(`Unable to derive a valid Cognito domain prefix from scope "${npmScope ?? ''}" and project "${projectName}". Please specify a cognitoDomain explicitly.`);
     }
     return candidate;
 };
-exports.deriveCognitoDomainPrefix = deriveCognitoDomainPrefix;
 // Adds a user greeting and sign-out button to the default AppLayout header when using the None UX provider.
-async function addNoneAuthMenu(tree, appLayoutTsxPath) {
-    await (0, ast_1.applyGritQL)(tree, appLayoutTsxPath, readGritPattern('none-auth-menu'));
+export async function addNoneAuthMenu(tree, appLayoutTsxPath) {
+    await applyGritQL(tree, appLayoutTsxPath, readGritPattern('none-auth-menu'));
 }
 // Adds a top navigation dropdown with sign-out when using the Cloudscape UX provider.
-async function addCloudscapeAuthMenu(tree, appLayoutTsxPath) {
-    await (0, ast_1.applyGritQL)(tree, appLayoutTsxPath, readGritPattern('cloudscape-auth-menu'));
+export async function addCloudscapeAuthMenu(tree, appLayoutTsxPath) {
+    await applyGritQL(tree, appLayoutTsxPath, readGritPattern('cloudscape-auth-menu'));
 }
-async function addShadcnAuthMenu(tree, appLayoutTsxPath) {
+export async function addShadcnAuthMenu(tree, appLayoutTsxPath) {
     if (!tree.exists(appLayoutTsxPath)) {
         throw new Error(`Expected top nav component at ${appLayoutTsxPath}`);
     }
     // Prepend state declarations to the AppLayout component body
-    await (0, ast_1.applyGritQL)(tree, appLayoutTsxPath, readGritPattern('shadcn-state-declarations'));
+    await applyGritQL(tree, appLayoutTsxPath, readGritPattern('shadcn-state-declarations'));
     // Add useEffect, useRef, useState imports from react
-    await (0, ast_1.addDestructuredImport)(tree, appLayoutTsxPath, ['useEffect', 'useRef', 'useState'], 'react');
+    await addDestructuredImport(tree, appLayoutTsxPath, [
+        'useEffect',
+        'useRef',
+        'useState'
+    ], 'react');
     // Append the auth menu to the header element
-    await (0, ast_1.applyGritQL)(tree, appLayoutTsxPath, readGritPattern('shadcn-auth-menu'));
+    await applyGritQL(tree, appLayoutTsxPath, readGritPattern('shadcn-auth-menu'));
 }
+
 //# sourceMappingURL=utils.js.map