@aws/nx-plugin 1.0.0-rc.43 → 1.0.0-rc.45

package/src/utils/dcr-proxy-constructs/files/cdk/app/dcr-proxies/__nameKebabCase__/__nameKebabCase__.ts.template

@@ -0,0 +1,227 @@
+import * as url from 'node:url';
+import { Construct } from 'constructs';
+import { Duration, Stack } from 'aws-cdk-lib';
+import * as apigwv2 from 'aws-cdk-lib/aws-apigatewayv2';
+import * as integrations from 'aws-cdk-lib/aws-apigatewayv2-integrations';
+import * as lambda from 'aws-cdk-lib/aws-lambda';
+import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
+import { HttpApi } from '../../../core/api/http-api<% if (esm) { %>.js<% } %>';
+import {
+  HttpApiIntegration,
+  OperationDetails,
+} from '../../../core/api/utils<% if (esm) { %>.js<% } %>';
+
+export interface <%- nameClassName %>Props {
+  /**
+   * Cognito User Pool id (e.g. `us-east-1_abc123`).
+   */
+  readonly userPoolId: string;
+
+  /**
+   * Cognito User Pool App Client id.
+   */
+  readonly userPoolClientId: string;
+
+  /**
+   * ARN of the Secrets Manager secret holding the Cognito App Client secret.
+   * The token handler reads this at runtime to complete the token exchange;
+   * the secret is never exposed to the client. Create the secret in your own
+   * stack (from your App Client's generated secret) and pass its ARN here.
+   */
+  readonly cognitoClientSecretArn: string;
+
+  /**
+   * Base URL of the Cognito Hosted UI domain, without a trailing slash
+   * (e.g. `https://my-domain.auth.us-east-1.amazoncognito.com`). The proxy
+   * forwards `/authorize` and `/oauth/token` to this host.
+   */
+  readonly cognitoHostedUiBase: string;
+
+  /**
+   * Full URL of the upstream MCP server (e.g. AgentCore Runtime/Gateway
+   * endpoint). The proxy forwards requests on its `/mcp` path to this URL and
+   * rewrites the upstream `WWW-Authenticate` header so MCP clients discover
+   * this proxy as the protected-resource metadata host.
+   */
+  readonly upstreamUrl: string;
+}
+
+// The proxy operations wired to the shared HttpApi construct. The
+// openid-configuration route reuses the authorization-server-metadata handler.
+type <%- nameClassName %>Operation =
+  | 'protectedResourceMetadata'
+  | 'authServerMetadata'
+  | 'openIdConfiguration'
+  | 'register'
+  | 'authorize'
+  | 'token'
+  | 'mcp';
+
+const OPERATIONS: Record<<%- nameClassName %>Operation, OperationDetails> = {
+  protectedResourceMetadata: {
+    path: '/.well-known/oauth-protected-resource',
+    method: 'GET',
+  },
+  authServerMetadata: {
+    path: '/.well-known/oauth-authorization-server',
+    method: 'GET',
+  },
+  openIdConfiguration: {
+    path: '/.well-known/openid-configuration',
+    method: 'GET',
+  },
+  register: { path: '/register', method: 'POST' },
+  authorize: { path: '/authorize', method: 'GET' },
+  token: { path: '/oauth/token', method: 'POST' },
+  mcp: { path: '/mcp', method: 'ANY' },
+};
+
+// Resolve a handler's rolldown bundle output directory, relative to this
+// compiled construct file, back to the workspace root.
+const asset = (bundlePathFromRoot: string): lambda.Code =>
+  lambda.Code.fromAsset(
+    url.fileURLToPath(
+      new URL(
+        `../../../../../../../${bundlePathFromRoot}`,
+        <% if (esm) { %>import.meta.url<% } else { %>require('url').pathToFileURL(__filename).href<% } %>,
+      ),
+    ),
+  );
+
+/**
+ * OAuth Dynamic Client Registration (DCR) proxy for Amazon Cognito.
+ *
+ * Lets MCP clients (Claude Code, Kiro CLI, MCP Inspector, ...) authenticate
+ * against an Amazon Cognito User Pool while keeping the Hosted UI flow intact,
+ * supporting RFC 7591 Dynamic Client Registration, and never exposing the
+ * Cognito App Client secret to the client.
+ */
+export class <%- nameClassName %> extends Construct {
+  readonly httpApi: HttpApi<
+    <%- nameClassName %>Operation,
+    Record<<%- nameClassName %>Operation, HttpApiIntegration>
+  >;
+  readonly proxyUrl: string;
+  readonly mcpUrl: string;
+  readonly metadataUrl: string;
+  readonly authServerMetadataUrl: string;
+  readonly tokenEndpoint: string;
+  readonly registrationEndpoint: string;
+
+  constructor(scope: Construct, id: string, props: <%- nameClassName %>Props) {
+    super(scope, id);
+
+    const region = Stack.of(this).region;
+
+    const clientSecret = secretsmanager.Secret.fromSecretCompleteArn(
+      this,
+      'CognitoClientSecret',
+      props.cognitoClientSecretArn,
+    );
+
+    const cognitoIssuer = `https://cognito-idp.${region}.amazonaws.com/${props.userPoolId}`;
+
+    const baseEnv: Record<string, string> = {
+      COGNITO_CLIENT_ID: props.userPoolClientId,
+      COGNITO_CLIENT_SECRET_ARN: clientSecret.secretArn,
+      COGNITO_ISSUER: cognitoIssuer,
+      COGNITO_HOSTED_UI_BASE: props.cognitoHostedUiBase,
+      COGNITO_REGION: region,
+    };
+
+    // Lambda functions use their auto-created log group; access logging for the
+    // API is handled by the shared HttpApi construct's KMS-encrypted log group.
+    const makeFn = (
+      id_: string,
+      bundlePathFromRoot: string,
+      overrides?: Partial<lambda.FunctionProps>,
+    ): lambda.Function =>
+      new lambda.Function(this, id_, {
+        code: asset(bundlePathFromRoot),
+        handler: 'index.handler',
+        runtime: lambda.Runtime.NODEJS_22_X,
+        architecture: lambda.Architecture.ARM_64,
+        timeout: Duration.seconds(10),
+        memorySize: 256,
+        environment: baseEnv,
+        tracing: lambda.Tracing.ACTIVE,
+        ...overrides,
+      });
+
+    const protectedResourceFn = makeFn(
+      'ProtectedResourceFn',
+      '<%- bundlePathsFromRoot['protected-resource-metadata'] %>',
+    );
+    const authServerFn = makeFn(
+      'AuthServerFn',
+      '<%- bundlePathsFromRoot['authorization-server-metadata'] %>',
+    );
+    const registerFn = makeFn(
+      'RegisterFn',
+      '<%- bundlePathsFromRoot['register'] %>',
+    );
+    const authorizeFn = makeFn(
+      'AuthorizeFn',
+      '<%- bundlePathsFromRoot['authorize'] %>',
+    );
+    const tokenFn = makeFn('TokenFn', '<%- bundlePathsFromRoot['token'] %>');
+
+    clientSecret.grantRead(tokenFn);
+
+    // The MCP proxy Lambda buffers upstream responses, so it is given more time
+    // (up to the API Gateway HTTP API integration limit) and memory.
+    const mcpProxyFn = makeFn(
+      'McpProxyFn',
+      '<%- bundlePathsFromRoot['mcp-proxy'] %>',
+      {
+        timeout: Duration.seconds(29),
+        memorySize: 512,
+      },
+    );
+
+    const int = (id_: string, fn: lambda.Function): HttpApiIntegration => ({
+      integration: new integrations.HttpLambdaIntegration(id_, fn),
+    });
+
+    this.httpApi = new HttpApi(this, 'HttpApi', {
+      apiName: `${id}-mcp-auth-proxy`,
+      description: 'MCP-compatible OAuth proxy for Amazon Cognito',
+      corsPreflight: {
+        allowOrigins: ['*'],
+        allowMethods: [
+          apigwv2.CorsHttpMethod.GET,
+          apigwv2.CorsHttpMethod.POST,
+          apigwv2.CorsHttpMethod.DELETE,
+          apigwv2.CorsHttpMethod.OPTIONS,
+        ],
+        allowHeaders: ['authorization', 'content-type', 'mcp-protocol-version'],
+        maxAge: Duration.minutes(10),
+      },
+      operations: OPERATIONS,
+      integrations: {
+        protectedResourceMetadata: int(
+          'ProtectedResourceInt',
+          protectedResourceFn,
+        ),
+        authServerMetadata: int('AuthServerInt', authServerFn),
+        openIdConfiguration: int('OpenIdConfigInt', authServerFn),
+        register: int('RegisterInt', registerFn),
+        authorize: int('AuthorizeInt', authorizeFn),
+        token: int('TokenInt', tokenFn),
+        mcp: int('McpProxyInt', mcpProxyFn),
+      },
+    });
+
+    this.proxyUrl = this.httpApi.api.apiEndpoint;
+    this.mcpUrl = `${this.proxyUrl}/mcp`;
+    this.metadataUrl = `${this.proxyUrl}/.well-known/oauth-protected-resource`;
+    this.authServerMetadataUrl = `${this.proxyUrl}/.well-known/oauth-authorization-server`;
+    this.tokenEndpoint = `${this.proxyUrl}/oauth/token`;
+    this.registrationEndpoint = `${this.proxyUrl}/register`;
+
+    // Wire the MCP proxy handler's upstream + metadata URLs after the API is
+    // created so its endpoint is resolvable.
+    mcpProxyFn.addEnvironment('UPSTREAM_URL', props.upstreamUrl);
+    mcpProxyFn.addEnvironment('PROXY_METADATA_URL', this.metadataUrl);
+  }
+}

package/src/utils/dcr-proxy-constructs/files/project/src/handlers/authorization-server-metadata.ts.template

@@ -0,0 +1,39 @@
+import type { APIGatewayProxyHandlerV2 } from 'aws-lambda';
+
+const COGNITO_ISSUER = process.env.COGNITO_ISSUER!;
+
+let cached: Record<string, unknown> | undefined;
+
+async function fetchUpstream(): Promise<Record<string, unknown>> {
+  if (cached) return cached;
+  const res = await fetch(`${COGNITO_ISSUER}/.well-known/openid-configuration`);
+  if (!res.ok) {
+    throw new Error(`Cognito discovery failed: ${res.status} ${res.statusText}`);
+  }
+  cached = (await res.json()) as Record<string, unknown>;
+  return cached;
+}
+
+export const handler: APIGatewayProxyHandlerV2 = async (event) => {
+  const proxyUrl = `https://${event.requestContext.domainName}`;
+  const upstream = await fetchUpstream();
+
+  // Override the proxy-handled endpoints.
+  // jwks_uri is kept as Cognito's so JWT verification works directly against
+  // Cognito. issuer is kept as Cognito's so JWT.iss validation matches.
+  // authorization_endpoint points to the proxy so we can strip the RFC 8707
+  // `resource` parameter that some MCP clients send (Cognito rejects token
+  // exchange for unregistered resource server URLs).
+  const metadata = {
+    ...upstream,
+    authorization_endpoint: `${proxyUrl}/authorize`,
+    token_endpoint: `${proxyUrl}/oauth/token`,
+    registration_endpoint: `${proxyUrl}/register`,
+  };
+
+  return {
+    statusCode: 200,
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(metadata),
+  };
+};

package/src/utils/dcr-proxy-constructs/files/project/src/handlers/authorize.ts.template

@@ -0,0 +1,26 @@
+import type { APIGatewayProxyHandlerV2 } from 'aws-lambda';
+
+const COGNITO_HOSTED_UI_BASE = process.env.COGNITO_HOSTED_UI_BASE!;
+
+export const handler: APIGatewayProxyHandlerV2 = async (event) => {
+  const params = new URLSearchParams(event.rawQueryString ?? '');
+
+  console.log('[authorize]', {
+    scope: params.get('scope'),
+    redirect_uri: params.get('redirect_uri'),
+    has_resource: params.has('resource'),
+  });
+
+  // RFC 8707 `resource` parameter binds the access token's `aud` claim to
+  // the given URL. Cognito accepts it at /authorize but rejects the token
+  // exchange with `invalid_grant` when the URL is not registered as a
+  // resource server. MCP clients send this unconditionally, so strip it.
+  params.delete('resource');
+
+  const target = `${COGNITO_HOSTED_UI_BASE}/oauth2/authorize?${params.toString()}`;
+  return {
+    statusCode: 302,
+    headers: { location: target },
+    body: '',
+  };
+};

package/src/utils/dcr-proxy-constructs/files/project/src/handlers/mcp-proxy.ts.template

@@ -0,0 +1,89 @@
+import type {
+  APIGatewayProxyHandlerV2,
+  APIGatewayProxyStructuredResultV2,
+} from 'aws-lambda';
+
+const UPSTREAM_URL = process.env.UPSTREAM_URL!;
+const PROXY_METADATA_URL = process.env.PROXY_METADATA_URL!;
+
+// Headers stripped when relaying requests/responses through the proxy:
+// RFC 7230 hop-by-hop headers (scoped to a single connection, not the next
+// hop), plus entity headers that fetch() re-derives from the actual body -
+// forwarding stale values would corrupt the response.
+const HOP_BY_HOP = new Set([
+  'connection',
+  'keep-alive',
+  'proxy-authenticate',
+  'proxy-authorization',
+  'te',
+  'trailers',
+  'transfer-encoding',
+  'upgrade',
+  'content-length',
+  'content-encoding',
+  'host',
+]);
+
+export const handler: APIGatewayProxyHandlerV2 = async (
+  event,
+): Promise<APIGatewayProxyStructuredResultV2> => {
+  const method = event.requestContext.http.method;
+  const qs = event.rawQueryString ? `?${event.rawQueryString}` : '';
+  const url = `${UPSTREAM_URL}${qs}`;
+
+  const fwdHeaders = new Headers();
+  for (const [k, v] of Object.entries(event.headers ?? {})) {
+    if (!v) continue;
+    if (HOP_BY_HOP.has(k.toLowerCase())) continue;
+    fwdHeaders.set(k, v);
+  }
+
+  const reqBody = event.body
+    ? event.isBase64Encoded
+      ? Buffer.from(event.body, 'base64')
+      : event.body
+    : undefined;
+
+  const upstream = await fetch(url, {
+    method,
+    headers: fwdHeaders,
+    body: reqBody as unknown as ArrayBuffer | string | undefined,
+  });
+
+  const respHeaders: Record<string, string> = {};
+  upstream.headers.forEach((v, k) => {
+    if (HOP_BY_HOP.has(k.toLowerCase())) return;
+    respHeaders[k] = v;
+  });
+
+  // Rewrite WWW-Authenticate so MCP clients discover this proxy
+  // as the protected-resource metadata host instead of the upstream.
+  const authKey = Object.keys(respHeaders).find(
+    (k) => k.toLowerCase() === 'www-authenticate',
+  );
+  if (authKey) {
+    respHeaders[authKey] = respHeaders[authKey].replace(
+      /resource_metadata="[^"]*"/i,
+      `resource_metadata="${PROXY_METADATA_URL}"`,
+    );
+  }
+
+  const buf = Buffer.from(await upstream.arrayBuffer());
+  const contentType = (
+    respHeaders['content-type'] ??
+    respHeaders['Content-Type'] ??
+    ''
+  ).toLowerCase();
+  const isText =
+    contentType.includes('json') ||
+    contentType.includes('text') ||
+    contentType.includes('xml') ||
+    contentType.includes('event-stream');
+
+  return {
+    statusCode: upstream.status,
+    headers: respHeaders,
+    body: isText ? buf.toString('utf-8') : buf.toString('base64'),
+    isBase64Encoded: !isText,
+  };
+};

package/src/utils/dcr-proxy-constructs/files/project/src/handlers/protected-resource-metadata.ts.template

@@ -0,0 +1,13 @@
+import type { APIGatewayProxyHandlerV2 } from 'aws-lambda';
+
+export const handler: APIGatewayProxyHandlerV2 = async (event) => {
+  const proxyUrl = `https://${event.requestContext.domainName}`;
+  return {
+    statusCode: 200,
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({
+      resource: `${proxyUrl}/mcp`,
+      authorization_servers: [proxyUrl],
+    }),
+  };
+};

package/src/utils/dcr-proxy-constructs/files/project/src/handlers/register.ts.template

@@ -0,0 +1,70 @@
+import type {
+  APIGatewayProxyHandlerV2,
+  APIGatewayProxyStructuredResultV2,
+} from 'aws-lambda';
+
+const COGNITO_CLIENT_ID = process.env.COGNITO_CLIENT_ID!;
+
+interface RegisterRequest {
+  redirect_uris?: unknown;
+  [key: string]: unknown;
+}
+
+function jsonResponse(
+  statusCode: number,
+  body: unknown,
+): APIGatewayProxyStructuredResultV2 {
+  return {
+    statusCode,
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(body),
+  };
+}
+
+export const handler: APIGatewayProxyHandlerV2 = async (event) => {
+  if (!event.body) {
+    return jsonResponse(400, {
+      error: 'invalid_client_metadata',
+      error_description: 'request body is required',
+    });
+  }
+
+  let req: RegisterRequest;
+  try {
+    req = JSON.parse(event.body) as RegisterRequest;
+  } catch {
+    return jsonResponse(400, {
+      error: 'invalid_client_metadata',
+      error_description: 'request body must be valid JSON',
+    });
+  }
+
+  const redirectUris = req.redirect_uris;
+  if (!Array.isArray(redirectUris) || redirectUris.length === 0) {
+    return jsonResponse(400, {
+      error: 'invalid_redirect_uri',
+      error_description: 'redirect_uris is required and must be a non-empty array',
+    });
+  }
+
+  // The proxy fronts a single Cognito App Client, so Cognito performs the
+  // authoritative check: any redirect_uri forwarded to the Hosted UI must be
+  // registered as a callback URL on that App Client. The proxy only validates
+  // the request shape here and passes the URIs through unchanged.
+  for (const uri of redirectUris) {
+    if (typeof uri !== 'string') {
+      return jsonResponse(400, {
+        error: 'invalid_redirect_uri',
+        error_description: 'each redirect_uri must be a string',
+      });
+    }
+  }
+
+  return jsonResponse(201, {
+    client_id: COGNITO_CLIENT_ID,
+    redirect_uris: redirectUris,
+    token_endpoint_auth_method: 'none',
+    grant_types: ['authorization_code', 'refresh_token'],
+    response_types: ['code'],
+  });
+};

package/src/utils/dcr-proxy-constructs/files/project/src/handlers/token.ts.template

@@ -0,0 +1,75 @@
+import type { APIGatewayProxyHandlerV2 } from 'aws-lambda';
+import {
+  SecretsManagerClient,
+  GetSecretValueCommand,
+} from '@aws-sdk/client-secrets-manager';
+
+const COGNITO_HOSTED_UI_BASE = process.env.COGNITO_HOSTED_UI_BASE!;
+const COGNITO_CLIENT_ID = process.env.COGNITO_CLIENT_ID!;
+const COGNITO_CLIENT_SECRET_ARN = process.env.COGNITO_CLIENT_SECRET_ARN!;
+const COGNITO_REGION = process.env.COGNITO_REGION!;
+
+const sm = new SecretsManagerClient({ region: COGNITO_REGION });
+let cachedSecret: string | undefined;
+
+async function getClientSecret(): Promise<string> {
+  if (cachedSecret) return cachedSecret;
+  const res = await sm.send(
+    new GetSecretValueCommand({ SecretId: COGNITO_CLIENT_SECRET_ARN }),
+  );
+  if (!res.SecretString) {
+    throw new Error('client_secret missing in Secrets Manager');
+  }
+  cachedSecret = res.SecretString;
+  return cachedSecret;
+}
+
+export const handler: APIGatewayProxyHandlerV2 = async (event) => {
+  if (!event.body) {
+    return {
+      statusCode: 400,
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({
+        error: 'invalid_request',
+        error_description: 'request body is required',
+      }),
+    };
+  }
+
+  const rawBody = event.isBase64Encoded
+    ? Buffer.from(event.body, 'base64').toString('utf-8')
+    : event.body;
+
+  const params = new URLSearchParams(rawBody);
+
+  // Always force the real Cognito client_id and inject the server-side secret.
+  // DCR returned the same client_id to every caller, but we re-assert here
+  // to keep client_id/secret consistent regardless of what the caller sent.
+  params.set('client_id', COGNITO_CLIENT_ID);
+  params.set('client_secret', await getClientSecret());
+
+  // Cognito does not understand RFC 8707 `resource`; some MCP clients send it
+  // and Cognito has been observed to reject the exchange when present.
+  params.delete('resource');
+
+  const res = await fetch(`${COGNITO_HOSTED_UI_BASE}/oauth2/token`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/x-www-form-urlencoded' },
+    body: params.toString(),
+  });
+
+  const responseBody = await res.text();
+  console.log('[token]', {
+    grant_type: params.get('grant_type'),
+    status: res.status,
+    ...(res.ok ? {} : { body: responseBody }),
+  });
+
+  return {
+    statusCode: res.status,
+    headers: {
+      'content-type': res.headers.get('content-type') ?? 'application/json',
+    },
+    body: responseBody,
+  };
+};