@ttoss/cloud-auth 0.12.18 → 0.12.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttoss/cloud-auth",
-  "version": "0.12.18",
+  "version": "0.12.20",
   "repository": {
     "type": "git",
     "url": "https://github.com/ttoss/ttoss.git",
@@ -19,14 +19,14 @@
   ],
   "sideEffects": false,
   "dependencies": {
-    "@ttoss/cloudformation": "^0.10.7"
+    "@ttoss/cloudformation": "^0.10.9"
   },
   "devDependencies": {
-    "@types/jest": "^29.5.12",
+    "@types/jest": "^29.5.13",
     "jest": "^29.7.0",
-    "tsup": "^8.2.4",
+    "tsup": "^8.3.0",
     "typescript": "~5.6.2",
-    "@ttoss/config": "^1.32.9"
+    "@ttoss/config": "^1.33.0"
   },
   "publishConfig": {
     "access": "public",

package/dist/esm/index.js

@@ -1,299 +0,0 @@
-/** Powered by @ttoss/config. https://ttoss.dev/docs/modules/packages/config/ */
-
-// src/config.ts
-var PASSWORD_MINIMUM_LENGTH = 8;
-
-// src/template.ts
-var CognitoUserPoolLogicalId = "CognitoUserPool";
-var CognitoUserPoolClientLogicalId = "CognitoUserPoolClient";
-var CognitoIdentityPoolLogicalId = "CognitoIdentityPool";
-var IdentityPoolAuthenticatedIAMRoleLogicalId = "IdentityPoolAuthenticatedIAMRole";
-var IdentityPoolUnauthenticatedIAMRoleLogicalId = "IdentityPoolUnauthenticatedIAMRole";
-var DenyStatement = {
-  Effect: "Deny",
-  Action: ["*"],
-  Resource: ["*"]
-};
-var defaultPrincipalTags = {
-  appClientId: "aud",
-  userId: "sub"
-};
-var createAuthTemplate = ({
-  autoVerifiedAttributes = ["email"],
-  identityPool,
-  schema,
-  usernameAttributes = ["email"]
-} = {}) => {
-  const AutoVerifiedAttributes = Array.isArray(autoVerifiedAttributes) && autoVerifiedAttributes.length > 0 ? autoVerifiedAttributes : [];
-  const template = {
-    AWSTemplateFormatVersion: "2010-09-09",
-    Resources: {
-      [CognitoUserPoolLogicalId]: {
-        /**
-         * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpool.html
-         */
-        Type: "AWS::Cognito::UserPool",
-        Properties: {
-          AutoVerifiedAttributes,
-          Policies: {
-            PasswordPolicy: {
-              MinimumLength: PASSWORD_MINIMUM_LENGTH,
-              RequireLowercase: false,
-              RequireNumbers: false,
-              RequireSymbols: false,
-              RequireUppercase: false,
-              TemporaryPasswordValidityDays: 30
-            }
-          },
-          UsernameAttributes: usernameAttributes,
-          UsernameConfiguration: {
-            CaseSensitive: false
-          },
-          UserPoolName: {
-            Ref: "AWS::StackName"
-          }
-        }
-      },
-      [CognitoUserPoolClientLogicalId]: {
-        /**
-         * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpoolclient.html
-         */
-        Type: "AWS::Cognito::UserPoolClient",
-        Properties: {
-          SupportedIdentityProviders: ["COGNITO"],
-          UserPoolId: {
-            Ref: "CognitoUserPool"
-          }
-        }
-      }
-    },
-    Outputs: {
-      Region: {
-        Description: "You use this value on Amplify Auth `region`.",
-        Value: {
-          Ref: "AWS::Region"
-        },
-        Export: {
-          Name: {
-            "Fn::Join": [":", [{
-              Ref: "AWS::StackName"
-            }, "Region"]]
-          }
-        }
-      },
-      UserPoolId: {
-        Description: "You use this value on Amplify Auth `userPoolId`.",
-        Value: {
-          Ref: CognitoUserPoolLogicalId
-        },
-        Export: {
-          Name: {
-            "Fn::Join": [":", [{
-              Ref: "AWS::StackName"
-            }, "UserPoolId"]]
-          }
-        }
-      },
-      AppClientId: {
-        Description: "You use this value on Amplify Auth `userPoolWebClientId`.",
-        Value: {
-          Ref: CognitoUserPoolClientLogicalId
-        },
-        Export: {
-          Name: {
-            "Fn::Join": [":", [{
-              Ref: "AWS::StackName"
-            }, "AppClientId"]]
-          }
-        }
-      }
-    }
-  };
-  if (schema) {
-    const Schema = schema.map(attribute => {
-      let NumberAttributeConstraints = void 0;
-      if (attribute.numberAttributeConstraints) {
-        NumberAttributeConstraints = {
-          MaxValue: attribute.numberAttributeConstraints?.maxValue,
-          MinValue: attribute.numberAttributeConstraints?.minValue
-        };
-      }
-      let StringAttributeConstraints = void 0;
-      if (attribute.stringAttributeConstraints) {
-        StringAttributeConstraints = {
-          MaxLength: attribute.stringAttributeConstraints?.maxLength,
-          MinLength: attribute.stringAttributeConstraints?.minLength
-        };
-      }
-      return {
-        AttributeDataType: attribute.attributeDataType,
-        DeveloperOnlyAttribute: attribute.developerOnlyAttribute,
-        Mutable: attribute.mutable,
-        Name: attribute.name,
-        NumberAttributeConstraints,
-        Required: attribute.required,
-        StringAttributeConstraints
-      };
-    });
-    template.Resources[CognitoUserPoolLogicalId].Properties.Schema = Schema;
-  }
-  if (identityPool?.enabled) {
-    template.Resources[CognitoIdentityPoolLogicalId] = {
-      /**
-       * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-identitypool.html
-       */
-      Type: "AWS::Cognito::IdentityPool",
-      Properties: {
-        AllowUnauthenticatedIdentities: identityPool.allowUnauthenticatedIdentities || false,
-        CognitoIdentityProviders: [{
-          ClientId: {
-            Ref: CognitoUserPoolClientLogicalId
-          },
-          ProviderName: {
-            "Fn::GetAtt": [CognitoUserPoolLogicalId, "ProviderName"]
-          }
-        }]
-      }
-    };
-    if (identityPool.name) {
-      template.Resources[CognitoIdentityPoolLogicalId].Properties.IdentityPoolName = identityPool.name;
-    }
-    template.Resources.CognitoIdentityPoolRoleAttachment = {
-      /**
-       * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-identitypoolroleattachment.html
-       */
-      Type: "AWS::Cognito::IdentityPoolRoleAttachment",
-      Properties: {
-        IdentityPoolId: {
-          Ref: CognitoIdentityPoolLogicalId
-        },
-        Roles: {}
-      }
-    };
-    if (!identityPool.authenticatedRoleArn) {
-      template.Resources[IdentityPoolAuthenticatedIAMRoleLogicalId] = {
-        Type: "AWS::IAM::Role",
-        Properties: {
-          AssumeRolePolicyDocument: {
-            Version: "2012-10-17",
-            Statement: [{
-              Effect: "Allow",
-              Principal: {
-                Federated: "cognito-identity.amazonaws.com"
-              },
-              Action: ["sts:AssumeRoleWithWebIdentity", "sts:TagSession"],
-              Condition: {
-                StringEquals: {
-                  "cognito-identity.amazonaws.com:aud": {
-                    Ref: CognitoIdentityPoolLogicalId
-                  }
-                },
-                "ForAnyValue:StringLike": {
-                  "cognito-identity.amazonaws.com:amr": "authenticated"
-                }
-              }
-            }]
-          },
-          Policies: identityPool.authenticatedPolicies || [{
-            PolicyName: "IdentityPoolAuthenticatedIAMRolePolicyName",
-            PolicyDocument: {
-              Version: "2012-10-17",
-              Statement: [DenyStatement]
-            }
-          }]
-        }
-      };
-      template.Resources.CognitoIdentityPoolRoleAttachment.Properties.Roles.authenticated = {
-        "Fn::GetAtt": [IdentityPoolAuthenticatedIAMRoleLogicalId, "Arn"]
-      };
-    } else {
-      template.Resources.CognitoIdentityPoolRoleAttachment.Properties.Roles.authenticated = identityPool.authenticatedRoleArn;
-    }
-    if (!identityPool.unauthenticatedRoleArn) {
-      template.Resources[IdentityPoolUnauthenticatedIAMRoleLogicalId] = {
-        Type: "AWS::IAM::Role",
-        Properties: {
-          AssumeRolePolicyDocument: {
-            Version: "2012-10-17",
-            Statement: [{
-              Effect: "Allow",
-              Principal: {
-                Federated: "cognito-identity.amazonaws.com"
-              },
-              Action: "sts:AssumeRoleWithWebIdentity",
-              Condition: {
-                StringEquals: {
-                  "cognito-identity.amazonaws.com:aud": {
-                    Ref: CognitoIdentityPoolLogicalId
-                  }
-                },
-                "ForAnyValue:StringLike": {
-                  "cognito-identity.amazonaws.com:amr": "unauthenticated"
-                }
-              }
-            }]
-          },
-          Policies: identityPool.authenticatedPolicies || [{
-            PolicyName: "IdentityPoolUnauthenticatedIAMRolePolicyName",
-            PolicyDocument: {
-              Version: "2012-10-17",
-              Statement: [DenyStatement]
-            }
-          }]
-        }
-      };
-      template.Resources.CognitoIdentityPoolRoleAttachment.Properties.Roles.unauthenticated = {
-        "Fn::GetAtt": [IdentityPoolUnauthenticatedIAMRoleLogicalId, "Arn"]
-      };
-    } else {
-      template.Resources.CognitoIdentityPoolRoleAttachment.Properties.Roles.unauthenticated = identityPool.unauthenticatedRoleArn;
-    }
-    if (identityPool.principalTags || identityPool.principalTags === void 0) {
-      const PrincipalTags = (() => {
-        if (typeof identityPool.principalTags === "boolean") {
-          return defaultPrincipalTags;
-        }
-        if (identityPool.principalTags === void 0) {
-          return defaultPrincipalTags;
-        }
-        return identityPool.principalTags;
-      })();
-      template.Resources.CognitoIdentityPoolPrincipalTag = {
-        Type: "AWS::Cognito::IdentityPoolPrincipalTag",
-        Properties: {
-          IdentityPoolId: {
-            Ref: CognitoIdentityPoolLogicalId
-          },
-          IdentityProviderName: {
-            "Fn::GetAtt": [CognitoUserPoolLogicalId, "ProviderName"]
-          },
-          PrincipalTags,
-          UseDefaults: false
-        }
-      };
-    }
-    if (!template.Outputs) {
-      template.Outputs = {};
-    }
-    template.Outputs.IdentityPoolId = {
-      Description: "You use this value on Amplify Auth `identityPoolId`.",
-      Value: {
-        Ref: CognitoIdentityPoolLogicalId
-      },
-      Export: {
-        Name: {
-          "Fn::Join": [":", [{
-            Ref: "AWS::StackName"
-          }, "CognitoIdentityPoolId"]]
-        }
-      }
-    };
-  }
-  return template;
-};
-createAuthTemplate.CognitoUserPoolLogicalId = CognitoUserPoolLogicalId;
-createAuthTemplate.CognitoUserPoolClientLogicalId = CognitoUserPoolClientLogicalId;
-createAuthTemplate.CognitoIdentityPoolLogicalId = CognitoIdentityPoolLogicalId;
-createAuthTemplate.IdentityPoolAuthenticatedIAMRoleLogicalId = IdentityPoolAuthenticatedIAMRoleLogicalId;
-createAuthTemplate.IdentityPoolUnauthenticatedIAMRoleLogicalId = IdentityPoolUnauthenticatedIAMRoleLogicalId;
-export { PASSWORD_MINIMUM_LENGTH, createAuthTemplate };

package/dist/index.d.mts

@@ -1,45 +0,0 @@
-import { Policy } from '@ttoss/cloudformation';
-
-declare const PASSWORD_MINIMUM_LENGTH = 8;
-
-declare const createAuthTemplate: {
-    ({ autoVerifiedAttributes, identityPool, schema, usernameAttributes, }?: {
-        autoVerifiedAttributes?: Array<"email" | "phone_number"> | null | false;
-        identityPool?: {
-            enabled?: boolean;
-            name?: string;
-            allowUnauthenticatedIdentities?: boolean;
-            authenticatedRoleArn?: string;
-            authenticatedPolicies?: Policy[];
-            unauthenticatedRoleArn?: string;
-            unauthenticatedPolicies?: Policy[];
-            principalTags?: Record<string, string> | boolean;
-        };
-        /**
-         * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-userpool-schemaattribute.html
-         */
-        schema?: {
-            attributeDataType?: "Boolean" | "DateTime" | "Number" | "String";
-            developerOnlyAttribute?: boolean;
-            mutable?: boolean;
-            name?: string;
-            numberAttributeConstraints?: {
-                maxValue?: string;
-                minValue?: string;
-            };
-            required?: boolean;
-            stringAttributeConstraints?: {
-                maxLength: string;
-                minLength: string;
-            };
-        }[];
-        usernameAttributes?: Array<"email" | "phone_number"> | null;
-    }): any;
-    CognitoUserPoolLogicalId: string;
-    CognitoUserPoolClientLogicalId: string;
-    CognitoIdentityPoolLogicalId: string;
-    IdentityPoolAuthenticatedIAMRoleLogicalId: string;
-    IdentityPoolUnauthenticatedIAMRoleLogicalId: string;
-};
-
-export { PASSWORD_MINIMUM_LENGTH, createAuthTemplate };

package/dist/index.d.ts

@@ -1,45 +0,0 @@
-import { Policy } from '@ttoss/cloudformation';
-
-declare const PASSWORD_MINIMUM_LENGTH = 8;
-
-declare const createAuthTemplate: {
-    ({ autoVerifiedAttributes, identityPool, schema, usernameAttributes, }?: {
-        autoVerifiedAttributes?: Array<"email" | "phone_number"> | null | false;
-        identityPool?: {
-            enabled?: boolean;
-            name?: string;
-            allowUnauthenticatedIdentities?: boolean;
-            authenticatedRoleArn?: string;
-            authenticatedPolicies?: Policy[];
-            unauthenticatedRoleArn?: string;
-            unauthenticatedPolicies?: Policy[];
-            principalTags?: Record<string, string> | boolean;
-        };
-        /**
-         * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-userpool-schemaattribute.html
-         */
-        schema?: {
-            attributeDataType?: "Boolean" | "DateTime" | "Number" | "String";
-            developerOnlyAttribute?: boolean;
-            mutable?: boolean;
-            name?: string;
-            numberAttributeConstraints?: {
-                maxValue?: string;
-                minValue?: string;
-            };
-            required?: boolean;
-            stringAttributeConstraints?: {
-                maxLength: string;
-                minLength: string;
-            };
-        }[];
-        usernameAttributes?: Array<"email" | "phone_number"> | null;
-    }): any;
-    CognitoUserPoolLogicalId: string;
-    CognitoUserPoolClientLogicalId: string;
-    CognitoIdentityPoolLogicalId: string;
-    IdentityPoolAuthenticatedIAMRoleLogicalId: string;
-    IdentityPoolUnauthenticatedIAMRoleLogicalId: string;
-};
-
-export { PASSWORD_MINIMUM_LENGTH, createAuthTemplate };

package/dist/index.js

@@ -1,335 +0,0 @@
-/** Powered by @ttoss/config. https://ttoss.dev/docs/modules/packages/config/ */
-"use strict";
-
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all) __defProp(target, name, {
-    get: all[name],
-    enumerable: true
-  });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from)) if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
-      get: () => from[key],
-      enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
-    });
-  }
-  return to;
-};
-var __toCommonJS = mod => __copyProps(__defProp({}, "__esModule", {
-  value: true
-}), mod);
-
-// src/index.ts
-var src_exports = {};
-__export(src_exports, {
-  PASSWORD_MINIMUM_LENGTH: () => PASSWORD_MINIMUM_LENGTH,
-  createAuthTemplate: () => createAuthTemplate
-});
-module.exports = __toCommonJS(src_exports);
-
-// src/config.ts
-var PASSWORD_MINIMUM_LENGTH = 8;
-
-// src/template.ts
-var CognitoUserPoolLogicalId = "CognitoUserPool";
-var CognitoUserPoolClientLogicalId = "CognitoUserPoolClient";
-var CognitoIdentityPoolLogicalId = "CognitoIdentityPool";
-var IdentityPoolAuthenticatedIAMRoleLogicalId = "IdentityPoolAuthenticatedIAMRole";
-var IdentityPoolUnauthenticatedIAMRoleLogicalId = "IdentityPoolUnauthenticatedIAMRole";
-var DenyStatement = {
-  Effect: "Deny",
-  Action: ["*"],
-  Resource: ["*"]
-};
-var defaultPrincipalTags = {
-  appClientId: "aud",
-  userId: "sub"
-};
-var createAuthTemplate = ({
-  autoVerifiedAttributes = ["email"],
-  identityPool,
-  schema,
-  usernameAttributes = ["email"]
-} = {}) => {
-  const AutoVerifiedAttributes = Array.isArray(autoVerifiedAttributes) && autoVerifiedAttributes.length > 0 ? autoVerifiedAttributes : [];
-  const template = {
-    AWSTemplateFormatVersion: "2010-09-09",
-    Resources: {
-      [CognitoUserPoolLogicalId]: {
-        /**
-         * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpool.html
-         */
-        Type: "AWS::Cognito::UserPool",
-        Properties: {
-          AutoVerifiedAttributes,
-          Policies: {
-            PasswordPolicy: {
-              MinimumLength: PASSWORD_MINIMUM_LENGTH,
-              RequireLowercase: false,
-              RequireNumbers: false,
-              RequireSymbols: false,
-              RequireUppercase: false,
-              TemporaryPasswordValidityDays: 30
-            }
-          },
-          UsernameAttributes: usernameAttributes,
-          UsernameConfiguration: {
-            CaseSensitive: false
-          },
-          UserPoolName: {
-            Ref: "AWS::StackName"
-          }
-        }
-      },
-      [CognitoUserPoolClientLogicalId]: {
-        /**
-         * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpoolclient.html
-         */
-        Type: "AWS::Cognito::UserPoolClient",
-        Properties: {
-          SupportedIdentityProviders: ["COGNITO"],
-          UserPoolId: {
-            Ref: "CognitoUserPool"
-          }
-        }
-      }
-    },
-    Outputs: {
-      Region: {
-        Description: "You use this value on Amplify Auth `region`.",
-        Value: {
-          Ref: "AWS::Region"
-        },
-        Export: {
-          Name: {
-            "Fn::Join": [":", [{
-              Ref: "AWS::StackName"
-            }, "Region"]]
-          }
-        }
-      },
-      UserPoolId: {
-        Description: "You use this value on Amplify Auth `userPoolId`.",
-        Value: {
-          Ref: CognitoUserPoolLogicalId
-        },
-        Export: {
-          Name: {
-            "Fn::Join": [":", [{
-              Ref: "AWS::StackName"
-            }, "UserPoolId"]]
-          }
-        }
-      },
-      AppClientId: {
-        Description: "You use this value on Amplify Auth `userPoolWebClientId`.",
-        Value: {
-          Ref: CognitoUserPoolClientLogicalId
-        },
-        Export: {
-          Name: {
-            "Fn::Join": [":", [{
-              Ref: "AWS::StackName"
-            }, "AppClientId"]]
-          }
-        }
-      }
-    }
-  };
-  if (schema) {
-    const Schema = schema.map(attribute => {
-      let NumberAttributeConstraints = void 0;
-      if (attribute.numberAttributeConstraints) {
-        NumberAttributeConstraints = {
-          MaxValue: attribute.numberAttributeConstraints?.maxValue,
-          MinValue: attribute.numberAttributeConstraints?.minValue
-        };
-      }
-      let StringAttributeConstraints = void 0;
-      if (attribute.stringAttributeConstraints) {
-        StringAttributeConstraints = {
-          MaxLength: attribute.stringAttributeConstraints?.maxLength,
-          MinLength: attribute.stringAttributeConstraints?.minLength
-        };
-      }
-      return {
-        AttributeDataType: attribute.attributeDataType,
-        DeveloperOnlyAttribute: attribute.developerOnlyAttribute,
-        Mutable: attribute.mutable,
-        Name: attribute.name,
-        NumberAttributeConstraints,
-        Required: attribute.required,
-        StringAttributeConstraints
-      };
-    });
-    template.Resources[CognitoUserPoolLogicalId].Properties.Schema = Schema;
-  }
-  if (identityPool?.enabled) {
-    template.Resources[CognitoIdentityPoolLogicalId] = {
-      /**
-       * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-identitypool.html
-       */
-      Type: "AWS::Cognito::IdentityPool",
-      Properties: {
-        AllowUnauthenticatedIdentities: identityPool.allowUnauthenticatedIdentities || false,
-        CognitoIdentityProviders: [{
-          ClientId: {
-            Ref: CognitoUserPoolClientLogicalId
-          },
-          ProviderName: {
-            "Fn::GetAtt": [CognitoUserPoolLogicalId, "ProviderName"]
-          }
-        }]
-      }
-    };
-    if (identityPool.name) {
-      template.Resources[CognitoIdentityPoolLogicalId].Properties.IdentityPoolName = identityPool.name;
-    }
-    template.Resources.CognitoIdentityPoolRoleAttachment = {
-      /**
-       * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-identitypoolroleattachment.html
-       */
-      Type: "AWS::Cognito::IdentityPoolRoleAttachment",
-      Properties: {
-        IdentityPoolId: {
-          Ref: CognitoIdentityPoolLogicalId
-        },
-        Roles: {}
-      }
-    };
-    if (!identityPool.authenticatedRoleArn) {
-      template.Resources[IdentityPoolAuthenticatedIAMRoleLogicalId] = {
-        Type: "AWS::IAM::Role",
-        Properties: {
-          AssumeRolePolicyDocument: {
-            Version: "2012-10-17",
-            Statement: [{
-              Effect: "Allow",
-              Principal: {
-                Federated: "cognito-identity.amazonaws.com"
-              },
-              Action: ["sts:AssumeRoleWithWebIdentity", "sts:TagSession"],
-              Condition: {
-                StringEquals: {
-                  "cognito-identity.amazonaws.com:aud": {
-                    Ref: CognitoIdentityPoolLogicalId
-                  }
-                },
-                "ForAnyValue:StringLike": {
-                  "cognito-identity.amazonaws.com:amr": "authenticated"
-                }
-              }
-            }]
-          },
-          Policies: identityPool.authenticatedPolicies || [{
-            PolicyName: "IdentityPoolAuthenticatedIAMRolePolicyName",
-            PolicyDocument: {
-              Version: "2012-10-17",
-              Statement: [DenyStatement]
-            }
-          }]
-        }
-      };
-      template.Resources.CognitoIdentityPoolRoleAttachment.Properties.Roles.authenticated = {
-        "Fn::GetAtt": [IdentityPoolAuthenticatedIAMRoleLogicalId, "Arn"]
-      };
-    } else {
-      template.Resources.CognitoIdentityPoolRoleAttachment.Properties.Roles.authenticated = identityPool.authenticatedRoleArn;
-    }
-    if (!identityPool.unauthenticatedRoleArn) {
-      template.Resources[IdentityPoolUnauthenticatedIAMRoleLogicalId] = {
-        Type: "AWS::IAM::Role",
-        Properties: {
-          AssumeRolePolicyDocument: {
-            Version: "2012-10-17",
-            Statement: [{
-              Effect: "Allow",
-              Principal: {
-                Federated: "cognito-identity.amazonaws.com"
-              },
-              Action: "sts:AssumeRoleWithWebIdentity",
-              Condition: {
-                StringEquals: {
-                  "cognito-identity.amazonaws.com:aud": {
-                    Ref: CognitoIdentityPoolLogicalId
-                  }
-                },
-                "ForAnyValue:StringLike": {
-                  "cognito-identity.amazonaws.com:amr": "unauthenticated"
-                }
-              }
-            }]
-          },
-          Policies: identityPool.authenticatedPolicies || [{
-            PolicyName: "IdentityPoolUnauthenticatedIAMRolePolicyName",
-            PolicyDocument: {
-              Version: "2012-10-17",
-              Statement: [DenyStatement]
-            }
-          }]
-        }
-      };
-      template.Resources.CognitoIdentityPoolRoleAttachment.Properties.Roles.unauthenticated = {
-        "Fn::GetAtt": [IdentityPoolUnauthenticatedIAMRoleLogicalId, "Arn"]
-      };
-    } else {
-      template.Resources.CognitoIdentityPoolRoleAttachment.Properties.Roles.unauthenticated = identityPool.unauthenticatedRoleArn;
-    }
-    if (identityPool.principalTags || identityPool.principalTags === void 0) {
-      const PrincipalTags = (() => {
-        if (typeof identityPool.principalTags === "boolean") {
-          return defaultPrincipalTags;
-        }
-        if (identityPool.principalTags === void 0) {
-          return defaultPrincipalTags;
-        }
-        return identityPool.principalTags;
-      })();
-      template.Resources.CognitoIdentityPoolPrincipalTag = {
-        Type: "AWS::Cognito::IdentityPoolPrincipalTag",
-        Properties: {
-          IdentityPoolId: {
-            Ref: CognitoIdentityPoolLogicalId
-          },
-          IdentityProviderName: {
-            "Fn::GetAtt": [CognitoUserPoolLogicalId, "ProviderName"]
-          },
-          PrincipalTags,
-          UseDefaults: false
-        }
-      };
-    }
-    if (!template.Outputs) {
-      template.Outputs = {};
-    }
-    template.Outputs.IdentityPoolId = {
-      Description: "You use this value on Amplify Auth `identityPoolId`.",
-      Value: {
-        Ref: CognitoIdentityPoolLogicalId
-      },
-      Export: {
-        Name: {
-          "Fn::Join": [":", [{
-            Ref: "AWS::StackName"
-          }, "CognitoIdentityPoolId"]]
-        }
-      }
-    };
-  }
-  return template;
-};
-createAuthTemplate.CognitoUserPoolLogicalId = CognitoUserPoolLogicalId;
-createAuthTemplate.CognitoUserPoolClientLogicalId = CognitoUserPoolClientLogicalId;
-createAuthTemplate.CognitoIdentityPoolLogicalId = CognitoIdentityPoolLogicalId;
-createAuthTemplate.IdentityPoolAuthenticatedIAMRoleLogicalId = IdentityPoolAuthenticatedIAMRoleLogicalId;
-createAuthTemplate.IdentityPoolUnauthenticatedIAMRoleLogicalId = IdentityPoolUnauthenticatedIAMRoleLogicalId;
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  PASSWORD_MINIMUM_LENGTH,
-  createAuthTemplate
-});