@ttoss/cloud-auth 0.12.20 → 0.12.22

package/dist/esm/index.js

@@ -0,0 +1,299 @@
+/** Powered by @ttoss/config. https://ttoss.dev/docs/modules/packages/config/ */
+
+// src/config.ts
+var PASSWORD_MINIMUM_LENGTH = 8;
+
+// src/template.ts
+var CognitoUserPoolLogicalId = "CognitoUserPool";
+var CognitoUserPoolClientLogicalId = "CognitoUserPoolClient";
+var CognitoIdentityPoolLogicalId = "CognitoIdentityPool";
+var IdentityPoolAuthenticatedIAMRoleLogicalId = "IdentityPoolAuthenticatedIAMRole";
+var IdentityPoolUnauthenticatedIAMRoleLogicalId = "IdentityPoolUnauthenticatedIAMRole";
+var DenyStatement = {
+  Effect: "Deny",
+  Action: ["*"],
+  Resource: ["*"]
+};
+var defaultPrincipalTags = {
+  appClientId: "aud",
+  userId: "sub"
+};
+var createAuthTemplate = ({
+  autoVerifiedAttributes = ["email"],
+  identityPool,
+  schema,
+  usernameAttributes = ["email"]
+} = {}) => {
+  const AutoVerifiedAttributes = Array.isArray(autoVerifiedAttributes) && autoVerifiedAttributes.length > 0 ? autoVerifiedAttributes : [];
+  const template = {
+    AWSTemplateFormatVersion: "2010-09-09",
+    Resources: {
+      [CognitoUserPoolLogicalId]: {
+        /**
+         * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpool.html
+         */
+        Type: "AWS::Cognito::UserPool",
+        Properties: {
+          AutoVerifiedAttributes,
+          Policies: {
+            PasswordPolicy: {
+              MinimumLength: PASSWORD_MINIMUM_LENGTH,
+              RequireLowercase: false,
+              RequireNumbers: false,
+              RequireSymbols: false,
+              RequireUppercase: false,
+              TemporaryPasswordValidityDays: 30
+            }
+          },
+          UsernameAttributes: usernameAttributes,
+          UsernameConfiguration: {
+            CaseSensitive: false
+          },
+          UserPoolName: {
+            Ref: "AWS::StackName"
+          }
+        }
+      },
+      [CognitoUserPoolClientLogicalId]: {
+        /**
+         * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpoolclient.html
+         */
+        Type: "AWS::Cognito::UserPoolClient",
+        Properties: {
+          SupportedIdentityProviders: ["COGNITO"],
+          UserPoolId: {
+            Ref: "CognitoUserPool"
+          }
+        }
+      }
+    },
+    Outputs: {
+      Region: {
+        Description: "You use this value on Amplify Auth `region`.",
+        Value: {
+          Ref: "AWS::Region"
+        },
+        Export: {
+          Name: {
+            "Fn::Join": [":", [{
+              Ref: "AWS::StackName"
+            }, "Region"]]
+          }
+        }
+      },
+      UserPoolId: {
+        Description: "You use this value on Amplify Auth `userPoolId`.",
+        Value: {
+          Ref: CognitoUserPoolLogicalId
+        },
+        Export: {
+          Name: {
+            "Fn::Join": [":", [{
+              Ref: "AWS::StackName"
+            }, "UserPoolId"]]
+          }
+        }
+      },
+      AppClientId: {
+        Description: "You use this value on Amplify Auth `userPoolWebClientId`.",
+        Value: {
+          Ref: CognitoUserPoolClientLogicalId
+        },
+        Export: {
+          Name: {
+            "Fn::Join": [":", [{
+              Ref: "AWS::StackName"
+            }, "AppClientId"]]
+          }
+        }
+      }
+    }
+  };
+  if (schema) {
+    const Schema = schema.map(attribute => {
+      let NumberAttributeConstraints = void 0;
+      if (attribute.numberAttributeConstraints) {
+        NumberAttributeConstraints = {
+          MaxValue: attribute.numberAttributeConstraints?.maxValue,
+          MinValue: attribute.numberAttributeConstraints?.minValue
+        };
+      }
+      let StringAttributeConstraints = void 0;
+      if (attribute.stringAttributeConstraints) {
+        StringAttributeConstraints = {
+          MaxLength: attribute.stringAttributeConstraints?.maxLength,
+          MinLength: attribute.stringAttributeConstraints?.minLength
+        };
+      }
+      return {
+        AttributeDataType: attribute.attributeDataType,
+        DeveloperOnlyAttribute: attribute.developerOnlyAttribute,
+        Mutable: attribute.mutable,
+        Name: attribute.name,
+        NumberAttributeConstraints,
+        Required: attribute.required,
+        StringAttributeConstraints
+      };
+    });
+    template.Resources[CognitoUserPoolLogicalId].Properties.Schema = Schema;
+  }
+  if (identityPool?.enabled) {
+    template.Resources[CognitoIdentityPoolLogicalId] = {
+      /**
+       * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-identitypool.html
+       */
+      Type: "AWS::Cognito::IdentityPool",
+      Properties: {
+        AllowUnauthenticatedIdentities: identityPool.allowUnauthenticatedIdentities || false,
+        CognitoIdentityProviders: [{
+          ClientId: {
+            Ref: CognitoUserPoolClientLogicalId
+          },
+          ProviderName: {
+            "Fn::GetAtt": [CognitoUserPoolLogicalId, "ProviderName"]
+          }
+        }]
+      }
+    };
+    if (identityPool.name) {
+      template.Resources[CognitoIdentityPoolLogicalId].Properties.IdentityPoolName = identityPool.name;
+    }
+    template.Resources.CognitoIdentityPoolRoleAttachment = {
+      /**
+       * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-identitypoolroleattachment.html
+       */
+      Type: "AWS::Cognito::IdentityPoolRoleAttachment",
+      Properties: {
+        IdentityPoolId: {
+          Ref: CognitoIdentityPoolLogicalId
+        },
+        Roles: {}
+      }
+    };
+    if (!identityPool.authenticatedRoleArn) {
+      template.Resources[IdentityPoolAuthenticatedIAMRoleLogicalId] = {
+        Type: "AWS::IAM::Role",
+        Properties: {
+          AssumeRolePolicyDocument: {
+            Version: "2012-10-17",
+            Statement: [{
+              Effect: "Allow",
+              Principal: {
+                Federated: "cognito-identity.amazonaws.com"
+              },
+              Action: ["sts:AssumeRoleWithWebIdentity", "sts:TagSession"],
+              Condition: {
+                StringEquals: {
+                  "cognito-identity.amazonaws.com:aud": {
+                    Ref: CognitoIdentityPoolLogicalId
+                  }
+                },
+                "ForAnyValue:StringLike": {
+                  "cognito-identity.amazonaws.com:amr": "authenticated"
+                }
+              }
+            }]
+          },
+          Policies: identityPool.authenticatedPolicies || [{
+            PolicyName: "IdentityPoolAuthenticatedIAMRolePolicyName",
+            PolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [DenyStatement]
+            }
+          }]
+        }
+      };
+      template.Resources.CognitoIdentityPoolRoleAttachment.Properties.Roles.authenticated = {
+        "Fn::GetAtt": [IdentityPoolAuthenticatedIAMRoleLogicalId, "Arn"]
+      };
+    } else {
+      template.Resources.CognitoIdentityPoolRoleAttachment.Properties.Roles.authenticated = identityPool.authenticatedRoleArn;
+    }
+    if (!identityPool.unauthenticatedRoleArn) {
+      template.Resources[IdentityPoolUnauthenticatedIAMRoleLogicalId] = {
+        Type: "AWS::IAM::Role",
+        Properties: {
+          AssumeRolePolicyDocument: {
+            Version: "2012-10-17",
+            Statement: [{
+              Effect: "Allow",
+              Principal: {
+                Federated: "cognito-identity.amazonaws.com"
+              },
+              Action: "sts:AssumeRoleWithWebIdentity",
+              Condition: {
+                StringEquals: {
+                  "cognito-identity.amazonaws.com:aud": {
+                    Ref: CognitoIdentityPoolLogicalId
+                  }
+                },
+                "ForAnyValue:StringLike": {
+                  "cognito-identity.amazonaws.com:amr": "unauthenticated"
+                }
+              }
+            }]
+          },
+          Policies: identityPool.authenticatedPolicies || [{
+            PolicyName: "IdentityPoolUnauthenticatedIAMRolePolicyName",
+            PolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [DenyStatement]
+            }
+          }]
+        }
+      };
+      template.Resources.CognitoIdentityPoolRoleAttachment.Properties.Roles.unauthenticated = {
+        "Fn::GetAtt": [IdentityPoolUnauthenticatedIAMRoleLogicalId, "Arn"]
+      };
+    } else {
+      template.Resources.CognitoIdentityPoolRoleAttachment.Properties.Roles.unauthenticated = identityPool.unauthenticatedRoleArn;
+    }
+    if (identityPool.principalTags || identityPool.principalTags === void 0) {
+      const PrincipalTags = (() => {
+        if (typeof identityPool.principalTags === "boolean") {
+          return defaultPrincipalTags;
+        }
+        if (identityPool.principalTags === void 0) {
+          return defaultPrincipalTags;
+        }
+        return identityPool.principalTags;
+      })();
+      template.Resources.CognitoIdentityPoolPrincipalTag = {
+        Type: "AWS::Cognito::IdentityPoolPrincipalTag",
+        Properties: {
+          IdentityPoolId: {
+            Ref: CognitoIdentityPoolLogicalId
+          },
+          IdentityProviderName: {
+            "Fn::GetAtt": [CognitoUserPoolLogicalId, "ProviderName"]
+          },
+          PrincipalTags,
+          UseDefaults: false
+        }
+      };
+    }
+    if (!template.Outputs) {
+      template.Outputs = {};
+    }
+    template.Outputs.IdentityPoolId = {
+      Description: "You use this value on Amplify Auth `identityPoolId`.",
+      Value: {
+        Ref: CognitoIdentityPoolLogicalId
+      },
+      Export: {
+        Name: {
+          "Fn::Join": [":", [{
+            Ref: "AWS::StackName"
+          }, "CognitoIdentityPoolId"]]
+        }
+      }
+    };
+  }
+  return template;
+};
+createAuthTemplate.CognitoUserPoolLogicalId = CognitoUserPoolLogicalId;
+createAuthTemplate.CognitoUserPoolClientLogicalId = CognitoUserPoolClientLogicalId;
+createAuthTemplate.CognitoIdentityPoolLogicalId = CognitoIdentityPoolLogicalId;
+createAuthTemplate.IdentityPoolAuthenticatedIAMRoleLogicalId = IdentityPoolAuthenticatedIAMRoleLogicalId;
+createAuthTemplate.IdentityPoolUnauthenticatedIAMRoleLogicalId = IdentityPoolUnauthenticatedIAMRoleLogicalId;
+export { PASSWORD_MINIMUM_LENGTH, createAuthTemplate };

package/dist/index.d.mts

@@ -0,0 +1,45 @@
+import { Policy } from '@ttoss/cloudformation';
+
+declare const PASSWORD_MINIMUM_LENGTH = 8;
+
+declare const createAuthTemplate: {
+    ({ autoVerifiedAttributes, identityPool, schema, usernameAttributes, }?: {
+        autoVerifiedAttributes?: Array<"email" | "phone_number"> | null | false;
+        identityPool?: {
+            enabled?: boolean;
+            name?: string;
+            allowUnauthenticatedIdentities?: boolean;
+            authenticatedRoleArn?: string;
+            authenticatedPolicies?: Policy[];
+            unauthenticatedRoleArn?: string;
+            unauthenticatedPolicies?: Policy[];
+            principalTags?: Record<string, string> | boolean;
+        };
+        /**
+         * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-userpool-schemaattribute.html
+         */
+        schema?: {
+            attributeDataType?: "Boolean" | "DateTime" | "Number" | "String";
+            developerOnlyAttribute?: boolean;
+            mutable?: boolean;
+            name?: string;
+            numberAttributeConstraints?: {
+                maxValue?: string;
+                minValue?: string;
+            };
+            required?: boolean;
+            stringAttributeConstraints?: {
+                maxLength: string;
+                minLength: string;
+            };
+        }[];
+        usernameAttributes?: Array<"email" | "phone_number"> | null;
+    }): any;
+    CognitoUserPoolLogicalId: string;
+    CognitoUserPoolClientLogicalId: string;
+    CognitoIdentityPoolLogicalId: string;
+    IdentityPoolAuthenticatedIAMRoleLogicalId: string;
+    IdentityPoolUnauthenticatedIAMRoleLogicalId: string;
+};
+
+export { PASSWORD_MINIMUM_LENGTH, createAuthTemplate };

package/dist/index.d.ts

@@ -0,0 +1,45 @@
+import { Policy } from '@ttoss/cloudformation';
+
+declare const PASSWORD_MINIMUM_LENGTH = 8;
+
+declare const createAuthTemplate: {
+    ({ autoVerifiedAttributes, identityPool, schema, usernameAttributes, }?: {
+        autoVerifiedAttributes?: Array<"email" | "phone_number"> | null | false;
+        identityPool?: {
+            enabled?: boolean;
+            name?: string;
+            allowUnauthenticatedIdentities?: boolean;
+            authenticatedRoleArn?: string;
+            authenticatedPolicies?: Policy[];
+            unauthenticatedRoleArn?: string;
+            unauthenticatedPolicies?: Policy[];
+            principalTags?: Record<string, string> | boolean;
+        };
+        /**
+         * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-userpool-schemaattribute.html
+         */
+        schema?: {
+            attributeDataType?: "Boolean" | "DateTime" | "Number" | "String";
+            developerOnlyAttribute?: boolean;
+            mutable?: boolean;
+            name?: string;
+            numberAttributeConstraints?: {
+                maxValue?: string;
+                minValue?: string;
+            };
+            required?: boolean;
+            stringAttributeConstraints?: {
+                maxLength: string;
+                minLength: string;
+            };
+        }[];
+        usernameAttributes?: Array<"email" | "phone_number"> | null;
+    }): any;
+    CognitoUserPoolLogicalId: string;
+    CognitoUserPoolClientLogicalId: string;
+    CognitoIdentityPoolLogicalId: string;
+    IdentityPoolAuthenticatedIAMRoleLogicalId: string;
+    IdentityPoolUnauthenticatedIAMRoleLogicalId: string;
+};
+
+export { PASSWORD_MINIMUM_LENGTH, createAuthTemplate };