@ttoss/cloud-auth 0.12.20 → 0.12.22

package/dist/index.js

@@ -0,0 +1,335 @@
+/** Powered by @ttoss/config. https://ttoss.dev/docs/modules/packages/config/ */
+"use strict";
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all) __defProp(target, name, {
+    get: all[name],
+    enumerable: true
+  });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from)) if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+      get: () => from[key],
+      enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+    });
+  }
+  return to;
+};
+var __toCommonJS = mod => __copyProps(__defProp({}, "__esModule", {
+  value: true
+}), mod);
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  PASSWORD_MINIMUM_LENGTH: () => PASSWORD_MINIMUM_LENGTH,
+  createAuthTemplate: () => createAuthTemplate
+});
+module.exports = __toCommonJS(src_exports);
+
+// src/config.ts
+var PASSWORD_MINIMUM_LENGTH = 8;
+
+// src/template.ts
+var CognitoUserPoolLogicalId = "CognitoUserPool";
+var CognitoUserPoolClientLogicalId = "CognitoUserPoolClient";
+var CognitoIdentityPoolLogicalId = "CognitoIdentityPool";
+var IdentityPoolAuthenticatedIAMRoleLogicalId = "IdentityPoolAuthenticatedIAMRole";
+var IdentityPoolUnauthenticatedIAMRoleLogicalId = "IdentityPoolUnauthenticatedIAMRole";
+var DenyStatement = {
+  Effect: "Deny",
+  Action: ["*"],
+  Resource: ["*"]
+};
+var defaultPrincipalTags = {
+  appClientId: "aud",
+  userId: "sub"
+};
+var createAuthTemplate = ({
+  autoVerifiedAttributes = ["email"],
+  identityPool,
+  schema,
+  usernameAttributes = ["email"]
+} = {}) => {
+  const AutoVerifiedAttributes = Array.isArray(autoVerifiedAttributes) && autoVerifiedAttributes.length > 0 ? autoVerifiedAttributes : [];
+  const template = {
+    AWSTemplateFormatVersion: "2010-09-09",
+    Resources: {
+      [CognitoUserPoolLogicalId]: {
+        /**
+         * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpool.html
+         */
+        Type: "AWS::Cognito::UserPool",
+        Properties: {
+          AutoVerifiedAttributes,
+          Policies: {
+            PasswordPolicy: {
+              MinimumLength: PASSWORD_MINIMUM_LENGTH,
+              RequireLowercase: false,
+              RequireNumbers: false,
+              RequireSymbols: false,
+              RequireUppercase: false,
+              TemporaryPasswordValidityDays: 30
+            }
+          },
+          UsernameAttributes: usernameAttributes,
+          UsernameConfiguration: {
+            CaseSensitive: false
+          },
+          UserPoolName: {
+            Ref: "AWS::StackName"
+          }
+        }
+      },
+      [CognitoUserPoolClientLogicalId]: {
+        /**
+         * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpoolclient.html
+         */
+        Type: "AWS::Cognito::UserPoolClient",
+        Properties: {
+          SupportedIdentityProviders: ["COGNITO"],
+          UserPoolId: {
+            Ref: "CognitoUserPool"
+          }
+        }
+      }
+    },
+    Outputs: {
+      Region: {
+        Description: "You use this value on Amplify Auth `region`.",
+        Value: {
+          Ref: "AWS::Region"
+        },
+        Export: {
+          Name: {
+            "Fn::Join": [":", [{
+              Ref: "AWS::StackName"
+            }, "Region"]]
+          }
+        }
+      },
+      UserPoolId: {
+        Description: "You use this value on Amplify Auth `userPoolId`.",
+        Value: {
+          Ref: CognitoUserPoolLogicalId
+        },
+        Export: {
+          Name: {
+            "Fn::Join": [":", [{
+              Ref: "AWS::StackName"
+            }, "UserPoolId"]]
+          }
+        }
+      },
+      AppClientId: {
+        Description: "You use this value on Amplify Auth `userPoolWebClientId`.",
+        Value: {
+          Ref: CognitoUserPoolClientLogicalId
+        },
+        Export: {
+          Name: {
+            "Fn::Join": [":", [{
+              Ref: "AWS::StackName"
+            }, "AppClientId"]]
+          }
+        }
+      }
+    }
+  };
+  if (schema) {
+    const Schema = schema.map(attribute => {
+      let NumberAttributeConstraints = void 0;
+      if (attribute.numberAttributeConstraints) {
+        NumberAttributeConstraints = {
+          MaxValue: attribute.numberAttributeConstraints?.maxValue,
+          MinValue: attribute.numberAttributeConstraints?.minValue
+        };
+      }
+      let StringAttributeConstraints = void 0;
+      if (attribute.stringAttributeConstraints) {
+        StringAttributeConstraints = {
+          MaxLength: attribute.stringAttributeConstraints?.maxLength,
+          MinLength: attribute.stringAttributeConstraints?.minLength
+        };
+      }
+      return {
+        AttributeDataType: attribute.attributeDataType,
+        DeveloperOnlyAttribute: attribute.developerOnlyAttribute,
+        Mutable: attribute.mutable,
+        Name: attribute.name,
+        NumberAttributeConstraints,
+        Required: attribute.required,
+        StringAttributeConstraints
+      };
+    });
+    template.Resources[CognitoUserPoolLogicalId].Properties.Schema = Schema;
+  }
+  if (identityPool?.enabled) {
+    template.Resources[CognitoIdentityPoolLogicalId] = {
+      /**
+       * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-identitypool.html
+       */
+      Type: "AWS::Cognito::IdentityPool",
+      Properties: {
+        AllowUnauthenticatedIdentities: identityPool.allowUnauthenticatedIdentities || false,
+        CognitoIdentityProviders: [{
+          ClientId: {
+            Ref: CognitoUserPoolClientLogicalId
+          },
+          ProviderName: {
+            "Fn::GetAtt": [CognitoUserPoolLogicalId, "ProviderName"]
+          }
+        }]
+      }
+    };
+    if (identityPool.name) {
+      template.Resources[CognitoIdentityPoolLogicalId].Properties.IdentityPoolName = identityPool.name;
+    }
+    template.Resources.CognitoIdentityPoolRoleAttachment = {
+      /**
+       * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-identitypoolroleattachment.html
+       */
+      Type: "AWS::Cognito::IdentityPoolRoleAttachment",
+      Properties: {
+        IdentityPoolId: {
+          Ref: CognitoIdentityPoolLogicalId
+        },
+        Roles: {}
+      }
+    };
+    if (!identityPool.authenticatedRoleArn) {
+      template.Resources[IdentityPoolAuthenticatedIAMRoleLogicalId] = {
+        Type: "AWS::IAM::Role",
+        Properties: {
+          AssumeRolePolicyDocument: {
+            Version: "2012-10-17",
+            Statement: [{
+              Effect: "Allow",
+              Principal: {
+                Federated: "cognito-identity.amazonaws.com"
+              },
+              Action: ["sts:AssumeRoleWithWebIdentity", "sts:TagSession"],
+              Condition: {
+                StringEquals: {
+                  "cognito-identity.amazonaws.com:aud": {
+                    Ref: CognitoIdentityPoolLogicalId
+                  }
+                },
+                "ForAnyValue:StringLike": {
+                  "cognito-identity.amazonaws.com:amr": "authenticated"
+                }
+              }
+            }]
+          },
+          Policies: identityPool.authenticatedPolicies || [{
+            PolicyName: "IdentityPoolAuthenticatedIAMRolePolicyName",
+            PolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [DenyStatement]
+            }
+          }]
+        }
+      };
+      template.Resources.CognitoIdentityPoolRoleAttachment.Properties.Roles.authenticated = {
+        "Fn::GetAtt": [IdentityPoolAuthenticatedIAMRoleLogicalId, "Arn"]
+      };
+    } else {
+      template.Resources.CognitoIdentityPoolRoleAttachment.Properties.Roles.authenticated = identityPool.authenticatedRoleArn;
+    }
+    if (!identityPool.unauthenticatedRoleArn) {
+      template.Resources[IdentityPoolUnauthenticatedIAMRoleLogicalId] = {
+        Type: "AWS::IAM::Role",
+        Properties: {
+          AssumeRolePolicyDocument: {
+            Version: "2012-10-17",
+            Statement: [{
+              Effect: "Allow",
+              Principal: {
+                Federated: "cognito-identity.amazonaws.com"
+              },
+              Action: "sts:AssumeRoleWithWebIdentity",
+              Condition: {
+                StringEquals: {
+                  "cognito-identity.amazonaws.com:aud": {
+                    Ref: CognitoIdentityPoolLogicalId
+                  }
+                },
+                "ForAnyValue:StringLike": {
+                  "cognito-identity.amazonaws.com:amr": "unauthenticated"
+                }
+              }
+            }]
+          },
+          Policies: identityPool.authenticatedPolicies || [{
+            PolicyName: "IdentityPoolUnauthenticatedIAMRolePolicyName",
+            PolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [DenyStatement]
+            }
+          }]
+        }
+      };
+      template.Resources.CognitoIdentityPoolRoleAttachment.Properties.Roles.unauthenticated = {
+        "Fn::GetAtt": [IdentityPoolUnauthenticatedIAMRoleLogicalId, "Arn"]
+      };
+    } else {
+      template.Resources.CognitoIdentityPoolRoleAttachment.Properties.Roles.unauthenticated = identityPool.unauthenticatedRoleArn;
+    }
+    if (identityPool.principalTags || identityPool.principalTags === void 0) {
+      const PrincipalTags = (() => {
+        if (typeof identityPool.principalTags === "boolean") {
+          return defaultPrincipalTags;
+        }
+        if (identityPool.principalTags === void 0) {
+          return defaultPrincipalTags;
+        }
+        return identityPool.principalTags;
+      })();
+      template.Resources.CognitoIdentityPoolPrincipalTag = {
+        Type: "AWS::Cognito::IdentityPoolPrincipalTag",
+        Properties: {
+          IdentityPoolId: {
+            Ref: CognitoIdentityPoolLogicalId
+          },
+          IdentityProviderName: {
+            "Fn::GetAtt": [CognitoUserPoolLogicalId, "ProviderName"]
+          },
+          PrincipalTags,
+          UseDefaults: false
+        }
+      };
+    }
+    if (!template.Outputs) {
+      template.Outputs = {};
+    }
+    template.Outputs.IdentityPoolId = {
+      Description: "You use this value on Amplify Auth `identityPoolId`.",
+      Value: {
+        Ref: CognitoIdentityPoolLogicalId
+      },
+      Export: {
+        Name: {
+          "Fn::Join": [":", [{
+            Ref: "AWS::StackName"
+          }, "CognitoIdentityPoolId"]]
+        }
+      }
+    };
+  }
+  return template;
+};
+createAuthTemplate.CognitoUserPoolLogicalId = CognitoUserPoolLogicalId;
+createAuthTemplate.CognitoUserPoolClientLogicalId = CognitoUserPoolClientLogicalId;
+createAuthTemplate.CognitoIdentityPoolLogicalId = CognitoIdentityPoolLogicalId;
+createAuthTemplate.IdentityPoolAuthenticatedIAMRoleLogicalId = IdentityPoolAuthenticatedIAMRoleLogicalId;
+createAuthTemplate.IdentityPoolUnauthenticatedIAMRoleLogicalId = IdentityPoolUnauthenticatedIAMRoleLogicalId;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  PASSWORD_MINIMUM_LENGTH,
+  createAuthTemplate
+});

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@ttoss/cloud-auth",
-  "version": "0.12.20",
+  "version": "0.12.22",
+  "license": "MIT",
   "repository": {
     "type": "git",
     "url": "https://github.com/ttoss/ttoss.git",
@@ -14,19 +15,18 @@
     }
   },
   "files": [
-    "dist",
-    "src"
+    "dist"
   ],
   "sideEffects": false,
   "dependencies": {
-    "@ttoss/cloudformation": "^0.10.9"
+    "@ttoss/cloudformation": "^0.10.11"
   },
   "devDependencies": {
     "@types/jest": "^29.5.13",
     "jest": "^29.7.0",
     "tsup": "^8.3.0",
     "typescript": "~5.6.2",
-    "@ttoss/config": "^1.33.0"
+    "@ttoss/config": "^1.34.1"
   },
   "publishConfig": {
     "access": "public",

package/src/config.ts

@@ -1 +0,0 @@
-export const PASSWORD_MINIMUM_LENGTH = 8;

package/src/index.ts

@@ -1,2 +0,0 @@
-export * from './config';
-export { createAuthTemplate } from './template';