@ttoss/cloud-auth 0.13.11 → 0.13.13

package/dist/esm/index.js

@@ -0,0 +1,382 @@
+/** Powered by @ttoss/config. https://ttoss.dev/docs/modules/packages/config/ */
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", {
+  value,
+  configurable: true
+});
+
+// src/config.ts
+var PASSWORD_MINIMUM_LENGTH = 8;
+
+// src/template.ts
+var CognitoUserPoolLogicalId = "CognitoUserPool";
+var CognitoUserPoolClientLogicalId = "CognitoUserPoolClient";
+var CognitoIdentityPoolLogicalId = "CognitoIdentityPool";
+var IdentityPoolAuthenticatedIAMRoleLogicalId = "IdentityPoolAuthenticatedIAMRole";
+var IdentityPoolUnauthenticatedIAMRoleLogicalId = "IdentityPoolUnauthenticatedIAMRole";
+var DenyStatement = {
+  Effect: "Deny",
+  Action: ["*"],
+  Resource: ["*"]
+};
+var defaultPrincipalTags = {
+  appClientId: "aud",
+  userId: "sub"
+};
+var createAuthTemplate = /* @__PURE__ */__name(({
+  autoVerifiedAttributes = ["email"],
+  identityPool,
+  schema,
+  usernameAttributes = ["email"],
+  lambdaTriggers,
+  deletionProtection
+} = {}) => {
+  const AutoVerifiedAttributes = Array.isArray(autoVerifiedAttributes) && autoVerifiedAttributes.length > 0 ? autoVerifiedAttributes : [];
+  const template = {
+    AWSTemplateFormatVersion: "2010-09-09",
+    Resources: {
+      [CognitoUserPoolLogicalId]: {
+        /**
+        * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpool.html
+        */
+        Type: "AWS::Cognito::UserPool",
+        Properties: {
+          AutoVerifiedAttributes,
+          Policies: {
+            PasswordPolicy: {
+              MinimumLength: PASSWORD_MINIMUM_LENGTH,
+              RequireLowercase: false,
+              RequireNumbers: false,
+              RequireSymbols: false,
+              RequireUppercase: false,
+              TemporaryPasswordValidityDays: 30
+            }
+          },
+          UsernameAttributes: usernameAttributes,
+          UsernameConfiguration: {
+            CaseSensitive: false
+          },
+          UserPoolName: {
+            Ref: "AWS::StackName"
+          },
+          ...(deletionProtection && {
+            DeletionProtection: deletionProtection
+          })
+        }
+      },
+      [CognitoUserPoolClientLogicalId]: {
+        /**
+        * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpoolclient.html
+        */
+        Type: "AWS::Cognito::UserPoolClient",
+        Properties: {
+          SupportedIdentityProviders: ["COGNITO"],
+          UserPoolId: {
+            Ref: "CognitoUserPool"
+          }
+        }
+      }
+    },
+    Outputs: {
+      Region: {
+        Description: "You use this value on Amplify Auth `region`.",
+        Value: {
+          Ref: "AWS::Region"
+        },
+        Export: {
+          Name: {
+            "Fn::Join": [":", [{
+              Ref: "AWS::StackName"
+            }, "Region"]]
+          }
+        }
+      },
+      UserPoolId: {
+        Description: "You use this value on Amplify Auth `userPoolId`.",
+        Value: {
+          Ref: CognitoUserPoolLogicalId
+        },
+        Export: {
+          Name: {
+            "Fn::Join": [":", [{
+              Ref: "AWS::StackName"
+            }, "UserPoolId"]]
+          }
+        }
+      },
+      AppClientId: {
+        Description: "You use this value on Amplify Auth `userPoolWebClientId`.",
+        Value: {
+          Ref: CognitoUserPoolClientLogicalId
+        },
+        Export: {
+          Name: {
+            "Fn::Join": [":", [{
+              Ref: "AWS::StackName"
+            }, "AppClientId"]]
+          }
+        }
+      }
+    }
+  };
+  if (schema) {
+    const Schema = schema.map(attribute => {
+      let NumberAttributeConstraints = void 0;
+      if (attribute.numberAttributeConstraints) {
+        NumberAttributeConstraints = {
+          MaxValue: attribute.numberAttributeConstraints?.maxValue,
+          MinValue: attribute.numberAttributeConstraints?.minValue
+        };
+      }
+      let StringAttributeConstraints = void 0;
+      if (attribute.stringAttributeConstraints) {
+        StringAttributeConstraints = {
+          MaxLength: attribute.stringAttributeConstraints?.maxLength,
+          MinLength: attribute.stringAttributeConstraints?.minLength
+        };
+      }
+      return {
+        AttributeDataType: attribute.attributeDataType,
+        DeveloperOnlyAttribute: attribute.developerOnlyAttribute,
+        Mutable: attribute.mutable,
+        Name: attribute.name,
+        NumberAttributeConstraints,
+        Required: attribute.required,
+        StringAttributeConstraints
+      };
+    });
+    template.Resources[CognitoUserPoolLogicalId].Properties = {
+      ...template.Resources[CognitoUserPoolLogicalId].Properties,
+      Schema
+    };
+  }
+  if (identityPool?.enabled) {
+    template.Resources[CognitoIdentityPoolLogicalId] = {
+      /**
+      * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-identitypool.html
+      */
+      Type: "AWS::Cognito::IdentityPool",
+      Properties: {
+        AllowUnauthenticatedIdentities: identityPool.allowUnauthenticatedIdentities || false,
+        CognitoIdentityProviders: [{
+          ClientId: {
+            Ref: CognitoUserPoolClientLogicalId
+          },
+          ProviderName: {
+            "Fn::GetAtt": [CognitoUserPoolLogicalId, "ProviderName"]
+          }
+        }]
+      }
+    };
+    if (identityPool.name) {
+      template.Resources[CognitoIdentityPoolLogicalId].Properties = {
+        ...template.Resources[CognitoIdentityPoolLogicalId].Properties,
+        IdentityPoolName: identityPool.name
+      };
+    }
+    template.Resources.CognitoIdentityPoolRoleAttachment = {
+      /**
+      * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-identitypoolroleattachment.html
+      */
+      Type: "AWS::Cognito::IdentityPoolRoleAttachment",
+      Properties: {
+        IdentityPoolId: {
+          Ref: CognitoIdentityPoolLogicalId
+        },
+        Roles: {}
+      }
+    };
+    if (!identityPool.authenticatedRoleArn) {
+      template.Resources[IdentityPoolAuthenticatedIAMRoleLogicalId] = {
+        Type: "AWS::IAM::Role",
+        Properties: {
+          AssumeRolePolicyDocument: {
+            Version: "2012-10-17",
+            Statement: [{
+              Effect: "Allow",
+              Principal: {
+                Federated: "cognito-identity.amazonaws.com"
+              },
+              Action: ["sts:AssumeRoleWithWebIdentity", "sts:TagSession"],
+              Condition: {
+                StringEquals: {
+                  "cognito-identity.amazonaws.com:aud": {
+                    Ref: CognitoIdentityPoolLogicalId
+                  }
+                },
+                "ForAnyValue:StringLike": {
+                  "cognito-identity.amazonaws.com:amr": "authenticated"
+                }
+              }
+            }]
+          },
+          Policies: identityPool.authenticatedPolicies || [{
+            PolicyName: "IdentityPoolAuthenticatedIAMRolePolicyName",
+            PolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [DenyStatement]
+            }
+          }]
+        }
+      };
+      Object.assign(template.Resources.CognitoIdentityPoolRoleAttachment.Properties?.Roles, {
+        authenticated: {
+          "Fn::GetAtt": [IdentityPoolAuthenticatedIAMRoleLogicalId, "Arn"]
+        }
+      });
+    } else {
+      Object.assign(template.Resources.CognitoIdentityPoolRoleAttachment.Properties?.Roles, {
+        authenticated: identityPool.authenticatedRoleArn
+      });
+    }
+    if (!identityPool.unauthenticatedRoleArn) {
+      template.Resources[IdentityPoolUnauthenticatedIAMRoleLogicalId] = {
+        Type: "AWS::IAM::Role",
+        Properties: {
+          AssumeRolePolicyDocument: {
+            Version: "2012-10-17",
+            Statement: [{
+              Effect: "Allow",
+              Principal: {
+                Federated: "cognito-identity.amazonaws.com"
+              },
+              Action: "sts:AssumeRoleWithWebIdentity",
+              Condition: {
+                StringEquals: {
+                  "cognito-identity.amazonaws.com:aud": {
+                    Ref: CognitoIdentityPoolLogicalId
+                  }
+                },
+                "ForAnyValue:StringLike": {
+                  "cognito-identity.amazonaws.com:amr": "unauthenticated"
+                }
+              }
+            }]
+          },
+          Policies: identityPool.unauthenticatedPolicies || [{
+            PolicyName: "IdentityPoolUnauthenticatedIAMRolePolicyName",
+            PolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [DenyStatement]
+            }
+          }]
+        }
+      };
+      Object.assign(template.Resources.CognitoIdentityPoolRoleAttachment.Properties?.Roles, {
+        unauthenticated: {
+          "Fn::GetAtt": [IdentityPoolUnauthenticatedIAMRoleLogicalId, "Arn"]
+        }
+      });
+    } else {
+      Object.assign(template.Resources.CognitoIdentityPoolRoleAttachment.Properties?.Roles, {
+        unauthenticated: identityPool.unauthenticatedRoleArn
+      });
+    }
+    if (identityPool.principalTags || identityPool.principalTags === void 0) {
+      const PrincipalTags = (() => {
+        if (typeof identityPool.principalTags === "boolean") {
+          return defaultPrincipalTags;
+        }
+        if (identityPool.principalTags === void 0) {
+          return defaultPrincipalTags;
+        }
+        return identityPool.principalTags;
+      })();
+      template.Resources.CognitoIdentityPoolPrincipalTag = {
+        Type: "AWS::Cognito::IdentityPoolPrincipalTag",
+        Properties: {
+          IdentityPoolId: {
+            Ref: CognitoIdentityPoolLogicalId
+          },
+          IdentityProviderName: {
+            "Fn::GetAtt": [CognitoUserPoolLogicalId, "ProviderName"]
+          },
+          PrincipalTags,
+          UseDefaults: false
+        }
+      };
+    }
+    template.Outputs = {
+      ...template.Outputs,
+      IdentityPoolId: {
+        Description: "You use this value on Amplify Auth `identityPoolId`.",
+        Value: {
+          Ref: CognitoIdentityPoolLogicalId
+        },
+        Export: {
+          Name: {
+            "Fn::Join": [":", [{
+              Ref: "AWS::StackName"
+            }, "CognitoIdentityPoolId"]]
+          }
+        }
+      }
+    };
+  }
+  if (lambdaTriggers) {
+    const LambdaConfig = {};
+    if (lambdaTriggers.preSignUp) {
+      LambdaConfig.PreSignUp = lambdaTriggers.preSignUp;
+    }
+    if (lambdaTriggers.postConfirmation) {
+      LambdaConfig.PostConfirmation = lambdaTriggers.postConfirmation;
+    }
+    if (lambdaTriggers.preAuthentication) {
+      LambdaConfig.PreAuthentication = lambdaTriggers.preAuthentication;
+    }
+    if (lambdaTriggers.postAuthentication) {
+      LambdaConfig.PostAuthentication = lambdaTriggers.postAuthentication;
+    }
+    if (lambdaTriggers.defineAuthChallenge) {
+      LambdaConfig.DefineAuthChallenge = lambdaTriggers.defineAuthChallenge;
+    }
+    if (lambdaTriggers.createAuthChallenge) {
+      LambdaConfig.CreateAuthChallenge = lambdaTriggers.createAuthChallenge;
+    }
+    if (lambdaTriggers.verifyAuthChallengeResponse) {
+      LambdaConfig.VerifyAuthChallengeResponse = lambdaTriggers.verifyAuthChallengeResponse;
+    }
+    if (lambdaTriggers.preTokenGeneration) {
+      LambdaConfig.PreTokenGeneration = lambdaTriggers.preTokenGeneration;
+    }
+    if (lambdaTriggers.userMigration) {
+      LambdaConfig.UserMigration = lambdaTriggers.userMigration;
+    }
+    if (lambdaTriggers.customMessage) {
+      LambdaConfig.CustomMessage = lambdaTriggers.customMessage;
+    }
+    if (lambdaTriggers.customEmailSender) {
+      LambdaConfig.CustomEmailSender = lambdaTriggers.customEmailSender;
+    }
+    if (lambdaTriggers.customSMSSender) {
+      LambdaConfig.CustomSMSSender = lambdaTriggers.customSMSSender;
+    }
+    if (Object.keys(LambdaConfig).length > 0) {
+      template.Resources[CognitoUserPoolLogicalId].Properties = {
+        ...template.Resources[CognitoUserPoolLogicalId].Properties,
+        LambdaConfig
+      };
+    }
+    for (const [key, lambdaTrigger] of Object.entries(LambdaConfig)) {
+      const permissionLogicalId = `${key}PermissionFor${CognitoUserPoolLogicalId}`.slice(0, 255);
+      template.Resources[permissionLogicalId] = {
+        Type: "AWS::Lambda::Permission",
+        Properties: {
+          Action: "lambda:InvokeFunction",
+          FunctionName: lambdaTrigger,
+          Principal: "cognito-idp.amazonaws.com",
+          SourceArn: {
+            "Fn::GetAtt": [CognitoUserPoolLogicalId, "Arn"]
+          }
+        }
+      };
+    }
+  }
+  return template;
+}, "createAuthTemplate");
+createAuthTemplate.CognitoUserPoolLogicalId = CognitoUserPoolLogicalId;
+createAuthTemplate.CognitoUserPoolClientLogicalId = CognitoUserPoolClientLogicalId;
+createAuthTemplate.CognitoIdentityPoolLogicalId = CognitoIdentityPoolLogicalId;
+createAuthTemplate.IdentityPoolAuthenticatedIAMRoleLogicalId = IdentityPoolAuthenticatedIAMRoleLogicalId;
+createAuthTemplate.IdentityPoolUnauthenticatedIAMRoleLogicalId = IdentityPoolUnauthenticatedIAMRoleLogicalId;
+export { PASSWORD_MINIMUM_LENGTH, createAuthTemplate };

package/dist/index.d.mts

@@ -0,0 +1,62 @@
+import { Policy, CloudFormationGetAtt, CloudFormationTemplate } from '@ttoss/cloudformation';
+export { CloudFormationTemplate } from '@ttoss/cloudformation';
+
+declare const PASSWORD_MINIMUM_LENGTH = 8;
+
+type SchemaAttribute = {
+    attributeDataType?: 'Boolean' | 'DateTime' | 'Number' | 'String';
+    developerOnlyAttribute?: boolean;
+    mutable?: boolean;
+    name?: string;
+    numberAttributeConstraints?: {
+        maxValue?: string;
+        minValue?: string;
+    };
+    required?: boolean;
+    stringAttributeConstraints?: {
+        maxLength: string;
+        minLength: string;
+    };
+};
+type IdentityPoolConfig = {
+    enabled?: boolean;
+    name?: string;
+    allowUnauthenticatedIdentities?: boolean;
+    authenticatedRoleArn?: string;
+    authenticatedPolicies?: Policy[];
+    unauthenticatedRoleArn?: string;
+    unauthenticatedPolicies?: Policy[];
+    principalTags?: Record<string, string> | boolean;
+};
+type LambdaTriggers = {
+    preSignUp?: string | CloudFormationGetAtt;
+    postConfirmation?: string | CloudFormationGetAtt;
+    preAuthentication?: string | CloudFormationGetAtt;
+    postAuthentication?: string | CloudFormationGetAtt;
+    defineAuthChallenge?: string | CloudFormationGetAtt;
+    createAuthChallenge?: string | CloudFormationGetAtt;
+    verifyAuthChallengeResponse?: string | CloudFormationGetAtt;
+    preTokenGeneration?: string | CloudFormationGetAtt;
+    userMigration?: string | CloudFormationGetAtt;
+    customMessage?: string | CloudFormationGetAtt;
+    customEmailSender?: string | CloudFormationGetAtt;
+    customSMSSender?: string | CloudFormationGetAtt;
+};
+type CreateAuthTemplateParams = {
+    autoVerifiedAttributes?: Array<'email' | 'phone_number'> | null | false;
+    identityPool?: IdentityPoolConfig;
+    schema?: SchemaAttribute[];
+    usernameAttributes?: Array<'email' | 'phone_number'> | null;
+    lambdaTriggers?: LambdaTriggers;
+    deletionProtection?: 'ACTIVE' | 'INACTIVE';
+};
+declare const createAuthTemplate: {
+    ({ autoVerifiedAttributes, identityPool, schema, usernameAttributes, lambdaTriggers, deletionProtection, }?: CreateAuthTemplateParams): CloudFormationTemplate;
+    CognitoUserPoolLogicalId: string;
+    CognitoUserPoolClientLogicalId: string;
+    CognitoIdentityPoolLogicalId: string;
+    IdentityPoolAuthenticatedIAMRoleLogicalId: string;
+    IdentityPoolUnauthenticatedIAMRoleLogicalId: string;
+};
+
+export { PASSWORD_MINIMUM_LENGTH, createAuthTemplate };

package/dist/index.d.ts

@@ -0,0 +1,62 @@
+import { Policy, CloudFormationGetAtt, CloudFormationTemplate } from '@ttoss/cloudformation';
+export { CloudFormationTemplate } from '@ttoss/cloudformation';
+
+declare const PASSWORD_MINIMUM_LENGTH = 8;
+
+type SchemaAttribute = {
+    attributeDataType?: 'Boolean' | 'DateTime' | 'Number' | 'String';
+    developerOnlyAttribute?: boolean;
+    mutable?: boolean;
+    name?: string;
+    numberAttributeConstraints?: {
+        maxValue?: string;
+        minValue?: string;
+    };
+    required?: boolean;
+    stringAttributeConstraints?: {
+        maxLength: string;
+        minLength: string;
+    };
+};
+type IdentityPoolConfig = {
+    enabled?: boolean;
+    name?: string;
+    allowUnauthenticatedIdentities?: boolean;
+    authenticatedRoleArn?: string;
+    authenticatedPolicies?: Policy[];
+    unauthenticatedRoleArn?: string;
+    unauthenticatedPolicies?: Policy[];
+    principalTags?: Record<string, string> | boolean;
+};
+type LambdaTriggers = {
+    preSignUp?: string | CloudFormationGetAtt;
+    postConfirmation?: string | CloudFormationGetAtt;
+    preAuthentication?: string | CloudFormationGetAtt;
+    postAuthentication?: string | CloudFormationGetAtt;
+    defineAuthChallenge?: string | CloudFormationGetAtt;
+    createAuthChallenge?: string | CloudFormationGetAtt;
+    verifyAuthChallengeResponse?: string | CloudFormationGetAtt;
+    preTokenGeneration?: string | CloudFormationGetAtt;
+    userMigration?: string | CloudFormationGetAtt;
+    customMessage?: string | CloudFormationGetAtt;
+    customEmailSender?: string | CloudFormationGetAtt;
+    customSMSSender?: string | CloudFormationGetAtt;
+};
+type CreateAuthTemplateParams = {
+    autoVerifiedAttributes?: Array<'email' | 'phone_number'> | null | false;
+    identityPool?: IdentityPoolConfig;
+    schema?: SchemaAttribute[];
+    usernameAttributes?: Array<'email' | 'phone_number'> | null;
+    lambdaTriggers?: LambdaTriggers;
+    deletionProtection?: 'ACTIVE' | 'INACTIVE';
+};
+declare const createAuthTemplate: {
+    ({ autoVerifiedAttributes, identityPool, schema, usernameAttributes, lambdaTriggers, deletionProtection, }?: CreateAuthTemplateParams): CloudFormationTemplate;
+    CognitoUserPoolLogicalId: string;
+    CognitoUserPoolClientLogicalId: string;
+    CognitoIdentityPoolLogicalId: string;
+    IdentityPoolAuthenticatedIAMRoleLogicalId: string;
+    IdentityPoolUnauthenticatedIAMRoleLogicalId: string;
+};
+
+export { PASSWORD_MINIMUM_LENGTH, createAuthTemplate };

package/dist/index.js

@@ -0,0 +1,417 @@
+/** Powered by @ttoss/config. https://ttoss.dev/docs/modules/packages/config/ */
+"use strict";
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", {
+  value,
+  configurable: true
+});
+var __export = (target, all) => {
+  for (var name in all) __defProp(target, name, {
+    get: all[name],
+    enumerable: true
+  });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from)) if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+      get: () => from[key],
+      enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+    });
+  }
+  return to;
+};
+var __toCommonJS = mod => __copyProps(__defProp({}, "__esModule", {
+  value: true
+}), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  PASSWORD_MINIMUM_LENGTH: () => PASSWORD_MINIMUM_LENGTH,
+  createAuthTemplate: () => createAuthTemplate
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/config.ts
+var PASSWORD_MINIMUM_LENGTH = 8;
+
+// src/template.ts
+var CognitoUserPoolLogicalId = "CognitoUserPool";
+var CognitoUserPoolClientLogicalId = "CognitoUserPoolClient";
+var CognitoIdentityPoolLogicalId = "CognitoIdentityPool";
+var IdentityPoolAuthenticatedIAMRoleLogicalId = "IdentityPoolAuthenticatedIAMRole";
+var IdentityPoolUnauthenticatedIAMRoleLogicalId = "IdentityPoolUnauthenticatedIAMRole";
+var DenyStatement = {
+  Effect: "Deny",
+  Action: ["*"],
+  Resource: ["*"]
+};
+var defaultPrincipalTags = {
+  appClientId: "aud",
+  userId: "sub"
+};
+var createAuthTemplate = /* @__PURE__ */__name(({
+  autoVerifiedAttributes = ["email"],
+  identityPool,
+  schema,
+  usernameAttributes = ["email"],
+  lambdaTriggers,
+  deletionProtection
+} = {}) => {
+  const AutoVerifiedAttributes = Array.isArray(autoVerifiedAttributes) && autoVerifiedAttributes.length > 0 ? autoVerifiedAttributes : [];
+  const template = {
+    AWSTemplateFormatVersion: "2010-09-09",
+    Resources: {
+      [CognitoUserPoolLogicalId]: {
+        /**
+        * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpool.html
+        */
+        Type: "AWS::Cognito::UserPool",
+        Properties: {
+          AutoVerifiedAttributes,
+          Policies: {
+            PasswordPolicy: {
+              MinimumLength: PASSWORD_MINIMUM_LENGTH,
+              RequireLowercase: false,
+              RequireNumbers: false,
+              RequireSymbols: false,
+              RequireUppercase: false,
+              TemporaryPasswordValidityDays: 30
+            }
+          },
+          UsernameAttributes: usernameAttributes,
+          UsernameConfiguration: {
+            CaseSensitive: false
+          },
+          UserPoolName: {
+            Ref: "AWS::StackName"
+          },
+          ...(deletionProtection && {
+            DeletionProtection: deletionProtection
+          })
+        }
+      },
+      [CognitoUserPoolClientLogicalId]: {
+        /**
+        * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpoolclient.html
+        */
+        Type: "AWS::Cognito::UserPoolClient",
+        Properties: {
+          SupportedIdentityProviders: ["COGNITO"],
+          UserPoolId: {
+            Ref: "CognitoUserPool"
+          }
+        }
+      }
+    },
+    Outputs: {
+      Region: {
+        Description: "You use this value on Amplify Auth `region`.",
+        Value: {
+          Ref: "AWS::Region"
+        },
+        Export: {
+          Name: {
+            "Fn::Join": [":", [{
+              Ref: "AWS::StackName"
+            }, "Region"]]
+          }
+        }
+      },
+      UserPoolId: {
+        Description: "You use this value on Amplify Auth `userPoolId`.",
+        Value: {
+          Ref: CognitoUserPoolLogicalId
+        },
+        Export: {
+          Name: {
+            "Fn::Join": [":", [{
+              Ref: "AWS::StackName"
+            }, "UserPoolId"]]
+          }
+        }
+      },
+      AppClientId: {
+        Description: "You use this value on Amplify Auth `userPoolWebClientId`.",
+        Value: {
+          Ref: CognitoUserPoolClientLogicalId
+        },
+        Export: {
+          Name: {
+            "Fn::Join": [":", [{
+              Ref: "AWS::StackName"
+            }, "AppClientId"]]
+          }
+        }
+      }
+    }
+  };
+  if (schema) {
+    const Schema = schema.map(attribute => {
+      let NumberAttributeConstraints = void 0;
+      if (attribute.numberAttributeConstraints) {
+        NumberAttributeConstraints = {
+          MaxValue: attribute.numberAttributeConstraints?.maxValue,
+          MinValue: attribute.numberAttributeConstraints?.minValue
+        };
+      }
+      let StringAttributeConstraints = void 0;
+      if (attribute.stringAttributeConstraints) {
+        StringAttributeConstraints = {
+          MaxLength: attribute.stringAttributeConstraints?.maxLength,
+          MinLength: attribute.stringAttributeConstraints?.minLength
+        };
+      }
+      return {
+        AttributeDataType: attribute.attributeDataType,
+        DeveloperOnlyAttribute: attribute.developerOnlyAttribute,
+        Mutable: attribute.mutable,
+        Name: attribute.name,
+        NumberAttributeConstraints,
+        Required: attribute.required,
+        StringAttributeConstraints
+      };
+    });
+    template.Resources[CognitoUserPoolLogicalId].Properties = {
+      ...template.Resources[CognitoUserPoolLogicalId].Properties,
+      Schema
+    };
+  }
+  if (identityPool?.enabled) {
+    template.Resources[CognitoIdentityPoolLogicalId] = {
+      /**
+      * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-identitypool.html
+      */
+      Type: "AWS::Cognito::IdentityPool",
+      Properties: {
+        AllowUnauthenticatedIdentities: identityPool.allowUnauthenticatedIdentities || false,
+        CognitoIdentityProviders: [{
+          ClientId: {
+            Ref: CognitoUserPoolClientLogicalId
+          },
+          ProviderName: {
+            "Fn::GetAtt": [CognitoUserPoolLogicalId, "ProviderName"]
+          }
+        }]
+      }
+    };
+    if (identityPool.name) {
+      template.Resources[CognitoIdentityPoolLogicalId].Properties = {
+        ...template.Resources[CognitoIdentityPoolLogicalId].Properties,
+        IdentityPoolName: identityPool.name
+      };
+    }
+    template.Resources.CognitoIdentityPoolRoleAttachment = {
+      /**
+      * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-identitypoolroleattachment.html
+      */
+      Type: "AWS::Cognito::IdentityPoolRoleAttachment",
+      Properties: {
+        IdentityPoolId: {
+          Ref: CognitoIdentityPoolLogicalId
+        },
+        Roles: {}
+      }
+    };
+    if (!identityPool.authenticatedRoleArn) {
+      template.Resources[IdentityPoolAuthenticatedIAMRoleLogicalId] = {
+        Type: "AWS::IAM::Role",
+        Properties: {
+          AssumeRolePolicyDocument: {
+            Version: "2012-10-17",
+            Statement: [{
+              Effect: "Allow",
+              Principal: {
+                Federated: "cognito-identity.amazonaws.com"
+              },
+              Action: ["sts:AssumeRoleWithWebIdentity", "sts:TagSession"],
+              Condition: {
+                StringEquals: {
+                  "cognito-identity.amazonaws.com:aud": {
+                    Ref: CognitoIdentityPoolLogicalId
+                  }
+                },
+                "ForAnyValue:StringLike": {
+                  "cognito-identity.amazonaws.com:amr": "authenticated"
+                }
+              }
+            }]
+          },
+          Policies: identityPool.authenticatedPolicies || [{
+            PolicyName: "IdentityPoolAuthenticatedIAMRolePolicyName",
+            PolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [DenyStatement]
+            }
+          }]
+        }
+      };
+      Object.assign(template.Resources.CognitoIdentityPoolRoleAttachment.Properties?.Roles, {
+        authenticated: {
+          "Fn::GetAtt": [IdentityPoolAuthenticatedIAMRoleLogicalId, "Arn"]
+        }
+      });
+    } else {
+      Object.assign(template.Resources.CognitoIdentityPoolRoleAttachment.Properties?.Roles, {
+        authenticated: identityPool.authenticatedRoleArn
+      });
+    }
+    if (!identityPool.unauthenticatedRoleArn) {
+      template.Resources[IdentityPoolUnauthenticatedIAMRoleLogicalId] = {
+        Type: "AWS::IAM::Role",
+        Properties: {
+          AssumeRolePolicyDocument: {
+            Version: "2012-10-17",
+            Statement: [{
+              Effect: "Allow",
+              Principal: {
+                Federated: "cognito-identity.amazonaws.com"
+              },
+              Action: "sts:AssumeRoleWithWebIdentity",
+              Condition: {
+                StringEquals: {
+                  "cognito-identity.amazonaws.com:aud": {
+                    Ref: CognitoIdentityPoolLogicalId
+                  }
+                },
+                "ForAnyValue:StringLike": {
+                  "cognito-identity.amazonaws.com:amr": "unauthenticated"
+                }
+              }
+            }]
+          },
+          Policies: identityPool.unauthenticatedPolicies || [{
+            PolicyName: "IdentityPoolUnauthenticatedIAMRolePolicyName",
+            PolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [DenyStatement]
+            }
+          }]
+        }
+      };
+      Object.assign(template.Resources.CognitoIdentityPoolRoleAttachment.Properties?.Roles, {
+        unauthenticated: {
+          "Fn::GetAtt": [IdentityPoolUnauthenticatedIAMRoleLogicalId, "Arn"]
+        }
+      });
+    } else {
+      Object.assign(template.Resources.CognitoIdentityPoolRoleAttachment.Properties?.Roles, {
+        unauthenticated: identityPool.unauthenticatedRoleArn
+      });
+    }
+    if (identityPool.principalTags || identityPool.principalTags === void 0) {
+      const PrincipalTags = (() => {
+        if (typeof identityPool.principalTags === "boolean") {
+          return defaultPrincipalTags;
+        }
+        if (identityPool.principalTags === void 0) {
+          return defaultPrincipalTags;
+        }
+        return identityPool.principalTags;
+      })();
+      template.Resources.CognitoIdentityPoolPrincipalTag = {
+        Type: "AWS::Cognito::IdentityPoolPrincipalTag",
+        Properties: {
+          IdentityPoolId: {
+            Ref: CognitoIdentityPoolLogicalId
+          },
+          IdentityProviderName: {
+            "Fn::GetAtt": [CognitoUserPoolLogicalId, "ProviderName"]
+          },
+          PrincipalTags,
+          UseDefaults: false
+        }
+      };
+    }
+    template.Outputs = {
+      ...template.Outputs,
+      IdentityPoolId: {
+        Description: "You use this value on Amplify Auth `identityPoolId`.",
+        Value: {
+          Ref: CognitoIdentityPoolLogicalId
+        },
+        Export: {
+          Name: {
+            "Fn::Join": [":", [{
+              Ref: "AWS::StackName"
+            }, "CognitoIdentityPoolId"]]
+          }
+        }
+      }
+    };
+  }
+  if (lambdaTriggers) {
+    const LambdaConfig = {};
+    if (lambdaTriggers.preSignUp) {
+      LambdaConfig.PreSignUp = lambdaTriggers.preSignUp;
+    }
+    if (lambdaTriggers.postConfirmation) {
+      LambdaConfig.PostConfirmation = lambdaTriggers.postConfirmation;
+    }
+    if (lambdaTriggers.preAuthentication) {
+      LambdaConfig.PreAuthentication = lambdaTriggers.preAuthentication;
+    }
+    if (lambdaTriggers.postAuthentication) {
+      LambdaConfig.PostAuthentication = lambdaTriggers.postAuthentication;
+    }
+    if (lambdaTriggers.defineAuthChallenge) {
+      LambdaConfig.DefineAuthChallenge = lambdaTriggers.defineAuthChallenge;
+    }
+    if (lambdaTriggers.createAuthChallenge) {
+      LambdaConfig.CreateAuthChallenge = lambdaTriggers.createAuthChallenge;
+    }
+    if (lambdaTriggers.verifyAuthChallengeResponse) {
+      LambdaConfig.VerifyAuthChallengeResponse = lambdaTriggers.verifyAuthChallengeResponse;
+    }
+    if (lambdaTriggers.preTokenGeneration) {
+      LambdaConfig.PreTokenGeneration = lambdaTriggers.preTokenGeneration;
+    }
+    if (lambdaTriggers.userMigration) {
+      LambdaConfig.UserMigration = lambdaTriggers.userMigration;
+    }
+    if (lambdaTriggers.customMessage) {
+      LambdaConfig.CustomMessage = lambdaTriggers.customMessage;
+    }
+    if (lambdaTriggers.customEmailSender) {
+      LambdaConfig.CustomEmailSender = lambdaTriggers.customEmailSender;
+    }
+    if (lambdaTriggers.customSMSSender) {
+      LambdaConfig.CustomSMSSender = lambdaTriggers.customSMSSender;
+    }
+    if (Object.keys(LambdaConfig).length > 0) {
+      template.Resources[CognitoUserPoolLogicalId].Properties = {
+        ...template.Resources[CognitoUserPoolLogicalId].Properties,
+        LambdaConfig
+      };
+    }
+    for (const [key, lambdaTrigger] of Object.entries(LambdaConfig)) {
+      const permissionLogicalId = `${key}PermissionFor${CognitoUserPoolLogicalId}`.slice(0, 255);
+      template.Resources[permissionLogicalId] = {
+        Type: "AWS::Lambda::Permission",
+        Properties: {
+          Action: "lambda:InvokeFunction",
+          FunctionName: lambdaTrigger,
+          Principal: "cognito-idp.amazonaws.com",
+          SourceArn: {
+            "Fn::GetAtt": [CognitoUserPoolLogicalId, "Arn"]
+          }
+        }
+      };
+    }
+  }
+  return template;
+}, "createAuthTemplate");
+createAuthTemplate.CognitoUserPoolLogicalId = CognitoUserPoolLogicalId;
+createAuthTemplate.CognitoUserPoolClientLogicalId = CognitoUserPoolClientLogicalId;
+createAuthTemplate.CognitoIdentityPoolLogicalId = CognitoIdentityPoolLogicalId;
+createAuthTemplate.IdentityPoolAuthenticatedIAMRoleLogicalId = IdentityPoolAuthenticatedIAMRoleLogicalId;
+createAuthTemplate.IdentityPoolUnauthenticatedIAMRoleLogicalId = IdentityPoolUnauthenticatedIAMRoleLogicalId;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  PASSWORD_MINIMUM_LENGTH,
+  createAuthTemplate
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttoss/cloud-auth",
-  "version": "0.13.11",
+  "version": "0.13.13",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -19,14 +19,14 @@
   ],
   "sideEffects": false,
   "dependencies": {
-    "@ttoss/cloudformation": "^0.11.9"
+    "@ttoss/cloudformation": "^0.12.0"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",
     "jest": "^30.2.0",
     "tsup": "^8.5.1",
     "typescript": "~5.9.3",
-    "@ttoss/config": "^1.35.12"
+    "@ttoss/config": "^1.36.0"
   },
   "publishConfig": {
     "access": "public",