@ttoss/cloud-auth 0.6.4 → 0.7.1

package/coverage/lcov.info

@@ -28,7 +28,7 @@ BRH:4
 end_of_record
 TN:
 SF:src/template.ts
-FN:16,createAuthTemplate
+FN:22,createAuthTemplate
 FNF:1
 FNH:1
 FNDA:12,createAuthTemplate
@@ -48,12 +48,12 @@ DA:13,1
 DA:14,1
 DA:15,1
 DA:16,1
-DA:17,12
-DA:18,12
-DA:19,12
-DA:20,12
-DA:21,12
-DA:22,12
+DA:17,1
+DA:18,1
+DA:19,1
+DA:20,1
+DA:21,1
+DA:22,1
 DA:23,12
 DA:24,12
 DA:25,12
@@ -82,12 +82,12 @@ DA:47,12
 DA:48,12
 DA:49,12
 DA:50,12
-DA:51,9
+DA:51,12
 DA:52,12
 DA:53,12
 DA:54,12
 DA:55,12
-DA:56,12
+DA:56,9
 DA:57,12
 DA:58,12
 DA:59,12
@@ -161,27 +161,27 @@ DA:126,12
 DA:127,12
 DA:128,12
 DA:129,12
-DA:130,11
-DA:131,11
-DA:132,11
-DA:133,11
-DA:134,11
-DA:135,11
-DA:136,11
-DA:137,11
-DA:138,11
-DA:139,11
-DA:140,11
-DA:141,11
-DA:142,11
-DA:143,11
-DA:144,11
-DA:145,11
-DA:146,11
-DA:147,11
-DA:148,11
-DA:149,11
-DA:150,11
+DA:130,12
+DA:131,12
+DA:132,12
+DA:133,12
+DA:134,12
+DA:135,1
+DA:136,1
+DA:137,1
+DA:138,1
+DA:139,0
+DA:140,0
+DA:141,0
+DA:142,0
+DA:143,0
+DA:144,1
+DA:145,1
+DA:146,1
+DA:147,1
+DA:148,1
+DA:149,1
+DA:150,1
 DA:151,1
 DA:152,1
 DA:153,1
@@ -195,43 +195,164 @@ DA:160,1
 DA:161,1
 DA:162,1
 DA:163,1
-DA:164,11
-DA:165,11
-DA:166,0
-DA:167,0
-DA:168,11
-DA:169,11
-DA:170,11
-DA:171,11
-DA:172,11
-DA:173,11
-DA:174,11
-DA:175,11
-DA:176,11
-DA:177,11
-DA:178,11
-DA:179,11
-DA:180,11
-DA:181,11
-DA:182,11
-DA:183,11
-DA:184,12
-DA:185,12
-DA:186,12
-DA:187,1
-DA:188,1
-DA:189,1
-DA:190,1
-DA:191,1
-LF:191
-LH:189
-BRDA:16,0,0,12
-BRDA:50,1,0,10
-BRDA:51,2,0,9
-BRDA:52,3,0,3
-BRDA:129,4,0,11
-BRDA:150,5,0,1
-BRDA:165,6,0,0
-BRF:7
-BRH:6
+DA:164,1
+DA:165,1
+DA:166,1
+DA:167,12
+DA:168,12
+DA:169,2
+DA:170,2
+DA:171,2
+DA:172,2
+DA:173,2
+DA:174,2
+DA:175,2
+DA:176,2
+DA:177,2
+DA:178,2
+DA:179,2
+DA:180,2
+DA:181,2
+DA:182,2
+DA:183,2
+DA:184,2
+DA:185,2
+DA:186,2
+DA:187,2
+DA:188,2
+DA:189,2
+DA:190,2
+DA:191,2
+DA:192,2
+DA:193,2
+DA:194,2
+DA:195,2
+DA:196,2
+DA:197,2
+DA:198,2
+DA:199,2
+DA:200,2
+DA:201,2
+DA:202,2
+DA:203,2
+DA:204,2
+DA:205,2
+DA:206,2
+DA:207,2
+DA:208,2
+DA:209,2
+DA:210,2
+DA:211,2
+DA:212,2
+DA:213,2
+DA:214,2
+DA:215,2
+DA:216,2
+DA:217,2
+DA:218,2
+DA:219,2
+DA:220,2
+DA:221,2
+DA:222,2
+DA:223,2
+DA:224,2
+DA:225,2
+DA:226,2
+DA:227,2
+DA:228,2
+DA:229,2
+DA:230,2
+DA:231,2
+DA:232,2
+DA:233,2
+DA:234,2
+DA:235,2
+DA:236,2
+DA:237,2
+DA:238,2
+DA:239,2
+DA:240,2
+DA:241,2
+DA:242,2
+DA:243,2
+DA:244,2
+DA:245,2
+DA:246,2
+DA:247,2
+DA:248,2
+DA:249,2
+DA:250,2
+DA:251,2
+DA:252,2
+DA:253,2
+DA:254,2
+DA:255,2
+DA:256,2
+DA:257,2
+DA:258,2
+DA:259,2
+DA:260,2
+DA:261,2
+DA:262,2
+DA:263,2
+DA:264,2
+DA:265,2
+DA:266,2
+DA:267,2
+DA:268,2
+DA:269,2
+DA:270,2
+DA:271,2
+DA:272,2
+DA:273,2
+DA:274,2
+DA:275,2
+DA:276,2
+DA:277,2
+DA:278,2
+DA:279,2
+DA:280,2
+DA:281,2
+DA:282,2
+DA:283,2
+DA:284,0
+DA:285,0
+DA:286,2
+DA:287,2
+DA:288,2
+DA:289,2
+DA:290,2
+DA:291,2
+DA:292,2
+DA:293,2
+DA:294,2
+DA:295,2
+DA:296,2
+DA:297,2
+DA:298,2
+DA:299,2
+DA:300,2
+DA:301,2
+DA:302,12
+DA:303,12
+DA:304,12
+DA:305,1
+DA:306,1
+DA:307,1
+DA:308,1
+DA:309,1
+LF:309
+LH:302
+BRDA:22,0,0,12
+BRDA:55,1,0,10
+BRDA:56,2,0,9
+BRDA:57,3,0,3
+BRDA:134,4,0,1
+BRDA:168,5,0,4
+BRDA:168,6,0,2
+BRDA:283,7,0,0
+BRDA:135,8,0,1
+BRDA:138,9,0,0
+BRF:10
+BRH:8
 end_of_record

package/dist/esm/index.js

@@ -7,10 +7,16 @@ var PASSWORD_MINIMUM_LENGTH = 8;
 var CognitoUserPoolLogicalId = "CognitoUserPool";
 var CognitoUserPoolClientLogicalId = "CognitoUserPoolClient";
 var CognitoIdentityPoolLogicalId = "CognitoIdentityPool";
+var IdentityPoolAuthenticatedIAMRoleLogicalId = "IdentityPoolAuthenticatedIAMRole";
+var IdentityPoolUnauthenticatedIAMRoleLogicalId = "IdentityPoolUnauthenticatedIAMRole";
+var DenyStatement = {
+  Effect: "Deny",
+  Action: ["*"],
+  Resource: ["*"]
+};
 var createAuthTemplate = ({
   autoVerifiedAttributes = ["email"],
-  identityPool = true,
-  roles,
+  identityPool,
   schema,
   usernameAttributes = ["email"]
 } = {}) => {
@@ -20,6 +26,7 @@ var createAuthTemplate = ({
     Resources: {
       [CognitoUserPoolLogicalId]: {
         Type: "AWS::Cognito::UserPool",
+        DeletionPolicy: "Retain",
         Properties: {
           AutoVerifiedAttributes,
           Policies: {
@@ -32,7 +39,6 @@ var createAuthTemplate = ({
               TemporaryPasswordValidityDays: 30
             }
           },
-          Schema: schema,
           UsernameAttributes: usernameAttributes,
           UsernameConfiguration: {
             CaseSensitive: false
@@ -88,7 +94,35 @@ var createAuthTemplate = ({
       }
     }
   };
-  if (identityPool) {
+  if (schema) {
+    const Schema = schema.map((attribute) => {
+      let NumberAttributeConstraints = void 0;
+      if (attribute.numberAttributeConstraints) {
+        NumberAttributeConstraints = {
+          MaxValue: attribute.numberAttributeConstraints?.maxValue,
+          MinValue: attribute.numberAttributeConstraints?.minValue
+        };
+      }
+      let StringAttributeConstraints = void 0;
+      if (attribute.stringAttributeConstraints) {
+        StringAttributeConstraints = {
+          MaxLength: attribute.stringAttributeConstraints?.maxLength,
+          MinLength: attribute.stringAttributeConstraints?.minLength
+        };
+      }
+      return {
+        AttributeDataType: attribute.attributeDataType,
+        DeveloperOnlyAttribute: attribute.developerOnlyAttribute,
+        Mutable: attribute.mutable,
+        Name: attribute.name,
+        NumberAttributeConstraints,
+        Required: attribute.required,
+        StringAttributeConstraints
+      };
+    });
+    template.Resources[CognitoUserPoolLogicalId].Properties.Schema = Schema;
+  }
+  if (identityPool?.enabled) {
     template.Resources[CognitoIdentityPoolLogicalId] = {
       Type: "AWS::Cognito::IdentityPool",
       Properties: {
@@ -105,17 +139,94 @@ var createAuthTemplate = ({
         ]
       }
     };
-    if (roles) {
-      template.Resources.CognitoIdentityPoolRoleAttachment = {
-        Type: "AWS::Cognito::IdentityPoolRoleAttachment",
-        Properties: {
-          IdentityPoolId: {
-            Ref: CognitoIdentityPoolLogicalId
+    template.Resources[IdentityPoolAuthenticatedIAMRoleLogicalId] = {
+      Type: "AWS::IAM::Role",
+      Properties: {
+        AssumeRolePolicyDocument: {
+          Version: "2012-10-17",
+          Statement: [
+            {
+              Effect: "Allow",
+              Principal: {
+                Federated: "cognito-identity.amazonaws.com"
+              },
+              Action: ["sts:AssumeRoleWithWebIdentity", "sts:TagSession"],
+              Condition: {
+                StringEquals: {
+                  "cognito-identity.amazonaws.com:aud": {
+                    Ref: CognitoIdentityPoolLogicalId
+                  }
+                },
+                "ForAnyValue:StringLike": {
+                  "cognito-identity.amazonaws.com:amr": "authenticated"
+                }
+              }
+            }
+          ]
+        },
+        Policies: identityPool.authenticatedPolicies || [
+          {
+            PolicyName: "IdentityPoolAuthenticatedIAMRolePolicyName",
+            PolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [DenyStatement]
+            }
+          }
+        ]
+      }
+    };
+    template.Resources[IdentityPoolUnauthenticatedIAMRoleLogicalId] = {
+      Type: "AWS::IAM::Role",
+      Properties: {
+        AssumeRolePolicyDocument: {
+          Version: "2012-10-17",
+          Statement: [
+            {
+              Effect: "Allow",
+              Principal: {
+                Federated: "cognito-identity.amazonaws.com"
+              },
+              Action: "sts:AssumeRoleWithWebIdentity",
+              Condition: {
+                StringEquals: {
+                  "cognito-identity.amazonaws.com:aud": {
+                    Ref: CognitoIdentityPoolLogicalId
+                  }
+                },
+                "ForAnyValue:StringLike": {
+                  "cognito-identity.amazonaws.com:amr": "unauthenticated"
+                }
+              }
+            }
+          ]
+        },
+        Policies: identityPool.authenticatedPolicies || [
+          {
+            PolicyName: "IdentityPoolUnauthenticatedIAMRolePolicyName",
+            PolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [DenyStatement]
+            }
+          }
+        ]
+      }
+    };
+    template.Resources.CognitoIdentityPoolRoleAttachment = {
+      Type: "AWS::Cognito::IdentityPoolRoleAttachment",
+      Properties: {
+        IdentityPoolId: {
+          Ref: CognitoIdentityPoolLogicalId
+        },
+        Roles: {
+          authenticated: {
+            "Fn::GetAtt": [IdentityPoolAuthenticatedIAMRoleLogicalId, "Arn"]
           },
-          Roles: roles
+          unauthenticated: {
+            "Fn::GetAtt": [IdentityPoolUnauthenticatedIAMRoleLogicalId, "Arn"]
+          }
         }
-      };
-    }
+      }
+    };
     if (!template.Outputs) {
       template.Outputs = {};
     }

package/dist/index.d.ts

@@ -1,34 +1,31 @@
-import { CloudFormationTemplate } from '@ttoss/cloudformation';
+import { Policy, CloudFormationTemplate } from '@ttoss/cloudformation';
 
 declare const PASSWORD_MINIMUM_LENGTH = 8;
 
-type Role = string | {
-    'Fn::ImportValue': string;
-};
 declare const createAuthTemplate: {
-    ({ autoVerifiedAttributes, identityPool, roles, schema, usernameAttributes, }?: {
+    ({ autoVerifiedAttributes, identityPool, schema, usernameAttributes, }?: {
         autoVerifiedAttributes?: false | ("email" | "phone_number")[] | null | undefined;
-        identityPool?: boolean | undefined;
-        roles?: {
-            authenticated?: Role | undefined;
-            unauthenticated?: Role | undefined;
+        identityPool?: {
+            enabled?: boolean | undefined;
+            authenticatedPolicies?: Policy[] | undefined;
+            unauthenticatedPolicies?: Policy[] | undefined;
         } | undefined;
         /**
          * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-userpool-schemaattribute.html
          */
         schema?: {
-            AttributeDataType?: "Boolean" | "DateTime" | "Number" | "String" | undefined;
-            DeveloperOnlyAttribute?: boolean | undefined;
-            Mutable?: boolean | undefined;
-            Name?: string | undefined;
-            NumberAttributeConstraints?: {
-                MaxValue?: string | undefined;
-                MinValue?: string | undefined;
+            attributeDataType?: "Boolean" | "DateTime" | "Number" | "String" | undefined;
+            developerOnlyAttribute?: boolean | undefined;
+            mutable?: boolean | undefined;
+            name?: string | undefined;
+            numberAttributeConstraints?: {
+                maxValue?: string | undefined;
+                minValue?: string | undefined;
             } | undefined;
-            Required?: boolean | undefined;
-            StringAttributeConstraints?: {
-                MaxLength: string;
-                MinLength: string;
+            required?: boolean | undefined;
+            stringAttributeConstraints?: {
+                maxLength: string;
+                minLength: string;
             } | undefined;
         }[] | undefined;
         usernameAttributes?: ("email" | "phone_number")[] | null | undefined;

package/dist/index.js

@@ -33,10 +33,16 @@ var PASSWORD_MINIMUM_LENGTH = 8;
 var CognitoUserPoolLogicalId = "CognitoUserPool";
 var CognitoUserPoolClientLogicalId = "CognitoUserPoolClient";
 var CognitoIdentityPoolLogicalId = "CognitoIdentityPool";
+var IdentityPoolAuthenticatedIAMRoleLogicalId = "IdentityPoolAuthenticatedIAMRole";
+var IdentityPoolUnauthenticatedIAMRoleLogicalId = "IdentityPoolUnauthenticatedIAMRole";
+var DenyStatement = {
+  Effect: "Deny",
+  Action: ["*"],
+  Resource: ["*"]
+};
 var createAuthTemplate = ({
   autoVerifiedAttributes = ["email"],
-  identityPool = true,
-  roles,
+  identityPool,
   schema,
   usernameAttributes = ["email"]
 } = {}) => {
@@ -46,6 +52,7 @@ var createAuthTemplate = ({
     Resources: {
       [CognitoUserPoolLogicalId]: {
         Type: "AWS::Cognito::UserPool",
+        DeletionPolicy: "Retain",
         Properties: {
           AutoVerifiedAttributes,
           Policies: {
@@ -58,7 +65,6 @@ var createAuthTemplate = ({
               TemporaryPasswordValidityDays: 30
             }
           },
-          Schema: schema,
           UsernameAttributes: usernameAttributes,
           UsernameConfiguration: {
             CaseSensitive: false
@@ -114,7 +120,35 @@ var createAuthTemplate = ({
       }
     }
   };
-  if (identityPool) {
+  if (schema) {
+    const Schema = schema.map((attribute) => {
+      let NumberAttributeConstraints = void 0;
+      if (attribute.numberAttributeConstraints) {
+        NumberAttributeConstraints = {
+          MaxValue: attribute.numberAttributeConstraints?.maxValue,
+          MinValue: attribute.numberAttributeConstraints?.minValue
+        };
+      }
+      let StringAttributeConstraints = void 0;
+      if (attribute.stringAttributeConstraints) {
+        StringAttributeConstraints = {
+          MaxLength: attribute.stringAttributeConstraints?.maxLength,
+          MinLength: attribute.stringAttributeConstraints?.minLength
+        };
+      }
+      return {
+        AttributeDataType: attribute.attributeDataType,
+        DeveloperOnlyAttribute: attribute.developerOnlyAttribute,
+        Mutable: attribute.mutable,
+        Name: attribute.name,
+        NumberAttributeConstraints,
+        Required: attribute.required,
+        StringAttributeConstraints
+      };
+    });
+    template.Resources[CognitoUserPoolLogicalId].Properties.Schema = Schema;
+  }
+  if (identityPool?.enabled) {
     template.Resources[CognitoIdentityPoolLogicalId] = {
       Type: "AWS::Cognito::IdentityPool",
       Properties: {
@@ -131,17 +165,94 @@ var createAuthTemplate = ({
         ]
       }
     };
-    if (roles) {
-      template.Resources.CognitoIdentityPoolRoleAttachment = {
-        Type: "AWS::Cognito::IdentityPoolRoleAttachment",
-        Properties: {
-          IdentityPoolId: {
-            Ref: CognitoIdentityPoolLogicalId
+    template.Resources[IdentityPoolAuthenticatedIAMRoleLogicalId] = {
+      Type: "AWS::IAM::Role",
+      Properties: {
+        AssumeRolePolicyDocument: {
+          Version: "2012-10-17",
+          Statement: [
+            {
+              Effect: "Allow",
+              Principal: {
+                Federated: "cognito-identity.amazonaws.com"
+              },
+              Action: ["sts:AssumeRoleWithWebIdentity", "sts:TagSession"],
+              Condition: {
+                StringEquals: {
+                  "cognito-identity.amazonaws.com:aud": {
+                    Ref: CognitoIdentityPoolLogicalId
+                  }
+                },
+                "ForAnyValue:StringLike": {
+                  "cognito-identity.amazonaws.com:amr": "authenticated"
+                }
+              }
+            }
+          ]
+        },
+        Policies: identityPool.authenticatedPolicies || [
+          {
+            PolicyName: "IdentityPoolAuthenticatedIAMRolePolicyName",
+            PolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [DenyStatement]
+            }
+          }
+        ]
+      }
+    };
+    template.Resources[IdentityPoolUnauthenticatedIAMRoleLogicalId] = {
+      Type: "AWS::IAM::Role",
+      Properties: {
+        AssumeRolePolicyDocument: {
+          Version: "2012-10-17",
+          Statement: [
+            {
+              Effect: "Allow",
+              Principal: {
+                Federated: "cognito-identity.amazonaws.com"
+              },
+              Action: "sts:AssumeRoleWithWebIdentity",
+              Condition: {
+                StringEquals: {
+                  "cognito-identity.amazonaws.com:aud": {
+                    Ref: CognitoIdentityPoolLogicalId
+                  }
+                },
+                "ForAnyValue:StringLike": {
+                  "cognito-identity.amazonaws.com:amr": "unauthenticated"
+                }
+              }
+            }
+          ]
+        },
+        Policies: identityPool.authenticatedPolicies || [
+          {
+            PolicyName: "IdentityPoolUnauthenticatedIAMRolePolicyName",
+            PolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [DenyStatement]
+            }
+          }
+        ]
+      }
+    };
+    template.Resources.CognitoIdentityPoolRoleAttachment = {
+      Type: "AWS::Cognito::IdentityPoolRoleAttachment",
+      Properties: {
+        IdentityPoolId: {
+          Ref: CognitoIdentityPoolLogicalId
+        },
+        Roles: {
+          authenticated: {
+            "Fn::GetAtt": [IdentityPoolAuthenticatedIAMRoleLogicalId, "Arn"]
           },
-          Roles: roles
+          unauthenticated: {
+            "Fn::GetAtt": [IdentityPoolUnauthenticatedIAMRoleLogicalId, "Arn"]
+          }
         }
-      };
-    }
+      }
+    };
     if (!template.Outputs) {
       template.Outputs = {};
     }