@ttoss/react-auth 1.2.17 → 1.2.18

package/dist/esm/index.js

@@ -212,10 +212,16 @@ var PASSWORD_MINIMUM_LENGTH = 8;
 var CognitoUserPoolLogicalId = "CognitoUserPool";
 var CognitoUserPoolClientLogicalId = "CognitoUserPoolClient";
 var CognitoIdentityPoolLogicalId = "CognitoIdentityPool";
+var IdentityPoolAuthenticatedIAMRoleLogicalId = "IdentityPoolAuthenticatedIAMRole";
+var IdentityPoolUnauthenticatedIAMRoleLogicalId = "IdentityPoolUnauthenticatedIAMRole";
+var DenyStatement = {
+  Effect: "Deny",
+  Action: ["*"],
+  Resource: ["*"]
+};
 var createAuthTemplate = ({
   autoVerifiedAttributes = ["email"],
-  identityPool = true,
-  roles,
+  identityPool,
   schema,
   usernameAttributes = ["email"]
 } = {}) => {
@@ -237,7 +243,6 @@ var createAuthTemplate = ({
               TemporaryPasswordValidityDays: 30
             }
           },
-          Schema: schema,
           UsernameAttributes: usernameAttributes,
           UsernameConfiguration: {
             CaseSensitive: false
@@ -293,7 +298,35 @@ var createAuthTemplate = ({
       }
     }
   };
-  if (identityPool) {
+  if (schema) {
+    const Schema = schema.map((attribute) => {
+      let NumberAttributeConstraints = void 0;
+      if (attribute.numberAttributeConstraints) {
+        NumberAttributeConstraints = {
+          MaxValue: attribute.numberAttributeConstraints?.maxValue,
+          MinValue: attribute.numberAttributeConstraints?.minValue
+        };
+      }
+      let StringAttributeConstraints = void 0;
+      if (attribute.stringAttributeConstraints) {
+        StringAttributeConstraints = {
+          MaxLength: attribute.stringAttributeConstraints?.maxLength,
+          MinLength: attribute.stringAttributeConstraints?.minLength
+        };
+      }
+      return {
+        AttributeDataType: attribute.attributeDataType,
+        DeveloperOnlyAttribute: attribute.developerOnlyAttribute,
+        Mutable: attribute.mutable,
+        Name: attribute.name,
+        NumberAttributeConstraints,
+        Required: attribute.required,
+        StringAttributeConstraints
+      };
+    });
+    template.Resources[CognitoUserPoolLogicalId].Properties.Schema = Schema;
+  }
+  if (identityPool?.enabled) {
     template.Resources[CognitoIdentityPoolLogicalId] = {
       Type: "AWS::Cognito::IdentityPool",
       Properties: {
@@ -310,17 +343,94 @@ var createAuthTemplate = ({
         ]
       }
     };
-    if (roles) {
-      template.Resources.CognitoIdentityPoolRoleAttachment = {
-        Type: "AWS::Cognito::IdentityPoolRoleAttachment",
-        Properties: {
-          IdentityPoolId: {
-            Ref: CognitoIdentityPoolLogicalId
+    template.Resources[IdentityPoolAuthenticatedIAMRoleLogicalId] = {
+      Type: "AWS::IAM::Role",
+      Properties: {
+        AssumeRolePolicyDocument: {
+          Version: "2012-10-17",
+          Statement: [
+            {
+              Effect: "Allow",
+              Principal: {
+                Federated: "cognito-identity.amazonaws.com"
+              },
+              Action: ["sts:AssumeRoleWithWebIdentity", "sts:TagSession"],
+              Condition: {
+                StringEquals: {
+                  "cognito-identity.amazonaws.com:aud": {
+                    Ref: CognitoIdentityPoolLogicalId
+                  }
+                },
+                "ForAnyValue:StringLike": {
+                  "cognito-identity.amazonaws.com:amr": "authenticated"
+                }
+              }
+            }
+          ]
+        },
+        Policies: identityPool.authenticatedPolicies || [
+          {
+            PolicyName: "IdentityPoolAuthenticatedIAMRolePolicyName",
+            PolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [DenyStatement]
+            }
+          }
+        ]
+      }
+    };
+    template.Resources[IdentityPoolUnauthenticatedIAMRoleLogicalId] = {
+      Type: "AWS::IAM::Role",
+      Properties: {
+        AssumeRolePolicyDocument: {
+          Version: "2012-10-17",
+          Statement: [
+            {
+              Effect: "Allow",
+              Principal: {
+                Federated: "cognito-identity.amazonaws.com"
+              },
+              Action: "sts:AssumeRoleWithWebIdentity",
+              Condition: {
+                StringEquals: {
+                  "cognito-identity.amazonaws.com:aud": {
+                    Ref: CognitoIdentityPoolLogicalId
+                  }
+                },
+                "ForAnyValue:StringLike": {
+                  "cognito-identity.amazonaws.com:amr": "unauthenticated"
+                }
+              }
+            }
+          ]
+        },
+        Policies: identityPool.authenticatedPolicies || [
+          {
+            PolicyName: "IdentityPoolUnauthenticatedIAMRolePolicyName",
+            PolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [DenyStatement]
+            }
+          }
+        ]
+      }
+    };
+    template.Resources.CognitoIdentityPoolRoleAttachment = {
+      Type: "AWS::Cognito::IdentityPoolRoleAttachment",
+      Properties: {
+        IdentityPoolId: {
+          Ref: CognitoIdentityPoolLogicalId
+        },
+        Roles: {
+          authenticated: {
+            "Fn::GetAtt": [IdentityPoolAuthenticatedIAMRoleLogicalId, "Arn"]
           },
-          Roles: roles
+          unauthenticated: {
+            "Fn::GetAtt": [IdentityPoolUnauthenticatedIAMRoleLogicalId, "Arn"]
+          }
         }
-      };
-    }
+      }
+    };
     if (!template.Outputs) {
       template.Outputs = {};
     }

package/dist/index.js

@@ -249,10 +249,16 @@ var PASSWORD_MINIMUM_LENGTH = 8;
 var CognitoUserPoolLogicalId = "CognitoUserPool";
 var CognitoUserPoolClientLogicalId = "CognitoUserPoolClient";
 var CognitoIdentityPoolLogicalId = "CognitoIdentityPool";
+var IdentityPoolAuthenticatedIAMRoleLogicalId = "IdentityPoolAuthenticatedIAMRole";
+var IdentityPoolUnauthenticatedIAMRoleLogicalId = "IdentityPoolUnauthenticatedIAMRole";
+var DenyStatement = {
+  Effect: "Deny",
+  Action: ["*"],
+  Resource: ["*"]
+};
 var createAuthTemplate = ({
   autoVerifiedAttributes = ["email"],
-  identityPool = true,
-  roles,
+  identityPool,
   schema,
   usernameAttributes = ["email"]
 } = {}) => {
@@ -274,7 +280,6 @@ var createAuthTemplate = ({
               TemporaryPasswordValidityDays: 30
             }
           },
-          Schema: schema,
           UsernameAttributes: usernameAttributes,
           UsernameConfiguration: {
             CaseSensitive: false
@@ -330,7 +335,35 @@ var createAuthTemplate = ({
       }
     }
   };
-  if (identityPool) {
+  if (schema) {
+    const Schema = schema.map((attribute) => {
+      let NumberAttributeConstraints = void 0;
+      if (attribute.numberAttributeConstraints) {
+        NumberAttributeConstraints = {
+          MaxValue: attribute.numberAttributeConstraints?.maxValue,
+          MinValue: attribute.numberAttributeConstraints?.minValue
+        };
+      }
+      let StringAttributeConstraints = void 0;
+      if (attribute.stringAttributeConstraints) {
+        StringAttributeConstraints = {
+          MaxLength: attribute.stringAttributeConstraints?.maxLength,
+          MinLength: attribute.stringAttributeConstraints?.minLength
+        };
+      }
+      return {
+        AttributeDataType: attribute.attributeDataType,
+        DeveloperOnlyAttribute: attribute.developerOnlyAttribute,
+        Mutable: attribute.mutable,
+        Name: attribute.name,
+        NumberAttributeConstraints,
+        Required: attribute.required,
+        StringAttributeConstraints
+      };
+    });
+    template.Resources[CognitoUserPoolLogicalId].Properties.Schema = Schema;
+  }
+  if (identityPool?.enabled) {
     template.Resources[CognitoIdentityPoolLogicalId] = {
       Type: "AWS::Cognito::IdentityPool",
       Properties: {
@@ -347,17 +380,94 @@ var createAuthTemplate = ({
         ]
       }
     };
-    if (roles) {
-      template.Resources.CognitoIdentityPoolRoleAttachment = {
-        Type: "AWS::Cognito::IdentityPoolRoleAttachment",
-        Properties: {
-          IdentityPoolId: {
-            Ref: CognitoIdentityPoolLogicalId
+    template.Resources[IdentityPoolAuthenticatedIAMRoleLogicalId] = {
+      Type: "AWS::IAM::Role",
+      Properties: {
+        AssumeRolePolicyDocument: {
+          Version: "2012-10-17",
+          Statement: [
+            {
+              Effect: "Allow",
+              Principal: {
+                Federated: "cognito-identity.amazonaws.com"
+              },
+              Action: ["sts:AssumeRoleWithWebIdentity", "sts:TagSession"],
+              Condition: {
+                StringEquals: {
+                  "cognito-identity.amazonaws.com:aud": {
+                    Ref: CognitoIdentityPoolLogicalId
+                  }
+                },
+                "ForAnyValue:StringLike": {
+                  "cognito-identity.amazonaws.com:amr": "authenticated"
+                }
+              }
+            }
+          ]
+        },
+        Policies: identityPool.authenticatedPolicies || [
+          {
+            PolicyName: "IdentityPoolAuthenticatedIAMRolePolicyName",
+            PolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [DenyStatement]
+            }
+          }
+        ]
+      }
+    };
+    template.Resources[IdentityPoolUnauthenticatedIAMRoleLogicalId] = {
+      Type: "AWS::IAM::Role",
+      Properties: {
+        AssumeRolePolicyDocument: {
+          Version: "2012-10-17",
+          Statement: [
+            {
+              Effect: "Allow",
+              Principal: {
+                Federated: "cognito-identity.amazonaws.com"
+              },
+              Action: "sts:AssumeRoleWithWebIdentity",
+              Condition: {
+                StringEquals: {
+                  "cognito-identity.amazonaws.com:aud": {
+                    Ref: CognitoIdentityPoolLogicalId
+                  }
+                },
+                "ForAnyValue:StringLike": {
+                  "cognito-identity.amazonaws.com:amr": "unauthenticated"
+                }
+              }
+            }
+          ]
+        },
+        Policies: identityPool.authenticatedPolicies || [
+          {
+            PolicyName: "IdentityPoolUnauthenticatedIAMRolePolicyName",
+            PolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [DenyStatement]
+            }
+          }
+        ]
+      }
+    };
+    template.Resources.CognitoIdentityPoolRoleAttachment = {
+      Type: "AWS::Cognito::IdentityPoolRoleAttachment",
+      Properties: {
+        IdentityPoolId: {
+          Ref: CognitoIdentityPoolLogicalId
+        },
+        Roles: {
+          authenticated: {
+            "Fn::GetAtt": [IdentityPoolAuthenticatedIAMRoleLogicalId, "Arn"]
           },
-          Roles: roles
+          unauthenticated: {
+            "Fn::GetAtt": [IdentityPoolUnauthenticatedIAMRoleLogicalId, "Arn"]
+          }
         }
-      };
-    }
+      }
+    };
     if (!template.Outputs) {
       template.Outputs = {};
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttoss/react-auth",
-  "version": "1.2.17",
+  "version": "1.2.18",
   "description": "ttoss authentication module for React apps.",
   "license": "UNLICENSED",
   "author": "ttoss",
@@ -34,7 +34,7 @@
     "react": ">=16.8.0"
   },
   "devDependencies": {
-    "@ttoss/cloud-auth": "^0.6.4",
+    "@ttoss/cloud-auth": "^0.7.0",
     "@ttoss/config": "^1.28.2",
     "@ttoss/i18n-cli": "^0.3.5",
     "@ttoss/react-i18n": "^1.18.8",
@@ -50,5 +50,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "0a6b947e6dc4386ff80861cbed8c119c6bd39f47"
+  "gitHead": "ff8bed71bb39e2e7d7385f8bb4a1bfda3553cb5c"
 }