@ttoss/react-auth 1.7.20 → 1.7.22

package/dist/esm/index.js

@@ -358,6 +358,10 @@ var DenyStatement = {
   Action: ["*"],
   Resource: ["*"]
 };
+var defaultPrincipalTags = {
+  appClientId: "aud",
+  userId: "sub"
+};
 var createAuthTemplate = ({
   autoVerifiedAttributes = ["email"],
   identityPool,
@@ -369,6 +373,9 @@ var createAuthTemplate = ({
     AWSTemplateFormatVersion: "2010-09-09",
     Resources: {
       [CognitoUserPoolLogicalId]: {
+        /**
+         * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpool.html
+         */
         Type: "AWS::Cognito::UserPool",
         Properties: {
           AutoVerifiedAttributes,
@@ -392,6 +399,9 @@ var createAuthTemplate = ({
         }
       },
       [CognitoUserPoolClientLogicalId]: {
+        /**
+         * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpoolclient.html
+         */
         Type: "AWS::Cognito::UserPoolClient",
         Properties: {
           SupportedIdentityProviders: ["COGNITO"],
@@ -473,9 +483,12 @@ var createAuthTemplate = ({
   }
   if (identityPool?.enabled) {
     template.Resources[CognitoIdentityPoolLogicalId] = {
+      /**
+       * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-identitypool.html
+       */
       Type: "AWS::Cognito::IdentityPool",
       Properties: {
-        AllowUnauthenticatedIdentities: true,
+        AllowUnauthenticatedIdentities: identityPool.allowUnauthenticatedIdentities || false,
         CognitoIdentityProviders: [{
           ClientId: {
             Ref: CognitoUserPoolClientLogicalId
@@ -486,86 +499,123 @@ var createAuthTemplate = ({
         }]
       }
     };
-    template.Resources[IdentityPoolAuthenticatedIAMRoleLogicalId] = {
-      Type: "AWS::IAM::Role",
+    if (identityPool.name) {
+      template.Resources[CognitoIdentityPoolLogicalId].Properties.IdentityPoolName = identityPool.name;
+    }
+    template.Resources.CognitoIdentityPoolRoleAttachment = {
+      /**
+       * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-identitypoolroleattachment.html
+       */
+      Type: "AWS::Cognito::IdentityPoolRoleAttachment",
       Properties: {
-        AssumeRolePolicyDocument: {
-          Version: "2012-10-17",
-          Statement: [{
-            Effect: "Allow",
-            Principal: {
-              Federated: "cognito-identity.amazonaws.com"
-            },
-            Action: ["sts:AssumeRoleWithWebIdentity", "sts:TagSession"],
-            Condition: {
-              StringEquals: {
-                "cognito-identity.amazonaws.com:aud": {
-                  Ref: CognitoIdentityPoolLogicalId
-                }
+        IdentityPoolId: {
+          Ref: CognitoIdentityPoolLogicalId
+        },
+        Roles: {}
+      }
+    };
+    if (!identityPool.authenticatedRoleArn) {
+      template.Resources[IdentityPoolAuthenticatedIAMRoleLogicalId] = {
+        Type: "AWS::IAM::Role",
+        Properties: {
+          AssumeRolePolicyDocument: {
+            Version: "2012-10-17",
+            Statement: [{
+              Effect: "Allow",
+              Principal: {
+                Federated: "cognito-identity.amazonaws.com"
               },
-              "ForAnyValue:StringLike": {
-                "cognito-identity.amazonaws.com:amr": "authenticated"
+              Action: ["sts:AssumeRoleWithWebIdentity", "sts:TagSession"],
+              Condition: {
+                StringEquals: {
+                  "cognito-identity.amazonaws.com:aud": {
+                    Ref: CognitoIdentityPoolLogicalId
+                  }
+                },
+                "ForAnyValue:StringLike": {
+                  "cognito-identity.amazonaws.com:amr": "authenticated"
+                }
               }
+            }]
+          },
+          Policies: identityPool.authenticatedPolicies || [{
+            PolicyName: "IdentityPoolAuthenticatedIAMRolePolicyName",
+            PolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [DenyStatement]
             }
           }]
-        },
-        Policies: identityPool.authenticatedPolicies || [{
-          PolicyName: "IdentityPoolAuthenticatedIAMRolePolicyName",
-          PolicyDocument: {
+        }
+      };
+      template.Resources.CognitoIdentityPoolRoleAttachment.Properties.Roles.authenticated = {
+        "Fn::GetAtt": [IdentityPoolAuthenticatedIAMRoleLogicalId, "Arn"]
+      };
+    } else {
+      template.Resources.CognitoIdentityPoolRoleAttachment.Properties.Roles.authenticated = identityPool.authenticatedRoleArn;
+    }
+    if (!identityPool.unauthenticatedRoleArn) {
+      template.Resources[IdentityPoolUnauthenticatedIAMRoleLogicalId] = {
+        Type: "AWS::IAM::Role",
+        Properties: {
+          AssumeRolePolicyDocument: {
             Version: "2012-10-17",
-            Statement: [DenyStatement]
-          }
-        }]
-      }
-    };
-    template.Resources[IdentityPoolUnauthenticatedIAMRoleLogicalId] = {
-      Type: "AWS::IAM::Role",
-      Properties: {
-        AssumeRolePolicyDocument: {
-          Version: "2012-10-17",
-          Statement: [{
-            Effect: "Allow",
-            Principal: {
-              Federated: "cognito-identity.amazonaws.com"
-            },
-            Action: "sts:AssumeRoleWithWebIdentity",
-            Condition: {
-              StringEquals: {
-                "cognito-identity.amazonaws.com:aud": {
-                  Ref: CognitoIdentityPoolLogicalId
-                }
+            Statement: [{
+              Effect: "Allow",
+              Principal: {
+                Federated: "cognito-identity.amazonaws.com"
               },
-              "ForAnyValue:StringLike": {
-                "cognito-identity.amazonaws.com:amr": "unauthenticated"
+              Action: "sts:AssumeRoleWithWebIdentity",
+              Condition: {
+                StringEquals: {
+                  "cognito-identity.amazonaws.com:aud": {
+                    Ref: CognitoIdentityPoolLogicalId
+                  }
+                },
+                "ForAnyValue:StringLike": {
+                  "cognito-identity.amazonaws.com:amr": "unauthenticated"
+                }
               }
+            }]
+          },
+          Policies: identityPool.authenticatedPolicies || [{
+            PolicyName: "IdentityPoolUnauthenticatedIAMRolePolicyName",
+            PolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [DenyStatement]
             }
           }]
-        },
-        Policies: identityPool.authenticatedPolicies || [{
-          PolicyName: "IdentityPoolUnauthenticatedIAMRolePolicyName",
-          PolicyDocument: {
-            Version: "2012-10-17",
-            Statement: [DenyStatement]
-          }
-        }]
-      }
-    };
-    template.Resources.CognitoIdentityPoolRoleAttachment = {
-      Type: "AWS::Cognito::IdentityPoolRoleAttachment",
-      Properties: {
-        IdentityPoolId: {
-          Ref: CognitoIdentityPoolLogicalId
-        },
-        Roles: {
-          authenticated: {
-            "Fn::GetAtt": [IdentityPoolAuthenticatedIAMRoleLogicalId, "Arn"]
+        }
+      };
+      template.Resources.CognitoIdentityPoolRoleAttachment.Properties.Roles.unauthenticated = {
+        "Fn::GetAtt": [IdentityPoolUnauthenticatedIAMRoleLogicalId, "Arn"]
+      };
+    } else {
+      template.Resources.CognitoIdentityPoolRoleAttachment.Properties.Roles.unauthenticated = identityPool.unauthenticatedRoleArn;
+    }
+    if (identityPool.principalTags || identityPool.principalTags === void 0) {
+      const PrincipalTags = (() => {
+        if (typeof identityPool.principalTags === "boolean") {
+          return defaultPrincipalTags;
+        }
+        if (identityPool.principalTags === void 0) {
+          return defaultPrincipalTags;
+        }
+        return identityPool.principalTags;
+      })();
+      template.Resources.CognitoIdentityPoolPrincipalTag = {
+        Type: "AWS::Cognito::IdentityPoolPrincipalTag",
+        Properties: {
+          IdentityPoolId: {
+            Ref: CognitoIdentityPoolLogicalId
           },
-          unauthenticated: {
-            "Fn::GetAtt": [IdentityPoolUnauthenticatedIAMRoleLogicalId, "Arn"]
-          }
+          IdentityProviderName: {
+            "Fn::GetAtt": [CognitoUserPoolLogicalId, "ProviderName"]
+          },
+          PrincipalTags,
+          UseDefaults: false
         }
-      }
-    };
+      };
+    }
     if (!template.Outputs) {
       template.Outputs = {};
     }
@@ -588,6 +638,8 @@ var createAuthTemplate = ({
 createAuthTemplate.CognitoUserPoolLogicalId = CognitoUserPoolLogicalId;
 createAuthTemplate.CognitoUserPoolClientLogicalId = CognitoUserPoolClientLogicalId;
 createAuthTemplate.CognitoIdentityPoolLogicalId = CognitoIdentityPoolLogicalId;
+createAuthTemplate.IdentityPoolAuthenticatedIAMRoleLogicalId = IdentityPoolAuthenticatedIAMRoleLogicalId;
+createAuthTemplate.IdentityPoolUnauthenticatedIAMRoleLogicalId = IdentityPoolUnauthenticatedIAMRoleLogicalId;
 
 // src/AuthForgotPasswordResetPassword.tsx
 import { useI18n as useI18n3 } from "@ttoss/react-i18n";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttoss/react-auth",
-  "version": "1.7.20",
+  "version": "1.7.22",
   "description": "ttoss authentication module for React apps.",
   "author": "ttoss",
   "contributors": [
@@ -32,8 +32,8 @@
   "peerDependencies": {
     "aws-amplify": "^5.0.0",
     "react": ">=16.8.0",
-    "@ttoss/react-i18n": "^1.25.8",
     "@ttoss/react-notifications": "^1.24.22",
+    "@ttoss/react-i18n": "^1.25.8",
     "@ttoss/ui": "^4.0.7"
   },
   "devDependencies": {
@@ -42,7 +42,7 @@
     "aws-amplify": "^5.3.11",
     "jest": "^29.7.0",
     "tsup": "^8.0.1",
-    "@ttoss/cloud-auth": "^0.10.7",
+    "@ttoss/cloud-auth": "^0.12.0",
     "@ttoss/config": "^1.31.4",
     "@ttoss/i18n-cli": "^0.7.5",
     "@ttoss/react-i18n": "^1.25.8",