insomnia-plugin-aws-amplify 2.2.0 → 2.3.0

package/README.md

@@ -5,11 +5,48 @@
 [Insomnia](https://insomnia.rest) plugin for signing in via AWS Amplify
 
 **Key Features**
+
 - Environment configuration GUI to input Amplify credentials.
 - Automatic token caching and flexible expiry options.
 - Customisable return properties (Access Token, ID Token, User ID, Auth ID).
 - Multiple user pool support across environments.
+- Two authentication methods: AWS Amplify with USER_SRP_AUTH or Cognito Identity Provider with ADMIN_USER_PASSWORD_AUTH
 
 ## Installation
+
 1. Open Insomnia and go to plugin settings.
 2. Add `insomnia-plugin-aws-amplify`.
+
+## Usage
+
+### AWS Amplify Provider (Default)
+
+Uses client-side authentication flow. No AWS credentials required.
+
+**Required fields:**
+
+- username
+- password
+- region (e.g., `us-east-1`)
+- userPoolId (e.g., `us-east-1_XXXXXXXXX`)
+- clientId
+
+### Cognito Identity Provider
+
+Uses server-side AdminInitiateAuth flow. Retrieves AWS credentials from your local AWS CLI configuration.
+
+**Required fields:**
+
+- username
+- password
+- region (e.g., `us-east-1`)
+- userPoolId (e.g., `us-east-1_XXXXXXXXX`)
+- clientId
+- **awsProfile**: AWS profile name (e.g., `staging`) - only shown when "Cognito Identity Provider" is selected
+
+**Notes**:
+
+- The plugin uses the AWS CLI to retrieve credentials, so you must have:
+  1. AWS CLI installed and configured
+  2. Valid SSO session (run `aws sso login --profile <profile-name>`)
+- Your AWS profile/role must have permission to call `cognito-idp:AdminInitiateAuth`:

package/app.js

@@ -242238,6 +242238,7 @@ __export(app_exports, {
 module.exports = __toCommonJS(app_exports);
 
 // src/modules/auth/index.ts
+var import_node_child_process = require("child_process");
 var import_client_cognito_identity_provider = __toESM(require_dist_cjs59());
 var import_aws_amplify = __toESM(require_lib20());
 async function loginUser(username, password, region, userPoolId, clientId) {
@@ -242264,8 +242265,43 @@ async function loginUser(username, password, region, userPoolId, clientId) {
     accessToken
   };
 }
-async function loginUserViaCognito(username, password, region, userPoolId, clientId) {
-  const client = new import_client_cognito_identity_provider.CognitoIdentityProviderClient({ region });
+async function loginUserViaCognito(username, password, region, userPoolId, clientId, awsProfile) {
+  const profileName = (awsProfile == null ? void 0 : awsProfile.trim()) || "";
+  if (!profileName) {
+    throw new Error(
+      'AWS Profile is required for Cognito Identity Provider. Please specify your AWS profile name (e.g., "staging").'
+    );
+  }
+  if (!/^[a-zA-Z0-9_-]+$/.test(profileName)) {
+    throw new Error(
+      `Invalid AWS profile name: "${profileName}". Profile names can only contain letters, numbers, hyphens, and underscores.`
+    );
+  }
+  let credentials;
+  try {
+    const output = (0, import_node_child_process.execSync)(
+      `aws configure export-credentials --profile ${profileName} --format process`,
+      {
+        encoding: "utf-8",
+        timeout: 5e3
+        // 5 seconds timeout
+      }
+    );
+    const creds = JSON.parse(output);
+    credentials = {
+      accessKeyId: creds.AccessKeyId,
+      secretAccessKey: creds.SecretAccessKey,
+      sessionToken: creds.SessionToken
+    };
+  } catch (error2) {
+    throw new Error(
+      `Failed to load AWS credentials for profile "${profileName}". Make sure you have run 'aws sso login --profile ${profileName}' and have valid credentials. Error: ${error2 instanceof Error ? error2.message : String(error2)}`
+    );
+  }
+  const client = new import_client_cognito_identity_provider.CognitoIdentityProviderClient({
+    region,
+    credentials
+  });
   const command = new import_client_cognito_identity_provider.AdminInitiateAuthCommand({
     AuthFlow: "ADMIN_USER_PASSWORD_AUTH",
     UserPoolId: userPoolId,
@@ -242277,7 +242313,7 @@ async function loginUserViaCognito(username, password, region, userPoolId, clien
   });
   const response = await client.send(command);
   const authResult = response.AuthenticationResult;
-  if (!authResult || !authResult.IdToken || !authResult.AccessToken) {
+  if (!(authResult == null ? void 0 : authResult.IdToken) || !authResult.AccessToken) {
     throw new Error(
       `Invalid auth response: ${JSON.stringify(response, null, 2)}`
     );
@@ -242388,6 +242424,7 @@ var root = async (context, ...args) => {
     userPoolId,
     clientId,
     provider,
+    awsProfile,
     returnValue
   ] = args;
   const inputs = { username, password, region, userPoolId, clientId };
@@ -242402,7 +242439,8 @@ var root = async (context, ...args) => {
     region,
     userPoolId,
     clientId,
-    provider
+    provider,
+    awsProfile
   });
   const authStorePool = await getAuthPool(context.store, userPoolId);
   if (!authStorePool) {
@@ -242428,14 +242466,23 @@ var authenticate = async (context) => {
   if (!inputStore) {
     throw Error("Input credentials not found in cache");
   }
-  const { username, password, region, userPoolId, clientId, provider } = inputStore;
+  const {
+    username,
+    password,
+    region,
+    userPoolId,
+    clientId,
+    provider,
+    awsProfile
+  } = inputStore;
   try {
     const loginResponse = provider === "amplify" ? await loginUser(username, password, region, userPoolId, clientId) : await loginUserViaCognito(
       username,
       password,
       region,
       userPoolId,
-      clientId
+      clientId,
+      awsProfile
     );
     const ONE_HOUR_MS = 1e3 * 60 * 60;
     const expiresAt = (/* @__PURE__ */ new Date()).getTime() + ONE_HOUR_MS;
@@ -242524,6 +242571,16 @@ var rootTemplate = [
           }
         ]
       },
+      {
+        displayName: "awsProfile",
+        type: "string",
+        defaultValue: "staging",
+        help: 'Run "aws sso login --profile <name>" first, and use the same profile name here.',
+        hide: (args) => {
+          const providerArg = args[5];
+          return (providerArg == null ? void 0 : providerArg.value) !== "cognito";
+        }
+      },
       {
         displayName: "returnValue",
         type: "enum",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insomnia-plugin-aws-amplify",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "Insomnia plugin for signing in via AWS Amplify",
   "author": "Dan <dan@fate.org.au>",
   "license": "ISC",