quidproquo-deploy-awscdk 0.0.71 → 0.0.73

package/lib/constructs/base/QpqConstructBlock.js

@@ -10,10 +10,10 @@ class QpqConstructBlock extends constructs_1.Construct {
         this.qpqConfig = props.qpqConfig;
     }
     resourceName(name) {
-        return quidproquo_actionprocessor_awslambda_1.awsNamingUtils.getConfigRuntimeResourceName(name, this.qpqConfig);
+        return quidproquo_actionprocessor_awslambda_1.awsNamingUtils.getConfigRuntimeResourceNameFromConfig(name, this.qpqConfig);
     }
     qpqResourceName(name, resourceType) {
-        return quidproquo_actionprocessor_awslambda_1.awsNamingUtils.getQpqRuntimeResourceName(name, this.qpqConfig, resourceType);
+        return quidproquo_actionprocessor_awslambda_1.awsNamingUtils.getQpqRuntimeResourceNameFromConfig(name, this.qpqConfig, resourceType);
     }
     grantRead(grantee) { }
     grantWrite(grantee) { }

package/lib/constructs/basic/Function.js

@@ -44,6 +44,11 @@ class Function extends QpqConstructBlock_1.QpqConstructBlock {
             handler: `index.${props.executorName}`,
             environment: props.environment,
         });
+        // Let lambdas read from the exported variables in cloudformation
+        this.lambdaFunction.addToRolePolicy(new aws_cdk_lib_1.aws_iam.PolicyStatement({
+            actions: ['cloudformation:ListExports'],
+            resources: ['*'],
+        }));
     }
 }
 exports.Function = Function;

package/lib/constructs/basic/LambdaLayers.js

@@ -10,7 +10,7 @@ class LambdaLayers extends QpqConstructBlock_1.QpqConstructBlock {
         this.layers = (props.apiLayers || []).map((layer) => {
             return layer.buildPath
                 ? new aws_cdk_lib_1.aws_lambda.LayerVersion(this, `${layer.name}-layer`, {
-                    layerVersionName: quidproquo_actionprocessor_awslambda_1.awsNamingUtils.getQpqRuntimeResourceName(layer.name, props.qpqConfig),
+                    layerVersionName: quidproquo_actionprocessor_awslambda_1.awsNamingUtils.getQpqRuntimeResourceNameFromConfig(layer.name, props.qpqConfig),
                     code: new aws_cdk_lib_1.aws_lambda.AssetCode(layer.buildPath),
                     compatibleRuntimes: [aws_cdk_lib_1.aws_lambda.Runtime.NODEJS_18_X],
                 })

package/lib/constructs/feature/core/auth/QpqCoreUserDirectoryConstruct.d.ts

@@ -0,0 +1,19 @@
+import { QPQConfig, UserDirectoryQPQConfigSetting } from 'quidproquo-core';
+import { QpqConstructBlock, QpqConstructBlockProps } from '../../../base/QpqConstructBlock';
+import { QpqResource } from '../../../base/QpqResource';
+import { Construct } from 'constructs';
+import { aws_iam, aws_cognito } from 'aws-cdk-lib';
+export interface QpqCoreUserDirectoryConstructProps extends QpqConstructBlockProps {
+    userDirectoryConfig: UserDirectoryQPQConfigSetting;
+}
+export declare abstract class QpqCoreUserDirectoryConstructBase extends QpqConstructBlock {
+    abstract userPool: aws_cognito.IUserPool;
+    grantRead(grantee: aws_iam.IGrantable): void;
+    grantWrite(grantee: aws_iam.IGrantable): void;
+    grantAll(grantee: aws_iam.IGrantable): void;
+}
+export declare class QpqCoreUserDirectoryConstruct extends QpqCoreUserDirectoryConstructBase {
+    userPool: aws_cognito.IUserPool;
+    static fromOtherStack(scope: Construct, id: string, qpqConfig: QPQConfig, awsAccountId: string, userDirectoryName: string, serviceOverride?: string, applicationOverride?: string): QpqResource;
+    constructor(scope: Construct, id: string, props: QpqCoreUserDirectoryConstructProps);
+}

package/lib/constructs/feature/core/auth/QpqCoreUserDirectoryConstruct.js

@@ -0,0 +1,89 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.QpqCoreUserDirectoryConstruct = exports.QpqCoreUserDirectoryConstructBase = void 0;
+const quidproquo_actionprocessor_awslambda_1 = require("quidproquo-actionprocessor-awslambda");
+const QpqConstructBlock_1 = require("../../../base/QpqConstructBlock");
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const cdk = __importStar(require("aws-cdk-lib"));
+const qpqDeployAwsCdkUtils = __importStar(require("../../../../utils"));
+class QpqCoreUserDirectoryConstructBase extends QpqConstructBlock_1.QpqConstructBlock {
+    grantRead(grantee) {
+        this.userPool.grant(grantee, 'cognito-idp:ListUsers', 'cognito-idp:GetUser', 'cognito-idp:ListGroups', 'cognito-idp:GetGroup', 'cognito-idp:ListUserPools', 'cognito-idp:DescribeUserPool', 'cognito-idp:DescribeUserPoolClient');
+    }
+    grantWrite(grantee) {
+        this.userPool.grant(grantee, 'cognito-idp:SignUp', 'cognito-idp:AdminCreateUser', 'cognito-idp:AdminInitiateAuth', 'cognito-idp:AdminRespondToAuthChallenge', 'cognito-idp:AdminAddUserToGroup', 'cognito-idp:AdminDeleteUser', 'cognito-idp:AdminUpdateUserAttributes', 'cognito-idp:AdminDeleteUserAttributes', 'cognito-idp:AdminSetUserPassword');
+    }
+    grantAll(grantee) {
+        this.grantRead(grantee);
+        this.grantWrite(grantee);
+    }
+}
+exports.QpqCoreUserDirectoryConstructBase = QpqCoreUserDirectoryConstructBase;
+class QpqCoreUserDirectoryConstruct extends QpqCoreUserDirectoryConstructBase {
+    static fromOtherStack(scope, id, qpqConfig, awsAccountId, userDirectoryName, serviceOverride, applicationOverride) {
+        const userPoolId = qpqDeployAwsCdkUtils.importStackValue(quidproquo_actionprocessor_awslambda_1.awsNamingUtils.getCFExportNameUserPoolIdFromConfig(userDirectoryName, qpqConfig, serviceOverride, applicationOverride));
+        class Import extends QpqCoreUserDirectoryConstructBase {
+            constructor() {
+                super(...arguments);
+                this.userPool = aws_cdk_lib_1.aws_cognito.UserPool.fromUserPoolId(this, 'pool-id', userPoolId);
+            }
+        }
+        return new Import(scope, id, { qpqConfig, awsAccountId });
+    }
+    constructor(scope, id, props) {
+        super(scope, id, props);
+        this.userPool = new aws_cdk_lib_1.aws_cognito.UserPool(this, 'user-pool', {
+            removalPolicy: cdk.RemovalPolicy.DESTROY,
+            userPoolName: this.resourceName(props.userDirectoryConfig.name),
+            selfSignUpEnabled: props.userDirectoryConfig.selfSignUpEnabled,
+            standardAttributes: {
+                email: {
+                    required: true,
+                    mutable: true,
+                },
+                phoneNumber: {
+                    required: props.userDirectoryConfig.phoneRequired,
+                    mutable: true,
+                },
+            },
+            autoVerify: {
+                email: true,
+                phone: props.userDirectoryConfig.phoneRequired,
+            },
+        });
+        qpqDeployAwsCdkUtils.exportStackValue(this, quidproquo_actionprocessor_awslambda_1.awsNamingUtils.getCFExportNameUserPoolIdFromConfig(props.userDirectoryConfig.name, props.qpqConfig), this.userPool.userPoolId);
+        const userPoolClient = new aws_cdk_lib_1.aws_cognito.UserPoolClient(this, 'user-pool-client', {
+            userPoolClientName: this.qpqResourceName(props.userDirectoryConfig.name, 'upc'),
+            userPool: this.userPool,
+            generateSecret: true,
+            authFlows: {
+                adminUserPassword: true,
+            },
+        });
+        qpqDeployAwsCdkUtils.exportStackValue(this, quidproquo_actionprocessor_awslambda_1.awsNamingUtils.getCFExportNameUserPoolClientIdFromConfig(props.userDirectoryConfig.name, props.qpqConfig), userPoolClient.userPoolClientId);
+    }
+}
+exports.QpqCoreUserDirectoryConstruct = QpqCoreUserDirectoryConstruct;

package/lib/constructs/feature/core/auth/index.d.ts

@@ -0,0 +1 @@
+export * from './QpqCoreUserDirectoryConstruct';

package/lib/constructs/feature/core/auth/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./QpqCoreUserDirectoryConstruct"), exports);

package/lib/constructs/feature/core/index.d.ts

@@ -1,3 +1,4 @@
+export * from './auth';
 export * from './parameter';
 export * from './queue';
 export * from './schedule';

package/lib/constructs/feature/core/index.js

@@ -14,6 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./auth"), exports);
 __exportStar(require("./parameter"), exports);
 __exportStar(require("./queue"), exports);
 __exportStar(require("./schedule"), exports);

package/lib/constructs/feature/webserver/api/QpqWebserverApiConstruct.js

@@ -54,7 +54,7 @@ class QpqWebserverApiConstruct extends QpqConstructBlock_1.QpqConstructBlock {
             apiLayerVersions: props.apiLayerVersions,
             awsAccountId: props.awsAccountId,
         });
-        const grantables = qpqDeployAwsCdkUtils.getQqpGrantableResources(this, 'grantable', this.qpqConfig, props.awsAccountId);
+        const grantables = qpqDeployAwsCdkUtils.getQqpGrantableResourcesForApiConfig(this, 'grantable', this.qpqConfig, props.awsAccountId, props.apiConfig);
         grantables.forEach((g) => {
             g.grantAll(func.lambdaFunction);
         });

package/lib/lambdas/lambdaAPIGatewayEvent.js

@@ -32,6 +32,7 @@ const ErrorTypeHttpResponseMap = {
     [quidproquo_core_1.ErrorTypeEnum.Forbidden]: 403,
     [quidproquo_core_1.ErrorTypeEnum.NotFound]: 404,
     [quidproquo_core_1.ErrorTypeEnum.TimeOut]: 408,
+    [quidproquo_core_1.ErrorTypeEnum.Conflict]: 409,
     [quidproquo_core_1.ErrorTypeEnum.UnsupportedMediaType]: 415,
     [quidproquo_core_1.ErrorTypeEnum.OutOfResources]: 500,
     [quidproquo_core_1.ErrorTypeEnum.GenericError]: 500,
@@ -44,7 +45,7 @@ const getAPIGatewayEventExecutor = (dynamicModuleLoader, getCustomActionProcesso
         const cdkConfig = yield (0, lambdaConfig_1.getLambdaConfigs)();
         // Build a processor for the session and stuff
         // Remove the non route ones ~ let the story execute action add them
-        const storyActionProcessor = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, quidproquo_actionprocessor_node_1.coreActionProcessor), quidproquo_actionprocessor_node_1.webserverActionProcessor), (0, quidproquo_actionprocessor_awslambda_1.getAPIGatewayEventActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getConfigGetSecretActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getConfigGetParameterActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getConfigGetParametersActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getSystemActionProcessor)(dynamicModuleLoader)), (0, quidproquo_actionprocessor_awslambda_1.getFileActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_node_2.getConfigActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getQueueActionProcessor)(cdkConfig.qpqConfig)), getCustomActionProcessors(cdkConfig.qpqConfig)), (0, qpq_custom_action_processors_loader_1.default)());
+        const storyActionProcessor = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, quidproquo_actionprocessor_node_1.coreActionProcessor), quidproquo_actionprocessor_node_1.webserverActionProcessor), (0, quidproquo_actionprocessor_awslambda_1.getAPIGatewayEventActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getConfigGetSecretActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getConfigGetParameterActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getConfigGetParametersActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getSystemActionProcessor)(dynamicModuleLoader)), (0, quidproquo_actionprocessor_awslambda_1.getFileActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_node_2.getConfigActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getQueueActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getUserDirectoryActionProcessor)(cdkConfig.qpqConfig)), getCustomActionProcessors(cdkConfig.qpqConfig)), (0, qpq_custom_action_processors_loader_1.default)());
         const logger = (result) => __awaiter(void 0, void 0, void 0, function* () {
             // addResult(
             //   envConfig.appName,
@@ -67,6 +68,7 @@ const getAPIGatewayEventExecutor = (dynamicModuleLoader, getCustomActionProcesso
                 headers: result.result.headers,
                 isBase64Encoded: result.result.isBase64Encoded,
             };
+            console.log('Response: ', response);
             return response;
         }
         const code = ErrorTypeHttpResponseMap[result.error.errorType];

package/lib/lambdas/lambdaEventBridgeEvent.js

@@ -30,7 +30,7 @@ const getEventBridgeEventExecutor = (dynamicModuleLoader, getCustomActionProcess
         const lambdaRuntimeConfig = JSON.parse(process.env.lambdaRuntimeConfig || '{}');
         // Build a processor for the session and stuff
         // Remove the  non event ones
-        const storyActionProcessor = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, quidproquo_actionprocessor_node_1.coreActionProcessor), quidproquo_actionprocessor_node_1.webserverActionProcessor), (0, quidproquo_actionprocessor_awslambda_1.getEventBridgeEventActionProcessor)(lambdaRuntimeConfig)), (0, quidproquo_actionprocessor_awslambda_1.getSystemActionProcessor)(dynamicModuleLoader)), (0, quidproquo_actionprocessor_awslambda_1.getFileActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getConfigGetSecretActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getConfigGetParameterActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getConfigGetParametersActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_node_2.getConfigActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getQueueActionProcessor)(cdkConfig.qpqConfig)), getCustomActionProcessors(cdkConfig.qpqConfig)), (0, qpq_custom_action_processors_loader_1.default)());
+        const storyActionProcessor = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, quidproquo_actionprocessor_node_1.coreActionProcessor), quidproquo_actionprocessor_node_1.webserverActionProcessor), (0, quidproquo_actionprocessor_awslambda_1.getEventBridgeEventActionProcessor)(lambdaRuntimeConfig)), (0, quidproquo_actionprocessor_awslambda_1.getSystemActionProcessor)(dynamicModuleLoader)), (0, quidproquo_actionprocessor_awslambda_1.getFileActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getConfigGetSecretActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getConfigGetParameterActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getConfigGetParametersActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_node_2.getConfigActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getQueueActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getUserDirectoryActionProcessor)(cdkConfig.qpqConfig)), getCustomActionProcessors(cdkConfig.qpqConfig)), (0, qpq_custom_action_processors_loader_1.default)());
         const logger = (result) => __awaiter(void 0, void 0, void 0, function* () { });
         // Run the callback
         const resolveStory = (0, quidproquo_core_1.createRuntime)({}, storyActionProcessor, getDateNow, logger, quidproquo_actionprocessor_awslambda_1.awsLambdaUtils.randomGuid);

package/lib/lambdas/lambdaEventOriginRequest.js

@@ -30,7 +30,7 @@ const getOriginRequestEventExecutor = (dynamicModuleLoader, getCustomActionProce
         const cdkConfig = yield (0, lambdaConfig_1.getLambdaConfigs)();
         // Build a processor for the session and stuff
         // Remove the non route ones ~ let the story execute action add them
-        const storyActionProcessor = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, quidproquo_actionprocessor_node_1.coreActionProcessor), quidproquo_actionprocessor_node_1.webserverActionProcessor), (0, quidproquo_actionprocessor_awslambda_1.getCloudFrontOriginRequestEventActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getConfigGetSecretActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getConfigGetParameterActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getConfigGetParametersActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getSystemActionProcessor)(dynamicModuleLoader)), (0, quidproquo_actionprocessor_awslambda_1.getFileActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_node_2.getConfigActionProcessor)(cdkConfig.qpqConfig)), getCustomActionProcessors(cdkConfig.qpqConfig)), (0, qpq_custom_action_processors_loader_1.default)());
+        const storyActionProcessor = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, quidproquo_actionprocessor_node_1.coreActionProcessor), quidproquo_actionprocessor_node_1.webserverActionProcessor), (0, quidproquo_actionprocessor_awslambda_1.getCloudFrontOriginRequestEventActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getConfigGetSecretActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getConfigGetParameterActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getConfigGetParametersActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getSystemActionProcessor)(dynamicModuleLoader)), (0, quidproquo_actionprocessor_awslambda_1.getFileActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_node_2.getConfigActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getUserDirectoryActionProcessor)(cdkConfig.qpqConfig)), getCustomActionProcessors(cdkConfig.qpqConfig)), (0, qpq_custom_action_processors_loader_1.default)());
         const logger = (result) => __awaiter(void 0, void 0, void 0, function* () { });
         // Run the callback
         const resolveStory = (0, quidproquo_core_1.createRuntime)({}, storyActionProcessor, getDateNow, logger, quidproquo_actionprocessor_awslambda_1.awsLambdaUtils.randomGuid);

package/lib/lambdas/lambdaSQSEvent.js

@@ -28,7 +28,7 @@ const getStoryActionRuntime = (dynamicModuleLoader, getCustomActionProcessors =
     const cdkConfig = yield (0, lambdaConfig_1.getLambdaConfigs)();
     // Build a processor for the session and stuff
     // Remove the non route ones ~ let the story execute action add them
-    const storyActionProcessor = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, quidproquo_actionprocessor_node_1.coreActionProcessor), quidproquo_actionprocessor_node_1.webserverActionProcessor), (0, quidproquo_actionprocessor_awslambda_1.getSQSEventRecordActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getConfigGetSecretActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getConfigGetParameterActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getConfigGetParametersActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getSystemActionProcessor)(dynamicModuleLoader)), (0, quidproquo_actionprocessor_awslambda_1.getFileActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_node_2.getConfigActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getQueueActionProcessor)(cdkConfig.qpqConfig)), getCustomActionProcessors(cdkConfig.qpqConfig)), (0, qpq_custom_action_processors_loader_1.default)());
+    const storyActionProcessor = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, quidproquo_actionprocessor_node_1.coreActionProcessor), quidproquo_actionprocessor_node_1.webserverActionProcessor), (0, quidproquo_actionprocessor_awslambda_1.getSQSEventRecordActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getConfigGetSecretActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getConfigGetParameterActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getConfigGetParametersActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getSystemActionProcessor)(dynamicModuleLoader)), (0, quidproquo_actionprocessor_awslambda_1.getFileActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_node_2.getConfigActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getQueueActionProcessor)(cdkConfig.qpqConfig)), (0, quidproquo_actionprocessor_awslambda_1.getUserDirectoryActionProcessor)(cdkConfig.qpqConfig)), getCustomActionProcessors(cdkConfig.qpqConfig)), (0, qpq_custom_action_processors_loader_1.default)());
     const logger = (result) => __awaiter(void 0, void 0, void 0, function* () { });
     // Run the callback
     const resolveStory = (0, quidproquo_core_1.createRuntime)({}, storyActionProcessor, getDateNow, logger, quidproquo_actionprocessor_awslambda_1.awsLambdaUtils.randomGuid);

package/lib/stacks/InfQpqServiceStack.js

@@ -38,6 +38,12 @@ class InfQpqServiceStack extends QpqServiceStack_1.QpqServiceStack {
             qpqConfig: props.qpqConfig,
             dnsConfig: setting,
         }));
+        // User Directories
+        const userDirectories = quidproquo_core_1.qpqCoreUtils.getUserDirectories(props.qpqConfig).map((setting) => new constructs_1.QpqCoreUserDirectoryConstruct(this, quidproquo_core_1.qpqCoreUtils.getUniqueKeyForSetting(setting), {
+            awsAccountId: props.awsAccountId,
+            qpqConfig: props.qpqConfig,
+            userDirectoryConfig: setting,
+        }));
     }
 }
 exports.InfQpqServiceStack = InfQpqServiceStack;

package/lib/utils/qpqDeployAwsCdkUtils.d.ts

@@ -1,9 +1,16 @@
 import { Construct } from 'constructs';
+import * as cdk from 'aws-cdk-lib';
 import { QPQConfig } from 'quidproquo-core';
+import { ApiQPQWebServerConfigSetting } from 'quidproquo-webserver';
 import { QpqResource } from '../constructs';
 export declare const getQqpSecretGrantables: (scope: Construct, id: string, qpqConfig: QPQConfig, awsAccountId: string) => QpqResource[];
 export declare const getQqpParameterGrantables: (scope: Construct, id: string, qpqConfig: QPQConfig, awsAccountId: string) => QpqResource[];
 export declare const getQqpStorageDriveGrantables: (scope: Construct, id: string, qpqConfig: QPQConfig, awsAccountId: string) => QpqResource[];
 export declare const getQqpQueueGrantables: (scope: Construct, id: string, qpqConfig: QPQConfig, awsAccountId: string) => QpqResource[];
+export declare const getQqpUserPoolGrantables: (scope: Construct, id: string, qpqConfig: QPQConfig, awsAccountId: string) => QpqResource[];
+export declare const getQqpUserPoolGrantablesForApiConfig: (scope: Construct, id: string, qpqConfig: QPQConfig, awsAccountId: string, config: ApiQPQWebServerConfigSetting) => QpqResource[];
 export declare const serviceNeedsServiceHostedZone: (qpqConfig: QPQConfig) => boolean;
 export declare const getQqpGrantableResources: (scope: Construct, id: string, qpqConfig: QPQConfig, awsAccountId: string) => QpqResource[];
+export declare const getQqpGrantableResourcesForApiConfig: (scope: Construct, id: string, qpqConfig: QPQConfig, awsAccountId: string, config: ApiQPQWebServerConfigSetting) => QpqResource[];
+export declare const exportStackValue: (scope: Construct, uniqueKey: string, value: string) => cdk.CfnOutput;
+export declare const importStackValue: (uniqueKey: string) => string;

package/lib/utils/qpqDeployAwsCdkUtils.js

@@ -1,6 +1,30 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getQqpGrantableResources = exports.serviceNeedsServiceHostedZone = exports.getQqpQueueGrantables = exports.getQqpStorageDriveGrantables = exports.getQqpParameterGrantables = exports.getQqpSecretGrantables = void 0;
+exports.importStackValue = exports.exportStackValue = exports.getQqpGrantableResourcesForApiConfig = exports.getQqpGrantableResources = exports.serviceNeedsServiceHostedZone = exports.getQqpUserPoolGrantablesForApiConfig = exports.getQqpUserPoolGrantables = exports.getQqpQueueGrantables = exports.getQqpStorageDriveGrantables = exports.getQqpParameterGrantables = exports.getQqpSecretGrantables = void 0;
+const cdk = __importStar(require("aws-cdk-lib"));
 const quidproquo_core_1 = require("quidproquo-core");
 const quidproquo_webserver_1 = require("quidproquo-webserver");
 const constructs_1 = require("../constructs");
@@ -44,6 +68,29 @@ const getQqpQueueGrantables = (scope, id, qpqConfig, awsAccountId) => {
     return queueResources;
 };
 exports.getQqpQueueGrantables = getQqpQueueGrantables;
+const getQqpUserPoolGrantables = (scope, id, qpqConfig, awsAccountId) => {
+    const userDirectoryConfigs = quidproquo_core_1.qpqCoreUtils.getUserDirectories(qpqConfig);
+    const userDirectoryResources = userDirectoryConfigs.map((userDirectoryConfig) => {
+        return constructs_1.QpqCoreUserDirectoryConstruct.fromOtherStack(scope, `${id}-${quidproquo_core_1.qpqCoreUtils.getUniqueKeyForSetting(userDirectoryConfig)}-grantable`, qpqConfig, awsAccountId, userDirectoryConfig.name);
+    });
+    return userDirectoryResources;
+};
+exports.getQqpUserPoolGrantables = getQqpUserPoolGrantables;
+const getQqpUserPoolGrantablesForApiConfig = (scope, id, qpqConfig, awsAccountId, config) => {
+    const routesWithAuth = quidproquo_webserver_1.qpqWebServerUtils
+        .getAllRoutesForApi(config.apiName, qpqConfig)
+        .filter((r) => {
+        var _a, _b, _c;
+        return ((_a = r.options.routeAuthSettings) === null || _a === void 0 ? void 0 : _a.userDirectoryName) &&
+            (((_b = r.options.routeAuthSettings) === null || _b === void 0 ? void 0 : _b.applicationName) || ((_c = r.options.routeAuthSettings) === null || _c === void 0 ? void 0 : _c.serviceName));
+    });
+    const userDirectoryResources = routesWithAuth.map((route) => {
+        var _a, _b, _c;
+        return constructs_1.QpqCoreUserDirectoryConstruct.fromOtherStack(scope, `${id}-${quidproquo_core_1.qpqCoreUtils.getUniqueKeyForSetting(route)}-grantable-xserver`, qpqConfig, awsAccountId, (_a = route.options.routeAuthSettings) === null || _a === void 0 ? void 0 : _a.userDirectoryName, (_b = route.options.routeAuthSettings) === null || _b === void 0 ? void 0 : _b.serviceName, (_c = route.options.routeAuthSettings) === null || _c === void 0 ? void 0 : _c.applicationName);
+    });
+    return userDirectoryResources;
+};
+exports.getQqpUserPoolGrantablesForApiConfig = getQqpUserPoolGrantablesForApiConfig;
 const serviceNeedsServiceHostedZone = (qpqConfig) => {
     // We need it if we are deploying our api to a service domain
     const apiConfigs = quidproquo_core_1.qpqCoreUtils
@@ -61,6 +108,27 @@ const getQqpGrantableResources = (scope, id, qpqConfig, awsAccountId) => {
         ...(0, exports.getQqpSecretGrantables)(scope, id, qpqConfig, awsAccountId),
         ...(0, exports.getQqpStorageDriveGrantables)(scope, id, qpqConfig, awsAccountId),
         ...(0, exports.getQqpQueueGrantables)(scope, id, qpqConfig, awsAccountId),
+        ...(0, exports.getQqpUserPoolGrantables)(scope, id, qpqConfig, awsAccountId),
     ];
 };
 exports.getQqpGrantableResources = getQqpGrantableResources;
+const getQqpGrantableResourcesForApiConfig = (scope, id, qpqConfig, awsAccountId, config) => {
+    return [
+        // All the normal grantables
+        ...(0, exports.getQqpGrantableResources)(scope, id, qpqConfig, awsAccountId),
+        // Then special grantables just for this config.
+        ...(0, exports.getQqpUserPoolGrantablesForApiConfig)(scope, id, qpqConfig, awsAccountId, config),
+    ];
+};
+exports.getQqpGrantableResourcesForApiConfig = getQqpGrantableResourcesForApiConfig;
+const exportStackValue = (scope, uniqueKey, value) => {
+    return new cdk.CfnOutput(scope, uniqueKey, {
+        exportName: uniqueKey,
+        value,
+    });
+};
+exports.exportStackValue = exportStackValue;
+const importStackValue = (uniqueKey) => {
+    return cdk.Fn.importValue(uniqueKey);
+};
+exports.importStackValue = importStackValue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "quidproquo-deploy-awscdk",
-  "version": "0.0.71",
+  "version": "0.0.73",
   "description": "",
   "main": "./lib/index.js",
   "types": "./lib/index.d.js",

package/src/constructs/base/QpqConstructBlock.ts

@@ -22,11 +22,11 @@ export class QpqConstructBlock extends Construct implements QpqResource {
   }
 
   resourceName(name: string) {
-    return awsNamingUtils.getConfigRuntimeResourceName(name, this.qpqConfig);
+    return awsNamingUtils.getConfigRuntimeResourceNameFromConfig(name, this.qpqConfig);
   }
 
   qpqResourceName(name: string, resourceType: string) {
-    return awsNamingUtils.getQpqRuntimeResourceName(name, this.qpqConfig, resourceType);
+    return awsNamingUtils.getQpqRuntimeResourceNameFromConfig(name, this.qpqConfig, resourceType);
   }
 
   grantRead(grantee: IGrantable): void {}

package/src/constructs/basic/Function.ts

@@ -2,7 +2,7 @@ import path from 'path';
 
 import { QpqConstructBlock, QpqConstructBlockProps } from '../base/QpqConstructBlock';
 import { Construct } from 'constructs';
-import { aws_lambda } from 'aws-cdk-lib';
+import { aws_lambda, aws_iam } from 'aws-cdk-lib';
 import * as cdk from 'aws-cdk-lib';
 
 export interface FunctionProps extends QpqConstructBlockProps {
@@ -41,5 +41,13 @@ export class Function extends QpqConstructBlock {
 
       environment: props.environment,
     });
+
+    // Let lambdas read from the exported variables in cloudformation
+    this.lambdaFunction.addToRolePolicy(
+      new aws_iam.PolicyStatement({
+        actions: ['cloudformation:ListExports'],
+        resources: ['*'],
+      }),
+    );
   }
 }

package/src/constructs/basic/LambdaLayers.ts

@@ -22,7 +22,10 @@ export class LambdaLayers extends QpqConstructBlock {
     this.layers = (props.apiLayers || []).map((layer) => {
       return layer.buildPath
         ? new aws_lambda.LayerVersion(this, `${layer.name}-layer`, {
-            layerVersionName: awsNamingUtils.getQpqRuntimeResourceName(layer.name, props.qpqConfig),
+            layerVersionName: awsNamingUtils.getQpqRuntimeResourceNameFromConfig(
+              layer.name,
+              props.qpqConfig,
+            ),
             code: new aws_lambda.AssetCode(layer.buildPath),
             compatibleRuntimes: [aws_lambda.Runtime.NODEJS_18_X],
           })

package/src/constructs/feature/core/auth/QpqCoreUserDirectoryConstruct.ts

@@ -0,0 +1,136 @@
+import { QPQConfig, UserDirectoryQPQConfigSetting } from 'quidproquo-core';
+import { awsNamingUtils } from 'quidproquo-actionprocessor-awslambda';
+
+import { QpqConstructBlock, QpqConstructBlockProps } from '../../../base/QpqConstructBlock';
+import { QpqResource } from '../../../base/QpqResource';
+
+import { Construct } from 'constructs';
+import { aws_iam, aws_cognito } from 'aws-cdk-lib';
+import * as cdk from 'aws-cdk-lib';
+
+import * as qpqDeployAwsCdkUtils from '../../../../utils';
+
+export interface QpqCoreUserDirectoryConstructProps extends QpqConstructBlockProps {
+  userDirectoryConfig: UserDirectoryQPQConfigSetting;
+}
+
+export abstract class QpqCoreUserDirectoryConstructBase extends QpqConstructBlock {
+  abstract userPool: aws_cognito.IUserPool;
+
+  public grantRead(grantee: aws_iam.IGrantable) {
+    this.userPool.grant(
+      grantee,
+
+      'cognito-idp:ListUsers',
+      'cognito-idp:GetUser',
+
+      'cognito-idp:ListGroups',
+      'cognito-idp:GetGroup',
+
+      'cognito-idp:ListUserPools',
+
+      'cognito-idp:DescribeUserPool',
+      'cognito-idp:DescribeUserPoolClient',
+    );
+  }
+
+  public grantWrite(grantee: aws_iam.IGrantable): void {
+    this.userPool.grant(
+      grantee,
+      'cognito-idp:SignUp',
+      'cognito-idp:AdminCreateUser',
+      'cognito-idp:AdminInitiateAuth',
+      'cognito-idp:AdminRespondToAuthChallenge',
+      'cognito-idp:AdminAddUserToGroup',
+      'cognito-idp:AdminDeleteUser',
+      'cognito-idp:AdminUpdateUserAttributes',
+      'cognito-idp:AdminDeleteUserAttributes',
+      'cognito-idp:AdminSetUserPassword',
+    );
+  }
+
+  public grantAll(grantee: aws_iam.IGrantable): void {
+    this.grantRead(grantee);
+    this.grantWrite(grantee);
+  }
+}
+
+export class QpqCoreUserDirectoryConstruct extends QpqCoreUserDirectoryConstructBase {
+  userPool: aws_cognito.IUserPool;
+
+  static fromOtherStack(
+    scope: Construct,
+    id: string,
+    qpqConfig: QPQConfig,
+    awsAccountId: string,
+    userDirectoryName: string,
+    serviceOverride?: string,
+    applicationOverride?: string,
+  ): QpqResource {
+    const userPoolId = qpqDeployAwsCdkUtils.importStackValue(
+      awsNamingUtils.getCFExportNameUserPoolIdFromConfig(
+        userDirectoryName,
+        qpqConfig,
+        serviceOverride,
+        applicationOverride,
+      ),
+    );
+
+    class Import extends QpqCoreUserDirectoryConstructBase {
+      userPool = aws_cognito.UserPool.fromUserPoolId(this, 'pool-id', userPoolId);
+    }
+
+    return new Import(scope, id, { qpqConfig, awsAccountId });
+  }
+
+  constructor(scope: Construct, id: string, props: QpqCoreUserDirectoryConstructProps) {
+    super(scope, id, props);
+
+    this.userPool = new aws_cognito.UserPool(this, 'user-pool', {
+      removalPolicy: cdk.RemovalPolicy.DESTROY,
+      userPoolName: this.resourceName(props.userDirectoryConfig.name),
+      selfSignUpEnabled: props.userDirectoryConfig.selfSignUpEnabled,
+      standardAttributes: {
+        email: {
+          required: true,
+          mutable: true,
+        },
+        phoneNumber: {
+          required: props.userDirectoryConfig.phoneRequired,
+          mutable: true,
+        },
+      },
+      autoVerify: {
+        email: true,
+        phone: props.userDirectoryConfig.phoneRequired,
+      },
+    });
+
+    qpqDeployAwsCdkUtils.exportStackValue(
+      this,
+      awsNamingUtils.getCFExportNameUserPoolIdFromConfig(
+        props.userDirectoryConfig.name,
+        props.qpqConfig,
+      ),
+      this.userPool.userPoolId,
+    );
+
+    const userPoolClient = new aws_cognito.UserPoolClient(this, 'user-pool-client', {
+      userPoolClientName: this.qpqResourceName(props.userDirectoryConfig.name, 'upc'),
+      userPool: this.userPool,
+      generateSecret: true,
+      authFlows: {
+        adminUserPassword: true,
+      },
+    });
+
+    qpqDeployAwsCdkUtils.exportStackValue(
+      this,
+      awsNamingUtils.getCFExportNameUserPoolClientIdFromConfig(
+        props.userDirectoryConfig.name,
+        props.qpqConfig,
+      ),
+      userPoolClient.userPoolClientId,
+    );
+  }
+}

package/src/constructs/feature/core/auth/index.ts

@@ -0,0 +1 @@
+export * from './QpqCoreUserDirectoryConstruct';

package/src/constructs/feature/core/index.ts

@@ -1,3 +1,4 @@
+export * from './auth';
 export * from './parameter';
 export * from './queue';
 export * from './schedule';

package/src/constructs/feature/webserver/api/QpqWebserverApiConstruct.ts

@@ -47,11 +47,12 @@ export class QpqWebserverApiConstruct extends QpqConstructBlock {
       awsAccountId: props.awsAccountId,
     });
 
-    const grantables = qpqDeployAwsCdkUtils.getQqpGrantableResources(
+    const grantables = qpqDeployAwsCdkUtils.getQqpGrantableResourcesForApiConfig(
       this,
       'grantable',
       this.qpqConfig,
       props.awsAccountId,
+      props.apiConfig,
     );
 
     grantables.forEach((g) => {

package/src/lambdas/lambdaAPIGatewayEvent.ts

@@ -8,6 +8,7 @@ import {
   getConfigGetSecretActionProcessor,
   getConfigGetParameterActionProcessor,
   getConfigGetParametersActionProcessor,
+  getUserDirectoryActionProcessor,
   awsLambdaUtils,
   DynamicModuleLoader,
 } from 'quidproquo-actionprocessor-awslambda';
@@ -39,6 +40,7 @@ const ErrorTypeHttpResponseMap = {
   [ErrorTypeEnum.Forbidden]: 403,
   [ErrorTypeEnum.NotFound]: 404,
   [ErrorTypeEnum.TimeOut]: 408,
+  [ErrorTypeEnum.Conflict]: 409,
   [ErrorTypeEnum.UnsupportedMediaType]: 415,
   [ErrorTypeEnum.OutOfResources]: 500,
   [ErrorTypeEnum.GenericError]: 500,
@@ -68,6 +70,7 @@ export const getAPIGatewayEventExecutor = (
       ...getFileActionProcessor(cdkConfig.qpqConfig),
       ...getConfigActionProcessor(cdkConfig.qpqConfig),
       ...getQueueActionProcessor(cdkConfig.qpqConfig),
+      ...getUserDirectoryActionProcessor(cdkConfig.qpqConfig),
 
       ...getCustomActionProcessors(cdkConfig.qpqConfig),
       ...qpqCustomActionProcessors(),
@@ -105,6 +108,8 @@ export const getAPIGatewayEventExecutor = (
         headers: result.result.headers,
         isBase64Encoded: result.result.isBase64Encoded,
       };
+
+      console.log('Response: ', response);
       return response;
     }
 

package/src/lambdas/lambdaEventBridgeEvent.ts

@@ -5,6 +5,7 @@ import {
   getSystemActionProcessor,
   getFileActionProcessor,
   getQueueActionProcessor,
+  getUserDirectoryActionProcessor,
   getConfigGetSecretActionProcessor,
   getConfigGetParameterActionProcessor,
   getConfigGetParametersActionProcessor,
@@ -56,6 +57,7 @@ export const getEventBridgeEventExecutor = (
       ...getConfigGetParametersActionProcessor(cdkConfig.qpqConfig),
       ...getConfigActionProcessor(cdkConfig.qpqConfig),
       ...getQueueActionProcessor(cdkConfig.qpqConfig),
+      ...getUserDirectoryActionProcessor(cdkConfig.qpqConfig),
 
       ...getCustomActionProcessors(cdkConfig.qpqConfig),
       ...qpqCustomActionProcessors(),

package/src/lambdas/lambdaEventOriginRequest.ts

@@ -4,6 +4,7 @@ import {
   getCloudFrontOriginRequestEventActionProcessor,
   getSystemActionProcessor,
   getFileActionProcessor,
+  getUserDirectoryActionProcessor,
   getConfigGetSecretActionProcessor,
   getConfigGetParameterActionProcessor,
   getConfigGetParametersActionProcessor,
@@ -53,6 +54,9 @@ export const getOriginRequestEventExecutor = (
       ...getFileActionProcessor(cdkConfig.qpqConfig),
       ...getConfigActionProcessor(cdkConfig.qpqConfig),
 
+      // We probably don't want this?
+      ...getUserDirectoryActionProcessor(cdkConfig.qpqConfig),
+
       ...getCustomActionProcessors(cdkConfig.qpqConfig),
       ...qpqCustomActionProcessors(),
     };

package/src/lambdas/lambdaSQSEvent.ts

@@ -10,6 +10,7 @@ import {
   getConfigGetSecretActionProcessor,
   getConfigGetParameterActionProcessor,
   getConfigGetParametersActionProcessor,
+  getUserDirectoryActionProcessor,
   awsLambdaUtils,
   DynamicModuleLoader,
 } from 'quidproquo-actionprocessor-awslambda';
@@ -57,6 +58,7 @@ export const getStoryActionRuntime = async (
     ...getFileActionProcessor(cdkConfig.qpqConfig),
     ...getConfigActionProcessor(cdkConfig.qpqConfig),
     ...getQueueActionProcessor(cdkConfig.qpqConfig),
+    ...getUserDirectoryActionProcessor(cdkConfig.qpqConfig),
 
     ...getCustomActionProcessors(cdkConfig.qpqConfig),
     ...qpqCustomActionProcessors(),

package/src/stacks/InfQpqServiceStack.ts

@@ -10,6 +10,7 @@ import {
   QpqCoreQueueConstruct,
   QpqCoreSecretConstruct,
   QpqWebserverDomainConstruct,
+  QpqCoreUserDirectoryConstruct,
 } from '../constructs';
 
 export interface InfQpqServiceStackProps extends QpqServiceStackProps {}
@@ -72,5 +73,16 @@ export class InfQpqServiceStack extends QpqServiceStack {
           dnsConfig: setting,
         }),
     );
+
+    // User Directories
+    const userDirectories = qpqCoreUtils.getUserDirectories(props.qpqConfig).map(
+      (setting) =>
+        new QpqCoreUserDirectoryConstruct(this, qpqCoreUtils.getUniqueKeyForSetting(setting), {
+          awsAccountId: props.awsAccountId,
+          qpqConfig: props.qpqConfig,
+
+          userDirectoryConfig: setting,
+        }),
+    );
   }
 }

package/src/utils/qpqDeployAwsCdkUtils.ts

@@ -1,4 +1,5 @@
 import { Construct } from 'constructs';
+import * as cdk from 'aws-cdk-lib';
 
 import {
   QPQCoreConfigSettingType,
@@ -10,7 +11,11 @@ import {
   QueueQPQConfigSetting,
 } from 'quidproquo-core';
 
-import { ApiQPQWebServerConfigSetting, QPQWebServerConfigSettingType } from 'quidproquo-webserver';
+import {
+  ApiQPQWebServerConfigSetting,
+  QPQWebServerConfigSettingType,
+  qpqWebServerUtils,
+} from 'quidproquo-webserver';
 
 import {
   QpqResource,
@@ -18,6 +23,7 @@ import {
   QpqCoreSecretConstruct,
   QpqCoreStorageDriveConstruct,
   QpqCoreQueueConstruct,
+  QpqCoreUserDirectoryConstruct,
 } from '../constructs';
 
 export const getQqpSecretGrantables = (
@@ -124,6 +130,57 @@ export const getQqpQueueGrantables = (
   return queueResources;
 };
 
+export const getQqpUserPoolGrantables = (
+  scope: Construct,
+  id: string,
+  qpqConfig: QPQConfig,
+  awsAccountId: string,
+): QpqResource[] => {
+  const userDirectoryConfigs = qpqCoreUtils.getUserDirectories(qpqConfig);
+
+  const userDirectoryResources = userDirectoryConfigs.map((userDirectoryConfig) => {
+    return QpqCoreUserDirectoryConstruct.fromOtherStack(
+      scope,
+      `${id}-${qpqCoreUtils.getUniqueKeyForSetting(userDirectoryConfig)}-grantable`,
+      qpqConfig,
+      awsAccountId,
+      userDirectoryConfig.name,
+    );
+  });
+
+  return userDirectoryResources;
+};
+
+export const getQqpUserPoolGrantablesForApiConfig = (
+  scope: Construct,
+  id: string,
+  qpqConfig: QPQConfig,
+  awsAccountId: string,
+  config: ApiQPQWebServerConfigSetting,
+): QpqResource[] => {
+  const routesWithAuth = qpqWebServerUtils
+    .getAllRoutesForApi(config.apiName, qpqConfig)
+    .filter(
+      (r) =>
+        r.options.routeAuthSettings?.userDirectoryName &&
+        (r.options.routeAuthSettings?.applicationName || r.options.routeAuthSettings?.serviceName),
+    );
+
+  const userDirectoryResources = routesWithAuth.map((route) => {
+    return QpqCoreUserDirectoryConstruct.fromOtherStack(
+      scope,
+      `${id}-${qpqCoreUtils.getUniqueKeyForSetting(route)}-grantable-xserver`,
+      qpqConfig,
+      awsAccountId,
+      route.options.routeAuthSettings?.userDirectoryName!,
+      route.options.routeAuthSettings?.serviceName,
+      route.options.routeAuthSettings?.applicationName,
+    );
+  });
+
+  return userDirectoryResources;
+};
+
 export const serviceNeedsServiceHostedZone = (qpqConfig: QPQConfig) => {
   // We need it if we are deploying our api to a service domain
   const apiConfigs = qpqCoreUtils
@@ -148,5 +205,37 @@ export const getQqpGrantableResources = (
     ...getQqpSecretGrantables(scope, id, qpqConfig, awsAccountId),
     ...getQqpStorageDriveGrantables(scope, id, qpqConfig, awsAccountId),
     ...getQqpQueueGrantables(scope, id, qpqConfig, awsAccountId),
+    ...getQqpUserPoolGrantables(scope, id, qpqConfig, awsAccountId),
   ];
 };
+
+export const getQqpGrantableResourcesForApiConfig = (
+  scope: Construct,
+  id: string,
+  qpqConfig: QPQConfig,
+  awsAccountId: string,
+  config: ApiQPQWebServerConfigSetting,
+): QpqResource[] => {
+  return [
+    // All the normal grantables
+    ...getQqpGrantableResources(scope, id, qpqConfig, awsAccountId),
+
+    // Then special grantables just for this config.
+    ...getQqpUserPoolGrantablesForApiConfig(scope, id, qpqConfig, awsAccountId, config),
+  ];
+};
+
+export const exportStackValue = (
+  scope: Construct,
+  uniqueKey: string,
+  value: string,
+): cdk.CfnOutput => {
+  return new cdk.CfnOutput(scope, uniqueKey, {
+    exportName: uniqueKey,
+    value,
+  });
+};
+
+export const importStackValue = (uniqueKey: string): string => {
+  return cdk.Fn.importValue(uniqueKey);
+};