moto 5.0.13.dev37__tar.gz → 5.0.13.dev44__tar.gz

{moto-5.0.13.dev37/moto.egg-info → moto-5.0.13.dev44}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: moto
-Version: 5.0.13.dev37
+Version: 5.0.13.dev44
 Home-page: https://github.com/getmoto/moto
 Author: Steve Pulec
 Author-email: spulec@gmail.com

{moto-5.0.13.dev37 → moto-5.0.13.dev44}/moto/__init__.py

@@ -1,4 +1,4 @@
 from moto.core.decorator import mock_aws as mock_aws
 
 __title__ = "moto"
-__version__ = "5.0.13.dev37"
+__version__ = "5.0.13.dev44"

{moto-5.0.13.dev37 → moto-5.0.13.dev44}/moto/cognitoidp/models.py

@@ -1674,13 +1674,14 @@ class CognitoIdpBackend(BaseBackend):
             )
             user.confirmation_code = confirmation_code
 
-        code_delivery_details = {
-            "Destination": username + "@h***.com"
-            if not user
-            else user.attribute_lookup.get("email", username + "@h***.com"),
-            "DeliveryMedium": "EMAIL",
-            "AttributeName": "email",
-        }
+        code_delivery_details = self._get_code_delivery_details(
+            recovery_settings, user, username
+        )
+        return confirmation_code, {"CodeDeliveryDetails": code_delivery_details}
+
+    def _get_code_delivery_details(
+        self, recovery_settings: Any, user: Optional[CognitoIdpUser], username: str
+    ) -> Dict[str, str]:
         selected_recovery = min(
             recovery_settings["RecoveryMechanisms"],
             key=lambda recovery_mechanism: recovery_mechanism["Priority"],
@@ -1688,14 +1689,24 @@ class CognitoIdpBackend(BaseBackend):
         if selected_recovery["Name"] == "admin_only":
             raise NotAuthorizedError("Contact administrator to reset password.")
         if selected_recovery["Name"] == "verified_phone_number":
-            code_delivery_details = {
-                "Destination": "+*******9934"
-                if not user
-                else user.attribute_lookup.get("phone_number", "+*******9934"),
+            number = "+*******9934"
+            if user and "phone_number" in user.attribute_lookup:
+                number = user.attribute_lookup["phone_number"]
+            return {
+                "Destination": number,
                 "DeliveryMedium": "SMS",
                 "AttributeName": "phone_number",
             }
-        return confirmation_code, {"CodeDeliveryDetails": code_delivery_details}
+        else:
+            email = username + "@h***.com"
+            if user and "email" in user.attribute_lookup:
+                first, second = user.attribute_lookup["email"].split("@")
+                email = f"{first[0]}***@{second[0]}***"
+            return {
+                "Destination": email,
+                "DeliveryMedium": "EMAIL",
+                "AttributeName": "email",
+            }
 
     def change_password(
         self, access_token: str, previous_password: str, proposed_password: str
@@ -1796,7 +1807,7 @@ class CognitoIdpBackend(BaseBackend):
         username: str,
         password: str,
         attributes: List[Dict[str, str]],
-    ) -> CognitoIdpUser:
+    ) -> Tuple[CognitoIdpUser, Any]:
         user_pool = None
         for p in self.user_pools.values():
             if client_id in p.clients:
@@ -1858,7 +1869,27 @@ class CognitoIdpBackend(BaseBackend):
             status=UserStatus.UNCONFIRMED,
         )
         user_pool.users[user.username] = user
-        return user
+
+        has_email = "email" in user.attribute_lookup
+        has_phone = "phone_number" in user.attribute_lookup
+        verified_attributes = user_pool.extended_config.get(
+            "AutoVerifiedAttributes", []
+        )
+        email_verified = (
+            "email_verified" in user.attribute_lookup or "email" in verified_attributes
+        )
+        phone_verified = (
+            "phone_number_verified" in user.attribute_lookup
+            or "phone_number" in verified_attributes
+        )
+        if (has_email and email_verified) or (has_phone and phone_verified):
+            recovery_settings = user_pool.extended_config["AccountRecoverySetting"]
+            details = self._get_code_delivery_details(
+                recovery_settings=recovery_settings, user=user, username=user.username
+            )
+            return user, details
+        else:
+            return user, None
 
     def confirm_sign_up(self, client_id: str, username: str) -> str:
         user_pool = None
@@ -2229,7 +2260,7 @@ class RegionAgnosticBackend:
         username: str,
         password: str,
         attributes: List[Dict[str, str]],
-    ) -> CognitoIdpUser:
+    ) -> Tuple[CognitoIdpUser, Any]:
         backend = self._find_backend_for_clientid(client_id)
         return backend.sign_up(client_id, username, password, attributes)
 

{moto-5.0.13.dev37 → moto-5.0.13.dev44}/moto/cognitoidp/responses.py

@@ -588,18 +588,19 @@ class CognitoIdpResponse(BaseResponse):
         client_id = self._get_param("ClientId")
         username = self._get_param("Username")
         password = self._get_param("Password")
-        user = self._get_region_agnostic_backend().sign_up(
+        user, code_delivery_details = self._get_region_agnostic_backend().sign_up(
             client_id=client_id,
             username=username,
             password=password,
             attributes=self._get_param("UserAttributes", []),
         )
-        return json.dumps(
-            {
-                "UserConfirmed": user.status == UserStatus["CONFIRMED"],
-                "UserSub": user.id,
-            }
-        )
+        response = {
+            "UserConfirmed": user.status == UserStatus["CONFIRMED"],
+            "UserSub": user.id,
+        }
+        if code_delivery_details:
+            response["CodeDeliveryDetails"] = code_delivery_details
+        return json.dumps(response)
 
     def confirm_sign_up(self) -> str:
         client_id = self._get_param("ClientId")

{moto-5.0.13.dev37 → moto-5.0.13.dev44}/moto/dynamodb/exceptions.py

@@ -395,3 +395,11 @@ class DeletionProtectedException(MockValidationException):
     def __init__(self, table_name: str):
         msg = f"1 validation error detected: Table '{table_name}' can't be deleted while DeletionProtectionEnabled is set to True"
         super().__init__(msg)
+
+
+class PolicyNotFoundException(DynamodbException):
+    error_type = ERROR_TYPE_PREFIX + "PolicyNotFoundException"
+
+    def __init__(self, message: str):
+        super().__init__(PolicyNotFoundException.error_type, message=message)
+        self.exception_msg = message

{moto-5.0.13.dev37 → moto-5.0.13.dev44}/moto/dynamodb/models/__init__.py

@@ -20,6 +20,7 @@ from moto.dynamodb.exceptions import (
     MockValidationException,
     MultipleTransactionsException,
     PointInTimeRecoveryUnavailable,
+    PolicyNotFoundException,
     ResourceInUseException,
     ResourceNotFoundException,
     SourceTableNotFoundException,
@@ -34,6 +35,7 @@ from moto.dynamodb.models.dynamo_type import DynamoType, Item
 from moto.dynamodb.models.table import (
     Backup,
     GlobalSecondaryIndex,
+    ResourcePolicy,
     RestoredPITTable,
     RestoredTable,
     Table,
@@ -56,6 +58,7 @@ class DynamoDBBackend(BaseBackend):
         self.backups: Dict[str, Backup] = OrderedDict()
         self.table_imports: Dict[str, TableImport] = {}
         self.table_exports: Dict[str, TableExport] = {}
+        self.resource_policies: Dict[str, ResourcePolicy] = {}
 
     @staticmethod
     def default_vpc_endpoint_service(
@@ -1042,5 +1045,56 @@ class DynamoDBBackend(BaseBackend):
                 exports.append(self.table_exports[export_arn])
         return exports
 
+    def put_resource_policy(
+        self, resource_arn: str, policy_doc: str, expected_revision_id: Optional[str]
+    ) -> ResourcePolicy:
+        table_name = resource_arn.split("/")[-1]
+        if table_name not in self.tables:
+            raise ResourceNotFoundException(table_name=table_name)
+        if current_policy := self.resource_policies.get(resource_arn):
+            if expected_revision_id == "NO_POLICY":
+                raise PolicyNotFoundException(
+                    f"Resource-based policy not found for the provided ResourceArn: Requested policy update expecting none to be present for table {table_name}, but a policy exists with revision id {current_policy.revision_id}."
+                )
+            if (
+                expected_revision_id
+                and current_policy.revision_id != expected_revision_id
+            ):
+                raise PolicyNotFoundException(
+                    f"Resource-based policy not found for the provided ResourceArn: Requested update for policy with revision id {expected_revision_id}, but the policy associated to target table {table_name} has revision id {current_policy.revision_id}."
+                )
+            if current_policy.policy_doc == policy_doc:
+                return current_policy
+        policy = ResourcePolicy(
+            resource_arn=resource_arn,
+            policy_doc=policy_doc,
+        )
+        self.resource_policies[resource_arn] = policy
+        return policy
+
+    def get_resource_policy(self, resource_arn: str) -> ResourcePolicy:
+        table_name = resource_arn.split("/")[-1]
+        if table_name not in self.tables:
+            raise ResourceNotFoundException(table_name=table_name)
+        if resource_arn not in self.resource_policies:
+            raise PolicyNotFoundException(
+                f"Resource-based policy not found for the provided ResourceArn: {resource_arn}"
+            )
+        return self.resource_policies[resource_arn]
+
+    def delete_resource_policy(
+        self, resource_arn: str, expected_revision_id: Optional[str]
+    ) -> None:
+        table_name = resource_arn.split("/")[-1]
+        if table_name not in self.tables or not (
+            policy := self.resource_policies.get(resource_arn)
+        ):
+            raise ResourceNotFoundException(table_name=table_name)
+        if expected_revision_id and policy.revision_id != expected_revision_id:
+            raise PolicyNotFoundException(
+                f"Resource-based policy not found for the provided ResourceArn: Requested update for policy with revision id {expected_revision_id}, but the policy associated to target table {table_name} has revision id {policy.revision_id}."
+            )
+        self.resource_policies.pop(resource_arn)
+
 
 dynamodb_backends = BackendDict(DynamoDBBackend, "dynamodb")

{moto-5.0.13.dev37 → moto-5.0.13.dev44}/moto/dynamodb/models/table.py

@@ -1198,3 +1198,10 @@ class RestoredPITTable(Table):
             "RestoreInProgress": False,
         }
         return result
+
+
+class ResourcePolicy:
+    def __init__(self, resource_arn: str, policy_doc: str):
+        self.resource_arn = resource_arn
+        self.policy_doc = policy_doc
+        self.revision_id = str(int(unix_time_millis()))

{moto-5.0.13.dev37 → moto-5.0.13.dev44}/moto/dynamodb/responses.py

@@ -1269,3 +1269,26 @@ class DynamoHandler(BaseResponse):
                 }
             )
         return json.dumps({"ExportSummaries": response})
+
+    def put_resource_policy(self) -> str:
+        policy = self.dynamodb_backend.put_resource_policy(
+            resource_arn=self.body.get("ResourceArn"),
+            policy_doc=self.body.get("Policy"),
+            expected_revision_id=self.body.get("ExpectedRevisionId"),
+        )
+        return json.dumps({"RevisionId": policy.revision_id})
+
+    def get_resource_policy(self) -> str:
+        policy = self.dynamodb_backend.get_resource_policy(
+            resource_arn=self.body.get("ResourceArn")
+        )
+        return json.dumps(
+            {"Policy": policy.policy_doc, "RevisionId": policy.revision_id}
+        )
+
+    def delete_resource_policy(self) -> str:
+        self.dynamodb_backend.delete_resource_policy(
+            resource_arn=self.body.get("ResourceArn"),
+            expected_revision_id=self.body.get("ExpectedRevisionId"),
+        )
+        return "{}"

{moto-5.0.13.dev37 → moto-5.0.13.dev44/moto.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: moto
-Version: 5.0.13.dev37
+Version: 5.0.13.dev44
 Home-page: https://github.com/getmoto/moto
 Author: Steve Pulec
 Author-email: spulec@gmail.com

{moto-5.0.13.dev37 → moto-5.0.13.dev44}/moto.egg-info/SOURCES.txt

@@ -1718,6 +1718,7 @@ tests/test_dynamodb/test_dynamodb_expression_tokenizer.py
 tests/test_dynamodb/test_dynamodb_expressions.py
 tests/test_dynamodb/test_dynamodb_import_table.py
 tests/test_dynamodb/test_dynamodb_query.py
+tests/test_dynamodb/test_dynamodb_resource_policy.py
 tests/test_dynamodb/test_dynamodb_scan.py
 tests/test_dynamodb/test_dynamodb_statements.py
 tests/test_dynamodb/test_dynamodb_table_with_range_key.py

{moto-5.0.13.dev37 → moto-5.0.13.dev44}/setup.cfg

@@ -1,6 +1,6 @@
 [metadata]
 name = moto
-version = 5.0.13.dev37
+version = 5.0.13.dev44
 long_description = file:README.md
 long_description_content_type = text/markdown
 author = Steve Pulec

{moto-5.0.13.dev37 → moto-5.0.13.dev44}/tests/test_cognitoidp/__init__.py

@@ -12,6 +12,8 @@ def cognitoidp_aws_verified(
     read_attributes=None,
     explicit_auth_flows=None,
     generate_secret=False,
+    recovery=None,
+    verified_attributes=None,
 ):
     """
     Function that is verified to work against AWS.
@@ -35,6 +37,12 @@ def cognitoidp_aws_verified(
                 userpool_args = {}
                 if username_attributes:
                     userpool_args["UsernameAttributes"] = username_attributes
+                if recovery:
+                    userpool_args["AccountRecoverySetting"] = {
+                        "RecoveryMechanisms": recovery
+                    }
+                if verified_attributes:
+                    userpool_args["AutoVerifiedAttributes"] = verified_attributes
                 user_pool = conn.create_user_pool(PoolName=pool_name, **userpool_args)
                 pool_id = user_pool["UserPool"]["Id"]
                 pool_client_kwargs = {}

{moto-5.0.13.dev37 → moto-5.0.13.dev44}/tests/test_cognitoidp/test_cognitoidp.py

@@ -3224,14 +3224,14 @@ def test_forgot_password_user_with_all_recovery_attributes():
         UserPoolId=user_pool_id,
         Username=username,
         UserAttributes=[
-            {"Name": "email", "Value": "test@moto.com"},
+            {"Name": "email", "Value": "test@m***"},
             {"Name": "phone_number", "Value": "555555555"},
         ],
     )
 
     result = conn.forgot_password(ClientId=client_id, Username=username)
 
-    assert result["CodeDeliveryDetails"]["Destination"] == "test@moto.com"
+    assert result["CodeDeliveryDetails"]["Destination"] == "t***@m***"
     assert result["CodeDeliveryDetails"]["DeliveryMedium"] == "EMAIL"
     assert result["CodeDeliveryDetails"]["AttributeName"] == "email"
 
@@ -3251,6 +3251,8 @@ def test_forgot_password_user_with_all_recovery_attributes():
 
 @mock_aws
 def test_forgot_password_nonexistent_user_or_user_without_attributes():
+    # Whether this fails against AWS or not depends on a setting
+    # https://github.com/aws/aws-aspnet-cognito-identity-provider/issues/179#issuecomment-871051383
     conn = boto3.client("cognito-idp", "us-west-2")
     user_pool_id = conn.create_user_pool(
         PoolName=str(uuid.uuid4()),
@@ -3263,6 +3265,7 @@ def test_forgot_password_nonexistent_user_or_user_without_attributes():
     )["UserPoolClient"]["ClientId"]
     user_without_attributes = str(uuid.uuid4())
     nonexistent_user = str(uuid.uuid4())
+
     conn.admin_create_user(UserPoolId=user_pool_id, Username=user_without_attributes)
     for user in user_without_attributes, nonexistent_user:
         result = conn.forgot_password(ClientId=client_id, Username=user)
@@ -3286,6 +3289,37 @@ def test_forgot_password_nonexistent_user_or_user_without_attributes():
         assert result["CodeDeliveryDetails"]["AttributeName"] == "phone_number"
 
 
+@cognitoidp_aws_verified(recovery=[{"Name": "verified_email", "Priority": 1}])
+@pytest.mark.aws_verified
+def test_forgot_password_with_email_delivery_details(
+    user_pool=None, user_pool_client=None
+):
+    conn = boto3.client("cognito-idp", "us-west-2")
+    user_pool_id = user_pool["UserPool"]["Id"]
+    client_id = user_pool_client["UserPoolClient"]["ClientId"]
+    user_without_attributes = str(uuid.uuid4())
+
+    conn.admin_create_user(
+        UserPoolId=user_pool_id,
+        Username=user_without_attributes,
+        UserAttributes=[
+            {"Name": "email", "Value": "test@test.com"},
+            {"Name": "email_verified", "Value": "True"},
+        ],
+    )
+    conn.admin_set_user_password(
+        UserPoolId=user_pool_id,
+        Username=user_without_attributes,
+        Password="secretP2ss!",
+        Permanent=True,
+    )
+
+    result = conn.forgot_password(ClientId=client_id, Username=user_without_attributes)
+    assert result["CodeDeliveryDetails"]["Destination"] == "t***@t***"
+    assert result["CodeDeliveryDetails"]["DeliveryMedium"] == "EMAIL"
+    assert result["CodeDeliveryDetails"]["AttributeName"] == "email"
+
+
 @mock_aws
 def test_confirm_forgot_password_legacy():
     conn = boto3.client("cognito-idp", "us-west-2")
@@ -3938,18 +3972,76 @@ def test_list_resource_servers_multi_page():
             )
 
 
-@mock_aws
-def test_sign_up():
+@cognitoidp_aws_verified()
+@pytest.mark.aws_verified
+def test_sign_up(user_pool=None, user_pool_client=None):
     conn = boto3.client("cognito-idp", "us-west-2")
-    user_pool_id = conn.create_user_pool(PoolName=str(uuid.uuid4()))["UserPool"]["Id"]
-    client_id = conn.create_user_pool_client(
-        UserPoolId=user_pool_id, ClientName=str(uuid.uuid4())
-    )["UserPoolClient"]["ClientId"]
+    client_id = user_pool_client["UserPoolClient"]["ClientId"]
+    username = str(uuid.uuid4())
+    password = "P2$Sword"
+    result = conn.sign_up(ClientId=client_id, Username=username, Password=password)
+    assert result["UserConfirmed"] is False
+    assert result["UserSub"] is not None
+    assert "CodeDeliveryDetails" not in result
+
+
+@cognitoidp_aws_verified(recovery=[{"Name": "verified_email", "Priority": 1}])
+@pytest.mark.aws_verified
+def test_sign_up_with_unverified_email(user_pool=None, user_pool_client=None):
+    conn = boto3.client("cognito-idp", "us-west-2")
+    client_id = user_pool_client["UserPoolClient"]["ClientId"]
+    username = str(uuid.uuid4())
+    password = "P2$Sword"
+    result = conn.sign_up(
+        ClientId=client_id,
+        Username=username,
+        Password=password,
+        UserAttributes=[{"Name": "email", "Value": "test@test.com"}],
+    )
+    assert result["UserConfirmed"] is False
+    assert result["UserSub"] is not None
+    assert "CodeDeliveryDetails" not in result
+
+
+@cognitoidp_aws_verified(
+    recovery=[{"Name": "verified_email", "Priority": 1}], verified_attributes=["email"]
+)
+@pytest.mark.aws_verified
+def test_sign_up_with_verified_email(user_pool=None, user_pool_client=None):
+    conn = boto3.client("cognito-idp", "us-west-2")
+    client_id = user_pool_client["UserPoolClient"]["ClientId"]
+    username = str(uuid.uuid4())
+    password = "P2$Sword"
+    result = conn.sign_up(
+        ClientId=client_id,
+        Username=username,
+        Password=password,
+        UserAttributes=[{"Name": "email", "Value": "test@test.com"}],
+    )
+    assert result["UserConfirmed"] is False
+    assert result["UserSub"] is not None
+    assert result["CodeDeliveryDetails"] == {
+        "Destination": "t***@t***",
+        "DeliveryMedium": "EMAIL",
+        "AttributeName": "email",
+    }
+
+
+@cognitoidp_aws_verified(
+    recovery=[{"Name": "verified_email", "Priority": 1}], verified_attributes=["email"]
+)
+@pytest.mark.aws_verified
+def test_sign_up_with_verified_but_not_supplied_email(
+    user_pool=None, user_pool_client=None
+):
+    conn = boto3.client("cognito-idp", "us-west-2")
+    client_id = user_pool_client["UserPoolClient"]["ClientId"]
     username = str(uuid.uuid4())
     password = "P2$Sword"
     result = conn.sign_up(ClientId=client_id, Username=username, Password=password)
     assert result["UserConfirmed"] is False
     assert result["UserSub"] is not None
+    assert "CodeDeliveryDetails" not in result
 
 
 @mock_aws