fix(gen2-migration): skip imported auth resources in refactor step (#14722)

fix(cli-internal): skip imported auth resources in refactor step

Imported (reference) auth resources have no nested CloudFormation
stack — they reference externally-managed Cognito resources. The
refactor step was unconditionally creating an
AuthCognitoForwardRefactorer for every auth:Cognito resource,
which then failed with "unable to find source stack" because
there is no stack to find.

Now checks serviceType === 'imported' in amplify-meta.json before
creating the refactorer, matching the existing pattern in the
generate step. Added tests for both forward and rollback paths.
---
Prompt: In the gen2-migration tool, I am getting this error
when trying to refactor an app with an imported auth resource -
"[AuthCognitoForwardRefactorer] unable to find source stack"

Author: dgandhi62

packages/amplify-cli/src/__tests__/commands/gen2-migration/refactor/refactor.test.ts

@@ -128,10 +128,10 @@ function findGen2RootStackName(app: MigrationApp) {
   throw new Error(`Unable to find Gen2 root stack name for app: ${app.name}`);
 }
 
-function mockDiscover(resources: DiscoveredResource[]): jest.SpyInstance {
+function mockDiscover(resources: DiscoveredResource[], metaOverrides?: Record<string, unknown>): jest.SpyInstance {
   return jest.spyOn(Gen1App, 'create').mockResolvedValue({
     discover: () => resources,
-    meta: () => undefined,
+    meta: (category: string) => metaOverrides?.[category] as Record<string, unknown> | undefined,
   } as unknown as Gen1App);
 }
 
@@ -232,6 +232,17 @@ describe('AmplifyMigrationRefactorStep', () => {
       const plan = await step.forward();
       await plan.describe();
     });
+
+    it('skips imported auth resources', async () => {
+      infraSpy = mockCreateInfrastructure();
+      createSpy = mockDiscover([{ category: 'auth', resourceName: 'myImportedPool', service: 'Cognito', key: 'auth:Cognito' }], {
+        auth: { myImportedPool: { service: 'Cognito', serviceType: 'imported' } },
+      });
+
+      const step = createStep();
+      const plan = await step.forward();
+      await plan.describe();
+    });
   });
 
   describe('rollback()', () => {
@@ -254,5 +265,16 @@ describe('AmplifyMigrationRefactorStep', () => {
       const plan = await step.rollback();
       await plan.describe();
     });
+
+    it('skips imported auth resources', async () => {
+      infraSpy = mockCreateInfrastructure();
+      createSpy = mockDiscover([{ category: 'auth', resourceName: 'myImportedPool', service: 'Cognito', key: 'auth:Cognito' }], {
+        auth: { myImportedPool: { service: 'Cognito', serviceType: 'imported' } },
+      });
+
+      const step = createStep();
+      const plan = await step.rollback();
+      await plan.describe();
+    });
   });
 });

packages/amplify-cli/src/commands/gen2-migration/refactor/refactor.ts

@@ -67,22 +67,32 @@ export class AmplifyMigrationRefactorStep extends AmplifyMigrationStep {
 
     for (const resource of discovered) {
       switch (resource.key) {
-        case 'auth:Cognito':
-          refactorers.push(
-            new AuthCognitoForwardRefactorer(
-              gen1Env,
-              gen2Branch,
-              clients,
-              this.region,
-              accountId,
-              this.logger,
-              this.appId,
-              this.currentEnvName,
-              resource,
-              cfn,
-            ),
-          );
+        case 'auth:Cognito': {
+          // Imported auth resources have no CloudFormation stack to move — skip.
+          const isReferenceAuth = discovered
+            .filter((r) => r.category === 'auth')
+            .some((r) => {
+              const meta = (gen1App.meta('auth') ?? {})[r.resourceName] as Record<string, unknown> | undefined;
+              return meta?.serviceType === 'imported';
+            });
+          if (!isReferenceAuth) {
+            refactorers.push(
+              new AuthCognitoForwardRefactorer(
+                gen1Env,
+                gen2Branch,
+                clients,
+                this.region,
+                accountId,
+                this.logger,
+                this.appId,
+                this.currentEnvName,
+                resource,
+                cfn,
+              ),
+            );
+          }
           break;
+        }
         case 'auth:Cognito-UserPool-Groups':
           refactorers.push(
             new AuthUserPoolGroupsForwardRefactorer(gen1Env, gen2Branch, clients, this.region, accountId, this.logger, resource, cfn),
@@ -143,11 +153,21 @@ export class AmplifyMigrationRefactorStep extends AmplifyMigrationStep {
 
     for (const resource of discovered) {
       switch (resource.key) {
-        case 'auth:Cognito':
-          refactorers.push(
-            new AuthCognitoRollbackRefactorer(gen1Env, gen2Branch, clients, this.region, accountId, this.logger, resource, cfn),
-          );
+        case 'auth:Cognito': {
+          // Imported auth resources have no CloudFormation stack to move — skip.
+          const isReferenceAuth = discovered
+            .filter((r) => r.category === 'auth')
+            .some((r) => {
+              const meta = (gen1App.meta('auth') ?? {})[r.resourceName] as Record<string, unknown> | undefined;
+              return meta?.serviceType === 'imported';
+            });
+          if (!isReferenceAuth) {
+            refactorers.push(
+              new AuthCognitoRollbackRefactorer(gen1Env, gen2Branch, clients, this.region, accountId, this.logger, resource, cfn),
+            );
+          }
           break;
+        }
         case 'auth:Cognito-UserPool-Groups':
           refactorers.push(
             new AuthUserPoolGroupsRollbackRefactorer(gen1Env, gen2Branch, clients, this.region, accountId, this.logger, resource, cfn),