fix(cli-internal): correct OIDC TTL conversion and handle clientId field

fix(cli-internal): correct OIDC TTL conversion and handle clientId field

Author: adrianjoshua-strutt

packages/amplify-cli/src/__tests__/commands/gen2-migration/generate/amplify/data/data.generator.test.ts

@@ -390,7 +390,7 @@ describe('DataGenerator', () => {
     `);
   });
 
-  it('renders OIDC auth mode', async () => {
+  it('renders OIDC auth mode with TTL converted from milliseconds to seconds', async () => {
     const gen1App = await createGen1App({
       providers: { awscloudformation: { StackName: 'amplify-test-main-123456', Region: 'us-east-1' } },
       api: {
@@ -412,8 +412,8 @@ describe('DataGenerator', () => {
                 name: 'MyOIDC',
                 issuerUrl: 'https://example.com',
                 clientId: 'client123',
-                authTTL: 3600,
-                iatTTL: 7200,
+                authTTL: 3600000,
+                iatTTL: 7200000,
               },
             },
           ],
@@ -459,6 +459,93 @@ describe('DataGenerator', () => {
     `);
   });
 
+  it('renders OIDC auth mode without clientId when absent and supplements from live API', async () => {
+    const gen1App = await createGen1App({
+      providers: { awscloudformation: { StackName: 'amplify-test-main-123456', Region: 'us-east-1' } },
+      api: {
+        testApi: {
+          service: 'AppSync',
+          output: { GraphQLAPIIdOutput: 'api-123' },
+        },
+      },
+    });
+    mockSchema(gen1App, 'type Todo @model { id: ID! }', ['Todo']);
+    jest.spyOn(gen1App, 'resourceMetaOutput').mockImplementation((_resource: DiscoveredResource, key: string) => {
+      if (key === 'GraphQLAPIIdOutput') return 'api-123';
+      if (key === 'authConfig')
+        return {
+          defaultAuthentication: {
+            authenticationType: 'OPENID_CONNECT',
+            openIDConnectConfig: {
+              name: 'NoClientIdProvider',
+              issuerUrl: 'https://idp.example.com',
+              authTTL: 1800000,
+              iatTTL: 3600000,
+            },
+          },
+        } as any;
+      return undefined as any;
+    });
+    jest.spyOn(gen1App.aws, 'fetchGraphqlApi').mockResolvedValue({
+      apiId: 'api-123',
+      name: 'testApi',
+      openIDConnectConfig: { issuer: 'https://idp.example.com', clientId: 'supplemented-client-id' },
+      additionalAuthenticationProviders: [],
+    });
+
+    const generator = new DataGenerator(gen1App, backendGenerator, outputDir, dataResource, logger);
+    const ops = await generator.plan();
+    await ops[0].execute();
+
+    const output = writtenFile('resource.ts');
+    expect(output).toContain("clientId: 'supplemented-client-id'");
+    expect(output).toContain('tokenExpiryFromAuthInSeconds: 1800');
+    expect(output).toContain('tokenExpireFromIssueInSeconds: 3600');
+  });
+
+  it('floors TTL values when not exact multiples of 1000', async () => {
+    const gen1App = await createGen1App({
+      providers: { awscloudformation: { StackName: 'amplify-test-main-123456', Region: 'us-east-1' } },
+      api: {
+        testApi: {
+          service: 'AppSync',
+          output: { GraphQLAPIIdOutput: 'api-123' },
+        },
+      },
+    });
+    mockSchema(gen1App, 'type Todo @model { id: ID! }', ['Todo']);
+    jest.spyOn(gen1App, 'resourceMetaOutput').mockImplementation((_resource: DiscoveredResource, key: string) => {
+      if (key === 'GraphQLAPIIdOutput') return 'api-123';
+      if (key === 'authConfig')
+        return {
+          defaultAuthentication: {
+            authenticationType: 'OPENID_CONNECT',
+            openIDConnectConfig: {
+              name: 'Floored',
+              issuerUrl: 'https://idp.example.com',
+              clientId: 'abc',
+              authTTL: 3599999,
+              iatTTL: 7200500,
+            },
+          },
+        } as any;
+      return undefined as any;
+    });
+    jest.spyOn(gen1App.aws, 'fetchGraphqlApi').mockResolvedValue({
+      apiId: 'api-123',
+      name: 'testApi',
+      additionalAuthenticationProviders: [],
+    });
+
+    const generator = new DataGenerator(gen1App, backendGenerator, outputDir, dataResource, logger);
+    const ops = await generator.plan();
+    await ops[0].execute();
+
+    const output = writtenFile('resource.ts');
+    expect(output).toContain('tokenExpiryFromAuthInSeconds: 3599');
+    expect(output).toContain('tokenExpireFromIssueInSeconds: 7200');
+  });
+
   it('renders Lambda auth mode', async () => {
     const gen1App = await createGen1App({
       providers: { awscloudformation: { StackName: 'amplify-test-main-123456', Region: 'us-east-1' } },

packages/amplify-cli/src/commands/gen2-migration/generate/amplify/data/data.generator.ts

@@ -169,7 +169,7 @@ export class DataGenerator implements Planner {
     const hasAdditionalAuthProviders =
       graphqlApi.additionalAuthenticationProviders !== undefined && graphqlApi.additionalAuthenticationProviders.length > 0;
     const hasAuth = this.gen1App.categoryMeta('auth') !== undefined;
-    const authorizationModes = this.gen1App.resourceMetaOutput(this.resource, 'authConfig');
+    const authorizationModes = supplementOidcConfig(this.gen1App.resourceMetaOutput(this.resource, 'authConfig'), graphqlApi);
     const hasIamAuth = this.detectIamAuth(authorizationModes, graphqlApi);
     const vtlFiles = this.findResolverVtlFiles(this.resource.resourceName);
     const hasResolvers = vtlFiles.length > 0;
@@ -275,3 +275,42 @@ export class DataGenerator implements Planner {
     return graphqlApi.additionalAuthenticationProviders?.some((p) => p.authenticationType === 'AWS_IAM') ?? false;
   }
 }
+
+/**
+ * Supplements the authConfig from amplify-meta.json with OIDC clientId
+ * values from the live GraphQL API when they are missing in the local config.
+ *
+ * Gen1 amplify-meta.json may not include the `clientId` field for OIDC
+ * providers (depends on CLI version), but the live API always has it.
+ */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- untyped authConfig from amplify-meta.json
+function supplementOidcConfig(authConfig: any, graphqlApi: GraphqlApi): any {
+  if (!authConfig) return authConfig;
+
+  const result = JSON.parse(JSON.stringify(authConfig));
+
+  if (
+    result.defaultAuthentication?.authenticationType === 'OPENID_CONNECT' &&
+    result.defaultAuthentication.openIDConnectConfig &&
+    !result.defaultAuthentication.openIDConnectConfig.clientId &&
+    graphqlApi.openIDConnectConfig?.clientId
+  ) {
+    result.defaultAuthentication.openIDConnectConfig.clientId = graphqlApi.openIDConnectConfig.clientId;
+  }
+
+  if (result.additionalAuthenticationProviders) {
+    for (const provider of result.additionalAuthenticationProviders) {
+      if (provider.authenticationType !== 'OPENID_CONNECT' || !provider.openIDConnectConfig || provider.openIDConnectConfig.clientId) {
+        continue;
+      }
+      const match = graphqlApi.additionalAuthenticationProviders?.find(
+        (p) => p.authenticationType === 'OPENID_CONNECT' && p.openIDConnectConfig?.issuer === provider.openIDConnectConfig.issuerUrl,
+      );
+      if (match?.openIDConnectConfig?.clientId) {
+        provider.openIDConnectConfig.clientId = match.openIDConnectConfig.clientId;
+      }
+    }
+  }
+
+  return result;
+}

packages/amplify-cli/src/commands/gen2-migration/generate/amplify/data/data.renderer.ts

@@ -489,9 +489,19 @@ export class DataRenderer {
     ];
     if (cfg.clientId) props.push(factory.createPropertyAssignment('clientId', factory.createStringLiteral(cfg.clientId)));
     if (cfg.authTTL)
-      props.push(factory.createPropertyAssignment('tokenExpiryFromAuthInSeconds', factory.createNumericLiteral(cfg.authTTL.toString())));
+      props.push(
+        factory.createPropertyAssignment(
+          'tokenExpiryFromAuthInSeconds',
+          factory.createNumericLiteral(Math.floor(Number(cfg.authTTL) / 1000).toString()),
+        ),
+      );
     if (cfg.iatTTL)
-      props.push(factory.createPropertyAssignment('tokenExpireFromIssueInSeconds', factory.createNumericLiteral(cfg.iatTTL.toString())));
+      props.push(
+        factory.createPropertyAssignment(
+          'tokenExpireFromIssueInSeconds',
+          factory.createNumericLiteral(Math.floor(Number(cfg.iatTTL) / 1000).toString()),
+        ),
+      );
     target.push(factory.createPropertyAssignment('oidcAuthorizationMode', factory.createObjectLiteralExpression(props)));
   }