|
16 | 16 |
|
17 | 17 | import crypto from 'node:crypto'; |
18 | 18 | import { |
| 19 | + AdminAddUserToGroupCommand, |
| 20 | + AdminCreateUserCommand, |
| 21 | + AdminDeleteUserCommand, |
| 22 | + AdminDisableUserCommand, |
| 23 | + AdminEnableUserCommand, |
| 24 | + AdminGetUserCommand, |
| 25 | + AdminListGroupsForUserCommand, |
| 26 | + AdminRemoveUserFromGroupCommand, |
| 27 | + AdminResetUserPasswordCommand, |
| 28 | + AdminSetUserPasswordCommand, |
| 29 | + AdminUserGlobalSignOutCommand, |
| 30 | + ListUsersCommand, |
| 31 | + ListUsersInGroupCommand, |
| 32 | + type AttributeType, |
| 33 | + type UserType, |
19 | 34 | AssociateSoftwareTokenCommand, |
20 | 35 | ChangePasswordCommand, |
21 | 36 | ChallengeNameType, |
@@ -88,6 +103,11 @@ import { |
88 | 103 | envVarNames, |
89 | 104 | isRetriableAuthError, |
90 | 105 | makeExternalUserPoolRef, |
| 106 | + type AdminCreateInit, |
| 107 | + type AdminGetterOf, |
| 108 | + type AdminUser, |
| 109 | + type GroupAdmin, |
| 110 | + type LifecycleAdmin, |
91 | 111 | type AuthCognitoOptions, |
92 | 112 | type CodeDeliveryDetails, |
93 | 113 | type AttrOf, |
@@ -593,6 +613,8 @@ export class AuthCognito<O extends AuthCognitoOptions = AuthCognitoOptions> |
593 | 613 | private readonly sessions: SessionStore; |
594 | 614 | private readonly sessionSecretSetting: AppSetting; |
595 | 615 | private sessionSecret?: string; |
| 616 | + /** Full admin surface, built once; the single generic projection lives in `get admin()`. */ |
| 617 | + private readonly adminSurface: GroupAdmin<AuthCognitoOptions> & LifecycleAdmin<AuthCognitoOptions>; |
596 | 618 |
|
597 | 619 | constructor(scope: ScopeParent, id: string, options?: O) { |
598 | 620 | super(id, { parent: scope, bbName: BB_NAME, bbVersion: BB_VERSION }); |
@@ -632,6 +654,192 @@ export class AuthCognito<O extends AuthCognitoOptions = AuthCognitoOptions> |
632 | 654 | // Nested scope `session-secret` — matches the CDK layer's AppSetting |
633 | 655 | // so both sides derive the same SSM parameter path. |
634 | 656 | this.sessionSecretSetting = new AppSetting(this, 'session-secret', { secret: true }); |
| 657 | + this.adminSurface = this.buildAdminSurface(); |
| 658 | + } |
| 659 | + |
| 660 | + /** |
| 661 | + * Opt-in server-side admin surface (group membership + user lifecycle). |
| 662 | + * `AdminDisabled` (compile error on access) unless `admin` was configured; |
| 663 | + * throws at runtime for untyped JS callers. Methods are narrowed by |
| 664 | + * `admin.actions`; the runtime object always carries every method. |
| 665 | + * |
| 666 | + * @category admin |
| 667 | + */ |
| 668 | + get admin(): AdminGetterOf<O> { |
| 669 | + if (!this.options.admin) { |
| 670 | + throw new Error("admin not enabled: construct AuthCognito with { admin: {} }"); |
| 671 | + } |
| 672 | + return this.adminSurface as AdminGetterOf<O>; |
| 673 | + } |
| 674 | + |
| 675 | + /** Pool ID for admin SDK calls. Throws if discovery env isn't populated. */ |
| 676 | + private adminUserPoolId(): string { |
| 677 | + const { userPoolId } = getSdkIdentifiers(this); |
| 678 | + if (!userPoolId) { |
| 679 | + throw new ApiError('Cognito user pool not configured', 500, { name: DEFAULT_API_ERROR_NAME }); |
| 680 | + } |
| 681 | + return userPoolId; |
| 682 | + } |
| 683 | + |
| 684 | + private buildAdminSurface(): GroupAdmin<AuthCognitoOptions> & LifecycleAdmin<AuthCognitoOptions> { |
| 685 | + const toAdminUser = (u: UserType): AdminUser => { |
| 686 | + const attributes: Record<string, string> = {}; |
| 687 | + for (const a of (u.Attributes ?? []) as AttributeType[]) { |
| 688 | + if (a.Name) attributes[a.Name] = a.Value ?? ''; |
| 689 | + } |
| 690 | + return { |
| 691 | + username: u.Username ?? '', |
| 692 | + userSub: attributes['sub'] ?? '', |
| 693 | + enabled: u.Enabled ?? true, |
| 694 | + attributes, |
| 695 | + }; |
| 696 | + }; |
| 697 | + |
| 698 | + return { |
| 699 | + // ── GroupAdmin ─────────────────────────────────────────────────── |
| 700 | + addUserToGroup: async (username, group) => { |
| 701 | + try { |
| 702 | + await this.client.send(new AdminAddUserToGroupCommand({ |
| 703 | + UserPoolId: this.adminUserPoolId(), Username: username, GroupName: String(group), |
| 704 | + })); |
| 705 | + } catch (e) { throw asApiError(e); } |
| 706 | + }, |
| 707 | + removeUserFromGroup: async (username, group) => { |
| 708 | + try { |
| 709 | + await this.client.send(new AdminRemoveUserFromGroupCommand({ |
| 710 | + UserPoolId: this.adminUserPoolId(), Username: username, GroupName: String(group), |
| 711 | + })); |
| 712 | + } catch (e) { throw asApiError(e); } |
| 713 | + }, |
| 714 | + listGroupsForUser: async (username) => { |
| 715 | + try { |
| 716 | + const out: string[] = []; |
| 717 | + let nextToken: string | undefined; |
| 718 | + do { |
| 719 | + const resp = await this.client.send(new AdminListGroupsForUserCommand({ |
| 720 | + UserPoolId: this.adminUserPoolId(), Username: username, NextToken: nextToken, |
| 721 | + })); |
| 722 | + for (const g of resp.Groups ?? []) if (g.GroupName) out.push(g.GroupName); |
| 723 | + nextToken = resp.NextToken; |
| 724 | + } while (nextToken); |
| 725 | + return out as GroupOf<AuthCognitoOptions>[]; |
| 726 | + } catch (e) { throw asApiError(e); } |
| 727 | + }, |
| 728 | + listUsersInGroup: async (group) => { |
| 729 | + try { |
| 730 | + const out: AdminUser[] = []; |
| 731 | + let nextToken: string | undefined; |
| 732 | + do { |
| 733 | + const resp = await this.client.send(new ListUsersInGroupCommand({ |
| 734 | + UserPoolId: this.adminUserPoolId(), GroupName: String(group), NextToken: nextToken, |
| 735 | + })); |
| 736 | + for (const u of resp.Users ?? []) out.push(toAdminUser(u)); |
| 737 | + nextToken = resp.NextToken; |
| 738 | + } while (nextToken); |
| 739 | + return out; |
| 740 | + } catch (e) { throw asApiError(e); } |
| 741 | + }, |
| 742 | + |
| 743 | + // ── LifecycleAdmin ─────────────────────────────────────────────── |
| 744 | + createUser: async (username, init) => { |
| 745 | + try { |
| 746 | + const attrs: AttributeType[] = Object.entries(init?.attributes ?? {}).map( |
| 747 | + ([Name, Value]) => ({ Name, Value }), |
| 748 | + ); |
| 749 | + const resp = await this.client.send(new AdminCreateUserCommand({ |
| 750 | + UserPoolId: this.adminUserPoolId(), |
| 751 | + Username: username, |
| 752 | + TemporaryPassword: init?.temporaryPassword, |
| 753 | + UserAttributes: attrs.length ? attrs : undefined, |
| 754 | + MessageAction: init?.suppressInvite ? 'SUPPRESS' : undefined, |
| 755 | + })); |
| 756 | + return resp.User ? toAdminUser(resp.User) : { username, userSub: '', enabled: true, attributes: {} }; |
| 757 | + } catch (e) { throw asApiError(e); } |
| 758 | + }, |
| 759 | + deleteUser: async (username) => { |
| 760 | + try { |
| 761 | + await this.client.send(new AdminDeleteUserCommand({ |
| 762 | + UserPoolId: this.adminUserPoolId(), Username: username, |
| 763 | + })); |
| 764 | + } catch (e) { throw asApiError(e); } |
| 765 | + }, |
| 766 | + disableUser: async (username) => { |
| 767 | + try { |
| 768 | + await this.client.send(new AdminDisableUserCommand({ |
| 769 | + UserPoolId: this.adminUserPoolId(), Username: username, |
| 770 | + })); |
| 771 | + } catch (e) { throw asApiError(e); } |
| 772 | + }, |
| 773 | + enableUser: async (username) => { |
| 774 | + try { |
| 775 | + await this.client.send(new AdminEnableUserCommand({ |
| 776 | + UserPoolId: this.adminUserPoolId(), Username: username, |
| 777 | + })); |
| 778 | + } catch (e) { throw asApiError(e); } |
| 779 | + }, |
| 780 | + resetUserPassword: async (username) => { |
| 781 | + try { |
| 782 | + await this.client.send(new AdminResetUserPasswordCommand({ |
| 783 | + UserPoolId: this.adminUserPoolId(), Username: username, |
| 784 | + })); |
| 785 | + } catch (e) { throw asApiError(e); } |
| 786 | + }, |
| 787 | + setUserPassword: async (username, password, permanent) => { |
| 788 | + try { |
| 789 | + await this.client.send(new AdminSetUserPasswordCommand({ |
| 790 | + UserPoolId: this.adminUserPoolId(), Username: username, Password: password, Permanent: permanent, |
| 791 | + })); |
| 792 | + } catch (e) { throw asApiError(e); } |
| 793 | + }, |
| 794 | + getUser: async (username) => { |
| 795 | + try { |
| 796 | + const resp = await this.client.send(new AdminGetUserCommand({ |
| 797 | + UserPoolId: this.adminUserPoolId(), Username: username, |
| 798 | + })); |
| 799 | + const attributes: Record<string, string> = {}; |
| 800 | + for (const a of (resp.UserAttributes ?? []) as AttributeType[]) { |
| 801 | + if (a.Name) attributes[a.Name] = a.Value ?? ''; |
| 802 | + } |
| 803 | + return { |
| 804 | + username: resp.Username ?? username, |
| 805 | + userSub: attributes['sub'] ?? '', |
| 806 | + enabled: resp.Enabled ?? true, |
| 807 | + attributes, |
| 808 | + }; |
| 809 | + } catch (e) { |
| 810 | + if (e instanceof Error && e.name === AuthCognitoErrors.UserNotFound) return null; |
| 811 | + throw asApiError(e); |
| 812 | + } |
| 813 | + }, |
| 814 | + scan: async function* (this: AuthCognito<O>) { |
| 815 | + let paginationToken: string | undefined; |
| 816 | + do { |
| 817 | + const resp = await this.client.send(new ListUsersCommand({ |
| 818 | + UserPoolId: this.adminUserPoolId(), PaginationToken: paginationToken, |
| 819 | + })); |
| 820 | + for (const u of resp.Users ?? []) { |
| 821 | + const attributes: Record<string, string> = {}; |
| 822 | + for (const a of (u.Attributes ?? []) as AttributeType[]) { |
| 823 | + if (a.Name) attributes[a.Name] = a.Value ?? ''; |
| 824 | + } |
| 825 | + yield { |
| 826 | + username: u.Username ?? '', |
| 827 | + userSub: attributes['sub'] ?? '', |
| 828 | + enabled: u.Enabled ?? true, |
| 829 | + attributes, |
| 830 | + }; |
| 831 | + } |
| 832 | + paginationToken = resp.PaginationToken; |
| 833 | + } while (paginationToken); |
| 834 | + }.bind(this), |
| 835 | + revokeUserSessions: async (username) => { |
| 836 | + try { |
| 837 | + await this.client.send(new AdminUserGlobalSignOutCommand({ |
| 838 | + UserPoolId: this.adminUserPoolId(), Username: username, |
| 839 | + })); |
| 840 | + } catch (e) { throw asApiError(e); } |
| 841 | + }, |
| 842 | + }; |
635 | 843 | } |
636 | 844 |
|
637 | 845 | private get verifier(): ReturnType<typeof CognitoJwtVerifier.create> { |
|
0 commit comments