Skip to content

Commit 288af9e

Browse files
bmoffattbmoffatt
authored
Deprecate Cognito PreTokenGenV2 and introduce PreTokenGenV2_0 (#589)
1 parent 528ceb5 commit 288af9e

File tree

3 files changed

+155
-0
lines changed

3 files changed

+155
-0
lines changed

‎events/cognito.go‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,12 +54,23 @@ type CognitoEventUserPoolsPreTokenGen struct {
5454

5555
// CognitoEventUserPoolsPreTokenGenV2 is sent by Amazon Cognito User Pools when a user attempts to retrieve
5656
// credentials, allowing a Lambda to perform insert, suppress or override claims and scopes
57+
//
58+
// Deprecated: Use CognitoEventUserPoolsPreTokenGenV2_0 instead.
59+
// This struct incorrectly restricts the ClaimsToAddOrOverride values as strings, but Cogntio supports any type.
5760
type CognitoEventUserPoolsPreTokenGenV2 struct {
5861
CognitoEventUserPoolsHeader
5962
Request CognitoEventUserPoolsPreTokenGenV2Request `json:"request"`
6063
Response CognitoEventUserPoolsPreTokenGenV2Response `json:"response"`
6164
}
6265

66+
// CognitoEventUserPoolsPreTokenGenV2_0 is sent by Amazon Cognito User Pools when a user attempts to retrieve
67+
// credentials, allowing a Lambda to perform insert, suppress or override claims and scopes
68+
type CognitoEventUserPoolsPreTokenGenV2_0 struct {
69+
CognitoEventUserPoolsHeader
70+
Request CognitoEventUserPoolsPreTokenGenRequestV2_0 `json:"request"`
71+
Response CognitoEventUserPoolsPreTokenGenResponseV2_0 `json:"response"`
72+
}
73+
6374
// CognitoEventUserPoolsPostAuthentication is sent by Amazon Cognito User Pools after a user is authenticated,
6475
// allowing the Lambda to add custom logic.
6576
type CognitoEventUserPoolsPostAuthentication struct {
@@ -134,23 +145,40 @@ type CognitoEventUserPoolsPreTokenGenRequest struct {
134145
}
135146

136147
// CognitoEventUserPoolsPreTokenGenV2Request contains request portion of V2 PreTokenGen event
148+
//
149+
// Deprecated: Use CognitoEventUserPoolsPreTokenGenRequestV2_0 instead
137150
type CognitoEventUserPoolsPreTokenGenV2Request struct {
138151
UserAttributes map[string]string `json:"userAttributes"`
139152
GroupConfiguration GroupConfiguration `json:"groupConfiguration"`
140153
ClientMetadata map[string]string `json:"clientMetadata,omitempty"`
141154
Scopes []string `json:"scopes"`
142155
}
143156

157+
// CognitoEventUserPoolsPreTokenGenRequestV2_0 contains request portion of V2 PreTokenGen event
158+
type CognitoEventUserPoolsPreTokenGenRequestV2_0 struct {
159+
UserAttributes map[string]string `json:"userAttributes"`
160+
GroupConfiguration GroupConfigurationV2_0 `json:"groupConfiguration"`
161+
ClientMetadata map[string]string `json:"clientMetadata,omitempty"`
162+
Scopes []string `json:"scopes"`
163+
}
164+
144165
// CognitoEventUserPoolsPreTokenGenResponse contains the response portion of a PreTokenGen event
145166
type CognitoEventUserPoolsPreTokenGenResponse struct {
146167
ClaimsOverrideDetails ClaimsOverrideDetails `json:"claimsOverrideDetails"`
147168
}
148169

149170
// CognitoEventUserPoolsPreTokenGenV2Response contains the response portion of a V2 PreTokenGen event
171+
//
172+
// Deprecated: Use CognitoEventUserPoolsPreTokenGenResponseV2_0 instead
150173
type CognitoEventUserPoolsPreTokenGenV2Response struct {
151174
ClaimsAndScopeOverrideDetails ClaimsAndScopeOverrideDetails `json:"claimsAndScopeOverrideDetails"`
152175
}
153176

177+
// CognitoEventUserPoolsPreTokenGenResponseV2_0 contains the response portion of a V2 PreTokenGen event
178+
type CognitoEventUserPoolsPreTokenGenResponseV2_0 struct {
179+
ClaimsAndScopeOverrideDetails ClaimsAndScopeOverrideDetailsV2_0 `json:"claimsAndScopeOverrideDetails"`
180+
}
181+
154182
// CognitoEventUserPoolsPostAuthenticationRequest contains the request portion of a PostAuthentication event
155183
type CognitoEventUserPoolsPostAuthenticationRequest struct {
156184
NewDeviceUsed bool `json:"newDeviceUsed"`
@@ -179,26 +207,51 @@ type CognitoEventUserPoolsMigrateUserResponse struct {
179207
}
180208

181209
// ClaimsAndScopeOverrideDetails allows lambda to add, suppress or override V2 claims and scopes in the token
210+
//
211+
// Deprecated: Use ClaimsAndScopeOverrideDetailsV2_0 instead
182212
type ClaimsAndScopeOverrideDetails struct {
183213
IDTokenGeneration IDTokenGeneration `json:"idTokenGeneration"`
184214
AccessTokenGeneration AccessTokenGeneration `json:"accessTokenGeneration"`
185215
GroupOverrideDetails GroupConfiguration `json:"groupOverrideDetails"`
186216
}
187217

218+
// ClaimsAndScopeOverrideDetailsV2 allows lambda to add, suppress or override V2 claims and scopes in the token
219+
type ClaimsAndScopeOverrideDetailsV2_0 struct {
220+
IDTokenGeneration IDTokenGenerationV2_0 `json:"idTokenGeneration"`
221+
AccessTokenGeneration AccessTokenGenerationV2_0 `json:"accessTokenGeneration"`
222+
GroupOverrideDetails GroupConfigurationV2_0 `json:"groupOverrideDetails"`
223+
}
224+
188225
// IDTokenGeneration allows lambda to modify the ID token
189226
type IDTokenGeneration struct {
190227
ClaimsToAddOrOverride map[string]string `json:"claimsToAddOrOverride"`
191228
ClaimsToSuppress []string `json:"claimsToSuppress"`
192229
}
193230

231+
// IDTokenGenerationV2_0 allows lambda to modify the ID token
232+
type IDTokenGenerationV2_0 struct {
233+
ClaimsToAddOrOverride map[string]interface{} `json:"claimsToAddOrOverride"`
234+
ClaimsToSuppress []string `json:"claimsToSuppress"`
235+
}
236+
194237
// AccessTokenGeneration allows lambda to modify the access token
238+
//
239+
// Deprecated: Use AccessTokenGenerationV2_0 instead
195240
type AccessTokenGeneration struct {
196241
ClaimsToAddOrOverride map[string]string `json:"claimsToAddOrOverride"`
197242
ClaimsToSuppress []string `json:"claimsToSuppress"`
198243
ScopesToAdd []string `json:"scopesToAdd"`
199244
ScopesToSuppress []string `json:"scopesToSuppress"`
200245
}
201246

247+
// AccessTokenGenerationV2_0 allows lambda to modify the access token
248+
type AccessTokenGenerationV2_0 struct {
249+
ClaimsToAddOrOverride map[string]interface{} `json:"claimsToAddOrOverride"`
250+
ClaimsToSuppress []string `json:"claimsToSuppress"`
251+
ScopesToAdd []string `json:"scopesToAdd"`
252+
ScopesToSuppress []string `json:"scopesToSuppress"`
253+
}
254+
202255
// ClaimsOverrideDetails allows lambda to add, suppress or override claims in the token
203256
type ClaimsOverrideDetails struct {
204257
GroupOverrideDetails GroupConfiguration `json:"groupOverrideDetails"`
@@ -213,6 +266,13 @@ type GroupConfiguration struct {
213266
PreferredRole *string `json:"preferredRole"`
214267
}
215268

269+
// GroupConfigurationV2_0 allows lambda to override groups, roles and set a preferred role
270+
type GroupConfigurationV2_0 struct {
271+
GroupsToOverride []string `json:"groupsToOverride"`
272+
IAMRolesToOverride []string `json:"iamRolesToOverride"`
273+
PreferredRole *string `json:"preferredRole"`
274+
}
275+
216276
// CognitoEventUserPoolsChallengeResult represents a challenge that is presented to the user in the authentication
217277
// process that is underway, along with the corresponding result.
218278
type CognitoEventUserPoolsChallengeResult struct {

‎events/cognito_test.go‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,28 @@ func TestCognitoEventUserPoolsPreTokenGenV2Marshaling(t *testing.T) {
162162
test.AssertJsonsEqual(t, inputJSON, outputJSON)
163163
}
164164

165+
func TestCognitoEventUserPoolsPreTokenGenV2_0Marshaling(t *testing.T) {
166+
// read json from file
167+
inputJSON, err := ioutil.ReadFile("./testdata/cognito-event-userpools-pretokengen-v2_0.json")
168+
if err != nil {
169+
t.Errorf("could not open test file. details: %v", err)
170+
}
171+
172+
// de-serialize into CognitoEvent
173+
var inputEvent CognitoEventUserPoolsPreTokenGenV2_0
174+
if err := json.Unmarshal(inputJSON, &inputEvent); err != nil {
175+
t.Errorf("could not unmarshal event. details: %v", err)
176+
}
177+
178+
// serialize to json
179+
outputJSON, err := json.Marshal(inputEvent)
180+
if err != nil {
181+
t.Errorf("could not marshal event. details: %v", err)
182+
}
183+
184+
test.AssertJsonsEqual(t, inputJSON, outputJSON)
185+
}
186+
165187
func TestCognitoEventUserPoolsDefineAuthChallengeMarshaling(t *testing.T) {
166188
var inputEvent CognitoEventUserPoolsDefineAuthChallenge
167189
test.AssertJsonFile(t, "./testdata/cognito-event-userpools-define-auth-challenge.json", &inputEvent)

‎events/testdata/cognito-event-userpools-pretokengen-v2_0.json‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
{
2+
"version": "2",
3+
"triggerSource": "TokenGeneration_Authentication",
4+
"region": "us-east-1",
5+
"userPoolId": "us-east-1_EXAMPLE",
6+
"userName": "testuser",
7+
"callerContext": {
8+
"awsSdkVersion": "aws-sdk-unknown-unknown",
9+
"clientId": "1example23456789"
10+
},
11+
"request": {
12+
"userAttributes": {
13+
"sub": "a36036a8-9061-424d-a737-56d57dae7bc6",
14+
"cognito:email_alias": "[email protected]",
15+
"cognito:user_status": "CONFIRMED",
16+
"email_verified": "true",
17+
"email": "[email protected]"
18+
},
19+
"groupConfiguration": {
20+
"groupsToOverride": [],
21+
"iamRolesToOverride": [],
22+
"preferredRole": null
23+
},
24+
"scopes": [
25+
"aws.cognito.signin.user.admin"
26+
]
27+
},
28+
"response": {
29+
"claimsAndScopeOverrideDetails": {
30+
"idTokenGeneration": {
31+
"claimsToAddOrOverride": {
32+
"family_name": "xyz",
33+
"favorite_number": 2
34+
},
35+
"claimsToSuppress": [
36+
"email",
37+
"birthdate"
38+
]
39+
},
40+
"accessTokenGeneration": {
41+
"claimsToAddOrOverride": {
42+
"family_name": "xyz",
43+
"favorite_number": 2
44+
},
45+
"claimsToSuppress": [
46+
"email",
47+
"birthdate"
48+
],
49+
"scopesToAdd": [
50+
"scope1",
51+
"scope2",
52+
"scopeLomond"
53+
],
54+
"scopesToSuppress": [
55+
"phone_number"
56+
]
57+
},
58+
"groupOverrideDetails": {
59+
"groupsToOverride": [
60+
"group-A",
61+
"group-B",
62+
"group-C"
63+
],
64+
"iamRolesToOverride": [
65+
"arn:aws:iam::123456789012:role/sns_callerA",
66+
"arn:aws:iam::123456789012:role/sns_callerB",
67+
"arn:aws:iam::123456789012:role/sns_callerC"
68+
],
69+
"preferredRole": "arn:aws:iam::123456789012:role/sns_caller"
70+
}
71+
}
72+
}
73+
}

0 commit comments

Comments
 (0)