| 1 | import type * as ci from "@distilled.cloud/aws/cognito-identity"; |
| 2 | import type * as Effect from "effect/Effect"; |
| 3 | import * as Binding from "../../Binding.ts"; |
| 4 | import type { IdentityPool } from "./IdentityPool.ts"; |
| 5 | |
| 6 | export interface GetIdRequest extends Omit<ci.GetIdInput, "IdentityPoolId"> {} |
| 7 | |
| 8 | /** |
| 9 | * The typed client returned by binding {@link IdentityPoolAuth} to an |
| 10 | * `IdentityPool`. `getId` automatically injects the identity pool ID; the |
| 11 | * remaining calls operate on the returned identity ID. |
| 12 | */ |
| 13 | export interface IdentityPoolAuthClient { |
| 14 | /** Mint (or look up) an identity ID for a set of logins — or for a guest |
| 15 | * when the pool allows unauthenticated identities. */ |
| 16 | getId: ( |
| 17 | request?: GetIdRequest, |
| 18 | ) => Effect.Effect<ci.GetIdResponse, ci.GetIdError>; |
| 19 | /** Exchange an identity ID (+ logins) for temporary AWS credentials. */ |
| 20 | getCredentialsForIdentity: ( |
| 21 | request: ci.GetCredentialsForIdentityInput, |
| 22 | ) => Effect.Effect< |
| 23 | ci.GetCredentialsForIdentityResponse, |
| 24 | ci.GetCredentialsForIdentityError |
| 25 | >; |
| 26 | /** Exchange an identity ID (+ logins) for an OpenID Connect token |
| 27 | * (basic/classic flow — requires `allowClassicFlow`). */ |
| 28 | getOpenIdToken: ( |
| 29 | request: ci.GetOpenIdTokenInput, |
| 30 | ) => Effect.Effect<ci.GetOpenIdTokenResponse, ci.GetOpenIdTokenError>; |
| 31 | /** Unlink a federated login from an identity. */ |
| 32 | unlinkIdentity: ( |
| 33 | request: ci.UnlinkIdentityInput, |
| 34 | ) => Effect.Effect<ci.UnlinkIdentityResponse, ci.UnlinkIdentityError>; |
| 35 | } |
| 36 | |
| 37 | /** |
| 38 | * Runtime binding for the public (token-based) Cognito identity pool flows — |
| 39 | * the credentials-vending data plane. |
| 40 | * |
| 41 | * Bind this to an `IdentityPool` inside a function runtime to exchange user |
| 42 | * pool / social / OIDC tokens (or nothing, for guest access) for an identity |
| 43 | * ID and temporary AWS credentials. These operations are unauthenticated |
| 44 | * (Cognito does not evaluate IAM for them), so the binding grants no IAM |
| 45 | * policy — it injects the identity pool ID into `getId`. |
| 46 | * ### Vending AWS Credentials |
| 47 | * **Example:** Guest (Unauthenticated) Credentials |
| 48 | * ```typescript |
| 49 | * const identity = yield* Cognito.IdentityPoolAuth(identityPool); |
| 50 | * |
| 51 | * const { IdentityId } = yield* identity.getId(); |
| 52 | * const creds = yield* identity.getCredentialsForIdentity({ |
| 53 | * IdentityId: IdentityId!, |
| 54 | * }); |
| 55 | * ``` |
| 56 | * |
| 57 | * **Example:** Credentials for a User Pool Sign-In |
| 58 | * ```typescript |
| 59 | * const provider = `cognito-idp.${region}.amazonaws.com/${userPoolId}`; |
| 60 | * const { IdentityId } = yield* identity.getId({ |
| 61 | * Logins: { [provider]: idToken }, |
| 62 | * }); |
| 63 | * const creds = yield* identity.getCredentialsForIdentity({ |
| 64 | * IdentityId: IdentityId!, |
| 65 | * Logins: { [provider]: idToken }, |
| 66 | * }); |
| 67 | * ``` |
| 68 | * |
| 69 | * @binding |
| 70 | */ |
| 71 | export interface IdentityPoolAuth extends Binding.Service< |
| 72 | IdentityPoolAuth, |
| 73 | "AWS.Cognito.IdentityPoolAuth", |
| 74 | <P extends IdentityPool>(pool: P) => Effect.Effect<IdentityPoolAuthClient> |
| 75 | > {} |
| 76 | export const IdentityPoolAuth = Binding.Service<IdentityPoolAuth>( |
| 77 | "AWS.Cognito.IdentityPoolAuth", |
| 78 | ); |