Skip to content

Commit 3b32d09

Browse files
benbpylebenbpyle
authored
Add Event Definition for CognitoEventUserPoolsPreTokenGenV2 (#764)
The added structs allow for the processing of Version 2 Cognito PreToken generation in a Lambda The V2 payloads allow for customization of the Access Token in addition to the ID Token which was already supported
1 parent ee7dcd7 commit 3b32d09

File tree

3 files changed

+170
-0
lines changed

3 files changed

+170
-0
lines changed

‎lambda-events/src/event/cognito/mod.rs

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -213,6 +213,65 @@ pub struct CognitoEventUserPoolsPreTokenGenResponse {
213213
pub claims_override_details: Option<ClaimsOverrideDetails>,
214214
}
215215

216+
/// `CognitoEventUserPoolsPreTokenGenV2` is sent by AWS Cognito User Pools when a user attempts to retrieve
217+
/// credentials, allowing a Lambda to perform insert, suppress or override claims. This is the Version 2 Payload
218+
#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
219+
#[serde(rename_all = "camelCase")]
220+
pub struct CognitoEventUserPoolsPreTokenGenV2 {
221+
#[serde(rename = "CognitoEventUserPoolsHeader")]
222+
#[serde(flatten)]
223+
pub cognito_event_user_pools_header: CognitoEventUserPoolsHeader,
224+
pub request: CognitoEventUserPoolsPreTokenGenRequestV2,
225+
pub response: CognitoEventUserPoolsPreTokenGenResponseV2,
226+
}
227+
228+
/// `CognitoEventUserPoolsPreTokenGenRequestV2` contains request portion of PreTokenGenV2 event
229+
#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
230+
#[serde(rename_all = "camelCase")]
231+
pub struct CognitoEventUserPoolsPreTokenGenRequestV2 {
232+
#[serde(deserialize_with = "deserialize_lambda_map")]
233+
#[serde(default)]
234+
pub user_attributes: HashMap<String, String>,
235+
pub group_configuration: GroupConfiguration,
236+
#[serde(deserialize_with = "deserialize_lambda_map")]
237+
#[serde(default)]
238+
pub client_metadata: HashMap<String, String>,
239+
pub scopes: Vec<String>,
240+
}
241+
242+
#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
243+
#[serde(rename_all = "camelCase")]
244+
pub struct CognitoEventUserPoolsPreTokenGenResponseV2 {
245+
pub claims_and_scope_override_details: Option<ClaimsAndScopeOverrideDetailsV2>,
246+
}
247+
248+
/// `ClaimsAndScopeOverrideDetailsV2` allows lambda to add, suppress or override claims in the token
249+
#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
250+
#[serde(rename_all = "camelCase")]
251+
pub struct ClaimsAndScopeOverrideDetailsV2 {
252+
pub group_override_details: GroupConfiguration,
253+
pub id_token_generation: Option<CognitoIdTokenGenerationV2>,
254+
pub access_token_generation: Option<CognitoAccessTokenGenerationV2>,
255+
}
256+
257+
/// `CognitoIdTokenGenerationV2` allows lambda to customize the ID Token before generation
258+
#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
259+
#[serde(rename_all = "camelCase")]
260+
pub struct CognitoIdTokenGenerationV2 {
261+
pub claims_to_add_or_override: HashMap<String, String>,
262+
pub claims_to_suppress: Vec<String>,
263+
}
264+
265+
/// `CognitoAccessTokenGenerationV2` allows lambda to customize the Access Token before generation
266+
#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
267+
#[serde(rename_all = "camelCase")]
268+
pub struct CognitoAccessTokenGenerationV2 {
269+
pub claims_to_add_or_override: HashMap<String, String>,
270+
pub claims_to_suppress: Vec<String>,
271+
pub scopes_to_add: Vec<String>,
272+
pub scopes_to_suppress: Vec<String>,
273+
}
274+
216275
/// `CognitoEventUserPoolsPostAuthenticationRequest` contains the request portion of a PostAuthentication event
217276
#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
218277
#[serde(rename_all = "camelCase")]
@@ -608,6 +667,16 @@ mod test {
608667
assert_eq!(parsed, reparsed);
609668
}
610669

670+
#[test]
671+
#[cfg(feature = "cognito")]
672+
fn example_cognito_event_userpools_pretokengen_v2_incoming() {
673+
let data = include_bytes!("../../fixtures/example-cognito-event-userpools-pretokengen-v2-incoming.json");
674+
let parsed: CognitoEventUserPoolsPreTokenGenV2 = serde_json::from_slice(data).unwrap();
675+
let output: String = serde_json::to_string(&parsed).unwrap();
676+
let reparsed: CognitoEventUserPoolsPreTokenGenV2 = serde_json::from_slice(output.as_bytes()).unwrap();
677+
assert_eq!(parsed, reparsed);
678+
}
679+
611680
#[test]
612681
#[cfg(feature = "cognito")]
613682
fn example_cognito_event_userpools_pretokengen() {
@@ -618,6 +687,16 @@ mod test {
618687
assert_eq!(parsed, reparsed);
619688
}
620689

690+
#[test]
691+
#[cfg(feature = "cognito")]
692+
fn example_cognito_event_userpools_v2_pretokengen() {
693+
let data = include_bytes!("../../fixtures/example-cognito-event-userpools-pretokengen-v2.json");
694+
let parsed: CognitoEventUserPoolsPreTokenGenV2 = serde_json::from_slice(data).unwrap();
695+
let output: String = serde_json::to_string(&parsed).unwrap();
696+
let reparsed: CognitoEventUserPoolsPreTokenGenV2 = serde_json::from_slice(output.as_bytes()).unwrap();
697+
assert_eq!(parsed, reparsed);
698+
}
699+
621700
#[test]
622701
#[cfg(feature = "cognito")]
623702
fn example_cognito_event_userpools_verify_auth_challenge() {

‎lambda-events/src/fixtures/example-cognito-event-userpools-pretokengen-v2-incoming.json

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"version": "1",
3+
"triggerSource": "PreTokenGen",
4+
"region": "region",
5+
"userPoolId": "userPoolId",
6+
"userName": "userName",
7+
"callerContext": {
8+
"awsSdkVersion": "calling aws sdk with version",
9+
"clientId": "apps client id"
10+
},
11+
"request": {
12+
"userAttributes": {
13+
"email": "email",
14+
"phone_number": "phone_number"
15+
},
16+
"scopes": ["scope-1", "scope-2"],
17+
"groupConfiguration": {
18+
"groupsToOverride": ["group-A", "group-B", "group-C"],
19+
"iamRolesToOverride": [
20+
"arn:aws:iam::XXXXXXXXXXXX:role/sns_callerA",
21+
"arn:aws:iam::XXXXXXXXX:role/sns_callerB",
22+
"arn:aws:iam::XXXXXXXXXX:role/sns_callerC"
23+
],
24+
"preferredRole": "arn:aws:iam::XXXXXXXXXXX:role/sns_caller"
25+
},
26+
"clientMetadata": {
27+
"exampleMetadataKey": "example metadata value"
28+
}
29+
},
30+
"response": {
31+
"claimsOverrideDetails": null
32+
}
33+
}

‎lambda-events/src/fixtures/example-cognito-event-userpools-pretokengen-v2.json

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{
2+
"version": "1",
3+
"triggerSource": "PreTokenGen",
4+
"region": "region",
5+
"userPoolId": "userPoolId",
6+
"userName": "userName",
7+
"callerContext": {
8+
"awsSdkVersion": "calling aws sdk with version",
9+
"clientId": "apps client id"
10+
},
11+
"request": {
12+
"userAttributes": {
13+
"email": "email",
14+
"phone_number": "phone_number"
15+
},
16+
"scopes": ["scope-1", "scope-2"],
17+
"groupConfiguration": {
18+
"groupsToOverride": ["group-A", "group-B", "group-C"],
19+
"iamRolesToOverride": [
20+
"arn:aws:iam::XXXXXXXXXXXX:role/sns_callerA",
21+
"arn:aws:iam::XXXXXXXXX:role/sns_callerB",
22+
"arn:aws:iam::XXXXXXXXXX:role/sns_callerC"
23+
],
24+
"preferredRole": "arn:aws:iam::XXXXXXXXXXX:role/sns_caller"
25+
},
26+
"clientMetadata": {
27+
"exampleMetadataKey": "example metadata value"
28+
}
29+
},
30+
"response": {
31+
"claimsAndScopeOverrideDetails": {
32+
"idTokenGeneration": {
33+
"claimsToAddOrOverride": {
34+
"string": "string"
35+
},
36+
"claimsToSuppress": ["string", "string"]
37+
},
38+
"accessTokenGeneration": {
39+
"claimsToAddOrOverride": {
40+
"attribute_key2": "attribute_value2",
41+
"attribute_key": "attribute_value"
42+
},
43+
"claimsToSuppress": ["email", "phone"],
44+
"scopesToAdd": ["scope-B", "scope-B"],
45+
"scopesToSuppress": ["scope-C", "scope-D"]
46+
},
47+
"groupOverrideDetails": {
48+
"groupsToOverride": ["group-A", "group-B", "group-C"],
49+
"iamRolesToOverride": [
50+
"arn:aws:iam::XXXXXXXXXXXX:role/sns_callerA",
51+
"arn:aws:iam::XXXXXXXXX:role/sns_callerB",
52+
"arn:aws:iam::XXXXXXXXXX:role/sns_callerC"
53+
],
54+
"preferredRole": "arn:aws:iam::XXXXXXXXXXX:role/sns_caller"
55+
}
56+
}
57+
}
58+
}

0 commit comments

Comments
 (0)