feat(frontend): hosted sign-in and OAuth settings for Cognito app clients

packages/api/src/cloud-spi/types.ts

@@ -178,6 +178,8 @@ export type UserPoolActionName =
     | 'createGroup'
     | 'deleteGroup'
     | 'testSignIn'
+    | 'describeClient'
+    | 'updateClientOAuth'
 export type CapabilityStatus = 'available' | 'blocked' | 'partial' | 'coming_soon'
 
 export interface CapabilitySchema<TAction extends string> {
@@ -453,6 +455,29 @@ export interface UserPoolSignInTestInput {
 }
 
 /** Decoded claims only: the console shows what a sign-in yields without handing out tokens. */
+export type UserPoolOAuthFlow = 'code' | 'implicit' | 'client_credentials'
+
+/** The app client settings that decide how the hosted login and OAuth endpoints treat it. */
+export interface UserPoolClientSettings {
+    clientId: string
+    clientName: string
+    hasSecret: boolean
+    explicitAuthFlows: string[]
+    callbackUrls: string[]
+    logoutUrls: string[]
+    oauthFlows: UserPoolOAuthFlow[]
+    oauthScopes: string[]
+    identityProviders: string[]
+}
+
+export interface UpdateUserPoolClientOAuthInput {
+    callbackUrls: string[]
+    logoutUrls: string[]
+    oauthFlows: UserPoolOAuthFlow[]
+    oauthScopes: string[]
+    identityProviders: string[]
+}
+
 export type UserPoolSignInTestResult =
     | {outcome: 'signed-in'; expiresIn: number | null; idToken: Record<string, unknown>; accessToken: Record<string, unknown>}
     | {outcome: 'challenge'; challengeName: string}
@@ -970,6 +995,8 @@ export interface CloudServiceAdapter {
     createUserPoolGroup?(poolId: string, input: CreateUserPoolGroupInput): Promise<UserPoolGroup>
     deleteUserPoolGroup?(poolId: string, groupName: string): Promise<void>
     testUserPoolSignIn?(poolId: string, input: UserPoolSignInTestInput): Promise<UserPoolSignInTestResult>
+    describeUserPoolClient?(poolId: string, clientId: string): Promise<UserPoolClientSettings>
+    updateUserPoolClientOAuth?(poolId: string, clientId: string, input: UpdateUserPoolClientOAuthInput): Promise<UserPoolClientSettings>
     /** Clears the provider's locally captured email inbox, if it exposes one. */
     clearEmailInbox?(): Promise<void>
     // AppConfig nested resources, keyed by the ids the provider needs. Inspect

packages/api/src/cloud-spi/userPoolsSchema.ts

@@ -81,6 +81,8 @@ export function awsUserPoolsSchema(): ServiceSchema {
                 {name: 'createGroup', label: 'Create group', enabled: true, status: 'available', runtimeRequired: true},
                 {name: 'deleteGroup', label: 'Delete group', enabled: true, status: 'available', runtimeRequired: true},
                 {name: 'testSignIn', label: 'Test sign-in', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'describeClient', label: 'Show app client settings', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'updateClientOAuth', label: 'Change hosted sign-in and OAuth settings', enabled: true, status: 'available', runtimeRequired: true},
             ],
         },
         filters: userPoolFilters,
@@ -92,6 +94,10 @@ export function awsUserPoolsSchema(): ServiceSchema {
     }
 }
 
+export const USER_POOL_OAUTH_FLOWS = ['code', 'implicit', 'client_credentials'] as const
+/** Scopes every pool offers; resource servers can add their own. */
+export const USER_POOL_STANDARD_SCOPES = ['openid', 'email', 'phone', 'profile', 'aws.cognito.signin.user.admin'] as const
+
 export function userPoolsSchemaFor(cloud: CloudProvider): ServiceSchema | null {
     return cloud === 'aws' ? awsUserPoolsSchema() : null
 }