feat(frontend): hosted sign-in and OAuth settings for Cognito app clients

packages/frontend/src/components/CognitoUsersPanel.test.tsx

@@ -17,6 +17,8 @@ const api = vi.hoisted(() => ({
     createUserPoolGroup: vi.fn(),
     deleteUserPoolGroup: vi.fn(),
     testUserPoolSignIn: vi.fn(),
+    describeUserPoolClient: vi.fn(),
+    updateUserPoolClientOAuth: vi.fn(),
 }))
 
 vi.mock('@/api/cloudProxyClient', () => api)
@@ -82,6 +84,32 @@ test('says when a pool has no Lambda triggers', async () => {
     expect(await screen.findByText('This pool runs no Lambda triggers.')).toBeInTheDocument()
 })
 
+test('turns on hosted sign-in for an app client', async () => {
+    const user = userEvent.setup()
+    const settings = {clientId: 'a8e5c7d38d3b4a1a97c9d822de', clientName: 'orders-users-client', hasSecret: false, explicitAuthFlows: ['ALLOW_REFRESH_TOKEN_AUTH'],
+        callbackUrls: [], logoutUrls: [], oauthFlows: [], oauthScopes: [], identityProviders: ['COGNITO']}
+    api.getCloudResource.mockResolvedValue(pool('email'))
+    api.describeUserPoolClient.mockResolvedValue(settings)
+    api.updateUserPoolClientOAuth.mockImplementation(async (_cloud, _pool, _client, input) => ({...settings, ...input}))
+    renderPanel()
+
+    await user.click(await screen.findByRole('button', {name: 'Manage app client orders-users-client'}))
+    const form = await screen.findByRole('form', {name: 'Hosted sign-in settings'})
+    expect(within(form).getByRole('checkbox', {name: /Client credentials/})).toBeDisabled()
+    await user.click(within(form).getByRole('checkbox', {name: /Authorization code/}))
+    await user.click(within(form).getByRole('checkbox', {name: 'openid'}))
+    await user.click(within(form).getByRole('checkbox', {name: 'email'}))
+    await user.type(within(form).getByLabelText(/Callback URLs/), 'http://localhost:4600/api/auth/callback')
+    await user.type(within(form).getByLabelText(/Sign-out URLs/), 'http://localhost:4600/')
+    await user.click(within(form).getByRole('button', {name: 'Save settings'}))
+
+    expect(api.updateUserPoolClientOAuth).toHaveBeenCalledWith('aws', summary.id, 'a8e5c7d38d3b4a1a97c9d822de', {
+        callbackUrls: ['http://localhost:4600/api/auth/callback'], logoutUrls: ['http://localhost:4600/'],
+        oauthFlows: ['code'], oauthScopes: ['openid', 'email'], identityProviders: ['COGNITO'],
+    })
+    expect(await screen.findByText(/can now send users to the hosted login page/)).toBeInTheDocument()
+})
+
 test('creates an email user who can sign in immediately', async () => {
     const user = userEvent.setup()
     api.getCloudResource.mockResolvedValue(pool('email'))