import { CodeGenDirectives , CodeGenDirective } from '../visitors/appsync-visitor' ; export enum AuthProvider { apiKey = 'apiKey' , iam = 'iam' , oidc = 'oidc' , userPools = 'userPools' } export enum AuthStrategy { owner = 'owner' , groups = 'groups' , private = 'private' , public = 'public' } export enum AuthModelOperation { create = 'create' , update = 'update' , delete = 'delete' , read = 'read' } export enum AuthModelMutation { create = 'create' , update = 'update' , delete = 'delete' } const DEFAULT_GROUP_CLAIM = 'cognito:groups' ; const DEFAULT_IDENTITY_CLAIM = 'username' ; const DEFAULT_OPERATIONS = [ AuthModelOperation . create , AuthModelOperation . update , AuthModelOperation . delete , AuthModelOperation . read ] ; const DEFAULT_AUTH_PROVIDER = AuthProvider . userPools ; const DEFAULT_OWNER_FIELD = 'owner' ; const DEFAULT_GROUPS_FIELD = 'groups' ; export type AuthRule = { allow : AuthStrategy ; provider ? : AuthProvider ; operations : ( AuthModelOperation | AuthModelMutation ) [ ] ; groupField ? : string ; ownerField ? : string ; groups ? : string [ ] ; identityField ? : string ; identityClaim ? : string ; groupClaim ? : string ; mutations ? : AuthModelMutation [ ] ; } ; export type AuthDirective = CodeGenDirective & { arguments : { rules : AuthRule [ ] ; } ; } ; export function processAuthDirective ( directives ) { const authDirectives = directives . filter ( d => d . name === 'auth' ) ; return authDirectives . map ( d => { const authRules = d . arguments . rules || [ ] ; const processedRules = authRules . filter ( ( rule ) => ! ( rule . allow === AuthStrategy . groups && rule . groupField ) ) . map ( ( rule ) => { const operations = rule . operations || rule . mutations || DEFAULT_OPERATIONS ; const identityClaim = rule . identityClaim || rule . identityField || DEFAULT_IDENTITY_CLAIM ; if ( rule . allow === AuthStrategy . owner ) { return { provider : DEFAULT_AUTH_PROVIDER , ownerField : rule . ownerField ? rule . ownerField : DEFAULT_OWNER_FIELD , ... rule , identityClaim : identityClaim === 'username' ? 'cognito:username' : identityClaim , operations , } ; } else if ( rule . allow === AuthStrategy . groups ) { return { groupClaim : DEFAULT_GROUP_CLAIM , provider : DEFAULT_AUTH_PROVIDER , ... rule , groupField : rule . groups ? undefined : rule . groupField || DEFAULT_GROUPS_FIELD , operations , } ; } return { ... rule , operations } ; } ) ; return { ... d , arguments : { ... d . arguments , rules : processedRules , } , } ; } ) ; }