Cognito User Pool Construct¶

using Amazon.CDK;
using Amazon.CDK.AWS.Cognito;
using LayeredCraft.Cdk.Constructs;
using LayeredCraft.Cdk.Constructs.Models;

public class MyStack : Stack
{
    public MyStack(Construct scope, string id, IStackProps props = null) : base(scope, id, props)
    {
        var pool = new CognitoUserPoolConstruct(this, "my-user-pool", new CognitoUserPoolConstructProps
        {
            UserPoolName = "my-app-users",
            SelfSignUpEnabled = true,
            Domain = new CognitoUserPoolDomainProps
            {
                CognitoDomainPrefix = "my-app-auth",
            },
            AppClients =
            [
                new CognitoUserPoolAppClientProps
                {
                    Name = "my-web-app",
                    CallbackUrls = ["https://example.com/authentication/login-callback"],
                    LogoutUrls = ["https://example.com"],
                    AllowedOAuthScopes = [OAuthScope.OPENID, OAuthScope.EMAIL, OAuthScope.PROFILE],
                },
            ],
        });
    }
}

var pool = new CognitoUserPoolConstruct(this, "auth-pool", new CognitoUserPoolConstructProps
{
    UserPoolName = "my-app-users",
    Domain = new CognitoUserPoolDomainProps
    {
        DomainName = "example.com",       // Hosted zone must exist in this account
        AuthSubDomain = "auth",           // → auth.example.com
        ManagedLoginVersion = CognitoManagedLoginVersion.ManagedLogin,
        CreateRoute53Record = true,
    },
    AppClients =
    [
        new CognitoUserPoolAppClientProps
        {
            Name = "web-app",
            CallbackUrls = ["https://example.com/authentication/login-callback"],
            LogoutUrls = ["https://example.com"],
            AllowedOAuthScopes = [OAuthScope.OPENID, OAuthScope.EMAIL, OAuthScope.PROFILE],
        },
    ],
});

var pool = new CognitoUserPoolConstruct(this, "auth-pool", new CognitoUserPoolConstructProps
{
    UserPoolName = "my-api-users",
    Domain = new CognitoUserPoolDomainProps { CognitoDomainPrefix = "my-api-auth" },
    ResourceServers =
    [
        new CognitoResourceServerProps
        {
            Name = "My API",
            Identifier = "my-api",
            Scopes =
            [
                new CognitoResourceServerScopeProps { Name = "read",  Description = "Read access" },
                new CognitoResourceServerScopeProps { Name = "write", Description = "Write access" },
            ],
        },
    ],
    AppClients =
    [
        new CognitoUserPoolAppClientProps
        {
            Name = "my-web-app",
            CallbackUrls = ["https://example.com/callback"],
            LogoutUrls = ["https://example.com"],
            AllowedOAuthScopes =
            [
                OAuthScope.OPENID,
                OAuthScope.EMAIL,
                OAuthScope.Custom("my-api/read"),
            ],
        },
    ],
});

new CognitoUserPoolAppClientProps
{
    Name = "backend-service",
    GenerateSecret = true,
    CallbackUrls = [],
    LogoutUrls = [],
    AuthorizationCodeGrant = false,
    ImplicitCodeGrant = false,
    ClientCredentials = true,
    AllowedOAuthScopes = [OAuthScope.Custom("my-api/read")],
    SupportedIdentityProviders = [],
},

var pool = new CognitoUserPoolConstruct(this, "auth-pool", new CognitoUserPoolConstructProps
{
    UserPoolName = "my-app-users",
    Groups =
    [
        new CognitoUserPoolGroupProps(Name: "admin",  Description: "Administrators", Precedence: 1),
        new CognitoUserPoolGroupProps(Name: "player", Description: "Regular players",  Precedence: 2),
    ],
    // ... domain and app clients
});

new CognitoUserPoolAppClientProps
{
    Name = "my-web-app",
    CallbackUrls = ["https://example.com/callback"],
    LogoutUrls = ["https://example.com"],
    AllowedOAuthScopes = [OAuthScope.OPENID, OAuthScope.EMAIL],
    ManagedLoginBranding = new CognitoManagedLoginBrandingProps(
        SettingsJson: MyBrandingConstants.SettingsJson),
},

// In the consuming stack:
var userPoolId = Fn.ImportValue("my-infra-stack-prod-auth-pool-user-pool-id");
var clientId   = Fn.ImportValue("my-infra-stack-prod-auth-pool-client-my-web-app-id");

var props = new CognitoUserPoolConstructPropsBuilder()
    .WithUserPoolName("my-pool")
    .WithSelfSignUpEnabled(true)
    .WithCognitoDomain("my-pool-auth")
    .AddResourceServer("My API", "my-api",
        scopes: [new CognitoResourceServerScopeProps { Name = "read", Description = "Read" }])
    .AddWebAppClient(
        name: "web-app",
        callbackUrls: ["https://example.com/callback"],
        logoutUrls: ["https://example.com"])
    .AddGroup("admin", description: "Admins", precedence: 1)
    .Build();

var props = new CognitoUserPoolConstructPropsBuilder()
    .ForWebApplication(userPoolName: "my-pool", cognitoDomainPrefix: "my-pool-auth")
    .Build();

// Pool and domain
template.ShouldHaveUserPool("my-app-users");
template.ShouldHaveCognitoUserPoolDomain("my-pool-auth");

// App clients and resource servers
template.ShouldHaveUserPoolClient("web-app");
template.ShouldHaveResourceServer("my-api");

// Groups
template.ShouldHaveUserPoolGroup("admin");

// Managed Login branding
template.ShouldHaveManagedLoginBranding();
template.ShouldNotHaveManagedLoginBranding();

// CloudFormation exports
template.ShouldExportUserPoolId("test-stack", "auth-pool");
template.ShouldExportUserPoolArn("test-stack", "auth-pool");
template.ShouldExportAppClientId("test-stack", "auth-pool", "web-app");

[Theory]
[CognitoUserPoolConstructAutoData]
public void Should_Create_User_Pool(CognitoUserPoolConstructProps props)
{
    // props generated with sensible defaults (no branding)
}

[Theory]
[CognitoUserPoolConstructAutoData(includeBranding: true)]
public void Should_Create_User_Pool_With_Branding(CognitoUserPoolConstructProps props)
{
    // props generated with Managed Login branding included
}