cognitoidentity

package
v1.1.4 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 20, 2026 License: MIT Imports: 23 Imported by: 0

README

Cognito Identity

Parity grade: A · SDK aws-sdk-go-v2/service/cognitoidentity@v1.33.20 · last audited 2026-07-13 (659c9617)

Coverage

Metric Value
Operations audited 23 (23 ok)
Known gaps 2
Deferred items 1
Resource leaks clean
Known gaps
  • GetOpenIdTokenForDeveloperIdentity accepts a PrincipalTags request field (SDK-modeled) but the backend never stores/applies it; our OpenID tokens are synthetic strings, not real JWTs with claims, so there is nowhere to embed the tags. Low priority (niche custom-provider attribute-mapping feature).
  • SetIdentityPoolRoles/GetOpenIdTokenForDeveloperIdentity TokenDuration are accepted/validated but not enforced against issued token lifetime (tokens are opaque synthetic strings, not real expiring JWTs).
Deferred
  • HTTP status code choice for NotAuthorizedException (403 here) vs AWS's actual per-exception status (SDK error-type resolution is body-driven, not status-code-driven, so this doesn't break aws-sdk-go-v2 clients; only relevant to tooling that inspects raw HTTP status).

More

Documentation

Overview

Package cognitoidentity provides a mock implementation of the AWS Cognito Federated Identities service.

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrIdentityPoolNotFound is returned when the requested identity pool does not exist.
	ErrIdentityPoolNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)

	// ErrIdentityPoolAlreadyExists is returned when an identity pool with the given name already exists.
	ErrIdentityPoolAlreadyExists = awserr.New("ResourceConflictException", awserr.ErrAlreadyExists)

	// ErrInvalidParameter is returned when an invalid or missing parameter is supplied.
	ErrInvalidParameter = awserr.New("InvalidParameterException", awserr.ErrInvalidParameter)

	// ErrNotAuthorized is returned when the caller lacks required permissions.
	ErrNotAuthorized = awserr.New("NotAuthorizedException", awserr.ErrInvalidParameter)
)

Sentinel errors for Cognito Identity Pool operations.

Functions

This section is empty.

Types

type Credentials 

type Credentials struct {
	Expiration      time.Time
	AccessKeyID     string
	SecretAccessKey string
	SessionToken    string
	IdentityID      string
}

Credentials holds temporary AWS credentials returned by GetCredentialsForIdentity.

type DeveloperOpenIDToken 

type DeveloperOpenIDToken struct {
	IdentityID string
	Token      string
}

DeveloperOpenIDToken is the result of GetOpenIDTokenForDeveloperIdentity.

type Handler 

type Handler struct {
	Backend *InMemoryBackend
	// contains filtered or unexported fields
}

Handler is the Echo HTTP handler for Cognito Identity Pool operations.

func NewHandler 

func NewHandler(backend *InMemoryBackend, region string) *Handler

NewHandler creates a new Cognito Identity handler.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this Cognito Identity instance handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the Cognito Identity action from the X-Amz-Target header.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource extracts the identity pool or identity resource from the request.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all backend state and rebuilds the dispatch table.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches Cognito Identity requests.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

type Identity 

type Identity struct {
	CreatedAt        time.Time         `json:"createdAt"`
	LastModifiedDate time.Time         `json:"lastModifiedDate"`
	Logins           map[string]string `json:"logins,omitempty"`
	IdentityID       string            `json:"identityID"`
	IdentityPoolID   string            `json:"identityPoolID"`

	Enabled bool `json:"enabled"`
	// contains filtered or unexported fields
}

Identity represents a federated identity.

type IdentityDescription 

type IdentityDescription struct {
	CreationDate     time.Time `json:"creationDate"`
	LastModifiedDate time.Time `json:"lastModifiedDate"`
	IdentityID       string    `json:"identityId"`
	Logins           []string  `json:"logins,omitempty"`
}

IdentityDescription describes a federated identity, including its login providers.

type IdentityPool 

type IdentityPool struct {
	CreatedAt                 time.Time         `json:"createdAt"`
	SupportedLoginProviders   map[string]string `json:"supportedLoginProviders,omitempty"`
	Tags                      map[string]string `json:"tags,omitempty"`
	OpenIDConnectProviderARNs []string          `json:"openIdConnectProviderARNs,omitempty"`
	SamlProviderARNs          []string          `json:"samlProviderARNs,omitempty"`
	IdentityPoolID            string            `json:"identityPoolID"`
	IdentityPoolName          string            `json:"identityPoolName"`
	ARN                       string            `json:"arn"`
	DeveloperProviderName     string            `json:"developerProviderName,omitempty"`

	IdentityProviders              []IdentityProvider `json:"identityProviders,omitempty"`
	AllowUnauthenticatedIdentities bool               `json:"allowUnauthenticatedIdentities"`
	AllowClassicFlow               bool               `json:"allowClassicFlow"`
	// contains filtered or unexported fields
}

IdentityPool represents an Amazon Cognito Identity Pool.

type IdentityProvider 

type IdentityProvider struct {
	ProviderName         string `json:"providerName"`
	ClientID             string `json:"clientID"`
	ServerSideTokenCheck bool   `json:"serverSideTokenCheck"`
}

IdentityProvider represents a linked Cognito User Pool provider.

type IdentityRoles 

type IdentityRoles struct {
	RoleMappings           map[string]RoleMapping `json:"roleMappings,omitempty"`
	AuthenticatedRoleARN   string                 `json:"authenticatedRoleARN"`
	UnauthenticatedRoleARN string                 `json:"unauthenticatedRoleARN"`
	// contains filtered or unexported fields
}

IdentityRoles holds IAM role mappings for an identity pool.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the in-memory store for Cognito Identity Pool resources.

The four resource collections below were previously nested by region (outer key = region, e.g. map[string]map[string]*IdentityPool) so that same-named resources are isolated across regions. Each is now a flat *store.Table keyed by the composite "region|id" string (see regionKey), with companion *store.Index values replacing the old reverse-lookup maps (poolsByName, poolsByARN, identitiesByPool) and the prefix-scan used to purge a pool's principal-tag mappings. Callers must hold b.mu while accessing any table or index, exactly as they held it for the old maps -- store.Table and store.Index perform no locking of their own.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend creates a new InMemoryBackend.

func (*InMemoryBackend) AddIdentityInternal 

func (b *InMemoryBackend) AddIdentityInternal(identity *Identity)

AddIdentityInternal seeds an identity directly into the backend for testing purposes. The region is derived from the identity's IdentityPoolID prefix (format: "region:uuid").

func (*InMemoryBackend) AddPoolInternal 

func (b *InMemoryBackend) AddPoolInternal(pool *IdentityPool)

AddPoolInternal seeds an identity pool directly into the backend for testing purposes. It bypasses the normal CreateIdentityPool validation. The region is derived from the pool's ARN.

func (*InMemoryBackend) CreateIdentityPool 

func (b *InMemoryBackend) CreateIdentityPool(
	ctx context.Context,
	name string,
	allowUnauthenticated bool,
	allowClassicFlow bool,
	developerProviderName string,
	providers []IdentityProvider,
	supportedLoginProviders map[string]string,
	tags map[string]string,
	opts ...*PoolExtendedConfig,
) (*IdentityPool, error)

CreateIdentityPool creates a new identity pool.

func (*InMemoryBackend) DeleteIdentities 

func (b *InMemoryBackend) DeleteIdentities(
	ctx context.Context,
	identityIDs []string,
) ([]UnprocessedIdentityID, error)

DeleteIdentities deletes the given identity IDs from the backend. Identities that do not exist are silently skipped. Returns a (possibly empty) list of IDs that could not be processed.

func (*InMemoryBackend) DeleteIdentityPool 

func (b *InMemoryBackend) DeleteIdentityPool(ctx context.Context, poolID string) error

DeleteIdentityPool removes an identity pool and all associated identities, roles, and principal-tag configurations.

func (*InMemoryBackend) DescribeIdentity 

func (b *InMemoryBackend) DescribeIdentity(
	ctx context.Context,
	identityID string,
) (*IdentityDescription, error)

DescribeIdentity returns metadata about a specific federated identity.

func (*InMemoryBackend) DescribeIdentityPool 

func (b *InMemoryBackend) DescribeIdentityPool(
	ctx context.Context,
	poolID string,
) (*IdentityPool, error)

DescribeIdentityPool returns the identity pool with the given ID.

func (*InMemoryBackend) GetCredentialsForIdentity 

func (b *InMemoryBackend) GetCredentialsForIdentity(
	ctx context.Context,
	identityID string,
	logins map[string]string,
) (*Credentials, error)

GetCredentialsForIdentity returns synthetic temporary AWS credentials for an identity.

func (*InMemoryBackend) GetID 

func (b *InMemoryBackend) GetID(
	ctx context.Context,
	poolID string,
	_ string,
	logins map[string]string,
) (*Identity, error)

GetID returns an existing identity or creates a new one for the given pool and logins.

func (*InMemoryBackend) GetIdentityPoolRoles 

func (b *InMemoryBackend) GetIdentityPoolRoles(
	ctx context.Context,
	poolID string,
) (*IdentityRoles, error)

GetIdentityPoolRoles returns the IAM roles configured for an identity pool.

func (*InMemoryBackend) GetOpenIDToken 

func (b *InMemoryBackend) GetOpenIDToken(
	ctx context.Context,
	identityID string,
	_ map[string]string,
) (*OpenIDToken, error)

GetOpenIDToken returns a synthetic OpenID Connect token for an identity.

func (*InMemoryBackend) GetOpenIDTokenForDeveloperIdentity 

func (b *InMemoryBackend) GetOpenIDTokenForDeveloperIdentity(
	ctx context.Context,
	poolID string,
	identityID string,
	logins map[string]string,
	tokenDuration int64,
) (*DeveloperOpenIDToken, error)

GetOpenIDTokenForDeveloperIdentity registers or retrieves an identity for a developer authenticated user, then returns a synthetic OpenID token.

func (*InMemoryBackend) GetPrincipalTagAttributeMap 

func (b *InMemoryBackend) GetPrincipalTagAttributeMap(
	ctx context.Context,
	poolID, providerName string,
) (*PrincipalTagMapping, error)

GetPrincipalTagAttributeMap returns the principal tag attribute map for a pool and provider.

func (*InMemoryBackend) ListIdentities 

func (b *InMemoryBackend) ListIdentities(
	ctx context.Context,
	poolID string,
	maxResults int,
	hideDisabled bool,
	nextToken string,
) (*ListIdentitiesResult, error)

ListIdentities returns identities associated with an identity pool, sorted by IdentityId. nextToken is an opaque cursor encoding the last-returned IdentityId for pagination.

func (*InMemoryBackend) ListIdentityPools 

func (b *InMemoryBackend) ListIdentityPools(
	ctx context.Context,
	maxResults int,
	nextToken string,
) ([]*IdentityPool, string)

ListIdentityPools returns all identity pools sorted by name, up to maxResults (0 = all). nextToken is an opaque cursor that encodes the last-returned pool name for pagination.

func (*InMemoryBackend) ListTagsForResource 

func (b *InMemoryBackend) ListTagsForResource(
	ctx context.Context,
	resourceARN string,
) (map[string]string, error)

ListTagsForResource returns the tags for an identity pool resource by its ARN.

func (*InMemoryBackend) LookupDeveloperIdentity 

func (b *InMemoryBackend) LookupDeveloperIdentity(
	ctx context.Context,
	poolID string,
	identityID string,
	developerUserIdentifier string,
	developerProviderName string,
) (*LookupDeveloperIdentityResult, error)

LookupDeveloperIdentity retrieves the identity associated with a developer user identifier or the list of developer user identifiers associated with an identity.

func (*InMemoryBackend) MergeDeveloperIdentities 

func (b *InMemoryBackend) MergeDeveloperIdentities(
	ctx context.Context,
	sourceUserID string,
	destUserID string,
	developerProviderName string,
	poolID string,
) (*Identity, error)

MergeDeveloperIdentities merges the source identity into the destination identity.

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the region this backend is configured for.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all identity pool, identity and role state.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot. It implements persistence.Persistable.

func (*InMemoryBackend) SetIdentityPoolRoles 

func (b *InMemoryBackend) SetIdentityPoolRoles(
	ctx context.Context,
	poolID, authenticatedARN, unauthenticatedARN string,
	roleMappings map[string]RoleMapping,
) error

SetIdentityPoolRoles configures IAM roles for an identity pool. Only the roles that are present (non-empty) in the provided map are updated; existing roles for omitted keys are preserved.

func (*InMemoryBackend) SetPrincipalTagAttributeMap 

func (b *InMemoryBackend) SetPrincipalTagAttributeMap(
	ctx context.Context,
	poolID string,
	providerName string,
	useDefaults bool,
	principalTags map[string]string,
) (*PrincipalTagMapping, error)

SetPrincipalTagAttributeMap configures principal tag attribute mappings for a pool and provider.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON. It implements persistence.Persistable.

func (*InMemoryBackend) TagResource 

func (b *InMemoryBackend) TagResource(
	ctx context.Context,
	resourceARN string,
	tags map[string]string,
) error

TagResource adds or updates tags on an identity pool resource by ARN.

func (*InMemoryBackend) UnlinkDeveloperIdentity 

func (b *InMemoryBackend) UnlinkDeveloperIdentity(
	ctx context.Context,
	identityID string,
	poolID string,
	developerProviderName string,
	developerUserIdentifier string,
) error

UnlinkDeveloperIdentity removes a developer-provider association from an identity.

func (*InMemoryBackend) UnlinkIdentity 

func (b *InMemoryBackend) UnlinkIdentity(
	ctx context.Context,
	identityID string,
	logins map[string]string,
	loginsToRemove []string,
) error

UnlinkIdentity removes login providers from an identity after validating the supplied login tokens.

func (*InMemoryBackend) UntagResource 

func (b *InMemoryBackend) UntagResource(
	ctx context.Context,
	resourceARN string,
	tagKeys []string,
) error

UntagResource removes the given tag keys from an identity pool resource by ARN.

func (*InMemoryBackend) UpdateIdentityPool 

func (b *InMemoryBackend) UpdateIdentityPool(
	ctx context.Context,
	poolID string,
	name string,
	allowUnauthenticated bool,
	allowClassicFlow bool,
	developerProviderName string,
	providers []IdentityProvider,
	supportedLoginProviders map[string]string,
	tags map[string]string,
	opts ...*PoolExtendedConfig,
) (*IdentityPool, error)

UpdateIdentityPool updates the settings of an existing identity pool.

type ListIdentitiesResult 

type ListIdentitiesResult struct {
	IdentityPoolID string                `json:"identityPoolId"`
	NextToken      string                `json:"nextToken,omitempty"`
	Identities     []IdentityDescription `json:"identities"`
}

ListIdentitiesResult holds the output for ListIdentities.

type LookupDeveloperIdentityResult 

type LookupDeveloperIdentityResult struct {
	IdentityID                  string
	DeveloperUserIdentifierList []string
}

LookupDeveloperIdentityResult holds the output of LookupDeveloperIdentity.

type MappingRule 

type MappingRule struct {
	Claim     string `json:"claim"`
	MatchType string `json:"matchType"`
	Value     string `json:"value"`
	RoleARN   string `json:"roleARN"`
}

MappingRule defines a single claim-based role assignment rule.

type OpenIDToken 

type OpenIDToken struct {
	IdentityID string
	Token      string
}

OpenIDToken holds the result of GetOpenIdToken.

type PoolExtendedConfig 

type PoolExtendedConfig struct {
	OpenIDConnectProviderARNs []string
	SamlProviderARNs          []string
}

PoolExtendedConfig carries optional fields added in later API versions that would otherwise require touching every existing CreateIdentityPool/UpdateIdentityPool call site. Pass as a trailing variadic arg; callers that omit it get zero values.

type PrincipalTagMapping 

type PrincipalTagMapping struct {
	PrincipalTags map[string]string `json:"principalTags,omitempty"`

	UseDefaults bool `json:"useDefaults"`
	// contains filtered or unexported fields
}

PrincipalTagMapping stores the principal tag attribute map for a pool and provider.

type Provider 

type Provider struct{}

Provider implements service.Provider for Amazon Cognito Federated Identities.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the Cognito Identity service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type RoleMapping 

type RoleMapping struct {
	RulesConfiguration      *RulesConfiguration `json:"rulesConfiguration,omitempty"`
	Type                    string              `json:"type"`
	AmbiguousRoleResolution string              `json:"ambiguousRoleResolution,omitempty"`
}

RoleMapping configures how an identity pool assigns IAM roles for a provider.

type RulesConfiguration 

type RulesConfiguration struct {
	Rules []MappingRule `json:"rules"`
}

RulesConfiguration holds an ordered list of claim-based mapping rules.

type UnprocessedIdentityID 

type UnprocessedIdentityID struct {
	ErrorCode  string `json:"errorCode"`
	IdentityID string `json:"identityId"`
}

UnprocessedIdentityID represents a Cognito identity that could not be deleted.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.