Amazon Cognito Derinlemesine: Temel Authentication'ın Ötesinde

import * as cognito from 'aws-cdk-lib/aws-cognito';import * as iam from 'aws-cdk-lib/aws-iam';
// Authentication için User Poolconst userPool = new cognito.UserPool(this, 'UserPool', {  selfSignUpEnabled: false, // Production: User creation'ı kontrol et  signInAliases: { email: true, username: true },  autoVerify: { email: true },  passwordPolicy: {    minLength: 12,    requireLowercase: true,    requireUppercase: true,    requireDigits: true,    requireSymbols: true,  },  accountRecovery: cognito.AccountRecovery.EMAIL_ONLY,  advancedSecurityMode: cognito.AdvancedSecurityMode.ENFORCED,  mfa: cognito.Mfa.OPTIONAL,  mfaSecondFactor: {    sms: true,    otp: true, // Time-based one-time password (TOTP)  },});
// Web application için app clientconst appClient = userPool.addClient('WebAppClient', {  authFlows: {    userPassword: false, // Daha az güvenli flow'u devre dışı bırak    userSrp: true, // Secure Remote Password    custom: true, // Custom auth flow'ları aktifleştir  },  oAuth: {    flows: {      authorizationCodeGrant: true,      implicitCodeGrant: false, // Production'da implicit flow'dan kaçın    },    scopes: [      cognito.OAuthScope.OPENID,      cognito.OAuthScope.EMAIL,      cognito.OAuthScope.PROFILE,      cognito.OAuthScope.custom('billing-api/read'),    ],    callbackUrls: ['https://app.example.com/callback'],    logoutUrls: ['https://app.example.com/logout'],  },  generateSecret: true, // Server-side app'ler için gerekli});
// AWS kaynaklarına erişim için Identity Poolconst identityPool = new cognito.CfnIdentityPool(this, 'IdentityPool', {  allowUnauthenticatedIdentities: false,  cognitoIdentityProviders: [{    clientId: appClient.userPoolClientId,    providerName: userPool.userPoolProviderName,  }],});
// Scoped permission'larla authenticated roleconst authenticatedRole = new iam.Role(this, 'CognitoAuthenticatedRole', {  assumedBy: new iam.FederatedPrincipal(    'cognito-identity.amazonaws.com',    {      StringEquals: {        'cognito-identity.amazonaws.com:aud': identityPool.ref,      },      'ForAnyValue:StringLike': {        'cognito-identity.amazonaws.com:amr': 'authenticated',      },    },    'sts:AssumeRoleWithWebIdentity'  ),});
// User-scoped path'lerle spesifik S3 erişimi verauthenticatedRole.addToPolicy(new iam.PolicyStatement({  effect: iam.Effect.ALLOW,  actions: ['s3:GetObject', 's3:PutObject'],  resources: ['arn:aws:s3:::my-bucket/${cognito-identity.amazonaws.com:sub}/*'],}));

// Define Auth Challenge - Challenge sequence'ını orkestra ederexport const defineAuthChallenge = async (event: DefineAuthChallengeTrigger) => {  const session = event.request.session;
  // İlk challenge: SRP password verification (Cognito tarafından handle edilir)  if (session.length === 0) {    event.response.issueTokens = false;    event.response.failAuthentication = false;    event.response.challengeName = 'SRP_A';  }  // İkinci challenge: SRP password verifier  else if (session.length === 1 && session[0].challengeName === 'SRP_A') {    event.response.issueTokens = false;    event.response.failAuthentication = false;    event.response.challengeName = 'PASSWORD_VERIFIER';  }  // Üçüncü challenge: CAPTCHA  else if (session.length === 2 && session[1].challengeName === 'PASSWORD_VERIFIER'           && session[1].challengeResult === true) {    event.response.issueTokens = false;    event.response.failAuthentication = false;    event.response.challengeName = 'CUSTOM_CHALLENGE';    event.response.challengeMetadata = 'CAPTCHA_CHALLENGE';  }  // Dördüncü challenge: Security question  else if (session.length === 3 && session[2].challengeName === 'CUSTOM_CHALLENGE'           && session[2].challengeResult === true) {    event.response.issueTokens = false;    event.response.failAuthentication = false;    event.response.challengeName = 'CUSTOM_CHALLENGE';    event.response.challengeMetadata = 'SECURITY_QUESTION';  }  // Tüm challenge'lar başarılı  else if (session.length === 4 && session[3].challengeName === 'CUSTOM_CHALLENGE'           && session[3].challengeResult === true) {    event.response.issueTokens = true;    event.response.failAuthentication = false;  }  // Challenge başarısız  else {    event.response.issueTokens = false;    event.response.failAuthentication = true;  }
  return event;};
// Create Auth Challenge - Challenge data'sını oluştururexport const createAuthChallenge = async (event: CreateAuthChallengeTrigger) => {  const metadata = event.request.challengeMetadata;
  if (metadata === 'CAPTCHA_CHALLENGE') {    // External servis veya internal logic kullanarak CAPTCHA oluştur    const captchaToken = await generateCaptcha();
    event.response.publicChallengeParameters = {      captchaUrl: `https://captcha.example.com/${captchaToken}`,      challengeType: 'CAPTCHA',    };
    event.response.privateChallengeParameters = {      captchaAnswer: await getCaptchaAnswer(captchaToken),    };  }  else if (metadata === 'SECURITY_QUESTION') {    // DynamoDB'den kullanıcının güvenlik sorusunu al    const question = await getSecurityQuestion(event.userName);
    event.response.publicChallengeParameters = {      question: question.text,      challengeType: 'SECURITY_QUESTION',    };
    event.response.privateChallengeParameters = {      answer: question.answer,    };  }
  return event;};
// Verify Auth Challenge Responseexport const verifyAuthChallenge = async (event: VerifyAuthChallengeTrigger) => {  const privateParams = event.request.privateChallengeParameters;  const challengeAnswer = event.request.challengeAnswer;
  if (privateParams.captchaAnswer) {    event.response.answerCorrect =      challengeAnswer.toLowerCase() === privateParams.captchaAnswer.toLowerCase();  }  else if (privateParams.answer) {    event.response.answerCorrect =      challengeAnswer.toLowerCase() === privateParams.answer.toLowerCase();  }
  return event;};

// Pre Token Generation V2 - Hem ID hem de Access token'ları özelleştirexport const preTokenGeneration = async (event: PreTokenGenerationTriggerEvent) => {  // DynamoDB'den tenant ve role bilgisini al  const userMetadata = await getUserMetadata(event.userName);
  if (event.request.userAttributes['custom:tenantId']) {    const tenantId = event.request.userAttributes['custom:tenantId'];
    // Tenant'ın active olduğunu doğrula    const tenant = await getTenantById(tenantId);    if (!tenant || tenant.status !== 'ACTIVE') {      throw new Error('Tenant is not active');    }
    // ID token'a custom claim'ler ekle (user info için)    event.response.claimsOverrideDetails = {      claimsToAddOrOverride: {        'custom:tenantId': tenantId,        'custom:tenantName': tenant.name,        'custom:organizationId': tenant.organizationId,        'custom:role': userMetadata.role,        'custom:permissions': JSON.stringify(userMetadata.permissions),      },    };
    // Access Token'ı özelleştir (sadece Cognito Essentials/Plus tier)    if (event.triggerSource === 'TokenGeneration_Authentication') {      event.response.claimsOverrideDetails.accessTokenGeneration = {        claimsToAddOrOverride: {          'tenant_id': tenantId,          'role': userMetadata.role,        },        claimsToSuppress: [],        scopesToAdd: [`tenant:${tenantId}:read`, `tenant:${tenantId}:write`],      };    }  }
  // Feature flag'ler için subscription tier ekle  if (userMetadata.subscriptionTier) {    event.response.claimsOverrideDetails.claimsToAddOrOverride['custom:tier'] =      userMetadata.subscriptionTier;  }
  return event;};
// DynamoDB helper fonksiyonlarıasync function getUserMetadata(username: string) {  const result = await dynamoDB.get({    TableName: 'UserMetadata',    Key: { username },  }).promise();
  return result.Item || { role: 'user', permissions: [] };}
async function getTenantById(tenantId: string) {  const result = await dynamoDB.get({    TableName: 'Tenants',    Key: { tenantId },  }).promise();
  return result.Item;}

// Tenant izolasyonuyla Shared User Poolconst userPool = new cognito.UserPool(this, 'MultiTenantUserPool', {  selfSignUpEnabled: false,  standardAttributes: {    email: { required: true, mutable: true },  },  customAttributes: {    tenantId: new cognito.StringAttribute({      minLen: 1,      maxLen: 128,      mutable: false, // Oluşturulduktan sonra tenant değiştirilemez    }),    organizationId: new cognito.StringAttribute({      minLen: 1,      maxLen: 128,      mutable: false,    }),    role: new cognito.StringAttribute({      minLen: 1,      maxLen: 64,      mutable: true, // Role güncellenebilir    }),  },});
// Pre Sign Up - Invitation token'dan tenant ataexport const preSignUp = async (event: PreSignUpTriggerEvent) => {  const invitationToken = event.request.validationData?.invitationToken;
  if (!invitationToken) {    throw new Error('Invitation token required');  }
  // Invitation'ı doğrula ve tenant bilgisini al  const invitation = await validateInvitation(invitationToken);
  if (!invitation || invitation.expired) {    throw new Error('Invalid or expired invitation');  }
  // Auto-confirm ve tenant attribute'larını set et  event.response.autoConfirmUser = true;  event.response.autoVerifyEmail = true;
  // Bunlar custom attribute olarak set edilecek  event.request.userAttributes['custom:tenantId'] = invitation.tenantId;  event.request.userAttributes['custom:organizationId'] = invitation.organizationId;  event.request.userAttributes['custom:role'] = invitation.role;
  // Invitation'ı kullanıldı olarak işaretle  await markInvitationUsed(invitationToken, event.userName);
  return event;};

// SAML provider için CDK setupconst samlProvider = new cognito.UserPoolIdentityProviderSaml(this, 'AzureADProvider', {  userPool,  name: 'AzureAD',  metadata: cognito.UserPoolIdentityProviderSamlMetadata.url(    'https://login.microsoftonline.com/TENANT_ID/federationmetadata/2007-06/federationmetadata.xml'  ),  attributeMapping: {    email: cognito.ProviderAttribute.other('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'),    givenName: cognito.ProviderAttribute.other('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname'),    familyName: cognito.ProviderAttribute.other('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname'),    custom: {      'tenantId': cognito.ProviderAttribute.other('http://schemas.microsoft.com/identity/claims/tenantid'),    },  },  idpSignout: true,});
// Federated user'ı mevcut profile link et (duplicate'leri önle)export const postAuthentication = async (event: PostAuthenticationTriggerEvent) => {  // Bu federated bir identity mi kontrol et  if (event.request.userAttributes.identities) {    const identities = JSON.parse(event.request.userAttributes.identities);    const federatedIdentity = identities[0];
    if (federatedIdentity.providerName === 'AzureAD') {      const email = event.request.userAttributes.email;
      // Bu email ile zaten bir kullanıcı var mı kontrol et      const existingUser = await findUserByEmail(email);
      if (existingUser && existingUser.username !== event.userName) {        // Federated identity'yi mevcut kullanıcıya link et        await cognito.adminLinkProviderForUser({          UserPoolId: event.userPoolId,          DestinationUser: {            ProviderName: 'Cognito',            ProviderAttributeValue: existingUser.username,          },          SourceUser: {            ProviderName: federatedIdentity.providerName,            ProviderAttributeName: 'Cognito_Subject',            ProviderAttributeValue: federatedIdentity.userId,          },        }).promise();
        // Audit için linking'i logla        await auditLog({          action: 'FEDERATED_IDENTITY_LINKED',          email,          provider: federatedIdentity.providerName,        });      }    }  }
  return event;};

// CDK: Cognito authorizer ile API Gatewayconst api = new apigateway.RestApi(this, 'MyApi', {  restApiName: 'Secure API',  deployOptions: {    stageName: 'prod',    tracingEnabled: true,  },});
const authorizer = new apigateway.CognitoUserPoolsAuthorizer(this, 'CognitoAuthorizer', {  cognitoUserPools: [userPool],  authorizerName: 'CognitoAuthorizer',  identitySource: 'method.request.header.Authorization',  resultsCacheTtl: Duration.minutes(5), // Authorization kararlarını cache'le});
// Spesifik OAuth scope gerektiren protected endpointconst protectedResource = api.root.addResource('billing');protectedResource.addMethod('GET', new apigateway.LambdaIntegration(billingFunction), {  authorizer,  authorizationType: apigateway.AuthorizationType.COGNITO,  authorizationScopes: ['billing-api/read'], // OAuth scope validation  requestValidator: new apigateway.RequestValidator(this, 'RequestValidator', {    restApi: api,    validateRequestBody: true,    validateRequestParameters: true,  }),});
// JWT validation ve tenant izolasyonu ile Lambda fonksiyonuexport const handler = async (event: APIGatewayProxyEvent) => {  // API Gateway JWT'yi zaten doğruladı, claim'leri çıkar  const claims = event.requestContext.authorizer?.claims;
  if (!claims) {    return { statusCode: 401, body: 'Unauthorized' };  }
  const tenantId = claims['custom:tenantId'];  const role = claims['custom:role'];
  // Tenant context'i doğrula  if (!tenantId) {    return { statusCode: 403, body: 'Missing tenant context' };  }
  // Tenant izolasyonuyla query  const result = await dynamoDB.query({    TableName: 'BillingRecords',    IndexName: 'TenantIndex',    KeyConditionExpression: 'tenantId = :tenantId',    ExpressionAttributeValues: {      ':tenantId': tenantId,    },  }).promise();
  // Role-based filtering uygula  const filteredRecords = filterByRole(result.Items, role);
  return {    statusCode: 200,    body: JSON.stringify(filteredRecords),  };};

// User Migration Lambda - Lazy migration yaklaşımıexport const userMigration = async (event: UserMigrationTriggerEvent) => {  if (event.triggerSource === 'UserMigration_Authentication') {    // Kullanıcı sign-in olmaya çalışıyor ama Cognito'da yok    const { userName, password } = event.request;
    try {      // Credential'ları Auth0'a karşı doğrula      const auth0User = await validateWithAuth0(userName, password);
      if (auth0User) {        // Kullanıcı geçerli, Cognito'ya migrate et        event.response.userAttributes = {          email: auth0User.email,          email_verified: 'true',          given_name: auth0User.given_name,          family_name: auth0User.family_name,          'custom:auth0Id': auth0User.user_id,          'custom:migratedAt': new Date().toISOString(),        };
        event.response.finalUserStatus = 'CONFIRMED';        event.response.messageAction = 'SUPPRESS'; // Welcome email gönderme
        // Tracking için migration'ı logla        await logMigration(userName, 'success');
        return event;      }    } catch (error) {      await logMigration(userName, 'failed', error);      throw error;    }  }
  if (event.triggerSource === 'UserMigration_ForgotPassword') {    // Kullanıcı password reset istiyor ama Cognito'da yok    const { userName } = event.request;
    // Kullanıcı Auth0'da var mı kontrol et    const auth0User = await getUserFromAuth0(userName);
    if (auth0User) {      event.response.userAttributes = {        email: auth0User.email,        email_verified: 'true',        'custom:auth0Id': auth0User.user_id,      };
      event.response.messageAction = 'SUPPRESS';
      return event;    }  }
  throw new Error('User not found in legacy system');};
async function validateWithAuth0(username: string, password: string) {  const response = await axios.post('https://YOUR_DOMAIN.auth0.com/oauth/token', {    grant_type: 'password',    username,    password,    client_id: process.env.AUTH0_CLIENT_ID,    client_secret: process.env.AUTH0_CLIENT_SECRET,    audience: process.env.AUTH0_AUDIENCE,    scope: 'openid profile email',  });
  if (response.data.access_token) {    // User info al    const userInfo = await axios.get('https://YOUR_DOMAIN.auth0.com/userinfo', {      headers: { Authorization: `Bearer ${response.data.access_token}` },    });
    return userInfo.data;  }
  return null;}

// Advanced Security'yi aktifleştir (Plus tier gerekli)const userPool = new cognito.UserPool(this, 'SecureUserPool', {  advancedSecurityMode: cognito.AdvancedSecurityMode.ENFORCED,  userPoolAddOns: {    advancedSecurityMode: cognito.AdvancedSecurityMode.ENFORCED,  },  signInAliases: { email: true },  signInCaseSensitive: false,});
// Post Authentication - Risk seviyelerini handle etexport const postAuthentication = async (event: PostAuthenticationTriggerEvent) => {  const riskLevel = event.request.userContextData?.encodedData    ? parseRiskData(event.request.userContextData.encodedData)    : 'LOW';
  // Risk seviyesiyle authentication'ı logla  await logAuthentication({    username: event.userName,    riskLevel,    ipAddress: event.request.userContextData?.ipAddress,    deviceKey: event.request.userContextData?.deviceKey,    timestamp: new Date().toISOString(),  });
  // Yüksek riskli authentication'lar için ek güvenlik tetikle  if (riskLevel === 'HIGH' || riskLevel === 'MEDIUM') {    await sendSecurityAlert(event.userName, riskLevel);
    if (riskLevel === 'HIGH') {      await setUserMFARequired(event.userPoolId, event.userName);    }  }
  return event;};

import { Amplify } from 'aws-amplify';import { signIn, signOut, getCurrentUser } from 'aws-amplify/auth';
Amplify.configure({  Auth: {    Cognito: {      userPoolId: 'us-east-1_ABC123',      userPoolClientId: 'abc123def456',      identityPoolId: 'us-east-1:abc123-def456',      loginWith: {        oauth: {          domain: 'auth.example.com',          scopes: ['openid', 'email', 'profile', 'billing-api/read'],          redirectSignIn: ['https://app.example.com/callback'],          redirectSignOut: ['https://app.example.com/logout'],          responseType: 'code',        },      },    },  },});
async function handleSignIn(email: string, password: string) {  try {    const { isSignedIn, nextStep } = await signIn({      username: email,      password,    });
    if (nextStep.signInStep === 'CONFIRM_SIGN_IN_WITH_TOTP_CODE') {      const code = await promptForMFACode();      await confirmSignIn({ challengeResponse: code });    }
    // Token'lar otomatik olarak saklanıyor ve refresh ediliyor    const user = await getCurrentUser();    return user;  } catch (error) {    console.error('Sign in error:', error);    throw error;  }}

import {  CognitoIdentityProviderClient,  AdminInitiateAuthCommand,} from '@aws-sdk/client-cognito-identity-provider';import { createHmac } from 'crypto';
const client = new CognitoIdentityProviderClient({ region: 'us-east-1' });
function calculateSecretHash(username: string): string {  const message = username + process.env.COGNITO_CLIENT_ID;  const hash = createHmac('sha256', process.env.COGNITO_CLIENT_SECRET!)    .update(message)    .digest('base64');  return hash;}
async function authenticateUser(username: string, password: string) {  const command = new AdminInitiateAuthCommand({    UserPoolId: process.env.USER_POOL_ID,    ClientId: process.env.COGNITO_CLIENT_ID,    AuthFlow: 'ADMIN_USER_PASSWORD_AUTH',    AuthParameters: {      USERNAME: username,      PASSWORD: password,      SECRET_HASH: calculateSecretHash(username),    },  });
  const response = await client.send(command);
  return {    accessToken: response.AuthenticationResult?.AccessToken,    idToken: response.AuthenticationResult?.IdToken,    refreshToken: response.AuthenticationResult?.RefreshToken,    expiresIn: response.AuthenticationResult?.ExpiresIn,  };}

const TOKEN_REFRESH_THRESHOLD = 5 * 60 * 1000; // 5 dakika
async function getValidToken(): Promise<string> {  const session = await Auth.currentSession();  const expiresAt = session.getAccessToken().getExpiration() * 1000;
  if (Date.now() + TOKEN_REFRESH_THRESHOLD > expiresAt) {    const newSession = await Auth.currentSession();    return newSession.getAccessToken().getJwtToken();  }
  return session.getAccessToken().getJwtToken();}