cognito

{
"ClientId":"string",　// Cognitoユーザープールに登録したアプリクライアントのID
"SecretHash": "string", // シークレットを設定した場合に必要　つまり上記設定だと必要
"UserName":"string", 
"Password":"string"
}

{
   "ClientId": "string",
   "AuthFlow": "USER_PASSWORD_AUTH",
   "AuthParameters": { 
      "USERNAME" : "string",
      "PASSWORD" : "string"
    }
}

{
    "AuthFlow": "USER_SRP_AUTH",
    "ClientId": "1example23456789", 
    "AuthParameters": {
        "USERNAME": "exampleuser",
        "SRP_A": "exampleSrpValue",
        "SECRET_HASH": "oT5ZkS8ctnrhYeeGsGTvOzPhoc/Jd1cO5fueBWFVmp8="
    },
    "AnalyticsMetadata": {
        "AnalyticsEndpointId": "exampleAnalyticsEndpointId"
    },
    "UserContextData": {
        "EncodedData": "AmazonCognitoAdvancedSecurityData_object",
        "IpAddress": "192.0.2.1"
    },
    "ClientMetadata": {
        "CustomKey": "CustomValue"
    }
}

{
    "ChallengeName": "PASSWORD_VERIFIER",
    "ChallengeResponses": {
        "USERNAME": "exampleuser",
        "PASSWORD_CLAIM_SIGNATURE": "exampleClaimSignature",
        "PASSWORD_CLAIM_SECRET_BLOCK": "exampleSecretBlock",
        "TIMESTAMP": "2024-11-17T12:34:56Z"
    },
    "ClientId": "1example23456789",
    "Session": "exampleSessionId"
}

{
   "AccessToken": "string"
}

input := &cognitoidentityprovider.AdminCreateUserInput{
		UserPoolId: aws.String("ap-northeast-1_XXXX"), // ユーザープールID
		Username:   aws.String("testuser"),         // ユーザー名
		DesiredDeliveryMediums: []types.DeliveryMediumType{
			types.DeliveryMediumTypeSms, // SMSで通知
		},
		MessageAction: types.MessageActionTypeSuppress, // 通知を抑制
		TemporaryPassword: aws.String("This-is-my-test-99!"), // 一時パスワード
		UserAttributes: []types.AttributeType{
			{
				Name:  aws.String("name"),
				Value: aws.String("John"),
			},
			{
				Name:  aws.String("phone_number"),
				Value: aws.String("+12065551212"),
			},
			{
				Name:  aws.String("email"),
				Value: aws.String("testuser@example.com"),
			},
		},
	}

	// リクエスト送信
	return c.AdminCreateUser(context.TODO(), input)

func calculateSecretHash(username, clientId, clientSecret string) string {
	data := username + clientId
	h := hmac.New(sha256.New, []byte(clientSecret))
	h.Write([]byte(data))
	return base64.StdEncoding.EncodeToString(h.Sum(nil))
}

func AuthorizeWithPassword(c *cognitoidentityprovider.Client) (*cognitoidentityprovider.InitiateAuthOutput, error) {
	username := "testuser"
	clientId := "client id"
	clientSecret := "secret"
	secretHash := calculateSecretHash(username, clientId, clientSecret)
	input := &cognitoidentityprovider.InitiateAuthInput{
		AuthFlow:       types.AuthFlowTypeUserPasswordAuth,
		ClientId: 		 aws.String("client id"),
		AuthParameters: map[string]string{
			"USERNAME": "testuser",
			"PASSWORD": "This-is-my-test-99!!!",
			"SECRET_HASH": secretHash,
		},
	}

	ret, err := c.InitiateAuth(context.TODO(), input)

	if err != nil {
		fmt.Println("Error")
		fmt.Println(err)
		return nil, err
	}

	if ret.ChallengeName == types.ChallengeNameTypeNewPasswordRequired {
		fmt.Println("New password required")
		_, err := RespondToNewPasswordChallenge(c, secretHash, ret.Session)
		if err != nil {
			fmt.Println("Error")
			fmt.Println(err)
			return nil, err
		}
	} else {
		fmt.Println("No new password required")
	}

	return ret, nil
}

func RespondToNewPasswordChallenge(c *cognitoidentityprovider.Client, hash string, session *string) (*cognitoidentityprovider.RespondToAuthChallengeOutput, error) {
	input := &cognitoidentityprovider.RespondToAuthChallengeInput{
		ChallengeName: types.ChallengeNameTypeNewPasswordRequired,
		ClientId: aws.String("client id"),
		ChallengeResponses: map[string]string{
			"USERNAME": "testuser",
			"NEW_PASSWORD": "This-is-my-test-99!!!",
			"SECRET_HASH": hash,
		},
		Session: session,
	}

	ret, err := c.RespondToAuthChallenge(context.TODO(), input)

	if err != nil {
		fmt.Println("Error")
		fmt.Println(err)
		return nil, err
	}

	return ret, nil

}

SECRET_HASH = Base64( HMAC-SHA256( ClientSecret, Username + ClientId ) )

- AdminCreateUser
- InitiateAuth
  - ChallengeName:"NEW_PASSWORD_REQUIRED"
- RespondToAuthChallenge
- InitiateAuth