From 8eb2d36499c8fa13cac316bbb014dbe8a91c733a Mon Sep 17 00:00:00 2001
From: jay brown <jay.a.brown@gmail.com>
Date: Tue, 8 Apr 2025 14:17:12 -0700
Subject: [PATCH] sync changes

working state
---
 cmd/cognito_test/cognito.pkce/cognito_pkce.go |  1 +
 cmd/cognito_test/cognito.pkce/main.go         | 25 +++++++++++++------
 2 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/cmd/cognito_test/cognito.pkce/cognito_pkce.go b/cmd/cognito_test/cognito.pkce/cognito_pkce.go
index 47704c1a..ff811aeb 100644
--- a/cmd/cognito_test/cognito.pkce/cognito_pkce.go
+++ b/cmd/cognito_test/cognito.pkce/cognito_pkce.go
@@ -58,6 +58,7 @@ func initiateLoginWithPKCE(c echo.Context, config *CognitoConfig, logger *slog.L
 		logger.Error("Failed to generate state parameter", "error", err)
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "Authentication initialization failed"})
 	}
+	fmt.Println("random state:", state)
 
 	// Generate code verifier (random string between 43-128 chars)
 	codeVerifier, err := generateRandomString(64)
diff --git a/cmd/cognito_test/cognito.pkce/main.go b/cmd/cognito_test/cognito.pkce/main.go
index a1486adc..e9c62c99 100644
--- a/cmd/cognito_test/cognito.pkce/main.go
+++ b/cmd/cognito_test/cognito.pkce/main.go
@@ -86,10 +86,10 @@ func GetJWKS(jwksURL string, logger *slog.Logger) (jwk.Set, error) {
 	return keySet, nil
 }
 
-// TokenValidationMiddleware verifies JWT tokens efficiently
+// PkceTokenValidationMiddleware verifies JWT tokens efficiently
 // This is the primary middleware that handles both authentication and authorization
 // Applied to all routes to enforce security requirements
-func TokenValidationMiddleware(config *CognitoConfig, routePermissions map[string][]string, logger *slog.Logger) echo.MiddlewareFunc {
+func PkceTokenValidationMiddleware(config *CognitoConfig, routePermissions map[string][]string, logger *slog.Logger) echo.MiddlewareFunc {
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) error {
 			requestPath := c.Request().URL.Path
@@ -110,7 +110,7 @@ func TokenValidationMiddleware(config *CognitoConfig, routePermissions map[strin
 				return handleOAuthCallback(c, config, routePermissions, logger)
 			}
 
-			// Initialize login flow if this is a login request
+			// Initialize login flow if this is a login request - first thing after we arrive at /login
 			if requestPath == "/login" {
 				return initiateLoginWithPKCE(c, config, logger)
 			}
@@ -409,6 +409,12 @@ func maskString(s string) string {
 	return s[:4] + "..." + s[len(s)-4:]
 }
 
+func getJwksURL(region, userPoolID string) string {
+	// original logic
+	//       :    fmt.Sprintf("https://cognito-idp.%s.amazonaws.com/%s/.well-known/jwks.json", region, userPoolID),
+	return fmt.Sprintf("https://cognito-idp.%s.amazonaws.com/%s/.well-known/jwks.json", region, userPoolID)
+}
+
 // main is the entry point of the application
 // Sets up the Echo server, middleware, routes, and starts listening
 func main() {
@@ -451,6 +457,8 @@ func main() {
 		domain = fmt.Sprintf("%s.auth.%s.amazoncognito.com", userPoolID, region)
 	}
 
+	fmt.Printf("Using domain %s\n", domain)
+
 	// Ensure domain format is correct (no protocol prefix)
 	domain = strings.TrimPrefix(domain, "https://")
 	domain = strings.TrimPrefix(domain, "http://")
@@ -461,8 +469,9 @@ func main() {
 		RedirectURI:  "http://localhost:8080" + LOGIN_CALLBACK_PATH,
 		TokenURL:     fmt.Sprintf("https://%s/oauth2/token", domain),
 		AuthURL:      fmt.Sprintf("https://%s/oauth2/authorize", domain),
-		// actual https://cognito-idp.us-east-2.amazonaws.com/us-east-2_1y6po8rR8/.well-known/jwks.json
-		JwksURL:    fmt.Sprintf("https://cognito-idp.%s.amazonaws.com/%s/.well-known/jwks.json", region, userPoolID),
+
+		// actual : https://cognito-idp.us-east-2.amazonaws.com/us-east-2_1y6po8rR8/.well-known/jwks.json
+		JwksURL:    getJwksURL(region, userPoolID),
 		UserPoolID: userPoolID,
 	}
 
@@ -486,11 +495,11 @@ func main() {
 
 	// Then apply token validation middleware
 	// This will validate the token from the Authorization header
-	e.Use(TokenValidationMiddleware(config, routePermissions, logger))
+	e.Use(PkceTokenValidationMiddleware(config, routePermissions, logger))
 
-	// Login route
+	// Login route entirely handled by middleware - nothing to do here.
 	e.GET("/login", func(c echo.Context) error {
-		// The TokenValidationMiddleware will handle this
+		// The PkceTokenValidationMiddleware will handle this
 		return nil
 	})