From e677c91daa002454e942f47e8d7b888ba97d438c Mon Sep 17 00:00:00 2001
From: jay brown <jay.a.brown@gmail.com>
Date: Tue, 1 Apr 2025 10:30:00 -0700
Subject: [PATCH] add secret support

---
 cmd/cognito_test/cognito.pkce/main.go   | 30 ++++++++++++++++---------
 cmd/cognito_test/cognito.pkce/readme.md | 20 +++++++++++++++++
 2 files changed, 40 insertions(+), 10 deletions(-)

diff --git a/cmd/cognito_test/cognito.pkce/main.go b/cmd/cognito_test/cognito.pkce/main.go
index 7efd3701..cff0eab1 100644
--- a/cmd/cognito_test/cognito.pkce/main.go
+++ b/cmd/cognito_test/cognito.pkce/main.go
@@ -37,12 +37,13 @@ type CognitoTokenResponse struct {
 // CognitoConfig holds the configuration for AWS Cognito
 // Contains all necessary parameters to interact with Cognito endpoints
 type CognitoConfig struct {
-	ClientID    string // OAuth2 client ID registered with Cognito
-	RedirectURI string // URL where Cognito redirects after authentication
-	TokenURL    string // Cognito endpoint for token operations
-	JwksURL     string // URL for JSON Web Key Set (for token verification)
-	UserPoolID  string // Cognito User Pool ID
-	AuthURL     string // Cognito authorization endpoint for initiating login
+	ClientID     string // OAuth2 client ID registered with Cognito
+	RedirectURI  string // URL where Cognito redirects after authentication
+	TokenURL     string // Cognito endpoint for token operations
+	JwksURL      string // URL for JSON Web Key Set (for token verification)
+	UserPoolID   string // Cognito User Pool ID
+	AuthURL      string // Cognito authorization endpoint for initiating login
+	ClientSecret string // Client secret for authenticated clients
 }
 
 // PKCESession stores PKCE code verifier for verification
@@ -544,6 +545,14 @@ func exchangeCodeForTokensWithPKCE(authCode, codeVerifier string, config Cognito
 
 	req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
 
+	// Add Authorization header if client secret is provided
+	if config.ClientSecret != "" {
+		req.SetBasicAuth(config.ClientID, config.ClientSecret)
+		logger.Debug("Using Basic Auth authentication")
+	} else {
+		logger.Debug("Using public client authentication (no secret)")
+	}
+
 	client := &http.Client{Timeout: 10 * time.Second}
 	resp, err := client.Do(req)
 	if err != nil {
@@ -757,10 +766,11 @@ func main() {
 	domain = strings.TrimPrefix(domain, "http://")
 
 	config := &CognitoConfig{
-		ClientID:    os.Getenv("COGNITO_CLIENT_ID"),
-		RedirectURI: "http://localhost:8080" + LOGIN_CALLBACK_PATH,
-		TokenURL:    fmt.Sprintf("https://%s/oauth2/token", domain),
-		AuthURL:     fmt.Sprintf("https://%s/oauth2/authorize", domain),
+		ClientID:     os.Getenv("COGNITO_CLIENT_ID"),
+		ClientSecret: os.Getenv("COGNITO_CLIENT_SECRET"),
+		RedirectURI:  "http://localhost:8080" + LOGIN_CALLBACK_PATH,
+		TokenURL:     fmt.Sprintf("https://%s/oauth2/token", domain),
+		AuthURL:      fmt.Sprintf("https://%s/oauth2/authorize", domain),
 		// actual https://cognito-idp.us-east-2.amazonaws.com/us-east-2_1y6po8rR8/.well-known/jwks.json
 		JwksURL:    fmt.Sprintf("https://cognito-idp.%s.amazonaws.com/%s/.well-known/jwks.json", region, userPoolID),
 		UserPoolID: userPoolID,
diff --git a/cmd/cognito_test/cognito.pkce/readme.md b/cmd/cognito_test/cognito.pkce/readme.md
index 02d94f7f..023a4d9e 100644
--- a/cmd/cognito_test/cognito.pkce/readme.md
+++ b/cmd/cognito_test/cognito.pkce/readme.md
@@ -58,6 +58,8 @@ Your Cognito App Client must be configured as follows:
 You can create a compatible app client with the AWS CLI:
 
 # Creating a cognito app client for cognito pkce /login
+Note that both of the examples below create clients that work except they have broken login pages. 
+When we cretae them from the AWS console however they work fine.  (TODO research)
 Assumed the cognito user pool is already created.
 ```
 aws --profile aarete --region us-east-2 --endpoint-url https://cognito-idp.us-east-2.amazonaws.com cognito-idp create-user-pool-client \
@@ -77,6 +79,24 @@ aws --profile aarete --region us-east-2 --endpoint-url https://cognito-idp.us-ea
   --prevent-user-existence-errors ENABLED
 ```
 
+Creating a client with a secret
+```
+aws --profile aarete --region us-east-2 cognito-idp create-user-pool-client \
+--user-pool-id us-east-2_1y6po8rR8 \
+--client-name "public-pkce-client-with-secret-1" \
+--refresh-token-validity 5 \
+--access-token-validity 60 \
+--id-token-validity 60 \
+--token-validity-units "RefreshToken=days,IdToken=minutes,AccessToken=minutes" \
+--explicit-auth-flows ALLOW_REFRESH_TOKEN_AUTH ALLOW_USER_AUTH ALLOW_USER_SRP_AUTH \
+--supported-identity-providers COGNITO \
+--callback-urls http://localhost:8080/login-callback \
+--allowed-o-auth-flows code \
+--allowed-o-auth-scopes email openid phone profile \
+--allowed-o-auth-flows-user-pool-client \
+--prevent-user-existence-errors ENABLED
+```
+
 ## Setup and Running
 
 1.2 omitted