ResourceServer

Source: src/AWS/Cognito/ResourceServer.ts

An OAuth 2.0 resource server for an Amazon Cognito user pool. Resource servers declare custom scopes that app clients can request in client_credentials and authorization-code flows.

Creating a Resource Server

API with Custom Scopes

import * as Cognito from "alchemy/AWS/Cognito";

const pool = yield* Cognito.UserPool("Users", {});
const api = yield* Cognito.ResourceServer("Api", {
  userPoolId: pool.userPoolId,
  identifier: "https://api.example.com",
  scopes: [
    { scopeName: "read", scopeDescription: "Read access" },
    { scopeName: "write", scopeDescription: "Write access" },
  ],
});

Client Requesting Resource-Server Scopes

const client = yield* Cognito.UserPoolClient("Machine", {
  userPoolId: pool.userPoolId,
  generateSecret: true,
  allowedOAuthFlowsUserPoolClient: true,
  allowedOAuthFlows: ["client_credentials"],
  allowedOAuthScopes: ["https://api.example.com/read"],
});