aws-samples / aws-samples/aws-saas-factory-ref-solution-serverless-saas
custom:tenantId and custom:tenantTier not passed to new user
- Dominant language
- TypeScript
- Stars
- 522
- Forks
- 168
- Avg merge
- 7d 8h
- Merged PRs (30d)
- 1
Description
Assume I am a TenantAdmin signed-in in the Application App, and I create a new user in BASIC tier within the App, the Cognito attributes: custom:tenantId and custom:tenantTier are not set within the new user.
Later, if I login with the newly created user in the Application App, the products and orders cannot be retrieved. The ApiGatewayAuthorizer breaks as the custom:tenantId is not set in the user's parameters.
I suppose there is a bug in the user-management api? In my opinion it should be set in
server/src/layers/cognito/user_management_util.py
from this...
```python
def create_user(user_pool_id, user_details):
response = cognito.admin_create_user(
Username=user_details['userName'],
UserPoolId=user_pool_id,
ForceAliasCreation=True,
UserAttributes=
[
{
'Name': 'email',
'Value': user_details['userEmail']
},
{
'Name': 'email_verified',
'Value': 'true'
},
{
'Name': 'custom:userRole',
'Value': user_details['userRole']
}
]
)
return response
```
to this...
```python
def create_user(user_pool_id, user_details):
response = cognito.admin_create_user(
Username=user_details['userName'],
UserPoolId=user_pool_id,
ForceAliasCreation=True,
UserAttributes=
[
{
'Name': 'email',
'Value': user_details['userEmail']
},
{
'Name': 'email_verified',
'Value': 'true'
},
{
'Name': 'custom:userRole',
'Value': user_details['userRole']
},
{
'Name': 'custom:tenantId',
'Value': user_details['tenantId']
}
]
)
return response
```
Do you agree?
Contributor guide
Research direction
Start in server/src/layers/cognito/user_management_util.py at create_user, then trace how user_details supplies tenantId and tenantTier. Verify that newly created Cognito users receive the required tenant attributes and that a subsequent login can retrieve products and orders without the authorizer failure.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python
- Domain
- authentication, backend-api-design
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100