{
  "description": "Defines acceptable payloads to amplify add auth --headless.",
  "type": "object",
  "properties": {
    "version": {
      "description": "The schema version.",
      "type": "number",
      "enum": [2]
    },
    "resourceName": {
      "description": "A name for the auth resource.",
      "type": "string"
    },
    "serviceConfiguration": {
      "description": "The configuration that defines the auth resource.",
      "anyOf": [
        {
          "allOf": [
            {
              "$ref": "#/definitions/BaseCognitoServiceConfiguration"
            },
            {
              "$ref": "#/definitions/NoCognitoIdentityPool"
            }
          ]
        },
        {
          "allOf": [
            {
              "$ref": "#/definitions/BaseCognitoServiceConfiguration"
            },
            {
              "$ref": "#/definitions/CognitoIdentityPool"
            }
          ]
        }
      ]
    }
  },
  "required": ["resourceName", "serviceConfiguration", "version"],
  "definitions": {
    "BaseCognitoServiceConfiguration": {
      "description": "Configuration that applies to all Cognito configuration.",
      "type": "object",
      "properties": {
        "serviceName": {
          "description": "The name of the service providing the resource.",
          "type": "string",
          "enum": ["Cognito"]
        },
        "userPoolConfiguration": {
          "$ref": "#/definitions/CognitoUserPoolConfiguration",
          "description": "The Cognito user pool configuration."
        }
      },
      "required": ["serviceName", "userPoolConfiguration"]
    },
    "CognitoUserPoolConfiguration": {
      "description": "Cognito configuration exposed by Amplify.",
      "type": "object",
      "properties": {
        "signinMethod": {
          "$ref": "#/definitions/CognitoUserPoolSigninMethod",
          "description": "How users will signin to their account."
        },
        "requiredSignupAttributes": {
          "description": "Account attributes that must be specified to sign up.",
          "type": "array",
          "items": {
            "enum": [
              "ADDRESS",
              "BIRTHDATE",
              "EMAIL",
              "FAMILY_NAME",
              "GENDER",
              "GIVEN_NAME",
              "LOCALE",
              "MIDDLE_NAME",
              "NAME",
              "NICKNAME",
              "PHONE_NUMBER",
              "PICTURE",
              "PREFERRED_USERNAME",
              "PROFILE",
              "UPDATED_AT",
              "WEBSITE",
              "ZONE_INFO"
            ],
            "type": "string"
          }
        },
        "aliasAttributes": {
          "description": "Alias attributes that can be used for sign-up/sign-in",
          "type": "array",
          "items": {
            "enum": ["EMAIL", "PHONE_NUMBER", "PREFERRED_USERNAME"],
            "type": "string"
          }
        },
        "userPoolName": {
          "description": "The name of the user pool. If not specified, a unique string will be generated.",
          "type": "string"
        },
        "userPoolGroups": {
          "description": "User pool groups to create within the user pool. If not specified, no groups are created.",
          "type": "array",
          "items": {
            "$ref": "#/definitions/CognitoUserPoolGroup"
          }
        },
        "adminQueries": {
          "$ref": "#/definitions/CognitoAdminQueries",
          "description": "If defined, an Admin Queries API is created."
        },
        "mfa": {
          "description": "If defined, specifies MFA configuration. Default is MFA off.",
          "anyOf": [
            {
              "$ref": "#/definitions/CognitoMFAOff"
            },
            {
              "$ref": "#/definitions/CognitoMFASettings"
            }
          ]
        },
        "passwordPolicy": {
          "$ref": "#/definitions/CognitoPasswordPolicy",
          "description": "If defined, specifies password constraint configuration. Default is minimum length of 8 characters."
        },
        "refreshTokenPeriod": {
          "description": "Defines how long refresh tokens are valid in days. Default is 30 days.",
          "type": "number"
        },
        "readAttributes": {
          "description": "Defines which user attributes can be read by the app. Default is email.",
          "type": "array",
          "items": {
            "enum": [
              "ADDRESS",
              "BIRTHDATE",
              "EMAIL",
              "EMAIL_VERIFIED",
              "FAMILY_NAME",
              "GENDER",
              "GIVEN_NAME",
              "LOCALE",
              "MIDDLE_NAME",
              "NAME",
              "NICKNAME",
              "PHONE_NUMBER",
              "PHONE_NUMBER_VERIFIED",
              "PICTURE",
              "PREFERRED_USERNAME",
              "PROFILE",
              "UPDATED_AT",
              "WEBSITE",
              "ZONE_INFO"
            ],
            "type": "string"
          }
        },
        "writeAttributes": {
          "description": "Defines which user attributes can be written by the app. Default is none.",
          "type": "array",
          "items": {
            "enum": [
              "ADDRESS",
              "BIRTHDATE",
              "EMAIL",
              "FAMILY_NAME",
              "GENDER",
              "GIVEN_NAME",
              "LOCALE",
              "MIDDLE_NAME",
              "NAME",
              "NICKNAME",
              "PHONE_NUMBER",
              "PICTURE",
              "PREFERRED_USERNAME",
              "PROFILE",
              "UPDATED_AT",
              "WEBSITE",
              "ZONE_INFO"
            ],
            "type": "string"
          }
        },
        "oAuth": {
          "$ref": "#/definitions/CognitoOAuthConfiguration",
          "description": "If defined, specified oAuth configuration will be applied to the user pool."
        },
        "autoVerifiedAttributes": {
          "description": "Defines user attributes that will be automatically verified upon account creation.",
          "type": "array",
          "items": {
            "anyOf": [
              {
                "$ref": "#/definitions/CognitoAutoVerifyPhoneNumberConfiguration"
              },
              {
                "$ref": "#/definitions/CognitoAutoVerifyEmailConfiguration"
              }
            ]
          }
        }
      },
      "required": ["requiredSignupAttributes", "signinMethod"]
    },
    "CognitoUserPoolSigninMethod": {
      "enum": ["EMAIL", "EMAIL_AND_PHONE_NUMBER", "PHONE_NUMBER", "USERNAME"],
      "type": "string"
    },
    "CognitoUserPoolGroup": {
      "description": "Defines a Cognito user pool group.",
      "type": "object",
      "properties": {
        "customPolicy": {
          "description": "Not implemented and should not be used.",
          "type": "string"
        },
        "groupName": {
          "description": "The group name.",
          "type": "string"
        }
      },
      "required": ["groupName"]
    },
    "CognitoAdminQueries": {
      "description": "Configuration for the AdminQueries API",
      "type": "object",
      "properties": {
        "permissions": {
          "description": "Defines the API permissions. groupName must only be specified if restrictAccess is true, in which case only the specified user pool group will have access to the Admin Queries API.",
          "type": "object",
          "properties": {
            "restrictAccess": {
              "type": "boolean"
            },
            "groupName": {
              "type": "string"
            }
          },
          "required": ["restrictAccess"]
        }
      },
      "required": ["permissions"]
    },
    "CognitoMFAOff": {
      "description": "Specifies that MFA should not be enabled for the user pool.",
      "type": "object",
      "properties": {
        "mode": {
          "type": "string",
          "enum": ["OFF"]
        }
      },
      "required": ["mode"]
    },
    "CognitoMFASettings": {
      "description": "Specifies that MFA is enabled for the user pool.",
      "type": "object",
      "properties": {
        "mode": {
          "description": "ON requires users to set up MFA when creating an account. OPTIONAL means the user has the option to set up MFA.",
          "enum": ["ON", "OPTIONAL"],
          "type": "string"
        },
        "mfaTypes": {
          "description": "MFA delivery options.",
          "type": "array",
          "items": {
            "enum": ["SMS", "TOTP"],
            "type": "string"
          }
        },
        "smsMessage": {
          "description": "If SMS is specified in \"mfaTypes\" this specifies the smsMessage that will be sent to the user.",
          "type": "string"
        }
      },
      "required": ["mfaTypes", "mode", "smsMessage"]
    },
    "CognitoPasswordPolicy": {
      "type": "object",
      "properties": {
        "minimumLength": {
          "type": "number"
        },
        "additionalConstraints": {
          "type": "array",
          "items": {
            "description": "Password contraints that can be applied to Cognito user pools.",
            "enum": ["REQUIRE_DIGIT", "REQUIRE_LOWERCASE", "REQUIRE_SYMBOL", "REQUIRE_UPPERCASE"],
            "type": "string"
          }
        }
      }
    },
    "CognitoOAuthConfiguration": {
      "description": "Cognito OAuth configuration exposed by Amplify",
      "type": "object",
      "properties": {
        "domainPrefix": {
          "description": "Your hosted UI domain name.",
          "type": "string"
        },
        "redirectSigninURIs": {
          "description": "Valid signin redirect URIs.",
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "redirectSignoutURIs": {
          "description": "Valid signout redirect URIs.",
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "oAuthGrantType": {
          "description": "The oAuth grant type.",
          "enum": ["CODE", "IMPLICIT"],
          "type": "string"
        },
        "oAuthScopes": {
          "description": "The oAuth scopes granted by signin.",
          "type": "array",
          "items": {
            "enum": ["AWS.COGNITO.SIGNIN.USER.ADMIN", "EMAIL", "OPENID", "PHONE", "PROFILE"],
            "type": "string"
          }
        },
        "socialProviderConfigurations": {
          "description": "If defined, users will be able to login with the specified social providers.",
          "type": "array",
          "items": {
            "description": "Defines a Cognito oAuth social provider",
            "anyOf": [
              {
                "$ref": "#/definitions/SocialProviderConfig"
              },
              {
                "$ref": "#/definitions/SignInWithAppleSocialProviderConfig"
              }
            ]
          }
        }
      },
      "required": ["oAuthGrantType", "oAuthScopes", "redirectSigninURIs", "redirectSignoutURIs"]
    },
    "SocialProviderConfig": {
      "description": "Defines a Cognito oAuth social provider",
      "type": "object",
      "properties": {
        "provider": {
          "description": "Social providers supported by Amplify and Cognito",
          "enum": ["FACEBOOK", "GOOGLE", "LOGIN_WITH_AMAZON"],
          "type": "string"
        },
        "clientId": {
          "description": "The client ID (sometimes called app ID) configured with the provider.",
          "type": "string"
        },
        "clientSecret": {
          "description": "The client secret (sometimes called an app secret) configured with the provider.",
          "type": "string"
        }
      },
      "required": ["clientId", "clientSecret", "provider"]
    },
    "SignInWithAppleSocialProviderConfig": {
      "description": "Defines a Cognito Sign in with Apple oAuth social provider",
      "type": "object",
      "properties": {
        "provider": {
          "type": "string",
          "enum": ["SIGN_IN_WITH_APPLE"]
        },
        "clientId": {
          "description": "The client ID (sometimes called apple services ID) configured with the provider.",
          "type": "string"
        },
        "teamId": {
          "description": "The team ID configured with the provider",
          "type": "string"
        },
        "keyId": {
          "description": "The key ID (sometimes called apple private key ID) configured with the provider.",
          "type": "string"
        },
        "privateKey": {
          "description": "The private key configured with the provider. Value can be undefined on an update request.\nEvery member can be updated except the privateKey because the privateKey isn't easily retrievable.",
          "type": "string"
        }
      },
      "required": ["clientId", "keyId", "provider", "teamId"]
    },
    "CognitoAutoVerifyPhoneNumberConfiguration": {
      "type": "object",
      "properties": {
        "type": {
          "type": "string",
          "enum": ["PHONE_NUMBER"]
        },
        "verificationMessage": {
          "type": "string"
        }
      },
      "required": ["type"]
    },
    "CognitoAutoVerifyEmailConfiguration": {
      "type": "object",
      "properties": {
        "type": {
          "type": "string",
          "enum": ["EMAIL"]
        },
        "verificationMessage": {
          "type": "string"
        },
        "verifiectionSubject": {
          "type": "string"
        }
      },
      "required": ["type"]
    },
    "NoCognitoIdentityPool": {
      "description": "Specifies that the Cognito configuration should not include an identity pool.",
      "type": "object",
      "properties": {
        "includeIdentityPool": {
          "description": "Indicates an indentity pool should not be configured.",
          "type": "boolean",
          "enum": [false]
        }
      },
      "required": ["includeIdentityPool"]
    },
    "CognitoIdentityPool": {
      "description": "Specifies that the Cognito configuration includes an identity pool configuration.",
      "type": "object",
      "properties": {
        "includeIdentityPool": {
          "description": "Indicates an identity pool should be configured.",
          "type": "boolean",
          "enum": [true]
        },
        "identityPoolConfiguration": {
          "$ref": "#/definitions/CognitoIdentityPoolConfiguration",
          "description": "The identity pool configuration. If not specified, defaults are applied."
        }
      },
      "required": ["includeIdentityPool"]
    },
    "CognitoIdentityPoolConfiguration": {
      "type": "object",
      "properties": {
        "identityPoolName": {
          "description": "If not specified, a random string is generated.",
          "type": "string"
        },
        "unauthenticatedLogin": {
          "description": "Allow guest login or not. Default is false.",
          "type": "boolean"
        },
        "identitySocialFederation": {
          "description": "If specified, Cognito will allow the specified providers to federate into the IdentityPool.",
          "type": "array",
          "items": {
            "$ref": "#/definitions/CognitoIdentitySocialFederation"
          }
        }
      }
    },
    "CognitoIdentitySocialFederation": {
      "description": "Defines a social federation provider.",
      "type": "object",
      "properties": {
        "provider": {
          "enum": ["AMAZON", "APPLE", "FACEBOOK", "GOOGLE"],
          "type": "string"
        },
        "clientId": {
          "description": "ClientId unique to your client and the provider.",
          "type": "string"
        }
      },
      "required": ["clientId", "provider"]
    }
  },
  "$schema": "http://json-schema.org/draft-07/schema#"
}