AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31

Description: >
  Infrastructure as code for authentication layer (Amazon Cognito).

Resources:
  CognitoUserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      UserPoolName: !Sub ${AWS::StackName}-UserPool
      AutoVerifiedAttributes:
        - email
      Schema:
        - Name: email
          AttributeDataType: String
          Mutable: false
          Required: true

  UserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      ClientName: avp-client
      GenerateSecret: false
      UserPoolId: !Ref CognitoUserPool
      ExplicitAuthFlows:
        - ALLOW_ADMIN_USER_PASSWORD_AUTH
        - ALLOW_REFRESH_TOKEN_AUTH
        - ALLOW_USER_PASSWORD_AUTH

  TransactionViewersGroup:
    Type: AWS::Cognito::UserPoolGroup
    Properties:
      GroupName: transaction_viewers
      Description: "Group for users with the permissions to view transactions."
      UserPoolId: !Ref CognitoUserPool
      Precedence: 1

  TransactionApproversGroup:
    Type: AWS::Cognito::UserPoolGroup
    Properties:
      GroupName: transaction_approvers
      Description: "Group for users with the permissions to approve transactions."
      UserPoolId: !Ref CognitoUserPool
      Precedence: 2
  TransactionEditorsGroup:
    Type: AWS::Cognito::UserPoolGroup
    Properties:
      GroupName: transaction_editors
      Description: "Group for users with the permissions to edit transactions."
      UserPoolId: !Ref CognitoUserPool
      Precedence: 2

Outputs:
  CognitoUserPoolId:
    Description: "Amazon Cognito User Pool ID"
    Value: !Ref CognitoUserPool
    Export:
      Name: !Sub "${AWS::StackName}-UserPoolID"

  CognitoAppClientId:
    Description: "Amazon Cognito App Client ID"
    Value: !Ref UserPoolClient
    Export:
      Name: !Sub "${AWS::StackName}-UserPoolClientID"