feat(cognito): user pools - non-ascii email domains (#11099)

If an email address for cognito email settings contains a non-ascii character, the cognito cdk package applies punycode encoding, which cloudformation will pick up properly.

This pull request adds the [`punycode`](https://github.com/bestiejs/punycode.js) package to the dependencies, as previously discussed in #8473. The package occupies 42KB in `node_modules` after installation. I am not sure if I configured the package correctly to be included in the cdk build. The project itself added `punycode` to `aws-cdk-lib` and `monocdk`, I had to re-run `yarn install` in these packages.

Unit- and integration tests are added, but notice that I could not manage a manual e2e test, I think I need to own a domain with non-ascii letters to do so, which I currently do not.

A similar approach as in this PR will also be interesting for other cdk packages which deal with email addresses and domains, like hosted zones.

According to the [Cfn Domain Name Format Docs](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/DomainNameFormat.html), characters with code point below 33, or in `[127, 255]` should be escaped with an octal code, which is not applied in this pull request.

Fixes #8473

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

package.json

@@ -53,6 +53,8 @@
       "**/jszip/**",
       "@aws-cdk/aws-codepipeline-actions/case",
       "@aws-cdk/aws-codepipeline-actions/case/**",
+      "@aws-cdk/aws-cognito/punycode",
+      "@aws-cdk/aws-cognito/punycode/**",
       "@aws-cdk/aws-ecr-assets/minimatch",
       "@aws-cdk/aws-ecr-assets/minimatch/**",
       "@aws-cdk/aws-eks/yaml",
@@ -79,6 +81,8 @@
       "aws-cdk-lib/jsonschema/**",
       "aws-cdk-lib/minimatch",
       "aws-cdk-lib/minimatch/**",
+      "aws-cdk-lib/punycode",
+      "aws-cdk-lib/punycode/**",
       "aws-cdk-lib/semver",
       "aws-cdk-lib/semver/**",
       "aws-cdk-lib/yaml",
@@ -91,6 +95,8 @@
       "monocdk/jsonschema/**",
       "monocdk/minimatch",
       "monocdk/minimatch/**",
+      "monocdk/punycode",
+      "monocdk/punycode/**",
       "monocdk/semver",
       "monocdk/semver/**",
       "monocdk/yaml",

packages/@aws-cdk/aws-cognito/NOTICE

@@ -1,2 +1,30 @@
 AWS Cloud Development Kit (AWS CDK)
 Copyright 2018-2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+
+-------------------------------------------------------------------------------
+
+The AWS CDK includes the following third-party software/licensing:
+
+** punycode - https://www.npmjs.com/package/punycode
+Copyright Mathias Bynens <https://mathiasbynens.be/>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+----------------

packages/@aws-cdk/aws-cognito/README.md

@@ -319,6 +319,9 @@ Amazon SES, however, support for Amazon SES is not available in the CDK yet. If
 give [this issue](https://github.com/aws/aws-cdk/issues/6768) a +1. Until then, you can use the [cfn
 layer](https://docs.aws.amazon.com/cdk/latest/guide/cfn_layer.html) to configure this.
 
+If an email address contains non-ASCII characters, it will be encoded using the [punycode
+encoding](https://en.wikipedia.org/wiki/Punycode) when generating the template for Cloudformation.
+
 ### Lambda Triggers
 
 User pools can be configured such that AWS Lambda functions can be triggered when certain user operations or actions

packages/@aws-cdk/aws-cognito/lib/user-pool.ts

@@ -2,6 +2,7 @@ import { IRole, PolicyDocument, PolicyStatement, Role, ServicePrincipal } from '
 import * as lambda from '@aws-cdk/aws-lambda';
 import { Duration, IResource, Lazy, Names, Resource, Stack, Token } from '@aws-cdk/core';
 import { Construct } from 'constructs';
+import { toASCII as punycodeEncode } from 'punycode/';
 import { CfnUserPool } from './cognito.generated';
 import { StandardAttributeNames } from './private/attr-names';
 import { ICustomAttribute, StandardAttribute, StandardAttributes } from './user-pool-attr';
@@ -733,8 +734,8 @@ export class UserPool extends UserPoolBase {
       enabledMfas: this.mfaConfiguration(props),
       policies: passwordPolicy !== undefined ? { passwordPolicy } : undefined,
       emailConfiguration: undefinedIfNoKeys({
-        from: props.emailSettings?.from,
-        replyToEmailAddress: props.emailSettings?.replyTo,
+        from: encodePuny(props.emailSettings?.from),
+        replyToEmailAddress: encodePuny(props.emailSettings?.replyTo),
       }),
       usernameConfiguration: undefinedIfNoKeys({
         caseSensitive: props.signInCaseSensitive,
@@ -1019,6 +1020,9 @@ export class UserPool extends UserPoolBase {
 }
 
 function undefinedIfNoKeys(struct: object): object | undefined {
-  const allUndefined = Object.values(struct).reduce((acc, v) => acc && (v === undefined), true);
+  const allUndefined = Object.values(struct).every(val => val === undefined);
   return allUndefined ? undefined : struct;
 }
+function encodePuny(input: string | undefined): string | undefined {
+  return input !== undefined ? punycodeEncode(input) : input;
+}

packages/@aws-cdk/aws-cognito/package.json

@@ -73,6 +73,7 @@
   "license": "Apache-2.0",
   "devDependencies": {
     "@aws-cdk/assert": "0.0.0",
+    "@types/punycode": "^2.1.0",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
     "cfn2ts": "0.0.0",
@@ -85,7 +86,9 @@
     "@aws-cdk/aws-lambda": "0.0.0",
     "@aws-cdk/core": "0.0.0",
     "@aws-cdk/custom-resources": "0.0.0",
-    "constructs": "^3.2.0"
+    "constructs": "^3.2.0",
+    "punycode": "^2.1.1"
+
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
@@ -96,6 +99,9 @@
     "@aws-cdk/custom-resources": "0.0.0",
     "constructs": "^3.2.0"
   },
+  "bundledDependencies": [
+    "punycode"
+  ],
   "engines": {
     "node": ">= 10.13.0 <13 || >=13.7.0"
   },

packages/@aws-cdk/aws-cognito/test/user-pool.test.ts

@@ -1271,6 +1271,27 @@ describe('User Pool', () => {
       })).toThrow(/enableSmsRole cannot be disabled/);
     });
   });
+
+  test('email transmission with cyrillic characters are encoded', () => {
+    // GIVEN
+    const stack = new Stack();
+
+    // WHEN
+    new UserPool(stack, 'Pool', {
+      emailSettings: {
+        from: 'от@домен.рф',
+        replyTo: 'ответить@домен.рф',
+      },
+    });
+
+    // THEN
+    expect(stack).toHaveResourceLike('AWS::Cognito::UserPool', {
+      EmailConfiguration: {
+        From: 'от@xn--d1acufc.xn--p1ai',
+        ReplyToEmailAddress: 'ответить@xn--d1acufc.xn--p1ai',
+      },
+    });
+  });
 });
 
 

packages/aws-cdk-lib/package.json

@@ -82,6 +82,7 @@
     "fs-extra",
     "jsonschema",
     "minimatch",
+    "punycode",
     "semver",
     "yaml"
   ],
@@ -90,6 +91,7 @@
     "fs-extra": "^9.0.1",
     "jsonschema": "^1.4.0",
     "minimatch": "^3.0.4",
+    "punycode": "^2.1.1",
     "semver": "^7.3.2",
     "yaml": "1.10.0"
   },

packages/monocdk/NOTICE

@@ -120,4 +120,28 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
-----------------
+----------------
+
+** punycode - https://www.npmjs.com/package/punycode
+Copyright Mathias Bynens <https://mathiasbynens.be/>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+---------------- 

packages/monocdk/package.json

@@ -81,6 +81,7 @@
     "fs-extra",
     "jsonschema",
     "minimatch",
+    "punycode",
     "semver",
     "yaml"
   ],
@@ -89,6 +90,7 @@
     "fs-extra": "^9.0.1",
     "jsonschema": "^1.4.0",
     "minimatch": "^3.0.4",
+    "punycode": "^2.1.1",
     "semver": "^7.3.2",
     "yaml": "1.10.0"
   },

tools/cdk-build-tools/config/eslintrc.js

@@ -84,6 +84,19 @@ module.exports = {
       alphabetize: { order: 'asc', caseInsensitive: true },
     }],
 
+    // disallow import of deprecated punycode package
+    'no-restricted-imports': [
+      'error', {
+        paths: [
+          {
+            name: 'punycode',
+            message: `Package 'punycode' has to be imported with trailing slash, see warning in https://github.com/bestiejs/punycode.js#installation`,
+          },
+        ],
+        patterns: ['!punycode/'],
+      },
+    ],
+
     // Cannot import from the same module twice
     'no-duplicate-imports': ['error'],
 

yarn.lock

@@ -3191,6 +3191,11 @@
   resolved "https://registry.yarnpkg.com/@types/proxyquire/-/proxyquire-1.3.28.tgz#05a647bb0d8fe48fc8edcc193e43cc79310faa7d"
   integrity sha512-SQaNzWQ2YZSr7FqAyPPiA3FYpux2Lqh3HWMZQk47x3xbMCqgC/w0dY3dw9rGqlweDDkrySQBcaScXWeR+Yb11Q==
 
+"@types/punycode@^2.1.0":
+  version "2.1.0"
+  resolved "https://registry.yarnpkg.com/@types/punycode/-/punycode-2.1.0.tgz#89e4f3d09b3f92e87a80505af19be7e0c31d4e83"
+  integrity sha512-PG5aLpW6PJOeV2fHRslP4IOMWn+G+Uq8CfnyJ+PDS8ndCbU+soO+fB3NKCKo0p/Jh2Y4aPaiQZsrOXFdzpcA6g==
+
 "@types/q@^1.5.1":
   version "1.5.4"
   resolved "https://registry.yarnpkg.com/@types/q/-/q-1.5.4.tgz#15925414e0ad2cd765bfef58842f7e26a7accb24"