feat: add OAuth2 provider support to identity (#1856)

* feat: add OAuth2 provider support to identity

* fix: mark provider config as sensitive + use modeled errors

* fix: preserve existing provider config on update, and generalize config validation

Author: nborges-aws

src/core/identity.tsx

@@ -1,19 +1,31 @@
 import {
   CreateApiKeyCredentialProviderCommand,
+  CreateOauth2CredentialProviderCommand,
   DeleteApiKeyCredentialProviderCommand,
+  DeleteOauth2CredentialProviderCommand,
   GetApiKeyCredentialProviderCommand,
+  GetOauth2CredentialProviderCommand,
   ListApiKeyCredentialProvidersCommand,
+  ListOauth2CredentialProvidersCommand,
   UpdateApiKeyCredentialProviderCommand,
+  UpdateOauth2CredentialProviderCommand,
   type CreateApiKeyCredentialProviderResponse,
+  type CreateOauth2CredentialProviderResponse,
   type DeleteApiKeyCredentialProviderResponse,
+  type DeleteOauth2CredentialProviderResponse,
   type GetApiKeyCredentialProviderResponse,
+  type GetOauth2CredentialProviderResponse,
   type ListApiKeyCredentialProvidersResponse,
+  type ListOauth2CredentialProvidersResponse,
   type UpdateApiKeyCredentialProviderResponse,
+  type UpdateOauth2CredentialProviderResponse,
 } from "@aws-sdk/client-bedrock-agentcore-control";
 import type {
   CoreIdentityClient,
   CreateApiKeyCredentialProviderInput,
+  CreateOauth2CredentialProviderInput,
   UpdateApiKeyCredentialProviderInput,
+  UpdateOauth2CredentialProviderInput,
 } from "../handlers/identity/types";
 import type { AwsClients, CoreOptions } from "./types";
 import { toClientConfig } from "./utils";
@@ -66,4 +78,50 @@ export class IdentityClient implements CoreIdentityClient {
       .control(toClientConfig(options))
       .send(new DeleteApiKeyCredentialProviderCommand({ name }));
   }
+
+  async createOauth2CredentialProvider(
+    input: CreateOauth2CredentialProviderInput,
+    options: CoreOptions,
+  ): Promise<CreateOauth2CredentialProviderResponse> {
+    return this.clients
+      .control(toClientConfig(options))
+      .send(new CreateOauth2CredentialProviderCommand(input));
+  }
+
+  async getOauth2CredentialProvider(
+    name: string,
+    options: CoreOptions,
+  ): Promise<GetOauth2CredentialProviderResponse> {
+    return this.clients
+      .control(toClientConfig(options))
+      .send(new GetOauth2CredentialProviderCommand({ name }));
+  }
+
+  async listOauth2CredentialProviders(
+    nextToken: string | undefined,
+    maxResults: number | undefined,
+    options: CoreOptions,
+  ): Promise<ListOauth2CredentialProvidersResponse> {
+    return this.clients
+      .control(toClientConfig(options))
+      .send(new ListOauth2CredentialProvidersCommand({ nextToken, maxResults }));
+  }
+
+  async updateOauth2CredentialProvider(
+    input: UpdateOauth2CredentialProviderInput,
+    options: CoreOptions,
+  ): Promise<UpdateOauth2CredentialProviderResponse> {
+    return this.clients
+      .control(toClientConfig(options))
+      .send(new UpdateOauth2CredentialProviderCommand(input));
+  }
+
+  async deleteOauth2CredentialProvider(
+    name: string,
+    options: CoreOptions,
+  ): Promise<DeleteOauth2CredentialProviderResponse> {
+    return this.clients
+      .control(toClientConfig(options))
+      .send(new DeleteOauth2CredentialProviderCommand({ name }));
+  }
 }

src/handlers/identity/api-key-credential-provider/create/index.tsx

@@ -6,7 +6,7 @@ import type { Core } from "../../../types";
 import type { AppIO } from "../../../../io";
 import { coreOptsFromCtx, parseTags } from "../../../utils";
 import { SourceResolver } from "../../../../io";
-import { parseSecretReference } from "../parser";
+import { parseSecretReference } from "../../parser";
 
 export const createCreateApiKeyCredentialProviderHandler = (core: Core, io: AppIO) =>
   createHandler({
@@ -46,7 +46,7 @@ export const createCreateApiKeyCredentialProviderHandler = (core: Core, io: AppI
       const resolver = new SourceResolver({ stdin: io.stdin });
       const apiKey = await resolver.resolveText("api-key", flags["api-key"]);
       const apiKeySecretConfig = hasSecretRef
-        ? parseSecretReference(flags["api-key-secret-reference"]!)
+        ? parseSecretReference("api-key-secret-reference", flags["api-key-secret-reference"]!)
         : undefined;
       const apiKeySecretSource = hasApiKey ? "MANAGED" : "EXTERNAL";
       const tags = parseTags(flags.tags);

src/handlers/identity/api-key-credential-provider/parser.tsx

@@ -6,7 +6,7 @@ import type { Core } from "../../../types";
 import type { AppIO } from "../../../../io";
 import { coreOptsFromCtx } from "../../../utils";
 import { SourceResolver } from "../../../../io";
-import { parseSecretReference } from "../parser";
+import { parseSecretReference } from "../../parser";
 
 export const createUpdateApiKeyCredentialProviderHandler = (core: Core, io: AppIO) =>
   createHandler({
@@ -59,7 +59,7 @@ export const createUpdateApiKeyCredentialProviderHandler = (core: Core, io: AppI
       const resolver = new SourceResolver({ stdin: io.stdin });
       const apiKey = await resolver.resolveText("api-key", flags["api-key"]);
       const apiKeySecretConfig = hasSecretRef
-        ? parseSecretReference(flags["api-key-secret-reference"]!)
+        ? parseSecretReference("api-key-secret-reference", flags["api-key-secret-reference"]!)
         : undefined;
 
       ctx.require(JsonRendererKey).renderJson(

src/handlers/identity/api-key-credential-provider/update/index.tsx

@@ -53,6 +53,7 @@ describe("identity command hierarchy", () => {
 
     expect(identity?.children().map((child) => child.name())).toEqual([
       "api-key-credential-provider",
+      "oauth2-credential-provider",
     ]);
     expect(
       identity
@@ -240,7 +241,7 @@ describe("api-key-credential-provider CRUDL", () => {
         "--api-key-secret-reference",
         '{"jsonKey":"apiKey"}',
       ],
-      /non-empty "secretId"/,
+      /--api-key-secret-reference/,
     ],
     [
       "create: --api-key-secret-reference with unexpected field",
@@ -253,7 +254,7 @@ describe("api-key-credential-provider CRUDL", () => {
         "--api-key-secret-reference",
         '{"secretId":"arn:aws:secretsmanager:us-west-2:123:secret:s","jsonKey":"apiKey","extra":"bad"}',
       ],
-      /unexpected fields/,
+      /--api-key-secret-reference/,
     ],
     [
       "update: --api-key with --api-key-secret-reference",

src/handlers/identity/identity.test.tsx

@@ -2,10 +2,12 @@ import { Router } from "../../router";
 import type { AppIO } from "../../io";
 import type { Core } from "../types";
 import { createApiKeyCredentialProviderHandler } from "./api-key-credential-provider";
+import { createOauth2CredentialProviderHandler } from "./oauth2-credential-provider";
 import { createHelpDefault } from "../help";
 
 export function createIdentityHandler(core: Core, io: AppIO): Router {
   return new Router("identity", "manage AgentCore Identity resources")
     .default(createHelpDefault(io))
-    .handler(createApiKeyCredentialProviderHandler(core, io));
+    .handler(createApiKeyCredentialProviderHandler(core, io))
+    .handler(createOauth2CredentialProviderHandler(core, io));
 }

src/handlers/identity/index.tsx

@@ -0,0 +1,18 @@
+{
+  "clientSecretArn": {
+    "secretArn": "arn:aws:secretsmanager:us-west-2:685197708687:secret:bedrock-agentcore-identity!default/oauth2/agentcore-cli-oauth2-fixture-2-7058dd32-VnfWeP"
+  },
+  "name": "agentcore-cli-oauth2-fixture-2",
+  "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/oauth2credentialprovider/agentcore-cli-oauth2-fixture-2",
+  "clientSecretSource": "MANAGED",
+  "callbackUrl": "https://bedrock-agentcore.us-west-2.amazonaws.com/identities/oauth2/callback/b783b413-142f-4bbd-9f5d-6198ce095ee3",
+  "oauth2ProviderConfigOutput": {
+    "customOauth2ProviderConfig": {
+      "oauthDiscovery": {
+        "discoveryUrl": "https://example.com/.well-known/openid-configuration"
+      },
+      "clientId": "fixture-client-id-2"
+    }
+  },
+  "status": "READY"
+}

src/handlers/identity/oauth2-credential-provider/__fixtures__/CreateOauth2CredentialProviderCommand.304dfc1dc8ca48aa.json

@@ -0,0 +1,18 @@
+{
+  "clientSecretArn": {
+    "secretArn": "arn:aws:secretsmanager:us-west-2:685197708687:secret:bedrock-agentcore-identity!default/oauth2/agentcore-cli-oauth2-fixture-d172b1a9-dFOvOv"
+  },
+  "name": "agentcore-cli-oauth2-fixture",
+  "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/oauth2credentialprovider/agentcore-cli-oauth2-fixture",
+  "clientSecretSource": "MANAGED",
+  "callbackUrl": "https://bedrock-agentcore.us-west-2.amazonaws.com/identities/oauth2/callback/2edfe7c4-4655-41a5-9722-767aa15e5b45",
+  "oauth2ProviderConfigOutput": {
+    "customOauth2ProviderConfig": {
+      "oauthDiscovery": {
+        "discoveryUrl": "https://example.com/.well-known/openid-configuration"
+      },
+      "clientId": "fixture-client-id"
+    }
+  },
+  "status": "READY"
+}

src/handlers/identity/oauth2-credential-provider/__fixtures__/CreateOauth2CredentialProviderCommand.4167f0c84f961433.json

@@ -0,0 +1 @@
+{}

src/handlers/identity/oauth2-credential-provider/__fixtures__/DeleteOauth2CredentialProviderCommand.1def95784910b125.json

@@ -0,0 +1 @@
+{}