Amazon DynamoDBへのアクセスをCognitoにより制限してみる

$(function(){
	// 定数
	var REGION = 'us-west-2';
	var ID_POOL_ID = 'フェデレーティッドアイデンティティの[IDプールのID]';
	var COGNITO_IDP = 'cognito-idp.us-west-2.amazonaws.com/ユーザープールの[プールID]';
	var COGNITO_USER_POOL_PARAMS_WITH_PARANOIA = {
		UserPoolId: 'ユーザープールの[プールID]',
		ClientId: '[アプリクライアントID]',
		Paranoia : 7 /* between 1 - 10らしい */
	};
	var COGNITO_USER_POOL_PARAMS = {
		UserPoolId: 'ユーザープールの[プールID]',
		ClientId: '[アプリクライアントID]'
	};
	// 環境設定
	AWS.config.region = REGION;
	AWS.config.credentials = new AWS.CognitoIdentityCredentials({ IdentityPoolId: ID_POOL_ID });
	AWSCognito.config.region = REGION;
	AWSCognito.config.credentials = new AWS.CognitoIdentityCredentials({ IdentityPoolId: ID_POOL_ID });

	var procResetPwdFlow = function(cognitoUser,callbackDialog){

		cognitoUser.forgotPassword({
			onSuccess: function (result) {
				callbackDialog({ state: 'reauth', detail: "" });
			},
			onFailure: function(err) {
				callbackDialog({ state: 'failure', detail: err });
			},
			inputVerificationCode() {
				while(true){
					var verifyCode = prompt('確認コードを入力してください。' ,'');
					var newPwd = prompt('新しいパスワードを入力してください。 ' ,'');
					if(verifyCode && newPwd){
						cognitoUser.confirmPassword(verifyCode, newPwd, this);
						break;
					}
				}
			}
		});
	}
	var procAuthFlow = function(getDlgValue,callbackDialog,mainCallback){

		var authData = new Object();
		authData['Username'] = getDlgValue('name');
		authData['Password'] = getDlgValue('password');

		var authenticationDetails = 
			new AWSCognito.CognitoIdentityServiceProvider.AuthenticationDetails(authData);

		var userData = new Object();
		userData['Username'] = authData['Username'];
		userData['Pool'] = 
			new AWSCognito.CognitoIdentityServiceProvider.CognitoUserPool(COGNITO_USER_POOL_PARAMS_WITH_PARANOIA);

		var cognitoUser = 
			new AWSCognito.CognitoIdentityServiceProvider.CognitoUser(userData);

		cognitoUser.authenticateUser(authenticationDetails, {
			onSuccess: function (authresult) {
				callbackDialog({state:'success', detail:authresult});
				procSession(authresult, mainCallback);
			},
			onFailure: function(err) {
				if(err.code == "PasswordResetRequiredException"){
					procResetPwdFlow(cognitoUser,callbackDialog);
				} else {
					callbackDialog({ state: 'failure', detail: err});
				}
			},
			newPasswordRequired: function(userAttributes, requiredAttributes) {
				while(true){
					var newPwd = prompt('新しいパスワードを入力してください。 ' ,'');
					if(newPwd){
						var attributesData = {};
						cognitoUser.completeNewPasswordChallenge(newPwd, attributesData, this);
						break;
					}
				}
			}
		});
	}
	var procSession = function(userSession, mainCallback){
		var jwtToken = userSession.getIdToken().getJwtToken();

		var logins = new Object();
		logins[COGNITO_IDP] = jwtToken;
		var params = new Object();
		params['IdentityPoolId'] = ID_POOL_ID;
		params['Logins'] = logins;

		AWS.config.credentials = new AWS.CognitoIdentityCredentials(params);
		AWS.config.credentials.get(mainCallback);
	}
	var signIn = function(mainCallback){

		var userPool = 
			new AWSCognito.CognitoIdentityServiceProvider.CognitoUserPool(COGNITO_USER_POOL_PARAMS);
		var cognitoUser = userPool.getCurrentUser();
		if(cognitoUser){
			cognitoUser.getSession(function(err, signInUserSession) {
				if (signInUserSession) {
					procSession(signInUserSession,mainCallback);
				} else {
					$("#dialog").dialog("open");
				}
			});
		} else {
			$("#dialog").dialog("open");
		}
	}
	var getToken = function(table,param) {
		var dfd = $.Deferred();

		table.getItem(param,function(err,data){
			if(err){
				return dfd.reject(err);
			} else {
				var token = data.Item.data.S;
				dfd.resolve(token);
			}
		});
		return dfd.promise();
	}

	var getItemFromDB = function(err){

		if(err){
			alert("getItemFromDB err["+err+"]");
			return ;
		}
		var table = new AWS.DynamoDB({params: {TableName: 'watsonTokens'}, region: REGION });
		$.when(
			getToken(table, { Key:{ tokenType:{S:'STTtoken'}}}),
			getToken(table, { Key:{ tokenType:{S:'TTStoken'}}})
		).done(function(STTtoken,TTStoken){
			alert("STT Token\n---\n"+STTtoken+"\n---\n\nTTS Token\n---\n"+TTStoken+"\n---");
		})
		.fail(function(res){
			alert(res);
		});
	}
	$("#dialog").dialog({
		autoOpen: false,
		modal: true,
		show: 'explode',
		buttons: {
			'ログイン': function() {
				procAuthFlow(getDlgValue, controlDialog, getItemFromDB);
			},
			'キャンセル': function() {
				$(this).dialog('close');
			},
		}
	});
	var getOpenDlg = function(){
		if($('#dialog').dialog('isOpen') === true){
			return $('#dialog');
		}
		return null;
	}
	var controlDialog = function(result){
		var dlg = getOpenDlg();
		if(dlg){
			if(result.state == 'success'){
				dlg.dialog('close');
			} else if(result.state == 'failure'){
				alert(result.detail.message);
			} else if(result.state == 'reauth'){
				dlg.dialog('close');
				$("#dialog").dialog('open');
			} else {
				dlg.dialog('close');
			}
		}
	}
	var getDlgValue = function(id){
		return $('#'+id).val();
	}
	signIn(getItemFromDB);
});