阻止用户自行使用联合身份提供商(FIP)进行注册，但如果管理员添加，则允许使用FIP进行登录

所以，这是我最终编写的预注册 Lambda 触发器。我花时间使用async/await而不是 Promises。它工作得很好，除了有一个记录在案的错误，即 Cognito 强制第一次使用外部身份提供者的用户注册，然后再次登录（因此他们会看到两次身份验证页面），然后才能访问应用程序。我有一个关于如何解决这个问题的想法，但与此同时，下面的 Lambda 做了我想要的。此外，事实证明来自 Login With Amazon 的 ID 没有使用正确的大小写，所以我不得不手动重新格式化该 ID，这很不幸。让我觉得 Cognito 触发器的实现有点问题。

const PROVIDER_MAP = new Map([
    ['facebook', 'Facebook'],
    ['google', 'Google'],
    ['loginwithamazon', 'LoginWithAmazon'],
    ['signinwithapple', 'SignInWithApple']
]);

async function getFirstCognitoUserWithSameEmail(event) {
    const { region, userPoolId, request } = event;

    const AWS = require('aws-sdk');
    const cognito = new AWS.CognitoIdentityServiceProvider({
        region
    });

    const parameters = {
        UserPoolId: userPoolId,
        AttributesToGet: ['sub', 'email'], // We don't really need these attributes
        Filter: `email = "${request.userAttributes.email}"` // Unfortunately, only one filter can be applied at once
    };

    const listUserQuery = await cognito.listUsers(parameters).promise();

    if (!listUserQuery || !listUserQuery.Users) {
        return { error: 'Could not get list of users.' };
    }

    const { Users: users } = listUserQuery;

    const cognitoUsers = users.filter(
        user => user.UserStatus !== 'EXTERNAL_PROVIDER' && user.Enabled
    );

    if (cognitoUsers.length === 0) {
        console.log('No existing enabled Cognito user with same email address found.');
        return {
            error: 'User is not allowed to sign up.'
        };
    }

    if (cognitoUsers.length > 1) {
        cognitoUsers.sort((a, b) =>
            a.UserCreateDate > b.UserCreateDate ? 1 : -1
        );
    }

    console.log(
        `Found ${cognitoUsers.length} enabled Cognito user(s) with same email address.`
    );

    return { user: cognitoUsers[0], error: null };
}

// Only external users get linked with Cognito users by design
async function linkExternalUserToCognitoUser(event, existingUsername) {
    const { userName, region, userPoolId } = event;

    const [
        externalIdentityProviderName,
        externalIdentityUserId
    ] = userName.split('_');

    if (!externalIdentityProviderName || !externalIdentityUserId) {
        console.error(
            'Invalid identity provider name or external user ID. Should look like facebook_123456789.'
        );
        return { error: 'Invalid external user data.' };
    }

    const providerName = PROVIDER_MAP.get(externalIdentityProviderName);

    let userId = externalIdentityUserId;
    if (providerName === PROVIDER_MAP.get('loginwithamazon')) {
        // Amazon IDs look like amzn1.account.ABC123DEF456
        const [part1, part2, amazonId] = userId.split('.');
        const upperCaseAmazonId = amazonId.toUpperCase();
        userId = `${part1}.${part2}.${upperCaseAmazonId}`;
    }

    const AWS = require('aws-sdk');
    const cognito = new AWS.CognitoIdentityServiceProvider({
        region
    });

    console.log(`Linking ${userName} (ID: ${userId}).`);

    const parameters = {
        // Existing user in the user pool to be linked to the external identity provider user account.
        DestinationUser: {
            ProviderAttributeValue: existingUsername,
            ProviderName: 'Cognito'
        },
        // An external identity provider account for a user who does not currently exist yet in the user pool.
        SourceUser: {
            ProviderAttributeName: 'Cognito_Subject',
            ProviderAttributeValue: userId,
            ProviderName: providerName // Facebook, Google, Login with Amazon, Sign in with Apple
        },
        UserPoolId: userPoolId
    };

    // See https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminLinkProviderForUser.html
    await cognito.adminLinkProviderForUser(parameters).promise();

    console.log('Successfully linked external identity to user.');

    // TODO: Update the user created for the external identity and update the "email verified" flag to true. This should take care of the bug where users have to sign in twice when they sign up with an identity provider for the first time to access the website.
    // Bug is documented here: https://forums.aws.amazon.com/thread.jspa?threadID=267154&start=25&tstart=0

    return { error: null };
}

module.exports = async (event, context, callback) => {
    // See event structure at https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html
    const { triggerSource } = event;

    switch (triggerSource) {
        default: {
            return callback(null, event);
        }
        case 'PreSignUp_ExternalProvider': {
            try {
                const {
                    user,
                    error: getUserError
                } = await getFirstCognitoUserWithSameEmail(event);

                if (getUserError) {
                    console.error(getUserError);
                    return callback(getUserError, null);
                }

                const {
                    error: linkUserError
                } = await linkExternalUserToCognitoUser(event, user.Username);

                if (linkUserError) {
                    console.error(linkUserError);
                    return callback(linkUserError, null);
                }

                return callback(null, event);
            } catch (error) {
                const errorMessage =
                    'An error occurred while signing up user from an external identity provider.';
                console.error(errorMessage, error);

                return callback(errorMessage, null);
            }
        }
    }
};