[cognito] UserPoolClient CallbackURLs specified when disableOAuth is true

[blimmer]

When disableOAuth is true, cdk synth still produces an array of CallbackURLs for a UserPoolClient.

Reproduction Steps

import * as cdk from '@aws-cdk/core';
import * as cognito from '@aws-cdk/aws-cognito';

export class CdkStack extends cdk.Stack {
  constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const userPool = new cognito.UserPool(this, 'UserPool');
    const userPoolClient = new cognito.UserPoolClient(this, 'UserPoolClient', {
      userPool,
      disableOAuth: true
    })
  }
}

What did you expect to happen?

I didn't expect any OAuth values to be present in the synth-ed document.

What actually happened?

Resources:
  UserPool6BA7E5F2:
    Type: AWS::Cognito::UserPool
    Properties:
      AccountRecoverySetting:
        RecoveryMechanisms:
          - Name: verified_phone_number
            Priority: 1
          - Name: verified_email
            Priority: 2
      AdminCreateUserConfig:
        AllowAdminCreateUserOnly: true
      EmailVerificationMessage: The verification code to your new account is {####}
      EmailVerificationSubject: Verify your new account
      SmsVerificationMessage: The verification code to your new account is {####}
      VerificationMessageTemplate:
        DefaultEmailOption: CONFIRM_WITH_CODE
        EmailMessage: The verification code to your new account is {####}
        EmailSubject: Verify your new account
        SmsMessage: The verification code to your new account is {####}
    Metadata:
      aws:cdk:path: CdkStack/UserPool/Resource
  UserPoolClient2F5918F7:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      UserPoolId:
        Ref: UserPool6BA7E5F2
      AllowedOAuthFlowsUserPoolClient: false
      CallbackURLs:
        - https://example.com
      SupportedIdentityProviders:
        - COGNITO
    Metadata:
      aws:cdk:path: CdkStack/UserPoolClient/Resource
  CDKMetadata:
    Type: AWS::CDK::Metadata
    Properties:
      Modules: aws-cdk=1.62.0,@aws-cdk/assets=1.62.0,@aws-cdk/aws-applicationautoscaling=1.62.0,@aws-cdk/aws-autoscaling-common=1.62.0,@aws-cdk/aws-cloudwatch=1.62.0,@aws-cdk/aws-codeguruprofiler=1.62.0,@aws-cdk/aws-cognito=1.62.0,@aws-cdk/aws-ec2=1.62.0,@aws-cdk/aws-events=1.62.0,@aws-cdk/aws-iam=1.62.0,@aws-cdk/aws-kms=1.62.0,@aws-cdk/aws-lambda=1.62.0,@aws-cdk/aws-logs=1.62.0,@aws-cdk/aws-s3=1.62.0,@aws-cdk/aws-s3-assets=1.62.0,@aws-cdk/aws-sqs=1.62.0,@aws-cdk/aws-ssm=1.62.0,@aws-cdk/cloud-assembly-schema=1.62.0,@aws-cdk/core=1.62.0,@aws-cdk/custom-resources=1.62.0,@aws-cdk/cx-api=1.62.0,@aws-cdk/region-info=1.62.0,jsii-runtime=node.js/v12.18.3
    Condition: CDKMetadataAvailable

Specifically, I didn't expect this block to be present:

CallbackURLs:
  - https://example.com

Environment

• CLI Version : 1.62.0 (build 8c2d7fc)
• Framework Version: 1.62.0
• Node.js Version: v12.18.3
• OS : macOS
• Language (Version):

Other

---

This is 🐛 Bug Report

[nija-at]

It looks like this was missed here. This must likely also be applied to logoutUrls.

aws-cdk/packages/@aws-cdk/aws-cognito/lib/user-pool-client.ts

Lines 323 to 324 in 483e319

	callbackUrLs: callbackUrls && callbackUrls.length > 0 ? callbackUrls : undefined,
	logoutUrLs: props.oAuth?.logoutUrls,

@blimmer - does this cause any impact to the Cognito client or your application because of this?

[blimmer]

Hey @nija-at - I didn't notice anything weird from this, just the presence of that URL in the cdk diff.