fix: do not sign requests that have optional auth

[Jordan-Nelson]

Issue #, if available:

Description of changes:

• Update WithSigV4 to not sign requests that have optional auth
• Update amplify auth to only use local credentials to determine if a user is logged in prior to calling sign in
• Update the Authenticator to only use local credentials to determine if a user is logged in prior to calling sign in

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[dnys1]

Suggested change

	// Do not attempt to sign requests where auth is optional.
	// Do not attempt to sign requests where auth is optional.
	//
	// This is only set in Cognito and SSO services where the trait indicates
	// that signing is strictly unnecessary and that signing the request does
	// not impact the behavior of the APIs.

Wondering if we should put a check in place in smithy_codegen which throws if we encounter an @optionalAuth trait which is not in one of these services 🤔

[dnys1]

For example, we could add this to packages/smithy_codegen/lib/src/generate.dart:

/// Asserts that the `@optionalAuth` trait is only present in Cognito and SSO
/// services, where we know the behavior is that signing is strictly unnecessary.
///
/// Any other services which onboard this trait must be validated for the same behavior
/// before we can generate for them.
class _AssertOptionalAuthVisitor extends CategoryShapeVisitor<Shape> {
  const _AssertOptionalAuthVisitor();

  /// The list of known services where `@optionalAuth` is present and its behavior has
  /// been verified.
  static const _knownServices = [
    'com.amazonaws.cognitoidentity',
    'com.amazonaws.cognitoidentityprovider',
    'com.amazonaws.sso',
    'com.amazonaws.ssooidc',
  ];

  @override
  EnumShape enumShape(EnumShape shape, [Shape? parent]) => shape;

  @override
  ListShape listShape(ListShape shape, [Shape? parent]) => shape;

  @override
  MapShape mapShape(MapShape shape, [Shape? parent]) => shape;

  @override
  MemberShape memberShape(MemberShape shape, [Shape? parent]) => shape;

  @override
  OperationShape operationShape(OperationShape shape, [Shape? parent]) {
    if (shape.hasTrait<OptionalAuthTrait>() &&
        !_knownServices.contains(shape.shapeId.namespace)) {
      throw StateError(
        'Shape has @optionalAuth but it is not from a validated service: '
        '${shape.shapeId}',
      );
    }
    return shape;
  }

  @override
  ResourceShape resourceShape(ResourceShape shape, [Shape? parent]) => shape;

  @override
  ServiceShape serviceShape(ServiceShape shape, [Shape? parent]) => shape;

  @override
  SetShape setShape(SetShape shape, [Shape? parent]) => shape;

  @override
  SimpleShape simpleShape(SimpleShape shape, [Shape? parent]) => shape;

  @override
  StructureShape structureShape(StructureShape shape, [Shape? parent]) => shape;

  @override
  UnionShape unionShape(UnionShape shape, [Shape? parent]) => shape;
}

[Jordan-Nelson]

Updated the comment.

As for the check, I think we have to be able to assume traits mean the same thing across services. In this case "optionalAuth" means that signing the request is not required, has no impact on the behavior.

[Equartey]

Does this throws if it can't get the user?