import base64
import hashlib
import hmac

def calculate_secret_hash(username: str, client_id: str, client_secret: str) -> str:
    """
    Calculate the Cognito SECRET_HASH using HMAC SHA256 for secret-enabled clients.
    """
    msg = username + client_id
    dig = hmac.new(client_secret.encode('utf-8'),
                   msg.encode('utf-8'), hashlib.sha256).digest()
    return base64.b64encode(dig).decode()