belt 0.3.14 → 0.3.15

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 55308d608d7b85464c0b0861a0aa5e38ea9787ff931cf2ed9ee698d62d0bcbe8
-  data.tar.gz: daa931d9c87236b78510a870d6a651377233d185812b8bf557a4a4afd23d6f01
+  metadata.gz: 491ae37769b6a21cfd1823301d425d0af0b3f1e3c19952b909febebc7f2c3b32
+  data.tar.gz: a2427f68a34d38be0cf3af42ac33a8d3c3d190f36505c54ef531219cd0c3fb66
 SHA512:
-  metadata.gz: 1b1b6ac554fca615222bffd1e9089fc6e96ad089a9081b6dc83f48a7ea73477662373e57ad33d4f51aad41991fb747f67575bc68c8e8a4a9b88715f2c7af4764
-  data.tar.gz: cf04548387af38ae1b49375ecb782fcd51878c679fbf8340f083b82c26b6900524cdf89dfc196b12d21918dd0b145e3a1de8624d7b44a118cc61eea2197aa49d
+  metadata.gz: 895fb4f7238141ba4752cdfc9200c44b2ef870bbc61585a436d3a9e36f39c689e8429d97ad4cf0101d92cbea06b3771864c1d31e4892dae54448a2f0e8ec138b
+  data.tar.gz: 4b2fee884c2f7ad9ba78bd7a46dacf75d1d5c8aa5da43d151ab7d03889aa740dd60a12a1fce5c18467f7c3bbb54aacb886a55efdcc58a997ed6367148ea37f15

data/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.3.15
+
+### Bug Fix
+
+- **`belt generate auth` NEW_PASSWORD_REQUIRED challenge sent `email` even when
+  the user already had it**: The 0.3.14 fix always passed `{ email }` to
+  `completeNewPasswordChallenge`. That fixed pools where `email` was missing, but
+  broke the common case where the user already has `email` set (e.g. created via
+  `admin-create-user` with an email) — Cognito rejects that with a 400
+  `NotAuthorizedException: Cannot modify an already provided email`. The template
+  now reads the `requiredAttributes` list Cognito provides in the
+  `newPasswordRequired` callback and supplies `email` **only when Cognito actually
+  requires it**. Users with email already set complete the challenge without
+  re-sending it; users missing email still get it supplied. Handles both cases.
+
 ## 0.3.14
 
 ### Bug Fix

data/lib/belt/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Belt
-  VERSION = '0.3.14'
+  VERSION = '0.3.15'
 end

data/lib/templates/generate/auth/frontend/auth.js

@@ -37,41 +37,54 @@ export function signIn(username, password) {
         resolve({ success: true })
       },
       onFailure: (err) => reject(err),
-      newPasswordRequired: () => {
-        // Stash the user so completeNewPassword can continue the SRP session.
+      newPasswordRequired: (_userAttributes, requiredAttributes) => {
+        // Stash the user + the attributes Cognito actually requires so
+        // completeNewPassword can continue the SRP session and supply exactly
+        // what the pool asks for — no more, no less.
         pendingUser = cognitoUser
+        pendingRequiredAttributes = requiredAttributes || []
         resolve({ challenge: 'NEW_PASSWORD_REQUIRED' })
       }
     })
   })
 }
 
-// Holds the CognitoUser mid-challenge for the NEW_PASSWORD_REQUIRED flow.
+// Holds the CognitoUser mid-challenge for the NEW_PASSWORD_REQUIRED flow,
+// plus the list of attributes Cognito flagged as required for the challenge.
 let pendingUser = null
+let pendingRequiredAttributes = []
 
 export function completeNewPassword(email, newPassword) {
   if (!pendingUser) {
     return Promise.reject(new Error('No pending password challenge. Sign in again.'))
   }
 
-  // Pools that require `email` reject the NEW_PASSWORD_REQUIRED challenge with
-  // "Invalid attributes given, email is missing" unless we supply it here.
-  // Admin-created users hitting this challenge don't have email set yet, so we
-  // pass the username (which is the email) as the required attribute.
-  const requiredAttributes = { email }
+  // Only supply attributes Cognito actually asks for in this challenge.
+  //   - If the pool requires `email` and the user doesn't have it yet, it shows
+  //     up in requiredAttributes → we send it (username is the email). Skipping
+  //     it would fail with "Invalid attributes given, email is missing".
+  //   - If the user already has `email` (e.g. admin-created with it), it is NOT
+  //     in requiredAttributes → we must NOT send it, or Cognito rejects with
+  //     "Cannot modify an already provided email".
+  const attributes = {}
+  if (pendingRequiredAttributes.includes('email')) {
+    attributes.email = email
+  }
 
   return new Promise((resolve, reject) => {
-    pendingUser.completeNewPasswordChallenge(newPassword, requiredAttributes, {
+    pendingUser.completeNewPasswordChallenge(newPassword, attributes, {
       onSuccess: (session) => {
         setTokens({
           IdToken: session.getIdToken().getJwtToken(),
           RefreshToken: session.getRefreshToken().getToken()
         })
         pendingUser = null
+        pendingRequiredAttributes = []
         resolve({ success: true })
       },
       onFailure: (err) => {
         pendingUser = null
+        pendingRequiredAttributes = []
         reject(err)
       }
     })

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: belt
 version: !ruby/object:Gem::Version
-  version: 0.3.14
+  version: 0.3.15
 platform: ruby
 authors:
 - Stowzilla