@aws-amplify/adapter-nextjs 1.3.1-unstable.4b3b13d.0 → 1.3.1

package/dist/cjs/createServerRunner.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createServerRunner = void 0;
 const utils_1 = require("@aws-amplify/core/internals/utils");
 const utils_2 = require("./utils");
+const createTokenValidator_1 = require("./utils/createTokenValidator");
 /**
  * Creates the `runWithAmplifyServerContext` function to run Amplify server side APIs in an isolated request context.
  *
@@ -26,9 +27,18 @@ const utils_2 = require("./utils");
  */
 const createServerRunner = ({ config, }) => {
     const amplifyConfig = (0, utils_1.parseAmplifyConfig)(config);
+    let tokenValidator;
+    if (amplifyConfig?.Auth) {
+        const { Cognito } = amplifyConfig.Auth;
+        tokenValidator = (0, createTokenValidator_1.createTokenValidator)({
+            userPoolId: Cognito?.userPoolId,
+            userPoolClientId: Cognito?.userPoolClientId,
+        });
+    }
     return {
         runWithAmplifyServerContext: (0, utils_2.createRunWithAmplifyServerContext)({
             config: amplifyConfig,
+            tokenValidator,
         }),
     };
 };

package/dist/cjs/createServerRunner.js.map

@@ -1 +1 @@
-{"version":3,"file":"createServerRunner.js","sources":["../../src/createServerRunner.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.createServerRunner = void 0;\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nconst utils_2 = require(\"./utils\");\n/**\n * Creates the `runWithAmplifyServerContext` function to run Amplify server side APIs in an isolated request context.\n *\n * @remarks\n * This function should be called only once; you can use the returned `runWithAmplifyServerContext` across\n * your codebase.\n *\n * @param input The input used to create the `runWithAmplifyServerContext` function.\n * @param input.config The {@link ResourcesConfig} imported from the `amplifyconfiguration.json` file or manually\n * created.\n * @returns An object that contains the `runWithAmplifyServerContext` function.\n *\n * @example\n * import { createServerRunner } from '@aws-amplify/adapter-nextjs';\n * import config from './amplifyconfiguration.json';\n *\n * export const { runWithAmplifyServerContext } = createServerRunner({ config })\n */\nconst createServerRunner = ({ config, }) => {\n    const amplifyConfig = (0, utils_1.parseAmplifyConfig)(config);\n    return {\n        runWithAmplifyServerContext: (0, utils_2.createRunWithAmplifyServerContext)({\n            config: amplifyConfig,\n        }),\n    };\n};\nexports.createServerRunner = createServerRunner;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,OAAO,CAAC,kBAAkB,GAAG,KAAK,CAAC,CAAC;AACpC,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC,CAAC;AAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;AACnC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAM,kBAAkB,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK;AAC5C,IAAI,MAAM,aAAa,GAAG,IAAI,OAAO,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;AAClE,IAAI,OAAO;AACX,QAAQ,2BAA2B,EAAE,IAAI,OAAO,CAAC,iCAAiC,EAAE;AACpF,YAAY,MAAM,EAAE,aAAa;AACjC,SAAS,CAAC;AACV,KAAK,CAAC;AACN,CAAC,CAAC;AACF,OAAO,CAAC,kBAAkB,GAAG,kBAAkB;;"}
+{"version":3,"file":"createServerRunner.js","sources":["../../src/createServerRunner.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.createServerRunner = void 0;\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nconst utils_2 = require(\"./utils\");\nconst createTokenValidator_1 = require(\"./utils/createTokenValidator\");\n/**\n * Creates the `runWithAmplifyServerContext` function to run Amplify server side APIs in an isolated request context.\n *\n * @remarks\n * This function should be called only once; you can use the returned `runWithAmplifyServerContext` across\n * your codebase.\n *\n * @param input The input used to create the `runWithAmplifyServerContext` function.\n * @param input.config The {@link ResourcesConfig} imported from the `amplifyconfiguration.json` file or manually\n * created.\n * @returns An object that contains the `runWithAmplifyServerContext` function.\n *\n * @example\n * import { createServerRunner } from '@aws-amplify/adapter-nextjs';\n * import config from './amplifyconfiguration.json';\n *\n * export const { runWithAmplifyServerContext } = createServerRunner({ config })\n */\nconst createServerRunner = ({ config, }) => {\n    const amplifyConfig = (0, utils_1.parseAmplifyConfig)(config);\n    let tokenValidator;\n    if (amplifyConfig?.Auth) {\n        const { Cognito } = amplifyConfig.Auth;\n        tokenValidator = (0, createTokenValidator_1.createTokenValidator)({\n            userPoolId: Cognito?.userPoolId,\n            userPoolClientId: Cognito?.userPoolClientId,\n        });\n    }\n    return {\n        runWithAmplifyServerContext: (0, utils_2.createRunWithAmplifyServerContext)({\n            config: amplifyConfig,\n            tokenValidator,\n        }),\n    };\n};\nexports.createServerRunner = createServerRunner;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,OAAO,CAAC,kBAAkB,GAAG,KAAK,CAAC,CAAC;AACpC,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC,CAAC;AAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;AACnC,MAAM,sBAAsB,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;AACvE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAM,kBAAkB,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK;AAC5C,IAAI,MAAM,aAAa,GAAG,IAAI,OAAO,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;AAClE,IAAI,IAAI,cAAc,CAAC;AACvB,IAAI,IAAI,aAAa,EAAE,IAAI,EAAE;AAC7B,QAAQ,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC;AAC/C,QAAQ,cAAc,GAAG,IAAI,sBAAsB,CAAC,oBAAoB,EAAE;AAC1E,YAAY,UAAU,EAAE,OAAO,EAAE,UAAU;AAC3C,YAAY,gBAAgB,EAAE,OAAO,EAAE,gBAAgB;AACvD,SAAS,CAAC,CAAC;AACX,KAAK;AACL,IAAI,OAAO;AACX,QAAQ,2BAA2B,EAAE,IAAI,OAAO,CAAC,iCAAiC,EAAE;AACpF,YAAY,MAAM,EAAE,aAAa;AACjC,YAAY,cAAc;AAC1B,SAAS,CAAC;AACV,KAAK,CAAC;AACN,CAAC,CAAC;AACF,OAAO,CAAC,kBAAkB,GAAG,kBAAkB;;"}

package/dist/cjs/utils/createRunWithAmplifyServerContext.js

@@ -6,9 +6,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createRunWithAmplifyServerContext = void 0;
 const core_1 = require("@aws-amplify/core");
 const adapter_core_1 = require("aws-amplify/adapter-core");
-const createTokenValidator_1 = require("./createTokenValidator");
 const createCookieStorageAdapterFromNextServerContext_1 = require("./createCookieStorageAdapterFromNextServerContext");
-const createRunWithAmplifyServerContext = ({ config: resourcesConfig, }) => {
+const createRunWithAmplifyServerContext = ({ config: resourcesConfig, tokenValidator, }) => {
     const runWithAmplifyServerContext = async ({ nextServerContext, operation }) => {
         // When the Auth config is presented, attempt to create a Amplify server
         // context with token and credentials provider.
@@ -20,10 +19,7 @@ const createRunWithAmplifyServerContext = ({ config: resourcesConfig, }) => {
             // static rendering uses the same unauthenticated role cross-sever.
             nextServerContext === null
                 ? core_1.sharedInMemoryStorage
-                : (0, adapter_core_1.createKeyValueStorageFromCookieStorageAdapter)(await (0, createCookieStorageAdapterFromNextServerContext_1.createCookieStorageAdapterFromNextServerContext)(nextServerContext), (0, createTokenValidator_1.createTokenValidator)({
-                    userPoolId: resourcesConfig?.Auth.Cognito?.userPoolId,
-                    userPoolClientId: resourcesConfig?.Auth.Cognito?.userPoolClientId,
-                }));
+                : (0, adapter_core_1.createKeyValueStorageFromCookieStorageAdapter)(await (0, createCookieStorageAdapterFromNextServerContext_1.createCookieStorageAdapterFromNextServerContext)(nextServerContext), tokenValidator);
             const credentialsProvider = (0, adapter_core_1.createAWSCredentialsAndIdentityIdProvider)(resourcesConfig.Auth, keyValueStorage);
             const tokenProvider = (0, adapter_core_1.createUserPoolsTokenProvider)(resourcesConfig.Auth, keyValueStorage);
             return (0, adapter_core_1.runWithAmplifyServerContext)(resourcesConfig, {

package/dist/cjs/utils/createRunWithAmplifyServerContext.js.map

@@ -1 +1 @@
-{"version":3,"file":"createRunWithAmplifyServerContext.js","sources":["../../../src/utils/createRunWithAmplifyServerContext.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.createRunWithAmplifyServerContext = void 0;\nconst core_1 = require(\"@aws-amplify/core\");\nconst adapter_core_1 = require(\"aws-amplify/adapter-core\");\nconst createTokenValidator_1 = require(\"./createTokenValidator\");\nconst createCookieStorageAdapterFromNextServerContext_1 = require(\"./createCookieStorageAdapterFromNextServerContext\");\nconst createRunWithAmplifyServerContext = ({ config: resourcesConfig, }) => {\n    const runWithAmplifyServerContext = async ({ nextServerContext, operation }) => {\n        // When the Auth config is presented, attempt to create a Amplify server\n        // context with token and credentials provider.\n        if (resourcesConfig.Auth) {\n            const keyValueStorage = \n            // When `null` is passed as the value of `nextServerContext`, opt-in\n            // unauthenticated role (primarily for static rendering). It's\n            // safe to use the singleton `MemoryKeyValueStorage` here, as the\n            // static rendering uses the same unauthenticated role cross-sever.\n            nextServerContext === null\n                ? core_1.sharedInMemoryStorage\n                : (0, adapter_core_1.createKeyValueStorageFromCookieStorageAdapter)(await (0, createCookieStorageAdapterFromNextServerContext_1.createCookieStorageAdapterFromNextServerContext)(nextServerContext), (0, createTokenValidator_1.createTokenValidator)({\n                    userPoolId: resourcesConfig?.Auth.Cognito?.userPoolId,\n                    userPoolClientId: resourcesConfig?.Auth.Cognito?.userPoolClientId,\n                }));\n            const credentialsProvider = (0, adapter_core_1.createAWSCredentialsAndIdentityIdProvider)(resourcesConfig.Auth, keyValueStorage);\n            const tokenProvider = (0, adapter_core_1.createUserPoolsTokenProvider)(resourcesConfig.Auth, keyValueStorage);\n            return (0, adapter_core_1.runWithAmplifyServerContext)(resourcesConfig, {\n                Auth: { credentialsProvider, tokenProvider },\n            }, operation);\n        }\n        // Otherwise it may be the case that auth is not used, e.g. API key.\n        // Omitting the `Auth` in the second parameter.\n        return (0, adapter_core_1.runWithAmplifyServerContext)(resourcesConfig, {}, operation);\n    };\n    return runWithAmplifyServerContext;\n};\nexports.createRunWithAmplifyServerContext = createRunWithAmplifyServerContext;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,OAAO,CAAC,iCAAiC,GAAG,KAAK,CAAC,CAAC;AACnD,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAC5C,MAAM,cAAc,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAC3D,MAAM,sBAAsB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;AACjE,MAAM,iDAAiD,GAAG,OAAO,CAAC,mDAAmD,CAAC,CAAC;AACvH,MAAM,iCAAiC,GAAG,CAAC,EAAE,MAAM,EAAE,eAAe,GAAG,KAAK;AAC5E,IAAI,MAAM,2BAA2B,GAAG,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK;AACpF;AACA;AACA,QAAQ,IAAI,eAAe,CAAC,IAAI,EAAE;AAClC,YAAY,MAAM,eAAe;AACjC;AACA;AACA;AACA;AACA,YAAY,iBAAiB,KAAK,IAAI;AACtC,kBAAkB,MAAM,CAAC,qBAAqB;AAC9C,kBAAkB,IAAI,cAAc,CAAC,6CAA6C,EAAE,MAAM,IAAI,iDAAiD,CAAC,+CAA+C,EAAE,iBAAiB,CAAC,EAAE,IAAI,sBAAsB,CAAC,oBAAoB,EAAE;AACtQ,oBAAoB,UAAU,EAAE,eAAe,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU;AACzE,oBAAoB,gBAAgB,EAAE,eAAe,EAAE,IAAI,CAAC,OAAO,EAAE,gBAAgB;AACrF,iBAAiB,CAAC,CAAC,CAAC;AACpB,YAAY,MAAM,mBAAmB,GAAG,IAAI,cAAc,CAAC,yCAAyC,EAAE,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;AAC7I,YAAY,MAAM,aAAa,GAAG,IAAI,cAAc,CAAC,4BAA4B,EAAE,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;AAC1H,YAAY,OAAO,IAAI,cAAc,CAAC,2BAA2B,EAAE,eAAe,EAAE;AACpF,gBAAgB,IAAI,EAAE,EAAE,mBAAmB,EAAE,aAAa,EAAE;AAC5D,aAAa,EAAE,SAAS,CAAC,CAAC;AAC1B,SAAS;AACT;AACA;AACA,QAAQ,OAAO,IAAI,cAAc,CAAC,2BAA2B,EAAE,eAAe,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;AAC/F,KAAK,CAAC;AACN,IAAI,OAAO,2BAA2B,CAAC;AACvC,CAAC,CAAC;AACF,OAAO,CAAC,iCAAiC,GAAG,iCAAiC;;"}
+{"version":3,"file":"createRunWithAmplifyServerContext.js","sources":["../../../src/utils/createRunWithAmplifyServerContext.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.createRunWithAmplifyServerContext = void 0;\nconst core_1 = require(\"@aws-amplify/core\");\nconst adapter_core_1 = require(\"aws-amplify/adapter-core\");\nconst createCookieStorageAdapterFromNextServerContext_1 = require(\"./createCookieStorageAdapterFromNextServerContext\");\nconst createRunWithAmplifyServerContext = ({ config: resourcesConfig, tokenValidator, }) => {\n    const runWithAmplifyServerContext = async ({ nextServerContext, operation }) => {\n        // When the Auth config is presented, attempt to create a Amplify server\n        // context with token and credentials provider.\n        if (resourcesConfig.Auth) {\n            const keyValueStorage = \n            // When `null` is passed as the value of `nextServerContext`, opt-in\n            // unauthenticated role (primarily for static rendering). It's\n            // safe to use the singleton `MemoryKeyValueStorage` here, as the\n            // static rendering uses the same unauthenticated role cross-sever.\n            nextServerContext === null\n                ? core_1.sharedInMemoryStorage\n                : (0, adapter_core_1.createKeyValueStorageFromCookieStorageAdapter)(await (0, createCookieStorageAdapterFromNextServerContext_1.createCookieStorageAdapterFromNextServerContext)(nextServerContext), tokenValidator);\n            const credentialsProvider = (0, adapter_core_1.createAWSCredentialsAndIdentityIdProvider)(resourcesConfig.Auth, keyValueStorage);\n            const tokenProvider = (0, adapter_core_1.createUserPoolsTokenProvider)(resourcesConfig.Auth, keyValueStorage);\n            return (0, adapter_core_1.runWithAmplifyServerContext)(resourcesConfig, {\n                Auth: { credentialsProvider, tokenProvider },\n            }, operation);\n        }\n        // Otherwise it may be the case that auth is not used, e.g. API key.\n        // Omitting the `Auth` in the second parameter.\n        return (0, adapter_core_1.runWithAmplifyServerContext)(resourcesConfig, {}, operation);\n    };\n    return runWithAmplifyServerContext;\n};\nexports.createRunWithAmplifyServerContext = createRunWithAmplifyServerContext;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,OAAO,CAAC,iCAAiC,GAAG,KAAK,CAAC,CAAC;AACnD,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAC5C,MAAM,cAAc,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAC3D,MAAM,iDAAiD,GAAG,OAAO,CAAC,mDAAmD,CAAC,CAAC;AACvH,MAAM,iCAAiC,GAAG,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,cAAc,GAAG,KAAK;AAC5F,IAAI,MAAM,2BAA2B,GAAG,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK;AACpF;AACA;AACA,QAAQ,IAAI,eAAe,CAAC,IAAI,EAAE;AAClC,YAAY,MAAM,eAAe;AACjC;AACA;AACA;AACA;AACA,YAAY,iBAAiB,KAAK,IAAI;AACtC,kBAAkB,MAAM,CAAC,qBAAqB;AAC9C,kBAAkB,IAAI,cAAc,CAAC,6CAA6C,EAAE,MAAM,IAAI,iDAAiD,CAAC,+CAA+C,EAAE,iBAAiB,CAAC,EAAE,cAAc,CAAC,CAAC;AACrO,YAAY,MAAM,mBAAmB,GAAG,IAAI,cAAc,CAAC,yCAAyC,EAAE,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;AAC7I,YAAY,MAAM,aAAa,GAAG,IAAI,cAAc,CAAC,4BAA4B,EAAE,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;AAC1H,YAAY,OAAO,IAAI,cAAc,CAAC,2BAA2B,EAAE,eAAe,EAAE;AACpF,gBAAgB,IAAI,EAAE,EAAE,mBAAmB,EAAE,aAAa,EAAE;AAC5D,aAAa,EAAE,SAAS,CAAC,CAAC;AAC1B,SAAS;AACT;AACA;AACA,QAAQ,OAAO,IAAI,cAAc,CAAC,2BAA2B,EAAE,eAAe,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;AAC/F,KAAK,CAAC;AACN,IAAI,OAAO,2BAA2B,CAAC;AACvC,CAAC,CAAC;AACF,OAAO,CAAC,iCAAiC,GAAG,iCAAiC;;"}

package/dist/cjs/utils/createTokenValidator.js

@@ -4,28 +4,42 @@
 // SPDX-License-Identifier: Apache-2.0
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createTokenValidator = void 0;
+const aws_jwt_verify_1 = require("aws-jwt-verify");
 const isValidCognitoToken_1 = require("./isValidCognitoToken");
 /**
  * Creates a validator object for validating methods in a KeyValueStorage.
  */
 const createTokenValidator = ({ userPoolId, userPoolClientId: clientId, }) => {
+    let idTokenVerifier;
+    let accessTokenVerifier;
     return {
         // validate access, id tokens
         getItem: async (key, value) => {
-            const tokenType = key.includes('.accessToken')
-                ? 'access'
-                : key.includes('.idToken')
-                    ? 'id'
-                    : null;
-            if (!tokenType)
+            const isAccessToken = key.includes('.accessToken');
+            const isIdToken = key.includes('.idToken');
+            if (!isAccessToken && !isIdToken) {
                 return true;
-            if (!userPoolId || !clientId)
+            }
+            if (!userPoolId || !clientId) {
                 return false;
+            }
+            if (isAccessToken && !accessTokenVerifier) {
+                accessTokenVerifier = aws_jwt_verify_1.CognitoJwtVerifier.create({
+                    userPoolId,
+                    tokenUse: 'access',
+                    clientId,
+                });
+            }
+            if (isIdToken && !idTokenVerifier) {
+                idTokenVerifier = aws_jwt_verify_1.CognitoJwtVerifier.create({
+                    userPoolId,
+                    tokenUse: 'id',
+                    clientId,
+                });
+            }
             return (0, isValidCognitoToken_1.isValidCognitoToken)({
-                clientId,
-                userPoolId,
-                tokenType,
                 token: value,
+                verifier: isAccessToken ? accessTokenVerifier : idTokenVerifier,
             });
         },
     };

package/dist/cjs/utils/createTokenValidator.js.map

@@ -1 +1 @@
-{"version":3,"file":"createTokenValidator.js","sources":["../../../src/utils/createTokenValidator.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.createTokenValidator = void 0;\nconst isValidCognitoToken_1 = require(\"./isValidCognitoToken\");\n/**\n * Creates a validator object for validating methods in a KeyValueStorage.\n */\nconst createTokenValidator = ({ userPoolId, userPoolClientId: clientId, }) => {\n    return {\n        // validate access, id tokens\n        getItem: async (key, value) => {\n            const tokenType = key.includes('.accessToken')\n                ? 'access'\n                : key.includes('.idToken')\n                    ? 'id'\n                    : null;\n            if (!tokenType)\n                return true;\n            if (!userPoolId || !clientId)\n                return false;\n            return (0, isValidCognitoToken_1.isValidCognitoToken)({\n                clientId,\n                userPoolId,\n                tokenType,\n                token: value,\n            });\n        },\n    };\n};\nexports.createTokenValidator = createTokenValidator;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,OAAO,CAAC,oBAAoB,GAAG,KAAK,CAAC,CAAC;AACtC,MAAM,qBAAqB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;AAC/D;AACA;AACA;AACA,MAAM,oBAAoB,GAAG,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,QAAQ,GAAG,KAAK;AAC9E,IAAI,OAAO;AACX;AACA,QAAQ,OAAO,EAAE,OAAO,GAAG,EAAE,KAAK,KAAK;AACvC,YAAY,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;AAC1D,kBAAkB,QAAQ;AAC1B,kBAAkB,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;AAC1C,sBAAsB,IAAI;AAC1B,sBAAsB,IAAI,CAAC;AAC3B,YAAY,IAAI,CAAC,SAAS;AAC1B,gBAAgB,OAAO,IAAI,CAAC;AAC5B,YAAY,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ;AACxC,gBAAgB,OAAO,KAAK,CAAC;AAC7B,YAAY,OAAO,IAAI,qBAAqB,CAAC,mBAAmB,EAAE;AAClE,gBAAgB,QAAQ;AACxB,gBAAgB,UAAU;AAC1B,gBAAgB,SAAS;AACzB,gBAAgB,KAAK,EAAE,KAAK;AAC5B,aAAa,CAAC,CAAC;AACf,SAAS;AACT,KAAK,CAAC;AACN,CAAC,CAAC;AACF,OAAO,CAAC,oBAAoB,GAAG,oBAAoB;;"}
+{"version":3,"file":"createTokenValidator.js","sources":["../../../src/utils/createTokenValidator.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.createTokenValidator = void 0;\nconst aws_jwt_verify_1 = require(\"aws-jwt-verify\");\nconst isValidCognitoToken_1 = require(\"./isValidCognitoToken\");\n/**\n * Creates a validator object for validating methods in a KeyValueStorage.\n */\nconst createTokenValidator = ({ userPoolId, userPoolClientId: clientId, }) => {\n    let idTokenVerifier;\n    let accessTokenVerifier;\n    return {\n        // validate access, id tokens\n        getItem: async (key, value) => {\n            const isAccessToken = key.includes('.accessToken');\n            const isIdToken = key.includes('.idToken');\n            if (!isAccessToken && !isIdToken) {\n                return true;\n            }\n            if (!userPoolId || !clientId) {\n                return false;\n            }\n            if (isAccessToken && !accessTokenVerifier) {\n                accessTokenVerifier = aws_jwt_verify_1.CognitoJwtVerifier.create({\n                    userPoolId,\n                    tokenUse: 'access',\n                    clientId,\n                });\n            }\n            if (isIdToken && !idTokenVerifier) {\n                idTokenVerifier = aws_jwt_verify_1.CognitoJwtVerifier.create({\n                    userPoolId,\n                    tokenUse: 'id',\n                    clientId,\n                });\n            }\n            return (0, isValidCognitoToken_1.isValidCognitoToken)({\n                token: value,\n                verifier: isAccessToken ? accessTokenVerifier : idTokenVerifier,\n            });\n        },\n    };\n};\nexports.createTokenValidator = createTokenValidator;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,OAAO,CAAC,oBAAoB,GAAG,KAAK,CAAC,CAAC;AACtC,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;AACnD,MAAM,qBAAqB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;AAC/D;AACA;AACA;AACA,MAAM,oBAAoB,GAAG,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,QAAQ,GAAG,KAAK;AAC9E,IAAI,IAAI,eAAe,CAAC;AACxB,IAAI,IAAI,mBAAmB,CAAC;AAC5B,IAAI,OAAO;AACX;AACA,QAAQ,OAAO,EAAE,OAAO,GAAG,EAAE,KAAK,KAAK;AACvC,YAAY,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;AAC/D,YAAY,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACvD,YAAY,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS,EAAE;AAC9C,gBAAgB,OAAO,IAAI,CAAC;AAC5B,aAAa;AACb,YAAY,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE;AAC1C,gBAAgB,OAAO,KAAK,CAAC;AAC7B,aAAa;AACb,YAAY,IAAI,aAAa,IAAI,CAAC,mBAAmB,EAAE;AACvD,gBAAgB,mBAAmB,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,MAAM,CAAC;AACjF,oBAAoB,UAAU;AAC9B,oBAAoB,QAAQ,EAAE,QAAQ;AACtC,oBAAoB,QAAQ;AAC5B,iBAAiB,CAAC,CAAC;AACnB,aAAa;AACb,YAAY,IAAI,SAAS,IAAI,CAAC,eAAe,EAAE;AAC/C,gBAAgB,eAAe,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,MAAM,CAAC;AAC7E,oBAAoB,UAAU;AAC9B,oBAAoB,QAAQ,EAAE,IAAI;AAClC,oBAAoB,QAAQ;AAC5B,iBAAiB,CAAC,CAAC;AACnB,aAAa;AACb,YAAY,OAAO,IAAI,qBAAqB,CAAC,mBAAmB,EAAE;AAClE,gBAAgB,KAAK,EAAE,KAAK;AAC5B,gBAAgB,QAAQ,EAAE,aAAa,GAAG,mBAAmB,GAAG,eAAe;AAC/E,aAAa,CAAC,CAAC;AACf,SAAS;AACT,KAAK,CAAC;AACN,CAAC,CAAC;AACF,OAAO,CAAC,oBAAoB,GAAG,oBAAoB;;"}

package/dist/cjs/utils/isValidCognitoToken.js

@@ -4,25 +4,18 @@
 // SPDX-License-Identifier: Apache-2.0
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isValidCognitoToken = void 0;
-const aws_jwt_verify_1 = require("aws-jwt-verify");
 const error_1 = require("aws-jwt-verify/error");
 /**
  * Verifies a Cognito JWT token for its validity.
  *
  * @param input - An object containing:
  *                - token: The JWT token as a string that needs to be verified.
- *                - userPoolId: The ID of the AWS Cognito User Pool to which the token belongs.
- *                - clientId: The Client ID associated with the Cognito User Pool.
+ *                - verifier: The JWT verifier which will verify the token.
  * @internal
  */
 const isValidCognitoToken = async (input) => {
-    const { userPoolId, clientId, tokenType, token } = input;
+    const { token, verifier } = input;
     try {
-        const verifier = aws_jwt_verify_1.CognitoJwtVerifier.create({
-            userPoolId,
-            tokenUse: tokenType,
-            clientId,
-        });
         await verifier.verify(token);
         return true;
     }

package/dist/cjs/utils/isValidCognitoToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"isValidCognitoToken.js","sources":["../../../src/utils/isValidCognitoToken.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.isValidCognitoToken = void 0;\nconst aws_jwt_verify_1 = require(\"aws-jwt-verify\");\nconst error_1 = require(\"aws-jwt-verify/error\");\n/**\n * Verifies a Cognito JWT token for its validity.\n *\n * @param input - An object containing:\n *                - token: The JWT token as a string that needs to be verified.\n *                - userPoolId: The ID of the AWS Cognito User Pool to which the token belongs.\n *                - clientId: The Client ID associated with the Cognito User Pool.\n * @internal\n */\nconst isValidCognitoToken = async (input) => {\n    const { userPoolId, clientId, tokenType, token } = input;\n    try {\n        const verifier = aws_jwt_verify_1.CognitoJwtVerifier.create({\n            userPoolId,\n            tokenUse: tokenType,\n            clientId,\n        });\n        await verifier.verify(token);\n        return true;\n    }\n    catch (error) {\n        // When `JwtExpiredError` is thrown, the token should have valid signature\n        // but expired. So, we can consider it as a valid token.\n        // Reference https://github.com/awslabs/aws-jwt-verify/blob/8d8f714d7281913ecd660147f5c30311479601c1/src/jwt-rsa.ts#L290-L301\n        if (error instanceof error_1.JwtExpiredError) {\n            return true;\n        }\n        // TODO (ashwinkumar6): surface invalid cognito token error to customer\n        // TODO: clear invalid tokens from Storage\n        return false;\n    }\n};\nexports.isValidCognitoToken = isValidCognitoToken;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,OAAO,CAAC,mBAAmB,GAAG,KAAK,CAAC,CAAC;AACrC,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;AACnD,MAAM,OAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAChD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAM,mBAAmB,GAAG,OAAO,KAAK,KAAK;AAC7C,IAAI,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;AAC7D,IAAI,IAAI;AACR,QAAQ,MAAM,QAAQ,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,MAAM,CAAC;AACpE,YAAY,UAAU;AACtB,YAAY,QAAQ,EAAE,SAAS;AAC/B,YAAY,QAAQ;AACpB,SAAS,CAAC,CAAC;AACX,QAAQ,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrC,QAAQ,OAAO,IAAI,CAAC;AACpB,KAAK;AACL,IAAI,OAAO,KAAK,EAAE;AAClB;AACA;AACA;AACA,QAAQ,IAAI,KAAK,YAAY,OAAO,CAAC,eAAe,EAAE;AACtD,YAAY,OAAO,IAAI,CAAC;AACxB,SAAS;AACT;AACA;AACA,QAAQ,OAAO,KAAK,CAAC;AACrB,KAAK;AACL,CAAC,CAAC;AACF,OAAO,CAAC,mBAAmB,GAAG,mBAAmB;;"}
+{"version":3,"file":"isValidCognitoToken.js","sources":["../../../src/utils/isValidCognitoToken.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.isValidCognitoToken = void 0;\nconst error_1 = require(\"aws-jwt-verify/error\");\n/**\n * Verifies a Cognito JWT token for its validity.\n *\n * @param input - An object containing:\n *                - token: The JWT token as a string that needs to be verified.\n *                - verifier: The JWT verifier which will verify the token.\n * @internal\n */\nconst isValidCognitoToken = async (input) => {\n    const { token, verifier } = input;\n    try {\n        await verifier.verify(token);\n        return true;\n    }\n    catch (error) {\n        // When `JwtExpiredError` is thrown, the token should have valid signature\n        // but expired. So, we can consider it as a valid token.\n        // Reference https://github.com/awslabs/aws-jwt-verify/blob/8d8f714d7281913ecd660147f5c30311479601c1/src/jwt-rsa.ts#L290-L301\n        if (error instanceof error_1.JwtExpiredError) {\n            return true;\n        }\n        // TODO (ashwinkumar6): surface invalid cognito token error to customer\n        // TODO: clear invalid tokens from Storage\n        return false;\n    }\n};\nexports.isValidCognitoToken = isValidCognitoToken;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,OAAO,CAAC,mBAAmB,GAAG,KAAK,CAAC,CAAC;AACrC,MAAM,OAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAChD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAM,mBAAmB,GAAG,OAAO,KAAK,KAAK;AAC7C,IAAI,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;AACtC,IAAI,IAAI;AACR,QAAQ,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrC,QAAQ,OAAO,IAAI,CAAC;AACpB,KAAK;AACL,IAAI,OAAO,KAAK,EAAE;AAClB;AACA;AACA;AACA,QAAQ,IAAI,KAAK,YAAY,OAAO,CAAC,eAAe,EAAE;AACtD,YAAY,OAAO,IAAI,CAAC;AACxB,SAAS;AACT;AACA;AACA,QAAQ,OAAO,KAAK,CAAC;AACrB,KAAK;AACL,CAAC,CAAC;AACF,OAAO,CAAC,mBAAmB,GAAG,mBAAmB;;"}

package/dist/esm/api/createServerRunnerForAPI.mjs

@@ -1,6 +1,5 @@
 import { parseAmplifyConfig } from '@aws-amplify/core/internals/utils';
 import { createRunWithAmplifyServerContext } from '../utils/createRunWithAmplifyServerContext.mjs';
-import 'aws-jwt-verify';
 import 'aws-jwt-verify/error';
 
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.

package/dist/esm/api/createServerRunnerForAPI.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"createServerRunnerForAPI.mjs","sources":["../../../src/api/createServerRunnerForAPI.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { parseAmplifyConfig } from '@aws-amplify/core/internals/utils';\nimport { createRunWithAmplifyServerContext } from '../utils';\nexport const createServerRunnerForAPI = ({ config, }) => {\n    const amplifyConfig = parseAmplifyConfig(config);\n    return {\n        runWithAmplifyServerContext: createRunWithAmplifyServerContext({\n            config: amplifyConfig,\n        }),\n        resourcesConfig: amplifyConfig,\n    };\n};\n"],"names":[],"mappings":";;;;;AAAA;AACA;AAGY,MAAC,wBAAwB,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK;AACzD,IAAI,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACrD,IAAI,OAAO;AACX,QAAQ,2BAA2B,EAAE,iCAAiC,CAAC;AACvE,YAAY,MAAM,EAAE,aAAa;AACjC,SAAS,CAAC;AACV,QAAQ,eAAe,EAAE,aAAa;AACtC,KAAK,CAAC;AACN;;;;"}
+{"version":3,"file":"createServerRunnerForAPI.mjs","sources":["../../../src/api/createServerRunnerForAPI.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { parseAmplifyConfig } from '@aws-amplify/core/internals/utils';\nimport { createRunWithAmplifyServerContext } from '../utils';\nexport const createServerRunnerForAPI = ({ config, }) => {\n    const amplifyConfig = parseAmplifyConfig(config);\n    return {\n        runWithAmplifyServerContext: createRunWithAmplifyServerContext({\n            config: amplifyConfig,\n        }),\n        resourcesConfig: amplifyConfig,\n    };\n};\n"],"names":[],"mappings":";;;;AAAA;AACA;AAGY,MAAC,wBAAwB,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK;AACzD,IAAI,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACrD,IAAI,OAAO;AACX,QAAQ,2BAA2B,EAAE,iCAAiC,CAAC;AACvE,YAAY,MAAM,EAAE,aAAa;AACjC,SAAS,CAAC;AACV,QAAQ,eAAe,EAAE,aAAa;AACtC,KAAK,CAAC;AACN;;;;"}

package/dist/esm/createServerRunner.mjs

@@ -1,7 +1,7 @@
 import { parseAmplifyConfig } from '@aws-amplify/core/internals/utils';
 import { createRunWithAmplifyServerContext } from './utils/createRunWithAmplifyServerContext.mjs';
-import 'aws-jwt-verify';
 import 'aws-jwt-verify/error';
+import { createTokenValidator } from './utils/createTokenValidator.mjs';
 
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
@@ -25,9 +25,18 @@ import 'aws-jwt-verify/error';
  */
 const createServerRunner = ({ config, }) => {
     const amplifyConfig = parseAmplifyConfig(config);
+    let tokenValidator;
+    if (amplifyConfig?.Auth) {
+        const { Cognito } = amplifyConfig.Auth;
+        tokenValidator = createTokenValidator({
+            userPoolId: Cognito?.userPoolId,
+            userPoolClientId: Cognito?.userPoolClientId,
+        });
+    }
     return {
         runWithAmplifyServerContext: createRunWithAmplifyServerContext({
             config: amplifyConfig,
+            tokenValidator,
         }),
     };
 };

package/dist/esm/createServerRunner.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"createServerRunner.mjs","sources":["../../src/createServerRunner.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { parseAmplifyConfig } from '@aws-amplify/core/internals/utils';\nimport { createRunWithAmplifyServerContext } from './utils';\n/**\n * Creates the `runWithAmplifyServerContext` function to run Amplify server side APIs in an isolated request context.\n *\n * @remarks\n * This function should be called only once; you can use the returned `runWithAmplifyServerContext` across\n * your codebase.\n *\n * @param input The input used to create the `runWithAmplifyServerContext` function.\n * @param input.config The {@link ResourcesConfig} imported from the `amplifyconfiguration.json` file or manually\n * created.\n * @returns An object that contains the `runWithAmplifyServerContext` function.\n *\n * @example\n * import { createServerRunner } from '@aws-amplify/adapter-nextjs';\n * import config from './amplifyconfiguration.json';\n *\n * export const { runWithAmplifyServerContext } = createServerRunner({ config })\n */\nexport const createServerRunner = ({ config, }) => {\n    const amplifyConfig = parseAmplifyConfig(config);\n    return {\n        runWithAmplifyServerContext: createRunWithAmplifyServerContext({\n            config: amplifyConfig,\n        }),\n    };\n};\n"],"names":[],"mappings":";;;;;AAAA;AACA;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACY,MAAC,kBAAkB,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK;AACnD,IAAI,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACrD,IAAI,OAAO;AACX,QAAQ,2BAA2B,EAAE,iCAAiC,CAAC;AACvE,YAAY,MAAM,EAAE,aAAa;AACjC,SAAS,CAAC;AACV,KAAK,CAAC;AACN;;;;"}
+{"version":3,"file":"createServerRunner.mjs","sources":["../../src/createServerRunner.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { parseAmplifyConfig } from '@aws-amplify/core/internals/utils';\nimport { createRunWithAmplifyServerContext } from './utils';\nimport { createTokenValidator } from './utils/createTokenValidator';\n/**\n * Creates the `runWithAmplifyServerContext` function to run Amplify server side APIs in an isolated request context.\n *\n * @remarks\n * This function should be called only once; you can use the returned `runWithAmplifyServerContext` across\n * your codebase.\n *\n * @param input The input used to create the `runWithAmplifyServerContext` function.\n * @param input.config The {@link ResourcesConfig} imported from the `amplifyconfiguration.json` file or manually\n * created.\n * @returns An object that contains the `runWithAmplifyServerContext` function.\n *\n * @example\n * import { createServerRunner } from '@aws-amplify/adapter-nextjs';\n * import config from './amplifyconfiguration.json';\n *\n * export const { runWithAmplifyServerContext } = createServerRunner({ config })\n */\nexport const createServerRunner = ({ config, }) => {\n    const amplifyConfig = parseAmplifyConfig(config);\n    let tokenValidator;\n    if (amplifyConfig?.Auth) {\n        const { Cognito } = amplifyConfig.Auth;\n        tokenValidator = createTokenValidator({\n            userPoolId: Cognito?.userPoolId,\n            userPoolClientId: Cognito?.userPoolClientId,\n        });\n    }\n    return {\n        runWithAmplifyServerContext: createRunWithAmplifyServerContext({\n            config: amplifyConfig,\n            tokenValidator,\n        }),\n    };\n};\n"],"names":[],"mappings":";;;;;AAAA;AACA;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACY,MAAC,kBAAkB,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK;AACnD,IAAI,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACrD,IAAI,IAAI,cAAc,CAAC;AACvB,IAAI,IAAI,aAAa,EAAE,IAAI,EAAE;AAC7B,QAAQ,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC;AAC/C,QAAQ,cAAc,GAAG,oBAAoB,CAAC;AAC9C,YAAY,UAAU,EAAE,OAAO,EAAE,UAAU;AAC3C,YAAY,gBAAgB,EAAE,OAAO,EAAE,gBAAgB;AACvD,SAAS,CAAC,CAAC;AACX,KAAK;AACL,IAAI,OAAO;AACX,QAAQ,2BAA2B,EAAE,iCAAiC,CAAC;AACvE,YAAY,MAAM,EAAE,aAAa;AACjC,YAAY,cAAc;AAC1B,SAAS,CAAC;AACV,KAAK,CAAC;AACN;;;;"}

package/dist/esm/types/index.d.ts

@@ -1 +1,3 @@
+import { CognitoJwtVerifier } from 'aws-jwt-verify';
 export { NextServer } from './NextServer';
+export type JwtVerifier = ReturnType<typeof CognitoJwtVerifier.create>;

package/dist/esm/utils/createRunWithAmplifyServerContext.d.ts

@@ -1,5 +1,7 @@
 import { ResourcesConfig } from '@aws-amplify/core';
+import { KeyValueStorageMethodValidator } from '@aws-amplify/core/internals/adapter-core';
 import { NextServer } from '../types';
-export declare const createRunWithAmplifyServerContext: ({ config: resourcesConfig, }: {
+export declare const createRunWithAmplifyServerContext: ({ config: resourcesConfig, tokenValidator, }: {
     config: ResourcesConfig;
+    tokenValidator?: Partial<Record<keyof import("@aws-amplify/core").KeyValueStorageInterface, (...args: any[]) => Promise<boolean>>> | undefined;
 }) => NextServer.RunOperationWithContext;

package/dist/esm/utils/createRunWithAmplifyServerContext.mjs

@@ -1,11 +1,10 @@
 import { sharedInMemoryStorage } from '@aws-amplify/core';
 import { createKeyValueStorageFromCookieStorageAdapter, createAWSCredentialsAndIdentityIdProvider, createUserPoolsTokenProvider, runWithAmplifyServerContext } from 'aws-amplify/adapter-core';
-import { createTokenValidator } from './createTokenValidator.mjs';
 import { createCookieStorageAdapterFromNextServerContext } from './createCookieStorageAdapterFromNextServerContext.mjs';
 
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
-const createRunWithAmplifyServerContext = ({ config: resourcesConfig, }) => {
+const createRunWithAmplifyServerContext = ({ config: resourcesConfig, tokenValidator, }) => {
     const runWithAmplifyServerContext$1 = async ({ nextServerContext, operation }) => {
         // When the Auth config is presented, attempt to create a Amplify server
         // context with token and credentials provider.
@@ -17,10 +16,7 @@ const createRunWithAmplifyServerContext = ({ config: resourcesConfig, }) => {
             // static rendering uses the same unauthenticated role cross-sever.
             nextServerContext === null
                 ? sharedInMemoryStorage
-                : createKeyValueStorageFromCookieStorageAdapter(await createCookieStorageAdapterFromNextServerContext(nextServerContext), createTokenValidator({
-                    userPoolId: resourcesConfig?.Auth.Cognito?.userPoolId,
-                    userPoolClientId: resourcesConfig?.Auth.Cognito?.userPoolClientId,
-                }));
+                : createKeyValueStorageFromCookieStorageAdapter(await createCookieStorageAdapterFromNextServerContext(nextServerContext), tokenValidator);
             const credentialsProvider = createAWSCredentialsAndIdentityIdProvider(resourcesConfig.Auth, keyValueStorage);
             const tokenProvider = createUserPoolsTokenProvider(resourcesConfig.Auth, keyValueStorage);
             return runWithAmplifyServerContext(resourcesConfig, {

package/dist/esm/utils/createRunWithAmplifyServerContext.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"createRunWithAmplifyServerContext.mjs","sources":["../../../src/utils/createRunWithAmplifyServerContext.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { sharedInMemoryStorage } from '@aws-amplify/core';\nimport { createAWSCredentialsAndIdentityIdProvider, createKeyValueStorageFromCookieStorageAdapter, createUserPoolsTokenProvider, runWithAmplifyServerContext as runWithAmplifyServerContextCore, } from 'aws-amplify/adapter-core';\nimport { createTokenValidator } from './createTokenValidator';\nimport { createCookieStorageAdapterFromNextServerContext } from './createCookieStorageAdapterFromNextServerContext';\nexport const createRunWithAmplifyServerContext = ({ config: resourcesConfig, }) => {\n    const runWithAmplifyServerContext = async ({ nextServerContext, operation }) => {\n        // When the Auth config is presented, attempt to create a Amplify server\n        // context with token and credentials provider.\n        if (resourcesConfig.Auth) {\n            const keyValueStorage = \n            // When `null` is passed as the value of `nextServerContext`, opt-in\n            // unauthenticated role (primarily for static rendering). It's\n            // safe to use the singleton `MemoryKeyValueStorage` here, as the\n            // static rendering uses the same unauthenticated role cross-sever.\n            nextServerContext === null\n                ? sharedInMemoryStorage\n                : createKeyValueStorageFromCookieStorageAdapter(await createCookieStorageAdapterFromNextServerContext(nextServerContext), createTokenValidator({\n                    userPoolId: resourcesConfig?.Auth.Cognito?.userPoolId,\n                    userPoolClientId: resourcesConfig?.Auth.Cognito?.userPoolClientId,\n                }));\n            const credentialsProvider = createAWSCredentialsAndIdentityIdProvider(resourcesConfig.Auth, keyValueStorage);\n            const tokenProvider = createUserPoolsTokenProvider(resourcesConfig.Auth, keyValueStorage);\n            return runWithAmplifyServerContextCore(resourcesConfig, {\n                Auth: { credentialsProvider, tokenProvider },\n            }, operation);\n        }\n        // Otherwise it may be the case that auth is not used, e.g. API key.\n        // Omitting the `Auth` in the second parameter.\n        return runWithAmplifyServerContextCore(resourcesConfig, {}, operation);\n    };\n    return runWithAmplifyServerContext;\n};\n"],"names":["runWithAmplifyServerContext","runWithAmplifyServerContextCore"],"mappings":";;;;;AAAA;AACA;AAKY,MAAC,iCAAiC,GAAG,CAAC,EAAE,MAAM,EAAE,eAAe,GAAG,KAAK;AACnF,IAAI,MAAMA,6BAA2B,GAAG,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK;AACpF;AACA;AACA,QAAQ,IAAI,eAAe,CAAC,IAAI,EAAE;AAClC,YAAY,MAAM,eAAe;AACjC;AACA;AACA;AACA;AACA,YAAY,iBAAiB,KAAK,IAAI;AACtC,kBAAkB,qBAAqB;AACvC,kBAAkB,6CAA6C,CAAC,MAAM,+CAA+C,CAAC,iBAAiB,CAAC,EAAE,oBAAoB,CAAC;AAC/J,oBAAoB,UAAU,EAAE,eAAe,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU;AACzE,oBAAoB,gBAAgB,EAAE,eAAe,EAAE,IAAI,CAAC,OAAO,EAAE,gBAAgB;AACrF,iBAAiB,CAAC,CAAC,CAAC;AACpB,YAAY,MAAM,mBAAmB,GAAG,yCAAyC,CAAC,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;AACzH,YAAY,MAAM,aAAa,GAAG,4BAA4B,CAAC,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;AACtG,YAAY,OAAOC,2BAA+B,CAAC,eAAe,EAAE;AACpE,gBAAgB,IAAI,EAAE,EAAE,mBAAmB,EAAE,aAAa,EAAE;AAC5D,aAAa,EAAE,SAAS,CAAC,CAAC;AAC1B,SAAS;AACT;AACA;AACA,QAAQ,OAAOA,2BAA+B,CAAC,eAAe,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;AAC/E,KAAK,CAAC;AACN,IAAI,OAAOD,6BAA2B,CAAC;AACvC;;;;"}
+{"version":3,"file":"createRunWithAmplifyServerContext.mjs","sources":["../../../src/utils/createRunWithAmplifyServerContext.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { sharedInMemoryStorage } from '@aws-amplify/core';\nimport { createAWSCredentialsAndIdentityIdProvider, createKeyValueStorageFromCookieStorageAdapter, createUserPoolsTokenProvider, runWithAmplifyServerContext as runWithAmplifyServerContextCore, } from 'aws-amplify/adapter-core';\nimport { createCookieStorageAdapterFromNextServerContext } from './createCookieStorageAdapterFromNextServerContext';\nexport const createRunWithAmplifyServerContext = ({ config: resourcesConfig, tokenValidator, }) => {\n    const runWithAmplifyServerContext = async ({ nextServerContext, operation }) => {\n        // When the Auth config is presented, attempt to create a Amplify server\n        // context with token and credentials provider.\n        if (resourcesConfig.Auth) {\n            const keyValueStorage = \n            // When `null` is passed as the value of `nextServerContext`, opt-in\n            // unauthenticated role (primarily for static rendering). It's\n            // safe to use the singleton `MemoryKeyValueStorage` here, as the\n            // static rendering uses the same unauthenticated role cross-sever.\n            nextServerContext === null\n                ? sharedInMemoryStorage\n                : createKeyValueStorageFromCookieStorageAdapter(await createCookieStorageAdapterFromNextServerContext(nextServerContext), tokenValidator);\n            const credentialsProvider = createAWSCredentialsAndIdentityIdProvider(resourcesConfig.Auth, keyValueStorage);\n            const tokenProvider = createUserPoolsTokenProvider(resourcesConfig.Auth, keyValueStorage);\n            return runWithAmplifyServerContextCore(resourcesConfig, {\n                Auth: { credentialsProvider, tokenProvider },\n            }, operation);\n        }\n        // Otherwise it may be the case that auth is not used, e.g. API key.\n        // Omitting the `Auth` in the second parameter.\n        return runWithAmplifyServerContextCore(resourcesConfig, {}, operation);\n    };\n    return runWithAmplifyServerContext;\n};\n"],"names":["runWithAmplifyServerContext","runWithAmplifyServerContextCore"],"mappings":";;;;AAAA;AACA;AAIY,MAAC,iCAAiC,GAAG,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,cAAc,GAAG,KAAK;AACnG,IAAI,MAAMA,6BAA2B,GAAG,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK;AACpF;AACA;AACA,QAAQ,IAAI,eAAe,CAAC,IAAI,EAAE;AAClC,YAAY,MAAM,eAAe;AACjC;AACA;AACA;AACA;AACA,YAAY,iBAAiB,KAAK,IAAI;AACtC,kBAAkB,qBAAqB;AACvC,kBAAkB,6CAA6C,CAAC,MAAM,+CAA+C,CAAC,iBAAiB,CAAC,EAAE,cAAc,CAAC,CAAC;AAC1J,YAAY,MAAM,mBAAmB,GAAG,yCAAyC,CAAC,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;AACzH,YAAY,MAAM,aAAa,GAAG,4BAA4B,CAAC,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;AACtG,YAAY,OAAOC,2BAA+B,CAAC,eAAe,EAAE;AACpE,gBAAgB,IAAI,EAAE,EAAE,mBAAmB,EAAE,aAAa,EAAE;AAC5D,aAAa,EAAE,SAAS,CAAC,CAAC;AAC1B,SAAS;AACT;AACA;AACA,QAAQ,OAAOA,2BAA+B,CAAC,eAAe,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;AAC/E,KAAK,CAAC;AACN,IAAI,OAAOD,6BAA2B,CAAC;AACvC;;;;"}

package/dist/esm/utils/createTokenValidator.mjs

@@ -1,3 +1,4 @@
+import { CognitoJwtVerifier } from 'aws-jwt-verify';
 import { isValidCognitoToken } from './isValidCognitoToken.mjs';
 
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
@@ -6,23 +7,36 @@ import { isValidCognitoToken } from './isValidCognitoToken.mjs';
  * Creates a validator object for validating methods in a KeyValueStorage.
  */
 const createTokenValidator = ({ userPoolId, userPoolClientId: clientId, }) => {
+    let idTokenVerifier;
+    let accessTokenVerifier;
     return {
         // validate access, id tokens
         getItem: async (key, value) => {
-            const tokenType = key.includes('.accessToken')
-                ? 'access'
-                : key.includes('.idToken')
-                    ? 'id'
-                    : null;
-            if (!tokenType)
+            const isAccessToken = key.includes('.accessToken');
+            const isIdToken = key.includes('.idToken');
+            if (!isAccessToken && !isIdToken) {
                 return true;
-            if (!userPoolId || !clientId)
+            }
+            if (!userPoolId || !clientId) {
                 return false;
+            }
+            if (isAccessToken && !accessTokenVerifier) {
+                accessTokenVerifier = CognitoJwtVerifier.create({
+                    userPoolId,
+                    tokenUse: 'access',
+                    clientId,
+                });
+            }
+            if (isIdToken && !idTokenVerifier) {
+                idTokenVerifier = CognitoJwtVerifier.create({
+                    userPoolId,
+                    tokenUse: 'id',
+                    clientId,
+                });
+            }
             return isValidCognitoToken({
-                clientId,
-                userPoolId,
-                tokenType,
                 token: value,
+                verifier: isAccessToken ? accessTokenVerifier : idTokenVerifier,
             });
         },
     };

package/dist/esm/utils/createTokenValidator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"createTokenValidator.mjs","sources":["../../../src/utils/createTokenValidator.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { isValidCognitoToken } from './isValidCognitoToken';\n/**\n * Creates a validator object for validating methods in a KeyValueStorage.\n */\nexport const createTokenValidator = ({ userPoolId, userPoolClientId: clientId, }) => {\n    return {\n        // validate access, id tokens\n        getItem: async (key, value) => {\n            const tokenType = key.includes('.accessToken')\n                ? 'access'\n                : key.includes('.idToken')\n                    ? 'id'\n                    : null;\n            if (!tokenType)\n                return true;\n            if (!userPoolId || !clientId)\n                return false;\n            return isValidCognitoToken({\n                clientId,\n                userPoolId,\n                tokenType,\n                token: value,\n            });\n        },\n    };\n};\n"],"names":[],"mappings":";;AAAA;AACA;AAEA;AACA;AACA;AACY,MAAC,oBAAoB,GAAG,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,QAAQ,GAAG,KAAK;AACrF,IAAI,OAAO;AACX;AACA,QAAQ,OAAO,EAAE,OAAO,GAAG,EAAE,KAAK,KAAK;AACvC,YAAY,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;AAC1D,kBAAkB,QAAQ;AAC1B,kBAAkB,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;AAC1C,sBAAsB,IAAI;AAC1B,sBAAsB,IAAI,CAAC;AAC3B,YAAY,IAAI,CAAC,SAAS;AAC1B,gBAAgB,OAAO,IAAI,CAAC;AAC5B,YAAY,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ;AACxC,gBAAgB,OAAO,KAAK,CAAC;AAC7B,YAAY,OAAO,mBAAmB,CAAC;AACvC,gBAAgB,QAAQ;AACxB,gBAAgB,UAAU;AAC1B,gBAAgB,SAAS;AACzB,gBAAgB,KAAK,EAAE,KAAK;AAC5B,aAAa,CAAC,CAAC;AACf,SAAS;AACT,KAAK,CAAC;AACN;;;;"}
+{"version":3,"file":"createTokenValidator.mjs","sources":["../../../src/utils/createTokenValidator.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { CognitoJwtVerifier } from 'aws-jwt-verify';\nimport { isValidCognitoToken } from './isValidCognitoToken';\n/**\n * Creates a validator object for validating methods in a KeyValueStorage.\n */\nexport const createTokenValidator = ({ userPoolId, userPoolClientId: clientId, }) => {\n    let idTokenVerifier;\n    let accessTokenVerifier;\n    return {\n        // validate access, id tokens\n        getItem: async (key, value) => {\n            const isAccessToken = key.includes('.accessToken');\n            const isIdToken = key.includes('.idToken');\n            if (!isAccessToken && !isIdToken) {\n                return true;\n            }\n            if (!userPoolId || !clientId) {\n                return false;\n            }\n            if (isAccessToken && !accessTokenVerifier) {\n                accessTokenVerifier = CognitoJwtVerifier.create({\n                    userPoolId,\n                    tokenUse: 'access',\n                    clientId,\n                });\n            }\n            if (isIdToken && !idTokenVerifier) {\n                idTokenVerifier = CognitoJwtVerifier.create({\n                    userPoolId,\n                    tokenUse: 'id',\n                    clientId,\n                });\n            }\n            return isValidCognitoToken({\n                token: value,\n                verifier: isAccessToken ? accessTokenVerifier : idTokenVerifier,\n            });\n        },\n    };\n};\n"],"names":[],"mappings":";;;AAAA;AACA;AAGA;AACA;AACA;AACY,MAAC,oBAAoB,GAAG,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,QAAQ,GAAG,KAAK;AACrF,IAAI,IAAI,eAAe,CAAC;AACxB,IAAI,IAAI,mBAAmB,CAAC;AAC5B,IAAI,OAAO;AACX;AACA,QAAQ,OAAO,EAAE,OAAO,GAAG,EAAE,KAAK,KAAK;AACvC,YAAY,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;AAC/D,YAAY,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACvD,YAAY,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS,EAAE;AAC9C,gBAAgB,OAAO,IAAI,CAAC;AAC5B,aAAa;AACb,YAAY,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE;AAC1C,gBAAgB,OAAO,KAAK,CAAC;AAC7B,aAAa;AACb,YAAY,IAAI,aAAa,IAAI,CAAC,mBAAmB,EAAE;AACvD,gBAAgB,mBAAmB,GAAG,kBAAkB,CAAC,MAAM,CAAC;AAChE,oBAAoB,UAAU;AAC9B,oBAAoB,QAAQ,EAAE,QAAQ;AACtC,oBAAoB,QAAQ;AAC5B,iBAAiB,CAAC,CAAC;AACnB,aAAa;AACb,YAAY,IAAI,SAAS,IAAI,CAAC,eAAe,EAAE;AAC/C,gBAAgB,eAAe,GAAG,kBAAkB,CAAC,MAAM,CAAC;AAC5D,oBAAoB,UAAU;AAC9B,oBAAoB,QAAQ,EAAE,IAAI;AAClC,oBAAoB,QAAQ;AAC5B,iBAAiB,CAAC,CAAC;AACnB,aAAa;AACb,YAAY,OAAO,mBAAmB,CAAC;AACvC,gBAAgB,KAAK,EAAE,KAAK;AAC5B,gBAAgB,QAAQ,EAAE,aAAa,GAAG,mBAAmB,GAAG,eAAe;AAC/E,aAAa,CAAC,CAAC;AACf,SAAS;AACT,KAAK,CAAC;AACN;;;;"}

package/dist/esm/utils/isValidCognitoToken.d.ts

@@ -1,15 +1,13 @@
+import { JwtVerifier } from '../types';
 /**
  * Verifies a Cognito JWT token for its validity.
  *
  * @param input - An object containing:
  *                - token: The JWT token as a string that needs to be verified.
- *                - userPoolId: The ID of the AWS Cognito User Pool to which the token belongs.
- *                - clientId: The Client ID associated with the Cognito User Pool.
+ *                - verifier: The JWT verifier which will verify the token.
  * @internal
  */
 export declare const isValidCognitoToken: (input: {
     token: string;
-    userPoolId: string;
-    clientId: string;
-    tokenType: 'id' | 'access';
+    verifier: JwtVerifier;
 }) => Promise<boolean>;

package/dist/esm/utils/isValidCognitoToken.mjs

@@ -1,4 +1,3 @@
-import { CognitoJwtVerifier } from 'aws-jwt-verify';
 import { JwtExpiredError } from 'aws-jwt-verify/error';
 
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
@@ -8,18 +7,12 @@ import { JwtExpiredError } from 'aws-jwt-verify/error';
  *
  * @param input - An object containing:
  *                - token: The JWT token as a string that needs to be verified.
- *                - userPoolId: The ID of the AWS Cognito User Pool to which the token belongs.
- *                - clientId: The Client ID associated with the Cognito User Pool.
+ *                - verifier: The JWT verifier which will verify the token.
  * @internal
  */
 const isValidCognitoToken = async (input) => {
-    const { userPoolId, clientId, tokenType, token } = input;
+    const { token, verifier } = input;
     try {
-        const verifier = CognitoJwtVerifier.create({
-            userPoolId,
-            tokenUse: tokenType,
-            clientId,
-        });
         await verifier.verify(token);
         return true;
     }

package/dist/esm/utils/isValidCognitoToken.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"isValidCognitoToken.mjs","sources":["../../../src/utils/isValidCognitoToken.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { CognitoJwtVerifier } from 'aws-jwt-verify';\nimport { JwtExpiredError } from 'aws-jwt-verify/error';\n/**\n * Verifies a Cognito JWT token for its validity.\n *\n * @param input - An object containing:\n *                - token: The JWT token as a string that needs to be verified.\n *                - userPoolId: The ID of the AWS Cognito User Pool to which the token belongs.\n *                - clientId: The Client ID associated with the Cognito User Pool.\n * @internal\n */\nexport const isValidCognitoToken = async (input) => {\n    const { userPoolId, clientId, tokenType, token } = input;\n    try {\n        const verifier = CognitoJwtVerifier.create({\n            userPoolId,\n            tokenUse: tokenType,\n            clientId,\n        });\n        await verifier.verify(token);\n        return true;\n    }\n    catch (error) {\n        // When `JwtExpiredError` is thrown, the token should have valid signature\n        // but expired. So, we can consider it as a valid token.\n        // Reference https://github.com/awslabs/aws-jwt-verify/blob/8d8f714d7281913ecd660147f5c30311479601c1/src/jwt-rsa.ts#L290-L301\n        if (error instanceof JwtExpiredError) {\n            return true;\n        }\n        // TODO (ashwinkumar6): surface invalid cognito token error to customer\n        // TODO: clear invalid tokens from Storage\n        return false;\n    }\n};\n"],"names":[],"mappings":";;;AAAA;AACA;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACY,MAAC,mBAAmB,GAAG,OAAO,KAAK,KAAK;AACpD,IAAI,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;AAC7D,IAAI,IAAI;AACR,QAAQ,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC;AACnD,YAAY,UAAU;AACtB,YAAY,QAAQ,EAAE,SAAS;AAC/B,YAAY,QAAQ;AACpB,SAAS,CAAC,CAAC;AACX,QAAQ,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrC,QAAQ,OAAO,IAAI,CAAC;AACpB,KAAK;AACL,IAAI,OAAO,KAAK,EAAE;AAClB;AACA;AACA;AACA,QAAQ,IAAI,KAAK,YAAY,eAAe,EAAE;AAC9C,YAAY,OAAO,IAAI,CAAC;AACxB,SAAS;AACT;AACA;AACA,QAAQ,OAAO,KAAK,CAAC;AACrB,KAAK;AACL;;;;"}
+{"version":3,"file":"isValidCognitoToken.mjs","sources":["../../../src/utils/isValidCognitoToken.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { JwtExpiredError } from 'aws-jwt-verify/error';\n/**\n * Verifies a Cognito JWT token for its validity.\n *\n * @param input - An object containing:\n *                - token: The JWT token as a string that needs to be verified.\n *                - verifier: The JWT verifier which will verify the token.\n * @internal\n */\nexport const isValidCognitoToken = async (input) => {\n    const { token, verifier } = input;\n    try {\n        await verifier.verify(token);\n        return true;\n    }\n    catch (error) {\n        // When `JwtExpiredError` is thrown, the token should have valid signature\n        // but expired. So, we can consider it as a valid token.\n        // Reference https://github.com/awslabs/aws-jwt-verify/blob/8d8f714d7281913ecd660147f5c30311479601c1/src/jwt-rsa.ts#L290-L301\n        if (error instanceof JwtExpiredError) {\n            return true;\n        }\n        // TODO (ashwinkumar6): surface invalid cognito token error to customer\n        // TODO: clear invalid tokens from Storage\n        return false;\n    }\n};\n"],"names":[],"mappings":";;AAAA;AACA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACY,MAAC,mBAAmB,GAAG,OAAO,KAAK,KAAK;AACpD,IAAI,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;AACtC,IAAI,IAAI;AACR,QAAQ,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrC,QAAQ,OAAO,IAAI,CAAC;AACpB,KAAK;AACL,IAAI,OAAO,KAAK,EAAE;AAClB;AACA;AACA;AACA,QAAQ,IAAI,KAAK,YAAY,eAAe,EAAE;AAC9C,YAAY,OAAO,IAAI,CAAC;AACxB,SAAS;AACT;AACA;AACA,QAAQ,OAAO,KAAK,CAAC;AACrB,KAAK;AACL;;;;"}

package/package.json

@@ -1,75 +1,75 @@
 {
-  "author": "Amazon Web Services",
-  "name": "@aws-amplify/adapter-nextjs",
-  "version": "1.3.1-unstable.4b3b13d.0+4b3b13d",
-  "description": "The adapter for the supporting of using Amplify APIs in Next.js.",
-  "peerDependencies": {
-    "aws-amplify": "6.10.4-unstable.4b3b13d.0+4b3b13d",
-    "next": ">=13.5.0 <16.0.0"
-  },
-  "dependencies": {
-    "aws-jwt-verify": "^4.0.1",
-    "cookie": "^0.7.0"
-  },
-  "devDependencies": {
-    "@types/cookie": "^0.5.1",
-    "@types/node": "^20.3.1",
-    "@types/react": "^18.2.13",
-    "@types/react-dom": "^18.2.6",
-    "aws-amplify": "6.10.4-unstable.4b3b13d.0+4b3b13d",
-    "jest-fetch-mock": "3.0.3",
-    "next": ">= 13.5.0 < 15.0.0",
-    "typescript": "5.0.2"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "bugs": {
-    "url": "https://github.com/aws/aws-amplify/issues"
-  },
-  "exports": {
-    ".": {
-      "types": "./dist/esm/index.d.ts",
-      "import": "./dist/esm/index.mjs",
-      "require": "./dist/cjs/index.js"
-    },
-    "./api": {
-      "types": "./dist/esm/api/index.d.ts",
-      "import": "./dist/esm/api/index.mjs",
-      "require": "./dist/cjs/api/index.js"
-    },
-    "./data": {
-      "types": "./dist/esm/api/index.d.ts",
-      "import": "./dist/esm/api/index.mjs",
-      "require": "./dist/cjs/api/index.js"
-    },
-    "./package.json": "./package.json"
-  },
-  "files": [
-    "dist/cjs",
-    "dist/esm",
-    "src",
-    "api",
-    "data"
-  ],
-  "homepage": "https://aws-amplify.github.io/",
-  "license": "Apache-2.0",
-  "main": "./dist/cjs/index.js",
-  "module": "./dist/esm/index.mjs",
-  "typings": "./dist/esm/index.d.ts",
-  "sideEffects": false,
-  "scripts": {
-    "build": "npm run clean && npm run build:esm-cjs",
-    "build-with-test": "npm test && npm run build",
-    "build:esm-cjs": "rollup --forceExit -c rollup.config.mjs",
-    "build:watch": "npm run build:esm-cjs -- --watch",
-    "clean": "npm run clean:size && rimraf dist",
-    "clean:size": "rimraf dual-publish-tmp tmp*",
-    "format": "echo \"Not implemented\"",
-    "lint": "eslint '**/*.{ts,tsx}' && npm run ts-coverage",
-    "lint:fix": "eslint '**/*.{ts,tsx}' --fix",
-    "test": "npm run lint && jest -w 1 --coverage --logHeapUsage",
-    "ts-coverage": "typescript-coverage-report -p ./tsconfig.build.json -t 90.31"
-  },
-  "gitHead": "4b3b13d62be701a327c00dc720c3f2577db85300"
+	"author": "Amazon Web Services",
+	"name": "@aws-amplify/adapter-nextjs",
+	"version": "1.3.1",
+	"description": "The adapter for the supporting of using Amplify APIs in Next.js.",
+	"peerDependencies": {
+		"aws-amplify": "^6.0.7",
+		"next": ">=13.5.0 <16.0.0"
+	},
+	"dependencies": {
+		"aws-jwt-verify": "^4.0.1",
+		"cookie": "^0.7.0"
+	},
+	"devDependencies": {
+		"@types/cookie": "^0.5.1",
+		"@types/node": "^20.3.1",
+		"@types/react": "^18.2.13",
+		"@types/react-dom": "^18.2.6",
+		"aws-amplify": "6.11.0",
+		"jest-fetch-mock": "3.0.3",
+		"next": ">= 13.5.0 < 15.0.0",
+		"typescript": "5.0.2"
+	},
+	"publishConfig": {
+		"access": "public"
+	},
+	"bugs": {
+		"url": "https://github.com/aws/aws-amplify/issues"
+	},
+	"exports": {
+		".": {
+			"types": "./dist/esm/index.d.ts",
+			"import": "./dist/esm/index.mjs",
+			"require": "./dist/cjs/index.js"
+		},
+		"./api": {
+			"types": "./dist/esm/api/index.d.ts",
+			"import": "./dist/esm/api/index.mjs",
+			"require": "./dist/cjs/api/index.js"
+		},
+		"./data": {
+			"types": "./dist/esm/api/index.d.ts",
+			"import": "./dist/esm/api/index.mjs",
+			"require": "./dist/cjs/api/index.js"
+		},
+		"./package.json": "./package.json"
+	},
+	"files": [
+		"dist/cjs",
+		"dist/esm",
+		"src",
+		"api",
+		"data"
+	],
+	"homepage": "https://aws-amplify.github.io/",
+	"license": "Apache-2.0",
+	"main": "./dist/cjs/index.js",
+	"module": "./dist/esm/index.mjs",
+	"typings": "./dist/esm/index.d.ts",
+	"sideEffects": false,
+	"scripts": {
+		"build": "npm run clean && npm run build:esm-cjs",
+		"build-with-test": "npm test && npm run build",
+		"build:esm-cjs": "rollup --forceExit -c rollup.config.mjs",
+		"build:watch": "npm run build:esm-cjs -- --watch",
+		"clean": "npm run clean:size && rimraf dist",
+		"clean:size": "rimraf dual-publish-tmp tmp*",
+		"format": "echo \"Not implemented\"",
+		"lint": "eslint '**/*.{ts,tsx}' && npm run ts-coverage",
+		"lint:fix": "eslint '**/*.{ts,tsx}' --fix",
+		"test": "npm run lint && jest -w 1 --coverage --logHeapUsage",
+		"ts-coverage": "typescript-coverage-report -p ./tsconfig.build.json -t 90.31"
+	},
+	"gitHead": "71558b702db117a4deba51cd23a5a9c455e88bf3"
 }

package/src/createServerRunner.ts

@@ -2,10 +2,12 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import { ResourcesConfig } from 'aws-amplify';
+import { KeyValueStorageMethodValidator } from '@aws-amplify/core/internals/adapter-core';
 import { parseAmplifyConfig } from '@aws-amplify/core/internals/utils';
 
 import { createRunWithAmplifyServerContext } from './utils';
 import { NextServer } from './types';
+import { createTokenValidator } from './utils/createTokenValidator';
 
 /**
  * Creates the `runWithAmplifyServerContext` function to run Amplify server side APIs in an isolated request context.
@@ -30,9 +32,19 @@ export const createServerRunner: NextServer.CreateServerRunner = ({
 }) => {
 	const amplifyConfig = parseAmplifyConfig(config);
 
+	let tokenValidator: KeyValueStorageMethodValidator | undefined;
+	if (amplifyConfig?.Auth) {
+		const { Cognito } = amplifyConfig.Auth;
+		tokenValidator = createTokenValidator({
+			userPoolId: Cognito?.userPoolId,
+			userPoolClientId: Cognito?.userPoolClientId,
+		});
+	}
+
 	return {
 		runWithAmplifyServerContext: createRunWithAmplifyServerContext({
 			config: amplifyConfig,
+			tokenValidator,
 		}),
 	};
 };

package/src/types/index.ts

@@ -1,4 +1,8 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
+import { CognitoJwtVerifier } from 'aws-jwt-verify';
+
 export { NextServer } from './NextServer';
+
+export type JwtVerifier = ReturnType<typeof CognitoJwtVerifier.create>;

package/src/utils/createRunWithAmplifyServerContext.ts

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import { ResourcesConfig, sharedInMemoryStorage } from '@aws-amplify/core';
+import { KeyValueStorageMethodValidator } from '@aws-amplify/core/internals/adapter-core';
 import {
 	createAWSCredentialsAndIdentityIdProvider,
 	createKeyValueStorageFromCookieStorageAdapter,
@@ -11,13 +12,14 @@ import {
 
 import { NextServer } from '../types';
 
-import { createTokenValidator } from './createTokenValidator';
 import { createCookieStorageAdapterFromNextServerContext } from './createCookieStorageAdapterFromNextServerContext';
 
 export const createRunWithAmplifyServerContext = ({
 	config: resourcesConfig,
+	tokenValidator,
 }: {
 	config: ResourcesConfig;
+	tokenValidator?: KeyValueStorageMethodValidator;
 }) => {
 	const runWithAmplifyServerContext: NextServer.RunOperationWithContext =
 		async ({ nextServerContext, operation }) => {
@@ -35,11 +37,7 @@ export const createRunWithAmplifyServerContext = ({
 								await createCookieStorageAdapterFromNextServerContext(
 									nextServerContext,
 								),
-								createTokenValidator({
-									userPoolId: resourcesConfig?.Auth.Cognito?.userPoolId,
-									userPoolClientId:
-										resourcesConfig?.Auth.Cognito?.userPoolClientId,
-								}),
+								tokenValidator,
 							);
 				const credentialsProvider = createAWSCredentialsAndIdentityIdProvider(
 					resourcesConfig.Auth,

package/src/utils/createTokenValidator.ts

@@ -2,6 +2,9 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import { KeyValueStorageMethodValidator } from '@aws-amplify/core/internals/adapter-core';
+import { CognitoJwtVerifier } from 'aws-jwt-verify';
+
+import { JwtVerifier } from '../types';
 
 import { isValidCognitoToken } from './isValidCognitoToken';
 
@@ -9,6 +12,7 @@ interface CreateTokenValidatorInput {
 	userPoolId?: string;
 	userPoolClientId?: string;
 }
+
 /**
  * Creates a validator object for validating methods in a KeyValueStorage.
  */
@@ -16,23 +20,42 @@ export const createTokenValidator = ({
 	userPoolId,
 	userPoolClientId: clientId,
 }: CreateTokenValidatorInput): KeyValueStorageMethodValidator => {
+	let idTokenVerifier: JwtVerifier;
+	let accessTokenVerifier: JwtVerifier;
+
 	return {
 		// validate access, id tokens
 		getItem: async (key: string, value: string): Promise<boolean> => {
-			const tokenType = key.includes('.accessToken')
-				? 'access'
-				: key.includes('.idToken')
-					? 'id'
-					: null;
-			if (!tokenType) return true;
+			const isAccessToken = key.includes('.accessToken');
+			const isIdToken = key.includes('.idToken');
+
+			if (!isAccessToken && !isIdToken) {
+				return true;
+			}
+
+			if (!userPoolId || !clientId) {
+				return false;
+			}
+
+			if (isAccessToken && !accessTokenVerifier) {
+				accessTokenVerifier = CognitoJwtVerifier.create({
+					userPoolId,
+					tokenUse: 'access',
+					clientId,
+				});
+			}
 
-			if (!userPoolId || !clientId) return false;
+			if (isIdToken && !idTokenVerifier) {
+				idTokenVerifier = CognitoJwtVerifier.create({
+					userPoolId,
+					tokenUse: 'id',
+					clientId,
+				});
+			}
 
 			return isValidCognitoToken({
-				clientId,
-				userPoolId,
-				tokenType,
 				token: value,
+				verifier: isAccessToken ? accessTokenVerifier : idTokenVerifier,
 			});
 		},
 	};

package/src/utils/isValidCognitoToken.ts

@@ -1,32 +1,25 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import { CognitoJwtVerifier } from 'aws-jwt-verify';
 import { JwtExpiredError } from 'aws-jwt-verify/error';
 
+import { JwtVerifier } from '../types';
+
 /**
  * Verifies a Cognito JWT token for its validity.
  *
  * @param input - An object containing:
  *                - token: The JWT token as a string that needs to be verified.
- *                - userPoolId: The ID of the AWS Cognito User Pool to which the token belongs.
- *                - clientId: The Client ID associated with the Cognito User Pool.
+ *                - verifier: The JWT verifier which will verify the token.
  * @internal
  */
 export const isValidCognitoToken = async (input: {
 	token: string;
-	userPoolId: string;
-	clientId: string;
-	tokenType: 'id' | 'access';
+	verifier: JwtVerifier;
 }): Promise<boolean> => {
-	const { userPoolId, clientId, tokenType, token } = input;
+	const { token, verifier } = input;
 
 	try {
-		const verifier = CognitoJwtVerifier.create({
-			userPoolId,
-			tokenUse: tokenType,
-			clientId,
-		});
 		await verifier.verify(token);
 
 		return true;