@aws-amplify/auth 4.3.19 → 4.3.20-custom-pk.79

package/src/Auth.ts

@@ -41,7 +41,7 @@ import {
 	StorageHelper,
 	ICredentials,
 	Parser,
-	JS,
+	browserOrNode,
 	UniversalStorage,
 	urlSafeDecode,
 } from '@aws-amplify/core';
@@ -80,10 +80,11 @@ const USER_ADMIN_SCOPE = 'aws.cognito.signin.user.admin';
 // 10 sec, following this guide https://www.nngroup.com/articles/response-times-3-important-limits/
 const OAUTH_FLOW_MS_TIMEOUT = 10 * 1000;
 
-const AMPLIFY_SYMBOL = (typeof Symbol !== 'undefined' &&
-typeof Symbol.for === 'function'
-	? Symbol.for('amplify_default')
-	: '@@amplify_default') as Symbol;
+const AMPLIFY_SYMBOL = (
+	typeof Symbol !== 'undefined' && typeof Symbol.for === 'function'
+		? Symbol.for('amplify_default')
+		: '@@amplify_default'
+) as Symbol;
 
 const dispatchAuthEvent = (event: string, data: any, message: string) => {
 	Hub.dispatch('auth', { event, data, message }, 'Auth', AMPLIFY_SYMBOL);
@@ -699,9 +700,21 @@ export class AuthClass {
 
 			const bypassCache = params ? params.bypassCache : false;
 			user.getUserData(
-				(err, data) => {
+				async (err, data) => {
 					if (err) {
 						logger.debug('getting preferred mfa failed', err);
+						if (this.isSessionInvalid(err)) {
+							try {
+								await this.cleanUpInvalidSession(user);
+							} catch (cleanUpError) {
+								rej(
+									new Error(
+										`Session is invalid due to: ${err.message} and failed to clean up invalid session: ${cleanUpError.message}`
+									)
+								);
+								return;
+							}
+						}
 						rej(err);
 						return;
 					}
@@ -752,14 +765,25 @@ export class AuthClass {
 
 	private _getUserData(user, params) {
 		return new Promise((res, rej) => {
-			user.getUserData((err, data) => {
+			user.getUserData(async (err, data) => {
 				if (err) {
 					logger.debug('getting user data failed', err);
+					if (this.isSessionInvalid(err)) {
+						try {
+							await this.cleanUpInvalidSession(user);
+						} catch (cleanUpError) {
+							rej(
+								new Error(
+									`Session is invalid due to: ${err.message} and failed to clean up invalid session: ${cleanUpError.message}`
+								)
+							);
+							return;
+						}
+					}
 					rej(err);
 					return;
 				} else {
 					res(data);
-					return;
 				}
 			}, params);
 		});
@@ -773,7 +797,7 @@ export class AuthClass {
 	 */
 	public async setPreferredMFA(
 		user: CognitoUser | any,
-		mfaMethod: 'TOTP' | 'SMS' | 'NOMFA' | 'SMS_MFA' | 'SOFTWARE_TOKEN_MFA' 
+		mfaMethod: 'TOTP' | 'SMS' | 'NOMFA' | 'SMS_MFA' | 'SOFTWARE_TOKEN_MFA'
 	): Promise<string> {
 		const clientMetadata = this._config.clientMetadata; // TODO: verify behavior if this is override during signIn
 
@@ -793,7 +817,7 @@ export class AuthClass {
 				};
 				break;
 			case 'SMS':
-			case 'SMS_MFA':	
+			case 'SMS_MFA':
 				smsMfaSettings = {
 					PreferredMfa: true,
 					Enabled: true,
@@ -855,9 +879,21 @@ export class AuthClass {
 					logger.debug('Caching the latest user data into local');
 					// cache the latest result into user data
 					user.getUserData(
-						(err, data) => {
+						async (err, data) => {
 							if (err) {
 								logger.debug('getting user data failed', err);
+								if (this.isSessionInvalid(err)) {
+									try {
+										await this.cleanUpInvalidSession(user);
+									} catch (cleanUpError) {
+										rej(
+											new Error(
+												`Session is invalid due to: ${err.message} and failed to clean up invalid session: ${cleanUpError.message}`
+											)
+										);
+										return;
+									}
+								}
 								return rej(err);
 							} else {
 								return res(result);
@@ -1120,24 +1156,102 @@ export class AuthClass {
 	 **/
 	public deleteUserAttributes(
 		user: CognitoUser | any,
-		attributeNames: string[],
+		attributeNames: string[]
 	) {
 		const that = this;
 		return new Promise((resolve, reject) => {
 			that.userSession(user).then(session => {
-				user.deleteAttributes(
-					attributeNames,
-					(err, result) => {
-						if (err) {
-							return reject(err);
-						} else {
-							return resolve(result);
-						}
+				user.deleteAttributes(attributeNames, (err, result) => {
+					if (err) {
+						return reject(err);
+					} else {
+						return resolve(result);
 					}
-				);
+				});
 			});
 		});
+	}
+
+	/**
+	 * Delete the current authenticated user
+	 * @return {Promise}
+	 **/
+	// TODO: Check return type void
+	public async deleteUser(): Promise<string | void> {
+		try {
+			await this._storageSync;
+		} catch (e) {
+			logger.debug('Failed to sync cache info into memory', e);
+			throw new Error(e);
+		}
+
+		const isSignedInHostedUI =
+			this._oAuthHandler &&
+			this._storage.getItem('amplify-signin-with-hostedUI') === 'true';
+
+		return new Promise(async (res, rej) => {
+			if (this.userPool) {
+				const user = this.userPool.getCurrentUser();
 
+				if (!user) {
+					logger.debug('Failed to get user from user pool');
+					return rej(new Error('No current user.'));
+				} else {
+					user.getSession(async (err, session) => {
+						if (err) {
+							logger.debug('Failed to get the user session', err);
+							if (this.isSessionInvalid(err)) {
+								try {
+									await this.cleanUpInvalidSession(user);
+								} catch (cleanUpError) {
+									rej(
+										new Error(
+											`Session is invalid due to: ${err.message} and failed to clean up invalid session: ${cleanUpError.message}`
+										)
+									);
+									return;
+								}
+							}
+							return rej(err);
+						} else {
+							user.deleteUser((err, result: string) => {
+								if (err) {
+									rej(err);
+								} else {
+									dispatchAuthEvent(
+										'userDeleted',
+										result,
+										'The authenticated user has been deleted.'
+									);
+									user.signOut();
+									this.user = null;
+									try {
+										this.cleanCachedItems(); // clean aws credentials
+									} catch (e) {
+										// TODO: change to rejects in refactor
+										logger.debug('failed to clear cached items');
+									}
+
+									if (isSignedInHostedUI) {
+										this.oAuthSignOutRedirect(res, rej);
+									} else {
+										dispatchAuthEvent(
+											'signOut',
+											this.user,
+											`A user has been signed out`
+										);
+										res(result);
+									}
+								}
+							});
+						}
+					});
+				}
+			} else {
+				logger.debug('no Congito User pool');
+				rej(new Error('Cognito User pool does not exist'));
+			}
+		});
 	}
 
 	/**
@@ -1225,6 +1339,89 @@ export class AuthClass {
 		});
 	}
 
+	private isErrorWithMessage(err: any): err is { message: string } {
+		return (
+			typeof err === 'object' &&
+			Object.prototype.hasOwnProperty.call(err, 'message')
+		);
+	}
+
+	// Session revoked by another app
+	private isTokenRevokedError(
+		err: any
+	): err is { message: 'Access Token has been revoked' } {
+		return (
+			this.isErrorWithMessage(err) &&
+			err.message === 'Access Token has been revoked'
+		);
+	}
+
+	private isRefreshTokenRevokedError(
+		err: any
+	): err is { message: 'Refresh Token has been revoked' } {
+		return (
+			this.isErrorWithMessage(err) &&
+			err.message === 'Refresh Token has been revoked'
+		);
+	}
+
+	private isUserDisabledError(
+		err: any
+	): err is { message: 'User is disabled.' } {
+		return this.isErrorWithMessage(err) && err.message === 'User is disabled.';
+	}
+
+	private isUserDoesNotExistError(
+		err: any
+	): err is { message: 'User does not exist.' } {
+		return (
+			this.isErrorWithMessage(err) && err.message === 'User does not exist.'
+		);
+	}
+
+	private isRefreshTokenExpiredError(
+		err: any
+	): err is { message: 'Refresh Token has expired' } {
+		return (
+			this.isErrorWithMessage(err) &&
+			err.message === 'Refresh Token has expired'
+		);
+	}
+
+	private isSignedInHostedUI() {
+		return (
+			this._oAuthHandler &&
+			this._storage.getItem('amplify-signin-with-hostedUI') === 'true'
+		);
+	}
+
+	private isSessionInvalid(err: any) {
+		return (
+			this.isUserDisabledError(err) ||
+			this.isUserDoesNotExistError(err) ||
+			this.isTokenRevokedError(err) ||
+			this.isRefreshTokenRevokedError(err) ||
+			this.isRefreshTokenExpiredError(err)
+		);
+	}
+
+	private async cleanUpInvalidSession(user: CognitoUser) {
+		user.signOut();
+		this.user = null;
+		try {
+			await this.cleanCachedItems(); // clean aws credentials
+		} catch (e) {
+			logger.debug('failed to clear cached items');
+		}
+		if (this.isSignedInHostedUI()) {
+			return new Promise((res, rej) => {
+				this.oAuthSignOutRedirect(res, rej);
+			});
+		} else {
+			dispatchAuthEvent('signOut', this.user, `A user has been signed out`);
+		}
+	}
+
 	/**
 	 * Get current authenticated user
 	 * @return - A promise resolves to current authenticated CognitoUser if success
@@ -1286,6 +1483,18 @@ export class AuthClass {
 						async (err, session) => {
 							if (err) {
 								logger.debug('Failed to get the user session', err);
+								if (this.isSessionInvalid(err)) {
+									try {
+										await this.cleanUpInvalidSession(user);
+									} catch (cleanUpError) {
+										rej(
+											new Error(
+												`Session is invalid due to: ${err.message} and failed to clean up invalid session: ${cleanUpError.message}`
+											)
+										);
+										return;
+									}
+								}
 								rej(err);
 								return;
 							}
@@ -1303,19 +1512,22 @@ export class AuthClass {
 							const { scope = '' } = session.getAccessToken().decodePayload();
 							if (scope.split(' ').includes(USER_ADMIN_SCOPE)) {
 								user.getUserData(
-									(err, data) => {
+									async (err, data) => {
 										if (err) {
 											logger.debug('getting user data failed', err);
-											// Make sure the user is still valid
-											if (
-												err.message === 'User is disabled.' ||
-												err.message === 'User does not exist.' ||
-												err.message === 'Access Token has been revoked' // Session revoked by another app
-											) {
+											if (this.isSessionInvalid(err)) {
+												try {
+													await this.cleanUpInvalidSession(user);
+												} catch (cleanUpError) {
+													rej(
+														new Error(
+															`Session is invalid due to: ${err.message} and failed to clean up invalid session: ${cleanUpError.message}`
+														)
+													);
+													return;
+												}
 												rej(err);
 											} else {
-												// the error may also be thrown when lack of permissions to get user info etc
-												// in that case we just bypass the error
 												res(user);
 											}
 											return;
@@ -1424,7 +1636,7 @@ export class AuthClass {
 		logger.debug('Getting current session');
 		// Purposely not calling the reject method here because we don't need a console error
 		if (!this.userPool) {
-			return Promise.reject();
+			return this.rejectNoUserPool();
 		}
 
 		return new Promise((res, rej) => {
@@ -1463,17 +1675,29 @@ export class AuthClass {
 		}
 		const clientMetadata = this._config.clientMetadata; // TODO: verify behavior if this is override during signIn
 
-		return new Promise((resolve, reject) => {
+		return new Promise((res, rej) => {
 			logger.debug('Getting the session from this user:', user);
 			user.getSession(
-				(err, session) => {
+				async (err, session) => {
 					if (err) {
 						logger.debug('Failed to get the session from user', user);
-						reject(err);
+						if (this.isSessionInvalid(err)) {
+							try {
+								await this.cleanUpInvalidSession(user);
+							} catch (cleanUpError) {
+								rej(
+									new Error(
+										`Session is invalid due to: ${err.message} and failed to clean up invalid session: ${cleanUpError.message}`
+									)
+								);
+								return;
+							}
+						}
+						rej(err);
 						return;
 					} else {
 						logger.debug('Succeed to get the user session', session);
-						resolve(session);
+						res(session);
 						return;
 					}
 				},
@@ -1515,8 +1739,8 @@ export class AuthClass {
 					logger.debug('getting session success', session);
 					return this.Credentials.set(session, 'session');
 				})
-				.catch(error => {
-					logger.debug('getting session failed', error);
+				.catch(() => {
+					logger.debug('getting guest credentials');
 					return this.Credentials.set(null, 'guest');
 				});
 		}
@@ -1630,9 +1854,21 @@ export class AuthClass {
 				const clientMetadata = this._config.clientMetadata; // TODO: verify behavior if this is override during signIn
 
 				user.getSession(
-					(err, result) => {
+					async (err, result) => {
 						if (err) {
 							logger.debug('failed to get the user session', err);
+							if (this.isSessionInvalid(err)) {
+								try {
+									await this.cleanUpInvalidSession(user);
+								} catch (cleanUpError) {
+									rej(
+										new Error(
+											`Session is invalid due to: ${err.message} and failed to clean up invalid session: ${cleanUpError.message}`
+										)
+									);
+									return;
+								}
+							}
 							return rej(err);
 						}
 						user.globalSignOut({
@@ -1669,7 +1905,7 @@ export class AuthClass {
 		resolve: () => void,
 		reject: (reason?: any) => void
 	) {
-		const { isBrowser } = JS.browserOrNode();
+		const { isBrowser } = browserOrNode();
 
 		if (isBrowser) {
 			this.oAuthSignOutRedirectOrReject(reject);
@@ -1687,7 +1923,7 @@ export class AuthClass {
 		this._oAuthHandler.signOut(); // this method redirects url
 
 		// App should be redirected to another url otherwise it will reject
-		setTimeout(() => reject('Signout timeout fail'), 3000);
+		setTimeout(() => reject(Error('Signout timeout fail')), 3000);
 	}
 
 	/**
@@ -1710,7 +1946,7 @@ export class AuthClass {
 				logger.debug('no current Cognito user');
 			}
 		} else {
-			logger.debug('no Congito User pool');
+			logger.debug('no Cognito User pool');
 		}
 
 		/**
@@ -1841,7 +2077,7 @@ export class AuthClass {
 				code,
 				password,
 				{
-					onSuccess: (success) => {
+					onSuccess: success => {
 						dispatchAuthEvent(
 							'forgotPasswordSubmit',
 							user,
@@ -2037,7 +2273,7 @@ export class AuthClass {
 			);
 
 			const currentUrl =
-				URL || (JS.browserOrNode().isBrowser ? window.location.href : '');
+				URL || (browserOrNode().isBrowser ? window.location.href : '');
 
 			const hasCodeOrError = !!(parse(currentUrl).query || '')
 				.split('&')
@@ -2053,12 +2289,8 @@ export class AuthClass {
 			if (hasCodeOrError || hasTokenOrError) {
 				this._storage.setItem('amplify-redirected-from-hosted-ui', 'true');
 				try {
-					const {
-						accessToken,
-						idToken,
-						refreshToken,
-						state,
-					} = await this._oAuthHandler.handleAuthResponse(currentUrl);
+					const { accessToken, idToken, refreshToken, state } =
+						await this._oAuthHandler.handleAuthResponse(currentUrl);
 					const session = new CognitoUserSession({
 						IdToken: new CognitoIdToken({ IdToken: idToken }),
 						RefreshToken: new CognitoRefreshToken({
@@ -2076,7 +2308,7 @@ export class AuthClass {
 						logger.debug('AWS credentials', credentials);
 					}
 
-					/* 
+					/*
 				Prior to the request we do sign the custom state along with the state we set. This check will verify
 				if there is a dash indicated when setting custom state from the request. If a dash is contained
 				then there is custom state present on the state string.
@@ -2115,10 +2347,7 @@ export class AuthClass {
 					);
 
 					if (isCustomStateIncluded) {
-						const customState = state
-							.split('-')
-							.splice(1)
-							.join('-');
+						const customState = state.split('-').splice(1).join('-');
 
 						dispatchAuthEvent(
 							'customOAuthState',
@@ -2352,4 +2581,3 @@ export class AuthClass {
 export const Auth = new AuthClass(null);
 
 Amplify.register(Auth);
-

package/src/index.ts

@@ -1,35 +1,40 @@
-/*
- * Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
- *
- * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with
- * the License. A copy of the License is located at
- *
- *     http://aws.amazon.com/apache2.0/
- *
- * or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
- * CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions
- * and limitations under the License.
- */
-
-import { Auth } from './Auth';
-import { CognitoHostedUIIdentityProvider, SignUpParams } from './types/Auth';
-import {
-	CognitoUser,
-	CookieStorage,
-	appendToCognitoUserAgent,
-} from 'amazon-cognito-identity-js';
-import { AuthErrorStrings } from './common/AuthErrorStrings';
-
-/**
- * @deprecated use named import
- */
-export default Auth;
-export {
-	Auth,
-	CognitoUser,
-	CookieStorage,
-	CognitoHostedUIIdentityProvider,
-	SignUpParams,
-	appendToCognitoUserAgent,
-	AuthErrorStrings,
-};
+/*
+ * Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with
+ * the License. A copy of the License is located at
+ *
+ *     http://aws.amazon.com/apache2.0/
+ *
+ * or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+ * CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions
+ * and limitations under the License.
+ */
+
+import { Auth } from './Auth';
+import {
+	CognitoHostedUIIdentityProvider,
+	SignUpParams,
+	GRAPHQL_AUTH_MODE,
+} from './types/Auth';
+import {
+	CognitoUser,
+	CookieStorage,
+	appendToCognitoUserAgent,
+} from 'amazon-cognito-identity-js';
+import { AuthErrorStrings } from './common/AuthErrorStrings';
+
+/**
+ * @deprecated use named import
+ */
+export default Auth;
+export {
+	Auth,
+	CognitoUser,
+	CookieStorage,
+	CognitoHostedUIIdentityProvider,
+	SignUpParams,
+	appendToCognitoUserAgent,
+	AuthErrorStrings,
+	GRAPHQL_AUTH_MODE,
+};

package/src/types/Auth.ts

@@ -227,3 +227,11 @@ export interface IAuthDevice {
 	id: string;
 	name: string;
 }
+
+export enum GRAPHQL_AUTH_MODE {
+	API_KEY = 'API_KEY',
+	AWS_IAM = 'AWS_IAM',
+	OPENID_CONNECT = 'OPENID_CONNECT',
+	AMAZON_COGNITO_USER_POOLS = 'AMAZON_COGNITO_USER_POOLS',
+	AWS_LAMBDA = 'AWS_LAMBDA',
+}

package/src/urlListener.ts

@@ -10,14 +10,14 @@
  * CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions
  * and limitations under the License.
  */
-import { JS } from '@aws-amplify/core';
+import { browserOrNode } from '@aws-amplify/core';
 
 export default callback => {
-	if (JS.browserOrNode().isBrowser && window.location) {
+	if (browserOrNode().isBrowser && window.location) {
 		const url = window.location.href;
 
 		callback({ url });
-	} else if (JS.browserOrNode().isNode) {
+	} else if (browserOrNode().isNode) {
 		// continue building on ssr
 		() => {}; // noop
 	} else {