@aws-amplify/auth 4.4.3-cloud-logging.7 → 4.4.3-cloud-logging.8

package/src/Auth.ts

@@ -700,9 +700,21 @@ export class AuthClass {
 
 			const bypassCache = params ? params.bypassCache : false;
 			user.getUserData(
-				(err, data) => {
+				async (err, data) => {
 					if (err) {
 						logger.debug('getting preferred mfa failed', err);
+						if (this.isSessionInvalid(err)) {
+							try {
+								await this.cleanUpInvalidSession(user);
+							} catch (cleanUpError) {
+								rej(
+									new Error(
+										`Session is invalid due to: ${err.message} and failed to clean up invalid session: ${cleanUpError.message}`
+									)
+								);
+								return;
+							}
+						}
 						rej(err);
 						return;
 					}
@@ -753,14 +765,25 @@ export class AuthClass {
 
 	private _getUserData(user, params) {
 		return new Promise((res, rej) => {
-			user.getUserData((err, data) => {
+			user.getUserData(async (err, data) => {
 				if (err) {
 					logger.debug('getting user data failed', err);
+					if (this.isSessionInvalid(err)) {
+						try {
+							await this.cleanUpInvalidSession(user);
+						} catch (cleanUpError) {
+							rej(
+								new Error(
+									`Session is invalid due to: ${err.message} and failed to clean up invalid session: ${cleanUpError.message}`
+								)
+							);
+							return;
+						}
+					}
 					rej(err);
 					return;
 				} else {
 					res(data);
-					return;
 				}
 			}, params);
 		});
@@ -856,9 +879,21 @@ export class AuthClass {
 					logger.debug('Caching the latest user data into local');
 					// cache the latest result into user data
 					user.getUserData(
-						(err, data) => {
+						async (err, data) => {
 							if (err) {
 								logger.debug('getting user data failed', err);
+								if (this.isSessionInvalid(err)) {
+									try {
+										await this.cleanUpInvalidSession(user);
+									} catch (cleanUpError) {
+										rej(
+											new Error(
+												`Session is invalid due to: ${err.message} and failed to clean up invalid session: ${cleanUpError.message}`
+											)
+										);
+										return;
+									}
+								}
 								return rej(err);
 							} else {
 								return res(result);
@@ -1165,6 +1200,18 @@ export class AuthClass {
 					user.getSession(async (err, session) => {
 						if (err) {
 							logger.debug('Failed to get the user session', err);
+							if (this.isSessionInvalid(err)) {
+								try {
+									await this.cleanUpInvalidSession(user);
+								} catch (cleanUpError) {
+									rej(
+										new Error(
+											`Session is invalid due to: ${err.message} and failed to clean up invalid session: ${cleanUpError.message}`
+										)
+									);
+									return;
+								}
+							}
 							return rej(err);
 						} else {
 							user.deleteUser((err, result: string) => {
@@ -1292,6 +1339,89 @@ export class AuthClass {
 		});
 	}
 
+	private isErrorWithMessage(err: any): err is { message: string } {
+		return (
+			typeof err === 'object' &&
+			Object.prototype.hasOwnProperty.call(err, 'message')
+		);
+	}
+
+	// Session revoked by another app
+	private isTokenRevokedError(
+		err: any
+	): err is { message: 'Access Token has been revoked' } {
+		return (
+			this.isErrorWithMessage(err) &&
+			err.message === 'Access Token has been revoked'
+		);
+	}
+
+	private isRefreshTokenRevokedError(
+		err: any
+	): err is { message: 'Refresh Token has been revoked' } {
+		return (
+			this.isErrorWithMessage(err) &&
+			err.message === 'Refresh Token has been revoked'
+		);
+	}
+
+	private isUserDisabledError(
+		err: any
+	): err is { message: 'User is disabled.' } {
+		return this.isErrorWithMessage(err) && err.message === 'User is disabled.';
+	}
+
+	private isUserDoesNotExistError(
+		err: any
+	): err is { message: 'User does not exist.' } {
+		return (
+			this.isErrorWithMessage(err) && err.message === 'User does not exist.'
+		);
+	}
+
+	private isRefreshTokenExpiredError(
+		err: any
+	): err is { message: 'Refresh Token has expired' } {
+		return (
+			this.isErrorWithMessage(err) &&
+			err.message === 'Refresh Token has expired'
+		);
+	}
+
+	private isSignedInHostedUI() {
+		return (
+			this._oAuthHandler &&
+			this._storage.getItem('amplify-signin-with-hostedUI') === 'true'
+		);
+	}
+
+	private isSessionInvalid(err: any) {
+		return (
+			this.isUserDisabledError(err) ||
+			this.isUserDoesNotExistError(err) ||
+			this.isTokenRevokedError(err) ||
+			this.isRefreshTokenRevokedError(err) ||
+			this.isRefreshTokenExpiredError(err)
+		);
+	}
+
+	private async cleanUpInvalidSession(user: CognitoUser) {
+		user.signOut();
+		this.user = null;
+		try {
+			await this.cleanCachedItems(); // clean aws credentials
+		} catch (e) {
+			logger.debug('failed to clear cached items');
+		}
+		if (this.isSignedInHostedUI()) {
+			return new Promise((res, rej) => {
+				this.oAuthSignOutRedirect(res, rej);
+			});
+		} else {
+			dispatchAuthEvent('signOut', this.user, `A user has been signed out`);
+		}
+	}
+
 	/**
 	 * Get current authenticated user
 	 * @return - A promise resolves to current authenticated CognitoUser if success
@@ -1353,6 +1483,18 @@ export class AuthClass {
 						async (err, session) => {
 							if (err) {
 								logger.debug('Failed to get the user session', err);
+								if (this.isSessionInvalid(err)) {
+									try {
+										await this.cleanUpInvalidSession(user);
+									} catch (cleanUpError) {
+										rej(
+											new Error(
+												`Session is invalid due to: ${err.message} and failed to clean up invalid session: ${cleanUpError.message}`
+											)
+										);
+										return;
+									}
+								}
 								rej(err);
 								return;
 							}
@@ -1370,19 +1512,22 @@ export class AuthClass {
 							const { scope = '' } = session.getAccessToken().decodePayload();
 							if (scope.split(' ').includes(USER_ADMIN_SCOPE)) {
 								user.getUserData(
-									(err, data) => {
+									async (err, data) => {
 										if (err) {
 											logger.debug('getting user data failed', err);
-											// Make sure the user is still valid
-											if (
-												err.message === 'User is disabled.' ||
-												err.message === 'User does not exist.' ||
-												err.message === 'Access Token has been revoked' // Session revoked by another app
-											) {
+											if (this.isSessionInvalid(err)) {
+												try {
+													await this.cleanUpInvalidSession(user);
+												} catch (cleanUpError) {
+													rej(
+														new Error(
+															`Session is invalid due to: ${err.message} and failed to clean up invalid session: ${cleanUpError.message}`
+														)
+													);
+													return;
+												}
 												rej(err);
 											} else {
-												// the error may also be thrown when lack of permissions to get user info etc
-												// in that case we just bypass the error
 												res(user);
 											}
 											return;
@@ -1491,7 +1636,7 @@ export class AuthClass {
 		logger.debug('Getting current session');
 		// Purposely not calling the reject method here because we don't need a console error
 		if (!this.userPool) {
-			return Promise.reject();
+			return this.rejectNoUserPool();
 		}
 
 		return new Promise((res, rej) => {
@@ -1530,17 +1675,29 @@ export class AuthClass {
 		}
 		const clientMetadata = this._config.clientMetadata; // TODO: verify behavior if this is override during signIn
 
-		return new Promise((resolve, reject) => {
+		return new Promise((res, rej) => {
 			logger.debug('Getting the session from this user:', user);
 			user.getSession(
-				(err, session) => {
+				async (err, session) => {
 					if (err) {
 						logger.debug('Failed to get the session from user', user);
-						reject(err);
+						if (this.isSessionInvalid(err)) {
+							try {
+								await this.cleanUpInvalidSession(user);
+							} catch (cleanUpError) {
+								rej(
+									new Error(
+										`Session is invalid due to: ${err.message} and failed to clean up invalid session: ${cleanUpError.message}`
+									)
+								);
+								return;
+							}
+						}
+						rej(err);
 						return;
 					} else {
 						logger.debug('Succeed to get the user session', session);
-						resolve(session);
+						res(session);
 						return;
 					}
 				},
@@ -1582,8 +1739,8 @@ export class AuthClass {
 					logger.debug('getting session success', session);
 					return this.Credentials.set(session, 'session');
 				})
-				.catch(error => {
-					logger.debug('getting session failed', error);
+				.catch(() => {
+					logger.debug('getting guest credentials');
 					return this.Credentials.set(null, 'guest');
 				});
 		}
@@ -1697,9 +1854,21 @@ export class AuthClass {
 				const clientMetadata = this._config.clientMetadata; // TODO: verify behavior if this is override during signIn
 
 				user.getSession(
-					(err, result) => {
+					async (err, result) => {
 						if (err) {
 							logger.debug('failed to get the user session', err);
+							if (this.isSessionInvalid(err)) {
+								try {
+									await this.cleanUpInvalidSession(user);
+								} catch (cleanUpError) {
+									rej(
+										new Error(
+											`Session is invalid due to: ${err.message} and failed to clean up invalid session: ${cleanUpError.message}`
+										)
+									);
+									return;
+								}
+							}
 							return rej(err);
 						}
 						user.globalSignOut({
@@ -1754,7 +1923,7 @@ export class AuthClass {
 		this._oAuthHandler.signOut(); // this method redirects url
 
 		// App should be redirected to another url otherwise it will reject
-		setTimeout(() => reject('Signout timeout fail'), 3000);
+		setTimeout(() => reject(Error('Signout timeout fail')), 3000);
 	}
 
 	/**
@@ -1777,7 +1946,7 @@ export class AuthClass {
 				logger.debug('no current Cognito user');
 			}
 		} else {
-			logger.debug('no Congito User pool');
+			logger.debug('no Cognito User pool');
 		}
 
 		/**
@@ -2139,7 +2308,7 @@ export class AuthClass {
 						logger.debug('AWS credentials', credentials);
 					}
 
-					/* 
+					/*
 				Prior to the request we do sign the custom state along with the state we set. This check will verify
 				if there is a dash indicated when setting custom state from the request. If a dash is contained
 				then there is custom state present on the state string.

package/src/index.ts

@@ -1,35 +1,40 @@
-/*
- * Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
- *
- * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with
- * the License. A copy of the License is located at
- *
- *     http://aws.amazon.com/apache2.0/
- *
- * or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
- * CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions
- * and limitations under the License.
- */
-
-import { Auth } from './Auth';
-import { CognitoHostedUIIdentityProvider, SignUpParams } from './types/Auth';
-import {
-	CognitoUser,
-	CookieStorage,
-	appendToCognitoUserAgent,
-} from 'amazon-cognito-identity-js';
-import { AuthErrorStrings } from './common/AuthErrorStrings';
-
-/**
- * @deprecated use named import
- */
-export default Auth;
-export {
-	Auth,
-	CognitoUser,
-	CookieStorage,
-	CognitoHostedUIIdentityProvider,
-	SignUpParams,
-	appendToCognitoUserAgent,
-	AuthErrorStrings,
-};
+/*
+ * Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with
+ * the License. A copy of the License is located at
+ *
+ *     http://aws.amazon.com/apache2.0/
+ *
+ * or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+ * CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions
+ * and limitations under the License.
+ */
+
+import { Auth } from './Auth';
+import {
+	CognitoHostedUIIdentityProvider,
+	SignUpParams,
+	GRAPHQL_AUTH_MODE,
+} from './types/Auth';
+import {
+	CognitoUser,
+	CookieStorage,
+	appendToCognitoUserAgent,
+} from 'amazon-cognito-identity-js';
+import { AuthErrorStrings } from './common/AuthErrorStrings';
+
+/**
+ * @deprecated use named import
+ */
+export default Auth;
+export {
+	Auth,
+	CognitoUser,
+	CookieStorage,
+	CognitoHostedUIIdentityProvider,
+	SignUpParams,
+	appendToCognitoUserAgent,
+	AuthErrorStrings,
+	GRAPHQL_AUTH_MODE,
+};

package/src/types/Auth.ts

@@ -227,3 +227,11 @@ export interface IAuthDevice {
 	id: string;
 	name: string;
 }
+
+export enum GRAPHQL_AUTH_MODE {
+	API_KEY = 'API_KEY',
+	AWS_IAM = 'AWS_IAM',
+	OPENID_CONNECT = 'OPENID_CONNECT',
+	AMAZON_COGNITO_USER_POOLS = 'AMAZON_COGNITO_USER_POOLS',
+	AWS_LAMBDA = 'AWS_LAMBDA',
+}