@aws-amplify/auth 6.11.3 → 6.11.4-Lerna-v8-testing.5bbeffa.0

package/dist/cjs/providers/cognito/credentialsProvider/IdentityIdProvider.js

@@ -8,7 +8,6 @@ const core_1 = require("@aws-amplify/core");
 const AuthError_1 = require("../../../errors/AuthError");
 const parsers_1 = require("../../../foundation/parsers");
 const utils_1 = require("./utils");
-const logger = new core_1.ConsoleLogger('CognitoIdentityIdProvider');
 /**
  * Provides a Cognito identityId
  *
@@ -21,42 +20,20 @@ const logger = new core_1.ConsoleLogger('CognitoIdentityIdProvider');
 async function cognitoIdentityIdProvider({ tokens, authConfig, identityIdStore, }) {
     identityIdStore.setAuthConfig({ Cognito: authConfig });
     // will return null only if there is no identityId cached or if there is an error retrieving it
-    let identityId = await identityIdStore.loadIdentityId();
-    // Tokens are available so return primary identityId
-    if (tokens) {
-        // If there is existing primary identityId in-memory return that
-        if (identityId && identityId.type === 'primary') {
-            return identityId.id;
-        }
-        else {
-            const logins = tokens.idToken
-                ? (0, utils_1.formLoginsMap)(tokens.idToken.toString())
-                : {};
-            const generatedIdentityId = await generateIdentityId(logins, authConfig);
-            if (identityId && identityId.id === generatedIdentityId) {
-                logger.debug(`The guest identity ${identityId.id} has become the primary identity.`);
-            }
-            identityId = {
-                id: generatedIdentityId,
-                type: 'primary',
-            };
-        }
+    const identityId = await identityIdStore.loadIdentityId();
+    if (identityId) {
+        return identityId.id;
     }
-    else {
-        // If there is existing guest identityId cached return that
-        if (identityId && identityId.type === 'guest') {
-            return identityId.id;
-        }
-        else {
-            identityId = {
-                id: await generateIdentityId({}, authConfig),
-                type: 'guest',
-            };
-        }
-    }
-    // Store in-memory or local storage depending on guest or primary identityId
-    identityIdStore.storeIdentityId(identityId);
-    return identityId.id;
+    const logins = tokens?.idToken
+        ? (0, utils_1.formLoginsMap)(tokens.idToken.toString())
+        : {};
+    const generatedIdentityId = await generateIdentityId(logins, authConfig);
+    // Store generated identityId
+    identityIdStore.storeIdentityId({
+        id: generatedIdentityId,
+        type: tokens ? 'primary' : 'guest',
+    });
+    return generatedIdentityId;
 }
 exports.cognitoIdentityIdProvider = cognitoIdentityIdProvider;
 async function generateIdentityId(logins, authConfig) {

package/dist/cjs/providers/cognito/credentialsProvider/IdentityIdProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityIdProvider.js","sources":["../../../../../src/providers/cognito/credentialsProvider/IdentityIdProvider.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.cognitoIdentityIdProvider = void 0;\nconst core_1 = require(\"@aws-amplify/core\");\nconst AuthError_1 = require(\"../../../errors/AuthError\");\nconst parsers_1 = require(\"../../../foundation/parsers\");\nconst utils_1 = require(\"./utils\");\nconst logger = new core_1.ConsoleLogger('CognitoIdentityIdProvider');\n/**\n * Provides a Cognito identityId\n *\n * @param tokens - The AuthTokens received after SignIn\n * @returns string\n * @throws configuration exceptions: `InvalidIdentityPoolIdException`\n *  - Auth errors that may arise from misconfiguration.\n * @throws service exceptions: {@link GetIdException }\n */\nasync function cognitoIdentityIdProvider({ tokens, authConfig, identityIdStore, }) {\n    identityIdStore.setAuthConfig({ Cognito: authConfig });\n    // will return null only if there is no identityId cached or if there is an error retrieving it\n    let identityId = await identityIdStore.loadIdentityId();\n    // Tokens are available so return primary identityId\n    if (tokens) {\n        // If there is existing primary identityId in-memory return that\n        if (identityId && identityId.type === 'primary') {\n            return identityId.id;\n        }\n        else {\n            const logins = tokens.idToken\n                ? (0, utils_1.formLoginsMap)(tokens.idToken.toString())\n                : {};\n            const generatedIdentityId = await generateIdentityId(logins, authConfig);\n            if (identityId && identityId.id === generatedIdentityId) {\n                logger.debug(`The guest identity ${identityId.id} has become the primary identity.`);\n            }\n            identityId = {\n                id: generatedIdentityId,\n                type: 'primary',\n            };\n        }\n    }\n    else {\n        // If there is existing guest identityId cached return that\n        if (identityId && identityId.type === 'guest') {\n            return identityId.id;\n        }\n        else {\n            identityId = {\n                id: await generateIdentityId({}, authConfig),\n                type: 'guest',\n            };\n        }\n    }\n    // Store in-memory or local storage depending on guest or primary identityId\n    identityIdStore.storeIdentityId(identityId);\n    return identityId.id;\n}\nexports.cognitoIdentityIdProvider = cognitoIdentityIdProvider;\nasync function generateIdentityId(logins, authConfig) {\n    const identityPoolId = authConfig?.identityPoolId;\n    const region = (0, parsers_1.getRegionFromIdentityPoolId)(identityPoolId);\n    // IdentityId is absent so get it using IdentityPoolId with Cognito's GetId API\n    const idResult = \n    // for a first-time user, this will return a brand new identity\n    // for a returning user, this will retrieve the previous identity assocaited with the logins\n    (await (0, core_1.getId)({\n        region,\n    }, {\n        IdentityPoolId: identityPoolId,\n        Logins: logins,\n    })).IdentityId;\n    if (!idResult) {\n        throw new AuthError_1.AuthError({\n            name: 'GetIdResponseException',\n            message: 'Received undefined response from getId operation',\n            recoverySuggestion: 'Make sure to pass a valid identityPoolId in the configuration.',\n        });\n    }\n    return idResult;\n}\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,OAAO,CAAC,yBAAyB,GAAG,KAAK,CAAC,CAAC;AAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAC5C,MAAM,WAAW,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;AACzD,MAAM,SAAS,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;AACzD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;AACnC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,aAAa,CAAC,2BAA2B,CAAC,CAAC;AACrE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,yBAAyB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,GAAG,EAAE;AACnF,IAAI,eAAe,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;AAC3D;AACA,IAAI,IAAI,UAAU,GAAG,MAAM,eAAe,CAAC,cAAc,EAAE,CAAC;AAC5D;AACA,IAAI,IAAI,MAAM,EAAE;AAChB;AACA,QAAQ,IAAI,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE;AACzD,YAAY,OAAO,UAAU,CAAC,EAAE,CAAC;AACjC,SAAS;AACT,aAAa;AACb,YAAY,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO;AACzC,kBAAkB,IAAI,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;AACvE,kBAAkB,EAAE,CAAC;AACrB,YAAY,MAAM,mBAAmB,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AACrF,YAAY,IAAI,UAAU,IAAI,UAAU,CAAC,EAAE,KAAK,mBAAmB,EAAE;AACrE,gBAAgB,MAAM,CAAC,KAAK,CAAC,CAAC,mBAAmB,EAAE,UAAU,CAAC,EAAE,CAAC,iCAAiC,CAAC,CAAC,CAAC;AACrG,aAAa;AACb,YAAY,UAAU,GAAG;AACzB,gBAAgB,EAAE,EAAE,mBAAmB;AACvC,gBAAgB,IAAI,EAAE,SAAS;AAC/B,aAAa,CAAC;AACd,SAAS;AACT,KAAK;AACL,SAAS;AACT;AACA,QAAQ,IAAI,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE;AACvD,YAAY,OAAO,UAAU,CAAC,EAAE,CAAC;AACjC,SAAS;AACT,aAAa;AACb,YAAY,UAAU,GAAG;AACzB,gBAAgB,EAAE,EAAE,MAAM,kBAAkB,CAAC,EAAE,EAAE,UAAU,CAAC;AAC5D,gBAAgB,IAAI,EAAE,OAAO;AAC7B,aAAa,CAAC;AACd,SAAS;AACT,KAAK;AACL;AACA,IAAI,eAAe,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;AAChD,IAAI,OAAO,UAAU,CAAC,EAAE,CAAC;AACzB,CAAC;AACD,OAAO,CAAC,yBAAyB,GAAG,yBAAyB,CAAC;AAC9D,eAAe,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE;AACtD,IAAI,MAAM,cAAc,GAAG,UAAU,EAAE,cAAc,CAAC;AACtD,IAAI,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,2BAA2B,EAAE,cAAc,CAAC,CAAC;AAC9E;AACA,IAAI,MAAM,QAAQ;AAClB;AACA;AACA,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,EAAE;AAC7B,QAAQ,MAAM;AACd,KAAK,EAAE;AACP,QAAQ,cAAc,EAAE,cAAc;AACtC,QAAQ,MAAM,EAAE,MAAM;AACtB,KAAK,CAAC,EAAE,UAAU,CAAC;AACnB,IAAI,IAAI,CAAC,QAAQ,EAAE;AACnB,QAAQ,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC;AACxC,YAAY,IAAI,EAAE,wBAAwB;AAC1C,YAAY,OAAO,EAAE,kDAAkD;AACvE,YAAY,kBAAkB,EAAE,gEAAgE;AAChG,SAAS,CAAC,CAAC;AACX,KAAK;AACL,IAAI,OAAO,QAAQ,CAAC;AACpB;;"}
+{"version":3,"file":"IdentityIdProvider.js","sources":["../../../../../src/providers/cognito/credentialsProvider/IdentityIdProvider.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.cognitoIdentityIdProvider = void 0;\nconst core_1 = require(\"@aws-amplify/core\");\nconst AuthError_1 = require(\"../../../errors/AuthError\");\nconst parsers_1 = require(\"../../../foundation/parsers\");\nconst utils_1 = require(\"./utils\");\n/**\n * Provides a Cognito identityId\n *\n * @param tokens - The AuthTokens received after SignIn\n * @returns string\n * @throws configuration exceptions: `InvalidIdentityPoolIdException`\n *  - Auth errors that may arise from misconfiguration.\n * @throws service exceptions: {@link GetIdException }\n */\nasync function cognitoIdentityIdProvider({ tokens, authConfig, identityIdStore, }) {\n    identityIdStore.setAuthConfig({ Cognito: authConfig });\n    // will return null only if there is no identityId cached or if there is an error retrieving it\n    const identityId = await identityIdStore.loadIdentityId();\n    if (identityId) {\n        return identityId.id;\n    }\n    const logins = tokens?.idToken\n        ? (0, utils_1.formLoginsMap)(tokens.idToken.toString())\n        : {};\n    const generatedIdentityId = await generateIdentityId(logins, authConfig);\n    // Store generated identityId\n    identityIdStore.storeIdentityId({\n        id: generatedIdentityId,\n        type: tokens ? 'primary' : 'guest',\n    });\n    return generatedIdentityId;\n}\nexports.cognitoIdentityIdProvider = cognitoIdentityIdProvider;\nasync function generateIdentityId(logins, authConfig) {\n    const identityPoolId = authConfig?.identityPoolId;\n    const region = (0, parsers_1.getRegionFromIdentityPoolId)(identityPoolId);\n    // IdentityId is absent so get it using IdentityPoolId with Cognito's GetId API\n    const idResult = \n    // for a first-time user, this will return a brand new identity\n    // for a returning user, this will retrieve the previous identity assocaited with the logins\n    (await (0, core_1.getId)({\n        region,\n    }, {\n        IdentityPoolId: identityPoolId,\n        Logins: logins,\n    })).IdentityId;\n    if (!idResult) {\n        throw new AuthError_1.AuthError({\n            name: 'GetIdResponseException',\n            message: 'Received undefined response from getId operation',\n            recoverySuggestion: 'Make sure to pass a valid identityPoolId in the configuration.',\n        });\n    }\n    return idResult;\n}\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,OAAO,CAAC,yBAAyB,GAAG,KAAK,CAAC,CAAC;AAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAC5C,MAAM,WAAW,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;AACzD,MAAM,SAAS,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;AACzD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;AACnC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,yBAAyB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,GAAG,EAAE;AACnF,IAAI,eAAe,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;AAC3D;AACA,IAAI,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,cAAc,EAAE,CAAC;AAC9D,IAAI,IAAI,UAAU,EAAE;AACpB,QAAQ,OAAO,UAAU,CAAC,EAAE,CAAC;AAC7B,KAAK;AACL,IAAI,MAAM,MAAM,GAAG,MAAM,EAAE,OAAO;AAClC,UAAU,IAAI,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;AAC/D,UAAU,EAAE,CAAC;AACb,IAAI,MAAM,mBAAmB,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAC7E;AACA,IAAI,eAAe,CAAC,eAAe,CAAC;AACpC,QAAQ,EAAE,EAAE,mBAAmB;AAC/B,QAAQ,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;AAC1C,KAAK,CAAC,CAAC;AACP,IAAI,OAAO,mBAAmB,CAAC;AAC/B,CAAC;AACD,OAAO,CAAC,yBAAyB,GAAG,yBAAyB,CAAC;AAC9D,eAAe,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE;AACtD,IAAI,MAAM,cAAc,GAAG,UAAU,EAAE,cAAc,CAAC;AACtD,IAAI,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,2BAA2B,EAAE,cAAc,CAAC,CAAC;AAC9E;AACA,IAAI,MAAM,QAAQ;AAClB;AACA;AACA,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,EAAE;AAC7B,QAAQ,MAAM;AACd,KAAK,EAAE;AACP,QAAQ,cAAc,EAAE,cAAc;AACtC,QAAQ,MAAM,EAAE,MAAM;AACtB,KAAK,CAAC,EAAE,UAAU,CAAC;AACnB,IAAI,IAAI,CAAC,QAAQ,EAAE;AACnB,QAAQ,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC;AACxC,YAAY,IAAI,EAAE,wBAAwB;AAC1C,YAAY,OAAO,EAAE,kDAAkD;AACvE,YAAY,kBAAkB,EAAE,gEAAgE;AAChG,SAAS,CAAC,CAAC;AACX,KAAK;AACL,IAAI,OAAO,QAAQ,CAAC;AACpB;;"}

package/dist/cjs/providers/cognito/credentialsProvider/credentialsProvider.js

@@ -92,11 +92,10 @@ class CognitoAWSCredentialsAndIdentityIdProvider {
                 },
                 identityId,
             };
-            const identityIdRes = clientResult.IdentityId;
-            if (identityIdRes) {
-                res.identityId = identityIdRes;
+            if (clientResult.IdentityId) {
+                res.identityId = clientResult.IdentityId;
                 this._identityIdStore.storeIdentityId({
-                    id: identityIdRes,
+                    id: clientResult.IdentityId,
                     type: 'guest',
                 });
             }
@@ -133,6 +132,7 @@ class CognitoAWSCredentialsAndIdentityIdProvider {
         if (clientResult.Credentials &&
             clientResult.Credentials.AccessKeyId &&
             clientResult.Credentials.SecretKey) {
+            this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;
             const res = {
                 credentials: {
                     accessKeyId: clientResult.Credentials.AccessKeyId,
@@ -142,21 +142,20 @@ class CognitoAWSCredentialsAndIdentityIdProvider {
                 },
                 identityId,
             };
+            if (clientResult.IdentityId) {
+                res.identityId = clientResult.IdentityId;
+                // note: the following call removes guest identityId from the persistent store (localStorage)
+                this._identityIdStore.storeIdentityId({
+                    id: clientResult.IdentityId,
+                    type: 'primary',
+                });
+            }
             // Store the credentials in-memory along with the expiration
             this._credentialsAndIdentityId = {
                 ...res,
                 isAuthenticatedCreds: true,
                 associatedIdToken: authTokens.idToken?.toString(),
             };
-            this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;
-            const identityIdRes = clientResult.IdentityId;
-            if (identityIdRes) {
-                res.identityId = identityIdRes;
-                this._identityIdStore.storeIdentityId({
-                    id: identityIdRes,
-                    type: 'primary',
-                });
-            }
             return res;
         }
         else {

package/dist/cjs/providers/cognito/credentialsProvider/credentialsProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentialsProvider.js","sources":["../../../../../src/providers/cognito/credentialsProvider/credentialsProvider.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.CognitoAWSCredentialsAndIdentityIdProvider = void 0;\nconst core_1 = require(\"@aws-amplify/core\");\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nconst AuthError_1 = require(\"../../../errors/AuthError\");\nconst parsers_1 = require(\"../../../foundation/parsers\");\nconst types_1 = require(\"../utils/types\");\nconst IdentityIdProvider_1 = require(\"./IdentityIdProvider\");\nconst utils_2 = require(\"./utils\");\nconst logger = new core_1.ConsoleLogger('CognitoCredentialsProvider');\nconst CREDENTIALS_TTL = 50 * 60 * 1000; // 50 min, can be modified on config if required in the future\nclass CognitoAWSCredentialsAndIdentityIdProvider {\n    constructor(identityIdStore) {\n        this._nextCredentialsRefresh = 0;\n        this._identityIdStore = identityIdStore;\n    }\n    async clearCredentialsAndIdentityId() {\n        logger.debug('Clearing out credentials and identityId');\n        this._credentialsAndIdentityId = undefined;\n        await this._identityIdStore.clearIdentityId();\n    }\n    async clearCredentials() {\n        logger.debug('Clearing out in-memory credentials');\n        this._credentialsAndIdentityId = undefined;\n    }\n    async getCredentialsAndIdentityId(getCredentialsOptions) {\n        const isAuthenticated = getCredentialsOptions.authenticated;\n        const { tokens } = getCredentialsOptions;\n        const { authConfig } = getCredentialsOptions;\n        try {\n            (0, utils_1.assertIdentityPoolIdConfig)(authConfig?.Cognito);\n        }\n        catch {\n            // No identity pool configured, skipping\n            return;\n        }\n        if (!isAuthenticated && !authConfig.Cognito.allowGuestAccess) {\n            // TODO(V6): return partial result like Native platforms\n            return;\n        }\n        const { forceRefresh } = getCredentialsOptions;\n        const tokenHasChanged = this.hasTokenChanged(tokens);\n        const identityId = await (0, IdentityIdProvider_1.cognitoIdentityIdProvider)({\n            tokens,\n            authConfig: authConfig.Cognito,\n            identityIdStore: this._identityIdStore,\n        });\n        // Clear cached credentials when forceRefresh is true OR the cache token has changed\n        if (forceRefresh || tokenHasChanged) {\n            this.clearCredentials();\n        }\n        if (!isAuthenticated) {\n            return this.getGuestCredentials(identityId, authConfig.Cognito);\n        }\n        else {\n            (0, types_1.assertIdTokenInAuthTokens)(tokens);\n            return this.credsForOIDCTokens(authConfig.Cognito, tokens, identityId);\n        }\n    }\n    async getGuestCredentials(identityId, authConfig) {\n        // Return existing in-memory cached credentials only if it exists, is not past it's lifetime and is unauthenticated credentials\n        if (this._credentialsAndIdentityId &&\n            !this.isPastTTL() &&\n            this._credentialsAndIdentityId.isAuthenticatedCreds === false) {\n            logger.info('returning stored credentials as they neither past TTL nor expired.');\n            return this._credentialsAndIdentityId;\n        }\n        // Clear to discard if any authenticated credentials are set and start with a clean slate\n        this.clearCredentials();\n        const region = (0, parsers_1.getRegionFromIdentityPoolId)(authConfig.identityPoolId);\n        // use identityId to obtain guest credentials\n        // save credentials in-memory\n        // No logins params should be passed for guest creds:\n        // https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetCredentialsForIdentity.html\n        const clientResult = await (0, core_1.getCredentialsForIdentity)({ region }, {\n            IdentityId: identityId,\n        });\n        if (clientResult.Credentials &&\n            clientResult.Credentials.AccessKeyId &&\n            clientResult.Credentials.SecretKey) {\n            this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;\n            const res = {\n                credentials: {\n                    accessKeyId: clientResult.Credentials.AccessKeyId,\n                    secretAccessKey: clientResult.Credentials.SecretKey,\n                    sessionToken: clientResult.Credentials.SessionToken,\n                    expiration: clientResult.Credentials.Expiration,\n                },\n                identityId,\n            };\n            const identityIdRes = clientResult.IdentityId;\n            if (identityIdRes) {\n                res.identityId = identityIdRes;\n                this._identityIdStore.storeIdentityId({\n                    id: identityIdRes,\n                    type: 'guest',\n                });\n            }\n            this._credentialsAndIdentityId = {\n                ...res,\n                isAuthenticatedCreds: false,\n            };\n            return res;\n        }\n        else {\n            throw new AuthError_1.AuthError({\n                name: 'CredentialsNotFoundException',\n                message: `Cognito did not respond with either Credentials, AccessKeyId or SecretKey.`,\n            });\n        }\n    }\n    async credsForOIDCTokens(authConfig, authTokens, identityId) {\n        if (this._credentialsAndIdentityId &&\n            !this.isPastTTL() &&\n            this._credentialsAndIdentityId.isAuthenticatedCreds === true) {\n            logger.debug('returning stored credentials as they neither past TTL nor expired.');\n            return this._credentialsAndIdentityId;\n        }\n        // Clear to discard if any unauthenticated credentials are set and start with a clean slate\n        this.clearCredentials();\n        const logins = authTokens.idToken\n            ? (0, utils_2.formLoginsMap)(authTokens.idToken.toString())\n            : {};\n        const region = (0, parsers_1.getRegionFromIdentityPoolId)(authConfig.identityPoolId);\n        const clientResult = await (0, core_1.getCredentialsForIdentity)({ region }, {\n            IdentityId: identityId,\n            Logins: logins,\n        });\n        if (clientResult.Credentials &&\n            clientResult.Credentials.AccessKeyId &&\n            clientResult.Credentials.SecretKey) {\n            const res = {\n                credentials: {\n                    accessKeyId: clientResult.Credentials.AccessKeyId,\n                    secretAccessKey: clientResult.Credentials.SecretKey,\n                    sessionToken: clientResult.Credentials.SessionToken,\n                    expiration: clientResult.Credentials.Expiration,\n                },\n                identityId,\n            };\n            // Store the credentials in-memory along with the expiration\n            this._credentialsAndIdentityId = {\n                ...res,\n                isAuthenticatedCreds: true,\n                associatedIdToken: authTokens.idToken?.toString(),\n            };\n            this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;\n            const identityIdRes = clientResult.IdentityId;\n            if (identityIdRes) {\n                res.identityId = identityIdRes;\n                this._identityIdStore.storeIdentityId({\n                    id: identityIdRes,\n                    type: 'primary',\n                });\n            }\n            return res;\n        }\n        else {\n            throw new AuthError_1.AuthError({\n                name: 'CredentialsException',\n                message: `Cognito did not respond with either Credentials, AccessKeyId or SecretKey.`,\n            });\n        }\n    }\n    isPastTTL() {\n        return this._nextCredentialsRefresh === undefined\n            ? true\n            : this._nextCredentialsRefresh <= Date.now();\n    }\n    hasTokenChanged(tokens) {\n        return (!!tokens &&\n            !!this._credentialsAndIdentityId?.associatedIdToken &&\n            tokens.idToken?.toString() !==\n                this._credentialsAndIdentityId.associatedIdToken);\n    }\n}\nexports.CognitoAWSCredentialsAndIdentityIdProvider = CognitoAWSCredentialsAndIdentityIdProvider;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,OAAO,CAAC,0CAA0C,GAAG,KAAK,CAAC,CAAC;AAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC,CAAC;AAC7D,MAAM,WAAW,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;AACzD,MAAM,SAAS,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;AACzD,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAC1C,MAAM,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;AACnC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,aAAa,CAAC,4BAA4B,CAAC,CAAC;AACtE,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,MAAM,0CAA0C,CAAC;AACjD,IAAI,WAAW,CAAC,eAAe,EAAE;AACjC,QAAQ,IAAI,CAAC,uBAAuB,GAAG,CAAC,CAAC;AACzC,QAAQ,IAAI,CAAC,gBAAgB,GAAG,eAAe,CAAC;AAChD,KAAK;AACL,IAAI,MAAM,6BAA6B,GAAG;AAC1C,QAAQ,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;AAChE,QAAQ,IAAI,CAAC,yBAAyB,GAAG,SAAS,CAAC;AACnD,QAAQ,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE,CAAC;AACtD,KAAK;AACL,IAAI,MAAM,gBAAgB,GAAG;AAC7B,QAAQ,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;AAC3D,QAAQ,IAAI,CAAC,yBAAyB,GAAG,SAAS,CAAC;AACnD,KAAK;AACL,IAAI,MAAM,2BAA2B,CAAC,qBAAqB,EAAE;AAC7D,QAAQ,MAAM,eAAe,GAAG,qBAAqB,CAAC,aAAa,CAAC;AACpE,QAAQ,MAAM,EAAE,MAAM,EAAE,GAAG,qBAAqB,CAAC;AACjD,QAAQ,MAAM,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAAC;AACrD,QAAQ,IAAI;AACZ,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,0BAA0B,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AACzE,SAAS;AACT,QAAQ,MAAM;AACd;AACA,YAAY,OAAO;AACnB,SAAS;AACT,QAAQ,IAAI,CAAC,eAAe,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,EAAE;AACtE;AACA,YAAY,OAAO;AACnB,SAAS;AACT,QAAQ,MAAM,EAAE,YAAY,EAAE,GAAG,qBAAqB,CAAC;AACvD,QAAQ,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;AAC7D,QAAQ,MAAM,UAAU,GAAG,MAAM,IAAI,oBAAoB,CAAC,yBAAyB,EAAE;AACrF,YAAY,MAAM;AAClB,YAAY,UAAU,EAAE,UAAU,CAAC,OAAO;AAC1C,YAAY,eAAe,EAAE,IAAI,CAAC,gBAAgB;AAClD,SAAS,CAAC,CAAC;AACX;AACA,QAAQ,IAAI,YAAY,IAAI,eAAe,EAAE;AAC7C,YAAY,IAAI,CAAC,gBAAgB,EAAE,CAAC;AACpC,SAAS;AACT,QAAQ,IAAI,CAAC,eAAe,EAAE;AAC9B,YAAY,OAAO,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;AAC5E,SAAS;AACT,aAAa;AACb,YAAY,IAAI,OAAO,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAAC;AAC3D,YAAY,OAAO,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AACnF,SAAS;AACT,KAAK;AACL,IAAI,MAAM,mBAAmB,CAAC,UAAU,EAAE,UAAU,EAAE;AACtD;AACA,QAAQ,IAAI,IAAI,CAAC,yBAAyB;AAC1C,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE;AAC7B,YAAY,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,KAAK,KAAK,EAAE;AAC3E,YAAY,MAAM,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;AAC9F,YAAY,OAAO,IAAI,CAAC,yBAAyB,CAAC;AAClD,SAAS;AACT;AACA,QAAQ,IAAI,CAAC,gBAAgB,EAAE,CAAC;AAChC,QAAQ,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,2BAA2B,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC;AAC7F;AACA;AACA;AACA;AACA,QAAQ,MAAM,YAAY,GAAG,MAAM,IAAI,MAAM,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,EAAE;AACrF,YAAY,UAAU,EAAE,UAAU;AAClC,SAAS,CAAC,CAAC;AACX,QAAQ,IAAI,YAAY,CAAC,WAAW;AACpC,YAAY,YAAY,CAAC,WAAW,CAAC,WAAW;AAChD,YAAY,YAAY,CAAC,WAAW,CAAC,SAAS,EAAE;AAChD,YAAY,IAAI,CAAC,uBAAuB,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,eAAe,CAAC;AAClF,YAAY,MAAM,GAAG,GAAG;AACxB,gBAAgB,WAAW,EAAE;AAC7B,oBAAoB,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC,WAAW;AACrE,oBAAoB,eAAe,EAAE,YAAY,CAAC,WAAW,CAAC,SAAS;AACvE,oBAAoB,YAAY,EAAE,YAAY,CAAC,WAAW,CAAC,YAAY;AACvE,oBAAoB,UAAU,EAAE,YAAY,CAAC,WAAW,CAAC,UAAU;AACnE,iBAAiB;AACjB,gBAAgB,UAAU;AAC1B,aAAa,CAAC;AACd,YAAY,MAAM,aAAa,GAAG,YAAY,CAAC,UAAU,CAAC;AAC1D,YAAY,IAAI,aAAa,EAAE;AAC/B,gBAAgB,GAAG,CAAC,UAAU,GAAG,aAAa,CAAC;AAC/C,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;AACtD,oBAAoB,EAAE,EAAE,aAAa;AACrC,oBAAoB,IAAI,EAAE,OAAO;AACjC,iBAAiB,CAAC,CAAC;AACnB,aAAa;AACb,YAAY,IAAI,CAAC,yBAAyB,GAAG;AAC7C,gBAAgB,GAAG,GAAG;AACtB,gBAAgB,oBAAoB,EAAE,KAAK;AAC3C,aAAa,CAAC;AACd,YAAY,OAAO,GAAG,CAAC;AACvB,SAAS;AACT,aAAa;AACb,YAAY,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC;AAC5C,gBAAgB,IAAI,EAAE,8BAA8B;AACpD,gBAAgB,OAAO,EAAE,CAAC,0EAA0E,CAAC;AACrG,aAAa,CAAC,CAAC;AACf,SAAS;AACT,KAAK;AACL,IAAI,MAAM,kBAAkB,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE;AACjE,QAAQ,IAAI,IAAI,CAAC,yBAAyB;AAC1C,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE;AAC7B,YAAY,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,KAAK,IAAI,EAAE;AAC1E,YAAY,MAAM,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;AAC/F,YAAY,OAAO,IAAI,CAAC,yBAAyB,CAAC;AAClD,SAAS;AACT;AACA,QAAQ,IAAI,CAAC,gBAAgB,EAAE,CAAC;AAChC,QAAQ,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO;AACzC,cAAc,IAAI,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;AACvE,cAAc,EAAE,CAAC;AACjB,QAAQ,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,2BAA2B,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC;AAC7F,QAAQ,MAAM,YAAY,GAAG,MAAM,IAAI,MAAM,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,EAAE;AACrF,YAAY,UAAU,EAAE,UAAU;AAClC,YAAY,MAAM,EAAE,MAAM;AAC1B,SAAS,CAAC,CAAC;AACX,QAAQ,IAAI,YAAY,CAAC,WAAW;AACpC,YAAY,YAAY,CAAC,WAAW,CAAC,WAAW;AAChD,YAAY,YAAY,CAAC,WAAW,CAAC,SAAS,EAAE;AAChD,YAAY,MAAM,GAAG,GAAG;AACxB,gBAAgB,WAAW,EAAE;AAC7B,oBAAoB,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC,WAAW;AACrE,oBAAoB,eAAe,EAAE,YAAY,CAAC,WAAW,CAAC,SAAS;AACvE,oBAAoB,YAAY,EAAE,YAAY,CAAC,WAAW,CAAC,YAAY;AACvE,oBAAoB,UAAU,EAAE,YAAY,CAAC,WAAW,CAAC,UAAU;AACnE,iBAAiB;AACjB,gBAAgB,UAAU;AAC1B,aAAa,CAAC;AACd;AACA,YAAY,IAAI,CAAC,yBAAyB,GAAG;AAC7C,gBAAgB,GAAG,GAAG;AACtB,gBAAgB,oBAAoB,EAAE,IAAI;AAC1C,gBAAgB,iBAAiB,EAAE,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE;AACjE,aAAa,CAAC;AACd,YAAY,IAAI,CAAC,uBAAuB,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,eAAe,CAAC;AAClF,YAAY,MAAM,aAAa,GAAG,YAAY,CAAC,UAAU,CAAC;AAC1D,YAAY,IAAI,aAAa,EAAE;AAC/B,gBAAgB,GAAG,CAAC,UAAU,GAAG,aAAa,CAAC;AAC/C,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;AACtD,oBAAoB,EAAE,EAAE,aAAa;AACrC,oBAAoB,IAAI,EAAE,SAAS;AACnC,iBAAiB,CAAC,CAAC;AACnB,aAAa;AACb,YAAY,OAAO,GAAG,CAAC;AACvB,SAAS;AACT,aAAa;AACb,YAAY,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC;AAC5C,gBAAgB,IAAI,EAAE,sBAAsB;AAC5C,gBAAgB,OAAO,EAAE,CAAC,0EAA0E,CAAC;AACrG,aAAa,CAAC,CAAC;AACf,SAAS;AACT,KAAK;AACL,IAAI,SAAS,GAAG;AAChB,QAAQ,OAAO,IAAI,CAAC,uBAAuB,KAAK,SAAS;AACzD,cAAc,IAAI;AAClB,cAAc,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;AACzD,KAAK;AACL,IAAI,eAAe,CAAC,MAAM,EAAE;AAC5B,QAAQ,QAAQ,CAAC,CAAC,MAAM;AACxB,YAAY,CAAC,CAAC,IAAI,CAAC,yBAAyB,EAAE,iBAAiB;AAC/D,YAAY,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE;AACtC,gBAAgB,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,EAAE;AAClE,KAAK;AACL,CAAC;AACD,OAAO,CAAC,0CAA0C,GAAG,0CAA0C;;"}
+{"version":3,"file":"credentialsProvider.js","sources":["../../../../../src/providers/cognito/credentialsProvider/credentialsProvider.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.CognitoAWSCredentialsAndIdentityIdProvider = void 0;\nconst core_1 = require(\"@aws-amplify/core\");\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nconst AuthError_1 = require(\"../../../errors/AuthError\");\nconst parsers_1 = require(\"../../../foundation/parsers\");\nconst types_1 = require(\"../utils/types\");\nconst IdentityIdProvider_1 = require(\"./IdentityIdProvider\");\nconst utils_2 = require(\"./utils\");\nconst logger = new core_1.ConsoleLogger('CognitoCredentialsProvider');\nconst CREDENTIALS_TTL = 50 * 60 * 1000; // 50 min, can be modified on config if required in the future\nclass CognitoAWSCredentialsAndIdentityIdProvider {\n    constructor(identityIdStore) {\n        this._nextCredentialsRefresh = 0;\n        this._identityIdStore = identityIdStore;\n    }\n    async clearCredentialsAndIdentityId() {\n        logger.debug('Clearing out credentials and identityId');\n        this._credentialsAndIdentityId = undefined;\n        await this._identityIdStore.clearIdentityId();\n    }\n    async clearCredentials() {\n        logger.debug('Clearing out in-memory credentials');\n        this._credentialsAndIdentityId = undefined;\n    }\n    async getCredentialsAndIdentityId(getCredentialsOptions) {\n        const isAuthenticated = getCredentialsOptions.authenticated;\n        const { tokens } = getCredentialsOptions;\n        const { authConfig } = getCredentialsOptions;\n        try {\n            (0, utils_1.assertIdentityPoolIdConfig)(authConfig?.Cognito);\n        }\n        catch {\n            // No identity pool configured, skipping\n            return;\n        }\n        if (!isAuthenticated && !authConfig.Cognito.allowGuestAccess) {\n            // TODO(V6): return partial result like Native platforms\n            return;\n        }\n        const { forceRefresh } = getCredentialsOptions;\n        const tokenHasChanged = this.hasTokenChanged(tokens);\n        const identityId = await (0, IdentityIdProvider_1.cognitoIdentityIdProvider)({\n            tokens,\n            authConfig: authConfig.Cognito,\n            identityIdStore: this._identityIdStore,\n        });\n        // Clear cached credentials when forceRefresh is true OR the cache token has changed\n        if (forceRefresh || tokenHasChanged) {\n            this.clearCredentials();\n        }\n        if (!isAuthenticated) {\n            return this.getGuestCredentials(identityId, authConfig.Cognito);\n        }\n        else {\n            (0, types_1.assertIdTokenInAuthTokens)(tokens);\n            return this.credsForOIDCTokens(authConfig.Cognito, tokens, identityId);\n        }\n    }\n    async getGuestCredentials(identityId, authConfig) {\n        // Return existing in-memory cached credentials only if it exists, is not past it's lifetime and is unauthenticated credentials\n        if (this._credentialsAndIdentityId &&\n            !this.isPastTTL() &&\n            this._credentialsAndIdentityId.isAuthenticatedCreds === false) {\n            logger.info('returning stored credentials as they neither past TTL nor expired.');\n            return this._credentialsAndIdentityId;\n        }\n        // Clear to discard if any authenticated credentials are set and start with a clean slate\n        this.clearCredentials();\n        const region = (0, parsers_1.getRegionFromIdentityPoolId)(authConfig.identityPoolId);\n        // use identityId to obtain guest credentials\n        // save credentials in-memory\n        // No logins params should be passed for guest creds:\n        // https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetCredentialsForIdentity.html\n        const clientResult = await (0, core_1.getCredentialsForIdentity)({ region }, {\n            IdentityId: identityId,\n        });\n        if (clientResult.Credentials &&\n            clientResult.Credentials.AccessKeyId &&\n            clientResult.Credentials.SecretKey) {\n            this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;\n            const res = {\n                credentials: {\n                    accessKeyId: clientResult.Credentials.AccessKeyId,\n                    secretAccessKey: clientResult.Credentials.SecretKey,\n                    sessionToken: clientResult.Credentials.SessionToken,\n                    expiration: clientResult.Credentials.Expiration,\n                },\n                identityId,\n            };\n            if (clientResult.IdentityId) {\n                res.identityId = clientResult.IdentityId;\n                this._identityIdStore.storeIdentityId({\n                    id: clientResult.IdentityId,\n                    type: 'guest',\n                });\n            }\n            this._credentialsAndIdentityId = {\n                ...res,\n                isAuthenticatedCreds: false,\n            };\n            return res;\n        }\n        else {\n            throw new AuthError_1.AuthError({\n                name: 'CredentialsNotFoundException',\n                message: `Cognito did not respond with either Credentials, AccessKeyId or SecretKey.`,\n            });\n        }\n    }\n    async credsForOIDCTokens(authConfig, authTokens, identityId) {\n        if (this._credentialsAndIdentityId &&\n            !this.isPastTTL() &&\n            this._credentialsAndIdentityId.isAuthenticatedCreds === true) {\n            logger.debug('returning stored credentials as they neither past TTL nor expired.');\n            return this._credentialsAndIdentityId;\n        }\n        // Clear to discard if any unauthenticated credentials are set and start with a clean slate\n        this.clearCredentials();\n        const logins = authTokens.idToken\n            ? (0, utils_2.formLoginsMap)(authTokens.idToken.toString())\n            : {};\n        const region = (0, parsers_1.getRegionFromIdentityPoolId)(authConfig.identityPoolId);\n        const clientResult = await (0, core_1.getCredentialsForIdentity)({ region }, {\n            IdentityId: identityId,\n            Logins: logins,\n        });\n        if (clientResult.Credentials &&\n            clientResult.Credentials.AccessKeyId &&\n            clientResult.Credentials.SecretKey) {\n            this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;\n            const res = {\n                credentials: {\n                    accessKeyId: clientResult.Credentials.AccessKeyId,\n                    secretAccessKey: clientResult.Credentials.SecretKey,\n                    sessionToken: clientResult.Credentials.SessionToken,\n                    expiration: clientResult.Credentials.Expiration,\n                },\n                identityId,\n            };\n            if (clientResult.IdentityId) {\n                res.identityId = clientResult.IdentityId;\n                // note: the following call removes guest identityId from the persistent store (localStorage)\n                this._identityIdStore.storeIdentityId({\n                    id: clientResult.IdentityId,\n                    type: 'primary',\n                });\n            }\n            // Store the credentials in-memory along with the expiration\n            this._credentialsAndIdentityId = {\n                ...res,\n                isAuthenticatedCreds: true,\n                associatedIdToken: authTokens.idToken?.toString(),\n            };\n            return res;\n        }\n        else {\n            throw new AuthError_1.AuthError({\n                name: 'CredentialsException',\n                message: `Cognito did not respond with either Credentials, AccessKeyId or SecretKey.`,\n            });\n        }\n    }\n    isPastTTL() {\n        return this._nextCredentialsRefresh === undefined\n            ? true\n            : this._nextCredentialsRefresh <= Date.now();\n    }\n    hasTokenChanged(tokens) {\n        return (!!tokens &&\n            !!this._credentialsAndIdentityId?.associatedIdToken &&\n            tokens.idToken?.toString() !==\n                this._credentialsAndIdentityId.associatedIdToken);\n    }\n}\nexports.CognitoAWSCredentialsAndIdentityIdProvider = CognitoAWSCredentialsAndIdentityIdProvider;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,OAAO,CAAC,0CAA0C,GAAG,KAAK,CAAC,CAAC;AAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC,CAAC;AAC7D,MAAM,WAAW,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;AACzD,MAAM,SAAS,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;AACzD,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAC1C,MAAM,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;AACnC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,aAAa,CAAC,4BAA4B,CAAC,CAAC;AACtE,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,MAAM,0CAA0C,CAAC;AACjD,IAAI,WAAW,CAAC,eAAe,EAAE;AACjC,QAAQ,IAAI,CAAC,uBAAuB,GAAG,CAAC,CAAC;AACzC,QAAQ,IAAI,CAAC,gBAAgB,GAAG,eAAe,CAAC;AAChD,KAAK;AACL,IAAI,MAAM,6BAA6B,GAAG;AAC1C,QAAQ,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;AAChE,QAAQ,IAAI,CAAC,yBAAyB,GAAG,SAAS,CAAC;AACnD,QAAQ,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE,CAAC;AACtD,KAAK;AACL,IAAI,MAAM,gBAAgB,GAAG;AAC7B,QAAQ,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;AAC3D,QAAQ,IAAI,CAAC,yBAAyB,GAAG,SAAS,CAAC;AACnD,KAAK;AACL,IAAI,MAAM,2BAA2B,CAAC,qBAAqB,EAAE;AAC7D,QAAQ,MAAM,eAAe,GAAG,qBAAqB,CAAC,aAAa,CAAC;AACpE,QAAQ,MAAM,EAAE,MAAM,EAAE,GAAG,qBAAqB,CAAC;AACjD,QAAQ,MAAM,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAAC;AACrD,QAAQ,IAAI;AACZ,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,0BAA0B,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AACzE,SAAS;AACT,QAAQ,MAAM;AACd;AACA,YAAY,OAAO;AACnB,SAAS;AACT,QAAQ,IAAI,CAAC,eAAe,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,EAAE;AACtE;AACA,YAAY,OAAO;AACnB,SAAS;AACT,QAAQ,MAAM,EAAE,YAAY,EAAE,GAAG,qBAAqB,CAAC;AACvD,QAAQ,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;AAC7D,QAAQ,MAAM,UAAU,GAAG,MAAM,IAAI,oBAAoB,CAAC,yBAAyB,EAAE;AACrF,YAAY,MAAM;AAClB,YAAY,UAAU,EAAE,UAAU,CAAC,OAAO;AAC1C,YAAY,eAAe,EAAE,IAAI,CAAC,gBAAgB;AAClD,SAAS,CAAC,CAAC;AACX;AACA,QAAQ,IAAI,YAAY,IAAI,eAAe,EAAE;AAC7C,YAAY,IAAI,CAAC,gBAAgB,EAAE,CAAC;AACpC,SAAS;AACT,QAAQ,IAAI,CAAC,eAAe,EAAE;AAC9B,YAAY,OAAO,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;AAC5E,SAAS;AACT,aAAa;AACb,YAAY,IAAI,OAAO,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAAC;AAC3D,YAAY,OAAO,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AACnF,SAAS;AACT,KAAK;AACL,IAAI,MAAM,mBAAmB,CAAC,UAAU,EAAE,UAAU,EAAE;AACtD;AACA,QAAQ,IAAI,IAAI,CAAC,yBAAyB;AAC1C,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE;AAC7B,YAAY,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,KAAK,KAAK,EAAE;AAC3E,YAAY,MAAM,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;AAC9F,YAAY,OAAO,IAAI,CAAC,yBAAyB,CAAC;AAClD,SAAS;AACT;AACA,QAAQ,IAAI,CAAC,gBAAgB,EAAE,CAAC;AAChC,QAAQ,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,2BAA2B,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC;AAC7F;AACA;AACA;AACA;AACA,QAAQ,MAAM,YAAY,GAAG,MAAM,IAAI,MAAM,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,EAAE;AACrF,YAAY,UAAU,EAAE,UAAU;AAClC,SAAS,CAAC,CAAC;AACX,QAAQ,IAAI,YAAY,CAAC,WAAW;AACpC,YAAY,YAAY,CAAC,WAAW,CAAC,WAAW;AAChD,YAAY,YAAY,CAAC,WAAW,CAAC,SAAS,EAAE;AAChD,YAAY,IAAI,CAAC,uBAAuB,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,eAAe,CAAC;AAClF,YAAY,MAAM,GAAG,GAAG;AACxB,gBAAgB,WAAW,EAAE;AAC7B,oBAAoB,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC,WAAW;AACrE,oBAAoB,eAAe,EAAE,YAAY,CAAC,WAAW,CAAC,SAAS;AACvE,oBAAoB,YAAY,EAAE,YAAY,CAAC,WAAW,CAAC,YAAY;AACvE,oBAAoB,UAAU,EAAE,YAAY,CAAC,WAAW,CAAC,UAAU;AACnE,iBAAiB;AACjB,gBAAgB,UAAU;AAC1B,aAAa,CAAC;AACd,YAAY,IAAI,YAAY,CAAC,UAAU,EAAE;AACzC,gBAAgB,GAAG,CAAC,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC;AACzD,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;AACtD,oBAAoB,EAAE,EAAE,YAAY,CAAC,UAAU;AAC/C,oBAAoB,IAAI,EAAE,OAAO;AACjC,iBAAiB,CAAC,CAAC;AACnB,aAAa;AACb,YAAY,IAAI,CAAC,yBAAyB,GAAG;AAC7C,gBAAgB,GAAG,GAAG;AACtB,gBAAgB,oBAAoB,EAAE,KAAK;AAC3C,aAAa,CAAC;AACd,YAAY,OAAO,GAAG,CAAC;AACvB,SAAS;AACT,aAAa;AACb,YAAY,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC;AAC5C,gBAAgB,IAAI,EAAE,8BAA8B;AACpD,gBAAgB,OAAO,EAAE,CAAC,0EAA0E,CAAC;AACrG,aAAa,CAAC,CAAC;AACf,SAAS;AACT,KAAK;AACL,IAAI,MAAM,kBAAkB,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE;AACjE,QAAQ,IAAI,IAAI,CAAC,yBAAyB;AAC1C,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE;AAC7B,YAAY,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,KAAK,IAAI,EAAE;AAC1E,YAAY,MAAM,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;AAC/F,YAAY,OAAO,IAAI,CAAC,yBAAyB,CAAC;AAClD,SAAS;AACT;AACA,QAAQ,IAAI,CAAC,gBAAgB,EAAE,CAAC;AAChC,QAAQ,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO;AACzC,cAAc,IAAI,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;AACvE,cAAc,EAAE,CAAC;AACjB,QAAQ,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,2BAA2B,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC;AAC7F,QAAQ,MAAM,YAAY,GAAG,MAAM,IAAI,MAAM,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,EAAE;AACrF,YAAY,UAAU,EAAE,UAAU;AAClC,YAAY,MAAM,EAAE,MAAM;AAC1B,SAAS,CAAC,CAAC;AACX,QAAQ,IAAI,YAAY,CAAC,WAAW;AACpC,YAAY,YAAY,CAAC,WAAW,CAAC,WAAW;AAChD,YAAY,YAAY,CAAC,WAAW,CAAC,SAAS,EAAE;AAChD,YAAY,IAAI,CAAC,uBAAuB,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,eAAe,CAAC;AAClF,YAAY,MAAM,GAAG,GAAG;AACxB,gBAAgB,WAAW,EAAE;AAC7B,oBAAoB,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC,WAAW;AACrE,oBAAoB,eAAe,EAAE,YAAY,CAAC,WAAW,CAAC,SAAS;AACvE,oBAAoB,YAAY,EAAE,YAAY,CAAC,WAAW,CAAC,YAAY;AACvE,oBAAoB,UAAU,EAAE,YAAY,CAAC,WAAW,CAAC,UAAU;AACnE,iBAAiB;AACjB,gBAAgB,UAAU;AAC1B,aAAa,CAAC;AACd,YAAY,IAAI,YAAY,CAAC,UAAU,EAAE;AACzC,gBAAgB,GAAG,CAAC,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC;AACzD;AACA,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;AACtD,oBAAoB,EAAE,EAAE,YAAY,CAAC,UAAU;AAC/C,oBAAoB,IAAI,EAAE,SAAS;AACnC,iBAAiB,CAAC,CAAC;AACnB,aAAa;AACb;AACA,YAAY,IAAI,CAAC,yBAAyB,GAAG;AAC7C,gBAAgB,GAAG,GAAG;AACtB,gBAAgB,oBAAoB,EAAE,IAAI;AAC1C,gBAAgB,iBAAiB,EAAE,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE;AACjE,aAAa,CAAC;AACd,YAAY,OAAO,GAAG,CAAC;AACvB,SAAS;AACT,aAAa;AACb,YAAY,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC;AAC5C,gBAAgB,IAAI,EAAE,sBAAsB;AAC5C,gBAAgB,OAAO,EAAE,CAAC,0EAA0E,CAAC;AACrG,aAAa,CAAC,CAAC;AACf,SAAS;AACT,KAAK;AACL,IAAI,SAAS,GAAG;AAChB,QAAQ,OAAO,IAAI,CAAC,uBAAuB,KAAK,SAAS;AACzD,cAAc,IAAI;AAClB,cAAc,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;AACzD,KAAK;AACL,IAAI,eAAe,CAAC,MAAM,EAAE;AAC5B,QAAQ,QAAQ,CAAC,CAAC,MAAM;AACxB,YAAY,CAAC,CAAC,IAAI,CAAC,yBAAyB,EAAE,iBAAiB;AAC/D,YAAY,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE;AACtC,gBAAgB,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,EAAE;AAClE,KAAK;AACL,CAAC;AACD,OAAO,CAAC,0CAA0C,GAAG,0CAA0C;;"}

package/dist/cjs/providers/cognito/utils/oauth/completeOAuthFlow.js

@@ -145,6 +145,8 @@ const completeFlow = async ({ redirectUri, state, preferPrivateSession, }) => {
     // e.g. `getCurrentUser()` below, so it allows every inflight async calls to
     //  `fetchAuthSession` can be resolved
     (0, inflightPromise_1.resolveAndClearInflightPromises)();
+    // clear history before sending out final Hub events
+    clearHistory(redirectUri);
     if (isCustomState(state)) {
         core_1.Hub.dispatch('auth', {
             event: 'customOAuthState',
@@ -153,7 +155,6 @@ const completeFlow = async ({ redirectUri, state, preferPrivateSession, }) => {
     }
     core_1.Hub.dispatch('auth', { event: 'signInWithRedirect' }, 'Auth', utils_1.AMPLIFY_SYMBOL);
     await (0, dispatchSignedInHubEvent_1.dispatchSignedInHubEvent)();
-    clearHistory(redirectUri);
 };
 const isCustomState = (state) => {
     return /-/.test(state);

package/dist/cjs/providers/cognito/utils/oauth/completeOAuthFlow.js.map

@@ -1 +1 @@
-{"version":3,"file":"completeOAuthFlow.js","sources":["../../../../../../src/providers/cognito/utils/oauth/completeOAuthFlow.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.completeOAuthFlow = void 0;\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nconst core_1 = require(\"@aws-amplify/core\");\nconst cacheTokens_1 = require(\"../../tokenProvider/cacheTokens\");\nconst dispatchSignedInHubEvent_1 = require(\"../dispatchSignedInHubEvent\");\nconst tokenProvider_1 = require(\"../../tokenProvider\");\nconst createOAuthError_1 = require(\"./createOAuthError\");\nconst inflightPromise_1 = require(\"./inflightPromise\");\nconst validateState_1 = require(\"./validateState\");\nconst oAuthStore_1 = require(\"./oAuthStore\");\nconst completeOAuthFlow = async ({ currentUrl, userAgentValue, clientId, redirectUri, responseType, domain, preferPrivateSession, }) => {\n    const urlParams = new utils_1.AmplifyUrl(currentUrl);\n    const error = urlParams.searchParams.get('error');\n    const errorMessage = urlParams.searchParams.get('error_description');\n    if (error) {\n        throw (0, createOAuthError_1.createOAuthError)(errorMessage ?? error);\n    }\n    if (responseType === 'code') {\n        return handleCodeFlow({\n            currentUrl,\n            userAgentValue,\n            clientId,\n            redirectUri,\n            domain,\n            preferPrivateSession,\n        });\n    }\n    return handleImplicitFlow({\n        currentUrl,\n        redirectUri,\n        preferPrivateSession,\n    });\n};\nexports.completeOAuthFlow = completeOAuthFlow;\nconst handleCodeFlow = async ({ currentUrl, userAgentValue, clientId, redirectUri, domain, preferPrivateSession, }) => {\n    /* Convert URL into an object with parameters as keys\n{ redirect_uri: 'http://localhost:3000/', response_type: 'code', ...} */\n    const url = new utils_1.AmplifyUrl(currentUrl);\n    const code = url.searchParams.get('code');\n    const state = url.searchParams.get('state');\n    // if `code` or `state` is not presented in the redirect url, most likely\n    // that the end user cancelled the inflight oauth flow by:\n    // 1. clicking the back button of browser\n    // 2. closing the provider hosted UI page and coming back to the app\n    if (!code || !state) {\n        throw (0, createOAuthError_1.createOAuthError)('User cancelled OAuth flow.');\n    }\n    // may throw error is being caught in attemptCompleteOAuthFlow.ts\n    const validatedState = await (0, validateState_1.validateState)(state);\n    const oAuthTokenEndpoint = 'https://' + domain + '/oauth2/token';\n    // TODO(v6): check hub events\n    // dispatchAuthEvent(\n    // \t'codeFlow',\n    // \t{},\n    // \t`Retrieving tokens from ${oAuthTokenEndpoint}`\n    // );\n    const codeVerifier = await oAuthStore_1.oAuthStore.loadPKCE();\n    const oAuthTokenBody = {\n        grant_type: 'authorization_code',\n        code,\n        client_id: clientId,\n        redirect_uri: redirectUri,\n        ...(codeVerifier ? { code_verifier: codeVerifier } : {}),\n    };\n    const body = Object.entries(oAuthTokenBody)\n        .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`)\n        .join('&');\n    const { access_token, refresh_token: refreshToken, id_token, error, error_message: errorMessage, token_type, expires_in, } = await (await fetch(oAuthTokenEndpoint, {\n        method: 'POST',\n        headers: {\n            'Content-Type': 'application/x-www-form-urlencoded',\n            [utils_1.USER_AGENT_HEADER]: userAgentValue,\n        },\n        body,\n    })).json();\n    if (error) {\n        // error is being caught in attemptCompleteOAuthFlow.ts\n        throw (0, createOAuthError_1.createOAuthError)(errorMessage ?? error);\n    }\n    const username = (access_token && (0, core_1.decodeJWT)(access_token).payload.username) ?? 'username';\n    await (0, cacheTokens_1.cacheCognitoTokens)({\n        username,\n        AccessToken: access_token,\n        IdToken: id_token,\n        RefreshToken: refreshToken,\n        TokenType: token_type,\n        ExpiresIn: expires_in,\n    });\n    return completeFlow({\n        redirectUri,\n        state: validatedState,\n        preferPrivateSession,\n    });\n};\nconst handleImplicitFlow = async ({ currentUrl, redirectUri, preferPrivateSession, }) => {\n    // hash is `null` if `#` doesn't exist on URL\n    const url = new utils_1.AmplifyUrl(currentUrl);\n    const { id_token, access_token, state, token_type, expires_in, error_description, error, } = (url.hash ?? '#')\n        .substring(1) // Remove # from returned code\n        .split('&')\n        .map(pairings => pairings.split('='))\n        .reduce((accum, [k, v]) => ({ ...accum, [k]: v }), {\n        id_token: undefined,\n        access_token: undefined,\n        state: undefined,\n        token_type: undefined,\n        expires_in: undefined,\n        error_description: undefined,\n        error: undefined,\n    });\n    if (error) {\n        throw (0, createOAuthError_1.createOAuthError)(error_description ?? error);\n    }\n    if (!access_token) {\n        // error is being caught in attemptCompleteOAuthFlow.ts\n        throw (0, createOAuthError_1.createOAuthError)('No access token returned from OAuth flow.');\n    }\n    const validatedState = await (0, validateState_1.validateState)(state);\n    const username = (access_token && (0, core_1.decodeJWT)(access_token).payload.username) ?? 'username';\n    await (0, cacheTokens_1.cacheCognitoTokens)({\n        username,\n        AccessToken: access_token,\n        IdToken: id_token,\n        TokenType: token_type,\n        ExpiresIn: expires_in,\n    });\n    return completeFlow({\n        redirectUri,\n        state: validatedState,\n        preferPrivateSession,\n    });\n};\nconst completeFlow = async ({ redirectUri, state, preferPrivateSession, }) => {\n    await tokenProvider_1.tokenOrchestrator.setOAuthMetadata({\n        oauthSignIn: true,\n    });\n    await oAuthStore_1.oAuthStore.clearOAuthData();\n    await oAuthStore_1.oAuthStore.storeOAuthSignIn(true, preferPrivateSession);\n    // this should be called before any call that involves `fetchAuthSession`\n    // e.g. `getCurrentUser()` below, so it allows every inflight async calls to\n    //  `fetchAuthSession` can be resolved\n    (0, inflightPromise_1.resolveAndClearInflightPromises)();\n    if (isCustomState(state)) {\n        core_1.Hub.dispatch('auth', {\n            event: 'customOAuthState',\n            data: (0, utils_1.urlSafeDecode)(getCustomState(state)),\n        }, 'Auth', utils_1.AMPLIFY_SYMBOL);\n    }\n    core_1.Hub.dispatch('auth', { event: 'signInWithRedirect' }, 'Auth', utils_1.AMPLIFY_SYMBOL);\n    await (0, dispatchSignedInHubEvent_1.dispatchSignedInHubEvent)();\n    clearHistory(redirectUri);\n};\nconst isCustomState = (state) => {\n    return /-/.test(state);\n};\nconst getCustomState = (state) => {\n    return state.split('-').splice(1).join('-');\n};\nconst clearHistory = (redirectUri) => {\n    if (typeof window !== 'undefined' && typeof window.history !== 'undefined') {\n        window.history.replaceState(window.history.state, '', redirectUri);\n    }\n};\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,OAAO,CAAC,iBAAiB,GAAG,KAAK,CAAC,CAAC;AACnC,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC,CAAC;AAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAC5C,MAAM,aAAa,GAAG,OAAO,CAAC,iCAAiC,CAAC,CAAC;AACjE,MAAM,0BAA0B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;AAC1E,MAAM,eAAe,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;AACvD,MAAM,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;AACzD,MAAM,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AACvD,MAAM,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AACnD,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;AAC7C,MAAM,iBAAiB,GAAG,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,oBAAoB,GAAG,KAAK;AACxI,IAAI,MAAM,SAAS,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACzD,IAAI,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACtD,IAAI,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AACzE,IAAI,IAAI,KAAK,EAAE;AACf,QAAQ,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,YAAY,IAAI,KAAK,CAAC,CAAC;AAC9E,KAAK;AACL,IAAI,IAAI,YAAY,KAAK,MAAM,EAAE;AACjC,QAAQ,OAAO,cAAc,CAAC;AAC9B,YAAY,UAAU;AACtB,YAAY,cAAc;AAC1B,YAAY,QAAQ;AACpB,YAAY,WAAW;AACvB,YAAY,MAAM;AAClB,YAAY,oBAAoB;AAChC,SAAS,CAAC,CAAC;AACX,KAAK;AACL,IAAI,OAAO,kBAAkB,CAAC;AAC9B,QAAQ,UAAU;AAClB,QAAQ,WAAW;AACnB,QAAQ,oBAAoB;AAC5B,KAAK,CAAC,CAAC;AACP,CAAC,CAAC;AACF,OAAO,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;AAC9C,MAAM,cAAc,GAAG,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,oBAAoB,GAAG,KAAK;AACvH;AACA;AACA,IAAI,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACnD,IAAI,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC9C,IAAI,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAChD;AACA;AACA;AACA;AACA,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE;AACzB,QAAQ,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,4BAA4B,CAAC,CAAC;AACrF,KAAK;AACL;AACA,IAAI,MAAM,cAAc,GAAG,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;AAC3E,IAAI,MAAM,kBAAkB,GAAG,UAAU,GAAG,MAAM,GAAG,eAAe,CAAC;AACrE;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;AAClE,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,UAAU,EAAE,oBAAoB;AACxC,QAAQ,IAAI;AACZ,QAAQ,SAAS,EAAE,QAAQ;AAC3B,QAAQ,YAAY,EAAE,WAAW;AACjC,QAAQ,IAAI,YAAY,GAAG,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;AAChE,KAAK,CAAC;AACN,IAAI,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC;AAC/C,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7E,SAAS,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,IAAI,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,kBAAkB,EAAE;AACxK,QAAQ,MAAM,EAAE,MAAM;AACtB,QAAQ,OAAO,EAAE;AACjB,YAAY,cAAc,EAAE,mCAAmC;AAC/D,YAAY,CAAC,OAAO,CAAC,iBAAiB,GAAG,cAAc;AACvD,SAAS;AACT,QAAQ,IAAI;AACZ,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;AACf,IAAI,IAAI,KAAK,EAAE;AACf;AACA,QAAQ,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,YAAY,IAAI,KAAK,CAAC,CAAC;AAC9E,KAAK;AACL,IAAI,MAAM,QAAQ,GAAG,CAAC,YAAY,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC;AAC1G,IAAI,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE;AAChD,QAAQ,QAAQ;AAChB,QAAQ,WAAW,EAAE,YAAY;AACjC,QAAQ,OAAO,EAAE,QAAQ;AACzB,QAAQ,YAAY,EAAE,YAAY;AAClC,QAAQ,SAAS,EAAE,UAAU;AAC7B,QAAQ,SAAS,EAAE,UAAU;AAC7B,KAAK,CAAC,CAAC;AACP,IAAI,OAAO,YAAY,CAAC;AACxB,QAAQ,WAAW;AACnB,QAAQ,KAAK,EAAE,cAAc;AAC7B,QAAQ,oBAAoB;AAC5B,KAAK,CAAC,CAAC;AACP,CAAC,CAAC;AACF,MAAM,kBAAkB,GAAG,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,oBAAoB,GAAG,KAAK;AACzF;AACA,IAAI,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACnD,IAAI,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG;AACjH,SAAS,SAAS,CAAC,CAAC,CAAC;AACrB,SAAS,KAAK,CAAC,GAAG,CAAC;AACnB,SAAS,GAAG,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC7C,SAAS,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;AAC3D,QAAQ,QAAQ,EAAE,SAAS;AAC3B,QAAQ,YAAY,EAAE,SAAS;AAC/B,QAAQ,KAAK,EAAE,SAAS;AACxB,QAAQ,UAAU,EAAE,SAAS;AAC7B,QAAQ,UAAU,EAAE,SAAS;AAC7B,QAAQ,iBAAiB,EAAE,SAAS;AACpC,QAAQ,KAAK,EAAE,SAAS;AACxB,KAAK,CAAC,CAAC;AACP,IAAI,IAAI,KAAK,EAAE;AACf,QAAQ,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,iBAAiB,IAAI,KAAK,CAAC,CAAC;AACnF,KAAK;AACL,IAAI,IAAI,CAAC,YAAY,EAAE;AACvB;AACA,QAAQ,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,2CAA2C,CAAC,CAAC;AACpG,KAAK;AACL,IAAI,MAAM,cAAc,GAAG,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;AAC3E,IAAI,MAAM,QAAQ,GAAG,CAAC,YAAY,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC;AAC1G,IAAI,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE;AAChD,QAAQ,QAAQ;AAChB,QAAQ,WAAW,EAAE,YAAY;AACjC,QAAQ,OAAO,EAAE,QAAQ;AACzB,QAAQ,SAAS,EAAE,UAAU;AAC7B,QAAQ,SAAS,EAAE,UAAU;AAC7B,KAAK,CAAC,CAAC;AACP,IAAI,OAAO,YAAY,CAAC;AACxB,QAAQ,WAAW;AACnB,QAAQ,KAAK,EAAE,cAAc;AAC7B,QAAQ,oBAAoB;AAC5B,KAAK,CAAC,CAAC;AACP,CAAC,CAAC;AACF,MAAM,YAAY,GAAG,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,oBAAoB,GAAG,KAAK;AAC9E,IAAI,MAAM,eAAe,CAAC,iBAAiB,CAAC,gBAAgB,CAAC;AAC7D,QAAQ,WAAW,EAAE,IAAI;AACzB,KAAK,CAAC,CAAC;AACP,IAAI,MAAM,YAAY,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;AACnD,IAAI,MAAM,YAAY,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;AAC/E;AACA;AACA;AACA,IAAI,IAAI,iBAAiB,CAAC,+BAA+B,GAAG,CAAC;AAC7D,IAAI,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE;AAC9B,QAAQ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE;AACpC,YAAY,KAAK,EAAE,kBAAkB;AACrC,YAAY,IAAI,EAAE,IAAI,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;AACnE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;AAC3C,KAAK;AACL,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;AACjG,IAAI,MAAM,IAAI,0BAA0B,CAAC,wBAAwB,GAAG,CAAC;AACrE,IAAI,YAAY,CAAC,WAAW,CAAC,CAAC;AAC9B,CAAC,CAAC;AACF,MAAM,aAAa,GAAG,CAAC,KAAK,KAAK;AACjC,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC,CAAC;AACF,MAAM,cAAc,GAAG,CAAC,KAAK,KAAK;AAClC,IAAI,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChD,CAAC,CAAC;AACF,MAAM,YAAY,GAAG,CAAC,WAAW,KAAK;AACtC,IAAI,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,WAAW,EAAE;AAChF,QAAQ,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;AAC3E,KAAK;AACL,CAAC;;"}
+{"version":3,"file":"completeOAuthFlow.js","sources":["../../../../../../src/providers/cognito/utils/oauth/completeOAuthFlow.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.completeOAuthFlow = void 0;\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nconst core_1 = require(\"@aws-amplify/core\");\nconst cacheTokens_1 = require(\"../../tokenProvider/cacheTokens\");\nconst dispatchSignedInHubEvent_1 = require(\"../dispatchSignedInHubEvent\");\nconst tokenProvider_1 = require(\"../../tokenProvider\");\nconst createOAuthError_1 = require(\"./createOAuthError\");\nconst inflightPromise_1 = require(\"./inflightPromise\");\nconst validateState_1 = require(\"./validateState\");\nconst oAuthStore_1 = require(\"./oAuthStore\");\nconst completeOAuthFlow = async ({ currentUrl, userAgentValue, clientId, redirectUri, responseType, domain, preferPrivateSession, }) => {\n    const urlParams = new utils_1.AmplifyUrl(currentUrl);\n    const error = urlParams.searchParams.get('error');\n    const errorMessage = urlParams.searchParams.get('error_description');\n    if (error) {\n        throw (0, createOAuthError_1.createOAuthError)(errorMessage ?? error);\n    }\n    if (responseType === 'code') {\n        return handleCodeFlow({\n            currentUrl,\n            userAgentValue,\n            clientId,\n            redirectUri,\n            domain,\n            preferPrivateSession,\n        });\n    }\n    return handleImplicitFlow({\n        currentUrl,\n        redirectUri,\n        preferPrivateSession,\n    });\n};\nexports.completeOAuthFlow = completeOAuthFlow;\nconst handleCodeFlow = async ({ currentUrl, userAgentValue, clientId, redirectUri, domain, preferPrivateSession, }) => {\n    /* Convert URL into an object with parameters as keys\n{ redirect_uri: 'http://localhost:3000/', response_type: 'code', ...} */\n    const url = new utils_1.AmplifyUrl(currentUrl);\n    const code = url.searchParams.get('code');\n    const state = url.searchParams.get('state');\n    // if `code` or `state` is not presented in the redirect url, most likely\n    // that the end user cancelled the inflight oauth flow by:\n    // 1. clicking the back button of browser\n    // 2. closing the provider hosted UI page and coming back to the app\n    if (!code || !state) {\n        throw (0, createOAuthError_1.createOAuthError)('User cancelled OAuth flow.');\n    }\n    // may throw error is being caught in attemptCompleteOAuthFlow.ts\n    const validatedState = await (0, validateState_1.validateState)(state);\n    const oAuthTokenEndpoint = 'https://' + domain + '/oauth2/token';\n    // TODO(v6): check hub events\n    // dispatchAuthEvent(\n    // \t'codeFlow',\n    // \t{},\n    // \t`Retrieving tokens from ${oAuthTokenEndpoint}`\n    // );\n    const codeVerifier = await oAuthStore_1.oAuthStore.loadPKCE();\n    const oAuthTokenBody = {\n        grant_type: 'authorization_code',\n        code,\n        client_id: clientId,\n        redirect_uri: redirectUri,\n        ...(codeVerifier ? { code_verifier: codeVerifier } : {}),\n    };\n    const body = Object.entries(oAuthTokenBody)\n        .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`)\n        .join('&');\n    const { access_token, refresh_token: refreshToken, id_token, error, error_message: errorMessage, token_type, expires_in, } = await (await fetch(oAuthTokenEndpoint, {\n        method: 'POST',\n        headers: {\n            'Content-Type': 'application/x-www-form-urlencoded',\n            [utils_1.USER_AGENT_HEADER]: userAgentValue,\n        },\n        body,\n    })).json();\n    if (error) {\n        // error is being caught in attemptCompleteOAuthFlow.ts\n        throw (0, createOAuthError_1.createOAuthError)(errorMessage ?? error);\n    }\n    const username = (access_token && (0, core_1.decodeJWT)(access_token).payload.username) ?? 'username';\n    await (0, cacheTokens_1.cacheCognitoTokens)({\n        username,\n        AccessToken: access_token,\n        IdToken: id_token,\n        RefreshToken: refreshToken,\n        TokenType: token_type,\n        ExpiresIn: expires_in,\n    });\n    return completeFlow({\n        redirectUri,\n        state: validatedState,\n        preferPrivateSession,\n    });\n};\nconst handleImplicitFlow = async ({ currentUrl, redirectUri, preferPrivateSession, }) => {\n    // hash is `null` if `#` doesn't exist on URL\n    const url = new utils_1.AmplifyUrl(currentUrl);\n    const { id_token, access_token, state, token_type, expires_in, error_description, error, } = (url.hash ?? '#')\n        .substring(1) // Remove # from returned code\n        .split('&')\n        .map(pairings => pairings.split('='))\n        .reduce((accum, [k, v]) => ({ ...accum, [k]: v }), {\n        id_token: undefined,\n        access_token: undefined,\n        state: undefined,\n        token_type: undefined,\n        expires_in: undefined,\n        error_description: undefined,\n        error: undefined,\n    });\n    if (error) {\n        throw (0, createOAuthError_1.createOAuthError)(error_description ?? error);\n    }\n    if (!access_token) {\n        // error is being caught in attemptCompleteOAuthFlow.ts\n        throw (0, createOAuthError_1.createOAuthError)('No access token returned from OAuth flow.');\n    }\n    const validatedState = await (0, validateState_1.validateState)(state);\n    const username = (access_token && (0, core_1.decodeJWT)(access_token).payload.username) ?? 'username';\n    await (0, cacheTokens_1.cacheCognitoTokens)({\n        username,\n        AccessToken: access_token,\n        IdToken: id_token,\n        TokenType: token_type,\n        ExpiresIn: expires_in,\n    });\n    return completeFlow({\n        redirectUri,\n        state: validatedState,\n        preferPrivateSession,\n    });\n};\nconst completeFlow = async ({ redirectUri, state, preferPrivateSession, }) => {\n    await tokenProvider_1.tokenOrchestrator.setOAuthMetadata({\n        oauthSignIn: true,\n    });\n    await oAuthStore_1.oAuthStore.clearOAuthData();\n    await oAuthStore_1.oAuthStore.storeOAuthSignIn(true, preferPrivateSession);\n    // this should be called before any call that involves `fetchAuthSession`\n    // e.g. `getCurrentUser()` below, so it allows every inflight async calls to\n    //  `fetchAuthSession` can be resolved\n    (0, inflightPromise_1.resolveAndClearInflightPromises)();\n    // clear history before sending out final Hub events\n    clearHistory(redirectUri);\n    if (isCustomState(state)) {\n        core_1.Hub.dispatch('auth', {\n            event: 'customOAuthState',\n            data: (0, utils_1.urlSafeDecode)(getCustomState(state)),\n        }, 'Auth', utils_1.AMPLIFY_SYMBOL);\n    }\n    core_1.Hub.dispatch('auth', { event: 'signInWithRedirect' }, 'Auth', utils_1.AMPLIFY_SYMBOL);\n    await (0, dispatchSignedInHubEvent_1.dispatchSignedInHubEvent)();\n};\nconst isCustomState = (state) => {\n    return /-/.test(state);\n};\nconst getCustomState = (state) => {\n    return state.split('-').splice(1).join('-');\n};\nconst clearHistory = (redirectUri) => {\n    if (typeof window !== 'undefined' && typeof window.history !== 'undefined') {\n        window.history.replaceState(window.history.state, '', redirectUri);\n    }\n};\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,OAAO,CAAC,iBAAiB,GAAG,KAAK,CAAC,CAAC;AACnC,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC,CAAC;AAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAC5C,MAAM,aAAa,GAAG,OAAO,CAAC,iCAAiC,CAAC,CAAC;AACjE,MAAM,0BAA0B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;AAC1E,MAAM,eAAe,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;AACvD,MAAM,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;AACzD,MAAM,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AACvD,MAAM,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AACnD,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;AAC7C,MAAM,iBAAiB,GAAG,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,oBAAoB,GAAG,KAAK;AACxI,IAAI,MAAM,SAAS,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACzD,IAAI,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACtD,IAAI,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AACzE,IAAI,IAAI,KAAK,EAAE;AACf,QAAQ,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,YAAY,IAAI,KAAK,CAAC,CAAC;AAC9E,KAAK;AACL,IAAI,IAAI,YAAY,KAAK,MAAM,EAAE;AACjC,QAAQ,OAAO,cAAc,CAAC;AAC9B,YAAY,UAAU;AACtB,YAAY,cAAc;AAC1B,YAAY,QAAQ;AACpB,YAAY,WAAW;AACvB,YAAY,MAAM;AAClB,YAAY,oBAAoB;AAChC,SAAS,CAAC,CAAC;AACX,KAAK;AACL,IAAI,OAAO,kBAAkB,CAAC;AAC9B,QAAQ,UAAU;AAClB,QAAQ,WAAW;AACnB,QAAQ,oBAAoB;AAC5B,KAAK,CAAC,CAAC;AACP,CAAC,CAAC;AACF,OAAO,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;AAC9C,MAAM,cAAc,GAAG,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,oBAAoB,GAAG,KAAK;AACvH;AACA;AACA,IAAI,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACnD,IAAI,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC9C,IAAI,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAChD;AACA;AACA;AACA;AACA,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE;AACzB,QAAQ,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,4BAA4B,CAAC,CAAC;AACrF,KAAK;AACL;AACA,IAAI,MAAM,cAAc,GAAG,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;AAC3E,IAAI,MAAM,kBAAkB,GAAG,UAAU,GAAG,MAAM,GAAG,eAAe,CAAC;AACrE;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;AAClE,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,UAAU,EAAE,oBAAoB;AACxC,QAAQ,IAAI;AACZ,QAAQ,SAAS,EAAE,QAAQ;AAC3B,QAAQ,YAAY,EAAE,WAAW;AACjC,QAAQ,IAAI,YAAY,GAAG,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;AAChE,KAAK,CAAC;AACN,IAAI,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC;AAC/C,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7E,SAAS,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,IAAI,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,kBAAkB,EAAE;AACxK,QAAQ,MAAM,EAAE,MAAM;AACtB,QAAQ,OAAO,EAAE;AACjB,YAAY,cAAc,EAAE,mCAAmC;AAC/D,YAAY,CAAC,OAAO,CAAC,iBAAiB,GAAG,cAAc;AACvD,SAAS;AACT,QAAQ,IAAI;AACZ,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;AACf,IAAI,IAAI,KAAK,EAAE;AACf;AACA,QAAQ,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,YAAY,IAAI,KAAK,CAAC,CAAC;AAC9E,KAAK;AACL,IAAI,MAAM,QAAQ,GAAG,CAAC,YAAY,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC;AAC1G,IAAI,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE;AAChD,QAAQ,QAAQ;AAChB,QAAQ,WAAW,EAAE,YAAY;AACjC,QAAQ,OAAO,EAAE,QAAQ;AACzB,QAAQ,YAAY,EAAE,YAAY;AAClC,QAAQ,SAAS,EAAE,UAAU;AAC7B,QAAQ,SAAS,EAAE,UAAU;AAC7B,KAAK,CAAC,CAAC;AACP,IAAI,OAAO,YAAY,CAAC;AACxB,QAAQ,WAAW;AACnB,QAAQ,KAAK,EAAE,cAAc;AAC7B,QAAQ,oBAAoB;AAC5B,KAAK,CAAC,CAAC;AACP,CAAC,CAAC;AACF,MAAM,kBAAkB,GAAG,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,oBAAoB,GAAG,KAAK;AACzF;AACA,IAAI,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACnD,IAAI,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG;AACjH,SAAS,SAAS,CAAC,CAAC,CAAC;AACrB,SAAS,KAAK,CAAC,GAAG,CAAC;AACnB,SAAS,GAAG,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC7C,SAAS,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;AAC3D,QAAQ,QAAQ,EAAE,SAAS;AAC3B,QAAQ,YAAY,EAAE,SAAS;AAC/B,QAAQ,KAAK,EAAE,SAAS;AACxB,QAAQ,UAAU,EAAE,SAAS;AAC7B,QAAQ,UAAU,EAAE,SAAS;AAC7B,QAAQ,iBAAiB,EAAE,SAAS;AACpC,QAAQ,KAAK,EAAE,SAAS;AACxB,KAAK,CAAC,CAAC;AACP,IAAI,IAAI,KAAK,EAAE;AACf,QAAQ,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,iBAAiB,IAAI,KAAK,CAAC,CAAC;AACnF,KAAK;AACL,IAAI,IAAI,CAAC,YAAY,EAAE;AACvB;AACA,QAAQ,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,2CAA2C,CAAC,CAAC;AACpG,KAAK;AACL,IAAI,MAAM,cAAc,GAAG,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;AAC3E,IAAI,MAAM,QAAQ,GAAG,CAAC,YAAY,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC;AAC1G,IAAI,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE;AAChD,QAAQ,QAAQ;AAChB,QAAQ,WAAW,EAAE,YAAY;AACjC,QAAQ,OAAO,EAAE,QAAQ;AACzB,QAAQ,SAAS,EAAE,UAAU;AAC7B,QAAQ,SAAS,EAAE,UAAU;AAC7B,KAAK,CAAC,CAAC;AACP,IAAI,OAAO,YAAY,CAAC;AACxB,QAAQ,WAAW;AACnB,QAAQ,KAAK,EAAE,cAAc;AAC7B,QAAQ,oBAAoB;AAC5B,KAAK,CAAC,CAAC;AACP,CAAC,CAAC;AACF,MAAM,YAAY,GAAG,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,oBAAoB,GAAG,KAAK;AAC9E,IAAI,MAAM,eAAe,CAAC,iBAAiB,CAAC,gBAAgB,CAAC;AAC7D,QAAQ,WAAW,EAAE,IAAI;AACzB,KAAK,CAAC,CAAC;AACP,IAAI,MAAM,YAAY,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;AACnD,IAAI,MAAM,YAAY,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;AAC/E;AACA;AACA;AACA,IAAI,IAAI,iBAAiB,CAAC,+BAA+B,GAAG,CAAC;AAC7D;AACA,IAAI,YAAY,CAAC,WAAW,CAAC,CAAC;AAC9B,IAAI,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE;AAC9B,QAAQ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE;AACpC,YAAY,KAAK,EAAE,kBAAkB;AACrC,YAAY,IAAI,EAAE,IAAI,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;AACnE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;AAC3C,KAAK;AACL,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;AACjG,IAAI,MAAM,IAAI,0BAA0B,CAAC,wBAAwB,GAAG,CAAC;AACrE,CAAC,CAAC;AACF,MAAM,aAAa,GAAG,CAAC,KAAK,KAAK;AACjC,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC,CAAC;AACF,MAAM,cAAc,GAAG,CAAC,KAAK,KAAK;AAClC,IAAI,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChD,CAAC,CAAC;AACF,MAAM,YAAY,GAAG,CAAC,WAAW,KAAK;AACtC,IAAI,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,WAAW,EAAE;AAChF,QAAQ,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;AAC3E,KAAK;AACL,CAAC;;"}

package/dist/esm/providers/cognito/credentialsProvider/IdentityIdProvider.mjs

@@ -1,11 +1,10 @@
-import { ConsoleLogger, getId } from '@aws-amplify/core';
+import { getId } from '@aws-amplify/core';
 import { AuthError } from '../../../errors/AuthError.mjs';
 import { getRegionFromIdentityPoolId } from '../../../foundation/parsers/regionParsers.mjs';
 import { formLoginsMap } from './utils.mjs';
 
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
-const logger = new ConsoleLogger('CognitoIdentityIdProvider');
 /**
  * Provides a Cognito identityId
  *
@@ -18,42 +17,20 @@ const logger = new ConsoleLogger('CognitoIdentityIdProvider');
 async function cognitoIdentityIdProvider({ tokens, authConfig, identityIdStore, }) {
     identityIdStore.setAuthConfig({ Cognito: authConfig });
     // will return null only if there is no identityId cached or if there is an error retrieving it
-    let identityId = await identityIdStore.loadIdentityId();
-    // Tokens are available so return primary identityId
-    if (tokens) {
-        // If there is existing primary identityId in-memory return that
-        if (identityId && identityId.type === 'primary') {
-            return identityId.id;
-        }
-        else {
-            const logins = tokens.idToken
-                ? formLoginsMap(tokens.idToken.toString())
-                : {};
-            const generatedIdentityId = await generateIdentityId(logins, authConfig);
-            if (identityId && identityId.id === generatedIdentityId) {
-                logger.debug(`The guest identity ${identityId.id} has become the primary identity.`);
-            }
-            identityId = {
-                id: generatedIdentityId,
-                type: 'primary',
-            };
-        }
+    const identityId = await identityIdStore.loadIdentityId();
+    if (identityId) {
+        return identityId.id;
     }
-    else {
-        // If there is existing guest identityId cached return that
-        if (identityId && identityId.type === 'guest') {
-            return identityId.id;
-        }
-        else {
-            identityId = {
-                id: await generateIdentityId({}, authConfig),
-                type: 'guest',
-            };
-        }
-    }
-    // Store in-memory or local storage depending on guest or primary identityId
-    identityIdStore.storeIdentityId(identityId);
-    return identityId.id;
+    const logins = tokens?.idToken
+        ? formLoginsMap(tokens.idToken.toString())
+        : {};
+    const generatedIdentityId = await generateIdentityId(logins, authConfig);
+    // Store generated identityId
+    identityIdStore.storeIdentityId({
+        id: generatedIdentityId,
+        type: tokens ? 'primary' : 'guest',
+    });
+    return generatedIdentityId;
 }
 async function generateIdentityId(logins, authConfig) {
     const identityPoolId = authConfig?.identityPoolId;

package/dist/esm/providers/cognito/credentialsProvider/IdentityIdProvider.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityIdProvider.mjs","sources":["../../../../../src/providers/cognito/credentialsProvider/IdentityIdProvider.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { ConsoleLogger, getId } from '@aws-amplify/core';\nimport { AuthError } from '../../../errors/AuthError';\nimport { getRegionFromIdentityPoolId } from '../../../foundation/parsers';\nimport { formLoginsMap } from './utils';\nconst logger = new ConsoleLogger('CognitoIdentityIdProvider');\n/**\n * Provides a Cognito identityId\n *\n * @param tokens - The AuthTokens received after SignIn\n * @returns string\n * @throws configuration exceptions: `InvalidIdentityPoolIdException`\n *  - Auth errors that may arise from misconfiguration.\n * @throws service exceptions: {@link GetIdException }\n */\nexport async function cognitoIdentityIdProvider({ tokens, authConfig, identityIdStore, }) {\n    identityIdStore.setAuthConfig({ Cognito: authConfig });\n    // will return null only if there is no identityId cached or if there is an error retrieving it\n    let identityId = await identityIdStore.loadIdentityId();\n    // Tokens are available so return primary identityId\n    if (tokens) {\n        // If there is existing primary identityId in-memory return that\n        if (identityId && identityId.type === 'primary') {\n            return identityId.id;\n        }\n        else {\n            const logins = tokens.idToken\n                ? formLoginsMap(tokens.idToken.toString())\n                : {};\n            const generatedIdentityId = await generateIdentityId(logins, authConfig);\n            if (identityId && identityId.id === generatedIdentityId) {\n                logger.debug(`The guest identity ${identityId.id} has become the primary identity.`);\n            }\n            identityId = {\n                id: generatedIdentityId,\n                type: 'primary',\n            };\n        }\n    }\n    else {\n        // If there is existing guest identityId cached return that\n        if (identityId && identityId.type === 'guest') {\n            return identityId.id;\n        }\n        else {\n            identityId = {\n                id: await generateIdentityId({}, authConfig),\n                type: 'guest',\n            };\n        }\n    }\n    // Store in-memory or local storage depending on guest or primary identityId\n    identityIdStore.storeIdentityId(identityId);\n    return identityId.id;\n}\nasync function generateIdentityId(logins, authConfig) {\n    const identityPoolId = authConfig?.identityPoolId;\n    const region = getRegionFromIdentityPoolId(identityPoolId);\n    // IdentityId is absent so get it using IdentityPoolId with Cognito's GetId API\n    const idResult = \n    // for a first-time user, this will return a brand new identity\n    // for a returning user, this will retrieve the previous identity assocaited with the logins\n    (await getId({\n        region,\n    }, {\n        IdentityPoolId: identityPoolId,\n        Logins: logins,\n    })).IdentityId;\n    if (!idResult) {\n        throw new AuthError({\n            name: 'GetIdResponseException',\n            message: 'Received undefined response from getId operation',\n            recoverySuggestion: 'Make sure to pass a valid identityPoolId in the configuration.',\n        });\n    }\n    return idResult;\n}\n"],"names":[],"mappings":";;;;;AAAA;AACA;AAKA,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,2BAA2B,CAAC,CAAC;AAC9D;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAe,yBAAyB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,GAAG,EAAE;AAC1F,IAAI,eAAe,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;AAC3D;AACA,IAAI,IAAI,UAAU,GAAG,MAAM,eAAe,CAAC,cAAc,EAAE,CAAC;AAC5D;AACA,IAAI,IAAI,MAAM,EAAE;AAChB;AACA,QAAQ,IAAI,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE;AACzD,YAAY,OAAO,UAAU,CAAC,EAAE,CAAC;AACjC,SAAS;AACT,aAAa;AACb,YAAY,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO;AACzC,kBAAkB,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;AAC1D,kBAAkB,EAAE,CAAC;AACrB,YAAY,MAAM,mBAAmB,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AACrF,YAAY,IAAI,UAAU,IAAI,UAAU,CAAC,EAAE,KAAK,mBAAmB,EAAE;AACrE,gBAAgB,MAAM,CAAC,KAAK,CAAC,CAAC,mBAAmB,EAAE,UAAU,CAAC,EAAE,CAAC,iCAAiC,CAAC,CAAC,CAAC;AACrG,aAAa;AACb,YAAY,UAAU,GAAG;AACzB,gBAAgB,EAAE,EAAE,mBAAmB;AACvC,gBAAgB,IAAI,EAAE,SAAS;AAC/B,aAAa,CAAC;AACd,SAAS;AACT,KAAK;AACL,SAAS;AACT;AACA,QAAQ,IAAI,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE;AACvD,YAAY,OAAO,UAAU,CAAC,EAAE,CAAC;AACjC,SAAS;AACT,aAAa;AACb,YAAY,UAAU,GAAG;AACzB,gBAAgB,EAAE,EAAE,MAAM,kBAAkB,CAAC,EAAE,EAAE,UAAU,CAAC;AAC5D,gBAAgB,IAAI,EAAE,OAAO;AAC7B,aAAa,CAAC;AACd,SAAS;AACT,KAAK;AACL;AACA,IAAI,eAAe,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;AAChD,IAAI,OAAO,UAAU,CAAC,EAAE,CAAC;AACzB,CAAC;AACD,eAAe,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE;AACtD,IAAI,MAAM,cAAc,GAAG,UAAU,EAAE,cAAc,CAAC;AACtD,IAAI,MAAM,MAAM,GAAG,2BAA2B,CAAC,cAAc,CAAC,CAAC;AAC/D;AACA,IAAI,MAAM,QAAQ;AAClB;AACA;AACA,IAAI,CAAC,MAAM,KAAK,CAAC;AACjB,QAAQ,MAAM;AACd,KAAK,EAAE;AACP,QAAQ,cAAc,EAAE,cAAc;AACtC,QAAQ,MAAM,EAAE,MAAM;AACtB,KAAK,CAAC,EAAE,UAAU,CAAC;AACnB,IAAI,IAAI,CAAC,QAAQ,EAAE;AACnB,QAAQ,MAAM,IAAI,SAAS,CAAC;AAC5B,YAAY,IAAI,EAAE,wBAAwB;AAC1C,YAAY,OAAO,EAAE,kDAAkD;AACvE,YAAY,kBAAkB,EAAE,gEAAgE;AAChG,SAAS,CAAC,CAAC;AACX,KAAK;AACL,IAAI,OAAO,QAAQ,CAAC;AACpB;;;;"}
+{"version":3,"file":"IdentityIdProvider.mjs","sources":["../../../../../src/providers/cognito/credentialsProvider/IdentityIdProvider.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { getId } from '@aws-amplify/core';\nimport { AuthError } from '../../../errors/AuthError';\nimport { getRegionFromIdentityPoolId } from '../../../foundation/parsers';\nimport { formLoginsMap } from './utils';\n/**\n * Provides a Cognito identityId\n *\n * @param tokens - The AuthTokens received after SignIn\n * @returns string\n * @throws configuration exceptions: `InvalidIdentityPoolIdException`\n *  - Auth errors that may arise from misconfiguration.\n * @throws service exceptions: {@link GetIdException }\n */\nexport async function cognitoIdentityIdProvider({ tokens, authConfig, identityIdStore, }) {\n    identityIdStore.setAuthConfig({ Cognito: authConfig });\n    // will return null only if there is no identityId cached or if there is an error retrieving it\n    const identityId = await identityIdStore.loadIdentityId();\n    if (identityId) {\n        return identityId.id;\n    }\n    const logins = tokens?.idToken\n        ? formLoginsMap(tokens.idToken.toString())\n        : {};\n    const generatedIdentityId = await generateIdentityId(logins, authConfig);\n    // Store generated identityId\n    identityIdStore.storeIdentityId({\n        id: generatedIdentityId,\n        type: tokens ? 'primary' : 'guest',\n    });\n    return generatedIdentityId;\n}\nasync function generateIdentityId(logins, authConfig) {\n    const identityPoolId = authConfig?.identityPoolId;\n    const region = getRegionFromIdentityPoolId(identityPoolId);\n    // IdentityId is absent so get it using IdentityPoolId with Cognito's GetId API\n    const idResult = \n    // for a first-time user, this will return a brand new identity\n    // for a returning user, this will retrieve the previous identity assocaited with the logins\n    (await getId({\n        region,\n    }, {\n        IdentityPoolId: identityPoolId,\n        Logins: logins,\n    })).IdentityId;\n    if (!idResult) {\n        throw new AuthError({\n            name: 'GetIdResponseException',\n            message: 'Received undefined response from getId operation',\n            recoverySuggestion: 'Make sure to pass a valid identityPoolId in the configuration.',\n        });\n    }\n    return idResult;\n}\n"],"names":[],"mappings":";;;;;AAAA;AACA;AAKA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAe,yBAAyB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,GAAG,EAAE;AAC1F,IAAI,eAAe,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;AAC3D;AACA,IAAI,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,cAAc,EAAE,CAAC;AAC9D,IAAI,IAAI,UAAU,EAAE;AACpB,QAAQ,OAAO,UAAU,CAAC,EAAE,CAAC;AAC7B,KAAK;AACL,IAAI,MAAM,MAAM,GAAG,MAAM,EAAE,OAAO;AAClC,UAAU,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;AAClD,UAAU,EAAE,CAAC;AACb,IAAI,MAAM,mBAAmB,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAC7E;AACA,IAAI,eAAe,CAAC,eAAe,CAAC;AACpC,QAAQ,EAAE,EAAE,mBAAmB;AAC/B,QAAQ,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;AAC1C,KAAK,CAAC,CAAC;AACP,IAAI,OAAO,mBAAmB,CAAC;AAC/B,CAAC;AACD,eAAe,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE;AACtD,IAAI,MAAM,cAAc,GAAG,UAAU,EAAE,cAAc,CAAC;AACtD,IAAI,MAAM,MAAM,GAAG,2BAA2B,CAAC,cAAc,CAAC,CAAC;AAC/D;AACA,IAAI,MAAM,QAAQ;AAClB;AACA;AACA,IAAI,CAAC,MAAM,KAAK,CAAC;AACjB,QAAQ,MAAM;AACd,KAAK,EAAE;AACP,QAAQ,cAAc,EAAE,cAAc;AACtC,QAAQ,MAAM,EAAE,MAAM;AACtB,KAAK,CAAC,EAAE,UAAU,CAAC;AACnB,IAAI,IAAI,CAAC,QAAQ,EAAE;AACnB,QAAQ,MAAM,IAAI,SAAS,CAAC;AAC5B,YAAY,IAAI,EAAE,wBAAwB;AAC1C,YAAY,OAAO,EAAE,kDAAkD;AACvE,YAAY,kBAAkB,EAAE,gEAAgE;AAChG,SAAS,CAAC,CAAC;AACX,KAAK;AACL,IAAI,OAAO,QAAQ,CAAC;AACpB;;;;"}

package/dist/esm/providers/cognito/credentialsProvider/credentialsProvider.mjs

@@ -89,11 +89,10 @@ class CognitoAWSCredentialsAndIdentityIdProvider {
                 },
                 identityId,
             };
-            const identityIdRes = clientResult.IdentityId;
-            if (identityIdRes) {
-                res.identityId = identityIdRes;
+            if (clientResult.IdentityId) {
+                res.identityId = clientResult.IdentityId;
                 this._identityIdStore.storeIdentityId({
-                    id: identityIdRes,
+                    id: clientResult.IdentityId,
                     type: 'guest',
                 });
             }
@@ -130,6 +129,7 @@ class CognitoAWSCredentialsAndIdentityIdProvider {
         if (clientResult.Credentials &&
             clientResult.Credentials.AccessKeyId &&
             clientResult.Credentials.SecretKey) {
+            this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;
             const res = {
                 credentials: {
                     accessKeyId: clientResult.Credentials.AccessKeyId,
@@ -139,21 +139,20 @@ class CognitoAWSCredentialsAndIdentityIdProvider {
                 },
                 identityId,
             };
+            if (clientResult.IdentityId) {
+                res.identityId = clientResult.IdentityId;
+                // note: the following call removes guest identityId from the persistent store (localStorage)
+                this._identityIdStore.storeIdentityId({
+                    id: clientResult.IdentityId,
+                    type: 'primary',
+                });
+            }
             // Store the credentials in-memory along with the expiration
             this._credentialsAndIdentityId = {
                 ...res,
                 isAuthenticatedCreds: true,
                 associatedIdToken: authTokens.idToken?.toString(),
             };
-            this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;
-            const identityIdRes = clientResult.IdentityId;
-            if (identityIdRes) {
-                res.identityId = identityIdRes;
-                this._identityIdStore.storeIdentityId({
-                    id: identityIdRes,
-                    type: 'primary',
-                });
-            }
             return res;
         }
         else {

package/dist/esm/providers/cognito/credentialsProvider/credentialsProvider.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"credentialsProvider.mjs","sources":["../../../../../src/providers/cognito/credentialsProvider/credentialsProvider.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { ConsoleLogger, getCredentialsForIdentity, } from '@aws-amplify/core';\nimport { assertIdentityPoolIdConfig, } from '@aws-amplify/core/internals/utils';\nimport { AuthError } from '../../../errors/AuthError';\nimport { getRegionFromIdentityPoolId } from '../../../foundation/parsers';\nimport { assertIdTokenInAuthTokens } from '../utils/types';\nimport { cognitoIdentityIdProvider } from './IdentityIdProvider';\nimport { formLoginsMap } from './utils';\nconst logger = new ConsoleLogger('CognitoCredentialsProvider');\nconst CREDENTIALS_TTL = 50 * 60 * 1000; // 50 min, can be modified on config if required in the future\nexport class CognitoAWSCredentialsAndIdentityIdProvider {\n    constructor(identityIdStore) {\n        this._nextCredentialsRefresh = 0;\n        this._identityIdStore = identityIdStore;\n    }\n    async clearCredentialsAndIdentityId() {\n        logger.debug('Clearing out credentials and identityId');\n        this._credentialsAndIdentityId = undefined;\n        await this._identityIdStore.clearIdentityId();\n    }\n    async clearCredentials() {\n        logger.debug('Clearing out in-memory credentials');\n        this._credentialsAndIdentityId = undefined;\n    }\n    async getCredentialsAndIdentityId(getCredentialsOptions) {\n        const isAuthenticated = getCredentialsOptions.authenticated;\n        const { tokens } = getCredentialsOptions;\n        const { authConfig } = getCredentialsOptions;\n        try {\n            assertIdentityPoolIdConfig(authConfig?.Cognito);\n        }\n        catch {\n            // No identity pool configured, skipping\n            return;\n        }\n        if (!isAuthenticated && !authConfig.Cognito.allowGuestAccess) {\n            // TODO(V6): return partial result like Native platforms\n            return;\n        }\n        const { forceRefresh } = getCredentialsOptions;\n        const tokenHasChanged = this.hasTokenChanged(tokens);\n        const identityId = await cognitoIdentityIdProvider({\n            tokens,\n            authConfig: authConfig.Cognito,\n            identityIdStore: this._identityIdStore,\n        });\n        // Clear cached credentials when forceRefresh is true OR the cache token has changed\n        if (forceRefresh || tokenHasChanged) {\n            this.clearCredentials();\n        }\n        if (!isAuthenticated) {\n            return this.getGuestCredentials(identityId, authConfig.Cognito);\n        }\n        else {\n            assertIdTokenInAuthTokens(tokens);\n            return this.credsForOIDCTokens(authConfig.Cognito, tokens, identityId);\n        }\n    }\n    async getGuestCredentials(identityId, authConfig) {\n        // Return existing in-memory cached credentials only if it exists, is not past it's lifetime and is unauthenticated credentials\n        if (this._credentialsAndIdentityId &&\n            !this.isPastTTL() &&\n            this._credentialsAndIdentityId.isAuthenticatedCreds === false) {\n            logger.info('returning stored credentials as they neither past TTL nor expired.');\n            return this._credentialsAndIdentityId;\n        }\n        // Clear to discard if any authenticated credentials are set and start with a clean slate\n        this.clearCredentials();\n        const region = getRegionFromIdentityPoolId(authConfig.identityPoolId);\n        // use identityId to obtain guest credentials\n        // save credentials in-memory\n        // No logins params should be passed for guest creds:\n        // https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetCredentialsForIdentity.html\n        const clientResult = await getCredentialsForIdentity({ region }, {\n            IdentityId: identityId,\n        });\n        if (clientResult.Credentials &&\n            clientResult.Credentials.AccessKeyId &&\n            clientResult.Credentials.SecretKey) {\n            this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;\n            const res = {\n                credentials: {\n                    accessKeyId: clientResult.Credentials.AccessKeyId,\n                    secretAccessKey: clientResult.Credentials.SecretKey,\n                    sessionToken: clientResult.Credentials.SessionToken,\n                    expiration: clientResult.Credentials.Expiration,\n                },\n                identityId,\n            };\n            const identityIdRes = clientResult.IdentityId;\n            if (identityIdRes) {\n                res.identityId = identityIdRes;\n                this._identityIdStore.storeIdentityId({\n                    id: identityIdRes,\n                    type: 'guest',\n                });\n            }\n            this._credentialsAndIdentityId = {\n                ...res,\n                isAuthenticatedCreds: false,\n            };\n            return res;\n        }\n        else {\n            throw new AuthError({\n                name: 'CredentialsNotFoundException',\n                message: `Cognito did not respond with either Credentials, AccessKeyId or SecretKey.`,\n            });\n        }\n    }\n    async credsForOIDCTokens(authConfig, authTokens, identityId) {\n        if (this._credentialsAndIdentityId &&\n            !this.isPastTTL() &&\n            this._credentialsAndIdentityId.isAuthenticatedCreds === true) {\n            logger.debug('returning stored credentials as they neither past TTL nor expired.');\n            return this._credentialsAndIdentityId;\n        }\n        // Clear to discard if any unauthenticated credentials are set and start with a clean slate\n        this.clearCredentials();\n        const logins = authTokens.idToken\n            ? formLoginsMap(authTokens.idToken.toString())\n            : {};\n        const region = getRegionFromIdentityPoolId(authConfig.identityPoolId);\n        const clientResult = await getCredentialsForIdentity({ region }, {\n            IdentityId: identityId,\n            Logins: logins,\n        });\n        if (clientResult.Credentials &&\n            clientResult.Credentials.AccessKeyId &&\n            clientResult.Credentials.SecretKey) {\n            const res = {\n                credentials: {\n                    accessKeyId: clientResult.Credentials.AccessKeyId,\n                    secretAccessKey: clientResult.Credentials.SecretKey,\n                    sessionToken: clientResult.Credentials.SessionToken,\n                    expiration: clientResult.Credentials.Expiration,\n                },\n                identityId,\n            };\n            // Store the credentials in-memory along with the expiration\n            this._credentialsAndIdentityId = {\n                ...res,\n                isAuthenticatedCreds: true,\n                associatedIdToken: authTokens.idToken?.toString(),\n            };\n            this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;\n            const identityIdRes = clientResult.IdentityId;\n            if (identityIdRes) {\n                res.identityId = identityIdRes;\n                this._identityIdStore.storeIdentityId({\n                    id: identityIdRes,\n                    type: 'primary',\n                });\n            }\n            return res;\n        }\n        else {\n            throw new AuthError({\n                name: 'CredentialsException',\n                message: `Cognito did not respond with either Credentials, AccessKeyId or SecretKey.`,\n            });\n        }\n    }\n    isPastTTL() {\n        return this._nextCredentialsRefresh === undefined\n            ? true\n            : this._nextCredentialsRefresh <= Date.now();\n    }\n    hasTokenChanged(tokens) {\n        return (!!tokens &&\n            !!this._credentialsAndIdentityId?.associatedIdToken &&\n            tokens.idToken?.toString() !==\n                this._credentialsAndIdentityId.associatedIdToken);\n    }\n}\n"],"names":[],"mappings":";;;;;;;;AAAA;AACA;AAQA,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,4BAA4B,CAAC,CAAC;AAC/D,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAChC,MAAM,0CAA0C,CAAC;AACxD,IAAI,WAAW,CAAC,eAAe,EAAE;AACjC,QAAQ,IAAI,CAAC,uBAAuB,GAAG,CAAC,CAAC;AACzC,QAAQ,IAAI,CAAC,gBAAgB,GAAG,eAAe,CAAC;AAChD,KAAK;AACL,IAAI,MAAM,6BAA6B,GAAG;AAC1C,QAAQ,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;AAChE,QAAQ,IAAI,CAAC,yBAAyB,GAAG,SAAS,CAAC;AACnD,QAAQ,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE,CAAC;AACtD,KAAK;AACL,IAAI,MAAM,gBAAgB,GAAG;AAC7B,QAAQ,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;AAC3D,QAAQ,IAAI,CAAC,yBAAyB,GAAG,SAAS,CAAC;AACnD,KAAK;AACL,IAAI,MAAM,2BAA2B,CAAC,qBAAqB,EAAE;AAC7D,QAAQ,MAAM,eAAe,GAAG,qBAAqB,CAAC,aAAa,CAAC;AACpE,QAAQ,MAAM,EAAE,MAAM,EAAE,GAAG,qBAAqB,CAAC;AACjD,QAAQ,MAAM,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAAC;AACrD,QAAQ,IAAI;AACZ,YAAY,0BAA0B,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAC5D,SAAS;AACT,QAAQ,MAAM;AACd;AACA,YAAY,OAAO;AACnB,SAAS;AACT,QAAQ,IAAI,CAAC,eAAe,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,EAAE;AACtE;AACA,YAAY,OAAO;AACnB,SAAS;AACT,QAAQ,MAAM,EAAE,YAAY,EAAE,GAAG,qBAAqB,CAAC;AACvD,QAAQ,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;AAC7D,QAAQ,MAAM,UAAU,GAAG,MAAM,yBAAyB,CAAC;AAC3D,YAAY,MAAM;AAClB,YAAY,UAAU,EAAE,UAAU,CAAC,OAAO;AAC1C,YAAY,eAAe,EAAE,IAAI,CAAC,gBAAgB;AAClD,SAAS,CAAC,CAAC;AACX;AACA,QAAQ,IAAI,YAAY,IAAI,eAAe,EAAE;AAC7C,YAAY,IAAI,CAAC,gBAAgB,EAAE,CAAC;AACpC,SAAS;AACT,QAAQ,IAAI,CAAC,eAAe,EAAE;AAC9B,YAAY,OAAO,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;AAC5E,SAAS;AACT,aAAa;AACb,YAAY,yBAAyB,CAAC,MAAM,CAAC,CAAC;AAC9C,YAAY,OAAO,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AACnF,SAAS;AACT,KAAK;AACL,IAAI,MAAM,mBAAmB,CAAC,UAAU,EAAE,UAAU,EAAE;AACtD;AACA,QAAQ,IAAI,IAAI,CAAC,yBAAyB;AAC1C,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE;AAC7B,YAAY,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,KAAK,KAAK,EAAE;AAC3E,YAAY,MAAM,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;AAC9F,YAAY,OAAO,IAAI,CAAC,yBAAyB,CAAC;AAClD,SAAS;AACT;AACA,QAAQ,IAAI,CAAC,gBAAgB,EAAE,CAAC;AAChC,QAAQ,MAAM,MAAM,GAAG,2BAA2B,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AAC9E;AACA;AACA;AACA;AACA,QAAQ,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,EAAE,MAAM,EAAE,EAAE;AACzE,YAAY,UAAU,EAAE,UAAU;AAClC,SAAS,CAAC,CAAC;AACX,QAAQ,IAAI,YAAY,CAAC,WAAW;AACpC,YAAY,YAAY,CAAC,WAAW,CAAC,WAAW;AAChD,YAAY,YAAY,CAAC,WAAW,CAAC,SAAS,EAAE;AAChD,YAAY,IAAI,CAAC,uBAAuB,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,eAAe,CAAC;AAClF,YAAY,MAAM,GAAG,GAAG;AACxB,gBAAgB,WAAW,EAAE;AAC7B,oBAAoB,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC,WAAW;AACrE,oBAAoB,eAAe,EAAE,YAAY,CAAC,WAAW,CAAC,SAAS;AACvE,oBAAoB,YAAY,EAAE,YAAY,CAAC,WAAW,CAAC,YAAY;AACvE,oBAAoB,UAAU,EAAE,YAAY,CAAC,WAAW,CAAC,UAAU;AACnE,iBAAiB;AACjB,gBAAgB,UAAU;AAC1B,aAAa,CAAC;AACd,YAAY,MAAM,aAAa,GAAG,YAAY,CAAC,UAAU,CAAC;AAC1D,YAAY,IAAI,aAAa,EAAE;AAC/B,gBAAgB,GAAG,CAAC,UAAU,GAAG,aAAa,CAAC;AAC/C,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;AACtD,oBAAoB,EAAE,EAAE,aAAa;AACrC,oBAAoB,IAAI,EAAE,OAAO;AACjC,iBAAiB,CAAC,CAAC;AACnB,aAAa;AACb,YAAY,IAAI,CAAC,yBAAyB,GAAG;AAC7C,gBAAgB,GAAG,GAAG;AACtB,gBAAgB,oBAAoB,EAAE,KAAK;AAC3C,aAAa,CAAC;AACd,YAAY,OAAO,GAAG,CAAC;AACvB,SAAS;AACT,aAAa;AACb,YAAY,MAAM,IAAI,SAAS,CAAC;AAChC,gBAAgB,IAAI,EAAE,8BAA8B;AACpD,gBAAgB,OAAO,EAAE,CAAC,0EAA0E,CAAC;AACrG,aAAa,CAAC,CAAC;AACf,SAAS;AACT,KAAK;AACL,IAAI,MAAM,kBAAkB,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE;AACjE,QAAQ,IAAI,IAAI,CAAC,yBAAyB;AAC1C,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE;AAC7B,YAAY,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,KAAK,IAAI,EAAE;AAC1E,YAAY,MAAM,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;AAC/F,YAAY,OAAO,IAAI,CAAC,yBAAyB,CAAC;AAClD,SAAS;AACT;AACA,QAAQ,IAAI,CAAC,gBAAgB,EAAE,CAAC;AAChC,QAAQ,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO;AACzC,cAAc,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;AAC1D,cAAc,EAAE,CAAC;AACjB,QAAQ,MAAM,MAAM,GAAG,2BAA2B,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AAC9E,QAAQ,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,EAAE,MAAM,EAAE,EAAE;AACzE,YAAY,UAAU,EAAE,UAAU;AAClC,YAAY,MAAM,EAAE,MAAM;AAC1B,SAAS,CAAC,CAAC;AACX,QAAQ,IAAI,YAAY,CAAC,WAAW;AACpC,YAAY,YAAY,CAAC,WAAW,CAAC,WAAW;AAChD,YAAY,YAAY,CAAC,WAAW,CAAC,SAAS,EAAE;AAChD,YAAY,MAAM,GAAG,GAAG;AACxB,gBAAgB,WAAW,EAAE;AAC7B,oBAAoB,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC,WAAW;AACrE,oBAAoB,eAAe,EAAE,YAAY,CAAC,WAAW,CAAC,SAAS;AACvE,oBAAoB,YAAY,EAAE,YAAY,CAAC,WAAW,CAAC,YAAY;AACvE,oBAAoB,UAAU,EAAE,YAAY,CAAC,WAAW,CAAC,UAAU;AACnE,iBAAiB;AACjB,gBAAgB,UAAU;AAC1B,aAAa,CAAC;AACd;AACA,YAAY,IAAI,CAAC,yBAAyB,GAAG;AAC7C,gBAAgB,GAAG,GAAG;AACtB,gBAAgB,oBAAoB,EAAE,IAAI;AAC1C,gBAAgB,iBAAiB,EAAE,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE;AACjE,aAAa,CAAC;AACd,YAAY,IAAI,CAAC,uBAAuB,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,eAAe,CAAC;AAClF,YAAY,MAAM,aAAa,GAAG,YAAY,CAAC,UAAU,CAAC;AAC1D,YAAY,IAAI,aAAa,EAAE;AAC/B,gBAAgB,GAAG,CAAC,UAAU,GAAG,aAAa,CAAC;AAC/C,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;AACtD,oBAAoB,EAAE,EAAE,aAAa;AACrC,oBAAoB,IAAI,EAAE,SAAS;AACnC,iBAAiB,CAAC,CAAC;AACnB,aAAa;AACb,YAAY,OAAO,GAAG,CAAC;AACvB,SAAS;AACT,aAAa;AACb,YAAY,MAAM,IAAI,SAAS,CAAC;AAChC,gBAAgB,IAAI,EAAE,sBAAsB;AAC5C,gBAAgB,OAAO,EAAE,CAAC,0EAA0E,CAAC;AACrG,aAAa,CAAC,CAAC;AACf,SAAS;AACT,KAAK;AACL,IAAI,SAAS,GAAG;AAChB,QAAQ,OAAO,IAAI,CAAC,uBAAuB,KAAK,SAAS;AACzD,cAAc,IAAI;AAClB,cAAc,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;AACzD,KAAK;AACL,IAAI,eAAe,CAAC,MAAM,EAAE;AAC5B,QAAQ,QAAQ,CAAC,CAAC,MAAM;AACxB,YAAY,CAAC,CAAC,IAAI,CAAC,yBAAyB,EAAE,iBAAiB;AAC/D,YAAY,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE;AACtC,gBAAgB,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,EAAE;AAClE,KAAK;AACL;;;;"}
+{"version":3,"file":"credentialsProvider.mjs","sources":["../../../../../src/providers/cognito/credentialsProvider/credentialsProvider.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { ConsoleLogger, getCredentialsForIdentity, } from '@aws-amplify/core';\nimport { assertIdentityPoolIdConfig, } from '@aws-amplify/core/internals/utils';\nimport { AuthError } from '../../../errors/AuthError';\nimport { getRegionFromIdentityPoolId } from '../../../foundation/parsers';\nimport { assertIdTokenInAuthTokens } from '../utils/types';\nimport { cognitoIdentityIdProvider } from './IdentityIdProvider';\nimport { formLoginsMap } from './utils';\nconst logger = new ConsoleLogger('CognitoCredentialsProvider');\nconst CREDENTIALS_TTL = 50 * 60 * 1000; // 50 min, can be modified on config if required in the future\nexport class CognitoAWSCredentialsAndIdentityIdProvider {\n    constructor(identityIdStore) {\n        this._nextCredentialsRefresh = 0;\n        this._identityIdStore = identityIdStore;\n    }\n    async clearCredentialsAndIdentityId() {\n        logger.debug('Clearing out credentials and identityId');\n        this._credentialsAndIdentityId = undefined;\n        await this._identityIdStore.clearIdentityId();\n    }\n    async clearCredentials() {\n        logger.debug('Clearing out in-memory credentials');\n        this._credentialsAndIdentityId = undefined;\n    }\n    async getCredentialsAndIdentityId(getCredentialsOptions) {\n        const isAuthenticated = getCredentialsOptions.authenticated;\n        const { tokens } = getCredentialsOptions;\n        const { authConfig } = getCredentialsOptions;\n        try {\n            assertIdentityPoolIdConfig(authConfig?.Cognito);\n        }\n        catch {\n            // No identity pool configured, skipping\n            return;\n        }\n        if (!isAuthenticated && !authConfig.Cognito.allowGuestAccess) {\n            // TODO(V6): return partial result like Native platforms\n            return;\n        }\n        const { forceRefresh } = getCredentialsOptions;\n        const tokenHasChanged = this.hasTokenChanged(tokens);\n        const identityId = await cognitoIdentityIdProvider({\n            tokens,\n            authConfig: authConfig.Cognito,\n            identityIdStore: this._identityIdStore,\n        });\n        // Clear cached credentials when forceRefresh is true OR the cache token has changed\n        if (forceRefresh || tokenHasChanged) {\n            this.clearCredentials();\n        }\n        if (!isAuthenticated) {\n            return this.getGuestCredentials(identityId, authConfig.Cognito);\n        }\n        else {\n            assertIdTokenInAuthTokens(tokens);\n            return this.credsForOIDCTokens(authConfig.Cognito, tokens, identityId);\n        }\n    }\n    async getGuestCredentials(identityId, authConfig) {\n        // Return existing in-memory cached credentials only if it exists, is not past it's lifetime and is unauthenticated credentials\n        if (this._credentialsAndIdentityId &&\n            !this.isPastTTL() &&\n            this._credentialsAndIdentityId.isAuthenticatedCreds === false) {\n            logger.info('returning stored credentials as they neither past TTL nor expired.');\n            return this._credentialsAndIdentityId;\n        }\n        // Clear to discard if any authenticated credentials are set and start with a clean slate\n        this.clearCredentials();\n        const region = getRegionFromIdentityPoolId(authConfig.identityPoolId);\n        // use identityId to obtain guest credentials\n        // save credentials in-memory\n        // No logins params should be passed for guest creds:\n        // https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetCredentialsForIdentity.html\n        const clientResult = await getCredentialsForIdentity({ region }, {\n            IdentityId: identityId,\n        });\n        if (clientResult.Credentials &&\n            clientResult.Credentials.AccessKeyId &&\n            clientResult.Credentials.SecretKey) {\n            this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;\n            const res = {\n                credentials: {\n                    accessKeyId: clientResult.Credentials.AccessKeyId,\n                    secretAccessKey: clientResult.Credentials.SecretKey,\n                    sessionToken: clientResult.Credentials.SessionToken,\n                    expiration: clientResult.Credentials.Expiration,\n                },\n                identityId,\n            };\n            if (clientResult.IdentityId) {\n                res.identityId = clientResult.IdentityId;\n                this._identityIdStore.storeIdentityId({\n                    id: clientResult.IdentityId,\n                    type: 'guest',\n                });\n            }\n            this._credentialsAndIdentityId = {\n                ...res,\n                isAuthenticatedCreds: false,\n            };\n            return res;\n        }\n        else {\n            throw new AuthError({\n                name: 'CredentialsNotFoundException',\n                message: `Cognito did not respond with either Credentials, AccessKeyId or SecretKey.`,\n            });\n        }\n    }\n    async credsForOIDCTokens(authConfig, authTokens, identityId) {\n        if (this._credentialsAndIdentityId &&\n            !this.isPastTTL() &&\n            this._credentialsAndIdentityId.isAuthenticatedCreds === true) {\n            logger.debug('returning stored credentials as they neither past TTL nor expired.');\n            return this._credentialsAndIdentityId;\n        }\n        // Clear to discard if any unauthenticated credentials are set and start with a clean slate\n        this.clearCredentials();\n        const logins = authTokens.idToken\n            ? formLoginsMap(authTokens.idToken.toString())\n            : {};\n        const region = getRegionFromIdentityPoolId(authConfig.identityPoolId);\n        const clientResult = await getCredentialsForIdentity({ region }, {\n            IdentityId: identityId,\n            Logins: logins,\n        });\n        if (clientResult.Credentials &&\n            clientResult.Credentials.AccessKeyId &&\n            clientResult.Credentials.SecretKey) {\n            this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;\n            const res = {\n                credentials: {\n                    accessKeyId: clientResult.Credentials.AccessKeyId,\n                    secretAccessKey: clientResult.Credentials.SecretKey,\n                    sessionToken: clientResult.Credentials.SessionToken,\n                    expiration: clientResult.Credentials.Expiration,\n                },\n                identityId,\n            };\n            if (clientResult.IdentityId) {\n                res.identityId = clientResult.IdentityId;\n                // note: the following call removes guest identityId from the persistent store (localStorage)\n                this._identityIdStore.storeIdentityId({\n                    id: clientResult.IdentityId,\n                    type: 'primary',\n                });\n            }\n            // Store the credentials in-memory along with the expiration\n            this._credentialsAndIdentityId = {\n                ...res,\n                isAuthenticatedCreds: true,\n                associatedIdToken: authTokens.idToken?.toString(),\n            };\n            return res;\n        }\n        else {\n            throw new AuthError({\n                name: 'CredentialsException',\n                message: `Cognito did not respond with either Credentials, AccessKeyId or SecretKey.`,\n            });\n        }\n    }\n    isPastTTL() {\n        return this._nextCredentialsRefresh === undefined\n            ? true\n            : this._nextCredentialsRefresh <= Date.now();\n    }\n    hasTokenChanged(tokens) {\n        return (!!tokens &&\n            !!this._credentialsAndIdentityId?.associatedIdToken &&\n            tokens.idToken?.toString() !==\n                this._credentialsAndIdentityId.associatedIdToken);\n    }\n}\n"],"names":[],"mappings":";;;;;;;;AAAA;AACA;AAQA,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,4BAA4B,CAAC,CAAC;AAC/D,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAChC,MAAM,0CAA0C,CAAC;AACxD,IAAI,WAAW,CAAC,eAAe,EAAE;AACjC,QAAQ,IAAI,CAAC,uBAAuB,GAAG,CAAC,CAAC;AACzC,QAAQ,IAAI,CAAC,gBAAgB,GAAG,eAAe,CAAC;AAChD,KAAK;AACL,IAAI,MAAM,6BAA6B,GAAG;AAC1C,QAAQ,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;AAChE,QAAQ,IAAI,CAAC,yBAAyB,GAAG,SAAS,CAAC;AACnD,QAAQ,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE,CAAC;AACtD,KAAK;AACL,IAAI,MAAM,gBAAgB,GAAG;AAC7B,QAAQ,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;AAC3D,QAAQ,IAAI,CAAC,yBAAyB,GAAG,SAAS,CAAC;AACnD,KAAK;AACL,IAAI,MAAM,2BAA2B,CAAC,qBAAqB,EAAE;AAC7D,QAAQ,MAAM,eAAe,GAAG,qBAAqB,CAAC,aAAa,CAAC;AACpE,QAAQ,MAAM,EAAE,MAAM,EAAE,GAAG,qBAAqB,CAAC;AACjD,QAAQ,MAAM,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAAC;AACrD,QAAQ,IAAI;AACZ,YAAY,0BAA0B,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAC5D,SAAS;AACT,QAAQ,MAAM;AACd;AACA,YAAY,OAAO;AACnB,SAAS;AACT,QAAQ,IAAI,CAAC,eAAe,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,EAAE;AACtE;AACA,YAAY,OAAO;AACnB,SAAS;AACT,QAAQ,MAAM,EAAE,YAAY,EAAE,GAAG,qBAAqB,CAAC;AACvD,QAAQ,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;AAC7D,QAAQ,MAAM,UAAU,GAAG,MAAM,yBAAyB,CAAC;AAC3D,YAAY,MAAM;AAClB,YAAY,UAAU,EAAE,UAAU,CAAC,OAAO;AAC1C,YAAY,eAAe,EAAE,IAAI,CAAC,gBAAgB;AAClD,SAAS,CAAC,CAAC;AACX;AACA,QAAQ,IAAI,YAAY,IAAI,eAAe,EAAE;AAC7C,YAAY,IAAI,CAAC,gBAAgB,EAAE,CAAC;AACpC,SAAS;AACT,QAAQ,IAAI,CAAC,eAAe,EAAE;AAC9B,YAAY,OAAO,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;AAC5E,SAAS;AACT,aAAa;AACb,YAAY,yBAAyB,CAAC,MAAM,CAAC,CAAC;AAC9C,YAAY,OAAO,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AACnF,SAAS;AACT,KAAK;AACL,IAAI,MAAM,mBAAmB,CAAC,UAAU,EAAE,UAAU,EAAE;AACtD;AACA,QAAQ,IAAI,IAAI,CAAC,yBAAyB;AAC1C,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE;AAC7B,YAAY,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,KAAK,KAAK,EAAE;AAC3E,YAAY,MAAM,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;AAC9F,YAAY,OAAO,IAAI,CAAC,yBAAyB,CAAC;AAClD,SAAS;AACT;AACA,QAAQ,IAAI,CAAC,gBAAgB,EAAE,CAAC;AAChC,QAAQ,MAAM,MAAM,GAAG,2BAA2B,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AAC9E;AACA;AACA;AACA;AACA,QAAQ,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,EAAE,MAAM,EAAE,EAAE;AACzE,YAAY,UAAU,EAAE,UAAU;AAClC,SAAS,CAAC,CAAC;AACX,QAAQ,IAAI,YAAY,CAAC,WAAW;AACpC,YAAY,YAAY,CAAC,WAAW,CAAC,WAAW;AAChD,YAAY,YAAY,CAAC,WAAW,CAAC,SAAS,EAAE;AAChD,YAAY,IAAI,CAAC,uBAAuB,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,eAAe,CAAC;AAClF,YAAY,MAAM,GAAG,GAAG;AACxB,gBAAgB,WAAW,EAAE;AAC7B,oBAAoB,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC,WAAW;AACrE,oBAAoB,eAAe,EAAE,YAAY,CAAC,WAAW,CAAC,SAAS;AACvE,oBAAoB,YAAY,EAAE,YAAY,CAAC,WAAW,CAAC,YAAY;AACvE,oBAAoB,UAAU,EAAE,YAAY,CAAC,WAAW,CAAC,UAAU;AACnE,iBAAiB;AACjB,gBAAgB,UAAU;AAC1B,aAAa,CAAC;AACd,YAAY,IAAI,YAAY,CAAC,UAAU,EAAE;AACzC,gBAAgB,GAAG,CAAC,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC;AACzD,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;AACtD,oBAAoB,EAAE,EAAE,YAAY,CAAC,UAAU;AAC/C,oBAAoB,IAAI,EAAE,OAAO;AACjC,iBAAiB,CAAC,CAAC;AACnB,aAAa;AACb,YAAY,IAAI,CAAC,yBAAyB,GAAG;AAC7C,gBAAgB,GAAG,GAAG;AACtB,gBAAgB,oBAAoB,EAAE,KAAK;AAC3C,aAAa,CAAC;AACd,YAAY,OAAO,GAAG,CAAC;AACvB,SAAS;AACT,aAAa;AACb,YAAY,MAAM,IAAI,SAAS,CAAC;AAChC,gBAAgB,IAAI,EAAE,8BAA8B;AACpD,gBAAgB,OAAO,EAAE,CAAC,0EAA0E,CAAC;AACrG,aAAa,CAAC,CAAC;AACf,SAAS;AACT,KAAK;AACL,IAAI,MAAM,kBAAkB,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE;AACjE,QAAQ,IAAI,IAAI,CAAC,yBAAyB;AAC1C,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE;AAC7B,YAAY,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,KAAK,IAAI,EAAE;AAC1E,YAAY,MAAM,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;AAC/F,YAAY,OAAO,IAAI,CAAC,yBAAyB,CAAC;AAClD,SAAS;AACT;AACA,QAAQ,IAAI,CAAC,gBAAgB,EAAE,CAAC;AAChC,QAAQ,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO;AACzC,cAAc,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;AAC1D,cAAc,EAAE,CAAC;AACjB,QAAQ,MAAM,MAAM,GAAG,2BAA2B,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AAC9E,QAAQ,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,EAAE,MAAM,EAAE,EAAE;AACzE,YAAY,UAAU,EAAE,UAAU;AAClC,YAAY,MAAM,EAAE,MAAM;AAC1B,SAAS,CAAC,CAAC;AACX,QAAQ,IAAI,YAAY,CAAC,WAAW;AACpC,YAAY,YAAY,CAAC,WAAW,CAAC,WAAW;AAChD,YAAY,YAAY,CAAC,WAAW,CAAC,SAAS,EAAE;AAChD,YAAY,IAAI,CAAC,uBAAuB,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,eAAe,CAAC;AAClF,YAAY,MAAM,GAAG,GAAG;AACxB,gBAAgB,WAAW,EAAE;AAC7B,oBAAoB,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC,WAAW;AACrE,oBAAoB,eAAe,EAAE,YAAY,CAAC,WAAW,CAAC,SAAS;AACvE,oBAAoB,YAAY,EAAE,YAAY,CAAC,WAAW,CAAC,YAAY;AACvE,oBAAoB,UAAU,EAAE,YAAY,CAAC,WAAW,CAAC,UAAU;AACnE,iBAAiB;AACjB,gBAAgB,UAAU;AAC1B,aAAa,CAAC;AACd,YAAY,IAAI,YAAY,CAAC,UAAU,EAAE;AACzC,gBAAgB,GAAG,CAAC,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC;AACzD;AACA,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;AACtD,oBAAoB,EAAE,EAAE,YAAY,CAAC,UAAU;AAC/C,oBAAoB,IAAI,EAAE,SAAS;AACnC,iBAAiB,CAAC,CAAC;AACnB,aAAa;AACb;AACA,YAAY,IAAI,CAAC,yBAAyB,GAAG;AAC7C,gBAAgB,GAAG,GAAG;AACtB,gBAAgB,oBAAoB,EAAE,IAAI;AAC1C,gBAAgB,iBAAiB,EAAE,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE;AACjE,aAAa,CAAC;AACd,YAAY,OAAO,GAAG,CAAC;AACvB,SAAS;AACT,aAAa;AACb,YAAY,MAAM,IAAI,SAAS,CAAC;AAChC,gBAAgB,IAAI,EAAE,sBAAsB;AAC5C,gBAAgB,OAAO,EAAE,CAAC,0EAA0E,CAAC;AACrG,aAAa,CAAC,CAAC;AACf,SAAS;AACT,KAAK;AACL,IAAI,SAAS,GAAG;AAChB,QAAQ,OAAO,IAAI,CAAC,uBAAuB,KAAK,SAAS;AACzD,cAAc,IAAI;AAClB,cAAc,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;AACzD,KAAK;AACL,IAAI,eAAe,CAAC,MAAM,EAAE;AAC5B,QAAQ,QAAQ,CAAC,CAAC,MAAM;AACxB,YAAY,CAAC,CAAC,IAAI,CAAC,yBAAyB,EAAE,iBAAiB;AAC/D,YAAY,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE;AACtC,gBAAgB,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,EAAE;AAClE,KAAK;AACL;;;;"}

package/dist/esm/providers/cognito/utils/oauth/completeOAuthFlow.mjs

@@ -143,6 +143,8 @@ const completeFlow = async ({ redirectUri, state, preferPrivateSession, }) => {
     // e.g. `getCurrentUser()` below, so it allows every inflight async calls to
     //  `fetchAuthSession` can be resolved
     resolveAndClearInflightPromises();
+    // clear history before sending out final Hub events
+    clearHistory(redirectUri);
     if (isCustomState(state)) {
         Hub.dispatch('auth', {
             event: 'customOAuthState',
@@ -151,7 +153,6 @@ const completeFlow = async ({ redirectUri, state, preferPrivateSession, }) => {
     }
     Hub.dispatch('auth', { event: 'signInWithRedirect' }, 'Auth', AMPLIFY_SYMBOL);
     await dispatchSignedInHubEvent();
-    clearHistory(redirectUri);
 };
 const isCustomState = (state) => {
     return /-/.test(state);

package/dist/esm/providers/cognito/utils/oauth/completeOAuthFlow.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"completeOAuthFlow.mjs","sources":["../../../../../../src/providers/cognito/utils/oauth/completeOAuthFlow.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { AMPLIFY_SYMBOL, AmplifyUrl, USER_AGENT_HEADER, urlSafeDecode, } from '@aws-amplify/core/internals/utils';\nimport { Hub, decodeJWT } from '@aws-amplify/core';\nimport { cacheCognitoTokens } from '../../tokenProvider/cacheTokens';\nimport { dispatchSignedInHubEvent } from '../dispatchSignedInHubEvent';\nimport { tokenOrchestrator } from '../../tokenProvider';\nimport { createOAuthError } from './createOAuthError';\nimport { resolveAndClearInflightPromises } from './inflightPromise';\nimport { validateState } from './validateState';\nimport { oAuthStore } from './oAuthStore';\nexport const completeOAuthFlow = async ({ currentUrl, userAgentValue, clientId, redirectUri, responseType, domain, preferPrivateSession, }) => {\n    const urlParams = new AmplifyUrl(currentUrl);\n    const error = urlParams.searchParams.get('error');\n    const errorMessage = urlParams.searchParams.get('error_description');\n    if (error) {\n        throw createOAuthError(errorMessage ?? error);\n    }\n    if (responseType === 'code') {\n        return handleCodeFlow({\n            currentUrl,\n            userAgentValue,\n            clientId,\n            redirectUri,\n            domain,\n            preferPrivateSession,\n        });\n    }\n    return handleImplicitFlow({\n        currentUrl,\n        redirectUri,\n        preferPrivateSession,\n    });\n};\nconst handleCodeFlow = async ({ currentUrl, userAgentValue, clientId, redirectUri, domain, preferPrivateSession, }) => {\n    /* Convert URL into an object with parameters as keys\n{ redirect_uri: 'http://localhost:3000/', response_type: 'code', ...} */\n    const url = new AmplifyUrl(currentUrl);\n    const code = url.searchParams.get('code');\n    const state = url.searchParams.get('state');\n    // if `code` or `state` is not presented in the redirect url, most likely\n    // that the end user cancelled the inflight oauth flow by:\n    // 1. clicking the back button of browser\n    // 2. closing the provider hosted UI page and coming back to the app\n    if (!code || !state) {\n        throw createOAuthError('User cancelled OAuth flow.');\n    }\n    // may throw error is being caught in attemptCompleteOAuthFlow.ts\n    const validatedState = await validateState(state);\n    const oAuthTokenEndpoint = 'https://' + domain + '/oauth2/token';\n    // TODO(v6): check hub events\n    // dispatchAuthEvent(\n    // \t'codeFlow',\n    // \t{},\n    // \t`Retrieving tokens from ${oAuthTokenEndpoint}`\n    // );\n    const codeVerifier = await oAuthStore.loadPKCE();\n    const oAuthTokenBody = {\n        grant_type: 'authorization_code',\n        code,\n        client_id: clientId,\n        redirect_uri: redirectUri,\n        ...(codeVerifier ? { code_verifier: codeVerifier } : {}),\n    };\n    const body = Object.entries(oAuthTokenBody)\n        .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`)\n        .join('&');\n    const { access_token, refresh_token: refreshToken, id_token, error, error_message: errorMessage, token_type, expires_in, } = await (await fetch(oAuthTokenEndpoint, {\n        method: 'POST',\n        headers: {\n            'Content-Type': 'application/x-www-form-urlencoded',\n            [USER_AGENT_HEADER]: userAgentValue,\n        },\n        body,\n    })).json();\n    if (error) {\n        // error is being caught in attemptCompleteOAuthFlow.ts\n        throw createOAuthError(errorMessage ?? error);\n    }\n    const username = (access_token && decodeJWT(access_token).payload.username) ?? 'username';\n    await cacheCognitoTokens({\n        username,\n        AccessToken: access_token,\n        IdToken: id_token,\n        RefreshToken: refreshToken,\n        TokenType: token_type,\n        ExpiresIn: expires_in,\n    });\n    return completeFlow({\n        redirectUri,\n        state: validatedState,\n        preferPrivateSession,\n    });\n};\nconst handleImplicitFlow = async ({ currentUrl, redirectUri, preferPrivateSession, }) => {\n    // hash is `null` if `#` doesn't exist on URL\n    const url = new AmplifyUrl(currentUrl);\n    const { id_token, access_token, state, token_type, expires_in, error_description, error, } = (url.hash ?? '#')\n        .substring(1) // Remove # from returned code\n        .split('&')\n        .map(pairings => pairings.split('='))\n        .reduce((accum, [k, v]) => ({ ...accum, [k]: v }), {\n        id_token: undefined,\n        access_token: undefined,\n        state: undefined,\n        token_type: undefined,\n        expires_in: undefined,\n        error_description: undefined,\n        error: undefined,\n    });\n    if (error) {\n        throw createOAuthError(error_description ?? error);\n    }\n    if (!access_token) {\n        // error is being caught in attemptCompleteOAuthFlow.ts\n        throw createOAuthError('No access token returned from OAuth flow.');\n    }\n    const validatedState = await validateState(state);\n    const username = (access_token && decodeJWT(access_token).payload.username) ?? 'username';\n    await cacheCognitoTokens({\n        username,\n        AccessToken: access_token,\n        IdToken: id_token,\n        TokenType: token_type,\n        ExpiresIn: expires_in,\n    });\n    return completeFlow({\n        redirectUri,\n        state: validatedState,\n        preferPrivateSession,\n    });\n};\nconst completeFlow = async ({ redirectUri, state, preferPrivateSession, }) => {\n    await tokenOrchestrator.setOAuthMetadata({\n        oauthSignIn: true,\n    });\n    await oAuthStore.clearOAuthData();\n    await oAuthStore.storeOAuthSignIn(true, preferPrivateSession);\n    // this should be called before any call that involves `fetchAuthSession`\n    // e.g. `getCurrentUser()` below, so it allows every inflight async calls to\n    //  `fetchAuthSession` can be resolved\n    resolveAndClearInflightPromises();\n    if (isCustomState(state)) {\n        Hub.dispatch('auth', {\n            event: 'customOAuthState',\n            data: urlSafeDecode(getCustomState(state)),\n        }, 'Auth', AMPLIFY_SYMBOL);\n    }\n    Hub.dispatch('auth', { event: 'signInWithRedirect' }, 'Auth', AMPLIFY_SYMBOL);\n    await dispatchSignedInHubEvent();\n    clearHistory(redirectUri);\n};\nconst isCustomState = (state) => {\n    return /-/.test(state);\n};\nconst getCustomState = (state) => {\n    return state.split('-').splice(1).join('-');\n};\nconst clearHistory = (redirectUri) => {\n    if (typeof window !== 'undefined' && typeof window.history !== 'undefined') {\n        window.history.replaceState(window.history.state, '', redirectUri);\n    }\n};\n"],"names":[],"mappings":";;;;;;;;;;;;AAAA;AACA;AAUY,MAAC,iBAAiB,GAAG,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,oBAAoB,GAAG,KAAK;AAC/I,IAAI,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;AACjD,IAAI,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACtD,IAAI,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AACzE,IAAI,IAAI,KAAK,EAAE;AACf,QAAQ,MAAM,gBAAgB,CAAC,YAAY,IAAI,KAAK,CAAC,CAAC;AACtD,KAAK;AACL,IAAI,IAAI,YAAY,KAAK,MAAM,EAAE;AACjC,QAAQ,OAAO,cAAc,CAAC;AAC9B,YAAY,UAAU;AACtB,YAAY,cAAc;AAC1B,YAAY,QAAQ;AACpB,YAAY,WAAW;AACvB,YAAY,MAAM;AAClB,YAAY,oBAAoB;AAChC,SAAS,CAAC,CAAC;AACX,KAAK;AACL,IAAI,OAAO,kBAAkB,CAAC;AAC9B,QAAQ,UAAU;AAClB,QAAQ,WAAW;AACnB,QAAQ,oBAAoB;AAC5B,KAAK,CAAC,CAAC;AACP,EAAE;AACF,MAAM,cAAc,GAAG,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,oBAAoB,GAAG,KAAK;AACvH;AACA;AACA,IAAI,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;AAC3C,IAAI,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC9C,IAAI,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAChD;AACA;AACA;AACA;AACA,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE;AACzB,QAAQ,MAAM,gBAAgB,CAAC,4BAA4B,CAAC,CAAC;AAC7D,KAAK;AACL;AACA,IAAI,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;AACtD,IAAI,MAAM,kBAAkB,GAAG,UAAU,GAAG,MAAM,GAAG,eAAe,CAAC;AACrE;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC;AACrD,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,UAAU,EAAE,oBAAoB;AACxC,QAAQ,IAAI;AACZ,QAAQ,SAAS,EAAE,QAAQ;AAC3B,QAAQ,YAAY,EAAE,WAAW;AACjC,QAAQ,IAAI,YAAY,GAAG,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;AAChE,KAAK,CAAC;AACN,IAAI,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC;AAC/C,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7E,SAAS,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,IAAI,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,kBAAkB,EAAE;AACxK,QAAQ,MAAM,EAAE,MAAM;AACtB,QAAQ,OAAO,EAAE;AACjB,YAAY,cAAc,EAAE,mCAAmC;AAC/D,YAAY,CAAC,iBAAiB,GAAG,cAAc;AAC/C,SAAS;AACT,QAAQ,IAAI;AACZ,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;AACf,IAAI,IAAI,KAAK,EAAE;AACf;AACA,QAAQ,MAAM,gBAAgB,CAAC,YAAY,IAAI,KAAK,CAAC,CAAC;AACtD,KAAK;AACL,IAAI,MAAM,QAAQ,GAAG,CAAC,YAAY,IAAI,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC;AAC9F,IAAI,MAAM,kBAAkB,CAAC;AAC7B,QAAQ,QAAQ;AAChB,QAAQ,WAAW,EAAE,YAAY;AACjC,QAAQ,OAAO,EAAE,QAAQ;AACzB,QAAQ,YAAY,EAAE,YAAY;AAClC,QAAQ,SAAS,EAAE,UAAU;AAC7B,QAAQ,SAAS,EAAE,UAAU;AAC7B,KAAK,CAAC,CAAC;AACP,IAAI,OAAO,YAAY,CAAC;AACxB,QAAQ,WAAW;AACnB,QAAQ,KAAK,EAAE,cAAc;AAC7B,QAAQ,oBAAoB;AAC5B,KAAK,CAAC,CAAC;AACP,CAAC,CAAC;AACF,MAAM,kBAAkB,GAAG,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,oBAAoB,GAAG,KAAK;AACzF;AACA,IAAI,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;AAC3C,IAAI,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG;AACjH,SAAS,SAAS,CAAC,CAAC,CAAC;AACrB,SAAS,KAAK,CAAC,GAAG,CAAC;AACnB,SAAS,GAAG,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC7C,SAAS,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;AAC3D,QAAQ,QAAQ,EAAE,SAAS;AAC3B,QAAQ,YAAY,EAAE,SAAS;AAC/B,QAAQ,KAAK,EAAE,SAAS;AACxB,QAAQ,UAAU,EAAE,SAAS;AAC7B,QAAQ,UAAU,EAAE,SAAS;AAC7B,QAAQ,iBAAiB,EAAE,SAAS;AACpC,QAAQ,KAAK,EAAE,SAAS;AACxB,KAAK,CAAC,CAAC;AACP,IAAI,IAAI,KAAK,EAAE;AACf,QAAQ,MAAM,gBAAgB,CAAC,iBAAiB,IAAI,KAAK,CAAC,CAAC;AAC3D,KAAK;AACL,IAAI,IAAI,CAAC,YAAY,EAAE;AACvB;AACA,QAAQ,MAAM,gBAAgB,CAAC,2CAA2C,CAAC,CAAC;AAC5E,KAAK;AACL,IAAI,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;AACtD,IAAI,MAAM,QAAQ,GAAG,CAAC,YAAY,IAAI,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC;AAC9F,IAAI,MAAM,kBAAkB,CAAC;AAC7B,QAAQ,QAAQ;AAChB,QAAQ,WAAW,EAAE,YAAY;AACjC,QAAQ,OAAO,EAAE,QAAQ;AACzB,QAAQ,SAAS,EAAE,UAAU;AAC7B,QAAQ,SAAS,EAAE,UAAU;AAC7B,KAAK,CAAC,CAAC;AACP,IAAI,OAAO,YAAY,CAAC;AACxB,QAAQ,WAAW;AACnB,QAAQ,KAAK,EAAE,cAAc;AAC7B,QAAQ,oBAAoB;AAC5B,KAAK,CAAC,CAAC;AACP,CAAC,CAAC;AACF,MAAM,YAAY,GAAG,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,oBAAoB,GAAG,KAAK;AAC9E,IAAI,MAAM,iBAAiB,CAAC,gBAAgB,CAAC;AAC7C,QAAQ,WAAW,EAAE,IAAI;AACzB,KAAK,CAAC,CAAC;AACP,IAAI,MAAM,UAAU,CAAC,cAAc,EAAE,CAAC;AACtC,IAAI,MAAM,UAAU,CAAC,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;AAClE;AACA;AACA;AACA,IAAI,+BAA+B,EAAE,CAAC;AACtC,IAAI,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE;AAC9B,QAAQ,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE;AAC7B,YAAY,KAAK,EAAE,kBAAkB;AACrC,YAAY,IAAI,EAAE,aAAa,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;AACtD,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;AACnC,KAAK;AACL,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;AAClF,IAAI,MAAM,wBAAwB,EAAE,CAAC;AACrC,IAAI,YAAY,CAAC,WAAW,CAAC,CAAC;AAC9B,CAAC,CAAC;AACF,MAAM,aAAa,GAAG,CAAC,KAAK,KAAK;AACjC,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC,CAAC;AACF,MAAM,cAAc,GAAG,CAAC,KAAK,KAAK;AAClC,IAAI,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChD,CAAC,CAAC;AACF,MAAM,YAAY,GAAG,CAAC,WAAW,KAAK;AACtC,IAAI,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,WAAW,EAAE;AAChF,QAAQ,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;AAC3E,KAAK;AACL,CAAC;;;;"}
+{"version":3,"file":"completeOAuthFlow.mjs","sources":["../../../../../../src/providers/cognito/utils/oauth/completeOAuthFlow.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { AMPLIFY_SYMBOL, AmplifyUrl, USER_AGENT_HEADER, urlSafeDecode, } from '@aws-amplify/core/internals/utils';\nimport { Hub, decodeJWT } from '@aws-amplify/core';\nimport { cacheCognitoTokens } from '../../tokenProvider/cacheTokens';\nimport { dispatchSignedInHubEvent } from '../dispatchSignedInHubEvent';\nimport { tokenOrchestrator } from '../../tokenProvider';\nimport { createOAuthError } from './createOAuthError';\nimport { resolveAndClearInflightPromises } from './inflightPromise';\nimport { validateState } from './validateState';\nimport { oAuthStore } from './oAuthStore';\nexport const completeOAuthFlow = async ({ currentUrl, userAgentValue, clientId, redirectUri, responseType, domain, preferPrivateSession, }) => {\n    const urlParams = new AmplifyUrl(currentUrl);\n    const error = urlParams.searchParams.get('error');\n    const errorMessage = urlParams.searchParams.get('error_description');\n    if (error) {\n        throw createOAuthError(errorMessage ?? error);\n    }\n    if (responseType === 'code') {\n        return handleCodeFlow({\n            currentUrl,\n            userAgentValue,\n            clientId,\n            redirectUri,\n            domain,\n            preferPrivateSession,\n        });\n    }\n    return handleImplicitFlow({\n        currentUrl,\n        redirectUri,\n        preferPrivateSession,\n    });\n};\nconst handleCodeFlow = async ({ currentUrl, userAgentValue, clientId, redirectUri, domain, preferPrivateSession, }) => {\n    /* Convert URL into an object with parameters as keys\n{ redirect_uri: 'http://localhost:3000/', response_type: 'code', ...} */\n    const url = new AmplifyUrl(currentUrl);\n    const code = url.searchParams.get('code');\n    const state = url.searchParams.get('state');\n    // if `code` or `state` is not presented in the redirect url, most likely\n    // that the end user cancelled the inflight oauth flow by:\n    // 1. clicking the back button of browser\n    // 2. closing the provider hosted UI page and coming back to the app\n    if (!code || !state) {\n        throw createOAuthError('User cancelled OAuth flow.');\n    }\n    // may throw error is being caught in attemptCompleteOAuthFlow.ts\n    const validatedState = await validateState(state);\n    const oAuthTokenEndpoint = 'https://' + domain + '/oauth2/token';\n    // TODO(v6): check hub events\n    // dispatchAuthEvent(\n    // \t'codeFlow',\n    // \t{},\n    // \t`Retrieving tokens from ${oAuthTokenEndpoint}`\n    // );\n    const codeVerifier = await oAuthStore.loadPKCE();\n    const oAuthTokenBody = {\n        grant_type: 'authorization_code',\n        code,\n        client_id: clientId,\n        redirect_uri: redirectUri,\n        ...(codeVerifier ? { code_verifier: codeVerifier } : {}),\n    };\n    const body = Object.entries(oAuthTokenBody)\n        .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`)\n        .join('&');\n    const { access_token, refresh_token: refreshToken, id_token, error, error_message: errorMessage, token_type, expires_in, } = await (await fetch(oAuthTokenEndpoint, {\n        method: 'POST',\n        headers: {\n            'Content-Type': 'application/x-www-form-urlencoded',\n            [USER_AGENT_HEADER]: userAgentValue,\n        },\n        body,\n    })).json();\n    if (error) {\n        // error is being caught in attemptCompleteOAuthFlow.ts\n        throw createOAuthError(errorMessage ?? error);\n    }\n    const username = (access_token && decodeJWT(access_token).payload.username) ?? 'username';\n    await cacheCognitoTokens({\n        username,\n        AccessToken: access_token,\n        IdToken: id_token,\n        RefreshToken: refreshToken,\n        TokenType: token_type,\n        ExpiresIn: expires_in,\n    });\n    return completeFlow({\n        redirectUri,\n        state: validatedState,\n        preferPrivateSession,\n    });\n};\nconst handleImplicitFlow = async ({ currentUrl, redirectUri, preferPrivateSession, }) => {\n    // hash is `null` if `#` doesn't exist on URL\n    const url = new AmplifyUrl(currentUrl);\n    const { id_token, access_token, state, token_type, expires_in, error_description, error, } = (url.hash ?? '#')\n        .substring(1) // Remove # from returned code\n        .split('&')\n        .map(pairings => pairings.split('='))\n        .reduce((accum, [k, v]) => ({ ...accum, [k]: v }), {\n        id_token: undefined,\n        access_token: undefined,\n        state: undefined,\n        token_type: undefined,\n        expires_in: undefined,\n        error_description: undefined,\n        error: undefined,\n    });\n    if (error) {\n        throw createOAuthError(error_description ?? error);\n    }\n    if (!access_token) {\n        // error is being caught in attemptCompleteOAuthFlow.ts\n        throw createOAuthError('No access token returned from OAuth flow.');\n    }\n    const validatedState = await validateState(state);\n    const username = (access_token && decodeJWT(access_token).payload.username) ?? 'username';\n    await cacheCognitoTokens({\n        username,\n        AccessToken: access_token,\n        IdToken: id_token,\n        TokenType: token_type,\n        ExpiresIn: expires_in,\n    });\n    return completeFlow({\n        redirectUri,\n        state: validatedState,\n        preferPrivateSession,\n    });\n};\nconst completeFlow = async ({ redirectUri, state, preferPrivateSession, }) => {\n    await tokenOrchestrator.setOAuthMetadata({\n        oauthSignIn: true,\n    });\n    await oAuthStore.clearOAuthData();\n    await oAuthStore.storeOAuthSignIn(true, preferPrivateSession);\n    // this should be called before any call that involves `fetchAuthSession`\n    // e.g. `getCurrentUser()` below, so it allows every inflight async calls to\n    //  `fetchAuthSession` can be resolved\n    resolveAndClearInflightPromises();\n    // clear history before sending out final Hub events\n    clearHistory(redirectUri);\n    if (isCustomState(state)) {\n        Hub.dispatch('auth', {\n            event: 'customOAuthState',\n            data: urlSafeDecode(getCustomState(state)),\n        }, 'Auth', AMPLIFY_SYMBOL);\n    }\n    Hub.dispatch('auth', { event: 'signInWithRedirect' }, 'Auth', AMPLIFY_SYMBOL);\n    await dispatchSignedInHubEvent();\n};\nconst isCustomState = (state) => {\n    return /-/.test(state);\n};\nconst getCustomState = (state) => {\n    return state.split('-').splice(1).join('-');\n};\nconst clearHistory = (redirectUri) => {\n    if (typeof window !== 'undefined' && typeof window.history !== 'undefined') {\n        window.history.replaceState(window.history.state, '', redirectUri);\n    }\n};\n"],"names":[],"mappings":";;;;;;;;;;;;AAAA;AACA;AAUY,MAAC,iBAAiB,GAAG,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,oBAAoB,GAAG,KAAK;AAC/I,IAAI,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;AACjD,IAAI,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACtD,IAAI,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AACzE,IAAI,IAAI,KAAK,EAAE;AACf,QAAQ,MAAM,gBAAgB,CAAC,YAAY,IAAI,KAAK,CAAC,CAAC;AACtD,KAAK;AACL,IAAI,IAAI,YAAY,KAAK,MAAM,EAAE;AACjC,QAAQ,OAAO,cAAc,CAAC;AAC9B,YAAY,UAAU;AACtB,YAAY,cAAc;AAC1B,YAAY,QAAQ;AACpB,YAAY,WAAW;AACvB,YAAY,MAAM;AAClB,YAAY,oBAAoB;AAChC,SAAS,CAAC,CAAC;AACX,KAAK;AACL,IAAI,OAAO,kBAAkB,CAAC;AAC9B,QAAQ,UAAU;AAClB,QAAQ,WAAW;AACnB,QAAQ,oBAAoB;AAC5B,KAAK,CAAC,CAAC;AACP,EAAE;AACF,MAAM,cAAc,GAAG,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,oBAAoB,GAAG,KAAK;AACvH;AACA;AACA,IAAI,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;AAC3C,IAAI,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC9C,IAAI,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAChD;AACA;AACA;AACA;AACA,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE;AACzB,QAAQ,MAAM,gBAAgB,CAAC,4BAA4B,CAAC,CAAC;AAC7D,KAAK;AACL;AACA,IAAI,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;AACtD,IAAI,MAAM,kBAAkB,GAAG,UAAU,GAAG,MAAM,GAAG,eAAe,CAAC;AACrE;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC;AACrD,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,UAAU,EAAE,oBAAoB;AACxC,QAAQ,IAAI;AACZ,QAAQ,SAAS,EAAE,QAAQ;AAC3B,QAAQ,YAAY,EAAE,WAAW;AACjC,QAAQ,IAAI,YAAY,GAAG,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;AAChE,KAAK,CAAC;AACN,IAAI,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC;AAC/C,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7E,SAAS,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,IAAI,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,kBAAkB,EAAE;AACxK,QAAQ,MAAM,EAAE,MAAM;AACtB,QAAQ,OAAO,EAAE;AACjB,YAAY,cAAc,EAAE,mCAAmC;AAC/D,YAAY,CAAC,iBAAiB,GAAG,cAAc;AAC/C,SAAS;AACT,QAAQ,IAAI;AACZ,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;AACf,IAAI,IAAI,KAAK,EAAE;AACf;AACA,QAAQ,MAAM,gBAAgB,CAAC,YAAY,IAAI,KAAK,CAAC,CAAC;AACtD,KAAK;AACL,IAAI,MAAM,QAAQ,GAAG,CAAC,YAAY,IAAI,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC;AAC9F,IAAI,MAAM,kBAAkB,CAAC;AAC7B,QAAQ,QAAQ;AAChB,QAAQ,WAAW,EAAE,YAAY;AACjC,QAAQ,OAAO,EAAE,QAAQ;AACzB,QAAQ,YAAY,EAAE,YAAY;AAClC,QAAQ,SAAS,EAAE,UAAU;AAC7B,QAAQ,SAAS,EAAE,UAAU;AAC7B,KAAK,CAAC,CAAC;AACP,IAAI,OAAO,YAAY,CAAC;AACxB,QAAQ,WAAW;AACnB,QAAQ,KAAK,EAAE,cAAc;AAC7B,QAAQ,oBAAoB;AAC5B,KAAK,CAAC,CAAC;AACP,CAAC,CAAC;AACF,MAAM,kBAAkB,GAAG,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,oBAAoB,GAAG,KAAK;AACzF;AACA,IAAI,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;AAC3C,IAAI,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG;AACjH,SAAS,SAAS,CAAC,CAAC,CAAC;AACrB,SAAS,KAAK,CAAC,GAAG,CAAC;AACnB,SAAS,GAAG,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC7C,SAAS,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;AAC3D,QAAQ,QAAQ,EAAE,SAAS;AAC3B,QAAQ,YAAY,EAAE,SAAS;AAC/B,QAAQ,KAAK,EAAE,SAAS;AACxB,QAAQ,UAAU,EAAE,SAAS;AAC7B,QAAQ,UAAU,EAAE,SAAS;AAC7B,QAAQ,iBAAiB,EAAE,SAAS;AACpC,QAAQ,KAAK,EAAE,SAAS;AACxB,KAAK,CAAC,CAAC;AACP,IAAI,IAAI,KAAK,EAAE;AACf,QAAQ,MAAM,gBAAgB,CAAC,iBAAiB,IAAI,KAAK,CAAC,CAAC;AAC3D,KAAK;AACL,IAAI,IAAI,CAAC,YAAY,EAAE;AACvB;AACA,QAAQ,MAAM,gBAAgB,CAAC,2CAA2C,CAAC,CAAC;AAC5E,KAAK;AACL,IAAI,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;AACtD,IAAI,MAAM,QAAQ,GAAG,CAAC,YAAY,IAAI,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC;AAC9F,IAAI,MAAM,kBAAkB,CAAC;AAC7B,QAAQ,QAAQ;AAChB,QAAQ,WAAW,EAAE,YAAY;AACjC,QAAQ,OAAO,EAAE,QAAQ;AACzB,QAAQ,SAAS,EAAE,UAAU;AAC7B,QAAQ,SAAS,EAAE,UAAU;AAC7B,KAAK,CAAC,CAAC;AACP,IAAI,OAAO,YAAY,CAAC;AACxB,QAAQ,WAAW;AACnB,QAAQ,KAAK,EAAE,cAAc;AAC7B,QAAQ,oBAAoB;AAC5B,KAAK,CAAC,CAAC;AACP,CAAC,CAAC;AACF,MAAM,YAAY,GAAG,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,oBAAoB,GAAG,KAAK;AAC9E,IAAI,MAAM,iBAAiB,CAAC,gBAAgB,CAAC;AAC7C,QAAQ,WAAW,EAAE,IAAI;AACzB,KAAK,CAAC,CAAC;AACP,IAAI,MAAM,UAAU,CAAC,cAAc,EAAE,CAAC;AACtC,IAAI,MAAM,UAAU,CAAC,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;AAClE;AACA;AACA;AACA,IAAI,+BAA+B,EAAE,CAAC;AACtC;AACA,IAAI,YAAY,CAAC,WAAW,CAAC,CAAC;AAC9B,IAAI,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE;AAC9B,QAAQ,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE;AAC7B,YAAY,KAAK,EAAE,kBAAkB;AACrC,YAAY,IAAI,EAAE,aAAa,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;AACtD,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;AACnC,KAAK;AACL,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;AAClF,IAAI,MAAM,wBAAwB,EAAE,CAAC;AACrC,CAAC,CAAC;AACF,MAAM,aAAa,GAAG,CAAC,KAAK,KAAK;AACjC,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC,CAAC;AACF,MAAM,cAAc,GAAG,CAAC,KAAK,KAAK;AAClC,IAAI,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChD,CAAC,CAAC;AACF,MAAM,YAAY,GAAG,CAAC,WAAW,KAAK;AACtC,IAAI,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,WAAW,EAAE;AAChF,QAAQ,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;AAC3E,KAAK;AACL,CAAC;;;;"}

package/package.json

@@ -1,108 +1,108 @@
 {
-	"name": "@aws-amplify/auth",
-	"version": "6.11.3",
-	"description": "Auth category of aws-amplify",
-	"main": "./dist/cjs/index.js",
-	"module": "./dist/esm/index.mjs",
-	"typings": "./dist/esm/index.d.ts",
-	"react-native": "./src/index.ts",
-	"sideEffects": [
-		"./dist/cjs/providers/cognito/apis/signInWithRedirect.js",
-		"./dist/esm/providers/cognito/apis/signInWithRedirect.mjs",
-		"./dist/cjs/providers/cognito/utils/oauth/enableOAuthListener.js",
-		"./dist/esm/providers/cognito/utils/oauth/enableOAuthListener.mjs"
-	],
-	"publishConfig": {
-		"access": "public"
-	},
-	"scripts": {
-		"test": "yarn lint --fix && jest -w 1 --coverage --logHeapUsage",
-		"build-with-test": "npm test && npm run build",
-		"build:umd": "webpack && webpack --config ./webpack.config.dev.js",
-		"build:esm-cjs": "rollup --forceExit -c rollup.config.mjs",
-		"build:watch": "npm run build:esm-cjs -- --watch",
-		"build": "npm run clean && npm run build:esm-cjs && npm run build:umd",
-		"clean": "npm run clean:size && rimraf lib-esm lib dist",
-		"clean:size": "rimraf dual-publish-tmp tmp*",
-		"format": "echo \"Not implemented\"",
-		"lint": "eslint '**/*.{ts,tsx}' && npm run ts-coverage",
-		"lint:fix": "eslint '**/*.{ts,tsx}' --fix",
-		"ts-coverage": "typescript-coverage-report -p ./tsconfig.build.json -t 91.18"
-	},
-	"typesVersions": {
-		">=4.2": {
-			"cognito": [
-				"./dist/esm/providers/cognito/index.d.ts"
-			],
-			"cognito/server": [
-				"./dist/esm/providers/cognito/apis/server/index.d.ts"
-			],
-			"server": [
-				"./dist/esm/server.d.ts"
-			]
-		}
-	},
-	"exports": {
-		".": {
-			"types": "./dist/esm/index.d.ts",
-			"import": "./dist/esm/index.mjs",
-			"require": "./dist/cjs/index.js",
-			"react-native": "./src/index.ts"
-		},
-		"./cognito": {
-			"types": "./dist/esm/providers/cognito/index.d.ts",
-			"import": "./dist/esm/providers/cognito/index.mjs",
-			"require": "./dist/cjs/providers/cognito/index.js",
-			"react-native": "./src/providers/cognito/index.ts"
-		},
-		"./cognito/server": {
-			"types": "./dist/esm/providers/cognito/apis/server/index.d.ts",
-			"import": "./dist/esm/providers/cognito/apis/server/index.mjs",
-			"require": "./dist/cjs/providers/cognito/apis/server/index.js"
-		},
-		"./server": {
-			"types": "./dist/esm/server.d.ts",
-			"import": "./dist/esm/server.mjs",
-			"require": "./dist/cjs/server.js"
-		},
-		"./enable-oauth-listener": {
-			"types": "./dist/esm/providers/cognito/utils/oauth/enableOAuthListener.d.ts",
-			"import": "./dist/esm/providers/cognito/utils/oauth/enableOAuthListener.mjs",
-			"require": "./dist/cjs/providers/cognito/utils/oauth/enableOAuthListener.js"
-		},
-		"./package.json": "./package.json"
-	},
-	"repository": {
-		"type": "git",
-		"url": "https://github.com/aws-amplify/amplify-js.git"
-	},
-	"author": "Amazon Web Services",
-	"license": "Apache-2.0",
-	"bugs": {
-		"url": "https://github.com/aws/aws-amplify/issues"
-	},
-	"homepage": "https://aws-amplify.github.io/",
-	"files": [
-		"dist/cjs",
-		"dist/esm",
-		"src",
-		"cognito",
-		"server",
-		"enable-oauth-listener"
-	],
-	"dependencies": {
-		"@aws-crypto/sha256-js": "5.2.0",
-		"@smithy/types": "^3.3.0",
-		"tslib": "^2.5.0"
-	},
-	"peerDependencies": {
-		"@aws-amplify/core": "^6.1.0"
-	},
-	"devDependencies": {
-		"@aws-amplify/core": "6.10.3",
-		"@aws-amplify/react-native": "1.1.7",
-		"@jest/test-sequencer": "^29.7.0",
-		"typescript": "5.0.2"
-	},
-	"gitHead": "eacdf1ae8dd0e011fd707b31548cf5fd8704d7b4"
+  "name": "@aws-amplify/auth",
+  "version": "6.11.4-Lerna-v8-testing.5bbeffa.0+5bbeffa",
+  "description": "Auth category of aws-amplify",
+  "main": "./dist/cjs/index.js",
+  "module": "./dist/esm/index.mjs",
+  "typings": "./dist/esm/index.d.ts",
+  "react-native": "./src/index.ts",
+  "sideEffects": [
+    "./dist/cjs/providers/cognito/apis/signInWithRedirect.js",
+    "./dist/esm/providers/cognito/apis/signInWithRedirect.mjs",
+    "./dist/cjs/providers/cognito/utils/oauth/enableOAuthListener.js",
+    "./dist/esm/providers/cognito/utils/oauth/enableOAuthListener.mjs"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "test": "yarn lint --fix && jest -w 1 --coverage --logHeapUsage",
+    "build-with-test": "npm test && npm run build",
+    "build:umd": "webpack && webpack --config ./webpack.config.dev.js",
+    "build:esm-cjs": "rollup --forceExit -c rollup.config.mjs",
+    "build:watch": "npm run build:esm-cjs -- --watch",
+    "build": "npm run clean && npm run build:esm-cjs && npm run build:umd",
+    "clean": "npm run clean:size && rimraf lib-esm lib dist",
+    "clean:size": "rimraf dual-publish-tmp tmp*",
+    "format": "echo \"Not implemented\"",
+    "lint": "eslint '**/*.{ts,tsx}' && npm run ts-coverage",
+    "lint:fix": "eslint '**/*.{ts,tsx}' --fix",
+    "ts-coverage": "typescript-coverage-report -p ./tsconfig.build.json -t 91.18"
+  },
+  "typesVersions": {
+    ">=4.2": {
+      "cognito": [
+        "./dist/esm/providers/cognito/index.d.ts"
+      ],
+      "cognito/server": [
+        "./dist/esm/providers/cognito/apis/server/index.d.ts"
+      ],
+      "server": [
+        "./dist/esm/server.d.ts"
+      ]
+    }
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/esm/index.d.ts",
+      "import": "./dist/esm/index.mjs",
+      "require": "./dist/cjs/index.js",
+      "react-native": "./src/index.ts"
+    },
+    "./cognito": {
+      "types": "./dist/esm/providers/cognito/index.d.ts",
+      "import": "./dist/esm/providers/cognito/index.mjs",
+      "require": "./dist/cjs/providers/cognito/index.js",
+      "react-native": "./src/providers/cognito/index.ts"
+    },
+    "./cognito/server": {
+      "types": "./dist/esm/providers/cognito/apis/server/index.d.ts",
+      "import": "./dist/esm/providers/cognito/apis/server/index.mjs",
+      "require": "./dist/cjs/providers/cognito/apis/server/index.js"
+    },
+    "./server": {
+      "types": "./dist/esm/server.d.ts",
+      "import": "./dist/esm/server.mjs",
+      "require": "./dist/cjs/server.js"
+    },
+    "./enable-oauth-listener": {
+      "types": "./dist/esm/providers/cognito/utils/oauth/enableOAuthListener.d.ts",
+      "import": "./dist/esm/providers/cognito/utils/oauth/enableOAuthListener.mjs",
+      "require": "./dist/cjs/providers/cognito/utils/oauth/enableOAuthListener.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/aws-amplify/amplify-js.git"
+  },
+  "author": "Amazon Web Services",
+  "license": "Apache-2.0",
+  "bugs": {
+    "url": "https://github.com/aws/aws-amplify/issues"
+  },
+  "homepage": "https://aws-amplify.github.io/",
+  "files": [
+    "dist/cjs",
+    "dist/esm",
+    "src",
+    "cognito",
+    "server",
+    "enable-oauth-listener"
+  ],
+  "dependencies": {
+    "@aws-crypto/sha256-js": "5.2.0",
+    "@smithy/types": "^3.3.0",
+    "tslib": "^2.5.0"
+  },
+  "peerDependencies": {
+    "@aws-amplify/core": "6.10.4-Lerna-v8-testing.5bbeffa.0+5bbeffa"
+  },
+  "devDependencies": {
+    "@aws-amplify/core": "6.10.4-Lerna-v8-testing.5bbeffa.0+5bbeffa",
+    "@aws-amplify/react-native": "1.1.8-Lerna-v8-testing.5bbeffa.0+5bbeffa",
+    "@jest/test-sequencer": "^29.7.0",
+    "typescript": "5.0.2"
+  },
+  "gitHead": "5bbeffa374af242a5100db1618268cabe1635985"
 }

package/src/providers/cognito/credentialsProvider/IdentityIdProvider.ts

@@ -1,7 +1,7 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import { AuthTokens, ConsoleLogger, Identity, getId } from '@aws-amplify/core';
+import { AuthTokens, Identity, getId } from '@aws-amplify/core';
 import { CognitoIdentityPoolConfig } from '@aws-amplify/core/internals/utils';
 
 import { AuthError } from '../../../errors/AuthError';
@@ -11,7 +11,6 @@ import { GetIdException } from '../types/errors';
 import { IdentityIdStore } from './types';
 import { formLoginsMap } from './utils';
 
-const logger = new ConsoleLogger('CognitoIdentityIdProvider');
 /**
  * Provides a Cognito identityId
  *
@@ -33,46 +32,22 @@ export async function cognitoIdentityIdProvider({
 	identityIdStore.setAuthConfig({ Cognito: authConfig });
 
 	// will return null only if there is no identityId cached or if there is an error retrieving it
-	let identityId: Identity | null = await identityIdStore.loadIdentityId();
+	const identityId: Identity | null = await identityIdStore.loadIdentityId();
 
-	// Tokens are available so return primary identityId
-	if (tokens) {
-		// If there is existing primary identityId in-memory return that
-		if (identityId && identityId.type === 'primary') {
-			return identityId.id;
-		} else {
-			const logins = tokens.idToken
-				? formLoginsMap(tokens.idToken.toString())
-				: {};
-
-			const generatedIdentityId = await generateIdentityId(logins, authConfig);
-
-			if (identityId && identityId.id === generatedIdentityId) {
-				logger.debug(
-					`The guest identity ${identityId.id} has become the primary identity.`,
-				);
-			}
-			identityId = {
-				id: generatedIdentityId,
-				type: 'primary',
-			};
-		}
-	} else {
-		// If there is existing guest identityId cached return that
-		if (identityId && identityId.type === 'guest') {
-			return identityId.id;
-		} else {
-			identityId = {
-				id: await generateIdentityId({}, authConfig),
-				type: 'guest',
-			};
-		}
+	if (identityId) {
+		return identityId.id;
 	}
+	const logins = tokens?.idToken
+		? formLoginsMap(tokens.idToken.toString())
+		: {};
+	const generatedIdentityId = await generateIdentityId(logins, authConfig);
+	// Store generated identityId
+	identityIdStore.storeIdentityId({
+		id: generatedIdentityId,
+		type: tokens ? 'primary' : 'guest',
+	});
 
-	// Store in-memory or local storage depending on guest or primary identityId
-	identityIdStore.storeIdentityId(identityId);
-
-	return identityId.id;
+	return generatedIdentityId;
 }
 
 async function generateIdentityId(

package/src/providers/cognito/credentialsProvider/credentialsProvider.ts

@@ -129,6 +129,7 @@ export class CognitoAWSCredentialsAndIdentityIdProvider
 			clientResult.Credentials.SecretKey
 		) {
 			this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;
+
 			const res: CredentialsAndIdentityId = {
 				credentials: {
 					accessKeyId: clientResult.Credentials.AccessKeyId,
@@ -138,11 +139,10 @@ export class CognitoAWSCredentialsAndIdentityIdProvider
 				},
 				identityId,
 			};
-			const identityIdRes = clientResult.IdentityId;
-			if (identityIdRes) {
-				res.identityId = identityIdRes;
+			if (clientResult.IdentityId) {
+				res.identityId = clientResult.IdentityId;
 				this._identityIdStore.storeIdentityId({
-					id: identityIdRes,
+					id: clientResult.IdentityId,
 					type: 'guest',
 				});
 			}
@@ -199,6 +199,8 @@ export class CognitoAWSCredentialsAndIdentityIdProvider
 			clientResult.Credentials.AccessKeyId &&
 			clientResult.Credentials.SecretKey
 		) {
+			this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;
+
 			const res: CredentialsAndIdentityId = {
 				credentials: {
 					accessKeyId: clientResult.Credentials.AccessKeyId,
@@ -208,22 +210,22 @@ export class CognitoAWSCredentialsAndIdentityIdProvider
 				},
 				identityId,
 			};
+
+			if (clientResult.IdentityId) {
+				res.identityId = clientResult.IdentityId;
+				// note: the following call removes guest identityId from the persistent store (localStorage)
+				this._identityIdStore.storeIdentityId({
+					id: clientResult.IdentityId,
+					type: 'primary',
+				});
+			}
+
 			// Store the credentials in-memory along with the expiration
 			this._credentialsAndIdentityId = {
 				...res,
 				isAuthenticatedCreds: true,
 				associatedIdToken: authTokens.idToken?.toString(),
 			};
-			this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;
-
-			const identityIdRes = clientResult.IdentityId;
-			if (identityIdRes) {
-				res.identityId = identityIdRes;
-				this._identityIdStore.storeIdentityId({
-					id: identityIdRes,
-					type: 'primary',
-				});
-			}
 
 			return res;
 		} else {

package/src/providers/cognito/utils/oauth/completeOAuthFlow.ts

@@ -239,6 +239,9 @@ const completeFlow = async ({
 	//  `fetchAuthSession` can be resolved
 	resolveAndClearInflightPromises();
 
+	// clear history before sending out final Hub events
+	clearHistory(redirectUri);
+
 	if (isCustomState(state)) {
 		Hub.dispatch(
 			'auth',
@@ -252,7 +255,6 @@ const completeFlow = async ({
 	}
 	Hub.dispatch('auth', { event: 'signInWithRedirect' }, 'Auth', AMPLIFY_SYMBOL);
 	await dispatchSignedInHubEvent();
-	clearHistory(redirectUri);
 };
 
 const isCustomState = (state: string): boolean => {