@aws-amplify/auth 6.11.6-unstable.cde36a7.0 → 6.11.7-unstable.b188564.0

package/dist/cjs/foundation/factories/serviceClients/cognitoIdentityProvider/shared/serde/createUserPoolDeserializer.js

@@ -11,7 +11,11 @@ const createUserPoolDeserializer = () => async (response) => {
     if (response.statusCode >= 300) {
         const error = await (0, aws_client_utils_1.parseJsonError)(response);
         (0, assertServiceError_1.assertServiceError)(error);
-        throw new AuthError_1.AuthError({ name: error.name, message: error.message });
+        throw new AuthError_1.AuthError({
+            name: error.name,
+            message: error.message,
+            metadata: error.$metadata,
+        });
     }
     return (0, aws_client_utils_1.parseJsonBody)(response);
 };

package/dist/cjs/foundation/factories/serviceClients/cognitoIdentityProvider/shared/serde/createUserPoolDeserializer.js.map

@@ -1 +1 @@
-{"version":3,"file":"createUserPoolDeserializer.js","sources":["../../../../../../../../src/foundation/factories/serviceClients/cognitoIdentityProvider/shared/serde/createUserPoolDeserializer.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.createUserPoolDeserializer = void 0;\nconst aws_client_utils_1 = require(\"@aws-amplify/core/internals/aws-client-utils\");\nconst assertServiceError_1 = require(\"../../../../../../errors/utils/assertServiceError\");\nconst AuthError_1 = require(\"../../../../../../errors/AuthError\");\nconst createUserPoolDeserializer = () => async (response) => {\n    if (response.statusCode >= 300) {\n        const error = await (0, aws_client_utils_1.parseJsonError)(response);\n        (0, assertServiceError_1.assertServiceError)(error);\n        throw new AuthError_1.AuthError({ name: error.name, message: error.message });\n    }\n    return (0, aws_client_utils_1.parseJsonBody)(response);\n};\nexports.createUserPoolDeserializer = createUserPoolDeserializer;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC7D,OAAO,CAAC,0BAA0B,GAAG,MAAM;AAC3C,MAAM,kBAAkB,GAAG,OAAO,CAAC,8CAA8C,CAAC;AAClF,MAAM,oBAAoB,GAAG,OAAO,CAAC,mDAAmD,CAAC;AACzF,MAAM,WAAW,GAAG,OAAO,CAAC,oCAAoC,CAAC;AACjE,MAAM,0BAA0B,GAAG,MAAM,OAAO,QAAQ,KAAK;AAC7D,IAAI,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE;AACpC,QAAQ,MAAM,KAAK,GAAG,MAAM,IAAI,kBAAkB,CAAC,cAAc,EAAE,QAAQ,CAAC;AAC5E,QAAQ,IAAI,oBAAoB,CAAC,kBAAkB,EAAE,KAAK,CAAC;AAC3D,QAAQ,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;AACrF;AACA,IAAI,OAAO,IAAI,kBAAkB,CAAC,aAAa,EAAE,QAAQ,CAAC;AAC1D,CAAC;AACD,OAAO,CAAC,0BAA0B,GAAG,0BAA0B;;"}
+{"version":3,"file":"createUserPoolDeserializer.js","sources":["../../../../../../../../src/foundation/factories/serviceClients/cognitoIdentityProvider/shared/serde/createUserPoolDeserializer.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.createUserPoolDeserializer = void 0;\nconst aws_client_utils_1 = require(\"@aws-amplify/core/internals/aws-client-utils\");\nconst assertServiceError_1 = require(\"../../../../../../errors/utils/assertServiceError\");\nconst AuthError_1 = require(\"../../../../../../errors/AuthError\");\nconst createUserPoolDeserializer = () => async (response) => {\n    if (response.statusCode >= 300) {\n        const error = await (0, aws_client_utils_1.parseJsonError)(response);\n        (0, assertServiceError_1.assertServiceError)(error);\n        throw new AuthError_1.AuthError({\n            name: error.name,\n            message: error.message,\n            metadata: error.$metadata,\n        });\n    }\n    return (0, aws_client_utils_1.parseJsonBody)(response);\n};\nexports.createUserPoolDeserializer = createUserPoolDeserializer;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC7D,OAAO,CAAC,0BAA0B,GAAG,MAAM;AAC3C,MAAM,kBAAkB,GAAG,OAAO,CAAC,8CAA8C,CAAC;AAClF,MAAM,oBAAoB,GAAG,OAAO,CAAC,mDAAmD,CAAC;AACzF,MAAM,WAAW,GAAG,OAAO,CAAC,oCAAoC,CAAC;AACjE,MAAM,0BAA0B,GAAG,MAAM,OAAO,QAAQ,KAAK;AAC7D,IAAI,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE;AACpC,QAAQ,MAAM,KAAK,GAAG,MAAM,IAAI,kBAAkB,CAAC,cAAc,EAAE,QAAQ,CAAC;AAC5E,QAAQ,IAAI,oBAAoB,CAAC,kBAAkB,EAAE,KAAK,CAAC;AAC3D,QAAQ,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC;AACxC,YAAY,IAAI,EAAE,KAAK,CAAC,IAAI;AAC5B,YAAY,OAAO,EAAE,KAAK,CAAC,OAAO;AAClC,YAAY,QAAQ,EAAE,KAAK,CAAC,SAAS;AACrC,SAAS,CAAC;AACV;AACA,IAAI,OAAO,IAAI,kBAAkB,CAAC,aAAa,EAAE,QAAQ,CAAC;AAC1D,CAAC;AACD,OAAO,CAAC,0BAA0B,GAAG,0BAA0B;;"}

package/dist/cjs/providers/cognito/credentialsProvider/IdentityIdProvider.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.cognitoIdentityIdProvider = void 0;
 const core_1 = require("@aws-amplify/core");
 const AuthError_1 = require("../../../errors/AuthError");
+const assertServiceError_1 = require("../../../errors/utils/assertServiceError");
 const parsers_1 = require("../../../foundation/parsers");
 const utils_1 = require("./utils");
 /**
@@ -40,15 +41,21 @@ async function generateIdentityId(logins, authConfig) {
     const identityPoolId = authConfig?.identityPoolId;
     const region = (0, parsers_1.getRegionFromIdentityPoolId)(identityPoolId);
     // IdentityId is absent so get it using IdentityPoolId with Cognito's GetId API
-    const idResult = 
+    let idResult;
     // for a first-time user, this will return a brand new identity
     // for a returning user, this will retrieve the previous identity assocaited with the logins
-    (await (0, core_1.getId)({
-        region,
-    }, {
-        IdentityPoolId: identityPoolId,
-        Logins: logins,
-    })).IdentityId;
+    try {
+        idResult = (await (0, core_1.getId)({
+            region,
+        }, {
+            IdentityPoolId: identityPoolId,
+            Logins: logins,
+        })).IdentityId;
+    }
+    catch (e) {
+        (0, assertServiceError_1.assertServiceError)(e);
+        throw new AuthError_1.AuthError(e);
+    }
     if (!idResult) {
         throw new AuthError_1.AuthError({
             name: 'GetIdResponseException',

package/dist/cjs/providers/cognito/credentialsProvider/IdentityIdProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityIdProvider.js","sources":["../../../../../src/providers/cognito/credentialsProvider/IdentityIdProvider.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.cognitoIdentityIdProvider = void 0;\nconst core_1 = require(\"@aws-amplify/core\");\nconst AuthError_1 = require(\"../../../errors/AuthError\");\nconst parsers_1 = require(\"../../../foundation/parsers\");\nconst utils_1 = require(\"./utils\");\n/**\n * Provides a Cognito identityId\n *\n * @param tokens - The AuthTokens received after SignIn\n * @returns string\n * @throws configuration exceptions: `InvalidIdentityPoolIdException`\n *  - Auth errors that may arise from misconfiguration.\n * @throws service exceptions: {@link GetIdException }\n */\nasync function cognitoIdentityIdProvider({ tokens, authConfig, identityIdStore, }) {\n    identityIdStore.setAuthConfig({ Cognito: authConfig });\n    // will return null only if there is no identityId cached or if there is an error retrieving it\n    const identityId = await identityIdStore.loadIdentityId();\n    if (identityId) {\n        return identityId.id;\n    }\n    const logins = tokens?.idToken\n        ? (0, utils_1.formLoginsMap)(tokens.idToken.toString())\n        : {};\n    const generatedIdentityId = await generateIdentityId(logins, authConfig);\n    // Store generated identityId\n    identityIdStore.storeIdentityId({\n        id: generatedIdentityId,\n        type: tokens ? 'primary' : 'guest',\n    });\n    return generatedIdentityId;\n}\nexports.cognitoIdentityIdProvider = cognitoIdentityIdProvider;\nasync function generateIdentityId(logins, authConfig) {\n    const identityPoolId = authConfig?.identityPoolId;\n    const region = (0, parsers_1.getRegionFromIdentityPoolId)(identityPoolId);\n    // IdentityId is absent so get it using IdentityPoolId with Cognito's GetId API\n    const idResult = \n    // for a first-time user, this will return a brand new identity\n    // for a returning user, this will retrieve the previous identity assocaited with the logins\n    (await (0, core_1.getId)({\n        region,\n    }, {\n        IdentityPoolId: identityPoolId,\n        Logins: logins,\n    })).IdentityId;\n    if (!idResult) {\n        throw new AuthError_1.AuthError({\n            name: 'GetIdResponseException',\n            message: 'Received undefined response from getId operation',\n            recoverySuggestion: 'Make sure to pass a valid identityPoolId in the configuration.',\n        });\n    }\n    return idResult;\n}\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC7D,OAAO,CAAC,yBAAyB,GAAG,MAAM;AAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;AAC3C,MAAM,WAAW,GAAG,OAAO,CAAC,2BAA2B,CAAC;AACxD,MAAM,SAAS,GAAG,OAAO,CAAC,6BAA6B,CAAC;AACxD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;AAClC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,yBAAyB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,GAAG,EAAE;AACnF,IAAI,eAAe,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AAC1D;AACA,IAAI,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,cAAc,EAAE;AAC7D,IAAI,IAAI,UAAU,EAAE;AACpB,QAAQ,OAAO,UAAU,CAAC,EAAE;AAC5B;AACA,IAAI,MAAM,MAAM,GAAG,MAAM,EAAE;AAC3B,UAAU,IAAI,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE;AAC9D,UAAU,EAAE;AACZ,IAAI,MAAM,mBAAmB,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC;AAC5E;AACA,IAAI,eAAe,CAAC,eAAe,CAAC;AACpC,QAAQ,EAAE,EAAE,mBAAmB;AAC/B,QAAQ,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;AAC1C,KAAK,CAAC;AACN,IAAI,OAAO,mBAAmB;AAC9B;AACA,OAAO,CAAC,yBAAyB,GAAG,yBAAyB;AAC7D,eAAe,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE;AACtD,IAAI,MAAM,cAAc,GAAG,UAAU,EAAE,cAAc;AACrD,IAAI,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,2BAA2B,EAAE,cAAc,CAAC;AAC7E;AACA,IAAI,MAAM,QAAQ;AAClB;AACA;AACA,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,EAAE;AAC7B,QAAQ,MAAM;AACd,KAAK,EAAE;AACP,QAAQ,cAAc,EAAE,cAAc;AACtC,QAAQ,MAAM,EAAE,MAAM;AACtB,KAAK,CAAC,EAAE,UAAU;AAClB,IAAI,IAAI,CAAC,QAAQ,EAAE;AACnB,QAAQ,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC;AACxC,YAAY,IAAI,EAAE,wBAAwB;AAC1C,YAAY,OAAO,EAAE,kDAAkD;AACvE,YAAY,kBAAkB,EAAE,gEAAgE;AAChG,SAAS,CAAC;AACV;AACA,IAAI,OAAO,QAAQ;AACnB;;"}
+{"version":3,"file":"IdentityIdProvider.js","sources":["../../../../../src/providers/cognito/credentialsProvider/IdentityIdProvider.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.cognitoIdentityIdProvider = void 0;\nconst core_1 = require(\"@aws-amplify/core\");\nconst AuthError_1 = require(\"../../../errors/AuthError\");\nconst assertServiceError_1 = require(\"../../../errors/utils/assertServiceError\");\nconst parsers_1 = require(\"../../../foundation/parsers\");\nconst utils_1 = require(\"./utils\");\n/**\n * Provides a Cognito identityId\n *\n * @param tokens - The AuthTokens received after SignIn\n * @returns string\n * @throws configuration exceptions: `InvalidIdentityPoolIdException`\n *  - Auth errors that may arise from misconfiguration.\n * @throws service exceptions: {@link GetIdException }\n */\nasync function cognitoIdentityIdProvider({ tokens, authConfig, identityIdStore, }) {\n    identityIdStore.setAuthConfig({ Cognito: authConfig });\n    // will return null only if there is no identityId cached or if there is an error retrieving it\n    const identityId = await identityIdStore.loadIdentityId();\n    if (identityId) {\n        return identityId.id;\n    }\n    const logins = tokens?.idToken\n        ? (0, utils_1.formLoginsMap)(tokens.idToken.toString())\n        : {};\n    const generatedIdentityId = await generateIdentityId(logins, authConfig);\n    // Store generated identityId\n    identityIdStore.storeIdentityId({\n        id: generatedIdentityId,\n        type: tokens ? 'primary' : 'guest',\n    });\n    return generatedIdentityId;\n}\nexports.cognitoIdentityIdProvider = cognitoIdentityIdProvider;\nasync function generateIdentityId(logins, authConfig) {\n    const identityPoolId = authConfig?.identityPoolId;\n    const region = (0, parsers_1.getRegionFromIdentityPoolId)(identityPoolId);\n    // IdentityId is absent so get it using IdentityPoolId with Cognito's GetId API\n    let idResult;\n    // for a first-time user, this will return a brand new identity\n    // for a returning user, this will retrieve the previous identity assocaited with the logins\n    try {\n        idResult = (await (0, core_1.getId)({\n            region,\n        }, {\n            IdentityPoolId: identityPoolId,\n            Logins: logins,\n        })).IdentityId;\n    }\n    catch (e) {\n        (0, assertServiceError_1.assertServiceError)(e);\n        throw new AuthError_1.AuthError(e);\n    }\n    if (!idResult) {\n        throw new AuthError_1.AuthError({\n            name: 'GetIdResponseException',\n            message: 'Received undefined response from getId operation',\n            recoverySuggestion: 'Make sure to pass a valid identityPoolId in the configuration.',\n        });\n    }\n    return idResult;\n}\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC7D,OAAO,CAAC,yBAAyB,GAAG,MAAM;AAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;AAC3C,MAAM,WAAW,GAAG,OAAO,CAAC,2BAA2B,CAAC;AACxD,MAAM,oBAAoB,GAAG,OAAO,CAAC,0CAA0C,CAAC;AAChF,MAAM,SAAS,GAAG,OAAO,CAAC,6BAA6B,CAAC;AACxD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;AAClC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,yBAAyB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,GAAG,EAAE;AACnF,IAAI,eAAe,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AAC1D;AACA,IAAI,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,cAAc,EAAE;AAC7D,IAAI,IAAI,UAAU,EAAE;AACpB,QAAQ,OAAO,UAAU,CAAC,EAAE;AAC5B;AACA,IAAI,MAAM,MAAM,GAAG,MAAM,EAAE;AAC3B,UAAU,IAAI,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE;AAC9D,UAAU,EAAE;AACZ,IAAI,MAAM,mBAAmB,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC;AAC5E;AACA,IAAI,eAAe,CAAC,eAAe,CAAC;AACpC,QAAQ,EAAE,EAAE,mBAAmB;AAC/B,QAAQ,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;AAC1C,KAAK,CAAC;AACN,IAAI,OAAO,mBAAmB;AAC9B;AACA,OAAO,CAAC,yBAAyB,GAAG,yBAAyB;AAC7D,eAAe,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE;AACtD,IAAI,MAAM,cAAc,GAAG,UAAU,EAAE,cAAc;AACrD,IAAI,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,2BAA2B,EAAE,cAAc,CAAC;AAC7E;AACA,IAAI,IAAI,QAAQ;AAChB;AACA;AACA,IAAI,IAAI;AACR,QAAQ,QAAQ,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE;AAC5C,YAAY,MAAM;AAClB,SAAS,EAAE;AACX,YAAY,cAAc,EAAE,cAAc;AAC1C,YAAY,MAAM,EAAE,MAAM;AAC1B,SAAS,CAAC,EAAE,UAAU;AACtB;AACA,IAAI,OAAO,CAAC,EAAE;AACd,QAAQ,IAAI,oBAAoB,CAAC,kBAAkB,EAAE,CAAC,CAAC;AACvD,QAAQ,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;AAC1C;AACA,IAAI,IAAI,CAAC,QAAQ,EAAE;AACnB,QAAQ,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC;AACxC,YAAY,IAAI,EAAE,wBAAwB;AAC1C,YAAY,OAAO,EAAE,kDAAkD;AACvE,YAAY,kBAAkB,EAAE,gEAAgE;AAChG,SAAS,CAAC;AACV;AACA,IAAI,OAAO,QAAQ;AACnB;;"}

package/dist/cjs/providers/cognito/credentialsProvider/credentialsProvider.js

@@ -7,6 +7,7 @@ exports.CognitoAWSCredentialsAndIdentityIdProvider = void 0;
 const core_1 = require("@aws-amplify/core");
 const utils_1 = require("@aws-amplify/core/internals/utils");
 const AuthError_1 = require("../../../errors/AuthError");
+const assertServiceError_1 = require("../../../errors/utils/assertServiceError");
 const parsers_1 = require("../../../foundation/parsers");
 const types_1 = require("../utils/types");
 const IdentityIdProvider_1 = require("./IdentityIdProvider");
@@ -76,12 +77,18 @@ class CognitoAWSCredentialsAndIdentityIdProvider {
         // save credentials in-memory
         // No logins params should be passed for guest creds:
         // https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetCredentialsForIdentity.html
-        const clientResult = await (0, core_1.getCredentialsForIdentity)({ region }, {
-            IdentityId: identityId,
-        });
-        if (clientResult.Credentials &&
-            clientResult.Credentials.AccessKeyId &&
-            clientResult.Credentials.SecretKey) {
+        let clientResult;
+        try {
+            clientResult = await (0, core_1.getCredentialsForIdentity)({ region }, {
+                IdentityId: identityId,
+            });
+        }
+        catch (e) {
+            (0, assertServiceError_1.assertServiceError)(e);
+            throw new AuthError_1.AuthError(e);
+        }
+        if (clientResult?.Credentials?.AccessKeyId &&
+            clientResult?.Credentials?.SecretKey) {
             this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;
             const res = {
                 credentials: {
@@ -125,13 +132,19 @@ class CognitoAWSCredentialsAndIdentityIdProvider {
             ? (0, utils_2.formLoginsMap)(authTokens.idToken.toString())
             : {};
         const region = (0, parsers_1.getRegionFromIdentityPoolId)(authConfig.identityPoolId);
-        const clientResult = await (0, core_1.getCredentialsForIdentity)({ region }, {
-            IdentityId: identityId,
-            Logins: logins,
-        });
-        if (clientResult.Credentials &&
-            clientResult.Credentials.AccessKeyId &&
-            clientResult.Credentials.SecretKey) {
+        let clientResult;
+        try {
+            clientResult = await (0, core_1.getCredentialsForIdentity)({ region }, {
+                IdentityId: identityId,
+                Logins: logins,
+            });
+        }
+        catch (e) {
+            (0, assertServiceError_1.assertServiceError)(e);
+            throw new AuthError_1.AuthError(e);
+        }
+        if (clientResult?.Credentials?.AccessKeyId &&
+            clientResult?.Credentials?.SecretKey) {
             this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;
             const res = {
                 credentials: {

package/dist/cjs/providers/cognito/credentialsProvider/credentialsProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentialsProvider.js","sources":["../../../../../src/providers/cognito/credentialsProvider/credentialsProvider.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.CognitoAWSCredentialsAndIdentityIdProvider = void 0;\nconst core_1 = require(\"@aws-amplify/core\");\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nconst AuthError_1 = require(\"../../../errors/AuthError\");\nconst parsers_1 = require(\"../../../foundation/parsers\");\nconst types_1 = require(\"../utils/types\");\nconst IdentityIdProvider_1 = require(\"./IdentityIdProvider\");\nconst utils_2 = require(\"./utils\");\nconst logger = new core_1.ConsoleLogger('CognitoCredentialsProvider');\nconst CREDENTIALS_TTL = 50 * 60 * 1000; // 50 min, can be modified on config if required in the future\nclass CognitoAWSCredentialsAndIdentityIdProvider {\n    constructor(identityIdStore) {\n        this._nextCredentialsRefresh = 0;\n        this._identityIdStore = identityIdStore;\n    }\n    async clearCredentialsAndIdentityId() {\n        logger.debug('Clearing out credentials and identityId');\n        this._credentialsAndIdentityId = undefined;\n        await this._identityIdStore.clearIdentityId();\n    }\n    async clearCredentials() {\n        logger.debug('Clearing out in-memory credentials');\n        this._credentialsAndIdentityId = undefined;\n    }\n    async getCredentialsAndIdentityId(getCredentialsOptions) {\n        const isAuthenticated = getCredentialsOptions.authenticated;\n        const { tokens } = getCredentialsOptions;\n        const { authConfig } = getCredentialsOptions;\n        try {\n            (0, utils_1.assertIdentityPoolIdConfig)(authConfig?.Cognito);\n        }\n        catch {\n            // No identity pool configured, skipping\n            return;\n        }\n        if (!isAuthenticated && !authConfig.Cognito.allowGuestAccess) {\n            // TODO(V6): return partial result like Native platforms\n            return;\n        }\n        const { forceRefresh } = getCredentialsOptions;\n        const tokenHasChanged = this.hasTokenChanged(tokens);\n        const identityId = await (0, IdentityIdProvider_1.cognitoIdentityIdProvider)({\n            tokens,\n            authConfig: authConfig.Cognito,\n            identityIdStore: this._identityIdStore,\n        });\n        // Clear cached credentials when forceRefresh is true OR the cache token has changed\n        if (forceRefresh || tokenHasChanged) {\n            this.clearCredentials();\n        }\n        if (!isAuthenticated) {\n            return this.getGuestCredentials(identityId, authConfig.Cognito);\n        }\n        else {\n            (0, types_1.assertIdTokenInAuthTokens)(tokens);\n            return this.credsForOIDCTokens(authConfig.Cognito, tokens, identityId);\n        }\n    }\n    async getGuestCredentials(identityId, authConfig) {\n        // Return existing in-memory cached credentials only if it exists, is not past it's lifetime and is unauthenticated credentials\n        if (this._credentialsAndIdentityId &&\n            !this.isPastTTL() &&\n            this._credentialsAndIdentityId.isAuthenticatedCreds === false) {\n            logger.info('returning stored credentials as they neither past TTL nor expired.');\n            return this._credentialsAndIdentityId;\n        }\n        // Clear to discard if any authenticated credentials are set and start with a clean slate\n        this.clearCredentials();\n        const region = (0, parsers_1.getRegionFromIdentityPoolId)(authConfig.identityPoolId);\n        // use identityId to obtain guest credentials\n        // save credentials in-memory\n        // No logins params should be passed for guest creds:\n        // https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetCredentialsForIdentity.html\n        const clientResult = await (0, core_1.getCredentialsForIdentity)({ region }, {\n            IdentityId: identityId,\n        });\n        if (clientResult.Credentials &&\n            clientResult.Credentials.AccessKeyId &&\n            clientResult.Credentials.SecretKey) {\n            this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;\n            const res = {\n                credentials: {\n                    accessKeyId: clientResult.Credentials.AccessKeyId,\n                    secretAccessKey: clientResult.Credentials.SecretKey,\n                    sessionToken: clientResult.Credentials.SessionToken,\n                    expiration: clientResult.Credentials.Expiration,\n                },\n                identityId,\n            };\n            if (clientResult.IdentityId) {\n                res.identityId = clientResult.IdentityId;\n                this._identityIdStore.storeIdentityId({\n                    id: clientResult.IdentityId,\n                    type: 'guest',\n                });\n            }\n            this._credentialsAndIdentityId = {\n                ...res,\n                isAuthenticatedCreds: false,\n            };\n            return res;\n        }\n        else {\n            throw new AuthError_1.AuthError({\n                name: 'CredentialsNotFoundException',\n                message: `Cognito did not respond with either Credentials, AccessKeyId or SecretKey.`,\n            });\n        }\n    }\n    async credsForOIDCTokens(authConfig, authTokens, identityId) {\n        if (this._credentialsAndIdentityId &&\n            !this.isPastTTL() &&\n            this._credentialsAndIdentityId.isAuthenticatedCreds === true) {\n            logger.debug('returning stored credentials as they neither past TTL nor expired.');\n            return this._credentialsAndIdentityId;\n        }\n        // Clear to discard if any unauthenticated credentials are set and start with a clean slate\n        this.clearCredentials();\n        const logins = authTokens.idToken\n            ? (0, utils_2.formLoginsMap)(authTokens.idToken.toString())\n            : {};\n        const region = (0, parsers_1.getRegionFromIdentityPoolId)(authConfig.identityPoolId);\n        const clientResult = await (0, core_1.getCredentialsForIdentity)({ region }, {\n            IdentityId: identityId,\n            Logins: logins,\n        });\n        if (clientResult.Credentials &&\n            clientResult.Credentials.AccessKeyId &&\n            clientResult.Credentials.SecretKey) {\n            this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;\n            const res = {\n                credentials: {\n                    accessKeyId: clientResult.Credentials.AccessKeyId,\n                    secretAccessKey: clientResult.Credentials.SecretKey,\n                    sessionToken: clientResult.Credentials.SessionToken,\n                    expiration: clientResult.Credentials.Expiration,\n                },\n                identityId,\n            };\n            if (clientResult.IdentityId) {\n                res.identityId = clientResult.IdentityId;\n                // note: the following call removes guest identityId from the persistent store (localStorage)\n                this._identityIdStore.storeIdentityId({\n                    id: clientResult.IdentityId,\n                    type: 'primary',\n                });\n            }\n            // Store the credentials in-memory along with the expiration\n            this._credentialsAndIdentityId = {\n                ...res,\n                isAuthenticatedCreds: true,\n                associatedIdToken: authTokens.idToken?.toString(),\n            };\n            return res;\n        }\n        else {\n            throw new AuthError_1.AuthError({\n                name: 'CredentialsException',\n                message: `Cognito did not respond with either Credentials, AccessKeyId or SecretKey.`,\n            });\n        }\n    }\n    isPastTTL() {\n        return this._nextCredentialsRefresh === undefined\n            ? true\n            : this._nextCredentialsRefresh <= Date.now();\n    }\n    hasTokenChanged(tokens) {\n        return (!!tokens &&\n            !!this._credentialsAndIdentityId?.associatedIdToken &&\n            tokens.idToken?.toString() !==\n                this._credentialsAndIdentityId.associatedIdToken);\n    }\n}\nexports.CognitoAWSCredentialsAndIdentityIdProvider = CognitoAWSCredentialsAndIdentityIdProvider;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC7D,OAAO,CAAC,0CAA0C,GAAG,MAAM;AAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;AAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC;AAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,2BAA2B,CAAC;AACxD,MAAM,SAAS,GAAG,OAAO,CAAC,6BAA6B,CAAC;AACxD,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACzC,MAAM,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC;AAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;AAClC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,aAAa,CAAC,4BAA4B,CAAC;AACrE,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,MAAM,0CAA0C,CAAC;AACjD,IAAI,WAAW,CAAC,eAAe,EAAE;AACjC,QAAQ,IAAI,CAAC,uBAAuB,GAAG,CAAC;AACxC,QAAQ,IAAI,CAAC,gBAAgB,GAAG,eAAe;AAC/C;AACA,IAAI,MAAM,6BAA6B,GAAG;AAC1C,QAAQ,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC;AAC/D,QAAQ,IAAI,CAAC,yBAAyB,GAAG,SAAS;AAClD,QAAQ,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE;AACrD;AACA,IAAI,MAAM,gBAAgB,GAAG;AAC7B,QAAQ,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC;AAC1D,QAAQ,IAAI,CAAC,yBAAyB,GAAG,SAAS;AAClD;AACA,IAAI,MAAM,2BAA2B,CAAC,qBAAqB,EAAE;AAC7D,QAAQ,MAAM,eAAe,GAAG,qBAAqB,CAAC,aAAa;AACnE,QAAQ,MAAM,EAAE,MAAM,EAAE,GAAG,qBAAqB;AAChD,QAAQ,MAAM,EAAE,UAAU,EAAE,GAAG,qBAAqB;AACpD,QAAQ,IAAI;AACZ,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,0BAA0B,EAAE,UAAU,EAAE,OAAO,CAAC;AACxE;AACA,QAAQ,MAAM;AACd;AACA,YAAY;AACZ;AACA,QAAQ,IAAI,CAAC,eAAe,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,EAAE;AACtE;AACA,YAAY;AACZ;AACA,QAAQ,MAAM,EAAE,YAAY,EAAE,GAAG,qBAAqB;AACtD,QAAQ,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;AAC5D,QAAQ,MAAM,UAAU,GAAG,MAAM,IAAI,oBAAoB,CAAC,yBAAyB,EAAE;AACrF,YAAY,MAAM;AAClB,YAAY,UAAU,EAAE,UAAU,CAAC,OAAO;AAC1C,YAAY,eAAe,EAAE,IAAI,CAAC,gBAAgB;AAClD,SAAS,CAAC;AACV;AACA,QAAQ,IAAI,YAAY,IAAI,eAAe,EAAE;AAC7C,YAAY,IAAI,CAAC,gBAAgB,EAAE;AACnC;AACA,QAAQ,IAAI,CAAC,eAAe,EAAE;AAC9B,YAAY,OAAO,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC;AAC3E;AACA,aAAa;AACb,YAAY,IAAI,OAAO,CAAC,yBAAyB,EAAE,MAAM,CAAC;AAC1D,YAAY,OAAO,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC;AAClF;AACA;AACA,IAAI,MAAM,mBAAmB,CAAC,UAAU,EAAE,UAAU,EAAE;AACtD;AACA,QAAQ,IAAI,IAAI,CAAC,yBAAyB;AAC1C,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE;AAC7B,YAAY,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,KAAK,KAAK,EAAE;AAC3E,YAAY,MAAM,CAAC,IAAI,CAAC,oEAAoE,CAAC;AAC7F,YAAY,OAAO,IAAI,CAAC,yBAAyB;AACjD;AACA;AACA,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,QAAQ,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,2BAA2B,EAAE,UAAU,CAAC,cAAc,CAAC;AAC5F;AACA;AACA;AACA;AACA,QAAQ,MAAM,YAAY,GAAG,MAAM,IAAI,MAAM,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,EAAE;AACrF,YAAY,UAAU,EAAE,UAAU;AAClC,SAAS,CAAC;AACV,QAAQ,IAAI,YAAY,CAAC,WAAW;AACpC,YAAY,YAAY,CAAC,WAAW,CAAC,WAAW;AAChD,YAAY,YAAY,CAAC,WAAW,CAAC,SAAS,EAAE;AAChD,YAAY,IAAI,CAAC,uBAAuB,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,eAAe;AACjF,YAAY,MAAM,GAAG,GAAG;AACxB,gBAAgB,WAAW,EAAE;AAC7B,oBAAoB,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC,WAAW;AACrE,oBAAoB,eAAe,EAAE,YAAY,CAAC,WAAW,CAAC,SAAS;AACvE,oBAAoB,YAAY,EAAE,YAAY,CAAC,WAAW,CAAC,YAAY;AACvE,oBAAoB,UAAU,EAAE,YAAY,CAAC,WAAW,CAAC,UAAU;AACnE,iBAAiB;AACjB,gBAAgB,UAAU;AAC1B,aAAa;AACb,YAAY,IAAI,YAAY,CAAC,UAAU,EAAE;AACzC,gBAAgB,GAAG,CAAC,UAAU,GAAG,YAAY,CAAC,UAAU;AACxD,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;AACtD,oBAAoB,EAAE,EAAE,YAAY,CAAC,UAAU;AAC/C,oBAAoB,IAAI,EAAE,OAAO;AACjC,iBAAiB,CAAC;AAClB;AACA,YAAY,IAAI,CAAC,yBAAyB,GAAG;AAC7C,gBAAgB,GAAG,GAAG;AACtB,gBAAgB,oBAAoB,EAAE,KAAK;AAC3C,aAAa;AACb,YAAY,OAAO,GAAG;AACtB;AACA,aAAa;AACb,YAAY,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC;AAC5C,gBAAgB,IAAI,EAAE,8BAA8B;AACpD,gBAAgB,OAAO,EAAE,CAAC,0EAA0E,CAAC;AACrG,aAAa,CAAC;AACd;AACA;AACA,IAAI,MAAM,kBAAkB,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE;AACjE,QAAQ,IAAI,IAAI,CAAC,yBAAyB;AAC1C,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE;AAC7B,YAAY,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,KAAK,IAAI,EAAE;AAC1E,YAAY,MAAM,CAAC,KAAK,CAAC,oEAAoE,CAAC;AAC9F,YAAY,OAAO,IAAI,CAAC,yBAAyB;AACjD;AACA;AACA,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,QAAQ,MAAM,MAAM,GAAG,UAAU,CAAC;AAClC,cAAc,IAAI,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE;AACtE,cAAc,EAAE;AAChB,QAAQ,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,2BAA2B,EAAE,UAAU,CAAC,cAAc,CAAC;AAC5F,QAAQ,MAAM,YAAY,GAAG,MAAM,IAAI,MAAM,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,EAAE;AACrF,YAAY,UAAU,EAAE,UAAU;AAClC,YAAY,MAAM,EAAE,MAAM;AAC1B,SAAS,CAAC;AACV,QAAQ,IAAI,YAAY,CAAC,WAAW;AACpC,YAAY,YAAY,CAAC,WAAW,CAAC,WAAW;AAChD,YAAY,YAAY,CAAC,WAAW,CAAC,SAAS,EAAE;AAChD,YAAY,IAAI,CAAC,uBAAuB,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,eAAe;AACjF,YAAY,MAAM,GAAG,GAAG;AACxB,gBAAgB,WAAW,EAAE;AAC7B,oBAAoB,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC,WAAW;AACrE,oBAAoB,eAAe,EAAE,YAAY,CAAC,WAAW,CAAC,SAAS;AACvE,oBAAoB,YAAY,EAAE,YAAY,CAAC,WAAW,CAAC,YAAY;AACvE,oBAAoB,UAAU,EAAE,YAAY,CAAC,WAAW,CAAC,UAAU;AACnE,iBAAiB;AACjB,gBAAgB,UAAU;AAC1B,aAAa;AACb,YAAY,IAAI,YAAY,CAAC,UAAU,EAAE;AACzC,gBAAgB,GAAG,CAAC,UAAU,GAAG,YAAY,CAAC,UAAU;AACxD;AACA,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;AACtD,oBAAoB,EAAE,EAAE,YAAY,CAAC,UAAU;AAC/C,oBAAoB,IAAI,EAAE,SAAS;AACnC,iBAAiB,CAAC;AAClB;AACA;AACA,YAAY,IAAI,CAAC,yBAAyB,GAAG;AAC7C,gBAAgB,GAAG,GAAG;AACtB,gBAAgB,oBAAoB,EAAE,IAAI;AAC1C,gBAAgB,iBAAiB,EAAE,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE;AACjE,aAAa;AACb,YAAY,OAAO,GAAG;AACtB;AACA,aAAa;AACb,YAAY,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC;AAC5C,gBAAgB,IAAI,EAAE,sBAAsB;AAC5C,gBAAgB,OAAO,EAAE,CAAC,0EAA0E,CAAC;AACrG,aAAa,CAAC;AACd;AACA;AACA,IAAI,SAAS,GAAG;AAChB,QAAQ,OAAO,IAAI,CAAC,uBAAuB,KAAK;AAChD,cAAc;AACd,cAAc,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,GAAG,EAAE;AACxD;AACA,IAAI,eAAe,CAAC,MAAM,EAAE;AAC5B,QAAQ,QAAQ,CAAC,CAAC,MAAM;AACxB,YAAY,CAAC,CAAC,IAAI,CAAC,yBAAyB,EAAE,iBAAiB;AAC/D,YAAY,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE;AACtC,gBAAgB,IAAI,CAAC,yBAAyB,CAAC,iBAAiB;AAChE;AACA;AACA,OAAO,CAAC,0CAA0C,GAAG,0CAA0C;;"}
+{"version":3,"file":"credentialsProvider.js","sources":["../../../../../src/providers/cognito/credentialsProvider/credentialsProvider.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.CognitoAWSCredentialsAndIdentityIdProvider = void 0;\nconst core_1 = require(\"@aws-amplify/core\");\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nconst AuthError_1 = require(\"../../../errors/AuthError\");\nconst assertServiceError_1 = require(\"../../../errors/utils/assertServiceError\");\nconst parsers_1 = require(\"../../../foundation/parsers\");\nconst types_1 = require(\"../utils/types\");\nconst IdentityIdProvider_1 = require(\"./IdentityIdProvider\");\nconst utils_2 = require(\"./utils\");\nconst logger = new core_1.ConsoleLogger('CognitoCredentialsProvider');\nconst CREDENTIALS_TTL = 50 * 60 * 1000; // 50 min, can be modified on config if required in the future\nclass CognitoAWSCredentialsAndIdentityIdProvider {\n    constructor(identityIdStore) {\n        this._nextCredentialsRefresh = 0;\n        this._identityIdStore = identityIdStore;\n    }\n    async clearCredentialsAndIdentityId() {\n        logger.debug('Clearing out credentials and identityId');\n        this._credentialsAndIdentityId = undefined;\n        await this._identityIdStore.clearIdentityId();\n    }\n    async clearCredentials() {\n        logger.debug('Clearing out in-memory credentials');\n        this._credentialsAndIdentityId = undefined;\n    }\n    async getCredentialsAndIdentityId(getCredentialsOptions) {\n        const isAuthenticated = getCredentialsOptions.authenticated;\n        const { tokens } = getCredentialsOptions;\n        const { authConfig } = getCredentialsOptions;\n        try {\n            (0, utils_1.assertIdentityPoolIdConfig)(authConfig?.Cognito);\n        }\n        catch {\n            // No identity pool configured, skipping\n            return;\n        }\n        if (!isAuthenticated && !authConfig.Cognito.allowGuestAccess) {\n            // TODO(V6): return partial result like Native platforms\n            return;\n        }\n        const { forceRefresh } = getCredentialsOptions;\n        const tokenHasChanged = this.hasTokenChanged(tokens);\n        const identityId = await (0, IdentityIdProvider_1.cognitoIdentityIdProvider)({\n            tokens,\n            authConfig: authConfig.Cognito,\n            identityIdStore: this._identityIdStore,\n        });\n        // Clear cached credentials when forceRefresh is true OR the cache token has changed\n        if (forceRefresh || tokenHasChanged) {\n            this.clearCredentials();\n        }\n        if (!isAuthenticated) {\n            return this.getGuestCredentials(identityId, authConfig.Cognito);\n        }\n        else {\n            (0, types_1.assertIdTokenInAuthTokens)(tokens);\n            return this.credsForOIDCTokens(authConfig.Cognito, tokens, identityId);\n        }\n    }\n    async getGuestCredentials(identityId, authConfig) {\n        // Return existing in-memory cached credentials only if it exists, is not past it's lifetime and is unauthenticated credentials\n        if (this._credentialsAndIdentityId &&\n            !this.isPastTTL() &&\n            this._credentialsAndIdentityId.isAuthenticatedCreds === false) {\n            logger.info('returning stored credentials as they neither past TTL nor expired.');\n            return this._credentialsAndIdentityId;\n        }\n        // Clear to discard if any authenticated credentials are set and start with a clean slate\n        this.clearCredentials();\n        const region = (0, parsers_1.getRegionFromIdentityPoolId)(authConfig.identityPoolId);\n        // use identityId to obtain guest credentials\n        // save credentials in-memory\n        // No logins params should be passed for guest creds:\n        // https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetCredentialsForIdentity.html\n        let clientResult;\n        try {\n            clientResult = await (0, core_1.getCredentialsForIdentity)({ region }, {\n                IdentityId: identityId,\n            });\n        }\n        catch (e) {\n            (0, assertServiceError_1.assertServiceError)(e);\n            throw new AuthError_1.AuthError(e);\n        }\n        if (clientResult?.Credentials?.AccessKeyId &&\n            clientResult?.Credentials?.SecretKey) {\n            this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;\n            const res = {\n                credentials: {\n                    accessKeyId: clientResult.Credentials.AccessKeyId,\n                    secretAccessKey: clientResult.Credentials.SecretKey,\n                    sessionToken: clientResult.Credentials.SessionToken,\n                    expiration: clientResult.Credentials.Expiration,\n                },\n                identityId,\n            };\n            if (clientResult.IdentityId) {\n                res.identityId = clientResult.IdentityId;\n                this._identityIdStore.storeIdentityId({\n                    id: clientResult.IdentityId,\n                    type: 'guest',\n                });\n            }\n            this._credentialsAndIdentityId = {\n                ...res,\n                isAuthenticatedCreds: false,\n            };\n            return res;\n        }\n        else {\n            throw new AuthError_1.AuthError({\n                name: 'CredentialsNotFoundException',\n                message: `Cognito did not respond with either Credentials, AccessKeyId or SecretKey.`,\n            });\n        }\n    }\n    async credsForOIDCTokens(authConfig, authTokens, identityId) {\n        if (this._credentialsAndIdentityId &&\n            !this.isPastTTL() &&\n            this._credentialsAndIdentityId.isAuthenticatedCreds === true) {\n            logger.debug('returning stored credentials as they neither past TTL nor expired.');\n            return this._credentialsAndIdentityId;\n        }\n        // Clear to discard if any unauthenticated credentials are set and start with a clean slate\n        this.clearCredentials();\n        const logins = authTokens.idToken\n            ? (0, utils_2.formLoginsMap)(authTokens.idToken.toString())\n            : {};\n        const region = (0, parsers_1.getRegionFromIdentityPoolId)(authConfig.identityPoolId);\n        let clientResult;\n        try {\n            clientResult = await (0, core_1.getCredentialsForIdentity)({ region }, {\n                IdentityId: identityId,\n                Logins: logins,\n            });\n        }\n        catch (e) {\n            (0, assertServiceError_1.assertServiceError)(e);\n            throw new AuthError_1.AuthError(e);\n        }\n        if (clientResult?.Credentials?.AccessKeyId &&\n            clientResult?.Credentials?.SecretKey) {\n            this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;\n            const res = {\n                credentials: {\n                    accessKeyId: clientResult.Credentials.AccessKeyId,\n                    secretAccessKey: clientResult.Credentials.SecretKey,\n                    sessionToken: clientResult.Credentials.SessionToken,\n                    expiration: clientResult.Credentials.Expiration,\n                },\n                identityId,\n            };\n            if (clientResult.IdentityId) {\n                res.identityId = clientResult.IdentityId;\n                // note: the following call removes guest identityId from the persistent store (localStorage)\n                this._identityIdStore.storeIdentityId({\n                    id: clientResult.IdentityId,\n                    type: 'primary',\n                });\n            }\n            // Store the credentials in-memory along with the expiration\n            this._credentialsAndIdentityId = {\n                ...res,\n                isAuthenticatedCreds: true,\n                associatedIdToken: authTokens.idToken?.toString(),\n            };\n            return res;\n        }\n        else {\n            throw new AuthError_1.AuthError({\n                name: 'CredentialsException',\n                message: `Cognito did not respond with either Credentials, AccessKeyId or SecretKey.`,\n            });\n        }\n    }\n    isPastTTL() {\n        return this._nextCredentialsRefresh === undefined\n            ? true\n            : this._nextCredentialsRefresh <= Date.now();\n    }\n    hasTokenChanged(tokens) {\n        return (!!tokens &&\n            !!this._credentialsAndIdentityId?.associatedIdToken &&\n            tokens.idToken?.toString() !==\n                this._credentialsAndIdentityId.associatedIdToken);\n    }\n}\nexports.CognitoAWSCredentialsAndIdentityIdProvider = CognitoAWSCredentialsAndIdentityIdProvider;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC7D,OAAO,CAAC,0CAA0C,GAAG,MAAM;AAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;AAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC;AAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,2BAA2B,CAAC;AACxD,MAAM,oBAAoB,GAAG,OAAO,CAAC,0CAA0C,CAAC;AAChF,MAAM,SAAS,GAAG,OAAO,CAAC,6BAA6B,CAAC;AACxD,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACzC,MAAM,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC;AAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;AAClC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,aAAa,CAAC,4BAA4B,CAAC;AACrE,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,MAAM,0CAA0C,CAAC;AACjD,IAAI,WAAW,CAAC,eAAe,EAAE;AACjC,QAAQ,IAAI,CAAC,uBAAuB,GAAG,CAAC;AACxC,QAAQ,IAAI,CAAC,gBAAgB,GAAG,eAAe;AAC/C;AACA,IAAI,MAAM,6BAA6B,GAAG;AAC1C,QAAQ,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC;AAC/D,QAAQ,IAAI,CAAC,yBAAyB,GAAG,SAAS;AAClD,QAAQ,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE;AACrD;AACA,IAAI,MAAM,gBAAgB,GAAG;AAC7B,QAAQ,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC;AAC1D,QAAQ,IAAI,CAAC,yBAAyB,GAAG,SAAS;AAClD;AACA,IAAI,MAAM,2BAA2B,CAAC,qBAAqB,EAAE;AAC7D,QAAQ,MAAM,eAAe,GAAG,qBAAqB,CAAC,aAAa;AACnE,QAAQ,MAAM,EAAE,MAAM,EAAE,GAAG,qBAAqB;AAChD,QAAQ,MAAM,EAAE,UAAU,EAAE,GAAG,qBAAqB;AACpD,QAAQ,IAAI;AACZ,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,0BAA0B,EAAE,UAAU,EAAE,OAAO,CAAC;AACxE;AACA,QAAQ,MAAM;AACd;AACA,YAAY;AACZ;AACA,QAAQ,IAAI,CAAC,eAAe,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,EAAE;AACtE;AACA,YAAY;AACZ;AACA,QAAQ,MAAM,EAAE,YAAY,EAAE,GAAG,qBAAqB;AACtD,QAAQ,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;AAC5D,QAAQ,MAAM,UAAU,GAAG,MAAM,IAAI,oBAAoB,CAAC,yBAAyB,EAAE;AACrF,YAAY,MAAM;AAClB,YAAY,UAAU,EAAE,UAAU,CAAC,OAAO;AAC1C,YAAY,eAAe,EAAE,IAAI,CAAC,gBAAgB;AAClD,SAAS,CAAC;AACV;AACA,QAAQ,IAAI,YAAY,IAAI,eAAe,EAAE;AAC7C,YAAY,IAAI,CAAC,gBAAgB,EAAE;AACnC;AACA,QAAQ,IAAI,CAAC,eAAe,EAAE;AAC9B,YAAY,OAAO,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC;AAC3E;AACA,aAAa;AACb,YAAY,IAAI,OAAO,CAAC,yBAAyB,EAAE,MAAM,CAAC;AAC1D,YAAY,OAAO,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC;AAClF;AACA;AACA,IAAI,MAAM,mBAAmB,CAAC,UAAU,EAAE,UAAU,EAAE;AACtD;AACA,QAAQ,IAAI,IAAI,CAAC,yBAAyB;AAC1C,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE;AAC7B,YAAY,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,KAAK,KAAK,EAAE;AAC3E,YAAY,MAAM,CAAC,IAAI,CAAC,oEAAoE,CAAC;AAC7F,YAAY,OAAO,IAAI,CAAC,yBAAyB;AACjD;AACA;AACA,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,QAAQ,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,2BAA2B,EAAE,UAAU,CAAC,cAAc,CAAC;AAC5F;AACA;AACA;AACA;AACA,QAAQ,IAAI,YAAY;AACxB,QAAQ,IAAI;AACZ,YAAY,YAAY,GAAG,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,EAAE;AACnF,gBAAgB,UAAU,EAAE,UAAU;AACtC,aAAa,CAAC;AACd;AACA,QAAQ,OAAO,CAAC,EAAE;AAClB,YAAY,IAAI,oBAAoB,CAAC,kBAAkB,EAAE,CAAC,CAAC;AAC3D,YAAY,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;AAC9C;AACA,QAAQ,IAAI,YAAY,EAAE,WAAW,EAAE,WAAW;AAClD,YAAY,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE;AAClD,YAAY,IAAI,CAAC,uBAAuB,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,eAAe;AACjF,YAAY,MAAM,GAAG,GAAG;AACxB,gBAAgB,WAAW,EAAE;AAC7B,oBAAoB,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC,WAAW;AACrE,oBAAoB,eAAe,EAAE,YAAY,CAAC,WAAW,CAAC,SAAS;AACvE,oBAAoB,YAAY,EAAE,YAAY,CAAC,WAAW,CAAC,YAAY;AACvE,oBAAoB,UAAU,EAAE,YAAY,CAAC,WAAW,CAAC,UAAU;AACnE,iBAAiB;AACjB,gBAAgB,UAAU;AAC1B,aAAa;AACb,YAAY,IAAI,YAAY,CAAC,UAAU,EAAE;AACzC,gBAAgB,GAAG,CAAC,UAAU,GAAG,YAAY,CAAC,UAAU;AACxD,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;AACtD,oBAAoB,EAAE,EAAE,YAAY,CAAC,UAAU;AAC/C,oBAAoB,IAAI,EAAE,OAAO;AACjC,iBAAiB,CAAC;AAClB;AACA,YAAY,IAAI,CAAC,yBAAyB,GAAG;AAC7C,gBAAgB,GAAG,GAAG;AACtB,gBAAgB,oBAAoB,EAAE,KAAK;AAC3C,aAAa;AACb,YAAY,OAAO,GAAG;AACtB;AACA,aAAa;AACb,YAAY,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC;AAC5C,gBAAgB,IAAI,EAAE,8BAA8B;AACpD,gBAAgB,OAAO,EAAE,CAAC,0EAA0E,CAAC;AACrG,aAAa,CAAC;AACd;AACA;AACA,IAAI,MAAM,kBAAkB,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE;AACjE,QAAQ,IAAI,IAAI,CAAC,yBAAyB;AAC1C,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE;AAC7B,YAAY,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,KAAK,IAAI,EAAE;AAC1E,YAAY,MAAM,CAAC,KAAK,CAAC,oEAAoE,CAAC;AAC9F,YAAY,OAAO,IAAI,CAAC,yBAAyB;AACjD;AACA;AACA,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,QAAQ,MAAM,MAAM,GAAG,UAAU,CAAC;AAClC,cAAc,IAAI,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE;AACtE,cAAc,EAAE;AAChB,QAAQ,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,2BAA2B,EAAE,UAAU,CAAC,cAAc,CAAC;AAC5F,QAAQ,IAAI,YAAY;AACxB,QAAQ,IAAI;AACZ,YAAY,YAAY,GAAG,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,EAAE;AACnF,gBAAgB,UAAU,EAAE,UAAU;AACtC,gBAAgB,MAAM,EAAE,MAAM;AAC9B,aAAa,CAAC;AACd;AACA,QAAQ,OAAO,CAAC,EAAE;AAClB,YAAY,IAAI,oBAAoB,CAAC,kBAAkB,EAAE,CAAC,CAAC;AAC3D,YAAY,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;AAC9C;AACA,QAAQ,IAAI,YAAY,EAAE,WAAW,EAAE,WAAW;AAClD,YAAY,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE;AAClD,YAAY,IAAI,CAAC,uBAAuB,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,eAAe;AACjF,YAAY,MAAM,GAAG,GAAG;AACxB,gBAAgB,WAAW,EAAE;AAC7B,oBAAoB,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC,WAAW;AACrE,oBAAoB,eAAe,EAAE,YAAY,CAAC,WAAW,CAAC,SAAS;AACvE,oBAAoB,YAAY,EAAE,YAAY,CAAC,WAAW,CAAC,YAAY;AACvE,oBAAoB,UAAU,EAAE,YAAY,CAAC,WAAW,CAAC,UAAU;AACnE,iBAAiB;AACjB,gBAAgB,UAAU;AAC1B,aAAa;AACb,YAAY,IAAI,YAAY,CAAC,UAAU,EAAE;AACzC,gBAAgB,GAAG,CAAC,UAAU,GAAG,YAAY,CAAC,UAAU;AACxD;AACA,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;AACtD,oBAAoB,EAAE,EAAE,YAAY,CAAC,UAAU;AAC/C,oBAAoB,IAAI,EAAE,SAAS;AACnC,iBAAiB,CAAC;AAClB;AACA;AACA,YAAY,IAAI,CAAC,yBAAyB,GAAG;AAC7C,gBAAgB,GAAG,GAAG;AACtB,gBAAgB,oBAAoB,EAAE,IAAI;AAC1C,gBAAgB,iBAAiB,EAAE,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE;AACjE,aAAa;AACb,YAAY,OAAO,GAAG;AACtB;AACA,aAAa;AACb,YAAY,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC;AAC5C,gBAAgB,IAAI,EAAE,sBAAsB;AAC5C,gBAAgB,OAAO,EAAE,CAAC,0EAA0E,CAAC;AACrG,aAAa,CAAC;AACd;AACA;AACA,IAAI,SAAS,GAAG;AAChB,QAAQ,OAAO,IAAI,CAAC,uBAAuB,KAAK;AAChD,cAAc;AACd,cAAc,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,GAAG,EAAE;AACxD;AACA,IAAI,eAAe,CAAC,MAAM,EAAE;AAC5B,QAAQ,QAAQ,CAAC,CAAC,MAAM;AACxB,YAAY,CAAC,CAAC,IAAI,CAAC,yBAAyB,EAAE,iBAAiB;AAC/D,YAAY,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE;AACtC,gBAAgB,IAAI,CAAC,yBAAyB,CAAC,iBAAiB;AAChE;AACA;AACA,OAAO,CAAC,0CAA0C,GAAG,0CAA0C;;"}

package/dist/esm/foundation/factories/serviceClients/cognitoIdentityProvider/shared/handler/cognitoUserPoolTransferHandler.d.ts

@@ -6,4 +6,4 @@ import { HttpResponse } from '@aws-amplify/core/src/clients/types';
  *
  * @internal
  */
-export declare const cognitoUserPoolTransferHandler: (request: HttpRequest, options: Record<string, unknown> & import("@aws-amplify/core/internals/aws-client-utils").UserAgentOptions & import("@aws-amplify/core/internals/aws-client-utils").RetryOptions<import("@aws-amplify/core/internals/aws-client-utils").HttpResponse> & import("@aws-amplify/core/internals/aws-client-utils").HttpTransferOptions) => Promise<HttpResponse>;
+export declare const cognitoUserPoolTransferHandler: (request: HttpRequest, options: Record<string, unknown> & import("@aws-amplify/core/internals/aws-client-utils").UserAgentOptions & object & import("@aws-amplify/core/internals/aws-client-utils").RetryOptions<import("@aws-amplify/core/internals/aws-client-utils").HttpResponse> & import("@aws-amplify/core/internals/aws-client-utils").AmzSdkRequestHeaderMiddlewareOptions & import("@aws-amplify/core/internals/aws-client-utils").HttpTransferOptions) => Promise<HttpResponse>;

package/dist/esm/foundation/factories/serviceClients/cognitoIdentityProvider/shared/serde/createUserPoolDeserializer.mjs

@@ -8,7 +8,11 @@ const createUserPoolDeserializer = () => async (response) => {
     if (response.statusCode >= 300) {
         const error = await parseJsonError(response);
         assertServiceError(error);
-        throw new AuthError({ name: error.name, message: error.message });
+        throw new AuthError({
+            name: error.name,
+            message: error.message,
+            metadata: error.$metadata,
+        });
     }
     return parseJsonBody(response);
 };

package/dist/esm/foundation/factories/serviceClients/cognitoIdentityProvider/shared/serde/createUserPoolDeserializer.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"createUserPoolDeserializer.mjs","sources":["../../../../../../../../src/foundation/factories/serviceClients/cognitoIdentityProvider/shared/serde/createUserPoolDeserializer.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { parseJsonBody, parseJsonError, } from '@aws-amplify/core/internals/aws-client-utils';\nimport { assertServiceError } from '../../../../../../errors/utils/assertServiceError';\nimport { AuthError } from '../../../../../../errors/AuthError';\nexport const createUserPoolDeserializer = () => async (response) => {\n    if (response.statusCode >= 300) {\n        const error = await parseJsonError(response);\n        assertServiceError(error);\n        throw new AuthError({ name: error.name, message: error.message });\n    }\n    return parseJsonBody(response);\n};\n"],"names":[],"mappings":";;;;AAAA;AACA;AAIY,MAAC,0BAA0B,GAAG,MAAM,OAAO,QAAQ,KAAK;AACpE,IAAI,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE;AACpC,QAAQ,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC;AACpD,QAAQ,kBAAkB,CAAC,KAAK,CAAC;AACjC,QAAQ,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;AACzE;AACA,IAAI,OAAO,aAAa,CAAC,QAAQ,CAAC;AAClC;;;;"}
+{"version":3,"file":"createUserPoolDeserializer.mjs","sources":["../../../../../../../../src/foundation/factories/serviceClients/cognitoIdentityProvider/shared/serde/createUserPoolDeserializer.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { parseJsonBody, parseJsonError, } from '@aws-amplify/core/internals/aws-client-utils';\nimport { assertServiceError } from '../../../../../../errors/utils/assertServiceError';\nimport { AuthError } from '../../../../../../errors/AuthError';\nexport const createUserPoolDeserializer = () => async (response) => {\n    if (response.statusCode >= 300) {\n        const error = await parseJsonError(response);\n        assertServiceError(error);\n        throw new AuthError({\n            name: error.name,\n            message: error.message,\n            metadata: error.$metadata,\n        });\n    }\n    return parseJsonBody(response);\n};\n"],"names":[],"mappings":";;;;AAAA;AACA;AAIY,MAAC,0BAA0B,GAAG,MAAM,OAAO,QAAQ,KAAK;AACpE,IAAI,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE;AACpC,QAAQ,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC;AACpD,QAAQ,kBAAkB,CAAC,KAAK,CAAC;AACjC,QAAQ,MAAM,IAAI,SAAS,CAAC;AAC5B,YAAY,IAAI,EAAE,KAAK,CAAC,IAAI;AAC5B,YAAY,OAAO,EAAE,KAAK,CAAC,OAAO;AAClC,YAAY,QAAQ,EAAE,KAAK,CAAC,SAAS;AACrC,SAAS,CAAC;AACV;AACA,IAAI,OAAO,aAAa,CAAC,QAAQ,CAAC;AAClC;;;;"}

package/dist/esm/providers/cognito/credentialsProvider/IdentityIdProvider.mjs

@@ -1,5 +1,6 @@
 import { getId } from '@aws-amplify/core';
 import { AuthError } from '../../../errors/AuthError.mjs';
+import { assertServiceError } from '../../../errors/utils/assertServiceError.mjs';
 import { getRegionFromIdentityPoolId } from '../../../foundation/parsers/regionParsers.mjs';
 import { formLoginsMap } from './utils.mjs';
 
@@ -36,15 +37,21 @@ async function generateIdentityId(logins, authConfig) {
     const identityPoolId = authConfig?.identityPoolId;
     const region = getRegionFromIdentityPoolId(identityPoolId);
     // IdentityId is absent so get it using IdentityPoolId with Cognito's GetId API
-    const idResult = 
+    let idResult;
     // for a first-time user, this will return a brand new identity
     // for a returning user, this will retrieve the previous identity assocaited with the logins
-    (await getId({
-        region,
-    }, {
-        IdentityPoolId: identityPoolId,
-        Logins: logins,
-    })).IdentityId;
+    try {
+        idResult = (await getId({
+            region,
+        }, {
+            IdentityPoolId: identityPoolId,
+            Logins: logins,
+        })).IdentityId;
+    }
+    catch (e) {
+        assertServiceError(e);
+        throw new AuthError(e);
+    }
     if (!idResult) {
         throw new AuthError({
             name: 'GetIdResponseException',

package/dist/esm/providers/cognito/credentialsProvider/IdentityIdProvider.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityIdProvider.mjs","sources":["../../../../../src/providers/cognito/credentialsProvider/IdentityIdProvider.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { getId } from '@aws-amplify/core';\nimport { AuthError } from '../../../errors/AuthError';\nimport { getRegionFromIdentityPoolId } from '../../../foundation/parsers';\nimport { formLoginsMap } from './utils';\n/**\n * Provides a Cognito identityId\n *\n * @param tokens - The AuthTokens received after SignIn\n * @returns string\n * @throws configuration exceptions: `InvalidIdentityPoolIdException`\n *  - Auth errors that may arise from misconfiguration.\n * @throws service exceptions: {@link GetIdException }\n */\nexport async function cognitoIdentityIdProvider({ tokens, authConfig, identityIdStore, }) {\n    identityIdStore.setAuthConfig({ Cognito: authConfig });\n    // will return null only if there is no identityId cached or if there is an error retrieving it\n    const identityId = await identityIdStore.loadIdentityId();\n    if (identityId) {\n        return identityId.id;\n    }\n    const logins = tokens?.idToken\n        ? formLoginsMap(tokens.idToken.toString())\n        : {};\n    const generatedIdentityId = await generateIdentityId(logins, authConfig);\n    // Store generated identityId\n    identityIdStore.storeIdentityId({\n        id: generatedIdentityId,\n        type: tokens ? 'primary' : 'guest',\n    });\n    return generatedIdentityId;\n}\nasync function generateIdentityId(logins, authConfig) {\n    const identityPoolId = authConfig?.identityPoolId;\n    const region = getRegionFromIdentityPoolId(identityPoolId);\n    // IdentityId is absent so get it using IdentityPoolId with Cognito's GetId API\n    const idResult = \n    // for a first-time user, this will return a brand new identity\n    // for a returning user, this will retrieve the previous identity assocaited with the logins\n    (await getId({\n        region,\n    }, {\n        IdentityPoolId: identityPoolId,\n        Logins: logins,\n    })).IdentityId;\n    if (!idResult) {\n        throw new AuthError({\n            name: 'GetIdResponseException',\n            message: 'Received undefined response from getId operation',\n            recoverySuggestion: 'Make sure to pass a valid identityPoolId in the configuration.',\n        });\n    }\n    return idResult;\n}\n"],"names":[],"mappings":";;;;;AAAA;AACA;AAKA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAe,yBAAyB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,GAAG,EAAE;AAC1F,IAAI,eAAe,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AAC1D;AACA,IAAI,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,cAAc,EAAE;AAC7D,IAAI,IAAI,UAAU,EAAE;AACpB,QAAQ,OAAO,UAAU,CAAC,EAAE;AAC5B;AACA,IAAI,MAAM,MAAM,GAAG,MAAM,EAAE;AAC3B,UAAU,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE;AACjD,UAAU,EAAE;AACZ,IAAI,MAAM,mBAAmB,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC;AAC5E;AACA,IAAI,eAAe,CAAC,eAAe,CAAC;AACpC,QAAQ,EAAE,EAAE,mBAAmB;AAC/B,QAAQ,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;AAC1C,KAAK,CAAC;AACN,IAAI,OAAO,mBAAmB;AAC9B;AACA,eAAe,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE;AACtD,IAAI,MAAM,cAAc,GAAG,UAAU,EAAE,cAAc;AACrD,IAAI,MAAM,MAAM,GAAG,2BAA2B,CAAC,cAAc,CAAC;AAC9D;AACA,IAAI,MAAM,QAAQ;AAClB;AACA;AACA,IAAI,CAAC,MAAM,KAAK,CAAC;AACjB,QAAQ,MAAM;AACd,KAAK,EAAE;AACP,QAAQ,cAAc,EAAE,cAAc;AACtC,QAAQ,MAAM,EAAE,MAAM;AACtB,KAAK,CAAC,EAAE,UAAU;AAClB,IAAI,IAAI,CAAC,QAAQ,EAAE;AACnB,QAAQ,MAAM,IAAI,SAAS,CAAC;AAC5B,YAAY,IAAI,EAAE,wBAAwB;AAC1C,YAAY,OAAO,EAAE,kDAAkD;AACvE,YAAY,kBAAkB,EAAE,gEAAgE;AAChG,SAAS,CAAC;AACV;AACA,IAAI,OAAO,QAAQ;AACnB;;;;"}
+{"version":3,"file":"IdentityIdProvider.mjs","sources":["../../../../../src/providers/cognito/credentialsProvider/IdentityIdProvider.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { getId } from '@aws-amplify/core';\nimport { AuthError } from '../../../errors/AuthError';\nimport { assertServiceError } from '../../../errors/utils/assertServiceError';\nimport { getRegionFromIdentityPoolId } from '../../../foundation/parsers';\nimport { formLoginsMap } from './utils';\n/**\n * Provides a Cognito identityId\n *\n * @param tokens - The AuthTokens received after SignIn\n * @returns string\n * @throws configuration exceptions: `InvalidIdentityPoolIdException`\n *  - Auth errors that may arise from misconfiguration.\n * @throws service exceptions: {@link GetIdException }\n */\nexport async function cognitoIdentityIdProvider({ tokens, authConfig, identityIdStore, }) {\n    identityIdStore.setAuthConfig({ Cognito: authConfig });\n    // will return null only if there is no identityId cached or if there is an error retrieving it\n    const identityId = await identityIdStore.loadIdentityId();\n    if (identityId) {\n        return identityId.id;\n    }\n    const logins = tokens?.idToken\n        ? formLoginsMap(tokens.idToken.toString())\n        : {};\n    const generatedIdentityId = await generateIdentityId(logins, authConfig);\n    // Store generated identityId\n    identityIdStore.storeIdentityId({\n        id: generatedIdentityId,\n        type: tokens ? 'primary' : 'guest',\n    });\n    return generatedIdentityId;\n}\nasync function generateIdentityId(logins, authConfig) {\n    const identityPoolId = authConfig?.identityPoolId;\n    const region = getRegionFromIdentityPoolId(identityPoolId);\n    // IdentityId is absent so get it using IdentityPoolId with Cognito's GetId API\n    let idResult;\n    // for a first-time user, this will return a brand new identity\n    // for a returning user, this will retrieve the previous identity assocaited with the logins\n    try {\n        idResult = (await getId({\n            region,\n        }, {\n            IdentityPoolId: identityPoolId,\n            Logins: logins,\n        })).IdentityId;\n    }\n    catch (e) {\n        assertServiceError(e);\n        throw new AuthError(e);\n    }\n    if (!idResult) {\n        throw new AuthError({\n            name: 'GetIdResponseException',\n            message: 'Received undefined response from getId operation',\n            recoverySuggestion: 'Make sure to pass a valid identityPoolId in the configuration.',\n        });\n    }\n    return idResult;\n}\n"],"names":[],"mappings":";;;;;;AAAA;AACA;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAe,yBAAyB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,GAAG,EAAE;AAC1F,IAAI,eAAe,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AAC1D;AACA,IAAI,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,cAAc,EAAE;AAC7D,IAAI,IAAI,UAAU,EAAE;AACpB,QAAQ,OAAO,UAAU,CAAC,EAAE;AAC5B;AACA,IAAI,MAAM,MAAM,GAAG,MAAM,EAAE;AAC3B,UAAU,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE;AACjD,UAAU,EAAE;AACZ,IAAI,MAAM,mBAAmB,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC;AAC5E;AACA,IAAI,eAAe,CAAC,eAAe,CAAC;AACpC,QAAQ,EAAE,EAAE,mBAAmB;AAC/B,QAAQ,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;AAC1C,KAAK,CAAC;AACN,IAAI,OAAO,mBAAmB;AAC9B;AACA,eAAe,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE;AACtD,IAAI,MAAM,cAAc,GAAG,UAAU,EAAE,cAAc;AACrD,IAAI,MAAM,MAAM,GAAG,2BAA2B,CAAC,cAAc,CAAC;AAC9D;AACA,IAAI,IAAI,QAAQ;AAChB;AACA;AACA,IAAI,IAAI;AACR,QAAQ,QAAQ,GAAG,CAAC,MAAM,KAAK,CAAC;AAChC,YAAY,MAAM;AAClB,SAAS,EAAE;AACX,YAAY,cAAc,EAAE,cAAc;AAC1C,YAAY,MAAM,EAAE,MAAM;AAC1B,SAAS,CAAC,EAAE,UAAU;AACtB;AACA,IAAI,OAAO,CAAC,EAAE;AACd,QAAQ,kBAAkB,CAAC,CAAC,CAAC;AAC7B,QAAQ,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC;AAC9B;AACA,IAAI,IAAI,CAAC,QAAQ,EAAE;AACnB,QAAQ,MAAM,IAAI,SAAS,CAAC;AAC5B,YAAY,IAAI,EAAE,wBAAwB;AAC1C,YAAY,OAAO,EAAE,kDAAkD;AACvE,YAAY,kBAAkB,EAAE,gEAAgE;AAChG,SAAS,CAAC;AACV;AACA,IAAI,OAAO,QAAQ;AACnB;;;;"}

package/dist/esm/providers/cognito/credentialsProvider/credentialsProvider.mjs

@@ -1,6 +1,7 @@
 import { ConsoleLogger, getCredentialsForIdentity } from '@aws-amplify/core';
 import { assertIdentityPoolIdConfig } from '@aws-amplify/core/internals/utils';
 import { AuthError } from '../../../errors/AuthError.mjs';
+import { assertServiceError } from '../../../errors/utils/assertServiceError.mjs';
 import { getRegionFromIdentityPoolId } from '../../../foundation/parsers/regionParsers.mjs';
 import { assertIdTokenInAuthTokens } from '../utils/types.mjs';
 import { cognitoIdentityIdProvider } from './IdentityIdProvider.mjs';
@@ -73,12 +74,18 @@ class CognitoAWSCredentialsAndIdentityIdProvider {
         // save credentials in-memory
         // No logins params should be passed for guest creds:
         // https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetCredentialsForIdentity.html
-        const clientResult = await getCredentialsForIdentity({ region }, {
-            IdentityId: identityId,
-        });
-        if (clientResult.Credentials &&
-            clientResult.Credentials.AccessKeyId &&
-            clientResult.Credentials.SecretKey) {
+        let clientResult;
+        try {
+            clientResult = await getCredentialsForIdentity({ region }, {
+                IdentityId: identityId,
+            });
+        }
+        catch (e) {
+            assertServiceError(e);
+            throw new AuthError(e);
+        }
+        if (clientResult?.Credentials?.AccessKeyId &&
+            clientResult?.Credentials?.SecretKey) {
             this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;
             const res = {
                 credentials: {
@@ -122,13 +129,19 @@ class CognitoAWSCredentialsAndIdentityIdProvider {
             ? formLoginsMap(authTokens.idToken.toString())
             : {};
         const region = getRegionFromIdentityPoolId(authConfig.identityPoolId);
-        const clientResult = await getCredentialsForIdentity({ region }, {
-            IdentityId: identityId,
-            Logins: logins,
-        });
-        if (clientResult.Credentials &&
-            clientResult.Credentials.AccessKeyId &&
-            clientResult.Credentials.SecretKey) {
+        let clientResult;
+        try {
+            clientResult = await getCredentialsForIdentity({ region }, {
+                IdentityId: identityId,
+                Logins: logins,
+            });
+        }
+        catch (e) {
+            assertServiceError(e);
+            throw new AuthError(e);
+        }
+        if (clientResult?.Credentials?.AccessKeyId &&
+            clientResult?.Credentials?.SecretKey) {
             this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;
             const res = {
                 credentials: {

package/dist/esm/providers/cognito/credentialsProvider/credentialsProvider.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"credentialsProvider.mjs","sources":["../../../../../src/providers/cognito/credentialsProvider/credentialsProvider.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { ConsoleLogger, getCredentialsForIdentity, } from '@aws-amplify/core';\nimport { assertIdentityPoolIdConfig, } from '@aws-amplify/core/internals/utils';\nimport { AuthError } from '../../../errors/AuthError';\nimport { getRegionFromIdentityPoolId } from '../../../foundation/parsers';\nimport { assertIdTokenInAuthTokens } from '../utils/types';\nimport { cognitoIdentityIdProvider } from './IdentityIdProvider';\nimport { formLoginsMap } from './utils';\nconst logger = new ConsoleLogger('CognitoCredentialsProvider');\nconst CREDENTIALS_TTL = 50 * 60 * 1000; // 50 min, can be modified on config if required in the future\nexport class CognitoAWSCredentialsAndIdentityIdProvider {\n    constructor(identityIdStore) {\n        this._nextCredentialsRefresh = 0;\n        this._identityIdStore = identityIdStore;\n    }\n    async clearCredentialsAndIdentityId() {\n        logger.debug('Clearing out credentials and identityId');\n        this._credentialsAndIdentityId = undefined;\n        await this._identityIdStore.clearIdentityId();\n    }\n    async clearCredentials() {\n        logger.debug('Clearing out in-memory credentials');\n        this._credentialsAndIdentityId = undefined;\n    }\n    async getCredentialsAndIdentityId(getCredentialsOptions) {\n        const isAuthenticated = getCredentialsOptions.authenticated;\n        const { tokens } = getCredentialsOptions;\n        const { authConfig } = getCredentialsOptions;\n        try {\n            assertIdentityPoolIdConfig(authConfig?.Cognito);\n        }\n        catch {\n            // No identity pool configured, skipping\n            return;\n        }\n        if (!isAuthenticated && !authConfig.Cognito.allowGuestAccess) {\n            // TODO(V6): return partial result like Native platforms\n            return;\n        }\n        const { forceRefresh } = getCredentialsOptions;\n        const tokenHasChanged = this.hasTokenChanged(tokens);\n        const identityId = await cognitoIdentityIdProvider({\n            tokens,\n            authConfig: authConfig.Cognito,\n            identityIdStore: this._identityIdStore,\n        });\n        // Clear cached credentials when forceRefresh is true OR the cache token has changed\n        if (forceRefresh || tokenHasChanged) {\n            this.clearCredentials();\n        }\n        if (!isAuthenticated) {\n            return this.getGuestCredentials(identityId, authConfig.Cognito);\n        }\n        else {\n            assertIdTokenInAuthTokens(tokens);\n            return this.credsForOIDCTokens(authConfig.Cognito, tokens, identityId);\n        }\n    }\n    async getGuestCredentials(identityId, authConfig) {\n        // Return existing in-memory cached credentials only if it exists, is not past it's lifetime and is unauthenticated credentials\n        if (this._credentialsAndIdentityId &&\n            !this.isPastTTL() &&\n            this._credentialsAndIdentityId.isAuthenticatedCreds === false) {\n            logger.info('returning stored credentials as they neither past TTL nor expired.');\n            return this._credentialsAndIdentityId;\n        }\n        // Clear to discard if any authenticated credentials are set and start with a clean slate\n        this.clearCredentials();\n        const region = getRegionFromIdentityPoolId(authConfig.identityPoolId);\n        // use identityId to obtain guest credentials\n        // save credentials in-memory\n        // No logins params should be passed for guest creds:\n        // https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetCredentialsForIdentity.html\n        const clientResult = await getCredentialsForIdentity({ region }, {\n            IdentityId: identityId,\n        });\n        if (clientResult.Credentials &&\n            clientResult.Credentials.AccessKeyId &&\n            clientResult.Credentials.SecretKey) {\n            this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;\n            const res = {\n                credentials: {\n                    accessKeyId: clientResult.Credentials.AccessKeyId,\n                    secretAccessKey: clientResult.Credentials.SecretKey,\n                    sessionToken: clientResult.Credentials.SessionToken,\n                    expiration: clientResult.Credentials.Expiration,\n                },\n                identityId,\n            };\n            if (clientResult.IdentityId) {\n                res.identityId = clientResult.IdentityId;\n                this._identityIdStore.storeIdentityId({\n                    id: clientResult.IdentityId,\n                    type: 'guest',\n                });\n            }\n            this._credentialsAndIdentityId = {\n                ...res,\n                isAuthenticatedCreds: false,\n            };\n            return res;\n        }\n        else {\n            throw new AuthError({\n                name: 'CredentialsNotFoundException',\n                message: `Cognito did not respond with either Credentials, AccessKeyId or SecretKey.`,\n            });\n        }\n    }\n    async credsForOIDCTokens(authConfig, authTokens, identityId) {\n        if (this._credentialsAndIdentityId &&\n            !this.isPastTTL() &&\n            this._credentialsAndIdentityId.isAuthenticatedCreds === true) {\n            logger.debug('returning stored credentials as they neither past TTL nor expired.');\n            return this._credentialsAndIdentityId;\n        }\n        // Clear to discard if any unauthenticated credentials are set and start with a clean slate\n        this.clearCredentials();\n        const logins = authTokens.idToken\n            ? formLoginsMap(authTokens.idToken.toString())\n            : {};\n        const region = getRegionFromIdentityPoolId(authConfig.identityPoolId);\n        const clientResult = await getCredentialsForIdentity({ region }, {\n            IdentityId: identityId,\n            Logins: logins,\n        });\n        if (clientResult.Credentials &&\n            clientResult.Credentials.AccessKeyId &&\n            clientResult.Credentials.SecretKey) {\n            this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;\n            const res = {\n                credentials: {\n                    accessKeyId: clientResult.Credentials.AccessKeyId,\n                    secretAccessKey: clientResult.Credentials.SecretKey,\n                    sessionToken: clientResult.Credentials.SessionToken,\n                    expiration: clientResult.Credentials.Expiration,\n                },\n                identityId,\n            };\n            if (clientResult.IdentityId) {\n                res.identityId = clientResult.IdentityId;\n                // note: the following call removes guest identityId from the persistent store (localStorage)\n                this._identityIdStore.storeIdentityId({\n                    id: clientResult.IdentityId,\n                    type: 'primary',\n                });\n            }\n            // Store the credentials in-memory along with the expiration\n            this._credentialsAndIdentityId = {\n                ...res,\n                isAuthenticatedCreds: true,\n                associatedIdToken: authTokens.idToken?.toString(),\n            };\n            return res;\n        }\n        else {\n            throw new AuthError({\n                name: 'CredentialsException',\n                message: `Cognito did not respond with either Credentials, AccessKeyId or SecretKey.`,\n            });\n        }\n    }\n    isPastTTL() {\n        return this._nextCredentialsRefresh === undefined\n            ? true\n            : this._nextCredentialsRefresh <= Date.now();\n    }\n    hasTokenChanged(tokens) {\n        return (!!tokens &&\n            !!this._credentialsAndIdentityId?.associatedIdToken &&\n            tokens.idToken?.toString() !==\n                this._credentialsAndIdentityId.associatedIdToken);\n    }\n}\n"],"names":[],"mappings":";;;;;;;;AAAA;AACA;AAQA,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,4BAA4B,CAAC;AAC9D,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAChC,MAAM,0CAA0C,CAAC;AACxD,IAAI,WAAW,CAAC,eAAe,EAAE;AACjC,QAAQ,IAAI,CAAC,uBAAuB,GAAG,CAAC;AACxC,QAAQ,IAAI,CAAC,gBAAgB,GAAG,eAAe;AAC/C;AACA,IAAI,MAAM,6BAA6B,GAAG;AAC1C,QAAQ,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC;AAC/D,QAAQ,IAAI,CAAC,yBAAyB,GAAG,SAAS;AAClD,QAAQ,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE;AACrD;AACA,IAAI,MAAM,gBAAgB,GAAG;AAC7B,QAAQ,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC;AAC1D,QAAQ,IAAI,CAAC,yBAAyB,GAAG,SAAS;AAClD;AACA,IAAI,MAAM,2BAA2B,CAAC,qBAAqB,EAAE;AAC7D,QAAQ,MAAM,eAAe,GAAG,qBAAqB,CAAC,aAAa;AACnE,QAAQ,MAAM,EAAE,MAAM,EAAE,GAAG,qBAAqB;AAChD,QAAQ,MAAM,EAAE,UAAU,EAAE,GAAG,qBAAqB;AACpD,QAAQ,IAAI;AACZ,YAAY,0BAA0B,CAAC,UAAU,EAAE,OAAO,CAAC;AAC3D;AACA,QAAQ,MAAM;AACd;AACA,YAAY;AACZ;AACA,QAAQ,IAAI,CAAC,eAAe,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,EAAE;AACtE;AACA,YAAY;AACZ;AACA,QAAQ,MAAM,EAAE,YAAY,EAAE,GAAG,qBAAqB;AACtD,QAAQ,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;AAC5D,QAAQ,MAAM,UAAU,GAAG,MAAM,yBAAyB,CAAC;AAC3D,YAAY,MAAM;AAClB,YAAY,UAAU,EAAE,UAAU,CAAC,OAAO;AAC1C,YAAY,eAAe,EAAE,IAAI,CAAC,gBAAgB;AAClD,SAAS,CAAC;AACV;AACA,QAAQ,IAAI,YAAY,IAAI,eAAe,EAAE;AAC7C,YAAY,IAAI,CAAC,gBAAgB,EAAE;AACnC;AACA,QAAQ,IAAI,CAAC,eAAe,EAAE;AAC9B,YAAY,OAAO,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC;AAC3E;AACA,aAAa;AACb,YAAY,yBAAyB,CAAC,MAAM,CAAC;AAC7C,YAAY,OAAO,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC;AAClF;AACA;AACA,IAAI,MAAM,mBAAmB,CAAC,UAAU,EAAE,UAAU,EAAE;AACtD;AACA,QAAQ,IAAI,IAAI,CAAC,yBAAyB;AAC1C,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE;AAC7B,YAAY,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,KAAK,KAAK,EAAE;AAC3E,YAAY,MAAM,CAAC,IAAI,CAAC,oEAAoE,CAAC;AAC7F,YAAY,OAAO,IAAI,CAAC,yBAAyB;AACjD;AACA;AACA,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,QAAQ,MAAM,MAAM,GAAG,2BAA2B,CAAC,UAAU,CAAC,cAAc,CAAC;AAC7E;AACA;AACA;AACA;AACA,QAAQ,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,EAAE,MAAM,EAAE,EAAE;AACzE,YAAY,UAAU,EAAE,UAAU;AAClC,SAAS,CAAC;AACV,QAAQ,IAAI,YAAY,CAAC,WAAW;AACpC,YAAY,YAAY,CAAC,WAAW,CAAC,WAAW;AAChD,YAAY,YAAY,CAAC,WAAW,CAAC,SAAS,EAAE;AAChD,YAAY,IAAI,CAAC,uBAAuB,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,eAAe;AACjF,YAAY,MAAM,GAAG,GAAG;AACxB,gBAAgB,WAAW,EAAE;AAC7B,oBAAoB,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC,WAAW;AACrE,oBAAoB,eAAe,EAAE,YAAY,CAAC,WAAW,CAAC,SAAS;AACvE,oBAAoB,YAAY,EAAE,YAAY,CAAC,WAAW,CAAC,YAAY;AACvE,oBAAoB,UAAU,EAAE,YAAY,CAAC,WAAW,CAAC,UAAU;AACnE,iBAAiB;AACjB,gBAAgB,UAAU;AAC1B,aAAa;AACb,YAAY,IAAI,YAAY,CAAC,UAAU,EAAE;AACzC,gBAAgB,GAAG,CAAC,UAAU,GAAG,YAAY,CAAC,UAAU;AACxD,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;AACtD,oBAAoB,EAAE,EAAE,YAAY,CAAC,UAAU;AAC/C,oBAAoB,IAAI,EAAE,OAAO;AACjC,iBAAiB,CAAC;AAClB;AACA,YAAY,IAAI,CAAC,yBAAyB,GAAG;AAC7C,gBAAgB,GAAG,GAAG;AACtB,gBAAgB,oBAAoB,EAAE,KAAK;AAC3C,aAAa;AACb,YAAY,OAAO,GAAG;AACtB;AACA,aAAa;AACb,YAAY,MAAM,IAAI,SAAS,CAAC;AAChC,gBAAgB,IAAI,EAAE,8BAA8B;AACpD,gBAAgB,OAAO,EAAE,CAAC,0EAA0E,CAAC;AACrG,aAAa,CAAC;AACd;AACA;AACA,IAAI,MAAM,kBAAkB,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE;AACjE,QAAQ,IAAI,IAAI,CAAC,yBAAyB;AAC1C,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE;AAC7B,YAAY,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,KAAK,IAAI,EAAE;AAC1E,YAAY,MAAM,CAAC,KAAK,CAAC,oEAAoE,CAAC;AAC9F,YAAY,OAAO,IAAI,CAAC,yBAAyB;AACjD;AACA;AACA,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,QAAQ,MAAM,MAAM,GAAG,UAAU,CAAC;AAClC,cAAc,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE;AACzD,cAAc,EAAE;AAChB,QAAQ,MAAM,MAAM,GAAG,2BAA2B,CAAC,UAAU,CAAC,cAAc,CAAC;AAC7E,QAAQ,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,EAAE,MAAM,EAAE,EAAE;AACzE,YAAY,UAAU,EAAE,UAAU;AAClC,YAAY,MAAM,EAAE,MAAM;AAC1B,SAAS,CAAC;AACV,QAAQ,IAAI,YAAY,CAAC,WAAW;AACpC,YAAY,YAAY,CAAC,WAAW,CAAC,WAAW;AAChD,YAAY,YAAY,CAAC,WAAW,CAAC,SAAS,EAAE;AAChD,YAAY,IAAI,CAAC,uBAAuB,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,eAAe;AACjF,YAAY,MAAM,GAAG,GAAG;AACxB,gBAAgB,WAAW,EAAE;AAC7B,oBAAoB,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC,WAAW;AACrE,oBAAoB,eAAe,EAAE,YAAY,CAAC,WAAW,CAAC,SAAS;AACvE,oBAAoB,YAAY,EAAE,YAAY,CAAC,WAAW,CAAC,YAAY;AACvE,oBAAoB,UAAU,EAAE,YAAY,CAAC,WAAW,CAAC,UAAU;AACnE,iBAAiB;AACjB,gBAAgB,UAAU;AAC1B,aAAa;AACb,YAAY,IAAI,YAAY,CAAC,UAAU,EAAE;AACzC,gBAAgB,GAAG,CAAC,UAAU,GAAG,YAAY,CAAC,UAAU;AACxD;AACA,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;AACtD,oBAAoB,EAAE,EAAE,YAAY,CAAC,UAAU;AAC/C,oBAAoB,IAAI,EAAE,SAAS;AACnC,iBAAiB,CAAC;AAClB;AACA;AACA,YAAY,IAAI,CAAC,yBAAyB,GAAG;AAC7C,gBAAgB,GAAG,GAAG;AACtB,gBAAgB,oBAAoB,EAAE,IAAI;AAC1C,gBAAgB,iBAAiB,EAAE,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE;AACjE,aAAa;AACb,YAAY,OAAO,GAAG;AACtB;AACA,aAAa;AACb,YAAY,MAAM,IAAI,SAAS,CAAC;AAChC,gBAAgB,IAAI,EAAE,sBAAsB;AAC5C,gBAAgB,OAAO,EAAE,CAAC,0EAA0E,CAAC;AACrG,aAAa,CAAC;AACd;AACA;AACA,IAAI,SAAS,GAAG;AAChB,QAAQ,OAAO,IAAI,CAAC,uBAAuB,KAAK;AAChD,cAAc;AACd,cAAc,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,GAAG,EAAE;AACxD;AACA,IAAI,eAAe,CAAC,MAAM,EAAE;AAC5B,QAAQ,QAAQ,CAAC,CAAC,MAAM;AACxB,YAAY,CAAC,CAAC,IAAI,CAAC,yBAAyB,EAAE,iBAAiB;AAC/D,YAAY,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE;AACtC,gBAAgB,IAAI,CAAC,yBAAyB,CAAC,iBAAiB;AAChE;AACA;;;;"}
+{"version":3,"file":"credentialsProvider.mjs","sources":["../../../../../src/providers/cognito/credentialsProvider/credentialsProvider.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { ConsoleLogger, getCredentialsForIdentity, } from '@aws-amplify/core';\nimport { assertIdentityPoolIdConfig, } from '@aws-amplify/core/internals/utils';\nimport { AuthError } from '../../../errors/AuthError';\nimport { assertServiceError } from '../../../errors/utils/assertServiceError';\nimport { getRegionFromIdentityPoolId } from '../../../foundation/parsers';\nimport { assertIdTokenInAuthTokens } from '../utils/types';\nimport { cognitoIdentityIdProvider } from './IdentityIdProvider';\nimport { formLoginsMap } from './utils';\nconst logger = new ConsoleLogger('CognitoCredentialsProvider');\nconst CREDENTIALS_TTL = 50 * 60 * 1000; // 50 min, can be modified on config if required in the future\nexport class CognitoAWSCredentialsAndIdentityIdProvider {\n    constructor(identityIdStore) {\n        this._nextCredentialsRefresh = 0;\n        this._identityIdStore = identityIdStore;\n    }\n    async clearCredentialsAndIdentityId() {\n        logger.debug('Clearing out credentials and identityId');\n        this._credentialsAndIdentityId = undefined;\n        await this._identityIdStore.clearIdentityId();\n    }\n    async clearCredentials() {\n        logger.debug('Clearing out in-memory credentials');\n        this._credentialsAndIdentityId = undefined;\n    }\n    async getCredentialsAndIdentityId(getCredentialsOptions) {\n        const isAuthenticated = getCredentialsOptions.authenticated;\n        const { tokens } = getCredentialsOptions;\n        const { authConfig } = getCredentialsOptions;\n        try {\n            assertIdentityPoolIdConfig(authConfig?.Cognito);\n        }\n        catch {\n            // No identity pool configured, skipping\n            return;\n        }\n        if (!isAuthenticated && !authConfig.Cognito.allowGuestAccess) {\n            // TODO(V6): return partial result like Native platforms\n            return;\n        }\n        const { forceRefresh } = getCredentialsOptions;\n        const tokenHasChanged = this.hasTokenChanged(tokens);\n        const identityId = await cognitoIdentityIdProvider({\n            tokens,\n            authConfig: authConfig.Cognito,\n            identityIdStore: this._identityIdStore,\n        });\n        // Clear cached credentials when forceRefresh is true OR the cache token has changed\n        if (forceRefresh || tokenHasChanged) {\n            this.clearCredentials();\n        }\n        if (!isAuthenticated) {\n            return this.getGuestCredentials(identityId, authConfig.Cognito);\n        }\n        else {\n            assertIdTokenInAuthTokens(tokens);\n            return this.credsForOIDCTokens(authConfig.Cognito, tokens, identityId);\n        }\n    }\n    async getGuestCredentials(identityId, authConfig) {\n        // Return existing in-memory cached credentials only if it exists, is not past it's lifetime and is unauthenticated credentials\n        if (this._credentialsAndIdentityId &&\n            !this.isPastTTL() &&\n            this._credentialsAndIdentityId.isAuthenticatedCreds === false) {\n            logger.info('returning stored credentials as they neither past TTL nor expired.');\n            return this._credentialsAndIdentityId;\n        }\n        // Clear to discard if any authenticated credentials are set and start with a clean slate\n        this.clearCredentials();\n        const region = getRegionFromIdentityPoolId(authConfig.identityPoolId);\n        // use identityId to obtain guest credentials\n        // save credentials in-memory\n        // No logins params should be passed for guest creds:\n        // https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetCredentialsForIdentity.html\n        let clientResult;\n        try {\n            clientResult = await getCredentialsForIdentity({ region }, {\n                IdentityId: identityId,\n            });\n        }\n        catch (e) {\n            assertServiceError(e);\n            throw new AuthError(e);\n        }\n        if (clientResult?.Credentials?.AccessKeyId &&\n            clientResult?.Credentials?.SecretKey) {\n            this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;\n            const res = {\n                credentials: {\n                    accessKeyId: clientResult.Credentials.AccessKeyId,\n                    secretAccessKey: clientResult.Credentials.SecretKey,\n                    sessionToken: clientResult.Credentials.SessionToken,\n                    expiration: clientResult.Credentials.Expiration,\n                },\n                identityId,\n            };\n            if (clientResult.IdentityId) {\n                res.identityId = clientResult.IdentityId;\n                this._identityIdStore.storeIdentityId({\n                    id: clientResult.IdentityId,\n                    type: 'guest',\n                });\n            }\n            this._credentialsAndIdentityId = {\n                ...res,\n                isAuthenticatedCreds: false,\n            };\n            return res;\n        }\n        else {\n            throw new AuthError({\n                name: 'CredentialsNotFoundException',\n                message: `Cognito did not respond with either Credentials, AccessKeyId or SecretKey.`,\n            });\n        }\n    }\n    async credsForOIDCTokens(authConfig, authTokens, identityId) {\n        if (this._credentialsAndIdentityId &&\n            !this.isPastTTL() &&\n            this._credentialsAndIdentityId.isAuthenticatedCreds === true) {\n            logger.debug('returning stored credentials as they neither past TTL nor expired.');\n            return this._credentialsAndIdentityId;\n        }\n        // Clear to discard if any unauthenticated credentials are set and start with a clean slate\n        this.clearCredentials();\n        const logins = authTokens.idToken\n            ? formLoginsMap(authTokens.idToken.toString())\n            : {};\n        const region = getRegionFromIdentityPoolId(authConfig.identityPoolId);\n        let clientResult;\n        try {\n            clientResult = await getCredentialsForIdentity({ region }, {\n                IdentityId: identityId,\n                Logins: logins,\n            });\n        }\n        catch (e) {\n            assertServiceError(e);\n            throw new AuthError(e);\n        }\n        if (clientResult?.Credentials?.AccessKeyId &&\n            clientResult?.Credentials?.SecretKey) {\n            this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;\n            const res = {\n                credentials: {\n                    accessKeyId: clientResult.Credentials.AccessKeyId,\n                    secretAccessKey: clientResult.Credentials.SecretKey,\n                    sessionToken: clientResult.Credentials.SessionToken,\n                    expiration: clientResult.Credentials.Expiration,\n                },\n                identityId,\n            };\n            if (clientResult.IdentityId) {\n                res.identityId = clientResult.IdentityId;\n                // note: the following call removes guest identityId from the persistent store (localStorage)\n                this._identityIdStore.storeIdentityId({\n                    id: clientResult.IdentityId,\n                    type: 'primary',\n                });\n            }\n            // Store the credentials in-memory along with the expiration\n            this._credentialsAndIdentityId = {\n                ...res,\n                isAuthenticatedCreds: true,\n                associatedIdToken: authTokens.idToken?.toString(),\n            };\n            return res;\n        }\n        else {\n            throw new AuthError({\n                name: 'CredentialsException',\n                message: `Cognito did not respond with either Credentials, AccessKeyId or SecretKey.`,\n            });\n        }\n    }\n    isPastTTL() {\n        return this._nextCredentialsRefresh === undefined\n            ? true\n            : this._nextCredentialsRefresh <= Date.now();\n    }\n    hasTokenChanged(tokens) {\n        return (!!tokens &&\n            !!this._credentialsAndIdentityId?.associatedIdToken &&\n            tokens.idToken?.toString() !==\n                this._credentialsAndIdentityId.associatedIdToken);\n    }\n}\n"],"names":[],"mappings":";;;;;;;;;AAAA;AACA;AASA,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,4BAA4B,CAAC;AAC9D,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAChC,MAAM,0CAA0C,CAAC;AACxD,IAAI,WAAW,CAAC,eAAe,EAAE;AACjC,QAAQ,IAAI,CAAC,uBAAuB,GAAG,CAAC;AACxC,QAAQ,IAAI,CAAC,gBAAgB,GAAG,eAAe;AAC/C;AACA,IAAI,MAAM,6BAA6B,GAAG;AAC1C,QAAQ,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC;AAC/D,QAAQ,IAAI,CAAC,yBAAyB,GAAG,SAAS;AAClD,QAAQ,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE;AACrD;AACA,IAAI,MAAM,gBAAgB,GAAG;AAC7B,QAAQ,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC;AAC1D,QAAQ,IAAI,CAAC,yBAAyB,GAAG,SAAS;AAClD;AACA,IAAI,MAAM,2BAA2B,CAAC,qBAAqB,EAAE;AAC7D,QAAQ,MAAM,eAAe,GAAG,qBAAqB,CAAC,aAAa;AACnE,QAAQ,MAAM,EAAE,MAAM,EAAE,GAAG,qBAAqB;AAChD,QAAQ,MAAM,EAAE,UAAU,EAAE,GAAG,qBAAqB;AACpD,QAAQ,IAAI;AACZ,YAAY,0BAA0B,CAAC,UAAU,EAAE,OAAO,CAAC;AAC3D;AACA,QAAQ,MAAM;AACd;AACA,YAAY;AACZ;AACA,QAAQ,IAAI,CAAC,eAAe,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,EAAE;AACtE;AACA,YAAY;AACZ;AACA,QAAQ,MAAM,EAAE,YAAY,EAAE,GAAG,qBAAqB;AACtD,QAAQ,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;AAC5D,QAAQ,MAAM,UAAU,GAAG,MAAM,yBAAyB,CAAC;AAC3D,YAAY,MAAM;AAClB,YAAY,UAAU,EAAE,UAAU,CAAC,OAAO;AAC1C,YAAY,eAAe,EAAE,IAAI,CAAC,gBAAgB;AAClD,SAAS,CAAC;AACV;AACA,QAAQ,IAAI,YAAY,IAAI,eAAe,EAAE;AAC7C,YAAY,IAAI,CAAC,gBAAgB,EAAE;AACnC;AACA,QAAQ,IAAI,CAAC,eAAe,EAAE;AAC9B,YAAY,OAAO,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC;AAC3E;AACA,aAAa;AACb,YAAY,yBAAyB,CAAC,MAAM,CAAC;AAC7C,YAAY,OAAO,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC;AAClF;AACA;AACA,IAAI,MAAM,mBAAmB,CAAC,UAAU,EAAE,UAAU,EAAE;AACtD;AACA,QAAQ,IAAI,IAAI,CAAC,yBAAyB;AAC1C,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE;AAC7B,YAAY,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,KAAK,KAAK,EAAE;AAC3E,YAAY,MAAM,CAAC,IAAI,CAAC,oEAAoE,CAAC;AAC7F,YAAY,OAAO,IAAI,CAAC,yBAAyB;AACjD;AACA;AACA,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,QAAQ,MAAM,MAAM,GAAG,2BAA2B,CAAC,UAAU,CAAC,cAAc,CAAC;AAC7E;AACA;AACA;AACA;AACA,QAAQ,IAAI,YAAY;AACxB,QAAQ,IAAI;AACZ,YAAY,YAAY,GAAG,MAAM,yBAAyB,CAAC,EAAE,MAAM,EAAE,EAAE;AACvE,gBAAgB,UAAU,EAAE,UAAU;AACtC,aAAa,CAAC;AACd;AACA,QAAQ,OAAO,CAAC,EAAE;AAClB,YAAY,kBAAkB,CAAC,CAAC,CAAC;AACjC,YAAY,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC;AAClC;AACA,QAAQ,IAAI,YAAY,EAAE,WAAW,EAAE,WAAW;AAClD,YAAY,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE;AAClD,YAAY,IAAI,CAAC,uBAAuB,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,eAAe;AACjF,YAAY,MAAM,GAAG,GAAG;AACxB,gBAAgB,WAAW,EAAE;AAC7B,oBAAoB,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC,WAAW;AACrE,oBAAoB,eAAe,EAAE,YAAY,CAAC,WAAW,CAAC,SAAS;AACvE,oBAAoB,YAAY,EAAE,YAAY,CAAC,WAAW,CAAC,YAAY;AACvE,oBAAoB,UAAU,EAAE,YAAY,CAAC,WAAW,CAAC,UAAU;AACnE,iBAAiB;AACjB,gBAAgB,UAAU;AAC1B,aAAa;AACb,YAAY,IAAI,YAAY,CAAC,UAAU,EAAE;AACzC,gBAAgB,GAAG,CAAC,UAAU,GAAG,YAAY,CAAC,UAAU;AACxD,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;AACtD,oBAAoB,EAAE,EAAE,YAAY,CAAC,UAAU;AAC/C,oBAAoB,IAAI,EAAE,OAAO;AACjC,iBAAiB,CAAC;AAClB;AACA,YAAY,IAAI,CAAC,yBAAyB,GAAG;AAC7C,gBAAgB,GAAG,GAAG;AACtB,gBAAgB,oBAAoB,EAAE,KAAK;AAC3C,aAAa;AACb,YAAY,OAAO,GAAG;AACtB;AACA,aAAa;AACb,YAAY,MAAM,IAAI,SAAS,CAAC;AAChC,gBAAgB,IAAI,EAAE,8BAA8B;AACpD,gBAAgB,OAAO,EAAE,CAAC,0EAA0E,CAAC;AACrG,aAAa,CAAC;AACd;AACA;AACA,IAAI,MAAM,kBAAkB,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE;AACjE,QAAQ,IAAI,IAAI,CAAC,yBAAyB;AAC1C,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE;AAC7B,YAAY,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,KAAK,IAAI,EAAE;AAC1E,YAAY,MAAM,CAAC,KAAK,CAAC,oEAAoE,CAAC;AAC9F,YAAY,OAAO,IAAI,CAAC,yBAAyB;AACjD;AACA;AACA,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,QAAQ,MAAM,MAAM,GAAG,UAAU,CAAC;AAClC,cAAc,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE;AACzD,cAAc,EAAE;AAChB,QAAQ,MAAM,MAAM,GAAG,2BAA2B,CAAC,UAAU,CAAC,cAAc,CAAC;AAC7E,QAAQ,IAAI,YAAY;AACxB,QAAQ,IAAI;AACZ,YAAY,YAAY,GAAG,MAAM,yBAAyB,CAAC,EAAE,MAAM,EAAE,EAAE;AACvE,gBAAgB,UAAU,EAAE,UAAU;AACtC,gBAAgB,MAAM,EAAE,MAAM;AAC9B,aAAa,CAAC;AACd;AACA,QAAQ,OAAO,CAAC,EAAE;AAClB,YAAY,kBAAkB,CAAC,CAAC,CAAC;AACjC,YAAY,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC;AAClC;AACA,QAAQ,IAAI,YAAY,EAAE,WAAW,EAAE,WAAW;AAClD,YAAY,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE;AAClD,YAAY,IAAI,CAAC,uBAAuB,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,eAAe;AACjF,YAAY,MAAM,GAAG,GAAG;AACxB,gBAAgB,WAAW,EAAE;AAC7B,oBAAoB,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC,WAAW;AACrE,oBAAoB,eAAe,EAAE,YAAY,CAAC,WAAW,CAAC,SAAS;AACvE,oBAAoB,YAAY,EAAE,YAAY,CAAC,WAAW,CAAC,YAAY;AACvE,oBAAoB,UAAU,EAAE,YAAY,CAAC,WAAW,CAAC,UAAU;AACnE,iBAAiB;AACjB,gBAAgB,UAAU;AAC1B,aAAa;AACb,YAAY,IAAI,YAAY,CAAC,UAAU,EAAE;AACzC,gBAAgB,GAAG,CAAC,UAAU,GAAG,YAAY,CAAC,UAAU;AACxD;AACA,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;AACtD,oBAAoB,EAAE,EAAE,YAAY,CAAC,UAAU;AAC/C,oBAAoB,IAAI,EAAE,SAAS;AACnC,iBAAiB,CAAC;AAClB;AACA;AACA,YAAY,IAAI,CAAC,yBAAyB,GAAG;AAC7C,gBAAgB,GAAG,GAAG;AACtB,gBAAgB,oBAAoB,EAAE,IAAI;AAC1C,gBAAgB,iBAAiB,EAAE,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE;AACjE,aAAa;AACb,YAAY,OAAO,GAAG;AACtB;AACA,aAAa;AACb,YAAY,MAAM,IAAI,SAAS,CAAC;AAChC,gBAAgB,IAAI,EAAE,sBAAsB;AAC5C,gBAAgB,OAAO,EAAE,CAAC,0EAA0E,CAAC;AACrG,aAAa,CAAC;AACd;AACA;AACA,IAAI,SAAS,GAAG;AAChB,QAAQ,OAAO,IAAI,CAAC,uBAAuB,KAAK;AAChD,cAAc;AACd,cAAc,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,GAAG,EAAE;AACxD;AACA,IAAI,eAAe,CAAC,MAAM,EAAE;AAC5B,QAAQ,QAAQ,CAAC,CAAC,MAAM;AACxB,YAAY,CAAC,CAAC,IAAI,CAAC,yBAAyB,EAAE,iBAAiB;AAC/D,YAAY,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE;AACtC,gBAAgB,IAAI,CAAC,yBAAyB,CAAC,iBAAiB;AAChE;AACA;;;;"}

package/dist/esm/providers/cognito/tokenProvider/types.d.ts

@@ -5,9 +5,7 @@ export type TokenRefresher = ({ tokens, authConfig, username, }: {
     authConfig?: AuthConfig;
     username: string;
 }) => Promise<CognitoAuthTokens>;
-export type AuthKeys<AuthKey extends string> = {
-    [Key in AuthKey]: string;
-};
+export type AuthKeys<AuthKey extends string> = Record<AuthKey, string>;
 export declare const AuthTokenStorageKeys: {
     accessToken: string;
     idToken: string;

package/dist/esm/types/Auth.d.ts

@@ -16,9 +16,7 @@ export declare enum AuthErrorTypes {
     AutoSignInError = "autoSignInError",
     OAuthSignInError = "oauthSignInError"
 }
-export type AuthErrorMessages = {
-    [key in AuthErrorTypes]: AuthErrorMessage;
-};
+export type AuthErrorMessages = Record<AuthErrorTypes, AuthErrorMessage>;
 export interface AuthErrorMessage {
     message: string;
     log?: string;

package/dist/esm/types/models.d.ts

@@ -201,9 +201,7 @@ export type AuthNextSignInStep<UserAttributeKey extends AuthUserAttributeKey = A
 /**
  * Key/value pairs describing a user attributes.
  */
-export type AuthUserAttributes<UserAttributeKey extends AuthUserAttributeKey = AuthUserAttributeKey> = {
-    [Attribute in UserAttributeKey]?: string;
-};
+export type AuthUserAttributes<UserAttributeKey extends AuthUserAttributeKey = AuthUserAttributeKey> = Partial<Record<UserAttributeKey, string>>;
 /**
  * The interface of a user attribute.
  */

package/dist/esm/types/outputs.d.ts

@@ -16,6 +16,4 @@ export interface AuthUpdateUserAttributeOutput<UserAttributeKey extends AuthUser
     isUpdated: boolean;
     nextStep: AuthNextUpdateAttributeStep<UserAttributeKey>;
 }
-export type AuthUpdateUserAttributesOutput<UserAttributeKey extends AuthUserAttributeKey = AuthUserAttributeKey> = {
-    [authKey in UserAttributeKey]: AuthUpdateUserAttributeOutput<UserAttributeKey>;
-};
+export type AuthUpdateUserAttributesOutput<UserAttributeKey extends AuthUserAttributeKey = AuthUserAttributeKey> = Record<UserAttributeKey, AuthUpdateUserAttributeOutput<UserAttributeKey>>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-amplify/auth",
-  "version": "6.11.6-unstable.cde36a7.0+cde36a7",
+  "version": "6.11.7-unstable.b188564.0+b188564",
   "description": "Auth category of aws-amplify",
   "main": "./dist/cjs/index.js",
   "module": "./dist/esm/index.mjs",
@@ -96,13 +96,13 @@
     "tslib": "^2.5.0"
   },
   "peerDependencies": {
-    "@aws-amplify/core": "6.10.6-unstable.cde36a7.0+cde36a7"
+    "@aws-amplify/core": "6.10.7-unstable.b188564.0+b188564"
   },
   "devDependencies": {
-    "@aws-amplify/core": "6.10.6-unstable.cde36a7.0+cde36a7",
-    "@aws-amplify/react-native": "1.1.8-unstable.cde36a7.0+cde36a7",
+    "@aws-amplify/core": "6.10.7-unstable.b188564.0+b188564",
+    "@aws-amplify/react-native": "1.1.8-unstable.b188564.0+b188564",
     "@jest/test-sequencer": "^29.7.0",
     "typescript": "5.0.2"
   },
-  "gitHead": "cde36a7b5ca5254a6821db46832a80c9e0ea54fd"
+  "gitHead": "b1885648589e0549c0e7c257e8be5fb4936d5bde"
 }

package/src/foundation/factories/serviceClients/cognitoIdentityProvider/shared/serde/createUserPoolDeserializer.ts

@@ -16,7 +16,11 @@ export const createUserPoolDeserializer =
 		if (response.statusCode >= 300) {
 			const error = await parseJsonError(response);
 			assertServiceError(error);
-			throw new AuthError({ name: error.name, message: error.message });
+			throw new AuthError({
+				name: error.name,
+				message: error.message,
+				metadata: error.$metadata,
+			});
 		}
 
 		return parseJsonBody(response);

package/src/providers/cognito/credentialsProvider/IdentityIdProvider.ts

@@ -5,6 +5,7 @@ import { AuthTokens, Identity, getId } from '@aws-amplify/core';
 import { CognitoIdentityPoolConfig } from '@aws-amplify/core/internals/utils';
 
 import { AuthError } from '../../../errors/AuthError';
+import { assertServiceError } from '../../../errors/utils/assertServiceError';
 import { getRegionFromIdentityPoolId } from '../../../foundation/parsers';
 import { GetIdException } from '../types/errors';
 
@@ -58,10 +59,11 @@ async function generateIdentityId(
 	const region = getRegionFromIdentityPoolId(identityPoolId);
 
 	// IdentityId is absent so get it using IdentityPoolId with Cognito's GetId API
-	const idResult =
-		// for a first-time user, this will return a brand new identity
-		// for a returning user, this will retrieve the previous identity assocaited with the logins
-		(
+	let idResult: string | undefined;
+	// for a first-time user, this will return a brand new identity
+	// for a returning user, this will retrieve the previous identity assocaited with the logins
+	try {
+		idResult = (
 			await getId(
 				{
 					region,
@@ -72,6 +74,10 @@ async function generateIdentityId(
 				},
 			)
 		).IdentityId;
+	} catch (e) {
+		assertServiceError(e);
+		throw new AuthError(e);
+	}
 	if (!idResult) {
 		throw new AuthError({
 			name: 'GetIdResponseException',

package/src/providers/cognito/credentialsProvider/credentialsProvider.ts

@@ -15,6 +15,7 @@ import {
 } from '@aws-amplify/core/internals/utils';
 
 import { AuthError } from '../../../errors/AuthError';
+import { assertServiceError } from '../../../errors/utils/assertServiceError';
 import { getRegionFromIdentityPoolId } from '../../../foundation/parsers';
 import { assertIdTokenInAuthTokens } from '../utils/types';
 
@@ -116,17 +117,24 @@ export class CognitoAWSCredentialsAndIdentityIdProvider
 		// save credentials in-memory
 		// No logins params should be passed for guest creds:
 		// https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetCredentialsForIdentity.html
-		const clientResult = await getCredentialsForIdentity(
-			{ region },
-			{
-				IdentityId: identityId,
-			},
-		);
+		let clientResult:
+			| Awaited<ReturnType<typeof getCredentialsForIdentity>>
+			| undefined;
+		try {
+			clientResult = await getCredentialsForIdentity(
+				{ region },
+				{
+					IdentityId: identityId,
+				},
+			);
+		} catch (e) {
+			assertServiceError(e);
+			throw new AuthError(e);
+		}
 
 		if (
-			clientResult.Credentials &&
-			clientResult.Credentials.AccessKeyId &&
-			clientResult.Credentials.SecretKey
+			clientResult?.Credentials?.AccessKeyId &&
+			clientResult?.Credentials?.SecretKey
 		) {
 			this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;
 
@@ -186,18 +194,25 @@ export class CognitoAWSCredentialsAndIdentityIdProvider
 
 		const region = getRegionFromIdentityPoolId(authConfig.identityPoolId);
 
-		const clientResult = await getCredentialsForIdentity(
-			{ region },
-			{
-				IdentityId: identityId,
-				Logins: logins,
-			},
-		);
+		let clientResult:
+			| Awaited<ReturnType<typeof getCredentialsForIdentity>>
+			| undefined;
+		try {
+			clientResult = await getCredentialsForIdentity(
+				{ region },
+				{
+					IdentityId: identityId,
+					Logins: logins,
+				},
+			);
+		} catch (e) {
+			assertServiceError(e);
+			throw new AuthError(e);
+		}
 
 		if (
-			clientResult.Credentials &&
-			clientResult.Credentials.AccessKeyId &&
-			clientResult.Credentials.SecretKey
+			clientResult?.Credentials?.AccessKeyId &&
+			clientResult?.Credentials?.SecretKey
 		) {
 			this._nextCredentialsRefresh = new Date().getTime() + CREDENTIALS_TTL;
 

package/src/providers/cognito/tokenProvider/types.ts

@@ -20,9 +20,7 @@ export type TokenRefresher = ({
 	username: string;
 }) => Promise<CognitoAuthTokens>;
 
-export type AuthKeys<AuthKey extends string> = {
-	[Key in AuthKey]: string;
-};
+export type AuthKeys<AuthKey extends string> = Record<AuthKey, string>;
 
 export const AuthTokenStorageKeys = {
 	accessToken: 'accessToken',

package/src/types/Auth.ts

@@ -20,7 +20,7 @@ export enum AuthErrorTypes {
 	OAuthSignInError = 'oauthSignInError',
 }
 
-export type AuthErrorMessages = { [key in AuthErrorTypes]: AuthErrorMessage };
+export type AuthErrorMessages = Record<AuthErrorTypes, AuthErrorMessage>;
 
 export interface AuthErrorMessage {
 	message: string;

package/src/types/models.ts

@@ -251,9 +251,7 @@ export type AuthNextSignInStep<
  */
 export type AuthUserAttributes<
 	UserAttributeKey extends AuthUserAttributeKey = AuthUserAttributeKey,
-> = {
-	[Attribute in UserAttributeKey]?: string;
-};
+> = Partial<Record<UserAttributeKey, string>>;
 
 /**
  * The interface of a user attribute.

package/src/types/outputs.ts

@@ -40,6 +40,4 @@ export interface AuthUpdateUserAttributeOutput<
 
 export type AuthUpdateUserAttributesOutput<
 	UserAttributeKey extends AuthUserAttributeKey = AuthUserAttributeKey,
-> = {
-	[authKey in UserAttributeKey]: AuthUpdateUserAttributeOutput<UserAttributeKey>;
-};
+> = Record<UserAttributeKey, AuthUpdateUserAttributeOutput<UserAttributeKey>>;