@aws-amplify/auth 6.14.0 → 6.14.1-unstable.2212704.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cjs/providers/cognito/apis/signInWithRedirect.js +27 -25
- package/dist/cjs/providers/cognito/apis/signInWithRedirect.js.map +1 -1
- package/dist/esm/providers/cognito/apis/signInWithRedirect.mjs +27 -25
- package/dist/esm/providers/cognito/apis/signInWithRedirect.mjs.map +1 -1
- package/dist/esm/types/inputs.d.ts +23 -0
- package/package.json +105 -105
- package/src/providers/cognito/apis/signInWithRedirect.ts +39 -26
- package/src/types/inputs.ts +26 -0
|
@@ -26,7 +26,9 @@ async function signInWithRedirect(input) {
|
|
|
26
26
|
(0, utils_1.assertTokenProviderConfig)(authConfig);
|
|
27
27
|
(0, utils_1.assertOAuthConfig)(authConfig);
|
|
28
28
|
oauth_1.oAuthStore.setAuthConfig(authConfig);
|
|
29
|
-
|
|
29
|
+
if (!input?.options?.prompt) {
|
|
30
|
+
await (0, signInHelpers_1.assertUserNotAuthenticated)();
|
|
31
|
+
}
|
|
30
32
|
let provider = 'COGNITO'; // Default
|
|
31
33
|
if (typeof input?.provider === 'string') {
|
|
32
34
|
provider = models_1.cognitoHostedUIIdentityProviderMap[input.provider];
|
|
@@ -44,13 +46,16 @@ async function signInWithRedirect(input) {
|
|
|
44
46
|
loginHint: input?.options?.loginHint,
|
|
45
47
|
lang: input?.options?.lang,
|
|
46
48
|
nonce: input?.options?.nonce,
|
|
49
|
+
prompt: input?.options?.prompt,
|
|
47
50
|
},
|
|
51
|
+
authSessionOpener: input?.options?.authSessionOpener,
|
|
48
52
|
});
|
|
49
53
|
}
|
|
50
|
-
const oauthSignIn = async ({ oauthConfig, provider, clientId, customState, preferPrivateSession, options, }) => {
|
|
54
|
+
const oauthSignIn = async ({ oauthConfig, provider, clientId, customState, preferPrivateSession, options, authSessionOpener, }) => {
|
|
51
55
|
const { domain, redirectSignIn, responseType, scopes } = oauthConfig;
|
|
52
|
-
const { loginHint, lang, nonce } = options ?? {};
|
|
56
|
+
const { loginHint, lang, nonce, prompt } = options ?? {};
|
|
53
57
|
const randomState = (0, oauth_1.generateState)();
|
|
58
|
+
const openAuthSession = authSessionOpener || utils_2.openAuthSession;
|
|
54
59
|
/* encodeURIComponent is not URL safe, use urlSafeEncode instead. Cognito
|
|
55
60
|
single-encodes/decodes url on first sign in and double-encodes/decodes url
|
|
56
61
|
when user already signed in. Using encodeURIComponent, Base32, Base64 add
|
|
@@ -66,33 +71,30 @@ const oauthSignIn = async ({ oauthConfig, provider, clientId, customState, prefe
|
|
|
66
71
|
oauth_1.oAuthStore.storeOAuthInFlight(true);
|
|
67
72
|
oauth_1.oAuthStore.storeOAuthState(state);
|
|
68
73
|
oauth_1.oAuthStore.storePKCE(value);
|
|
69
|
-
const
|
|
70
|
-
redirect_uri
|
|
71
|
-
response_type
|
|
72
|
-
client_id
|
|
73
|
-
identity_provider
|
|
74
|
-
scope
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
}
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
// TODO(v6): use URL object instead
|
|
88
|
-
const oAuthUrl = `https://${domain}/oauth2/authorize?${queryString}`;
|
|
74
|
+
const params = new URLSearchParams([
|
|
75
|
+
['redirect_uri', redirectUri],
|
|
76
|
+
['response_type', responseType],
|
|
77
|
+
['client_id', clientId],
|
|
78
|
+
['identity_provider', provider],
|
|
79
|
+
['scope', scopes.join(' ')],
|
|
80
|
+
]);
|
|
81
|
+
loginHint && params.append('login_hint', loginHint);
|
|
82
|
+
lang && params.append('lang', lang);
|
|
83
|
+
nonce && params.append('nonce', nonce);
|
|
84
|
+
prompt && params.append('prompt', prompt.toLowerCase());
|
|
85
|
+
params.append('state', state);
|
|
86
|
+
if (responseType === 'code') {
|
|
87
|
+
params.append('code_challenge', toCodeChallenge());
|
|
88
|
+
params.append('code_challenge_method', method);
|
|
89
|
+
}
|
|
90
|
+
const oAuthUrl = new URL('/oauth2/authorize', `https://${domain}/`);
|
|
91
|
+
oAuthUrl.search = params.toString();
|
|
89
92
|
// this will only take effect in the following scenarios:
|
|
90
93
|
// 1. the user cancels the OAuth flow on web via back button, and
|
|
91
94
|
// 2. when bfcache is enabled
|
|
92
95
|
(0, cancelOAuthFlow_1.listenForOAuthFlowCancellation)(oauth_1.oAuthStore);
|
|
93
96
|
// the following is effective only in react-native as openAuthSession resolves only in react-native
|
|
94
|
-
const { type, error, url } = (await
|
|
95
|
-
{};
|
|
97
|
+
const { type, error, url } = (await openAuthSession(oAuthUrl.href, redirectSignIn, preferPrivateSession)) ?? {};
|
|
96
98
|
try {
|
|
97
99
|
if (type === 'error') {
|
|
98
100
|
throw (0, createOAuthError_1.createOAuthError)(String(error));
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"signInWithRedirect.js","sources":["../../../../../src/providers/cognito/apis/signInWithRedirect.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.signInWithRedirect = signInWithRedirect;\nconst core_1 = require(\"@aws-amplify/core\");\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nrequire(\"../utils/oauth/enableOAuthListener\");\nconst models_1 = require(\"../types/models\");\nconst utils_2 = require(\"../../../utils\");\nconst signInHelpers_1 = require(\"../utils/signInHelpers\");\nconst oauth_1 = require(\"../utils/oauth\");\nconst createOAuthError_1 = require(\"../utils/oauth/createOAuthError\");\nconst cancelOAuthFlow_1 = require(\"../utils/oauth/cancelOAuthFlow\");\n/**\n * Signs in a user with OAuth. Redirects the application to an Identity Provider.\n *\n * @param input - The SignInWithRedirectInput object, if empty it will redirect to Cognito HostedUI\n *\n * @throws AuthTokenConfigException - Thrown when the user pool config is invalid.\n * @throws OAuthNotConfigureException - Thrown when the oauth config is invalid.\n */\nasync function signInWithRedirect(input) {\n const authConfig = core_1.Amplify.getConfig().Auth?.Cognito;\n (0, utils_1.assertTokenProviderConfig)(authConfig);\n (0, utils_1.assertOAuthConfig)(authConfig);\n oauth_1.oAuthStore.setAuthConfig(authConfig);\n await (0, signInHelpers_1.assertUserNotAuthenticated)();\n let provider = 'COGNITO'; // Default\n if (typeof input?.provider === 'string') {\n provider = models_1.cognitoHostedUIIdentityProviderMap[input.provider];\n }\n else if (input?.provider?.custom) {\n provider = input.provider.custom;\n }\n return oauthSignIn({\n oauthConfig: authConfig.loginWith.oauth,\n clientId: authConfig.userPoolClientId,\n provider,\n customState: input?.customState,\n preferPrivateSession: input?.options?.preferPrivateSession,\n options: {\n loginHint: input?.options?.loginHint,\n lang: input?.options?.lang,\n nonce: input?.options?.nonce,\n },\n });\n}\nconst oauthSignIn = async ({ oauthConfig, provider, clientId, customState, preferPrivateSession, options, }) => {\n const { domain, redirectSignIn, responseType, scopes } = oauthConfig;\n const { loginHint, lang, nonce } = options ?? {};\n const randomState = (0, oauth_1.generateState)();\n /* encodeURIComponent is not URL safe, use urlSafeEncode instead. Cognito\n single-encodes/decodes url on first sign in and double-encodes/decodes url\n when user already signed in. Using encodeURIComponent, Base32, Base64 add\n characters % or = which on further encoding becomes unsafe. '=' create issue\n for parsing query params.\n Refer: https://github.com/aws-amplify/amplify-js/issues/5218 */\n const state = customState\n ? `${randomState}-${(0, utils_1.urlSafeEncode)(customState)}`\n : randomState;\n const { value, method, toCodeChallenge } = (0, oauth_1.generateCodeVerifier)(128);\n const redirectUri = (0, oauth_1.getRedirectUrl)(oauthConfig.redirectSignIn);\n if ((0, utils_1.isBrowser)())\n oauth_1.oAuthStore.storeOAuthInFlight(true);\n oauth_1.oAuthStore.storeOAuthState(state);\n oauth_1.oAuthStore.storePKCE(value);\n const
|
|
1
|
+
{"version":3,"file":"signInWithRedirect.js","sources":["../../../../../src/providers/cognito/apis/signInWithRedirect.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.signInWithRedirect = signInWithRedirect;\nconst core_1 = require(\"@aws-amplify/core\");\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nrequire(\"../utils/oauth/enableOAuthListener\");\nconst models_1 = require(\"../types/models\");\nconst utils_2 = require(\"../../../utils\");\nconst signInHelpers_1 = require(\"../utils/signInHelpers\");\nconst oauth_1 = require(\"../utils/oauth\");\nconst createOAuthError_1 = require(\"../utils/oauth/createOAuthError\");\nconst cancelOAuthFlow_1 = require(\"../utils/oauth/cancelOAuthFlow\");\n/**\n * Signs in a user with OAuth. Redirects the application to an Identity Provider.\n *\n * @param input - The SignInWithRedirectInput object, if empty it will redirect to Cognito HostedUI\n *\n * @throws AuthTokenConfigException - Thrown when the user pool config is invalid.\n * @throws OAuthNotConfigureException - Thrown when the oauth config is invalid.\n */\nasync function signInWithRedirect(input) {\n const authConfig = core_1.Amplify.getConfig().Auth?.Cognito;\n (0, utils_1.assertTokenProviderConfig)(authConfig);\n (0, utils_1.assertOAuthConfig)(authConfig);\n oauth_1.oAuthStore.setAuthConfig(authConfig);\n if (!input?.options?.prompt) {\n await (0, signInHelpers_1.assertUserNotAuthenticated)();\n }\n let provider = 'COGNITO'; // Default\n if (typeof input?.provider === 'string') {\n provider = models_1.cognitoHostedUIIdentityProviderMap[input.provider];\n }\n else if (input?.provider?.custom) {\n provider = input.provider.custom;\n }\n return oauthSignIn({\n oauthConfig: authConfig.loginWith.oauth,\n clientId: authConfig.userPoolClientId,\n provider,\n customState: input?.customState,\n preferPrivateSession: input?.options?.preferPrivateSession,\n options: {\n loginHint: input?.options?.loginHint,\n lang: input?.options?.lang,\n nonce: input?.options?.nonce,\n prompt: input?.options?.prompt,\n },\n authSessionOpener: input?.options?.authSessionOpener,\n });\n}\nconst oauthSignIn = async ({ oauthConfig, provider, clientId, customState, preferPrivateSession, options, authSessionOpener, }) => {\n const { domain, redirectSignIn, responseType, scopes } = oauthConfig;\n const { loginHint, lang, nonce, prompt } = options ?? {};\n const randomState = (0, oauth_1.generateState)();\n const openAuthSession = authSessionOpener || utils_2.openAuthSession;\n /* encodeURIComponent is not URL safe, use urlSafeEncode instead. Cognito\n single-encodes/decodes url on first sign in and double-encodes/decodes url\n when user already signed in. Using encodeURIComponent, Base32, Base64 add\n characters % or = which on further encoding becomes unsafe. '=' create issue\n for parsing query params.\n Refer: https://github.com/aws-amplify/amplify-js/issues/5218 */\n const state = customState\n ? `${randomState}-${(0, utils_1.urlSafeEncode)(customState)}`\n : randomState;\n const { value, method, toCodeChallenge } = (0, oauth_1.generateCodeVerifier)(128);\n const redirectUri = (0, oauth_1.getRedirectUrl)(oauthConfig.redirectSignIn);\n if ((0, utils_1.isBrowser)())\n oauth_1.oAuthStore.storeOAuthInFlight(true);\n oauth_1.oAuthStore.storeOAuthState(state);\n oauth_1.oAuthStore.storePKCE(value);\n const params = new URLSearchParams([\n ['redirect_uri', redirectUri],\n ['response_type', responseType],\n ['client_id', clientId],\n ['identity_provider', provider],\n ['scope', scopes.join(' ')],\n ]);\n loginHint && params.append('login_hint', loginHint);\n lang && params.append('lang', lang);\n nonce && params.append('nonce', nonce);\n prompt && params.append('prompt', prompt.toLowerCase());\n params.append('state', state);\n if (responseType === 'code') {\n params.append('code_challenge', toCodeChallenge());\n params.append('code_challenge_method', method);\n }\n const oAuthUrl = new URL('/oauth2/authorize', `https://${domain}/`);\n oAuthUrl.search = params.toString();\n // this will only take effect in the following scenarios:\n // 1. the user cancels the OAuth flow on web via back button, and\n // 2. when bfcache is enabled\n (0, cancelOAuthFlow_1.listenForOAuthFlowCancellation)(oauth_1.oAuthStore);\n // the following is effective only in react-native as openAuthSession resolves only in react-native\n const { type, error, url } = (await openAuthSession(oAuthUrl.href, redirectSignIn, preferPrivateSession)) ?? {};\n try {\n if (type === 'error') {\n throw (0, createOAuthError_1.createOAuthError)(String(error));\n }\n if (type === 'success' && url) {\n await (0, oauth_1.completeOAuthFlow)({\n currentUrl: url,\n clientId,\n domain,\n redirectUri,\n responseType,\n userAgentValue: (0, utils_2.getAuthUserAgentValue)(utils_1.AuthAction.SignInWithRedirect),\n preferPrivateSession,\n });\n }\n }\n catch (err) {\n await (0, oauth_1.handleFailure)(err);\n // rethrow the error so it can be caught by `await signInWithRedirect()` in react-native\n throw err;\n }\n};\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC7D,OAAO,CAAC,kBAAkB,GAAG,kBAAkB;AAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;AAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC;AAC5D,OAAO,CAAC,oCAAoC,CAAC;AAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAC;AAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACzC,MAAM,eAAe,GAAG,OAAO,CAAC,wBAAwB,CAAC;AACzD,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACzC,MAAM,kBAAkB,GAAG,OAAO,CAAC,iCAAiC,CAAC;AACrE,MAAM,iBAAiB,GAAG,OAAO,CAAC,gCAAgC,CAAC;AACnE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,kBAAkB,CAAC,KAAK,EAAE;AACzC,IAAI,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO;AAC/D,IAAI,IAAI,OAAO,CAAC,yBAAyB,EAAE,UAAU,CAAC;AACtD,IAAI,IAAI,OAAO,CAAC,iBAAiB,EAAE,UAAU,CAAC;AAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC;AAChD,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE;AACjC,QAAQ,MAAM,IAAI,eAAe,CAAC,0BAA0B,GAAG;AAC/D,IAAI;AACJ,IAAI,IAAI,QAAQ,GAAG,SAAS,CAAC;AAC7B,IAAI,IAAI,OAAO,KAAK,EAAE,QAAQ,KAAK,QAAQ,EAAE;AAC7C,QAAQ,QAAQ,GAAG,QAAQ,CAAC,kCAAkC,CAAC,KAAK,CAAC,QAAQ,CAAC;AAC9E,IAAI;AACJ,SAAS,IAAI,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE;AACtC,QAAQ,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM;AACxC,IAAI;AACJ,IAAI,OAAO,WAAW,CAAC;AACvB,QAAQ,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK;AAC/C,QAAQ,QAAQ,EAAE,UAAU,CAAC,gBAAgB;AAC7C,QAAQ,QAAQ;AAChB,QAAQ,WAAW,EAAE,KAAK,EAAE,WAAW;AACvC,QAAQ,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB;AAClE,QAAQ,OAAO,EAAE;AACjB,YAAY,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS;AAChD,YAAY,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI;AACtC,YAAY,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AACxC,YAAY,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM;AAC1C,SAAS;AACT,QAAQ,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB;AAC5D,KAAK,CAAC;AACN;AACA,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,OAAO,EAAE,iBAAiB,GAAG,KAAK;AACnI,IAAI,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,WAAW;AACxE,IAAI,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,IAAI,EAAE;AAC5D,IAAI,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,aAAa,GAAG;AACpD,IAAI,MAAM,eAAe,GAAG,iBAAiB,IAAI,OAAO,CAAC,eAAe;AACxE;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,KAAK,GAAG;AAClB,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;AACpE,UAAU,WAAW;AACrB,IAAI,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC;AACrF,IAAI,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,cAAc,EAAE,WAAW,CAAC,cAAc,CAAC;AAC/E,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,GAAG;AAChC,QAAQ,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC;AACnD,IAAI,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC;AAC7C,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC;AACvC,IAAI,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;AACvC,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC;AACrC,QAAQ,CAAC,eAAe,EAAE,YAAY,CAAC;AACvC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC;AAC/B,QAAQ,CAAC,mBAAmB,EAAE,QAAQ,CAAC;AACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnC,KAAK,CAAC;AACN,IAAI,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC;AACvD,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;AACvC,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;AAC1C,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;AAC3D,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;AACjC,IAAI,IAAI,YAAY,KAAK,MAAM,EAAE;AACjC,QAAQ,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,eAAe,EAAE,CAAC;AAC1D,QAAQ,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC;AACtD,IAAI;AACJ,IAAI,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,mBAAmB,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACvE,IAAI,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE;AACvC;AACA;AACA;AACA,IAAI,IAAI,iBAAiB,CAAC,8BAA8B,EAAE,OAAO,CAAC,UAAU,CAAC;AAC7E;AACA,IAAI,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,eAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,oBAAoB,CAAC,KAAK,EAAE;AACnH,IAAI,IAAI;AACR,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE;AAC9B,YAAY,MAAM,CAAC,CAAC,EAAE,kBAAkB,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AACzE,QAAQ;AACR,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,EAAE;AACvC,YAAY,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,iBAAiB,EAAE;AACjD,gBAAgB,UAAU,EAAE,GAAG;AAC/B,gBAAgB,QAAQ;AACxB,gBAAgB,MAAM;AACtB,gBAAgB,WAAW;AAC3B,gBAAgB,YAAY;AAC5B,gBAAgB,cAAc,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,qBAAqB,EAAE,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC;AACzG,gBAAgB,oBAAoB;AACpC,aAAa,CAAC;AACd,QAAQ;AACR,IAAI;AACJ,IAAI,OAAO,GAAG,EAAE;AAChB,QAAQ,MAAM,IAAI,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;AAC7C;AACA,QAAQ,MAAM,GAAG;AACjB,IAAI;AACJ,CAAC;;"}
|
|
@@ -33,7 +33,9 @@ async function signInWithRedirect(input) {
|
|
|
33
33
|
assertTokenProviderConfig(authConfig);
|
|
34
34
|
assertOAuthConfig(authConfig);
|
|
35
35
|
oAuthStore.setAuthConfig(authConfig);
|
|
36
|
-
|
|
36
|
+
if (!input?.options?.prompt) {
|
|
37
|
+
await assertUserNotAuthenticated();
|
|
38
|
+
}
|
|
37
39
|
let provider = 'COGNITO'; // Default
|
|
38
40
|
if (typeof input?.provider === 'string') {
|
|
39
41
|
provider = cognitoHostedUIIdentityProviderMap[input.provider];
|
|
@@ -51,13 +53,16 @@ async function signInWithRedirect(input) {
|
|
|
51
53
|
loginHint: input?.options?.loginHint,
|
|
52
54
|
lang: input?.options?.lang,
|
|
53
55
|
nonce: input?.options?.nonce,
|
|
56
|
+
prompt: input?.options?.prompt,
|
|
54
57
|
},
|
|
58
|
+
authSessionOpener: input?.options?.authSessionOpener,
|
|
55
59
|
});
|
|
56
60
|
}
|
|
57
|
-
const oauthSignIn = async ({ oauthConfig, provider, clientId, customState, preferPrivateSession, options, }) => {
|
|
61
|
+
const oauthSignIn = async ({ oauthConfig, provider, clientId, customState, preferPrivateSession, options, authSessionOpener, }) => {
|
|
58
62
|
const { domain, redirectSignIn, responseType, scopes } = oauthConfig;
|
|
59
|
-
const { loginHint, lang, nonce } = options ?? {};
|
|
63
|
+
const { loginHint, lang, nonce, prompt } = options ?? {};
|
|
60
64
|
const randomState = generateState();
|
|
65
|
+
const openAuthSession$1 = authSessionOpener || openAuthSession;
|
|
61
66
|
/* encodeURIComponent is not URL safe, use urlSafeEncode instead. Cognito
|
|
62
67
|
single-encodes/decodes url on first sign in and double-encodes/decodes url
|
|
63
68
|
when user already signed in. Using encodeURIComponent, Base32, Base64 add
|
|
@@ -73,33 +78,30 @@ const oauthSignIn = async ({ oauthConfig, provider, clientId, customState, prefe
|
|
|
73
78
|
oAuthStore.storeOAuthInFlight(true);
|
|
74
79
|
oAuthStore.storeOAuthState(state);
|
|
75
80
|
oAuthStore.storePKCE(value);
|
|
76
|
-
const
|
|
77
|
-
redirect_uri
|
|
78
|
-
response_type
|
|
79
|
-
client_id
|
|
80
|
-
identity_provider
|
|
81
|
-
scope
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
}
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
// TODO(v6): use URL object instead
|
|
95
|
-
const oAuthUrl = `https://${domain}/oauth2/authorize?${queryString}`;
|
|
81
|
+
const params = new URLSearchParams([
|
|
82
|
+
['redirect_uri', redirectUri],
|
|
83
|
+
['response_type', responseType],
|
|
84
|
+
['client_id', clientId],
|
|
85
|
+
['identity_provider', provider],
|
|
86
|
+
['scope', scopes.join(' ')],
|
|
87
|
+
]);
|
|
88
|
+
loginHint && params.append('login_hint', loginHint);
|
|
89
|
+
lang && params.append('lang', lang);
|
|
90
|
+
nonce && params.append('nonce', nonce);
|
|
91
|
+
prompt && params.append('prompt', prompt.toLowerCase());
|
|
92
|
+
params.append('state', state);
|
|
93
|
+
if (responseType === 'code') {
|
|
94
|
+
params.append('code_challenge', toCodeChallenge());
|
|
95
|
+
params.append('code_challenge_method', method);
|
|
96
|
+
}
|
|
97
|
+
const oAuthUrl = new URL('/oauth2/authorize', `https://${domain}/`);
|
|
98
|
+
oAuthUrl.search = params.toString();
|
|
96
99
|
// this will only take effect in the following scenarios:
|
|
97
100
|
// 1. the user cancels the OAuth flow on web via back button, and
|
|
98
101
|
// 2. when bfcache is enabled
|
|
99
102
|
listenForOAuthFlowCancellation(oAuthStore);
|
|
100
103
|
// the following is effective only in react-native as openAuthSession resolves only in react-native
|
|
101
|
-
const { type, error, url } = (await openAuthSession(oAuthUrl)) ??
|
|
102
|
-
{};
|
|
104
|
+
const { type, error, url } = (await openAuthSession$1(oAuthUrl.href, redirectSignIn, preferPrivateSession)) ?? {};
|
|
103
105
|
try {
|
|
104
106
|
if (type === 'error') {
|
|
105
107
|
throw createOAuthError(String(error));
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"signInWithRedirect.mjs","sources":["../../../../../src/providers/cognito/apis/signInWithRedirect.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { Amplify } from '@aws-amplify/core';\nimport { AuthAction, assertOAuthConfig, assertTokenProviderConfig, isBrowser, urlSafeEncode, } from '@aws-amplify/core/internals/utils';\nimport '../utils/oauth/enableOAuthListener';\nimport { cognitoHostedUIIdentityProviderMap } from '../types/models';\nimport { getAuthUserAgentValue,
|
|
1
|
+
{"version":3,"file":"signInWithRedirect.mjs","sources":["../../../../../src/providers/cognito/apis/signInWithRedirect.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { Amplify } from '@aws-amplify/core';\nimport { AuthAction, assertOAuthConfig, assertTokenProviderConfig, isBrowser, urlSafeEncode, } from '@aws-amplify/core/internals/utils';\nimport '../utils/oauth/enableOAuthListener';\nimport { cognitoHostedUIIdentityProviderMap } from '../types/models';\nimport { openAuthSession as _openAuthSession, getAuthUserAgentValue, } from '../../../utils';\nimport { assertUserNotAuthenticated } from '../utils/signInHelpers';\nimport { completeOAuthFlow, generateCodeVerifier, generateState, getRedirectUrl, handleFailure, oAuthStore, } from '../utils/oauth';\nimport { createOAuthError } from '../utils/oauth/createOAuthError';\nimport { listenForOAuthFlowCancellation } from '../utils/oauth/cancelOAuthFlow';\n/**\n * Signs in a user with OAuth. Redirects the application to an Identity Provider.\n *\n * @param input - The SignInWithRedirectInput object, if empty it will redirect to Cognito HostedUI\n *\n * @throws AuthTokenConfigException - Thrown when the user pool config is invalid.\n * @throws OAuthNotConfigureException - Thrown when the oauth config is invalid.\n */\nexport async function signInWithRedirect(input) {\n const authConfig = Amplify.getConfig().Auth?.Cognito;\n assertTokenProviderConfig(authConfig);\n assertOAuthConfig(authConfig);\n oAuthStore.setAuthConfig(authConfig);\n if (!input?.options?.prompt) {\n await assertUserNotAuthenticated();\n }\n let provider = 'COGNITO'; // Default\n if (typeof input?.provider === 'string') {\n provider = cognitoHostedUIIdentityProviderMap[input.provider];\n }\n else if (input?.provider?.custom) {\n provider = input.provider.custom;\n }\n return oauthSignIn({\n oauthConfig: authConfig.loginWith.oauth,\n clientId: authConfig.userPoolClientId,\n provider,\n customState: input?.customState,\n preferPrivateSession: input?.options?.preferPrivateSession,\n options: {\n loginHint: input?.options?.loginHint,\n lang: input?.options?.lang,\n nonce: input?.options?.nonce,\n prompt: input?.options?.prompt,\n },\n authSessionOpener: input?.options?.authSessionOpener,\n });\n}\nconst oauthSignIn = async ({ oauthConfig, provider, clientId, customState, preferPrivateSession, options, authSessionOpener, }) => {\n const { domain, redirectSignIn, responseType, scopes } = oauthConfig;\n const { loginHint, lang, nonce, prompt } = options ?? {};\n const randomState = generateState();\n const openAuthSession = authSessionOpener || _openAuthSession;\n /* encodeURIComponent is not URL safe, use urlSafeEncode instead. Cognito\n single-encodes/decodes url on first sign in and double-encodes/decodes url\n when user already signed in. Using encodeURIComponent, Base32, Base64 add\n characters % or = which on further encoding becomes unsafe. '=' create issue\n for parsing query params.\n Refer: https://github.com/aws-amplify/amplify-js/issues/5218 */\n const state = customState\n ? `${randomState}-${urlSafeEncode(customState)}`\n : randomState;\n const { value, method, toCodeChallenge } = generateCodeVerifier(128);\n const redirectUri = getRedirectUrl(oauthConfig.redirectSignIn);\n if (isBrowser())\n oAuthStore.storeOAuthInFlight(true);\n oAuthStore.storeOAuthState(state);\n oAuthStore.storePKCE(value);\n const params = new URLSearchParams([\n ['redirect_uri', redirectUri],\n ['response_type', responseType],\n ['client_id', clientId],\n ['identity_provider', provider],\n ['scope', scopes.join(' ')],\n ]);\n loginHint && params.append('login_hint', loginHint);\n lang && params.append('lang', lang);\n nonce && params.append('nonce', nonce);\n prompt && params.append('prompt', prompt.toLowerCase());\n params.append('state', state);\n if (responseType === 'code') {\n params.append('code_challenge', toCodeChallenge());\n params.append('code_challenge_method', method);\n }\n const oAuthUrl = new URL('/oauth2/authorize', `https://${domain}/`);\n oAuthUrl.search = params.toString();\n // this will only take effect in the following scenarios:\n // 1. the user cancels the OAuth flow on web via back button, and\n // 2. when bfcache is enabled\n listenForOAuthFlowCancellation(oAuthStore);\n // the following is effective only in react-native as openAuthSession resolves only in react-native\n const { type, error, url } = (await openAuthSession(oAuthUrl.href, redirectSignIn, preferPrivateSession)) ?? {};\n try {\n if (type === 'error') {\n throw createOAuthError(String(error));\n }\n if (type === 'success' && url) {\n await completeOAuthFlow({\n currentUrl: url,\n clientId,\n domain,\n redirectUri,\n responseType,\n userAgentValue: getAuthUserAgentValue(AuthAction.SignInWithRedirect),\n preferPrivateSession,\n });\n }\n }\n catch (err) {\n await handleFailure(err);\n // rethrow the error so it can be caught by `await signInWithRedirect()` in react-native\n throw err;\n }\n};\n"],"names":["openAuthSession","_openAuthSession"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AACA;AAUA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAe,kBAAkB,CAAC,KAAK,EAAE;AAChD,IAAI,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO;AACxD,IAAI,yBAAyB,CAAC,UAAU,CAAC;AACzC,IAAI,iBAAiB,CAAC,UAAU,CAAC;AACjC,IAAI,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC;AACxC,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE;AACjC,QAAQ,MAAM,0BAA0B,EAAE;AAC1C,IAAI;AACJ,IAAI,IAAI,QAAQ,GAAG,SAAS,CAAC;AAC7B,IAAI,IAAI,OAAO,KAAK,EAAE,QAAQ,KAAK,QAAQ,EAAE;AAC7C,QAAQ,QAAQ,GAAG,kCAAkC,CAAC,KAAK,CAAC,QAAQ,CAAC;AACrE,IAAI;AACJ,SAAS,IAAI,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE;AACtC,QAAQ,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM;AACxC,IAAI;AACJ,IAAI,OAAO,WAAW,CAAC;AACvB,QAAQ,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK;AAC/C,QAAQ,QAAQ,EAAE,UAAU,CAAC,gBAAgB;AAC7C,QAAQ,QAAQ;AAChB,QAAQ,WAAW,EAAE,KAAK,EAAE,WAAW;AACvC,QAAQ,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB;AAClE,QAAQ,OAAO,EAAE;AACjB,YAAY,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS;AAChD,YAAY,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI;AACtC,YAAY,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AACxC,YAAY,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM;AAC1C,SAAS;AACT,QAAQ,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB;AAC5D,KAAK,CAAC;AACN;AACA,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,OAAO,EAAE,iBAAiB,GAAG,KAAK;AACnI,IAAI,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,WAAW;AACxE,IAAI,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,IAAI,EAAE;AAC5D,IAAI,MAAM,WAAW,GAAG,aAAa,EAAE;AACvC,IAAI,MAAMA,iBAAe,GAAG,iBAAiB,IAAIC,eAAgB;AACjE;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,KAAK,GAAG;AAClB,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;AACvD,UAAU,WAAW;AACrB,IAAI,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC;AACxE,IAAI,MAAM,WAAW,GAAG,cAAc,CAAC,WAAW,CAAC,cAAc,CAAC;AAClE,IAAI,IAAI,SAAS,EAAE;AACnB,QAAQ,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC;AAC3C,IAAI,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC;AACrC,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC;AAC/B,IAAI,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;AACvC,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC;AACrC,QAAQ,CAAC,eAAe,EAAE,YAAY,CAAC;AACvC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC;AAC/B,QAAQ,CAAC,mBAAmB,EAAE,QAAQ,CAAC;AACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnC,KAAK,CAAC;AACN,IAAI,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC;AACvD,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;AACvC,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;AAC1C,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;AAC3D,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;AACjC,IAAI,IAAI,YAAY,KAAK,MAAM,EAAE;AACjC,QAAQ,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,eAAe,EAAE,CAAC;AAC1D,QAAQ,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC;AACtD,IAAI;AACJ,IAAI,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,mBAAmB,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACvE,IAAI,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE;AACvC;AACA;AACA;AACA,IAAI,8BAA8B,CAAC,UAAU,CAAC;AAC9C;AACA,IAAI,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,MAAMD,iBAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,oBAAoB,CAAC,KAAK,EAAE;AACnH,IAAI,IAAI;AACR,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE;AAC9B,YAAY,MAAM,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjD,QAAQ;AACR,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,EAAE;AACvC,YAAY,MAAM,iBAAiB,CAAC;AACpC,gBAAgB,UAAU,EAAE,GAAG;AAC/B,gBAAgB,QAAQ;AACxB,gBAAgB,MAAM;AACtB,gBAAgB,WAAW;AAC3B,gBAAgB,YAAY;AAC5B,gBAAgB,cAAc,EAAE,qBAAqB,CAAC,UAAU,CAAC,kBAAkB,CAAC;AACpF,gBAAgB,oBAAoB;AACpC,aAAa,CAAC;AACd,QAAQ;AACR,IAAI;AACJ,IAAI,OAAO,GAAG,EAAE;AAChB,QAAQ,MAAM,aAAa,CAAC,GAAG,CAAC;AAChC;AACA,QAAQ,MAAM,GAAG;AACjB,IAAI;AACJ,CAAC;;;;"}
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import { OpenAuthSession } from '../utils/types';
|
|
1
2
|
import { AuthDevice, AuthUserAttribute, AuthUserAttributeKey, AuthUserAttributes } from './models';
|
|
2
3
|
import { AuthServiceOptions, AuthSignUpOptions } from './options';
|
|
3
4
|
export interface AuthConfirmResetPasswordInput<ServiceOptions extends AuthServiceOptions = AuthServiceOptions> {
|
|
@@ -32,12 +33,29 @@ export interface AuthSignOutInput {
|
|
|
32
33
|
};
|
|
33
34
|
}
|
|
34
35
|
export type AuthProvider = 'Amazon' | 'Apple' | 'Facebook' | 'Google';
|
|
36
|
+
/**
|
|
37
|
+
* OIDC prompt parameter that specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
|
|
38
|
+
*
|
|
39
|
+
* - `'NONE'` - No authentication or consent UI will be displayed
|
|
40
|
+
* - `'LOGIN'` - Force user to re-authenticate even if they have a valid session
|
|
41
|
+
* - `'CONSENT'` - Force user to consent to sharing information with the client
|
|
42
|
+
* - `'SELECT_ACCOUNT'` - Prompt user to select among multiple authenticated accounts
|
|
43
|
+
*
|
|
44
|
+
* @see https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
|
|
45
|
+
*/
|
|
46
|
+
export type AuthPrompt = 'NONE' | 'LOGIN' | 'CONSENT' | 'SELECT_ACCOUNT';
|
|
35
47
|
export interface AuthSignInWithRedirectInput {
|
|
36
48
|
provider?: AuthProvider | {
|
|
37
49
|
custom: string;
|
|
38
50
|
};
|
|
39
51
|
customState?: string;
|
|
40
52
|
options?: {
|
|
53
|
+
/**
|
|
54
|
+
* on various mobile frameworks which allow js usage for app development (e.g. cordova)
|
|
55
|
+
* in-app or webview redirects are discouraged or not allowed by the OS.
|
|
56
|
+
* this gives an option to adjust the behaviour to the framework
|
|
57
|
+
*/
|
|
58
|
+
authSessionOpener?: OpenAuthSession;
|
|
41
59
|
/**
|
|
42
60
|
* On iOS devices, setting this to true requests that the browser not share cookies or other browsing data between
|
|
43
61
|
* the authentication session and the user’s normal browser session. This will bypass the permissions dialog that
|
|
@@ -63,6 +81,11 @@ export interface AuthSignInWithRedirectInput {
|
|
|
63
81
|
* @see https://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.html
|
|
64
82
|
*/
|
|
65
83
|
nonce?: string;
|
|
84
|
+
/**
|
|
85
|
+
* An OIDC parameter that controls authentication behavior for existing sessions. It can be used by the Client to make sure that the End-User is still present for the current session or to bring attention to the request. Available in the managed login branding version only, not in the classic hosted UI.
|
|
86
|
+
* @see https://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.html
|
|
87
|
+
*/
|
|
88
|
+
prompt?: AuthPrompt;
|
|
66
89
|
};
|
|
67
90
|
}
|
|
68
91
|
/**
|
package/package.json
CHANGED
|
@@ -1,107 +1,107 @@
|
|
|
1
1
|
{
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
2
|
+
"name": "@aws-amplify/auth",
|
|
3
|
+
"version": "6.14.1-unstable.2212704.0+2212704",
|
|
4
|
+
"description": "Auth category of aws-amplify",
|
|
5
|
+
"main": "./dist/cjs/index.js",
|
|
6
|
+
"module": "./dist/esm/index.mjs",
|
|
7
|
+
"typings": "./dist/esm/index.d.ts",
|
|
8
|
+
"react-native": "./dist/cjs/index.js",
|
|
9
|
+
"sideEffects": [
|
|
10
|
+
"./dist/cjs/providers/cognito/apis/signInWithRedirect.js",
|
|
11
|
+
"./dist/esm/providers/cognito/apis/signInWithRedirect.mjs",
|
|
12
|
+
"./dist/cjs/providers/cognito/utils/oauth/enableOAuthListener.js",
|
|
13
|
+
"./dist/esm/providers/cognito/utils/oauth/enableOAuthListener.mjs"
|
|
14
|
+
],
|
|
15
|
+
"publishConfig": {
|
|
16
|
+
"access": "public"
|
|
17
|
+
},
|
|
18
|
+
"scripts": {
|
|
19
|
+
"test": "yarn lint --fix && jest -w 1 --coverage --logHeapUsage",
|
|
20
|
+
"build-with-test": "npm test && npm run build",
|
|
21
|
+
"build:umd": "webpack && webpack --config ./webpack.config.dev.js",
|
|
22
|
+
"build:esm-cjs": "rollup --forceExit -c rollup.config.mjs",
|
|
23
|
+
"build:watch": "npm run build:esm-cjs -- --watch",
|
|
24
|
+
"build": "npm run clean && npm run build:esm-cjs && npm run build:umd",
|
|
25
|
+
"clean": "npm run clean:size && rimraf lib-esm lib dist",
|
|
26
|
+
"clean:size": "rimraf dual-publish-tmp tmp*",
|
|
27
|
+
"format": "echo \"Not implemented\"",
|
|
28
|
+
"lint": "eslint '**/*.{ts,tsx}' && npm run ts-coverage",
|
|
29
|
+
"lint:fix": "eslint '**/*.{ts,tsx}' --fix",
|
|
30
|
+
"ts-coverage": "typescript-coverage-report -p ./tsconfig.build.json -t 91.18"
|
|
31
|
+
},
|
|
32
|
+
"typesVersions": {
|
|
33
|
+
">=4.2": {
|
|
34
|
+
"cognito": [
|
|
35
|
+
"./dist/esm/providers/cognito/index.d.ts"
|
|
36
|
+
],
|
|
37
|
+
"cognito/server": [
|
|
38
|
+
"./dist/esm/providers/cognito/apis/server/index.d.ts"
|
|
39
|
+
],
|
|
40
|
+
"server": [
|
|
41
|
+
"./dist/esm/server.d.ts"
|
|
42
|
+
]
|
|
43
|
+
}
|
|
44
|
+
},
|
|
45
|
+
"exports": {
|
|
46
|
+
".": {
|
|
47
|
+
"react-native": "./dist/cjs/index.js",
|
|
48
|
+
"types": "./dist/esm/index.d.ts",
|
|
49
|
+
"import": "./dist/esm/index.mjs",
|
|
50
|
+
"require": "./dist/cjs/index.js"
|
|
51
|
+
},
|
|
52
|
+
"./cognito": {
|
|
53
|
+
"react-native": "./dist/cjs/providers/cognito/index.js",
|
|
54
|
+
"types": "./dist/esm/providers/cognito/index.d.ts",
|
|
55
|
+
"import": "./dist/esm/providers/cognito/index.mjs",
|
|
56
|
+
"require": "./dist/cjs/providers/cognito/index.js"
|
|
57
|
+
},
|
|
58
|
+
"./cognito/server": {
|
|
59
|
+
"types": "./dist/esm/providers/cognito/apis/server/index.d.ts",
|
|
60
|
+
"import": "./dist/esm/providers/cognito/apis/server/index.mjs",
|
|
61
|
+
"require": "./dist/cjs/providers/cognito/apis/server/index.js"
|
|
62
|
+
},
|
|
63
|
+
"./server": {
|
|
64
|
+
"types": "./dist/esm/server.d.ts",
|
|
65
|
+
"import": "./dist/esm/server.mjs",
|
|
66
|
+
"require": "./dist/cjs/server.js"
|
|
67
|
+
},
|
|
68
|
+
"./enable-oauth-listener": {
|
|
69
|
+
"types": "./dist/esm/providers/cognito/utils/oauth/enableOAuthListener.d.ts",
|
|
70
|
+
"import": "./dist/esm/providers/cognito/utils/oauth/enableOAuthListener.mjs",
|
|
71
|
+
"require": "./dist/cjs/providers/cognito/utils/oauth/enableOAuthListener.js"
|
|
72
|
+
},
|
|
73
|
+
"./package.json": "./package.json"
|
|
74
|
+
},
|
|
75
|
+
"repository": {
|
|
76
|
+
"type": "git",
|
|
77
|
+
"url": "https://github.com/aws-amplify/amplify-js.git"
|
|
78
|
+
},
|
|
79
|
+
"author": "Amazon Web Services",
|
|
80
|
+
"license": "Apache-2.0",
|
|
81
|
+
"bugs": {
|
|
82
|
+
"url": "https://github.com/aws/aws-amplify/issues"
|
|
83
|
+
},
|
|
84
|
+
"homepage": "https://aws-amplify.github.io/",
|
|
85
|
+
"files": [
|
|
86
|
+
"dist/cjs",
|
|
87
|
+
"dist/esm",
|
|
88
|
+
"src",
|
|
89
|
+
"cognito",
|
|
90
|
+
"server",
|
|
91
|
+
"enable-oauth-listener"
|
|
92
|
+
],
|
|
93
|
+
"dependencies": {
|
|
94
|
+
"@aws-crypto/sha256-js": "5.2.0",
|
|
95
|
+
"@smithy/types": "^3.3.0",
|
|
96
|
+
"tslib": "^2.5.0"
|
|
97
|
+
},
|
|
98
|
+
"peerDependencies": {
|
|
99
|
+
"@aws-amplify/core": "6.13.1-unstable.2212704.0+2212704"
|
|
100
|
+
},
|
|
101
|
+
"devDependencies": {
|
|
102
|
+
"@aws-amplify/core": "6.13.1-unstable.2212704.0+2212704",
|
|
103
|
+
"@aws-amplify/react-native": "1.1.11-unstable.2212704.0+2212704",
|
|
104
|
+
"@jest/test-sequencer": "^29.7.0"
|
|
105
|
+
},
|
|
106
|
+
"gitHead": "2212704a2a35b40e60984a0a79770a4b59aae52d"
|
|
107
107
|
}
|
|
@@ -12,7 +12,10 @@ import {
|
|
|
12
12
|
|
|
13
13
|
import '../utils/oauth/enableOAuthListener';
|
|
14
14
|
import { cognitoHostedUIIdentityProviderMap } from '../types/models';
|
|
15
|
-
import {
|
|
15
|
+
import {
|
|
16
|
+
openAuthSession as _openAuthSession,
|
|
17
|
+
getAuthUserAgentValue,
|
|
18
|
+
} from '../../../utils';
|
|
16
19
|
import { assertUserNotAuthenticated } from '../utils/signInHelpers';
|
|
17
20
|
import { SignInWithRedirectInput } from '../types';
|
|
18
21
|
import {
|
|
@@ -25,6 +28,7 @@ import {
|
|
|
25
28
|
} from '../utils/oauth';
|
|
26
29
|
import { createOAuthError } from '../utils/oauth/createOAuthError';
|
|
27
30
|
import { listenForOAuthFlowCancellation } from '../utils/oauth/cancelOAuthFlow';
|
|
31
|
+
import { OpenAuthSession } from '../../../utils/types';
|
|
28
32
|
|
|
29
33
|
/**
|
|
30
34
|
* Signs in a user with OAuth. Redirects the application to an Identity Provider.
|
|
@@ -41,7 +45,10 @@ export async function signInWithRedirect(
|
|
|
41
45
|
assertTokenProviderConfig(authConfig);
|
|
42
46
|
assertOAuthConfig(authConfig);
|
|
43
47
|
oAuthStore.setAuthConfig(authConfig);
|
|
44
|
-
|
|
48
|
+
|
|
49
|
+
if (!input?.options?.prompt) {
|
|
50
|
+
await assertUserNotAuthenticated();
|
|
51
|
+
}
|
|
45
52
|
|
|
46
53
|
let provider = 'COGNITO'; // Default
|
|
47
54
|
|
|
@@ -61,7 +68,9 @@ export async function signInWithRedirect(
|
|
|
61
68
|
loginHint: input?.options?.loginHint,
|
|
62
69
|
lang: input?.options?.lang,
|
|
63
70
|
nonce: input?.options?.nonce,
|
|
71
|
+
prompt: input?.options?.prompt,
|
|
64
72
|
},
|
|
73
|
+
authSessionOpener: input?.options?.authSessionOpener,
|
|
65
74
|
});
|
|
66
75
|
}
|
|
67
76
|
|
|
@@ -72,6 +81,7 @@ const oauthSignIn = async ({
|
|
|
72
81
|
customState,
|
|
73
82
|
preferPrivateSession,
|
|
74
83
|
options,
|
|
84
|
+
authSessionOpener,
|
|
75
85
|
}: {
|
|
76
86
|
oauthConfig: OAuthConfig;
|
|
77
87
|
provider: string;
|
|
@@ -79,10 +89,12 @@ const oauthSignIn = async ({
|
|
|
79
89
|
customState?: string;
|
|
80
90
|
preferPrivateSession?: boolean;
|
|
81
91
|
options?: SignInWithRedirectInput['options'];
|
|
92
|
+
authSessionOpener?: OpenAuthSession;
|
|
82
93
|
}) => {
|
|
83
94
|
const { domain, redirectSignIn, responseType, scopes } = oauthConfig;
|
|
84
|
-
const { loginHint, lang, nonce } = options ?? {};
|
|
95
|
+
const { loginHint, lang, nonce, prompt } = options ?? {};
|
|
85
96
|
const randomState = generateState();
|
|
97
|
+
const openAuthSession = authSessionOpener || _openAuthSession;
|
|
86
98
|
|
|
87
99
|
/* encodeURIComponent is not URL safe, use urlSafeEncode instead. Cognito
|
|
88
100
|
single-encodes/decodes url on first sign in and double-encodes/decodes url
|
|
@@ -101,27 +113,25 @@ const oauthSignIn = async ({
|
|
|
101
113
|
oAuthStore.storeOAuthState(state);
|
|
102
114
|
oAuthStore.storePKCE(value);
|
|
103
115
|
|
|
104
|
-
const
|
|
105
|
-
redirect_uri
|
|
106
|
-
response_type
|
|
107
|
-
client_id
|
|
108
|
-
identity_provider
|
|
109
|
-
scope
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
// TODO(v6): use URL object instead
|
|
124
|
-
const oAuthUrl = `https://${domain}/oauth2/authorize?${queryString}`;
|
|
116
|
+
const params = new URLSearchParams([
|
|
117
|
+
['redirect_uri', redirectUri],
|
|
118
|
+
['response_type', responseType],
|
|
119
|
+
['client_id', clientId],
|
|
120
|
+
['identity_provider', provider],
|
|
121
|
+
['scope', scopes.join(' ')],
|
|
122
|
+
]);
|
|
123
|
+
|
|
124
|
+
loginHint && params.append('login_hint', loginHint);
|
|
125
|
+
lang && params.append('lang', lang);
|
|
126
|
+
nonce && params.append('nonce', nonce);
|
|
127
|
+
prompt && params.append('prompt', prompt.toLowerCase());
|
|
128
|
+
params.append('state', state);
|
|
129
|
+
if (responseType === 'code') {
|
|
130
|
+
params.append('code_challenge', toCodeChallenge());
|
|
131
|
+
params.append('code_challenge_method', method);
|
|
132
|
+
}
|
|
133
|
+
const oAuthUrl = new URL('/oauth2/authorize', `https://${domain}/`);
|
|
134
|
+
oAuthUrl.search = params.toString();
|
|
125
135
|
|
|
126
136
|
// this will only take effect in the following scenarios:
|
|
127
137
|
// 1. the user cancels the OAuth flow on web via back button, and
|
|
@@ -130,8 +140,11 @@ const oauthSignIn = async ({
|
|
|
130
140
|
|
|
131
141
|
// the following is effective only in react-native as openAuthSession resolves only in react-native
|
|
132
142
|
const { type, error, url } =
|
|
133
|
-
(await openAuthSession(
|
|
134
|
-
|
|
143
|
+
(await openAuthSession(
|
|
144
|
+
oAuthUrl.href,
|
|
145
|
+
redirectSignIn,
|
|
146
|
+
preferPrivateSession,
|
|
147
|
+
)) ?? {};
|
|
135
148
|
|
|
136
149
|
try {
|
|
137
150
|
if (type === 'error') {
|
package/src/types/inputs.ts
CHANGED
|
@@ -1,6 +1,8 @@
|
|
|
1
1
|
// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
|
|
2
2
|
// SPDX-License-Identifier: Apache-2.0
|
|
3
3
|
|
|
4
|
+
import { OpenAuthSession } from '../utils/types';
|
|
5
|
+
|
|
4
6
|
import {
|
|
5
7
|
AuthDevice,
|
|
6
8
|
AuthUserAttribute,
|
|
@@ -54,10 +56,28 @@ export interface AuthSignOutInput {
|
|
|
54
56
|
|
|
55
57
|
export type AuthProvider = 'Amazon' | 'Apple' | 'Facebook' | 'Google';
|
|
56
58
|
|
|
59
|
+
/**
|
|
60
|
+
* OIDC prompt parameter that specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
|
|
61
|
+
*
|
|
62
|
+
* - `'NONE'` - No authentication or consent UI will be displayed
|
|
63
|
+
* - `'LOGIN'` - Force user to re-authenticate even if they have a valid session
|
|
64
|
+
* - `'CONSENT'` - Force user to consent to sharing information with the client
|
|
65
|
+
* - `'SELECT_ACCOUNT'` - Prompt user to select among multiple authenticated accounts
|
|
66
|
+
*
|
|
67
|
+
* @see https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
|
|
68
|
+
*/
|
|
69
|
+
export type AuthPrompt = 'NONE' | 'LOGIN' | 'CONSENT' | 'SELECT_ACCOUNT';
|
|
70
|
+
|
|
57
71
|
export interface AuthSignInWithRedirectInput {
|
|
58
72
|
provider?: AuthProvider | { custom: string };
|
|
59
73
|
customState?: string;
|
|
60
74
|
options?: {
|
|
75
|
+
/**
|
|
76
|
+
* on various mobile frameworks which allow js usage for app development (e.g. cordova)
|
|
77
|
+
* in-app or webview redirects are discouraged or not allowed by the OS.
|
|
78
|
+
* this gives an option to adjust the behaviour to the framework
|
|
79
|
+
*/
|
|
80
|
+
authSessionOpener?: OpenAuthSession;
|
|
61
81
|
/**
|
|
62
82
|
* On iOS devices, setting this to true requests that the browser not share cookies or other browsing data between
|
|
63
83
|
* the authentication session and the user’s normal browser session. This will bypass the permissions dialog that
|
|
@@ -95,6 +115,12 @@ export interface AuthSignInWithRedirectInput {
|
|
|
95
115
|
* @see https://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.html
|
|
96
116
|
*/
|
|
97
117
|
nonce?: string;
|
|
118
|
+
|
|
119
|
+
/**
|
|
120
|
+
* An OIDC parameter that controls authentication behavior for existing sessions. It can be used by the Client to make sure that the End-User is still present for the current session or to bring attention to the request. Available in the managed login branding version only, not in the classic hosted UI.
|
|
121
|
+
* @see https://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.html
|
|
122
|
+
*/
|
|
123
|
+
prompt?: AuthPrompt;
|
|
98
124
|
};
|
|
99
125
|
}
|
|
100
126
|
|