@aws-amplify/auth 6.14.0 → 6.14.1-unstable.76548ca.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cjs/providers/cognito/apis/signInWithRedirect.js +6 -2
- package/dist/cjs/providers/cognito/apis/signInWithRedirect.js.map +1 -1
- package/dist/esm/providers/cognito/apis/signInWithRedirect.mjs +6 -2
- package/dist/esm/providers/cognito/apis/signInWithRedirect.mjs.map +1 -1
- package/dist/esm/types/inputs.d.ts +16 -0
- package/package.json +105 -105
- package/src/providers/cognito/apis/signInWithRedirect.ts +7 -2
- package/src/types/inputs.ts +18 -0
|
@@ -26,7 +26,9 @@ async function signInWithRedirect(input) {
|
|
|
26
26
|
(0, utils_1.assertTokenProviderConfig)(authConfig);
|
|
27
27
|
(0, utils_1.assertOAuthConfig)(authConfig);
|
|
28
28
|
oauth_1.oAuthStore.setAuthConfig(authConfig);
|
|
29
|
-
|
|
29
|
+
if (!input?.options?.prompt) {
|
|
30
|
+
await (0, signInHelpers_1.assertUserNotAuthenticated)();
|
|
31
|
+
}
|
|
30
32
|
let provider = 'COGNITO'; // Default
|
|
31
33
|
if (typeof input?.provider === 'string') {
|
|
32
34
|
provider = models_1.cognitoHostedUIIdentityProviderMap[input.provider];
|
|
@@ -44,12 +46,13 @@ async function signInWithRedirect(input) {
|
|
|
44
46
|
loginHint: input?.options?.loginHint,
|
|
45
47
|
lang: input?.options?.lang,
|
|
46
48
|
nonce: input?.options?.nonce,
|
|
49
|
+
prompt: input?.options?.prompt,
|
|
47
50
|
},
|
|
48
51
|
});
|
|
49
52
|
}
|
|
50
53
|
const oauthSignIn = async ({ oauthConfig, provider, clientId, customState, preferPrivateSession, options, }) => {
|
|
51
54
|
const { domain, redirectSignIn, responseType, scopes } = oauthConfig;
|
|
52
|
-
const { loginHint, lang, nonce } = options ?? {};
|
|
55
|
+
const { loginHint, lang, nonce, prompt } = options ?? {};
|
|
53
56
|
const randomState = (0, oauth_1.generateState)();
|
|
54
57
|
/* encodeURIComponent is not URL safe, use urlSafeEncode instead. Cognito
|
|
55
58
|
single-encodes/decodes url on first sign in and double-encodes/decodes url
|
|
@@ -76,6 +79,7 @@ const oauthSignIn = async ({ oauthConfig, provider, clientId, customState, prefe
|
|
|
76
79
|
...(loginHint && { login_hint: loginHint }),
|
|
77
80
|
...(lang && { lang }),
|
|
78
81
|
...(nonce && { nonce }),
|
|
82
|
+
...(prompt && { prompt: prompt.toLowerCase() }), // Cognito expects lowercase prompt values
|
|
79
83
|
state,
|
|
80
84
|
...(responseType === 'code' && {
|
|
81
85
|
code_challenge: toCodeChallenge(),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"signInWithRedirect.js","sources":["../../../../../src/providers/cognito/apis/signInWithRedirect.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.signInWithRedirect = signInWithRedirect;\nconst core_1 = require(\"@aws-amplify/core\");\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nrequire(\"../utils/oauth/enableOAuthListener\");\nconst models_1 = require(\"../types/models\");\nconst utils_2 = require(\"../../../utils\");\nconst signInHelpers_1 = require(\"../utils/signInHelpers\");\nconst oauth_1 = require(\"../utils/oauth\");\nconst createOAuthError_1 = require(\"../utils/oauth/createOAuthError\");\nconst cancelOAuthFlow_1 = require(\"../utils/oauth/cancelOAuthFlow\");\n/**\n * Signs in a user with OAuth. Redirects the application to an Identity Provider.\n *\n * @param input - The SignInWithRedirectInput object, if empty it will redirect to Cognito HostedUI\n *\n * @throws AuthTokenConfigException - Thrown when the user pool config is invalid.\n * @throws OAuthNotConfigureException - Thrown when the oauth config is invalid.\n */\nasync function signInWithRedirect(input) {\n const authConfig = core_1.Amplify.getConfig().Auth?.Cognito;\n (0, utils_1.assertTokenProviderConfig)(authConfig);\n (0, utils_1.assertOAuthConfig)(authConfig);\n oauth_1.oAuthStore.setAuthConfig(authConfig);\n await (0, signInHelpers_1.assertUserNotAuthenticated)();\n let provider = 'COGNITO'; // Default\n if (typeof input?.provider === 'string') {\n provider = models_1.cognitoHostedUIIdentityProviderMap[input.provider];\n }\n else if (input?.provider?.custom) {\n provider = input.provider.custom;\n }\n return oauthSignIn({\n oauthConfig: authConfig.loginWith.oauth,\n clientId: authConfig.userPoolClientId,\n provider,\n customState: input?.customState,\n preferPrivateSession: input?.options?.preferPrivateSession,\n options: {\n loginHint: input?.options?.loginHint,\n lang: input?.options?.lang,\n nonce: input?.options?.nonce,\n },\n });\n}\nconst oauthSignIn = async ({ oauthConfig, provider, clientId, customState, preferPrivateSession, options, }) => {\n const { domain, redirectSignIn, responseType, scopes } = oauthConfig;\n const { loginHint, lang, nonce } = options ?? {};\n const randomState = (0, oauth_1.generateState)();\n /* encodeURIComponent is not URL safe, use urlSafeEncode instead. Cognito\n single-encodes/decodes url on first sign in and double-encodes/decodes url\n when user already signed in. Using encodeURIComponent, Base32, Base64 add\n characters % or = which on further encoding becomes unsafe. '=' create issue\n for parsing query params.\n Refer: https://github.com/aws-amplify/amplify-js/issues/5218 */\n const state = customState\n ? `${randomState}-${(0, utils_1.urlSafeEncode)(customState)}`\n : randomState;\n const { value, method, toCodeChallenge } = (0, oauth_1.generateCodeVerifier)(128);\n const redirectUri = (0, oauth_1.getRedirectUrl)(oauthConfig.redirectSignIn);\n if ((0, utils_1.isBrowser)())\n oauth_1.oAuthStore.storeOAuthInFlight(true);\n oauth_1.oAuthStore.storeOAuthState(state);\n oauth_1.oAuthStore.storePKCE(value);\n const queryString = Object.entries({\n redirect_uri: redirectUri,\n response_type: responseType,\n client_id: clientId,\n identity_provider: provider,\n scope: scopes.join(' '),\n // eslint-disable-next-line camelcase\n ...(loginHint && { login_hint: loginHint }),\n ...(lang && { lang }),\n ...(nonce && { nonce }),\n state,\n ...(responseType === 'code' && {\n code_challenge: toCodeChallenge(),\n code_challenge_method: method,\n }),\n })\n .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`)\n .join('&');\n // TODO(v6): use URL object instead\n const oAuthUrl = `https://${domain}/oauth2/authorize?${queryString}`;\n // this will only take effect in the following scenarios:\n // 1. the user cancels the OAuth flow on web via back button, and\n // 2. when bfcache is enabled\n (0, cancelOAuthFlow_1.listenForOAuthFlowCancellation)(oauth_1.oAuthStore);\n // the following is effective only in react-native as openAuthSession resolves only in react-native\n const { type, error, url } = (await (0, utils_2.openAuthSession)(oAuthUrl, redirectSignIn, preferPrivateSession)) ??\n {};\n try {\n if (type === 'error') {\n throw (0, createOAuthError_1.createOAuthError)(String(error));\n }\n if (type === 'success' && url) {\n await (0, oauth_1.completeOAuthFlow)({\n currentUrl: url,\n clientId,\n domain,\n redirectUri,\n responseType,\n userAgentValue: (0, utils_2.getAuthUserAgentValue)(utils_1.AuthAction.SignInWithRedirect),\n preferPrivateSession,\n });\n }\n }\n catch (err) {\n await (0, oauth_1.handleFailure)(err);\n // rethrow the error so it can be caught by `await signInWithRedirect()` in react-native\n throw err;\n }\n};\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC7D,OAAO,CAAC,kBAAkB,GAAG,kBAAkB;AAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;AAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC;AAC5D,OAAO,CAAC,oCAAoC,CAAC;AAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAC;AAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACzC,MAAM,eAAe,GAAG,OAAO,CAAC,wBAAwB,CAAC;AACzD,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACzC,MAAM,kBAAkB,GAAG,OAAO,CAAC,iCAAiC,CAAC;AACrE,MAAM,iBAAiB,GAAG,OAAO,CAAC,gCAAgC,CAAC;AACnE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,kBAAkB,CAAC,KAAK,EAAE;AACzC,IAAI,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO;AAC/D,IAAI,IAAI,OAAO,CAAC,yBAAyB,EAAE,UAAU,CAAC;AACtD,IAAI,IAAI,OAAO,CAAC,iBAAiB,EAAE,UAAU,CAAC;AAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC;AAChD,IAAI,MAAM,IAAI,eAAe,CAAC,0BAA0B,GAAG;
|
|
1
|
+
{"version":3,"file":"signInWithRedirect.js","sources":["../../../../../src/providers/cognito/apis/signInWithRedirect.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.signInWithRedirect = signInWithRedirect;\nconst core_1 = require(\"@aws-amplify/core\");\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nrequire(\"../utils/oauth/enableOAuthListener\");\nconst models_1 = require(\"../types/models\");\nconst utils_2 = require(\"../../../utils\");\nconst signInHelpers_1 = require(\"../utils/signInHelpers\");\nconst oauth_1 = require(\"../utils/oauth\");\nconst createOAuthError_1 = require(\"../utils/oauth/createOAuthError\");\nconst cancelOAuthFlow_1 = require(\"../utils/oauth/cancelOAuthFlow\");\n/**\n * Signs in a user with OAuth. Redirects the application to an Identity Provider.\n *\n * @param input - The SignInWithRedirectInput object, if empty it will redirect to Cognito HostedUI\n *\n * @throws AuthTokenConfigException - Thrown when the user pool config is invalid.\n * @throws OAuthNotConfigureException - Thrown when the oauth config is invalid.\n */\nasync function signInWithRedirect(input) {\n const authConfig = core_1.Amplify.getConfig().Auth?.Cognito;\n (0, utils_1.assertTokenProviderConfig)(authConfig);\n (0, utils_1.assertOAuthConfig)(authConfig);\n oauth_1.oAuthStore.setAuthConfig(authConfig);\n if (!input?.options?.prompt) {\n await (0, signInHelpers_1.assertUserNotAuthenticated)();\n }\n let provider = 'COGNITO'; // Default\n if (typeof input?.provider === 'string') {\n provider = models_1.cognitoHostedUIIdentityProviderMap[input.provider];\n }\n else if (input?.provider?.custom) {\n provider = input.provider.custom;\n }\n return oauthSignIn({\n oauthConfig: authConfig.loginWith.oauth,\n clientId: authConfig.userPoolClientId,\n provider,\n customState: input?.customState,\n preferPrivateSession: input?.options?.preferPrivateSession,\n options: {\n loginHint: input?.options?.loginHint,\n lang: input?.options?.lang,\n nonce: input?.options?.nonce,\n prompt: input?.options?.prompt,\n },\n });\n}\nconst oauthSignIn = async ({ oauthConfig, provider, clientId, customState, preferPrivateSession, options, }) => {\n const { domain, redirectSignIn, responseType, scopes } = oauthConfig;\n const { loginHint, lang, nonce, prompt } = options ?? {};\n const randomState = (0, oauth_1.generateState)();\n /* encodeURIComponent is not URL safe, use urlSafeEncode instead. Cognito\n single-encodes/decodes url on first sign in and double-encodes/decodes url\n when user already signed in. Using encodeURIComponent, Base32, Base64 add\n characters % or = which on further encoding becomes unsafe. '=' create issue\n for parsing query params.\n Refer: https://github.com/aws-amplify/amplify-js/issues/5218 */\n const state = customState\n ? `${randomState}-${(0, utils_1.urlSafeEncode)(customState)}`\n : randomState;\n const { value, method, toCodeChallenge } = (0, oauth_1.generateCodeVerifier)(128);\n const redirectUri = (0, oauth_1.getRedirectUrl)(oauthConfig.redirectSignIn);\n if ((0, utils_1.isBrowser)())\n oauth_1.oAuthStore.storeOAuthInFlight(true);\n oauth_1.oAuthStore.storeOAuthState(state);\n oauth_1.oAuthStore.storePKCE(value);\n const queryString = Object.entries({\n redirect_uri: redirectUri,\n response_type: responseType,\n client_id: clientId,\n identity_provider: provider,\n scope: scopes.join(' '),\n // eslint-disable-next-line camelcase\n ...(loginHint && { login_hint: loginHint }),\n ...(lang && { lang }),\n ...(nonce && { nonce }),\n ...(prompt && { prompt: prompt.toLowerCase() }), // Cognito expects lowercase prompt values\n state,\n ...(responseType === 'code' && {\n code_challenge: toCodeChallenge(),\n code_challenge_method: method,\n }),\n })\n .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`)\n .join('&');\n // TODO(v6): use URL object instead\n const oAuthUrl = `https://${domain}/oauth2/authorize?${queryString}`;\n // this will only take effect in the following scenarios:\n // 1. the user cancels the OAuth flow on web via back button, and\n // 2. when bfcache is enabled\n (0, cancelOAuthFlow_1.listenForOAuthFlowCancellation)(oauth_1.oAuthStore);\n // the following is effective only in react-native as openAuthSession resolves only in react-native\n const { type, error, url } = (await (0, utils_2.openAuthSession)(oAuthUrl, redirectSignIn, preferPrivateSession)) ??\n {};\n try {\n if (type === 'error') {\n throw (0, createOAuthError_1.createOAuthError)(String(error));\n }\n if (type === 'success' && url) {\n await (0, oauth_1.completeOAuthFlow)({\n currentUrl: url,\n clientId,\n domain,\n redirectUri,\n responseType,\n userAgentValue: (0, utils_2.getAuthUserAgentValue)(utils_1.AuthAction.SignInWithRedirect),\n preferPrivateSession,\n });\n }\n }\n catch (err) {\n await (0, oauth_1.handleFailure)(err);\n // rethrow the error so it can be caught by `await signInWithRedirect()` in react-native\n throw err;\n }\n};\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC7D,OAAO,CAAC,kBAAkB,GAAG,kBAAkB;AAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;AAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC;AAC5D,OAAO,CAAC,oCAAoC,CAAC;AAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAC;AAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACzC,MAAM,eAAe,GAAG,OAAO,CAAC,wBAAwB,CAAC;AACzD,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACzC,MAAM,kBAAkB,GAAG,OAAO,CAAC,iCAAiC,CAAC;AACrE,MAAM,iBAAiB,GAAG,OAAO,CAAC,gCAAgC,CAAC;AACnE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,kBAAkB,CAAC,KAAK,EAAE;AACzC,IAAI,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO;AAC/D,IAAI,IAAI,OAAO,CAAC,yBAAyB,EAAE,UAAU,CAAC;AACtD,IAAI,IAAI,OAAO,CAAC,iBAAiB,EAAE,UAAU,CAAC;AAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC;AAChD,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE;AACjC,QAAQ,MAAM,IAAI,eAAe,CAAC,0BAA0B,GAAG;AAC/D,IAAI;AACJ,IAAI,IAAI,QAAQ,GAAG,SAAS,CAAC;AAC7B,IAAI,IAAI,OAAO,KAAK,EAAE,QAAQ,KAAK,QAAQ,EAAE;AAC7C,QAAQ,QAAQ,GAAG,QAAQ,CAAC,kCAAkC,CAAC,KAAK,CAAC,QAAQ,CAAC;AAC9E,IAAI;AACJ,SAAS,IAAI,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE;AACtC,QAAQ,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM;AACxC,IAAI;AACJ,IAAI,OAAO,WAAW,CAAC;AACvB,QAAQ,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK;AAC/C,QAAQ,QAAQ,EAAE,UAAU,CAAC,gBAAgB;AAC7C,QAAQ,QAAQ;AAChB,QAAQ,WAAW,EAAE,KAAK,EAAE,WAAW;AACvC,QAAQ,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB;AAClE,QAAQ,OAAO,EAAE;AACjB,YAAY,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS;AAChD,YAAY,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI;AACtC,YAAY,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AACxC,YAAY,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM;AAC1C,SAAS;AACT,KAAK,CAAC;AACN;AACA,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,OAAO,GAAG,KAAK;AAChH,IAAI,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,WAAW;AACxE,IAAI,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,IAAI,EAAE;AAC5D,IAAI,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,aAAa,GAAG;AACpD;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,KAAK,GAAG;AAClB,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;AACpE,UAAU,WAAW;AACrB,IAAI,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC;AACrF,IAAI,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,cAAc,EAAE,WAAW,CAAC,cAAc,CAAC;AAC/E,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,GAAG;AAChC,QAAQ,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC;AACnD,IAAI,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC;AAC7C,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC;AACvC,IAAI,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC;AACvC,QAAQ,YAAY,EAAE,WAAW;AACjC,QAAQ,aAAa,EAAE,YAAY;AACnC,QAAQ,SAAS,EAAE,QAAQ;AAC3B,QAAQ,iBAAiB,EAAE,QAAQ;AACnC,QAAQ,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;AAC/B;AACA,QAAQ,IAAI,SAAS,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AACnD,QAAQ,IAAI,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC;AAC7B,QAAQ,IAAI,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC;AAC/B,QAAQ,IAAI,MAAM,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;AACvD,QAAQ,KAAK;AACb,QAAQ,IAAI,YAAY,KAAK,MAAM,IAAI;AACvC,YAAY,cAAc,EAAE,eAAe,EAAE;AAC7C,YAAY,qBAAqB,EAAE,MAAM;AACzC,SAAS,CAAC;AACV,KAAK;AACL,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5E,SAAS,IAAI,CAAC,GAAG,CAAC;AAClB;AACA,IAAI,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC;AACxE;AACA;AACA;AACA,IAAI,IAAI,iBAAiB,CAAC,8BAA8B,EAAE,OAAO,CAAC,UAAU,CAAC;AAC7E;AACA,IAAI,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,eAAe,EAAE,QAAQ,EAAE,cAAc,EAAE,oBAAoB,CAAC;AACpH,QAAQ,EAAE;AACV,IAAI,IAAI;AACR,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE;AAC9B,YAAY,MAAM,CAAC,CAAC,EAAE,kBAAkB,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AACzE,QAAQ;AACR,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,EAAE;AACvC,YAAY,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,iBAAiB,EAAE;AACjD,gBAAgB,UAAU,EAAE,GAAG;AAC/B,gBAAgB,QAAQ;AACxB,gBAAgB,MAAM;AACtB,gBAAgB,WAAW;AAC3B,gBAAgB,YAAY;AAC5B,gBAAgB,cAAc,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,qBAAqB,EAAE,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC;AACzG,gBAAgB,oBAAoB;AACpC,aAAa,CAAC;AACd,QAAQ;AACR,IAAI;AACJ,IAAI,OAAO,GAAG,EAAE;AAChB,QAAQ,MAAM,IAAI,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;AAC7C;AACA,QAAQ,MAAM,GAAG;AACjB,IAAI;AACJ,CAAC;;"}
|
|
@@ -33,7 +33,9 @@ async function signInWithRedirect(input) {
|
|
|
33
33
|
assertTokenProviderConfig(authConfig);
|
|
34
34
|
assertOAuthConfig(authConfig);
|
|
35
35
|
oAuthStore.setAuthConfig(authConfig);
|
|
36
|
-
|
|
36
|
+
if (!input?.options?.prompt) {
|
|
37
|
+
await assertUserNotAuthenticated();
|
|
38
|
+
}
|
|
37
39
|
let provider = 'COGNITO'; // Default
|
|
38
40
|
if (typeof input?.provider === 'string') {
|
|
39
41
|
provider = cognitoHostedUIIdentityProviderMap[input.provider];
|
|
@@ -51,12 +53,13 @@ async function signInWithRedirect(input) {
|
|
|
51
53
|
loginHint: input?.options?.loginHint,
|
|
52
54
|
lang: input?.options?.lang,
|
|
53
55
|
nonce: input?.options?.nonce,
|
|
56
|
+
prompt: input?.options?.prompt,
|
|
54
57
|
},
|
|
55
58
|
});
|
|
56
59
|
}
|
|
57
60
|
const oauthSignIn = async ({ oauthConfig, provider, clientId, customState, preferPrivateSession, options, }) => {
|
|
58
61
|
const { domain, redirectSignIn, responseType, scopes } = oauthConfig;
|
|
59
|
-
const { loginHint, lang, nonce } = options ?? {};
|
|
62
|
+
const { loginHint, lang, nonce, prompt } = options ?? {};
|
|
60
63
|
const randomState = generateState();
|
|
61
64
|
/* encodeURIComponent is not URL safe, use urlSafeEncode instead. Cognito
|
|
62
65
|
single-encodes/decodes url on first sign in and double-encodes/decodes url
|
|
@@ -83,6 +86,7 @@ const oauthSignIn = async ({ oauthConfig, provider, clientId, customState, prefe
|
|
|
83
86
|
...(loginHint && { login_hint: loginHint }),
|
|
84
87
|
...(lang && { lang }),
|
|
85
88
|
...(nonce && { nonce }),
|
|
89
|
+
...(prompt && { prompt: prompt.toLowerCase() }), // Cognito expects lowercase prompt values
|
|
86
90
|
state,
|
|
87
91
|
...(responseType === 'code' && {
|
|
88
92
|
code_challenge: toCodeChallenge(),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"signInWithRedirect.mjs","sources":["../../../../../src/providers/cognito/apis/signInWithRedirect.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { Amplify } from '@aws-amplify/core';\nimport { AuthAction, assertOAuthConfig, assertTokenProviderConfig, isBrowser, urlSafeEncode, } from '@aws-amplify/core/internals/utils';\nimport '../utils/oauth/enableOAuthListener';\nimport { cognitoHostedUIIdentityProviderMap } from '../types/models';\nimport { getAuthUserAgentValue, openAuthSession } from '../../../utils';\nimport { assertUserNotAuthenticated } from '../utils/signInHelpers';\nimport { completeOAuthFlow, generateCodeVerifier, generateState, getRedirectUrl, handleFailure, oAuthStore, } from '../utils/oauth';\nimport { createOAuthError } from '../utils/oauth/createOAuthError';\nimport { listenForOAuthFlowCancellation } from '../utils/oauth/cancelOAuthFlow';\n/**\n * Signs in a user with OAuth. Redirects the application to an Identity Provider.\n *\n * @param input - The SignInWithRedirectInput object, if empty it will redirect to Cognito HostedUI\n *\n * @throws AuthTokenConfigException - Thrown when the user pool config is invalid.\n * @throws OAuthNotConfigureException - Thrown when the oauth config is invalid.\n */\nexport async function signInWithRedirect(input) {\n const authConfig = Amplify.getConfig().Auth?.Cognito;\n assertTokenProviderConfig(authConfig);\n assertOAuthConfig(authConfig);\n oAuthStore.setAuthConfig(authConfig);\n await assertUserNotAuthenticated();\n let provider = 'COGNITO'; // Default\n if (typeof input?.provider === 'string') {\n provider = cognitoHostedUIIdentityProviderMap[input.provider];\n }\n else if (input?.provider?.custom) {\n provider = input.provider.custom;\n }\n return oauthSignIn({\n oauthConfig: authConfig.loginWith.oauth,\n clientId: authConfig.userPoolClientId,\n provider,\n customState: input?.customState,\n preferPrivateSession: input?.options?.preferPrivateSession,\n options: {\n loginHint: input?.options?.loginHint,\n lang: input?.options?.lang,\n nonce: input?.options?.nonce,\n },\n });\n}\nconst oauthSignIn = async ({ oauthConfig, provider, clientId, customState, preferPrivateSession, options, }) => {\n const { domain, redirectSignIn, responseType, scopes } = oauthConfig;\n const { loginHint, lang, nonce } = options ?? {};\n const randomState = generateState();\n /* encodeURIComponent is not URL safe, use urlSafeEncode instead. Cognito\n single-encodes/decodes url on first sign in and double-encodes/decodes url\n when user already signed in. Using encodeURIComponent, Base32, Base64 add\n characters % or = which on further encoding becomes unsafe. '=' create issue\n for parsing query params.\n Refer: https://github.com/aws-amplify/amplify-js/issues/5218 */\n const state = customState\n ? `${randomState}-${urlSafeEncode(customState)}`\n : randomState;\n const { value, method, toCodeChallenge } = generateCodeVerifier(128);\n const redirectUri = getRedirectUrl(oauthConfig.redirectSignIn);\n if (isBrowser())\n oAuthStore.storeOAuthInFlight(true);\n oAuthStore.storeOAuthState(state);\n oAuthStore.storePKCE(value);\n const queryString = Object.entries({\n redirect_uri: redirectUri,\n response_type: responseType,\n client_id: clientId,\n identity_provider: provider,\n scope: scopes.join(' '),\n // eslint-disable-next-line camelcase\n ...(loginHint && { login_hint: loginHint }),\n ...(lang && { lang }),\n ...(nonce && { nonce }),\n state,\n ...(responseType === 'code' && {\n code_challenge: toCodeChallenge(),\n code_challenge_method: method,\n }),\n })\n .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`)\n .join('&');\n // TODO(v6): use URL object instead\n const oAuthUrl = `https://${domain}/oauth2/authorize?${queryString}`;\n // this will only take effect in the following scenarios:\n // 1. the user cancels the OAuth flow on web via back button, and\n // 2. when bfcache is enabled\n listenForOAuthFlowCancellation(oAuthStore);\n // the following is effective only in react-native as openAuthSession resolves only in react-native\n const { type, error, url } = (await openAuthSession(oAuthUrl, redirectSignIn, preferPrivateSession)) ??\n {};\n try {\n if (type === 'error') {\n throw createOAuthError(String(error));\n }\n if (type === 'success' && url) {\n await completeOAuthFlow({\n currentUrl: url,\n clientId,\n domain,\n redirectUri,\n responseType,\n userAgentValue: getAuthUserAgentValue(AuthAction.SignInWithRedirect),\n preferPrivateSession,\n });\n }\n }\n catch (err) {\n await handleFailure(err);\n // rethrow the error so it can be caught by `await signInWithRedirect()` in react-native\n throw err;\n }\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AACA;AAUA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAe,kBAAkB,CAAC,KAAK,EAAE;AAChD,IAAI,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO;AACxD,IAAI,yBAAyB,CAAC,UAAU,CAAC;AACzC,IAAI,iBAAiB,CAAC,UAAU,CAAC;AACjC,IAAI,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC;AACxC,IAAI,MAAM,0BAA0B,EAAE;
|
|
1
|
+
{"version":3,"file":"signInWithRedirect.mjs","sources":["../../../../../src/providers/cognito/apis/signInWithRedirect.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { Amplify } from '@aws-amplify/core';\nimport { AuthAction, assertOAuthConfig, assertTokenProviderConfig, isBrowser, urlSafeEncode, } from '@aws-amplify/core/internals/utils';\nimport '../utils/oauth/enableOAuthListener';\nimport { cognitoHostedUIIdentityProviderMap } from '../types/models';\nimport { getAuthUserAgentValue, openAuthSession } from '../../../utils';\nimport { assertUserNotAuthenticated } from '../utils/signInHelpers';\nimport { completeOAuthFlow, generateCodeVerifier, generateState, getRedirectUrl, handleFailure, oAuthStore, } from '../utils/oauth';\nimport { createOAuthError } from '../utils/oauth/createOAuthError';\nimport { listenForOAuthFlowCancellation } from '../utils/oauth/cancelOAuthFlow';\n/**\n * Signs in a user with OAuth. Redirects the application to an Identity Provider.\n *\n * @param input - The SignInWithRedirectInput object, if empty it will redirect to Cognito HostedUI\n *\n * @throws AuthTokenConfigException - Thrown when the user pool config is invalid.\n * @throws OAuthNotConfigureException - Thrown when the oauth config is invalid.\n */\nexport async function signInWithRedirect(input) {\n const authConfig = Amplify.getConfig().Auth?.Cognito;\n assertTokenProviderConfig(authConfig);\n assertOAuthConfig(authConfig);\n oAuthStore.setAuthConfig(authConfig);\n if (!input?.options?.prompt) {\n await assertUserNotAuthenticated();\n }\n let provider = 'COGNITO'; // Default\n if (typeof input?.provider === 'string') {\n provider = cognitoHostedUIIdentityProviderMap[input.provider];\n }\n else if (input?.provider?.custom) {\n provider = input.provider.custom;\n }\n return oauthSignIn({\n oauthConfig: authConfig.loginWith.oauth,\n clientId: authConfig.userPoolClientId,\n provider,\n customState: input?.customState,\n preferPrivateSession: input?.options?.preferPrivateSession,\n options: {\n loginHint: input?.options?.loginHint,\n lang: input?.options?.lang,\n nonce: input?.options?.nonce,\n prompt: input?.options?.prompt,\n },\n });\n}\nconst oauthSignIn = async ({ oauthConfig, provider, clientId, customState, preferPrivateSession, options, }) => {\n const { domain, redirectSignIn, responseType, scopes } = oauthConfig;\n const { loginHint, lang, nonce, prompt } = options ?? {};\n const randomState = generateState();\n /* encodeURIComponent is not URL safe, use urlSafeEncode instead. Cognito\n single-encodes/decodes url on first sign in and double-encodes/decodes url\n when user already signed in. Using encodeURIComponent, Base32, Base64 add\n characters % or = which on further encoding becomes unsafe. '=' create issue\n for parsing query params.\n Refer: https://github.com/aws-amplify/amplify-js/issues/5218 */\n const state = customState\n ? `${randomState}-${urlSafeEncode(customState)}`\n : randomState;\n const { value, method, toCodeChallenge } = generateCodeVerifier(128);\n const redirectUri = getRedirectUrl(oauthConfig.redirectSignIn);\n if (isBrowser())\n oAuthStore.storeOAuthInFlight(true);\n oAuthStore.storeOAuthState(state);\n oAuthStore.storePKCE(value);\n const queryString = Object.entries({\n redirect_uri: redirectUri,\n response_type: responseType,\n client_id: clientId,\n identity_provider: provider,\n scope: scopes.join(' '),\n // eslint-disable-next-line camelcase\n ...(loginHint && { login_hint: loginHint }),\n ...(lang && { lang }),\n ...(nonce && { nonce }),\n ...(prompt && { prompt: prompt.toLowerCase() }), // Cognito expects lowercase prompt values\n state,\n ...(responseType === 'code' && {\n code_challenge: toCodeChallenge(),\n code_challenge_method: method,\n }),\n })\n .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`)\n .join('&');\n // TODO(v6): use URL object instead\n const oAuthUrl = `https://${domain}/oauth2/authorize?${queryString}`;\n // this will only take effect in the following scenarios:\n // 1. the user cancels the OAuth flow on web via back button, and\n // 2. when bfcache is enabled\n listenForOAuthFlowCancellation(oAuthStore);\n // the following is effective only in react-native as openAuthSession resolves only in react-native\n const { type, error, url } = (await openAuthSession(oAuthUrl, redirectSignIn, preferPrivateSession)) ??\n {};\n try {\n if (type === 'error') {\n throw createOAuthError(String(error));\n }\n if (type === 'success' && url) {\n await completeOAuthFlow({\n currentUrl: url,\n clientId,\n domain,\n redirectUri,\n responseType,\n userAgentValue: getAuthUserAgentValue(AuthAction.SignInWithRedirect),\n preferPrivateSession,\n });\n }\n }\n catch (err) {\n await handleFailure(err);\n // rethrow the error so it can be caught by `await signInWithRedirect()` in react-native\n throw err;\n }\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AACA;AAUA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAe,kBAAkB,CAAC,KAAK,EAAE;AAChD,IAAI,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO;AACxD,IAAI,yBAAyB,CAAC,UAAU,CAAC;AACzC,IAAI,iBAAiB,CAAC,UAAU,CAAC;AACjC,IAAI,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC;AACxC,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE;AACjC,QAAQ,MAAM,0BAA0B,EAAE;AAC1C,IAAI;AACJ,IAAI,IAAI,QAAQ,GAAG,SAAS,CAAC;AAC7B,IAAI,IAAI,OAAO,KAAK,EAAE,QAAQ,KAAK,QAAQ,EAAE;AAC7C,QAAQ,QAAQ,GAAG,kCAAkC,CAAC,KAAK,CAAC,QAAQ,CAAC;AACrE,IAAI;AACJ,SAAS,IAAI,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE;AACtC,QAAQ,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM;AACxC,IAAI;AACJ,IAAI,OAAO,WAAW,CAAC;AACvB,QAAQ,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK;AAC/C,QAAQ,QAAQ,EAAE,UAAU,CAAC,gBAAgB;AAC7C,QAAQ,QAAQ;AAChB,QAAQ,WAAW,EAAE,KAAK,EAAE,WAAW;AACvC,QAAQ,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB;AAClE,QAAQ,OAAO,EAAE;AACjB,YAAY,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS;AAChD,YAAY,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI;AACtC,YAAY,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AACxC,YAAY,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM;AAC1C,SAAS;AACT,KAAK,CAAC;AACN;AACA,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,OAAO,GAAG,KAAK;AAChH,IAAI,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,WAAW;AACxE,IAAI,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,IAAI,EAAE;AAC5D,IAAI,MAAM,WAAW,GAAG,aAAa,EAAE;AACvC;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,KAAK,GAAG;AAClB,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;AACvD,UAAU,WAAW;AACrB,IAAI,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC;AACxE,IAAI,MAAM,WAAW,GAAG,cAAc,CAAC,WAAW,CAAC,cAAc,CAAC;AAClE,IAAI,IAAI,SAAS,EAAE;AACnB,QAAQ,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC;AAC3C,IAAI,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC;AACrC,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC;AAC/B,IAAI,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC;AACvC,QAAQ,YAAY,EAAE,WAAW;AACjC,QAAQ,aAAa,EAAE,YAAY;AACnC,QAAQ,SAAS,EAAE,QAAQ;AAC3B,QAAQ,iBAAiB,EAAE,QAAQ;AACnC,QAAQ,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;AAC/B;AACA,QAAQ,IAAI,SAAS,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AACnD,QAAQ,IAAI,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC;AAC7B,QAAQ,IAAI,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC;AAC/B,QAAQ,IAAI,MAAM,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;AACvD,QAAQ,KAAK;AACb,QAAQ,IAAI,YAAY,KAAK,MAAM,IAAI;AACvC,YAAY,cAAc,EAAE,eAAe,EAAE;AAC7C,YAAY,qBAAqB,EAAE,MAAM;AACzC,SAAS,CAAC;AACV,KAAK;AACL,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5E,SAAS,IAAI,CAAC,GAAG,CAAC;AAClB;AACA,IAAI,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC;AACxE;AACA;AACA;AACA,IAAI,8BAA8B,CAAC,UAAU,CAAC;AAC9C;AACA,IAAI,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,eAAe,CAAC,QAA8C,CAAC;AACvG,QAAQ,EAAE;AACV,IAAI,IAAI;AACR,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE;AAC9B,YAAY,MAAM,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjD,QAAQ;AACR,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,EAAE;AACvC,YAAY,MAAM,iBAAiB,CAAC;AACpC,gBAAgB,UAAU,EAAE,GAAG;AAC/B,gBAAgB,QAAQ;AACxB,gBAAgB,MAAM;AACtB,gBAAgB,WAAW;AAC3B,gBAAgB,YAAY;AAC5B,gBAAgB,cAAc,EAAE,qBAAqB,CAAC,UAAU,CAAC,kBAAkB,CAAC;AACpF,gBAAgB,oBAAoB;AACpC,aAAa,CAAC;AACd,QAAQ;AACR,IAAI;AACJ,IAAI,OAAO,GAAG,EAAE;AAChB,QAAQ,MAAM,aAAa,CAAC,GAAG,CAAC;AAChC;AACA,QAAQ,MAAM,GAAG;AACjB,IAAI;AACJ,CAAC;;;;"}
|
|
@@ -32,6 +32,17 @@ export interface AuthSignOutInput {
|
|
|
32
32
|
};
|
|
33
33
|
}
|
|
34
34
|
export type AuthProvider = 'Amazon' | 'Apple' | 'Facebook' | 'Google';
|
|
35
|
+
/**
|
|
36
|
+
* OIDC prompt parameter that specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
|
|
37
|
+
*
|
|
38
|
+
* - `'NONE'` - No authentication or consent UI will be displayed
|
|
39
|
+
* - `'LOGIN'` - Force user to re-authenticate even if they have a valid session
|
|
40
|
+
* - `'CONSENT'` - Force user to consent to sharing information with the client
|
|
41
|
+
* - `'SELECT_ACCOUNT'` - Prompt user to select among multiple authenticated accounts
|
|
42
|
+
*
|
|
43
|
+
* @see https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
|
|
44
|
+
*/
|
|
45
|
+
export type AuthPrompt = 'NONE' | 'LOGIN' | 'CONSENT' | 'SELECT_ACCOUNT';
|
|
35
46
|
export interface AuthSignInWithRedirectInput {
|
|
36
47
|
provider?: AuthProvider | {
|
|
37
48
|
custom: string;
|
|
@@ -63,6 +74,11 @@ export interface AuthSignInWithRedirectInput {
|
|
|
63
74
|
* @see https://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.html
|
|
64
75
|
*/
|
|
65
76
|
nonce?: string;
|
|
77
|
+
/**
|
|
78
|
+
* An OIDC parameter that controls authentication behavior for existing sessions. It can be used by the Client to make sure that the End-User is still present for the current session or to bring attention to the request. Available in the managed login branding version only, not in the classic hosted UI.
|
|
79
|
+
* @see https://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.html
|
|
80
|
+
*/
|
|
81
|
+
prompt?: AuthPrompt;
|
|
66
82
|
};
|
|
67
83
|
}
|
|
68
84
|
/**
|
package/package.json
CHANGED
|
@@ -1,107 +1,107 @@
|
|
|
1
1
|
{
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
2
|
+
"name": "@aws-amplify/auth",
|
|
3
|
+
"version": "6.14.1-unstable.76548ca.0+76548ca",
|
|
4
|
+
"description": "Auth category of aws-amplify",
|
|
5
|
+
"main": "./dist/cjs/index.js",
|
|
6
|
+
"module": "./dist/esm/index.mjs",
|
|
7
|
+
"typings": "./dist/esm/index.d.ts",
|
|
8
|
+
"react-native": "./dist/cjs/index.js",
|
|
9
|
+
"sideEffects": [
|
|
10
|
+
"./dist/cjs/providers/cognito/apis/signInWithRedirect.js",
|
|
11
|
+
"./dist/esm/providers/cognito/apis/signInWithRedirect.mjs",
|
|
12
|
+
"./dist/cjs/providers/cognito/utils/oauth/enableOAuthListener.js",
|
|
13
|
+
"./dist/esm/providers/cognito/utils/oauth/enableOAuthListener.mjs"
|
|
14
|
+
],
|
|
15
|
+
"publishConfig": {
|
|
16
|
+
"access": "public"
|
|
17
|
+
},
|
|
18
|
+
"scripts": {
|
|
19
|
+
"test": "yarn lint --fix && jest -w 1 --coverage --logHeapUsage",
|
|
20
|
+
"build-with-test": "npm test && npm run build",
|
|
21
|
+
"build:umd": "webpack && webpack --config ./webpack.config.dev.js",
|
|
22
|
+
"build:esm-cjs": "rollup --forceExit -c rollup.config.mjs",
|
|
23
|
+
"build:watch": "npm run build:esm-cjs -- --watch",
|
|
24
|
+
"build": "npm run clean && npm run build:esm-cjs && npm run build:umd",
|
|
25
|
+
"clean": "npm run clean:size && rimraf lib-esm lib dist",
|
|
26
|
+
"clean:size": "rimraf dual-publish-tmp tmp*",
|
|
27
|
+
"format": "echo \"Not implemented\"",
|
|
28
|
+
"lint": "eslint '**/*.{ts,tsx}' && npm run ts-coverage",
|
|
29
|
+
"lint:fix": "eslint '**/*.{ts,tsx}' --fix",
|
|
30
|
+
"ts-coverage": "typescript-coverage-report -p ./tsconfig.build.json -t 91.18"
|
|
31
|
+
},
|
|
32
|
+
"typesVersions": {
|
|
33
|
+
">=4.2": {
|
|
34
|
+
"cognito": [
|
|
35
|
+
"./dist/esm/providers/cognito/index.d.ts"
|
|
36
|
+
],
|
|
37
|
+
"cognito/server": [
|
|
38
|
+
"./dist/esm/providers/cognito/apis/server/index.d.ts"
|
|
39
|
+
],
|
|
40
|
+
"server": [
|
|
41
|
+
"./dist/esm/server.d.ts"
|
|
42
|
+
]
|
|
43
|
+
}
|
|
44
|
+
},
|
|
45
|
+
"exports": {
|
|
46
|
+
".": {
|
|
47
|
+
"react-native": "./dist/cjs/index.js",
|
|
48
|
+
"types": "./dist/esm/index.d.ts",
|
|
49
|
+
"import": "./dist/esm/index.mjs",
|
|
50
|
+
"require": "./dist/cjs/index.js"
|
|
51
|
+
},
|
|
52
|
+
"./cognito": {
|
|
53
|
+
"react-native": "./dist/cjs/providers/cognito/index.js",
|
|
54
|
+
"types": "./dist/esm/providers/cognito/index.d.ts",
|
|
55
|
+
"import": "./dist/esm/providers/cognito/index.mjs",
|
|
56
|
+
"require": "./dist/cjs/providers/cognito/index.js"
|
|
57
|
+
},
|
|
58
|
+
"./cognito/server": {
|
|
59
|
+
"types": "./dist/esm/providers/cognito/apis/server/index.d.ts",
|
|
60
|
+
"import": "./dist/esm/providers/cognito/apis/server/index.mjs",
|
|
61
|
+
"require": "./dist/cjs/providers/cognito/apis/server/index.js"
|
|
62
|
+
},
|
|
63
|
+
"./server": {
|
|
64
|
+
"types": "./dist/esm/server.d.ts",
|
|
65
|
+
"import": "./dist/esm/server.mjs",
|
|
66
|
+
"require": "./dist/cjs/server.js"
|
|
67
|
+
},
|
|
68
|
+
"./enable-oauth-listener": {
|
|
69
|
+
"types": "./dist/esm/providers/cognito/utils/oauth/enableOAuthListener.d.ts",
|
|
70
|
+
"import": "./dist/esm/providers/cognito/utils/oauth/enableOAuthListener.mjs",
|
|
71
|
+
"require": "./dist/cjs/providers/cognito/utils/oauth/enableOAuthListener.js"
|
|
72
|
+
},
|
|
73
|
+
"./package.json": "./package.json"
|
|
74
|
+
},
|
|
75
|
+
"repository": {
|
|
76
|
+
"type": "git",
|
|
77
|
+
"url": "https://github.com/aws-amplify/amplify-js.git"
|
|
78
|
+
},
|
|
79
|
+
"author": "Amazon Web Services",
|
|
80
|
+
"license": "Apache-2.0",
|
|
81
|
+
"bugs": {
|
|
82
|
+
"url": "https://github.com/aws/aws-amplify/issues"
|
|
83
|
+
},
|
|
84
|
+
"homepage": "https://aws-amplify.github.io/",
|
|
85
|
+
"files": [
|
|
86
|
+
"dist/cjs",
|
|
87
|
+
"dist/esm",
|
|
88
|
+
"src",
|
|
89
|
+
"cognito",
|
|
90
|
+
"server",
|
|
91
|
+
"enable-oauth-listener"
|
|
92
|
+
],
|
|
93
|
+
"dependencies": {
|
|
94
|
+
"@aws-crypto/sha256-js": "5.2.0",
|
|
95
|
+
"@smithy/types": "^3.3.0",
|
|
96
|
+
"tslib": "^2.5.0"
|
|
97
|
+
},
|
|
98
|
+
"peerDependencies": {
|
|
99
|
+
"@aws-amplify/core": "6.13.1-unstable.76548ca.0+76548ca"
|
|
100
|
+
},
|
|
101
|
+
"devDependencies": {
|
|
102
|
+
"@aws-amplify/core": "6.13.1-unstable.76548ca.0+76548ca",
|
|
103
|
+
"@aws-amplify/react-native": "1.1.11-unstable.76548ca.0+76548ca",
|
|
104
|
+
"@jest/test-sequencer": "^29.7.0"
|
|
105
|
+
},
|
|
106
|
+
"gitHead": "76548ca51f2df7b5faac3233a1cc1d54d176b2ac"
|
|
107
107
|
}
|
|
@@ -41,7 +41,10 @@ export async function signInWithRedirect(
|
|
|
41
41
|
assertTokenProviderConfig(authConfig);
|
|
42
42
|
assertOAuthConfig(authConfig);
|
|
43
43
|
oAuthStore.setAuthConfig(authConfig);
|
|
44
|
-
|
|
44
|
+
|
|
45
|
+
if (!input?.options?.prompt) {
|
|
46
|
+
await assertUserNotAuthenticated();
|
|
47
|
+
}
|
|
45
48
|
|
|
46
49
|
let provider = 'COGNITO'; // Default
|
|
47
50
|
|
|
@@ -61,6 +64,7 @@ export async function signInWithRedirect(
|
|
|
61
64
|
loginHint: input?.options?.loginHint,
|
|
62
65
|
lang: input?.options?.lang,
|
|
63
66
|
nonce: input?.options?.nonce,
|
|
67
|
+
prompt: input?.options?.prompt,
|
|
64
68
|
},
|
|
65
69
|
});
|
|
66
70
|
}
|
|
@@ -81,7 +85,7 @@ const oauthSignIn = async ({
|
|
|
81
85
|
options?: SignInWithRedirectInput['options'];
|
|
82
86
|
}) => {
|
|
83
87
|
const { domain, redirectSignIn, responseType, scopes } = oauthConfig;
|
|
84
|
-
const { loginHint, lang, nonce } = options ?? {};
|
|
88
|
+
const { loginHint, lang, nonce, prompt } = options ?? {};
|
|
85
89
|
const randomState = generateState();
|
|
86
90
|
|
|
87
91
|
/* encodeURIComponent is not URL safe, use urlSafeEncode instead. Cognito
|
|
@@ -111,6 +115,7 @@ const oauthSignIn = async ({
|
|
|
111
115
|
...(loginHint && { login_hint: loginHint }),
|
|
112
116
|
...(lang && { lang }),
|
|
113
117
|
...(nonce && { nonce }),
|
|
118
|
+
...(prompt && { prompt: prompt.toLowerCase() }), // Cognito expects lowercase prompt values
|
|
114
119
|
state,
|
|
115
120
|
...(responseType === 'code' && {
|
|
116
121
|
code_challenge: toCodeChallenge(),
|
package/src/types/inputs.ts
CHANGED
|
@@ -54,6 +54,18 @@ export interface AuthSignOutInput {
|
|
|
54
54
|
|
|
55
55
|
export type AuthProvider = 'Amazon' | 'Apple' | 'Facebook' | 'Google';
|
|
56
56
|
|
|
57
|
+
/**
|
|
58
|
+
* OIDC prompt parameter that specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
|
|
59
|
+
*
|
|
60
|
+
* - `'NONE'` - No authentication or consent UI will be displayed
|
|
61
|
+
* - `'LOGIN'` - Force user to re-authenticate even if they have a valid session
|
|
62
|
+
* - `'CONSENT'` - Force user to consent to sharing information with the client
|
|
63
|
+
* - `'SELECT_ACCOUNT'` - Prompt user to select among multiple authenticated accounts
|
|
64
|
+
*
|
|
65
|
+
* @see https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
|
|
66
|
+
*/
|
|
67
|
+
export type AuthPrompt = 'NONE' | 'LOGIN' | 'CONSENT' | 'SELECT_ACCOUNT';
|
|
68
|
+
|
|
57
69
|
export interface AuthSignInWithRedirectInput {
|
|
58
70
|
provider?: AuthProvider | { custom: string };
|
|
59
71
|
customState?: string;
|
|
@@ -95,6 +107,12 @@ export interface AuthSignInWithRedirectInput {
|
|
|
95
107
|
* @see https://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.html
|
|
96
108
|
*/
|
|
97
109
|
nonce?: string;
|
|
110
|
+
|
|
111
|
+
/**
|
|
112
|
+
* An OIDC parameter that controls authentication behavior for existing sessions. It can be used by the Client to make sure that the End-User is still present for the current session or to bring attention to the request. Available in the managed login branding version only, not in the classic hosted UI.
|
|
113
|
+
* @see https://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.html
|
|
114
|
+
*/
|
|
115
|
+
prompt?: AuthPrompt;
|
|
98
116
|
};
|
|
99
117
|
}
|
|
100
118
|
|