@aws-amplify/auth 6.16.0 → 6.16.1-unstable.5bf5685.0

package/dist/cjs/providers/cognito/apis/signInWithRedirect.js

@@ -30,16 +30,21 @@ async function signInWithRedirect(input) {
         await (0, signInHelpers_1.assertUserNotAuthenticated)();
     }
     let provider = 'COGNITO'; // Default
+    let idpIdentifier;
     if (typeof input?.provider === 'string') {
         provider = models_1.cognitoHostedUIIdentityProviderMap[input.provider];
     }
     else if (input?.provider?.custom) {
         provider = input.provider.custom;
     }
+    else if (input?.provider?.idpIdentifier) {
+        ({ idpIdentifier } = input.provider);
+    }
     return oauthSignIn({
         oauthConfig: authConfig.loginWith.oauth,
         clientId: authConfig.userPoolClientId,
         provider,
+        idpIdentifier,
         customState: input?.customState,
         preferPrivateSession: input?.options?.preferPrivateSession,
         options: {
@@ -51,7 +56,7 @@ async function signInWithRedirect(input) {
         authSessionOpener: input?.options?.authSessionOpener,
     });
 }
-const oauthSignIn = async ({ oauthConfig, provider, clientId, customState, preferPrivateSession, options, authSessionOpener, }) => {
+const oauthSignIn = async ({ oauthConfig, provider, idpIdentifier, clientId, customState, preferPrivateSession, options, authSessionOpener, }) => {
     const { domain, redirectSignIn, responseType, scopes } = oauthConfig;
     const { loginHint, lang, nonce, prompt } = options ?? {};
     const randomState = (0, oauth_1.generateState)();
@@ -75,9 +80,15 @@ const oauthSignIn = async ({ oauthConfig, provider, clientId, customState, prefe
         ['redirect_uri', redirectUri],
         ['response_type', responseType],
         ['client_id', clientId],
-        ['identity_provider', provider],
-        ['scope', scopes.join(' ')],
     ]);
+    // Add either identity_provider or idp_identifier, but not both
+    if (idpIdentifier) {
+        params.append('idp_identifier', idpIdentifier);
+    }
+    else {
+        params.append('identity_provider', provider);
+    }
+    params.append('scope', scopes.join(' '));
     loginHint && params.append('login_hint', loginHint);
     lang && params.append('lang', lang);
     nonce && params.append('nonce', nonce);

package/dist/cjs/providers/cognito/apis/signInWithRedirect.js.map

@@ -1 +1 @@
-{"version":3,"file":"signInWithRedirect.js","sources":["../../../../../src/providers/cognito/apis/signInWithRedirect.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.signInWithRedirect = signInWithRedirect;\nconst core_1 = require(\"@aws-amplify/core\");\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nrequire(\"../utils/oauth/enableOAuthListener\");\nconst models_1 = require(\"../types/models\");\nconst utils_2 = require(\"../../../utils\");\nconst signInHelpers_1 = require(\"../utils/signInHelpers\");\nconst oauth_1 = require(\"../utils/oauth\");\nconst createOAuthError_1 = require(\"../utils/oauth/createOAuthError\");\nconst cancelOAuthFlow_1 = require(\"../utils/oauth/cancelOAuthFlow\");\n/**\n * Signs in a user with OAuth. Redirects the application to an Identity Provider.\n *\n * @param input - The SignInWithRedirectInput object, if empty it will redirect to Cognito HostedUI\n *\n * @throws AuthTokenConfigException - Thrown when the user pool config is invalid.\n * @throws OAuthNotConfigureException - Thrown when the oauth config is invalid.\n */\nasync function signInWithRedirect(input) {\n    const authConfig = core_1.Amplify.getConfig().Auth?.Cognito;\n    (0, utils_1.assertTokenProviderConfig)(authConfig);\n    (0, utils_1.assertOAuthConfig)(authConfig);\n    oauth_1.oAuthStore.setAuthConfig(authConfig);\n    if (!input?.options?.prompt) {\n        await (0, signInHelpers_1.assertUserNotAuthenticated)();\n    }\n    let provider = 'COGNITO'; // Default\n    if (typeof input?.provider === 'string') {\n        provider = models_1.cognitoHostedUIIdentityProviderMap[input.provider];\n    }\n    else if (input?.provider?.custom) {\n        provider = input.provider.custom;\n    }\n    return oauthSignIn({\n        oauthConfig: authConfig.loginWith.oauth,\n        clientId: authConfig.userPoolClientId,\n        provider,\n        customState: input?.customState,\n        preferPrivateSession: input?.options?.preferPrivateSession,\n        options: {\n            loginHint: input?.options?.loginHint,\n            lang: input?.options?.lang,\n            nonce: input?.options?.nonce,\n            prompt: input?.options?.prompt,\n        },\n        authSessionOpener: input?.options?.authSessionOpener,\n    });\n}\nconst oauthSignIn = async ({ oauthConfig, provider, clientId, customState, preferPrivateSession, options, authSessionOpener, }) => {\n    const { domain, redirectSignIn, responseType, scopes } = oauthConfig;\n    const { loginHint, lang, nonce, prompt } = options ?? {};\n    const randomState = (0, oauth_1.generateState)();\n    const openAuthSession = authSessionOpener || utils_2.openAuthSession;\n    /* encodeURIComponent is not URL safe, use urlSafeEncode instead. Cognito\n    single-encodes/decodes url on first sign in and double-encodes/decodes url\n    when user already signed in. Using encodeURIComponent, Base32, Base64 add\n    characters % or = which on further encoding becomes unsafe. '=' create issue\n    for parsing query params.\n    Refer: https://github.com/aws-amplify/amplify-js/issues/5218 */\n    const state = customState\n        ? `${randomState}-${(0, utils_1.urlSafeEncode)(customState)}`\n        : randomState;\n    const { value, method, toCodeChallenge } = (0, oauth_1.generateCodeVerifier)(128);\n    const redirectUri = (0, oauth_1.getRedirectUrl)(oauthConfig.redirectSignIn);\n    if ((0, utils_1.isBrowser)())\n        oauth_1.oAuthStore.storeOAuthInFlight(true);\n    oauth_1.oAuthStore.storeOAuthState(state);\n    oauth_1.oAuthStore.storePKCE(value);\n    const params = new URLSearchParams([\n        ['redirect_uri', redirectUri],\n        ['response_type', responseType],\n        ['client_id', clientId],\n        ['identity_provider', provider],\n        ['scope', scopes.join(' ')],\n    ]);\n    loginHint && params.append('login_hint', loginHint);\n    lang && params.append('lang', lang);\n    nonce && params.append('nonce', nonce);\n    prompt && params.append('prompt', prompt.toLowerCase());\n    params.append('state', state);\n    if (responseType === 'code') {\n        params.append('code_challenge', toCodeChallenge());\n        params.append('code_challenge_method', method);\n    }\n    // Using URL object is not supported in React Native as the `search` property is read-only\n    // See: https://github.com/facebook/react-native/blob/main/packages/react-native/Libraries/Blob/URL.js\n    const oAuthUrl = `https://${domain}/oauth2/authorize?${params.toString()}`;\n    // this will only take effect in the following scenarios:\n    // 1. the user cancels the OAuth flow on web via back button, and\n    // 2. when bfcache is enabled\n    (0, cancelOAuthFlow_1.listenForOAuthFlowCancellation)(oauth_1.oAuthStore);\n    // the following is effective only in react-native as openAuthSession resolves only in react-native\n    const { type, error, url } = (await openAuthSession(oAuthUrl, redirectSignIn, preferPrivateSession)) ??\n        {};\n    try {\n        if (type === 'error') {\n            throw (0, createOAuthError_1.createOAuthError)(String(error));\n        }\n        if (type === 'canceled') {\n            throw (0, createOAuthError_1.createOAuthError)(String(type));\n        }\n        if (type === 'success' && url) {\n            await (0, oauth_1.completeOAuthFlow)({\n                currentUrl: url,\n                clientId,\n                domain,\n                redirectUri,\n                responseType,\n                userAgentValue: (0, utils_2.getAuthUserAgentValue)(utils_1.AuthAction.SignInWithRedirect),\n                preferPrivateSession,\n            });\n        }\n    }\n    catch (err) {\n        await (0, oauth_1.handleFailure)(err);\n        // rethrow the error so it can be caught by `await signInWithRedirect()` in react-native\n        throw err;\n    }\n};\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC7D,OAAO,CAAC,kBAAkB,GAAG,kBAAkB;AAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;AAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC;AAC5D,OAAO,CAAC,oCAAoC,CAAC;AAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAC;AAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACzC,MAAM,eAAe,GAAG,OAAO,CAAC,wBAAwB,CAAC;AACzD,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACzC,MAAM,kBAAkB,GAAG,OAAO,CAAC,iCAAiC,CAAC;AACrE,MAAM,iBAAiB,GAAG,OAAO,CAAC,gCAAgC,CAAC;AACnE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,kBAAkB,CAAC,KAAK,EAAE;AACzC,IAAI,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO;AAC/D,IAAI,IAAI,OAAO,CAAC,yBAAyB,EAAE,UAAU,CAAC;AACtD,IAAI,IAAI,OAAO,CAAC,iBAAiB,EAAE,UAAU,CAAC;AAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC;AAChD,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE;AACjC,QAAQ,MAAM,IAAI,eAAe,CAAC,0BAA0B,GAAG;AAC/D,IAAI;AACJ,IAAI,IAAI,QAAQ,GAAG,SAAS,CAAC;AAC7B,IAAI,IAAI,OAAO,KAAK,EAAE,QAAQ,KAAK,QAAQ,EAAE;AAC7C,QAAQ,QAAQ,GAAG,QAAQ,CAAC,kCAAkC,CAAC,KAAK,CAAC,QAAQ,CAAC;AAC9E,IAAI;AACJ,SAAS,IAAI,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE;AACtC,QAAQ,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM;AACxC,IAAI;AACJ,IAAI,OAAO,WAAW,CAAC;AACvB,QAAQ,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK;AAC/C,QAAQ,QAAQ,EAAE,UAAU,CAAC,gBAAgB;AAC7C,QAAQ,QAAQ;AAChB,QAAQ,WAAW,EAAE,KAAK,EAAE,WAAW;AACvC,QAAQ,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB;AAClE,QAAQ,OAAO,EAAE;AACjB,YAAY,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS;AAChD,YAAY,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI;AACtC,YAAY,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AACxC,YAAY,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM;AAC1C,SAAS;AACT,QAAQ,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB;AAC5D,KAAK,CAAC;AACN;AACA,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,OAAO,EAAE,iBAAiB,GAAG,KAAK;AACnI,IAAI,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,WAAW;AACxE,IAAI,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,IAAI,EAAE;AAC5D,IAAI,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,aAAa,GAAG;AACpD,IAAI,MAAM,eAAe,GAAG,iBAAiB,IAAI,OAAO,CAAC,eAAe;AACxE;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,KAAK,GAAG;AAClB,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;AACpE,UAAU,WAAW;AACrB,IAAI,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC;AACrF,IAAI,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,cAAc,EAAE,WAAW,CAAC,cAAc,CAAC;AAC/E,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,GAAG;AAChC,QAAQ,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC;AACnD,IAAI,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC;AAC7C,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC;AACvC,IAAI,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;AACvC,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC;AACrC,QAAQ,CAAC,eAAe,EAAE,YAAY,CAAC;AACvC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC;AAC/B,QAAQ,CAAC,mBAAmB,EAAE,QAAQ,CAAC;AACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnC,KAAK,CAAC;AACN,IAAI,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC;AACvD,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;AACvC,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;AAC1C,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;AAC3D,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;AACjC,IAAI,IAAI,YAAY,KAAK,MAAM,EAAE;AACjC,QAAQ,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,eAAe,EAAE,CAAC;AAC1D,QAAQ,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC;AACtD,IAAI;AACJ;AACA;AACA,IAAI,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC9E;AACA;AACA;AACA,IAAI,IAAI,iBAAiB,CAAC,8BAA8B,EAAE,OAAO,CAAC,UAAU,CAAC;AAC7E;AACA,IAAI,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,eAAe,CAAC,QAAQ,EAAE,cAAc,EAAE,oBAAoB,CAAC;AACvG,QAAQ,EAAE;AACV,IAAI,IAAI;AACR,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE;AAC9B,YAAY,MAAM,CAAC,CAAC,EAAE,kBAAkB,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AACzE,QAAQ;AACR,QAAQ,IAAI,IAAI,KAAK,UAAU,EAAE;AACjC,YAAY,MAAM,CAAC,CAAC,EAAE,kBAAkB,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AACxE,QAAQ;AACR,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,EAAE;AACvC,YAAY,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,iBAAiB,EAAE;AACjD,gBAAgB,UAAU,EAAE,GAAG;AAC/B,gBAAgB,QAAQ;AACxB,gBAAgB,MAAM;AACtB,gBAAgB,WAAW;AAC3B,gBAAgB,YAAY;AAC5B,gBAAgB,cAAc,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,qBAAqB,EAAE,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC;AACzG,gBAAgB,oBAAoB;AACpC,aAAa,CAAC;AACd,QAAQ;AACR,IAAI;AACJ,IAAI,OAAO,GAAG,EAAE;AAChB,QAAQ,MAAM,IAAI,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;AAC7C;AACA,QAAQ,MAAM,GAAG;AACjB,IAAI;AACJ,CAAC;;"}
+{"version":3,"file":"signInWithRedirect.js","sources":["../../../../../src/providers/cognito/apis/signInWithRedirect.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.signInWithRedirect = signInWithRedirect;\nconst core_1 = require(\"@aws-amplify/core\");\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nrequire(\"../utils/oauth/enableOAuthListener\");\nconst models_1 = require(\"../types/models\");\nconst utils_2 = require(\"../../../utils\");\nconst signInHelpers_1 = require(\"../utils/signInHelpers\");\nconst oauth_1 = require(\"../utils/oauth\");\nconst createOAuthError_1 = require(\"../utils/oauth/createOAuthError\");\nconst cancelOAuthFlow_1 = require(\"../utils/oauth/cancelOAuthFlow\");\n/**\n * Signs in a user with OAuth. Redirects the application to an Identity Provider.\n *\n * @param input - The SignInWithRedirectInput object, if empty it will redirect to Cognito HostedUI\n *\n * @throws AuthTokenConfigException - Thrown when the user pool config is invalid.\n * @throws OAuthNotConfigureException - Thrown when the oauth config is invalid.\n */\nasync function signInWithRedirect(input) {\n    const authConfig = core_1.Amplify.getConfig().Auth?.Cognito;\n    (0, utils_1.assertTokenProviderConfig)(authConfig);\n    (0, utils_1.assertOAuthConfig)(authConfig);\n    oauth_1.oAuthStore.setAuthConfig(authConfig);\n    if (!input?.options?.prompt) {\n        await (0, signInHelpers_1.assertUserNotAuthenticated)();\n    }\n    let provider = 'COGNITO'; // Default\n    let idpIdentifier;\n    if (typeof input?.provider === 'string') {\n        provider = models_1.cognitoHostedUIIdentityProviderMap[input.provider];\n    }\n    else if (input?.provider?.custom) {\n        provider = input.provider.custom;\n    }\n    else if (input?.provider?.idpIdentifier) {\n        ({ idpIdentifier } = input.provider);\n    }\n    return oauthSignIn({\n        oauthConfig: authConfig.loginWith.oauth,\n        clientId: authConfig.userPoolClientId,\n        provider,\n        idpIdentifier,\n        customState: input?.customState,\n        preferPrivateSession: input?.options?.preferPrivateSession,\n        options: {\n            loginHint: input?.options?.loginHint,\n            lang: input?.options?.lang,\n            nonce: input?.options?.nonce,\n            prompt: input?.options?.prompt,\n        },\n        authSessionOpener: input?.options?.authSessionOpener,\n    });\n}\nconst oauthSignIn = async ({ oauthConfig, provider, idpIdentifier, clientId, customState, preferPrivateSession, options, authSessionOpener, }) => {\n    const { domain, redirectSignIn, responseType, scopes } = oauthConfig;\n    const { loginHint, lang, nonce, prompt } = options ?? {};\n    const randomState = (0, oauth_1.generateState)();\n    const openAuthSession = authSessionOpener || utils_2.openAuthSession;\n    /* encodeURIComponent is not URL safe, use urlSafeEncode instead. Cognito\n    single-encodes/decodes url on first sign in and double-encodes/decodes url\n    when user already signed in. Using encodeURIComponent, Base32, Base64 add\n    characters % or = which on further encoding becomes unsafe. '=' create issue\n    for parsing query params.\n    Refer: https://github.com/aws-amplify/amplify-js/issues/5218 */\n    const state = customState\n        ? `${randomState}-${(0, utils_1.urlSafeEncode)(customState)}`\n        : randomState;\n    const { value, method, toCodeChallenge } = (0, oauth_1.generateCodeVerifier)(128);\n    const redirectUri = (0, oauth_1.getRedirectUrl)(oauthConfig.redirectSignIn);\n    if ((0, utils_1.isBrowser)())\n        oauth_1.oAuthStore.storeOAuthInFlight(true);\n    oauth_1.oAuthStore.storeOAuthState(state);\n    oauth_1.oAuthStore.storePKCE(value);\n    const params = new URLSearchParams([\n        ['redirect_uri', redirectUri],\n        ['response_type', responseType],\n        ['client_id', clientId],\n    ]);\n    // Add either identity_provider or idp_identifier, but not both\n    if (idpIdentifier) {\n        params.append('idp_identifier', idpIdentifier);\n    }\n    else {\n        params.append('identity_provider', provider);\n    }\n    params.append('scope', scopes.join(' '));\n    loginHint && params.append('login_hint', loginHint);\n    lang && params.append('lang', lang);\n    nonce && params.append('nonce', nonce);\n    prompt && params.append('prompt', prompt.toLowerCase());\n    params.append('state', state);\n    if (responseType === 'code') {\n        params.append('code_challenge', toCodeChallenge());\n        params.append('code_challenge_method', method);\n    }\n    // Using URL object is not supported in React Native as the `search` property is read-only\n    // See: https://github.com/facebook/react-native/blob/main/packages/react-native/Libraries/Blob/URL.js\n    const oAuthUrl = `https://${domain}/oauth2/authorize?${params.toString()}`;\n    // this will only take effect in the following scenarios:\n    // 1. the user cancels the OAuth flow on web via back button, and\n    // 2. when bfcache is enabled\n    (0, cancelOAuthFlow_1.listenForOAuthFlowCancellation)(oauth_1.oAuthStore);\n    // the following is effective only in react-native as openAuthSession resolves only in react-native\n    const { type, error, url } = (await openAuthSession(oAuthUrl, redirectSignIn, preferPrivateSession)) ??\n        {};\n    try {\n        if (type === 'error') {\n            throw (0, createOAuthError_1.createOAuthError)(String(error));\n        }\n        if (type === 'canceled') {\n            throw (0, createOAuthError_1.createOAuthError)(String(type));\n        }\n        if (type === 'success' && url) {\n            await (0, oauth_1.completeOAuthFlow)({\n                currentUrl: url,\n                clientId,\n                domain,\n                redirectUri,\n                responseType,\n                userAgentValue: (0, utils_2.getAuthUserAgentValue)(utils_1.AuthAction.SignInWithRedirect),\n                preferPrivateSession,\n            });\n        }\n    }\n    catch (err) {\n        await (0, oauth_1.handleFailure)(err);\n        // rethrow the error so it can be caught by `await signInWithRedirect()` in react-native\n        throw err;\n    }\n};\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC7D,OAAO,CAAC,kBAAkB,GAAG,kBAAkB;AAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;AAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC;AAC5D,OAAO,CAAC,oCAAoC,CAAC;AAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAC;AAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACzC,MAAM,eAAe,GAAG,OAAO,CAAC,wBAAwB,CAAC;AACzD,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACzC,MAAM,kBAAkB,GAAG,OAAO,CAAC,iCAAiC,CAAC;AACrE,MAAM,iBAAiB,GAAG,OAAO,CAAC,gCAAgC,CAAC;AACnE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,kBAAkB,CAAC,KAAK,EAAE;AACzC,IAAI,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO;AAC/D,IAAI,IAAI,OAAO,CAAC,yBAAyB,EAAE,UAAU,CAAC;AACtD,IAAI,IAAI,OAAO,CAAC,iBAAiB,EAAE,UAAU,CAAC;AAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC;AAChD,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE;AACjC,QAAQ,MAAM,IAAI,eAAe,CAAC,0BAA0B,GAAG;AAC/D,IAAI;AACJ,IAAI,IAAI,QAAQ,GAAG,SAAS,CAAC;AAC7B,IAAI,IAAI,aAAa;AACrB,IAAI,IAAI,OAAO,KAAK,EAAE,QAAQ,KAAK,QAAQ,EAAE;AAC7C,QAAQ,QAAQ,GAAG,QAAQ,CAAC,kCAAkC,CAAC,KAAK,CAAC,QAAQ,CAAC;AAC9E,IAAI;AACJ,SAAS,IAAI,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE;AACtC,QAAQ,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM;AACxC,IAAI;AACJ,SAAS,IAAI,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE;AAC7C,QAAQ,CAAC,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC,QAAQ;AAC3C,IAAI;AACJ,IAAI,OAAO,WAAW,CAAC;AACvB,QAAQ,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK;AAC/C,QAAQ,QAAQ,EAAE,UAAU,CAAC,gBAAgB;AAC7C,QAAQ,QAAQ;AAChB,QAAQ,aAAa;AACrB,QAAQ,WAAW,EAAE,KAAK,EAAE,WAAW;AACvC,QAAQ,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB;AAClE,QAAQ,OAAO,EAAE;AACjB,YAAY,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS;AAChD,YAAY,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI;AACtC,YAAY,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AACxC,YAAY,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM;AAC1C,SAAS;AACT,QAAQ,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB;AAC5D,KAAK,CAAC;AACN;AACA,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,OAAO,EAAE,iBAAiB,GAAG,KAAK;AAClJ,IAAI,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,WAAW;AACxE,IAAI,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,IAAI,EAAE;AAC5D,IAAI,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,aAAa,GAAG;AACpD,IAAI,MAAM,eAAe,GAAG,iBAAiB,IAAI,OAAO,CAAC,eAAe;AACxE;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,KAAK,GAAG;AAClB,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;AACpE,UAAU,WAAW;AACrB,IAAI,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC;AACrF,IAAI,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,cAAc,EAAE,WAAW,CAAC,cAAc,CAAC;AAC/E,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,GAAG;AAChC,QAAQ,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC;AACnD,IAAI,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC;AAC7C,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC;AACvC,IAAI,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;AACvC,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC;AACrC,QAAQ,CAAC,eAAe,EAAE,YAAY,CAAC;AACvC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC;AAC/B,KAAK,CAAC;AACN;AACA,IAAI,IAAI,aAAa,EAAE;AACvB,QAAQ,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,aAAa,CAAC;AACtD,IAAI;AACJ,SAAS;AACT,QAAQ,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,QAAQ,CAAC;AACpD,IAAI;AACJ,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5C,IAAI,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC;AACvD,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;AACvC,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;AAC1C,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;AAC3D,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;AACjC,IAAI,IAAI,YAAY,KAAK,MAAM,EAAE;AACjC,QAAQ,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,eAAe,EAAE,CAAC;AAC1D,QAAQ,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC;AACtD,IAAI;AACJ;AACA;AACA,IAAI,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC9E;AACA;AACA;AACA,IAAI,IAAI,iBAAiB,CAAC,8BAA8B,EAAE,OAAO,CAAC,UAAU,CAAC;AAC7E;AACA,IAAI,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,eAAe,CAAC,QAAQ,EAAE,cAAc,EAAE,oBAAoB,CAAC;AACvG,QAAQ,EAAE;AACV,IAAI,IAAI;AACR,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE;AAC9B,YAAY,MAAM,CAAC,CAAC,EAAE,kBAAkB,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AACzE,QAAQ;AACR,QAAQ,IAAI,IAAI,KAAK,UAAU,EAAE;AACjC,YAAY,MAAM,CAAC,CAAC,EAAE,kBAAkB,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AACxE,QAAQ;AACR,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,EAAE;AACvC,YAAY,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,iBAAiB,EAAE;AACjD,gBAAgB,UAAU,EAAE,GAAG;AAC/B,gBAAgB,QAAQ;AACxB,gBAAgB,MAAM;AACtB,gBAAgB,WAAW;AAC3B,gBAAgB,YAAY;AAC5B,gBAAgB,cAAc,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,qBAAqB,EAAE,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC;AACzG,gBAAgB,oBAAoB;AACpC,aAAa,CAAC;AACd,QAAQ;AACR,IAAI;AACJ,IAAI,OAAO,GAAG,EAAE;AAChB,QAAQ,MAAM,IAAI,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;AAC7C;AACA,QAAQ,MAAM,GAAG;AACjB,IAAI;AACJ,CAAC;;"}

package/dist/cjs/providers/cognito/tokenProvider/CognitoUserPoolsTokenProvider.js

@@ -16,12 +16,15 @@ class CognitoUserPoolsTokenProvider {
         this.tokenOrchestrator.setAuthTokenStore(this.authTokenStore);
         this.tokenOrchestrator.setTokenRefresher(refreshAuthTokens_1.refreshAuthTokens);
     }
-    getTokens({ forceRefresh } = { forceRefresh: false }) {
-        return this.tokenOrchestrator.getTokens({ forceRefresh });
+    getTokens(options = {}) {
+        return this.tokenOrchestrator.getTokens(options);
     }
     setKeyValueStorage(keyValueStorage) {
         this.authTokenStore.setKeyValueStorage(keyValueStorage);
     }
+    setClientMetadataProvider(clientMetadataProvider) {
+        this.tokenOrchestrator.setClientMetadataProvider(clientMetadataProvider);
+    }
     setAuthConfig(authConfig) {
         this.authTokenStore.setAuthConfig(authConfig);
         this.tokenOrchestrator.setAuthConfig(authConfig);

package/dist/cjs/providers/cognito/tokenProvider/CognitoUserPoolsTokenProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"CognitoUserPoolsTokenProvider.js","sources":["../../../../../src/providers/cognito/tokenProvider/CognitoUserPoolsTokenProvider.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.CognitoUserPoolsTokenProvider = void 0;\nconst core_1 = require(\"@aws-amplify/core\");\nconst refreshAuthTokens_1 = require(\"../utils/refreshAuthTokens\");\nconst TokenStore_1 = require(\"./TokenStore\");\nconst TokenOrchestrator_1 = require(\"./TokenOrchestrator\");\nclass CognitoUserPoolsTokenProvider {\n    constructor() {\n        this.authTokenStore = new TokenStore_1.DefaultTokenStore();\n        this.authTokenStore.setKeyValueStorage(core_1.defaultStorage);\n        this.tokenOrchestrator = new TokenOrchestrator_1.TokenOrchestrator();\n        this.tokenOrchestrator.setAuthTokenStore(this.authTokenStore);\n        this.tokenOrchestrator.setTokenRefresher(refreshAuthTokens_1.refreshAuthTokens);\n    }\n    getTokens({ forceRefresh } = { forceRefresh: false }) {\n        return this.tokenOrchestrator.getTokens({ forceRefresh });\n    }\n    setKeyValueStorage(keyValueStorage) {\n        this.authTokenStore.setKeyValueStorage(keyValueStorage);\n    }\n    setAuthConfig(authConfig) {\n        this.authTokenStore.setAuthConfig(authConfig);\n        this.tokenOrchestrator.setAuthConfig(authConfig);\n    }\n}\nexports.CognitoUserPoolsTokenProvider = CognitoUserPoolsTokenProvider;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC7D,OAAO,CAAC,6BAA6B,GAAG,MAAM;AAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;AAC3C,MAAM,mBAAmB,GAAG,OAAO,CAAC,4BAA4B,CAAC;AACjE,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;AAC5C,MAAM,mBAAmB,GAAG,OAAO,CAAC,qBAAqB,CAAC;AAC1D,MAAM,6BAA6B,CAAC;AACpC,IAAI,WAAW,GAAG;AAClB,QAAQ,IAAI,CAAC,cAAc,GAAG,IAAI,YAAY,CAAC,iBAAiB,EAAE;AAClE,QAAQ,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC;AACrE,QAAQ,IAAI,CAAC,iBAAiB,GAAG,IAAI,mBAAmB,CAAC,iBAAiB,EAAE;AAC5E,QAAQ,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC;AACrE,QAAQ,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,iBAAiB,CAAC;AACvF,IAAI;AACJ,IAAI,SAAS,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE;AAC1D,QAAQ,OAAO,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;AACjE,IAAI;AACJ,IAAI,kBAAkB,CAAC,eAAe,EAAE;AACxC,QAAQ,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,eAAe,CAAC;AAC/D,IAAI;AACJ,IAAI,aAAa,CAAC,UAAU,EAAE;AAC9B,QAAQ,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,UAAU,CAAC;AACrD,QAAQ,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,UAAU,CAAC;AACxD,IAAI;AACJ;AACA,OAAO,CAAC,6BAA6B,GAAG,6BAA6B;;"}
+{"version":3,"file":"CognitoUserPoolsTokenProvider.js","sources":["../../../../../src/providers/cognito/tokenProvider/CognitoUserPoolsTokenProvider.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.CognitoUserPoolsTokenProvider = void 0;\nconst core_1 = require(\"@aws-amplify/core\");\nconst refreshAuthTokens_1 = require(\"../utils/refreshAuthTokens\");\nconst TokenStore_1 = require(\"./TokenStore\");\nconst TokenOrchestrator_1 = require(\"./TokenOrchestrator\");\nclass CognitoUserPoolsTokenProvider {\n    constructor() {\n        this.authTokenStore = new TokenStore_1.DefaultTokenStore();\n        this.authTokenStore.setKeyValueStorage(core_1.defaultStorage);\n        this.tokenOrchestrator = new TokenOrchestrator_1.TokenOrchestrator();\n        this.tokenOrchestrator.setAuthTokenStore(this.authTokenStore);\n        this.tokenOrchestrator.setTokenRefresher(refreshAuthTokens_1.refreshAuthTokens);\n    }\n    getTokens(options = {}) {\n        return this.tokenOrchestrator.getTokens(options);\n    }\n    setKeyValueStorage(keyValueStorage) {\n        this.authTokenStore.setKeyValueStorage(keyValueStorage);\n    }\n    setClientMetadataProvider(clientMetadataProvider) {\n        this.tokenOrchestrator.setClientMetadataProvider(clientMetadataProvider);\n    }\n    setAuthConfig(authConfig) {\n        this.authTokenStore.setAuthConfig(authConfig);\n        this.tokenOrchestrator.setAuthConfig(authConfig);\n    }\n}\nexports.CognitoUserPoolsTokenProvider = CognitoUserPoolsTokenProvider;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC7D,OAAO,CAAC,6BAA6B,GAAG,MAAM;AAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;AAC3C,MAAM,mBAAmB,GAAG,OAAO,CAAC,4BAA4B,CAAC;AACjE,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;AAC5C,MAAM,mBAAmB,GAAG,OAAO,CAAC,qBAAqB,CAAC;AAC1D,MAAM,6BAA6B,CAAC;AACpC,IAAI,WAAW,GAAG;AAClB,QAAQ,IAAI,CAAC,cAAc,GAAG,IAAI,YAAY,CAAC,iBAAiB,EAAE;AAClE,QAAQ,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC;AACrE,QAAQ,IAAI,CAAC,iBAAiB,GAAG,IAAI,mBAAmB,CAAC,iBAAiB,EAAE;AAC5E,QAAQ,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC;AACrE,QAAQ,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,iBAAiB,CAAC;AACvF,IAAI;AACJ,IAAI,SAAS,CAAC,OAAO,GAAG,EAAE,EAAE;AAC5B,QAAQ,OAAO,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC;AACxD,IAAI;AACJ,IAAI,kBAAkB,CAAC,eAAe,EAAE;AACxC,QAAQ,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,eAAe,CAAC;AAC/D,IAAI;AACJ,IAAI,yBAAyB,CAAC,sBAAsB,EAAE;AACtD,QAAQ,IAAI,CAAC,iBAAiB,CAAC,yBAAyB,CAAC,sBAAsB,CAAC;AAChF,IAAI;AACJ,IAAI,aAAa,CAAC,UAAU,EAAE;AAC9B,QAAQ,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,UAAU,CAAC;AACrD,QAAQ,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,UAAU,CAAC;AACxD,IAAI;AACJ;AACA,OAAO,CAAC,6BAA6B,GAAG,6BAA6B;;"}

package/dist/cjs/providers/cognito/tokenProvider/TokenOrchestrator.js

@@ -60,6 +60,9 @@ class TokenOrchestrator {
         }
         return this.tokenRefresher;
     }
+    setClientMetadataProvider(clientMetadataProvider) {
+        this.clientMetadataProvider = clientMetadataProvider;
+    }
     async getTokens(options) {
         let tokens;
         try {
@@ -89,6 +92,7 @@ class TokenOrchestrator {
             tokens = await this.refreshTokens({
                 tokens,
                 username,
+                clientMetadata: options?.clientMetadata ?? (await this.clientMetadataProvider?.()),
             });
             if (tokens === null) {
                 return null;
@@ -100,13 +104,14 @@ class TokenOrchestrator {
             signInDetails: tokens?.signInDetails,
         };
     }
-    async refreshTokens({ tokens, username, }) {
+    async refreshTokens({ tokens, username, clientMetadata, }) {
         try {
             const { signInDetails } = tokens;
             const newTokens = await this.getTokenRefresher()({
                 tokens,
                 authConfig: this.authConfig,
                 username,
+                clientMetadata,
             });
             newTokens.signInDetails = signInDetails;
             await this.setTokens({ tokens: newTokens });

package/dist/cjs/providers/cognito/tokenProvider/TokenOrchestrator.js.map

@@ -1 +1 @@
-{"version":3,"file":"TokenOrchestrator.js","sources":["../../../../../src/providers/cognito/tokenProvider/TokenOrchestrator.ts"],"sourcesContent":["\"use strict\";\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.TokenOrchestrator = void 0;\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nconst core_1 = require(\"@aws-amplify/core\");\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nconst assertServiceError_1 = require(\"../../../errors/utils/assertServiceError\");\nconst AuthError_1 = require(\"../../../errors/AuthError\");\nconst oAuthStore_1 = require(\"../utils/oauth/oAuthStore\");\nconst inflightPromise_1 = require(\"../utils/oauth/inflightPromise\");\nclass TokenOrchestrator {\n    constructor() {\n        this.waitForInflightOAuth = (0, utils_1.isBrowser)()\n            ? async () => {\n                if (!(await oAuthStore_1.oAuthStore.loadOAuthInFlight())) {\n                    return;\n                }\n                if (this.inflightPromise) {\n                    return this.inflightPromise;\n                }\n                // when there is valid oauth config and there is an inflight oauth flow, try\n                // to block async calls that require fetching tokens before the oauth flow completes\n                // e.g. getCurrentUser, fetchAuthSession etc.\n                this.inflightPromise = new Promise((resolve, _reject) => {\n                    (0, inflightPromise_1.addInflightPromise)(resolve);\n                });\n                return this.inflightPromise;\n            }\n            : async () => {\n                // no-op for non-browser environments\n            };\n    }\n    setAuthConfig(authConfig) {\n        oAuthStore_1.oAuthStore.setAuthConfig(authConfig.Cognito);\n        this.authConfig = authConfig;\n    }\n    setTokenRefresher(tokenRefresher) {\n        this.tokenRefresher = tokenRefresher;\n    }\n    setAuthTokenStore(tokenStore) {\n        this.tokenStore = tokenStore;\n    }\n    getTokenStore() {\n        if (!this.tokenStore) {\n            throw new AuthError_1.AuthError({\n                name: 'EmptyTokenStoreException',\n                message: 'TokenStore not set',\n            });\n        }\n        return this.tokenStore;\n    }\n    getTokenRefresher() {\n        if (!this.tokenRefresher) {\n            throw new AuthError_1.AuthError({\n                name: 'EmptyTokenRefresherException',\n                message: 'TokenRefresher not set',\n            });\n        }\n        return this.tokenRefresher;\n    }\n    async getTokens(options) {\n        let tokens;\n        try {\n            (0, utils_1.assertTokenProviderConfig)(this.authConfig?.Cognito);\n        }\n        catch (_err) {\n            // Token provider not configured\n            return null;\n        }\n        await this.waitForInflightOAuth();\n        this.inflightPromise = undefined;\n        tokens = await this.getTokenStore().loadTokens();\n        const username = await this.getTokenStore().getLastAuthUser();\n        if (tokens === null) {\n            return null;\n        }\n        const idTokenExpired = !!tokens?.idToken &&\n            (0, utils_1.isTokenExpired)({\n                expiresAt: (tokens.idToken?.payload?.exp ?? 0) * 1000,\n                clockDrift: tokens.clockDrift ?? 0,\n            });\n        const accessTokenExpired = (0, utils_1.isTokenExpired)({\n            expiresAt: (tokens.accessToken?.payload?.exp ?? 0) * 1000,\n            clockDrift: tokens.clockDrift ?? 0,\n        });\n        if (options?.forceRefresh || idTokenExpired || accessTokenExpired) {\n            tokens = await this.refreshTokens({\n                tokens,\n                username,\n            });\n            if (tokens === null) {\n                return null;\n            }\n        }\n        return {\n            accessToken: tokens?.accessToken,\n            idToken: tokens?.idToken,\n            signInDetails: tokens?.signInDetails,\n        };\n    }\n    async refreshTokens({ tokens, username, }) {\n        try {\n            const { signInDetails } = tokens;\n            const newTokens = await this.getTokenRefresher()({\n                tokens,\n                authConfig: this.authConfig,\n                username,\n            });\n            newTokens.signInDetails = signInDetails;\n            await this.setTokens({ tokens: newTokens });\n            core_1.Hub.dispatch('auth', { event: 'tokenRefresh' }, 'Auth', utils_1.AMPLIFY_SYMBOL);\n            return newTokens;\n        }\n        catch (err) {\n            return this.handleErrors(err);\n        }\n    }\n    handleErrors(err) {\n        (0, assertServiceError_1.assertServiceError)(err);\n        if (err.name !== utils_1.AmplifyErrorCode.NetworkError) {\n            // TODO(v6): Check errors on client\n            this.clearTokens();\n        }\n        core_1.Hub.dispatch('auth', {\n            event: 'tokenRefresh_failure',\n            data: { error: err },\n        }, 'Auth', utils_1.AMPLIFY_SYMBOL);\n        if (err.name.startsWith('NotAuthorizedException')) {\n            return null;\n        }\n        throw err;\n    }\n    async setTokens({ tokens }) {\n        return this.getTokenStore().storeTokens(tokens);\n    }\n    async clearTokens() {\n        return this.getTokenStore().clearTokens();\n    }\n    getDeviceMetadata(username) {\n        return this.getTokenStore().getDeviceMetadata(username);\n    }\n    clearDeviceMetadata(username) {\n        return this.getTokenStore().clearDeviceMetadata(username);\n    }\n    setOAuthMetadata(metadata) {\n        return this.getTokenStore().setOAuthMetadata(metadata);\n    }\n    getOAuthMetadata() {\n        return this.getTokenStore().getOAuthMetadata();\n    }\n}\nexports.TokenOrchestrator = TokenOrchestrator;\n"],"names":[],"mappings":";;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC7D,OAAO,CAAC,iBAAiB,GAAG,MAAM;AAClC;AACA;AACA,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;AAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC;AAC5D,MAAM,oBAAoB,GAAG,OAAO,CAAC,0CAA0C,CAAC;AAChF,MAAM,WAAW,GAAG,OAAO,CAAC,2BAA2B,CAAC;AACxD,MAAM,YAAY,GAAG,OAAO,CAAC,2BAA2B,CAAC;AACzD,MAAM,iBAAiB,GAAG,OAAO,CAAC,gCAAgC,CAAC;AACnE,MAAM,iBAAiB,CAAC;AACxB,IAAI,WAAW,GAAG;AAClB,QAAQ,IAAI,CAAC,oBAAoB,GAAG,IAAI,OAAO,CAAC,SAAS;AACzD,cAAc,YAAY;AAC1B,gBAAgB,IAAI,EAAE,MAAM,YAAY,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,EAAE;AAC1E,oBAAoB;AACpB,gBAAgB;AAChB,gBAAgB,IAAI,IAAI,CAAC,eAAe,EAAE;AAC1C,oBAAoB,OAAO,IAAI,CAAC,eAAe;AAC/C,gBAAgB;AAChB;AACA;AACA;AACA,gBAAgB,IAAI,CAAC,eAAe,GAAG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,OAAO,KAAK;AACzE,oBAAoB,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,OAAO,CAAC;AACtE,gBAAgB,CAAC,CAAC;AAClB,gBAAgB,OAAO,IAAI,CAAC,eAAe;AAC3C,YAAY;AACZ,cAAc,YAAY;AAC1B;AACA,YAAY,CAAC;AACb,IAAI;AACJ,IAAI,aAAa,CAAC,UAAU,EAAE;AAC9B,QAAQ,YAAY,CAAC,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC;AACjE,QAAQ,IAAI,CAAC,UAAU,GAAG,UAAU;AACpC,IAAI;AACJ,IAAI,iBAAiB,CAAC,cAAc,EAAE;AACtC,QAAQ,IAAI,CAAC,cAAc,GAAG,cAAc;AAC5C,IAAI;AACJ,IAAI,iBAAiB,CAAC,UAAU,EAAE;AAClC,QAAQ,IAAI,CAAC,UAAU,GAAG,UAAU;AACpC,IAAI;AACJ,IAAI,aAAa,GAAG;AACpB,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE;AAC9B,YAAY,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC;AAC5C,gBAAgB,IAAI,EAAE,0BAA0B;AAChD,gBAAgB,OAAO,EAAE,oBAAoB;AAC7C,aAAa,CAAC;AACd,QAAQ;AACR,QAAQ,OAAO,IAAI,CAAC,UAAU;AAC9B,IAAI;AACJ,IAAI,iBAAiB,GAAG;AACxB,QAAQ,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;AAClC,YAAY,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC;AAC5C,gBAAgB,IAAI,EAAE,8BAA8B;AACpD,gBAAgB,OAAO,EAAE,wBAAwB;AACjD,aAAa,CAAC;AACd,QAAQ;AACR,QAAQ,OAAO,IAAI,CAAC,cAAc;AAClC,IAAI;AACJ,IAAI,MAAM,SAAS,CAAC,OAAO,EAAE;AAC7B,QAAQ,IAAI,MAAM;AAClB,QAAQ,IAAI;AACZ,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,yBAAyB,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC;AAC5E,QAAQ;AACR,QAAQ,OAAO,IAAI,EAAE;AACrB;AACA,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,IAAI,CAAC,oBAAoB,EAAE;AACzC,QAAQ,IAAI,CAAC,eAAe,GAAG,SAAS;AACxC,QAAQ,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;AACxD,QAAQ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,eAAe,EAAE;AACrE,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE;AAC7B,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO;AAChD,YAAY,IAAI,OAAO,CAAC,cAAc,EAAE;AACxC,gBAAgB,SAAS,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI;AACrE,gBAAgB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC;AAClD,aAAa,CAAC;AACd,QAAQ,MAAM,kBAAkB,GAAG,IAAI,OAAO,CAAC,cAAc,EAAE;AAC/D,YAAY,SAAS,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI;AACrE,YAAY,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC;AAC9C,SAAS,CAAC;AACV,QAAQ,IAAI,OAAO,EAAE,YAAY,IAAI,cAAc,IAAI,kBAAkB,EAAE;AAC3E,YAAY,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;AAC9C,gBAAgB,MAAM;AACtB,gBAAgB,QAAQ;AACxB,aAAa,CAAC;AACd,YAAY,IAAI,MAAM,KAAK,IAAI,EAAE;AACjC,gBAAgB,OAAO,IAAI;AAC3B,YAAY;AACZ,QAAQ;AACR,QAAQ,OAAO;AACf,YAAY,WAAW,EAAE,MAAM,EAAE,WAAW;AAC5C,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO;AACpC,YAAY,aAAa,EAAE,MAAM,EAAE,aAAa;AAChD,SAAS;AACT,IAAI;AACJ,IAAI,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,EAAE;AAC/C,QAAQ,IAAI;AACZ,YAAY,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM;AAC5C,YAAY,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;AAC7D,gBAAgB,MAAM;AACtB,gBAAgB,UAAU,EAAE,IAAI,CAAC,UAAU;AAC3C,gBAAgB,QAAQ;AACxB,aAAa,CAAC;AACd,YAAY,SAAS,CAAC,aAAa,GAAG,aAAa;AACnD,YAAY,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACvD,YAAY,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC;AAClG,YAAY,OAAO,SAAS;AAC5B,QAAQ;AACR,QAAQ,OAAO,GAAG,EAAE;AACpB,YAAY,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;AACzC,QAAQ;AACR,IAAI;AACJ,IAAI,YAAY,CAAC,GAAG,EAAE;AACtB,QAAQ,IAAI,oBAAoB,CAAC,kBAAkB,EAAE,GAAG,CAAC;AACzD,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,gBAAgB,CAAC,YAAY,EAAE;AAChE;AACA,YAAY,IAAI,CAAC,WAAW,EAAE;AAC9B,QAAQ;AACR,QAAQ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE;AACpC,YAAY,KAAK,EAAE,sBAAsB;AACzC,YAAY,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;AAChC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC;AAC1C,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE;AAC3D,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,GAAG;AACjB,IAAI;AACJ,IAAI,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE;AAChC,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;AACvD,IAAI;AACJ,IAAI,MAAM,WAAW,GAAG;AACxB,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,WAAW,EAAE;AACjD,IAAI;AACJ,IAAI,iBAAiB,CAAC,QAAQ,EAAE;AAChC,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC;AAC/D,IAAI;AACJ,IAAI,mBAAmB,CAAC,QAAQ,EAAE;AAClC,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC;AACjE,IAAI;AACJ,IAAI,gBAAgB,CAAC,QAAQ,EAAE;AAC/B,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC;AAC9D,IAAI;AACJ,IAAI,gBAAgB,GAAG;AACvB,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,gBAAgB,EAAE;AACtD,IAAI;AACJ;AACA,OAAO,CAAC,iBAAiB,GAAG,iBAAiB;;"}
+{"version":3,"file":"TokenOrchestrator.js","sources":["../../../../../src/providers/cognito/tokenProvider/TokenOrchestrator.ts"],"sourcesContent":["\"use strict\";\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.TokenOrchestrator = void 0;\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nconst core_1 = require(\"@aws-amplify/core\");\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nconst assertServiceError_1 = require(\"../../../errors/utils/assertServiceError\");\nconst AuthError_1 = require(\"../../../errors/AuthError\");\nconst oAuthStore_1 = require(\"../utils/oauth/oAuthStore\");\nconst inflightPromise_1 = require(\"../utils/oauth/inflightPromise\");\nclass TokenOrchestrator {\n    constructor() {\n        this.waitForInflightOAuth = (0, utils_1.isBrowser)()\n            ? async () => {\n                if (!(await oAuthStore_1.oAuthStore.loadOAuthInFlight())) {\n                    return;\n                }\n                if (this.inflightPromise) {\n                    return this.inflightPromise;\n                }\n                // when there is valid oauth config and there is an inflight oauth flow, try\n                // to block async calls that require fetching tokens before the oauth flow completes\n                // e.g. getCurrentUser, fetchAuthSession etc.\n                this.inflightPromise = new Promise((resolve, _reject) => {\n                    (0, inflightPromise_1.addInflightPromise)(resolve);\n                });\n                return this.inflightPromise;\n            }\n            : async () => {\n                // no-op for non-browser environments\n            };\n    }\n    setAuthConfig(authConfig) {\n        oAuthStore_1.oAuthStore.setAuthConfig(authConfig.Cognito);\n        this.authConfig = authConfig;\n    }\n    setTokenRefresher(tokenRefresher) {\n        this.tokenRefresher = tokenRefresher;\n    }\n    setAuthTokenStore(tokenStore) {\n        this.tokenStore = tokenStore;\n    }\n    getTokenStore() {\n        if (!this.tokenStore) {\n            throw new AuthError_1.AuthError({\n                name: 'EmptyTokenStoreException',\n                message: 'TokenStore not set',\n            });\n        }\n        return this.tokenStore;\n    }\n    getTokenRefresher() {\n        if (!this.tokenRefresher) {\n            throw new AuthError_1.AuthError({\n                name: 'EmptyTokenRefresherException',\n                message: 'TokenRefresher not set',\n            });\n        }\n        return this.tokenRefresher;\n    }\n    setClientMetadataProvider(clientMetadataProvider) {\n        this.clientMetadataProvider = clientMetadataProvider;\n    }\n    async getTokens(options) {\n        let tokens;\n        try {\n            (0, utils_1.assertTokenProviderConfig)(this.authConfig?.Cognito);\n        }\n        catch (_err) {\n            // Token provider not configured\n            return null;\n        }\n        await this.waitForInflightOAuth();\n        this.inflightPromise = undefined;\n        tokens = await this.getTokenStore().loadTokens();\n        const username = await this.getTokenStore().getLastAuthUser();\n        if (tokens === null) {\n            return null;\n        }\n        const idTokenExpired = !!tokens?.idToken &&\n            (0, utils_1.isTokenExpired)({\n                expiresAt: (tokens.idToken?.payload?.exp ?? 0) * 1000,\n                clockDrift: tokens.clockDrift ?? 0,\n            });\n        const accessTokenExpired = (0, utils_1.isTokenExpired)({\n            expiresAt: (tokens.accessToken?.payload?.exp ?? 0) * 1000,\n            clockDrift: tokens.clockDrift ?? 0,\n        });\n        if (options?.forceRefresh || idTokenExpired || accessTokenExpired) {\n            tokens = await this.refreshTokens({\n                tokens,\n                username,\n                clientMetadata: options?.clientMetadata ?? (await this.clientMetadataProvider?.()),\n            });\n            if (tokens === null) {\n                return null;\n            }\n        }\n        return {\n            accessToken: tokens?.accessToken,\n            idToken: tokens?.idToken,\n            signInDetails: tokens?.signInDetails,\n        };\n    }\n    async refreshTokens({ tokens, username, clientMetadata, }) {\n        try {\n            const { signInDetails } = tokens;\n            const newTokens = await this.getTokenRefresher()({\n                tokens,\n                authConfig: this.authConfig,\n                username,\n                clientMetadata,\n            });\n            newTokens.signInDetails = signInDetails;\n            await this.setTokens({ tokens: newTokens });\n            core_1.Hub.dispatch('auth', { event: 'tokenRefresh' }, 'Auth', utils_1.AMPLIFY_SYMBOL);\n            return newTokens;\n        }\n        catch (err) {\n            return this.handleErrors(err);\n        }\n    }\n    handleErrors(err) {\n        (0, assertServiceError_1.assertServiceError)(err);\n        if (err.name !== utils_1.AmplifyErrorCode.NetworkError) {\n            // TODO(v6): Check errors on client\n            this.clearTokens();\n        }\n        core_1.Hub.dispatch('auth', {\n            event: 'tokenRefresh_failure',\n            data: { error: err },\n        }, 'Auth', utils_1.AMPLIFY_SYMBOL);\n        if (err.name.startsWith('NotAuthorizedException')) {\n            return null;\n        }\n        throw err;\n    }\n    async setTokens({ tokens }) {\n        return this.getTokenStore().storeTokens(tokens);\n    }\n    async clearTokens() {\n        return this.getTokenStore().clearTokens();\n    }\n    getDeviceMetadata(username) {\n        return this.getTokenStore().getDeviceMetadata(username);\n    }\n    clearDeviceMetadata(username) {\n        return this.getTokenStore().clearDeviceMetadata(username);\n    }\n    setOAuthMetadata(metadata) {\n        return this.getTokenStore().setOAuthMetadata(metadata);\n    }\n    getOAuthMetadata() {\n        return this.getTokenStore().getOAuthMetadata();\n    }\n}\nexports.TokenOrchestrator = TokenOrchestrator;\n"],"names":[],"mappings":";;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC7D,OAAO,CAAC,iBAAiB,GAAG,MAAM;AAClC;AACA;AACA,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;AAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC;AAC5D,MAAM,oBAAoB,GAAG,OAAO,CAAC,0CAA0C,CAAC;AAChF,MAAM,WAAW,GAAG,OAAO,CAAC,2BAA2B,CAAC;AACxD,MAAM,YAAY,GAAG,OAAO,CAAC,2BAA2B,CAAC;AACzD,MAAM,iBAAiB,GAAG,OAAO,CAAC,gCAAgC,CAAC;AACnE,MAAM,iBAAiB,CAAC;AACxB,IAAI,WAAW,GAAG;AAClB,QAAQ,IAAI,CAAC,oBAAoB,GAAG,IAAI,OAAO,CAAC,SAAS;AACzD,cAAc,YAAY;AAC1B,gBAAgB,IAAI,EAAE,MAAM,YAAY,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,EAAE;AAC1E,oBAAoB;AACpB,gBAAgB;AAChB,gBAAgB,IAAI,IAAI,CAAC,eAAe,EAAE;AAC1C,oBAAoB,OAAO,IAAI,CAAC,eAAe;AAC/C,gBAAgB;AAChB;AACA;AACA;AACA,gBAAgB,IAAI,CAAC,eAAe,GAAG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,OAAO,KAAK;AACzE,oBAAoB,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,OAAO,CAAC;AACtE,gBAAgB,CAAC,CAAC;AAClB,gBAAgB,OAAO,IAAI,CAAC,eAAe;AAC3C,YAAY;AACZ,cAAc,YAAY;AAC1B;AACA,YAAY,CAAC;AACb,IAAI;AACJ,IAAI,aAAa,CAAC,UAAU,EAAE;AAC9B,QAAQ,YAAY,CAAC,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC;AACjE,QAAQ,IAAI,CAAC,UAAU,GAAG,UAAU;AACpC,IAAI;AACJ,IAAI,iBAAiB,CAAC,cAAc,EAAE;AACtC,QAAQ,IAAI,CAAC,cAAc,GAAG,cAAc;AAC5C,IAAI;AACJ,IAAI,iBAAiB,CAAC,UAAU,EAAE;AAClC,QAAQ,IAAI,CAAC,UAAU,GAAG,UAAU;AACpC,IAAI;AACJ,IAAI,aAAa,GAAG;AACpB,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE;AAC9B,YAAY,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC;AAC5C,gBAAgB,IAAI,EAAE,0BAA0B;AAChD,gBAAgB,OAAO,EAAE,oBAAoB;AAC7C,aAAa,CAAC;AACd,QAAQ;AACR,QAAQ,OAAO,IAAI,CAAC,UAAU;AAC9B,IAAI;AACJ,IAAI,iBAAiB,GAAG;AACxB,QAAQ,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;AAClC,YAAY,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC;AAC5C,gBAAgB,IAAI,EAAE,8BAA8B;AACpD,gBAAgB,OAAO,EAAE,wBAAwB;AACjD,aAAa,CAAC;AACd,QAAQ;AACR,QAAQ,OAAO,IAAI,CAAC,cAAc;AAClC,IAAI;AACJ,IAAI,yBAAyB,CAAC,sBAAsB,EAAE;AACtD,QAAQ,IAAI,CAAC,sBAAsB,GAAG,sBAAsB;AAC5D,IAAI;AACJ,IAAI,MAAM,SAAS,CAAC,OAAO,EAAE;AAC7B,QAAQ,IAAI,MAAM;AAClB,QAAQ,IAAI;AACZ,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,yBAAyB,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC;AAC5E,QAAQ;AACR,QAAQ,OAAO,IAAI,EAAE;AACrB;AACA,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,IAAI,CAAC,oBAAoB,EAAE;AACzC,QAAQ,IAAI,CAAC,eAAe,GAAG,SAAS;AACxC,QAAQ,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;AACxD,QAAQ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,eAAe,EAAE;AACrE,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE;AAC7B,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO;AAChD,YAAY,IAAI,OAAO,CAAC,cAAc,EAAE;AACxC,gBAAgB,SAAS,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI;AACrE,gBAAgB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC;AAClD,aAAa,CAAC;AACd,QAAQ,MAAM,kBAAkB,GAAG,IAAI,OAAO,CAAC,cAAc,EAAE;AAC/D,YAAY,SAAS,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI;AACrE,YAAY,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC;AAC9C,SAAS,CAAC;AACV,QAAQ,IAAI,OAAO,EAAE,YAAY,IAAI,cAAc,IAAI,kBAAkB,EAAE;AAC3E,YAAY,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;AAC9C,gBAAgB,MAAM;AACtB,gBAAgB,QAAQ;AACxB,gBAAgB,cAAc,EAAE,OAAO,EAAE,cAAc,KAAK,MAAM,IAAI,CAAC,sBAAsB,IAAI,CAAC;AAClG,aAAa,CAAC;AACd,YAAY,IAAI,MAAM,KAAK,IAAI,EAAE;AACjC,gBAAgB,OAAO,IAAI;AAC3B,YAAY;AACZ,QAAQ;AACR,QAAQ,OAAO;AACf,YAAY,WAAW,EAAE,MAAM,EAAE,WAAW;AAC5C,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO;AACpC,YAAY,aAAa,EAAE,MAAM,EAAE,aAAa;AAChD,SAAS;AACT,IAAI;AACJ,IAAI,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,EAAE;AAC/D,QAAQ,IAAI;AACZ,YAAY,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM;AAC5C,YAAY,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;AAC7D,gBAAgB,MAAM;AACtB,gBAAgB,UAAU,EAAE,IAAI,CAAC,UAAU;AAC3C,gBAAgB,QAAQ;AACxB,gBAAgB,cAAc;AAC9B,aAAa,CAAC;AACd,YAAY,SAAS,CAAC,aAAa,GAAG,aAAa;AACnD,YAAY,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACvD,YAAY,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC;AAClG,YAAY,OAAO,SAAS;AAC5B,QAAQ;AACR,QAAQ,OAAO,GAAG,EAAE;AACpB,YAAY,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;AACzC,QAAQ;AACR,IAAI;AACJ,IAAI,YAAY,CAAC,GAAG,EAAE;AACtB,QAAQ,IAAI,oBAAoB,CAAC,kBAAkB,EAAE,GAAG,CAAC;AACzD,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,gBAAgB,CAAC,YAAY,EAAE;AAChE;AACA,YAAY,IAAI,CAAC,WAAW,EAAE;AAC9B,QAAQ;AACR,QAAQ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE;AACpC,YAAY,KAAK,EAAE,sBAAsB;AACzC,YAAY,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;AAChC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC;AAC1C,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE;AAC3D,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,GAAG;AACjB,IAAI;AACJ,IAAI,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE;AAChC,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;AACvD,IAAI;AACJ,IAAI,MAAM,WAAW,GAAG;AACxB,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,WAAW,EAAE;AACjD,IAAI;AACJ,IAAI,iBAAiB,CAAC,QAAQ,EAAE;AAChC,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC;AAC/D,IAAI;AACJ,IAAI,mBAAmB,CAAC,QAAQ,EAAE;AAClC,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC;AACjE,IAAI;AACJ,IAAI,gBAAgB,CAAC,QAAQ,EAAE;AAC/B,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC;AAC9D,IAAI;AACJ,IAAI,gBAAgB,GAAG;AACvB,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,gBAAgB,EAAE;AACtD,IAAI;AACJ;AACA,OAAO,CAAC,iBAAiB,GAAG,iBAAiB;;"}

package/dist/cjs/providers/cognito/utils/refreshAuthTokens.js

@@ -10,7 +10,7 @@ const types_1 = require("../utils/types");
 const AuthError_1 = require("../../../errors/AuthError");
 const factories_1 = require("../factories");
 const cognitoIdentityProvider_1 = require("../../../foundation/factories/serviceClients/cognitoIdentityProvider");
-const refreshAuthTokensFunction = async ({ tokens, authConfig, username, }) => {
+const refreshAuthTokensFunction = async ({ tokens, authConfig, username, clientMetadata, }) => {
     (0, utils_1.assertTokenProviderConfig)(authConfig?.Cognito);
     const { userPoolId, userPoolClientId, userPoolEndpoint } = authConfig.Cognito;
     const region = (0, parsers_1.getRegionFromUserPoolId)(userPoolId);
@@ -24,6 +24,7 @@ const refreshAuthTokensFunction = async ({ tokens, authConfig, username, }) => {
         ClientId: userPoolClientId,
         RefreshToken: tokens.refreshToken,
         DeviceKey: tokens.deviceMetadata?.deviceKey,
+        ClientMetadata: clientMetadata,
     });
     const accessToken = (0, utils_1.decodeJWT)(AuthenticationResult?.AccessToken ?? '');
     const idToken = AuthenticationResult?.IdToken

package/dist/cjs/providers/cognito/utils/refreshAuthTokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"refreshAuthTokens.js","sources":["../../../../../src/providers/cognito/utils/refreshAuthTokens.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.refreshAuthTokensWithoutDedupe = exports.refreshAuthTokens = void 0;\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nconst parsers_1 = require(\"../../../foundation/parsers\");\nconst types_1 = require(\"../utils/types\");\nconst AuthError_1 = require(\"../../../errors/AuthError\");\nconst factories_1 = require(\"../factories\");\nconst cognitoIdentityProvider_1 = require(\"../../../foundation/factories/serviceClients/cognitoIdentityProvider\");\nconst refreshAuthTokensFunction = async ({ tokens, authConfig, username, }) => {\n    (0, utils_1.assertTokenProviderConfig)(authConfig?.Cognito);\n    const { userPoolId, userPoolClientId, userPoolEndpoint } = authConfig.Cognito;\n    const region = (0, parsers_1.getRegionFromUserPoolId)(userPoolId);\n    (0, types_1.assertAuthTokensWithRefreshToken)(tokens);\n    const getTokensFromRefreshToken = (0, cognitoIdentityProvider_1.createGetTokensFromRefreshTokenClient)({\n        endpointResolver: (0, factories_1.createCognitoUserPoolEndpointResolver)({\n            endpointOverride: userPoolEndpoint,\n        }),\n    });\n    const { AuthenticationResult } = await getTokensFromRefreshToken({ region }, {\n        ClientId: userPoolClientId,\n        RefreshToken: tokens.refreshToken,\n        DeviceKey: tokens.deviceMetadata?.deviceKey,\n    });\n    const accessToken = (0, utils_1.decodeJWT)(AuthenticationResult?.AccessToken ?? '');\n    const idToken = AuthenticationResult?.IdToken\n        ? (0, utils_1.decodeJWT)(AuthenticationResult.IdToken)\n        : undefined;\n    const { iat } = accessToken.payload;\n    // This should never happen. If it does, it's a bug from the service.\n    if (!iat) {\n        throw new AuthError_1.AuthError({\n            name: 'iatNotFoundException',\n            message: 'iat not found in access token',\n        });\n    }\n    const clockDrift = iat * 1000 - new Date().getTime();\n    return {\n        accessToken,\n        idToken,\n        clockDrift,\n        refreshToken: AuthenticationResult?.RefreshToken ?? tokens.refreshToken,\n        username,\n    };\n};\nexports.refreshAuthTokens = (0, utils_1.deDupeAsyncFunction)(refreshAuthTokensFunction);\nexports.refreshAuthTokensWithoutDedupe = refreshAuthTokensFunction;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC7D,OAAO,CAAC,8BAA8B,GAAG,OAAO,CAAC,iBAAiB,GAAG,MAAM;AAC3E,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC;AAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,6BAA6B,CAAC;AACxD,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACzC,MAAM,WAAW,GAAG,OAAO,CAAC,2BAA2B,CAAC;AACxD,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC;AAC3C,MAAM,yBAAyB,GAAG,OAAO,CAAC,sEAAsE,CAAC;AACjH,MAAM,yBAAyB,GAAG,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,GAAG,KAAK;AAC/E,IAAI,IAAI,OAAO,CAAC,yBAAyB,EAAE,UAAU,EAAE,OAAO,CAAC;AAC/D,IAAI,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,UAAU,CAAC,OAAO;AACjF,IAAI,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,uBAAuB,EAAE,UAAU,CAAC;AACrE,IAAI,IAAI,OAAO,CAAC,gCAAgC,EAAE,MAAM,CAAC;AACzD,IAAI,MAAM,yBAAyB,GAAG,IAAI,yBAAyB,CAAC,qCAAqC,EAAE;AAC3G,QAAQ,gBAAgB,EAAE,IAAI,WAAW,CAAC,qCAAqC,EAAE;AACjF,YAAY,gBAAgB,EAAE,gBAAgB;AAC9C,SAAS,CAAC;AACV,KAAK,CAAC;AACN,IAAI,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,yBAAyB,CAAC,EAAE,MAAM,EAAE,EAAE;AACjF,QAAQ,QAAQ,EAAE,gBAAgB;AAClC,QAAQ,YAAY,EAAE,MAAM,CAAC,YAAY;AACzC,QAAQ,SAAS,EAAE,MAAM,CAAC,cAAc,EAAE,SAAS;AACnD,KAAK,CAAC;AACN,IAAI,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,SAAS,EAAE,oBAAoB,EAAE,WAAW,IAAI,EAAE,CAAC;AACvF,IAAI,MAAM,OAAO,GAAG,oBAAoB,EAAE;AAC1C,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,oBAAoB,CAAC,OAAO;AAC7D,UAAU,SAAS;AACnB,IAAI,MAAM,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO;AACvC;AACA,IAAI,IAAI,CAAC,GAAG,EAAE;AACd,QAAQ,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC;AACxC,YAAY,IAAI,EAAE,sBAAsB;AACxC,YAAY,OAAO,EAAE,+BAA+B;AACpD,SAAS,CAAC;AACV,IAAI;AACJ,IAAI,MAAM,UAAU,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE;AACxD,IAAI,OAAO;AACX,QAAQ,WAAW;AACnB,QAAQ,OAAO;AACf,QAAQ,UAAU;AAClB,QAAQ,YAAY,EAAE,oBAAoB,EAAE,YAAY,IAAI,MAAM,CAAC,YAAY;AAC/E,QAAQ,QAAQ;AAChB,KAAK;AACL,CAAC;AACD,OAAO,CAAC,iBAAiB,GAAG,IAAI,OAAO,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;AACvF,OAAO,CAAC,8BAA8B,GAAG,yBAAyB;;"}
+{"version":3,"file":"refreshAuthTokens.js","sources":["../../../../../src/providers/cognito/utils/refreshAuthTokens.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.refreshAuthTokensWithoutDedupe = exports.refreshAuthTokens = void 0;\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nconst parsers_1 = require(\"../../../foundation/parsers\");\nconst types_1 = require(\"../utils/types\");\nconst AuthError_1 = require(\"../../../errors/AuthError\");\nconst factories_1 = require(\"../factories\");\nconst cognitoIdentityProvider_1 = require(\"../../../foundation/factories/serviceClients/cognitoIdentityProvider\");\nconst refreshAuthTokensFunction = async ({ tokens, authConfig, username, clientMetadata, }) => {\n    (0, utils_1.assertTokenProviderConfig)(authConfig?.Cognito);\n    const { userPoolId, userPoolClientId, userPoolEndpoint } = authConfig.Cognito;\n    const region = (0, parsers_1.getRegionFromUserPoolId)(userPoolId);\n    (0, types_1.assertAuthTokensWithRefreshToken)(tokens);\n    const getTokensFromRefreshToken = (0, cognitoIdentityProvider_1.createGetTokensFromRefreshTokenClient)({\n        endpointResolver: (0, factories_1.createCognitoUserPoolEndpointResolver)({\n            endpointOverride: userPoolEndpoint,\n        }),\n    });\n    const { AuthenticationResult } = await getTokensFromRefreshToken({ region }, {\n        ClientId: userPoolClientId,\n        RefreshToken: tokens.refreshToken,\n        DeviceKey: tokens.deviceMetadata?.deviceKey,\n        ClientMetadata: clientMetadata,\n    });\n    const accessToken = (0, utils_1.decodeJWT)(AuthenticationResult?.AccessToken ?? '');\n    const idToken = AuthenticationResult?.IdToken\n        ? (0, utils_1.decodeJWT)(AuthenticationResult.IdToken)\n        : undefined;\n    const { iat } = accessToken.payload;\n    // This should never happen. If it does, it's a bug from the service.\n    if (!iat) {\n        throw new AuthError_1.AuthError({\n            name: 'iatNotFoundException',\n            message: 'iat not found in access token',\n        });\n    }\n    const clockDrift = iat * 1000 - new Date().getTime();\n    return {\n        accessToken,\n        idToken,\n        clockDrift,\n        refreshToken: AuthenticationResult?.RefreshToken ?? tokens.refreshToken,\n        username,\n    };\n};\nexports.refreshAuthTokens = (0, utils_1.deDupeAsyncFunction)(refreshAuthTokensFunction);\nexports.refreshAuthTokensWithoutDedupe = refreshAuthTokensFunction;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC7D,OAAO,CAAC,8BAA8B,GAAG,OAAO,CAAC,iBAAiB,GAAG,MAAM;AAC3E,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC;AAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,6BAA6B,CAAC;AACxD,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACzC,MAAM,WAAW,GAAG,OAAO,CAAC,2BAA2B,CAAC;AACxD,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC;AAC3C,MAAM,yBAAyB,GAAG,OAAO,CAAC,sEAAsE,CAAC;AACjH,MAAM,yBAAyB,GAAG,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,GAAG,KAAK;AAC/F,IAAI,IAAI,OAAO,CAAC,yBAAyB,EAAE,UAAU,EAAE,OAAO,CAAC;AAC/D,IAAI,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,UAAU,CAAC,OAAO;AACjF,IAAI,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,uBAAuB,EAAE,UAAU,CAAC;AACrE,IAAI,IAAI,OAAO,CAAC,gCAAgC,EAAE,MAAM,CAAC;AACzD,IAAI,MAAM,yBAAyB,GAAG,IAAI,yBAAyB,CAAC,qCAAqC,EAAE;AAC3G,QAAQ,gBAAgB,EAAE,IAAI,WAAW,CAAC,qCAAqC,EAAE;AACjF,YAAY,gBAAgB,EAAE,gBAAgB;AAC9C,SAAS,CAAC;AACV,KAAK,CAAC;AACN,IAAI,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,yBAAyB,CAAC,EAAE,MAAM,EAAE,EAAE;AACjF,QAAQ,QAAQ,EAAE,gBAAgB;AAClC,QAAQ,YAAY,EAAE,MAAM,CAAC,YAAY;AACzC,QAAQ,SAAS,EAAE,MAAM,CAAC,cAAc,EAAE,SAAS;AACnD,QAAQ,cAAc,EAAE,cAAc;AACtC,KAAK,CAAC;AACN,IAAI,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,SAAS,EAAE,oBAAoB,EAAE,WAAW,IAAI,EAAE,CAAC;AACvF,IAAI,MAAM,OAAO,GAAG,oBAAoB,EAAE;AAC1C,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,oBAAoB,CAAC,OAAO;AAC7D,UAAU,SAAS;AACnB,IAAI,MAAM,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO;AACvC;AACA,IAAI,IAAI,CAAC,GAAG,EAAE;AACd,QAAQ,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC;AACxC,YAAY,IAAI,EAAE,sBAAsB;AACxC,YAAY,OAAO,EAAE,+BAA+B;AACpD,SAAS,CAAC;AACV,IAAI;AACJ,IAAI,MAAM,UAAU,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE;AACxD,IAAI,OAAO;AACX,QAAQ,WAAW;AACnB,QAAQ,OAAO;AACf,QAAQ,UAAU;AAClB,QAAQ,YAAY,EAAE,oBAAoB,EAAE,YAAY,IAAI,MAAM,CAAC,YAAY;AAC/E,QAAQ,QAAQ;AAChB,KAAK;AACL,CAAC;AACD,OAAO,CAAC,iBAAiB,GAAG,IAAI,OAAO,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;AACvF,OAAO,CAAC,8BAA8B,GAAG,yBAAyB;;"}

package/dist/esm/providers/cognito/apis/signInWithRedirect.mjs

@@ -37,16 +37,21 @@ async function signInWithRedirect(input) {
         await assertUserNotAuthenticated();
     }
     let provider = 'COGNITO'; // Default
+    let idpIdentifier;
     if (typeof input?.provider === 'string') {
         provider = cognitoHostedUIIdentityProviderMap[input.provider];
     }
     else if (input?.provider?.custom) {
         provider = input.provider.custom;
     }
+    else if (input?.provider?.idpIdentifier) {
+        ({ idpIdentifier } = input.provider);
+    }
     return oauthSignIn({
         oauthConfig: authConfig.loginWith.oauth,
         clientId: authConfig.userPoolClientId,
         provider,
+        idpIdentifier,
         customState: input?.customState,
         preferPrivateSession: input?.options?.preferPrivateSession,
         options: {
@@ -58,7 +63,7 @@ async function signInWithRedirect(input) {
         authSessionOpener: input?.options?.authSessionOpener,
     });
 }
-const oauthSignIn = async ({ oauthConfig, provider, clientId, customState, preferPrivateSession, options, authSessionOpener, }) => {
+const oauthSignIn = async ({ oauthConfig, provider, idpIdentifier, clientId, customState, preferPrivateSession, options, authSessionOpener, }) => {
     const { domain, redirectSignIn, responseType, scopes } = oauthConfig;
     const { loginHint, lang, nonce, prompt } = options ?? {};
     const randomState = generateState();
@@ -82,9 +87,15 @@ const oauthSignIn = async ({ oauthConfig, provider, clientId, customState, prefe
         ['redirect_uri', redirectUri],
         ['response_type', responseType],
         ['client_id', clientId],
-        ['identity_provider', provider],
-        ['scope', scopes.join(' ')],
     ]);
+    // Add either identity_provider or idp_identifier, but not both
+    if (idpIdentifier) {
+        params.append('idp_identifier', idpIdentifier);
+    }
+    else {
+        params.append('identity_provider', provider);
+    }
+    params.append('scope', scopes.join(' '));
     loginHint && params.append('login_hint', loginHint);
     lang && params.append('lang', lang);
     nonce && params.append('nonce', nonce);

package/dist/esm/providers/cognito/apis/signInWithRedirect.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"signInWithRedirect.mjs","sources":["../../../../../src/providers/cognito/apis/signInWithRedirect.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { Amplify } from '@aws-amplify/core';\nimport { AuthAction, assertOAuthConfig, assertTokenProviderConfig, isBrowser, urlSafeEncode, } from '@aws-amplify/core/internals/utils';\nimport '../utils/oauth/enableOAuthListener';\nimport { cognitoHostedUIIdentityProviderMap } from '../types/models';\nimport { openAuthSession as _openAuthSession, getAuthUserAgentValue, } from '../../../utils';\nimport { assertUserNotAuthenticated } from '../utils/signInHelpers';\nimport { completeOAuthFlow, generateCodeVerifier, generateState, getRedirectUrl, handleFailure, oAuthStore, } from '../utils/oauth';\nimport { createOAuthError } from '../utils/oauth/createOAuthError';\nimport { listenForOAuthFlowCancellation } from '../utils/oauth/cancelOAuthFlow';\n/**\n * Signs in a user with OAuth. Redirects the application to an Identity Provider.\n *\n * @param input - The SignInWithRedirectInput object, if empty it will redirect to Cognito HostedUI\n *\n * @throws AuthTokenConfigException - Thrown when the user pool config is invalid.\n * @throws OAuthNotConfigureException - Thrown when the oauth config is invalid.\n */\nexport async function signInWithRedirect(input) {\n    const authConfig = Amplify.getConfig().Auth?.Cognito;\n    assertTokenProviderConfig(authConfig);\n    assertOAuthConfig(authConfig);\n    oAuthStore.setAuthConfig(authConfig);\n    if (!input?.options?.prompt) {\n        await assertUserNotAuthenticated();\n    }\n    let provider = 'COGNITO'; // Default\n    if (typeof input?.provider === 'string') {\n        provider = cognitoHostedUIIdentityProviderMap[input.provider];\n    }\n    else if (input?.provider?.custom) {\n        provider = input.provider.custom;\n    }\n    return oauthSignIn({\n        oauthConfig: authConfig.loginWith.oauth,\n        clientId: authConfig.userPoolClientId,\n        provider,\n        customState: input?.customState,\n        preferPrivateSession: input?.options?.preferPrivateSession,\n        options: {\n            loginHint: input?.options?.loginHint,\n            lang: input?.options?.lang,\n            nonce: input?.options?.nonce,\n            prompt: input?.options?.prompt,\n        },\n        authSessionOpener: input?.options?.authSessionOpener,\n    });\n}\nconst oauthSignIn = async ({ oauthConfig, provider, clientId, customState, preferPrivateSession, options, authSessionOpener, }) => {\n    const { domain, redirectSignIn, responseType, scopes } = oauthConfig;\n    const { loginHint, lang, nonce, prompt } = options ?? {};\n    const randomState = generateState();\n    const openAuthSession = authSessionOpener || _openAuthSession;\n    /* encodeURIComponent is not URL safe, use urlSafeEncode instead. Cognito\n    single-encodes/decodes url on first sign in and double-encodes/decodes url\n    when user already signed in. Using encodeURIComponent, Base32, Base64 add\n    characters % or = which on further encoding becomes unsafe. '=' create issue\n    for parsing query params.\n    Refer: https://github.com/aws-amplify/amplify-js/issues/5218 */\n    const state = customState\n        ? `${randomState}-${urlSafeEncode(customState)}`\n        : randomState;\n    const { value, method, toCodeChallenge } = generateCodeVerifier(128);\n    const redirectUri = getRedirectUrl(oauthConfig.redirectSignIn);\n    if (isBrowser())\n        oAuthStore.storeOAuthInFlight(true);\n    oAuthStore.storeOAuthState(state);\n    oAuthStore.storePKCE(value);\n    const params = new URLSearchParams([\n        ['redirect_uri', redirectUri],\n        ['response_type', responseType],\n        ['client_id', clientId],\n        ['identity_provider', provider],\n        ['scope', scopes.join(' ')],\n    ]);\n    loginHint && params.append('login_hint', loginHint);\n    lang && params.append('lang', lang);\n    nonce && params.append('nonce', nonce);\n    prompt && params.append('prompt', prompt.toLowerCase());\n    params.append('state', state);\n    if (responseType === 'code') {\n        params.append('code_challenge', toCodeChallenge());\n        params.append('code_challenge_method', method);\n    }\n    // Using URL object is not supported in React Native as the `search` property is read-only\n    // See: https://github.com/facebook/react-native/blob/main/packages/react-native/Libraries/Blob/URL.js\n    const oAuthUrl = `https://${domain}/oauth2/authorize?${params.toString()}`;\n    // this will only take effect in the following scenarios:\n    // 1. the user cancels the OAuth flow on web via back button, and\n    // 2. when bfcache is enabled\n    listenForOAuthFlowCancellation(oAuthStore);\n    // the following is effective only in react-native as openAuthSession resolves only in react-native\n    const { type, error, url } = (await openAuthSession(oAuthUrl, redirectSignIn, preferPrivateSession)) ??\n        {};\n    try {\n        if (type === 'error') {\n            throw createOAuthError(String(error));\n        }\n        if (type === 'canceled') {\n            throw createOAuthError(String(type));\n        }\n        if (type === 'success' && url) {\n            await completeOAuthFlow({\n                currentUrl: url,\n                clientId,\n                domain,\n                redirectUri,\n                responseType,\n                userAgentValue: getAuthUserAgentValue(AuthAction.SignInWithRedirect),\n                preferPrivateSession,\n            });\n        }\n    }\n    catch (err) {\n        await handleFailure(err);\n        // rethrow the error so it can be caught by `await signInWithRedirect()` in react-native\n        throw err;\n    }\n};\n"],"names":["openAuthSession","_openAuthSession"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AACA;AAUA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAe,kBAAkB,CAAC,KAAK,EAAE;AAChD,IAAI,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO;AACxD,IAAI,yBAAyB,CAAC,UAAU,CAAC;AACzC,IAAI,iBAAiB,CAAC,UAAU,CAAC;AACjC,IAAI,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC;AACxC,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE;AACjC,QAAQ,MAAM,0BAA0B,EAAE;AAC1C,IAAI;AACJ,IAAI,IAAI,QAAQ,GAAG,SAAS,CAAC;AAC7B,IAAI,IAAI,OAAO,KAAK,EAAE,QAAQ,KAAK,QAAQ,EAAE;AAC7C,QAAQ,QAAQ,GAAG,kCAAkC,CAAC,KAAK,CAAC,QAAQ,CAAC;AACrE,IAAI;AACJ,SAAS,IAAI,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE;AACtC,QAAQ,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM;AACxC,IAAI;AACJ,IAAI,OAAO,WAAW,CAAC;AACvB,QAAQ,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK;AAC/C,QAAQ,QAAQ,EAAE,UAAU,CAAC,gBAAgB;AAC7C,QAAQ,QAAQ;AAChB,QAAQ,WAAW,EAAE,KAAK,EAAE,WAAW;AACvC,QAAQ,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB;AAClE,QAAQ,OAAO,EAAE;AACjB,YAAY,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS;AAChD,YAAY,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI;AACtC,YAAY,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AACxC,YAAY,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM;AAC1C,SAAS;AACT,QAAQ,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB;AAC5D,KAAK,CAAC;AACN;AACA,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,OAAO,EAAE,iBAAiB,GAAG,KAAK;AACnI,IAAI,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,WAAW;AACxE,IAAI,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,IAAI,EAAE;AAC5D,IAAI,MAAM,WAAW,GAAG,aAAa,EAAE;AACvC,IAAI,MAAMA,iBAAe,GAAG,iBAAiB,IAAIC,eAAgB;AACjE;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,KAAK,GAAG;AAClB,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;AACvD,UAAU,WAAW;AACrB,IAAI,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC;AACxE,IAAI,MAAM,WAAW,GAAG,cAAc,CAAC,WAAW,CAAC,cAAc,CAAC;AAClE,IAAI,IAAI,SAAS,EAAE;AACnB,QAAQ,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC;AAC3C,IAAI,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC;AACrC,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC;AAC/B,IAAI,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;AACvC,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC;AACrC,QAAQ,CAAC,eAAe,EAAE,YAAY,CAAC;AACvC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC;AAC/B,QAAQ,CAAC,mBAAmB,EAAE,QAAQ,CAAC;AACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnC,KAAK,CAAC;AACN,IAAI,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC;AACvD,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;AACvC,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;AAC1C,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;AAC3D,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;AACjC,IAAI,IAAI,YAAY,KAAK,MAAM,EAAE;AACjC,QAAQ,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,eAAe,EAAE,CAAC;AAC1D,QAAQ,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC;AACtD,IAAI;AACJ;AACA;AACA,IAAI,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC9E;AACA;AACA;AACA,IAAI,8BAA8B,CAAC,UAAU,CAAC;AAC9C;AACA,IAAI,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,MAAMD,iBAAe,CAAC,QAAQ,EAAE,cAAc,EAAE,oBAAoB,CAAC;AACvG,QAAQ,EAAE;AACV,IAAI,IAAI;AACR,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE;AAC9B,YAAY,MAAM,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjD,QAAQ;AACR,QAAQ,IAAI,IAAI,KAAK,UAAU,EAAE;AACjC,YAAY,MAAM,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAChD,QAAQ;AACR,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,EAAE;AACvC,YAAY,MAAM,iBAAiB,CAAC;AACpC,gBAAgB,UAAU,EAAE,GAAG;AAC/B,gBAAgB,QAAQ;AACxB,gBAAgB,MAAM;AACtB,gBAAgB,WAAW;AAC3B,gBAAgB,YAAY;AAC5B,gBAAgB,cAAc,EAAE,qBAAqB,CAAC,UAAU,CAAC,kBAAkB,CAAC;AACpF,gBAAgB,oBAAoB;AACpC,aAAa,CAAC;AACd,QAAQ;AACR,IAAI;AACJ,IAAI,OAAO,GAAG,EAAE;AAChB,QAAQ,MAAM,aAAa,CAAC,GAAG,CAAC;AAChC;AACA,QAAQ,MAAM,GAAG;AACjB,IAAI;AACJ,CAAC;;;;"}
+{"version":3,"file":"signInWithRedirect.mjs","sources":["../../../../../src/providers/cognito/apis/signInWithRedirect.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { Amplify } from '@aws-amplify/core';\nimport { AuthAction, assertOAuthConfig, assertTokenProviderConfig, isBrowser, urlSafeEncode, } from '@aws-amplify/core/internals/utils';\nimport '../utils/oauth/enableOAuthListener';\nimport { cognitoHostedUIIdentityProviderMap } from '../types/models';\nimport { openAuthSession as _openAuthSession, getAuthUserAgentValue, } from '../../../utils';\nimport { assertUserNotAuthenticated } from '../utils/signInHelpers';\nimport { completeOAuthFlow, generateCodeVerifier, generateState, getRedirectUrl, handleFailure, oAuthStore, } from '../utils/oauth';\nimport { createOAuthError } from '../utils/oauth/createOAuthError';\nimport { listenForOAuthFlowCancellation } from '../utils/oauth/cancelOAuthFlow';\n/**\n * Signs in a user with OAuth. Redirects the application to an Identity Provider.\n *\n * @param input - The SignInWithRedirectInput object, if empty it will redirect to Cognito HostedUI\n *\n * @throws AuthTokenConfigException - Thrown when the user pool config is invalid.\n * @throws OAuthNotConfigureException - Thrown when the oauth config is invalid.\n */\nexport async function signInWithRedirect(input) {\n    const authConfig = Amplify.getConfig().Auth?.Cognito;\n    assertTokenProviderConfig(authConfig);\n    assertOAuthConfig(authConfig);\n    oAuthStore.setAuthConfig(authConfig);\n    if (!input?.options?.prompt) {\n        await assertUserNotAuthenticated();\n    }\n    let provider = 'COGNITO'; // Default\n    let idpIdentifier;\n    if (typeof input?.provider === 'string') {\n        provider = cognitoHostedUIIdentityProviderMap[input.provider];\n    }\n    else if (input?.provider?.custom) {\n        provider = input.provider.custom;\n    }\n    else if (input?.provider?.idpIdentifier) {\n        ({ idpIdentifier } = input.provider);\n    }\n    return oauthSignIn({\n        oauthConfig: authConfig.loginWith.oauth,\n        clientId: authConfig.userPoolClientId,\n        provider,\n        idpIdentifier,\n        customState: input?.customState,\n        preferPrivateSession: input?.options?.preferPrivateSession,\n        options: {\n            loginHint: input?.options?.loginHint,\n            lang: input?.options?.lang,\n            nonce: input?.options?.nonce,\n            prompt: input?.options?.prompt,\n        },\n        authSessionOpener: input?.options?.authSessionOpener,\n    });\n}\nconst oauthSignIn = async ({ oauthConfig, provider, idpIdentifier, clientId, customState, preferPrivateSession, options, authSessionOpener, }) => {\n    const { domain, redirectSignIn, responseType, scopes } = oauthConfig;\n    const { loginHint, lang, nonce, prompt } = options ?? {};\n    const randomState = generateState();\n    const openAuthSession = authSessionOpener || _openAuthSession;\n    /* encodeURIComponent is not URL safe, use urlSafeEncode instead. Cognito\n    single-encodes/decodes url on first sign in and double-encodes/decodes url\n    when user already signed in. Using encodeURIComponent, Base32, Base64 add\n    characters % or = which on further encoding becomes unsafe. '=' create issue\n    for parsing query params.\n    Refer: https://github.com/aws-amplify/amplify-js/issues/5218 */\n    const state = customState\n        ? `${randomState}-${urlSafeEncode(customState)}`\n        : randomState;\n    const { value, method, toCodeChallenge } = generateCodeVerifier(128);\n    const redirectUri = getRedirectUrl(oauthConfig.redirectSignIn);\n    if (isBrowser())\n        oAuthStore.storeOAuthInFlight(true);\n    oAuthStore.storeOAuthState(state);\n    oAuthStore.storePKCE(value);\n    const params = new URLSearchParams([\n        ['redirect_uri', redirectUri],\n        ['response_type', responseType],\n        ['client_id', clientId],\n    ]);\n    // Add either identity_provider or idp_identifier, but not both\n    if (idpIdentifier) {\n        params.append('idp_identifier', idpIdentifier);\n    }\n    else {\n        params.append('identity_provider', provider);\n    }\n    params.append('scope', scopes.join(' '));\n    loginHint && params.append('login_hint', loginHint);\n    lang && params.append('lang', lang);\n    nonce && params.append('nonce', nonce);\n    prompt && params.append('prompt', prompt.toLowerCase());\n    params.append('state', state);\n    if (responseType === 'code') {\n        params.append('code_challenge', toCodeChallenge());\n        params.append('code_challenge_method', method);\n    }\n    // Using URL object is not supported in React Native as the `search` property is read-only\n    // See: https://github.com/facebook/react-native/blob/main/packages/react-native/Libraries/Blob/URL.js\n    const oAuthUrl = `https://${domain}/oauth2/authorize?${params.toString()}`;\n    // this will only take effect in the following scenarios:\n    // 1. the user cancels the OAuth flow on web via back button, and\n    // 2. when bfcache is enabled\n    listenForOAuthFlowCancellation(oAuthStore);\n    // the following is effective only in react-native as openAuthSession resolves only in react-native\n    const { type, error, url } = (await openAuthSession(oAuthUrl, redirectSignIn, preferPrivateSession)) ??\n        {};\n    try {\n        if (type === 'error') {\n            throw createOAuthError(String(error));\n        }\n        if (type === 'canceled') {\n            throw createOAuthError(String(type));\n        }\n        if (type === 'success' && url) {\n            await completeOAuthFlow({\n                currentUrl: url,\n                clientId,\n                domain,\n                redirectUri,\n                responseType,\n                userAgentValue: getAuthUserAgentValue(AuthAction.SignInWithRedirect),\n                preferPrivateSession,\n            });\n        }\n    }\n    catch (err) {\n        await handleFailure(err);\n        // rethrow the error so it can be caught by `await signInWithRedirect()` in react-native\n        throw err;\n    }\n};\n"],"names":["openAuthSession","_openAuthSession"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AACA;AAUA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAe,kBAAkB,CAAC,KAAK,EAAE;AAChD,IAAI,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO;AACxD,IAAI,yBAAyB,CAAC,UAAU,CAAC;AACzC,IAAI,iBAAiB,CAAC,UAAU,CAAC;AACjC,IAAI,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC;AACxC,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE;AACjC,QAAQ,MAAM,0BAA0B,EAAE;AAC1C,IAAI;AACJ,IAAI,IAAI,QAAQ,GAAG,SAAS,CAAC;AAC7B,IAAI,IAAI,aAAa;AACrB,IAAI,IAAI,OAAO,KAAK,EAAE,QAAQ,KAAK,QAAQ,EAAE;AAC7C,QAAQ,QAAQ,GAAG,kCAAkC,CAAC,KAAK,CAAC,QAAQ,CAAC;AACrE,IAAI;AACJ,SAAS,IAAI,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE;AACtC,QAAQ,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM;AACxC,IAAI;AACJ,SAAS,IAAI,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE;AAC7C,QAAQ,CAAC,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC,QAAQ;AAC3C,IAAI;AACJ,IAAI,OAAO,WAAW,CAAC;AACvB,QAAQ,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK;AAC/C,QAAQ,QAAQ,EAAE,UAAU,CAAC,gBAAgB;AAC7C,QAAQ,QAAQ;AAChB,QAAQ,aAAa;AACrB,QAAQ,WAAW,EAAE,KAAK,EAAE,WAAW;AACvC,QAAQ,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB;AAClE,QAAQ,OAAO,EAAE;AACjB,YAAY,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS;AAChD,YAAY,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI;AACtC,YAAY,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AACxC,YAAY,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM;AAC1C,SAAS;AACT,QAAQ,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB;AAC5D,KAAK,CAAC;AACN;AACA,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,OAAO,EAAE,iBAAiB,GAAG,KAAK;AAClJ,IAAI,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,WAAW;AACxE,IAAI,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,IAAI,EAAE;AAC5D,IAAI,MAAM,WAAW,GAAG,aAAa,EAAE;AACvC,IAAI,MAAMA,iBAAe,GAAG,iBAAiB,IAAIC,eAAgB;AACjE;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,KAAK,GAAG;AAClB,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;AACvD,UAAU,WAAW;AACrB,IAAI,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC;AACxE,IAAI,MAAM,WAAW,GAAG,cAAc,CAAC,WAAW,CAAC,cAAc,CAAC;AAClE,IAAI,IAAI,SAAS,EAAE;AACnB,QAAQ,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC;AAC3C,IAAI,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC;AACrC,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC;AAC/B,IAAI,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;AACvC,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC;AACrC,QAAQ,CAAC,eAAe,EAAE,YAAY,CAAC;AACvC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC;AAC/B,KAAK,CAAC;AACN;AACA,IAAI,IAAI,aAAa,EAAE;AACvB,QAAQ,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,aAAa,CAAC;AACtD,IAAI;AACJ,SAAS;AACT,QAAQ,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,QAAQ,CAAC;AACpD,IAAI;AACJ,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5C,IAAI,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC;AACvD,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;AACvC,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;AAC1C,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;AAC3D,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;AACjC,IAAI,IAAI,YAAY,KAAK,MAAM,EAAE;AACjC,QAAQ,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,eAAe,EAAE,CAAC;AAC1D,QAAQ,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC;AACtD,IAAI;AACJ;AACA;AACA,IAAI,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC9E;AACA;AACA;AACA,IAAI,8BAA8B,CAAC,UAAU,CAAC;AAC9C;AACA,IAAI,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,MAAMD,iBAAe,CAAC,QAAQ,EAAE,cAAc,EAAE,oBAAoB,CAAC;AACvG,QAAQ,EAAE;AACV,IAAI,IAAI;AACR,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE;AAC9B,YAAY,MAAM,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjD,QAAQ;AACR,QAAQ,IAAI,IAAI,KAAK,UAAU,EAAE;AACjC,YAAY,MAAM,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAChD,QAAQ;AACR,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,EAAE;AACvC,YAAY,MAAM,iBAAiB,CAAC;AACpC,gBAAgB,UAAU,EAAE,GAAG;AAC/B,gBAAgB,QAAQ;AACxB,gBAAgB,MAAM;AACtB,gBAAgB,WAAW;AAC3B,gBAAgB,YAAY;AAC5B,gBAAgB,cAAc,EAAE,qBAAqB,CAAC,UAAU,CAAC,kBAAkB,CAAC;AACpF,gBAAgB,oBAAoB;AACpC,aAAa,CAAC;AACd,QAAQ;AACR,IAAI;AACJ,IAAI,OAAO,GAAG,EAAE;AAChB,QAAQ,MAAM,aAAa,CAAC,GAAG,CAAC;AAChC;AACA,QAAQ,MAAM,GAAG;AACjB,IAAI;AACJ,CAAC;;;;"}

package/dist/esm/providers/cognito/tokenProvider/CognitoUserPoolsTokenProvider.d.ts

@@ -1,4 +1,4 @@
-import { AuthConfig, AuthTokens, FetchAuthSessionOptions, KeyValueStorageInterface } from '@aws-amplify/core';
+import { AuthConfig, AuthTokens, ClientMetadataProvider, FetchAuthSessionOptions, KeyValueStorageInterface } from '@aws-amplify/core';
 import { DefaultTokenStore } from './TokenStore';
 import { TokenOrchestrator } from './TokenOrchestrator';
 import { CognitoUserPoolTokenProviderType } from './types';
@@ -6,7 +6,8 @@ export declare class CognitoUserPoolsTokenProvider implements CognitoUserPoolTok
     authTokenStore: DefaultTokenStore;
     tokenOrchestrator: TokenOrchestrator;
     constructor();
-    getTokens({ forceRefresh }?: FetchAuthSessionOptions): Promise<AuthTokens | null>;
+    getTokens(options?: FetchAuthSessionOptions): Promise<AuthTokens | null>;
     setKeyValueStorage(keyValueStorage: KeyValueStorageInterface): void;
+    setClientMetadataProvider(clientMetadataProvider: ClientMetadataProvider): void;
     setAuthConfig(authConfig: AuthConfig): void;
 }

package/dist/esm/providers/cognito/tokenProvider/CognitoUserPoolsTokenProvider.mjs

@@ -13,12 +13,15 @@ class CognitoUserPoolsTokenProvider {
         this.tokenOrchestrator.setAuthTokenStore(this.authTokenStore);
         this.tokenOrchestrator.setTokenRefresher(refreshAuthTokens);
     }
-    getTokens({ forceRefresh } = { forceRefresh: false }) {
-        return this.tokenOrchestrator.getTokens({ forceRefresh });
+    getTokens(options = {}) {
+        return this.tokenOrchestrator.getTokens(options);
     }
     setKeyValueStorage(keyValueStorage) {
         this.authTokenStore.setKeyValueStorage(keyValueStorage);
     }
+    setClientMetadataProvider(clientMetadataProvider) {
+        this.tokenOrchestrator.setClientMetadataProvider(clientMetadataProvider);
+    }
     setAuthConfig(authConfig) {
         this.authTokenStore.setAuthConfig(authConfig);
         this.tokenOrchestrator.setAuthConfig(authConfig);

package/dist/esm/providers/cognito/tokenProvider/CognitoUserPoolsTokenProvider.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"CognitoUserPoolsTokenProvider.mjs","sources":["../../../../../src/providers/cognito/tokenProvider/CognitoUserPoolsTokenProvider.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { defaultStorage, } from '@aws-amplify/core';\nimport { refreshAuthTokens } from '../utils/refreshAuthTokens';\nimport { DefaultTokenStore } from './TokenStore';\nimport { TokenOrchestrator } from './TokenOrchestrator';\nexport class CognitoUserPoolsTokenProvider {\n    constructor() {\n        this.authTokenStore = new DefaultTokenStore();\n        this.authTokenStore.setKeyValueStorage(defaultStorage);\n        this.tokenOrchestrator = new TokenOrchestrator();\n        this.tokenOrchestrator.setAuthTokenStore(this.authTokenStore);\n        this.tokenOrchestrator.setTokenRefresher(refreshAuthTokens);\n    }\n    getTokens({ forceRefresh } = { forceRefresh: false }) {\n        return this.tokenOrchestrator.getTokens({ forceRefresh });\n    }\n    setKeyValueStorage(keyValueStorage) {\n        this.authTokenStore.setKeyValueStorage(keyValueStorage);\n    }\n    setAuthConfig(authConfig) {\n        this.authTokenStore.setAuthConfig(authConfig);\n        this.tokenOrchestrator.setAuthConfig(authConfig);\n    }\n}\n"],"names":[],"mappings":";;;;;AAAA;AACA;AAKO,MAAM,6BAA6B,CAAC;AAC3C,IAAI,WAAW,GAAG;AAClB,QAAQ,IAAI,CAAC,cAAc,GAAG,IAAI,iBAAiB,EAAE;AACrD,QAAQ,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,cAAc,CAAC;AAC9D,QAAQ,IAAI,CAAC,iBAAiB,GAAG,IAAI,iBAAiB,EAAE;AACxD,QAAQ,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC;AACrE,QAAQ,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;AACnE,IAAI;AACJ,IAAI,SAAS,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE;AAC1D,QAAQ,OAAO,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;AACjE,IAAI;AACJ,IAAI,kBAAkB,CAAC,eAAe,EAAE;AACxC,QAAQ,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,eAAe,CAAC;AAC/D,IAAI;AACJ,IAAI,aAAa,CAAC,UAAU,EAAE;AAC9B,QAAQ,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,UAAU,CAAC;AACrD,QAAQ,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,UAAU,CAAC;AACxD,IAAI;AACJ;;;;"}
+{"version":3,"file":"CognitoUserPoolsTokenProvider.mjs","sources":["../../../../../src/providers/cognito/tokenProvider/CognitoUserPoolsTokenProvider.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { defaultStorage, } from '@aws-amplify/core';\nimport { refreshAuthTokens } from '../utils/refreshAuthTokens';\nimport { DefaultTokenStore } from './TokenStore';\nimport { TokenOrchestrator } from './TokenOrchestrator';\nexport class CognitoUserPoolsTokenProvider {\n    constructor() {\n        this.authTokenStore = new DefaultTokenStore();\n        this.authTokenStore.setKeyValueStorage(defaultStorage);\n        this.tokenOrchestrator = new TokenOrchestrator();\n        this.tokenOrchestrator.setAuthTokenStore(this.authTokenStore);\n        this.tokenOrchestrator.setTokenRefresher(refreshAuthTokens);\n    }\n    getTokens(options = {}) {\n        return this.tokenOrchestrator.getTokens(options);\n    }\n    setKeyValueStorage(keyValueStorage) {\n        this.authTokenStore.setKeyValueStorage(keyValueStorage);\n    }\n    setClientMetadataProvider(clientMetadataProvider) {\n        this.tokenOrchestrator.setClientMetadataProvider(clientMetadataProvider);\n    }\n    setAuthConfig(authConfig) {\n        this.authTokenStore.setAuthConfig(authConfig);\n        this.tokenOrchestrator.setAuthConfig(authConfig);\n    }\n}\n"],"names":[],"mappings":";;;;;AAAA;AACA;AAKO,MAAM,6BAA6B,CAAC;AAC3C,IAAI,WAAW,GAAG;AAClB,QAAQ,IAAI,CAAC,cAAc,GAAG,IAAI,iBAAiB,EAAE;AACrD,QAAQ,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,cAAc,CAAC;AAC9D,QAAQ,IAAI,CAAC,iBAAiB,GAAG,IAAI,iBAAiB,EAAE;AACxD,QAAQ,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC;AACrE,QAAQ,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;AACnE,IAAI;AACJ,IAAI,SAAS,CAAC,OAAO,GAAG,EAAE,EAAE;AAC5B,QAAQ,OAAO,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC;AACxD,IAAI;AACJ,IAAI,kBAAkB,CAAC,eAAe,EAAE;AACxC,QAAQ,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,eAAe,CAAC;AAC/D,IAAI;AACJ,IAAI,yBAAyB,CAAC,sBAAsB,EAAE;AACtD,QAAQ,IAAI,CAAC,iBAAiB,CAAC,yBAAyB,CAAC,sBAAsB,CAAC;AAChF,IAAI;AACJ,IAAI,aAAa,CAAC,UAAU,EAAE;AAC9B,QAAQ,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,UAAU,CAAC;AACrD,QAAQ,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,UAAU,CAAC;AACxD,IAAI;AACJ;;;;"}

package/dist/esm/providers/cognito/tokenProvider/TokenOrchestrator.d.ts

@@ -1,8 +1,9 @@
-import { AuthConfig, AuthTokens, FetchAuthSessionOptions } from '@aws-amplify/core';
+import { AuthConfig, AuthTokens, ClientMetadataProvider, FetchAuthSessionOptions } from '@aws-amplify/core';
 import { CognitoAuthSignInDetails } from '../types';
 import { AuthTokenOrchestrator, AuthTokenStore, CognitoAuthTokens, DeviceMetadata, OAuthMetadata, TokenRefresher } from './types';
 export declare class TokenOrchestrator implements AuthTokenOrchestrator {
     private authConfig?;
+    clientMetadataProvider?: ClientMetadataProvider;
     tokenStore?: AuthTokenStore;
     tokenRefresher?: TokenRefresher;
     inflightPromise: Promise<void> | undefined;
@@ -12,6 +13,7 @@ export declare class TokenOrchestrator implements AuthTokenOrchestrator {
     setAuthTokenStore(tokenStore: AuthTokenStore): void;
     getTokenStore(): AuthTokenStore;
     getTokenRefresher(): TokenRefresher;
+    setClientMetadataProvider(clientMetadataProvider: ClientMetadataProvider): void;
     getTokens(options?: FetchAuthSessionOptions): Promise<(AuthTokens & {
         signInDetails?: CognitoAuthSignInDetails;
     }) | null>;

package/dist/esm/providers/cognito/tokenProvider/TokenOrchestrator.mjs

@@ -57,6 +57,9 @@ class TokenOrchestrator {
         }
         return this.tokenRefresher;
     }
+    setClientMetadataProvider(clientMetadataProvider) {
+        this.clientMetadataProvider = clientMetadataProvider;
+    }
     async getTokens(options) {
         let tokens;
         try {
@@ -86,6 +89,7 @@ class TokenOrchestrator {
             tokens = await this.refreshTokens({
                 tokens,
                 username,
+                clientMetadata: options?.clientMetadata ?? (await this.clientMetadataProvider?.()),
             });
             if (tokens === null) {
                 return null;
@@ -97,13 +101,14 @@ class TokenOrchestrator {
             signInDetails: tokens?.signInDetails,
         };
     }
-    async refreshTokens({ tokens, username, }) {
+    async refreshTokens({ tokens, username, clientMetadata, }) {
         try {
             const { signInDetails } = tokens;
             const newTokens = await this.getTokenRefresher()({
                 tokens,
                 authConfig: this.authConfig,
                 username,
+                clientMetadata,
             });
             newTokens.signInDetails = signInDetails;
             await this.setTokens({ tokens: newTokens });

package/dist/esm/providers/cognito/tokenProvider/TokenOrchestrator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"TokenOrchestrator.mjs","sources":["../../../../../src/providers/cognito/tokenProvider/TokenOrchestrator.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { Hub, } from '@aws-amplify/core';\nimport { AMPLIFY_SYMBOL, AmplifyErrorCode, assertTokenProviderConfig, isBrowser, isTokenExpired, } from '@aws-amplify/core/internals/utils';\nimport { assertServiceError } from '../../../errors/utils/assertServiceError';\nimport { AuthError } from '../../../errors/AuthError';\nimport { oAuthStore } from '../utils/oauth/oAuthStore';\nimport { addInflightPromise } from '../utils/oauth/inflightPromise';\nexport class TokenOrchestrator {\n    constructor() {\n        this.waitForInflightOAuth = isBrowser()\n            ? async () => {\n                if (!(await oAuthStore.loadOAuthInFlight())) {\n                    return;\n                }\n                if (this.inflightPromise) {\n                    return this.inflightPromise;\n                }\n                // when there is valid oauth config and there is an inflight oauth flow, try\n                // to block async calls that require fetching tokens before the oauth flow completes\n                // e.g. getCurrentUser, fetchAuthSession etc.\n                this.inflightPromise = new Promise((resolve, _reject) => {\n                    addInflightPromise(resolve);\n                });\n                return this.inflightPromise;\n            }\n            : async () => {\n                // no-op for non-browser environments\n            };\n    }\n    setAuthConfig(authConfig) {\n        oAuthStore.setAuthConfig(authConfig.Cognito);\n        this.authConfig = authConfig;\n    }\n    setTokenRefresher(tokenRefresher) {\n        this.tokenRefresher = tokenRefresher;\n    }\n    setAuthTokenStore(tokenStore) {\n        this.tokenStore = tokenStore;\n    }\n    getTokenStore() {\n        if (!this.tokenStore) {\n            throw new AuthError({\n                name: 'EmptyTokenStoreException',\n                message: 'TokenStore not set',\n            });\n        }\n        return this.tokenStore;\n    }\n    getTokenRefresher() {\n        if (!this.tokenRefresher) {\n            throw new AuthError({\n                name: 'EmptyTokenRefresherException',\n                message: 'TokenRefresher not set',\n            });\n        }\n        return this.tokenRefresher;\n    }\n    async getTokens(options) {\n        let tokens;\n        try {\n            assertTokenProviderConfig(this.authConfig?.Cognito);\n        }\n        catch (_err) {\n            // Token provider not configured\n            return null;\n        }\n        await this.waitForInflightOAuth();\n        this.inflightPromise = undefined;\n        tokens = await this.getTokenStore().loadTokens();\n        const username = await this.getTokenStore().getLastAuthUser();\n        if (tokens === null) {\n            return null;\n        }\n        const idTokenExpired = !!tokens?.idToken &&\n            isTokenExpired({\n                expiresAt: (tokens.idToken?.payload?.exp ?? 0) * 1000,\n                clockDrift: tokens.clockDrift ?? 0,\n            });\n        const accessTokenExpired = isTokenExpired({\n            expiresAt: (tokens.accessToken?.payload?.exp ?? 0) * 1000,\n            clockDrift: tokens.clockDrift ?? 0,\n        });\n        if (options?.forceRefresh || idTokenExpired || accessTokenExpired) {\n            tokens = await this.refreshTokens({\n                tokens,\n                username,\n            });\n            if (tokens === null) {\n                return null;\n            }\n        }\n        return {\n            accessToken: tokens?.accessToken,\n            idToken: tokens?.idToken,\n            signInDetails: tokens?.signInDetails,\n        };\n    }\n    async refreshTokens({ tokens, username, }) {\n        try {\n            const { signInDetails } = tokens;\n            const newTokens = await this.getTokenRefresher()({\n                tokens,\n                authConfig: this.authConfig,\n                username,\n            });\n            newTokens.signInDetails = signInDetails;\n            await this.setTokens({ tokens: newTokens });\n            Hub.dispatch('auth', { event: 'tokenRefresh' }, 'Auth', AMPLIFY_SYMBOL);\n            return newTokens;\n        }\n        catch (err) {\n            return this.handleErrors(err);\n        }\n    }\n    handleErrors(err) {\n        assertServiceError(err);\n        if (err.name !== AmplifyErrorCode.NetworkError) {\n            // TODO(v6): Check errors on client\n            this.clearTokens();\n        }\n        Hub.dispatch('auth', {\n            event: 'tokenRefresh_failure',\n            data: { error: err },\n        }, 'Auth', AMPLIFY_SYMBOL);\n        if (err.name.startsWith('NotAuthorizedException')) {\n            return null;\n        }\n        throw err;\n    }\n    async setTokens({ tokens }) {\n        return this.getTokenStore().storeTokens(tokens);\n    }\n    async clearTokens() {\n        return this.getTokenStore().clearTokens();\n    }\n    getDeviceMetadata(username) {\n        return this.getTokenStore().getDeviceMetadata(username);\n    }\n    clearDeviceMetadata(username) {\n        return this.getTokenStore().clearDeviceMetadata(username);\n    }\n    setOAuthMetadata(metadata) {\n        return this.getTokenStore().setOAuthMetadata(metadata);\n    }\n    getOAuthMetadata() {\n        return this.getTokenStore().getOAuthMetadata();\n    }\n}\n"],"names":[],"mappings":";;;;;;;AAAA;AACA;AAOO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,WAAW,GAAG;AAClB,QAAQ,IAAI,CAAC,oBAAoB,GAAG,SAAS;AAC7C,cAAc,YAAY;AAC1B,gBAAgB,IAAI,EAAE,MAAM,UAAU,CAAC,iBAAiB,EAAE,CAAC,EAAE;AAC7D,oBAAoB;AACpB,gBAAgB;AAChB,gBAAgB,IAAI,IAAI,CAAC,eAAe,EAAE;AAC1C,oBAAoB,OAAO,IAAI,CAAC,eAAe;AAC/C,gBAAgB;AAChB;AACA;AACA;AACA,gBAAgB,IAAI,CAAC,eAAe,GAAG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,OAAO,KAAK;AACzE,oBAAoB,kBAAkB,CAAC,OAAO,CAAC;AAC/C,gBAAgB,CAAC,CAAC;AAClB,gBAAgB,OAAO,IAAI,CAAC,eAAe;AAC3C,YAAY;AACZ,cAAc,YAAY;AAC1B;AACA,YAAY,CAAC;AACb,IAAI;AACJ,IAAI,aAAa,CAAC,UAAU,EAAE;AAC9B,QAAQ,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC;AACpD,QAAQ,IAAI,CAAC,UAAU,GAAG,UAAU;AACpC,IAAI;AACJ,IAAI,iBAAiB,CAAC,cAAc,EAAE;AACtC,QAAQ,IAAI,CAAC,cAAc,GAAG,cAAc;AAC5C,IAAI;AACJ,IAAI,iBAAiB,CAAC,UAAU,EAAE;AAClC,QAAQ,IAAI,CAAC,UAAU,GAAG,UAAU;AACpC,IAAI;AACJ,IAAI,aAAa,GAAG;AACpB,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE;AAC9B,YAAY,MAAM,IAAI,SAAS,CAAC;AAChC,gBAAgB,IAAI,EAAE,0BAA0B;AAChD,gBAAgB,OAAO,EAAE,oBAAoB;AAC7C,aAAa,CAAC;AACd,QAAQ;AACR,QAAQ,OAAO,IAAI,CAAC,UAAU;AAC9B,IAAI;AACJ,IAAI,iBAAiB,GAAG;AACxB,QAAQ,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;AAClC,YAAY,MAAM,IAAI,SAAS,CAAC;AAChC,gBAAgB,IAAI,EAAE,8BAA8B;AACpD,gBAAgB,OAAO,EAAE,wBAAwB;AACjD,aAAa,CAAC;AACd,QAAQ;AACR,QAAQ,OAAO,IAAI,CAAC,cAAc;AAClC,IAAI;AACJ,IAAI,MAAM,SAAS,CAAC,OAAO,EAAE;AAC7B,QAAQ,IAAI,MAAM;AAClB,QAAQ,IAAI;AACZ,YAAY,yBAAyB,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC;AAC/D,QAAQ;AACR,QAAQ,OAAO,IAAI,EAAE;AACrB;AACA,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,IAAI,CAAC,oBAAoB,EAAE;AACzC,QAAQ,IAAI,CAAC,eAAe,GAAG,SAAS;AACxC,QAAQ,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;AACxD,QAAQ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,eAAe,EAAE;AACrE,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE;AAC7B,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO;AAChD,YAAY,cAAc,CAAC;AAC3B,gBAAgB,SAAS,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI;AACrE,gBAAgB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC;AAClD,aAAa,CAAC;AACd,QAAQ,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAClD,YAAY,SAAS,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI;AACrE,YAAY,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC;AAC9C,SAAS,CAAC;AACV,QAAQ,IAAI,OAAO,EAAE,YAAY,IAAI,cAAc,IAAI,kBAAkB,EAAE;AAC3E,YAAY,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;AAC9C,gBAAgB,MAAM;AACtB,gBAAgB,QAAQ;AACxB,aAAa,CAAC;AACd,YAAY,IAAI,MAAM,KAAK,IAAI,EAAE;AACjC,gBAAgB,OAAO,IAAI;AAC3B,YAAY;AACZ,QAAQ;AACR,QAAQ,OAAO;AACf,YAAY,WAAW,EAAE,MAAM,EAAE,WAAW;AAC5C,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO;AACpC,YAAY,aAAa,EAAE,MAAM,EAAE,aAAa;AAChD,SAAS;AACT,IAAI;AACJ,IAAI,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,EAAE;AAC/C,QAAQ,IAAI;AACZ,YAAY,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM;AAC5C,YAAY,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;AAC7D,gBAAgB,MAAM;AACtB,gBAAgB,UAAU,EAAE,IAAI,CAAC,UAAU;AAC3C,gBAAgB,QAAQ;AACxB,aAAa,CAAC;AACd,YAAY,SAAS,CAAC,aAAa,GAAG,aAAa;AACnD,YAAY,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACvD,YAAY,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC;AACnF,YAAY,OAAO,SAAS;AAC5B,QAAQ;AACR,QAAQ,OAAO,GAAG,EAAE;AACpB,YAAY,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;AACzC,QAAQ;AACR,IAAI;AACJ,IAAI,YAAY,CAAC,GAAG,EAAE;AACtB,QAAQ,kBAAkB,CAAC,GAAG,CAAC;AAC/B,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,CAAC,YAAY,EAAE;AACxD;AACA,YAAY,IAAI,CAAC,WAAW,EAAE;AAC9B,QAAQ;AACR,QAAQ,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE;AAC7B,YAAY,KAAK,EAAE,sBAAsB;AACzC,YAAY,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;AAChC,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC;AAClC,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE;AAC3D,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,GAAG;AACjB,IAAI;AACJ,IAAI,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE;AAChC,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;AACvD,IAAI;AACJ,IAAI,MAAM,WAAW,GAAG;AACxB,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,WAAW,EAAE;AACjD,IAAI;AACJ,IAAI,iBAAiB,CAAC,QAAQ,EAAE;AAChC,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC;AAC/D,IAAI;AACJ,IAAI,mBAAmB,CAAC,QAAQ,EAAE;AAClC,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC;AACjE,IAAI;AACJ,IAAI,gBAAgB,CAAC,QAAQ,EAAE;AAC/B,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC;AAC9D,IAAI;AACJ,IAAI,gBAAgB,GAAG;AACvB,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,gBAAgB,EAAE;AACtD,IAAI;AACJ;;;;"}
+{"version":3,"file":"TokenOrchestrator.mjs","sources":["../../../../../src/providers/cognito/tokenProvider/TokenOrchestrator.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { Hub, } from '@aws-amplify/core';\nimport { AMPLIFY_SYMBOL, AmplifyErrorCode, assertTokenProviderConfig, isBrowser, isTokenExpired, } from '@aws-amplify/core/internals/utils';\nimport { assertServiceError } from '../../../errors/utils/assertServiceError';\nimport { AuthError } from '../../../errors/AuthError';\nimport { oAuthStore } from '../utils/oauth/oAuthStore';\nimport { addInflightPromise } from '../utils/oauth/inflightPromise';\nexport class TokenOrchestrator {\n    constructor() {\n        this.waitForInflightOAuth = isBrowser()\n            ? async () => {\n                if (!(await oAuthStore.loadOAuthInFlight())) {\n                    return;\n                }\n                if (this.inflightPromise) {\n                    return this.inflightPromise;\n                }\n                // when there is valid oauth config and there is an inflight oauth flow, try\n                // to block async calls that require fetching tokens before the oauth flow completes\n                // e.g. getCurrentUser, fetchAuthSession etc.\n                this.inflightPromise = new Promise((resolve, _reject) => {\n                    addInflightPromise(resolve);\n                });\n                return this.inflightPromise;\n            }\n            : async () => {\n                // no-op for non-browser environments\n            };\n    }\n    setAuthConfig(authConfig) {\n        oAuthStore.setAuthConfig(authConfig.Cognito);\n        this.authConfig = authConfig;\n    }\n    setTokenRefresher(tokenRefresher) {\n        this.tokenRefresher = tokenRefresher;\n    }\n    setAuthTokenStore(tokenStore) {\n        this.tokenStore = tokenStore;\n    }\n    getTokenStore() {\n        if (!this.tokenStore) {\n            throw new AuthError({\n                name: 'EmptyTokenStoreException',\n                message: 'TokenStore not set',\n            });\n        }\n        return this.tokenStore;\n    }\n    getTokenRefresher() {\n        if (!this.tokenRefresher) {\n            throw new AuthError({\n                name: 'EmptyTokenRefresherException',\n                message: 'TokenRefresher not set',\n            });\n        }\n        return this.tokenRefresher;\n    }\n    setClientMetadataProvider(clientMetadataProvider) {\n        this.clientMetadataProvider = clientMetadataProvider;\n    }\n    async getTokens(options) {\n        let tokens;\n        try {\n            assertTokenProviderConfig(this.authConfig?.Cognito);\n        }\n        catch (_err) {\n            // Token provider not configured\n            return null;\n        }\n        await this.waitForInflightOAuth();\n        this.inflightPromise = undefined;\n        tokens = await this.getTokenStore().loadTokens();\n        const username = await this.getTokenStore().getLastAuthUser();\n        if (tokens === null) {\n            return null;\n        }\n        const idTokenExpired = !!tokens?.idToken &&\n            isTokenExpired({\n                expiresAt: (tokens.idToken?.payload?.exp ?? 0) * 1000,\n                clockDrift: tokens.clockDrift ?? 0,\n            });\n        const accessTokenExpired = isTokenExpired({\n            expiresAt: (tokens.accessToken?.payload?.exp ?? 0) * 1000,\n            clockDrift: tokens.clockDrift ?? 0,\n        });\n        if (options?.forceRefresh || idTokenExpired || accessTokenExpired) {\n            tokens = await this.refreshTokens({\n                tokens,\n                username,\n                clientMetadata: options?.clientMetadata ?? (await this.clientMetadataProvider?.()),\n            });\n            if (tokens === null) {\n                return null;\n            }\n        }\n        return {\n            accessToken: tokens?.accessToken,\n            idToken: tokens?.idToken,\n            signInDetails: tokens?.signInDetails,\n        };\n    }\n    async refreshTokens({ tokens, username, clientMetadata, }) {\n        try {\n            const { signInDetails } = tokens;\n            const newTokens = await this.getTokenRefresher()({\n                tokens,\n                authConfig: this.authConfig,\n                username,\n                clientMetadata,\n            });\n            newTokens.signInDetails = signInDetails;\n            await this.setTokens({ tokens: newTokens });\n            Hub.dispatch('auth', { event: 'tokenRefresh' }, 'Auth', AMPLIFY_SYMBOL);\n            return newTokens;\n        }\n        catch (err) {\n            return this.handleErrors(err);\n        }\n    }\n    handleErrors(err) {\n        assertServiceError(err);\n        if (err.name !== AmplifyErrorCode.NetworkError) {\n            // TODO(v6): Check errors on client\n            this.clearTokens();\n        }\n        Hub.dispatch('auth', {\n            event: 'tokenRefresh_failure',\n            data: { error: err },\n        }, 'Auth', AMPLIFY_SYMBOL);\n        if (err.name.startsWith('NotAuthorizedException')) {\n            return null;\n        }\n        throw err;\n    }\n    async setTokens({ tokens }) {\n        return this.getTokenStore().storeTokens(tokens);\n    }\n    async clearTokens() {\n        return this.getTokenStore().clearTokens();\n    }\n    getDeviceMetadata(username) {\n        return this.getTokenStore().getDeviceMetadata(username);\n    }\n    clearDeviceMetadata(username) {\n        return this.getTokenStore().clearDeviceMetadata(username);\n    }\n    setOAuthMetadata(metadata) {\n        return this.getTokenStore().setOAuthMetadata(metadata);\n    }\n    getOAuthMetadata() {\n        return this.getTokenStore().getOAuthMetadata();\n    }\n}\n"],"names":[],"mappings":";;;;;;;AAAA;AACA;AAOO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,WAAW,GAAG;AAClB,QAAQ,IAAI,CAAC,oBAAoB,GAAG,SAAS;AAC7C,cAAc,YAAY;AAC1B,gBAAgB,IAAI,EAAE,MAAM,UAAU,CAAC,iBAAiB,EAAE,CAAC,EAAE;AAC7D,oBAAoB;AACpB,gBAAgB;AAChB,gBAAgB,IAAI,IAAI,CAAC,eAAe,EAAE;AAC1C,oBAAoB,OAAO,IAAI,CAAC,eAAe;AAC/C,gBAAgB;AAChB;AACA;AACA;AACA,gBAAgB,IAAI,CAAC,eAAe,GAAG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,OAAO,KAAK;AACzE,oBAAoB,kBAAkB,CAAC,OAAO,CAAC;AAC/C,gBAAgB,CAAC,CAAC;AAClB,gBAAgB,OAAO,IAAI,CAAC,eAAe;AAC3C,YAAY;AACZ,cAAc,YAAY;AAC1B;AACA,YAAY,CAAC;AACb,IAAI;AACJ,IAAI,aAAa,CAAC,UAAU,EAAE;AAC9B,QAAQ,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC;AACpD,QAAQ,IAAI,CAAC,UAAU,GAAG,UAAU;AACpC,IAAI;AACJ,IAAI,iBAAiB,CAAC,cAAc,EAAE;AACtC,QAAQ,IAAI,CAAC,cAAc,GAAG,cAAc;AAC5C,IAAI;AACJ,IAAI,iBAAiB,CAAC,UAAU,EAAE;AAClC,QAAQ,IAAI,CAAC,UAAU,GAAG,UAAU;AACpC,IAAI;AACJ,IAAI,aAAa,GAAG;AACpB,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE;AAC9B,YAAY,MAAM,IAAI,SAAS,CAAC;AAChC,gBAAgB,IAAI,EAAE,0BAA0B;AAChD,gBAAgB,OAAO,EAAE,oBAAoB;AAC7C,aAAa,CAAC;AACd,QAAQ;AACR,QAAQ,OAAO,IAAI,CAAC,UAAU;AAC9B,IAAI;AACJ,IAAI,iBAAiB,GAAG;AACxB,QAAQ,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;AAClC,YAAY,MAAM,IAAI,SAAS,CAAC;AAChC,gBAAgB,IAAI,EAAE,8BAA8B;AACpD,gBAAgB,OAAO,EAAE,wBAAwB;AACjD,aAAa,CAAC;AACd,QAAQ;AACR,QAAQ,OAAO,IAAI,CAAC,cAAc;AAClC,IAAI;AACJ,IAAI,yBAAyB,CAAC,sBAAsB,EAAE;AACtD,QAAQ,IAAI,CAAC,sBAAsB,GAAG,sBAAsB;AAC5D,IAAI;AACJ,IAAI,MAAM,SAAS,CAAC,OAAO,EAAE;AAC7B,QAAQ,IAAI,MAAM;AAClB,QAAQ,IAAI;AACZ,YAAY,yBAAyB,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC;AAC/D,QAAQ;AACR,QAAQ,OAAO,IAAI,EAAE;AACrB;AACA,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,IAAI,CAAC,oBAAoB,EAAE;AACzC,QAAQ,IAAI,CAAC,eAAe,GAAG,SAAS;AACxC,QAAQ,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;AACxD,QAAQ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,eAAe,EAAE;AACrE,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE;AAC7B,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO;AAChD,YAAY,cAAc,CAAC;AAC3B,gBAAgB,SAAS,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI;AACrE,gBAAgB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC;AAClD,aAAa,CAAC;AACd,QAAQ,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAClD,YAAY,SAAS,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI;AACrE,YAAY,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC;AAC9C,SAAS,CAAC;AACV,QAAQ,IAAI,OAAO,EAAE,YAAY,IAAI,cAAc,IAAI,kBAAkB,EAAE;AAC3E,YAAY,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;AAC9C,gBAAgB,MAAM;AACtB,gBAAgB,QAAQ;AACxB,gBAAgB,cAAc,EAAE,OAAO,EAAE,cAAc,KAAK,MAAM,IAAI,CAAC,sBAAsB,IAAI,CAAC;AAClG,aAAa,CAAC;AACd,YAAY,IAAI,MAAM,KAAK,IAAI,EAAE;AACjC,gBAAgB,OAAO,IAAI;AAC3B,YAAY;AACZ,QAAQ;AACR,QAAQ,OAAO;AACf,YAAY,WAAW,EAAE,MAAM,EAAE,WAAW;AAC5C,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO;AACpC,YAAY,aAAa,EAAE,MAAM,EAAE,aAAa;AAChD,SAAS;AACT,IAAI;AACJ,IAAI,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,EAAE;AAC/D,QAAQ,IAAI;AACZ,YAAY,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM;AAC5C,YAAY,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;AAC7D,gBAAgB,MAAM;AACtB,gBAAgB,UAAU,EAAE,IAAI,CAAC,UAAU;AAC3C,gBAAgB,QAAQ;AACxB,gBAAgB,cAAc;AAC9B,aAAa,CAAC;AACd,YAAY,SAAS,CAAC,aAAa,GAAG,aAAa;AACnD,YAAY,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACvD,YAAY,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC;AACnF,YAAY,OAAO,SAAS;AAC5B,QAAQ;AACR,QAAQ,OAAO,GAAG,EAAE;AACpB,YAAY,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;AACzC,QAAQ;AACR,IAAI;AACJ,IAAI,YAAY,CAAC,GAAG,EAAE;AACtB,QAAQ,kBAAkB,CAAC,GAAG,CAAC;AAC/B,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,CAAC,YAAY,EAAE;AACxD;AACA,YAAY,IAAI,CAAC,WAAW,EAAE;AAC9B,QAAQ;AACR,QAAQ,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE;AAC7B,YAAY,KAAK,EAAE,sBAAsB;AACzC,YAAY,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;AAChC,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC;AAClC,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE;AAC3D,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,GAAG;AACjB,IAAI;AACJ,IAAI,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE;AAChC,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;AACvD,IAAI;AACJ,IAAI,MAAM,WAAW,GAAG;AACxB,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,WAAW,EAAE;AACjD,IAAI;AACJ,IAAI,iBAAiB,CAAC,QAAQ,EAAE;AAChC,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC;AAC/D,IAAI;AACJ,IAAI,mBAAmB,CAAC,QAAQ,EAAE;AAClC,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC;AACjE,IAAI;AACJ,IAAI,gBAAgB,CAAC,QAAQ,EAAE;AAC/B,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC;AAC9D,IAAI;AACJ,IAAI,gBAAgB,GAAG;AACvB,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,gBAAgB,EAAE;AACtD,IAAI;AACJ;;;;"}

package/dist/esm/providers/cognito/tokenProvider/types.d.ts

@@ -1,9 +1,10 @@
-import { AuthConfig, AuthTokens, FetchAuthSessionOptions, KeyValueStorageInterface, TokenProvider } from '@aws-amplify/core';
-import { CognitoAuthSignInDetails } from '../types';
-export type TokenRefresher = ({ tokens, authConfig, username, }: {
+import { AuthConfig, AuthTokens, ClientMetadataProvider, FetchAuthSessionOptions, KeyValueStorageInterface, TokenProvider } from '@aws-amplify/core';
+import { ClientMetadata, CognitoAuthSignInDetails } from '../types';
+export type TokenRefresher = ({ tokens, authConfig, username, clientMetadata, }: {
     tokens: CognitoAuthTokens;
     authConfig?: AuthConfig;
     username: string;
+    clientMetadata?: ClientMetadata;
 }) => Promise<CognitoAuthTokens>;
 export type AuthKeys<AuthKey extends string> = Record<AuthKey, string>;
 export declare const AuthTokenStorageKeys: {
@@ -47,6 +48,7 @@ export interface AuthTokenOrchestrator {
 export interface CognitoUserPoolTokenProviderType extends TokenProvider {
     setKeyValueStorage(keyValueStorage: KeyValueStorageInterface): void;
     setAuthConfig(authConfig: AuthConfig): void;
+    setClientMetadataProvider(clientMetadataProvider: ClientMetadataProvider): void;
 }
 export type CognitoAuthTokens = AuthTokens & {
     refreshToken?: string;

package/dist/esm/providers/cognito/types/models.d.ts

@@ -12,7 +12,7 @@ export declare const cognitoHostedUIIdentityProviderMap: Record<AuthProvider, st
 /**
  * Arbitrary key/value pairs that may be passed as part of certain Cognito requests
  */
-export type ClientMetadata = Record<string, string>;
+export type { ClientMetadata } from '@aws-amplify/core';
 /**
  * Allowed values for preferredChallenge
  */
@@ -70,4 +70,3 @@ export interface AuthUser extends AWSAuthUser {
  * Holds data describing the dispatch of a confirmation code.
  */
 export type CodeDeliveryDetails<CognitoUserAttributeKey extends UserAttributeKey = UserAttributeKey> = AuthCodeDeliveryDetails<CognitoUserAttributeKey>;
-export {};

package/dist/esm/providers/cognito/utils/refreshAuthTokens.d.ts

@@ -1,8 +1,10 @@
 import { AuthConfig } from '@aws-amplify/core';
 import { CognitoAuthTokens, TokenRefresher } from '../tokenProvider/types';
+import { ClientMetadata } from '../types';
 export declare const refreshAuthTokens: (args_0: {
     tokens: CognitoAuthTokens;
     authConfig?: AuthConfig;
     username: string;
+    clientMetadata?: ClientMetadata;
 }) => Promise<CognitoAuthTokens>;
 export declare const refreshAuthTokensWithoutDedupe: TokenRefresher;

package/dist/esm/providers/cognito/utils/refreshAuthTokens.mjs

@@ -15,7 +15,7 @@ import '../types/errors.mjs';
 
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
-const refreshAuthTokensFunction = async ({ tokens, authConfig, username, }) => {
+const refreshAuthTokensFunction = async ({ tokens, authConfig, username, clientMetadata, }) => {
     assertTokenProviderConfig(authConfig?.Cognito);
     const { userPoolId, userPoolClientId, userPoolEndpoint } = authConfig.Cognito;
     const region = getRegionFromUserPoolId(userPoolId);
@@ -29,6 +29,7 @@ const refreshAuthTokensFunction = async ({ tokens, authConfig, username, }) => {
         ClientId: userPoolClientId,
         RefreshToken: tokens.refreshToken,
         DeviceKey: tokens.deviceMetadata?.deviceKey,
+        ClientMetadata: clientMetadata,
     });
     const accessToken = decodeJWT(AuthenticationResult?.AccessToken ?? '');
     const idToken = AuthenticationResult?.IdToken

package/dist/esm/providers/cognito/utils/refreshAuthTokens.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"refreshAuthTokens.mjs","sources":["../../../../../src/providers/cognito/utils/refreshAuthTokens.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { assertTokenProviderConfig, deDupeAsyncFunction, decodeJWT, } from '@aws-amplify/core/internals/utils';\nimport { getRegionFromUserPoolId } from '../../../foundation/parsers';\nimport { assertAuthTokensWithRefreshToken } from '../utils/types';\nimport { AuthError } from '../../../errors/AuthError';\nimport { createCognitoUserPoolEndpointResolver } from '../factories';\nimport { createGetTokensFromRefreshTokenClient } from '../../../foundation/factories/serviceClients/cognitoIdentityProvider';\nconst refreshAuthTokensFunction = async ({ tokens, authConfig, username, }) => {\n    assertTokenProviderConfig(authConfig?.Cognito);\n    const { userPoolId, userPoolClientId, userPoolEndpoint } = authConfig.Cognito;\n    const region = getRegionFromUserPoolId(userPoolId);\n    assertAuthTokensWithRefreshToken(tokens);\n    const getTokensFromRefreshToken = createGetTokensFromRefreshTokenClient({\n        endpointResolver: createCognitoUserPoolEndpointResolver({\n            endpointOverride: userPoolEndpoint,\n        }),\n    });\n    const { AuthenticationResult } = await getTokensFromRefreshToken({ region }, {\n        ClientId: userPoolClientId,\n        RefreshToken: tokens.refreshToken,\n        DeviceKey: tokens.deviceMetadata?.deviceKey,\n    });\n    const accessToken = decodeJWT(AuthenticationResult?.AccessToken ?? '');\n    const idToken = AuthenticationResult?.IdToken\n        ? decodeJWT(AuthenticationResult.IdToken)\n        : undefined;\n    const { iat } = accessToken.payload;\n    // This should never happen. If it does, it's a bug from the service.\n    if (!iat) {\n        throw new AuthError({\n            name: 'iatNotFoundException',\n            message: 'iat not found in access token',\n        });\n    }\n    const clockDrift = iat * 1000 - new Date().getTime();\n    return {\n        accessToken,\n        idToken,\n        clockDrift,\n        refreshToken: AuthenticationResult?.RefreshToken ?? tokens.refreshToken,\n        username,\n    };\n};\nexport const refreshAuthTokens = deDupeAsyncFunction(refreshAuthTokensFunction);\nexport const refreshAuthTokensWithoutDedupe = refreshAuthTokensFunction;\n"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA;AACA;AAOA,MAAM,yBAAyB,GAAG,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,GAAG,KAAK;AAC/E,IAAI,yBAAyB,CAAC,UAAU,EAAE,OAAO,CAAC;AAClD,IAAI,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,UAAU,CAAC,OAAO;AACjF,IAAI,MAAM,MAAM,GAAG,uBAAuB,CAAC,UAAU,CAAC;AACtD,IAAI,gCAAgC,CAAC,MAAM,CAAC;AAC5C,IAAI,MAAM,yBAAyB,GAAG,qCAAqC,CAAC;AAC5E,QAAQ,gBAAgB,EAAE,qCAAqC,CAAC;AAChE,YAAY,gBAAgB,EAAE,gBAAgB;AAC9C,SAAS,CAAC;AACV,KAAK,CAAC;AACN,IAAI,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,yBAAyB,CAAC,EAAE,MAAM,EAAE,EAAE;AACjF,QAAQ,QAAQ,EAAE,gBAAgB;AAClC,QAAQ,YAAY,EAAE,MAAM,CAAC,YAAY;AACzC,QAAQ,SAAS,EAAE,MAAM,CAAC,cAAc,EAAE,SAAS;AACnD,KAAK,CAAC;AACN,IAAI,MAAM,WAAW,GAAG,SAAS,CAAC,oBAAoB,EAAE,WAAW,IAAI,EAAE,CAAC;AAC1E,IAAI,MAAM,OAAO,GAAG,oBAAoB,EAAE;AAC1C,UAAU,SAAS,CAAC,oBAAoB,CAAC,OAAO;AAChD,UAAU,SAAS;AACnB,IAAI,MAAM,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO;AACvC;AACA,IAAI,IAAI,CAAC,GAAG,EAAE;AACd,QAAQ,MAAM,IAAI,SAAS,CAAC;AAC5B,YAAY,IAAI,EAAE,sBAAsB;AACxC,YAAY,OAAO,EAAE,+BAA+B;AACpD,SAAS,CAAC;AACV,IAAI;AACJ,IAAI,MAAM,UAAU,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE;AACxD,IAAI,OAAO;AACX,QAAQ,WAAW;AACnB,QAAQ,OAAO;AACf,QAAQ,UAAU;AAClB,QAAQ,YAAY,EAAE,oBAAoB,EAAE,YAAY,IAAI,MAAM,CAAC,YAAY;AAC/E,QAAQ,QAAQ;AAChB,KAAK;AACL,CAAC;AACW,MAAC,iBAAiB,GAAG,mBAAmB,CAAC,yBAAyB;AAClE,MAAC,8BAA8B,GAAG;;;;"}
+{"version":3,"file":"refreshAuthTokens.mjs","sources":["../../../../../src/providers/cognito/utils/refreshAuthTokens.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { assertTokenProviderConfig, deDupeAsyncFunction, decodeJWT, } from '@aws-amplify/core/internals/utils';\nimport { getRegionFromUserPoolId } from '../../../foundation/parsers';\nimport { assertAuthTokensWithRefreshToken } from '../utils/types';\nimport { AuthError } from '../../../errors/AuthError';\nimport { createCognitoUserPoolEndpointResolver } from '../factories';\nimport { createGetTokensFromRefreshTokenClient } from '../../../foundation/factories/serviceClients/cognitoIdentityProvider';\nconst refreshAuthTokensFunction = async ({ tokens, authConfig, username, clientMetadata, }) => {\n    assertTokenProviderConfig(authConfig?.Cognito);\n    const { userPoolId, userPoolClientId, userPoolEndpoint } = authConfig.Cognito;\n    const region = getRegionFromUserPoolId(userPoolId);\n    assertAuthTokensWithRefreshToken(tokens);\n    const getTokensFromRefreshToken = createGetTokensFromRefreshTokenClient({\n        endpointResolver: createCognitoUserPoolEndpointResolver({\n            endpointOverride: userPoolEndpoint,\n        }),\n    });\n    const { AuthenticationResult } = await getTokensFromRefreshToken({ region }, {\n        ClientId: userPoolClientId,\n        RefreshToken: tokens.refreshToken,\n        DeviceKey: tokens.deviceMetadata?.deviceKey,\n        ClientMetadata: clientMetadata,\n    });\n    const accessToken = decodeJWT(AuthenticationResult?.AccessToken ?? '');\n    const idToken = AuthenticationResult?.IdToken\n        ? decodeJWT(AuthenticationResult.IdToken)\n        : undefined;\n    const { iat } = accessToken.payload;\n    // This should never happen. If it does, it's a bug from the service.\n    if (!iat) {\n        throw new AuthError({\n            name: 'iatNotFoundException',\n            message: 'iat not found in access token',\n        });\n    }\n    const clockDrift = iat * 1000 - new Date().getTime();\n    return {\n        accessToken,\n        idToken,\n        clockDrift,\n        refreshToken: AuthenticationResult?.RefreshToken ?? tokens.refreshToken,\n        username,\n    };\n};\nexport const refreshAuthTokens = deDupeAsyncFunction(refreshAuthTokensFunction);\nexport const refreshAuthTokensWithoutDedupe = refreshAuthTokensFunction;\n"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA;AACA;AAOA,MAAM,yBAAyB,GAAG,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,GAAG,KAAK;AAC/F,IAAI,yBAAyB,CAAC,UAAU,EAAE,OAAO,CAAC;AAClD,IAAI,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,UAAU,CAAC,OAAO;AACjF,IAAI,MAAM,MAAM,GAAG,uBAAuB,CAAC,UAAU,CAAC;AACtD,IAAI,gCAAgC,CAAC,MAAM,CAAC;AAC5C,IAAI,MAAM,yBAAyB,GAAG,qCAAqC,CAAC;AAC5E,QAAQ,gBAAgB,EAAE,qCAAqC,CAAC;AAChE,YAAY,gBAAgB,EAAE,gBAAgB;AAC9C,SAAS,CAAC;AACV,KAAK,CAAC;AACN,IAAI,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,yBAAyB,CAAC,EAAE,MAAM,EAAE,EAAE;AACjF,QAAQ,QAAQ,EAAE,gBAAgB;AAClC,QAAQ,YAAY,EAAE,MAAM,CAAC,YAAY;AACzC,QAAQ,SAAS,EAAE,MAAM,CAAC,cAAc,EAAE,SAAS;AACnD,QAAQ,cAAc,EAAE,cAAc;AACtC,KAAK,CAAC;AACN,IAAI,MAAM,WAAW,GAAG,SAAS,CAAC,oBAAoB,EAAE,WAAW,IAAI,EAAE,CAAC;AAC1E,IAAI,MAAM,OAAO,GAAG,oBAAoB,EAAE;AAC1C,UAAU,SAAS,CAAC,oBAAoB,CAAC,OAAO;AAChD,UAAU,SAAS;AACnB,IAAI,MAAM,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO;AACvC;AACA,IAAI,IAAI,CAAC,GAAG,EAAE;AACd,QAAQ,MAAM,IAAI,SAAS,CAAC;AAC5B,YAAY,IAAI,EAAE,sBAAsB;AACxC,YAAY,OAAO,EAAE,+BAA+B;AACpD,SAAS,CAAC;AACV,IAAI;AACJ,IAAI,MAAM,UAAU,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE;AACxD,IAAI,OAAO;AACX,QAAQ,WAAW;AACnB,QAAQ,OAAO;AACf,QAAQ,UAAU;AAClB,QAAQ,YAAY,EAAE,oBAAoB,EAAE,YAAY,IAAI,MAAM,CAAC,YAAY;AAC/E,QAAQ,QAAQ;AAChB,KAAK;AACL,CAAC;AACW,MAAC,iBAAiB,GAAG,mBAAmB,CAAC,yBAAyB;AAClE,MAAC,8BAA8B,GAAG;;;;"}

package/dist/esm/types/inputs.d.ts

@@ -47,6 +47,10 @@ export type AuthPrompt = 'NONE' | 'LOGIN' | 'CONSENT' | 'SELECT_ACCOUNT';
 export interface AuthSignInWithRedirectInput {
     provider?: AuthProvider | {
         custom: string;
+        idpIdentifier?: never;
+    } | {
+        idpIdentifier: string;
+        custom?: never;
     };
     customState?: string;
     options?: {

package/package.json

@@ -1,113 +1,113 @@
 {
-	"name": "@aws-amplify/auth",
-	"version": "6.16.0",
-	"description": "Auth category of aws-amplify",
-	"main": "./dist/cjs/index.js",
-	"module": "./dist/esm/index.mjs",
-	"typings": "./dist/esm/index.d.ts",
-	"react-native": "./dist/cjs/index.js",
-	"sideEffects": [
-		"./dist/cjs/providers/cognito/apis/signInWithRedirect.js",
-		"./dist/esm/providers/cognito/apis/signInWithRedirect.mjs",
-		"./dist/cjs/providers/cognito/utils/oauth/enableOAuthListener.js",
-		"./dist/esm/providers/cognito/utils/oauth/enableOAuthListener.mjs"
-	],
-	"publishConfig": {
-		"access": "public"
-	},
-	"scripts": {
-		"test": "yarn lint --fix && jest -w 1 --coverage --logHeapUsage",
-		"build-with-test": "npm test && npm run build",
-		"build:umd": "webpack && webpack --config ./webpack.config.dev.js",
-		"build:esm-cjs": "rollup --forceExit -c rollup.config.mjs",
-		"build:watch": "npm run build:esm-cjs -- --watch",
-		"build": "npm run clean && npm run build:esm-cjs && npm run build:umd",
-		"clean": "npm run clean:size && rimraf lib-esm lib dist",
-		"clean:size": "rimraf dual-publish-tmp tmp*",
-		"format": "echo \"Not implemented\"",
-		"lint": "eslint '**/*.{ts,tsx}' && npm run ts-coverage",
-		"lint:fix": "eslint '**/*.{ts,tsx}' --fix",
-		"ts-coverage": "typescript-coverage-report -p ./tsconfig.build.json -t 91.18"
-	},
-	"typesVersions": {
-		">=4.2": {
-			"cognito": [
-				"./dist/esm/providers/cognito/index.d.ts"
-			],
-			"cognito/server": [
-				"./dist/esm/providers/cognito/apis/server/index.d.ts"
-			],
-			"server": [
-				"./dist/esm/server.d.ts"
-			]
-		}
-	},
-	"exports": {
-		".": {
-			"react-native": "./dist/cjs/index.js",
-			"types": "./dist/esm/index.d.ts",
-			"import": "./dist/esm/index.mjs",
-			"require": "./dist/cjs/index.js"
-		},
-		"./cognito": {
-			"react-native": "./dist/cjs/providers/cognito/index.js",
-			"types": "./dist/esm/providers/cognito/index.d.ts",
-			"import": "./dist/esm/providers/cognito/index.mjs",
-			"require": "./dist/cjs/providers/cognito/index.js"
-		},
-		"./cognito/server": {
-			"types": "./dist/esm/providers/cognito/apis/server/index.d.ts",
-			"import": "./dist/esm/providers/cognito/apis/server/index.mjs",
-			"require": "./dist/cjs/providers/cognito/apis/server/index.js"
-		},
-		"./server": {
-			"types": "./dist/esm/server.d.ts",
-			"import": "./dist/esm/server.mjs",
-			"require": "./dist/cjs/server.js"
-		},
-		"./enable-oauth-listener": {
-			"types": "./dist/esm/providers/cognito/utils/oauth/enableOAuthListener.d.ts",
-			"import": "./dist/esm/providers/cognito/utils/oauth/enableOAuthListener.mjs",
-			"require": "./dist/cjs/providers/cognito/utils/oauth/enableOAuthListener.js"
-		},
-		"./package.json": "./package.json"
-	},
-	"repository": {
-		"type": "git",
-		"url": "https://github.com/aws-amplify/amplify-js.git"
-	},
-	"author": "Amazon Web Services",
-	"license": "Apache-2.0",
-	"bugs": {
-		"url": "https://github.com/aws/aws-amplify/issues"
-	},
-	"homepage": "https://aws-amplify.github.io/",
-	"files": [
-		"dist/cjs",
-		"dist/esm",
-		"src",
-		"cognito",
-		"server",
-		"enable-oauth-listener"
-	],
-	"dependencies": {
-		"@aws-crypto/sha256-js": "5.2.0",
-		"@smithy/types": "^3.3.0",
-		"tslib": "^2.5.0"
-	},
-	"peerDependencies": {
-		"@aws-amplify/core": "^6.1.0",
-		"@aws-amplify/react-native": "^1.1.10"
-	},
-	"peerDependenciesMeta": {
-		"@aws-amplify/react-native": {
-			"optional": true
-		}
-	},
-	"devDependencies": {
-		"@aws-amplify/core": "6.13.3",
-		"@aws-amplify/react-native": "1.2.0",
-		"@jest/test-sequencer": "^29.7.0"
-	},
-	"gitHead": "2ffc7200d2e7ca45b51bf40316431cf467065c32"
+  "name": "@aws-amplify/auth",
+  "version": "6.16.1-unstable.5bf5685.0+5bf5685",
+  "description": "Auth category of aws-amplify",
+  "main": "./dist/cjs/index.js",
+  "module": "./dist/esm/index.mjs",
+  "typings": "./dist/esm/index.d.ts",
+  "react-native": "./dist/cjs/index.js",
+  "sideEffects": [
+    "./dist/cjs/providers/cognito/apis/signInWithRedirect.js",
+    "./dist/esm/providers/cognito/apis/signInWithRedirect.mjs",
+    "./dist/cjs/providers/cognito/utils/oauth/enableOAuthListener.js",
+    "./dist/esm/providers/cognito/utils/oauth/enableOAuthListener.mjs"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "test": "yarn lint --fix && jest -w 1 --coverage --logHeapUsage",
+    "build-with-test": "npm test && npm run build",
+    "build:umd": "webpack && webpack --config ./webpack.config.dev.js",
+    "build:esm-cjs": "rollup --forceExit -c rollup.config.mjs",
+    "build:watch": "npm run build:esm-cjs -- --watch",
+    "build": "npm run clean && npm run build:esm-cjs && npm run build:umd",
+    "clean": "npm run clean:size && rimraf lib-esm lib dist",
+    "clean:size": "rimraf dual-publish-tmp tmp*",
+    "format": "echo \"Not implemented\"",
+    "lint": "eslint '**/*.{ts,tsx}' && npm run ts-coverage",
+    "lint:fix": "eslint '**/*.{ts,tsx}' --fix",
+    "ts-coverage": "typescript-coverage-report -p ./tsconfig.build.json -t 91.18"
+  },
+  "typesVersions": {
+    ">=4.2": {
+      "cognito": [
+        "./dist/esm/providers/cognito/index.d.ts"
+      ],
+      "cognito/server": [
+        "./dist/esm/providers/cognito/apis/server/index.d.ts"
+      ],
+      "server": [
+        "./dist/esm/server.d.ts"
+      ]
+    }
+  },
+  "exports": {
+    ".": {
+      "react-native": "./dist/cjs/index.js",
+      "types": "./dist/esm/index.d.ts",
+      "import": "./dist/esm/index.mjs",
+      "require": "./dist/cjs/index.js"
+    },
+    "./cognito": {
+      "react-native": "./dist/cjs/providers/cognito/index.js",
+      "types": "./dist/esm/providers/cognito/index.d.ts",
+      "import": "./dist/esm/providers/cognito/index.mjs",
+      "require": "./dist/cjs/providers/cognito/index.js"
+    },
+    "./cognito/server": {
+      "types": "./dist/esm/providers/cognito/apis/server/index.d.ts",
+      "import": "./dist/esm/providers/cognito/apis/server/index.mjs",
+      "require": "./dist/cjs/providers/cognito/apis/server/index.js"
+    },
+    "./server": {
+      "types": "./dist/esm/server.d.ts",
+      "import": "./dist/esm/server.mjs",
+      "require": "./dist/cjs/server.js"
+    },
+    "./enable-oauth-listener": {
+      "types": "./dist/esm/providers/cognito/utils/oauth/enableOAuthListener.d.ts",
+      "import": "./dist/esm/providers/cognito/utils/oauth/enableOAuthListener.mjs",
+      "require": "./dist/cjs/providers/cognito/utils/oauth/enableOAuthListener.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/aws-amplify/amplify-js.git"
+  },
+  "author": "Amazon Web Services",
+  "license": "Apache-2.0",
+  "bugs": {
+    "url": "https://github.com/aws/aws-amplify/issues"
+  },
+  "homepage": "https://aws-amplify.github.io/",
+  "files": [
+    "dist/cjs",
+    "dist/esm",
+    "src",
+    "cognito",
+    "server",
+    "enable-oauth-listener"
+  ],
+  "dependencies": {
+    "@aws-crypto/sha256-js": "5.2.0",
+    "@smithy/types": "^3.3.0",
+    "tslib": "^2.5.0"
+  },
+  "peerDependencies": {
+    "@aws-amplify/core": "6.13.4-unstable.5bf5685.0+5bf5685",
+    "@aws-amplify/react-native": "^1.1.10"
+  },
+  "peerDependenciesMeta": {
+    "@aws-amplify/react-native": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@aws-amplify/core": "6.13.4-unstable.5bf5685.0+5bf5685",
+    "@aws-amplify/react-native": "1.2.1-unstable.5bf5685.0+5bf5685",
+    "@jest/test-sequencer": "^29.7.0"
+  },
+  "gitHead": "5bf5685e1876bbb16550678bda9cfa3953831685"
 }

package/src/providers/cognito/apis/signInWithRedirect.ts

@@ -51,17 +51,21 @@ export async function signInWithRedirect(
 	}
 
 	let provider = 'COGNITO'; // Default
+	let idpIdentifier: string | undefined;
 
 	if (typeof input?.provider === 'string') {
 		provider = cognitoHostedUIIdentityProviderMap[input.provider];
 	} else if (input?.provider?.custom) {
 		provider = input.provider.custom;
+	} else if (input?.provider?.idpIdentifier) {
+		({ idpIdentifier } = input.provider);
 	}
 
 	return oauthSignIn({
 		oauthConfig: authConfig.loginWith.oauth,
 		clientId: authConfig.userPoolClientId,
 		provider,
+		idpIdentifier,
 		customState: input?.customState,
 		preferPrivateSession: input?.options?.preferPrivateSession,
 		options: {
@@ -77,6 +81,7 @@ export async function signInWithRedirect(
 const oauthSignIn = async ({
 	oauthConfig,
 	provider,
+	idpIdentifier,
 	clientId,
 	customState,
 	preferPrivateSession,
@@ -85,6 +90,7 @@ const oauthSignIn = async ({
 }: {
 	oauthConfig: OAuthConfig;
 	provider: string;
+	idpIdentifier?: string;
 	clientId: string;
 	customState?: string;
 	preferPrivateSession?: boolean;
@@ -117,10 +123,17 @@ const oauthSignIn = async ({
 		['redirect_uri', redirectUri],
 		['response_type', responseType],
 		['client_id', clientId],
-		['identity_provider', provider],
-		['scope', scopes.join(' ')],
 	]);
 
+	// Add either identity_provider or idp_identifier, but not both
+	if (idpIdentifier) {
+		params.append('idp_identifier', idpIdentifier);
+	} else {
+		params.append('identity_provider', provider);
+	}
+
+	params.append('scope', scopes.join(' '));
+
 	loginHint && params.append('login_hint', loginHint);
 	lang && params.append('lang', lang);
 	nonce && params.append('nonce', nonce);

package/src/providers/cognito/tokenProvider/CognitoUserPoolsTokenProvider.ts

@@ -4,6 +4,7 @@
 import {
 	AuthConfig,
 	AuthTokens,
+	ClientMetadataProvider,
 	FetchAuthSessionOptions,
 	KeyValueStorageInterface,
 	defaultStorage,
@@ -28,16 +29,20 @@ export class CognitoUserPoolsTokenProvider
 		this.tokenOrchestrator.setTokenRefresher(refreshAuthTokens);
 	}
 
-	getTokens(
-		{ forceRefresh }: FetchAuthSessionOptions = { forceRefresh: false },
-	): Promise<AuthTokens | null> {
-		return this.tokenOrchestrator.getTokens({ forceRefresh });
+	getTokens(options: FetchAuthSessionOptions = {}): Promise<AuthTokens | null> {
+		return this.tokenOrchestrator.getTokens(options);
 	}
 
 	setKeyValueStorage(keyValueStorage: KeyValueStorageInterface): void {
 		this.authTokenStore.setKeyValueStorage(keyValueStorage);
 	}
 
+	setClientMetadataProvider(
+		clientMetadataProvider: ClientMetadataProvider,
+	): void {
+		this.tokenOrchestrator.setClientMetadataProvider(clientMetadataProvider);
+	}
+
 	setAuthConfig(authConfig: AuthConfig) {
 		this.authTokenStore.setAuthConfig(authConfig);
 		this.tokenOrchestrator.setAuthConfig(authConfig);

package/src/providers/cognito/tokenProvider/TokenOrchestrator.ts

@@ -3,6 +3,7 @@
 import {
 	AuthConfig,
 	AuthTokens,
+	ClientMetadataProvider,
 	CognitoUserPoolConfig,
 	FetchAuthSessionOptions,
 	Hub,
@@ -19,7 +20,7 @@ import { assertServiceError } from '../../../errors/utils/assertServiceError';
 import { AuthError } from '../../../errors/AuthError';
 import { oAuthStore } from '../utils/oauth/oAuthStore';
 import { addInflightPromise } from '../utils/oauth/inflightPromise';
-import { CognitoAuthSignInDetails } from '../types';
+import { ClientMetadata, CognitoAuthSignInDetails } from '../types';
 
 import {
 	AuthTokenOrchestrator,
@@ -32,6 +33,7 @@ import {
 
 export class TokenOrchestrator implements AuthTokenOrchestrator {
 	private authConfig?: AuthConfig;
+	clientMetadataProvider?: ClientMetadataProvider;
 	tokenStore?: AuthTokenStore;
 	tokenRefresher?: TokenRefresher;
 	inflightPromise: Promise<void> | undefined;
@@ -94,6 +96,12 @@ export class TokenOrchestrator implements AuthTokenOrchestrator {
 		return this.tokenRefresher;
 	}
 
+	setClientMetadataProvider(
+		clientMetadataProvider: ClientMetadataProvider,
+	): void {
+		this.clientMetadataProvider = clientMetadataProvider;
+	}
+
 	async getTokens(
 		options?: FetchAuthSessionOptions,
 	): Promise<
@@ -130,6 +138,8 @@ export class TokenOrchestrator implements AuthTokenOrchestrator {
 			tokens = await this.refreshTokens({
 				tokens,
 				username,
+				clientMetadata:
+					options?.clientMetadata ?? (await this.clientMetadataProvider?.()),
 			});
 
 			if (tokens === null) {
@@ -147,9 +157,11 @@ export class TokenOrchestrator implements AuthTokenOrchestrator {
 	private async refreshTokens({
 		tokens,
 		username,
+		clientMetadata,
 	}: {
 		tokens: CognitoAuthTokens;
 		username: string;
+		clientMetadata?: ClientMetadata;
 	}): Promise<CognitoAuthTokens | null> {
 		try {
 			const { signInDetails } = tokens;
@@ -157,6 +169,7 @@ export class TokenOrchestrator implements AuthTokenOrchestrator {
 				tokens,
 				authConfig: this.authConfig,
 				username,
+				clientMetadata,
 			});
 			newTokens.signInDetails = signInDetails;
 			await this.setTokens({ tokens: newTokens });

package/src/providers/cognito/tokenProvider/types.ts

@@ -3,21 +3,24 @@
 import {
 	AuthConfig,
 	AuthTokens,
+	ClientMetadataProvider,
 	FetchAuthSessionOptions,
 	KeyValueStorageInterface,
 	TokenProvider,
 } from '@aws-amplify/core';
 
-import { CognitoAuthSignInDetails } from '../types';
+import { ClientMetadata, CognitoAuthSignInDetails } from '../types';
 
 export type TokenRefresher = ({
 	tokens,
 	authConfig,
 	username,
+	clientMetadata,
 }: {
 	tokens: CognitoAuthTokens;
 	authConfig?: AuthConfig;
 	username: string;
+	clientMetadata?: ClientMetadata;
 }) => Promise<CognitoAuthTokens>;
 
 export type AuthKeys<AuthKey extends string> = Record<AuthKey, string>;
@@ -66,6 +69,9 @@ export interface AuthTokenOrchestrator {
 export interface CognitoUserPoolTokenProviderType extends TokenProvider {
 	setKeyValueStorage(keyValueStorage: KeyValueStorageInterface): void;
 	setAuthConfig(authConfig: AuthConfig): void;
+	setClientMetadataProvider(
+		clientMetadataProvider: ClientMetadataProvider,
+	): void;
 }
 
 export type CognitoAuthTokens = AuthTokens & {

package/src/providers/cognito/types/models.ts

@@ -38,7 +38,7 @@ export const cognitoHostedUIIdentityProviderMap: Record<AuthProvider, string> =
 /**
  * Arbitrary key/value pairs that may be passed as part of certain Cognito requests
  */
-export type ClientMetadata = Record<string, string>;
+export type { ClientMetadata } from '@aws-amplify/core';
 
 /**
  * Allowed values for preferredChallenge

package/src/providers/cognito/utils/refreshAuthTokens.ts

@@ -14,15 +14,18 @@ import { assertAuthTokensWithRefreshToken } from '../utils/types';
 import { AuthError } from '../../../errors/AuthError';
 import { createCognitoUserPoolEndpointResolver } from '../factories';
 import { createGetTokensFromRefreshTokenClient } from '../../../foundation/factories/serviceClients/cognitoIdentityProvider';
+import { ClientMetadata } from '../types';
 
 const refreshAuthTokensFunction: TokenRefresher = async ({
 	tokens,
 	authConfig,
 	username,
+	clientMetadata,
 }: {
 	tokens: CognitoAuthTokens;
 	authConfig?: AuthConfig;
 	username: string;
+	clientMetadata?: ClientMetadata;
 }): Promise<CognitoAuthTokens> => {
 	assertTokenProviderConfig(authConfig?.Cognito);
 	const { userPoolId, userPoolClientId, userPoolEndpoint } = authConfig.Cognito;
@@ -41,6 +44,7 @@ const refreshAuthTokensFunction: TokenRefresher = async ({
 			ClientId: userPoolClientId,
 			RefreshToken: tokens.refreshToken,
 			DeviceKey: tokens.deviceMetadata?.deviceKey,
+			ClientMetadata: clientMetadata,
 		},
 	);
 

package/src/types/inputs.ts

@@ -69,7 +69,10 @@ export type AuthProvider = 'Amazon' | 'Apple' | 'Facebook' | 'Google';
 export type AuthPrompt = 'NONE' | 'LOGIN' | 'CONSENT' | 'SELECT_ACCOUNT';
 
 export interface AuthSignInWithRedirectInput {
-	provider?: AuthProvider | { custom: string };
+	provider?:
+		| AuthProvider
+		| { custom: string; idpIdentifier?: never }
+		| { idpIdentifier: string; custom?: never };
 	customState?: string;
 	options?: {
 		/**