@aws-amplify/auth 6.16.1-unstable.aae2834.0 → 6.17.0

package/dist/cjs/providers/cognito/apis/signInWithRedirect.js

@@ -30,16 +30,21 @@ async function signInWithRedirect(input) {
         await (0, signInHelpers_1.assertUserNotAuthenticated)();
     }
     let provider = 'COGNITO'; // Default
+    let idpIdentifier;
     if (typeof input?.provider === 'string') {
         provider = models_1.cognitoHostedUIIdentityProviderMap[input.provider];
     }
     else if (input?.provider?.custom) {
         provider = input.provider.custom;
     }
+    else if (input?.provider?.idpIdentifier) {
+        ({ idpIdentifier } = input.provider);
+    }
     return oauthSignIn({
         oauthConfig: authConfig.loginWith.oauth,
         clientId: authConfig.userPoolClientId,
         provider,
+        idpIdentifier,
         customState: input?.customState,
         preferPrivateSession: input?.options?.preferPrivateSession,
         options: {
@@ -51,7 +56,7 @@ async function signInWithRedirect(input) {
         authSessionOpener: input?.options?.authSessionOpener,
     });
 }
-const oauthSignIn = async ({ oauthConfig, provider, clientId, customState, preferPrivateSession, options, authSessionOpener, }) => {
+const oauthSignIn = async ({ oauthConfig, provider, idpIdentifier, clientId, customState, preferPrivateSession, options, authSessionOpener, }) => {
     const { domain, redirectSignIn, responseType, scopes } = oauthConfig;
     const { loginHint, lang, nonce, prompt } = options ?? {};
     const randomState = (0, oauth_1.generateState)();
@@ -75,9 +80,15 @@ const oauthSignIn = async ({ oauthConfig, provider, clientId, customState, prefe
         ['redirect_uri', redirectUri],
         ['response_type', responseType],
         ['client_id', clientId],
-        ['identity_provider', provider],
-        ['scope', scopes.join(' ')],
     ]);
+    // Add either identity_provider or idp_identifier, but not both
+    if (idpIdentifier) {
+        params.append('idp_identifier', idpIdentifier);
+    }
+    else {
+        params.append('identity_provider', provider);
+    }
+    params.append('scope', scopes.join(' '));
     loginHint && params.append('login_hint', loginHint);
     lang && params.append('lang', lang);
     nonce && params.append('nonce', nonce);

package/dist/cjs/providers/cognito/apis/signInWithRedirect.js.map

@@ -1 +1 @@
-{"version":3,"file":"signInWithRedirect.js","sources":["../../../../../src/providers/cognito/apis/signInWithRedirect.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.signInWithRedirect = signInWithRedirect;\nconst core_1 = require(\"@aws-amplify/core\");\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nrequire(\"../utils/oauth/enableOAuthListener\");\nconst models_1 = require(\"../types/models\");\nconst utils_2 = require(\"../../../utils\");\nconst signInHelpers_1 = require(\"../utils/signInHelpers\");\nconst oauth_1 = require(\"../utils/oauth\");\nconst createOAuthError_1 = require(\"../utils/oauth/createOAuthError\");\nconst cancelOAuthFlow_1 = require(\"../utils/oauth/cancelOAuthFlow\");\n/**\n * Signs in a user with OAuth. Redirects the application to an Identity Provider.\n *\n * @param input - The SignInWithRedirectInput object, if empty it will redirect to Cognito HostedUI\n *\n * @throws AuthTokenConfigException - Thrown when the user pool config is invalid.\n * @throws OAuthNotConfigureException - Thrown when the oauth config is invalid.\n */\nasync function signInWithRedirect(input) {\n    const authConfig = core_1.Amplify.getConfig().Auth?.Cognito;\n    (0, utils_1.assertTokenProviderConfig)(authConfig);\n    (0, utils_1.assertOAuthConfig)(authConfig);\n    oauth_1.oAuthStore.setAuthConfig(authConfig);\n    if (!input?.options?.prompt) {\n        await (0, signInHelpers_1.assertUserNotAuthenticated)();\n    }\n    let provider = 'COGNITO'; // Default\n    if (typeof input?.provider === 'string') {\n        provider = models_1.cognitoHostedUIIdentityProviderMap[input.provider];\n    }\n    else if (input?.provider?.custom) {\n        provider = input.provider.custom;\n    }\n    return oauthSignIn({\n        oauthConfig: authConfig.loginWith.oauth,\n        clientId: authConfig.userPoolClientId,\n        provider,\n        customState: input?.customState,\n        preferPrivateSession: input?.options?.preferPrivateSession,\n        options: {\n            loginHint: input?.options?.loginHint,\n            lang: input?.options?.lang,\n            nonce: input?.options?.nonce,\n            prompt: input?.options?.prompt,\n        },\n        authSessionOpener: input?.options?.authSessionOpener,\n    });\n}\nconst oauthSignIn = async ({ oauthConfig, provider, clientId, customState, preferPrivateSession, options, authSessionOpener, }) => {\n    const { domain, redirectSignIn, responseType, scopes } = oauthConfig;\n    const { loginHint, lang, nonce, prompt } = options ?? {};\n    const randomState = (0, oauth_1.generateState)();\n    const openAuthSession = authSessionOpener || utils_2.openAuthSession;\n    /* encodeURIComponent is not URL safe, use urlSafeEncode instead. Cognito\n    single-encodes/decodes url on first sign in and double-encodes/decodes url\n    when user already signed in. Using encodeURIComponent, Base32, Base64 add\n    characters % or = which on further encoding becomes unsafe. '=' create issue\n    for parsing query params.\n    Refer: https://github.com/aws-amplify/amplify-js/issues/5218 */\n    const state = customState\n        ? `${randomState}-${(0, utils_1.urlSafeEncode)(customState)}`\n        : randomState;\n    const { value, method, toCodeChallenge } = (0, oauth_1.generateCodeVerifier)(128);\n    const redirectUri = (0, oauth_1.getRedirectUrl)(oauthConfig.redirectSignIn);\n    if ((0, utils_1.isBrowser)())\n        oauth_1.oAuthStore.storeOAuthInFlight(true);\n    oauth_1.oAuthStore.storeOAuthState(state);\n    oauth_1.oAuthStore.storePKCE(value);\n    const params = new URLSearchParams([\n        ['redirect_uri', redirectUri],\n        ['response_type', responseType],\n        ['client_id', clientId],\n        ['identity_provider', provider],\n        ['scope', scopes.join(' ')],\n    ]);\n    loginHint && params.append('login_hint', loginHint);\n    lang && params.append('lang', lang);\n    nonce && params.append('nonce', nonce);\n    prompt && params.append('prompt', prompt.toLowerCase());\n    params.append('state', state);\n    if (responseType === 'code') {\n        params.append('code_challenge', toCodeChallenge());\n        params.append('code_challenge_method', method);\n    }\n    // Using URL object is not supported in React Native as the `search` property is read-only\n    // See: https://github.com/facebook/react-native/blob/main/packages/react-native/Libraries/Blob/URL.js\n    const oAuthUrl = `https://${domain}/oauth2/authorize?${params.toString()}`;\n    // this will only take effect in the following scenarios:\n    // 1. the user cancels the OAuth flow on web via back button, and\n    // 2. when bfcache is enabled\n    (0, cancelOAuthFlow_1.listenForOAuthFlowCancellation)(oauth_1.oAuthStore);\n    // the following is effective only in react-native as openAuthSession resolves only in react-native\n    const { type, error, url } = (await openAuthSession(oAuthUrl, redirectSignIn, preferPrivateSession)) ??\n        {};\n    try {\n        if (type === 'error') {\n            throw (0, createOAuthError_1.createOAuthError)(String(error));\n        }\n        if (type === 'canceled') {\n            throw (0, createOAuthError_1.createOAuthError)(String(type));\n        }\n        if (type === 'success' && url) {\n            await (0, oauth_1.completeOAuthFlow)({\n                currentUrl: url,\n                clientId,\n                domain,\n                redirectUri,\n                responseType,\n                userAgentValue: (0, utils_2.getAuthUserAgentValue)(utils_1.AuthAction.SignInWithRedirect),\n                preferPrivateSession,\n            });\n        }\n    }\n    catch (err) {\n        await (0, oauth_1.handleFailure)(err);\n        // rethrow the error so it can be caught by `await signInWithRedirect()` in react-native\n        throw err;\n    }\n};\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC7D,OAAO,CAAC,kBAAkB,GAAG,kBAAkB;AAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;AAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC;AAC5D,OAAO,CAAC,oCAAoC,CAAC;AAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAC;AAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACzC,MAAM,eAAe,GAAG,OAAO,CAAC,wBAAwB,CAAC;AACzD,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACzC,MAAM,kBAAkB,GAAG,OAAO,CAAC,iCAAiC,CAAC;AACrE,MAAM,iBAAiB,GAAG,OAAO,CAAC,gCAAgC,CAAC;AACnE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,kBAAkB,CAAC,KAAK,EAAE;AACzC,IAAI,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO;AAC/D,IAAI,IAAI,OAAO,CAAC,yBAAyB,EAAE,UAAU,CAAC;AACtD,IAAI,IAAI,OAAO,CAAC,iBAAiB,EAAE,UAAU,CAAC;AAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC;AAChD,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE;AACjC,QAAQ,MAAM,IAAI,eAAe,CAAC,0BAA0B,GAAG;AAC/D,IAAI;AACJ,IAAI,IAAI,QAAQ,GAAG,SAAS,CAAC;AAC7B,IAAI,IAAI,OAAO,KAAK,EAAE,QAAQ,KAAK,QAAQ,EAAE;AAC7C,QAAQ,QAAQ,GAAG,QAAQ,CAAC,kCAAkC,CAAC,KAAK,CAAC,QAAQ,CAAC;AAC9E,IAAI;AACJ,SAAS,IAAI,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE;AACtC,QAAQ,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM;AACxC,IAAI;AACJ,IAAI,OAAO,WAAW,CAAC;AACvB,QAAQ,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK;AAC/C,QAAQ,QAAQ,EAAE,UAAU,CAAC,gBAAgB;AAC7C,QAAQ,QAAQ;AAChB,QAAQ,WAAW,EAAE,KAAK,EAAE,WAAW;AACvC,QAAQ,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB;AAClE,QAAQ,OAAO,EAAE;AACjB,YAAY,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS;AAChD,YAAY,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI;AACtC,YAAY,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AACxC,YAAY,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM;AAC1C,SAAS;AACT,QAAQ,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB;AAC5D,KAAK,CAAC;AACN;AACA,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,OAAO,EAAE,iBAAiB,GAAG,KAAK;AACnI,IAAI,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,WAAW;AACxE,IAAI,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,IAAI,EAAE;AAC5D,IAAI,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,aAAa,GAAG;AACpD,IAAI,MAAM,eAAe,GAAG,iBAAiB,IAAI,OAAO,CAAC,eAAe;AACxE;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,KAAK,GAAG;AAClB,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;AACpE,UAAU,WAAW;AACrB,IAAI,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC;AACrF,IAAI,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,cAAc,EAAE,WAAW,CAAC,cAAc,CAAC;AAC/E,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,GAAG;AAChC,QAAQ,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC;AACnD,IAAI,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC;AAC7C,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC;AACvC,IAAI,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;AACvC,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC;AACrC,QAAQ,CAAC,eAAe,EAAE,YAAY,CAAC;AACvC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC;AAC/B,QAAQ,CAAC,mBAAmB,EAAE,QAAQ,CAAC;AACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnC,KAAK,CAAC;AACN,IAAI,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC;AACvD,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;AACvC,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;AAC1C,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;AAC3D,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;AACjC,IAAI,IAAI,YAAY,KAAK,MAAM,EAAE;AACjC,QAAQ,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,eAAe,EAAE,CAAC;AAC1D,QAAQ,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC;AACtD,IAAI;AACJ;AACA;AACA,IAAI,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC9E;AACA;AACA;AACA,IAAI,IAAI,iBAAiB,CAAC,8BAA8B,EAAE,OAAO,CAAC,UAAU,CAAC;AAC7E;AACA,IAAI,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,eAAe,CAAC,QAAQ,EAAE,cAAc,EAAE,oBAAoB,CAAC;AACvG,QAAQ,EAAE;AACV,IAAI,IAAI;AACR,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE;AAC9B,YAAY,MAAM,CAAC,CAAC,EAAE,kBAAkB,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AACzE,QAAQ;AACR,QAAQ,IAAI,IAAI,KAAK,UAAU,EAAE;AACjC,YAAY,MAAM,CAAC,CAAC,EAAE,kBAAkB,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AACxE,QAAQ;AACR,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,EAAE;AACvC,YAAY,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,iBAAiB,EAAE;AACjD,gBAAgB,UAAU,EAAE,GAAG;AAC/B,gBAAgB,QAAQ;AACxB,gBAAgB,MAAM;AACtB,gBAAgB,WAAW;AAC3B,gBAAgB,YAAY;AAC5B,gBAAgB,cAAc,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,qBAAqB,EAAE,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC;AACzG,gBAAgB,oBAAoB;AACpC,aAAa,CAAC;AACd,QAAQ;AACR,IAAI;AACJ,IAAI,OAAO,GAAG,EAAE;AAChB,QAAQ,MAAM,IAAI,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;AAC7C;AACA,QAAQ,MAAM,GAAG;AACjB,IAAI;AACJ,CAAC;;"}
+{"version":3,"file":"signInWithRedirect.js","sources":["../../../../../src/providers/cognito/apis/signInWithRedirect.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.signInWithRedirect = signInWithRedirect;\nconst core_1 = require(\"@aws-amplify/core\");\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nrequire(\"../utils/oauth/enableOAuthListener\");\nconst models_1 = require(\"../types/models\");\nconst utils_2 = require(\"../../../utils\");\nconst signInHelpers_1 = require(\"../utils/signInHelpers\");\nconst oauth_1 = require(\"../utils/oauth\");\nconst createOAuthError_1 = require(\"../utils/oauth/createOAuthError\");\nconst cancelOAuthFlow_1 = require(\"../utils/oauth/cancelOAuthFlow\");\n/**\n * Signs in a user with OAuth. Redirects the application to an Identity Provider.\n *\n * @param input - The SignInWithRedirectInput object, if empty it will redirect to Cognito HostedUI\n *\n * @throws AuthTokenConfigException - Thrown when the user pool config is invalid.\n * @throws OAuthNotConfigureException - Thrown when the oauth config is invalid.\n */\nasync function signInWithRedirect(input) {\n    const authConfig = core_1.Amplify.getConfig().Auth?.Cognito;\n    (0, utils_1.assertTokenProviderConfig)(authConfig);\n    (0, utils_1.assertOAuthConfig)(authConfig);\n    oauth_1.oAuthStore.setAuthConfig(authConfig);\n    if (!input?.options?.prompt) {\n        await (0, signInHelpers_1.assertUserNotAuthenticated)();\n    }\n    let provider = 'COGNITO'; // Default\n    let idpIdentifier;\n    if (typeof input?.provider === 'string') {\n        provider = models_1.cognitoHostedUIIdentityProviderMap[input.provider];\n    }\n    else if (input?.provider?.custom) {\n        provider = input.provider.custom;\n    }\n    else if (input?.provider?.idpIdentifier) {\n        ({ idpIdentifier } = input.provider);\n    }\n    return oauthSignIn({\n        oauthConfig: authConfig.loginWith.oauth,\n        clientId: authConfig.userPoolClientId,\n        provider,\n        idpIdentifier,\n        customState: input?.customState,\n        preferPrivateSession: input?.options?.preferPrivateSession,\n        options: {\n            loginHint: input?.options?.loginHint,\n            lang: input?.options?.lang,\n            nonce: input?.options?.nonce,\n            prompt: input?.options?.prompt,\n        },\n        authSessionOpener: input?.options?.authSessionOpener,\n    });\n}\nconst oauthSignIn = async ({ oauthConfig, provider, idpIdentifier, clientId, customState, preferPrivateSession, options, authSessionOpener, }) => {\n    const { domain, redirectSignIn, responseType, scopes } = oauthConfig;\n    const { loginHint, lang, nonce, prompt } = options ?? {};\n    const randomState = (0, oauth_1.generateState)();\n    const openAuthSession = authSessionOpener || utils_2.openAuthSession;\n    /* encodeURIComponent is not URL safe, use urlSafeEncode instead. Cognito\n    single-encodes/decodes url on first sign in and double-encodes/decodes url\n    when user already signed in. Using encodeURIComponent, Base32, Base64 add\n    characters % or = which on further encoding becomes unsafe. '=' create issue\n    for parsing query params.\n    Refer: https://github.com/aws-amplify/amplify-js/issues/5218 */\n    const state = customState\n        ? `${randomState}-${(0, utils_1.urlSafeEncode)(customState)}`\n        : randomState;\n    const { value, method, toCodeChallenge } = (0, oauth_1.generateCodeVerifier)(128);\n    const redirectUri = (0, oauth_1.getRedirectUrl)(oauthConfig.redirectSignIn);\n    if ((0, utils_1.isBrowser)())\n        oauth_1.oAuthStore.storeOAuthInFlight(true);\n    oauth_1.oAuthStore.storeOAuthState(state);\n    oauth_1.oAuthStore.storePKCE(value);\n    const params = new URLSearchParams([\n        ['redirect_uri', redirectUri],\n        ['response_type', responseType],\n        ['client_id', clientId],\n    ]);\n    // Add either identity_provider or idp_identifier, but not both\n    if (idpIdentifier) {\n        params.append('idp_identifier', idpIdentifier);\n    }\n    else {\n        params.append('identity_provider', provider);\n    }\n    params.append('scope', scopes.join(' '));\n    loginHint && params.append('login_hint', loginHint);\n    lang && params.append('lang', lang);\n    nonce && params.append('nonce', nonce);\n    prompt && params.append('prompt', prompt.toLowerCase());\n    params.append('state', state);\n    if (responseType === 'code') {\n        params.append('code_challenge', toCodeChallenge());\n        params.append('code_challenge_method', method);\n    }\n    // Using URL object is not supported in React Native as the `search` property is read-only\n    // See: https://github.com/facebook/react-native/blob/main/packages/react-native/Libraries/Blob/URL.js\n    const oAuthUrl = `https://${domain}/oauth2/authorize?${params.toString()}`;\n    // this will only take effect in the following scenarios:\n    // 1. the user cancels the OAuth flow on web via back button, and\n    // 2. when bfcache is enabled\n    (0, cancelOAuthFlow_1.listenForOAuthFlowCancellation)(oauth_1.oAuthStore);\n    // the following is effective only in react-native as openAuthSession resolves only in react-native\n    const { type, error, url } = (await openAuthSession(oAuthUrl, redirectSignIn, preferPrivateSession)) ??\n        {};\n    try {\n        if (type === 'error') {\n            throw (0, createOAuthError_1.createOAuthError)(String(error));\n        }\n        if (type === 'canceled') {\n            throw (0, createOAuthError_1.createOAuthError)(String(type));\n        }\n        if (type === 'success' && url) {\n            await (0, oauth_1.completeOAuthFlow)({\n                currentUrl: url,\n                clientId,\n                domain,\n                redirectUri,\n                responseType,\n                userAgentValue: (0, utils_2.getAuthUserAgentValue)(utils_1.AuthAction.SignInWithRedirect),\n                preferPrivateSession,\n            });\n        }\n    }\n    catch (err) {\n        await (0, oauth_1.handleFailure)(err);\n        // rethrow the error so it can be caught by `await signInWithRedirect()` in react-native\n        throw err;\n    }\n};\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC7D,OAAO,CAAC,kBAAkB,GAAG,kBAAkB;AAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;AAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC;AAC5D,OAAO,CAAC,oCAAoC,CAAC;AAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAC;AAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACzC,MAAM,eAAe,GAAG,OAAO,CAAC,wBAAwB,CAAC;AACzD,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACzC,MAAM,kBAAkB,GAAG,OAAO,CAAC,iCAAiC,CAAC;AACrE,MAAM,iBAAiB,GAAG,OAAO,CAAC,gCAAgC,CAAC;AACnE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,kBAAkB,CAAC,KAAK,EAAE;AACzC,IAAI,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO;AAC/D,IAAI,IAAI,OAAO,CAAC,yBAAyB,EAAE,UAAU,CAAC;AACtD,IAAI,IAAI,OAAO,CAAC,iBAAiB,EAAE,UAAU,CAAC;AAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC;AAChD,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE;AACjC,QAAQ,MAAM,IAAI,eAAe,CAAC,0BAA0B,GAAG;AAC/D,IAAI;AACJ,IAAI,IAAI,QAAQ,GAAG,SAAS,CAAC;AAC7B,IAAI,IAAI,aAAa;AACrB,IAAI,IAAI,OAAO,KAAK,EAAE,QAAQ,KAAK,QAAQ,EAAE;AAC7C,QAAQ,QAAQ,GAAG,QAAQ,CAAC,kCAAkC,CAAC,KAAK,CAAC,QAAQ,CAAC;AAC9E,IAAI;AACJ,SAAS,IAAI,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE;AACtC,QAAQ,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM;AACxC,IAAI;AACJ,SAAS,IAAI,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE;AAC7C,QAAQ,CAAC,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC,QAAQ;AAC3C,IAAI;AACJ,IAAI,OAAO,WAAW,CAAC;AACvB,QAAQ,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK;AAC/C,QAAQ,QAAQ,EAAE,UAAU,CAAC,gBAAgB;AAC7C,QAAQ,QAAQ;AAChB,QAAQ,aAAa;AACrB,QAAQ,WAAW,EAAE,KAAK,EAAE,WAAW;AACvC,QAAQ,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB;AAClE,QAAQ,OAAO,EAAE;AACjB,YAAY,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS;AAChD,YAAY,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI;AACtC,YAAY,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AACxC,YAAY,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM;AAC1C,SAAS;AACT,QAAQ,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB;AAC5D,KAAK,CAAC;AACN;AACA,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,OAAO,EAAE,iBAAiB,GAAG,KAAK;AAClJ,IAAI,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,WAAW;AACxE,IAAI,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,IAAI,EAAE;AAC5D,IAAI,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,aAAa,GAAG;AACpD,IAAI,MAAM,eAAe,GAAG,iBAAiB,IAAI,OAAO,CAAC,eAAe;AACxE;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,KAAK,GAAG;AAClB,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;AACpE,UAAU,WAAW;AACrB,IAAI,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC;AACrF,IAAI,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,cAAc,EAAE,WAAW,CAAC,cAAc,CAAC;AAC/E,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,GAAG;AAChC,QAAQ,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC;AACnD,IAAI,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC;AAC7C,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC;AACvC,IAAI,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;AACvC,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC;AACrC,QAAQ,CAAC,eAAe,EAAE,YAAY,CAAC;AACvC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC;AAC/B,KAAK,CAAC;AACN;AACA,IAAI,IAAI,aAAa,EAAE;AACvB,QAAQ,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,aAAa,CAAC;AACtD,IAAI;AACJ,SAAS;AACT,QAAQ,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,QAAQ,CAAC;AACpD,IAAI;AACJ,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5C,IAAI,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC;AACvD,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;AACvC,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;AAC1C,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;AAC3D,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;AACjC,IAAI,IAAI,YAAY,KAAK,MAAM,EAAE;AACjC,QAAQ,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,eAAe,EAAE,CAAC;AAC1D,QAAQ,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC;AACtD,IAAI;AACJ;AACA;AACA,IAAI,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC9E;AACA;AACA;AACA,IAAI,IAAI,iBAAiB,CAAC,8BAA8B,EAAE,OAAO,CAAC,UAAU,CAAC;AAC7E;AACA,IAAI,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,eAAe,CAAC,QAAQ,EAAE,cAAc,EAAE,oBAAoB,CAAC;AACvG,QAAQ,EAAE;AACV,IAAI,IAAI;AACR,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE;AAC9B,YAAY,MAAM,CAAC,CAAC,EAAE,kBAAkB,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AACzE,QAAQ;AACR,QAAQ,IAAI,IAAI,KAAK,UAAU,EAAE;AACjC,YAAY,MAAM,CAAC,CAAC,EAAE,kBAAkB,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AACxE,QAAQ;AACR,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,EAAE;AACvC,YAAY,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,iBAAiB,EAAE;AACjD,gBAAgB,UAAU,EAAE,GAAG;AAC/B,gBAAgB,QAAQ;AACxB,gBAAgB,MAAM;AACtB,gBAAgB,WAAW;AAC3B,gBAAgB,YAAY;AAC5B,gBAAgB,cAAc,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,qBAAqB,EAAE,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC;AACzG,gBAAgB,oBAAoB;AACpC,aAAa,CAAC;AACd,QAAQ;AACR,IAAI;AACJ,IAAI,OAAO,GAAG,EAAE;AAChB,QAAQ,MAAM,IAAI,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;AAC7C;AACA,QAAQ,MAAM,GAAG;AACjB,IAAI;AACJ,CAAC;;"}

package/dist/cjs/providers/cognito/tokenProvider/CognitoUserPoolsTokenProvider.js

@@ -16,12 +16,15 @@ class CognitoUserPoolsTokenProvider {
         this.tokenOrchestrator.setAuthTokenStore(this.authTokenStore);
         this.tokenOrchestrator.setTokenRefresher(refreshAuthTokens_1.refreshAuthTokens);
     }
-    getTokens({ forceRefresh } = { forceRefresh: false }) {
-        return this.tokenOrchestrator.getTokens({ forceRefresh });
+    getTokens(options = {}) {
+        return this.tokenOrchestrator.getTokens(options);
     }
     setKeyValueStorage(keyValueStorage) {
         this.authTokenStore.setKeyValueStorage(keyValueStorage);
     }
+    setClientMetadataProvider(clientMetadataProvider) {
+        this.tokenOrchestrator.setClientMetadataProvider(clientMetadataProvider);
+    }
     setAuthConfig(authConfig) {
         this.authTokenStore.setAuthConfig(authConfig);
         this.tokenOrchestrator.setAuthConfig(authConfig);

package/dist/cjs/providers/cognito/tokenProvider/CognitoUserPoolsTokenProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"CognitoUserPoolsTokenProvider.js","sources":["../../../../../src/providers/cognito/tokenProvider/CognitoUserPoolsTokenProvider.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.CognitoUserPoolsTokenProvider = void 0;\nconst core_1 = require(\"@aws-amplify/core\");\nconst refreshAuthTokens_1 = require(\"../utils/refreshAuthTokens\");\nconst TokenStore_1 = require(\"./TokenStore\");\nconst TokenOrchestrator_1 = require(\"./TokenOrchestrator\");\nclass CognitoUserPoolsTokenProvider {\n    constructor() {\n        this.authTokenStore = new TokenStore_1.DefaultTokenStore();\n        this.authTokenStore.setKeyValueStorage(core_1.defaultStorage);\n        this.tokenOrchestrator = new TokenOrchestrator_1.TokenOrchestrator();\n        this.tokenOrchestrator.setAuthTokenStore(this.authTokenStore);\n        this.tokenOrchestrator.setTokenRefresher(refreshAuthTokens_1.refreshAuthTokens);\n    }\n    getTokens({ forceRefresh } = { forceRefresh: false }) {\n        return this.tokenOrchestrator.getTokens({ forceRefresh });\n    }\n    setKeyValueStorage(keyValueStorage) {\n        this.authTokenStore.setKeyValueStorage(keyValueStorage);\n    }\n    setAuthConfig(authConfig) {\n        this.authTokenStore.setAuthConfig(authConfig);\n        this.tokenOrchestrator.setAuthConfig(authConfig);\n    }\n}\nexports.CognitoUserPoolsTokenProvider = CognitoUserPoolsTokenProvider;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC7D,OAAO,CAAC,6BAA6B,GAAG,MAAM;AAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;AAC3C,MAAM,mBAAmB,GAAG,OAAO,CAAC,4BAA4B,CAAC;AACjE,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;AAC5C,MAAM,mBAAmB,GAAG,OAAO,CAAC,qBAAqB,CAAC;AAC1D,MAAM,6BAA6B,CAAC;AACpC,IAAI,WAAW,GAAG;AAClB,QAAQ,IAAI,CAAC,cAAc,GAAG,IAAI,YAAY,CAAC,iBAAiB,EAAE;AAClE,QAAQ,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC;AACrE,QAAQ,IAAI,CAAC,iBAAiB,GAAG,IAAI,mBAAmB,CAAC,iBAAiB,EAAE;AAC5E,QAAQ,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC;AACrE,QAAQ,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,iBAAiB,CAAC;AACvF,IAAI;AACJ,IAAI,SAAS,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE;AAC1D,QAAQ,OAAO,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;AACjE,IAAI;AACJ,IAAI,kBAAkB,CAAC,eAAe,EAAE;AACxC,QAAQ,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,eAAe,CAAC;AAC/D,IAAI;AACJ,IAAI,aAAa,CAAC,UAAU,EAAE;AAC9B,QAAQ,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,UAAU,CAAC;AACrD,QAAQ,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,UAAU,CAAC;AACxD,IAAI;AACJ;AACA,OAAO,CAAC,6BAA6B,GAAG,6BAA6B;;"}
+{"version":3,"file":"CognitoUserPoolsTokenProvider.js","sources":["../../../../../src/providers/cognito/tokenProvider/CognitoUserPoolsTokenProvider.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.CognitoUserPoolsTokenProvider = void 0;\nconst core_1 = require(\"@aws-amplify/core\");\nconst refreshAuthTokens_1 = require(\"../utils/refreshAuthTokens\");\nconst TokenStore_1 = require(\"./TokenStore\");\nconst TokenOrchestrator_1 = require(\"./TokenOrchestrator\");\nclass CognitoUserPoolsTokenProvider {\n    constructor() {\n        this.authTokenStore = new TokenStore_1.DefaultTokenStore();\n        this.authTokenStore.setKeyValueStorage(core_1.defaultStorage);\n        this.tokenOrchestrator = new TokenOrchestrator_1.TokenOrchestrator();\n        this.tokenOrchestrator.setAuthTokenStore(this.authTokenStore);\n        this.tokenOrchestrator.setTokenRefresher(refreshAuthTokens_1.refreshAuthTokens);\n    }\n    getTokens(options = {}) {\n        return this.tokenOrchestrator.getTokens(options);\n    }\n    setKeyValueStorage(keyValueStorage) {\n        this.authTokenStore.setKeyValueStorage(keyValueStorage);\n    }\n    setClientMetadataProvider(clientMetadataProvider) {\n        this.tokenOrchestrator.setClientMetadataProvider(clientMetadataProvider);\n    }\n    setAuthConfig(authConfig) {\n        this.authTokenStore.setAuthConfig(authConfig);\n        this.tokenOrchestrator.setAuthConfig(authConfig);\n    }\n}\nexports.CognitoUserPoolsTokenProvider = CognitoUserPoolsTokenProvider;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC7D,OAAO,CAAC,6BAA6B,GAAG,MAAM;AAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;AAC3C,MAAM,mBAAmB,GAAG,OAAO,CAAC,4BAA4B,CAAC;AACjE,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;AAC5C,MAAM,mBAAmB,GAAG,OAAO,CAAC,qBAAqB,CAAC;AAC1D,MAAM,6BAA6B,CAAC;AACpC,IAAI,WAAW,GAAG;AAClB,QAAQ,IAAI,CAAC,cAAc,GAAG,IAAI,YAAY,CAAC,iBAAiB,EAAE;AAClE,QAAQ,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC;AACrE,QAAQ,IAAI,CAAC,iBAAiB,GAAG,IAAI,mBAAmB,CAAC,iBAAiB,EAAE;AAC5E,QAAQ,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC;AACrE,QAAQ,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,iBAAiB,CAAC;AACvF,IAAI;AACJ,IAAI,SAAS,CAAC,OAAO,GAAG,EAAE,EAAE;AAC5B,QAAQ,OAAO,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC;AACxD,IAAI;AACJ,IAAI,kBAAkB,CAAC,eAAe,EAAE;AACxC,QAAQ,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,eAAe,CAAC;AAC/D,IAAI;AACJ,IAAI,yBAAyB,CAAC,sBAAsB,EAAE;AACtD,QAAQ,IAAI,CAAC,iBAAiB,CAAC,yBAAyB,CAAC,sBAAsB,CAAC;AAChF,IAAI;AACJ,IAAI,aAAa,CAAC,UAAU,EAAE;AAC9B,QAAQ,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,UAAU,CAAC;AACrD,QAAQ,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,UAAU,CAAC;AACxD,IAAI;AACJ;AACA,OAAO,CAAC,6BAA6B,GAAG,6BAA6B;;"}

package/dist/cjs/providers/cognito/tokenProvider/TokenOrchestrator.js

@@ -60,6 +60,9 @@ class TokenOrchestrator {
         }
         return this.tokenRefresher;
     }
+    setClientMetadataProvider(clientMetadataProvider) {
+        this.clientMetadataProvider = clientMetadataProvider;
+    }
     async getTokens(options) {
         let tokens;
         try {
@@ -89,6 +92,7 @@ class TokenOrchestrator {
             tokens = await this.refreshTokens({
                 tokens,
                 username,
+                clientMetadata: options?.clientMetadata ?? (await this.clientMetadataProvider?.()),
             });
             if (tokens === null) {
                 return null;
@@ -100,13 +104,14 @@ class TokenOrchestrator {
             signInDetails: tokens?.signInDetails,
         };
     }
-    async refreshTokens({ tokens, username, }) {
+    async refreshTokens({ tokens, username, clientMetadata, }) {
         try {
             const { signInDetails } = tokens;
             const newTokens = await this.getTokenRefresher()({
                 tokens,
                 authConfig: this.authConfig,
                 username,
+                clientMetadata,
             });
             newTokens.signInDetails = signInDetails;
             await this.setTokens({ tokens: newTokens });
@@ -119,8 +124,10 @@ class TokenOrchestrator {
     }
     handleErrors(err) {
         (0, assertServiceError_1.assertServiceError)(err);
-        if (err.name !== utils_1.AmplifyErrorCode.NetworkError) {
-            // TODO(v6): Check errors on client
+        // Only clear tokens for definitive authentication failures
+        // Do NOT clear tokens for transient errors like service issues, rate limits, etc.
+        const shouldClearTokens = this.isAuthenticationError(err);
+        if (shouldClearTokens) {
             this.clearTokens();
         }
         core_1.Hub.dispatch('auth', {
@@ -132,6 +139,21 @@ class TokenOrchestrator {
         }
         throw err;
     }
+    isAuthenticationError(err) {
+        // Only clear tokens for errors that definitively indicate the tokens are invalid
+        // and re-authentication is required. All other errors (service errors, rate limits, etc.)
+        // should preserve the tokens to allow for retry.
+        // See: https://github.com/aws-amplify/amplify-js/issues/14534
+        const authErrorNames = [
+            'NotAuthorizedException', // Refresh token is expired or invalid
+            'TokenRevokedException', // Token was revoked by admin
+            'UserNotFoundException', // User no longer exists
+            'PasswordResetRequiredException', // User must reset password
+            'UserNotConfirmedException', // User account is not confirmed
+            'RefreshTokenReuseException', // Refresh token invalidated by rotation
+        ];
+        return authErrorNames.some(errorName => err?.name?.startsWith?.(errorName));
+    }
     async setTokens({ tokens }) {
         return this.getTokenStore().storeTokens(tokens);
     }

package/dist/cjs/providers/cognito/tokenProvider/TokenOrchestrator.js.map

@@ -1 +1 @@
-{"version":3,"file":"TokenOrchestrator.js","sources":["../../../../../src/providers/cognito/tokenProvider/TokenOrchestrator.ts"],"sourcesContent":["\"use strict\";\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.TokenOrchestrator = void 0;\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nconst core_1 = require(\"@aws-amplify/core\");\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nconst assertServiceError_1 = require(\"../../../errors/utils/assertServiceError\");\nconst AuthError_1 = require(\"../../../errors/AuthError\");\nconst oAuthStore_1 = require(\"../utils/oauth/oAuthStore\");\nconst inflightPromise_1 = require(\"../utils/oauth/inflightPromise\");\nclass TokenOrchestrator {\n    constructor() {\n        this.waitForInflightOAuth = (0, utils_1.isBrowser)()\n            ? async () => {\n                if (!(await oAuthStore_1.oAuthStore.loadOAuthInFlight())) {\n                    return;\n                }\n                if (this.inflightPromise) {\n                    return this.inflightPromise;\n                }\n                // when there is valid oauth config and there is an inflight oauth flow, try\n                // to block async calls that require fetching tokens before the oauth flow completes\n                // e.g. getCurrentUser, fetchAuthSession etc.\n                this.inflightPromise = new Promise((resolve, _reject) => {\n                    (0, inflightPromise_1.addInflightPromise)(resolve);\n                });\n                return this.inflightPromise;\n            }\n            : async () => {\n                // no-op for non-browser environments\n            };\n    }\n    setAuthConfig(authConfig) {\n        oAuthStore_1.oAuthStore.setAuthConfig(authConfig.Cognito);\n        this.authConfig = authConfig;\n    }\n    setTokenRefresher(tokenRefresher) {\n        this.tokenRefresher = tokenRefresher;\n    }\n    setAuthTokenStore(tokenStore) {\n        this.tokenStore = tokenStore;\n    }\n    getTokenStore() {\n        if (!this.tokenStore) {\n            throw new AuthError_1.AuthError({\n                name: 'EmptyTokenStoreException',\n                message: 'TokenStore not set',\n            });\n        }\n        return this.tokenStore;\n    }\n    getTokenRefresher() {\n        if (!this.tokenRefresher) {\n            throw new AuthError_1.AuthError({\n                name: 'EmptyTokenRefresherException',\n                message: 'TokenRefresher not set',\n            });\n        }\n        return this.tokenRefresher;\n    }\n    async getTokens(options) {\n        let tokens;\n        try {\n            (0, utils_1.assertTokenProviderConfig)(this.authConfig?.Cognito);\n        }\n        catch (_err) {\n            // Token provider not configured\n            return null;\n        }\n        await this.waitForInflightOAuth();\n        this.inflightPromise = undefined;\n        tokens = await this.getTokenStore().loadTokens();\n        const username = await this.getTokenStore().getLastAuthUser();\n        if (tokens === null) {\n            return null;\n        }\n        const idTokenExpired = !!tokens?.idToken &&\n            (0, utils_1.isTokenExpired)({\n                expiresAt: (tokens.idToken?.payload?.exp ?? 0) * 1000,\n                clockDrift: tokens.clockDrift ?? 0,\n            });\n        const accessTokenExpired = (0, utils_1.isTokenExpired)({\n            expiresAt: (tokens.accessToken?.payload?.exp ?? 0) * 1000,\n            clockDrift: tokens.clockDrift ?? 0,\n        });\n        if (options?.forceRefresh || idTokenExpired || accessTokenExpired) {\n            tokens = await this.refreshTokens({\n                tokens,\n                username,\n            });\n            if (tokens === null) {\n                return null;\n            }\n        }\n        return {\n            accessToken: tokens?.accessToken,\n            idToken: tokens?.idToken,\n            signInDetails: tokens?.signInDetails,\n        };\n    }\n    async refreshTokens({ tokens, username, }) {\n        try {\n            const { signInDetails } = tokens;\n            const newTokens = await this.getTokenRefresher()({\n                tokens,\n                authConfig: this.authConfig,\n                username,\n            });\n            newTokens.signInDetails = signInDetails;\n            await this.setTokens({ tokens: newTokens });\n            core_1.Hub.dispatch('auth', { event: 'tokenRefresh' }, 'Auth', utils_1.AMPLIFY_SYMBOL);\n            return newTokens;\n        }\n        catch (err) {\n            return this.handleErrors(err);\n        }\n    }\n    handleErrors(err) {\n        (0, assertServiceError_1.assertServiceError)(err);\n        if (err.name !== utils_1.AmplifyErrorCode.NetworkError) {\n            // TODO(v6): Check errors on client\n            this.clearTokens();\n        }\n        core_1.Hub.dispatch('auth', {\n            event: 'tokenRefresh_failure',\n            data: { error: err },\n        }, 'Auth', utils_1.AMPLIFY_SYMBOL);\n        if (err.name.startsWith('NotAuthorizedException')) {\n            return null;\n        }\n        throw err;\n    }\n    async setTokens({ tokens }) {\n        return this.getTokenStore().storeTokens(tokens);\n    }\n    async clearTokens() {\n        return this.getTokenStore().clearTokens();\n    }\n    getDeviceMetadata(username) {\n        return this.getTokenStore().getDeviceMetadata(username);\n    }\n    clearDeviceMetadata(username) {\n        return this.getTokenStore().clearDeviceMetadata(username);\n    }\n    setOAuthMetadata(metadata) {\n        return this.getTokenStore().setOAuthMetadata(metadata);\n    }\n    getOAuthMetadata() {\n        return this.getTokenStore().getOAuthMetadata();\n    }\n}\nexports.TokenOrchestrator = TokenOrchestrator;\n"],"names":[],"mappings":";;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC7D,OAAO,CAAC,iBAAiB,GAAG,MAAM;AAClC;AACA;AACA,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;AAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC;AAC5D,MAAM,oBAAoB,GAAG,OAAO,CAAC,0CAA0C,CAAC;AAChF,MAAM,WAAW,GAAG,OAAO,CAAC,2BAA2B,CAAC;AACxD,MAAM,YAAY,GAAG,OAAO,CAAC,2BAA2B,CAAC;AACzD,MAAM,iBAAiB,GAAG,OAAO,CAAC,gCAAgC,CAAC;AACnE,MAAM,iBAAiB,CAAC;AACxB,IAAI,WAAW,GAAG;AAClB,QAAQ,IAAI,CAAC,oBAAoB,GAAG,IAAI,OAAO,CAAC,SAAS;AACzD,cAAc,YAAY;AAC1B,gBAAgB,IAAI,EAAE,MAAM,YAAY,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,EAAE;AAC1E,oBAAoB;AACpB,gBAAgB;AAChB,gBAAgB,IAAI,IAAI,CAAC,eAAe,EAAE;AAC1C,oBAAoB,OAAO,IAAI,CAAC,eAAe;AAC/C,gBAAgB;AAChB;AACA;AACA;AACA,gBAAgB,IAAI,CAAC,eAAe,GAAG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,OAAO,KAAK;AACzE,oBAAoB,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,OAAO,CAAC;AACtE,gBAAgB,CAAC,CAAC;AAClB,gBAAgB,OAAO,IAAI,CAAC,eAAe;AAC3C,YAAY;AACZ,cAAc,YAAY;AAC1B;AACA,YAAY,CAAC;AACb,IAAI;AACJ,IAAI,aAAa,CAAC,UAAU,EAAE;AAC9B,QAAQ,YAAY,CAAC,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC;AACjE,QAAQ,IAAI,CAAC,UAAU,GAAG,UAAU;AACpC,IAAI;AACJ,IAAI,iBAAiB,CAAC,cAAc,EAAE;AACtC,QAAQ,IAAI,CAAC,cAAc,GAAG,cAAc;AAC5C,IAAI;AACJ,IAAI,iBAAiB,CAAC,UAAU,EAAE;AAClC,QAAQ,IAAI,CAAC,UAAU,GAAG,UAAU;AACpC,IAAI;AACJ,IAAI,aAAa,GAAG;AACpB,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE;AAC9B,YAAY,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC;AAC5C,gBAAgB,IAAI,EAAE,0BAA0B;AAChD,gBAAgB,OAAO,EAAE,oBAAoB;AAC7C,aAAa,CAAC;AACd,QAAQ;AACR,QAAQ,OAAO,IAAI,CAAC,UAAU;AAC9B,IAAI;AACJ,IAAI,iBAAiB,GAAG;AACxB,QAAQ,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;AAClC,YAAY,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC;AAC5C,gBAAgB,IAAI,EAAE,8BAA8B;AACpD,gBAAgB,OAAO,EAAE,wBAAwB;AACjD,aAAa,CAAC;AACd,QAAQ;AACR,QAAQ,OAAO,IAAI,CAAC,cAAc;AAClC,IAAI;AACJ,IAAI,MAAM,SAAS,CAAC,OAAO,EAAE;AAC7B,QAAQ,IAAI,MAAM;AAClB,QAAQ,IAAI;AACZ,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,yBAAyB,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC;AAC5E,QAAQ;AACR,QAAQ,OAAO,IAAI,EAAE;AACrB;AACA,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,IAAI,CAAC,oBAAoB,EAAE;AACzC,QAAQ,IAAI,CAAC,eAAe,GAAG,SAAS;AACxC,QAAQ,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;AACxD,QAAQ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,eAAe,EAAE;AACrE,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE;AAC7B,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO;AAChD,YAAY,IAAI,OAAO,CAAC,cAAc,EAAE;AACxC,gBAAgB,SAAS,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI;AACrE,gBAAgB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC;AAClD,aAAa,CAAC;AACd,QAAQ,MAAM,kBAAkB,GAAG,IAAI,OAAO,CAAC,cAAc,EAAE;AAC/D,YAAY,SAAS,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI;AACrE,YAAY,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC;AAC9C,SAAS,CAAC;AACV,QAAQ,IAAI,OAAO,EAAE,YAAY,IAAI,cAAc,IAAI,kBAAkB,EAAE;AAC3E,YAAY,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;AAC9C,gBAAgB,MAAM;AACtB,gBAAgB,QAAQ;AACxB,aAAa,CAAC;AACd,YAAY,IAAI,MAAM,KAAK,IAAI,EAAE;AACjC,gBAAgB,OAAO,IAAI;AAC3B,YAAY;AACZ,QAAQ;AACR,QAAQ,OAAO;AACf,YAAY,WAAW,EAAE,MAAM,EAAE,WAAW;AAC5C,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO;AACpC,YAAY,aAAa,EAAE,MAAM,EAAE,aAAa;AAChD,SAAS;AACT,IAAI;AACJ,IAAI,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,EAAE;AAC/C,QAAQ,IAAI;AACZ,YAAY,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM;AAC5C,YAAY,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;AAC7D,gBAAgB,MAAM;AACtB,gBAAgB,UAAU,EAAE,IAAI,CAAC,UAAU;AAC3C,gBAAgB,QAAQ;AACxB,aAAa,CAAC;AACd,YAAY,SAAS,CAAC,aAAa,GAAG,aAAa;AACnD,YAAY,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACvD,YAAY,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC;AAClG,YAAY,OAAO,SAAS;AAC5B,QAAQ;AACR,QAAQ,OAAO,GAAG,EAAE;AACpB,YAAY,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;AACzC,QAAQ;AACR,IAAI;AACJ,IAAI,YAAY,CAAC,GAAG,EAAE;AACtB,QAAQ,IAAI,oBAAoB,CAAC,kBAAkB,EAAE,GAAG,CAAC;AACzD,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,gBAAgB,CAAC,YAAY,EAAE;AAChE;AACA,YAAY,IAAI,CAAC,WAAW,EAAE;AAC9B,QAAQ;AACR,QAAQ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE;AACpC,YAAY,KAAK,EAAE,sBAAsB;AACzC,YAAY,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;AAChC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC;AAC1C,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE;AAC3D,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,GAAG;AACjB,IAAI;AACJ,IAAI,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE;AAChC,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;AACvD,IAAI;AACJ,IAAI,MAAM,WAAW,GAAG;AACxB,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,WAAW,EAAE;AACjD,IAAI;AACJ,IAAI,iBAAiB,CAAC,QAAQ,EAAE;AAChC,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC;AAC/D,IAAI;AACJ,IAAI,mBAAmB,CAAC,QAAQ,EAAE;AAClC,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC;AACjE,IAAI;AACJ,IAAI,gBAAgB,CAAC,QAAQ,EAAE;AAC/B,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC;AAC9D,IAAI;AACJ,IAAI,gBAAgB,GAAG;AACvB,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,gBAAgB,EAAE;AACtD,IAAI;AACJ;AACA,OAAO,CAAC,iBAAiB,GAAG,iBAAiB;;"}
+{"version":3,"file":"TokenOrchestrator.js","sources":["../../../../../src/providers/cognito/tokenProvider/TokenOrchestrator.ts"],"sourcesContent":["\"use strict\";\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.TokenOrchestrator = void 0;\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nconst core_1 = require(\"@aws-amplify/core\");\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nconst assertServiceError_1 = require(\"../../../errors/utils/assertServiceError\");\nconst AuthError_1 = require(\"../../../errors/AuthError\");\nconst oAuthStore_1 = require(\"../utils/oauth/oAuthStore\");\nconst inflightPromise_1 = require(\"../utils/oauth/inflightPromise\");\nclass TokenOrchestrator {\n    constructor() {\n        this.waitForInflightOAuth = (0, utils_1.isBrowser)()\n            ? async () => {\n                if (!(await oAuthStore_1.oAuthStore.loadOAuthInFlight())) {\n                    return;\n                }\n                if (this.inflightPromise) {\n                    return this.inflightPromise;\n                }\n                // when there is valid oauth config and there is an inflight oauth flow, try\n                // to block async calls that require fetching tokens before the oauth flow completes\n                // e.g. getCurrentUser, fetchAuthSession etc.\n                this.inflightPromise = new Promise((resolve, _reject) => {\n                    (0, inflightPromise_1.addInflightPromise)(resolve);\n                });\n                return this.inflightPromise;\n            }\n            : async () => {\n                // no-op for non-browser environments\n            };\n    }\n    setAuthConfig(authConfig) {\n        oAuthStore_1.oAuthStore.setAuthConfig(authConfig.Cognito);\n        this.authConfig = authConfig;\n    }\n    setTokenRefresher(tokenRefresher) {\n        this.tokenRefresher = tokenRefresher;\n    }\n    setAuthTokenStore(tokenStore) {\n        this.tokenStore = tokenStore;\n    }\n    getTokenStore() {\n        if (!this.tokenStore) {\n            throw new AuthError_1.AuthError({\n                name: 'EmptyTokenStoreException',\n                message: 'TokenStore not set',\n            });\n        }\n        return this.tokenStore;\n    }\n    getTokenRefresher() {\n        if (!this.tokenRefresher) {\n            throw new AuthError_1.AuthError({\n                name: 'EmptyTokenRefresherException',\n                message: 'TokenRefresher not set',\n            });\n        }\n        return this.tokenRefresher;\n    }\n    setClientMetadataProvider(clientMetadataProvider) {\n        this.clientMetadataProvider = clientMetadataProvider;\n    }\n    async getTokens(options) {\n        let tokens;\n        try {\n            (0, utils_1.assertTokenProviderConfig)(this.authConfig?.Cognito);\n        }\n        catch (_err) {\n            // Token provider not configured\n            return null;\n        }\n        await this.waitForInflightOAuth();\n        this.inflightPromise = undefined;\n        tokens = await this.getTokenStore().loadTokens();\n        const username = await this.getTokenStore().getLastAuthUser();\n        if (tokens === null) {\n            return null;\n        }\n        const idTokenExpired = !!tokens?.idToken &&\n            (0, utils_1.isTokenExpired)({\n                expiresAt: (tokens.idToken?.payload?.exp ?? 0) * 1000,\n                clockDrift: tokens.clockDrift ?? 0,\n            });\n        const accessTokenExpired = (0, utils_1.isTokenExpired)({\n            expiresAt: (tokens.accessToken?.payload?.exp ?? 0) * 1000,\n            clockDrift: tokens.clockDrift ?? 0,\n        });\n        if (options?.forceRefresh || idTokenExpired || accessTokenExpired) {\n            tokens = await this.refreshTokens({\n                tokens,\n                username,\n                clientMetadata: options?.clientMetadata ?? (await this.clientMetadataProvider?.()),\n            });\n            if (tokens === null) {\n                return null;\n            }\n        }\n        return {\n            accessToken: tokens?.accessToken,\n            idToken: tokens?.idToken,\n            signInDetails: tokens?.signInDetails,\n        };\n    }\n    async refreshTokens({ tokens, username, clientMetadata, }) {\n        try {\n            const { signInDetails } = tokens;\n            const newTokens = await this.getTokenRefresher()({\n                tokens,\n                authConfig: this.authConfig,\n                username,\n                clientMetadata,\n            });\n            newTokens.signInDetails = signInDetails;\n            await this.setTokens({ tokens: newTokens });\n            core_1.Hub.dispatch('auth', { event: 'tokenRefresh' }, 'Auth', utils_1.AMPLIFY_SYMBOL);\n            return newTokens;\n        }\n        catch (err) {\n            return this.handleErrors(err);\n        }\n    }\n    handleErrors(err) {\n        (0, assertServiceError_1.assertServiceError)(err);\n        // Only clear tokens for definitive authentication failures\n        // Do NOT clear tokens for transient errors like service issues, rate limits, etc.\n        const shouldClearTokens = this.isAuthenticationError(err);\n        if (shouldClearTokens) {\n            this.clearTokens();\n        }\n        core_1.Hub.dispatch('auth', {\n            event: 'tokenRefresh_failure',\n            data: { error: err },\n        }, 'Auth', utils_1.AMPLIFY_SYMBOL);\n        if (err.name.startsWith('NotAuthorizedException')) {\n            return null;\n        }\n        throw err;\n    }\n    isAuthenticationError(err) {\n        // Only clear tokens for errors that definitively indicate the tokens are invalid\n        // and re-authentication is required. All other errors (service errors, rate limits, etc.)\n        // should preserve the tokens to allow for retry.\n        // See: https://github.com/aws-amplify/amplify-js/issues/14534\n        const authErrorNames = [\n            'NotAuthorizedException', // Refresh token is expired or invalid\n            'TokenRevokedException', // Token was revoked by admin\n            'UserNotFoundException', // User no longer exists\n            'PasswordResetRequiredException', // User must reset password\n            'UserNotConfirmedException', // User account is not confirmed\n            'RefreshTokenReuseException', // Refresh token invalidated by rotation\n        ];\n        return authErrorNames.some(errorName => err?.name?.startsWith?.(errorName));\n    }\n    async setTokens({ tokens }) {\n        return this.getTokenStore().storeTokens(tokens);\n    }\n    async clearTokens() {\n        return this.getTokenStore().clearTokens();\n    }\n    getDeviceMetadata(username) {\n        return this.getTokenStore().getDeviceMetadata(username);\n    }\n    clearDeviceMetadata(username) {\n        return this.getTokenStore().clearDeviceMetadata(username);\n    }\n    setOAuthMetadata(metadata) {\n        return this.getTokenStore().setOAuthMetadata(metadata);\n    }\n    getOAuthMetadata() {\n        return this.getTokenStore().getOAuthMetadata();\n    }\n}\nexports.TokenOrchestrator = TokenOrchestrator;\n"],"names":[],"mappings":";;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC7D,OAAO,CAAC,iBAAiB,GAAG,MAAM;AAClC;AACA;AACA,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;AAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC;AAC5D,MAAM,oBAAoB,GAAG,OAAO,CAAC,0CAA0C,CAAC;AAChF,MAAM,WAAW,GAAG,OAAO,CAAC,2BAA2B,CAAC;AACxD,MAAM,YAAY,GAAG,OAAO,CAAC,2BAA2B,CAAC;AACzD,MAAM,iBAAiB,GAAG,OAAO,CAAC,gCAAgC,CAAC;AACnE,MAAM,iBAAiB,CAAC;AACxB,IAAI,WAAW,GAAG;AAClB,QAAQ,IAAI,CAAC,oBAAoB,GAAG,IAAI,OAAO,CAAC,SAAS;AACzD,cAAc,YAAY;AAC1B,gBAAgB,IAAI,EAAE,MAAM,YAAY,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,EAAE;AAC1E,oBAAoB;AACpB,gBAAgB;AAChB,gBAAgB,IAAI,IAAI,CAAC,eAAe,EAAE;AAC1C,oBAAoB,OAAO,IAAI,CAAC,eAAe;AAC/C,gBAAgB;AAChB;AACA;AACA;AACA,gBAAgB,IAAI,CAAC,eAAe,GAAG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,OAAO,KAAK;AACzE,oBAAoB,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,OAAO,CAAC;AACtE,gBAAgB,CAAC,CAAC;AAClB,gBAAgB,OAAO,IAAI,CAAC,eAAe;AAC3C,YAAY;AACZ,cAAc,YAAY;AAC1B;AACA,YAAY,CAAC;AACb,IAAI;AACJ,IAAI,aAAa,CAAC,UAAU,EAAE;AAC9B,QAAQ,YAAY,CAAC,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC;AACjE,QAAQ,IAAI,CAAC,UAAU,GAAG,UAAU;AACpC,IAAI;AACJ,IAAI,iBAAiB,CAAC,cAAc,EAAE;AACtC,QAAQ,IAAI,CAAC,cAAc,GAAG,cAAc;AAC5C,IAAI;AACJ,IAAI,iBAAiB,CAAC,UAAU,EAAE;AAClC,QAAQ,IAAI,CAAC,UAAU,GAAG,UAAU;AACpC,IAAI;AACJ,IAAI,aAAa,GAAG;AACpB,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE;AAC9B,YAAY,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC;AAC5C,gBAAgB,IAAI,EAAE,0BAA0B;AAChD,gBAAgB,OAAO,EAAE,oBAAoB;AAC7C,aAAa,CAAC;AACd,QAAQ;AACR,QAAQ,OAAO,IAAI,CAAC,UAAU;AAC9B,IAAI;AACJ,IAAI,iBAAiB,GAAG;AACxB,QAAQ,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;AAClC,YAAY,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC;AAC5C,gBAAgB,IAAI,EAAE,8BAA8B;AACpD,gBAAgB,OAAO,EAAE,wBAAwB;AACjD,aAAa,CAAC;AACd,QAAQ;AACR,QAAQ,OAAO,IAAI,CAAC,cAAc;AAClC,IAAI;AACJ,IAAI,yBAAyB,CAAC,sBAAsB,EAAE;AACtD,QAAQ,IAAI,CAAC,sBAAsB,GAAG,sBAAsB;AAC5D,IAAI;AACJ,IAAI,MAAM,SAAS,CAAC,OAAO,EAAE;AAC7B,QAAQ,IAAI,MAAM;AAClB,QAAQ,IAAI;AACZ,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,yBAAyB,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC;AAC5E,QAAQ;AACR,QAAQ,OAAO,IAAI,EAAE;AACrB;AACA,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,IAAI,CAAC,oBAAoB,EAAE;AACzC,QAAQ,IAAI,CAAC,eAAe,GAAG,SAAS;AACxC,QAAQ,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;AACxD,QAAQ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,eAAe,EAAE;AACrE,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE;AAC7B,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO;AAChD,YAAY,IAAI,OAAO,CAAC,cAAc,EAAE;AACxC,gBAAgB,SAAS,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI;AACrE,gBAAgB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC;AAClD,aAAa,CAAC;AACd,QAAQ,MAAM,kBAAkB,GAAG,IAAI,OAAO,CAAC,cAAc,EAAE;AAC/D,YAAY,SAAS,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI;AACrE,YAAY,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC;AAC9C,SAAS,CAAC;AACV,QAAQ,IAAI,OAAO,EAAE,YAAY,IAAI,cAAc,IAAI,kBAAkB,EAAE;AAC3E,YAAY,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;AAC9C,gBAAgB,MAAM;AACtB,gBAAgB,QAAQ;AACxB,gBAAgB,cAAc,EAAE,OAAO,EAAE,cAAc,KAAK,MAAM,IAAI,CAAC,sBAAsB,IAAI,CAAC;AAClG,aAAa,CAAC;AACd,YAAY,IAAI,MAAM,KAAK,IAAI,EAAE;AACjC,gBAAgB,OAAO,IAAI;AAC3B,YAAY;AACZ,QAAQ;AACR,QAAQ,OAAO;AACf,YAAY,WAAW,EAAE,MAAM,EAAE,WAAW;AAC5C,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO;AACpC,YAAY,aAAa,EAAE,MAAM,EAAE,aAAa;AAChD,SAAS;AACT,IAAI;AACJ,IAAI,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,EAAE;AAC/D,QAAQ,IAAI;AACZ,YAAY,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM;AAC5C,YAAY,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;AAC7D,gBAAgB,MAAM;AACtB,gBAAgB,UAAU,EAAE,IAAI,CAAC,UAAU;AAC3C,gBAAgB,QAAQ;AACxB,gBAAgB,cAAc;AAC9B,aAAa,CAAC;AACd,YAAY,SAAS,CAAC,aAAa,GAAG,aAAa;AACnD,YAAY,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACvD,YAAY,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC;AAClG,YAAY,OAAO,SAAS;AAC5B,QAAQ;AACR,QAAQ,OAAO,GAAG,EAAE;AACpB,YAAY,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;AACzC,QAAQ;AACR,IAAI;AACJ,IAAI,YAAY,CAAC,GAAG,EAAE;AACtB,QAAQ,IAAI,oBAAoB,CAAC,kBAAkB,EAAE,GAAG,CAAC;AACzD;AACA;AACA,QAAQ,MAAM,iBAAiB,GAAG,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC;AACjE,QAAQ,IAAI,iBAAiB,EAAE;AAC/B,YAAY,IAAI,CAAC,WAAW,EAAE;AAC9B,QAAQ;AACR,QAAQ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE;AACpC,YAAY,KAAK,EAAE,sBAAsB;AACzC,YAAY,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;AAChC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC;AAC1C,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE;AAC3D,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,GAAG;AACjB,IAAI;AACJ,IAAI,qBAAqB,CAAC,GAAG,EAAE;AAC/B;AACA;AACA;AACA;AACA,QAAQ,MAAM,cAAc,GAAG;AAC/B,YAAY,wBAAwB;AACpC,YAAY,uBAAuB;AACnC,YAAY,uBAAuB;AACnC,YAAY,gCAAgC;AAC5C,YAAY,2BAA2B;AACvC,YAAY,4BAA4B;AACxC,SAAS;AACT,QAAQ,OAAO,cAAc,CAAC,IAAI,CAAC,SAAS,IAAI,GAAG,EAAE,IAAI,EAAE,UAAU,GAAG,SAAS,CAAC,CAAC;AACnF,IAAI;AACJ,IAAI,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE;AAChC,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;AACvD,IAAI;AACJ,IAAI,MAAM,WAAW,GAAG;AACxB,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,WAAW,EAAE;AACjD,IAAI;AACJ,IAAI,iBAAiB,CAAC,QAAQ,EAAE;AAChC,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC;AAC/D,IAAI;AACJ,IAAI,mBAAmB,CAAC,QAAQ,EAAE;AAClC,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC;AACjE,IAAI;AACJ,IAAI,gBAAgB,CAAC,QAAQ,EAAE;AAC/B,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC;AAC9D,IAAI;AACJ,IAAI,gBAAgB,GAAG;AACvB,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,gBAAgB,EAAE;AACtD,IAAI;AACJ;AACA,OAAO,CAAC,iBAAiB,GAAG,iBAAiB;;"}

package/dist/cjs/providers/cognito/utils/refreshAuthTokens.js

@@ -10,7 +10,7 @@ const types_1 = require("../utils/types");
 const AuthError_1 = require("../../../errors/AuthError");
 const factories_1 = require("../factories");
 const cognitoIdentityProvider_1 = require("../../../foundation/factories/serviceClients/cognitoIdentityProvider");
-const refreshAuthTokensFunction = async ({ tokens, authConfig, username, }) => {
+const refreshAuthTokensFunction = async ({ tokens, authConfig, username, clientMetadata, }) => {
     (0, utils_1.assertTokenProviderConfig)(authConfig?.Cognito);
     const { userPoolId, userPoolClientId, userPoolEndpoint } = authConfig.Cognito;
     const region = (0, parsers_1.getRegionFromUserPoolId)(userPoolId);
@@ -24,6 +24,7 @@ const refreshAuthTokensFunction = async ({ tokens, authConfig, username, }) => {
         ClientId: userPoolClientId,
         RefreshToken: tokens.refreshToken,
         DeviceKey: tokens.deviceMetadata?.deviceKey,
+        ClientMetadata: clientMetadata,
     });
     const accessToken = (0, utils_1.decodeJWT)(AuthenticationResult?.AccessToken ?? '');
     const idToken = AuthenticationResult?.IdToken

package/dist/cjs/providers/cognito/utils/refreshAuthTokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"refreshAuthTokens.js","sources":["../../../../../src/providers/cognito/utils/refreshAuthTokens.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.refreshAuthTokensWithoutDedupe = exports.refreshAuthTokens = void 0;\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nconst parsers_1 = require(\"../../../foundation/parsers\");\nconst types_1 = require(\"../utils/types\");\nconst AuthError_1 = require(\"../../../errors/AuthError\");\nconst factories_1 = require(\"../factories\");\nconst cognitoIdentityProvider_1 = require(\"../../../foundation/factories/serviceClients/cognitoIdentityProvider\");\nconst refreshAuthTokensFunction = async ({ tokens, authConfig, username, }) => {\n    (0, utils_1.assertTokenProviderConfig)(authConfig?.Cognito);\n    const { userPoolId, userPoolClientId, userPoolEndpoint } = authConfig.Cognito;\n    const region = (0, parsers_1.getRegionFromUserPoolId)(userPoolId);\n    (0, types_1.assertAuthTokensWithRefreshToken)(tokens);\n    const getTokensFromRefreshToken = (0, cognitoIdentityProvider_1.createGetTokensFromRefreshTokenClient)({\n        endpointResolver: (0, factories_1.createCognitoUserPoolEndpointResolver)({\n            endpointOverride: userPoolEndpoint,\n        }),\n    });\n    const { AuthenticationResult } = await getTokensFromRefreshToken({ region }, {\n        ClientId: userPoolClientId,\n        RefreshToken: tokens.refreshToken,\n        DeviceKey: tokens.deviceMetadata?.deviceKey,\n    });\n    const accessToken = (0, utils_1.decodeJWT)(AuthenticationResult?.AccessToken ?? '');\n    const idToken = AuthenticationResult?.IdToken\n        ? (0, utils_1.decodeJWT)(AuthenticationResult.IdToken)\n        : undefined;\n    const { iat } = accessToken.payload;\n    // This should never happen. If it does, it's a bug from the service.\n    if (!iat) {\n        throw new AuthError_1.AuthError({\n            name: 'iatNotFoundException',\n            message: 'iat not found in access token',\n        });\n    }\n    const clockDrift = iat * 1000 - new Date().getTime();\n    return {\n        accessToken,\n        idToken,\n        clockDrift,\n        refreshToken: AuthenticationResult?.RefreshToken ?? tokens.refreshToken,\n        username,\n    };\n};\nexports.refreshAuthTokens = (0, utils_1.deDupeAsyncFunction)(refreshAuthTokensFunction);\nexports.refreshAuthTokensWithoutDedupe = refreshAuthTokensFunction;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC7D,OAAO,CAAC,8BAA8B,GAAG,OAAO,CAAC,iBAAiB,GAAG,MAAM;AAC3E,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC;AAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,6BAA6B,CAAC;AACxD,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACzC,MAAM,WAAW,GAAG,OAAO,CAAC,2BAA2B,CAAC;AACxD,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC;AAC3C,MAAM,yBAAyB,GAAG,OAAO,CAAC,sEAAsE,CAAC;AACjH,MAAM,yBAAyB,GAAG,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,GAAG,KAAK;AAC/E,IAAI,IAAI,OAAO,CAAC,yBAAyB,EAAE,UAAU,EAAE,OAAO,CAAC;AAC/D,IAAI,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,UAAU,CAAC,OAAO;AACjF,IAAI,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,uBAAuB,EAAE,UAAU,CAAC;AACrE,IAAI,IAAI,OAAO,CAAC,gCAAgC,EAAE,MAAM,CAAC;AACzD,IAAI,MAAM,yBAAyB,GAAG,IAAI,yBAAyB,CAAC,qCAAqC,EAAE;AAC3G,QAAQ,gBAAgB,EAAE,IAAI,WAAW,CAAC,qCAAqC,EAAE;AACjF,YAAY,gBAAgB,EAAE,gBAAgB;AAC9C,SAAS,CAAC;AACV,KAAK,CAAC;AACN,IAAI,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,yBAAyB,CAAC,EAAE,MAAM,EAAE,EAAE;AACjF,QAAQ,QAAQ,EAAE,gBAAgB;AAClC,QAAQ,YAAY,EAAE,MAAM,CAAC,YAAY;AACzC,QAAQ,SAAS,EAAE,MAAM,CAAC,cAAc,EAAE,SAAS;AACnD,KAAK,CAAC;AACN,IAAI,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,SAAS,EAAE,oBAAoB,EAAE,WAAW,IAAI,EAAE,CAAC;AACvF,IAAI,MAAM,OAAO,GAAG,oBAAoB,EAAE;AAC1C,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,oBAAoB,CAAC,OAAO;AAC7D,UAAU,SAAS;AACnB,IAAI,MAAM,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO;AACvC;AACA,IAAI,IAAI,CAAC,GAAG,EAAE;AACd,QAAQ,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC;AACxC,YAAY,IAAI,EAAE,sBAAsB;AACxC,YAAY,OAAO,EAAE,+BAA+B;AACpD,SAAS,CAAC;AACV,IAAI;AACJ,IAAI,MAAM,UAAU,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE;AACxD,IAAI,OAAO;AACX,QAAQ,WAAW;AACnB,QAAQ,OAAO;AACf,QAAQ,UAAU;AAClB,QAAQ,YAAY,EAAE,oBAAoB,EAAE,YAAY,IAAI,MAAM,CAAC,YAAY;AAC/E,QAAQ,QAAQ;AAChB,KAAK;AACL,CAAC;AACD,OAAO,CAAC,iBAAiB,GAAG,IAAI,OAAO,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;AACvF,OAAO,CAAC,8BAA8B,GAAG,yBAAyB;;"}
+{"version":3,"file":"refreshAuthTokens.js","sources":["../../../../../src/providers/cognito/utils/refreshAuthTokens.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.refreshAuthTokensWithoutDedupe = exports.refreshAuthTokens = void 0;\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nconst parsers_1 = require(\"../../../foundation/parsers\");\nconst types_1 = require(\"../utils/types\");\nconst AuthError_1 = require(\"../../../errors/AuthError\");\nconst factories_1 = require(\"../factories\");\nconst cognitoIdentityProvider_1 = require(\"../../../foundation/factories/serviceClients/cognitoIdentityProvider\");\nconst refreshAuthTokensFunction = async ({ tokens, authConfig, username, clientMetadata, }) => {\n    (0, utils_1.assertTokenProviderConfig)(authConfig?.Cognito);\n    const { userPoolId, userPoolClientId, userPoolEndpoint } = authConfig.Cognito;\n    const region = (0, parsers_1.getRegionFromUserPoolId)(userPoolId);\n    (0, types_1.assertAuthTokensWithRefreshToken)(tokens);\n    const getTokensFromRefreshToken = (0, cognitoIdentityProvider_1.createGetTokensFromRefreshTokenClient)({\n        endpointResolver: (0, factories_1.createCognitoUserPoolEndpointResolver)({\n            endpointOverride: userPoolEndpoint,\n        }),\n    });\n    const { AuthenticationResult } = await getTokensFromRefreshToken({ region }, {\n        ClientId: userPoolClientId,\n        RefreshToken: tokens.refreshToken,\n        DeviceKey: tokens.deviceMetadata?.deviceKey,\n        ClientMetadata: clientMetadata,\n    });\n    const accessToken = (0, utils_1.decodeJWT)(AuthenticationResult?.AccessToken ?? '');\n    const idToken = AuthenticationResult?.IdToken\n        ? (0, utils_1.decodeJWT)(AuthenticationResult.IdToken)\n        : undefined;\n    const { iat } = accessToken.payload;\n    // This should never happen. If it does, it's a bug from the service.\n    if (!iat) {\n        throw new AuthError_1.AuthError({\n            name: 'iatNotFoundException',\n            message: 'iat not found in access token',\n        });\n    }\n    const clockDrift = iat * 1000 - new Date().getTime();\n    return {\n        accessToken,\n        idToken,\n        clockDrift,\n        refreshToken: AuthenticationResult?.RefreshToken ?? tokens.refreshToken,\n        username,\n    };\n};\nexports.refreshAuthTokens = (0, utils_1.deDupeAsyncFunction)(refreshAuthTokensFunction);\nexports.refreshAuthTokensWithoutDedupe = refreshAuthTokensFunction;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC7D,OAAO,CAAC,8BAA8B,GAAG,OAAO,CAAC,iBAAiB,GAAG,MAAM;AAC3E,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC;AAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,6BAA6B,CAAC;AACxD,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACzC,MAAM,WAAW,GAAG,OAAO,CAAC,2BAA2B,CAAC;AACxD,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC;AAC3C,MAAM,yBAAyB,GAAG,OAAO,CAAC,sEAAsE,CAAC;AACjH,MAAM,yBAAyB,GAAG,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,GAAG,KAAK;AAC/F,IAAI,IAAI,OAAO,CAAC,yBAAyB,EAAE,UAAU,EAAE,OAAO,CAAC;AAC/D,IAAI,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,UAAU,CAAC,OAAO;AACjF,IAAI,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,uBAAuB,EAAE,UAAU,CAAC;AACrE,IAAI,IAAI,OAAO,CAAC,gCAAgC,EAAE,MAAM,CAAC;AACzD,IAAI,MAAM,yBAAyB,GAAG,IAAI,yBAAyB,CAAC,qCAAqC,EAAE;AAC3G,QAAQ,gBAAgB,EAAE,IAAI,WAAW,CAAC,qCAAqC,EAAE;AACjF,YAAY,gBAAgB,EAAE,gBAAgB;AAC9C,SAAS,CAAC;AACV,KAAK,CAAC;AACN,IAAI,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,yBAAyB,CAAC,EAAE,MAAM,EAAE,EAAE;AACjF,QAAQ,QAAQ,EAAE,gBAAgB;AAClC,QAAQ,YAAY,EAAE,MAAM,CAAC,YAAY;AACzC,QAAQ,SAAS,EAAE,MAAM,CAAC,cAAc,EAAE,SAAS;AACnD,QAAQ,cAAc,EAAE,cAAc;AACtC,KAAK,CAAC;AACN,IAAI,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,SAAS,EAAE,oBAAoB,EAAE,WAAW,IAAI,EAAE,CAAC;AACvF,IAAI,MAAM,OAAO,GAAG,oBAAoB,EAAE;AAC1C,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,oBAAoB,CAAC,OAAO;AAC7D,UAAU,SAAS;AACnB,IAAI,MAAM,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO;AACvC;AACA,IAAI,IAAI,CAAC,GAAG,EAAE;AACd,QAAQ,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC;AACxC,YAAY,IAAI,EAAE,sBAAsB;AACxC,YAAY,OAAO,EAAE,+BAA+B;AACpD,SAAS,CAAC;AACV,IAAI;AACJ,IAAI,MAAM,UAAU,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE;AACxD,IAAI,OAAO;AACX,QAAQ,WAAW;AACnB,QAAQ,OAAO;AACf,QAAQ,UAAU;AAClB,QAAQ,YAAY,EAAE,oBAAoB,EAAE,YAAY,IAAI,MAAM,CAAC,YAAY;AAC/E,QAAQ,QAAQ;AAChB,KAAK;AACL,CAAC;AACD,OAAO,CAAC,iBAAiB,GAAG,IAAI,OAAO,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;AACvF,OAAO,CAAC,8BAA8B,GAAG,yBAAyB;;"}

package/dist/esm/providers/cognito/apis/signInWithRedirect.mjs

@@ -37,16 +37,21 @@ async function signInWithRedirect(input) {
         await assertUserNotAuthenticated();
     }
     let provider = 'COGNITO'; // Default
+    let idpIdentifier;
     if (typeof input?.provider === 'string') {
         provider = cognitoHostedUIIdentityProviderMap[input.provider];
     }
     else if (input?.provider?.custom) {
         provider = input.provider.custom;
     }
+    else if (input?.provider?.idpIdentifier) {
+        ({ idpIdentifier } = input.provider);
+    }
     return oauthSignIn({
         oauthConfig: authConfig.loginWith.oauth,
         clientId: authConfig.userPoolClientId,
         provider,
+        idpIdentifier,
         customState: input?.customState,
         preferPrivateSession: input?.options?.preferPrivateSession,
         options: {
@@ -58,7 +63,7 @@ async function signInWithRedirect(input) {
         authSessionOpener: input?.options?.authSessionOpener,
     });
 }
-const oauthSignIn = async ({ oauthConfig, provider, clientId, customState, preferPrivateSession, options, authSessionOpener, }) => {
+const oauthSignIn = async ({ oauthConfig, provider, idpIdentifier, clientId, customState, preferPrivateSession, options, authSessionOpener, }) => {
     const { domain, redirectSignIn, responseType, scopes } = oauthConfig;
     const { loginHint, lang, nonce, prompt } = options ?? {};
     const randomState = generateState();
@@ -82,9 +87,15 @@ const oauthSignIn = async ({ oauthConfig, provider, clientId, customState, prefe
         ['redirect_uri', redirectUri],
         ['response_type', responseType],
         ['client_id', clientId],
-        ['identity_provider', provider],
-        ['scope', scopes.join(' ')],
     ]);
+    // Add either identity_provider or idp_identifier, but not both
+    if (idpIdentifier) {
+        params.append('idp_identifier', idpIdentifier);
+    }
+    else {
+        params.append('identity_provider', provider);
+    }
+    params.append('scope', scopes.join(' '));
     loginHint && params.append('login_hint', loginHint);
     lang && params.append('lang', lang);
     nonce && params.append('nonce', nonce);

package/dist/esm/providers/cognito/apis/signInWithRedirect.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"signInWithRedirect.mjs","sources":["../../../../../src/providers/cognito/apis/signInWithRedirect.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { Amplify } from '@aws-amplify/core';\nimport { AuthAction, assertOAuthConfig, assertTokenProviderConfig, isBrowser, urlSafeEncode, } from '@aws-amplify/core/internals/utils';\nimport '../utils/oauth/enableOAuthListener';\nimport { cognitoHostedUIIdentityProviderMap } from '../types/models';\nimport { openAuthSession as _openAuthSession, getAuthUserAgentValue, } from '../../../utils';\nimport { assertUserNotAuthenticated } from '../utils/signInHelpers';\nimport { completeOAuthFlow, generateCodeVerifier, generateState, getRedirectUrl, handleFailure, oAuthStore, } from '../utils/oauth';\nimport { createOAuthError } from '../utils/oauth/createOAuthError';\nimport { listenForOAuthFlowCancellation } from '../utils/oauth/cancelOAuthFlow';\n/**\n * Signs in a user with OAuth. Redirects the application to an Identity Provider.\n *\n * @param input - The SignInWithRedirectInput object, if empty it will redirect to Cognito HostedUI\n *\n * @throws AuthTokenConfigException - Thrown when the user pool config is invalid.\n * @throws OAuthNotConfigureException - Thrown when the oauth config is invalid.\n */\nexport async function signInWithRedirect(input) {\n    const authConfig = Amplify.getConfig().Auth?.Cognito;\n    assertTokenProviderConfig(authConfig);\n    assertOAuthConfig(authConfig);\n    oAuthStore.setAuthConfig(authConfig);\n    if (!input?.options?.prompt) {\n        await assertUserNotAuthenticated();\n    }\n    let provider = 'COGNITO'; // Default\n    if (typeof input?.provider === 'string') {\n        provider = cognitoHostedUIIdentityProviderMap[input.provider];\n    }\n    else if (input?.provider?.custom) {\n        provider = input.provider.custom;\n    }\n    return oauthSignIn({\n        oauthConfig: authConfig.loginWith.oauth,\n        clientId: authConfig.userPoolClientId,\n        provider,\n        customState: input?.customState,\n        preferPrivateSession: input?.options?.preferPrivateSession,\n        options: {\n            loginHint: input?.options?.loginHint,\n            lang: input?.options?.lang,\n            nonce: input?.options?.nonce,\n            prompt: input?.options?.prompt,\n        },\n        authSessionOpener: input?.options?.authSessionOpener,\n    });\n}\nconst oauthSignIn = async ({ oauthConfig, provider, clientId, customState, preferPrivateSession, options, authSessionOpener, }) => {\n    const { domain, redirectSignIn, responseType, scopes } = oauthConfig;\n    const { loginHint, lang, nonce, prompt } = options ?? {};\n    const randomState = generateState();\n    const openAuthSession = authSessionOpener || _openAuthSession;\n    /* encodeURIComponent is not URL safe, use urlSafeEncode instead. Cognito\n    single-encodes/decodes url on first sign in and double-encodes/decodes url\n    when user already signed in. Using encodeURIComponent, Base32, Base64 add\n    characters % or = which on further encoding becomes unsafe. '=' create issue\n    for parsing query params.\n    Refer: https://github.com/aws-amplify/amplify-js/issues/5218 */\n    const state = customState\n        ? `${randomState}-${urlSafeEncode(customState)}`\n        : randomState;\n    const { value, method, toCodeChallenge } = generateCodeVerifier(128);\n    const redirectUri = getRedirectUrl(oauthConfig.redirectSignIn);\n    if (isBrowser())\n        oAuthStore.storeOAuthInFlight(true);\n    oAuthStore.storeOAuthState(state);\n    oAuthStore.storePKCE(value);\n    const params = new URLSearchParams([\n        ['redirect_uri', redirectUri],\n        ['response_type', responseType],\n        ['client_id', clientId],\n        ['identity_provider', provider],\n        ['scope', scopes.join(' ')],\n    ]);\n    loginHint && params.append('login_hint', loginHint);\n    lang && params.append('lang', lang);\n    nonce && params.append('nonce', nonce);\n    prompt && params.append('prompt', prompt.toLowerCase());\n    params.append('state', state);\n    if (responseType === 'code') {\n        params.append('code_challenge', toCodeChallenge());\n        params.append('code_challenge_method', method);\n    }\n    // Using URL object is not supported in React Native as the `search` property is read-only\n    // See: https://github.com/facebook/react-native/blob/main/packages/react-native/Libraries/Blob/URL.js\n    const oAuthUrl = `https://${domain}/oauth2/authorize?${params.toString()}`;\n    // this will only take effect in the following scenarios:\n    // 1. the user cancels the OAuth flow on web via back button, and\n    // 2. when bfcache is enabled\n    listenForOAuthFlowCancellation(oAuthStore);\n    // the following is effective only in react-native as openAuthSession resolves only in react-native\n    const { type, error, url } = (await openAuthSession(oAuthUrl, redirectSignIn, preferPrivateSession)) ??\n        {};\n    try {\n        if (type === 'error') {\n            throw createOAuthError(String(error));\n        }\n        if (type === 'canceled') {\n            throw createOAuthError(String(type));\n        }\n        if (type === 'success' && url) {\n            await completeOAuthFlow({\n                currentUrl: url,\n                clientId,\n                domain,\n                redirectUri,\n                responseType,\n                userAgentValue: getAuthUserAgentValue(AuthAction.SignInWithRedirect),\n                preferPrivateSession,\n            });\n        }\n    }\n    catch (err) {\n        await handleFailure(err);\n        // rethrow the error so it can be caught by `await signInWithRedirect()` in react-native\n        throw err;\n    }\n};\n"],"names":["openAuthSession","_openAuthSession"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AACA;AAUA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAe,kBAAkB,CAAC,KAAK,EAAE;AAChD,IAAI,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO;AACxD,IAAI,yBAAyB,CAAC,UAAU,CAAC;AACzC,IAAI,iBAAiB,CAAC,UAAU,CAAC;AACjC,IAAI,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC;AACxC,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE;AACjC,QAAQ,MAAM,0BAA0B,EAAE;AAC1C,IAAI;AACJ,IAAI,IAAI,QAAQ,GAAG,SAAS,CAAC;AAC7B,IAAI,IAAI,OAAO,KAAK,EAAE,QAAQ,KAAK,QAAQ,EAAE;AAC7C,QAAQ,QAAQ,GAAG,kCAAkC,CAAC,KAAK,CAAC,QAAQ,CAAC;AACrE,IAAI;AACJ,SAAS,IAAI,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE;AACtC,QAAQ,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM;AACxC,IAAI;AACJ,IAAI,OAAO,WAAW,CAAC;AACvB,QAAQ,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK;AAC/C,QAAQ,QAAQ,EAAE,UAAU,CAAC,gBAAgB;AAC7C,QAAQ,QAAQ;AAChB,QAAQ,WAAW,EAAE,KAAK,EAAE,WAAW;AACvC,QAAQ,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB;AAClE,QAAQ,OAAO,EAAE;AACjB,YAAY,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS;AAChD,YAAY,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI;AACtC,YAAY,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AACxC,YAAY,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM;AAC1C,SAAS;AACT,QAAQ,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB;AAC5D,KAAK,CAAC;AACN;AACA,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,OAAO,EAAE,iBAAiB,GAAG,KAAK;AACnI,IAAI,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,WAAW;AACxE,IAAI,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,IAAI,EAAE;AAC5D,IAAI,MAAM,WAAW,GAAG,aAAa,EAAE;AACvC,IAAI,MAAMA,iBAAe,GAAG,iBAAiB,IAAIC,eAAgB;AACjE;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,KAAK,GAAG;AAClB,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;AACvD,UAAU,WAAW;AACrB,IAAI,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC;AACxE,IAAI,MAAM,WAAW,GAAG,cAAc,CAAC,WAAW,CAAC,cAAc,CAAC;AAClE,IAAI,IAAI,SAAS,EAAE;AACnB,QAAQ,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC;AAC3C,IAAI,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC;AACrC,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC;AAC/B,IAAI,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;AACvC,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC;AACrC,QAAQ,CAAC,eAAe,EAAE,YAAY,CAAC;AACvC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC;AAC/B,QAAQ,CAAC,mBAAmB,EAAE,QAAQ,CAAC;AACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnC,KAAK,CAAC;AACN,IAAI,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC;AACvD,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;AACvC,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;AAC1C,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;AAC3D,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;AACjC,IAAI,IAAI,YAAY,KAAK,MAAM,EAAE;AACjC,QAAQ,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,eAAe,EAAE,CAAC;AAC1D,QAAQ,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC;AACtD,IAAI;AACJ;AACA;AACA,IAAI,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC9E;AACA;AACA;AACA,IAAI,8BAA8B,CAAC,UAAU,CAAC;AAC9C;AACA,IAAI,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,MAAMD,iBAAe,CAAC,QAAQ,EAAE,cAAc,EAAE,oBAAoB,CAAC;AACvG,QAAQ,EAAE;AACV,IAAI,IAAI;AACR,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE;AAC9B,YAAY,MAAM,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjD,QAAQ;AACR,QAAQ,IAAI,IAAI,KAAK,UAAU,EAAE;AACjC,YAAY,MAAM,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAChD,QAAQ;AACR,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,EAAE;AACvC,YAAY,MAAM,iBAAiB,CAAC;AACpC,gBAAgB,UAAU,EAAE,GAAG;AAC/B,gBAAgB,QAAQ;AACxB,gBAAgB,MAAM;AACtB,gBAAgB,WAAW;AAC3B,gBAAgB,YAAY;AAC5B,gBAAgB,cAAc,EAAE,qBAAqB,CAAC,UAAU,CAAC,kBAAkB,CAAC;AACpF,gBAAgB,oBAAoB;AACpC,aAAa,CAAC;AACd,QAAQ;AACR,IAAI;AACJ,IAAI,OAAO,GAAG,EAAE;AAChB,QAAQ,MAAM,aAAa,CAAC,GAAG,CAAC;AAChC;AACA,QAAQ,MAAM,GAAG;AACjB,IAAI;AACJ,CAAC;;;;"}
+{"version":3,"file":"signInWithRedirect.mjs","sources":["../../../../../src/providers/cognito/apis/signInWithRedirect.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { Amplify } from '@aws-amplify/core';\nimport { AuthAction, assertOAuthConfig, assertTokenProviderConfig, isBrowser, urlSafeEncode, } from '@aws-amplify/core/internals/utils';\nimport '../utils/oauth/enableOAuthListener';\nimport { cognitoHostedUIIdentityProviderMap } from '../types/models';\nimport { openAuthSession as _openAuthSession, getAuthUserAgentValue, } from '../../../utils';\nimport { assertUserNotAuthenticated } from '../utils/signInHelpers';\nimport { completeOAuthFlow, generateCodeVerifier, generateState, getRedirectUrl, handleFailure, oAuthStore, } from '../utils/oauth';\nimport { createOAuthError } from '../utils/oauth/createOAuthError';\nimport { listenForOAuthFlowCancellation } from '../utils/oauth/cancelOAuthFlow';\n/**\n * Signs in a user with OAuth. Redirects the application to an Identity Provider.\n *\n * @param input - The SignInWithRedirectInput object, if empty it will redirect to Cognito HostedUI\n *\n * @throws AuthTokenConfigException - Thrown when the user pool config is invalid.\n * @throws OAuthNotConfigureException - Thrown when the oauth config is invalid.\n */\nexport async function signInWithRedirect(input) {\n    const authConfig = Amplify.getConfig().Auth?.Cognito;\n    assertTokenProviderConfig(authConfig);\n    assertOAuthConfig(authConfig);\n    oAuthStore.setAuthConfig(authConfig);\n    if (!input?.options?.prompt) {\n        await assertUserNotAuthenticated();\n    }\n    let provider = 'COGNITO'; // Default\n    let idpIdentifier;\n    if (typeof input?.provider === 'string') {\n        provider = cognitoHostedUIIdentityProviderMap[input.provider];\n    }\n    else if (input?.provider?.custom) {\n        provider = input.provider.custom;\n    }\n    else if (input?.provider?.idpIdentifier) {\n        ({ idpIdentifier } = input.provider);\n    }\n    return oauthSignIn({\n        oauthConfig: authConfig.loginWith.oauth,\n        clientId: authConfig.userPoolClientId,\n        provider,\n        idpIdentifier,\n        customState: input?.customState,\n        preferPrivateSession: input?.options?.preferPrivateSession,\n        options: {\n            loginHint: input?.options?.loginHint,\n            lang: input?.options?.lang,\n            nonce: input?.options?.nonce,\n            prompt: input?.options?.prompt,\n        },\n        authSessionOpener: input?.options?.authSessionOpener,\n    });\n}\nconst oauthSignIn = async ({ oauthConfig, provider, idpIdentifier, clientId, customState, preferPrivateSession, options, authSessionOpener, }) => {\n    const { domain, redirectSignIn, responseType, scopes } = oauthConfig;\n    const { loginHint, lang, nonce, prompt } = options ?? {};\n    const randomState = generateState();\n    const openAuthSession = authSessionOpener || _openAuthSession;\n    /* encodeURIComponent is not URL safe, use urlSafeEncode instead. Cognito\n    single-encodes/decodes url on first sign in and double-encodes/decodes url\n    when user already signed in. Using encodeURIComponent, Base32, Base64 add\n    characters % or = which on further encoding becomes unsafe. '=' create issue\n    for parsing query params.\n    Refer: https://github.com/aws-amplify/amplify-js/issues/5218 */\n    const state = customState\n        ? `${randomState}-${urlSafeEncode(customState)}`\n        : randomState;\n    const { value, method, toCodeChallenge } = generateCodeVerifier(128);\n    const redirectUri = getRedirectUrl(oauthConfig.redirectSignIn);\n    if (isBrowser())\n        oAuthStore.storeOAuthInFlight(true);\n    oAuthStore.storeOAuthState(state);\n    oAuthStore.storePKCE(value);\n    const params = new URLSearchParams([\n        ['redirect_uri', redirectUri],\n        ['response_type', responseType],\n        ['client_id', clientId],\n    ]);\n    // Add either identity_provider or idp_identifier, but not both\n    if (idpIdentifier) {\n        params.append('idp_identifier', idpIdentifier);\n    }\n    else {\n        params.append('identity_provider', provider);\n    }\n    params.append('scope', scopes.join(' '));\n    loginHint && params.append('login_hint', loginHint);\n    lang && params.append('lang', lang);\n    nonce && params.append('nonce', nonce);\n    prompt && params.append('prompt', prompt.toLowerCase());\n    params.append('state', state);\n    if (responseType === 'code') {\n        params.append('code_challenge', toCodeChallenge());\n        params.append('code_challenge_method', method);\n    }\n    // Using URL object is not supported in React Native as the `search` property is read-only\n    // See: https://github.com/facebook/react-native/blob/main/packages/react-native/Libraries/Blob/URL.js\n    const oAuthUrl = `https://${domain}/oauth2/authorize?${params.toString()}`;\n    // this will only take effect in the following scenarios:\n    // 1. the user cancels the OAuth flow on web via back button, and\n    // 2. when bfcache is enabled\n    listenForOAuthFlowCancellation(oAuthStore);\n    // the following is effective only in react-native as openAuthSession resolves only in react-native\n    const { type, error, url } = (await openAuthSession(oAuthUrl, redirectSignIn, preferPrivateSession)) ??\n        {};\n    try {\n        if (type === 'error') {\n            throw createOAuthError(String(error));\n        }\n        if (type === 'canceled') {\n            throw createOAuthError(String(type));\n        }\n        if (type === 'success' && url) {\n            await completeOAuthFlow({\n                currentUrl: url,\n                clientId,\n                domain,\n                redirectUri,\n                responseType,\n                userAgentValue: getAuthUserAgentValue(AuthAction.SignInWithRedirect),\n                preferPrivateSession,\n            });\n        }\n    }\n    catch (err) {\n        await handleFailure(err);\n        // rethrow the error so it can be caught by `await signInWithRedirect()` in react-native\n        throw err;\n    }\n};\n"],"names":["openAuthSession","_openAuthSession"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AACA;AAUA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAe,kBAAkB,CAAC,KAAK,EAAE;AAChD,IAAI,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO;AACxD,IAAI,yBAAyB,CAAC,UAAU,CAAC;AACzC,IAAI,iBAAiB,CAAC,UAAU,CAAC;AACjC,IAAI,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC;AACxC,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE;AACjC,QAAQ,MAAM,0BAA0B,EAAE;AAC1C,IAAI;AACJ,IAAI,IAAI,QAAQ,GAAG,SAAS,CAAC;AAC7B,IAAI,IAAI,aAAa;AACrB,IAAI,IAAI,OAAO,KAAK,EAAE,QAAQ,KAAK,QAAQ,EAAE;AAC7C,QAAQ,QAAQ,GAAG,kCAAkC,CAAC,KAAK,CAAC,QAAQ,CAAC;AACrE,IAAI;AACJ,SAAS,IAAI,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE;AACtC,QAAQ,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM;AACxC,IAAI;AACJ,SAAS,IAAI,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE;AAC7C,QAAQ,CAAC,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC,QAAQ;AAC3C,IAAI;AACJ,IAAI,OAAO,WAAW,CAAC;AACvB,QAAQ,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK;AAC/C,QAAQ,QAAQ,EAAE,UAAU,CAAC,gBAAgB;AAC7C,QAAQ,QAAQ;AAChB,QAAQ,aAAa;AACrB,QAAQ,WAAW,EAAE,KAAK,EAAE,WAAW;AACvC,QAAQ,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB;AAClE,QAAQ,OAAO,EAAE;AACjB,YAAY,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS;AAChD,YAAY,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI;AACtC,YAAY,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AACxC,YAAY,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM;AAC1C,SAAS;AACT,QAAQ,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB;AAC5D,KAAK,CAAC;AACN;AACA,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,OAAO,EAAE,iBAAiB,GAAG,KAAK;AAClJ,IAAI,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,WAAW;AACxE,IAAI,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,IAAI,EAAE;AAC5D,IAAI,MAAM,WAAW,GAAG,aAAa,EAAE;AACvC,IAAI,MAAMA,iBAAe,GAAG,iBAAiB,IAAIC,eAAgB;AACjE;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,KAAK,GAAG;AAClB,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;AACvD,UAAU,WAAW;AACrB,IAAI,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC;AACxE,IAAI,MAAM,WAAW,GAAG,cAAc,CAAC,WAAW,CAAC,cAAc,CAAC;AAClE,IAAI,IAAI,SAAS,EAAE;AACnB,QAAQ,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC;AAC3C,IAAI,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC;AACrC,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC;AAC/B,IAAI,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;AACvC,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC;AACrC,QAAQ,CAAC,eAAe,EAAE,YAAY,CAAC;AACvC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC;AAC/B,KAAK,CAAC;AACN;AACA,IAAI,IAAI,aAAa,EAAE;AACvB,QAAQ,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,aAAa,CAAC;AACtD,IAAI;AACJ,SAAS;AACT,QAAQ,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,QAAQ,CAAC;AACpD,IAAI;AACJ,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5C,IAAI,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC;AACvD,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;AACvC,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;AAC1C,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;AAC3D,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;AACjC,IAAI,IAAI,YAAY,KAAK,MAAM,EAAE;AACjC,QAAQ,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,eAAe,EAAE,CAAC;AAC1D,QAAQ,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC;AACtD,IAAI;AACJ;AACA;AACA,IAAI,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC9E;AACA;AACA;AACA,IAAI,8BAA8B,CAAC,UAAU,CAAC;AAC9C;AACA,IAAI,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,MAAMD,iBAAe,CAAC,QAAQ,EAAE,cAAc,EAAE,oBAAoB,CAAC;AACvG,QAAQ,EAAE;AACV,IAAI,IAAI;AACR,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE;AAC9B,YAAY,MAAM,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjD,QAAQ;AACR,QAAQ,IAAI,IAAI,KAAK,UAAU,EAAE;AACjC,YAAY,MAAM,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAChD,QAAQ;AACR,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,EAAE;AACvC,YAAY,MAAM,iBAAiB,CAAC;AACpC,gBAAgB,UAAU,EAAE,GAAG;AAC/B,gBAAgB,QAAQ;AACxB,gBAAgB,MAAM;AACtB,gBAAgB,WAAW;AAC3B,gBAAgB,YAAY;AAC5B,gBAAgB,cAAc,EAAE,qBAAqB,CAAC,UAAU,CAAC,kBAAkB,CAAC;AACpF,gBAAgB,oBAAoB;AACpC,aAAa,CAAC;AACd,QAAQ;AACR,IAAI;AACJ,IAAI,OAAO,GAAG,EAAE;AAChB,QAAQ,MAAM,aAAa,CAAC,GAAG,CAAC;AAChC;AACA,QAAQ,MAAM,GAAG;AACjB,IAAI;AACJ,CAAC;;;;"}

package/dist/esm/providers/cognito/tokenProvider/CognitoUserPoolsTokenProvider.d.ts

@@ -1,4 +1,4 @@
-import { AuthConfig, AuthTokens, FetchAuthSessionOptions, KeyValueStorageInterface } from '@aws-amplify/core';
+import { AuthConfig, AuthTokens, ClientMetadataProvider, FetchAuthSessionOptions, KeyValueStorageInterface } from '@aws-amplify/core';
 import { DefaultTokenStore } from './TokenStore';
 import { TokenOrchestrator } from './TokenOrchestrator';
 import { CognitoUserPoolTokenProviderType } from './types';
@@ -6,7 +6,8 @@ export declare class CognitoUserPoolsTokenProvider implements CognitoUserPoolTok
     authTokenStore: DefaultTokenStore;
     tokenOrchestrator: TokenOrchestrator;
     constructor();
-    getTokens({ forceRefresh }?: FetchAuthSessionOptions): Promise<AuthTokens | null>;
+    getTokens(options?: FetchAuthSessionOptions): Promise<AuthTokens | null>;
     setKeyValueStorage(keyValueStorage: KeyValueStorageInterface): void;
+    setClientMetadataProvider(clientMetadataProvider: ClientMetadataProvider): void;
     setAuthConfig(authConfig: AuthConfig): void;
 }

package/dist/esm/providers/cognito/tokenProvider/CognitoUserPoolsTokenProvider.mjs

@@ -13,12 +13,15 @@ class CognitoUserPoolsTokenProvider {
         this.tokenOrchestrator.setAuthTokenStore(this.authTokenStore);
         this.tokenOrchestrator.setTokenRefresher(refreshAuthTokens);
     }
-    getTokens({ forceRefresh } = { forceRefresh: false }) {
-        return this.tokenOrchestrator.getTokens({ forceRefresh });
+    getTokens(options = {}) {
+        return this.tokenOrchestrator.getTokens(options);
     }
     setKeyValueStorage(keyValueStorage) {
         this.authTokenStore.setKeyValueStorage(keyValueStorage);
     }
+    setClientMetadataProvider(clientMetadataProvider) {
+        this.tokenOrchestrator.setClientMetadataProvider(clientMetadataProvider);
+    }
     setAuthConfig(authConfig) {
         this.authTokenStore.setAuthConfig(authConfig);
         this.tokenOrchestrator.setAuthConfig(authConfig);

package/dist/esm/providers/cognito/tokenProvider/CognitoUserPoolsTokenProvider.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"CognitoUserPoolsTokenProvider.mjs","sources":["../../../../../src/providers/cognito/tokenProvider/CognitoUserPoolsTokenProvider.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { defaultStorage, } from '@aws-amplify/core';\nimport { refreshAuthTokens } from '../utils/refreshAuthTokens';\nimport { DefaultTokenStore } from './TokenStore';\nimport { TokenOrchestrator } from './TokenOrchestrator';\nexport class CognitoUserPoolsTokenProvider {\n    constructor() {\n        this.authTokenStore = new DefaultTokenStore();\n        this.authTokenStore.setKeyValueStorage(defaultStorage);\n        this.tokenOrchestrator = new TokenOrchestrator();\n        this.tokenOrchestrator.setAuthTokenStore(this.authTokenStore);\n        this.tokenOrchestrator.setTokenRefresher(refreshAuthTokens);\n    }\n    getTokens({ forceRefresh } = { forceRefresh: false }) {\n        return this.tokenOrchestrator.getTokens({ forceRefresh });\n    }\n    setKeyValueStorage(keyValueStorage) {\n        this.authTokenStore.setKeyValueStorage(keyValueStorage);\n    }\n    setAuthConfig(authConfig) {\n        this.authTokenStore.setAuthConfig(authConfig);\n        this.tokenOrchestrator.setAuthConfig(authConfig);\n    }\n}\n"],"names":[],"mappings":";;;;;AAAA;AACA;AAKO,MAAM,6BAA6B,CAAC;AAC3C,IAAI,WAAW,GAAG;AAClB,QAAQ,IAAI,CAAC,cAAc,GAAG,IAAI,iBAAiB,EAAE;AACrD,QAAQ,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,cAAc,CAAC;AAC9D,QAAQ,IAAI,CAAC,iBAAiB,GAAG,IAAI,iBAAiB,EAAE;AACxD,QAAQ,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC;AACrE,QAAQ,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;AACnE,IAAI;AACJ,IAAI,SAAS,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE;AAC1D,QAAQ,OAAO,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;AACjE,IAAI;AACJ,IAAI,kBAAkB,CAAC,eAAe,EAAE;AACxC,QAAQ,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,eAAe,CAAC;AAC/D,IAAI;AACJ,IAAI,aAAa,CAAC,UAAU,EAAE;AAC9B,QAAQ,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,UAAU,CAAC;AACrD,QAAQ,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,UAAU,CAAC;AACxD,IAAI;AACJ;;;;"}
+{"version":3,"file":"CognitoUserPoolsTokenProvider.mjs","sources":["../../../../../src/providers/cognito/tokenProvider/CognitoUserPoolsTokenProvider.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { defaultStorage, } from '@aws-amplify/core';\nimport { refreshAuthTokens } from '../utils/refreshAuthTokens';\nimport { DefaultTokenStore } from './TokenStore';\nimport { TokenOrchestrator } from './TokenOrchestrator';\nexport class CognitoUserPoolsTokenProvider {\n    constructor() {\n        this.authTokenStore = new DefaultTokenStore();\n        this.authTokenStore.setKeyValueStorage(defaultStorage);\n        this.tokenOrchestrator = new TokenOrchestrator();\n        this.tokenOrchestrator.setAuthTokenStore(this.authTokenStore);\n        this.tokenOrchestrator.setTokenRefresher(refreshAuthTokens);\n    }\n    getTokens(options = {}) {\n        return this.tokenOrchestrator.getTokens(options);\n    }\n    setKeyValueStorage(keyValueStorage) {\n        this.authTokenStore.setKeyValueStorage(keyValueStorage);\n    }\n    setClientMetadataProvider(clientMetadataProvider) {\n        this.tokenOrchestrator.setClientMetadataProvider(clientMetadataProvider);\n    }\n    setAuthConfig(authConfig) {\n        this.authTokenStore.setAuthConfig(authConfig);\n        this.tokenOrchestrator.setAuthConfig(authConfig);\n    }\n}\n"],"names":[],"mappings":";;;;;AAAA;AACA;AAKO,MAAM,6BAA6B,CAAC;AAC3C,IAAI,WAAW,GAAG;AAClB,QAAQ,IAAI,CAAC,cAAc,GAAG,IAAI,iBAAiB,EAAE;AACrD,QAAQ,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,cAAc,CAAC;AAC9D,QAAQ,IAAI,CAAC,iBAAiB,GAAG,IAAI,iBAAiB,EAAE;AACxD,QAAQ,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC;AACrE,QAAQ,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;AACnE,IAAI;AACJ,IAAI,SAAS,CAAC,OAAO,GAAG,EAAE,EAAE;AAC5B,QAAQ,OAAO,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC;AACxD,IAAI;AACJ,IAAI,kBAAkB,CAAC,eAAe,EAAE;AACxC,QAAQ,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,eAAe,CAAC;AAC/D,IAAI;AACJ,IAAI,yBAAyB,CAAC,sBAAsB,EAAE;AACtD,QAAQ,IAAI,CAAC,iBAAiB,CAAC,yBAAyB,CAAC,sBAAsB,CAAC;AAChF,IAAI;AACJ,IAAI,aAAa,CAAC,UAAU,EAAE;AAC9B,QAAQ,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,UAAU,CAAC;AACrD,QAAQ,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,UAAU,CAAC;AACxD,IAAI;AACJ;;;;"}

package/dist/esm/providers/cognito/tokenProvider/TokenOrchestrator.d.ts

@@ -1,8 +1,9 @@
-import { AuthConfig, AuthTokens, FetchAuthSessionOptions } from '@aws-amplify/core';
+import { AuthConfig, AuthTokens, ClientMetadataProvider, FetchAuthSessionOptions } from '@aws-amplify/core';
 import { CognitoAuthSignInDetails } from '../types';
 import { AuthTokenOrchestrator, AuthTokenStore, CognitoAuthTokens, DeviceMetadata, OAuthMetadata, TokenRefresher } from './types';
 export declare class TokenOrchestrator implements AuthTokenOrchestrator {
     private authConfig?;
+    clientMetadataProvider?: ClientMetadataProvider;
     tokenStore?: AuthTokenStore;
     tokenRefresher?: TokenRefresher;
     inflightPromise: Promise<void> | undefined;
@@ -12,11 +13,13 @@ export declare class TokenOrchestrator implements AuthTokenOrchestrator {
     setAuthTokenStore(tokenStore: AuthTokenStore): void;
     getTokenStore(): AuthTokenStore;
     getTokenRefresher(): TokenRefresher;
+    setClientMetadataProvider(clientMetadataProvider: ClientMetadataProvider): void;
     getTokens(options?: FetchAuthSessionOptions): Promise<(AuthTokens & {
         signInDetails?: CognitoAuthSignInDetails;
     }) | null>;
     private refreshTokens;
     private handleErrors;
+    private isAuthenticationError;
     setTokens({ tokens }: {
         tokens: CognitoAuthTokens;
     }): Promise<void>;

package/dist/esm/providers/cognito/tokenProvider/TokenOrchestrator.mjs

@@ -1,5 +1,5 @@
 import { Hub } from '@aws-amplify/core';
-import { isBrowser, assertTokenProviderConfig, isTokenExpired, AMPLIFY_SYMBOL, AmplifyErrorCode } from '@aws-amplify/core/internals/utils';
+import { isBrowser, assertTokenProviderConfig, isTokenExpired, AMPLIFY_SYMBOL } from '@aws-amplify/core/internals/utils';
 import { assertServiceError } from '../../../errors/utils/assertServiceError.mjs';
 import { AuthError } from '../../../errors/AuthError.mjs';
 import { oAuthStore } from '../utils/oauth/oAuthStore.mjs';
@@ -57,6 +57,9 @@ class TokenOrchestrator {
         }
         return this.tokenRefresher;
     }
+    setClientMetadataProvider(clientMetadataProvider) {
+        this.clientMetadataProvider = clientMetadataProvider;
+    }
     async getTokens(options) {
         let tokens;
         try {
@@ -86,6 +89,7 @@ class TokenOrchestrator {
             tokens = await this.refreshTokens({
                 tokens,
                 username,
+                clientMetadata: options?.clientMetadata ?? (await this.clientMetadataProvider?.()),
             });
             if (tokens === null) {
                 return null;
@@ -97,13 +101,14 @@ class TokenOrchestrator {
             signInDetails: tokens?.signInDetails,
         };
     }
-    async refreshTokens({ tokens, username, }) {
+    async refreshTokens({ tokens, username, clientMetadata, }) {
         try {
             const { signInDetails } = tokens;
             const newTokens = await this.getTokenRefresher()({
                 tokens,
                 authConfig: this.authConfig,
                 username,
+                clientMetadata,
             });
             newTokens.signInDetails = signInDetails;
             await this.setTokens({ tokens: newTokens });
@@ -116,8 +121,10 @@ class TokenOrchestrator {
     }
     handleErrors(err) {
         assertServiceError(err);
-        if (err.name !== AmplifyErrorCode.NetworkError) {
-            // TODO(v6): Check errors on client
+        // Only clear tokens for definitive authentication failures
+        // Do NOT clear tokens for transient errors like service issues, rate limits, etc.
+        const shouldClearTokens = this.isAuthenticationError(err);
+        if (shouldClearTokens) {
             this.clearTokens();
         }
         Hub.dispatch('auth', {
@@ -129,6 +136,21 @@ class TokenOrchestrator {
         }
         throw err;
     }
+    isAuthenticationError(err) {
+        // Only clear tokens for errors that definitively indicate the tokens are invalid
+        // and re-authentication is required. All other errors (service errors, rate limits, etc.)
+        // should preserve the tokens to allow for retry.
+        // See: https://github.com/aws-amplify/amplify-js/issues/14534
+        const authErrorNames = [
+            'NotAuthorizedException', // Refresh token is expired or invalid
+            'TokenRevokedException', // Token was revoked by admin
+            'UserNotFoundException', // User no longer exists
+            'PasswordResetRequiredException', // User must reset password
+            'UserNotConfirmedException', // User account is not confirmed
+            'RefreshTokenReuseException', // Refresh token invalidated by rotation
+        ];
+        return authErrorNames.some(errorName => err?.name?.startsWith?.(errorName));
+    }
     async setTokens({ tokens }) {
         return this.getTokenStore().storeTokens(tokens);
     }

package/dist/esm/providers/cognito/tokenProvider/TokenOrchestrator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"TokenOrchestrator.mjs","sources":["../../../../../src/providers/cognito/tokenProvider/TokenOrchestrator.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { Hub, } from '@aws-amplify/core';\nimport { AMPLIFY_SYMBOL, AmplifyErrorCode, assertTokenProviderConfig, isBrowser, isTokenExpired, } from '@aws-amplify/core/internals/utils';\nimport { assertServiceError } from '../../../errors/utils/assertServiceError';\nimport { AuthError } from '../../../errors/AuthError';\nimport { oAuthStore } from '../utils/oauth/oAuthStore';\nimport { addInflightPromise } from '../utils/oauth/inflightPromise';\nexport class TokenOrchestrator {\n    constructor() {\n        this.waitForInflightOAuth = isBrowser()\n            ? async () => {\n                if (!(await oAuthStore.loadOAuthInFlight())) {\n                    return;\n                }\n                if (this.inflightPromise) {\n                    return this.inflightPromise;\n                }\n                // when there is valid oauth config and there is an inflight oauth flow, try\n                // to block async calls that require fetching tokens before the oauth flow completes\n                // e.g. getCurrentUser, fetchAuthSession etc.\n                this.inflightPromise = new Promise((resolve, _reject) => {\n                    addInflightPromise(resolve);\n                });\n                return this.inflightPromise;\n            }\n            : async () => {\n                // no-op for non-browser environments\n            };\n    }\n    setAuthConfig(authConfig) {\n        oAuthStore.setAuthConfig(authConfig.Cognito);\n        this.authConfig = authConfig;\n    }\n    setTokenRefresher(tokenRefresher) {\n        this.tokenRefresher = tokenRefresher;\n    }\n    setAuthTokenStore(tokenStore) {\n        this.tokenStore = tokenStore;\n    }\n    getTokenStore() {\n        if (!this.tokenStore) {\n            throw new AuthError({\n                name: 'EmptyTokenStoreException',\n                message: 'TokenStore not set',\n            });\n        }\n        return this.tokenStore;\n    }\n    getTokenRefresher() {\n        if (!this.tokenRefresher) {\n            throw new AuthError({\n                name: 'EmptyTokenRefresherException',\n                message: 'TokenRefresher not set',\n            });\n        }\n        return this.tokenRefresher;\n    }\n    async getTokens(options) {\n        let tokens;\n        try {\n            assertTokenProviderConfig(this.authConfig?.Cognito);\n        }\n        catch (_err) {\n            // Token provider not configured\n            return null;\n        }\n        await this.waitForInflightOAuth();\n        this.inflightPromise = undefined;\n        tokens = await this.getTokenStore().loadTokens();\n        const username = await this.getTokenStore().getLastAuthUser();\n        if (tokens === null) {\n            return null;\n        }\n        const idTokenExpired = !!tokens?.idToken &&\n            isTokenExpired({\n                expiresAt: (tokens.idToken?.payload?.exp ?? 0) * 1000,\n                clockDrift: tokens.clockDrift ?? 0,\n            });\n        const accessTokenExpired = isTokenExpired({\n            expiresAt: (tokens.accessToken?.payload?.exp ?? 0) * 1000,\n            clockDrift: tokens.clockDrift ?? 0,\n        });\n        if (options?.forceRefresh || idTokenExpired || accessTokenExpired) {\n            tokens = await this.refreshTokens({\n                tokens,\n                username,\n            });\n            if (tokens === null) {\n                return null;\n            }\n        }\n        return {\n            accessToken: tokens?.accessToken,\n            idToken: tokens?.idToken,\n            signInDetails: tokens?.signInDetails,\n        };\n    }\n    async refreshTokens({ tokens, username, }) {\n        try {\n            const { signInDetails } = tokens;\n            const newTokens = await this.getTokenRefresher()({\n                tokens,\n                authConfig: this.authConfig,\n                username,\n            });\n            newTokens.signInDetails = signInDetails;\n            await this.setTokens({ tokens: newTokens });\n            Hub.dispatch('auth', { event: 'tokenRefresh' }, 'Auth', AMPLIFY_SYMBOL);\n            return newTokens;\n        }\n        catch (err) {\n            return this.handleErrors(err);\n        }\n    }\n    handleErrors(err) {\n        assertServiceError(err);\n        if (err.name !== AmplifyErrorCode.NetworkError) {\n            // TODO(v6): Check errors on client\n            this.clearTokens();\n        }\n        Hub.dispatch('auth', {\n            event: 'tokenRefresh_failure',\n            data: { error: err },\n        }, 'Auth', AMPLIFY_SYMBOL);\n        if (err.name.startsWith('NotAuthorizedException')) {\n            return null;\n        }\n        throw err;\n    }\n    async setTokens({ tokens }) {\n        return this.getTokenStore().storeTokens(tokens);\n    }\n    async clearTokens() {\n        return this.getTokenStore().clearTokens();\n    }\n    getDeviceMetadata(username) {\n        return this.getTokenStore().getDeviceMetadata(username);\n    }\n    clearDeviceMetadata(username) {\n        return this.getTokenStore().clearDeviceMetadata(username);\n    }\n    setOAuthMetadata(metadata) {\n        return this.getTokenStore().setOAuthMetadata(metadata);\n    }\n    getOAuthMetadata() {\n        return this.getTokenStore().getOAuthMetadata();\n    }\n}\n"],"names":[],"mappings":";;;;;;;AAAA;AACA;AAOO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,WAAW,GAAG;AAClB,QAAQ,IAAI,CAAC,oBAAoB,GAAG,SAAS;AAC7C,cAAc,YAAY;AAC1B,gBAAgB,IAAI,EAAE,MAAM,UAAU,CAAC,iBAAiB,EAAE,CAAC,EAAE;AAC7D,oBAAoB;AACpB,gBAAgB;AAChB,gBAAgB,IAAI,IAAI,CAAC,eAAe,EAAE;AAC1C,oBAAoB,OAAO,IAAI,CAAC,eAAe;AAC/C,gBAAgB;AAChB;AACA;AACA;AACA,gBAAgB,IAAI,CAAC,eAAe,GAAG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,OAAO,KAAK;AACzE,oBAAoB,kBAAkB,CAAC,OAAO,CAAC;AAC/C,gBAAgB,CAAC,CAAC;AAClB,gBAAgB,OAAO,IAAI,CAAC,eAAe;AAC3C,YAAY;AACZ,cAAc,YAAY;AAC1B;AACA,YAAY,CAAC;AACb,IAAI;AACJ,IAAI,aAAa,CAAC,UAAU,EAAE;AAC9B,QAAQ,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC;AACpD,QAAQ,IAAI,CAAC,UAAU,GAAG,UAAU;AACpC,IAAI;AACJ,IAAI,iBAAiB,CAAC,cAAc,EAAE;AACtC,QAAQ,IAAI,CAAC,cAAc,GAAG,cAAc;AAC5C,IAAI;AACJ,IAAI,iBAAiB,CAAC,UAAU,EAAE;AAClC,QAAQ,IAAI,CAAC,UAAU,GAAG,UAAU;AACpC,IAAI;AACJ,IAAI,aAAa,GAAG;AACpB,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE;AAC9B,YAAY,MAAM,IAAI,SAAS,CAAC;AAChC,gBAAgB,IAAI,EAAE,0BAA0B;AAChD,gBAAgB,OAAO,EAAE,oBAAoB;AAC7C,aAAa,CAAC;AACd,QAAQ;AACR,QAAQ,OAAO,IAAI,CAAC,UAAU;AAC9B,IAAI;AACJ,IAAI,iBAAiB,GAAG;AACxB,QAAQ,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;AAClC,YAAY,MAAM,IAAI,SAAS,CAAC;AAChC,gBAAgB,IAAI,EAAE,8BAA8B;AACpD,gBAAgB,OAAO,EAAE,wBAAwB;AACjD,aAAa,CAAC;AACd,QAAQ;AACR,QAAQ,OAAO,IAAI,CAAC,cAAc;AAClC,IAAI;AACJ,IAAI,MAAM,SAAS,CAAC,OAAO,EAAE;AAC7B,QAAQ,IAAI,MAAM;AAClB,QAAQ,IAAI;AACZ,YAAY,yBAAyB,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC;AAC/D,QAAQ;AACR,QAAQ,OAAO,IAAI,EAAE;AACrB;AACA,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,IAAI,CAAC,oBAAoB,EAAE;AACzC,QAAQ,IAAI,CAAC,eAAe,GAAG,SAAS;AACxC,QAAQ,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;AACxD,QAAQ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,eAAe,EAAE;AACrE,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE;AAC7B,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO;AAChD,YAAY,cAAc,CAAC;AAC3B,gBAAgB,SAAS,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI;AACrE,gBAAgB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC;AAClD,aAAa,CAAC;AACd,QAAQ,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAClD,YAAY,SAAS,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI;AACrE,YAAY,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC;AAC9C,SAAS,CAAC;AACV,QAAQ,IAAI,OAAO,EAAE,YAAY,IAAI,cAAc,IAAI,kBAAkB,EAAE;AAC3E,YAAY,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;AAC9C,gBAAgB,MAAM;AACtB,gBAAgB,QAAQ;AACxB,aAAa,CAAC;AACd,YAAY,IAAI,MAAM,KAAK,IAAI,EAAE;AACjC,gBAAgB,OAAO,IAAI;AAC3B,YAAY;AACZ,QAAQ;AACR,QAAQ,OAAO;AACf,YAAY,WAAW,EAAE,MAAM,EAAE,WAAW;AAC5C,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO;AACpC,YAAY,aAAa,EAAE,MAAM,EAAE,aAAa;AAChD,SAAS;AACT,IAAI;AACJ,IAAI,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,EAAE;AAC/C,QAAQ,IAAI;AACZ,YAAY,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM;AAC5C,YAAY,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;AAC7D,gBAAgB,MAAM;AACtB,gBAAgB,UAAU,EAAE,IAAI,CAAC,UAAU;AAC3C,gBAAgB,QAAQ;AACxB,aAAa,CAAC;AACd,YAAY,SAAS,CAAC,aAAa,GAAG,aAAa;AACnD,YAAY,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACvD,YAAY,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC;AACnF,YAAY,OAAO,SAAS;AAC5B,QAAQ;AACR,QAAQ,OAAO,GAAG,EAAE;AACpB,YAAY,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;AACzC,QAAQ;AACR,IAAI;AACJ,IAAI,YAAY,CAAC,GAAG,EAAE;AACtB,QAAQ,kBAAkB,CAAC,GAAG,CAAC;AAC/B,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,CAAC,YAAY,EAAE;AACxD;AACA,YAAY,IAAI,CAAC,WAAW,EAAE;AAC9B,QAAQ;AACR,QAAQ,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE;AAC7B,YAAY,KAAK,EAAE,sBAAsB;AACzC,YAAY,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;AAChC,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC;AAClC,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE;AAC3D,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,GAAG;AACjB,IAAI;AACJ,IAAI,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE;AAChC,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;AACvD,IAAI;AACJ,IAAI,MAAM,WAAW,GAAG;AACxB,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,WAAW,EAAE;AACjD,IAAI;AACJ,IAAI,iBAAiB,CAAC,QAAQ,EAAE;AAChC,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC;AAC/D,IAAI;AACJ,IAAI,mBAAmB,CAAC,QAAQ,EAAE;AAClC,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC;AACjE,IAAI;AACJ,IAAI,gBAAgB,CAAC,QAAQ,EAAE;AAC/B,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC;AAC9D,IAAI;AACJ,IAAI,gBAAgB,GAAG;AACvB,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,gBAAgB,EAAE;AACtD,IAAI;AACJ;;;;"}
+{"version":3,"file":"TokenOrchestrator.mjs","sources":["../../../../../src/providers/cognito/tokenProvider/TokenOrchestrator.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { Hub, } from '@aws-amplify/core';\nimport { AMPLIFY_SYMBOL, assertTokenProviderConfig, isBrowser, isTokenExpired, } from '@aws-amplify/core/internals/utils';\nimport { assertServiceError } from '../../../errors/utils/assertServiceError';\nimport { AuthError } from '../../../errors/AuthError';\nimport { oAuthStore } from '../utils/oauth/oAuthStore';\nimport { addInflightPromise } from '../utils/oauth/inflightPromise';\nexport class TokenOrchestrator {\n    constructor() {\n        this.waitForInflightOAuth = isBrowser()\n            ? async () => {\n                if (!(await oAuthStore.loadOAuthInFlight())) {\n                    return;\n                }\n                if (this.inflightPromise) {\n                    return this.inflightPromise;\n                }\n                // when there is valid oauth config and there is an inflight oauth flow, try\n                // to block async calls that require fetching tokens before the oauth flow completes\n                // e.g. getCurrentUser, fetchAuthSession etc.\n                this.inflightPromise = new Promise((resolve, _reject) => {\n                    addInflightPromise(resolve);\n                });\n                return this.inflightPromise;\n            }\n            : async () => {\n                // no-op for non-browser environments\n            };\n    }\n    setAuthConfig(authConfig) {\n        oAuthStore.setAuthConfig(authConfig.Cognito);\n        this.authConfig = authConfig;\n    }\n    setTokenRefresher(tokenRefresher) {\n        this.tokenRefresher = tokenRefresher;\n    }\n    setAuthTokenStore(tokenStore) {\n        this.tokenStore = tokenStore;\n    }\n    getTokenStore() {\n        if (!this.tokenStore) {\n            throw new AuthError({\n                name: 'EmptyTokenStoreException',\n                message: 'TokenStore not set',\n            });\n        }\n        return this.tokenStore;\n    }\n    getTokenRefresher() {\n        if (!this.tokenRefresher) {\n            throw new AuthError({\n                name: 'EmptyTokenRefresherException',\n                message: 'TokenRefresher not set',\n            });\n        }\n        return this.tokenRefresher;\n    }\n    setClientMetadataProvider(clientMetadataProvider) {\n        this.clientMetadataProvider = clientMetadataProvider;\n    }\n    async getTokens(options) {\n        let tokens;\n        try {\n            assertTokenProviderConfig(this.authConfig?.Cognito);\n        }\n        catch (_err) {\n            // Token provider not configured\n            return null;\n        }\n        await this.waitForInflightOAuth();\n        this.inflightPromise = undefined;\n        tokens = await this.getTokenStore().loadTokens();\n        const username = await this.getTokenStore().getLastAuthUser();\n        if (tokens === null) {\n            return null;\n        }\n        const idTokenExpired = !!tokens?.idToken &&\n            isTokenExpired({\n                expiresAt: (tokens.idToken?.payload?.exp ?? 0) * 1000,\n                clockDrift: tokens.clockDrift ?? 0,\n            });\n        const accessTokenExpired = isTokenExpired({\n            expiresAt: (tokens.accessToken?.payload?.exp ?? 0) * 1000,\n            clockDrift: tokens.clockDrift ?? 0,\n        });\n        if (options?.forceRefresh || idTokenExpired || accessTokenExpired) {\n            tokens = await this.refreshTokens({\n                tokens,\n                username,\n                clientMetadata: options?.clientMetadata ?? (await this.clientMetadataProvider?.()),\n            });\n            if (tokens === null) {\n                return null;\n            }\n        }\n        return {\n            accessToken: tokens?.accessToken,\n            idToken: tokens?.idToken,\n            signInDetails: tokens?.signInDetails,\n        };\n    }\n    async refreshTokens({ tokens, username, clientMetadata, }) {\n        try {\n            const { signInDetails } = tokens;\n            const newTokens = await this.getTokenRefresher()({\n                tokens,\n                authConfig: this.authConfig,\n                username,\n                clientMetadata,\n            });\n            newTokens.signInDetails = signInDetails;\n            await this.setTokens({ tokens: newTokens });\n            Hub.dispatch('auth', { event: 'tokenRefresh' }, 'Auth', AMPLIFY_SYMBOL);\n            return newTokens;\n        }\n        catch (err) {\n            return this.handleErrors(err);\n        }\n    }\n    handleErrors(err) {\n        assertServiceError(err);\n        // Only clear tokens for definitive authentication failures\n        // Do NOT clear tokens for transient errors like service issues, rate limits, etc.\n        const shouldClearTokens = this.isAuthenticationError(err);\n        if (shouldClearTokens) {\n            this.clearTokens();\n        }\n        Hub.dispatch('auth', {\n            event: 'tokenRefresh_failure',\n            data: { error: err },\n        }, 'Auth', AMPLIFY_SYMBOL);\n        if (err.name.startsWith('NotAuthorizedException')) {\n            return null;\n        }\n        throw err;\n    }\n    isAuthenticationError(err) {\n        // Only clear tokens for errors that definitively indicate the tokens are invalid\n        // and re-authentication is required. All other errors (service errors, rate limits, etc.)\n        // should preserve the tokens to allow for retry.\n        // See: https://github.com/aws-amplify/amplify-js/issues/14534\n        const authErrorNames = [\n            'NotAuthorizedException', // Refresh token is expired or invalid\n            'TokenRevokedException', // Token was revoked by admin\n            'UserNotFoundException', // User no longer exists\n            'PasswordResetRequiredException', // User must reset password\n            'UserNotConfirmedException', // User account is not confirmed\n            'RefreshTokenReuseException', // Refresh token invalidated by rotation\n        ];\n        return authErrorNames.some(errorName => err?.name?.startsWith?.(errorName));\n    }\n    async setTokens({ tokens }) {\n        return this.getTokenStore().storeTokens(tokens);\n    }\n    async clearTokens() {\n        return this.getTokenStore().clearTokens();\n    }\n    getDeviceMetadata(username) {\n        return this.getTokenStore().getDeviceMetadata(username);\n    }\n    clearDeviceMetadata(username) {\n        return this.getTokenStore().clearDeviceMetadata(username);\n    }\n    setOAuthMetadata(metadata) {\n        return this.getTokenStore().setOAuthMetadata(metadata);\n    }\n    getOAuthMetadata() {\n        return this.getTokenStore().getOAuthMetadata();\n    }\n}\n"],"names":[],"mappings":";;;;;;;AAAA;AACA;AAOO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,WAAW,GAAG;AAClB,QAAQ,IAAI,CAAC,oBAAoB,GAAG,SAAS;AAC7C,cAAc,YAAY;AAC1B,gBAAgB,IAAI,EAAE,MAAM,UAAU,CAAC,iBAAiB,EAAE,CAAC,EAAE;AAC7D,oBAAoB;AACpB,gBAAgB;AAChB,gBAAgB,IAAI,IAAI,CAAC,eAAe,EAAE;AAC1C,oBAAoB,OAAO,IAAI,CAAC,eAAe;AAC/C,gBAAgB;AAChB;AACA;AACA;AACA,gBAAgB,IAAI,CAAC,eAAe,GAAG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,OAAO,KAAK;AACzE,oBAAoB,kBAAkB,CAAC,OAAO,CAAC;AAC/C,gBAAgB,CAAC,CAAC;AAClB,gBAAgB,OAAO,IAAI,CAAC,eAAe;AAC3C,YAAY;AACZ,cAAc,YAAY;AAC1B;AACA,YAAY,CAAC;AACb,IAAI;AACJ,IAAI,aAAa,CAAC,UAAU,EAAE;AAC9B,QAAQ,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC;AACpD,QAAQ,IAAI,CAAC,UAAU,GAAG,UAAU;AACpC,IAAI;AACJ,IAAI,iBAAiB,CAAC,cAAc,EAAE;AACtC,QAAQ,IAAI,CAAC,cAAc,GAAG,cAAc;AAC5C,IAAI;AACJ,IAAI,iBAAiB,CAAC,UAAU,EAAE;AAClC,QAAQ,IAAI,CAAC,UAAU,GAAG,UAAU;AACpC,IAAI;AACJ,IAAI,aAAa,GAAG;AACpB,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE;AAC9B,YAAY,MAAM,IAAI,SAAS,CAAC;AAChC,gBAAgB,IAAI,EAAE,0BAA0B;AAChD,gBAAgB,OAAO,EAAE,oBAAoB;AAC7C,aAAa,CAAC;AACd,QAAQ;AACR,QAAQ,OAAO,IAAI,CAAC,UAAU;AAC9B,IAAI;AACJ,IAAI,iBAAiB,GAAG;AACxB,QAAQ,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;AAClC,YAAY,MAAM,IAAI,SAAS,CAAC;AAChC,gBAAgB,IAAI,EAAE,8BAA8B;AACpD,gBAAgB,OAAO,EAAE,wBAAwB;AACjD,aAAa,CAAC;AACd,QAAQ;AACR,QAAQ,OAAO,IAAI,CAAC,cAAc;AAClC,IAAI;AACJ,IAAI,yBAAyB,CAAC,sBAAsB,EAAE;AACtD,QAAQ,IAAI,CAAC,sBAAsB,GAAG,sBAAsB;AAC5D,IAAI;AACJ,IAAI,MAAM,SAAS,CAAC,OAAO,EAAE;AAC7B,QAAQ,IAAI,MAAM;AAClB,QAAQ,IAAI;AACZ,YAAY,yBAAyB,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC;AAC/D,QAAQ;AACR,QAAQ,OAAO,IAAI,EAAE;AACrB;AACA,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,IAAI,CAAC,oBAAoB,EAAE;AACzC,QAAQ,IAAI,CAAC,eAAe,GAAG,SAAS;AACxC,QAAQ,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;AACxD,QAAQ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,eAAe,EAAE;AACrE,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE;AAC7B,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO;AAChD,YAAY,cAAc,CAAC;AAC3B,gBAAgB,SAAS,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI;AACrE,gBAAgB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC;AAClD,aAAa,CAAC;AACd,QAAQ,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAClD,YAAY,SAAS,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI;AACrE,YAAY,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC;AAC9C,SAAS,CAAC;AACV,QAAQ,IAAI,OAAO,EAAE,YAAY,IAAI,cAAc,IAAI,kBAAkB,EAAE;AAC3E,YAAY,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;AAC9C,gBAAgB,MAAM;AACtB,gBAAgB,QAAQ;AACxB,gBAAgB,cAAc,EAAE,OAAO,EAAE,cAAc,KAAK,MAAM,IAAI,CAAC,sBAAsB,IAAI,CAAC;AAClG,aAAa,CAAC;AACd,YAAY,IAAI,MAAM,KAAK,IAAI,EAAE;AACjC,gBAAgB,OAAO,IAAI;AAC3B,YAAY;AACZ,QAAQ;AACR,QAAQ,OAAO;AACf,YAAY,WAAW,EAAE,MAAM,EAAE,WAAW;AAC5C,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO;AACpC,YAAY,aAAa,EAAE,MAAM,EAAE,aAAa;AAChD,SAAS;AACT,IAAI;AACJ,IAAI,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,EAAE;AAC/D,QAAQ,IAAI;AACZ,YAAY,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM;AAC5C,YAAY,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;AAC7D,gBAAgB,MAAM;AACtB,gBAAgB,UAAU,EAAE,IAAI,CAAC,UAAU;AAC3C,gBAAgB,QAAQ;AACxB,gBAAgB,cAAc;AAC9B,aAAa,CAAC;AACd,YAAY,SAAS,CAAC,aAAa,GAAG,aAAa;AACnD,YAAY,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACvD,YAAY,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC;AACnF,YAAY,OAAO,SAAS;AAC5B,QAAQ;AACR,QAAQ,OAAO,GAAG,EAAE;AACpB,YAAY,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;AACzC,QAAQ;AACR,IAAI;AACJ,IAAI,YAAY,CAAC,GAAG,EAAE;AACtB,QAAQ,kBAAkB,CAAC,GAAG,CAAC;AAC/B;AACA;AACA,QAAQ,MAAM,iBAAiB,GAAG,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC;AACjE,QAAQ,IAAI,iBAAiB,EAAE;AAC/B,YAAY,IAAI,CAAC,WAAW,EAAE;AAC9B,QAAQ;AACR,QAAQ,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE;AAC7B,YAAY,KAAK,EAAE,sBAAsB;AACzC,YAAY,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;AAChC,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC;AAClC,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE;AAC3D,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,GAAG;AACjB,IAAI;AACJ,IAAI,qBAAqB,CAAC,GAAG,EAAE;AAC/B;AACA;AACA;AACA;AACA,QAAQ,MAAM,cAAc,GAAG;AAC/B,YAAY,wBAAwB;AACpC,YAAY,uBAAuB;AACnC,YAAY,uBAAuB;AACnC,YAAY,gCAAgC;AAC5C,YAAY,2BAA2B;AACvC,YAAY,4BAA4B;AACxC,SAAS;AACT,QAAQ,OAAO,cAAc,CAAC,IAAI,CAAC,SAAS,IAAI,GAAG,EAAE,IAAI,EAAE,UAAU,GAAG,SAAS,CAAC,CAAC;AACnF,IAAI;AACJ,IAAI,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE;AAChC,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;AACvD,IAAI;AACJ,IAAI,MAAM,WAAW,GAAG;AACxB,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,WAAW,EAAE;AACjD,IAAI;AACJ,IAAI,iBAAiB,CAAC,QAAQ,EAAE;AAChC,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC;AAC/D,IAAI;AACJ,IAAI,mBAAmB,CAAC,QAAQ,EAAE;AAClC,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC;AACjE,IAAI;AACJ,IAAI,gBAAgB,CAAC,QAAQ,EAAE;AAC/B,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC;AAC9D,IAAI;AACJ,IAAI,gBAAgB,GAAG;AACvB,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,gBAAgB,EAAE;AACtD,IAAI;AACJ;;;;"}