@aws-amplify/auth 6.5.0 → 6.5.1-email-mfa-test.4e655bc.0

package/src/foundation/factories/serviceClients/cognitoIdentityProvider/types/sdk.ts

@@ -8,6 +8,7 @@ import { MetadataBearer as __MetadataBearer } from '@aws-sdk/types';
 export type ChallengeName =
 	| 'SMS_MFA'
 	| 'SOFTWARE_TOKEN_MFA'
+	| 'EMAIL_OTP'
 	| 'SELECT_MFA_TYPE'
 	| 'MFA_SETUP'
 	| 'PASSWORD_VERIFIER'
@@ -28,7 +29,7 @@ export type ChallengeParameters = {
 	MFAS_CAN_SETUP?: string;
 } & Record<string, unknown>;
 
-export type CognitoMFAType = 'SMS_MFA' | 'SOFTWARE_TOKEN_MFA';
+export type CognitoMFAType = 'SMS_MFA' | 'SOFTWARE_TOKEN_MFA' | 'EMAIL_OTP';
 
 export interface CognitoMFASettings {
 	Enabled?: boolean;
@@ -55,6 +56,7 @@ declare enum ChallengeNameType {
 	SELECT_MFA_TYPE = 'SELECT_MFA_TYPE',
 	SMS_MFA = 'SMS_MFA',
 	SOFTWARE_TOKEN_MFA = 'SOFTWARE_TOKEN_MFA',
+	EMAIL_OTP = 'EMAIL_OTP',
 }
 declare enum DeliveryMediumType {
 	EMAIL = 'EMAIL',
@@ -1430,6 +1432,10 @@ export interface SetUserMFAPreferenceRequest {
 	 * <p>The time-based one-time password software token MFA settings.</p>
 	 */
 	SoftwareTokenMfaSettings?: SoftwareTokenMfaSettingsType;
+	/**
+	 * <p>The email message multi-factor authentication (MFA) settings.</p>
+	 */
+	EmailMfaSettings?: EmailMfaSettingsType;
 	/**
 	 * <p>The access token for the user.</p>
 	 */
@@ -1538,6 +1544,22 @@ export interface SoftwareTokenMfaSettingsType {
 	 */
 	PreferredMfa?: boolean;
 }
+/**
+ * <p>The type used for enabling email MFA at the user level. If an MFA type is activated for a user, the user will be prompted for MFA during all sign-in attempts, unless device tracking
+ *             is turned on and the device has been trusted. If you want MFA to be applied selectively based on the assessed risk level of sign-in attempts, deactivate MFA for users and turn on Adaptive
+ *             Authentication for the user pool.</p>
+ */
+export interface EmailMfaSettingsType {
+	/**
+	 * <p>Specifies whether email MFA is activated. If an MFA type is activated for a user, the user will be prompted for MFA during all sign-in attempts, unless device tracking is turned
+	 *             on and the device has been trusted.</p>
+	 */
+	Enabled?: boolean;
+	/**
+	 * <p>Specifies whether email MFA is the preferred MFA method.</p>
+	 */
+	PreferredMfa?: boolean;
+}
 export type UpdateDeviceStatusCommandInput = UpdateDeviceStatusRequest;
 export interface UpdateDeviceStatusCommandOutput
 	extends UpdateDeviceStatusResponse,

package/src/providers/cognito/apis/confirmSignIn.ts

@@ -71,8 +71,8 @@ export async function confirmSignIn(
 		throw new AuthError({
 			name: AuthErrorCodes.SignInException,
 			message: `
-			An error occurred during the sign in process. 
-			
+			An error occurred during the sign in process.
+
 			This most likely occurred due to:
 			1. signIn was not called before confirmSignIn.
 			2. signIn threw an exception.

package/src/providers/cognito/apis/updateMFAPreference.ts

@@ -27,7 +27,7 @@ import { createCognitoUserPoolEndpointResolver } from '../factories';
 export async function updateMFAPreference(
 	input: UpdateMFAPreferenceInput,
 ): Promise<void> {
-	const { sms, totp } = input;
+	const { sms, totp, email } = input;
 	const authConfig = Amplify.getConfig().Auth?.Cognito;
 	assertTokenProviderConfig(authConfig);
 	const { userPoolEndpoint, userPoolId } = authConfig;
@@ -47,6 +47,7 @@ export async function updateMFAPreference(
 			AccessToken: tokens.accessToken.toString(),
 			SMSMfaSettings: getMFASettings(sms),
 			SoftwareTokenMfaSettings: getMFASettings(totp),
+			EmailMfaSettings: getMFASettings(email),
 		},
 	);
 }

package/src/providers/cognito/types/inputs.ts

@@ -118,6 +118,7 @@ export type SignUpInput = AuthSignUpInput<SignUpOptions<UserAttributeKey>>;
 export interface UpdateMFAPreferenceInput {
 	sms?: MFAPreference;
 	totp?: MFAPreference;
+	email?: MFAPreference;
 }
 
 /**

package/src/providers/cognito/utils/oauth/getRedirectUrl.ts

@@ -39,6 +39,7 @@ export function getRedirectUrl(
 // origin + pathname => https://example.com/app
 const isSameOriginAndPathName = (redirect: string) =>
 	redirect.startsWith(
+		// eslint-disable-next-line no-constant-binary-expression
 		String(window.location.origin + window.location.pathname ?? '/'),
 	);
 // domain => outlook.live.com, github.com

package/src/providers/cognito/utils/signInHelpers.ts

@@ -154,49 +154,110 @@ export async function handleMFASetupChallenge({
 	config,
 }: HandleAuthChallengeRequest): Promise<RespondToAuthChallengeCommandOutput> {
 	const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
-	const challengeResponses = {
+
+	if (challengeResponse === 'EMAIL') {
+		return {
+			ChallengeName: 'MFA_SETUP',
+			Session: session,
+			ChallengeParameters: {
+				MFAS_CAN_SETUP: '["EMAIL_OTP"]',
+			},
+			$metadata: {},
+		};
+	}
+
+	if (challengeResponse === 'TOTP') {
+		return {
+			ChallengeName: 'MFA_SETUP',
+			Session: session,
+			ChallengeParameters: {
+				MFAS_CAN_SETUP: '["SOFTWARE_TOKEN_MFA"]',
+			},
+			$metadata: {},
+		};
+	}
+
+	const challengeResponses: Record<string, string> = {
 		USERNAME: username,
 	};
-	const verifySoftwareToken = createVerifySoftwareTokenClient({
-		endpointResolver: createCognitoUserPoolEndpointResolver({
-			endpointOverride: userPoolEndpoint,
-		}),
-	});
-	const { Session } = await verifySoftwareToken(
-		{
-			region: getRegionFromUserPoolId(userPoolId),
-			userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
-		},
-		{
-			UserCode: challengeResponse,
+
+	const isTOTPCode = /^\d+$/.test(challengeResponse.trim());
+
+	if (isTOTPCode) {
+		const verifySoftwareToken = createVerifySoftwareTokenClient({
+			endpointResolver: createCognitoUserPoolEndpointResolver({
+				endpointOverride: userPoolEndpoint,
+			}),
+		});
+
+		const { Session } = await verifySoftwareToken(
+			{
+				region: getRegionFromUserPoolId(userPoolId),
+				userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
+			},
+			{
+				UserCode: challengeResponse,
+				Session: session,
+				FriendlyDeviceName: deviceName,
+			},
+		);
+
+		signInStore.dispatch({
+			type: 'SET_SIGN_IN_SESSION',
+			value: Session,
+		});
+
+		const jsonReq: RespondToAuthChallengeCommandInput = {
+			ChallengeName: 'MFA_SETUP',
+			ChallengeResponses: challengeResponses,
+			Session,
+			ClientMetadata: clientMetadata,
+			ClientId: userPoolClientId,
+		};
+
+		const respondToAuthChallenge = createRespondToAuthChallengeClient({
+			endpointResolver: createCognitoUserPoolEndpointResolver({
+				endpointOverride: userPoolEndpoint,
+			}),
+		});
+
+		return respondToAuthChallenge(
+			{ region: getRegionFromUserPoolId(userPoolId) },
+			jsonReq,
+		);
+	}
+
+	const isEmail = /^\S+@\S+\.\S+$/.test(challengeResponse.trim());
+
+	if (isEmail) {
+		challengeResponses.EMAIL = challengeResponse;
+
+		const jsonReq: RespondToAuthChallengeCommandInput = {
+			ChallengeName: 'MFA_SETUP',
+			ChallengeResponses: challengeResponses,
 			Session: session,
-			FriendlyDeviceName: deviceName,
-		},
-	);
+			ClientMetadata: clientMetadata,
+			ClientId: userPoolClientId,
+		};
 
-	signInStore.dispatch({
-		type: 'SET_SIGN_IN_SESSION',
-		value: Session,
-	});
+		const respondToAuthChallenge = createRespondToAuthChallengeClient({
+			endpointResolver: createCognitoUserPoolEndpointResolver({
+				endpointOverride: userPoolEndpoint,
+			}),
+		});
 
-	const jsonReq: RespondToAuthChallengeCommandInput = {
-		ChallengeName: 'MFA_SETUP',
-		ChallengeResponses: challengeResponses,
-		Session,
-		ClientMetadata: clientMetadata,
-		ClientId: userPoolClientId,
-	};
+		return respondToAuthChallenge(
+			{ region: getRegionFromUserPoolId(userPoolId) },
+			jsonReq,
+		);
+	}
 
-	const respondToAuthChallenge = createRespondToAuthChallengeClient({
-		endpointResolver: createCognitoUserPoolEndpointResolver({
-			endpointOverride: userPoolEndpoint,
-		}),
+	throw new AuthError({
+		name: AuthErrorCodes.SignInException,
+		message: `Cannot proceed with MFA setup using challengeResponse: ${challengeResponse}`,
+		recoverySuggestion:
+			'Try passing "EMAIL", "TOTP", a valid email, or OTP code as the challengeResponse.',
 	});
-
-	return respondToAuthChallenge(
-		{ region: getRegionFromUserPoolId(userPoolId) },
-		jsonReq,
-	);
 }
 
 export async function handleSelectMFATypeChallenge({
@@ -208,7 +269,9 @@ export async function handleSelectMFATypeChallenge({
 }: HandleAuthChallengeRequest): Promise<RespondToAuthChallengeCommandOutput> {
 	const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
 	assertValidationError(
-		challengeResponse === 'TOTP' || challengeResponse === 'SMS',
+		challengeResponse === 'TOTP' ||
+			challengeResponse === 'SMS' ||
+			challengeResponse === 'EMAIL',
 		AuthValidationErrorCode.IncorrectMFAMethod,
 	);
 
@@ -247,88 +310,6 @@ export async function handleSelectMFATypeChallenge({
 	);
 }
 
-export async function handleSMSMFAChallenge({
-	challengeResponse,
-	clientMetadata,
-	session,
-	username,
-	config,
-}: HandleAuthChallengeRequest): Promise<RespondToAuthChallengeCommandOutput> {
-	const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
-	const challengeResponses = {
-		USERNAME: username,
-		SMS_MFA_CODE: challengeResponse,
-	};
-	const UserContextData = getUserContextData({
-		username,
-		userPoolId,
-		userPoolClientId,
-	});
-	const jsonReq: RespondToAuthChallengeCommandInput = {
-		ChallengeName: 'SMS_MFA',
-		ChallengeResponses: challengeResponses,
-		Session: session,
-		ClientMetadata: clientMetadata,
-		ClientId: userPoolClientId,
-		UserContextData,
-	};
-
-	const respondToAuthChallenge = createRespondToAuthChallengeClient({
-		endpointResolver: createCognitoUserPoolEndpointResolver({
-			endpointOverride: userPoolEndpoint,
-		}),
-	});
-
-	return respondToAuthChallenge(
-		{
-			region: getRegionFromUserPoolId(userPoolId),
-			userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
-		},
-		jsonReq,
-	);
-}
-export async function handleSoftwareTokenMFAChallenge({
-	challengeResponse,
-	clientMetadata,
-	session,
-	username,
-	config,
-}: HandleAuthChallengeRequest): Promise<RespondToAuthChallengeCommandOutput> {
-	const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
-	const challengeResponses = {
-		USERNAME: username,
-		SOFTWARE_TOKEN_MFA_CODE: challengeResponse,
-	};
-
-	const UserContextData = getUserContextData({
-		username,
-		userPoolId,
-		userPoolClientId,
-	});
-
-	const jsonReq: RespondToAuthChallengeCommandInput = {
-		ChallengeName: 'SOFTWARE_TOKEN_MFA',
-		ChallengeResponses: challengeResponses,
-		Session: session,
-		ClientMetadata: clientMetadata,
-		ClientId: userPoolClientId,
-		UserContextData,
-	};
-
-	const respondToAuthChallenge = createRespondToAuthChallengeClient({
-		endpointResolver: createCognitoUserPoolEndpointResolver({
-			endpointOverride: userPoolEndpoint,
-		}),
-	});
-
-	return respondToAuthChallenge(
-		{
-			region: getRegionFromUserPoolId(userPoolId),
-			userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
-		},
-		jsonReq,
-	);
-}
 export async function handleCompleteNewPasswordChallenge({
 	challengeResponse,
 	clientMetadata,
@@ -842,37 +823,65 @@ export async function getSignInResult(params: {
 		case 'MFA_SETUP': {
 			const { signInSession, username } = signInStore.getState();
 
-			if (!isMFATypeEnabled(challengeParameters, 'TOTP'))
-				throw new AuthError({
-					name: AuthErrorCodes.SignInException,
-					message: `Cannot initiate MFA setup from available types: ${getMFATypes(
-						parseMFATypes(challengeParameters.MFAS_CAN_SETUP),
-					)}`,
+			const mfaSetupTypes =
+				getMFATypes(parseMFATypes(challengeParameters.MFAS_CAN_SETUP)) || [];
+
+			const allowedMfaSetupTypes = getAllowedMfaSetupTypes(mfaSetupTypes);
+
+			const isTotpMfaSetupAvailable = allowedMfaSetupTypes.includes('TOTP');
+			const isEmailMfaSetupAvailable = allowedMfaSetupTypes.includes('EMAIL');
+
+			if (isTotpMfaSetupAvailable && isEmailMfaSetupAvailable) {
+				return {
+					isSignedIn: false,
+					nextStep: {
+						signInStep: 'CONTINUE_SIGN_IN_WITH_MFA_SETUP_SELECTION',
+						allowedMFATypes: allowedMfaSetupTypes,
+					},
+				};
+			}
+
+			if (isEmailMfaSetupAvailable) {
+				return {
+					isSignedIn: false,
+					nextStep: {
+						signInStep: 'CONTINUE_SIGN_IN_WITH_EMAIL_SETUP',
+					},
+				};
+			}
+
+			if (isTotpMfaSetupAvailable) {
+				const associateSoftwareToken = createAssociateSoftwareTokenClient({
+					endpointResolver: createCognitoUserPoolEndpointResolver({
+						endpointOverride: authConfig.userPoolEndpoint,
+					}),
+				});
+				const { Session, SecretCode: secretCode } =
+					await associateSoftwareToken(
+						{ region: getRegionFromUserPoolId(authConfig.userPoolId) },
+						{
+							Session: signInSession,
+						},
+					);
+
+				signInStore.dispatch({
+					type: 'SET_SIGN_IN_SESSION',
+					value: Session,
 				});
 
-			const associateSoftwareToken = createAssociateSoftwareTokenClient({
-				endpointResolver: createCognitoUserPoolEndpointResolver({
-					endpointOverride: authConfig.userPoolEndpoint,
-				}),
-			});
-			const { Session, SecretCode: secretCode } = await associateSoftwareToken(
-				{ region: getRegionFromUserPoolId(authConfig.userPoolId) },
-				{
-					Session: signInSession,
-				},
-			);
-			signInStore.dispatch({
-				type: 'SET_SIGN_IN_SESSION',
-				value: Session,
-			});
+				return {
+					isSignedIn: false,
+					nextStep: {
+						signInStep: 'CONTINUE_SIGN_IN_WITH_TOTP_SETUP',
+						totpSetupDetails: getTOTPSetupDetails(secretCode!, username),
+					},
+				};
+			}
 
-			return {
-				isSignedIn: false,
-				nextStep: {
-					signInStep: 'CONTINUE_SIGN_IN_WITH_TOTP_SETUP',
-					totpSetupDetails: getTOTPSetupDetails(secretCode!, username),
-				},
-			};
+			throw new AuthError({
+				name: AuthErrorCodes.SignInException,
+				message: `Cannot initiate MFA setup from available types: ${mfaSetupTypes}`,
+			});
 		}
 		case 'NEW_PASSWORD_REQUIRED':
 			return {
@@ -913,6 +922,18 @@ export async function getSignInResult(params: {
 					signInStep: 'CONFIRM_SIGN_IN_WITH_TOTP_CODE',
 				},
 			};
+		case 'EMAIL_OTP':
+			return {
+				isSignedIn: false,
+				nextStep: {
+					signInStep: 'CONFIRM_SIGN_IN_WITH_EMAIL_CODE',
+					codeDeliveryDetails: {
+						deliveryMedium:
+							challengeParameters.CODE_DELIVERY_DELIVERY_MEDIUM as AuthDeliveryMedium,
+						destination: challengeParameters.CODE_DELIVERY_DESTINATION,
+					},
+				},
+			};
 		case 'ADMIN_NO_SRP_AUTH':
 			break;
 		case 'DEVICE_PASSWORD_VERIFIER':
@@ -1000,14 +1021,6 @@ export async function handleChallengeName(
 	const deviceName = options?.friendlyDeviceName;
 
 	switch (challengeName) {
-		case 'SMS_MFA':
-			return handleSMSMFAChallenge({
-				challengeResponse,
-				clientMetadata,
-				session,
-				username,
-				config,
-			});
 		case 'SELECT_MFA_TYPE':
 			return handleSelectMFATypeChallenge({
 				challengeResponse,
@@ -1050,8 +1063,11 @@ export async function handleChallengeName(
 				username,
 				tokenOrchestrator,
 			);
+		case 'SMS_MFA':
 		case 'SOFTWARE_TOKEN_MFA':
-			return handleSoftwareTokenMFAChallenge({
+		case 'EMAIL_OTP':
+			return handleMFAChallenge({
+				challengeName,
 				challengeResponse,
 				clientMetadata,
 				session,
@@ -1062,7 +1078,7 @@ export async function handleChallengeName(
 	// TODO: remove this error message for production apps
 	throw new AuthError({
 		name: AuthErrorCodes.SignInException,
-		message: `An error occurred during the sign in process. 
+		message: `An error occurred during the sign in process.
 		${challengeName} challengeName returned by the underlying service was not addressed.`,
 	});
 }
@@ -1070,6 +1086,7 @@ export async function handleChallengeName(
 export function mapMfaType(mfa: string): CognitoMFAType {
 	let mfaType: CognitoMFAType = 'SMS_MFA';
 	if (mfa === 'TOTP') mfaType = 'SOFTWARE_TOKEN_MFA';
+	if (mfa === 'EMAIL') mfaType = 'EMAIL_OTP';
 
 	return mfaType;
 }
@@ -1077,6 +1094,7 @@ export function mapMfaType(mfa: string): CognitoMFAType {
 export function getMFAType(type?: string): AuthMFAType | undefined {
 	if (type === 'SMS_MFA') return 'SMS';
 	if (type === 'SOFTWARE_TOKEN_MFA') return 'TOTP';
+	if (type === 'EMAIL_OTP') return 'EMAIL';
 	// TODO: log warning for unknown MFA type
 }
 
@@ -1091,15 +1109,10 @@ export function parseMFATypes(mfa?: string): CognitoMFAType[] {
 	return JSON.parse(mfa) as CognitoMFAType[];
 }
 
-export function isMFATypeEnabled(
-	challengeParams: ChallengeParameters,
-	mfaType: AuthMFAType,
-): boolean {
-	const { MFAS_CAN_SETUP } = challengeParams;
-	const mfaTypes = getMFATypes(parseMFATypes(MFAS_CAN_SETUP));
-	if (!mfaTypes) return false;
-
-	return mfaTypes.includes(mfaType);
+export function getAllowedMfaSetupTypes(availableMfaSetupTypes: AuthMFAType[]) {
+	return availableMfaSetupTypes.filter(
+		authMfaType => authMfaType === 'EMAIL' || authMfaType === 'TOTP',
+	);
 }
 
 export async function assertUserNotAuthenticated() {
@@ -1230,3 +1243,64 @@ export function getActiveSignInUsername(username: string): string {
 
 	return state.username ?? username;
 }
+
+export async function handleMFAChallenge({
+	challengeName,
+	challengeResponse,
+	clientMetadata,
+	session,
+	username,
+	config,
+}: HandleAuthChallengeRequest & {
+	challengeName: Extract<
+		ChallengeName,
+		'EMAIL_OTP' | 'SMS_MFA' | 'SOFTWARE_TOKEN_MFA'
+	>;
+}) {
+	const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
+
+	const challengeResponses: Record<string, string> = {
+		USERNAME: username,
+	};
+
+	if (challengeName === 'EMAIL_OTP') {
+		challengeResponses.EMAIL_OTP_CODE = challengeResponse;
+	}
+
+	if (challengeName === 'SMS_MFA') {
+		challengeResponses.SMS_MFA_CODE = challengeResponse;
+	}
+
+	if (challengeName === 'SOFTWARE_TOKEN_MFA') {
+		challengeResponses.SOFTWARE_TOKEN_MFA_CODE = challengeResponse;
+	}
+
+	const userContextData = getUserContextData({
+		username,
+		userPoolId,
+		userPoolClientId,
+	});
+
+	const jsonReq: RespondToAuthChallengeCommandInput = {
+		ChallengeName: challengeName,
+		ChallengeResponses: challengeResponses,
+		Session: session,
+		ClientMetadata: clientMetadata,
+		ClientId: userPoolClientId,
+		UserContextData: userContextData,
+	};
+
+	const respondToAuthChallenge = createRespondToAuthChallengeClient({
+		endpointResolver: createCognitoUserPoolEndpointResolver({
+			endpointOverride: userPoolEndpoint,
+		}),
+	});
+
+	return respondToAuthChallenge(
+		{
+			region: getRegionFromUserPoolId(userPoolId),
+			userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
+		},
+		jsonReq,
+	);
+}

package/src/types/models.ts

@@ -44,7 +44,7 @@ export interface AuthTOTPSetupDetails {
 	getSetupUri(appName: string, accountName?: string): URL;
 }
 
-export type AuthMFAType = 'SMS' | 'TOTP';
+export type AuthMFAType = 'SMS' | 'TOTP' | 'EMAIL';
 
 export type AuthAllowedMFATypes = AuthMFAType[];
 
@@ -63,6 +63,20 @@ export interface ContinueSignInWithTOTPSetup {
 	signInStep: 'CONTINUE_SIGN_IN_WITH_TOTP_SETUP';
 	totpSetupDetails: AuthTOTPSetupDetails;
 }
+export interface ContinueSignInWithEmailSetup {
+	/**
+	 * Auth step requires user to set up EMAIL as multifactor authentication by associating an email address
+	 * and entering the OTP.
+	 *
+	 * @example
+	 * ```typescript
+	 * // Code retrieved from email
+	 * const emailAddress = 'example@example.com';
+	 * await confirmSignIn({challengeResponse: emailAddress });
+	 * ```
+	 */
+	signInStep: 'CONTINUE_SIGN_IN_WITH_EMAIL_SETUP';
+}
 export interface ConfirmSignInWithTOTPCode {
 	/**
 	 * Auth step requires user to use TOTP as multifactor authentication by retriving an OTP code from authenticator app.
@@ -92,6 +106,21 @@ export interface ContinueSignInWithMFASelection {
 	allowedMFATypes?: AuthAllowedMFATypes;
 }
 
+export interface ContinueSignInWithMFASetupSelection {
+	/**
+	 * Auth step requires user to select an mfa option (SMS | TOTP) to setup before continuing the sign-in flow.
+	 *
+	 * @example
+	 * ```typescript
+	 * await confirmSignIn({challengeResponse:'TOTP'});
+	 * // OR
+	 * await confirmSignIn({challengeResponse:'EMAIL'});
+	 * ```
+	 */
+	signInStep: 'CONTINUE_SIGN_IN_WITH_MFA_SETUP_SELECTION';
+	allowedMFATypes?: AuthAllowedMFATypes;
+}
+
 export interface ConfirmSignInWithCustomChallenge {
 	/**
 	 * Auth step requires user to respond to a custom challenge.
@@ -146,6 +175,21 @@ export interface ConfirmSignInWithSMSCode {
 	codeDeliveryDetails?: AuthCodeDeliveryDetails;
 }
 
+export interface ConfirmSignInWithEmailCode {
+	/**
+	 * Auth step requires user to use EMAIL as multifactor authentication by retrieving a code sent to inbox.
+	 *
+	 * @example
+	 * ```typescript
+	 * // Code retrieved from email
+	 * const emailCode = '112233'
+	 * await confirmSignIn({challengeResponse: emailCode})
+	 * ```
+	 */
+	signInStep: 'CONFIRM_SIGN_IN_WITH_EMAIL_CODE';
+	codeDeliveryDetails?: AuthCodeDeliveryDetails;
+}
+
 export interface ConfirmSignUpStep {
 	/**
 	 * Auth step requires to confirm user's sign-up.
@@ -181,7 +225,10 @@ export type AuthNextSignInStep<
 	| ConfirmSignInWithNewPasswordRequired<UserAttributeKey>
 	| ConfirmSignInWithSMSCode
 	| ConfirmSignInWithTOTPCode
+	| ConfirmSignInWithEmailCode
 	| ContinueSignInWithTOTPSetup
+	| ContinueSignInWithEmailSetup
+	| ContinueSignInWithMFASetupSelection
 	| ConfirmSignUpStep
 	| ResetPasswordStep
 	| DoneSignInStep;