@aws-amplify/auth 6.5.1-email-mfa-test.4e655bc.0 → 6.5.1-storage-browser.4db9fef.0

package/dist/esm/providers/cognito/utils/signInHelpers.mjs

@@ -76,90 +76,43 @@ async function handleCustomChallenge({ challengeResponse, clientMetadata, sessio
 }
 async function handleMFASetupChallenge({ challengeResponse, username, clientMetadata, session, deviceName, config, }) {
     const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
-    if (challengeResponse === 'EMAIL') {
-        return {
-            ChallengeName: 'MFA_SETUP',
-            Session: session,
-            ChallengeParameters: {
-                MFAS_CAN_SETUP: '["EMAIL_OTP"]',
-            },
-            $metadata: {},
-        };
-    }
-    if (challengeResponse === 'TOTP') {
-        return {
-            ChallengeName: 'MFA_SETUP',
-            Session: session,
-            ChallengeParameters: {
-                MFAS_CAN_SETUP: '["SOFTWARE_TOKEN_MFA"]',
-            },
-            $metadata: {},
-        };
-    }
     const challengeResponses = {
         USERNAME: username,
     };
-    const isTOTPCode = /^\d+$/.test(challengeResponse.trim());
-    if (isTOTPCode) {
-        const verifySoftwareToken = createVerifySoftwareTokenClient({
-            endpointResolver: createCognitoUserPoolEndpointResolver({
-                endpointOverride: userPoolEndpoint,
-            }),
-        });
-        const { Session } = await verifySoftwareToken({
-            region: getRegionFromUserPoolId(userPoolId),
-            userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
-        }, {
-            UserCode: challengeResponse,
-            Session: session,
-            FriendlyDeviceName: deviceName,
-        });
-        signInStore.dispatch({
-            type: 'SET_SIGN_IN_SESSION',
-            value: Session,
-        });
-        const jsonReq = {
-            ChallengeName: 'MFA_SETUP',
-            ChallengeResponses: challengeResponses,
-            Session,
-            ClientMetadata: clientMetadata,
-            ClientId: userPoolClientId,
-        };
-        const respondToAuthChallenge = createRespondToAuthChallengeClient({
-            endpointResolver: createCognitoUserPoolEndpointResolver({
-                endpointOverride: userPoolEndpoint,
-            }),
-        });
-        return respondToAuthChallenge({ region: getRegionFromUserPoolId(userPoolId) }, jsonReq);
-    }
-    const isEmail = /^\S+@\S+\.\S+$/.test(challengeResponse.trim());
-    if (isEmail) {
-        challengeResponses.EMAIL = challengeResponse;
-        const jsonReq = {
-            ChallengeName: 'MFA_SETUP',
-            ChallengeResponses: challengeResponses,
-            Session: session,
-            ClientMetadata: clientMetadata,
-            ClientId: userPoolClientId,
-        };
-        const respondToAuthChallenge = createRespondToAuthChallengeClient({
-            endpointResolver: createCognitoUserPoolEndpointResolver({
-                endpointOverride: userPoolEndpoint,
-            }),
-        });
-        return respondToAuthChallenge({ region: getRegionFromUserPoolId(userPoolId) }, jsonReq);
-    }
-    throw new AuthError({
-        name: AuthErrorCodes.SignInException,
-        message: `Cannot proceed with MFA setup using challengeResponse: ${challengeResponse}`,
-        recoverySuggestion: 'Try passing "EMAIL", "TOTP", a valid email, or OTP code as the challengeResponse.',
+    const verifySoftwareToken = createVerifySoftwareTokenClient({
+        endpointResolver: createCognitoUserPoolEndpointResolver({
+            endpointOverride: userPoolEndpoint,
+        }),
+    });
+    const { Session } = await verifySoftwareToken({
+        region: getRegionFromUserPoolId(userPoolId),
+        userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
+    }, {
+        UserCode: challengeResponse,
+        Session: session,
+        FriendlyDeviceName: deviceName,
+    });
+    signInStore.dispatch({
+        type: 'SET_SIGN_IN_SESSION',
+        value: Session,
+    });
+    const jsonReq = {
+        ChallengeName: 'MFA_SETUP',
+        ChallengeResponses: challengeResponses,
+        Session,
+        ClientMetadata: clientMetadata,
+        ClientId: userPoolClientId,
+    };
+    const respondToAuthChallenge = createRespondToAuthChallengeClient({
+        endpointResolver: createCognitoUserPoolEndpointResolver({
+            endpointOverride: userPoolEndpoint,
+        }),
     });
+    return respondToAuthChallenge({ region: getRegionFromUserPoolId(userPoolId) }, jsonReq);
 }
 async function handleSelectMFATypeChallenge({ challengeResponse, username, clientMetadata, session, config, }) {
     const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
-    assertValidationError(challengeResponse === 'TOTP' ||
-        challengeResponse === 'SMS' ||
-        challengeResponse === 'EMAIL', AuthValidationErrorCode.IncorrectMFAMethod);
+    assertValidationError(challengeResponse === 'TOTP' || challengeResponse === 'SMS', AuthValidationErrorCode.IncorrectMFAMethod);
     const challengeResponses = {
         USERNAME: username,
         ANSWER: mapMfaType(challengeResponse),
@@ -187,6 +140,64 @@ async function handleSelectMFATypeChallenge({ challengeResponse, username, clien
         userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
     }, jsonReq);
 }
+async function handleSMSMFAChallenge({ challengeResponse, clientMetadata, session, username, config, }) {
+    const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
+    const challengeResponses = {
+        USERNAME: username,
+        SMS_MFA_CODE: challengeResponse,
+    };
+    const UserContextData = getUserContextData({
+        username,
+        userPoolId,
+        userPoolClientId,
+    });
+    const jsonReq = {
+        ChallengeName: 'SMS_MFA',
+        ChallengeResponses: challengeResponses,
+        Session: session,
+        ClientMetadata: clientMetadata,
+        ClientId: userPoolClientId,
+        UserContextData,
+    };
+    const respondToAuthChallenge = createRespondToAuthChallengeClient({
+        endpointResolver: createCognitoUserPoolEndpointResolver({
+            endpointOverride: userPoolEndpoint,
+        }),
+    });
+    return respondToAuthChallenge({
+        region: getRegionFromUserPoolId(userPoolId),
+        userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
+    }, jsonReq);
+}
+async function handleSoftwareTokenMFAChallenge({ challengeResponse, clientMetadata, session, username, config, }) {
+    const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
+    const challengeResponses = {
+        USERNAME: username,
+        SOFTWARE_TOKEN_MFA_CODE: challengeResponse,
+    };
+    const UserContextData = getUserContextData({
+        username,
+        userPoolId,
+        userPoolClientId,
+    });
+    const jsonReq = {
+        ChallengeName: 'SOFTWARE_TOKEN_MFA',
+        ChallengeResponses: challengeResponses,
+        Session: session,
+        ClientMetadata: clientMetadata,
+        ClientId: userPoolClientId,
+        UserContextData,
+    };
+    const respondToAuthChallenge = createRespondToAuthChallengeClient({
+        endpointResolver: createCognitoUserPoolEndpointResolver({
+            endpointOverride: userPoolEndpoint,
+        }),
+    });
+    return respondToAuthChallenge({
+        region: getRegionFromUserPoolId(userPoolId),
+        userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
+    }, jsonReq);
+}
 async function handleCompleteNewPasswordChallenge({ challengeResponse, clientMetadata, session, username, requiredAttributes, config, }) {
     const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
     const challengeResponses = {
@@ -540,52 +551,30 @@ async function getSignInResult(params) {
             };
         case 'MFA_SETUP': {
             const { signInSession, username } = signInStore.getState();
-            const mfaSetupTypes = getMFATypes(parseMFATypes(challengeParameters.MFAS_CAN_SETUP)) || [];
-            const allowedMfaSetupTypes = getAllowedMfaSetupTypes(mfaSetupTypes);
-            const isTotpMfaSetupAvailable = allowedMfaSetupTypes.includes('TOTP');
-            const isEmailMfaSetupAvailable = allowedMfaSetupTypes.includes('EMAIL');
-            if (isTotpMfaSetupAvailable && isEmailMfaSetupAvailable) {
-                return {
-                    isSignedIn: false,
-                    nextStep: {
-                        signInStep: 'CONTINUE_SIGN_IN_WITH_MFA_SETUP_SELECTION',
-                        allowedMFATypes: allowedMfaSetupTypes,
-                    },
-                };
-            }
-            if (isEmailMfaSetupAvailable) {
-                return {
-                    isSignedIn: false,
-                    nextStep: {
-                        signInStep: 'CONTINUE_SIGN_IN_WITH_EMAIL_SETUP',
-                    },
-                };
-            }
-            if (isTotpMfaSetupAvailable) {
-                const associateSoftwareToken = createAssociateSoftwareTokenClient({
-                    endpointResolver: createCognitoUserPoolEndpointResolver({
-                        endpointOverride: authConfig.userPoolEndpoint,
-                    }),
-                });
-                const { Session, SecretCode: secretCode } = await associateSoftwareToken({ region: getRegionFromUserPoolId(authConfig.userPoolId) }, {
-                    Session: signInSession,
-                });
-                signInStore.dispatch({
-                    type: 'SET_SIGN_IN_SESSION',
-                    value: Session,
+            if (!isMFATypeEnabled(challengeParameters, 'TOTP'))
+                throw new AuthError({
+                    name: AuthErrorCodes.SignInException,
+                    message: `Cannot initiate MFA setup from available types: ${getMFATypes(parseMFATypes(challengeParameters.MFAS_CAN_SETUP))}`,
                 });
-                return {
-                    isSignedIn: false,
-                    nextStep: {
-                        signInStep: 'CONTINUE_SIGN_IN_WITH_TOTP_SETUP',
-                        totpSetupDetails: getTOTPSetupDetails(secretCode, username),
-                    },
-                };
-            }
-            throw new AuthError({
-                name: AuthErrorCodes.SignInException,
-                message: `Cannot initiate MFA setup from available types: ${mfaSetupTypes}`,
+            const associateSoftwareToken = createAssociateSoftwareTokenClient({
+                endpointResolver: createCognitoUserPoolEndpointResolver({
+                    endpointOverride: authConfig.userPoolEndpoint,
+                }),
+            });
+            const { Session, SecretCode: secretCode } = await associateSoftwareToken({ region: getRegionFromUserPoolId(authConfig.userPoolId) }, {
+                Session: signInSession,
+            });
+            signInStore.dispatch({
+                type: 'SET_SIGN_IN_SESSION',
+                value: Session,
             });
+            return {
+                isSignedIn: false,
+                nextStep: {
+                    signInStep: 'CONTINUE_SIGN_IN_WITH_TOTP_SETUP',
+                    totpSetupDetails: getTOTPSetupDetails(secretCode, username),
+                },
+            };
         }
         case 'NEW_PASSWORD_REQUIRED':
             return {
@@ -621,17 +610,6 @@ async function getSignInResult(params) {
                     signInStep: 'CONFIRM_SIGN_IN_WITH_TOTP_CODE',
                 },
             };
-        case 'EMAIL_OTP':
-            return {
-                isSignedIn: false,
-                nextStep: {
-                    signInStep: 'CONFIRM_SIGN_IN_WITH_EMAIL_CODE',
-                    codeDeliveryDetails: {
-                        deliveryMedium: challengeParameters.CODE_DELIVERY_DELIVERY_MEDIUM,
-                        destination: challengeParameters.CODE_DELIVERY_DESTINATION,
-                    },
-                },
-            };
     }
     // TODO: remove this error message for production apps
     throw new AuthError({
@@ -683,6 +661,14 @@ async function handleChallengeName(username, challengeName, session, challengeRe
     const userAttributes = options?.userAttributes;
     const deviceName = options?.friendlyDeviceName;
     switch (challengeName) {
+        case 'SMS_MFA':
+            return handleSMSMFAChallenge({
+                challengeResponse,
+                clientMetadata,
+                session,
+                username,
+                config,
+            });
         case 'SELECT_MFA_TYPE':
             return handleSelectMFATypeChallenge({
                 challengeResponse,
@@ -720,11 +706,8 @@ async function handleChallengeName(username, challengeName, session, challengeRe
                     tokenOrchestrator,
                 },
             ], username, tokenOrchestrator);
-        case 'SMS_MFA':
         case 'SOFTWARE_TOKEN_MFA':
-        case 'EMAIL_OTP':
-            return handleMFAChallenge({
-                challengeName,
+            return handleSoftwareTokenMFAChallenge({
                 challengeResponse,
                 clientMetadata,
                 session,
@@ -735,7 +718,7 @@ async function handleChallengeName(username, challengeName, session, challengeRe
     // TODO: remove this error message for production apps
     throw new AuthError({
         name: AuthErrorCodes.SignInException,
-        message: `An error occurred during the sign in process.
+        message: `An error occurred during the sign in process. 
 		${challengeName} challengeName returned by the underlying service was not addressed.`,
     });
 }
@@ -743,8 +726,6 @@ function mapMfaType(mfa) {
     let mfaType = 'SMS_MFA';
     if (mfa === 'TOTP')
         mfaType = 'SOFTWARE_TOKEN_MFA';
-    if (mfa === 'EMAIL')
-        mfaType = 'EMAIL_OTP';
     return mfaType;
 }
 function getMFAType(type) {
@@ -752,8 +733,6 @@ function getMFAType(type) {
         return 'SMS';
     if (type === 'SOFTWARE_TOKEN_MFA')
         return 'TOTP';
-    if (type === 'EMAIL_OTP')
-        return 'EMAIL';
     // TODO: log warning for unknown MFA type
 }
 function getMFATypes(types) {
@@ -766,8 +745,12 @@ function parseMFATypes(mfa) {
         return [];
     return JSON.parse(mfa);
 }
-function getAllowedMfaSetupTypes(availableMfaSetupTypes) {
-    return availableMfaSetupTypes.filter(authMfaType => authMfaType === 'EMAIL' || authMfaType === 'TOTP');
+function isMFATypeEnabled(challengeParams, mfaType) {
+    const { MFAS_CAN_SETUP } = challengeParams;
+    const mfaTypes = getMFATypes(parseMFATypes(MFAS_CAN_SETUP));
+    if (!mfaTypes)
+        return false;
+    return mfaTypes.includes(mfaType);
 }
 async function assertUserNotAuthenticated() {
     let authUser;
@@ -861,43 +844,6 @@ function getActiveSignInUsername(username) {
     const state = signInStore.getState();
     return state.username ?? username;
 }
-async function handleMFAChallenge({ challengeName, challengeResponse, clientMetadata, session, username, config, }) {
-    const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
-    const challengeResponses = {
-        USERNAME: username,
-    };
-    if (challengeName === 'EMAIL_OTP') {
-        challengeResponses.EMAIL_OTP_CODE = challengeResponse;
-    }
-    if (challengeName === 'SMS_MFA') {
-        challengeResponses.SMS_MFA_CODE = challengeResponse;
-    }
-    if (challengeName === 'SOFTWARE_TOKEN_MFA') {
-        challengeResponses.SOFTWARE_TOKEN_MFA_CODE = challengeResponse;
-    }
-    const userContextData = getUserContextData({
-        username,
-        userPoolId,
-        userPoolClientId,
-    });
-    const jsonReq = {
-        ChallengeName: challengeName,
-        ChallengeResponses: challengeResponses,
-        Session: session,
-        ClientMetadata: clientMetadata,
-        ClientId: userPoolClientId,
-        UserContextData: userContextData,
-    };
-    const respondToAuthChallenge = createRespondToAuthChallengeClient({
-        endpointResolver: createCognitoUserPoolEndpointResolver({
-            endpointOverride: userPoolEndpoint,
-        }),
-    });
-    return respondToAuthChallenge({
-        region: getRegionFromUserPoolId(userPoolId),
-        userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
-    }, jsonReq);
-}
 
-export { assertUserNotAuthenticated, createAttributes, getActiveSignInUsername, getAllowedMfaSetupTypes, getMFAType, getMFATypes, getNewDeviceMetadata, getSignInResult, getSignInResultFromError, getTOTPSetupDetails, handleChallengeName, handleCompleteNewPasswordChallenge, handleCustomAuthFlowWithoutSRP, handleCustomChallenge, handleCustomSRPAuthFlow, handleMFAChallenge, handleMFASetupChallenge, handlePasswordVerifierChallenge, handleSelectMFATypeChallenge, handleUserPasswordAuthFlow, handleUserSRPAuthFlow, mapMfaType, parseAttributes, parseMFATypes, retryOnResourceNotFoundException, setActiveSignInUsername };
+export { assertUserNotAuthenticated, createAttributes, getActiveSignInUsername, getMFAType, getMFATypes, getNewDeviceMetadata, getSignInResult, getSignInResultFromError, getTOTPSetupDetails, handleChallengeName, handleCompleteNewPasswordChallenge, handleCustomAuthFlowWithoutSRP, handleCustomChallenge, handleCustomSRPAuthFlow, handleMFASetupChallenge, handlePasswordVerifierChallenge, handleSMSMFAChallenge, handleSelectMFATypeChallenge, handleSoftwareTokenMFAChallenge, handleUserPasswordAuthFlow, handleUserSRPAuthFlow, isMFATypeEnabled, mapMfaType, parseAttributes, parseMFATypes, retryOnResourceNotFoundException, setActiveSignInUsername };
 //# sourceMappingURL=signInHelpers.mjs.map