@aws-amplify/auth 6.5.1-email-mfa-test.4e655bc.0 → 6.5.1-storage-browser.4db9fef.0

package/src/providers/cognito/utils/signInHelpers.ts

@@ -154,110 +154,49 @@ export async function handleMFASetupChallenge({
 	config,
 }: HandleAuthChallengeRequest): Promise<RespondToAuthChallengeCommandOutput> {
 	const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
-
-	if (challengeResponse === 'EMAIL') {
-		return {
-			ChallengeName: 'MFA_SETUP',
-			Session: session,
-			ChallengeParameters: {
-				MFAS_CAN_SETUP: '["EMAIL_OTP"]',
-			},
-			$metadata: {},
-		};
-	}
-
-	if (challengeResponse === 'TOTP') {
-		return {
-			ChallengeName: 'MFA_SETUP',
-			Session: session,
-			ChallengeParameters: {
-				MFAS_CAN_SETUP: '["SOFTWARE_TOKEN_MFA"]',
-			},
-			$metadata: {},
-		};
-	}
-
-	const challengeResponses: Record<string, string> = {
+	const challengeResponses = {
 		USERNAME: username,
 	};
-
-	const isTOTPCode = /^\d+$/.test(challengeResponse.trim());
-
-	if (isTOTPCode) {
-		const verifySoftwareToken = createVerifySoftwareTokenClient({
-			endpointResolver: createCognitoUserPoolEndpointResolver({
-				endpointOverride: userPoolEndpoint,
-			}),
-		});
-
-		const { Session } = await verifySoftwareToken(
-			{
-				region: getRegionFromUserPoolId(userPoolId),
-				userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
-			},
-			{
-				UserCode: challengeResponse,
-				Session: session,
-				FriendlyDeviceName: deviceName,
-			},
-		);
-
-		signInStore.dispatch({
-			type: 'SET_SIGN_IN_SESSION',
-			value: Session,
-		});
-
-		const jsonReq: RespondToAuthChallengeCommandInput = {
-			ChallengeName: 'MFA_SETUP',
-			ChallengeResponses: challengeResponses,
-			Session,
-			ClientMetadata: clientMetadata,
-			ClientId: userPoolClientId,
-		};
-
-		const respondToAuthChallenge = createRespondToAuthChallengeClient({
-			endpointResolver: createCognitoUserPoolEndpointResolver({
-				endpointOverride: userPoolEndpoint,
-			}),
-		});
-
-		return respondToAuthChallenge(
-			{ region: getRegionFromUserPoolId(userPoolId) },
-			jsonReq,
-		);
-	}
-
-	const isEmail = /^\S+@\S+\.\S+$/.test(challengeResponse.trim());
-
-	if (isEmail) {
-		challengeResponses.EMAIL = challengeResponse;
-
-		const jsonReq: RespondToAuthChallengeCommandInput = {
-			ChallengeName: 'MFA_SETUP',
-			ChallengeResponses: challengeResponses,
+	const verifySoftwareToken = createVerifySoftwareTokenClient({
+		endpointResolver: createCognitoUserPoolEndpointResolver({
+			endpointOverride: userPoolEndpoint,
+		}),
+	});
+	const { Session } = await verifySoftwareToken(
+		{
+			region: getRegionFromUserPoolId(userPoolId),
+			userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
+		},
+		{
+			UserCode: challengeResponse,
 			Session: session,
-			ClientMetadata: clientMetadata,
-			ClientId: userPoolClientId,
-		};
+			FriendlyDeviceName: deviceName,
+		},
+	);
 
-		const respondToAuthChallenge = createRespondToAuthChallengeClient({
-			endpointResolver: createCognitoUserPoolEndpointResolver({
-				endpointOverride: userPoolEndpoint,
-			}),
-		});
+	signInStore.dispatch({
+		type: 'SET_SIGN_IN_SESSION',
+		value: Session,
+	});
 
-		return respondToAuthChallenge(
-			{ region: getRegionFromUserPoolId(userPoolId) },
-			jsonReq,
-		);
-	}
+	const jsonReq: RespondToAuthChallengeCommandInput = {
+		ChallengeName: 'MFA_SETUP',
+		ChallengeResponses: challengeResponses,
+		Session,
+		ClientMetadata: clientMetadata,
+		ClientId: userPoolClientId,
+	};
 
-	throw new AuthError({
-		name: AuthErrorCodes.SignInException,
-		message: `Cannot proceed with MFA setup using challengeResponse: ${challengeResponse}`,
-		recoverySuggestion:
-			'Try passing "EMAIL", "TOTP", a valid email, or OTP code as the challengeResponse.',
+	const respondToAuthChallenge = createRespondToAuthChallengeClient({
+		endpointResolver: createCognitoUserPoolEndpointResolver({
+			endpointOverride: userPoolEndpoint,
+		}),
 	});
+
+	return respondToAuthChallenge(
+		{ region: getRegionFromUserPoolId(userPoolId) },
+		jsonReq,
+	);
 }
 
 export async function handleSelectMFATypeChallenge({
@@ -269,9 +208,7 @@ export async function handleSelectMFATypeChallenge({
 }: HandleAuthChallengeRequest): Promise<RespondToAuthChallengeCommandOutput> {
 	const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
 	assertValidationError(
-		challengeResponse === 'TOTP' ||
-			challengeResponse === 'SMS' ||
-			challengeResponse === 'EMAIL',
+		challengeResponse === 'TOTP' || challengeResponse === 'SMS',
 		AuthValidationErrorCode.IncorrectMFAMethod,
 	);
 
@@ -310,6 +247,88 @@ export async function handleSelectMFATypeChallenge({
 	);
 }
 
+export async function handleSMSMFAChallenge({
+	challengeResponse,
+	clientMetadata,
+	session,
+	username,
+	config,
+}: HandleAuthChallengeRequest): Promise<RespondToAuthChallengeCommandOutput> {
+	const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
+	const challengeResponses = {
+		USERNAME: username,
+		SMS_MFA_CODE: challengeResponse,
+	};
+	const UserContextData = getUserContextData({
+		username,
+		userPoolId,
+		userPoolClientId,
+	});
+	const jsonReq: RespondToAuthChallengeCommandInput = {
+		ChallengeName: 'SMS_MFA',
+		ChallengeResponses: challengeResponses,
+		Session: session,
+		ClientMetadata: clientMetadata,
+		ClientId: userPoolClientId,
+		UserContextData,
+	};
+
+	const respondToAuthChallenge = createRespondToAuthChallengeClient({
+		endpointResolver: createCognitoUserPoolEndpointResolver({
+			endpointOverride: userPoolEndpoint,
+		}),
+	});
+
+	return respondToAuthChallenge(
+		{
+			region: getRegionFromUserPoolId(userPoolId),
+			userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
+		},
+		jsonReq,
+	);
+}
+export async function handleSoftwareTokenMFAChallenge({
+	challengeResponse,
+	clientMetadata,
+	session,
+	username,
+	config,
+}: HandleAuthChallengeRequest): Promise<RespondToAuthChallengeCommandOutput> {
+	const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
+	const challengeResponses = {
+		USERNAME: username,
+		SOFTWARE_TOKEN_MFA_CODE: challengeResponse,
+	};
+
+	const UserContextData = getUserContextData({
+		username,
+		userPoolId,
+		userPoolClientId,
+	});
+
+	const jsonReq: RespondToAuthChallengeCommandInput = {
+		ChallengeName: 'SOFTWARE_TOKEN_MFA',
+		ChallengeResponses: challengeResponses,
+		Session: session,
+		ClientMetadata: clientMetadata,
+		ClientId: userPoolClientId,
+		UserContextData,
+	};
+
+	const respondToAuthChallenge = createRespondToAuthChallengeClient({
+		endpointResolver: createCognitoUserPoolEndpointResolver({
+			endpointOverride: userPoolEndpoint,
+		}),
+	});
+
+	return respondToAuthChallenge(
+		{
+			region: getRegionFromUserPoolId(userPoolId),
+			userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
+		},
+		jsonReq,
+	);
+}
 export async function handleCompleteNewPasswordChallenge({
 	challengeResponse,
 	clientMetadata,
@@ -823,65 +842,37 @@ export async function getSignInResult(params: {
 		case 'MFA_SETUP': {
 			const { signInSession, username } = signInStore.getState();
 
-			const mfaSetupTypes =
-				getMFATypes(parseMFATypes(challengeParameters.MFAS_CAN_SETUP)) || [];
-
-			const allowedMfaSetupTypes = getAllowedMfaSetupTypes(mfaSetupTypes);
-
-			const isTotpMfaSetupAvailable = allowedMfaSetupTypes.includes('TOTP');
-			const isEmailMfaSetupAvailable = allowedMfaSetupTypes.includes('EMAIL');
-
-			if (isTotpMfaSetupAvailable && isEmailMfaSetupAvailable) {
-				return {
-					isSignedIn: false,
-					nextStep: {
-						signInStep: 'CONTINUE_SIGN_IN_WITH_MFA_SETUP_SELECTION',
-						allowedMFATypes: allowedMfaSetupTypes,
-					},
-				};
-			}
-
-			if (isEmailMfaSetupAvailable) {
-				return {
-					isSignedIn: false,
-					nextStep: {
-						signInStep: 'CONTINUE_SIGN_IN_WITH_EMAIL_SETUP',
-					},
-				};
-			}
-
-			if (isTotpMfaSetupAvailable) {
-				const associateSoftwareToken = createAssociateSoftwareTokenClient({
-					endpointResolver: createCognitoUserPoolEndpointResolver({
-						endpointOverride: authConfig.userPoolEndpoint,
-					}),
-				});
-				const { Session, SecretCode: secretCode } =
-					await associateSoftwareToken(
-						{ region: getRegionFromUserPoolId(authConfig.userPoolId) },
-						{
-							Session: signInSession,
-						},
-					);
-
-				signInStore.dispatch({
-					type: 'SET_SIGN_IN_SESSION',
-					value: Session,
+			if (!isMFATypeEnabled(challengeParameters, 'TOTP'))
+				throw new AuthError({
+					name: AuthErrorCodes.SignInException,
+					message: `Cannot initiate MFA setup from available types: ${getMFATypes(
+						parseMFATypes(challengeParameters.MFAS_CAN_SETUP),
+					)}`,
 				});
 
-				return {
-					isSignedIn: false,
-					nextStep: {
-						signInStep: 'CONTINUE_SIGN_IN_WITH_TOTP_SETUP',
-						totpSetupDetails: getTOTPSetupDetails(secretCode!, username),
-					},
-				};
-			}
-
-			throw new AuthError({
-				name: AuthErrorCodes.SignInException,
-				message: `Cannot initiate MFA setup from available types: ${mfaSetupTypes}`,
+			const associateSoftwareToken = createAssociateSoftwareTokenClient({
+				endpointResolver: createCognitoUserPoolEndpointResolver({
+					endpointOverride: authConfig.userPoolEndpoint,
+				}),
+			});
+			const { Session, SecretCode: secretCode } = await associateSoftwareToken(
+				{ region: getRegionFromUserPoolId(authConfig.userPoolId) },
+				{
+					Session: signInSession,
+				},
+			);
+			signInStore.dispatch({
+				type: 'SET_SIGN_IN_SESSION',
+				value: Session,
 			});
+
+			return {
+				isSignedIn: false,
+				nextStep: {
+					signInStep: 'CONTINUE_SIGN_IN_WITH_TOTP_SETUP',
+					totpSetupDetails: getTOTPSetupDetails(secretCode!, username),
+				},
+			};
 		}
 		case 'NEW_PASSWORD_REQUIRED':
 			return {
@@ -922,18 +913,6 @@ export async function getSignInResult(params: {
 					signInStep: 'CONFIRM_SIGN_IN_WITH_TOTP_CODE',
 				},
 			};
-		case 'EMAIL_OTP':
-			return {
-				isSignedIn: false,
-				nextStep: {
-					signInStep: 'CONFIRM_SIGN_IN_WITH_EMAIL_CODE',
-					codeDeliveryDetails: {
-						deliveryMedium:
-							challengeParameters.CODE_DELIVERY_DELIVERY_MEDIUM as AuthDeliveryMedium,
-						destination: challengeParameters.CODE_DELIVERY_DESTINATION,
-					},
-				},
-			};
 		case 'ADMIN_NO_SRP_AUTH':
 			break;
 		case 'DEVICE_PASSWORD_VERIFIER':
@@ -1021,6 +1000,14 @@ export async function handleChallengeName(
 	const deviceName = options?.friendlyDeviceName;
 
 	switch (challengeName) {
+		case 'SMS_MFA':
+			return handleSMSMFAChallenge({
+				challengeResponse,
+				clientMetadata,
+				session,
+				username,
+				config,
+			});
 		case 'SELECT_MFA_TYPE':
 			return handleSelectMFATypeChallenge({
 				challengeResponse,
@@ -1063,11 +1050,8 @@ export async function handleChallengeName(
 				username,
 				tokenOrchestrator,
 			);
-		case 'SMS_MFA':
 		case 'SOFTWARE_TOKEN_MFA':
-		case 'EMAIL_OTP':
-			return handleMFAChallenge({
-				challengeName,
+			return handleSoftwareTokenMFAChallenge({
 				challengeResponse,
 				clientMetadata,
 				session,
@@ -1078,7 +1062,7 @@ export async function handleChallengeName(
 	// TODO: remove this error message for production apps
 	throw new AuthError({
 		name: AuthErrorCodes.SignInException,
-		message: `An error occurred during the sign in process.
+		message: `An error occurred during the sign in process. 
 		${challengeName} challengeName returned by the underlying service was not addressed.`,
 	});
 }
@@ -1086,7 +1070,6 @@ export async function handleChallengeName(
 export function mapMfaType(mfa: string): CognitoMFAType {
 	let mfaType: CognitoMFAType = 'SMS_MFA';
 	if (mfa === 'TOTP') mfaType = 'SOFTWARE_TOKEN_MFA';
-	if (mfa === 'EMAIL') mfaType = 'EMAIL_OTP';
 
 	return mfaType;
 }
@@ -1094,7 +1077,6 @@ export function mapMfaType(mfa: string): CognitoMFAType {
 export function getMFAType(type?: string): AuthMFAType | undefined {
 	if (type === 'SMS_MFA') return 'SMS';
 	if (type === 'SOFTWARE_TOKEN_MFA') return 'TOTP';
-	if (type === 'EMAIL_OTP') return 'EMAIL';
 	// TODO: log warning for unknown MFA type
 }
 
@@ -1109,10 +1091,15 @@ export function parseMFATypes(mfa?: string): CognitoMFAType[] {
 	return JSON.parse(mfa) as CognitoMFAType[];
 }
 
-export function getAllowedMfaSetupTypes(availableMfaSetupTypes: AuthMFAType[]) {
-	return availableMfaSetupTypes.filter(
-		authMfaType => authMfaType === 'EMAIL' || authMfaType === 'TOTP',
-	);
+export function isMFATypeEnabled(
+	challengeParams: ChallengeParameters,
+	mfaType: AuthMFAType,
+): boolean {
+	const { MFAS_CAN_SETUP } = challengeParams;
+	const mfaTypes = getMFATypes(parseMFATypes(MFAS_CAN_SETUP));
+	if (!mfaTypes) return false;
+
+	return mfaTypes.includes(mfaType);
 }
 
 export async function assertUserNotAuthenticated() {
@@ -1243,64 +1230,3 @@ export function getActiveSignInUsername(username: string): string {
 
 	return state.username ?? username;
 }
-
-export async function handleMFAChallenge({
-	challengeName,
-	challengeResponse,
-	clientMetadata,
-	session,
-	username,
-	config,
-}: HandleAuthChallengeRequest & {
-	challengeName: Extract<
-		ChallengeName,
-		'EMAIL_OTP' | 'SMS_MFA' | 'SOFTWARE_TOKEN_MFA'
-	>;
-}) {
-	const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
-
-	const challengeResponses: Record<string, string> = {
-		USERNAME: username,
-	};
-
-	if (challengeName === 'EMAIL_OTP') {
-		challengeResponses.EMAIL_OTP_CODE = challengeResponse;
-	}
-
-	if (challengeName === 'SMS_MFA') {
-		challengeResponses.SMS_MFA_CODE = challengeResponse;
-	}
-
-	if (challengeName === 'SOFTWARE_TOKEN_MFA') {
-		challengeResponses.SOFTWARE_TOKEN_MFA_CODE = challengeResponse;
-	}
-
-	const userContextData = getUserContextData({
-		username,
-		userPoolId,
-		userPoolClientId,
-	});
-
-	const jsonReq: RespondToAuthChallengeCommandInput = {
-		ChallengeName: challengeName,
-		ChallengeResponses: challengeResponses,
-		Session: session,
-		ClientMetadata: clientMetadata,
-		ClientId: userPoolClientId,
-		UserContextData: userContextData,
-	};
-
-	const respondToAuthChallenge = createRespondToAuthChallengeClient({
-		endpointResolver: createCognitoUserPoolEndpointResolver({
-			endpointOverride: userPoolEndpoint,
-		}),
-	});
-
-	return respondToAuthChallenge(
-		{
-			region: getRegionFromUserPoolId(userPoolId),
-			userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
-		},
-		jsonReq,
-	);
-}

package/src/types/models.ts

@@ -44,7 +44,7 @@ export interface AuthTOTPSetupDetails {
 	getSetupUri(appName: string, accountName?: string): URL;
 }
 
-export type AuthMFAType = 'SMS' | 'TOTP' | 'EMAIL';
+export type AuthMFAType = 'SMS' | 'TOTP';
 
 export type AuthAllowedMFATypes = AuthMFAType[];
 
@@ -63,20 +63,6 @@ export interface ContinueSignInWithTOTPSetup {
 	signInStep: 'CONTINUE_SIGN_IN_WITH_TOTP_SETUP';
 	totpSetupDetails: AuthTOTPSetupDetails;
 }
-export interface ContinueSignInWithEmailSetup {
-	/**
-	 * Auth step requires user to set up EMAIL as multifactor authentication by associating an email address
-	 * and entering the OTP.
-	 *
-	 * @example
-	 * ```typescript
-	 * // Code retrieved from email
-	 * const emailAddress = 'example@example.com';
-	 * await confirmSignIn({challengeResponse: emailAddress });
-	 * ```
-	 */
-	signInStep: 'CONTINUE_SIGN_IN_WITH_EMAIL_SETUP';
-}
 export interface ConfirmSignInWithTOTPCode {
 	/**
 	 * Auth step requires user to use TOTP as multifactor authentication by retriving an OTP code from authenticator app.
@@ -106,21 +92,6 @@ export interface ContinueSignInWithMFASelection {
 	allowedMFATypes?: AuthAllowedMFATypes;
 }
 
-export interface ContinueSignInWithMFASetupSelection {
-	/**
-	 * Auth step requires user to select an mfa option (SMS | TOTP) to setup before continuing the sign-in flow.
-	 *
-	 * @example
-	 * ```typescript
-	 * await confirmSignIn({challengeResponse:'TOTP'});
-	 * // OR
-	 * await confirmSignIn({challengeResponse:'EMAIL'});
-	 * ```
-	 */
-	signInStep: 'CONTINUE_SIGN_IN_WITH_MFA_SETUP_SELECTION';
-	allowedMFATypes?: AuthAllowedMFATypes;
-}
-
 export interface ConfirmSignInWithCustomChallenge {
 	/**
 	 * Auth step requires user to respond to a custom challenge.
@@ -175,21 +146,6 @@ export interface ConfirmSignInWithSMSCode {
 	codeDeliveryDetails?: AuthCodeDeliveryDetails;
 }
 
-export interface ConfirmSignInWithEmailCode {
-	/**
-	 * Auth step requires user to use EMAIL as multifactor authentication by retrieving a code sent to inbox.
-	 *
-	 * @example
-	 * ```typescript
-	 * // Code retrieved from email
-	 * const emailCode = '112233'
-	 * await confirmSignIn({challengeResponse: emailCode})
-	 * ```
-	 */
-	signInStep: 'CONFIRM_SIGN_IN_WITH_EMAIL_CODE';
-	codeDeliveryDetails?: AuthCodeDeliveryDetails;
-}
-
 export interface ConfirmSignUpStep {
 	/**
 	 * Auth step requires to confirm user's sign-up.
@@ -225,10 +181,7 @@ export type AuthNextSignInStep<
 	| ConfirmSignInWithNewPasswordRequired<UserAttributeKey>
 	| ConfirmSignInWithSMSCode
 	| ConfirmSignInWithTOTPCode
-	| ConfirmSignInWithEmailCode
 	| ContinueSignInWithTOTPSetup
-	| ContinueSignInWithEmailSetup
-	| ContinueSignInWithMFASetupSelection
 	| ConfirmSignUpStep
 	| ResetPasswordStep
 	| DoneSignInStep;