@aws-amplify/auth 6.5.6-unstable.caf00e2.0 → 6.6.0

package/dist/esm/providers/cognito/utils/signInHelpers.mjs

@@ -76,43 +76,96 @@ async function handleCustomChallenge({ challengeResponse, clientMetadata, sessio
 }
 async function handleMFASetupChallenge({ challengeResponse, username, clientMetadata, session, deviceName, config, }) {
     const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
+    if (challengeResponse === 'EMAIL') {
+        return {
+            ChallengeName: 'MFA_SETUP',
+            Session: session,
+            ChallengeParameters: {
+                MFAS_CAN_SETUP: '["EMAIL_OTP"]',
+            },
+            $metadata: {},
+        };
+    }
+    if (challengeResponse === 'TOTP') {
+        return {
+            ChallengeName: 'MFA_SETUP',
+            Session: session,
+            ChallengeParameters: {
+                MFAS_CAN_SETUP: '["SOFTWARE_TOKEN_MFA"]',
+            },
+            $metadata: {},
+        };
+    }
     const challengeResponses = {
         USERNAME: username,
     };
-    const verifySoftwareToken = createVerifySoftwareTokenClient({
-        endpointResolver: createCognitoUserPoolEndpointResolver({
-            endpointOverride: userPoolEndpoint,
-        }),
-    });
-    const { Session } = await verifySoftwareToken({
-        region: getRegionFromUserPoolId(userPoolId),
-        userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
-    }, {
-        UserCode: challengeResponse,
-        Session: session,
-        FriendlyDeviceName: deviceName,
-    });
-    signInStore.dispatch({
-        type: 'SET_SIGN_IN_SESSION',
-        value: Session,
-    });
-    const jsonReq = {
-        ChallengeName: 'MFA_SETUP',
-        ChallengeResponses: challengeResponses,
-        Session,
-        ClientMetadata: clientMetadata,
-        ClientId: userPoolClientId,
-    };
-    const respondToAuthChallenge = createRespondToAuthChallengeClient({
-        endpointResolver: createCognitoUserPoolEndpointResolver({
-            endpointOverride: userPoolEndpoint,
-        }),
+    const isTOTPCode = /^\d+$/.test(challengeResponse);
+    if (isTOTPCode) {
+        const verifySoftwareToken = createVerifySoftwareTokenClient({
+            endpointResolver: createCognitoUserPoolEndpointResolver({
+                endpointOverride: userPoolEndpoint,
+            }),
+        });
+        const { Session } = await verifySoftwareToken({
+            region: getRegionFromUserPoolId(userPoolId),
+            userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
+        }, {
+            UserCode: challengeResponse,
+            Session: session,
+            FriendlyDeviceName: deviceName,
+        });
+        signInStore.dispatch({
+            type: 'SET_SIGN_IN_SESSION',
+            value: Session,
+        });
+        const jsonReq = {
+            ChallengeName: 'MFA_SETUP',
+            ChallengeResponses: challengeResponses,
+            Session,
+            ClientMetadata: clientMetadata,
+            ClientId: userPoolClientId,
+        };
+        const respondToAuthChallenge = createRespondToAuthChallengeClient({
+            endpointResolver: createCognitoUserPoolEndpointResolver({
+                endpointOverride: userPoolEndpoint,
+            }),
+        });
+        return respondToAuthChallenge({
+            region: getRegionFromUserPoolId(userPoolId),
+            userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
+        }, jsonReq);
+    }
+    const isEmail = challengeResponse.includes('@');
+    if (isEmail) {
+        challengeResponses.EMAIL = challengeResponse;
+        const jsonReq = {
+            ChallengeName: 'MFA_SETUP',
+            ChallengeResponses: challengeResponses,
+            Session: session,
+            ClientMetadata: clientMetadata,
+            ClientId: userPoolClientId,
+        };
+        const respondToAuthChallenge = createRespondToAuthChallengeClient({
+            endpointResolver: createCognitoUserPoolEndpointResolver({
+                endpointOverride: userPoolEndpoint,
+            }),
+        });
+        return respondToAuthChallenge({
+            region: getRegionFromUserPoolId(userPoolId),
+            userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
+        }, jsonReq);
+    }
+    throw new AuthError({
+        name: AuthErrorCodes.SignInException,
+        message: `Cannot proceed with MFA setup using challengeResponse: ${challengeResponse}`,
+        recoverySuggestion: 'Try passing "EMAIL", "TOTP", a valid email, or OTP code as the challengeResponse.',
     });
-    return respondToAuthChallenge({ region: getRegionFromUserPoolId(userPoolId) }, jsonReq);
 }
 async function handleSelectMFATypeChallenge({ challengeResponse, username, clientMetadata, session, config, }) {
     const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
-    assertValidationError(challengeResponse === 'TOTP' || challengeResponse === 'SMS', AuthValidationErrorCode.IncorrectMFAMethod);
+    assertValidationError(challengeResponse === 'TOTP' ||
+        challengeResponse === 'SMS' ||
+        challengeResponse === 'EMAIL', AuthValidationErrorCode.IncorrectMFAMethod);
     const challengeResponses = {
         USERNAME: username,
         ANSWER: mapMfaType(challengeResponse),
@@ -140,64 +193,6 @@ async function handleSelectMFATypeChallenge({ challengeResponse, username, clien
         userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
     }, jsonReq);
 }
-async function handleSMSMFAChallenge({ challengeResponse, clientMetadata, session, username, config, }) {
-    const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
-    const challengeResponses = {
-        USERNAME: username,
-        SMS_MFA_CODE: challengeResponse,
-    };
-    const UserContextData = getUserContextData({
-        username,
-        userPoolId,
-        userPoolClientId,
-    });
-    const jsonReq = {
-        ChallengeName: 'SMS_MFA',
-        ChallengeResponses: challengeResponses,
-        Session: session,
-        ClientMetadata: clientMetadata,
-        ClientId: userPoolClientId,
-        UserContextData,
-    };
-    const respondToAuthChallenge = createRespondToAuthChallengeClient({
-        endpointResolver: createCognitoUserPoolEndpointResolver({
-            endpointOverride: userPoolEndpoint,
-        }),
-    });
-    return respondToAuthChallenge({
-        region: getRegionFromUserPoolId(userPoolId),
-        userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
-    }, jsonReq);
-}
-async function handleSoftwareTokenMFAChallenge({ challengeResponse, clientMetadata, session, username, config, }) {
-    const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
-    const challengeResponses = {
-        USERNAME: username,
-        SOFTWARE_TOKEN_MFA_CODE: challengeResponse,
-    };
-    const UserContextData = getUserContextData({
-        username,
-        userPoolId,
-        userPoolClientId,
-    });
-    const jsonReq = {
-        ChallengeName: 'SOFTWARE_TOKEN_MFA',
-        ChallengeResponses: challengeResponses,
-        Session: session,
-        ClientMetadata: clientMetadata,
-        ClientId: userPoolClientId,
-        UserContextData,
-    };
-    const respondToAuthChallenge = createRespondToAuthChallengeClient({
-        endpointResolver: createCognitoUserPoolEndpointResolver({
-            endpointOverride: userPoolEndpoint,
-        }),
-    });
-    return respondToAuthChallenge({
-        region: getRegionFromUserPoolId(userPoolId),
-        userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
-    }, jsonReq);
-}
 async function handleCompleteNewPasswordChallenge({ challengeResponse, clientMetadata, session, username, requiredAttributes, config, }) {
     const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
     const challengeResponses = {
@@ -551,30 +546,52 @@ async function getSignInResult(params) {
             };
         case 'MFA_SETUP': {
             const { signInSession, username } = signInStore.getState();
-            if (!isMFATypeEnabled(challengeParameters, 'TOTP'))
-                throw new AuthError({
-                    name: AuthErrorCodes.SignInException,
-                    message: `Cannot initiate MFA setup from available types: ${getMFATypes(parseMFATypes(challengeParameters.MFAS_CAN_SETUP))}`,
+            const mfaSetupTypes = getMFATypes(parseMFATypes(challengeParameters.MFAS_CAN_SETUP)) || [];
+            const allowedMfaSetupTypes = getAllowedMfaSetupTypes(mfaSetupTypes);
+            const isTotpMfaSetupAvailable = allowedMfaSetupTypes.includes('TOTP');
+            const isEmailMfaSetupAvailable = allowedMfaSetupTypes.includes('EMAIL');
+            if (isTotpMfaSetupAvailable && isEmailMfaSetupAvailable) {
+                return {
+                    isSignedIn: false,
+                    nextStep: {
+                        signInStep: 'CONTINUE_SIGN_IN_WITH_MFA_SETUP_SELECTION',
+                        allowedMFATypes: allowedMfaSetupTypes,
+                    },
+                };
+            }
+            if (isEmailMfaSetupAvailable) {
+                return {
+                    isSignedIn: false,
+                    nextStep: {
+                        signInStep: 'CONTINUE_SIGN_IN_WITH_EMAIL_SETUP',
+                    },
+                };
+            }
+            if (isTotpMfaSetupAvailable) {
+                const associateSoftwareToken = createAssociateSoftwareTokenClient({
+                    endpointResolver: createCognitoUserPoolEndpointResolver({
+                        endpointOverride: authConfig.userPoolEndpoint,
+                    }),
                 });
-            const associateSoftwareToken = createAssociateSoftwareTokenClient({
-                endpointResolver: createCognitoUserPoolEndpointResolver({
-                    endpointOverride: authConfig.userPoolEndpoint,
-                }),
-            });
-            const { Session, SecretCode: secretCode } = await associateSoftwareToken({ region: getRegionFromUserPoolId(authConfig.userPoolId) }, {
-                Session: signInSession,
-            });
-            signInStore.dispatch({
-                type: 'SET_SIGN_IN_SESSION',
-                value: Session,
+                const { Session, SecretCode: secretCode } = await associateSoftwareToken({ region: getRegionFromUserPoolId(authConfig.userPoolId) }, {
+                    Session: signInSession,
+                });
+                signInStore.dispatch({
+                    type: 'SET_SIGN_IN_SESSION',
+                    value: Session,
+                });
+                return {
+                    isSignedIn: false,
+                    nextStep: {
+                        signInStep: 'CONTINUE_SIGN_IN_WITH_TOTP_SETUP',
+                        totpSetupDetails: getTOTPSetupDetails(secretCode, username),
+                    },
+                };
+            }
+            throw new AuthError({
+                name: AuthErrorCodes.SignInException,
+                message: `Cannot initiate MFA setup from available types: ${mfaSetupTypes}`,
             });
-            return {
-                isSignedIn: false,
-                nextStep: {
-                    signInStep: 'CONTINUE_SIGN_IN_WITH_TOTP_SETUP',
-                    totpSetupDetails: getTOTPSetupDetails(secretCode, username),
-                },
-            };
         }
         case 'NEW_PASSWORD_REQUIRED':
             return {
@@ -610,6 +627,17 @@ async function getSignInResult(params) {
                     signInStep: 'CONFIRM_SIGN_IN_WITH_TOTP_CODE',
                 },
             };
+        case 'EMAIL_OTP':
+            return {
+                isSignedIn: false,
+                nextStep: {
+                    signInStep: 'CONFIRM_SIGN_IN_WITH_EMAIL_CODE',
+                    codeDeliveryDetails: {
+                        deliveryMedium: challengeParameters.CODE_DELIVERY_DELIVERY_MEDIUM,
+                        destination: challengeParameters.CODE_DELIVERY_DESTINATION,
+                    },
+                },
+            };
     }
     // TODO: remove this error message for production apps
     throw new AuthError({
@@ -661,14 +689,6 @@ async function handleChallengeName(username, challengeName, session, challengeRe
     const userAttributes = options?.userAttributes;
     const deviceName = options?.friendlyDeviceName;
     switch (challengeName) {
-        case 'SMS_MFA':
-            return handleSMSMFAChallenge({
-                challengeResponse,
-                clientMetadata,
-                session,
-                username,
-                config,
-            });
         case 'SELECT_MFA_TYPE':
             return handleSelectMFATypeChallenge({
                 challengeResponse,
@@ -706,8 +726,11 @@ async function handleChallengeName(username, challengeName, session, challengeRe
                     tokenOrchestrator,
                 },
             ], username, tokenOrchestrator);
+        case 'SMS_MFA':
         case 'SOFTWARE_TOKEN_MFA':
-            return handleSoftwareTokenMFAChallenge({
+        case 'EMAIL_OTP':
+            return handleMFAChallenge({
+                challengeName,
                 challengeResponse,
                 clientMetadata,
                 session,
@@ -718,7 +741,7 @@ async function handleChallengeName(username, challengeName, session, challengeRe
     // TODO: remove this error message for production apps
     throw new AuthError({
         name: AuthErrorCodes.SignInException,
-        message: `An error occurred during the sign in process. 
+        message: `An error occurred during the sign in process.
 		${challengeName} challengeName returned by the underlying service was not addressed.`,
     });
 }
@@ -726,6 +749,8 @@ function mapMfaType(mfa) {
     let mfaType = 'SMS_MFA';
     if (mfa === 'TOTP')
         mfaType = 'SOFTWARE_TOKEN_MFA';
+    if (mfa === 'EMAIL')
+        mfaType = 'EMAIL_OTP';
     return mfaType;
 }
 function getMFAType(type) {
@@ -733,6 +758,8 @@ function getMFAType(type) {
         return 'SMS';
     if (type === 'SOFTWARE_TOKEN_MFA')
         return 'TOTP';
+    if (type === 'EMAIL_OTP')
+        return 'EMAIL';
     // TODO: log warning for unknown MFA type
 }
 function getMFATypes(types) {
@@ -745,12 +772,8 @@ function parseMFATypes(mfa) {
         return [];
     return JSON.parse(mfa);
 }
-function isMFATypeEnabled(challengeParams, mfaType) {
-    const { MFAS_CAN_SETUP } = challengeParams;
-    const mfaTypes = getMFATypes(parseMFATypes(MFAS_CAN_SETUP));
-    if (!mfaTypes)
-        return false;
-    return mfaTypes.includes(mfaType);
+function getAllowedMfaSetupTypes(availableMfaSetupTypes) {
+    return availableMfaSetupTypes.filter(authMfaType => authMfaType === 'EMAIL' || authMfaType === 'TOTP');
 }
 async function assertUserNotAuthenticated() {
     let authUser;
@@ -844,6 +867,43 @@ function getActiveSignInUsername(username) {
     const state = signInStore.getState();
     return state.username ?? username;
 }
+async function handleMFAChallenge({ challengeName, challengeResponse, clientMetadata, session, username, config, }) {
+    const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
+    const challengeResponses = {
+        USERNAME: username,
+    };
+    if (challengeName === 'EMAIL_OTP') {
+        challengeResponses.EMAIL_OTP_CODE = challengeResponse;
+    }
+    if (challengeName === 'SMS_MFA') {
+        challengeResponses.SMS_MFA_CODE = challengeResponse;
+    }
+    if (challengeName === 'SOFTWARE_TOKEN_MFA') {
+        challengeResponses.SOFTWARE_TOKEN_MFA_CODE = challengeResponse;
+    }
+    const userContextData = getUserContextData({
+        username,
+        userPoolId,
+        userPoolClientId,
+    });
+    const jsonReq = {
+        ChallengeName: challengeName,
+        ChallengeResponses: challengeResponses,
+        Session: session,
+        ClientMetadata: clientMetadata,
+        ClientId: userPoolClientId,
+        UserContextData: userContextData,
+    };
+    const respondToAuthChallenge = createRespondToAuthChallengeClient({
+        endpointResolver: createCognitoUserPoolEndpointResolver({
+            endpointOverride: userPoolEndpoint,
+        }),
+    });
+    return respondToAuthChallenge({
+        region: getRegionFromUserPoolId(userPoolId),
+        userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
+    }, jsonReq);
+}
 
-export { assertUserNotAuthenticated, createAttributes, getActiveSignInUsername, getMFAType, getMFATypes, getNewDeviceMetadata, getSignInResult, getSignInResultFromError, getTOTPSetupDetails, handleChallengeName, handleCompleteNewPasswordChallenge, handleCustomAuthFlowWithoutSRP, handleCustomChallenge, handleCustomSRPAuthFlow, handleMFASetupChallenge, handlePasswordVerifierChallenge, handleSMSMFAChallenge, handleSelectMFATypeChallenge, handleSoftwareTokenMFAChallenge, handleUserPasswordAuthFlow, handleUserSRPAuthFlow, isMFATypeEnabled, mapMfaType, parseAttributes, parseMFATypes, retryOnResourceNotFoundException, setActiveSignInUsername };
+export { assertUserNotAuthenticated, createAttributes, getActiveSignInUsername, getAllowedMfaSetupTypes, getMFAType, getMFATypes, getNewDeviceMetadata, getSignInResult, getSignInResultFromError, getTOTPSetupDetails, handleChallengeName, handleCompleteNewPasswordChallenge, handleCustomAuthFlowWithoutSRP, handleCustomChallenge, handleCustomSRPAuthFlow, handleMFAChallenge, handleMFASetupChallenge, handlePasswordVerifierChallenge, handleSelectMFATypeChallenge, handleUserPasswordAuthFlow, handleUserSRPAuthFlow, mapMfaType, parseAttributes, parseMFATypes, retryOnResourceNotFoundException, setActiveSignInUsername };
 //# sourceMappingURL=signInHelpers.mjs.map