@aws-amplify/auth 6.7.1-unstable.ab33a03.0 → 6.8.0

package/dist/cjs/client/apis/associateWebAuthnCredential.js

@@ -0,0 +1,62 @@
+'use strict';
+
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.associateWebAuthnCredential = void 0;
+const core_1 = require("@aws-amplify/core");
+const utils_1 = require("@aws-amplify/core/internals/utils");
+const types_1 = require("../../providers/cognito/utils/types");
+const factories_1 = require("../../providers/cognito/factories");
+const parsers_1 = require("../../foundation/parsers");
+const utils_2 = require("../../utils");
+const utils_3 = require("../utils");
+const cognitoIdentityProvider_1 = require("../../foundation/factories/serviceClients/cognitoIdentityProvider");
+const types_2 = require("../utils/passkey/types");
+/**
+ * Registers a new passkey for an authenticated user
+ *
+ * @returns Promise<void>
+ * @throws - {@link PasskeyError}:
+ * - Thrown when intermediate state is invalid
+ * @throws - {@link AuthError}:
+ * - Thrown when user is unauthenticated
+ * @throws - {@link StartWebAuthnRegistrationException}
+ * - Thrown due to a service error retrieving WebAuthn registration options
+ * @throws - {@link CompleteWebAuthnRegistrationException}
+ * - Thrown due to a service error when verifying WebAuthn registration result
+ */
+async function associateWebAuthnCredential() {
+    const authConfig = core_1.Amplify.getConfig().Auth?.Cognito;
+    (0, utils_1.assertTokenProviderConfig)(authConfig);
+    const { userPoolEndpoint, userPoolId } = authConfig;
+    const { tokens } = await (0, core_1.fetchAuthSession)();
+    (0, types_1.assertAuthTokens)(tokens);
+    const startWebAuthnRegistration = (0, cognitoIdentityProvider_1.createStartWebAuthnRegistrationClient)({
+        endpointResolver: (0, factories_1.createCognitoUserPoolEndpointResolver)({
+            endpointOverride: userPoolEndpoint,
+        }),
+    });
+    const { CredentialCreationOptions: credentialCreationOptions } = await startWebAuthnRegistration({
+        region: (0, parsers_1.getRegionFromUserPoolId)(userPoolId),
+        userAgentValue: (0, utils_2.getAuthUserAgentValue)(utils_1.AuthAction.StartWebAuthnRegistration),
+    }, {
+        AccessToken: tokens.accessToken.toString(),
+    });
+    (0, types_2.assertValidCredentialCreationOptions)(credentialCreationOptions);
+    const cred = await (0, utils_3.registerPasskey)(credentialCreationOptions);
+    const completeWebAuthnRegistration = (0, cognitoIdentityProvider_1.createCompleteWebAuthnRegistrationClient)({
+        endpointResolver: (0, factories_1.createCognitoUserPoolEndpointResolver)({
+            endpointOverride: userPoolEndpoint,
+        }),
+    });
+    await completeWebAuthnRegistration({
+        region: (0, parsers_1.getRegionFromUserPoolId)(userPoolId),
+        userAgentValue: (0, utils_2.getAuthUserAgentValue)(utils_1.AuthAction.CompleteWebAuthnRegistration),
+    }, {
+        AccessToken: tokens.accessToken.toString(),
+        Credential: cred,
+    });
+}
+exports.associateWebAuthnCredential = associateWebAuthnCredential;
+//# sourceMappingURL=associateWebAuthnCredential.js.map

package/dist/cjs/client/apis/associateWebAuthnCredential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"associateWebAuthnCredential.js","sources":["../../../../src/client/apis/associateWebAuthnCredential.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.associateWebAuthnCredential = void 0;\nconst core_1 = require(\"@aws-amplify/core\");\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nconst types_1 = require(\"../../providers/cognito/utils/types\");\nconst factories_1 = require(\"../../providers/cognito/factories\");\nconst parsers_1 = require(\"../../foundation/parsers\");\nconst utils_2 = require(\"../../utils\");\nconst utils_3 = require(\"../utils\");\nconst cognitoIdentityProvider_1 = require(\"../../foundation/factories/serviceClients/cognitoIdentityProvider\");\nconst types_2 = require(\"../utils/passkey/types\");\n/**\n * Registers a new passkey for an authenticated user\n *\n * @returns Promise<void>\n * @throws - {@link PasskeyError}:\n * - Thrown when intermediate state is invalid\n * @throws - {@link AuthError}:\n * - Thrown when user is unauthenticated\n * @throws - {@link StartWebAuthnRegistrationException}\n * - Thrown due to a service error retrieving WebAuthn registration options\n * @throws - {@link CompleteWebAuthnRegistrationException}\n * - Thrown due to a service error when verifying WebAuthn registration result\n */\nasync function associateWebAuthnCredential() {\n    const authConfig = core_1.Amplify.getConfig().Auth?.Cognito;\n    (0, utils_1.assertTokenProviderConfig)(authConfig);\n    const { userPoolEndpoint, userPoolId } = authConfig;\n    const { tokens } = await (0, core_1.fetchAuthSession)();\n    (0, types_1.assertAuthTokens)(tokens);\n    const startWebAuthnRegistration = (0, cognitoIdentityProvider_1.createStartWebAuthnRegistrationClient)({\n        endpointResolver: (0, factories_1.createCognitoUserPoolEndpointResolver)({\n            endpointOverride: userPoolEndpoint,\n        }),\n    });\n    const { CredentialCreationOptions: credentialCreationOptions } = await startWebAuthnRegistration({\n        region: (0, parsers_1.getRegionFromUserPoolId)(userPoolId),\n        userAgentValue: (0, utils_2.getAuthUserAgentValue)(utils_1.AuthAction.StartWebAuthnRegistration),\n    }, {\n        AccessToken: tokens.accessToken.toString(),\n    });\n    (0, types_2.assertValidCredentialCreationOptions)(credentialCreationOptions);\n    const cred = await (0, utils_3.registerPasskey)(credentialCreationOptions);\n    const completeWebAuthnRegistration = (0, cognitoIdentityProvider_1.createCompleteWebAuthnRegistrationClient)({\n        endpointResolver: (0, factories_1.createCognitoUserPoolEndpointResolver)({\n            endpointOverride: userPoolEndpoint,\n        }),\n    });\n    await completeWebAuthnRegistration({\n        region: (0, parsers_1.getRegionFromUserPoolId)(userPoolId),\n        userAgentValue: (0, utils_2.getAuthUserAgentValue)(utils_1.AuthAction.CompleteWebAuthnRegistration),\n    }, {\n        AccessToken: tokens.accessToken.toString(),\n        Credential: cred,\n    });\n}\nexports.associateWebAuthnCredential = associateWebAuthnCredential;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,OAAO,CAAC,2BAA2B,GAAG,KAAK,CAAC,CAAC;AAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC,CAAC;AAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,qCAAqC,CAAC,CAAC;AAC/D,MAAM,WAAW,GAAG,OAAO,CAAC,mCAAmC,CAAC,CAAC;AACjE,MAAM,SAAS,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;AACtD,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;AACvC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AACpC,MAAM,yBAAyB,GAAG,OAAO,CAAC,mEAAmE,CAAC,CAAC;AAC/G,MAAM,OAAO,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;AAClD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,2BAA2B,GAAG;AAC7C,IAAI,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC;AAChE,IAAI,IAAI,OAAO,CAAC,yBAAyB,EAAE,UAAU,CAAC,CAAC;AACvD,IAAI,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC;AACxD,IAAI,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,gBAAgB,GAAG,CAAC;AAC5D,IAAI,IAAI,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;AAC1C,IAAI,MAAM,yBAAyB,GAAG,IAAI,yBAAyB,CAAC,qCAAqC,EAAE;AAC3G,QAAQ,gBAAgB,EAAE,IAAI,WAAW,CAAC,qCAAqC,EAAE;AACjF,YAAY,gBAAgB,EAAE,gBAAgB;AAC9C,SAAS,CAAC;AACV,KAAK,CAAC,CAAC;AACP,IAAI,MAAM,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,GAAG,MAAM,yBAAyB,CAAC;AACrG,QAAQ,MAAM,EAAE,IAAI,SAAS,CAAC,uBAAuB,EAAE,UAAU,CAAC;AAClE,QAAQ,cAAc,EAAE,IAAI,OAAO,CAAC,qBAAqB,EAAE,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC;AACxG,KAAK,EAAE;AACP,QAAQ,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE;AAClD,KAAK,CAAC,CAAC;AACP,IAAI,IAAI,OAAO,CAAC,oCAAoC,EAAE,yBAAyB,CAAC,CAAC;AACjF,IAAI,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;AAC/E,IAAI,MAAM,4BAA4B,GAAG,IAAI,yBAAyB,CAAC,wCAAwC,EAAE;AACjH,QAAQ,gBAAgB,EAAE,IAAI,WAAW,CAAC,qCAAqC,EAAE;AACjF,YAAY,gBAAgB,EAAE,gBAAgB;AAC9C,SAAS,CAAC;AACV,KAAK,CAAC,CAAC;AACP,IAAI,MAAM,4BAA4B,CAAC;AACvC,QAAQ,MAAM,EAAE,IAAI,SAAS,CAAC,uBAAuB,EAAE,UAAU,CAAC;AAClE,QAAQ,cAAc,EAAE,IAAI,OAAO,CAAC,qBAAqB,EAAE,OAAO,CAAC,UAAU,CAAC,4BAA4B,CAAC;AAC3G,KAAK,EAAE;AACP,QAAQ,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE;AAClD,QAAQ,UAAU,EAAE,IAAI;AACxB,KAAK,CAAC,CAAC;AACP,CAAC;AACD,OAAO,CAAC,2BAA2B,GAAG,2BAA2B;;"}

package/dist/cjs/client/apis/deleteWebAuthnCredential.js

@@ -0,0 +1,22 @@
+'use strict';
+
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deleteWebAuthnCredential = void 0;
+const core_1 = require("@aws-amplify/core");
+const apis_1 = require("../../foundation/apis");
+/**
+ * Delete a registered credential for an authenticated user by credentialId
+ * @param {DeleteWebAuthnCredentialInput} input The delete input parameters including the credentialId
+ * @returns Promise<void>
+ * @throws - {@link AuthError}:
+ * - Thrown when user is unauthenticated
+ * @throws - {@link DeleteWebAuthnCredentialException}
+ * - Thrown due to a service error when deleting a WebAuthn credential
+ */
+async function deleteWebAuthnCredential(input) {
+    return (0, apis_1.deleteWebAuthnCredential)(core_1.Amplify, input);
+}
+exports.deleteWebAuthnCredential = deleteWebAuthnCredential;
+//# sourceMappingURL=deleteWebAuthnCredential.js.map

package/dist/cjs/client/apis/deleteWebAuthnCredential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deleteWebAuthnCredential.js","sources":["../../../../src/client/apis/deleteWebAuthnCredential.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.deleteWebAuthnCredential = void 0;\nconst core_1 = require(\"@aws-amplify/core\");\nconst apis_1 = require(\"../../foundation/apis\");\n/**\n * Delete a registered credential for an authenticated user by credentialId\n * @param {DeleteWebAuthnCredentialInput} input The delete input parameters including the credentialId\n * @returns Promise<void>\n * @throws - {@link AuthError}:\n * - Thrown when user is unauthenticated\n * @throws - {@link DeleteWebAuthnCredentialException}\n * - Thrown due to a service error when deleting a WebAuthn credential\n */\nasync function deleteWebAuthnCredential(input) {\n    return (0, apis_1.deleteWebAuthnCredential)(core_1.Amplify, input);\n}\nexports.deleteWebAuthnCredential = deleteWebAuthnCredential;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,OAAO,CAAC,wBAAwB,GAAG,KAAK,CAAC,CAAC;AAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;AAChD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,wBAAwB,CAAC,KAAK,EAAE;AAC/C,IAAI,OAAO,IAAI,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACvE,CAAC;AACD,OAAO,CAAC,wBAAwB,GAAG,wBAAwB;;"}

package/dist/cjs/client/apis/index.js

@@ -0,0 +1,13 @@
+'use strict';
+
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deleteWebAuthnCredential = exports.listWebAuthnCredentials = exports.associateWebAuthnCredential = void 0;
+var associateWebAuthnCredential_1 = require("./associateWebAuthnCredential");
+Object.defineProperty(exports, "associateWebAuthnCredential", { enumerable: true, get: function () { return associateWebAuthnCredential_1.associateWebAuthnCredential; } });
+var listWebAuthnCredentials_1 = require("./listWebAuthnCredentials");
+Object.defineProperty(exports, "listWebAuthnCredentials", { enumerable: true, get: function () { return listWebAuthnCredentials_1.listWebAuthnCredentials; } });
+var deleteWebAuthnCredential_1 = require("./deleteWebAuthnCredential");
+Object.defineProperty(exports, "deleteWebAuthnCredential", { enumerable: true, get: function () { return deleteWebAuthnCredential_1.deleteWebAuthnCredential; } });
+//# sourceMappingURL=index.js.map

package/dist/cjs/client/apis/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":["../../../../src/client/apis/index.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.deleteWebAuthnCredential = exports.listWebAuthnCredentials = exports.associateWebAuthnCredential = void 0;\nvar associateWebAuthnCredential_1 = require(\"./associateWebAuthnCredential\");\nObject.defineProperty(exports, \"associateWebAuthnCredential\", { enumerable: true, get: function () { return associateWebAuthnCredential_1.associateWebAuthnCredential; } });\nvar listWebAuthnCredentials_1 = require(\"./listWebAuthnCredentials\");\nObject.defineProperty(exports, \"listWebAuthnCredentials\", { enumerable: true, get: function () { return listWebAuthnCredentials_1.listWebAuthnCredentials; } });\nvar deleteWebAuthnCredential_1 = require(\"./deleteWebAuthnCredential\");\nObject.defineProperty(exports, \"deleteWebAuthnCredential\", { enumerable: true, get: function () { return deleteWebAuthnCredential_1.deleteWebAuthnCredential; } });\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,OAAO,CAAC,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,GAAG,OAAO,CAAC,2BAA2B,GAAG,KAAK,CAAC,CAAC;AAClH,IAAI,6BAA6B,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAAC;AAC7E,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,6BAA6B,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,6BAA6B,CAAC,2BAA2B,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5K,IAAI,yBAAyB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;AACrE,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,yBAAyB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,yBAAyB,CAAC,uBAAuB,CAAC,EAAE,EAAE,CAAC,CAAC;AAChK,IAAI,0BAA0B,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;AACvE,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,0BAA0B,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,0BAA0B,CAAC,wBAAwB,CAAC,EAAE,EAAE,CAAC;;"}

package/dist/cjs/client/apis/listWebAuthnCredentials.js

@@ -0,0 +1,23 @@
+'use strict';
+
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listWebAuthnCredentials = void 0;
+const core_1 = require("@aws-amplify/core");
+const apis_1 = require("../../foundation/apis");
+/**
+ * Lists registered credentials for an authenticated user
+ *
+ * @param {ListWebAuthnCredentialsInput} input The list input parameters including page size and next token.
+ * @returns Promise<ListWebAuthnCredentialsOutput>
+ * @throws - {@link AuthError}:
+ * - Thrown when user is unauthenticated
+ * @throws - {@link ListWebAuthnCredentialsException}
+ * - Thrown due to a service error when listing WebAuthn credentials
+ */
+async function listWebAuthnCredentials(input) {
+    return (0, apis_1.listWebAuthnCredentials)(core_1.Amplify, input);
+}
+exports.listWebAuthnCredentials = listWebAuthnCredentials;
+//# sourceMappingURL=listWebAuthnCredentials.js.map

package/dist/cjs/client/apis/listWebAuthnCredentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"listWebAuthnCredentials.js","sources":["../../../../src/client/apis/listWebAuthnCredentials.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.listWebAuthnCredentials = void 0;\nconst core_1 = require(\"@aws-amplify/core\");\nconst apis_1 = require(\"../../foundation/apis\");\n/**\n * Lists registered credentials for an authenticated user\n *\n * @param {ListWebAuthnCredentialsInput} input The list input parameters including page size and next token.\n * @returns Promise<ListWebAuthnCredentialsOutput>\n * @throws - {@link AuthError}:\n * - Thrown when user is unauthenticated\n * @throws - {@link ListWebAuthnCredentialsException}\n * - Thrown due to a service error when listing WebAuthn credentials\n */\nasync function listWebAuthnCredentials(input) {\n    return (0, apis_1.listWebAuthnCredentials)(core_1.Amplify, input);\n}\nexports.listWebAuthnCredentials = listWebAuthnCredentials;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,OAAO,CAAC,uBAAuB,GAAG,KAAK,CAAC,CAAC;AACzC,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;AAChD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,uBAAuB,CAAC,KAAK,EAAE;AAC9C,IAAI,OAAO,IAAI,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC;AACD,OAAO,CAAC,uBAAuB,GAAG,uBAAuB;;"}

package/dist/cjs/client/flows/shared/handlePasswordSRP.js

@@ -0,0 +1,79 @@
+'use strict';
+
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handlePasswordSRP = void 0;
+const utils_1 = require("@aws-amplify/core/internals/utils");
+const userContextData_1 = require("../../../providers/cognito/utils/userContextData");
+const srp_1 = require("../../../providers/cognito/utils/srp");
+const signInHelpers_1 = require("../../../providers/cognito/utils/signInHelpers");
+const cognitoIdentityProvider_1 = require("../../../foundation/factories/serviceClients/cognitoIdentityProvider");
+const factories_1 = require("../../../providers/cognito/factories");
+const parsers_1 = require("../../../foundation/parsers");
+const utils_2 = require("../../../utils");
+/**
+ * Handles the Password SRP (Secure Remote Password) authentication flow.
+ * This function can be used with both USER_SRP_AUTH and USER_AUTH flows.
+ *
+ * @param {Object} params - The parameters for the Password SRP authentication
+ * @param {string} params.username - The username for authentication
+ * @param {string} params.password - The user's password
+ * @param {ClientMetadata} [params.clientMetadata] - Optional metadata to be sent with auth requests
+ * @param {CognitoUserPoolConfig} params.config - Cognito User Pool configuration
+ * @param {AuthTokenOrchestrator} params.tokenOrchestrator - Token orchestrator for managing auth tokens
+ * @param {AuthFlowType} params.authFlow - The type of authentication flow ('USER_SRP_AUTH' or 'USER_AUTH')
+ * @param {AuthFactorType} [params.preferredChallenge] - Optional preferred challenge type when using USER_AUTH flow
+ *
+ * @returns {Promise<RespondToAuthChallengeCommandOutput>} The authentication response
+ */
+async function handlePasswordSRP({ username, password, clientMetadata, config, tokenOrchestrator, authFlow, preferredChallenge, }) {
+    const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
+    const userPoolName = userPoolId?.split('_')[1] || '';
+    const authenticationHelper = await (0, srp_1.getAuthenticationHelper)(userPoolName);
+    const authParameters = {
+        USERNAME: username,
+        SRP_A: authenticationHelper.A.toString(16),
+    };
+    if (authFlow === 'USER_AUTH' && preferredChallenge) {
+        authParameters.PREFERRED_CHALLENGE = preferredChallenge;
+    }
+    const UserContextData = (0, userContextData_1.getUserContextData)({
+        username,
+        userPoolId,
+        userPoolClientId,
+    });
+    const jsonReq = {
+        AuthFlow: authFlow,
+        AuthParameters: authParameters,
+        ClientMetadata: clientMetadata,
+        ClientId: userPoolClientId,
+        UserContextData,
+    };
+    const initiateAuth = (0, cognitoIdentityProvider_1.createInitiateAuthClient)({
+        endpointResolver: (0, factories_1.createCognitoUserPoolEndpointResolver)({
+            endpointOverride: userPoolEndpoint,
+        }),
+    });
+    const resp = await initiateAuth({
+        region: (0, parsers_1.getRegionFromUserPoolId)(userPoolId),
+        userAgentValue: (0, utils_2.getAuthUserAgentValue)(utils_1.AuthAction.SignIn),
+    }, jsonReq);
+    const { ChallengeParameters: challengeParameters, Session: session } = resp;
+    const activeUsername = challengeParameters?.USERNAME ?? username;
+    (0, signInHelpers_1.setActiveSignInUsername)(activeUsername);
+    if (resp.ChallengeName === 'PASSWORD_VERIFIER') {
+        return (0, signInHelpers_1.retryOnResourceNotFoundException)(signInHelpers_1.handlePasswordVerifierChallenge, [
+            password,
+            challengeParameters,
+            clientMetadata,
+            session,
+            authenticationHelper,
+            config,
+            tokenOrchestrator,
+        ], activeUsername, tokenOrchestrator);
+    }
+    return resp;
+}
+exports.handlePasswordSRP = handlePasswordSRP;
+//# sourceMappingURL=handlePasswordSRP.js.map

package/dist/cjs/client/flows/shared/handlePasswordSRP.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlePasswordSRP.js","sources":["../../../../../src/client/flows/shared/handlePasswordSRP.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.handlePasswordSRP = void 0;\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nconst userContextData_1 = require(\"../../../providers/cognito/utils/userContextData\");\nconst srp_1 = require(\"../../../providers/cognito/utils/srp\");\nconst signInHelpers_1 = require(\"../../../providers/cognito/utils/signInHelpers\");\nconst cognitoIdentityProvider_1 = require(\"../../../foundation/factories/serviceClients/cognitoIdentityProvider\");\nconst factories_1 = require(\"../../../providers/cognito/factories\");\nconst parsers_1 = require(\"../../../foundation/parsers\");\nconst utils_2 = require(\"../../../utils\");\n/**\n * Handles the Password SRP (Secure Remote Password) authentication flow.\n * This function can be used with both USER_SRP_AUTH and USER_AUTH flows.\n *\n * @param {Object} params - The parameters for the Password SRP authentication\n * @param {string} params.username - The username for authentication\n * @param {string} params.password - The user's password\n * @param {ClientMetadata} [params.clientMetadata] - Optional metadata to be sent with auth requests\n * @param {CognitoUserPoolConfig} params.config - Cognito User Pool configuration\n * @param {AuthTokenOrchestrator} params.tokenOrchestrator - Token orchestrator for managing auth tokens\n * @param {AuthFlowType} params.authFlow - The type of authentication flow ('USER_SRP_AUTH' or 'USER_AUTH')\n * @param {AuthFactorType} [params.preferredChallenge] - Optional preferred challenge type when using USER_AUTH flow\n *\n * @returns {Promise<RespondToAuthChallengeCommandOutput>} The authentication response\n */\nasync function handlePasswordSRP({ username, password, clientMetadata, config, tokenOrchestrator, authFlow, preferredChallenge, }) {\n    const { userPoolId, userPoolClientId, userPoolEndpoint } = config;\n    const userPoolName = userPoolId?.split('_')[1] || '';\n    const authenticationHelper = await (0, srp_1.getAuthenticationHelper)(userPoolName);\n    const authParameters = {\n        USERNAME: username,\n        SRP_A: authenticationHelper.A.toString(16),\n    };\n    if (authFlow === 'USER_AUTH' && preferredChallenge) {\n        authParameters.PREFERRED_CHALLENGE = preferredChallenge;\n    }\n    const UserContextData = (0, userContextData_1.getUserContextData)({\n        username,\n        userPoolId,\n        userPoolClientId,\n    });\n    const jsonReq = {\n        AuthFlow: authFlow,\n        AuthParameters: authParameters,\n        ClientMetadata: clientMetadata,\n        ClientId: userPoolClientId,\n        UserContextData,\n    };\n    const initiateAuth = (0, cognitoIdentityProvider_1.createInitiateAuthClient)({\n        endpointResolver: (0, factories_1.createCognitoUserPoolEndpointResolver)({\n            endpointOverride: userPoolEndpoint,\n        }),\n    });\n    const resp = await initiateAuth({\n        region: (0, parsers_1.getRegionFromUserPoolId)(userPoolId),\n        userAgentValue: (0, utils_2.getAuthUserAgentValue)(utils_1.AuthAction.SignIn),\n    }, jsonReq);\n    const { ChallengeParameters: challengeParameters, Session: session } = resp;\n    const activeUsername = challengeParameters?.USERNAME ?? username;\n    (0, signInHelpers_1.setActiveSignInUsername)(activeUsername);\n    if (resp.ChallengeName === 'PASSWORD_VERIFIER') {\n        return (0, signInHelpers_1.retryOnResourceNotFoundException)(signInHelpers_1.handlePasswordVerifierChallenge, [\n            password,\n            challengeParameters,\n            clientMetadata,\n            session,\n            authenticationHelper,\n            config,\n            tokenOrchestrator,\n        ], activeUsername, tokenOrchestrator);\n    }\n    return resp;\n}\nexports.handlePasswordSRP = handlePasswordSRP;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,OAAO,CAAC,iBAAiB,GAAG,KAAK,CAAC,CAAC;AACnC,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC,CAAC;AAC7D,MAAM,iBAAiB,GAAG,OAAO,CAAC,kDAAkD,CAAC,CAAC;AACtF,MAAM,KAAK,GAAG,OAAO,CAAC,sCAAsC,CAAC,CAAC;AAC9D,MAAM,eAAe,GAAG,OAAO,CAAC,gDAAgD,CAAC,CAAC;AAClF,MAAM,yBAAyB,GAAG,OAAO,CAAC,sEAAsE,CAAC,CAAC;AAClH,MAAM,WAAW,GAAG,OAAO,CAAC,sCAAsC,CAAC,CAAC;AACpE,MAAM,SAAS,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;AACzD,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAC1C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,iBAAiB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,kBAAkB,GAAG,EAAE;AACnI,IAAI,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;AACtE,IAAI,MAAM,YAAY,GAAG,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACzD,IAAI,MAAM,oBAAoB,GAAG,MAAM,IAAI,KAAK,CAAC,uBAAuB,EAAE,YAAY,CAAC,CAAC;AACxF,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,QAAQ,EAAE,QAAQ;AAC1B,QAAQ,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;AAClD,KAAK,CAAC;AACN,IAAI,IAAI,QAAQ,KAAK,WAAW,IAAI,kBAAkB,EAAE;AACxD,QAAQ,cAAc,CAAC,mBAAmB,GAAG,kBAAkB,CAAC;AAChE,KAAK;AACL,IAAI,MAAM,eAAe,GAAG,IAAI,iBAAiB,CAAC,kBAAkB,EAAE;AACtE,QAAQ,QAAQ;AAChB,QAAQ,UAAU;AAClB,QAAQ,gBAAgB;AACxB,KAAK,CAAC,CAAC;AACP,IAAI,MAAM,OAAO,GAAG;AACpB,QAAQ,QAAQ,EAAE,QAAQ;AAC1B,QAAQ,cAAc,EAAE,cAAc;AACtC,QAAQ,cAAc,EAAE,cAAc;AACtC,QAAQ,QAAQ,EAAE,gBAAgB;AAClC,QAAQ,eAAe;AACvB,KAAK,CAAC;AACN,IAAI,MAAM,YAAY,GAAG,IAAI,yBAAyB,CAAC,wBAAwB,EAAE;AACjF,QAAQ,gBAAgB,EAAE,IAAI,WAAW,CAAC,qCAAqC,EAAE;AACjF,YAAY,gBAAgB,EAAE,gBAAgB;AAC9C,SAAS,CAAC;AACV,KAAK,CAAC,CAAC;AACP,IAAI,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC;AACpC,QAAQ,MAAM,EAAE,IAAI,SAAS,CAAC,uBAAuB,EAAE,UAAU,CAAC;AAClE,QAAQ,cAAc,EAAE,IAAI,OAAO,CAAC,qBAAqB,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;AACrF,KAAK,EAAE,OAAO,CAAC,CAAC;AAChB,IAAI,MAAM,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;AAChF,IAAI,MAAM,cAAc,GAAG,mBAAmB,EAAE,QAAQ,IAAI,QAAQ,CAAC;AACrE,IAAI,IAAI,eAAe,CAAC,uBAAuB,EAAE,cAAc,CAAC,CAAC;AACjE,IAAI,IAAI,IAAI,CAAC,aAAa,KAAK,mBAAmB,EAAE;AACpD,QAAQ,OAAO,IAAI,eAAe,CAAC,gCAAgC,EAAE,eAAe,CAAC,+BAA+B,EAAE;AACtH,YAAY,QAAQ;AACpB,YAAY,mBAAmB;AAC/B,YAAY,cAAc;AAC1B,YAAY,OAAO;AACnB,YAAY,oBAAoB;AAChC,YAAY,MAAM;AAClB,YAAY,iBAAiB;AAC7B,SAAS,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC;AAC9C,KAAK;AACL,IAAI,OAAO,IAAI,CAAC;AAChB,CAAC;AACD,OAAO,CAAC,iBAAiB,GAAG,iBAAiB;;"}

package/dist/cjs/client/flows/userAuth/handleSelectChallenge.js

@@ -0,0 +1,46 @@
+'use strict';
+
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.initiateSelectedChallenge = void 0;
+const utils_1 = require("@aws-amplify/core/internals/utils");
+const cognitoIdentityProvider_1 = require("../../../foundation/factories/serviceClients/cognitoIdentityProvider");
+const factories_1 = require("../../../providers/cognito/factories");
+const parsers_1 = require("../../../foundation/parsers");
+const utils_2 = require("../../../utils");
+/**
+ * Handles the SELECT_CHALLENGE response for authentication.
+ * Initiates the selected authentication challenge based on user choice.
+ *
+ * @param {Object} params - The parameters for handling the selected challenge
+ * @param {string} params.username - The username for authentication
+ * @param {string} params.session - The current authentication session token
+ * @param {string} params.selectedChallenge - The challenge type selected by the user
+ * @param {CognitoUserPoolConfig} params.config - Cognito User Pool configuration
+ * @param {ClientMetadata} [params.clientMetadata] - Optional metadata to be sent with auth requests
+ *
+ * @returns {Promise<RespondToAuthChallengeCommandOutput>} The challenge response
+ */
+async function initiateSelectedChallenge({ username, session, selectedChallenge, config, clientMetadata, }) {
+    const respondToAuthChallenge = (0, cognitoIdentityProvider_1.createRespondToAuthChallengeClient)({
+        endpointResolver: (0, factories_1.createCognitoUserPoolEndpointResolver)({
+            endpointOverride: config.userPoolEndpoint,
+        }),
+    });
+    return respondToAuthChallenge({
+        region: (0, parsers_1.getRegionFromUserPoolId)(config.userPoolId),
+        userAgentValue: (0, utils_2.getAuthUserAgentValue)(utils_1.AuthAction.ConfirmSignIn),
+    }, {
+        ChallengeName: 'SELECT_CHALLENGE',
+        ChallengeResponses: {
+            USERNAME: username,
+            ANSWER: selectedChallenge,
+        },
+        ClientId: config.userPoolClientId,
+        Session: session,
+        ClientMetadata: clientMetadata,
+    });
+}
+exports.initiateSelectedChallenge = initiateSelectedChallenge;
+//# sourceMappingURL=handleSelectChallenge.js.map

package/dist/cjs/client/flows/userAuth/handleSelectChallenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handleSelectChallenge.js","sources":["../../../../../src/client/flows/userAuth/handleSelectChallenge.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.initiateSelectedChallenge = void 0;\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nconst cognitoIdentityProvider_1 = require(\"../../../foundation/factories/serviceClients/cognitoIdentityProvider\");\nconst factories_1 = require(\"../../../providers/cognito/factories\");\nconst parsers_1 = require(\"../../../foundation/parsers\");\nconst utils_2 = require(\"../../../utils\");\n/**\n * Handles the SELECT_CHALLENGE response for authentication.\n * Initiates the selected authentication challenge based on user choice.\n *\n * @param {Object} params - The parameters for handling the selected challenge\n * @param {string} params.username - The username for authentication\n * @param {string} params.session - The current authentication session token\n * @param {string} params.selectedChallenge - The challenge type selected by the user\n * @param {CognitoUserPoolConfig} params.config - Cognito User Pool configuration\n * @param {ClientMetadata} [params.clientMetadata] - Optional metadata to be sent with auth requests\n *\n * @returns {Promise<RespondToAuthChallengeCommandOutput>} The challenge response\n */\nasync function initiateSelectedChallenge({ username, session, selectedChallenge, config, clientMetadata, }) {\n    const respondToAuthChallenge = (0, cognitoIdentityProvider_1.createRespondToAuthChallengeClient)({\n        endpointResolver: (0, factories_1.createCognitoUserPoolEndpointResolver)({\n            endpointOverride: config.userPoolEndpoint,\n        }),\n    });\n    return respondToAuthChallenge({\n        region: (0, parsers_1.getRegionFromUserPoolId)(config.userPoolId),\n        userAgentValue: (0, utils_2.getAuthUserAgentValue)(utils_1.AuthAction.ConfirmSignIn),\n    }, {\n        ChallengeName: 'SELECT_CHALLENGE',\n        ChallengeResponses: {\n            USERNAME: username,\n            ANSWER: selectedChallenge,\n        },\n        ClientId: config.userPoolClientId,\n        Session: session,\n        ClientMetadata: clientMetadata,\n    });\n}\nexports.initiateSelectedChallenge = initiateSelectedChallenge;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,OAAO,CAAC,yBAAyB,GAAG,KAAK,CAAC,CAAC;AAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC,CAAC;AAC7D,MAAM,yBAAyB,GAAG,OAAO,CAAC,sEAAsE,CAAC,CAAC;AAClH,MAAM,WAAW,GAAG,OAAO,CAAC,sCAAsC,CAAC,CAAC;AACpE,MAAM,SAAS,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;AACzD,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAC1C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,yBAAyB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,cAAc,GAAG,EAAE;AAC5G,IAAI,MAAM,sBAAsB,GAAG,IAAI,yBAAyB,CAAC,kCAAkC,EAAE;AACrG,QAAQ,gBAAgB,EAAE,IAAI,WAAW,CAAC,qCAAqC,EAAE;AACjF,YAAY,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;AACrD,SAAS,CAAC;AACV,KAAK,CAAC,CAAC;AACP,IAAI,OAAO,sBAAsB,CAAC;AAClC,QAAQ,MAAM,EAAE,IAAI,SAAS,CAAC,uBAAuB,EAAE,MAAM,CAAC,UAAU,CAAC;AACzE,QAAQ,cAAc,EAAE,IAAI,OAAO,CAAC,qBAAqB,EAAE,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC;AAC5F,KAAK,EAAE;AACP,QAAQ,aAAa,EAAE,kBAAkB;AACzC,QAAQ,kBAAkB,EAAE;AAC5B,YAAY,QAAQ,EAAE,QAAQ;AAC9B,YAAY,MAAM,EAAE,iBAAiB;AACrC,SAAS;AACT,QAAQ,QAAQ,EAAE,MAAM,CAAC,gBAAgB;AACzC,QAAQ,OAAO,EAAE,OAAO;AACxB,QAAQ,cAAc,EAAE,cAAc;AACtC,KAAK,CAAC,CAAC;AACP,CAAC;AACD,OAAO,CAAC,yBAAyB,GAAG,yBAAyB;;"}

package/dist/cjs/client/flows/userAuth/handleSelectChallengeWithPassword.js

@@ -0,0 +1,59 @@
+'use strict';
+
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleSelectChallengeWithPassword = void 0;
+const utils_1 = require("@aws-amplify/core/internals/utils");
+const cognitoIdentityProvider_1 = require("../../../foundation/factories/serviceClients/cognitoIdentityProvider");
+const factories_1 = require("../../../providers/cognito/factories");
+const parsers_1 = require("../../../foundation/parsers");
+const utils_2 = require("../../../utils");
+const userContextData_1 = require("../../../providers/cognito/utils/userContextData");
+const signInHelpers_1 = require("../../../providers/cognito/utils/signInHelpers");
+/**
+ * Handles the SELECT_CHALLENGE response specifically for Password authentication.
+ * This function combines the SELECT_CHALLENGE flow with standard password authentication.
+ *
+ * @param {string} username - The username for authentication
+ * @param {string} password - The user's password
+ * @param {ClientMetadata} [clientMetadata] - Optional metadata to be sent with auth requests
+ * @param {CognitoUserPoolConfig} config - Cognito User Pool configuration
+ * @param {string} session - The current authentication session token
+ *
+ * @returns {Promise<RespondToAuthChallengeCommandOutput>} The challenge response
+ */
+async function handleSelectChallengeWithPassword(username, password, clientMetadata, config, session) {
+    const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
+    const authParameters = {
+        ANSWER: 'PASSWORD',
+        USERNAME: username,
+        PASSWORD: password,
+    };
+    const userContextData = (0, userContextData_1.getUserContextData)({
+        username,
+        userPoolId,
+        userPoolClientId,
+    });
+    const respondToAuthChallenge = (0, cognitoIdentityProvider_1.createRespondToAuthChallengeClient)({
+        endpointResolver: (0, factories_1.createCognitoUserPoolEndpointResolver)({
+            endpointOverride: userPoolEndpoint,
+        }),
+    });
+    const response = await respondToAuthChallenge({
+        region: (0, parsers_1.getRegionFromUserPoolId)(userPoolId),
+        userAgentValue: (0, utils_2.getAuthUserAgentValue)(utils_1.AuthAction.ConfirmSignIn),
+    }, {
+        ChallengeName: 'SELECT_CHALLENGE',
+        ChallengeResponses: authParameters,
+        ClientId: userPoolClientId,
+        ClientMetadata: clientMetadata,
+        Session: session,
+        UserContextData: userContextData,
+    });
+    const activeUsername = response.ChallengeParameters?.USERNAME ?? username;
+    (0, signInHelpers_1.setActiveSignInUsername)(activeUsername);
+    return response;
+}
+exports.handleSelectChallengeWithPassword = handleSelectChallengeWithPassword;
+//# sourceMappingURL=handleSelectChallengeWithPassword.js.map

package/dist/cjs/client/flows/userAuth/handleSelectChallengeWithPassword.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handleSelectChallengeWithPassword.js","sources":["../../../../../src/client/flows/userAuth/handleSelectChallengeWithPassword.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.handleSelectChallengeWithPassword = void 0;\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nconst cognitoIdentityProvider_1 = require(\"../../../foundation/factories/serviceClients/cognitoIdentityProvider\");\nconst factories_1 = require(\"../../../providers/cognito/factories\");\nconst parsers_1 = require(\"../../../foundation/parsers\");\nconst utils_2 = require(\"../../../utils\");\nconst userContextData_1 = require(\"../../../providers/cognito/utils/userContextData\");\nconst signInHelpers_1 = require(\"../../../providers/cognito/utils/signInHelpers\");\n/**\n * Handles the SELECT_CHALLENGE response specifically for Password authentication.\n * This function combines the SELECT_CHALLENGE flow with standard password authentication.\n *\n * @param {string} username - The username for authentication\n * @param {string} password - The user's password\n * @param {ClientMetadata} [clientMetadata] - Optional metadata to be sent with auth requests\n * @param {CognitoUserPoolConfig} config - Cognito User Pool configuration\n * @param {string} session - The current authentication session token\n *\n * @returns {Promise<RespondToAuthChallengeCommandOutput>} The challenge response\n */\nasync function handleSelectChallengeWithPassword(username, password, clientMetadata, config, session) {\n    const { userPoolId, userPoolClientId, userPoolEndpoint } = config;\n    const authParameters = {\n        ANSWER: 'PASSWORD',\n        USERNAME: username,\n        PASSWORD: password,\n    };\n    const userContextData = (0, userContextData_1.getUserContextData)({\n        username,\n        userPoolId,\n        userPoolClientId,\n    });\n    const respondToAuthChallenge = (0, cognitoIdentityProvider_1.createRespondToAuthChallengeClient)({\n        endpointResolver: (0, factories_1.createCognitoUserPoolEndpointResolver)({\n            endpointOverride: userPoolEndpoint,\n        }),\n    });\n    const response = await respondToAuthChallenge({\n        region: (0, parsers_1.getRegionFromUserPoolId)(userPoolId),\n        userAgentValue: (0, utils_2.getAuthUserAgentValue)(utils_1.AuthAction.ConfirmSignIn),\n    }, {\n        ChallengeName: 'SELECT_CHALLENGE',\n        ChallengeResponses: authParameters,\n        ClientId: userPoolClientId,\n        ClientMetadata: clientMetadata,\n        Session: session,\n        UserContextData: userContextData,\n    });\n    const activeUsername = response.ChallengeParameters?.USERNAME ?? username;\n    (0, signInHelpers_1.setActiveSignInUsername)(activeUsername);\n    return response;\n}\nexports.handleSelectChallengeWithPassword = handleSelectChallengeWithPassword;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,OAAO,CAAC,iCAAiC,GAAG,KAAK,CAAC,CAAC;AACnD,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC,CAAC;AAC7D,MAAM,yBAAyB,GAAG,OAAO,CAAC,sEAAsE,CAAC,CAAC;AAClH,MAAM,WAAW,GAAG,OAAO,CAAC,sCAAsC,CAAC,CAAC;AACpE,MAAM,SAAS,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;AACzD,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAC1C,MAAM,iBAAiB,GAAG,OAAO,CAAC,kDAAkD,CAAC,CAAC;AACtF,MAAM,eAAe,GAAG,OAAO,CAAC,gDAAgD,CAAC,CAAC;AAClF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,iCAAiC,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE;AACtG,IAAI,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;AACtE,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,MAAM,EAAE,UAAU;AAC1B,QAAQ,QAAQ,EAAE,QAAQ;AAC1B,QAAQ,QAAQ,EAAE,QAAQ;AAC1B,KAAK,CAAC;AACN,IAAI,MAAM,eAAe,GAAG,IAAI,iBAAiB,CAAC,kBAAkB,EAAE;AACtE,QAAQ,QAAQ;AAChB,QAAQ,UAAU;AAClB,QAAQ,gBAAgB;AACxB,KAAK,CAAC,CAAC;AACP,IAAI,MAAM,sBAAsB,GAAG,IAAI,yBAAyB,CAAC,kCAAkC,EAAE;AACrG,QAAQ,gBAAgB,EAAE,IAAI,WAAW,CAAC,qCAAqC,EAAE;AACjF,YAAY,gBAAgB,EAAE,gBAAgB;AAC9C,SAAS,CAAC;AACV,KAAK,CAAC,CAAC;AACP,IAAI,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC;AAClD,QAAQ,MAAM,EAAE,IAAI,SAAS,CAAC,uBAAuB,EAAE,UAAU,CAAC;AAClE,QAAQ,cAAc,EAAE,IAAI,OAAO,CAAC,qBAAqB,EAAE,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC;AAC5F,KAAK,EAAE;AACP,QAAQ,aAAa,EAAE,kBAAkB;AACzC,QAAQ,kBAAkB,EAAE,cAAc;AAC1C,QAAQ,QAAQ,EAAE,gBAAgB;AAClC,QAAQ,cAAc,EAAE,cAAc;AACtC,QAAQ,OAAO,EAAE,OAAO;AACxB,QAAQ,eAAe,EAAE,eAAe;AACxC,KAAK,CAAC,CAAC;AACP,IAAI,MAAM,cAAc,GAAG,QAAQ,CAAC,mBAAmB,EAAE,QAAQ,IAAI,QAAQ,CAAC;AAC9E,IAAI,IAAI,eAAe,CAAC,uBAAuB,EAAE,cAAc,CAAC,CAAC;AACjE,IAAI,OAAO,QAAQ,CAAC;AACpB,CAAC;AACD,OAAO,CAAC,iCAAiC,GAAG,iCAAiC;;"}

package/dist/cjs/client/flows/userAuth/handleSelectChallengeWithPasswordSRP.js

@@ -0,0 +1,74 @@
+'use strict';
+
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleSelectChallengeWithPasswordSRP = void 0;
+const utils_1 = require("@aws-amplify/core/internals/utils");
+const cognitoIdentityProvider_1 = require("../../../foundation/factories/serviceClients/cognitoIdentityProvider");
+const factories_1 = require("../../../providers/cognito/factories");
+const parsers_1 = require("../../../foundation/parsers");
+const utils_2 = require("../../../utils");
+const srp_1 = require("../../../providers/cognito/utils/srp");
+const userContextData_1 = require("../../../providers/cognito/utils/userContextData");
+const signInHelpers_1 = require("../../../providers/cognito/utils/signInHelpers");
+/**
+ * Handles the SELECT_CHALLENGE response specifically for Password SRP authentication.
+ * This function combines the SELECT_CHALLENGE flow with Password SRP protocol.
+ *
+ * @param {string} username - The username for authentication
+ * @param {string} password - The user's password
+ * @param {ClientMetadata} [clientMetadata] - Optional metadata to be sent with auth requests
+ * @param {CognitoUserPoolConfig} config - Cognito User Pool configuration
+ * @param {string} session - The current authentication session token
+ * @param {AuthTokenOrchestrator} tokenOrchestrator - Token orchestrator for managing auth tokens
+ *
+ * @returns {Promise<RespondToAuthChallengeCommandOutput>} The challenge response
+ */
+async function handleSelectChallengeWithPasswordSRP(username, password, clientMetadata, config, session, tokenOrchestrator) {
+    const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
+    const userPoolName = userPoolId.split('_')[1] || '';
+    const authenticationHelper = await (0, srp_1.getAuthenticationHelper)(userPoolName);
+    const authParameters = {
+        ANSWER: 'PASSWORD_SRP',
+        USERNAME: username,
+        SRP_A: authenticationHelper.A.toString(16),
+    };
+    const userContextData = (0, userContextData_1.getUserContextData)({
+        username,
+        userPoolId,
+        userPoolClientId,
+    });
+    const respondToAuthChallenge = (0, cognitoIdentityProvider_1.createRespondToAuthChallengeClient)({
+        endpointResolver: (0, factories_1.createCognitoUserPoolEndpointResolver)({
+            endpointOverride: userPoolEndpoint,
+        }),
+    });
+    const response = await respondToAuthChallenge({
+        region: (0, parsers_1.getRegionFromUserPoolId)(userPoolId),
+        userAgentValue: (0, utils_2.getAuthUserAgentValue)(utils_1.AuthAction.ConfirmSignIn),
+    }, {
+        ChallengeName: 'SELECT_CHALLENGE',
+        ChallengeResponses: authParameters,
+        ClientId: userPoolClientId,
+        ClientMetadata: clientMetadata,
+        Session: session,
+        UserContextData: userContextData,
+    });
+    const activeUsername = response.ChallengeParameters?.USERNAME ?? username;
+    (0, signInHelpers_1.setActiveSignInUsername)(activeUsername);
+    if (response.ChallengeName === 'PASSWORD_VERIFIER') {
+        return (0, signInHelpers_1.retryOnResourceNotFoundException)(signInHelpers_1.handlePasswordVerifierChallenge, [
+            password,
+            response.ChallengeParameters,
+            clientMetadata,
+            response.Session,
+            authenticationHelper,
+            config,
+            tokenOrchestrator,
+        ], activeUsername, tokenOrchestrator);
+    }
+    return response;
+}
+exports.handleSelectChallengeWithPasswordSRP = handleSelectChallengeWithPasswordSRP;
+//# sourceMappingURL=handleSelectChallengeWithPasswordSRP.js.map

package/dist/cjs/client/flows/userAuth/handleSelectChallengeWithPasswordSRP.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handleSelectChallengeWithPasswordSRP.js","sources":["../../../../../src/client/flows/userAuth/handleSelectChallengeWithPasswordSRP.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.handleSelectChallengeWithPasswordSRP = void 0;\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nconst cognitoIdentityProvider_1 = require(\"../../../foundation/factories/serviceClients/cognitoIdentityProvider\");\nconst factories_1 = require(\"../../../providers/cognito/factories\");\nconst parsers_1 = require(\"../../../foundation/parsers\");\nconst utils_2 = require(\"../../../utils\");\nconst srp_1 = require(\"../../../providers/cognito/utils/srp\");\nconst userContextData_1 = require(\"../../../providers/cognito/utils/userContextData\");\nconst signInHelpers_1 = require(\"../../../providers/cognito/utils/signInHelpers\");\n/**\n * Handles the SELECT_CHALLENGE response specifically for Password SRP authentication.\n * This function combines the SELECT_CHALLENGE flow with Password SRP protocol.\n *\n * @param {string} username - The username for authentication\n * @param {string} password - The user's password\n * @param {ClientMetadata} [clientMetadata] - Optional metadata to be sent with auth requests\n * @param {CognitoUserPoolConfig} config - Cognito User Pool configuration\n * @param {string} session - The current authentication session token\n * @param {AuthTokenOrchestrator} tokenOrchestrator - Token orchestrator for managing auth tokens\n *\n * @returns {Promise<RespondToAuthChallengeCommandOutput>} The challenge response\n */\nasync function handleSelectChallengeWithPasswordSRP(username, password, clientMetadata, config, session, tokenOrchestrator) {\n    const { userPoolId, userPoolClientId, userPoolEndpoint } = config;\n    const userPoolName = userPoolId.split('_')[1] || '';\n    const authenticationHelper = await (0, srp_1.getAuthenticationHelper)(userPoolName);\n    const authParameters = {\n        ANSWER: 'PASSWORD_SRP',\n        USERNAME: username,\n        SRP_A: authenticationHelper.A.toString(16),\n    };\n    const userContextData = (0, userContextData_1.getUserContextData)({\n        username,\n        userPoolId,\n        userPoolClientId,\n    });\n    const respondToAuthChallenge = (0, cognitoIdentityProvider_1.createRespondToAuthChallengeClient)({\n        endpointResolver: (0, factories_1.createCognitoUserPoolEndpointResolver)({\n            endpointOverride: userPoolEndpoint,\n        }),\n    });\n    const response = await respondToAuthChallenge({\n        region: (0, parsers_1.getRegionFromUserPoolId)(userPoolId),\n        userAgentValue: (0, utils_2.getAuthUserAgentValue)(utils_1.AuthAction.ConfirmSignIn),\n    }, {\n        ChallengeName: 'SELECT_CHALLENGE',\n        ChallengeResponses: authParameters,\n        ClientId: userPoolClientId,\n        ClientMetadata: clientMetadata,\n        Session: session,\n        UserContextData: userContextData,\n    });\n    const activeUsername = response.ChallengeParameters?.USERNAME ?? username;\n    (0, signInHelpers_1.setActiveSignInUsername)(activeUsername);\n    if (response.ChallengeName === 'PASSWORD_VERIFIER') {\n        return (0, signInHelpers_1.retryOnResourceNotFoundException)(signInHelpers_1.handlePasswordVerifierChallenge, [\n            password,\n            response.ChallengeParameters,\n            clientMetadata,\n            response.Session,\n            authenticationHelper,\n            config,\n            tokenOrchestrator,\n        ], activeUsername, tokenOrchestrator);\n    }\n    return response;\n}\nexports.handleSelectChallengeWithPasswordSRP = handleSelectChallengeWithPasswordSRP;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,OAAO,CAAC,oCAAoC,GAAG,KAAK,CAAC,CAAC;AACtD,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC,CAAC;AAC7D,MAAM,yBAAyB,GAAG,OAAO,CAAC,sEAAsE,CAAC,CAAC;AAClH,MAAM,WAAW,GAAG,OAAO,CAAC,sCAAsC,CAAC,CAAC;AACpE,MAAM,SAAS,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;AACzD,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,sCAAsC,CAAC,CAAC;AAC9D,MAAM,iBAAiB,GAAG,OAAO,CAAC,kDAAkD,CAAC,CAAC;AACtF,MAAM,eAAe,GAAG,OAAO,CAAC,gDAAgD,CAAC,CAAC;AAClF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,oCAAoC,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE;AAC5H,IAAI,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;AACtE,IAAI,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACxD,IAAI,MAAM,oBAAoB,GAAG,MAAM,IAAI,KAAK,CAAC,uBAAuB,EAAE,YAAY,CAAC,CAAC;AACxF,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,MAAM,EAAE,cAAc;AAC9B,QAAQ,QAAQ,EAAE,QAAQ;AAC1B,QAAQ,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;AAClD,KAAK,CAAC;AACN,IAAI,MAAM,eAAe,GAAG,IAAI,iBAAiB,CAAC,kBAAkB,EAAE;AACtE,QAAQ,QAAQ;AAChB,QAAQ,UAAU;AAClB,QAAQ,gBAAgB;AACxB,KAAK,CAAC,CAAC;AACP,IAAI,MAAM,sBAAsB,GAAG,IAAI,yBAAyB,CAAC,kCAAkC,EAAE;AACrG,QAAQ,gBAAgB,EAAE,IAAI,WAAW,CAAC,qCAAqC,EAAE;AACjF,YAAY,gBAAgB,EAAE,gBAAgB;AAC9C,SAAS,CAAC;AACV,KAAK,CAAC,CAAC;AACP,IAAI,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC;AAClD,QAAQ,MAAM,EAAE,IAAI,SAAS,CAAC,uBAAuB,EAAE,UAAU,CAAC;AAClE,QAAQ,cAAc,EAAE,IAAI,OAAO,CAAC,qBAAqB,EAAE,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC;AAC5F,KAAK,EAAE;AACP,QAAQ,aAAa,EAAE,kBAAkB;AACzC,QAAQ,kBAAkB,EAAE,cAAc;AAC1C,QAAQ,QAAQ,EAAE,gBAAgB;AAClC,QAAQ,cAAc,EAAE,cAAc;AACtC,QAAQ,OAAO,EAAE,OAAO;AACxB,QAAQ,eAAe,EAAE,eAAe;AACxC,KAAK,CAAC,CAAC;AACP,IAAI,MAAM,cAAc,GAAG,QAAQ,CAAC,mBAAmB,EAAE,QAAQ,IAAI,QAAQ,CAAC;AAC9E,IAAI,IAAI,eAAe,CAAC,uBAAuB,EAAE,cAAc,CAAC,CAAC;AACjE,IAAI,IAAI,QAAQ,CAAC,aAAa,KAAK,mBAAmB,EAAE;AACxD,QAAQ,OAAO,IAAI,eAAe,CAAC,gCAAgC,EAAE,eAAe,CAAC,+BAA+B,EAAE;AACtH,YAAY,QAAQ;AACpB,YAAY,QAAQ,CAAC,mBAAmB;AACxC,YAAY,cAAc;AAC1B,YAAY,QAAQ,CAAC,OAAO;AAC5B,YAAY,oBAAoB;AAChC,YAAY,MAAM;AAClB,YAAY,iBAAiB;AAC7B,SAAS,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC;AAC9C,KAAK;AACL,IAAI,OAAO,QAAQ,CAAC;AACpB,CAAC;AACD,OAAO,CAAC,oCAAoC,GAAG,oCAAoC;;"}

package/dist/cjs/client/flows/userAuth/handleUserAuthFlow.js

@@ -0,0 +1,84 @@
+'use strict';
+
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleUserAuthFlow = void 0;
+const utils_1 = require("@aws-amplify/core/internals/utils");
+const userContextData_1 = require("../../../providers/cognito/utils/userContextData");
+const cognitoIdentityProvider_1 = require("../../../foundation/factories/serviceClients/cognitoIdentityProvider");
+const factories_1 = require("../../../providers/cognito/factories");
+const parsers_1 = require("../../../foundation/parsers");
+const utils_2 = require("../../../utils");
+const handlePasswordSRP_1 = require("../shared/handlePasswordSRP");
+const assertValidationError_1 = require("../../../errors/utils/assertValidationError");
+const validation_1 = require("../../../errors/types/validation");
+const signInHelpers_1 = require("../../../providers/cognito/utils/signInHelpers");
+/**
+ * Handles user authentication flow with configurable challenge preferences.
+ * Supports AuthFactorType challenges through the USER_AUTH flow.
+ *
+ * @param {HandleUserAuthFlowInput} params - Authentication flow parameters
+ * @param {string} params.username - The username for authentication
+ * @param {Record<string, string>} [params.clientMetadata] - Optional metadata to pass to authentication service
+ * @param {CognitoUserPoolConfig} params.config - Cognito User Pool configuration
+ * @param {AuthTokenOrchestrator} params.tokenOrchestrator - Manages authentication tokens and device tracking
+ * @param {AuthFactorType} [params.preferredChallenge] - Optional preferred authentication method
+ * @param {string} [params.password] - Required when preferredChallenge is 'PASSWORD' or 'PASSWORD_SRP'
+ *
+ * @returns {Promise<InitiateAuthCommandOutput>} The authentication response from Cognito
+ */
+async function handleUserAuthFlow({ username, clientMetadata, config, tokenOrchestrator, preferredChallenge, password, session, }) {
+    const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
+    const UserContextData = (0, userContextData_1.getUserContextData)({
+        username,
+        userPoolId,
+        userPoolClientId,
+    });
+    const authParameters = { USERNAME: username };
+    if (preferredChallenge) {
+        if (preferredChallenge === 'PASSWORD_SRP') {
+            (0, assertValidationError_1.assertValidationError)(!!password, validation_1.AuthValidationErrorCode.EmptySignInPassword);
+            return (0, handlePasswordSRP_1.handlePasswordSRP)({
+                username,
+                password,
+                clientMetadata,
+                config,
+                tokenOrchestrator,
+                authFlow: 'USER_AUTH',
+                preferredChallenge,
+            });
+        }
+        if (preferredChallenge === 'PASSWORD') {
+            (0, assertValidationError_1.assertValidationError)(!!password, validation_1.AuthValidationErrorCode.EmptySignInPassword);
+            authParameters.PASSWORD = password;
+        }
+        authParameters.PREFERRED_CHALLENGE = preferredChallenge;
+    }
+    const jsonReq = {
+        AuthFlow: 'USER_AUTH',
+        AuthParameters: authParameters,
+        ClientMetadata: clientMetadata,
+        ClientId: userPoolClientId,
+        UserContextData,
+    };
+    if (session) {
+        jsonReq.Session = session;
+    }
+    const initiateAuth = (0, cognitoIdentityProvider_1.createInitiateAuthClient)({
+        endpointResolver: (0, factories_1.createCognitoUserPoolEndpointResolver)({
+            endpointOverride: userPoolEndpoint,
+        }),
+    });
+    const response = await initiateAuth({
+        region: (0, parsers_1.getRegionFromUserPoolId)(userPoolId),
+        userAgentValue: (0, utils_2.getAuthUserAgentValue)(utils_1.AuthAction.SignIn),
+    }, jsonReq);
+    // Set the active username immediately after successful authentication attempt
+    // If a user starts a new sign-in while another sign-in is incomplete,
+    // this ensures we're tracking the correct user for subsequent auth challenges.
+    (0, signInHelpers_1.setActiveSignInUsername)(username);
+    return response;
+}
+exports.handleUserAuthFlow = handleUserAuthFlow;
+//# sourceMappingURL=handleUserAuthFlow.js.map

package/dist/cjs/client/flows/userAuth/handleUserAuthFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handleUserAuthFlow.js","sources":["../../../../../src/client/flows/userAuth/handleUserAuthFlow.ts"],"sourcesContent":["\"use strict\";\n// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.handleUserAuthFlow = void 0;\nconst utils_1 = require(\"@aws-amplify/core/internals/utils\");\nconst userContextData_1 = require(\"../../../providers/cognito/utils/userContextData\");\nconst cognitoIdentityProvider_1 = require(\"../../../foundation/factories/serviceClients/cognitoIdentityProvider\");\nconst factories_1 = require(\"../../../providers/cognito/factories\");\nconst parsers_1 = require(\"../../../foundation/parsers\");\nconst utils_2 = require(\"../../../utils\");\nconst handlePasswordSRP_1 = require(\"../shared/handlePasswordSRP\");\nconst assertValidationError_1 = require(\"../../../errors/utils/assertValidationError\");\nconst validation_1 = require(\"../../../errors/types/validation\");\nconst signInHelpers_1 = require(\"../../../providers/cognito/utils/signInHelpers\");\n/**\n * Handles user authentication flow with configurable challenge preferences.\n * Supports AuthFactorType challenges through the USER_AUTH flow.\n *\n * @param {HandleUserAuthFlowInput} params - Authentication flow parameters\n * @param {string} params.username - The username for authentication\n * @param {Record<string, string>} [params.clientMetadata] - Optional metadata to pass to authentication service\n * @param {CognitoUserPoolConfig} params.config - Cognito User Pool configuration\n * @param {AuthTokenOrchestrator} params.tokenOrchestrator - Manages authentication tokens and device tracking\n * @param {AuthFactorType} [params.preferredChallenge] - Optional preferred authentication method\n * @param {string} [params.password] - Required when preferredChallenge is 'PASSWORD' or 'PASSWORD_SRP'\n *\n * @returns {Promise<InitiateAuthCommandOutput>} The authentication response from Cognito\n */\nasync function handleUserAuthFlow({ username, clientMetadata, config, tokenOrchestrator, preferredChallenge, password, session, }) {\n    const { userPoolId, userPoolClientId, userPoolEndpoint } = config;\n    const UserContextData = (0, userContextData_1.getUserContextData)({\n        username,\n        userPoolId,\n        userPoolClientId,\n    });\n    const authParameters = { USERNAME: username };\n    if (preferredChallenge) {\n        if (preferredChallenge === 'PASSWORD_SRP') {\n            (0, assertValidationError_1.assertValidationError)(!!password, validation_1.AuthValidationErrorCode.EmptySignInPassword);\n            return (0, handlePasswordSRP_1.handlePasswordSRP)({\n                username,\n                password,\n                clientMetadata,\n                config,\n                tokenOrchestrator,\n                authFlow: 'USER_AUTH',\n                preferredChallenge,\n            });\n        }\n        if (preferredChallenge === 'PASSWORD') {\n            (0, assertValidationError_1.assertValidationError)(!!password, validation_1.AuthValidationErrorCode.EmptySignInPassword);\n            authParameters.PASSWORD = password;\n        }\n        authParameters.PREFERRED_CHALLENGE = preferredChallenge;\n    }\n    const jsonReq = {\n        AuthFlow: 'USER_AUTH',\n        AuthParameters: authParameters,\n        ClientMetadata: clientMetadata,\n        ClientId: userPoolClientId,\n        UserContextData,\n    };\n    if (session) {\n        jsonReq.Session = session;\n    }\n    const initiateAuth = (0, cognitoIdentityProvider_1.createInitiateAuthClient)({\n        endpointResolver: (0, factories_1.createCognitoUserPoolEndpointResolver)({\n            endpointOverride: userPoolEndpoint,\n        }),\n    });\n    const response = await initiateAuth({\n        region: (0, parsers_1.getRegionFromUserPoolId)(userPoolId),\n        userAgentValue: (0, utils_2.getAuthUserAgentValue)(utils_1.AuthAction.SignIn),\n    }, jsonReq);\n    // Set the active username immediately after successful authentication attempt\n    // If a user starts a new sign-in while another sign-in is incomplete,\n    // this ensures we're tracking the correct user for subsequent auth challenges.\n    (0, signInHelpers_1.setActiveSignInUsername)(username);\n    return response;\n}\nexports.handleUserAuthFlow = handleUserAuthFlow;\n"],"names":[],"mappings":";;AACA;AACA;AACA,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,OAAO,CAAC,kBAAkB,GAAG,KAAK,CAAC,CAAC;AACpC,MAAM,OAAO,GAAG,OAAO,CAAC,mCAAmC,CAAC,CAAC;AAC7D,MAAM,iBAAiB,GAAG,OAAO,CAAC,kDAAkD,CAAC,CAAC;AACtF,MAAM,yBAAyB,GAAG,OAAO,CAAC,sEAAsE,CAAC,CAAC;AAClH,MAAM,WAAW,GAAG,OAAO,CAAC,sCAAsC,CAAC,CAAC;AACpE,MAAM,SAAS,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;AACzD,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAC1C,MAAM,mBAAmB,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;AACnE,MAAM,uBAAuB,GAAG,OAAO,CAAC,6CAA6C,CAAC,CAAC;AACvF,MAAM,YAAY,GAAG,OAAO,CAAC,kCAAkC,CAAC,CAAC;AACjE,MAAM,eAAe,GAAG,OAAO,CAAC,gDAAgD,CAAC,CAAC;AAClF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,kBAAkB,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,GAAG,EAAE;AACnI,IAAI,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;AACtE,IAAI,MAAM,eAAe,GAAG,IAAI,iBAAiB,CAAC,kBAAkB,EAAE;AACtE,QAAQ,QAAQ;AAChB,QAAQ,UAAU;AAClB,QAAQ,gBAAgB;AACxB,KAAK,CAAC,CAAC;AACP,IAAI,MAAM,cAAc,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAClD,IAAI,IAAI,kBAAkB,EAAE;AAC5B,QAAQ,IAAI,kBAAkB,KAAK,cAAc,EAAE;AACnD,YAAY,IAAI,uBAAuB,CAAC,qBAAqB,EAAE,CAAC,CAAC,QAAQ,EAAE,YAAY,CAAC,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;AACrI,YAAY,OAAO,IAAI,mBAAmB,CAAC,iBAAiB,EAAE;AAC9D,gBAAgB,QAAQ;AACxB,gBAAgB,QAAQ;AACxB,gBAAgB,cAAc;AAC9B,gBAAgB,MAAM;AACtB,gBAAgB,iBAAiB;AACjC,gBAAgB,QAAQ,EAAE,WAAW;AACrC,gBAAgB,kBAAkB;AAClC,aAAa,CAAC,CAAC;AACf,SAAS;AACT,QAAQ,IAAI,kBAAkB,KAAK,UAAU,EAAE;AAC/C,YAAY,IAAI,uBAAuB,CAAC,qBAAqB,EAAE,CAAC,CAAC,QAAQ,EAAE,YAAY,CAAC,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;AACrI,YAAY,cAAc,CAAC,QAAQ,GAAG,QAAQ,CAAC;AAC/C,SAAS;AACT,QAAQ,cAAc,CAAC,mBAAmB,GAAG,kBAAkB,CAAC;AAChE,KAAK;AACL,IAAI,MAAM,OAAO,GAAG;AACpB,QAAQ,QAAQ,EAAE,WAAW;AAC7B,QAAQ,cAAc,EAAE,cAAc;AACtC,QAAQ,cAAc,EAAE,cAAc;AACtC,QAAQ,QAAQ,EAAE,gBAAgB;AAClC,QAAQ,eAAe;AACvB,KAAK,CAAC;AACN,IAAI,IAAI,OAAO,EAAE;AACjB,QAAQ,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;AAClC,KAAK;AACL,IAAI,MAAM,YAAY,GAAG,IAAI,yBAAyB,CAAC,wBAAwB,EAAE;AACjF,QAAQ,gBAAgB,EAAE,IAAI,WAAW,CAAC,qCAAqC,EAAE;AACjF,YAAY,gBAAgB,EAAE,gBAAgB;AAC9C,SAAS,CAAC;AACV,KAAK,CAAC,CAAC;AACP,IAAI,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC;AACxC,QAAQ,MAAM,EAAE,IAAI,SAAS,CAAC,uBAAuB,EAAE,UAAU,CAAC;AAClE,QAAQ,cAAc,EAAE,IAAI,OAAO,CAAC,qBAAqB,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;AACrF,KAAK,EAAE,OAAO,CAAC,CAAC;AAChB;AACA;AACA;AACA,IAAI,IAAI,eAAe,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC;AAC3D,IAAI,OAAO,QAAQ,CAAC;AACpB,CAAC;AACD,OAAO,CAAC,kBAAkB,GAAG,kBAAkB;;"}