@aws-amplify/auth 6.7.1-unstable.ab33a03.0 → 6.8.0

package/src/client/flows/userAuth/handleSelectChallenge.ts

@@ -0,0 +1,62 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { CognitoUserPoolConfig } from '@aws-amplify/core';
+import { AuthAction } from '@aws-amplify/core/internals/utils';
+
+import { ClientMetadata } from '../../../providers/cognito/types';
+import { createRespondToAuthChallengeClient } from '../../../foundation/factories/serviceClients/cognitoIdentityProvider';
+import { createCognitoUserPoolEndpointResolver } from '../../../providers/cognito/factories';
+import { getRegionFromUserPoolId } from '../../../foundation/parsers';
+import { getAuthUserAgentValue } from '../../../utils';
+import { RespondToAuthChallengeCommandOutput } from '../../../foundation/factories/serviceClients/cognitoIdentityProvider/types';
+
+/**
+ * Handles the SELECT_CHALLENGE response for authentication.
+ * Initiates the selected authentication challenge based on user choice.
+ *
+ * @param {Object} params - The parameters for handling the selected challenge
+ * @param {string} params.username - The username for authentication
+ * @param {string} params.session - The current authentication session token
+ * @param {string} params.selectedChallenge - The challenge type selected by the user
+ * @param {CognitoUserPoolConfig} params.config - Cognito User Pool configuration
+ * @param {ClientMetadata} [params.clientMetadata] - Optional metadata to be sent with auth requests
+ *
+ * @returns {Promise<RespondToAuthChallengeCommandOutput>} The challenge response
+ */
+export async function initiateSelectedChallenge({
+	username,
+	session,
+	selectedChallenge,
+	config,
+	clientMetadata,
+}: {
+	username: string;
+	session: string;
+	selectedChallenge: string;
+	config: CognitoUserPoolConfig;
+	clientMetadata?: ClientMetadata;
+}): Promise<RespondToAuthChallengeCommandOutput> {
+	const respondToAuthChallenge = createRespondToAuthChallengeClient({
+		endpointResolver: createCognitoUserPoolEndpointResolver({
+			endpointOverride: config.userPoolEndpoint,
+		}),
+	});
+
+	return respondToAuthChallenge(
+		{
+			region: getRegionFromUserPoolId(config.userPoolId),
+			userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
+		},
+		{
+			ChallengeName: 'SELECT_CHALLENGE',
+			ChallengeResponses: {
+				USERNAME: username,
+				ANSWER: selectedChallenge,
+			},
+			ClientId: config.userPoolClientId,
+			Session: session,
+			ClientMetadata: clientMetadata,
+		},
+	);
+}

package/src/client/flows/userAuth/handleSelectChallengeWithPassword.ts

@@ -0,0 +1,74 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { CognitoUserPoolConfig } from '@aws-amplify/core';
+import { AuthAction } from '@aws-amplify/core/internals/utils';
+
+import { ClientMetadata } from '../../../providers/cognito/types';
+import { createRespondToAuthChallengeClient } from '../../../foundation/factories/serviceClients/cognitoIdentityProvider';
+import { createCognitoUserPoolEndpointResolver } from '../../../providers/cognito/factories';
+import { getRegionFromUserPoolId } from '../../../foundation/parsers';
+import { getAuthUserAgentValue } from '../../../utils';
+import { getUserContextData } from '../../../providers/cognito/utils/userContextData';
+import { RespondToAuthChallengeCommandOutput } from '../../../foundation/factories/serviceClients/cognitoIdentityProvider/types';
+import { setActiveSignInUsername } from '../../../providers/cognito/utils/signInHelpers';
+
+/**
+ * Handles the SELECT_CHALLENGE response specifically for Password authentication.
+ * This function combines the SELECT_CHALLENGE flow with standard password authentication.
+ *
+ * @param {string} username - The username for authentication
+ * @param {string} password - The user's password
+ * @param {ClientMetadata} [clientMetadata] - Optional metadata to be sent with auth requests
+ * @param {CognitoUserPoolConfig} config - Cognito User Pool configuration
+ * @param {string} session - The current authentication session token
+ *
+ * @returns {Promise<RespondToAuthChallengeCommandOutput>} The challenge response
+ */
+export async function handleSelectChallengeWithPassword(
+	username: string,
+	password: string,
+	clientMetadata: ClientMetadata | undefined,
+	config: CognitoUserPoolConfig,
+	session: string,
+): Promise<RespondToAuthChallengeCommandOutput> {
+	const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
+
+	const authParameters: Record<string, string> = {
+		ANSWER: 'PASSWORD',
+		USERNAME: username,
+		PASSWORD: password,
+	};
+
+	const userContextData = getUserContextData({
+		username,
+		userPoolId,
+		userPoolClientId,
+	});
+
+	const respondToAuthChallenge = createRespondToAuthChallengeClient({
+		endpointResolver: createCognitoUserPoolEndpointResolver({
+			endpointOverride: userPoolEndpoint,
+		}),
+	});
+
+	const response = await respondToAuthChallenge(
+		{
+			region: getRegionFromUserPoolId(userPoolId),
+			userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
+		},
+		{
+			ChallengeName: 'SELECT_CHALLENGE',
+			ChallengeResponses: authParameters,
+			ClientId: userPoolClientId,
+			ClientMetadata: clientMetadata,
+			Session: session,
+			UserContextData: userContextData,
+		},
+	);
+
+	const activeUsername = response.ChallengeParameters?.USERNAME ?? username;
+	setActiveSignInUsername(activeUsername);
+
+	return response;
+}

package/src/client/flows/userAuth/handleSelectChallengeWithPasswordSRP.ts

@@ -0,0 +1,105 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { CognitoUserPoolConfig } from '@aws-amplify/core';
+import { AuthAction } from '@aws-amplify/core/internals/utils';
+
+import { AuthTokenOrchestrator } from '../../../providers/cognito/tokenProvider/types';
+import {
+	ChallengeParameters,
+	RespondToAuthChallengeCommandOutput,
+} from '../../../foundation/factories/serviceClients/cognitoIdentityProvider/types';
+import { ClientMetadata } from '../../../providers/cognito/types';
+import { createRespondToAuthChallengeClient } from '../../../foundation/factories/serviceClients/cognitoIdentityProvider';
+import { createCognitoUserPoolEndpointResolver } from '../../../providers/cognito/factories';
+import { getRegionFromUserPoolId } from '../../../foundation/parsers';
+import { getAuthUserAgentValue } from '../../../utils';
+import { getAuthenticationHelper } from '../../../providers/cognito/utils/srp';
+import { getUserContextData } from '../../../providers/cognito/utils/userContextData';
+import {
+	handlePasswordVerifierChallenge,
+	retryOnResourceNotFoundException,
+	setActiveSignInUsername,
+} from '../../../providers/cognito/utils/signInHelpers';
+
+/**
+ * Handles the SELECT_CHALLENGE response specifically for Password SRP authentication.
+ * This function combines the SELECT_CHALLENGE flow with Password SRP protocol.
+ *
+ * @param {string} username - The username for authentication
+ * @param {string} password - The user's password
+ * @param {ClientMetadata} [clientMetadata] - Optional metadata to be sent with auth requests
+ * @param {CognitoUserPoolConfig} config - Cognito User Pool configuration
+ * @param {string} session - The current authentication session token
+ * @param {AuthTokenOrchestrator} tokenOrchestrator - Token orchestrator for managing auth tokens
+ *
+ * @returns {Promise<RespondToAuthChallengeCommandOutput>} The challenge response
+ */
+export async function handleSelectChallengeWithPasswordSRP(
+	username: string,
+	password: string,
+	clientMetadata: ClientMetadata | undefined,
+	config: CognitoUserPoolConfig,
+	session: string,
+	tokenOrchestrator: AuthTokenOrchestrator,
+): Promise<RespondToAuthChallengeCommandOutput> {
+	const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
+	const userPoolName = userPoolId.split('_')[1] || '';
+
+	const authenticationHelper = await getAuthenticationHelper(userPoolName);
+
+	const authParameters: Record<string, string> = {
+		ANSWER: 'PASSWORD_SRP',
+		USERNAME: username,
+		SRP_A: authenticationHelper.A.toString(16),
+	};
+
+	const userContextData = getUserContextData({
+		username,
+		userPoolId,
+		userPoolClientId,
+	});
+
+	const respondToAuthChallenge = createRespondToAuthChallengeClient({
+		endpointResolver: createCognitoUserPoolEndpointResolver({
+			endpointOverride: userPoolEndpoint,
+		}),
+	});
+
+	const response = await respondToAuthChallenge(
+		{
+			region: getRegionFromUserPoolId(userPoolId),
+			userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
+		},
+		{
+			ChallengeName: 'SELECT_CHALLENGE',
+			ChallengeResponses: authParameters,
+			ClientId: userPoolClientId,
+			ClientMetadata: clientMetadata,
+			Session: session,
+			UserContextData: userContextData,
+		},
+	);
+
+	const activeUsername = response.ChallengeParameters?.USERNAME ?? username;
+	setActiveSignInUsername(activeUsername);
+
+	if (response.ChallengeName === 'PASSWORD_VERIFIER') {
+		return retryOnResourceNotFoundException(
+			handlePasswordVerifierChallenge,
+			[
+				password,
+				response.ChallengeParameters as ChallengeParameters,
+				clientMetadata,
+				response.Session,
+				authenticationHelper,
+				config,
+				tokenOrchestrator,
+			],
+			activeUsername,
+			tokenOrchestrator,
+		);
+	}
+
+	return response;
+}

package/src/client/flows/userAuth/handleUserAuthFlow.ts

@@ -0,0 +1,125 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { CognitoUserPoolConfig } from '@aws-amplify/core';
+import { AuthAction } from '@aws-amplify/core/internals/utils';
+
+import { getUserContextData } from '../../../providers/cognito/utils/userContextData';
+import { AuthTokenOrchestrator } from '../../../providers/cognito/tokenProvider/types';
+import { AuthFactorType } from '../../../providers/cognito/types/models';
+import {
+	InitiateAuthCommandInput,
+	InitiateAuthCommandOutput,
+} from '../../../foundation/factories/serviceClients/cognitoIdentityProvider/types';
+import { createInitiateAuthClient } from '../../../foundation/factories/serviceClients/cognitoIdentityProvider';
+import { createCognitoUserPoolEndpointResolver } from '../../../providers/cognito/factories';
+import { getRegionFromUserPoolId } from '../../../foundation/parsers';
+import { getAuthUserAgentValue } from '../../../utils';
+import { handlePasswordSRP } from '../shared/handlePasswordSRP';
+import { assertValidationError } from '../../../errors/utils/assertValidationError';
+import { AuthValidationErrorCode } from '../../../errors/types/validation';
+import { setActiveSignInUsername } from '../../../providers/cognito/utils/signInHelpers';
+
+export interface HandleUserAuthFlowInput {
+	username: string;
+	config: CognitoUserPoolConfig;
+	tokenOrchestrator: AuthTokenOrchestrator;
+	clientMetadata?: Record<string, string>;
+	preferredChallenge?: AuthFactorType;
+	password?: string;
+	session?: string;
+}
+
+/**
+ * Handles user authentication flow with configurable challenge preferences.
+ * Supports AuthFactorType challenges through the USER_AUTH flow.
+ *
+ * @param {HandleUserAuthFlowInput} params - Authentication flow parameters
+ * @param {string} params.username - The username for authentication
+ * @param {Record<string, string>} [params.clientMetadata] - Optional metadata to pass to authentication service
+ * @param {CognitoUserPoolConfig} params.config - Cognito User Pool configuration
+ * @param {AuthTokenOrchestrator} params.tokenOrchestrator - Manages authentication tokens and device tracking
+ * @param {AuthFactorType} [params.preferredChallenge] - Optional preferred authentication method
+ * @param {string} [params.password] - Required when preferredChallenge is 'PASSWORD' or 'PASSWORD_SRP'
+ *
+ * @returns {Promise<InitiateAuthCommandOutput>} The authentication response from Cognito
+ */
+export async function handleUserAuthFlow({
+	username,
+	clientMetadata,
+	config,
+	tokenOrchestrator,
+	preferredChallenge,
+	password,
+	session,
+}: HandleUserAuthFlowInput) {
+	const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
+	const UserContextData = getUserContextData({
+		username,
+		userPoolId,
+		userPoolClientId,
+	});
+	const authParameters: Record<string, string> = { USERNAME: username };
+
+	if (preferredChallenge) {
+		if (preferredChallenge === 'PASSWORD_SRP') {
+			assertValidationError(
+				!!password,
+				AuthValidationErrorCode.EmptySignInPassword,
+			);
+
+			return handlePasswordSRP({
+				username,
+				password,
+				clientMetadata,
+				config,
+				tokenOrchestrator,
+				authFlow: 'USER_AUTH',
+				preferredChallenge,
+			});
+		}
+
+		if (preferredChallenge === 'PASSWORD') {
+			assertValidationError(
+				!!password,
+				AuthValidationErrorCode.EmptySignInPassword,
+			);
+			authParameters.PASSWORD = password;
+		}
+
+		authParameters.PREFERRED_CHALLENGE = preferredChallenge;
+	}
+
+	const jsonReq: InitiateAuthCommandInput = {
+		AuthFlow: 'USER_AUTH',
+		AuthParameters: authParameters,
+		ClientMetadata: clientMetadata,
+		ClientId: userPoolClientId,
+		UserContextData,
+	};
+
+	if (session) {
+		jsonReq.Session = session;
+	}
+
+	const initiateAuth = createInitiateAuthClient({
+		endpointResolver: createCognitoUserPoolEndpointResolver({
+			endpointOverride: userPoolEndpoint,
+		}),
+	});
+
+	const response = await initiateAuth(
+		{
+			region: getRegionFromUserPoolId(userPoolId),
+			userAgentValue: getAuthUserAgentValue(AuthAction.SignIn),
+		},
+		jsonReq,
+	);
+
+	// Set the active username immediately after successful authentication attempt
+	// If a user starts a new sign-in while another sign-in is incomplete,
+	// this ensures we're tracking the correct user for subsequent auth challenges.
+	setActiveSignInUsername(username);
+
+	return response;
+}

package/src/client/flows/userAuth/handleWebAuthnSignInResult.ts

@@ -0,0 +1,130 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { Amplify } from '@aws-amplify/core';
+import {
+	AuthAction,
+	assertTokenProviderConfig,
+} from '@aws-amplify/core/internals/utils';
+
+import { AuthErrorCodes } from '../../../common/AuthErrorStrings';
+import { createRespondToAuthChallengeClient } from '../../../foundation/factories/serviceClients/cognitoIdentityProvider';
+import {
+	ChallengeName,
+	ChallengeParameters,
+} from '../../../foundation/factories/serviceClients/cognitoIdentityProvider/types';
+import { getRegionFromUserPoolId } from '../../../foundation/parsers';
+import { createCognitoUserPoolEndpointResolver } from '../../../providers/cognito/factories';
+import { cacheCognitoTokens } from '../../../providers/cognito/tokenProvider/cacheTokens';
+import { dispatchSignedInHubEvent } from '../../../providers/cognito/utils/dispatchSignedInHubEvent';
+import {
+	getNewDeviceMetadata,
+	getSignInResult,
+} from '../../../providers/cognito/utils/signInHelpers';
+import {
+	cleanActiveSignInState,
+	setActiveSignInState,
+	signInStore,
+} from '../../../client/utils/store';
+import { AuthSignInOutput } from '../../../types';
+import { getAuthUserAgentValue } from '../../../utils';
+import { getPasskey } from '../../utils/passkey';
+import {
+	PasskeyErrorCode,
+	assertPasskeyError,
+} from '../../utils/passkey/errors';
+import { AuthError } from '../../../errors/AuthError';
+
+export async function handleWebAuthnSignInResult(
+	challengeParameters: ChallengeParameters,
+): Promise<AuthSignInOutput> {
+	const authConfig = Amplify.getConfig().Auth?.Cognito;
+	assertTokenProviderConfig(authConfig);
+	const { username, signInSession, signInDetails, challengeName } =
+		signInStore.getState();
+
+	if (challengeName !== 'WEB_AUTHN' || !username) {
+		throw new AuthError({
+			name: AuthErrorCodes.SignInException,
+			message: 'Unable to proceed due to invalid sign in state.',
+		});
+	}
+
+	const { CREDENTIAL_REQUEST_OPTIONS: credentialRequestOptions } =
+		challengeParameters;
+
+	assertPasskeyError(
+		!!credentialRequestOptions,
+		PasskeyErrorCode.InvalidPasskeyAuthenticationOptions,
+	);
+
+	const cred = await getPasskey(JSON.parse(credentialRequestOptions));
+
+	const respondToAuthChallenge = createRespondToAuthChallengeClient({
+		endpointResolver: createCognitoUserPoolEndpointResolver({
+			endpointOverride: authConfig.userPoolEndpoint,
+		}),
+	});
+
+	const {
+		ChallengeName: nextChallengeName,
+		ChallengeParameters: nextChallengeParameters,
+		AuthenticationResult: authenticationResult,
+		Session: nextSession,
+	} = await respondToAuthChallenge(
+		{
+			region: getRegionFromUserPoolId(authConfig.userPoolId),
+			userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
+		},
+		{
+			ChallengeName: 'WEB_AUTHN',
+			ChallengeResponses: {
+				USERNAME: username,
+				CREDENTIAL: JSON.stringify(cred),
+			},
+			ClientId: authConfig.userPoolClientId,
+			Session: signInSession,
+		},
+	);
+
+	setActiveSignInState({
+		signInSession: nextSession,
+		username,
+		challengeName: nextChallengeName as ChallengeName,
+		signInDetails,
+	});
+
+	if (authenticationResult) {
+		await cacheCognitoTokens({
+			...authenticationResult,
+			username,
+			NewDeviceMetadata: await getNewDeviceMetadata({
+				userPoolId: authConfig.userPoolId,
+				userPoolEndpoint: authConfig.userPoolEndpoint,
+				newDeviceMetadata: authenticationResult.NewDeviceMetadata,
+				accessToken: authenticationResult.AccessToken,
+			}),
+			signInDetails,
+		});
+		cleanActiveSignInState();
+		await dispatchSignedInHubEvent();
+
+		return {
+			isSignedIn: true,
+			nextStep: { signInStep: 'DONE' },
+		};
+	}
+
+	if (nextChallengeName === 'WEB_AUTHN') {
+		throw new AuthError({
+			name: AuthErrorCodes.SignInException,
+			message:
+				'Sequential WEB_AUTHN challenges returned from underlying service cannot be handled.',
+		});
+	}
+
+	return getSignInResult({
+		challengeName: nextChallengeName as ChallengeName,
+		challengeParameters: nextChallengeParameters as ChallengeParameters,
+	});
+}

package/src/client/utils/index.ts

@@ -0,0 +1,4 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+export { registerPasskey } from './passkey';