@aws-amplify/auth 6.7.1-unstable.ab33a03.0 → 6.8.0

package/src/client/utils/store/autoSignInStore.ts

@@ -0,0 +1,64 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { Reducer, Store } from './types';
+
+type AutoSignInAction =
+	| { type: 'START' }
+	| { type: 'SET_USERNAME'; value: string }
+	| { type: 'SET_SESSION'; value?: string }
+	| { type: 'RESET' };
+
+interface AutoSignInState {
+	active: boolean;
+	username?: string;
+	session?: string;
+}
+
+function defaultState(): AutoSignInState {
+	return {
+		active: false,
+	};
+}
+
+const autoSignInReducer: Reducer<AutoSignInState, AutoSignInAction> = (
+	state: AutoSignInState,
+	action: AutoSignInAction,
+): AutoSignInState => {
+	switch (action.type) {
+		case 'SET_USERNAME':
+			return {
+				...state,
+				username: action.value,
+			};
+		case 'SET_SESSION':
+			return {
+				...state,
+				session: action.value,
+			};
+		case 'START':
+			return {
+				...state,
+				active: true,
+			};
+		case 'RESET':
+			return defaultState();
+		default:
+			return state;
+	}
+};
+
+const createAutoSignInStore: Store<AutoSignInState, AutoSignInAction> = (
+	reducer: Reducer<AutoSignInState, AutoSignInAction>,
+) => {
+	let currentState = reducer(defaultState(), { type: 'RESET' });
+
+	return {
+		getState: () => currentState,
+		dispatch: action => {
+			currentState = reducer(currentState, action);
+		},
+	};
+};
+
+export const autoSignInStore = createAutoSignInStore(autoSignInReducer);

package/src/client/utils/store/index.ts

@@ -0,0 +1,5 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+export * from './autoSignInStore';
+export * from './signInStore';

package/src/{providers/cognito/utils → client/utils/store}/signInStore.ts

@@ -1,9 +1,11 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import { CognitoAuthSignInDetails } from '../types';
+import { CognitoAuthSignInDetails } from '../../../providers/cognito/types';
 import { ChallengeName } from '../../../foundation/factories/serviceClients/cognitoIdentityProvider/types';
 
+import { Reducer, Store } from './types';
+
 // TODO: replace all of this implementation with state machines
 interface SignInState {
 	username?: string;
@@ -19,13 +21,6 @@ type SignInAction =
 	| { type: 'SET_CHALLENGE_NAME'; value?: ChallengeName }
 	| { type: 'SET_SIGN_IN_SESSION'; value?: string };
 
-type Store<State, Action> = (reducer: Reducer<State, Action>) => {
-	getState(): ReturnType<Reducer<State, Action>>;
-	dispatch(action: Action): void;
-};
-
-type Reducer<State, Action> = (state: State, action: Action) => State;
-
 const signInReducer: Reducer<SignInState, SignInAction> = (state, action) => {
 	switch (action.type) {
 		case 'SET_SIGN_IN_SESSION':

package/src/client/utils/store/types.ts

@@ -0,0 +1,9 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+export type Store<State, Action> = (reducer: Reducer<State, Action>) => {
+	getState(): ReturnType<Reducer<State, Action>>;
+	dispatch(action: Action): void;
+};
+
+export type Reducer<State, Action> = (state: State, action: Action) => State;

package/src/foundation/apis/deleteWebAuthnCredential.ts

@@ -0,0 +1,45 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { AmplifyClassV6 } from '@aws-amplify/core';
+import {
+	AuthAction,
+	assertTokenProviderConfig,
+} from '@aws-amplify/core/internals/utils';
+
+import { assertAuthTokens } from '../../providers/cognito/utils/types';
+import { createCognitoUserPoolEndpointResolver } from '../../providers/cognito/factories';
+import { getRegionFromUserPoolId } from '../parsers';
+import { getAuthUserAgentValue } from '../../utils';
+import { createDeleteWebAuthnCredentialClient } from '../factories/serviceClients/cognitoIdentityProvider';
+import { DeleteWebAuthnCredentialInput } from '../types';
+
+export async function deleteWebAuthnCredential(
+	amplify: AmplifyClassV6,
+	input: DeleteWebAuthnCredentialInput,
+): Promise<void> {
+	const authConfig = amplify.getConfig().Auth?.Cognito;
+	assertTokenProviderConfig(authConfig);
+	const { userPoolEndpoint, userPoolId } = authConfig;
+	const { tokens } = await amplify.Auth.fetchAuthSession();
+	assertAuthTokens(tokens);
+
+	const deleteWebAuthnCredentialResult = createDeleteWebAuthnCredentialClient({
+		endpointResolver: createCognitoUserPoolEndpointResolver({
+			endpointOverride: userPoolEndpoint,
+		}),
+	});
+
+	await deleteWebAuthnCredentialResult(
+		{
+			region: getRegionFromUserPoolId(userPoolId),
+			userAgentValue: getAuthUserAgentValue(
+				AuthAction.DeleteWebAuthnCredential,
+			),
+		},
+		{
+			AccessToken: tokens.accessToken.toString(),
+			CredentialId: input.credentialId,
+		},
+	);
+}

package/src/foundation/apis/index.ts

@@ -0,0 +1,5 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+export { listWebAuthnCredentials } from './listWebAuthnCredentials';
+export { deleteWebAuthnCredential } from './deleteWebAuthnCredential';

package/src/foundation/apis/listWebAuthnCredentials.ts

@@ -0,0 +1,68 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { AmplifyClassV6 } from '@aws-amplify/core';
+import {
+	AuthAction,
+	assertTokenProviderConfig,
+} from '@aws-amplify/core/internals/utils';
+
+import { assertAuthTokens } from '../../providers/cognito/utils/types';
+import { createCognitoUserPoolEndpointResolver } from '../../providers/cognito/factories';
+import { getRegionFromUserPoolId } from '../parsers';
+import { getAuthUserAgentValue } from '../../utils';
+import { createListWebAuthnCredentialsClient } from '../factories/serviceClients/cognitoIdentityProvider';
+import {
+	AuthWebAuthnCredential,
+	ListWebAuthnCredentialsInput,
+	ListWebAuthnCredentialsOutput,
+} from '../types';
+
+export async function listWebAuthnCredentials(
+	amplify: AmplifyClassV6,
+	input?: ListWebAuthnCredentialsInput,
+): Promise<ListWebAuthnCredentialsOutput> {
+	const authConfig = amplify.getConfig().Auth?.Cognito;
+	assertTokenProviderConfig(authConfig);
+	const { userPoolEndpoint, userPoolId } = authConfig;
+
+	const { tokens } = await amplify.Auth.fetchAuthSession();
+	assertAuthTokens(tokens);
+
+	const listWebAuthnCredentialsResult = createListWebAuthnCredentialsClient({
+		endpointResolver: createCognitoUserPoolEndpointResolver({
+			endpointOverride: userPoolEndpoint,
+		}),
+	});
+
+	const { Credentials: commandCredentials = [], NextToken: nextToken } =
+		await listWebAuthnCredentialsResult(
+			{
+				region: getRegionFromUserPoolId(userPoolId),
+				userAgentValue: getAuthUserAgentValue(
+					AuthAction.ListWebAuthnCredentials,
+				),
+			},
+			{
+				AccessToken: tokens.accessToken.toString(),
+				MaxResults: input?.pageSize,
+				NextToken: input?.nextToken,
+			},
+		);
+
+	const credentials: AuthWebAuthnCredential[] = commandCredentials.map(
+		item => ({
+			credentialId: item.CredentialId,
+			friendlyCredentialName: item.FriendlyCredentialName,
+			relyingPartyId: item.RelyingPartyId,
+			authenticatorAttachment: item.AuthenticatorAttachment,
+			authenticatorTransports: item.AuthenticatorTransports,
+			createdAt: item.CreatedAt ? new Date(item.CreatedAt * 1000) : undefined,
+		}),
+	);
+
+	return {
+		credentials,
+		nextToken,
+	};
+}

package/src/foundation/convert/base64url/convertArrayBufferToBase64Url.ts

@@ -0,0 +1,18 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { base64Encoder } from '@aws-amplify/core/internals/utils';
+
+// https://datatracker.ietf.org/doc/html/rfc4648#page-7
+
+/**
+ * Converts an ArrayBuffer to a base64url encoded string
+ * @param buffer - the ArrayBuffer instance of a Uint8Array
+ * @returns string - a base64url encoded string
+ */
+export const convertArrayBufferToBase64Url = (buffer: ArrayBuffer): string => {
+	return base64Encoder.convert(new Uint8Array(buffer), {
+		urlSafe: true,
+		skipPadding: true,
+	});
+};

package/src/foundation/convert/base64url/convertBase64UrlToArrayBuffer.ts

@@ -0,0 +1,18 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { base64Decoder } from '@aws-amplify/core/internals/utils';
+
+/**
+ * Converts a base64url encoded string to an ArrayBuffer
+ * @param base64url - a base64url encoded string
+ * @returns ArrayBuffer
+ */
+export const convertBase64UrlToArrayBuffer = (
+	base64url: string,
+): ArrayBuffer => {
+	return Uint8Array.from(
+		base64Decoder.convert(base64url, { urlSafe: true }),
+		x => x.charCodeAt(0),
+	).buffer;
+};

package/src/foundation/convert/base64url/index.ts

@@ -0,0 +1,5 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+export { convertArrayBufferToBase64Url } from './convertArrayBufferToBase64Url';
+export { convertBase64UrlToArrayBuffer } from './convertBase64UrlToArrayBuffer';

package/src/foundation/convert/index.ts

@@ -0,0 +1,7 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+export {
+	convertArrayBufferToBase64Url,
+	convertBase64UrlToArrayBuffer,
+} from './base64url';

package/src/foundation/factories/serviceClients/cognitoIdentityProvider/createCompleteWebAuthnRegistrationClient.ts

@@ -0,0 +1,31 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { composeServiceApi } from '@aws-amplify/core/internals/aws-client-utils/composers';
+
+import {
+	CompleteWebAuthnRegistrationCommandInput,
+	CompleteWebAuthnRegistrationCommandOutput,
+	ServiceClientFactoryInput,
+} from './types';
+import { cognitoUserPoolTransferHandler } from './shared/handler';
+import {
+	createUserPoolDeserializer,
+	createUserPoolSerializer,
+} from './shared/serde';
+import { DEFAULT_SERVICE_CLIENT_API_CONFIG } from './constants';
+
+export const createCompleteWebAuthnRegistrationClient = (
+	config: ServiceClientFactoryInput,
+) =>
+	composeServiceApi(
+		cognitoUserPoolTransferHandler,
+		createUserPoolSerializer<CompleteWebAuthnRegistrationCommandInput>(
+			'CompleteWebAuthnRegistration',
+		),
+		createUserPoolDeserializer<CompleteWebAuthnRegistrationCommandOutput>(),
+		{
+			...DEFAULT_SERVICE_CLIENT_API_CONFIG,
+			...config,
+		},
+	);

package/src/foundation/factories/serviceClients/cognitoIdentityProvider/createDeleteWebAuthnCredentialClient.ts

@@ -0,0 +1,31 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { composeServiceApi } from '@aws-amplify/core/internals/aws-client-utils/composers';
+
+import {
+	DeleteWebAuthnCredentialCommandInput,
+	DeleteWebAuthnCredentialCommandOutput,
+	ServiceClientFactoryInput,
+} from './types';
+import { cognitoUserPoolTransferHandler } from './shared/handler';
+import {
+	createUserPoolDeserializer,
+	createUserPoolSerializer,
+} from './shared/serde';
+import { DEFAULT_SERVICE_CLIENT_API_CONFIG } from './constants';
+
+export const createDeleteWebAuthnCredentialClient = (
+	config: ServiceClientFactoryInput,
+) =>
+	composeServiceApi(
+		cognitoUserPoolTransferHandler,
+		createUserPoolSerializer<DeleteWebAuthnCredentialCommandInput>(
+			'DeleteWebAuthnCredential',
+		),
+		createUserPoolDeserializer<DeleteWebAuthnCredentialCommandOutput>(),
+		{
+			...DEFAULT_SERVICE_CLIENT_API_CONFIG,
+			...config,
+		},
+	);

package/src/foundation/factories/serviceClients/cognitoIdentityProvider/createListWebAuthnCredentialsClient.ts

@@ -0,0 +1,31 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { composeServiceApi } from '@aws-amplify/core/internals/aws-client-utils/composers';
+
+import {
+	ListWebAuthnCredentialsCommandInput,
+	ListWebAuthnCredentialsCommandOutput,
+	ServiceClientFactoryInput,
+} from './types';
+import { cognitoUserPoolTransferHandler } from './shared/handler';
+import {
+	createUserPoolDeserializer,
+	createUserPoolSerializer,
+} from './shared/serde';
+import { DEFAULT_SERVICE_CLIENT_API_CONFIG } from './constants';
+
+export const createListWebAuthnCredentialsClient = (
+	config: ServiceClientFactoryInput,
+) =>
+	composeServiceApi(
+		cognitoUserPoolTransferHandler,
+		createUserPoolSerializer<ListWebAuthnCredentialsCommandInput>(
+			'ListWebAuthnCredentials',
+		),
+		createUserPoolDeserializer<ListWebAuthnCredentialsCommandOutput>(),
+		{
+			...DEFAULT_SERVICE_CLIENT_API_CONFIG,
+			...config,
+		},
+	);

package/src/foundation/factories/serviceClients/cognitoIdentityProvider/createSignUpClient.ts

@@ -1,24 +1,61 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 import { composeServiceApi } from '@aws-amplify/core/internals/aws-client-utils/composers';
+import {
+	HttpResponse,
+	parseJsonBody,
+	parseJsonError,
+} from '@aws-amplify/core/internals/aws-client-utils';
+
+import { validationErrorMap } from '../../../../common/AuthErrorStrings';
+import { AuthError } from '../../../../errors/AuthError';
+import { AuthValidationErrorCode } from '../../../../errors/types/validation';
+import { assertServiceError } from '../../../../errors/utils/assertServiceError';
+import { SignUpException } from '../../../../providers/cognito/types/errors';
 
+import { createUserPoolSerializer } from './shared/serde';
+import { cognitoUserPoolTransferHandler } from './shared/handler';
+import { DEFAULT_SERVICE_CLIENT_API_CONFIG } from './constants';
 import {
 	ServiceClientFactoryInput,
 	SignUpCommandInput,
 	SignUpCommandOutput,
 } from './types';
-import { DEFAULT_SERVICE_CLIENT_API_CONFIG } from './constants';
-import { cognitoUserPoolTransferHandler } from './shared/handler';
-import {
-	createUserPoolDeserializer,
-	createUserPoolSerializer,
-} from './shared/serde';
+
+export const createSignUpClientDeserializer =
+	(): ((response: HttpResponse) => Promise<SignUpCommandOutput>) =>
+	async (response: HttpResponse): Promise<SignUpCommandOutput> => {
+		if (response.statusCode >= 300) {
+			const error = await parseJsonError(response);
+			assertServiceError(error);
+
+			if (
+				// Missing Password Error
+				// 1 validation error detected: Value at 'password'failed to satisfy constraint: Member must not be null
+				error.name === SignUpException.InvalidParameterException &&
+				/'password'/.test(error.message) &&
+				/Member must not be null/.test(error.message)
+			) {
+				const name = AuthValidationErrorCode.EmptySignUpPassword;
+				const { message, recoverySuggestion } = validationErrorMap[name];
+				throw new AuthError({
+					name,
+					message,
+					recoverySuggestion,
+				});
+			}
+
+			throw new AuthError({ name: error.name, message: error.message });
+		}
+
+		return parseJsonBody(response);
+	};
 
 export const createSignUpClient = (config: ServiceClientFactoryInput) =>
 	composeServiceApi(
 		cognitoUserPoolTransferHandler,
 		createUserPoolSerializer<SignUpCommandInput>('SignUp'),
-		createUserPoolDeserializer<SignUpCommandOutput>(),
+		createSignUpClientDeserializer(),
 		{
 			...DEFAULT_SERVICE_CLIENT_API_CONFIG,
 			...config,

package/src/foundation/factories/serviceClients/cognitoIdentityProvider/createStartWebAuthnRegistrationClient.ts

@@ -0,0 +1,31 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { composeServiceApi } from '@aws-amplify/core/internals/aws-client-utils/composers';
+
+import {
+	ServiceClientFactoryInput,
+	StartWebAuthnRegistrationCommandInput,
+	StartWebAuthnRegistrationCommandOutput,
+} from './types';
+import { cognitoUserPoolTransferHandler } from './shared/handler';
+import {
+	createUserPoolDeserializer,
+	createUserPoolSerializer,
+} from './shared/serde';
+import { DEFAULT_SERVICE_CLIENT_API_CONFIG } from './constants';
+
+export const createStartWebAuthnRegistrationClient = (
+	config: ServiceClientFactoryInput,
+) =>
+	composeServiceApi(
+		cognitoUserPoolTransferHandler,
+		createUserPoolSerializer<StartWebAuthnRegistrationCommandInput>(
+			'StartWebAuthnRegistration',
+		),
+		createUserPoolDeserializer<StartWebAuthnRegistrationCommandOutput>(),
+		{
+			...DEFAULT_SERVICE_CLIENT_API_CONFIG,
+			...config,
+		},
+	);

package/src/foundation/factories/serviceClients/cognitoIdentityProvider/index.ts

@@ -24,3 +24,7 @@ export { createVerifyUserAttributeClient } from './createVerifyUserAttributeClie
 export { createUpdateDeviceStatusClient } from './createUpdateDeviceStatusClient';
 export { createListDevicesClient } from './createListDevicesClient';
 export { createDeleteUserAttributesClient } from './createDeleteUserAttributesClient';
+export { createStartWebAuthnRegistrationClient } from './createStartWebAuthnRegistrationClient';
+export { createCompleteWebAuthnRegistrationClient } from './createCompleteWebAuthnRegistrationClient';
+export { createListWebAuthnCredentialsClient } from './createListWebAuthnCredentialsClient';
+export { createDeleteWebAuthnCredentialClient } from './createDeleteWebAuthnCredentialClient';

package/src/foundation/factories/serviceClients/cognitoIdentityProvider/shared/serde/createUserPoolSerializer.ts

@@ -30,7 +30,11 @@ type ClientOperation =
 	| 'DeleteUserAttributes'
 	| 'UpdateDeviceStatus'
 	| 'ListDevices'
-	| 'RevokeToken';
+	| 'RevokeToken'
+	| 'StartWebAuthnRegistration'
+	| 'CompleteWebAuthnRegistration'
+	| 'ListWebAuthnCredentials'
+	| 'DeleteWebAuthnCredential';
 
 export const createUserPoolSerializer =
 	<Input>(operation: ClientOperation) =>

package/src/foundation/factories/serviceClients/cognitoIdentityProvider/types/errors.ts

@@ -0,0 +1,43 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+export enum StartWebAuthnRegistrationException {
+	ForbiddenException = 'ForbiddenException',
+	InternalErrorException = 'InternalErrorException',
+	InvalidParameterException = 'InvalidParameterException',
+	LimitExceededException = 'LimitExceededException',
+	NotAuthorizedException = 'NotAuthorizedException',
+	TooManyRequestsException = 'TooManyRequestsException',
+	WebAuthnNotEnabledException = 'WebAuthnNotEnabledException',
+	WebAuthnConfigurationMissingException = 'WebAuthnConfigurationMissingException',
+}
+
+export enum CompleteWebAuthnRegistrationException {
+	ForbiddenException = 'ForbiddenException',
+	InternalErrorException = 'InternalErrorException',
+	InvalidParameterException = 'InvalidParameterException',
+	LimitExceededException = 'LimitExceededException',
+	NotAuthorizedException = 'NotAuthorizedException',
+	TooManyRequestsException = 'TooManyRequestsException',
+	WebAuthnNotEnabledException = 'WebAuthnNotEnabledException',
+	WebAuthnChallengeNotFoundException = 'WebAuthnChallengeNotFoundException',
+	WebAuthnRelyingPartyMismatchException = 'WebAuthnRelyingPartyMismatchException',
+	WebAuthnClientMismatchException = 'WebAuthnClientMismatchException',
+	WebAuthnOriginNotAllowedException = 'WebAuthnOriginNotAllowedException',
+	WebAuthnCredentialNotSupportedException = 'WebAuthnCredentialNotSupportedException',
+}
+
+export enum ListWebAuthnCredentialsException {
+	ForbiddenException = 'ForbiddenException',
+	InternalErrorException = 'InternalErrorException',
+	InvalidParameterException = 'InvalidParameterException',
+	NotAuthorizedException = 'NotAuthorizedException',
+}
+
+export enum DeleteWebAuthnCredentialException {
+	ForbiddenException = 'ForbiddenException',
+	InternalErrorException = 'InternalErrorException',
+	InvalidParameterException = 'InvalidParameterException',
+	NotAuthorizedException = 'NotAuthorizedException',
+	ResourceNotFoundException = 'ResourceNotFoundException',
+}

package/src/foundation/factories/serviceClients/cognitoIdentityProvider/types/index.ts

@@ -1,4 +1,6 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
+
 export * from './sdk';
 export * from './serviceClient';
+export * from './errors';