@aws-amplify/auth 6.7.1-unstable.ab33a03.0 → 6.8.0

package/src/foundation/factories/serviceClients/cognitoIdentityProvider/types/sdk.ts

@@ -7,16 +7,21 @@ import { MetadataBearer as __MetadataBearer } from '@aws-sdk/types';
 
 export type ChallengeName =
 	| 'SMS_MFA'
+	| 'SMS_OTP'
 	| 'SOFTWARE_TOKEN_MFA'
 	| 'EMAIL_OTP'
 	| 'SELECT_MFA_TYPE'
+	| 'SELECT_CHALLENGE'
 	| 'MFA_SETUP'
+	| 'PASSWORD'
+	| 'PASSWORD_SRP'
 	| 'PASSWORD_VERIFIER'
 	| 'CUSTOM_CHALLENGE'
 	| 'DEVICE_SRP_AUTH'
 	| 'DEVICE_PASSWORD_VERIFIER'
 	| 'ADMIN_NO_SRP_AUTH'
-	| 'NEW_PASSWORD_REQUIRED';
+	| 'NEW_PASSWORD_REQUIRED'
+	| 'WEB_AUTHN';
 
 export type ChallengeParameters = {
 	CODE_DELIVERY_DESTINATION?: string;
@@ -27,6 +32,7 @@ export type ChallengeParameters = {
 	PASSWORD_CLAIM_SIGNATURE?: string;
 	MFAS_CAN_CHOOSE?: string;
 	MFAS_CAN_SETUP?: string;
+	CREDENTIAL_REQUEST_OPTIONS?: string;
 } & Record<string, unknown>;
 
 export type CognitoMFAType = 'SMS_MFA' | 'SOFTWARE_TOKEN_MFA' | 'EMAIL_OTP';
@@ -56,6 +62,10 @@ declare enum ChallengeNameType {
 	SELECT_MFA_TYPE = 'SELECT_MFA_TYPE',
 	SMS_MFA = 'SMS_MFA',
 	SOFTWARE_TOKEN_MFA = 'SOFTWARE_TOKEN_MFA',
+	PASSWORD = 'PASSWORD',
+	PASSWORD_SRP = 'PASSWORD_SRP',
+	WEB_AUTHN = 'WEB_AUTHN',
+	SMS_OTP = 'SMS_OTP',
 	EMAIL_OTP = 'EMAIL_OTP',
 }
 declare enum DeliveryMediumType {
@@ -696,7 +706,15 @@ export interface ConfirmSignUpRequest {
 /**
  * <p>Represents the response from the server for the registration confirmation.</p>
  */
-export type ConfirmSignUpResponse = Record<never, never>;
+export interface ConfirmSignUpResponse {
+	/**
+	 * <p>Your <code>ConfirmSignUp</code> request might produce a challenge that your user must
+	 *             respond to, for example a one-time code. The <code>Session</code> parameter tracks the
+	 *             session in the flow of challenge responses and requests. Include this parameter in
+	 *                 <code>RespondToAuthChallenge</code> API requests.</p>
+	 */
+	Session?: string;
+}
 export type DeleteUserCommandInput = DeleteUserRequest;
 export interface DeleteUserCommandOutput
 	extends DeleteUserResponse,
@@ -1083,6 +1101,13 @@ export interface InitiateAuthRequest {
 	 * <p>Contextual data such as the user's device fingerprint, IP address, or location used for evaluating the risk of an unexpected event by Amazon Cognito advanced security.</p>
 	 */
 	UserContextData?: UserContextDataType;
+
+	/**
+	 * <p>The optional session ID from a <code>ConfirmSignUp</code> API
+	 *             request. You can sign in a user directly from the sign-up process with the
+	 *             <code>USER_AUTH</code> authentication flow.</p>
+	 */
+	Session?: string;
 }
 /**
  * <p>Initiates the authentication response.</p>
@@ -1133,8 +1158,10 @@ export interface InitiateAuthResponse {
 	 */
 	ChallengeName?: ChallengeNameType | string;
 	/**
-	 * <p>The session that should pass both ways in challenge-response calls to the service. If the caller must pass another challenge, they return a session with other challenge parameters. This session
-	 *             should be passed as it is to the next <code>RespondToAuthChallenge</code> API call.</p>
+	 * <p>The session that should pass both ways in challenge-response calls to the service. If
+	 *             the caller must pass another challenge, they return a session with other challenge
+	 *             parameters. Include this session identifier in a <code>RespondToAuthChallenge</code> API
+	 *             request.</p>
 	 */
 	Session?: string;
 	/**
@@ -1145,9 +1172,15 @@ export interface InitiateAuthResponse {
 	ChallengeParameters?: Record<string, string>;
 	/**
 	 * <p>The result of the authentication response. This result is only returned if the caller doesn't need to pass another challenge. If the caller does need to pass another challenge before it gets
-	 *             tokens, <code>ChallengeName</code>, <code>ChallengeParameters</code>, and <code>Session</code> are returned.</p>
+	 *             tokens, <code>ChallengeName</code>, <code>ChallengeParameters</code>, <code>AvailableChallenges</code>, and <code>Session</code> are returned.</p>
 	 */
 	AuthenticationResult?: AuthenticationResultType;
+	/**
+	 * <p>This response parameter prompts a user to select from multiple available challenges
+	 *             that they can complete authentication with. For example, they might be able to continue
+	 *             with passwordless authentication or with a one-time password from an SMS message.</p>
+	 */
+	AvailableChallenges?: ChallengeNameType[];
 }
 export type ListDevicesCommandInput = ListDevicesRequest;
 export interface ListDevicesCommandOutput
@@ -1527,6 +1560,13 @@ export interface SignUpResponse {
 	 * <p>The UUID of the authenticated user. This isn't the same as <code>username</code>.</p>
 	 */
 	UserSub: string | undefined;
+
+	/**
+	 * <p>A session Id that you can pass to <code>ConfirmSignUp</code> when you want to
+	 *         immediately sign in your user with the <code>USER_AUTH</code> flow after they complete
+	 *         sign-up.</p>
+	 */
+	Session?: string;
 }
 /**
  * <p>The type used for enabling software token MFA at the user level. If an MFA type is activated for a user, the user will be prompted for MFA during all sign-in attempts, unless device tracking
@@ -1732,3 +1772,99 @@ export interface DeleteUserAttributesRequest {
  */
 export type DeleteUserAttributesResponse = Record<never, never>;
 export {};
+
+export interface StartWebAuthnRegistrationRequest {
+	/**
+	 * A valid access token that Amazon Cognito issued to the user whose passkey metadata you want to
+	 *             generate.
+	 */
+	AccessToken: string | undefined;
+}
+
+export interface StartWebAuthnRegistrationResponse {
+	/**
+	 * The information that a user can provide in their request to register with their
+	 *             passkey provider.
+	 */
+	CredentialCreationOptions: Record<never, never> | undefined;
+}
+
+export type StartWebAuthnRegistrationCommandInput =
+	StartWebAuthnRegistrationRequest;
+
+export interface StartWebAuthnRegistrationCommandOutput
+	extends StartWebAuthnRegistrationResponse,
+		__MetadataBearer {}
+
+export interface CompleteWebAuthnRegistrationRequest {
+	/**
+	 * A valid access token that Amazon Cognito issued to the user whose passkey registration you want
+	 *             to verify. This information informs your user pool of the details of the user's
+	 *             successful registration with their passkey provider.
+	 */
+	AccessToken: string | undefined;
+
+	/**
+	 * A <a href="https://www.w3.org/TR/webauthn-3/#dictdef-registrationresponsejson">RegistrationResponseJSON</a> public-key credential response from the
+	 *             user's passkey provider.
+	 */
+	Credential: Record<never, never> | undefined;
+}
+
+export type CompleteWebAuthnRegistrationResponse = Record<never, never>;
+
+export type CompleteWebAuthnRegistrationCommandInput =
+	CompleteWebAuthnRegistrationRequest;
+
+export interface CompleteWebAuthnRegistrationCommandOutput
+	extends CompleteWebAuthnRegistrationResponse,
+		__MetadataBearer {}
+
+/**
+ * <p>The request to list WebAuthN credentials.</p>
+ */
+export interface ListWebAuthnCredentialsInput {
+	AccessToken: string | undefined;
+	NextToken?: string;
+	MaxResults?: number;
+}
+
+export interface WebAuthnCredentialDescription {
+	CredentialId: string | undefined;
+	FriendlyCredentialName: string | undefined;
+	RelyingPartyId: string | undefined;
+	AuthenticatorAttachment?: string;
+	AuthenticatorTransports: string[] | undefined;
+	CreatedAt: number | undefined;
+}
+
+/**
+ * <p>The response containing the list of WebAuthN credentials.</p>
+ */
+export interface ListWebAuthnCredentialsOutput {
+	Credentials: WebAuthnCredentialDescription[] | undefined;
+	NextToken?: string;
+}
+
+export type ListWebAuthnCredentialsCommandInput = ListWebAuthnCredentialsInput;
+
+export interface ListWebAuthnCredentialsCommandOutput
+	extends ListWebAuthnCredentialsOutput,
+		__MetadataBearer {}
+
+/**
+ * The request to delete a WebAuthN credential.
+ */
+export interface DeleteWebAuthnCredentialInput {
+	AccessToken: string | undefined;
+	CredentialId: string | undefined;
+}
+
+export type DeleteWebAuthnCredentialOutput = Record<never, never>;
+
+export type DeleteWebAuthnCredentialCommandInput =
+	DeleteWebAuthnCredentialInput;
+
+export interface DeleteWebAuthnCredentialCommandOutput
+	extends DeleteWebAuthnCredentialOutput,
+		__MetadataBearer {}

package/src/foundation/types/index.ts

@@ -0,0 +1,9 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+export {
+	ListWebAuthnCredentialsInput,
+	DeleteWebAuthnCredentialInput,
+} from './inputs';
+export { ListWebAuthnCredentialsOutput } from './outputs';
+export { AuthWebAuthnCredential } from './models';

package/src/foundation/types/inputs.ts

@@ -0,0 +1,14 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+/**
+ * Input type for Cognito listWebAuthnCredentials API.
+ */
+export interface ListWebAuthnCredentialsInput {
+	pageSize?: number;
+	nextToken?: string;
+}
+
+export interface DeleteWebAuthnCredentialInput {
+	credentialId: string;
+}

package/src/foundation/types/models.ts

@@ -0,0 +1,14 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+/**
+ * Shape of a WebAuthn credential
+ */
+export interface AuthWebAuthnCredential {
+	credentialId: string | undefined;
+	friendlyCredentialName: string | undefined;
+	relyingPartyId: string | undefined;
+	authenticatorAttachment?: string;
+	authenticatorTransports: string[] | undefined;
+	createdAt: Date | undefined;
+}

package/src/foundation/types/outputs.ts

@@ -0,0 +1,12 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { AuthWebAuthnCredential } from './models';
+
+/**
+ * Output type for Cognito listWebAuthnCredentials API.
+ */
+export interface ListWebAuthnCredentialsOutput {
+	credentials: AuthWebAuthnCredential[];
+	nextToken?: string;
+}

package/src/index.ts

@@ -87,3 +87,17 @@ export {
 	AuthTokens,
 	JWT,
 } from '@aws-amplify/core';
+
+export { associateWebAuthnCredential } from './client/apis';
+
+export {
+	listWebAuthnCredentials,
+	deleteWebAuthnCredential,
+} from './client/apis';
+
+export {
+	AuthWebAuthnCredential,
+	DeleteWebAuthnCredentialInput,
+	ListWebAuthnCredentialsInput,
+	ListWebAuthnCredentialsOutput,
+} from './foundation/types';

package/src/providers/cognito/apis/autoSignIn.ts

@@ -1,6 +1,7 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
+import { autoSignInStore } from '../../../client/utils/store';
 import { AuthError } from '../../../errors/AuthError';
 import { AUTO_SIGN_IN_EXCEPTION } from '../../../errors/constants';
 import { AutoSignInCallback } from '../../../types/models';
@@ -114,6 +115,9 @@ export function setAutoSignIn(callback: AutoSignInCallback) {
  *
  * @internal
  */
-export function resetAutoSignIn() {
-	autoSignIn = initialAutoSignIn;
+export function resetAutoSignIn(resetCallback = true) {
+	if (resetCallback) {
+		autoSignIn = initialAutoSignIn;
+	}
+	autoSignInStore.dispatch({ type: 'RESET' });
 }

package/src/providers/cognito/apis/confirmSignIn.ts

@@ -14,7 +14,7 @@ import {
 	cleanActiveSignInState,
 	setActiveSignInState,
 	signInStore,
-} from '../utils/signInStore';
+} from '../../../client/utils/store';
 import { AuthError } from '../../../errors/AuthError';
 import {
 	getNewDeviceMetadata,

package/src/providers/cognito/apis/confirmSignUp.ts

@@ -14,15 +14,13 @@ import { AuthValidationErrorCode } from '../../../errors/types/validation';
 import { ConfirmSignUpException } from '../types/errors';
 import { getRegionFromUserPoolId } from '../../../foundation/parsers';
 import { AutoSignInEventData } from '../types/models';
-import {
-	isAutoSignInStarted,
-	isAutoSignInUserUsingConfirmSignUp,
-	setAutoSignInStarted,
-} from '../utils/signUpHelpers';
 import { getAuthUserAgentValue } from '../../../utils';
 import { getUserContextData } from '../utils/userContextData';
 import { createConfirmSignUpClient } from '../../../foundation/factories/serviceClients/cognitoIdentityProvider';
 import { createCognitoUserPoolEndpointResolver } from '../factories';
+import { autoSignInStore } from '../../../client/utils/store';
+
+import { resetAutoSignIn } from './autoSignIn';
 
 /**
  * Confirms a new user account.
@@ -65,7 +63,7 @@ export async function confirmSignUp(
 		}),
 	});
 
-	await confirmSignUpClient(
+	const { Session: session } = await confirmSignUpClient(
 		{
 			region: getRegionFromUserPoolId(authConfig.userPoolId),
 			userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignUp),
@@ -88,16 +86,20 @@ export async function confirmSignUp(
 					signUpStep: 'DONE',
 				},
 			};
+			const autoSignInStoreState = autoSignInStore.getState();
 
 			if (
-				!isAutoSignInStarted() ||
-				!isAutoSignInUserUsingConfirmSignUp(username)
+				!autoSignInStoreState.active ||
+				autoSignInStoreState.username !== username
 			) {
 				resolve(signUpOut);
+				resetAutoSignIn();
 
 				return;
 			}
 
+			autoSignInStore.dispatch({ type: 'SET_SESSION', value: session });
+
 			const stopListener = HubInternal.listen<AutoSignInEventData>(
 				'auth-internal',
 				({ payload }) => {
@@ -109,7 +111,6 @@ export async function confirmSignUp(
 									signUpStep: 'COMPLETE_AUTO_SIGN_IN',
 								},
 							});
-							setAutoSignInStarted(false);
 							stopListener();
 					}
 				},

package/src/providers/cognito/apis/signIn.ts

@@ -13,6 +13,8 @@ import { signInWithCustomAuth } from './signInWithCustomAuth';
 import { signInWithCustomSRPAuth } from './signInWithCustomSRPAuth';
 import { signInWithSRP } from './signInWithSRP';
 import { signInWithUserPassword } from './signInWithUserPassword';
+import { signInWithUserAuth } from './signInWithUserAuth';
+import { resetAutoSignIn } from './autoSignIn';
 
 /**
  * Signs a user in
@@ -26,6 +28,12 @@ import { signInWithUserPassword } from './signInWithUserPassword';
  * @throws AuthTokenConfigException - Thrown when the token provider config is invalid.
  */
 export async function signIn(input: SignInInput): Promise<SignInOutput> {
+	// Here we want to reset the store but not reassign the callback.
+	// The callback is reset when the underlying promise resolves or rejects.
+	// With the advent of session based sign in, this guarantees that the signIn API initiates a new auth flow,
+	// regardless of whether it is called for a user currently engaged in an active auto sign in session.
+	resetAutoSignIn(false);
+
 	const authFlowType = input.options?.authFlowType;
 	await assertUserNotAuthenticated();
 	switch (authFlowType) {
@@ -37,6 +45,8 @@ export async function signIn(input: SignInInput): Promise<SignInOutput> {
 			return signInWithCustomAuth(input);
 		case 'CUSTOM_WITH_SRP':
 			return signInWithCustomSRPAuth(input);
+		case 'USER_AUTH':
+			return signInWithUserAuth(input);
 		default:
 			return signInWithSRP(input);
 	}

package/src/providers/cognito/apis/signInWithCustomAuth.ts

@@ -24,7 +24,7 @@ import {
 import {
 	cleanActiveSignInState,
 	setActiveSignInState,
-} from '../utils/signInStore';
+} from '../../../client/utils/store';
 import { cacheCognitoTokens } from '../tokenProvider/cacheTokens';
 import {
 	ChallengeName,

package/src/providers/cognito/apis/signInWithCustomSRPAuth.ts

@@ -26,7 +26,7 @@ import {
 import {
 	cleanActiveSignInState,
 	setActiveSignInState,
-} from '../utils/signInStore';
+} from '../../../client/utils/store';
 import { cacheCognitoTokens } from '../tokenProvider/cacheTokens';
 import {
 	ChallengeName,

package/src/providers/cognito/apis/signInWithSRP.ts

@@ -30,11 +30,13 @@ import {
 import {
 	cleanActiveSignInState,
 	setActiveSignInState,
-} from '../utils/signInStore';
+} from '../../../client/utils/store';
 import { cacheCognitoTokens } from '../tokenProvider/cacheTokens';
 import { tokenOrchestrator } from '../tokenProvider';
 import { dispatchSignedInHubEvent } from '../utils/dispatchSignedInHubEvent';
 
+import { resetAutoSignIn } from './autoSignIn';
+
 /**
  * Signs a user in
  *
@@ -104,6 +106,8 @@ export async function signInWithSRP(
 
 			await dispatchSignedInHubEvent();
 
+			resetAutoSignIn();
+
 			return {
 				isSignedIn: true,
 				nextStep: { signInStep: 'DONE' },
@@ -116,6 +120,7 @@ export async function signInWithSRP(
 		});
 	} catch (error) {
 		cleanActiveSignInState();
+		resetAutoSignIn();
 		assertServiceError(error);
 		const result = getSignInResultFromError(error.name);
 		if (result) return result;

package/src/providers/cognito/apis/signInWithUserAuth.ts

@@ -0,0 +1,141 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { Amplify } from '@aws-amplify/core';
+import { assertTokenProviderConfig } from '@aws-amplify/core/internals/utils';
+
+import { AuthValidationErrorCode } from '../../../errors/types/validation';
+import { assertValidationError } from '../../../errors/utils/assertValidationError';
+import { assertServiceError } from '../../../errors/utils/assertServiceError';
+import {
+	ChallengeName,
+	ChallengeParameters,
+} from '../../../foundation/factories/serviceClients/cognitoIdentityProvider/types';
+import {
+	InitiateAuthException,
+	RespondToAuthChallengeException,
+} from '../types/errors';
+import {
+	getActiveSignInUsername,
+	getNewDeviceMetadata,
+	getSignInResult,
+	getSignInResultFromError,
+} from '../utils/signInHelpers';
+import {
+	CognitoAuthSignInDetails,
+	SignInWithUserAuthInput,
+	SignInWithUserAuthOutput,
+} from '../types';
+import {
+	autoSignInStore,
+	cleanActiveSignInState,
+	setActiveSignInState,
+} from '../../../client/utils/store';
+import { cacheCognitoTokens } from '../tokenProvider/cacheTokens';
+import { dispatchSignedInHubEvent } from '../utils/dispatchSignedInHubEvent';
+import { tokenOrchestrator } from '../tokenProvider';
+import {
+	HandleUserAuthFlowInput,
+	handleUserAuthFlow,
+} from '../../../client/flows/userAuth/handleUserAuthFlow';
+
+import { resetAutoSignIn } from './autoSignIn';
+
+/**
+ * Signs a user in through a registered email or phone number without a password by by receiving and entering an OTP.
+ *
+ * @param input - The SignInWithUserAuthInput object
+ * @returns SignInWithUserAuthOutput
+ * @throws service: {@link InitiateAuthException }, {@link RespondToAuthChallengeException } - Cognito service errors
+ * thrown during the sign-in process.
+ * @throws validation: {@link AuthValidationErrorCode  } - Validation errors thrown when either username or password -- needs to change
+ *  are not defined.
+ * @throws AuthTokenConfigException - Thrown when the token provider config is invalid.
+ */
+export async function signInWithUserAuth(
+	input: SignInWithUserAuthInput,
+): Promise<SignInWithUserAuthOutput> {
+	const { username, password, options } = input;
+	const authConfig = Amplify.getConfig().Auth?.Cognito;
+	const signInDetails: CognitoAuthSignInDetails = {
+		loginId: username,
+		authFlowType: 'USER_AUTH',
+	};
+	assertTokenProviderConfig(authConfig);
+	const clientMetaData = options?.clientMetadata;
+	const preferredChallenge = options?.preferredChallenge;
+
+	assertValidationError(
+		!!username,
+		AuthValidationErrorCode.EmptySignInUsername,
+	);
+
+	try {
+		const handleUserAuthFlowInput: HandleUserAuthFlowInput = {
+			username,
+			config: authConfig,
+			tokenOrchestrator,
+			clientMetadata: clientMetaData,
+			preferredChallenge,
+			password,
+		};
+
+		const autoSignInStoreState = autoSignInStore.getState();
+		if (
+			autoSignInStoreState.active &&
+			autoSignInStoreState.username === username
+		) {
+			handleUserAuthFlowInput.session = autoSignInStoreState.session;
+		}
+
+		const response = await handleUserAuthFlow(handleUserAuthFlowInput);
+
+		const activeUsername = getActiveSignInUsername(username);
+
+		setActiveSignInState({
+			signInSession: response.Session,
+			username: activeUsername,
+			challengeName: response.ChallengeName as ChallengeName,
+			signInDetails,
+		});
+
+		if (response.AuthenticationResult) {
+			cleanActiveSignInState();
+			await cacheCognitoTokens({
+				username: activeUsername,
+				...response.AuthenticationResult,
+				NewDeviceMetadata: await getNewDeviceMetadata({
+					userPoolId: authConfig.userPoolId,
+					userPoolEndpoint: authConfig.userPoolEndpoint,
+					newDeviceMetadata: response.AuthenticationResult.NewDeviceMetadata,
+					accessToken: response.AuthenticationResult.AccessToken,
+				}),
+				signInDetails,
+			});
+			await dispatchSignedInHubEvent();
+
+			resetAutoSignIn();
+
+			return {
+				isSignedIn: true,
+				nextStep: { signInStep: 'DONE' },
+			};
+		}
+
+		return getSignInResult({
+			challengeName: response.ChallengeName as ChallengeName,
+			challengeParameters: response.ChallengeParameters as ChallengeParameters,
+			availableChallenges:
+				'AvailableChallenges' in response
+					? (response.AvailableChallenges as ChallengeName[])
+					: undefined,
+		});
+	} catch (error) {
+		cleanActiveSignInState();
+		resetAutoSignIn();
+		assertServiceError(error);
+		const result = getSignInResultFromError(error.name);
+		if (result) return result;
+		throw error;
+	}
+}

package/src/providers/cognito/apis/signInWithUserPassword.ts

@@ -28,11 +28,13 @@ import {
 import {
 	cleanActiveSignInState,
 	setActiveSignInState,
-} from '../utils/signInStore';
+} from '../../../client/utils/store';
 import { cacheCognitoTokens } from '../tokenProvider/cacheTokens';
 import { tokenOrchestrator } from '../tokenProvider';
 import { dispatchSignedInHubEvent } from '../utils/dispatchSignedInHubEvent';
 
+import { resetAutoSignIn } from './autoSignIn';
+
 /**
  * Signs a user in using USER_PASSWORD_AUTH AuthFlowType
  *
@@ -84,6 +86,7 @@ export async function signInWithUserPassword(
 			signInDetails,
 		});
 		if (AuthenticationResult) {
+			cleanActiveSignInState();
 			await cacheCognitoTokens({
 				...AuthenticationResult,
 				username: activeUsername,
@@ -95,10 +98,11 @@ export async function signInWithUserPassword(
 				}),
 				signInDetails,
 			});
-			cleanActiveSignInState();
 
 			await dispatchSignedInHubEvent();
 
+			resetAutoSignIn();
+
 			return {
 				isSignedIn: true,
 				nextStep: { signInStep: 'DONE' },
@@ -111,6 +115,7 @@ export async function signInWithUserPassword(
 		});
 	} catch (error) {
 		cleanActiveSignInState();
+		resetAutoSignIn();
 		assertServiceError(error);
 		const result = getSignInResultFromError(error.name);
 		if (result) return result;