@aws-amplify/core 6.5.3 → 6.5.4-storage-browser-integrity.34fba2d.0

package/dist/esm/singleton/Storage/types.d.ts

@@ -7,6 +7,8 @@ export interface BucketInfo {
     bucketName: string;
     /** Region of the bucket */
     region: string;
+    /** Paths to object with access permissions */
+    paths?: Record<string, Record<string, string[] | undefined>>;
 }
 export interface S3ProviderConfig {
     S3: {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@aws-amplify/core",
-	"version": "6.5.3",
+	"version": "6.5.4-storage-browser-integrity.34fba2d.0+34fba2d",
 	"description": "Core category of aws-amplify",
 	"main": "./dist/cjs/index.js",
 	"module": "./dist/esm/index.mjs",
@@ -60,7 +60,7 @@
 		"uuid": "^9.0.0"
 	},
 	"devDependencies": {
-		"@aws-amplify/react-native": "1.1.6",
+		"@aws-amplify/react-native": "1.1.7-storage-browser-integrity.34fba2d.0+34fba2d",
 		"@types/js-cookie": "3.0.2",
 		"genversion": "^2.2.0",
 		"typescript": "5.0.2"
@@ -192,5 +192,5 @@
 			]
 		}
 	},
-	"gitHead": "02b3769ac17b556b058d4b2856d543792c3a5e85"
+	"gitHead": "34fba2dbee947c4d42820499e52e09e638778a15"
 }

package/src/Platform/types.ts

@@ -133,6 +133,8 @@ export enum StorageAction {
 	Remove = '5',
 	GetProperties = '6',
 	GetUrl = '7',
+	GetDataAccess = '8',
+	ListCallerAccessGrants = '9',
 }
 
 interface ActionMap {

package/src/Platform/version.ts

@@ -1,2 +1,2 @@
 // generated by genversion
-export const version = '6.8.2';
+export const version = '6.8.3-storage-browser-integrity.34fba2d.0+34fba2d';

package/src/clients/index.ts

@@ -15,9 +15,14 @@ export {
 } from './middleware/signing/signer/signatureV4';
 export { EMPTY_HASH as EMPTY_SHA256_HASH } from './middleware/signing/signer/signatureV4/constants';
 export { extendedEncodeURIComponent } from './middleware/signing/utils/extendedEncodeURIComponent';
-export { signingMiddlewareFactory, SigningOptions } from './middleware/signing';
+export {
+	signingMiddlewareFactory,
+	SigningOptions,
+	CredentialsProviderOptions,
+} from './middleware/signing';
 export {
 	getRetryDecider,
+	RetryDeciderOutput,
 	jitteredBackoff,
 	retryMiddlewareFactory,
 	RetryOptions,

package/src/clients/internal/composeServiceApi.ts

@@ -5,6 +5,42 @@ import { ServiceClientOptions } from '../types/aws';
 import { Endpoint, TransferHandler } from '../types/core';
 import { HttpRequest, HttpResponse } from '../types/http';
 
+/**
+ * Compose a service API handler that accepts input as defined shape and responds conforming to defined output shape.
+ * A service API handler is composed with:
+ * * A transfer handler
+ * * A serializer function
+ * * A deserializer function
+ * * A default config object
+ *
+ * The returned service API handler, when called, will trigger the following workflow:
+ * 1. When calling the service API handler function, the default config object is merged into the input config
+ * object to assign the default values of some omitted configs, resulting to a resolved config object.
+ * 2. The `endpointResolver` function from the default config object will be invoked with the resolved config object and
+ * API input object resulting to an endpoint instance.
+ * 3. The serializer function is invoked with API input object and the endpoint instance resulting to an HTTP request
+ * instance.
+ * 4. The HTTP request instance and the resolved config object is passed to the transfer handler function.
+ * 5. The transfer handler function resolves to an HTTP response instance(can be either successful or failed status code).
+ * 6. The deserializer function is invoked with the HTTP response instance resulting to the API output object, and
+ * return to the caller.
+ *
+ *
+ * @param transferHandler Async function for dispatching HTTP requests and returning HTTP response.
+ * @param serializer  Async function for converting object in defined input shape into HTTP request targeting a given
+ * 	endpoint.
+ * @param deserializer Async function for converting HTTP response into output object in defined output shape, or error
+ * 	shape.
+ * @param defaultConfig  object containing default options to be consumed by transfer handler, serializer and
+ *  deserializer.
+ * @returns a async service API handler function that accepts a config object and input object in defined shape, returns
+ * 	an output object in defined shape. It may also throw error instance in defined shape in deserializer. The config
+ *  object type is composed with options type of transferHandler, endpointResolver function as well as endpointResolver
+ *  function's input options type, region string. The config object property will be marked as optional if it's also
+ * 	defined in defaultConfig.
+ *
+ * @internal
+ */
 export const composeServiceApi = <
 	TransferHandlerOptions,
 	Input,
@@ -26,9 +62,9 @@ export const composeServiceApi = <
 	return async (
 		config: OptionalizeKey<
 			TransferHandlerOptions &
-				ServiceClientOptions &
-				Partial<DefaultConfig> &
-				InferEndpointResolverOptionType<DefaultConfig>,
+				ServiceClientOptions & // Required configs(e.g. endpointResolver, region) to serialize input shapes into requests
+				InferEndpointResolverOptionType<DefaultConfig> & // Required inputs for endpointResolver
+				Partial<DefaultConfig>, // Properties defined in default configs, we need to allow overwriting them when invoking the service API handler
 			DefaultConfig
 		>,
 		input: Input,
@@ -37,8 +73,8 @@ export const composeServiceApi = <
 			...defaultConfig,
 			...config,
 		} as unknown as TransferHandlerOptions & ServiceClientOptions;
-		// We may want to allow different endpoints from given config(other than region) and input.
-		// Currently S3 supports additional `useAccelerateEndpoint` option to use accelerate endpoint.
+		// We need to allow different endpoints based on both given config(other than region) and input.
+		// However for most of non-S3 services, region is the only input for endpoint resolver.
 		const endpoint = await resolvedConfig.endpointResolver(
 			resolvedConfig,
 			input,
@@ -55,6 +91,30 @@ export const composeServiceApi = <
 	};
 };
 
+/**
+ * Type helper to make a given key optional in a given type. For all the keys in the `InputDefaultsType`, if its value
+ * is assignable to the value of the same key in `InputType`, we will mark the key in `InputType` is optional. If
+ * the `InputType` and `InputDefaultsType` has the same key but un-assignable types, the resulting type is `never` to
+ * trigger a type error down the line.
+ *
+ * @example
+ * type InputType = {
+ *   a: string;
+ *   b: number;
+ *   c: string;
+ * };
+ * type InputDefaultsType = {
+ *   a: string;
+ *   b: number;
+ * };
+ * type OutputType = OptionalizeKey<InputType, InputDefaultsType>;
+ * OutputType equals to:
+ * {
+ *   a?: string;
+ *   b?: number;
+ *   c: string;
+ * }
+ */
 type OptionalizeKey<InputType, InputDefaultsType> = {
 	[KeyWithDefaultValue in keyof InputDefaultsType]?: KeyWithDefaultValue extends keyof InputType
 		? InputType[KeyWithDefaultValue]
@@ -67,7 +127,7 @@ type OptionalizeKey<InputType, InputDefaultsType> = {
 };
 
 type InferEndpointResolverOptionType<T> = T extends {
-	endpointResolver(options: infer EndpointOptions): any;
+	endpointResolver(options: infer EndpointOptions, input: any): any;
 }
 	? EndpointOptions
 	: never;

package/src/clients/middleware/retry/defaultRetryDecider.ts

@@ -5,6 +5,7 @@ import { AmplifyErrorCode } from '../../../types';
 import { ErrorParser, HttpResponse } from '../../types';
 
 import { isClockSkewError } from './isClockSkewError';
+import { RetryDeciderOutput } from './types';
 
 /**
  * Get retry decider function
@@ -12,7 +13,10 @@ import { isClockSkewError } from './isClockSkewError';
  */
 export const getRetryDecider =
 	(errorParser: ErrorParser) =>
-	async (response?: HttpResponse, error?: unknown): Promise<boolean> => {
+	async (
+		response?: HttpResponse,
+		error?: unknown,
+	): Promise<RetryDeciderOutput> => {
 		const parsedError =
 			(error as Error & { code: string }) ??
 			(await errorParser(response)) ??
@@ -20,12 +24,15 @@ export const getRetryDecider =
 		const errorCode = parsedError?.code || parsedError?.name;
 		const statusCode = response?.statusCode;
 
-		return (
+		const isRetryable =
 			isConnectionError(error) ||
 			isThrottlingError(statusCode, errorCode) ||
 			isClockSkewError(errorCode) ||
-			isServerSideError(statusCode, errorCode)
-		);
+			isServerSideError(statusCode, errorCode);
+
+		return {
+			retryable: isRetryable,
+		};
 	};
 
 // reference: https://github.com/aws/aws-sdk-js-v3/blob/ab0e7be36e7e7f8a0c04834357aaad643c7912c3/packages/service-error-classification/src/constants.ts#L22-L37

package/src/clients/middleware/retry/index.ts

@@ -4,3 +4,4 @@
 export { RetryOptions, retryMiddlewareFactory } from './middleware';
 export { jitteredBackoff } from './jitteredBackoff';
 export { getRetryDecider } from './defaultRetryDecider';
+export { RetryDeciderOutput } from './types';

package/src/clients/middleware/retry/middleware.ts

@@ -8,6 +8,8 @@ import {
 	Response,
 } from '../../types/core';
 
+import { RetryDeciderOutput } from './types';
+
 const DEFAULT_RETRY_ATTEMPTS = 3;
 
 /**
@@ -19,9 +21,14 @@ export interface RetryOptions<TResponse = Response> {
 	 *
 	 * @param response Optional response of the request.
 	 * @param error Optional error thrown from previous attempts.
+	 * @param middlewareContext Optional context object to store data between retries.
 	 * @returns True if the request should be retried.
 	 */
-	retryDecider(response?: TResponse, error?: unknown): Promise<boolean>;
+	retryDecider(
+		response?: TResponse,
+		error?: unknown,
+		middlewareContext?: MiddlewareContext,
+	): Promise<RetryDeciderOutput>;
 	/**
 	 * Function to compute the delay in milliseconds before the next retry based
 	 * on the number of attempts.
@@ -87,7 +94,14 @@ export const retryMiddlewareFactory = <TInput = Request, TOutput = Response>({
 						? (context.attemptsCount ?? 0)
 						: attemptsCount + 1;
 				context.attemptsCount = attemptsCount;
-				if (await retryDecider(response, error)) {
+				const { isCredentialsExpiredError, retryable } = await retryDecider(
+					response,
+					error,
+					context,
+				);
+				if (retryable) {
+					// Setting isCredentialsInvalid flag to notify signing middleware to forceRefresh credentials provider.
+					context.isCredentialsExpired = !!isCredentialsExpiredError;
 					if (!abortSignal?.aborted && attemptsCount < maxAttempts) {
 						// prevent sleep for last attempt or cancelled request;
 						const delay = computeDelay(attemptsCount);

package/src/clients/middleware/retry/types.ts

@@ -0,0 +1,7 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+export interface RetryDeciderOutput {
+	retryable: boolean;
+	isCredentialsExpiredError?: boolean;
+}

package/src/clients/middleware/signing/index.ts

@@ -1,4 +1,8 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-export { signingMiddlewareFactory, SigningOptions } from './middleware';
+export {
+	signingMiddlewareFactory,
+	SigningOptions,
+	CredentialsProviderOptions,
+} from './middleware';

package/src/clients/middleware/signing/middleware.ts

@@ -7,16 +7,27 @@ import {
 	HttpResponse,
 	MiddlewareHandler,
 } from '../../types';
+import { MiddlewareContext } from '../../types/core';
 
 import { signRequest } from './signer/signatureV4';
 import { getSkewCorrectedDate } from './utils/getSkewCorrectedDate';
 import { getUpdatedSystemClockOffset } from './utils/getUpdatedSystemClockOffset';
 
+/**
+ * Options type for the async callback function returning aws credentials. This
+ * function is used by SigV4 signer to resolve the aws credentials
+ */
+export interface CredentialsProviderOptions {
+	forceRefresh?: boolean;
+}
+
 /**
  * Configuration of the signing middleware
  */
 export interface SigningOptions {
-	credentials: Credentials | (() => Promise<Credentials>);
+	credentials:
+		| Credentials
+		| ((options?: CredentialsProviderOptions) => Promise<Credentials>);
 	region: string;
 	service: string;
 
@@ -41,12 +52,19 @@ export const signingMiddlewareFactory = ({
 }: SigningOptions) => {
 	let currentSystemClockOffset: number;
 
-	return (next: MiddlewareHandler<HttpRequest, HttpResponse>) =>
+	return (
+		next: MiddlewareHandler<HttpRequest, HttpResponse>,
+		context: MiddlewareContext,
+	) =>
 		async function signingMiddleware(request: HttpRequest) {
 			currentSystemClockOffset = currentSystemClockOffset ?? 0;
 			const signRequestOptions = {
 				credentials:
-					typeof credentials === 'function' ? await credentials() : credentials,
+					typeof credentials === 'function'
+						? await credentials({
+								forceRefresh: !!context?.isCredentialsExpired,
+							})
+						: credentials,
 				signingDate: getSkewCorrectedDate(currentSystemClockOffset),
 				signingRegion: region,
 				signingService: service,

package/src/clients/types/core.ts

@@ -30,6 +30,11 @@ export type MiddlewareHandler<Input, Output> = (
  * The context object to store states across the middleware chain.
  */
 export interface MiddlewareContext {
+	/**
+	 * Whether an error indicating expired credentials has been returned from server-side.
+	 * This is set by the retry middleware.
+	 */
+	isCredentialsExpired?: boolean;
 	/**
 	 * The number of times the request has been attempted. This is set by retry middleware
 	 */

package/src/clients/types/index.ts

@@ -4,6 +4,7 @@
 export {
 	Middleware,
 	MiddlewareHandler,
+	MiddlewareContext,
 	Request,
 	Response,
 	TransferHandler,

package/src/parseAmplifyOutputs.ts

@@ -88,12 +88,14 @@ function parseAuth(
 		oauth,
 		username_attributes,
 		standard_required_attributes,
+		groups,
 	} = amplifyOutputsAuthProperties;
 
 	const authConfig = {
 		Cognito: {
 			userPoolId: user_pool_id,
 			userPoolClientId: user_pool_client_id,
+			groups,
 		},
 	} as AuthConfig;
 
@@ -373,18 +375,21 @@ function createBucketInfoMap(
 ): Record<string, BucketInfo> {
 	const mappedBuckets: Record<string, BucketInfo> = {};
 
-	buckets.forEach(({ name, bucket_name: bucketName, aws_region: region }) => {
-		if (name in mappedBuckets) {
-			throw new Error(
-				`Duplicate friendly name found: ${name}. Name must be unique.`,
-			);
-		}
-
-		mappedBuckets[name] = {
-			bucketName,
-			region,
-		};
-	});
+	buckets.forEach(
+		({ name, bucket_name: bucketName, aws_region: region, paths }) => {
+			if (name in mappedBuckets) {
+				throw new Error(
+					`Duplicate friendly name found: ${name}. Name must be unique.`,
+				);
+			}
+
+			mappedBuckets[name] = {
+				bucketName,
+				region,
+				paths,
+			};
+		},
+	);
 
 	return mappedBuckets;
 }

package/src/singleton/AmplifyOutputs/types.ts

@@ -13,7 +13,8 @@ export type AmplifyOutputsAuthMFAConfiguration =
 	| 'NONE';
 
 export type AmplifyOutputsAuthMFAMethod = 'SMS' | 'TOTP';
-
+type UserGroupName = string;
+type UserGroupPrecedence = Record<string, number>;
 export interface AmplifyOutputsAuthProperties {
 	aws_region: string;
 	authentication_flow_type?: 'USER_SRP_AUTH' | 'CUSTOM_AUTH';
@@ -41,6 +42,7 @@ export interface AmplifyOutputsAuthProperties {
 	unauthenticated_identities_enabled?: boolean;
 	mfa_configuration?: string;
 	mfa_methods?: string[];
+	groups?: Record<UserGroupName, UserGroupPrecedence>[];
 }
 
 export interface AmplifyOutputsStorageBucketProperties {
@@ -50,6 +52,8 @@ export interface AmplifyOutputsStorageBucketProperties {
 	bucket_name: string;
 	/** Region for the bucket */
 	aws_region: string;
+	/** Paths to object with access permissions */
+	paths?: Record<string, Record<string, string[] | undefined>>;
 }
 export interface AmplifyOutputsStorageProperties {
 	/** Default region for Storage */

package/src/singleton/Auth/types.ts

@@ -108,6 +108,9 @@ export type LegacyUserAttributeKey = Uppercase<AuthStandardAttributeKey>;
 
 export type AuthVerifiableAttributeKey = 'email' | 'phone_number';
 
+type UserGroupName = string;
+type UserGroupPrecedence = Record<string, number>;
+
 export type AuthConfigUserAttributes = Partial<
 	Record<AuthStandardAttributeKey, { required: boolean }>
 >;
@@ -130,6 +133,7 @@ export interface AuthIdentityPoolConfig {
 		userAttributes?: never;
 		mfa?: never;
 		passwordFormat?: never;
+		groups?: never;
 	};
 }
 
@@ -171,6 +175,7 @@ export interface CognitoUserPoolConfig {
 		requireNumbers?: boolean;
 		requireSpecialCharacters?: boolean;
 	};
+	groups?: Record<UserGroupName, UserGroupPrecedence>[];
 }
 
 export interface OAuthConfig {

package/src/singleton/Storage/types.ts

@@ -12,6 +12,8 @@ export interface BucketInfo {
 	bucketName: string;
 	/** Region of the bucket */
 	region: string;
+	/** Paths to object with access permissions */
+	paths?: Record<string, Record<string, string[] | undefined>>;
 }
 export interface S3ProviderConfig {
 	S3: {