@aws-amplify/ui 6.13.0 → 6.15.0

package/dist/esm/machines/authenticator/actors/signIn.mjs

@@ -1,5 +1,5 @@
 import { createMachine, sendUpdate } from 'xstate';
-import { signInWithRedirect, confirmSignIn, resetPassword, fetchUserAttributes } from 'aws-amplify/auth';
+import { listWebAuthnCredentials, signInWithRedirect, confirmSignIn, resetPassword, fetchUserAttributes } from 'aws-amplify/auth';
 import { runValidators } from '../../../validators/index.mjs';
 import ACTIONS from '../actions.mjs';
 import { defaultServices } from '../defaultServices.mjs';
@@ -35,32 +35,13 @@ const handleSignInResponse = {
                 'setNextSignInStep',
                 'setTotpSecretCode',
                 'setAllowedMfaTypes',
+                'setCodeDeliveryDetails',
             ],
             target: '#signInActor.init',
         },
     ],
     onError: { actions: 'setRemoteError', target: 'edit' },
 };
-const handleFetchUserAttributesResponse = {
-    onDone: [
-        {
-            cond: 'shouldVerifyAttribute',
-            actions: [
-                'setShouldVerifyUserAttributeStep',
-                'setUnverifiedUserAttributes',
-            ],
-            target: '#signInActor.resolved',
-        },
-        {
-            actions: 'setConfirmAttributeCompleteStep',
-            target: '#signInActor.resolved',
-        },
-    ],
-    onError: {
-        actions: 'setConfirmAttributeCompleteStep',
-        target: '#signInActor.resolved',
-    },
-};
 const getDefaultConfirmSignInState = (exit) => ({
     initial: 'edit',
     exit,
@@ -71,6 +52,7 @@ const getDefaultConfirmSignInState = (exit) => ({
                 SUBMIT: { actions: 'handleSubmit', target: 'submit' },
                 SIGN_IN: '#signInActor.signIn',
                 CHANGE: { actions: 'handleInput' },
+                RESEND: { target: 'resend' },
             },
         },
         submit: {
@@ -78,6 +60,21 @@ const getDefaultConfirmSignInState = (exit) => ({
             entry: ['sendUpdate', 'clearError'],
             invoke: { src: 'confirmSignIn', ...handleSignInResponse },
         },
+        resend: {
+            tags: 'pending',
+            entry: ['sendUpdate', 'clearError'],
+            invoke: {
+                src: 'resendSignInCode',
+                onDone: {
+                    actions: ['setCodeDeliveryDetails', 'sendUpdate'],
+                    target: 'edit',
+                },
+                onError: {
+                    actions: 'setRemoteError',
+                    target: 'edit',
+                },
+            },
+        },
     },
 });
 function signInActor({ services }) {
@@ -112,13 +109,68 @@ function signInActor({ services }) {
                     { target: 'signIn' },
                 ],
             },
-            federatedSignIn: getFederatedSignInState('signIn'),
+            federatedSignIn: { ...getFederatedSignInState('signIn') },
             fetchUserAttributes: {
                 invoke: {
                     src: 'fetchUserAttributes',
-                    ...handleFetchUserAttributesResponse,
+                    onDone: [
+                        {
+                            cond: 'hasPasskeyRegistrationPrompts',
+                            actions: 'setFetchedUserAttributes',
+                            target: 'checkPasskeys',
+                        },
+                        {
+                            actions: 'setFetchedUserAttributes',
+                            target: 'evaluatePasskeyPrompt',
+                        },
+                    ],
+                    onError: {
+                        actions: 'setConfirmAttributeCompleteStep',
+                        target: '#signInActor.resolved',
+                    },
                 },
             },
+            checkPasskeys: {
+                invoke: {
+                    src: async () => {
+                        try {
+                            const result = await listWebAuthnCredentials();
+                            return result.credentials && result.credentials.length > 0;
+                        }
+                        catch {
+                            return false;
+                        }
+                    },
+                    onDone: {
+                        actions: 'setHasExistingPasskeys',
+                        target: 'evaluatePasskeyPrompt',
+                    },
+                    onError: {
+                        actions: 'clearHasExistingPasskeys',
+                        target: 'evaluatePasskeyPrompt',
+                    },
+                },
+            },
+            evaluatePasskeyPrompt: {
+                always: [
+                    {
+                        cond: 'shouldPromptPasskeyRegistration',
+                        target: '#signInActor.passkeyPrompt',
+                    },
+                    {
+                        cond: 'shouldVerifyAttribute',
+                        actions: [
+                            'setShouldVerifyUserAttributeStep',
+                            'setUnverifiedUserAttributes',
+                        ],
+                        target: '#signInActor.resolved',
+                    },
+                    {
+                        actions: 'setConfirmAttributeCompleteStep',
+                        target: '#signInActor.resolved',
+                    },
+                ],
+            },
             resendSignUpCode: {
                 invoke: {
                     src: 'handleResendSignUpCode',
@@ -153,23 +205,70 @@ function signInActor({ services }) {
                         on: {
                             CHANGE: { actions: 'handleInput' },
                             FEDERATED_SIGN_IN: { target: '#signInActor.federatedSignIn' },
-                            SUBMIT: { actions: 'handleSubmit', target: 'submit' },
+                            SHOW_AUTH_METHODS: {
+                                actions: 'setUsernameSignIn',
+                                target: 'selectMethod',
+                            },
+                            SUBMIT: [
+                                {
+                                    cond: 'shouldSelectAuthMethod',
+                                    actions: 'handleSubmit',
+                                    target: 'selectMethod',
+                                },
+                                {
+                                    actions: 'handleSubmit',
+                                    target: 'submit',
+                                },
+                            ],
+                        },
+                    },
+                    selectMethod: {
+                        entry: [
+                            'sendUpdate',
+                            'setSelectAuthMethodStep',
+                            'setUsernameSignIn',
+                        ],
+                        on: {
+                            SELECT_METHOD: {
+                                actions: 'setSelectedAuthMethod',
+                                target: 'submit',
+                            },
+                            SUBMIT: {
+                                actions: ['handleSubmit', 'setSelectedAuthMethodFromForm'],
+                                target: 'submit',
+                            },
+                            SIGN_IN: {
+                                target: 'edit',
+                            },
                         },
                     },
                     submit: {
                         tags: 'pending',
                         entry: ['clearError', 'sendUpdate', 'setUsernameSignIn'],
                         exit: 'clearFormValues',
-                        invoke: { src: 'handleSignIn', ...handleSignInResponse },
+                        invoke: {
+                            src: 'handleSignIn',
+                            onDone: handleSignInResponse.onDone,
+                            onError: [
+                                {
+                                    cond: 'shouldReturnToSelectMethod',
+                                    actions: 'setRemoteError',
+                                    target: 'selectMethod',
+                                },
+                                handleSignInResponse.onError,
+                            ],
+                        },
                     },
                 },
             },
-            confirmSignIn: getDefaultConfirmSignInState([
-                'clearChallengeName',
-                'clearFormValues',
-                'clearError',
-                'clearTouched',
-            ]),
+            confirmSignIn: {
+                ...getDefaultConfirmSignInState([
+                    'clearChallengeName',
+                    'clearFormValues',
+                    'clearError',
+                    'clearTouched',
+                ]),
+            },
             forceChangePassword: {
                 entry: 'sendUpdate',
                 type: 'parallel',
@@ -242,21 +341,40 @@ function signInActor({ services }) {
                     },
                 },
             },
-            setupTotp: getDefaultConfirmSignInState([
-                'clearFormValues',
-                'clearError',
-                'clearTouched',
-            ]),
-            setupEmail: getDefaultConfirmSignInState([
-                'clearFormValues',
-                'clearError',
-                'clearTouched',
-            ]),
-            selectMfaType: getDefaultConfirmSignInState([
-                'clearFormValues',
-                'clearError',
-                'clearTouched',
-            ]),
+            setupTotp: {
+                ...getDefaultConfirmSignInState([
+                    'clearFormValues',
+                    'clearError',
+                    'clearTouched',
+                ]),
+            },
+            setupEmail: {
+                ...getDefaultConfirmSignInState([
+                    'clearFormValues',
+                    'clearError',
+                    'clearTouched',
+                ]),
+            },
+            selectMfaType: {
+                ...getDefaultConfirmSignInState([
+                    'clearFormValues',
+                    'clearError',
+                    'clearTouched',
+                ]),
+            },
+            passkeyPrompt: {
+                entry: 'sendUpdate',
+                on: {
+                    SUBMIT: {
+                        actions: 'setConfirmAttributeCompleteStep',
+                        target: 'resolved',
+                    },
+                    SKIP: {
+                        actions: 'setConfirmAttributeCompleteStep',
+                        target: 'resolved',
+                    },
+                },
+            },
             resolved: {
                 type: 'final',
                 data: (context) => ({
@@ -282,9 +400,41 @@ function signInActor({ services }) {
             handleResendSignUpCode({ username }) {
                 return services.handleResendSignUpCode({ username });
             },
-            handleSignIn({ formValues, username }) {
-                const { password } = formValues;
-                return services.handleSignIn({ username, password });
+            resendSignInCode({ username, selectedAuthMethod, availableAuthMethods, preferredChallenge, }) {
+                // Resend code by calling signIn again with the same parameters
+                const method = selectedAuthMethod ??
+                    preferredChallenge ??
+                    availableAuthMethods?.[0] ??
+                    'PASSWORD';
+                return services.handleSignIn({
+                    username,
+                    options: {
+                        authFlowType: 'USER_AUTH',
+                        preferredChallenge: method,
+                    },
+                });
+            },
+            handleSignIn({ formValues, username, selectedAuthMethod, availableAuthMethods, preferredChallenge, }) {
+                // Determine which method to use
+                const method = selectedAuthMethod ??
+                    preferredChallenge ??
+                    availableAuthMethods?.[0] ??
+                    'PASSWORD';
+                if (method === 'PASSWORD') {
+                    // Traditional password flow
+                    const { password } = formValues;
+                    return services.handleSignIn({ username, password });
+                }
+                else {
+                    // Passwordless flow using USER_AUTH
+                    return services.handleSignIn({
+                        username,
+                        options: {
+                            authFlowType: 'USER_AUTH',
+                            preferredChallenge: method,
+                        },
+                    });
+                }
             },
             confirmSignIn({ formValues, step }) {
                 const formValuesKey = getConfirmSignInFormValuesKey(step);

package/dist/esm/machines/authenticator/actors/signUp.mjs

@@ -1,5 +1,5 @@
 import { createMachine, sendUpdate } from 'xstate';
-import { signInWithRedirect, fetchUserAttributes, autoSignIn } from 'aws-amplify/auth';
+import { listWebAuthnCredentials, signInWithRedirect, fetchUserAttributes, autoSignIn } from 'aws-amplify/auth';
 import { getSignUpInput } from '../utils.mjs';
 import { runValidators } from '../../../validators/index.mjs';
 import ACTIONS from '../actions.mjs';
@@ -50,26 +50,6 @@ const handleAutoSignInResponse = {
         target: '#signUpActor.resolved',
     },
 };
-const handleFetchUserAttributesResponse = {
-    onDone: [
-        {
-            cond: 'shouldVerifyAttribute',
-            actions: [
-                'setShouldVerifyUserAttributeStep',
-                'setUnverifiedUserAttributes',
-            ],
-            target: '#signUpActor.resolved',
-        },
-        {
-            actions: 'setConfirmAttributeCompleteStep',
-            target: '#signUpActor.resolved',
-        },
-    ],
-    onError: {
-        actions: 'setConfirmAttributeCompleteStep',
-        target: '#signUpActor.resolved',
-    },
-};
 function signUpActor({ services }) {
     return createMachine({
         id: 'signUpActor',
@@ -89,10 +69,65 @@ function signUpActor({ services }) {
             fetchUserAttributes: {
                 invoke: {
                     src: 'fetchUserAttributes',
-                    ...handleFetchUserAttributesResponse,
+                    onDone: [
+                        {
+                            cond: 'hasPasskeyRegistrationPrompts',
+                            actions: 'setFetchedUserAttributes',
+                            target: 'checkPasskeys',
+                        },
+                        {
+                            actions: 'setFetchedUserAttributes',
+                            target: 'evaluatePasskeyPrompt',
+                        },
+                    ],
+                    onError: {
+                        actions: 'setConfirmAttributeCompleteStep',
+                        target: '#signUpActor.resolved',
+                    },
                 },
             },
-            federatedSignIn: getFederatedSignInState('signUp'),
+            checkPasskeys: {
+                invoke: {
+                    src: async () => {
+                        try {
+                            const result = await listWebAuthnCredentials();
+                            return result.credentials && result.credentials.length > 0;
+                        }
+                        catch {
+                            return false;
+                        }
+                    },
+                    onDone: {
+                        actions: 'setHasExistingPasskeys',
+                        target: 'evaluatePasskeyPrompt',
+                    },
+                    onError: {
+                        actions: 'clearHasExistingPasskeys',
+                        target: 'evaluatePasskeyPrompt',
+                    },
+                },
+            },
+            evaluatePasskeyPrompt: {
+                always: [
+                    {
+                        cond: 'shouldPromptPasskeyRegistrationAfterSignup',
+                        target: '#signUpActor.passkeyPrompt',
+                    },
+                    {
+                        cond: 'shouldVerifyAttribute',
+                        actions: [
+                            'setShouldVerifyUserAttributeStep',
+                            'setUnverifiedUserAttributes',
+                        ],
+                        target: '#signUpActor.resolved',
+                    },
+                    {
+                        actions: 'setConfirmAttributeCompleteStep',
+                        target: '#signUpActor.resolved',
+                    },
+                ],
+            },
+            federatedSignIn: { ...getFederatedSignInState('signUp') },
             resetPassword: {
                 invoke: { src: 'resetPassword', ...handleResetPasswordResponse },
             },
@@ -111,7 +146,10 @@ function signUpActor({ services }) {
                             cond: 'isUserAlreadyConfirmed',
                             target: '#signUpActor.resolved',
                         },
-                        { actions: ['setRemoteError', 'sendUpdate'] },
+                        {
+                            actions: ['setRemoteError', 'sendUpdate'],
+                            target: '#signUpActor.confirmSignUp',
+                        },
                     ],
                 },
             },
@@ -149,7 +187,13 @@ function signUpActor({ services }) {
                             idle: {
                                 entry: ['sendUpdate'],
                                 on: {
-                                    SUBMIT: { actions: 'handleSubmit', target: 'validate' },
+                                    SUBMIT: {
+                                        actions: [
+                                            'setSelectedAuthMethodFromForm',
+                                            'handleSubmit',
+                                        ],
+                                        target: 'validate',
+                                    },
                                 },
                             },
                             validate: {
@@ -234,6 +278,13 @@ function signUpActor({ services }) {
                     },
                 },
             },
+            passkeyPrompt: {
+                entry: 'sendUpdate',
+                on: {
+                    SKIP: { target: 'resolved' },
+                    SUBMIT: { target: 'resolved' },
+                },
+            },
             resolved: {
                 type: 'final',
                 data: (context) => ({
@@ -271,9 +322,10 @@ function signUpActor({ services }) {
                 return signInWithRedirect(data);
             },
             handleSignUp(context) {
-                const { formValues, loginMechanisms, username } = context;
+                const { formValues, loginMechanisms, username, selectedAuthMethod, preferredChallenge, } = context;
                 const loginMechanism = loginMechanisms[0];
-                const input = getSignUpInput(username, formValues, loginMechanism);
+                const authMethod = selectedAuthMethod ?? preferredChallenge;
+                const input = getSignUpInput(username, formValues, loginMechanism, authMethod);
                 return services.handleSignUp(input);
             },
             async validateSignUp(context) {
@@ -284,6 +336,8 @@ function signUpActor({ services }) {
                     // Validation for default form fields
                     services.validateConfirmPassword,
                     services.validatePreferredUsername,
+                    // Validation for required fields based on auth method
+                    services.validateRequiredFieldsForAuthMethod,
                     // Validation for any custom Sign Up fields
                     services.validateCustomSignUp,
                 ]);

package/dist/esm/machines/authenticator/defaultServices.mjs

@@ -40,11 +40,24 @@ const defaultServices = {
         const parsedSocialProviders = loginWith?.oauth?.providers
             ? loginWith.oauth.providers?.map((provider) => provider.toString().toLowerCase())
             : undefined;
+        // Detect passwordless capabilities from amplify_outputs.json
+        // Support both snake_case (legacy) and camelCase (current) formats
+        const passwordlessConfig = result.Auth?.Cognito?.passwordless;
+        const passwordlessCapabilities = {
+            emailOtpEnabled: passwordlessConfig?.emailOtpEnabled ??
+                passwordlessConfig?.email_otp_enabled === true,
+            smsOtpEnabled: passwordlessConfig?.smsOtpEnabled ??
+                passwordlessConfig?.sms_otp_enabled === true,
+            webAuthnEnabled: !!(passwordlessConfig?.webAuthn ?? passwordlessConfig?.web_authn),
+            preferredChallenge: passwordlessConfig?.preferredChallenge ??
+                passwordlessConfig?.preferred_challenge,
+        };
         return {
             ...cliConfig,
             loginMechanisms: parsedLoginMechanisms,
             signUpAttributes: parsedSignupAttributes,
             socialProviders: parsedSocialProviders,
+            passwordlessCapabilities,
         };
     },
     getCurrentUser,
@@ -107,6 +120,30 @@ const defaultServices = {
         }
     },
     async validatePreferredUsername(_, __) { },
+    async validateRequiredFieldsForAuthMethod(formData) {
+        const authMethod = formData.__authMethod;
+        // If no auth method specified, skip validation (will use default required fields)
+        if (!authMethod)
+            return null;
+        // Check required fields based on auth method
+        if (authMethod === 'EMAIL_OTP' && !formData.email) {
+            return { email: 'Email is required for Email OTP sign up' };
+        }
+        if (authMethod === 'SMS_OTP' && !formData.phone_number) {
+            return { phone_number: 'Phone number is required for SMS OTP sign up' };
+        }
+        if (authMethod === 'PASSWORD') {
+            const errors = {};
+            if (!formData.password) {
+                errors.password = 'Password is required';
+            }
+            if (!formData.confirm_password) {
+                errors.confirm_password = 'Confirm Password is required';
+            }
+            return Object.keys(errors).length > 0 ? errors : null;
+        }
+        return null;
+    },
 };
 
 export { defaultServices };

package/dist/esm/machines/authenticator/guards.mjs

@@ -30,7 +30,11 @@ const shouldResetPassword = ({ step }) => step === 'RESET_PASSWORD';
 const shouldConfirmResetPassword = ({ step }) => step === 'CONFIRM_RESET_PASSWORD_WITH_CODE';
 const shouldConfirmSignUp = ({ step }) => step === 'CONFIRM_SIGN_UP';
 // miscellaneous guards
-const shouldVerifyAttribute = (_, { data }) => {
+const shouldVerifyAttribute = (context, event) => {
+    // Try to get data from event first (for backward compatibility), then from context
+    const data = (event.data || context.fetchedUserAttributes);
+    if (!data)
+        return false;
     const { email, phone_number, phone_number_verified, email_verified } = data;
     // if neither email nor phone_number exist
     // there is nothing to verify
@@ -55,11 +59,51 @@ const shouldVerifyAttribute = (_, { data }) => {
  * https://github.com/aws-amplify/amplify-ui/issues/219
  */
 const isUserAlreadyConfirmed = (_, { data }) => data.message === 'User is already confirmed.';
+// passwordless guards
+const shouldSelectAuthMethod = ({ availableAuthMethods, preferredChallenge, selectedAuthMethod, }) => {
+    // Show selection if:
+    // 1. Multiple methods available
+    // 2. AND either no preferredChallenge OR selectedAuthMethod is explicitly cleared (null)
+    const hasMultipleMethods = availableAuthMethods && availableAuthMethods.length > 1;
+    const shouldShowSelection = !preferredChallenge || selectedAuthMethod === null;
+    return hasMultipleMethods && shouldShowSelection;
+};
+const shouldPromptPasskeyRegistration = ({ passwordless, hasExistingPasskeys, }) => {
+    const { passkeyRegistrationPrompts } = passwordless || {};
+    if (!passkeyRegistrationPrompts) {
+        return false;
+    }
+    // Don't prompt if user already has passkeys
+    if (hasExistingPasskeys) {
+        return false;
+    }
+    if (typeof passkeyRegistrationPrompts === 'boolean') {
+        return passkeyRegistrationPrompts;
+    }
+    return passkeyRegistrationPrompts.afterSignin === 'ALWAYS';
+};
+const shouldPromptPasskeyRegistrationAfterSignup = ({ passwordless, hasExistingPasskeys, }) => {
+    const { passkeyRegistrationPrompts } = passwordless || {};
+    if (!passkeyRegistrationPrompts) {
+        return false;
+    }
+    // Don't prompt if user already has passkeys
+    if (hasExistingPasskeys) {
+        return false;
+    }
+    if (typeof passkeyRegistrationPrompts === 'boolean') {
+        return passkeyRegistrationPrompts;
+    }
+    return passkeyRegistrationPrompts.afterSignup === 'ALWAYS';
+};
+const hasPasskeyRegistrationPrompts = ({ passwordless }) => passwordless?.passkeyRegistrationPrompts != null;
+const shouldReturnToSelectMethod = ({ selectedAuthMethod, step, }) => selectedAuthMethod != null && step === 'SELECT_AUTH_METHOD';
 const GUARDS = {
     hasCompletedAttributeConfirmation,
     hasCompletedResetPassword,
     hasCompletedSignIn,
     hasCompletedSignUp,
+    hasPasskeyRegistrationPrompts,
     isConfirmSignUpStep,
     isConfirmUserAttributeStep,
     isResetPasswordStep,
@@ -73,10 +117,14 @@ const GUARDS = {
     shouldConfirmSignUpFromSignIn,
     shouldResetPassword,
     shouldResetPasswordFromSignIn,
+    shouldReturnToSelectMethod,
+    shouldSelectAuthMethod,
     shouldSetupTotp,
     shouldSetupEmail,
     shouldSelectMfaType,
     shouldVerifyAttribute,
+    shouldPromptPasskeyRegistration,
+    shouldPromptPasskeyRegistrationAfterSignup,
 };
 
 export { GUARDS as default };