@aws-sdk/client-cognito-identity-provider 3.1120.0 → 3.1122.0

package/dist-types/commands/GetClientTokenCommand.d.ts

@@ -0,0 +1,144 @@
+import type { MetadataBearer as __MetadataBearer } from "@smithy/types";
+import type { GetClientTokenRequest, GetClientTokenResponse } from "../models/models_0";
+/**
+ * @public
+ */
+export type { __MetadataBearer };
+/**
+ * @public
+ *
+ * The input for {@link GetClientTokenCommand}.
+ */
+export interface GetClientTokenCommandInput extends GetClientTokenRequest {
+}
+/**
+ * @public
+ *
+ * The output of {@link GetClientTokenCommand}.
+ */
+export interface GetClientTokenCommandOutput extends GetClientTokenResponse, __MetadataBearer {
+}
+declare const GetClientTokenCommand_base: {
+    new (input: GetClientTokenCommandInput): import("@smithy/core/client").CommandImpl<GetClientTokenCommandInput, GetClientTokenCommandOutput, import("..").CognitoIdentityProviderClientResolvedConfig, import("..").ServiceInputTypes, import("..").ServiceOutputTypes>;
+    new (input: GetClientTokenCommandInput): import("@smithy/core/client").CommandImpl<GetClientTokenCommandInput, GetClientTokenCommandOutput, import("..").CognitoIdentityProviderClientResolvedConfig, import("..").ServiceInputTypes, import("..").ServiceOutputTypes>;
+    getEndpointParameterInstructions(): import("@smithy/types").EndpointParameterInstructions;
+};
+/**
+ * <p>Issues an access token for machine-to-machine (M2M) authorization. Your app client
+ *             provides its client ID and secret, and receives an access token that authorizes requests
+ *             to your resource servers. <code>GetClientToken</code> provides the same functionality as
+ *             the OAuth2 client-credentials grant; both authorize an application rather than a user.</p>
+ *          <p>To use this operation, you must configure the app client with a client secret and
+ *             enable the <code>ALLOW_CLIENT_TOKEN_AUTH</code> authentication flow. The
+ *             <code>ALLOW_CLIENT_TOKEN_AUTH</code> flow is mutually exclusive with user authentication
+ *             flows. It must be the only authentication flow that you configure for the app client. For
+ *             more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-define-resource-servers.html">Scopes, M2M, and resource servers</a>.</p>
+ *          <note>
+ *             <p>Amazon Cognito doesn't evaluate Identity and Access Management (IAM) policies in requests for this API operation. For
+ *     this operation, you can't use IAM credentials to authorize requests, and you can't
+ *     grant IAM permissions in policies. For more information about authorization models in
+ *     Amazon Cognito, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/user-pools-API-operations.html">Using the Amazon Cognito user pools API and user pool endpoints</a>.</p>
+ *          </note>
+ * @example
+ * Use a bare-bones client and the command you need to make an API call.
+ * ```javascript
+ * import { CognitoIdentityProviderClient, GetClientTokenCommand } from "@aws-sdk/client-cognito-identity-provider"; // ES Modules import
+ * // const { CognitoIdentityProviderClient, GetClientTokenCommand } = require("@aws-sdk/client-cognito-identity-provider"); // CommonJS import
+ * // import type { CognitoIdentityProviderClientConfig } from "@aws-sdk/client-cognito-identity-provider";
+ * const config = {}; // type is CognitoIdentityProviderClientConfig
+ * const client = new CognitoIdentityProviderClient(config);
+ * const input = { // GetClientTokenRequest
+ *   ClientId: "STRING_VALUE", // required
+ *   Secret: "STRING_VALUE", // required
+ *   Scopes: [ // ScopeListType
+ *     "STRING_VALUE",
+ *   ],
+ *   ClientMetadata: { // ClientMetadataType
+ *     "<keys>": "STRING_VALUE",
+ *   },
+ * };
+ * const command = new GetClientTokenCommand(input);
+ * const response = await client.send(command);
+ * // { // GetClientTokenResponse
+ * //   ClientAuthenticationResult: { // ClientAuthenticationResultType
+ * //     AccessToken: "STRING_VALUE",
+ * //     ExpiresIn: Number("int"),
+ * //     TokenType: "STRING_VALUE",
+ * //   },
+ * // };
+ *
+ * ```
+ *
+ * @param GetClientTokenCommandInput - {@link GetClientTokenCommandInput}
+ * @returns {@link GetClientTokenCommandOutput}
+ * @see {@link GetClientTokenCommandInput} for command's `input` shape.
+ * @see {@link GetClientTokenCommandOutput} for command's `response` shape.
+ * @see {@link CognitoIdentityProviderClientResolvedConfig | config} for CognitoIdentityProviderClient's `config` shape.
+ *
+ * @throws {@link ForbiddenException} (client fault)
+ *  <p>This exception is thrown when WAF doesn't allow your request based on a web
+ *             ACL that's associated with your user pool.</p>
+ *
+ * @throws {@link InternalErrorException} (server fault)
+ *  <p>This exception is thrown when Amazon Cognito encounters an internal error.</p>
+ *
+ * @throws {@link InvalidParameterException} (client fault)
+ *  <p>This exception is thrown when the Amazon Cognito service encounters an invalid
+ *             parameter.</p>
+ *
+ * @throws {@link NotAuthorizedException} (client fault)
+ *  <p>This exception is thrown when a user isn't authorized.</p>
+ *
+ * @throws {@link OperationNotEnabledException} (client fault)
+ *  <p>This exception is thrown when an operation is not available in the current region or for the current user pool configuration. This can occur when attempting to perform operations that are not supported in secondary replica regions.</p>
+ *
+ * @throws {@link ResourceNotFoundException} (client fault)
+ *  <p>This exception is thrown when the Amazon Cognito service can't find the requested
+ *             resource.</p>
+ *
+ * @throws {@link TooManyRequestsException} (client fault)
+ *  <p>This exception is thrown when the user has made too many requests for a given
+ *             operation.</p>
+ *
+ * @throws {@link CognitoIdentityProviderServiceException}
+ * <p>Base exception class for all service exceptions from CognitoIdentityProvider service.</p>
+ *
+ *
+ * @example Example – Get an access token for machine-to-machine authorization
+ * ```javascript
+ * // The following example gets an access token for the app client 1example23456789 with the custom scope solar-system-data/asteroids.add.
+ * const input = {
+ *   ClientId: "1example23456789",
+ *   Scopes: [
+ *     "solar-system-data/asteroids.add"
+ *   ],
+ *   Secret: "exampleClientSecret123EXAMPLE"
+ * };
+ * const command = new GetClientTokenCommand(input);
+ * const response = await client.send(command);
+ * /* response is
+ * {
+ *   ClientAuthenticationResult: {
+ *     AccessToken: "eyJra456defEXAMPLE",
+ *     ExpiresIn: 3600,
+ *     TokenType: "Bearer"
+ *   }
+ * }
+ * *\/
+ * ```
+ *
+ * @public
+ */
+export declare class GetClientTokenCommand extends GetClientTokenCommand_base {
+    /** @internal type navigation helper, not in runtime. */
+    protected static __types: {
+        api: {
+            input: GetClientTokenRequest;
+            output: GetClientTokenResponse;
+        };
+        sdk: {
+            input: GetClientTokenCommandInput;
+            output: GetClientTokenCommandOutput;
+        };
+    };
+}

package/dist-types/commands/SetUserPoolMfaConfigCommand.d.ts

@@ -1,5 +1,6 @@
 import type { MetadataBearer as __MetadataBearer } from "@smithy/types";
-import type { SetUserPoolMfaConfigRequest, SetUserPoolMfaConfigResponse } from "../models/models_0";
+import type { SetUserPoolMfaConfigRequest } from "../models/models_0";
+import type { SetUserPoolMfaConfigResponse } from "../models/models_1";
 /**
  * @public
  */

package/dist-types/commands/SetUserSettingsCommand.d.ts

@@ -1,5 +1,5 @@
 import type { MetadataBearer as __MetadataBearer } from "@smithy/types";
-import type { SetUserSettingsRequest, SetUserSettingsResponse } from "../models/models_0";
+import type { SetUserSettingsRequest, SetUserSettingsResponse } from "../models/models_1";
 /**
  * @public
  */

package/dist-types/commands/SignUpCommand.d.ts

@@ -1,5 +1,5 @@
 import type { MetadataBearer as __MetadataBearer } from "@smithy/types";
-import type { SignUpRequest, SignUpResponse } from "../models/models_0";
+import type { SignUpRequest, SignUpResponse } from "../models/models_1";
 /**
  * @public
  */

package/dist-types/commands/index.d.ts

@@ -62,6 +62,7 @@ export * from "./DescribeManagedLoginBrandingByClientCommand";
 export * from "./DescribeManagedLoginBrandingCommand";
 export * from "./DescribeResourceServerCommand";
 export * from "./DescribeRiskConfigurationCommand";
+export * from "./DescribeTermsByClientCommand";
 export * from "./DescribeTermsCommand";
 export * from "./DescribeUserImportJobCommand";
 export * from "./DescribeUserPoolClientCommand";
@@ -70,6 +71,7 @@ export * from "./DescribeUserPoolDomainCommand";
 export * from "./ForgetDeviceCommand";
 export * from "./ForgotPasswordCommand";
 export * from "./GetCSVHeaderCommand";
+export * from "./GetClientTokenCommand";
 export * from "./GetDeviceCommand";
 export * from "./GetGroupCommand";
 export * from "./GetIdentityProviderByIdentifierCommand";

package/dist-types/models/models_0.d.ts

@@ -7722,6 +7722,38 @@ export interface DescribeTermsResponse {
      */
     Terms?: TermsType | undefined;
 }
+/**
+ * @public
+ */
+export interface DescribeTermsByClientRequest {
+    /**
+     * <p>The ID of the app client that the terms documents are associated with.</p>
+     * @public
+     */
+    ClientId: string | undefined;
+    /**
+     * <p>The ID of the user pool that contains the terms documents that you want to
+     *             describe.</p>
+     * @public
+     */
+    UserPoolId: string | undefined;
+    /**
+     * <p>The name of the terms documents that you want to describe.</p>
+     * @public
+     */
+    TermsName: string | undefined;
+}
+/**
+ * @public
+ */
+export interface DescribeTermsByClientResponse {
+    /**
+     * <p>A summary of the requested terms documents. Includes a unique identifier for later
+     *             changes to the terms documents.</p>
+     * @public
+     */
+    Terms?: TermsType | undefined;
+}
 /**
  * <p>Represents the request to describe the user import job.</p>
  * @public
@@ -8015,6 +8047,96 @@ export interface ForgotPasswordResponse {
      */
     CodeDeliveryDetails?: CodeDeliveryDetailsType | undefined;
 }
+/**
+ * @public
+ */
+export interface GetClientTokenRequest {
+    /**
+     * <p>The ID of the app client that requests the access token. The app client must have a
+     *             client secret and the <code>ALLOW_CLIENT_TOKEN_AUTH</code> authentication flow.</p>
+     * @public
+     */
+    ClientId: string | undefined;
+    /**
+     * <p>An active secret for the app client.</p>
+     * @public
+     */
+    Secret: string | undefined;
+    /**
+     * <p>The custom scopes to authorize in the access token, in the format
+     *                 <code>resource-server-identifier/scope-name</code>. Each scope must belong to a
+     *             resource server in your user pool. If you don't specify any scopes, Amazon Cognito authorizes the
+     *             scopes that are configured for the app client.</p>
+     * @public
+     */
+    Scopes?: string[] | undefined;
+    /**
+     * <p>A map of custom key-value pairs that you can provide as input for any custom workflows
+     *             that this action triggers. You create custom workflows by assigning Lambda functions
+     *             to user pool triggers.</p>
+     *          <p>When Amazon Cognito invokes any of these functions, it passes a JSON payload, which the
+     *             function receives as input. This payload contains a <code>clientMetadata</code>
+     *             attribute that provides the data that you assigned to the ClientMetadata parameter in
+     *             your request. In your function code, you can process the <code>clientMetadata</code>
+     *             value to enhance your workflow for your specific needs.</p>
+     *          <p>To review the Lambda trigger types that Amazon Cognito invokes at runtime with API requests, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-working-with-lambda-triggers.html#lambda-triggers-by-event">
+     * Connecting API actions to Lambda triggers</a> in the <i>Amazon Cognito Developer Guide</i>.</p>
+     *          <note>
+     *             <p>When you use the <code>ClientMetadata</code> parameter, note that Amazon Cognito won't do the
+     *                 following:</p>
+     *             <ul>
+     *                <li>
+     *                   <p>Store the <code>ClientMetadata</code> value. This data is available only
+     *                         to Lambda triggers that are assigned to a user pool to support custom
+     *                         workflows. If your user pool configuration doesn't include triggers, the
+     *                         <code>ClientMetadata</code> parameter serves no purpose.</p>
+     *                </li>
+     *                <li>
+     *                   <p>Validate the <code>ClientMetadata</code> value.</p>
+     *                </li>
+     *                <li>
+     *                   <p>Encrypt the <code>ClientMetadata</code> value. Don't send sensitive
+     *                         information in this parameter.</p>
+     *                </li>
+     *             </ul>
+     *          </note>
+     * @public
+     */
+    ClientMetadata?: Record<string, string> | undefined;
+}
+/**
+ * <p>The access token and its metadata from a machine-to-machine (M2M) client credentials
+ *             grant.</p>
+ * @public
+ */
+export interface ClientAuthenticationResultType {
+    /**
+     * <p>The access token for the requested app client. Present this token to a resource server
+     *             to authorize a request, using the scopes granted in the token.</p>
+     * @public
+     */
+    AccessToken?: string | undefined;
+    /**
+     * <p>The number of seconds until the access token expires.</p>
+     * @public
+     */
+    ExpiresIn?: number | undefined;
+    /**
+     * <p>The type of the token. For example, <code>Bearer</code>.</p>
+     * @public
+     */
+    TokenType?: string | undefined;
+}
+/**
+ * @public
+ */
+export interface GetClientTokenResponse {
+    /**
+     * <p>The access token that Amazon Cognito issues for the app client, and its metadata.</p>
+     * @public
+     */
+    ClientAuthenticationResult?: ClientAuthenticationResultType | undefined;
+}
 /**
  * <p>Represents the request to get the header information of the CSV file for the user
  *             import job.</p>
@@ -10986,206 +11108,3 @@ export interface SetUserPoolMfaConfigRequest {
      */
     WebAuthnConfiguration?: WebAuthnConfigurationType | undefined;
 }
-/**
- * @public
- */
-export interface SetUserPoolMfaConfigResponse {
-    /**
-     * <p>Shows user pool SMS message configuration for MFA and sign-in with SMS-message OTPs.
-     *             Includes the message template and the SMS message sending configuration for
-     *             Amazon SNS.</p>
-     * @public
-     */
-    SmsMfaConfiguration?: SmsMfaConfigType | undefined;
-    /**
-     * <p>Shows user pool configuration for time-based one-time password (TOTP) MFA. Includes
-     *             TOTP enabled or disabled state.</p>
-     * @public
-     */
-    SoftwareTokenMfaConfiguration?: SoftwareTokenMfaConfigType | undefined;
-    /**
-     * <p>Shows configuration for user pool email message MFA and sign-in with one-time
-     *             passwords (OTPs). Includes the subject and body of the email message template for
-     *             sign-in and MFA messages. To activate this setting, your user pool must be in the <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/feature-plans-features-essentials.html">
-     *                      Essentials tier</a> or higher.</p>
-     * @public
-     */
-    EmailMfaConfiguration?: EmailMfaConfigType | undefined;
-    /**
-     * <p>Displays multi-factor authentication (MFA) as on, off, or optional. When
-     *                 <code>ON</code>, all users must set up MFA before they can sign in. When
-     *                 <code>OPTIONAL</code>, your application must make a client-side determination of
-     *             whether a user wants to register an MFA device. For user pools with adaptive
-     *             authentication with threat protection, choose <code>OPTIONAL</code>.</p>
-     *          <p>When <code>MfaConfiguration</code> is <code>OPTIONAL</code>, managed login
-     *             doesn't automatically prompt users to set up MFA. Amazon Cognito generates MFA prompts in
-     *             API responses and in managed login for users who have chosen and configured a preferred
-     *             MFA factor.</p>
-     * @public
-     */
-    MfaConfiguration?: UserPoolMfaType | undefined;
-    /**
-     * <p>The configuration of your user pool for passkey, or WebAuthn, sign-in with
-     *             authenticators such as biometric and security-key devices. Includes relying-party
-     *             configuration and settings for user-verification requirements.</p>
-     * @public
-     */
-    WebAuthnConfiguration?: WebAuthnConfigurationType | undefined;
-}
-/**
- * <p>Represents the request to set user settings.</p>
- * @public
- */
-export interface SetUserSettingsRequest {
-    /**
-     * <p>A valid access token that Amazon Cognito issued to the currently signed-in user. Must include a scope claim for
-     * <code>aws.cognito.signin.user.admin</code>.</p>
-     * @public
-     */
-    AccessToken: string | undefined;
-    /**
-     * <p>You can use this parameter only to set an SMS configuration that uses SMS for
-     *             delivery.</p>
-     * @public
-     */
-    MFAOptions: MFAOptionType[] | undefined;
-}
-/**
- * <p>The response from the server for a set user settings request.</p>
- * @public
- */
-export interface SetUserSettingsResponse {
-}
-/**
- * <p>Represents the request to register a user.</p>
- * @public
- */
-export interface SignUpRequest {
-    /**
-     * <p>The ID of the app client where the user wants to sign up.</p>
-     * @public
-     */
-    ClientId: string | undefined;
-    /**
-     * <p>A keyed-hash message authentication code (HMAC) calculated using the secret key of a
-     *             user pool client and username plus the client ID in the message. For more information
-     *             about <code>SecretHash</code>, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/signing-up-users-in-your-app.html#cognito-user-pools-computing-secret-hash">Computing secret hash values</a>.</p>
-     * @public
-     */
-    SecretHash?: string | undefined;
-    /**
-     * <p>The username of the user that you want to sign up. The value of this parameter is
-     *             typically a username, but can be any alias attribute in your user pool.</p>
-     * @public
-     */
-    Username: string | undefined;
-    /**
-     * <p>The user's proposed password. The password must comply with the <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/managing-users-passwords.html">password requirements</a> of your user pool.</p>
-     *          <p>Users can sign up without a password when your user pool supports passwordless sign-in
-     *             with email or SMS OTPs. To create a user with no password, omit this parameter or submit
-     *             a blank value. You can only create a passwordless user when passwordless sign-in is
-     *             available.</p>
-     * @public
-     */
-    Password?: string | undefined;
-    /**
-     * <p>An array of name-value pairs representing user attributes.</p>
-     *          <p>For custom attributes, include a <code>custom:</code> prefix in the attribute name,
-     *             for example <code>custom:department</code>.</p>
-     * @public
-     */
-    UserAttributes?: AttributeType[] | undefined;
-    /**
-     * <p>Temporary user attributes that contribute to the outcomes of your pre sign-up Lambda
-     *     trigger. This set of key-value pairs are for custom validation of information that you
-     *     collect from your users but don't need to retain.</p>
-     *          <p>Your Lambda function can analyze this additional data and act on it. Your function
-     *     can automatically confirm and verify select users or perform external API operations
-     *     like logging user attributes and validation data to Amazon CloudWatch Logs.</p>
-     *          <p>For more information about the pre sign-up Lambda trigger, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-pre-sign-up.html">Pre sign-up Lambda trigger</a>.</p>
-     * @public
-     */
-    ValidationData?: AttributeType[] | undefined;
-    /**
-     * <p>Information that supports analytics outcomes with Amazon Pinpoint, including the
-     * user's endpoint ID. The endpoint ID is a destination for Amazon Pinpoint push notifications, for example a device identifier,
-     * email address, or phone number.</p>
-     * @public
-     */
-    AnalyticsMetadata?: AnalyticsMetadataType | undefined;
-    /**
-     * <p>Contextual data about your user session like the device fingerprint, IP address, or location. Amazon Cognito threat
-     * protection evaluates the risk of an authentication event based on the context that your app generates and passes to Amazon Cognito
-     * when it makes API requests.</p>
-     *          <p>For more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-viewing-threat-protection-app.html">Collecting data for threat protection in
-     * applications</a>.</p>
-     * @public
-     */
-    UserContextData?: UserContextDataType | undefined;
-    /**
-     * <p>A map of custom key-value pairs that you can provide as input for any custom workflows
-     *             that this action triggers. You create custom workflows by assigning Lambda functions
-     *             to user pool triggers.</p>
-     *          <p>When Amazon Cognito invokes any of these functions, it passes a JSON payload, which the
-     *             function receives as input. This payload contains a <code>clientMetadata</code>
-     *             attribute that provides the data that you assigned to the ClientMetadata parameter in
-     *             your request. In your function code, you can process the <code>clientMetadata</code>
-     *             value to enhance your workflow for your specific needs.</p>
-     *          <p>To review the Lambda trigger types that Amazon Cognito invokes at runtime with API requests, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-working-with-lambda-triggers.html#lambda-triggers-by-event">
-     * Connecting API actions to Lambda triggers</a> in the <i>Amazon Cognito Developer Guide</i>.</p>
-     *          <note>
-     *             <p>When you use the <code>ClientMetadata</code> parameter, note that Amazon Cognito won't do the
-     *                 following:</p>
-     *             <ul>
-     *                <li>
-     *                   <p>Store the <code>ClientMetadata</code> value. This data is available only
-     *                         to Lambda triggers that are assigned to a user pool to support custom
-     *                         workflows. If your user pool configuration doesn't include triggers, the
-     *                         <code>ClientMetadata</code> parameter serves no purpose.</p>
-     *                </li>
-     *                <li>
-     *                   <p>Validate the <code>ClientMetadata</code> value.</p>
-     *                </li>
-     *                <li>
-     *                   <p>Encrypt the <code>ClientMetadata</code> value. Don't send sensitive
-     *                         information in this parameter.</p>
-     *                </li>
-     *             </ul>
-     *          </note>
-     * @public
-     */
-    ClientMetadata?: Record<string, string> | undefined;
-}
-/**
- * <p>The response from the server for a registration request.</p>
- * @public
- */
-export interface SignUpResponse {
-    /**
-     * <p>Indicates whether the user was automatically confirmed. You can auto-confirm users
-     *             with a <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-pre-sign-up.html">pre sign-up Lambda trigger</a>.</p>
-     * @public
-     */
-    UserConfirmed: boolean | undefined;
-    /**
-     * <p>In user pools that automatically verify and confirm new users, Amazon Cognito sends users a
-     *             message with a code or link that confirms ownership of the phone number or email address
-     *             that they entered. The <code>CodeDeliveryDetails</code> object is information about the
-     *             delivery destination for that link or code.</p>
-     * @public
-     */
-    CodeDeliveryDetails?: CodeDeliveryDetailsType | undefined;
-    /**
-     * <p>The unique identifier of the new user, for example
-     *                 <code>a1b2c3d4-5678-90ab-cdef-EXAMPLE11111</code>.</p>
-     * @public
-     */
-    UserSub: string | undefined;
-    /**
-     * <p>A session Id that you can pass to <code>ConfirmSignUp</code> when you want to
-     *             immediately sign in your user with the <code>USER_AUTH</code> flow after they complete
-     *             sign-up.</p>
-     * @public
-     */
-    Session?: string | undefined;
-}